173 files changed, 2303 insertions, 1513 deletions

diff --git a/arch/arm64/net/bpf_jit_comp.c b/arch/arm64/net/bpf_jit_comp.c
index c6e53580aefe..71f930501ade 100644
--- a/arch/arm64/net/bpf_jit_comp.c
+++ b/arch/arm64/net/bpf_jit_comp.c
@@ -253,8 +253,9 @@ static int emit_bpf_tail_call(struct jit_ctx *ctx)
          */
         off = offsetof(struct bpf_array, ptrs);
         emit_a64_mov_i64(tmp, off, ctx);
-        emit(A64_LDR64(tmp, r2, tmp), ctx);
-        emit(A64_LDR64(prg, tmp, r3), ctx);
+        emit(A64_ADD(1, tmp, r2, tmp), ctx);
+        emit(A64_LSL(1, prg, r3, 3), ctx);
+        emit(A64_LDR64(prg, tmp, prg), ctx);
         emit(A64_CBZ(1, prg, jmp_offset), ctx);
 
         /* goto *(prog->bpf_func + prologue_size); */
diff --git a/arch/s390/Kconfig b/arch/s390/Kconfig
index e161fafb495b..bb11f9f30c8d 100644
--- a/arch/s390/Kconfig
+++ b/arch/s390/Kconfig
@@ -64,6 +64,7 @@ config ARCH_SUPPORTS_UPROBES
 
 config S390
         def_bool y
+        select ARCH_BINFMT_ELF_STATE
         select ARCH_HAS_DEVMEM_IS_ALLOWED
         select ARCH_HAS_ELF_RANDOMIZE
         select ARCH_HAS_GCOV_PROFILE_ALL
@@ -184,7 +185,7 @@ config SCHED_OMIT_FRAME_POINTER
 
 config PGTABLE_LEVELS
         int
-        default 4
+        default 5
 
 source "init/Kconfig"
 
diff --git a/arch/s390/configs/default_defconfig b/arch/s390/configs/default_defconfig
index a5039fa89314..282072206df7 100644
--- a/arch/s390/configs/default_defconfig
+++ b/arch/s390/configs/default_defconfig
@@ -30,6 +30,7 @@ CONFIG_USER_NS=y
 CONFIG_SCHED_AUTOGROUP=y
 CONFIG_BLK_DEV_INITRD=y
 CONFIG_EXPERT=y
+# CONFIG_SYSFS_SYSCALL is not set
 CONFIG_BPF_SYSCALL=y
 CONFIG_USERFAULTFD=y
 # CONFIG_COMPAT_BRK is not set
@@ -44,7 +45,10 @@ CONFIG_MODULE_UNLOAD=y
 CONFIG_MODULE_FORCE_UNLOAD=y
 CONFIG_MODVERSIONS=y
 CONFIG_MODULE_SRCVERSION_ALL=y
+CONFIG_BLK_DEV_INTEGRITY=y
 CONFIG_BLK_DEV_THROTTLING=y
+CONFIG_BLK_WBT=y
+CONFIG_BLK_WBT_SQ=y
 CONFIG_PARTITION_ADVANCED=y
 CONFIG_IBM_PARTITION=y
 CONFIG_BSD_DISKLABEL=y
@@ -90,6 +94,8 @@ CONFIG_UNIX=y
 CONFIG_UNIX_DIAG=m
 CONFIG_XFRM_USER=m
 CONFIG_NET_KEY=m
+CONFIG_SMC=m
+CONFIG_SMC_DIAG=m
 CONFIG_INET=y
 CONFIG_IP_MULTICAST=y
 CONFIG_IP_ADVANCED_ROUTER=y
@@ -359,6 +365,7 @@ CONFIG_NET_ACT_SIMP=m
 CONFIG_NET_ACT_SKBEDIT=m
 CONFIG_NET_ACT_CSUM=m
 CONFIG_DNS_RESOLVER=y
+CONFIG_NETLINK_DIAG=m
 CONFIG_CGROUP_NET_PRIO=y
 CONFIG_BPF_JIT=y
 CONFIG_NET_PKTGEN=m
@@ -367,16 +374,19 @@ CONFIG_DEVTMPFS=y
 CONFIG_DMA_CMA=y
 CONFIG_CMA_SIZE_MBYTES=0
 CONFIG_CONNECTOR=y
+CONFIG_ZRAM=m
 CONFIG_BLK_DEV_LOOP=m
 CONFIG_BLK_DEV_CRYPTOLOOP=m
+CONFIG_BLK_DEV_DRBD=m
 CONFIG_BLK_DEV_NBD=m
 CONFIG_BLK_DEV_OSD=m
 CONFIG_BLK_DEV_RAM=y
 CONFIG_BLK_DEV_RAM_SIZE=32768
-CONFIG_CDROM_PKTCDVD=m
-CONFIG_ATA_OVER_ETH=m
+CONFIG_BLK_DEV_RAM_DAX=y
 CONFIG_VIRTIO_BLK=y
+CONFIG_BLK_DEV_RBD=m
 CONFIG_ENCLOSURE_SERVICES=m
+CONFIG_GENWQE=m
 CONFIG_RAID_ATTRS=m
 CONFIG_SCSI=y
 CONFIG_BLK_DEV_SD=y
@@ -442,6 +452,8 @@ CONFIG_NLMON=m
 # CONFIG_NET_VENDOR_INTEL is not set
 # CONFIG_NET_VENDOR_MARVELL is not set
 CONFIG_MLX4_EN=m
+CONFIG_MLX5_CORE=m
+CONFIG_MLX5_CORE_EN=y
 # CONFIG_NET_VENDOR_NATSEMI is not set
 CONFIG_PPP=m
 CONFIG_PPP_BSDCOMP=m
@@ -452,7 +464,6 @@ CONFIG_PPTP=m
 CONFIG_PPPOL2TP=m
 CONFIG_PPP_ASYNC=m
 CONFIG_PPP_SYNC_TTY=m
-# CONFIG_INPUT_MOUSEDEV_PSAUX is not set
 # CONFIG_INPUT_KEYBOARD is not set
 # CONFIG_INPUT_MOUSE is not set
 # CONFIG_SERIO is not set
@@ -471,6 +482,7 @@ CONFIG_DIAG288_WATCHDOG=m
 CONFIG_INFINIBAND=m
 CONFIG_INFINIBAND_USER_ACCESS=m
 CONFIG_MLX4_INFINIBAND=m
+CONFIG_MLX5_INFINIBAND=m
 CONFIG_VIRTIO_BALLOON=m
 CONFIG_EXT4_FS=y
 CONFIG_EXT4_FS_POSIX_ACL=y
@@ -487,12 +499,18 @@ CONFIG_XFS_POSIX_ACL=y
 CONFIG_XFS_RT=y
 CONFIG_XFS_DEBUG=y
 CONFIG_GFS2_FS=m
+CONFIG_GFS2_FS_LOCKING_DLM=y
 CONFIG_OCFS2_FS=m
 CONFIG_BTRFS_FS=y
 CONFIG_BTRFS_FS_POSIX_ACL=y
+CONFIG_BTRFS_DEBUG=y
 CONFIG_NILFS2_FS=m
+CONFIG_FS_DAX=y
+CONFIG_EXPORTFS_BLOCK_OPS=y
 CONFIG_FANOTIFY=y
+CONFIG_FANOTIFY_ACCESS_PERMISSIONS=y
 CONFIG_QUOTA_NETLINK_INTERFACE=y
+CONFIG_QUOTA_DEBUG=y
 CONFIG_QFMT_V1=m
 CONFIG_QFMT_V2=m
 CONFIG_AUTOFS4_FS=m
@@ -558,6 +576,7 @@ CONFIG_HEADERS_CHECK=y
 CONFIG_DEBUG_SECTION_MISMATCH=y
 CONFIG_MAGIC_SYSRQ=y
 CONFIG_DEBUG_PAGEALLOC=y
+CONFIG_DEBUG_RODATA_TEST=y
 CONFIG_DEBUG_OBJECTS=y
 CONFIG_DEBUG_OBJECTS_SELFTEST=y
 CONFIG_DEBUG_OBJECTS_FREE=y
@@ -580,7 +599,6 @@ CONFIG_DETECT_HUNG_TASK=y
 CONFIG_WQ_WATCHDOG=y
 CONFIG_PANIC_ON_OOPS=y
 CONFIG_DEBUG_TIMEKEEPING=y
-CONFIG_TIMER_STATS=y
 CONFIG_DEBUG_RT_MUTEXES=y
 CONFIG_DEBUG_WW_MUTEX_SLOWPATH=y
 CONFIG_PROVE_LOCKING=y
@@ -595,6 +613,7 @@ CONFIG_RCU_TORTURE_TEST=m
 CONFIG_RCU_CPU_STALL_TIMEOUT=300
 CONFIG_NOTIFIER_ERROR_INJECTION=m
 CONFIG_PM_NOTIFIER_ERROR_INJECT=m
+CONFIG_NETDEV_NOTIFIER_ERROR_INJECT=m
 CONFIG_FAULT_INJECTION=y
 CONFIG_FAILSLAB=y
 CONFIG_FAIL_PAGE_ALLOC=y
@@ -616,13 +635,12 @@ CONFIG_HIST_TRIGGERS=y
 CONFIG_TRACE_ENUM_MAP_FILE=y
 CONFIG_LKDTM=m
 CONFIG_TEST_LIST_SORT=y
+CONFIG_TEST_SORT=y
 CONFIG_KPROBES_SANITY_TEST=y
 CONFIG_RBTREE_TEST=y
 CONFIG_INTERVAL_TREE_TEST=m
 CONFIG_PERCPU_TEST=m
 CONFIG_ATOMIC64_SELFTEST=y
-CONFIG_TEST_STRING_HELPERS=y
-CONFIG_TEST_KSTRTOX=y
 CONFIG_DMA_API_DEBUG=y
 CONFIG_TEST_BPF=m
 CONFIG_BUG_ON_DATA_CORRUPTION=y
@@ -630,6 +648,7 @@ CONFIG_S390_PTDUMP=y
 CONFIG_ENCRYPTED_KEYS=m
 CONFIG_SECURITY=y
 CONFIG_SECURITY_NETWORK=y
+CONFIG_HARDENED_USERCOPY=y
 CONFIG_SECURITY_SELINUX=y
 CONFIG_SECURITY_SELINUX_BOOTPARAM=y
 CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE=0
@@ -640,7 +659,9 @@ CONFIG_CRYPTO_RSA=m
 CONFIG_CRYPTO_DH=m
 CONFIG_CRYPTO_ECDH=m
 CONFIG_CRYPTO_USER=m
+CONFIG_CRYPTO_PCRYPT=m
 CONFIG_CRYPTO_CRYPTD=m
+CONFIG_CRYPTO_MCRYPTD=m
 CONFIG_CRYPTO_TEST=m
 CONFIG_CRYPTO_CCM=m
 CONFIG_CRYPTO_GCM=m
@@ -648,6 +669,7 @@ CONFIG_CRYPTO_CHACHA20POLY1305=m
 CONFIG_CRYPTO_LRW=m
 CONFIG_CRYPTO_PCBC=m
 CONFIG_CRYPTO_KEYWRAP=m
+CONFIG_CRYPTO_CMAC=m
 CONFIG_CRYPTO_XCBC=m
 CONFIG_CRYPTO_VMAC=m
 CONFIG_CRYPTO_CRC32=m
@@ -657,8 +679,10 @@ CONFIG_CRYPTO_RMD160=m
 CONFIG_CRYPTO_RMD256=m
 CONFIG_CRYPTO_RMD320=m
 CONFIG_CRYPTO_SHA512=m
+CONFIG_CRYPTO_SHA3=m
 CONFIG_CRYPTO_TGR192=m
 CONFIG_CRYPTO_WP512=m
+CONFIG_CRYPTO_AES_TI=m
 CONFIG_CRYPTO_ANUBIS=m
 CONFIG_CRYPTO_BLOWFISH=m
 CONFIG_CRYPTO_CAMELLIA=m
@@ -674,6 +698,7 @@ CONFIG_CRYPTO_TWOFISH=m
 CONFIG_CRYPTO_842=m
 CONFIG_CRYPTO_LZ4=m
 CONFIG_CRYPTO_LZ4HC=m
+CONFIG_CRYPTO_ANSI_CPRNG=m
 CONFIG_CRYPTO_USER_API_HASH=m
 CONFIG_CRYPTO_USER_API_SKCIPHER=m
 CONFIG_CRYPTO_USER_API_RNG=m
@@ -685,6 +710,7 @@ CONFIG_CRYPTO_SHA256_S390=m
 CONFIG_CRYPTO_SHA512_S390=m
 CONFIG_CRYPTO_DES_S390=m
 CONFIG_CRYPTO_AES_S390=m
+CONFIG_CRYPTO_PAES_S390=m
 CONFIG_CRYPTO_GHASH_S390=m
 CONFIG_CRYPTO_CRC32_S390=y
 CONFIG_ASYMMETRIC_KEY_TYPE=y
@@ -692,6 +718,7 @@ CONFIG_ASYMMETRIC_PUBLIC_KEY_SUBTYPE=m
 CONFIG_X509_CERTIFICATE_PARSER=m
 CONFIG_CRC7=m
 CONFIG_CRC8=m
+CONFIG_RANDOM32_SELFTEST=y
 CONFIG_CORDIC=m
 CONFIG_CMM=m
 CONFIG_APPLDATA_BASE=y
diff --git a/arch/s390/configs/gcov_defconfig b/arch/s390/configs/gcov_defconfig
index 83970b5afb2b..3c6b78189fbc 100644
--- a/arch/s390/configs/gcov_defconfig
+++ b/arch/s390/configs/gcov_defconfig
@@ -31,6 +31,7 @@ CONFIG_USER_NS=y
 CONFIG_SCHED_AUTOGROUP=y
 CONFIG_BLK_DEV_INITRD=y
 CONFIG_EXPERT=y
+# CONFIG_SYSFS_SYSCALL is not set
 CONFIG_BPF_SYSCALL=y
 CONFIG_USERFAULTFD=y
 # CONFIG_COMPAT_BRK is not set
@@ -46,7 +47,10 @@ CONFIG_MODULE_UNLOAD=y
 CONFIG_MODULE_FORCE_UNLOAD=y
 CONFIG_MODVERSIONS=y
 CONFIG_MODULE_SRCVERSION_ALL=y
+CONFIG_BLK_DEV_INTEGRITY=y
 CONFIG_BLK_DEV_THROTTLING=y
+CONFIG_BLK_WBT=y
+CONFIG_BLK_WBT_SQ=y
 CONFIG_PARTITION_ADVANCED=y
 CONFIG_IBM_PARTITION=y
 CONFIG_BSD_DISKLABEL=y
@@ -88,6 +92,8 @@ CONFIG_UNIX=y
 CONFIG_UNIX_DIAG=m
 CONFIG_XFRM_USER=m
 CONFIG_NET_KEY=m
+CONFIG_SMC=m
+CONFIG_SMC_DIAG=m
 CONFIG_INET=y
 CONFIG_IP_MULTICAST=y
 CONFIG_IP_ADVANCED_ROUTER=y
@@ -356,6 +362,7 @@ CONFIG_NET_ACT_SIMP=m
 CONFIG_NET_ACT_SKBEDIT=m
 CONFIG_NET_ACT_CSUM=m
 CONFIG_DNS_RESOLVER=y
+CONFIG_NETLINK_DIAG=m
 CONFIG_CGROUP_NET_PRIO=y
 CONFIG_BPF_JIT=y
 CONFIG_NET_PKTGEN=m
@@ -364,16 +371,18 @@ CONFIG_DEVTMPFS=y
 CONFIG_DMA_CMA=y
 CONFIG_CMA_SIZE_MBYTES=0
 CONFIG_CONNECTOR=y
+CONFIG_ZRAM=m
 CONFIG_BLK_DEV_LOOP=m
 CONFIG_BLK_DEV_CRYPTOLOOP=m
+CONFIG_BLK_DEV_DRBD=m
 CONFIG_BLK_DEV_NBD=m
 CONFIG_BLK_DEV_OSD=m
 CONFIG_BLK_DEV_RAM=y
 CONFIG_BLK_DEV_RAM_SIZE=32768
-CONFIG_CDROM_PKTCDVD=m
-CONFIG_ATA_OVER_ETH=m
+CONFIG_BLK_DEV_RAM_DAX=y
 CONFIG_VIRTIO_BLK=y
 CONFIG_ENCLOSURE_SERVICES=m
+CONFIG_GENWQE=m
 CONFIG_RAID_ATTRS=m
 CONFIG_SCSI=y
 CONFIG_BLK_DEV_SD=y
@@ -439,6 +448,8 @@ CONFIG_NLMON=m
 # CONFIG_NET_VENDOR_INTEL is not set
 # CONFIG_NET_VENDOR_MARVELL is not set
 CONFIG_MLX4_EN=m
+CONFIG_MLX5_CORE=m
+CONFIG_MLX5_CORE_EN=y
 # CONFIG_NET_VENDOR_NATSEMI is not set
 CONFIG_PPP=m
 CONFIG_PPP_BSDCOMP=m
@@ -449,7 +460,6 @@ CONFIG_PPTP=m
 CONFIG_PPPOL2TP=m
 CONFIG_PPP_ASYNC=m
 CONFIG_PPP_SYNC_TTY=m
-# CONFIG_INPUT_MOUSEDEV_PSAUX is not set
 # CONFIG_INPUT_KEYBOARD is not set
 # CONFIG_INPUT_MOUSE is not set
 # CONFIG_SERIO is not set
@@ -468,6 +478,7 @@ CONFIG_DIAG288_WATCHDOG=m
 CONFIG_INFINIBAND=m
 CONFIG_INFINIBAND_USER_ACCESS=m
 CONFIG_MLX4_INFINIBAND=m
+CONFIG_MLX5_INFINIBAND=m
 CONFIG_VIRTIO_BALLOON=m
 CONFIG_EXT4_FS=y
 CONFIG_EXT4_FS_POSIX_ACL=y
@@ -483,11 +494,15 @@ CONFIG_XFS_QUOTA=y
 CONFIG_XFS_POSIX_ACL=y
 CONFIG_XFS_RT=y
 CONFIG_GFS2_FS=m
+CONFIG_GFS2_FS_LOCKING_DLM=y
 CONFIG_OCFS2_FS=m
 CONFIG_BTRFS_FS=y
 CONFIG_BTRFS_FS_POSIX_ACL=y
 CONFIG_NILFS2_FS=m
+CONFIG_FS_DAX=y
+CONFIG_EXPORTFS_BLOCK_OPS=y
 CONFIG_FANOTIFY=y
+CONFIG_FANOTIFY_ACCESS_PERMISSIONS=y
 CONFIG_QUOTA_NETLINK_INTERFACE=y
 CONFIG_QFMT_V1=m
 CONFIG_QFMT_V2=m
@@ -553,7 +568,6 @@ CONFIG_UNUSED_SYMBOLS=y
 CONFIG_MAGIC_SYSRQ=y
 CONFIG_DEBUG_MEMORY_INIT=y
 CONFIG_PANIC_ON_OOPS=y
-CONFIG_TIMER_STATS=y
 CONFIG_RCU_TORTURE_TEST=m
 CONFIG_RCU_CPU_STALL_TIMEOUT=60
 CONFIG_LATENCYTOP=y
@@ -576,6 +590,7 @@ CONFIG_BIG_KEYS=y
 CONFIG_ENCRYPTED_KEYS=m
 CONFIG_SECURITY=y
 CONFIG_SECURITY_NETWORK=y
+CONFIG_HARDENED_USERCOPY=y
 CONFIG_SECURITY_SELINUX=y
 CONFIG_SECURITY_SELINUX_BOOTPARAM=y
 CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE=0
@@ -599,6 +614,7 @@ CONFIG_CRYPTO_CHACHA20POLY1305=m
 CONFIG_CRYPTO_LRW=m
 CONFIG_CRYPTO_PCBC=m
 CONFIG_CRYPTO_KEYWRAP=m
+CONFIG_CRYPTO_CMAC=m
 CONFIG_CRYPTO_XCBC=m
 CONFIG_CRYPTO_VMAC=m
 CONFIG_CRYPTO_CRC32=m
@@ -611,6 +627,7 @@ CONFIG_CRYPTO_SHA512=m
 CONFIG_CRYPTO_SHA3=m
 CONFIG_CRYPTO_TGR192=m
 CONFIG_CRYPTO_WP512=m
+CONFIG_CRYPTO_AES_TI=m
 CONFIG_CRYPTO_ANUBIS=m
 CONFIG_CRYPTO_BLOWFISH=m
 CONFIG_CRYPTO_CAMELLIA=m
@@ -626,16 +643,19 @@ CONFIG_CRYPTO_TWOFISH=m
 CONFIG_CRYPTO_842=m
 CONFIG_CRYPTO_LZ4=m
 CONFIG_CRYPTO_LZ4HC=m
+CONFIG_CRYPTO_ANSI_CPRNG=m
 CONFIG_CRYPTO_USER_API_HASH=m
 CONFIG_CRYPTO_USER_API_SKCIPHER=m
 CONFIG_CRYPTO_USER_API_RNG=m
 CONFIG_CRYPTO_USER_API_AEAD=m
 CONFIG_ZCRYPT=m
+CONFIG_PKEY=m
 CONFIG_CRYPTO_SHA1_S390=m
 CONFIG_CRYPTO_SHA256_S390=m
 CONFIG_CRYPTO_SHA512_S390=m
 CONFIG_CRYPTO_DES_S390=m
 CONFIG_CRYPTO_AES_S390=m
+CONFIG_CRYPTO_PAES_S390=m
 CONFIG_CRYPTO_GHASH_S390=m
 CONFIG_CRYPTO_CRC32_S390=y
 CONFIG_CRC7=m
diff --git a/arch/s390/configs/performance_defconfig b/arch/s390/configs/performance_defconfig
index fbc6542aaf59..653d72bcc007 100644
--- a/arch/s390/configs/performance_defconfig
+++ b/arch/s390/configs/performance_defconfig
@@ -31,6 +31,7 @@ CONFIG_USER_NS=y
 CONFIG_SCHED_AUTOGROUP=y
 CONFIG_BLK_DEV_INITRD=y
 CONFIG_EXPERT=y
+# CONFIG_SYSFS_SYSCALL is not set
 CONFIG_BPF_SYSCALL=y
 CONFIG_USERFAULTFD=y
 # CONFIG_COMPAT_BRK is not set
@@ -44,7 +45,10 @@ CONFIG_MODULE_UNLOAD=y
 CONFIG_MODULE_FORCE_UNLOAD=y
 CONFIG_MODVERSIONS=y
 CONFIG_MODULE_SRCVERSION_ALL=y
+CONFIG_BLK_DEV_INTEGRITY=y
 CONFIG_BLK_DEV_THROTTLING=y
+CONFIG_BLK_WBT=y
+CONFIG_BLK_WBT_SQ=y
 CONFIG_PARTITION_ADVANCED=y
 CONFIG_IBM_PARTITION=y
 CONFIG_BSD_DISKLABEL=y
@@ -86,6 +90,8 @@ CONFIG_UNIX=y
 CONFIG_UNIX_DIAG=m
 CONFIG_XFRM_USER=m
 CONFIG_NET_KEY=m
+CONFIG_SMC=m
+CONFIG_SMC_DIAG=m
 CONFIG_INET=y
 CONFIG_IP_MULTICAST=y
 CONFIG_IP_ADVANCED_ROUTER=y
@@ -354,6 +360,7 @@ CONFIG_NET_ACT_SIMP=m
 CONFIG_NET_ACT_SKBEDIT=m
 CONFIG_NET_ACT_CSUM=m
 CONFIG_DNS_RESOLVER=y
+CONFIG_NETLINK_DIAG=m
 CONFIG_CGROUP_NET_PRIO=y
 CONFIG_BPF_JIT=y
 CONFIG_NET_PKTGEN=m
@@ -362,16 +369,18 @@ CONFIG_DEVTMPFS=y
 CONFIG_DMA_CMA=y
 CONFIG_CMA_SIZE_MBYTES=0
 CONFIG_CONNECTOR=y
+CONFIG_ZRAM=m
 CONFIG_BLK_DEV_LOOP=m
 CONFIG_BLK_DEV_CRYPTOLOOP=m
+CONFIG_BLK_DEV_DRBD=m
 CONFIG_BLK_DEV_NBD=m
 CONFIG_BLK_DEV_OSD=m
 CONFIG_BLK_DEV_RAM=y
 CONFIG_BLK_DEV_RAM_SIZE=32768
-CONFIG_CDROM_PKTCDVD=m
-CONFIG_ATA_OVER_ETH=m
+CONFIG_BLK_DEV_RAM_DAX=y
 CONFIG_VIRTIO_BLK=y
 CONFIG_ENCLOSURE_SERVICES=m
+CONFIG_GENWQE=m
 CONFIG_RAID_ATTRS=m
 CONFIG_SCSI=y
 CONFIG_BLK_DEV_SD=y
@@ -437,6 +446,8 @@ CONFIG_NLMON=m
 # CONFIG_NET_VENDOR_INTEL is not set
 # CONFIG_NET_VENDOR_MARVELL is not set
 CONFIG_MLX4_EN=m
+CONFIG_MLX5_CORE=m
+CONFIG_MLX5_CORE_EN=y
 # CONFIG_NET_VENDOR_NATSEMI is not set
 CONFIG_PPP=m
 CONFIG_PPP_BSDCOMP=m
@@ -447,7 +458,6 @@ CONFIG_PPTP=m
 CONFIG_PPPOL2TP=m
 CONFIG_PPP_ASYNC=m
 CONFIG_PPP_SYNC_TTY=m
-# CONFIG_INPUT_MOUSEDEV_PSAUX is not set
 # CONFIG_INPUT_KEYBOARD is not set
 # CONFIG_INPUT_MOUSE is not set
 # CONFIG_SERIO is not set
@@ -466,6 +476,7 @@ CONFIG_DIAG288_WATCHDOG=m
 CONFIG_INFINIBAND=m
 CONFIG_INFINIBAND_USER_ACCESS=m
 CONFIG_MLX4_INFINIBAND=m
+CONFIG_MLX5_INFINIBAND=m
 CONFIG_VIRTIO_BALLOON=m
 CONFIG_EXT4_FS=y
 CONFIG_EXT4_FS_POSIX_ACL=y
@@ -481,11 +492,15 @@ CONFIG_XFS_QUOTA=y
 CONFIG_XFS_POSIX_ACL=y
 CONFIG_XFS_RT=y
 CONFIG_GFS2_FS=m
+CONFIG_GFS2_FS_LOCKING_DLM=y
 CONFIG_OCFS2_FS=m
 CONFIG_BTRFS_FS=y
 CONFIG_BTRFS_FS_POSIX_ACL=y
 CONFIG_NILFS2_FS=m
+CONFIG_FS_DAX=y
+CONFIG_EXPORTFS_BLOCK_OPS=y
 CONFIG_FANOTIFY=y
+CONFIG_FANOTIFY_ACCESS_PERMISSIONS=y
 CONFIG_QUOTA_NETLINK_INTERFACE=y
 CONFIG_QFMT_V1=m
 CONFIG_QFMT_V2=m
@@ -551,7 +566,6 @@ CONFIG_UNUSED_SYMBOLS=y
 CONFIG_MAGIC_SYSRQ=y
 CONFIG_DEBUG_MEMORY_INIT=y
 CONFIG_PANIC_ON_OOPS=y
-CONFIG_TIMER_STATS=y
 CONFIG_RCU_TORTURE_TEST=m
 CONFIG_RCU_CPU_STALL_TIMEOUT=60
 CONFIG_LATENCYTOP=y
@@ -574,6 +588,7 @@ CONFIG_BIG_KEYS=y
 CONFIG_ENCRYPTED_KEYS=m
 CONFIG_SECURITY=y
 CONFIG_SECURITY_NETWORK=y
+CONFIG_HARDENED_USERCOPY=y
 CONFIG_SECURITY_SELINUX=y
 CONFIG_SECURITY_SELINUX_BOOTPARAM=y
 CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE=0
@@ -597,6 +612,7 @@ CONFIG_CRYPTO_CHACHA20POLY1305=m
 CONFIG_CRYPTO_LRW=m
 CONFIG_CRYPTO_PCBC=m
 CONFIG_CRYPTO_KEYWRAP=m
+CONFIG_CRYPTO_CMAC=m
 CONFIG_CRYPTO_XCBC=m
 CONFIG_CRYPTO_VMAC=m
 CONFIG_CRYPTO_CRC32=m
@@ -609,6 +625,7 @@ CONFIG_CRYPTO_SHA512=m
 CONFIG_CRYPTO_SHA3=m
 CONFIG_CRYPTO_TGR192=m
 CONFIG_CRYPTO_WP512=m
+CONFIG_CRYPTO_AES_TI=m
 CONFIG_CRYPTO_ANUBIS=m
 CONFIG_CRYPTO_BLOWFISH=m
 CONFIG_CRYPTO_CAMELLIA=m
@@ -624,6 +641,7 @@ CONFIG_CRYPTO_TWOFISH=m
 CONFIG_CRYPTO_842=m
 CONFIG_CRYPTO_LZ4=m
 CONFIG_CRYPTO_LZ4HC=m
+CONFIG_CRYPTO_ANSI_CPRNG=m
 CONFIG_CRYPTO_USER_API_HASH=m
 CONFIG_CRYPTO_USER_API_SKCIPHER=m
 CONFIG_CRYPTO_USER_API_RNG=m
@@ -635,6 +653,7 @@ CONFIG_CRYPTO_SHA256_S390=m
 CONFIG_CRYPTO_SHA512_S390=m
 CONFIG_CRYPTO_DES_S390=m
 CONFIG_CRYPTO_AES_S390=m
+CONFIG_CRYPTO_PAES_S390=m
 CONFIG_CRYPTO_GHASH_S390=m
 CONFIG_CRYPTO_CRC32_S390=y
 CONFIG_CRC7=m
diff --git a/arch/s390/configs/zfcpdump_defconfig b/arch/s390/configs/zfcpdump_defconfig
index e23d97c13735..afa46a7406ea 100644
--- a/arch/s390/configs/zfcpdump_defconfig
+++ b/arch/s390/configs/zfcpdump_defconfig
@@ -12,8 +12,10 @@ CONFIG_TUNE_ZEC12=y
 CONFIG_NR_CPUS=2
 # CONFIG_HOTPLUG_CPU is not set
 CONFIG_HZ_100=y
+# CONFIG_ARCH_RANDOM is not set
 # CONFIG_COMPACTION is not set
 # CONFIG_MIGRATION is not set
+# CONFIG_BOUNCE is not set
 # CONFIG_CHECK_STACK is not set
 # CONFIG_CHSC_SCH is not set
 # CONFIG_SCM_BUS is not set
@@ -36,11 +38,11 @@ CONFIG_SCSI_CONSTANTS=y
 CONFIG_SCSI_LOGGING=y
 CONFIG_SCSI_FC_ATTRS=y
 CONFIG_ZFCP=y
-# CONFIG_INPUT_MOUSEDEV_PSAUX is not set
 # CONFIG_INPUT_KEYBOARD is not set
 # CONFIG_INPUT_MOUSE is not set
 # CONFIG_SERIO is not set
 # CONFIG_HVC_IUCV is not set
+# CONFIG_HW_RANDOM_S390 is not set
 CONFIG_RAW_DRIVER=y
 # CONFIG_SCLP_ASYNC is not set
 # CONFIG_HMC_DRV is not set
@@ -54,9 +56,9 @@ CONFIG_RAW_DRIVER=y
 # CONFIG_INOTIFY_USER is not set
 CONFIG_CONFIGFS_FS=y
 # CONFIG_MISC_FILESYSTEMS is not set
+# CONFIG_NETWORK_FILESYSTEMS is not set
 CONFIG_PRINTK_TIME=y
 CONFIG_DEBUG_INFO=y
-CONFIG_DEBUG_FS=y
 CONFIG_DEBUG_KERNEL=y
 CONFIG_PANIC_ON_OOPS=y
 # CONFIG_SCHED_DEBUG is not set
diff --git a/arch/s390/crypto/Makefile b/arch/s390/crypto/Makefile
index 678d9863e3f0..ad4bd777768d 100644
--- a/arch/s390/crypto/Makefile
+++ b/arch/s390/crypto/Makefile
@@ -6,7 +6,8 @@ obj-$(CONFIG_CRYPTO_SHA1_S390) += sha1_s390.o sha_common.o
 obj-$(CONFIG_CRYPTO_SHA256_S390) += sha256_s390.o sha_common.o
 obj-$(CONFIG_CRYPTO_SHA512_S390) += sha512_s390.o sha_common.o
 obj-$(CONFIG_CRYPTO_DES_S390) += des_s390.o
-obj-$(CONFIG_CRYPTO_AES_S390) += aes_s390.o paes_s390.o
+obj-$(CONFIG_CRYPTO_AES_S390) += aes_s390.o
+obj-$(CONFIG_CRYPTO_PAES_S390) += paes_s390.o
 obj-$(CONFIG_S390_PRNG) += prng.o
 obj-$(CONFIG_CRYPTO_GHASH_S390) += ghash_s390.o
 obj-$(CONFIG_CRYPTO_CRC32_S390) += crc32-vx_s390.o
diff --git a/arch/s390/crypto/arch_random.c b/arch/s390/crypto/arch_random.c
index 9317b3e645e2..36aefc07d10c 100644
--- a/arch/s390/crypto/arch_random.c
+++ b/arch/s390/crypto/arch_random.c
@@ -12,6 +12,7 @@
 
 #include <linux/kernel.h>
 #include <linux/atomic.h>
+#include <linux/random.h>
 #include <linux/static_key.h>
 #include <asm/cpacf.h>
 
diff --git a/arch/s390/defconfig b/arch/s390/defconfig
index 97189dbaf34b..20244a38c886 100644
--- a/arch/s390/defconfig
+++ b/arch/s390/defconfig
@@ -28,6 +28,7 @@ CONFIG_NAMESPACES=y
 CONFIG_USER_NS=y
 CONFIG_BLK_DEV_INITRD=y
 CONFIG_EXPERT=y
+# CONFIG_SYSFS_SYSCALL is not set
 CONFIG_BPF_SYSCALL=y
 CONFIG_USERFAULTFD=y
 # CONFIG_COMPAT_BRK is not set
@@ -108,7 +109,6 @@ CONFIG_ZFCP=y
 CONFIG_SCSI_VIRTIO=y
 CONFIG_MD=y
 CONFIG_MD_LINEAR=m
-CONFIG_MD_RAID0=m
 CONFIG_MD_MULTIPATH=m
 CONFIG_BLK_DEV_DM=y
 CONFIG_DM_CRYPT=m
@@ -131,6 +131,7 @@ CONFIG_TUN=m
 CONFIG_VIRTIO_NET=y
 # CONFIG_NET_VENDOR_ALACRITECH is not set
 # CONFIG_NET_VENDOR_SOLARFLARE is not set
+# CONFIG_NET_VENDOR_SYNOPSYS is not set
 # CONFIG_INPUT is not set
 # CONFIG_SERIO is not set
 CONFIG_DEVKMEM=y
@@ -162,7 +163,6 @@ CONFIG_MAGIC_SYSRQ=y
 CONFIG_DEBUG_PAGEALLOC=y
 CONFIG_DETECT_HUNG_TASK=y
 CONFIG_PANIC_ON_OOPS=y
-CONFIG_TIMER_STATS=y
 CONFIG_DEBUG_RT_MUTEXES=y
 CONFIG_PROVE_LOCKING=y
 CONFIG_LOCK_STAT=y
@@ -172,14 +172,12 @@ CONFIG_DEBUG_LIST=y
 CONFIG_DEBUG_SG=y
 CONFIG_DEBUG_NOTIFIERS=y
 CONFIG_RCU_CPU_STALL_TIMEOUT=60
-CONFIG_RCU_TRACE=y
 CONFIG_LATENCYTOP=y
 CONFIG_SCHED_TRACER=y
 CONFIG_FTRACE_SYSCALLS=y
 CONFIG_TRACER_SNAPSHOT_PER_CPU_SWAP=y
 CONFIG_STACK_TRACER=y
 CONFIG_BLK_DEV_IO_TRACE=y
-CONFIG_UPROBE_EVENTS=y
 CONFIG_FUNCTION_PROFILER=y
 CONFIG_TRACE_ENUM_MAP_FILE=y
 CONFIG_KPROBES_SANITY_TEST=y
@@ -190,7 +188,6 @@ CONFIG_CRYPTO_CCM=m
 CONFIG_CRYPTO_GCM=m
 CONFIG_CRYPTO_CBC=y
 CONFIG_CRYPTO_CTS=m
-CONFIG_CRYPTO_ECB=m
 CONFIG_CRYPTO_LRW=m
 CONFIG_CRYPTO_PCBC=m
 CONFIG_CRYPTO_XTS=m
@@ -230,6 +227,7 @@ CONFIG_CRYPTO_USER_API_SKCIPHER=m
 CONFIG_CRYPTO_USER_API_RNG=m
 CONFIG_ZCRYPT=m
 CONFIG_PKEY=m
+CONFIG_CRYPTO_PAES_S390=m
 CONFIG_CRYPTO_SHA1_S390=m
 CONFIG_CRYPTO_SHA256_S390=m
 CONFIG_CRYPTO_SHA512_S390=m
diff --git a/arch/s390/include/asm/Kbuild b/arch/s390/include/asm/Kbuild
index 45092b12f54f..b3c88479feba 100644
--- a/arch/s390/include/asm/Kbuild
+++ b/arch/s390/include/asm/Kbuild
@@ -1,10 +1,12 @@
 generic-y += asm-offsets.h
 generic-y += cacheflush.h
 generic-y += clkdev.h
+generic-y += device.h
 generic-y += dma-contiguous.h
 generic-y += div64.h
 generic-y += emergency-restart.h
 generic-y += export.h
+generic-y += fb.h
 generic-y += irq_regs.h
 generic-y += irq_work.h
 generic-y += kmap_types.h
diff --git a/arch/s390/include/asm/debug.h b/arch/s390/include/asm/debug.h
index 0206c8052328..df7b54ea956d 100644
--- a/arch/s390/include/asm/debug.h
+++ b/arch/s390/include/asm/debug.h
@@ -10,6 +10,7 @@
 #include <linux/spinlock.h>
 #include <linux/kernel.h>
 #include <linux/time.h>
+#include <linux/refcount.h>
 #include <uapi/asm/debug.h>
 
 #define DEBUG_MAX_LEVEL            6  /* debug levels range from 0 to 6 */
@@ -31,7 +32,7 @@ struct debug_view;
 typedef struct debug_info {     
         struct debug_info* next;
         struct debug_info* prev;
-        atomic_t ref_count;
+        refcount_t ref_count;
         spinlock_t lock;                        
         int level;
         int nr_areas;
diff --git a/arch/s390/include/asm/device.h b/arch/s390/include/asm/device.h
deleted file mode 100644
index 5203fc87f080..000000000000
--- a/arch/s390/include/asm/device.h
+++ /dev/null
@@ -1,10 +0,0 @@
-/*
- * Arch specific extensions to struct device
- *
- * This file is released under the GPLv2
- */
-struct dev_archdata {
-};
-
-struct pdev_archdata {
-};
diff --git a/arch/s390/include/asm/dis.h b/arch/s390/include/asm/dis.h
index 60323c21938b..37f617dfbede 100644
--- a/arch/s390/include/asm/dis.h
+++ b/arch/s390/include/asm/dis.h
@@ -40,6 +40,8 @@ static inline int insn_length(unsigned char code)
         return ((((int) code + 64) >> 7) + 1) << 1;
 }
 
+struct pt_regs;
+
 void show_code(struct pt_regs *regs);
 void print_fn_code(unsigned char *code, unsigned long len);
 int insn_to_mnemonic(unsigned char *instruction, char *buf, unsigned int len);
diff --git a/arch/s390/include/asm/elf.h b/arch/s390/include/asm/elf.h
index e8f623041769..ec024c08dabe 100644
--- a/arch/s390/include/asm/elf.h
+++ b/arch/s390/include/asm/elf.h
@@ -117,6 +117,9 @@
 #define ELF_DATA        ELFDATA2MSB
 #define ELF_ARCH        EM_S390
 
+/* s390 specific phdr types */
+#define PT_S390_PGSTE   0x70000000
+
 /*
  * ELF register definitions..
  */
@@ -151,6 +154,35 @@ extern unsigned int vdso_enabled;
          && (x)->e_ident[EI_CLASS] == ELF_CLASS)
 #define compat_start_thread     start_thread31
 
+struct arch_elf_state {
+        int rc;
+};
+
+#define INIT_ARCH_ELF_STATE { .rc = 0 }
+
+#define arch_check_elf(ehdr, interp, interp_ehdr, state) (0)
+#ifdef CONFIG_PGSTE
+#define arch_elf_pt_proc(ehdr, phdr, elf, interp, state)        \
+({                                                              \
+        struct arch_elf_state *_state = state;                  \
+        if ((phdr)->p_type == PT_S390_PGSTE &&                  \
+            !page_table_allocate_pgste &&                       \
+            !test_thread_flag(TIF_PGSTE) &&                     \
+            !current->mm->context.alloc_pgste) {                \
+                set_thread_flag(TIF_PGSTE);                     \
+                set_pt_regs_flag(task_pt_regs(current),         \
+                                 PIF_SYSCALL_RESTART);          \
+                _state->rc = -EAGAIN;                           \
+        }                                                       \
+        _state->rc;                                             \
+})
+#else
+#define arch_elf_pt_proc(ehdr, phdr, elf, interp, state)        \
+({                                                              \
+        (state)->rc;                                            \
+})
+#endif
+
 /* For SVR4/S390 the function pointer to be registered with `atexit` is
    passed in R14. */
 #define ELF_PLAT_INIT(_r, load_addr) \
diff --git a/arch/s390/include/asm/fb.h b/arch/s390/include/asm/fb.h
deleted file mode 100644
index c7df38030992..000000000000
--- a/arch/s390/include/asm/fb.h
+++ /dev/null
@@ -1,12 +0,0 @@
-#ifndef _ASM_FB_H_
-#define _ASM_FB_H_
-#include <linux/fb.h>
-
-#define fb_pgprotect(...) do {} while (0)
-
-static inline int fb_is_primary_device(struct fb_info *info)
-{
-        return 0;
-}
-
-#endif /* _ASM_FB_H_ */
diff --git a/arch/s390/include/asm/io.h b/arch/s390/include/asm/io.h
index 437e9af96688..904e4b3af95d 100644
--- a/arch/s390/include/asm/io.h
+++ b/arch/s390/include/asm/io.h
@@ -25,8 +25,6 @@ void unxlate_dev_mem_ptr(phys_addr_t phys, void *addr);
 
 #define IO_SPACE_LIMIT 0
 
-#ifdef CONFIG_PCI
-
 #define ioremap_nocache(addr, size)     ioremap(addr, size)
 #define ioremap_wc                      ioremap_nocache
 #define ioremap_wt                      ioremap_nocache
@@ -49,6 +47,8 @@ static inline void ioport_unmap(void __iomem *p)
 {
 }
 
+#ifdef CONFIG_PCI
+
 /*
  * s390 needs a private implementation of pci_iomap since ioremap with its
  * offset parameter isn't sufficient. That's because BAR spaces are not
diff --git a/arch/s390/include/asm/kprobes.h b/arch/s390/include/asm/kprobes.h
index 1293c4066cfc..28792ef82c83 100644
--- a/arch/s390/include/asm/kprobes.h
+++ b/arch/s390/include/asm/kprobes.h
@@ -27,12 +27,21 @@
  * 2005-Dec     Used as a template for s390 by Mike Grundy
  *              <grundym@us.ibm.com>
  */
+#include <linux/types.h>
 #include <asm-generic/kprobes.h>
 
 #define BREAKPOINT_INSTRUCTION  0x0002
 
+#define FIXUP_PSW_NORMAL        0x08
+#define FIXUP_BRANCH_NOT_TAKEN  0x04
+#define FIXUP_RETURN_REGISTER   0x02
+#define FIXUP_NOT_REQUIRED      0x01
+
+int probe_is_prohibited_opcode(u16 *insn);
+int probe_get_fixup_type(u16 *insn);
+int probe_is_insn_relative_long(u16 *insn);
+
 #ifdef CONFIG_KPROBES
-#include <linux/types.h>
 #include <linux/ptrace.h>
 #include <linux/percpu.h>
 #include <linux/sched/task_stack.h>
@@ -56,11 +65,6 @@ typedef u16 kprobe_opcode_t;
 
 #define KPROBE_SWAP_INST        0x10
 
-#define FIXUP_PSW_NORMAL        0x08
-#define FIXUP_BRANCH_NOT_TAKEN  0x04
-#define FIXUP_RETURN_REGISTER   0x02
-#define FIXUP_NOT_REQUIRED      0x01
-
 /* Architecture specific copy of original instruction */
 struct arch_specific_insn {
         /* copy of original instruction */
@@ -90,10 +94,6 @@ int kprobe_fault_handler(struct pt_regs *regs, int trapnr);
 int kprobe_exceptions_notify(struct notifier_block *self,
         unsigned long val, void *data);
 
-int probe_is_prohibited_opcode(u16 *insn);
-int probe_get_fixup_type(u16 *insn);
-int probe_is_insn_relative_long(u16 *insn);
-
 #define flush_insn_slot(p)      do { } while (0)
 
 #endif /* CONFIG_KPROBES */
diff --git a/arch/s390/include/asm/mmu_context.h b/arch/s390/include/asm/mmu_context.h
index 8712e11bead4..4541ac44b35f 100644
--- a/arch/s390/include/asm/mmu_context.h
+++ b/arch/s390/include/asm/mmu_context.h
@@ -25,7 +25,9 @@ static inline int init_new_context(struct task_struct *tsk,
         mm->context.gmap_asce = 0;
         mm->context.flush_mm = 0;
 #ifdef CONFIG_PGSTE
-        mm->context.alloc_pgste = page_table_allocate_pgste;
+        mm->context.alloc_pgste = page_table_allocate_pgste ||
+                test_thread_flag(TIF_PGSTE) ||
+                current->mm->context.alloc_pgste;
         mm->context.has_pgste = 0;
         mm->context.use_skey = 0;
         mm->context.use_cmma = 0;
diff --git a/arch/s390/include/asm/page.h b/arch/s390/include/asm/page.h
index 69b8a41fca84..624deaa44230 100644
--- a/arch/s390/include/asm/page.h
+++ b/arch/s390/include/asm/page.h
@@ -74,6 +74,7 @@ typedef struct { unsigned long pgste; } pgste_t;
 typedef struct { unsigned long pte; } pte_t;
 typedef struct { unsigned long pmd; } pmd_t;
 typedef struct { unsigned long pud; } pud_t;
+typedef struct { unsigned long p4d; } p4d_t;
 typedef struct { unsigned long pgd; } pgd_t;
 typedef pte_t *pgtable_t;
 
@@ -82,12 +83,14 @@ typedef pte_t *pgtable_t;
 #define pte_val(x)      ((x).pte)
 #define pmd_val(x)      ((x).pmd)
 #define pud_val(x)      ((x).pud)
+#define p4d_val(x)      ((x).p4d)
 #define pgd_val(x)      ((x).pgd)
 
 #define __pgste(x)      ((pgste_t) { (x) } )
 #define __pte(x)        ((pte_t) { (x) } )
 #define __pmd(x)        ((pmd_t) { (x) } )
 #define __pud(x)        ((pud_t) { (x) } )
+#define __p4d(x)        ((p4d_t) { (x) } )
 #define __pgd(x)        ((pgd_t) { (x) } )
 #define __pgprot(x)     ((pgprot_t) { (x) } )
 
diff --git a/arch/s390/include/asm/pci.h b/arch/s390/include/asm/pci.h
index 4e3186649578..f36b4b726057 100644
--- a/arch/s390/include/asm/pci.h
+++ b/arch/s390/include/asm/pci.h
@@ -70,11 +70,10 @@ struct zpci_fmb {
 } __packed __aligned(128);
 
 enum zpci_state {
-        ZPCI_FN_STATE_RESERVED,
-        ZPCI_FN_STATE_STANDBY,
-        ZPCI_FN_STATE_CONFIGURED,
-        ZPCI_FN_STATE_ONLINE,
-        NR_ZPCI_FN_STATES,
+        ZPCI_FN_STATE_STANDBY = 0,
+        ZPCI_FN_STATE_CONFIGURED = 1,
+        ZPCI_FN_STATE_RESERVED = 2,
+        ZPCI_FN_STATE_ONLINE = 3,
 };
 
 struct zpci_bar_struct {
@@ -109,7 +108,7 @@ struct zpci_dev {
         u64             msi_addr;       /* MSI address */
         unsigned int    max_msi;        /* maximum number of MSI's */
         struct airq_iv *aibv;           /* adapter interrupt bit vector */
-        unsigned int    aisb;           /* number of the summary bit */
+        unsigned long   aisb;           /* number of the summary bit */
 
         /* DMA stuff */
         unsigned long   *dma_table;
@@ -159,11 +158,12 @@ extern const struct attribute_group *zpci_attr_groups[];
 ----------------------------------------------------------------------------- */
 /* Base stuff */
 int zpci_create_device(struct zpci_dev *);
+void zpci_remove_device(struct zpci_dev *zdev);
 int zpci_enable_device(struct zpci_dev *);
 int zpci_disable_device(struct zpci_dev *);
-void zpci_stop_device(struct zpci_dev *);
 int zpci_register_ioat(struct zpci_dev *, u8, u64, u64, u64);
 int zpci_unregister_ioat(struct zpci_dev *, u8);
+void zpci_remove_reserved_devices(void);
 
 /* CLP */
 int clp_scan_pci_devices(void);
@@ -172,6 +172,7 @@ int clp_rescan_pci_devices_simple(void);
 int clp_add_pci_device(u32, u32, int);
 int clp_enable_fh(struct zpci_dev *, u8);
 int clp_disable_fh(struct zpci_dev *);
+int clp_get_state(u32 fid, enum zpci_state *state);
 
 #ifdef CONFIG_PCI
 /* Error handling and recovery */
diff --git a/arch/s390/include/asm/pci_insn.h b/arch/s390/include/asm/pci_insn.h
index 649eb62c52b3..34abcf275799 100644
--- a/arch/s390/include/asm/pci_insn.h
+++ b/arch/s390/include/asm/pci_insn.h
@@ -76,7 +76,7 @@ struct zpci_fib {
         u32 gd;
 } __packed __aligned(8);
 
-int zpci_mod_fc(u64 req, struct zpci_fib *fib);
+u8 zpci_mod_fc(u64 req, struct zpci_fib *fib, u8 *status);
 int zpci_refresh_trans(u64 fn, u64 addr, u64 range);
 int zpci_load(u64 *data, u64 req, u64 offset);
 int zpci_store(u64 data, u64 req, u64 offset);
diff --git a/arch/s390/include/asm/pgalloc.h b/arch/s390/include/asm/pgalloc.h
index 166f703dad7c..bb0ff1bb0c4a 100644
--- a/arch/s390/include/asm/pgalloc.h
+++ b/arch/s390/include/asm/pgalloc.h
@@ -51,12 +51,24 @@ static inline unsigned long pgd_entry_type(struct mm_struct *mm)
                 return _SEGMENT_ENTRY_EMPTY;
         if (mm->context.asce_limit <= (1UL << 42))
                 return _REGION3_ENTRY_EMPTY;
-        return _REGION2_ENTRY_EMPTY;
+        if (mm->context.asce_limit <= (1UL << 53))
+                return _REGION2_ENTRY_EMPTY;
+        return _REGION1_ENTRY_EMPTY;
 }
 
-int crst_table_upgrade(struct mm_struct *);
+int crst_table_upgrade(struct mm_struct *mm, unsigned long limit);
 void crst_table_downgrade(struct mm_struct *);
 
+static inline p4d_t *p4d_alloc_one(struct mm_struct *mm, unsigned long address)
+{
+        unsigned long *table = crst_table_alloc(mm);
+
+        if (table)
+                crst_table_init(table, _REGION2_ENTRY_EMPTY);
+        return (p4d_t *) table;
+}
+#define p4d_free(mm, p4d) crst_table_free(mm, (unsigned long *) p4d)
+
 static inline pud_t *pud_alloc_one(struct mm_struct *mm, unsigned long address)
 {
         unsigned long *table = crst_table_alloc(mm);
@@ -86,9 +98,14 @@ static inline void pmd_free(struct mm_struct *mm, pmd_t *pmd)
         crst_table_free(mm, (unsigned long *) pmd);
 }
 
-static inline void pgd_populate(struct mm_struct *mm, pgd_t *pgd, pud_t *pud)
+static inline void pgd_populate(struct mm_struct *mm, pgd_t *pgd, p4d_t *p4d)
+{
+        pgd_val(*pgd) = _REGION1_ENTRY | __pa(p4d);
+}
+
+static inline void p4d_populate(struct mm_struct *mm, p4d_t *p4d, pud_t *pud)
 {
-        pgd_val(*pgd) = _REGION2_ENTRY | __pa(pud);
+        p4d_val(*p4d) = _REGION2_ENTRY | __pa(pud);
 }
 
 static inline void pud_populate(struct mm_struct *mm, pud_t *pud, pmd_t *pmd)
diff --git a/arch/s390/include/asm/pgtable.h b/arch/s390/include/asm/pgtable.h
index e6e3b887bee3..57057fb1cc07 100644
--- a/arch/s390/include/asm/pgtable.h
+++ b/arch/s390/include/asm/pgtable.h
@@ -24,7 +24,6 @@
  * the S390 page table tree.
  */
 #ifndef __ASSEMBLY__
-#include <asm-generic/5level-fixup.h>
 #include <linux/sched.h>
 #include <linux/mm_types.h>
 #include <linux/page-flags.h>
@@ -87,12 +86,15 @@ extern unsigned long zero_page_mask;
  */
 #define PMD_SHIFT       20
 #define PUD_SHIFT       31
-#define PGDIR_SHIFT     42
+#define P4D_SHIFT       42
+#define PGDIR_SHIFT     53
 
 #define PMD_SIZE        (1UL << PMD_SHIFT)
 #define PMD_MASK        (~(PMD_SIZE-1))
 #define PUD_SIZE        (1UL << PUD_SHIFT)
 #define PUD_MASK        (~(PUD_SIZE-1))
+#define P4D_SIZE        (1UL << P4D_SHIFT)
+#define P4D_MASK        (~(P4D_SIZE-1))
 #define PGDIR_SIZE      (1UL << PGDIR_SHIFT)
 #define PGDIR_MASK      (~(PGDIR_SIZE-1))
 
@@ -105,6 +107,7 @@ extern unsigned long zero_page_mask;
 #define PTRS_PER_PTE    256
 #define PTRS_PER_PMD    2048
 #define PTRS_PER_PUD    2048
+#define PTRS_PER_P4D    2048
 #define PTRS_PER_PGD    2048
 
 #define FIRST_USER_ADDRESS  0UL
@@ -115,6 +118,8 @@ extern unsigned long zero_page_mask;
         printk("%s:%d: bad pmd %p.\n", __FILE__, __LINE__, (void *) pmd_val(e))
 #define pud_ERROR(e) \
         printk("%s:%d: bad pud %p.\n", __FILE__, __LINE__, (void *) pud_val(e))
+#define p4d_ERROR(e) \
+        printk("%s:%d: bad p4d %p.\n", __FILE__, __LINE__, (void *) p4d_val(e))
 #define pgd_ERROR(e) \
         printk("%s:%d: bad pgd %p.\n", __FILE__, __LINE__, (void *) pgd_val(e))
 
@@ -296,8 +301,6 @@ static inline int is_module_addr(void *addr)
 #define _REGION3_ENTRY_EMPTY    (_REGION_ENTRY_TYPE_R3 | _REGION_ENTRY_INVALID)
 
 #define _REGION3_ENTRY_ORIGIN_LARGE ~0x7fffffffUL /* large page address      */
-#define _REGION3_ENTRY_ORIGIN  ~0x7ffUL/* region third table origin          */
-
 #define _REGION3_ENTRY_DIRTY    0x2000  /* SW region dirty bit */
 #define _REGION3_ENTRY_YOUNG    0x1000  /* SW region young bit */
 #define _REGION3_ENTRY_LARGE    0x0400  /* RTTE-format control, large page  */
@@ -310,8 +313,8 @@ static inline int is_module_addr(void *addr)
 #define _REGION3_ENTRY_SOFT_DIRTY 0x0000 /* SW region soft dirty bit */
 #endif
 
-#define _REGION_ENTRY_BITS       0xfffffffffffff227UL
-#define _REGION_ENTRY_BITS_LARGE 0xffffffff8000fe27UL
+#define _REGION_ENTRY_BITS       0xfffffffffffff22fUL
+#define _REGION_ENTRY_BITS_LARGE 0xffffffff8000fe2fUL
 
 /* Bits in the segment table entry */
 #define _SEGMENT_ENTRY_BITS     0xfffffffffffffe33UL
@@ -560,18 +563,23 @@ static inline void crdte(unsigned long old, unsigned long new,
 }
 
 /*
- * pgd/pmd/pte query functions
+ * pgd/p4d/pud/pmd/pte query functions
  */
+static inline int pgd_folded(pgd_t pgd)
+{
+        return (pgd_val(pgd) & _REGION_ENTRY_TYPE_MASK) < _REGION_ENTRY_TYPE_R1;
+}
+
 static inline int pgd_present(pgd_t pgd)
 {
-        if ((pgd_val(pgd) & _REGION_ENTRY_TYPE_MASK) < _REGION_ENTRY_TYPE_R2)
+        if (pgd_folded(pgd))
                 return 1;
         return (pgd_val(pgd) & _REGION_ENTRY_ORIGIN) != 0UL;
 }
 
 static inline int pgd_none(pgd_t pgd)
 {
-        if ((pgd_val(pgd) & _REGION_ENTRY_TYPE_MASK) < _REGION_ENTRY_TYPE_R2)
+        if (pgd_folded(pgd))
                 return 0;
         return (pgd_val(pgd) & _REGION_ENTRY_INVALID) != 0UL;
 }
@@ -589,16 +597,48 @@ static inline int pgd_bad(pgd_t pgd)
         return (pgd_val(pgd) & mask) != 0;
 }
 
+static inline int p4d_folded(p4d_t p4d)
+{
+        return (p4d_val(p4d) & _REGION_ENTRY_TYPE_MASK) < _REGION_ENTRY_TYPE_R2;
+}
+
+static inline int p4d_present(p4d_t p4d)
+{
+        if (p4d_folded(p4d))
+                return 1;
+        return (p4d_val(p4d) & _REGION_ENTRY_ORIGIN) != 0UL;
+}
+
+static inline int p4d_none(p4d_t p4d)
+{
+        if (p4d_folded(p4d))
+                return 0;
+        return p4d_val(p4d) == _REGION2_ENTRY_EMPTY;
+}
+
+static inline unsigned long p4d_pfn(p4d_t p4d)
+{
+        unsigned long origin_mask;
+
+        origin_mask = _REGION_ENTRY_ORIGIN;
+        return (p4d_val(p4d) & origin_mask) >> PAGE_SHIFT;
+}
+
+static inline int pud_folded(pud_t pud)
+{
+        return (pud_val(pud) & _REGION_ENTRY_TYPE_MASK) < _REGION_ENTRY_TYPE_R3;
+}
+
 static inline int pud_present(pud_t pud)
 {
-        if ((pud_val(pud) & _REGION_ENTRY_TYPE_MASK) < _REGION_ENTRY_TYPE_R3)
+        if (pud_folded(pud))
                 return 1;
         return (pud_val(pud) & _REGION_ENTRY_ORIGIN) != 0UL;
 }
 
 static inline int pud_none(pud_t pud)
 {
-        if ((pud_val(pud) & _REGION_ENTRY_TYPE_MASK) < _REGION_ENTRY_TYPE_R3)
+        if (pud_folded(pud))
                 return 0;
         return pud_val(pud) == _REGION3_ENTRY_EMPTY;
 }
@@ -614,7 +654,7 @@ static inline unsigned long pud_pfn(pud_t pud)
 {
         unsigned long origin_mask;
 
-        origin_mask = _REGION3_ENTRY_ORIGIN;
+        origin_mask = _REGION_ENTRY_ORIGIN;
         if (pud_large(pud))
                 origin_mask = _REGION3_ENTRY_ORIGIN_LARGE;
         return (pud_val(pud) & origin_mask) >> PAGE_SHIFT;
@@ -641,6 +681,13 @@ static inline int pud_bad(pud_t pud)
         return (pud_val(pud) & ~_REGION_ENTRY_BITS) != 0;
 }
 
+static inline int p4d_bad(p4d_t p4d)
+{
+        if ((p4d_val(p4d) & _REGION_ENTRY_TYPE_MASK) < _REGION_ENTRY_TYPE_R2)
+                return pud_bad(__pud(p4d_val(p4d)));
+        return (p4d_val(p4d) & ~_REGION_ENTRY_BITS) != 0;
+}
+
 static inline int pmd_present(pmd_t pmd)
 {
         return pmd_val(pmd) != _SEGMENT_ENTRY_EMPTY;
@@ -794,8 +841,14 @@ static inline int pte_unused(pte_t pte)
 
 static inline void pgd_clear(pgd_t *pgd)
 {
-        if ((pgd_val(*pgd) & _REGION_ENTRY_TYPE_MASK) == _REGION_ENTRY_TYPE_R2)
-                pgd_val(*pgd) = _REGION2_ENTRY_EMPTY;
+        if ((pgd_val(*pgd) & _REGION_ENTRY_TYPE_MASK) == _REGION_ENTRY_TYPE_R1)
+                pgd_val(*pgd) = _REGION1_ENTRY_EMPTY;
+}
+
+static inline void p4d_clear(p4d_t *p4d)
+{
+        if ((p4d_val(*p4d) & _REGION_ENTRY_TYPE_MASK) == _REGION_ENTRY_TYPE_R2)
+                p4d_val(*p4d) = _REGION2_ENTRY_EMPTY;
 }
 
 static inline void pud_clear(pud_t *pud)
@@ -1089,6 +1142,7 @@ static inline pte_t mk_pte(struct page *page, pgprot_t pgprot)
 }
 
 #define pgd_index(address) (((address) >> PGDIR_SHIFT) & (PTRS_PER_PGD-1))
+#define p4d_index(address) (((address) >> P4D_SHIFT) & (PTRS_PER_P4D-1))
 #define pud_index(address) (((address) >> PUD_SHIFT) & (PTRS_PER_PUD-1))
 #define pmd_index(address) (((address) >> PMD_SHIFT) & (PTRS_PER_PMD-1))
 #define pte_index(address) (((address) >> PAGE_SHIFT) & (PTRS_PER_PTE-1))
@@ -1098,19 +1152,31 @@ static inline pte_t mk_pte(struct page *page, pgprot_t pgprot)
 
 #define pmd_deref(pmd) (pmd_val(pmd) & _SEGMENT_ENTRY_ORIGIN)
 #define pud_deref(pud) (pud_val(pud) & _REGION_ENTRY_ORIGIN)
+#define p4d_deref(pud) (p4d_val(pud) & _REGION_ENTRY_ORIGIN)
 #define pgd_deref(pgd) (pgd_val(pgd) & _REGION_ENTRY_ORIGIN)
 
-static inline pud_t *pud_offset(pgd_t *pgd, unsigned long address)
+static inline p4d_t *p4d_offset(pgd_t *pgd, unsigned long address)
 {
-        pud_t *pud = (pud_t *) pgd;
-        if ((pgd_val(*pgd) & _REGION_ENTRY_TYPE_MASK) == _REGION_ENTRY_TYPE_R2)
-                pud = (pud_t *) pgd_deref(*pgd);
-        return pud  + pud_index(address);
+        p4d_t *p4d = (p4d_t *) pgd;
+
+        if ((pgd_val(*pgd) & _REGION_ENTRY_TYPE_MASK) == _REGION_ENTRY_TYPE_R1)
+                p4d = (p4d_t *) pgd_deref(*pgd);
+        return p4d + p4d_index(address);
+}
+
+static inline pud_t *pud_offset(p4d_t *p4d, unsigned long address)
+{
+        pud_t *pud = (pud_t *) p4d;
+
+        if ((p4d_val(*p4d) & _REGION_ENTRY_TYPE_MASK) == _REGION_ENTRY_TYPE_R2)
+                pud = (pud_t *) p4d_deref(*p4d);
+        return pud + pud_index(address);
 }
 
 static inline pmd_t *pmd_offset(pud_t *pud, unsigned long address)
 {
         pmd_t *pmd = (pmd_t *) pud;
+
         if ((pud_val(*pud) & _REGION_ENTRY_TYPE_MASK) == _REGION_ENTRY_TYPE_R3)
                 pmd = (pmd_t *) pud_deref(*pud);
         return pmd + pmd_index(address);
@@ -1122,6 +1188,7 @@ static inline pmd_t *pmd_offset(pud_t *pud, unsigned long address)
 
 #define pmd_page(pmd) pfn_to_page(pmd_pfn(pmd))
 #define pud_page(pud) pfn_to_page(pud_pfn(pud))
+#define p4d_page(pud) pfn_to_page(p4d_pfn(p4d))
 
 /* Find an entry in the lowest level page table.. */
 #define pte_offset(pmd, addr) ((pte_t *) pmd_deref(*(pmd)) + pte_index(addr))
diff --git a/arch/s390/include/asm/processor.h b/arch/s390/include/asm/processor.h
index 5b1b247dfbca..72c7b88f8d2c 100644
--- a/arch/s390/include/asm/processor.h
+++ b/arch/s390/include/asm/processor.h
@@ -94,11 +94,11 @@ extern void execve_tail(void);
  */
 
 #define TASK_SIZE_OF(tsk)       (test_tsk_thread_flag(tsk, TIF_31BIT) ? \
-                                        (1UL << 31) : (1UL << 53))
+                                        (1UL << 31) : -PAGE_SIZE)
 #define TASK_UNMAPPED_BASE      (test_thread_flag(TIF_31BIT) ? \
                                         (1UL << 30) : (1UL << 41))
 #define TASK_SIZE               TASK_SIZE_OF(current)
-#define TASK_SIZE_MAX           (1UL << 53)
+#define TASK_SIZE_MAX           (-PAGE_SIZE)
 
 #define STACK_TOP               (test_thread_flag(TIF_31BIT) ? \
                                         (1UL << 31) : (1UL << 42))
diff --git a/arch/s390/include/asm/ptrace.h b/arch/s390/include/asm/ptrace.h
index 99bc456cc26a..853b01245c20 100644
--- a/arch/s390/include/asm/ptrace.h
+++ b/arch/s390/include/asm/ptrace.h
@@ -11,9 +11,11 @@
 
 #define PIF_SYSCALL             0       /* inside a system call */
 #define PIF_PER_TRAP            1       /* deliver sigtrap on return to user */
+#define PIF_SYSCALL_RESTART     2       /* restart the current system call */
 
 #define _PIF_SYSCALL            _BITUL(PIF_SYSCALL)
 #define _PIF_PER_TRAP           _BITUL(PIF_PER_TRAP)
+#define _PIF_SYSCALL_RESTART    _BITUL(PIF_SYSCALL_RESTART)
 
 #ifndef __ASSEMBLY__
 
@@ -24,38 +26,38 @@
                          PSW_MASK_PSTATE | PSW_ASC_PRIMARY)
 
 struct psw_bits {
-        unsigned long      :  1;
-        unsigned long r    :  1; /* PER-Mask */
-        unsigned long      :  3;
-        unsigned long t    :  1; /* DAT Mode */
-        unsigned long i    :  1; /* Input/Output Mask */
-        unsigned long e    :  1; /* External Mask */
-        unsigned long key  :  4; /* PSW Key */
-        unsigned long      :  1;
-        unsigned long m    :  1; /* Machine-Check Mask */
-        unsigned long w    :  1; /* Wait State */
-        unsigned long p    :  1; /* Problem State */
-        unsigned long as   :  2; /* Address Space Control */
-        unsigned long cc   :  2; /* Condition Code */
-        unsigned long pm   :  4; /* Program Mask */
-        unsigned long ri   :  1; /* Runtime Instrumentation */
-        unsigned long      :  6;
-        unsigned long eaba :  2; /* Addressing Mode */
-        unsigned long      : 31;
-        unsigned long ia   : 64; /* Instruction Address */
+        unsigned long        :  1;
+        unsigned long per    :  1; /* PER-Mask */
+        unsigned long        :  3;
+        unsigned long dat    :  1; /* DAT Mode */
+        unsigned long io     :  1; /* Input/Output Mask */
+        unsigned long ext    :  1; /* External Mask */
+        unsigned long key    :  4; /* PSW Key */
+        unsigned long        :  1;
+        unsigned long mcheck :  1; /* Machine-Check Mask */
+        unsigned long wait   :  1; /* Wait State */
+        unsigned long pstate :  1; /* Problem State */
+        unsigned long as     :  2; /* Address Space Control */
+        unsigned long cc     :  2; /* Condition Code */
+        unsigned long pm     :  4; /* Program Mask */
+        unsigned long ri     :  1; /* Runtime Instrumentation */
+        unsigned long        :  6;
+        unsigned long eaba   :  2; /* Addressing Mode */
+        unsigned long        : 31;
+        unsigned long ia     : 64; /* Instruction Address */
 };
 
 enum {
-        PSW_AMODE_24BIT = 0,
-        PSW_AMODE_31BIT = 1,
-        PSW_AMODE_64BIT = 3
+        PSW_BITS_AMODE_24BIT = 0,
+        PSW_BITS_AMODE_31BIT = 1,
+        PSW_BITS_AMODE_64BIT = 3
 };
 
 enum {
-        PSW_AS_PRIMARY   = 0,
-        PSW_AS_ACCREG    = 1,
-        PSW_AS_SECONDARY = 2,
-        PSW_AS_HOME      = 3
+        PSW_BITS_AS_PRIMARY     = 0,
+        PSW_BITS_AS_ACCREG      = 1,
+        PSW_BITS_AS_SECONDARY   = 2,
+        PSW_BITS_AS_HOME        = 3
 };
 
 #define psw_bits(__psw) (*({                    \
diff --git a/arch/s390/include/asm/sigp.h b/arch/s390/include/asm/sigp.h
index 72df5f2de6b0..020a8814d511 100644
--- a/arch/s390/include/asm/sigp.h
+++ b/arch/s390/include/asm/sigp.h
@@ -59,7 +59,7 @@ static inline int __pcpu_sigp(u16 addr, u8 order, unsigned long parm,
         int cc;
 
         cc = ____pcpu_sigp(addr, order, parm, &_status);
-        if (status && cc == 1)
+        if (status && cc == SIGP_CC_STATUS_STORED)
                 *status = _status;
         return cc;
 }
diff --git a/arch/s390/include/asm/sysinfo.h b/arch/s390/include/asm/sysinfo.h
index 73bff45ced55..e784bed6ed7f 100644
--- a/arch/s390/include/asm/sysinfo.h
+++ b/arch/s390/include/asm/sysinfo.h
@@ -146,7 +146,7 @@ extern int topology_max_mnest;
  * Returns the maximum nesting level supported by the cpu topology code.
  * The current maximum level is 4 which is the drawer level.
  */
-static inline int topology_mnest_limit(void)
+static inline unsigned char topology_mnest_limit(void)
 {
         return min(topology_max_mnest, 4);
 }
diff --git a/arch/s390/include/asm/thread_info.h b/arch/s390/include/asm/thread_info.h
index 0b3ee083a665..1aecf432c48d 100644
--- a/arch/s390/include/asm/thread_info.h
+++ b/arch/s390/include/asm/thread_info.h
@@ -58,6 +58,7 @@ int arch_dup_task_struct(struct task_struct *dst, struct task_struct *src);
 #define TIF_UPROBE              3       /* breakpointed or single-stepping */
 #define TIF_GUARDED_STORAGE     4       /* load guarded storage control block */
 #define TIF_PATCH_PENDING       5       /* pending live patching update */
+#define TIF_PGSTE               6       /* New mm's will use 4K page tables */
 
 #define TIF_31BIT               16      /* 32bit process */
 #define TIF_MEMDIE              17      /* is terminating due to OOM killer */
diff --git a/arch/s390/include/asm/tlb.h b/arch/s390/include/asm/tlb.h
index 853b2a3d8dee..7317b3108a88 100644
--- a/arch/s390/include/asm/tlb.h
+++ b/arch/s390/include/asm/tlb.h
@@ -137,6 +137,21 @@ static inline void pmd_free_tlb(struct mmu_gather *tlb, pmd_t *pmd,
 }
 
 /*
+ * p4d_free_tlb frees a pud table and clears the CRSTE for the
+ * region second table entry from the tlb.
+ * If the mm uses a four level page table the single p4d is freed
+ * as the pgd. p4d_free_tlb checks the asce_limit against 8PB
+ * to avoid the double free of the p4d in this case.
+ */
+static inline void p4d_free_tlb(struct mmu_gather *tlb, p4d_t *p4d,
+                                unsigned long address)
+{
+        if (tlb->mm->context.asce_limit <= (1UL << 53))
+                return;
+        tlb_remove_table(tlb, p4d);
+}
+
+/*
  * pud_free_tlb frees a pud table and clears the CRSTE for the
  * region third table entry from the tlb.
  * If the mm uses a three level page table the single pud is freed
diff --git a/arch/s390/kernel/debug.c b/arch/s390/kernel/debug.c
index 530226b6cb19..86b3e74f569e 100644
--- a/arch/s390/kernel/debug.c
+++ b/arch/s390/kernel/debug.c
@@ -277,7 +277,7 @@ debug_info_alloc(const char *name, int pages_per_area, int nr_areas,
         memset(rc->views, 0, DEBUG_MAX_VIEWS * sizeof(struct debug_view *));
         memset(rc->debugfs_entries, 0 ,DEBUG_MAX_VIEWS *
                 sizeof(struct dentry*));
-        atomic_set(&(rc->ref_count), 0);
+        refcount_set(&(rc->ref_count), 0);
 
         return rc;
 
@@ -361,7 +361,7 @@ debug_info_create(const char *name, int pages_per_area, int nr_areas,
         debug_area_last = rc;
         rc->next = NULL;
 
-        debug_info_get(rc);
+        refcount_set(&rc->ref_count, 1);
 out:
         return rc;
 }
@@ -416,7 +416,7 @@ static void
 debug_info_get(debug_info_t * db_info)
 {
         if (db_info)
-                atomic_inc(&db_info->ref_count);
+                refcount_inc(&db_info->ref_count);
 }
 
 /*
@@ -431,7 +431,7 @@ debug_info_put(debug_info_t *db_info)
 
         if (!db_info)
                 return;
-        if (atomic_dec_and_test(&db_info->ref_count)) {
+        if (refcount_dec_and_test(&db_info->ref_count)) {
                 for (i = 0; i < DEBUG_MAX_VIEWS; i++) {
                         if (!db_info->views[i])
                                 continue;
diff --git a/arch/s390/kernel/dumpstack.c b/arch/s390/kernel/dumpstack.c
index 829e1c53005c..dab78babfab6 100644
--- a/arch/s390/kernel/dumpstack.c
+++ b/arch/s390/kernel/dumpstack.c
@@ -98,8 +98,10 @@ static int show_address(void *data, unsigned long address, int reliable)
         return 0;
 }
 
-static void show_trace(struct task_struct *task, unsigned long sp)
+void show_stack(struct task_struct *task, unsigned long *stack)
 {
+        unsigned long sp = (unsigned long) stack;
+
         if (!sp)
                 sp = task ? task->thread.ksp : current_stack_pointer();
         printk("Call Trace:\n");
@@ -109,29 +111,6 @@ static void show_trace(struct task_struct *task, unsigned long sp)
         debug_show_held_locks(task);
 }
 
-void show_stack(struct task_struct *task, unsigned long *sp)
-{
-        unsigned long *stack;
-        int i;
-
-        stack = sp;
-        if (!stack) {
-                if (!task)
-                        stack = (unsigned long *)current_stack_pointer();
-                else
-                        stack = (unsigned long *)task->thread.ksp;
-        }
-        printk(KERN_DEFAULT "Stack:\n");
-        for (i = 0; i < 20; i++) {
-                if (((addr_t) stack & (THREAD_SIZE-1)) == 0)
-                        break;
-                if (i % 4 == 0)
-                        printk(KERN_DEFAULT "       ");
-                pr_cont("%016lx%c", *stack++, i % 4 == 3 ? '\n' : ' ');
-        }
-        show_trace(task, (unsigned long)sp);
-}
-
 static void show_last_breaking_event(struct pt_regs *regs)
 {
         printk("Last Breaking-Event-Address:\n");
@@ -149,8 +128,8 @@ void show_registers(struct pt_regs *regs)
                 pr_cont(" (%pSR)", (void *)regs->psw.addr);
         pr_cont("\n");
         printk("           R:%x T:%x IO:%x EX:%x Key:%x M:%x W:%x "
-               "P:%x AS:%x CC:%x PM:%x", psw->r, psw->t, psw->i, psw->e,
-               psw->key, psw->m, psw->w, psw->p, psw->as, psw->cc, psw->pm);
+               "P:%x AS:%x CC:%x PM:%x", psw->per, psw->dat, psw->io, psw->ext,
+               psw->key, psw->mcheck, psw->wait, psw->pstate, psw->as, psw->cc, psw->pm);
         pr_cont(" RI:%x EA:%x\n", psw->ri, psw->eaba);
         printk("%s GPRS: %016lx %016lx %016lx %016lx\n", mode,
                regs->gprs[0], regs->gprs[1], regs->gprs[2], regs->gprs[3]);
@@ -169,7 +148,7 @@ void show_regs(struct pt_regs *regs)
         show_registers(regs);
         /* Show stack backtrace if pt_regs is from kernel mode */
         if (!user_mode(regs))
-                show_trace(NULL, regs->gprs[15]);
+                show_stack(NULL, (unsigned long *) regs->gprs[15]);
         show_last_breaking_event(regs);
 }
 
diff --git a/arch/s390/kernel/entry.S b/arch/s390/kernel/entry.S
index 9b48196ebf40..21900e1cee9c 100644
--- a/arch/s390/kernel/entry.S
+++ b/arch/s390/kernel/entry.S
@@ -52,7 +52,7 @@ _TIF_TRACE	= (_TIF_SYSCALL_TRACE | _TIF_SYSCALL_AUDIT | _TIF_SECCOMP | \
                    _TIF_SYSCALL_TRACEPOINT)
 _CIF_WORK       = (_CIF_MCCK_PENDING | _CIF_ASCE_PRIMARY | \
                    _CIF_ASCE_SECONDARY | _CIF_FPU)
-_PIF_WORK       = (_PIF_PER_TRAP)
+_PIF_WORK       = (_PIF_PER_TRAP | _PIF_SYSCALL_RESTART)
 
 #define BASED(name) name-cleanup_critical(%r13)
 
@@ -232,12 +232,17 @@ ENTRY(sie64a)
         lctlg   %c1,%c1,__LC_USER_ASCE          # load primary asce
 .Lsie_done:
 # some program checks are suppressing. C code (e.g. do_protection_exception)
-# will rewind the PSW by the ILC, which is 4 bytes in case of SIE. Other
-# instructions between sie64a and .Lsie_done should not cause program
-# interrupts. So lets use a nop (47 00 00 00) as a landing pad.
+# will rewind the PSW by the ILC, which is often 4 bytes in case of SIE. There
+# are some corner cases (e.g. runtime instrumentation) where ILC is unpredictable.
+# Other instructions between sie64a and .Lsie_done should not cause program
+# interrupts. So lets use 3 nops as a landing pad for all possible rewinds.
 # See also .Lcleanup_sie
-.Lrewind_pad:
-        nop     0
+.Lrewind_pad6:
+        nopr    7
+.Lrewind_pad4:
+        nopr    7
+.Lrewind_pad2:
+        nopr    7
         .globl sie_exit
 sie_exit:
         lg      %r14,__SF_EMPTY+8(%r15)         # load guest register save area
@@ -250,7 +255,9 @@ sie_exit:
         stg     %r14,__SF_EMPTY+16(%r15)        # set exit reason code
         j       sie_exit
 
-        EX_TABLE(.Lrewind_pad,.Lsie_fault)
+        EX_TABLE(.Lrewind_pad6,.Lsie_fault)
+        EX_TABLE(.Lrewind_pad4,.Lsie_fault)
+        EX_TABLE(.Lrewind_pad2,.Lsie_fault)
         EX_TABLE(sie_exit,.Lsie_fault)
 EXPORT_SYMBOL(sie64a)
 EXPORT_SYMBOL(sie_exit)
@@ -313,6 +320,7 @@ ENTRY(system_call)
         lg      %r14,__LC_VDSO_PER_CPU
         lmg     %r0,%r10,__PT_R0(%r11)
         mvc     __LC_RETURN_PSW(16),__PT_PSW(%r11)
+.Lsysc_exit_timer:
         stpt    __LC_EXIT_TIMER
         mvc     __VDSO_ECTG_BASE(16,%r14),__LC_EXIT_TIMER
         lmg     %r11,%r15,__PT_R11(%r11)
@@ -327,6 +335,8 @@ ENTRY(system_call)
         jo      .Lsysc_mcck_pending
         TSTMSK  __TI_flags(%r12),_TIF_NEED_RESCHED
         jo      .Lsysc_reschedule
+        TSTMSK  __PT_FLAGS(%r11),_PIF_SYSCALL_RESTART
+        jo      .Lsysc_syscall_restart
 #ifdef CONFIG_UPROBES
         TSTMSK  __TI_flags(%r12),_TIF_UPROBE
         jo      .Lsysc_uprobe_notify
@@ -340,6 +350,8 @@ ENTRY(system_call)
         jo      .Lsysc_patch_pending    # handle live patching just before
                                         # signals and possible syscall restart
 #endif
+        TSTMSK  __PT_FLAGS(%r11),_PIF_SYSCALL_RESTART
+        jo      .Lsysc_syscall_restart
         TSTMSK  __TI_flags(%r12),_TIF_SIGPENDING
         jo      .Lsysc_sigpending
         TSTMSK  __TI_flags(%r12),_TIF_NOTIFY_RESUME
@@ -441,6 +453,15 @@ ENTRY(system_call)
         jg      do_per_trap
 
 #
+# _PIF_SYSCALL_RESTART is set, repeat the current system call
+#
+.Lsysc_syscall_restart:
+        ni      __PT_FLAGS+7(%r11),255-_PIF_SYSCALL_RESTART
+        lmg     %r1,%r7,__PT_R1(%r11)   # load svc arguments
+        lg      %r2,__PT_ORIG_GPR2(%r11)
+        j       .Lsysc_do_svc
+
+#
 # call tracehook_report_syscall_entry/tracehook_report_syscall_exit before
 # and after the system call
 #
@@ -624,6 +645,7 @@ ENTRY(io_int_handler)
         lg      %r14,__LC_VDSO_PER_CPU
         lmg     %r0,%r10,__PT_R0(%r11)
         mvc     __LC_RETURN_PSW(16),__PT_PSW(%r11)
+.Lio_exit_timer:
         stpt    __LC_EXIT_TIMER
         mvc     __VDSO_ECTG_BASE(16,%r14),__LC_EXIT_TIMER
         lmg     %r11,%r15,__PT_R11(%r11)
@@ -873,9 +895,7 @@ ENTRY(save_fpu_regs)
         oi      __LC_CPU_FLAGS+7,_CIF_FPU
         br      %r14
 .Lsave_fpu_regs_end:
-#if IS_ENABLED(CONFIG_KVM)
 EXPORT_SYMBOL(save_fpu_regs)
-#endif
 
 /*
  * Load floating-point controls and floating-point or vector registers.
@@ -1181,15 +1201,23 @@ cleanup_critical:
         br      %r14
 
 .Lcleanup_sysc_restore:
+        # check if stpt has been executed
         clg     %r9,BASED(.Lcleanup_sysc_restore_insn)
+        jh      0f
+        mvc     __LC_EXIT_TIMER(8),__LC_ASYNC_ENTER_TIMER
+        cghi    %r11,__LC_SAVE_AREA_ASYNC
         je      0f
+        mvc     __LC_EXIT_TIMER(8),__LC_MCCK_ENTER_TIMER
+0:      clg     %r9,BASED(.Lcleanup_sysc_restore_insn+8)
+        je      1f
         lg      %r9,24(%r11)            # get saved pointer to pt_regs
         mvc     __LC_RETURN_PSW(16),__PT_PSW(%r9)
         mvc     0(64,%r11),__PT_R8(%r9)
         lmg     %r0,%r7,__PT_R0(%r9)
-0:      lmg     %r8,%r9,__LC_RETURN_PSW
+1:      lmg     %r8,%r9,__LC_RETURN_PSW
         br      %r14
 .Lcleanup_sysc_restore_insn:
+        .quad   .Lsysc_exit_timer
         .quad   .Lsysc_done - 4
 
 .Lcleanup_io_tif:
@@ -1197,15 +1225,20 @@ cleanup_critical:
         br      %r14
 
 .Lcleanup_io_restore:
+        # check if stpt has been executed
         clg     %r9,BASED(.Lcleanup_io_restore_insn)
-        je      0f
+        jh      0f
+        mvc     __LC_EXIT_TIMER(8),__LC_MCCK_ENTER_TIMER
+0:      clg     %r9,BASED(.Lcleanup_io_restore_insn+8)
+        je      1f
         lg      %r9,24(%r11)            # get saved r11 pointer to pt_regs
         mvc     __LC_RETURN_PSW(16),__PT_PSW(%r9)
         mvc     0(64,%r11),__PT_R8(%r9)
         lmg     %r0,%r7,__PT_R0(%r9)
-0:      lmg     %r8,%r9,__LC_RETURN_PSW
+1:      lmg     %r8,%r9,__LC_RETURN_PSW
         br      %r14
 .Lcleanup_io_restore_insn:
+        .quad   .Lio_exit_timer
         .quad   .Lio_done - 4
 
 .Lcleanup_idle:
diff --git a/arch/s390/kernel/ftrace.c b/arch/s390/kernel/ftrace.c
index 27477f34cc0a..d03a6d12c4bd 100644
--- a/arch/s390/kernel/ftrace.c
+++ b/arch/s390/kernel/ftrace.c
@@ -173,6 +173,8 @@ int __init ftrace_dyn_arch_init(void)
         return 0;
 }
 
+#ifdef CONFIG_MODULES
+
 static int __init ftrace_plt_init(void)
 {
         unsigned int *ip;
@@ -191,6 +193,8 @@ static int __init ftrace_plt_init(void)
 }
 device_initcall(ftrace_plt_init);
 
+#endif /* CONFIG_MODULES */
+
 #ifdef CONFIG_FUNCTION_GRAPH_TRACER
 /*
  * Hook the return address and push it in the stack of return addresses
diff --git a/arch/s390/kernel/ipl.c b/arch/s390/kernel/ipl.c
index e545ffe5155a..8e622bb52f7a 100644
--- a/arch/s390/kernel/ipl.c
+++ b/arch/s390/kernel/ipl.c
@@ -564,8 +564,6 @@ static struct kset *ipl_kset;
 
 static void __ipl_run(void *unused)
 {
-        if (MACHINE_IS_LPAR && ipl_info.type == IPL_TYPE_CCW)
-                diag308(DIAG308_LOAD_NORMAL_DUMP, NULL);
         diag308(DIAG308_LOAD_CLEAR, NULL);
         if (MACHINE_IS_VM)
                 __cpcmd("IPL", NULL, 0, NULL);
@@ -1088,10 +1086,7 @@ static void __reipl_run(void *unused)
                 break;
         case REIPL_METHOD_CCW_DIAG:
                 diag308(DIAG308_SET, reipl_block_ccw);
-                if (MACHINE_IS_LPAR)
-                        diag308(DIAG308_LOAD_NORMAL_DUMP, NULL);
-                else
-                        diag308(DIAG308_LOAD_CLEAR, NULL);
+                diag308(DIAG308_LOAD_CLEAR, NULL);
                 break;
         case REIPL_METHOD_FCP_RW_DIAG:
                 diag308(DIAG308_SET, reipl_block_fcp);
diff --git a/arch/s390/kernel/perf_cpum_sf.c b/arch/s390/kernel/perf_cpum_sf.c
index ca960d0370d5..0c82f7903fc7 100644
--- a/arch/s390/kernel/perf_cpum_sf.c
+++ b/arch/s390/kernel/perf_cpum_sf.c
@@ -995,11 +995,11 @@ static int perf_push_sample(struct perf_event *event, struct sf_raw_sample *sfr)
         regs.int_parm = CPU_MF_INT_SF_PRA;
         sde_regs = (struct perf_sf_sde_regs *) &regs.int_parm_long;
 
-        psw_bits(regs.psw).ia = sfr->basic.ia;
-        psw_bits(regs.psw).t  = sfr->basic.T;
-        psw_bits(regs.psw).w  = sfr->basic.W;
-        psw_bits(regs.psw).p  = sfr->basic.P;
-        psw_bits(regs.psw).as = sfr->basic.AS;
+        psw_bits(regs.psw).ia   = sfr->basic.ia;
+        psw_bits(regs.psw).dat  = sfr->basic.T;
+        psw_bits(regs.psw).wait = sfr->basic.W;
+        psw_bits(regs.psw).per  = sfr->basic.P;
+        psw_bits(regs.psw).as   = sfr->basic.AS;
 
         /*
          * Use the hardware provided configuration level to decide if the
diff --git a/arch/s390/kernel/perf_event.c b/arch/s390/kernel/perf_event.c
index 955a7b6fa0a4..93a386f4a3b5 100644
--- a/arch/s390/kernel/perf_event.c
+++ b/arch/s390/kernel/perf_event.c
@@ -245,6 +245,5 @@ ssize_t cpumf_events_sysfs_show(struct device *dev,
         struct perf_pmu_events_attr *pmu_attr;
 
         pmu_attr = container_of(attr, struct perf_pmu_events_attr, attr);
-        return sprintf(page, "event=0x%04llx,name=%s\n",
-                       pmu_attr->id, attr->attr.name);
+        return sprintf(page, "event=0x%04llx\n", pmu_attr->id);
 }
diff --git a/arch/s390/kernel/ptrace.c b/arch/s390/kernel/ptrace.c
index 488c5bb8dc77..252ed61a128b 100644
--- a/arch/s390/kernel/ptrace.c
+++ b/arch/s390/kernel/ptrace.c
@@ -1160,6 +1160,8 @@ static int s390_gs_cb_get(struct task_struct *target,
                 return -ENODEV;
         if (!data)
                 return -ENODATA;
+        if (target == current)
+                save_gs_cb(data);
         return user_regset_copyout(&pos, &count, &kbuf, &ubuf,
                                    data, 0, sizeof(struct gs_cb));
 }
@@ -1170,6 +1172,7 @@ static int s390_gs_cb_set(struct task_struct *target,
                           const void *kbuf, const void __user *ubuf)
 {
         struct gs_cb *data = target->thread.gs_cb;
+        int rc;
 
         if (!MACHINE_HAS_GS)
                 return -ENODEV;
@@ -1177,10 +1180,18 @@ static int s390_gs_cb_set(struct task_struct *target,
                 data = kzalloc(sizeof(*data), GFP_KERNEL);
                 if (!data)
                         return -ENOMEM;
+                data->gsd = 25;
                 target->thread.gs_cb = data;
+                if (target == current)
+                        __ctl_set_bit(2, 4);
+        } else if (target == current) {
+                save_gs_cb(data);
         }
-        return user_regset_copyin(&pos, &count, &kbuf, &ubuf,
-                                  data, 0, sizeof(struct gs_cb));
+        rc = user_regset_copyin(&pos, &count, &kbuf, &ubuf,
+                                data, 0, sizeof(struct gs_cb));
+        if (target == current)
+                restore_gs_cb(data);
+        return rc;
 }
 
 static int s390_gs_bc_get(struct task_struct *target,
diff --git a/arch/s390/kernel/smp.c b/arch/s390/kernel/smp.c
index 363000a77ffc..1020a11a24e5 100644
--- a/arch/s390/kernel/smp.c
+++ b/arch/s390/kernel/smp.c
@@ -26,6 +26,7 @@
 #include <linux/err.h>
 #include <linux/spinlock.h>
 #include <linux/kernel_stat.h>
+#include <linux/kmemleak.h>
 #include <linux/delay.h>
 #include <linux/interrupt.h>
 #include <linux/irqflags.h>
@@ -207,6 +208,8 @@ static int pcpu_alloc_lowcore(struct pcpu *pcpu, int cpu)
                                 kmem_cache_alloc(pcpu_mcesa_cache, GFP_KERNEL);
                         if (!mcesa_origin)
                                 goto out;
+                        /* The pointer is stored with mcesa_bits ORed in */
+                        kmemleak_not_leak((void *) mcesa_origin);
                         mcesa_bits = MACHINE_HAS_GS ? 11 : 0;
                 }
         } else {
diff --git a/arch/s390/kernel/traps.c b/arch/s390/kernel/traps.c
index f787b9d8f54c..442e5423ce3d 100644
--- a/arch/s390/kernel/traps.c
+++ b/arch/s390/kernel/traps.c
@@ -21,6 +21,7 @@
 #include <linux/mm.h>
 #include <linux/slab.h>
 #include <linux/uaccess.h>
+#include <linux/cpu.h>
 #include <asm/fpu/api.h>
 #include "entry.h"
 
diff --git a/arch/s390/kernel/uprobes.c b/arch/s390/kernel/uprobes.c
index 314e0ee3016a..d94baa8db507 100644
--- a/arch/s390/kernel/uprobes.c
+++ b/arch/s390/kernel/uprobes.c
@@ -27,12 +27,12 @@ int arch_uprobe_analyze_insn(struct arch_uprobe *auprobe, struct mm_struct *mm,
 
 int arch_uprobe_pre_xol(struct arch_uprobe *auprobe, struct pt_regs *regs)
 {
-        if (psw_bits(regs->psw).eaba == PSW_AMODE_24BIT)
+        if (psw_bits(regs->psw).eaba == PSW_BITS_AMODE_24BIT)
                 return -EINVAL;
-        if (!is_compat_task() && psw_bits(regs->psw).eaba == PSW_AMODE_31BIT)
+        if (!is_compat_task() && psw_bits(regs->psw).eaba == PSW_BITS_AMODE_31BIT)
                 return -EINVAL;
         clear_pt_regs_flag(regs, PIF_PER_TRAP);
-        auprobe->saved_per = psw_bits(regs->psw).r;
+        auprobe->saved_per = psw_bits(regs->psw).per;
         auprobe->saved_int_code = regs->int_code;
         regs->int_code = UPROBE_TRAP_NR;
         regs->psw.addr = current->utask->xol_vaddr;
@@ -81,7 +81,7 @@ int arch_uprobe_post_xol(struct arch_uprobe *auprobe, struct pt_regs *regs)
 
         clear_tsk_thread_flag(current, TIF_UPROBE_SINGLESTEP);
         update_cr_regs(current);
-        psw_bits(regs->psw).r = auprobe->saved_per;
+        psw_bits(regs->psw).per = auprobe->saved_per;
         regs->int_code = auprobe->saved_int_code;
 
         if (fixup & FIXUP_PSW_NORMAL)
@@ -372,8 +372,8 @@ static void handle_insn_ril(struct arch_uprobe *auprobe, struct pt_regs *regs)
 
 bool arch_uprobe_skip_sstep(struct arch_uprobe *auprobe, struct pt_regs *regs)
 {
-        if ((psw_bits(regs->psw).eaba == PSW_AMODE_24BIT) ||
-            ((psw_bits(regs->psw).eaba == PSW_AMODE_31BIT) &&
+        if ((psw_bits(regs->psw).eaba == PSW_BITS_AMODE_24BIT) ||
+            ((psw_bits(regs->psw).eaba == PSW_BITS_AMODE_31BIT) &&
              !is_compat_task())) {
                 regs->psw.addr = __rewind_psw(regs->psw, UPROBE_SWBP_INSN_SIZE);
                 do_report_trap(regs, SIGILL, ILL_ILLADR, NULL);
diff --git a/arch/s390/kernel/vdso.c b/arch/s390/kernel/vdso.c
index 10516ae3b55e..b89d19f6f2ab 100644
--- a/arch/s390/kernel/vdso.c
+++ b/arch/s390/kernel/vdso.c
@@ -50,6 +50,56 @@ static struct page **vdso64_pagelist;
  */
 unsigned int __read_mostly vdso_enabled = 1;
 
+static int vdso_fault(const struct vm_special_mapping *sm,
+                      struct vm_area_struct *vma, struct vm_fault *vmf)
+{
+        struct page **vdso_pagelist;
+        unsigned long vdso_pages;
+
+        vdso_pagelist = vdso64_pagelist;
+        vdso_pages = vdso64_pages;
+#ifdef CONFIG_COMPAT
+        if (is_compat_task()) {
+                vdso_pagelist = vdso32_pagelist;
+                vdso_pages = vdso32_pages;
+        }
+#endif
+
+        if (vmf->pgoff >= vdso_pages)
+                return VM_FAULT_SIGBUS;
+
+        vmf->page = vdso_pagelist[vmf->pgoff];
+        get_page(vmf->page);
+        return 0;
+}
+
+static int vdso_mremap(const struct vm_special_mapping *sm,
+                       struct vm_area_struct *vma)
+{
+        unsigned long vdso_pages;
+
+        vdso_pages = vdso64_pages;
+#ifdef CONFIG_COMPAT
+        if (is_compat_task())
+                vdso_pages = vdso32_pages;
+#endif
+
+        if ((vdso_pages << PAGE_SHIFT) != vma->vm_end - vma->vm_start)
+                return -EINVAL;
+
+        if (WARN_ON_ONCE(current->mm != vma->vm_mm))
+                return -EFAULT;
+
+        current->mm->context.vdso_base = vma->vm_start;
+        return 0;
+}
+
+static const struct vm_special_mapping vdso_mapping = {
+        .name = "[vdso]",
+        .fault = vdso_fault,
+        .mremap = vdso_mremap,
+};
+
 static int __init vdso_setup(char *s)
 {
         unsigned long val;
@@ -181,7 +231,7 @@ static void vdso_init_cr5(void)
 int arch_setup_additional_pages(struct linux_binprm *bprm, int uses_interp)
 {
         struct mm_struct *mm = current->mm;
-        struct page **vdso_pagelist;
+        struct vm_area_struct *vma;
         unsigned long vdso_pages;
         unsigned long vdso_base;
         int rc;
@@ -194,13 +244,10 @@ int arch_setup_additional_pages(struct linux_binprm *bprm, int uses_interp)
         if (!uses_interp)
                 return 0;
 
-        vdso_pagelist = vdso64_pagelist;
         vdso_pages = vdso64_pages;
 #ifdef CONFIG_COMPAT
-        if (is_compat_task()) {
-                vdso_pagelist = vdso32_pagelist;
+        if (is_compat_task())
                 vdso_pages = vdso32_pages;
-        }
 #endif
         /*
          * vDSO has a problem and was disabled, just don't "enable" it for
@@ -209,8 +256,6 @@ int arch_setup_additional_pages(struct linux_binprm *bprm, int uses_interp)
         if (vdso_pages == 0)
                 return 0;
 
-        current->mm->context.vdso_base = 0;
-
         /*
          * pick a base address for the vDSO in process space. We try to put
          * it at vdso_base which is the "natural" base for it, but we might
@@ -225,13 +270,6 @@ int arch_setup_additional_pages(struct linux_binprm *bprm, int uses_interp)
         }
 
         /*
-         * Put vDSO base into mm struct. We need to do this before calling
-         * install_special_mapping or the perf counter mmap tracking code
-         * will fail to recognise it as a vDSO (since arch_vma_name fails).
-         */
-        current->mm->context.vdso_base = vdso_base;
-
-        /*
          * our vma flags don't have VM_WRITE so by default, the process
          * isn't allowed to write those pages.
          * gdb can break that with ptrace interface, and thus trigger COW
@@ -241,24 +279,23 @@ int arch_setup_additional_pages(struct linux_binprm *bprm, int uses_interp)
          * It's fine to use that for setting breakpoints in the vDSO code
          * pages though.
          */
-        rc = install_special_mapping(mm, vdso_base, vdso_pages << PAGE_SHIFT,
-                                     VM_READ|VM_EXEC|
-                                     VM_MAYREAD|VM_MAYWRITE|VM_MAYEXEC,
-                                     vdso_pagelist);
-        if (rc)
-                current->mm->context.vdso_base = 0;
+        vma = _install_special_mapping(mm, vdso_base, vdso_pages << PAGE_SHIFT,
+                                       VM_READ|VM_EXEC|
+                                       VM_MAYREAD|VM_MAYWRITE|VM_MAYEXEC,
+                                       &vdso_mapping);
+        if (IS_ERR(vma)) {
+                rc = PTR_ERR(vma);
+                goto out_up;
+        }
+
+        current->mm->context.vdso_base = vdso_base;
+        rc = 0;
+
 out_up:
         up_write(&mm->mmap_sem);
         return rc;
 }
 
-const char *arch_vma_name(struct vm_area_struct *vma)
-{
-        if (vma->vm_mm && vma->vm_start == vma->vm_mm->context.vdso_base)
-                return "[vdso]";
-        return NULL;
-}
-
 static int __init vdso_init(void)
 {
         int i;
diff --git a/arch/s390/kernel/vmlinux.lds.S b/arch/s390/kernel/vmlinux.lds.S
index 72307f108c40..6e2c42bd1c3b 100644
--- a/arch/s390/kernel/vmlinux.lds.S
+++ b/arch/s390/kernel/vmlinux.lds.S
@@ -31,8 +31,14 @@ SECTIONS
 {
         . = 0x00000000;
         .text : {
-        _text = .;              /* Text and read-only data */
+                /* Text and read-only data */
                 HEAD_TEXT
+                /*
+                 * E.g. perf doesn't like symbols starting at address zero,
+                 * therefore skip the initial PSW and channel program located
+                 * at address zero and let _text start at 0x200.
+                 */
+        _text = 0x200;
                 TEXT_TEXT
                 SCHED_TEXT
                 CPUIDLE_TEXT
diff --git a/arch/s390/kernel/vtime.c b/arch/s390/kernel/vtime.c
index 072d84ba42a3..dd7178fbb4f3 100644
--- a/arch/s390/kernel/vtime.c
+++ b/arch/s390/kernel/vtime.c
@@ -110,11 +110,10 @@ static inline u64 scale_vtime(u64 vtime)
         return vtime;
 }
 
-static void account_system_index_scaled(struct task_struct *p,
-                                        u64 cputime, u64 scaled,
+static void account_system_index_scaled(struct task_struct *p, u64 cputime,
                                         enum cpu_usage_stat index)
 {
-        p->stimescaled += cputime_to_nsecs(scaled);
+        p->stimescaled += cputime_to_nsecs(scale_vtime(cputime));
         account_system_index_time(p, cputime_to_nsecs(cputime), index);
 }
 
@@ -176,14 +175,11 @@ static int do_account_vtime(struct task_struct *tsk)
         }
 
         if (system)
-                account_system_index_scaled(tsk, system, scale_vtime(system),
-                                            CPUTIME_SYSTEM);
+                account_system_index_scaled(tsk, system, CPUTIME_SYSTEM);
         if (hardirq)
-                account_system_index_scaled(tsk, hardirq, scale_vtime(hardirq),
-                                            CPUTIME_IRQ);
+                account_system_index_scaled(tsk, hardirq, CPUTIME_IRQ);
         if (softirq)
-                account_system_index_scaled(tsk, softirq, scale_vtime(softirq),
-                                            CPUTIME_SOFTIRQ);
+                account_system_index_scaled(tsk, softirq, CPUTIME_SOFTIRQ);
 
         steal = S390_lowcore.steal_timer;
         if ((s64) steal > 0) {
diff --git a/arch/s390/kvm/gaccess.c b/arch/s390/kvm/gaccess.c
index 9da243d94cc3..e0f7d5fc7efd 100644
--- a/arch/s390/kvm/gaccess.c
+++ b/arch/s390/kvm/gaccess.c
@@ -551,26 +551,26 @@ static int get_vcpu_asce(struct kvm_vcpu *vcpu, union asce *asce,
         int rc;
         struct psw_bits psw = psw_bits(vcpu->arch.sie_block->gpsw);
 
-        if (!psw.t) {
+        if (!psw.dat) {
                 asce->val = 0;
                 asce->r = 1;
                 return 0;
         }
 
-        if (mode == GACC_IFETCH)
-                psw.as = psw.as == PSW_AS_HOME ? PSW_AS_HOME : PSW_AS_PRIMARY;
+        if ((mode == GACC_IFETCH) && (psw.as != PSW_BITS_AS_HOME))
+                psw.as = PSW_BITS_AS_PRIMARY;
 
         switch (psw.as) {
-        case PSW_AS_PRIMARY:
+        case PSW_BITS_AS_PRIMARY:
                 asce->val = vcpu->arch.sie_block->gcr[1];
                 return 0;
-        case PSW_AS_SECONDARY:
+        case PSW_BITS_AS_SECONDARY:
                 asce->val = vcpu->arch.sie_block->gcr[7];
                 return 0;
-        case PSW_AS_HOME:
+        case PSW_BITS_AS_HOME:
                 asce->val = vcpu->arch.sie_block->gcr[13];
                 return 0;
-        case PSW_AS_ACCREG:
+        case PSW_BITS_AS_ACCREG:
                 rc = ar_translation(vcpu, asce, ar, mode);
                 if (rc > 0)
                         return trans_exc(vcpu, rc, ga, ar, mode, PROT_TYPE_ALC);
@@ -771,7 +771,7 @@ static int low_address_protection_enabled(struct kvm_vcpu *vcpu,
 
         if (!ctlreg0.lap)
                 return 0;
-        if (psw_bits(*psw).t && asce.p)
+        if (psw_bits(*psw).dat && asce.p)
                 return 0;
         return 1;
 }
@@ -790,7 +790,7 @@ static int guest_page_range(struct kvm_vcpu *vcpu, unsigned long ga, u8 ar,
                         return trans_exc(vcpu, PGM_PROTECTION, ga, ar, mode,
                                          PROT_TYPE_LA);
                 ga &= PAGE_MASK;
-                if (psw_bits(*psw).t) {
+                if (psw_bits(*psw).dat) {
                         rc = guest_translate(vcpu, ga, pages, asce, mode);
                         if (rc < 0)
                                 return rc;
@@ -831,7 +831,7 @@ int access_guest(struct kvm_vcpu *vcpu, unsigned long ga, u8 ar, void *data,
                 pages = vmalloc(nr_pages * sizeof(unsigned long));
         if (!pages)
                 return -ENOMEM;
-        need_ipte_lock = psw_bits(*psw).t && !asce.r;
+        need_ipte_lock = psw_bits(*psw).dat && !asce.r;
         if (need_ipte_lock)
                 ipte_lock(vcpu);
         rc = guest_page_range(vcpu, ga, ar, pages, nr_pages, asce, mode);
@@ -899,7 +899,7 @@ int guest_translate_address(struct kvm_vcpu *vcpu, unsigned long gva, u8 ar,
                                          mode, PROT_TYPE_LA);
         }
 
-        if (psw_bits(*psw).t && !asce.r) {      /* Use DAT? */
+        if (psw_bits(*psw).dat && !asce.r) {    /* Use DAT? */
                 rc = guest_translate(vcpu, gva, gpa, asce, mode);
                 if (rc > 0)
                         return trans_exc(vcpu, rc, gva, 0, mode, PROT_TYPE_DAT);
diff --git a/arch/s390/kvm/gaccess.h b/arch/s390/kvm/gaccess.h
index 7ce47fd36f28..bec42b852246 100644
--- a/arch/s390/kvm/gaccess.h
+++ b/arch/s390/kvm/gaccess.h
@@ -57,9 +57,9 @@ static inline unsigned long kvm_s390_logical_to_effective(struct kvm_vcpu *vcpu,
 {
         psw_t *psw = &vcpu->arch.sie_block->gpsw;
 
-        if (psw_bits(*psw).eaba == PSW_AMODE_64BIT)
+        if (psw_bits(*psw).eaba == PSW_BITS_AMODE_64BIT)
                 return ga;
-        if (psw_bits(*psw).eaba == PSW_AMODE_31BIT)
+        if (psw_bits(*psw).eaba == PSW_BITS_AMODE_31BIT)
                 return ga & ((1UL << 31) - 1);
         return ga & ((1UL << 24) - 1);
 }
diff --git a/arch/s390/kvm/guestdbg.c b/arch/s390/kvm/guestdbg.c
index 23d9a4e12da1..c2e0ddc1356e 100644
--- a/arch/s390/kvm/guestdbg.c
+++ b/arch/s390/kvm/guestdbg.c
@@ -613,15 +613,15 @@ int kvm_s390_handle_per_event(struct kvm_vcpu *vcpu)
                  * instruction. Check primary and home space-switch-event
                  * controls. (theoretically home -> home produced no event)
                  */
-                if (((new_as == PSW_AS_HOME) ^ old_as_is_home(vcpu)) &&
-                     (pssec(vcpu) || hssec(vcpu)))
+                if (((new_as == PSW_BITS_AS_HOME) ^ old_as_is_home(vcpu)) &&
+                    (pssec(vcpu) || hssec(vcpu)))
                         vcpu->arch.sie_block->iprcc = PGM_SPACE_SWITCH;
 
                 /*
                  * PT, PTI, PR, PC instruction operate on primary AS only. Check
                  * if the primary-space-switch-event control was or got set.
                  */
-                if (new_as == PSW_AS_PRIMARY && !old_as_is_home(vcpu) &&
+                if (new_as == PSW_BITS_AS_PRIMARY && !old_as_is_home(vcpu) &&
                     (pssec(vcpu) || old_ssec(vcpu)))
                         vcpu->arch.sie_block->iprcc = PGM_SPACE_SWITCH;
         }
diff --git a/arch/s390/kvm/priv.c b/arch/s390/kvm/priv.c
index c03106c428cf..e53292a89257 100644
--- a/arch/s390/kvm/priv.c
+++ b/arch/s390/kvm/priv.c
@@ -361,7 +361,7 @@ static int handle_sske(struct kvm_vcpu *vcpu)
                 }
         }
         if (m3 & SSKE_MB) {
-                if (psw_bits(vcpu->arch.sie_block->gpsw).eaba == PSW_AMODE_64BIT)
+                if (psw_bits(vcpu->arch.sie_block->gpsw).eaba == PSW_BITS_AMODE_64BIT)
                         vcpu->run->s.regs.gprs[reg2] &= ~PAGE_MASK;
                 else
                         vcpu->run->s.regs.gprs[reg2] &= ~0xfffff000UL;
@@ -374,7 +374,7 @@ static int handle_sske(struct kvm_vcpu *vcpu)
 static int handle_ipte_interlock(struct kvm_vcpu *vcpu)
 {
         vcpu->stat.instruction_ipte_interlock++;
-        if (psw_bits(vcpu->arch.sie_block->gpsw).p)
+        if (psw_bits(vcpu->arch.sie_block->gpsw).pstate)
                 return kvm_s390_inject_program_int(vcpu, PGM_PRIVILEGED_OP);
         wait_event(vcpu->kvm->arch.ipte_wq, !ipte_lock_held(vcpu));
         kvm_s390_retry_instr(vcpu);
@@ -901,7 +901,7 @@ static int handle_pfmf(struct kvm_vcpu *vcpu)
                 /* only support 2G frame size if EDAT2 is available and we are
                    not in 24-bit addressing mode */
                 if (!test_kvm_facility(vcpu->kvm, 78) ||
-                    psw_bits(vcpu->arch.sie_block->gpsw).eaba == PSW_AMODE_24BIT)
+                    psw_bits(vcpu->arch.sie_block->gpsw).eaba == PSW_BITS_AMODE_24BIT)
                         return kvm_s390_inject_program_int(vcpu, PGM_SPECIFICATION);
                 end = (start + (1UL << 31)) & ~((1UL << 31) - 1);
                 break;
@@ -938,7 +938,7 @@ static int handle_pfmf(struct kvm_vcpu *vcpu)
                 start += PAGE_SIZE;
         }
         if (vcpu->run->s.regs.gprs[reg1] & PFMF_FSC) {
-                if (psw_bits(vcpu->arch.sie_block->gpsw).eaba == PSW_AMODE_64BIT) {
+                if (psw_bits(vcpu->arch.sie_block->gpsw).eaba == PSW_BITS_AMODE_64BIT) {
                         vcpu->run->s.regs.gprs[reg2] = end;
                 } else {
                         vcpu->run->s.regs.gprs[reg2] &= ~0xffffffffUL;
diff --git a/arch/s390/lib/probes.c b/arch/s390/lib/probes.c
index ae90e1ae3607..1963ddbf4ab3 100644
--- a/arch/s390/lib/probes.c
+++ b/arch/s390/lib/probes.c
@@ -4,6 +4,7 @@
  *    Copyright IBM Corp. 2014
  */
 
+#include <linux/errno.h>
 #include <asm/kprobes.h>
 #include <asm/dis.h>
 
diff --git a/arch/s390/lib/uaccess.c b/arch/s390/lib/uaccess.c
index 1e5bb2b86c42..b3bd3f23b8e8 100644
--- a/arch/s390/lib/uaccess.c
+++ b/arch/s390/lib/uaccess.c
@@ -337,8 +337,8 @@ long __strncpy_from_user(char *dst, const char __user *src, long size)
                 return 0;
         done = 0;
         do {
-                offset = (size_t)src & ~PAGE_MASK;
-                len = min(size - done, PAGE_SIZE - offset);
+                offset = (size_t)src & (L1_CACHE_BYTES - 1);
+                len = min(size - done, L1_CACHE_BYTES - offset);
                 if (copy_from_user(dst, src, len))
                         return -EFAULT;
                 len_str = strnlen(dst, len);
diff --git a/arch/s390/mm/dump_pagetables.c b/arch/s390/mm/dump_pagetables.c
index 1b553d847140..049c3c455b32 100644
--- a/arch/s390/mm/dump_pagetables.c
+++ b/arch/s390/mm/dump_pagetables.c
@@ -149,7 +149,7 @@ static void walk_pmd_level(struct seq_file *m, struct pg_state *st,
 }
 
 static void walk_pud_level(struct seq_file *m, struct pg_state *st,
-                           pgd_t *pgd, unsigned long addr)
+                           p4d_t *p4d, unsigned long addr)
 {
         unsigned int prot;
         pud_t *pud;
@@ -157,7 +157,7 @@ static void walk_pud_level(struct seq_file *m, struct pg_state *st,
 
         for (i = 0; i < PTRS_PER_PUD && addr < max_addr; i++) {
                 st->current_address = addr;
-                pud = pud_offset(pgd, addr);
+                pud = pud_offset(p4d, addr);
                 if (!pud_none(*pud))
                         if (pud_large(*pud)) {
                                 prot = pud_val(*pud) &
@@ -172,6 +172,23 @@ static void walk_pud_level(struct seq_file *m, struct pg_state *st,
         }
 }
 
+static void walk_p4d_level(struct seq_file *m, struct pg_state *st,
+                           pgd_t *pgd, unsigned long addr)
+{
+        p4d_t *p4d;
+        int i;
+
+        for (i = 0; i < PTRS_PER_P4D && addr < max_addr; i++) {
+                st->current_address = addr;
+                p4d = p4d_offset(pgd, addr);
+                if (!p4d_none(*p4d))
+                        walk_pud_level(m, st, p4d, addr);
+                else
+                        note_page(m, st, _PAGE_INVALID, 2);
+                addr += P4D_SIZE;
+        }
+}
+
 static void walk_pgd_level(struct seq_file *m)
 {
         unsigned long addr = 0;
@@ -184,7 +201,7 @@ static void walk_pgd_level(struct seq_file *m)
                 st.current_address = addr;
                 pgd = pgd_offset_k(addr);
                 if (!pgd_none(*pgd))
-                        walk_pud_level(m, &st, pgd, addr);
+                        walk_p4d_level(m, &st, pgd, addr);
                 else
                         note_page(m, &st, _PAGE_INVALID, 1);
                 addr += PGDIR_SIZE;
diff --git a/arch/s390/mm/fault.c b/arch/s390/mm/fault.c
index 5845d3028ffc..14f25798b001 100644
--- a/arch/s390/mm/fault.c
+++ b/arch/s390/mm/fault.c
@@ -130,7 +130,7 @@ static int bad_address(void *p)
 
 static void dump_pagetable(unsigned long asce, unsigned long address)
 {
-        unsigned long *table = __va(asce & PAGE_MASK);
+        unsigned long *table = __va(asce & _ASCE_ORIGIN);
 
         pr_alert("AS:%016lx ", asce);
         switch (asce & _ASCE_TYPE_MASK) {
diff --git a/arch/s390/mm/gmap.c b/arch/s390/mm/gmap.c
index 7f6db1e6c048..4fb3d3cdb370 100644
--- a/arch/s390/mm/gmap.c
+++ b/arch/s390/mm/gmap.c
@@ -125,7 +125,7 @@ static void gmap_radix_tree_free(struct radix_tree_root *root)
         struct radix_tree_iter iter;
         unsigned long indices[16];
         unsigned long index;
-        void **slot;
+        void __rcu **slot;
         int i, nr;
 
         /* A radix tree is freed by deleting all of its entries */
@@ -150,7 +150,7 @@ static void gmap_rmap_radix_tree_free(struct radix_tree_root *root)
         struct radix_tree_iter iter;
         unsigned long indices[16];
         unsigned long index;
-        void **slot;
+        void __rcu **slot;
         int i, nr;
 
         /* A radix tree is freed by deleting all of its entries */
@@ -537,6 +537,7 @@ int __gmap_link(struct gmap *gmap, unsigned long gaddr, unsigned long vmaddr)
         unsigned long *table;
         spinlock_t *ptl;
         pgd_t *pgd;
+        p4d_t *p4d;
         pud_t *pud;
         pmd_t *pmd;
         int rc;
@@ -573,7 +574,9 @@ int __gmap_link(struct gmap *gmap, unsigned long gaddr, unsigned long vmaddr)
         mm = gmap->mm;
         pgd = pgd_offset(mm, vmaddr);
         VM_BUG_ON(pgd_none(*pgd));
-        pud = pud_offset(pgd, vmaddr);
+        p4d = p4d_offset(pgd, vmaddr);
+        VM_BUG_ON(p4d_none(*p4d));
+        pud = pud_offset(p4d, vmaddr);
         VM_BUG_ON(pud_none(*pud));
         /* large puds cannot yet be handled */
         if (pud_large(*pud))
@@ -1008,7 +1011,7 @@ EXPORT_SYMBOL_GPL(gmap_read_table);
 static inline void gmap_insert_rmap(struct gmap *sg, unsigned long vmaddr,
                                     struct gmap_rmap *rmap)
 {
-        void **slot;
+        void __rcu **slot;
 
         BUG_ON(!gmap_is_shadow(sg));
         slot = radix_tree_lookup_slot(&sg->host_to_rmap, vmaddr >> PAGE_SHIFT);
diff --git a/arch/s390/mm/gup.c b/arch/s390/mm/gup.c
index b7b779c40a5b..8ecc25e760fa 100644
--- a/arch/s390/mm/gup.c
+++ b/arch/s390/mm/gup.c
@@ -166,15 +166,15 @@ static int gup_huge_pud(pud_t *pudp, pud_t pud, unsigned long addr,
         return 1;
 }
 
-static inline int gup_pud_range(pgd_t *pgdp, pgd_t pgd, unsigned long addr,
+static inline int gup_pud_range(p4d_t *p4dp, p4d_t p4d, unsigned long addr,
                 unsigned long end, int write, struct page **pages, int *nr)
 {
         unsigned long next;
         pud_t *pudp, pud;
 
-        pudp = (pud_t *) pgdp;
-        if ((pgd_val(pgd) & _REGION_ENTRY_TYPE_MASK) == _REGION_ENTRY_TYPE_R2)
-                pudp = (pud_t *) pgd_deref(pgd);
+        pudp = (pud_t *) p4dp;
+        if ((p4d_val(p4d) & _REGION_ENTRY_TYPE_MASK) == _REGION_ENTRY_TYPE_R2)
+                pudp = (pud_t *) p4d_deref(p4d);
         pudp += pud_index(addr);
         do {
                 pud = *pudp;
@@ -194,6 +194,29 @@ static inline int gup_pud_range(pgd_t *pgdp, pgd_t pgd, unsigned long addr,
         return 1;
 }
 
+static inline int gup_p4d_range(pgd_t *pgdp, pgd_t pgd, unsigned long addr,
+                unsigned long end, int write, struct page **pages, int *nr)
+{
+        unsigned long next;
+        p4d_t *p4dp, p4d;
+
+        p4dp = (p4d_t *) pgdp;
+        if ((pgd_val(pgd) & _REGION_ENTRY_TYPE_MASK) == _REGION_ENTRY_TYPE_R1)
+                p4dp = (p4d_t *) pgd_deref(pgd);
+        p4dp += p4d_index(addr);
+        do {
+                p4d = *p4dp;
+                barrier();
+                next = p4d_addr_end(addr, end);
+                if (p4d_none(p4d))
+                        return 0;
+                if (!gup_pud_range(p4dp, p4d, addr, next, write, pages, nr))
+                        return 0;
+        } while (p4dp++, addr = next, addr != end);
+
+        return 1;
+}
+
 /*
  * Like get_user_pages_fast() except its IRQ-safe in that it won't fall
  * back to the regular GUP.
@@ -228,7 +251,7 @@ int __get_user_pages_fast(unsigned long start, int nr_pages, int write,
                 next = pgd_addr_end(addr, end);
                 if (pgd_none(pgd))
                         break;
-                if (!gup_pud_range(pgdp, pgd, addr, next, write, pages, &nr))
+                if (!gup_p4d_range(pgdp, pgd, addr, next, write, pages, &nr))
                         break;
         } while (pgdp++, addr = next, addr != end);
         local_irq_restore(flags);
diff --git a/arch/s390/mm/hugetlbpage.c b/arch/s390/mm/hugetlbpage.c
index 9b4050caa4e9..d3a5e39756f6 100644
--- a/arch/s390/mm/hugetlbpage.c
+++ b/arch/s390/mm/hugetlbpage.c
@@ -162,16 +162,20 @@ pte_t *huge_pte_alloc(struct mm_struct *mm,
                         unsigned long addr, unsigned long sz)
 {
         pgd_t *pgdp;
+        p4d_t *p4dp;
         pud_t *pudp;
         pmd_t *pmdp = NULL;
 
         pgdp = pgd_offset(mm, addr);
-        pudp = pud_alloc(mm, pgdp, addr);
-        if (pudp) {
-                if (sz == PUD_SIZE)
-                        return (pte_t *) pudp;
-                else if (sz == PMD_SIZE)
-                        pmdp = pmd_alloc(mm, pudp, addr);
+        p4dp = p4d_alloc(mm, pgdp, addr);
+        if (p4dp) {
+                pudp = pud_alloc(mm, p4dp, addr);
+                if (pudp) {
+                        if (sz == PUD_SIZE)
+                                return (pte_t *) pudp;
+                        else if (sz == PMD_SIZE)
+                                pmdp = pmd_alloc(mm, pudp, addr);
+                }
         }
         return (pte_t *) pmdp;
 }
@@ -179,16 +183,20 @@ pte_t *huge_pte_alloc(struct mm_struct *mm,
 pte_t *huge_pte_offset(struct mm_struct *mm, unsigned long addr)
 {
         pgd_t *pgdp;
+        p4d_t *p4dp;
         pud_t *pudp;
         pmd_t *pmdp = NULL;
 
         pgdp = pgd_offset(mm, addr);
         if (pgd_present(*pgdp)) {
-                pudp = pud_offset(pgdp, addr);
-                if (pud_present(*pudp)) {
-                        if (pud_large(*pudp))
-                                return (pte_t *) pudp;
-                        pmdp = pmd_offset(pudp, addr);
+                p4dp = p4d_offset(pgdp, addr);
+                if (p4d_present(*p4dp)) {
+                        pudp = pud_offset(p4dp, addr);
+                        if (pud_present(*pudp)) {
+                                if (pud_large(*pudp))
+                                        return (pte_t *) pudp;
+                                pmdp = pmd_offset(pudp, addr);
+                        }
                 }
         }
         return (pte_t *) pmdp;
diff --git a/arch/s390/mm/init.c b/arch/s390/mm/init.c
index ee6a1d3d4983..3348e60dd8ad 100644
--- a/arch/s390/mm/init.c
+++ b/arch/s390/mm/init.c
@@ -81,6 +81,7 @@ void __init paging_init(void)
 {
         unsigned long max_zone_pfns[MAX_NR_ZONES];
         unsigned long pgd_type, asce_bits;
+        psw_t psw;
 
         init_mm.pgd = swapper_pg_dir;
         if (VMALLOC_END > (1UL << 42)) {
@@ -100,7 +101,10 @@ void __init paging_init(void)
         __ctl_load(S390_lowcore.kernel_asce, 1, 1);
         __ctl_load(S390_lowcore.kernel_asce, 7, 7);
         __ctl_load(S390_lowcore.kernel_asce, 13, 13);
-        __arch_local_irq_stosm(0x04);
+        psw.mask = __extract_psw();
+        psw_bits(psw).dat = 1;
+        psw_bits(psw).as = PSW_BITS_AS_HOME;
+        __load_psw_mask(psw.mask);
 
         sparse_memory_present_with_active_regions(MAX_NUMNODES);
         sparse_init();
diff --git a/arch/s390/mm/mmap.c b/arch/s390/mm/mmap.c
index b017daed6887..8c5f284044ef 100644
--- a/arch/s390/mm/mmap.c
+++ b/arch/s390/mm/mmap.c
@@ -120,7 +120,7 @@ arch_get_unmapped_area(struct file *filp, unsigned long addr,
 
 check_asce_limit:
         if (addr + len > current->mm->context.asce_limit) {
-                rc = crst_table_upgrade(mm);
+                rc = crst_table_upgrade(mm, addr + len);
                 if (rc)
                         return (unsigned long) rc;
         }
@@ -184,7 +184,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
 
 check_asce_limit:
         if (addr + len > current->mm->context.asce_limit) {
-                rc = crst_table_upgrade(mm);
+                rc = crst_table_upgrade(mm, addr + len);
                 if (rc)
                         return (unsigned long) rc;
         }
diff --git a/arch/s390/mm/pageattr.c b/arch/s390/mm/pageattr.c
index 49e721f3645e..180481589246 100644
--- a/arch/s390/mm/pageattr.c
+++ b/arch/s390/mm/pageattr.c
@@ -229,14 +229,14 @@ static void modify_pud_page(pud_t *pudp, unsigned long addr,
         pgt_set((unsigned long *)pudp, pud_val(new), addr, CRDTE_DTT_REGION3);
 }
 
-static int walk_pud_level(pgd_t *pgd, unsigned long addr, unsigned long end,
+static int walk_pud_level(p4d_t *p4d, unsigned long addr, unsigned long end,
                           unsigned long flags)
 {
         unsigned long next;
         pud_t *pudp;
         int rc = 0;
 
-        pudp = pud_offset(pgd, addr);
+        pudp = pud_offset(p4d, addr);
         do {
                 if (pud_none(*pudp))
                         return -EINVAL;
@@ -259,6 +259,26 @@ static int walk_pud_level(pgd_t *pgd, unsigned long addr, unsigned long end,
         return rc;
 }
 
+static int walk_p4d_level(pgd_t *pgd, unsigned long addr, unsigned long end,
+                          unsigned long flags)
+{
+        unsigned long next;
+        p4d_t *p4dp;
+        int rc = 0;
+
+        p4dp = p4d_offset(pgd, addr);
+        do {
+                if (p4d_none(*p4dp))
+                        return -EINVAL;
+                next = p4d_addr_end(addr, end);
+                rc = walk_pud_level(p4dp, addr, next, flags);
+                p4dp++;
+                addr = next;
+                cond_resched();
+        } while (addr < end && !rc);
+        return rc;
+}
+
 static DEFINE_MUTEX(cpa_mutex);
 
 static int change_page_attr(unsigned long addr, unsigned long end,
@@ -278,7 +298,7 @@ static int change_page_attr(unsigned long addr, unsigned long end,
                 if (pgd_none(*pgdp))
                         break;
                 next = pgd_addr_end(addr, end);
-                rc = walk_pud_level(pgdp, addr, next, flags);
+                rc = walk_p4d_level(pgdp, addr, next, flags);
                 if (rc)
                         break;
                 cond_resched();
@@ -319,6 +339,7 @@ void __kernel_map_pages(struct page *page, int numpages, int enable)
         unsigned long address;
         int nr, i, j;
         pgd_t *pgd;
+        p4d_t *p4d;
         pud_t *pud;
         pmd_t *pmd;
         pte_t *pte;
@@ -326,7 +347,8 @@ void __kernel_map_pages(struct page *page, int numpages, int enable)
         for (i = 0; i < numpages;) {
                 address = page_to_phys(page + i);
                 pgd = pgd_offset_k(address);
-                pud = pud_offset(pgd, address);
+                p4d = p4d_offset(pgd, address);
+                pud = pud_offset(p4d, address);
                 pmd = pmd_offset(pud, address);
                 pte = pte_offset_kernel(pmd, address);
                 nr = (unsigned long)pte >> ilog2(sizeof(long));
diff --git a/arch/s390/mm/pgalloc.c b/arch/s390/mm/pgalloc.c
index f502cbe657af..18918e394ce4 100644
--- a/arch/s390/mm/pgalloc.c
+++ b/arch/s390/mm/pgalloc.c
@@ -76,29 +76,46 @@ static void __crst_table_upgrade(void *arg)
         __tlb_flush_local();
 }
 
-int crst_table_upgrade(struct mm_struct *mm)
+int crst_table_upgrade(struct mm_struct *mm, unsigned long end)
 {
         unsigned long *table, *pgd;
+        int rc, notify;
 
-        /* upgrade should only happen from 3 to 4 levels */
-        BUG_ON(mm->context.asce_limit != (1UL << 42));
-
-        table = crst_table_alloc(mm);
-        if (!table)
+        /* upgrade should only happen from 3 to 4, 3 to 5, or 4 to 5 levels */
+        BUG_ON(mm->context.asce_limit < (1UL << 42));
+        if (end >= TASK_SIZE_MAX)
                 return -ENOMEM;
-
-        spin_lock_bh(&mm->page_table_lock);
-        pgd = (unsigned long *) mm->pgd;
-        crst_table_init(table, _REGION2_ENTRY_EMPTY);
-        pgd_populate(mm, (pgd_t *) table, (pud_t *) pgd);
-        mm->pgd = (pgd_t *) table;
-        mm->context.asce_limit = 1UL << 53;
-        mm->context.asce = __pa(mm->pgd) | _ASCE_TABLE_LENGTH |
-                           _ASCE_USER_BITS | _ASCE_TYPE_REGION2;
-        spin_unlock_bh(&mm->page_table_lock);
-
-        on_each_cpu(__crst_table_upgrade, mm, 0);
-        return 0;
+        rc = 0;
+        notify = 0;
+        while (mm->context.asce_limit < end) {
+                table = crst_table_alloc(mm);
+                if (!table) {
+                        rc = -ENOMEM;
+                        break;
+                }
+                spin_lock_bh(&mm->page_table_lock);
+                pgd = (unsigned long *) mm->pgd;
+                if (mm->context.asce_limit == (1UL << 42)) {
+                        crst_table_init(table, _REGION2_ENTRY_EMPTY);
+                        p4d_populate(mm, (p4d_t *) table, (pud_t *) pgd);
+                        mm->pgd = (pgd_t *) table;
+                        mm->context.asce_limit = 1UL << 53;
+                        mm->context.asce = __pa(mm->pgd) | _ASCE_TABLE_LENGTH |
+                                _ASCE_USER_BITS | _ASCE_TYPE_REGION2;
+                } else {
+                        crst_table_init(table, _REGION1_ENTRY_EMPTY);
+                        pgd_populate(mm, (pgd_t *) table, (p4d_t *) pgd);
+                        mm->pgd = (pgd_t *) table;
+                        mm->context.asce_limit = -PAGE_SIZE;
+                        mm->context.asce = __pa(mm->pgd) | _ASCE_TABLE_LENGTH |
+                                _ASCE_USER_BITS | _ASCE_TYPE_REGION1;
+                }
+                notify = 1;
+                spin_unlock_bh(&mm->page_table_lock);
+        }
+        if (notify)
+                on_each_cpu(__crst_table_upgrade, mm, 0);
+        return rc;
 }
 
 void crst_table_downgrade(struct mm_struct *mm)
@@ -274,7 +291,7 @@ static void __tlb_remove_table(void *_table)
         struct page *page = pfn_to_page(__pa(table) >> PAGE_SHIFT);
 
         switch (mask) {
-        case 0:         /* pmd or pud */
+        case 0:         /* pmd, pud, or p4d */
                 free_pages((unsigned long) table, 2);
                 break;
         case 1:         /* lower 2K of a 4K page table */
diff --git a/arch/s390/mm/pgtable.c b/arch/s390/mm/pgtable.c
index 947b66a5cdba..d4d409ba206b 100644
--- a/arch/s390/mm/pgtable.c
+++ b/arch/s390/mm/pgtable.c
@@ -610,6 +610,7 @@ bool test_and_clear_guest_dirty(struct mm_struct *mm, unsigned long addr)
 {
         spinlock_t *ptl;
         pgd_t *pgd;
+        p4d_t *p4d;
         pud_t *pud;
         pmd_t *pmd;
         pgste_t pgste;
@@ -618,7 +619,10 @@ bool test_and_clear_guest_dirty(struct mm_struct *mm, unsigned long addr)
         bool dirty;
 
         pgd = pgd_offset(mm, addr);
-        pud = pud_alloc(mm, pgd, addr);
+        p4d = p4d_alloc(mm, pgd, addr);
+        if (!p4d)
+                return false;
+        pud = pud_alloc(mm, p4d, addr);
         if (!pud)
                 return false;
         pmd = pmd_alloc(mm, pud, addr);
diff --git a/arch/s390/mm/vmem.c b/arch/s390/mm/vmem.c
index c33c94b4be60..d8398962a723 100644
--- a/arch/s390/mm/vmem.c
+++ b/arch/s390/mm/vmem.c
@@ -38,6 +38,17 @@ static void __ref *vmem_alloc_pages(unsigned int order)
         return (void *) memblock_alloc(size, size);
 }
 
+static inline p4d_t *vmem_p4d_alloc(void)
+{
+        p4d_t *p4d = NULL;
+
+        p4d = vmem_alloc_pages(2);
+        if (!p4d)
+                return NULL;
+        clear_table((unsigned long *) p4d, _REGION2_ENTRY_EMPTY, PAGE_SIZE * 4);
+        return p4d;
+}
+
 static inline pud_t *vmem_pud_alloc(void)
 {
         pud_t *pud = NULL;
@@ -85,6 +96,7 @@ static int vmem_add_mem(unsigned long start, unsigned long size)
         unsigned long end = start + size;
         unsigned long address = start;
         pgd_t *pg_dir;
+        p4d_t *p4_dir;
         pud_t *pu_dir;
         pmd_t *pm_dir;
         pte_t *pt_dir;
@@ -102,12 +114,19 @@ static int vmem_add_mem(unsigned long start, unsigned long size)
         while (address < end) {
                 pg_dir = pgd_offset_k(address);
                 if (pgd_none(*pg_dir)) {
+                        p4_dir = vmem_p4d_alloc();
+                        if (!p4_dir)
+                                goto out;
+                        pgd_populate(&init_mm, pg_dir, p4_dir);
+                }
+                p4_dir = p4d_offset(pg_dir, address);
+                if (p4d_none(*p4_dir)) {
                         pu_dir = vmem_pud_alloc();
                         if (!pu_dir)
                                 goto out;
-                        pgd_populate(&init_mm, pg_dir, pu_dir);
+                        p4d_populate(&init_mm, p4_dir, pu_dir);
                 }
-                pu_dir = pud_offset(pg_dir, address);
+                pu_dir = pud_offset(p4_dir, address);
                 if (MACHINE_HAS_EDAT2 && pud_none(*pu_dir) && address &&
                     !(address & ~PUD_MASK) && (address + PUD_SIZE <= end) &&
                      !debug_pagealloc_enabled()) {
@@ -161,6 +180,7 @@ static void vmem_remove_range(unsigned long start, unsigned long size)
         unsigned long end = start + size;
         unsigned long address = start;
         pgd_t *pg_dir;
+        p4d_t *p4_dir;
         pud_t *pu_dir;
         pmd_t *pm_dir;
         pte_t *pt_dir;
@@ -172,7 +192,12 @@ static void vmem_remove_range(unsigned long start, unsigned long size)
                         address += PGDIR_SIZE;
                         continue;
                 }
-                pu_dir = pud_offset(pg_dir, address);
+                p4_dir = p4d_offset(pg_dir, address);
+                if (p4d_none(*p4_dir)) {
+                        address += P4D_SIZE;
+                        continue;
+                }
+                pu_dir = pud_offset(p4_dir, address);
                 if (pud_none(*pu_dir)) {
                         address += PUD_SIZE;
                         continue;
@@ -213,6 +238,7 @@ int __meminit vmemmap_populate(unsigned long start, unsigned long end, int node)
         unsigned long pgt_prot, sgt_prot;
         unsigned long address = start;
         pgd_t *pg_dir;
+        p4d_t *p4_dir;
         pud_t *pu_dir;
         pmd_t *pm_dir;
         pte_t *pt_dir;
@@ -227,13 +253,21 @@ int __meminit vmemmap_populate(unsigned long start, unsigned long end, int node)
         for (address = start; address < end;) {
                 pg_dir = pgd_offset_k(address);
                 if (pgd_none(*pg_dir)) {
+                        p4_dir = vmem_p4d_alloc();
+                        if (!p4_dir)
+                                goto out;
+                        pgd_populate(&init_mm, pg_dir, p4_dir);
+                }
+
+                p4_dir = p4d_offset(pg_dir, address);
+                if (p4d_none(*p4_dir)) {
                         pu_dir = vmem_pud_alloc();
                         if (!pu_dir)
                                 goto out;
-                        pgd_populate(&init_mm, pg_dir, pu_dir);
+                        p4d_populate(&init_mm, p4_dir, pu_dir);
                 }
 
-                pu_dir = pud_offset(pg_dir, address);
+                pu_dir = pud_offset(p4_dir, address);
                 if (pud_none(*pu_dir)) {
                         pm_dir = vmem_pmd_alloc();
                         if (!pm_dir)
diff --git a/arch/s390/pci/pci.c b/arch/s390/pci/pci.c
index 8051df109db3..7b30af5da222 100644
--- a/arch/s390/pci/pci.c
+++ b/arch/s390/pci/pci.c
@@ -86,6 +86,25 @@ struct zpci_dev *get_zdev_by_fid(u32 fid)
         return zdev;
 }
 
+void zpci_remove_reserved_devices(void)
+{
+        struct zpci_dev *tmp, *zdev;
+        enum zpci_state state;
+        LIST_HEAD(remove);
+
+        spin_lock(&zpci_list_lock);
+        list_for_each_entry_safe(zdev, tmp, &zpci_list, entry) {
+                if (zdev->state == ZPCI_FN_STATE_STANDBY &&
+                    !clp_get_state(zdev->fid, &state) &&
+                    state == ZPCI_FN_STATE_RESERVED)
+                        list_move_tail(&zdev->entry, &remove);
+        }
+        spin_unlock(&zpci_list_lock);
+
+        list_for_each_entry_safe(zdev, tmp, &remove, entry)
+                zpci_remove_device(zdev);
+}
+
 static struct zpci_dev *get_zdev_by_bus(struct pci_bus *bus)
 {
         return (bus && bus->sysdata) ? (struct zpci_dev *) bus->sysdata : NULL;
@@ -108,6 +127,7 @@ static int zpci_set_airq(struct zpci_dev *zdev)
 {
         u64 req = ZPCI_CREATE_REQ(zdev->fh, 0, ZPCI_MOD_FC_REG_INT);
         struct zpci_fib fib = {0};
+        u8 status;
 
         fib.isc = PCI_ISC;
         fib.sum = 1;            /* enable summary notifications */
@@ -117,60 +137,58 @@ static int zpci_set_airq(struct zpci_dev *zdev)
         fib.aisb = (unsigned long) zpci_aisb_iv->vector + (zdev->aisb/64)*8;
         fib.aisbo = zdev->aisb & 63;
 
-        return zpci_mod_fc(req, &fib);
+        return zpci_mod_fc(req, &fib, &status) ? -EIO : 0;
 }
 
-struct mod_pci_args {
-        u64 base;
-        u64 limit;
-        u64 iota;
-        u64 fmb_addr;
-};
-
-static int mod_pci(struct zpci_dev *zdev, int fn, u8 dmaas, struct mod_pci_args *args)
+/* Modify PCI: Unregister adapter interruptions */
+static int zpci_clear_airq(struct zpci_dev *zdev)
 {
-        u64 req = ZPCI_CREATE_REQ(zdev->fh, dmaas, fn);
+        u64 req = ZPCI_CREATE_REQ(zdev->fh, 0, ZPCI_MOD_FC_DEREG_INT);
         struct zpci_fib fib = {0};
+        u8 cc, status;
 
-        fib.pba = args->base;
-        fib.pal = args->limit;
-        fib.iota = args->iota;
-        fib.fmb_addr = args->fmb_addr;
+        cc = zpci_mod_fc(req, &fib, &status);
+        if (cc == 3 || (cc == 1 && status == 24))
+                /* Function already gone or IRQs already deregistered. */
+                cc = 0;
 
-        return zpci_mod_fc(req, &fib);
+        return cc ? -EIO : 0;
 }
 
 /* Modify PCI: Register I/O address translation parameters */
 int zpci_register_ioat(struct zpci_dev *zdev, u8 dmaas,
                        u64 base, u64 limit, u64 iota)
 {
-        struct mod_pci_args args = { base, limit, iota, 0 };
+        u64 req = ZPCI_CREATE_REQ(zdev->fh, dmaas, ZPCI_MOD_FC_REG_IOAT);
+        struct zpci_fib fib = {0};
+        u8 status;
 
         WARN_ON_ONCE(iota & 0x3fff);
-        args.iota |= ZPCI_IOTA_RTTO_FLAG;
-        return mod_pci(zdev, ZPCI_MOD_FC_REG_IOAT, dmaas, &args);
+        fib.pba = base;
+        fib.pal = limit;
+        fib.iota = iota | ZPCI_IOTA_RTTO_FLAG;
+        return zpci_mod_fc(req, &fib, &status) ? -EIO : 0;
 }
 
 /* Modify PCI: Unregister I/O address translation parameters */
 int zpci_unregister_ioat(struct zpci_dev *zdev, u8 dmaas)
 {
-        struct mod_pci_args args = { 0, 0, 0, 0 };
-
-        return mod_pci(zdev, ZPCI_MOD_FC_DEREG_IOAT, dmaas, &args);
-}
-
-/* Modify PCI: Unregister adapter interruptions */
-static int zpci_clear_airq(struct zpci_dev *zdev)
-{
-        struct mod_pci_args args = { 0, 0, 0, 0 };
+        u64 req = ZPCI_CREATE_REQ(zdev->fh, dmaas, ZPCI_MOD_FC_DEREG_IOAT);
+        struct zpci_fib fib = {0};
+        u8 cc, status;
 
-        return mod_pci(zdev, ZPCI_MOD_FC_DEREG_INT, 0, &args);
+        cc = zpci_mod_fc(req, &fib, &status);
+        if (cc == 3) /* Function already gone. */
+                cc = 0;
+        return cc ? -EIO : 0;
 }
 
 /* Modify PCI: Set PCI function measurement parameters */
 int zpci_fmb_enable_device(struct zpci_dev *zdev)
 {
-        struct mod_pci_args args = { 0, 0, 0, 0 };
+        u64 req = ZPCI_CREATE_REQ(zdev->fh, 0, ZPCI_MOD_FC_SET_MEASURE);
+        struct zpci_fib fib = {0};
+        u8 cc, status;
 
         if (zdev->fmb || sizeof(*zdev->fmb) < zdev->fmb_length)
                 return -EINVAL;
@@ -185,25 +203,35 @@ int zpci_fmb_enable_device(struct zpci_dev *zdev)
         atomic64_set(&zdev->mapped_pages, 0);
         atomic64_set(&zdev->unmapped_pages, 0);
 
-        args.fmb_addr = virt_to_phys(zdev->fmb);
-        return mod_pci(zdev, ZPCI_MOD_FC_SET_MEASURE, 0, &args);
+        fib.fmb_addr = virt_to_phys(zdev->fmb);
+        cc = zpci_mod_fc(req, &fib, &status);
+        if (cc) {
+                kmem_cache_free(zdev_fmb_cache, zdev->fmb);
+                zdev->fmb = NULL;
+        }
+        return cc ? -EIO : 0;
 }
 
 /* Modify PCI: Disable PCI function measurement */
 int zpci_fmb_disable_device(struct zpci_dev *zdev)
 {
-        struct mod_pci_args args = { 0, 0, 0, 0 };
-        int rc;
+        u64 req = ZPCI_CREATE_REQ(zdev->fh, 0, ZPCI_MOD_FC_SET_MEASURE);
+        struct zpci_fib fib = {0};
+        u8 cc, status;
 
         if (!zdev->fmb)
                 return -EINVAL;
 
         /* Function measurement is disabled if fmb address is zero */
-        rc = mod_pci(zdev, ZPCI_MOD_FC_SET_MEASURE, 0, &args);
+        cc = zpci_mod_fc(req, &fib, &status);
+        if (cc == 3) /* Function already gone. */
+                cc = 0;
 
-        kmem_cache_free(zdev_fmb_cache, zdev->fmb);
-        zdev->fmb = NULL;
-        return rc;
+        if (!cc) {
+                kmem_cache_free(zdev_fmb_cache, zdev->fmb);
+                zdev->fmb = NULL;
+        }
+        return cc ? -EIO : 0;
 }
 
 static int zpci_cfg_load(struct zpci_dev *zdev, int offset, u32 *val, u8 len)
@@ -372,22 +400,21 @@ int arch_setup_msi_irqs(struct pci_dev *pdev, int nvec, int type)
         struct msi_msg msg;
         int rc, irq;
 
+        zdev->aisb = -1UL;
         if (type == PCI_CAP_ID_MSI && nvec > 1)
                 return 1;
         msi_vecs = min_t(unsigned int, nvec, zdev->max_msi);
 
         /* Allocate adapter summary indicator bit */
-        rc = -EIO;
         aisb = airq_iv_alloc_bit(zpci_aisb_iv);
         if (aisb == -1UL)
-                goto out;
+                return -EIO;
         zdev->aisb = aisb;
 
         /* Create adapter interrupt vector */
-        rc = -ENOMEM;
         zdev->aibv = airq_iv_create(msi_vecs, AIRQ_IV_DATA | AIRQ_IV_BITLOCK);
         if (!zdev->aibv)
-                goto out_si;
+                return -ENOMEM;
 
         /* Wire up shortcut pointer */
         zpci_aibv[aisb] = zdev->aibv;
@@ -398,10 +425,10 @@ int arch_setup_msi_irqs(struct pci_dev *pdev, int nvec, int type)
                 rc = -EIO;
                 irq = irq_alloc_desc(0);        /* Alloc irq on node 0 */
                 if (irq < 0)
-                        goto out_msi;
+                        return -ENOMEM;
                 rc = irq_set_msi_desc(irq, msi);
                 if (rc)
-                        goto out_msi;
+                        return rc;
                 irq_set_chip_and_handler(irq, &zpci_irq_chip,
                                          handle_simple_irq);
                 msg.data = hwirq;
@@ -415,27 +442,9 @@ int arch_setup_msi_irqs(struct pci_dev *pdev, int nvec, int type)
         /* Enable adapter interrupts */
         rc = zpci_set_airq(zdev);
         if (rc)
-                goto out_msi;
+                return rc;
 
         return (msi_vecs == nvec) ? 0 : msi_vecs;
-
-out_msi:
-        for_each_pci_msi_entry(msi, pdev) {
-                if (hwirq-- == 0)
-                        break;
-                irq_set_msi_desc(msi->irq, NULL);
-                irq_free_desc(msi->irq);
-                msi->msg.address_lo = 0;
-                msi->msg.address_hi = 0;
-                msi->msg.data = 0;
-                msi->irq = 0;
-        }
-        zpci_aibv[aisb] = NULL;
-        airq_iv_release(zdev->aibv);
-out_si:
-        airq_iv_free_bit(zpci_aisb_iv, aisb);
-out:
-        return rc;
 }
 
 void arch_teardown_msi_irqs(struct pci_dev *pdev)
@@ -451,6 +460,8 @@ void arch_teardown_msi_irqs(struct pci_dev *pdev)
 
         /* Release MSI interrupts */
         for_each_pci_msi_entry(msi, pdev) {
+                if (!msi->irq)
+                        continue;
                 if (msi->msi_attrib.is_msix)
                         __pci_msix_desc_mask_irq(msi, 1);
                 else
@@ -463,9 +474,15 @@ void arch_teardown_msi_irqs(struct pci_dev *pdev)
                 msi->irq = 0;
         }
 
-        zpci_aibv[zdev->aisb] = NULL;
-        airq_iv_release(zdev->aibv);
-        airq_iv_free_bit(zpci_aisb_iv, zdev->aisb);
+        if (zdev->aisb != -1UL) {
+                zpci_aibv[zdev->aisb] = NULL;
+                airq_iv_free_bit(zpci_aisb_iv, zdev->aisb);
+                zdev->aisb = -1UL;
+        }
+        if (zdev->aibv) {
+                airq_iv_release(zdev->aibv);
+                zdev->aibv = NULL;
+        }
 }
 
 static void zpci_map_resources(struct pci_dev *pdev)
@@ -719,6 +736,16 @@ static int zpci_alloc_domain(struct zpci_dev *zdev)
 {
         if (zpci_unique_uid) {
                 zdev->domain = (u16) zdev->uid;
+                if (zdev->domain >= ZPCI_NR_DEVICES)
+                        return 0;
+
+                spin_lock(&zpci_domain_lock);
+                if (test_bit(zdev->domain, zpci_domain)) {
+                        spin_unlock(&zpci_domain_lock);
+                        return -EEXIST;
+                }
+                set_bit(zdev->domain, zpci_domain);
+                spin_unlock(&zpci_domain_lock);
                 return 0;
         }
 
@@ -735,7 +762,7 @@ static int zpci_alloc_domain(struct zpci_dev *zdev)
 
 static void zpci_free_domain(struct zpci_dev *zdev)
 {
-        if (zpci_unique_uid)
+        if (zdev->domain >= ZPCI_NR_DEVICES)
                 return;
 
         spin_lock(&zpci_domain_lock);
@@ -755,6 +782,7 @@ void pcibios_remove_bus(struct pci_bus *bus)
         list_del(&zdev->entry);
         spin_unlock(&zpci_list_lock);
 
+        zpci_dbg(3, "rem fid:%x\n", zdev->fid);
         kfree(zdev);
 }
 
@@ -847,15 +875,14 @@ out:
         return rc;
 }
 
-void zpci_stop_device(struct zpci_dev *zdev)
+void zpci_remove_device(struct zpci_dev *zdev)
 {
-        zpci_dma_exit_device(zdev);
-        /*
-         * Note: SCLP disables fh via set-pci-fn so don't
-         * do that here.
-         */
+        if (!zdev->bus)
+                return;
+
+        pci_stop_root_bus(zdev->bus);
+        pci_remove_root_bus(zdev->bus);
 }
-EXPORT_SYMBOL_GPL(zpci_stop_device);
 
 int zpci_report_error(struct pci_dev *pdev,
                       struct zpci_report_error_header *report)
diff --git a/arch/s390/pci/pci_clp.c b/arch/s390/pci/pci_clp.c
index 1c3332ac1957..bd534b4d40e3 100644
--- a/arch/s390/pci/pci_clp.c
+++ b/arch/s390/pci/pci_clp.c
@@ -193,12 +193,12 @@ out:
 int clp_add_pci_device(u32 fid, u32 fh, int configured)
 {
         struct zpci_dev *zdev;
-        int rc;
+        int rc = -ENOMEM;
 
         zpci_dbg(3, "add fid:%x, fh:%x, c:%d\n", fid, fh, configured);
         zdev = kzalloc(sizeof(*zdev), GFP_KERNEL);
         if (!zdev)
-                return -ENOMEM;
+                goto error;
 
         zdev->fh = fh;
         zdev->fid = fid;
@@ -219,6 +219,7 @@ int clp_add_pci_device(u32 fid, u32 fh, int configured)
         return 0;
 
 error:
+        zpci_dbg(0, "add fid:%x, rc:%d\n", fid, rc);
         kfree(zdev);
         return rc;
 }
@@ -295,8 +296,8 @@ int clp_disable_fh(struct zpci_dev *zdev)
         return rc;
 }
 
-static int clp_list_pci(struct clp_req_rsp_list_pci *rrb,
-                        void (*cb)(struct clp_fh_list_entry *entry))
+static int clp_list_pci(struct clp_req_rsp_list_pci *rrb, void *data,
+                        void (*cb)(struct clp_fh_list_entry *, void *))
 {
         u64 resume_token = 0;
         int entries, i, rc;
@@ -327,21 +328,13 @@ static int clp_list_pci(struct clp_req_rsp_list_pci *rrb,
 
                 resume_token = rrb->response.resume_token;
                 for (i = 0; i < entries; i++)
-                        cb(&rrb->response.fh_list[i]);
+                        cb(&rrb->response.fh_list[i], data);
         } while (resume_token);
 out:
         return rc;
 }
 
-static void __clp_add(struct clp_fh_list_entry *entry)
-{
-        if (!entry->vendor_id)
-                return;
-
-        clp_add_pci_device(entry->fid, entry->fh, entry->config_state);
-}
-
-static void __clp_rescan(struct clp_fh_list_entry *entry)
+static void __clp_add(struct clp_fh_list_entry *entry, void *data)
 {
         struct zpci_dev *zdev;
 
@@ -349,22 +342,11 @@ static void __clp_rescan(struct clp_fh_list_entry *entry)
                 return;
 
         zdev = get_zdev_by_fid(entry->fid);
-        if (!zdev) {
+        if (!zdev)
                 clp_add_pci_device(entry->fid, entry->fh, entry->config_state);
-                return;
-        }
-
-        if (!entry->config_state) {
-                /*
-                 * The handle is already disabled, that means no iota/irq freeing via
-                 * the firmware interfaces anymore. Need to free resources manually
-                 * (DMA memory, debug, sysfs)...
-                 */
-                zpci_stop_device(zdev);
-        }
 }
 
-static void __clp_update(struct clp_fh_list_entry *entry)
+static void __clp_update(struct clp_fh_list_entry *entry, void *data)
 {
         struct zpci_dev *zdev;
 
@@ -387,7 +369,7 @@ int clp_scan_pci_devices(void)
         if (!rrb)
                 return -ENOMEM;
 
-        rc = clp_list_pci(rrb, __clp_add);
+        rc = clp_list_pci(rrb, NULL, __clp_add);
 
         clp_free_block(rrb);
         return rc;
@@ -398,11 +380,13 @@ int clp_rescan_pci_devices(void)
         struct clp_req_rsp_list_pci *rrb;
         int rc;
 
+        zpci_remove_reserved_devices();
+
         rrb = clp_alloc_block(GFP_KERNEL);
         if (!rrb)
                 return -ENOMEM;
 
-        rc = clp_list_pci(rrb, __clp_rescan);
+        rc = clp_list_pci(rrb, NULL, __clp_add);
 
         clp_free_block(rrb);
         return rc;
@@ -417,7 +401,40 @@ int clp_rescan_pci_devices_simple(void)
         if (!rrb)
                 return -ENOMEM;
 
-        rc = clp_list_pci(rrb, __clp_update);
+        rc = clp_list_pci(rrb, NULL, __clp_update);
+
+        clp_free_block(rrb);
+        return rc;
+}
+
+struct clp_state_data {
+        u32 fid;
+        enum zpci_state state;
+};
+
+static void __clp_get_state(struct clp_fh_list_entry *entry, void *data)
+{
+        struct clp_state_data *sd = data;
+
+        if (entry->fid != sd->fid)
+                return;
+
+        sd->state = entry->config_state;
+}
+
+int clp_get_state(u32 fid, enum zpci_state *state)
+{
+        struct clp_req_rsp_list_pci *rrb;
+        struct clp_state_data sd = {fid, ZPCI_FN_STATE_RESERVED};
+        int rc;
+
+        rrb = clp_alloc_block(GFP_KERNEL);
+        if (!rrb)
+                return -ENOMEM;
+
+        rc = clp_list_pci(rrb, &sd, __clp_get_state);
+        if (!rc)
+                *state = sd.state;
 
         clp_free_block(rrb);
         return rc;
diff --git a/arch/s390/pci/pci_dma.c b/arch/s390/pci/pci_dma.c
index 9081a57fa340..8eb1cc341dab 100644
--- a/arch/s390/pci/pci_dma.c
+++ b/arch/s390/pci/pci_dma.c
@@ -601,7 +601,9 @@ void zpci_dma_exit_device(struct zpci_dev *zdev)
          */
         WARN_ON(zdev->s390_domain);
 
-        zpci_unregister_ioat(zdev, 0);
+        if (zpci_unregister_ioat(zdev, 0))
+                return;
+
         dma_cleanup_tables(zdev->dma_table);
         zdev->dma_table = NULL;
         vfree(zdev->iommu_bitmap);
diff --git a/arch/s390/pci/pci_event.c b/arch/s390/pci/pci_event.c
index c2b27ad8e94d..0bbc04af4418 100644
--- a/arch/s390/pci/pci_event.c
+++ b/arch/s390/pci/pci_event.c
@@ -74,6 +74,7 @@ static void __zpci_event_availability(struct zpci_ccdf_avail *ccdf)
 {
         struct zpci_dev *zdev = get_zdev_by_fid(ccdf->fid);
         struct pci_dev *pdev = NULL;
+        enum zpci_state state;
         int ret;
 
         if (zdev)
@@ -108,6 +109,8 @@ static void __zpci_event_availability(struct zpci_ccdf_avail *ccdf)
                         clp_add_pci_device(ccdf->fid, ccdf->fh, 0);
                 break;
         case 0x0303: /* Deconfiguration requested */
+                if (!zdev)
+                        break;
                 if (pdev)
                         pci_stop_and_remove_bus_device_locked(pdev);
 
@@ -121,7 +124,9 @@ static void __zpci_event_availability(struct zpci_ccdf_avail *ccdf)
                         zdev->state = ZPCI_FN_STATE_STANDBY;
 
                 break;
-        case 0x0304: /* Configured -> Standby */
+        case 0x0304: /* Configured -> Standby|Reserved */
+                if (!zdev)
+                        break;
                 if (pdev) {
                         /* Give the driver a hint that the function is
                          * already unusable. */
@@ -132,6 +137,10 @@ static void __zpci_event_availability(struct zpci_ccdf_avail *ccdf)
                 zdev->fh = ccdf->fh;
                 zpci_disable_device(zdev);
                 zdev->state = ZPCI_FN_STATE_STANDBY;
+                if (!clp_get_state(ccdf->fid, &state) &&
+                    state == ZPCI_FN_STATE_RESERVED) {
+                        zpci_remove_device(zdev);
+                }
                 break;
         case 0x0306: /* 0x308 or 0x302 for multiple devices */
                 clp_rescan_pci_devices();
@@ -139,8 +148,7 @@ static void __zpci_event_availability(struct zpci_ccdf_avail *ccdf)
         case 0x0308: /* Standby -> Reserved */
                 if (!zdev)
                         break;
-                pci_stop_root_bus(zdev->bus);
-                pci_remove_root_bus(zdev->bus);
+                zpci_remove_device(zdev);
                 break;
         default:
                 break;
diff --git a/arch/s390/pci/pci_insn.c b/arch/s390/pci/pci_insn.c
index fa8d7d4b9751..ea34086c8674 100644
--- a/arch/s390/pci/pci_insn.c
+++ b/arch/s390/pci/pci_insn.c
@@ -40,20 +40,20 @@ static inline u8 __mpcifc(u64 req, struct zpci_fib *fib, u8 *status)
         return cc;
 }
 
-int zpci_mod_fc(u64 req, struct zpci_fib *fib)
+u8 zpci_mod_fc(u64 req, struct zpci_fib *fib, u8 *status)
 {
-        u8 cc, status;
+        u8 cc;
 
         do {
-                cc = __mpcifc(req, fib, &status);
+                cc = __mpcifc(req, fib, status);
                 if (cc == 2)
                         msleep(ZPCI_INSN_BUSY_DELAY);
         } while (cc == 2);
 
         if (cc)
-                zpci_err_insn(cc, status, req, 0);
+                zpci_err_insn(cc, *status, req, 0);
 
-        return (cc) ? -EIO : 0;
+        return cc;
 }
 
 /* Refresh PCI Translations */
diff --git a/arch/s390/tools/gen_facilities.c b/arch/s390/tools/gen_facilities.c
index be63fbd699fd..025ea20fc4b4 100644
--- a/arch/s390/tools/gen_facilities.c
+++ b/arch/s390/tools/gen_facilities.c
@@ -34,8 +34,6 @@ static struct facility_def facility_defs[] = {
                         18, /* long displacement facility */
 #endif
 #ifdef CONFIG_HAVE_MARCH_Z9_109_FEATURES
-                        7,  /* stfle */
-                        17, /* message security assist */
                         21, /* extended-immediate facility */
                         25, /* store clock fast */
 #endif
diff --git a/drivers/crypto/Kconfig b/drivers/crypto/Kconfig
index fb1e60f5002e..9c7951bb05ac 100644
--- a/drivers/crypto/Kconfig
+++ b/drivers/crypto/Kconfig
@@ -89,6 +89,20 @@ config PKEY
           requires to have at least one CEX card in coprocessor mode
           available at runtime.
 
+config CRYPTO_PAES_S390
+        tristate "PAES cipher algorithms"
+        depends on S390
+        depends on ZCRYPT
+        depends on PKEY
+        select CRYPTO_ALGAPI
+        select CRYPTO_BLKCIPHER
+        help
+          This is the s390 hardware accelerated implementation of the
+          AES cipher algorithms for use with protected key.
+
+          Select this option if you want to use the paes cipher
+          for example to use protected key encrypted devices.
+
 config CRYPTO_SHA1_S390
         tristate "SHA1 digest algorithm"
         depends on S390
@@ -137,7 +151,6 @@ config CRYPTO_AES_S390
         depends on S390
         select CRYPTO_ALGAPI
         select CRYPTO_BLKCIPHER
-        select PKEY
         help
           This is the s390 hardware accelerated implementation of the
           AES cipher algorithms (FIPS-197).
diff --git a/drivers/edac/amd64_edac.c b/drivers/edac/amd64_edac.c
index 82dab1692264..3aea55698165 100644
--- a/drivers/edac/amd64_edac.c
+++ b/drivers/edac/amd64_edac.c
@@ -782,24 +782,26 @@ static void debug_dump_dramcfg_low(struct amd64_pvt *pvt, u32 dclr, int chan)
 
 static void debug_display_dimm_sizes_df(struct amd64_pvt *pvt, u8 ctrl)
 {
-        u32 *dcsb = ctrl ? pvt->csels[1].csbases : pvt->csels[0].csbases;
-        int dimm, size0, size1;
+        int dimm, size0, size1, cs0, cs1;
 
         edac_printk(KERN_DEBUG, EDAC_MC, "UMC%d chip selects:\n", ctrl);
 
         for (dimm = 0; dimm < 4; dimm++) {
                 size0 = 0;
+                cs0 = dimm * 2;
 
-                if (dcsb[dimm*2] & DCSB_CS_ENABLE)
-                        size0 = pvt->ops->dbam_to_cs(pvt, ctrl, 0, dimm);
+                if (csrow_enabled(cs0, ctrl, pvt))
+                        size0 = pvt->ops->dbam_to_cs(pvt, ctrl, 0, cs0);
 
                 size1 = 0;
-                if (dcsb[dimm*2 + 1] & DCSB_CS_ENABLE)
-                        size1 = pvt->ops->dbam_to_cs(pvt, ctrl, 0, dimm);
+                cs1 = dimm * 2 + 1;
+
+                if (csrow_enabled(cs1, ctrl, pvt))
+                        size1 = pvt->ops->dbam_to_cs(pvt, ctrl, 0, cs1);
 
                 amd64_info(EDAC_MC ": %d: %5dMB %d: %5dMB\n",
-                                dimm * 2,     size0,
-                                dimm * 2 + 1, size1);
+                                cs0,    size0,
+                                cs1,    size1);
         }
 }
 
@@ -2756,26 +2758,22 @@ skip:
  *      encompasses
  *
  */
-static u32 get_csrow_nr_pages(struct amd64_pvt *pvt, u8 dct, int csrow_nr)
+static u32 get_csrow_nr_pages(struct amd64_pvt *pvt, u8 dct, int csrow_nr_orig)
 {
-        u32 cs_mode, nr_pages;
         u32 dbam = dct ? pvt->dbam1 : pvt->dbam0;
+        int csrow_nr = csrow_nr_orig;
+        u32 cs_mode, nr_pages;
 
+        if (!pvt->umc)
+                csrow_nr >>= 1;
 
-        /*
-         * The math on this doesn't look right on the surface because x/2*4 can
-         * be simplified to x*2 but this expression makes use of the fact that
-         * it is integral math where 1/2=0. This intermediate value becomes the
-         * number of bits to shift the DBAM register to extract the proper CSROW
-         * field.
-         */
-        cs_mode = DBAM_DIMM(csrow_nr / 2, dbam);
+        cs_mode = DBAM_DIMM(csrow_nr, dbam);
 
-        nr_pages = pvt->ops->dbam_to_cs(pvt, dct, cs_mode, (csrow_nr / 2))
-                                                           << (20 - PAGE_SHIFT);
+        nr_pages   = pvt->ops->dbam_to_cs(pvt, dct, cs_mode, csrow_nr);
+        nr_pages <<= 20 - PAGE_SHIFT;
 
         edac_dbg(0, "csrow: %d, channel: %d, DBAM idx: %d\n",
-                    csrow_nr, dct,  cs_mode);
+                    csrow_nr_orig, dct,  cs_mode);
         edac_dbg(0, "nr_pages/channel: %u\n", nr_pages);
 
         return nr_pages;
diff --git a/drivers/firmware/efi/efi-pstore.c b/drivers/firmware/efi/efi-pstore.c
index ed3137c1ceb0..ab3a951a17e6 100644
--- a/drivers/firmware/efi/efi-pstore.c
+++ b/drivers/firmware/efi/efi-pstore.c
@@ -155,19 +155,14 @@ static int efi_pstore_scan_sysfs_exit(struct efivar_entry *pos,
  * efi_pstore_sysfs_entry_iter
  *
  * @record: pstore record to pass to callback
- * @pos: entry to begin iterating from
  *
  * You MUST call efivar_enter_iter_begin() before this function, and
  * efivar_entry_iter_end() afterwards.
  *
- * It is possible to begin iteration from an arbitrary entry within
- * the list by passing @pos. @pos is updated on return to point to
- * the next entry of the last one passed to efi_pstore_read_func().
- * To begin iterating from the beginning of the list @pos must be %NULL.
  */
-static int efi_pstore_sysfs_entry_iter(struct pstore_record *record,
-                                       struct efivar_entry **pos)
+static int efi_pstore_sysfs_entry_iter(struct pstore_record *record)
 {
+        struct efivar_entry **pos = (struct efivar_entry **)&record->psi->data;
         struct efivar_entry *entry, *n;
         struct list_head *head = &efivar_sysfs_list;
         int size = 0;
@@ -218,7 +213,6 @@ static int efi_pstore_sysfs_entry_iter(struct pstore_record *record,
  */
 static ssize_t efi_pstore_read(struct pstore_record *record)
 {
-        struct efivar_entry *entry = (struct efivar_entry *)record->psi->data;
         ssize_t size;
 
         record->buf = kzalloc(EFIVARS_DATA_SIZE_MAX, GFP_KERNEL);
@@ -229,7 +223,7 @@ static ssize_t efi_pstore_read(struct pstore_record *record)
                 size = -EINTR;
                 goto out;
         }
-        size = efi_pstore_sysfs_entry_iter(record, &entry);
+        size = efi_pstore_sysfs_entry_iter(record);
         efivar_entry_iter_end();
 
 out:
diff --git a/drivers/net/dsa/mv88e6xxx/chip.c b/drivers/net/dsa/mv88e6xxx/chip.c
index 19581d783d8e..d034d8cd7d22 100644
--- a/drivers/net/dsa/mv88e6xxx/chip.c
+++ b/drivers/net/dsa/mv88e6xxx/chip.c
@@ -849,6 +849,9 @@ static uint64_t _mv88e6xxx_get_ethtool_stat(struct mv88e6xxx_chip *chip,
                 mv88e6xxx_g1_stats_read(chip, reg, &low);
                 if (s->sizeof_stat == 8)
                         mv88e6xxx_g1_stats_read(chip, reg + 1, &high);
+                break;
+        default:
+                return UINT64_MAX;
         }
         value = (((u64)high) << 16) | low;
         return value;
diff --git a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_a0.c b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_a0.c
index 4ee15ff06a44..faeb4935ef3e 100644
--- a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_a0.c
+++ b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_a0.c
@@ -200,29 +200,18 @@ err_exit:
 static int hw_atl_a0_hw_offload_set(struct aq_hw_s *self,
                                     struct aq_nic_cfg_s *aq_nic_cfg)
 {
-        int err = 0;
-
         /* TX checksums offloads*/
         tpo_ipv4header_crc_offload_en_set(self, 1);
         tpo_tcp_udp_crc_offload_en_set(self, 1);
-        if (err < 0)
-                goto err_exit;
 
         /* RX checksums offloads*/
         rpo_ipv4header_crc_offload_en_set(self, 1);
         rpo_tcp_udp_crc_offload_en_set(self, 1);
-        if (err < 0)
-                goto err_exit;
 
         /* LSO offloads*/
         tdm_large_send_offload_en_set(self, 0xFFFFFFFFU);
-        if (err < 0)
-                goto err_exit;
-
-        err = aq_hw_err_from_flags(self);
 
-err_exit:
-        return err;
+        return aq_hw_err_from_flags(self);
 }
 
 static int hw_atl_a0_hw_init_tx_path(struct aq_hw_s *self)
diff --git a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c
index 42150708191d..1bceb7358e5c 100644
--- a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c
+++ b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c
@@ -200,25 +200,18 @@ err_exit:
 static int hw_atl_b0_hw_offload_set(struct aq_hw_s *self,
                                     struct aq_nic_cfg_s *aq_nic_cfg)
 {
-        int err = 0;
         unsigned int i;
 
         /* TX checksums offloads*/
         tpo_ipv4header_crc_offload_en_set(self, 1);
         tpo_tcp_udp_crc_offload_en_set(self, 1);
-        if (err < 0)
-                goto err_exit;
 
         /* RX checksums offloads*/
         rpo_ipv4header_crc_offload_en_set(self, 1);
         rpo_tcp_udp_crc_offload_en_set(self, 1);
-        if (err < 0)
-                goto err_exit;
 
         /* LSO offloads*/
         tdm_large_send_offload_en_set(self, 0xFFFFFFFFU);
-        if (err < 0)
-                goto err_exit;
 
 /* LRO offloads */
         {
@@ -245,10 +238,7 @@ static int hw_atl_b0_hw_offload_set(struct aq_hw_s *self,
 
                 rpo_lro_en_set(self, aq_nic_cfg->is_lro ? 0xFFFFFFFFU : 0U);
         }
-        err = aq_hw_err_from_flags(self);
-
-err_exit:
-        return err;
+        return aq_hw_err_from_flags(self);
 }
 
 static int hw_atl_b0_hw_init_tx_path(struct aq_hw_s *self)
diff --git a/drivers/net/ethernet/mellanox/mlx4/main.c b/drivers/net/ethernet/mellanox/mlx4/main.c
index 703205475524..83aab1e4c8c8 100644
--- a/drivers/net/ethernet/mellanox/mlx4/main.c
+++ b/drivers/net/ethernet/mellanox/mlx4/main.c
@@ -2862,12 +2862,10 @@ static void mlx4_enable_msi_x(struct mlx4_dev *dev)
         int port = 0;
 
         if (msi_x) {
-                int nreq = dev->caps.num_ports * num_online_cpus() + 1;
-
-                nreq = min_t(int, dev->caps.num_eqs - dev->caps.reserved_eqs,
-                             nreq);
-                if (nreq > MAX_MSIX)
-                        nreq = MAX_MSIX;
+                int nreq = min3(dev->caps.num_ports *
+                                (int)num_online_cpus() + 1,
+                                dev->caps.num_eqs - dev->caps.reserved_eqs,
+                                MAX_MSIX);
 
                 entries = kcalloc(nreq, sizeof *entries, GFP_KERNEL);
                 if (!entries)
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en.h b/drivers/net/ethernet/mellanox/mlx5/core/en.h
index 0099a3e397bc..2fd044b23875 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en.h
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en.h
@@ -1003,7 +1003,7 @@ int mlx5e_create_direct_tirs(struct mlx5e_priv *priv);
 void mlx5e_destroy_direct_tirs(struct mlx5e_priv *priv);
 void mlx5e_destroy_rqt(struct mlx5e_priv *priv, struct mlx5e_rqt *rqt);
 
-int mlx5e_create_ttc_table(struct mlx5e_priv *priv, u32 underlay_qpn);
+int mlx5e_create_ttc_table(struct mlx5e_priv *priv);
 void mlx5e_destroy_ttc_table(struct mlx5e_priv *priv);
 
 int mlx5e_create_tis(struct mlx5_core_dev *mdev, int tc,
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c b/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c
index ce7b09d72ff6..8209affa75c3 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c
@@ -794,7 +794,6 @@ static void get_supported(u32 eth_proto_cap,
         ptys2ethtool_supported_port(link_ksettings, eth_proto_cap);
         ptys2ethtool_supported_link(supported, eth_proto_cap);
         ethtool_link_ksettings_add_link_mode(link_ksettings, supported, Pause);
-        ethtool_link_ksettings_add_link_mode(link_ksettings, supported, Asym_Pause);
 }
 
 static void get_advertising(u32 eth_proto_cap, u8 tx_pause,
@@ -804,7 +803,7 @@ static void get_advertising(u32 eth_proto_cap, u8 tx_pause,
         unsigned long *advertising = link_ksettings->link_modes.advertising;
 
         ptys2ethtool_adver_link(advertising, eth_proto_cap);
-        if (tx_pause)
+        if (rx_pause)
                 ethtool_link_ksettings_add_link_mode(link_ksettings, advertising, Pause);
         if (tx_pause ^ rx_pause)
                 ethtool_link_ksettings_add_link_mode(link_ksettings, advertising, Asym_Pause);
@@ -849,6 +848,8 @@ static int mlx5e_get_link_ksettings(struct net_device *netdev,
         struct mlx5e_priv *priv    = netdev_priv(netdev);
         struct mlx5_core_dev *mdev = priv->mdev;
         u32 out[MLX5_ST_SZ_DW(ptys_reg)] = {0};
+        u32 rx_pause = 0;
+        u32 tx_pause = 0;
         u32 eth_proto_cap;
         u32 eth_proto_admin;
         u32 eth_proto_lp;
@@ -871,11 +872,13 @@ static int mlx5e_get_link_ksettings(struct net_device *netdev,
         an_disable_admin = MLX5_GET(ptys_reg, out, an_disable_admin);
         an_status        = MLX5_GET(ptys_reg, out, an_status);
 
+        mlx5_query_port_pause(mdev, &rx_pause, &tx_pause);
+
         ethtool_link_ksettings_zero_link_mode(link_ksettings, supported);
         ethtool_link_ksettings_zero_link_mode(link_ksettings, advertising);
 
         get_supported(eth_proto_cap, link_ksettings);
-        get_advertising(eth_proto_admin, 0, 0, link_ksettings);
+        get_advertising(eth_proto_admin, tx_pause, rx_pause, link_ksettings);
         get_speed_duplex(netdev, eth_proto_oper, link_ksettings);
 
         eth_proto_oper = eth_proto_oper ? eth_proto_oper : eth_proto_cap;
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_fs.c b/drivers/net/ethernet/mellanox/mlx5/core/en_fs.c
index 576d6787b484..53ed58320a24 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_fs.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_fs.c
@@ -800,7 +800,7 @@ void mlx5e_destroy_ttc_table(struct mlx5e_priv *priv)
         mlx5e_destroy_flow_table(&ttc->ft);
 }
 
-int mlx5e_create_ttc_table(struct mlx5e_priv *priv, u32 underlay_qpn)
+int mlx5e_create_ttc_table(struct mlx5e_priv *priv)
 {
         struct mlx5e_ttc_table *ttc = &priv->fs.ttc;
         struct mlx5_flow_table_attr ft_attr = {};
@@ -810,7 +810,6 @@ int mlx5e_create_ttc_table(struct mlx5e_priv *priv, u32 underlay_qpn)
         ft_attr.max_fte = MLX5E_TTC_TABLE_SIZE;
         ft_attr.level = MLX5E_TTC_FT_LEVEL;
         ft_attr.prio = MLX5E_NIC_PRIO;
-        ft_attr.underlay_qpn = underlay_qpn;
 
         ft->t = mlx5_create_flow_table(priv->fs.ns, &ft_attr);
         if (IS_ERR(ft->t)) {
@@ -1147,7 +1146,7 @@ int mlx5e_create_flow_steering(struct mlx5e_priv *priv)
                 priv->netdev->hw_features &= ~NETIF_F_NTUPLE;
         }
 
-        err = mlx5e_create_ttc_table(priv, 0);
+        err = mlx5e_create_ttc_table(priv);
         if (err) {
                 netdev_err(priv->netdev, "Failed to create ttc table, err=%d\n",
                            err);
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
index a61b71b6fff3..41cd22a223dc 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
@@ -2976,7 +2976,7 @@ static int mlx5e_setup_tc(struct net_device *netdev, u8 tc)
         new_channels.params = priv->channels.params;
         new_channels.params.num_tc = tc ? tc : 1;
 
-        if (test_bit(MLX5E_STATE_OPENED, &priv->state)) {
+        if (!test_bit(MLX5E_STATE_OPENED, &priv->state)) {
                 priv->channels.params = new_channels.params;
                 goto out;
         }
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fs_cmd.c b/drivers/net/ethernet/mellanox/mlx5/core/fs_cmd.c
index 19e3d2fc2099..fcec7bedd3cd 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/fs_cmd.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/fs_cmd.c
@@ -40,28 +40,25 @@
 #include "eswitch.h"
 
 int mlx5_cmd_update_root_ft(struct mlx5_core_dev *dev,
-                            struct mlx5_flow_table *ft)
+                            struct mlx5_flow_table *ft, u32 underlay_qpn)
 {
         u32 in[MLX5_ST_SZ_DW(set_flow_table_root_in)]   = {0};
         u32 out[MLX5_ST_SZ_DW(set_flow_table_root_out)] = {0};
 
         if ((MLX5_CAP_GEN(dev, port_type) == MLX5_CAP_PORT_TYPE_IB) &&
-            ft->underlay_qpn == 0)
+            underlay_qpn == 0)
                 return 0;
 
         MLX5_SET(set_flow_table_root_in, in, opcode,
                  MLX5_CMD_OP_SET_FLOW_TABLE_ROOT);
         MLX5_SET(set_flow_table_root_in, in, table_type, ft->type);
         MLX5_SET(set_flow_table_root_in, in, table_id, ft->id);
+        MLX5_SET(set_flow_table_root_in, in, underlay_qpn, underlay_qpn);
         if (ft->vport) {
                 MLX5_SET(set_flow_table_root_in, in, vport_number, ft->vport);
                 MLX5_SET(set_flow_table_root_in, in, other_vport, 1);
         }
 
-        if ((MLX5_CAP_GEN(dev, port_type) == MLX5_CAP_PORT_TYPE_IB) &&
-            ft->underlay_qpn != 0)
-                MLX5_SET(set_flow_table_root_in, in, underlay_qpn, ft->underlay_qpn);
-
         return mlx5_cmd_exec(dev, in, sizeof(in), out, sizeof(out));
 }
 
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fs_cmd.h b/drivers/net/ethernet/mellanox/mlx5/core/fs_cmd.h
index 8fad80688536..0f98a7cf4877 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/fs_cmd.h
+++ b/drivers/net/ethernet/mellanox/mlx5/core/fs_cmd.h
@@ -71,7 +71,8 @@ int mlx5_cmd_delete_fte(struct mlx5_core_dev *dev,
                         unsigned int index);
 
 int mlx5_cmd_update_root_ft(struct mlx5_core_dev *dev,
-                            struct mlx5_flow_table *ft);
+                            struct mlx5_flow_table *ft,
+                            u32 underlay_qpn);
 
 int mlx5_cmd_fc_alloc(struct mlx5_core_dev *dev, u16 *id);
 int mlx5_cmd_fc_free(struct mlx5_core_dev *dev, u16 id);
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c
index b8a176503d38..0e487e8ca634 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c
@@ -650,7 +650,7 @@ static int update_root_ft_create(struct mlx5_flow_table *ft, struct fs_prio
         if (ft->level >= min_level)
                 return 0;
 
-        err = mlx5_cmd_update_root_ft(root->dev, ft);
+        err = mlx5_cmd_update_root_ft(root->dev, ft, root->underlay_qpn);
         if (err)
                 mlx5_core_warn(root->dev, "Update root flow table of id=%u failed\n",
                                ft->id);
@@ -818,8 +818,6 @@ static struct mlx5_flow_table *__mlx5_create_flow_table(struct mlx5_flow_namespa
                 goto unlock_root;
         }
 
-        ft->underlay_qpn = ft_attr->underlay_qpn;
-
         tree_init_node(&ft->node, 1, del_flow_table);
         log_table_sz = ft->max_fte ? ilog2(ft->max_fte) : 0;
         next_ft = find_next_chained_ft(fs_prio);
@@ -1489,7 +1487,8 @@ static int update_root_ft_destroy(struct mlx5_flow_table *ft)
 
         new_root_ft = find_next_ft(ft);
         if (new_root_ft) {
-                int err = mlx5_cmd_update_root_ft(root->dev, new_root_ft);
+                int err = mlx5_cmd_update_root_ft(root->dev, new_root_ft,
+                                                  root->underlay_qpn);
 
                 if (err) {
                         mlx5_core_warn(root->dev, "Update root flow table of id=%u failed\n",
@@ -2062,3 +2061,21 @@ err:
         mlx5_cleanup_fs(dev);
         return err;
 }
+
+int mlx5_fs_add_rx_underlay_qpn(struct mlx5_core_dev *dev, u32 underlay_qpn)
+{
+        struct mlx5_flow_root_namespace *root = dev->priv.steering->root_ns;
+
+        root->underlay_qpn = underlay_qpn;
+        return 0;
+}
+EXPORT_SYMBOL(mlx5_fs_add_rx_underlay_qpn);
+
+int mlx5_fs_remove_rx_underlay_qpn(struct mlx5_core_dev *dev, u32 underlay_qpn)
+{
+        struct mlx5_flow_root_namespace *root = dev->priv.steering->root_ns;
+
+        root->underlay_qpn = 0;
+        return 0;
+}
+EXPORT_SYMBOL(mlx5_fs_remove_rx_underlay_qpn);
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.h b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.h
index 81eafc7b9dd9..990acee6fb09 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.h
+++ b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.h
@@ -118,7 +118,6 @@ struct mlx5_flow_table {
         /* FWD rules that point on this flow table */
         struct list_head                fwd_rules;
         u32                             flags;
-        u32                             underlay_qpn;
 };
 
 struct mlx5_fc_cache {
@@ -195,6 +194,7 @@ struct mlx5_flow_root_namespace {
         struct mlx5_flow_table          *root_ft;
         /* Should be held when chaining flow tables */
         struct mutex                    chain_lock;
+        u32                             underlay_qpn;
 };
 
 int mlx5_init_fc_stats(struct mlx5_core_dev *dev);
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/ipoib.c b/drivers/net/ethernet/mellanox/mlx5/core/ipoib.c
index 019c230da498..cc1858752e70 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/ipoib.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/ipoib.c
@@ -66,6 +66,10 @@ static void mlx5i_init(struct mlx5_core_dev *mdev,
 
         mlx5e_build_nic_params(mdev, &priv->channels.params, profile->max_nch(mdev));
 
+        /* Override RQ params as IPoIB supports only LINKED LIST RQ for now */
+        mlx5e_set_rq_type_params(mdev, &priv->channels.params, MLX5_WQ_TYPE_LINKED_LIST);
+        priv->channels.params.lro_en = false;
+
         mutex_init(&priv->state_lock);
 
         netdev->hw_features    |= NETIF_F_SG;
@@ -156,6 +160,8 @@ out:
 
 static void mlx5i_destroy_underlay_qp(struct mlx5_core_dev *mdev, struct mlx5_core_qp *qp)
 {
+        mlx5_fs_remove_rx_underlay_qpn(mdev, qp->qpn);
+
         mlx5_core_destroy_qp(mdev, qp);
 }
 
@@ -170,6 +176,8 @@ static int mlx5i_init_tx(struct mlx5e_priv *priv)
                 return err;
         }
 
+        mlx5_fs_add_rx_underlay_qpn(priv->mdev, ipriv->qp.qpn);
+
         err = mlx5e_create_tis(priv->mdev, 0 /* tc */, ipriv->qp.qpn, &priv->tisn[0]);
         if (err) {
                 mlx5_core_warn(priv->mdev, "create tis failed, %d\n", err);
@@ -189,7 +197,6 @@ static void mlx5i_cleanup_tx(struct mlx5e_priv *priv)
 
 static int mlx5i_create_flow_steering(struct mlx5e_priv *priv)
 {
-        struct mlx5i_priv *ipriv = priv->ppriv;
         int err;
 
         priv->fs.ns = mlx5_get_flow_namespace(priv->mdev,
@@ -205,7 +212,7 @@ static int mlx5i_create_flow_steering(struct mlx5e_priv *priv)
                 priv->netdev->hw_features &= ~NETIF_F_NTUPLE;
         }
 
-        err = mlx5e_create_ttc_table(priv, ipriv->qp.qpn);
+        err = mlx5e_create_ttc_table(priv);
         if (err) {
                 netdev_err(priv->netdev, "Failed to create ttc table, err=%d\n",
                            err);
diff --git a/drivers/net/ethernet/qlogic/netxen/netxen_nic_ctx.c b/drivers/net/ethernet/qlogic/netxen/netxen_nic_ctx.c
index b8d5270359cd..e30676515529 100644
--- a/drivers/net/ethernet/qlogic/netxen/netxen_nic_ctx.c
+++ b/drivers/net/ethernet/qlogic/netxen/netxen_nic_ctx.c
@@ -247,7 +247,7 @@ nx_fw_cmd_set_mtu(struct netxen_adapter *adapter, int mtu)
         cmd.req.arg3 = 0;
 
         if (recv_ctx->state == NX_HOST_CTX_STATE_ACTIVE)
-                netxen_issue_cmd(adapter, &cmd);
+                rcode = netxen_issue_cmd(adapter, &cmd);
 
         if (rcode != NX_RCODE_SUCCESS)
                 return -EIO;
diff --git a/drivers/net/ethernet/qlogic/qed/qed_init_fw_funcs.c b/drivers/net/ethernet/qlogic/qed/qed_init_fw_funcs.c
index 67200c5498ab..0a8fde629991 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_init_fw_funcs.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_init_fw_funcs.c
@@ -983,7 +983,7 @@ void qed_set_rfs_mode_disable(struct qed_hwfn *p_hwfn,
         memset(&camline, 0, sizeof(union gft_cam_line_union));
         qed_wr(p_hwfn, p_ptt, PRS_REG_GFT_CAM + CAM_LINE_SIZE * pf_id,
                camline.cam_line_mapped.camline);
-        memset(&ramline, 0, sizeof(union gft_cam_line_union));
+        memset(&ramline, 0, sizeof(ramline));
 
         for (i = 0; i < RAM_LINE_SIZE / REG_SIZE; i++) {
                 u32 hw_addr = PRS_REG_GFT_PROFILE_MASK_RAM;
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic.h b/drivers/net/ethernet/qlogic/qlcnic/qlcnic.h
index 49bad00a0f8f..7245b1072518 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic.h
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic.h
@@ -37,8 +37,8 @@
 
 #define _QLCNIC_LINUX_MAJOR 5
 #define _QLCNIC_LINUX_MINOR 3
-#define _QLCNIC_LINUX_SUBVERSION 65
-#define QLCNIC_LINUX_VERSIONID  "5.3.65"
+#define _QLCNIC_LINUX_SUBVERSION 66
+#define QLCNIC_LINUX_VERSIONID  "5.3.66"
 #define QLCNIC_DRV_IDC_VER  0x01
 #define QLCNIC_DRIVER_VERSION  ((_QLCNIC_LINUX_MAJOR << 16) |\
                  (_QLCNIC_LINUX_MINOR << 8) | (_QLCNIC_LINUX_SUBVERSION))
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c
index 718bf58a7da6..4fb68797630e 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c
@@ -3168,6 +3168,40 @@ int qlcnic_83xx_flash_read32(struct qlcnic_adapter *adapter, u32 flash_addr,
         return 0;
 }
 
+void qlcnic_83xx_get_port_type(struct qlcnic_adapter *adapter)
+{
+        struct qlcnic_hardware_context *ahw = adapter->ahw;
+        struct qlcnic_cmd_args cmd;
+        u32 config;
+        int err;
+
+        err = qlcnic_alloc_mbx_args(&cmd, adapter, QLCNIC_CMD_GET_LINK_STATUS);
+        if (err)
+                return;
+
+        err = qlcnic_issue_cmd(adapter, &cmd);
+        if (err) {
+                dev_info(&adapter->pdev->dev,
+                         "Get Link Status Command failed: 0x%x\n", err);
+                goto out;
+        } else {
+                config = cmd.rsp.arg[3];
+
+                switch (QLC_83XX_SFP_MODULE_TYPE(config)) {
+                case QLC_83XX_MODULE_FIBRE_1000BASE_SX:
+                case QLC_83XX_MODULE_FIBRE_1000BASE_LX:
+                case QLC_83XX_MODULE_FIBRE_1000BASE_CX:
+                case QLC_83XX_MODULE_TP_1000BASE_T:
+                        ahw->port_type = QLCNIC_GBE;
+                        break;
+                default:
+                        ahw->port_type = QLCNIC_XGBE;
+                }
+        }
+out:
+        qlcnic_free_mbx_args(&cmd);
+}
+
 int qlcnic_83xx_test_link(struct qlcnic_adapter *adapter)
 {
         u8 pci_func;
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.h b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.h
index 3dfe8e27b51c..b75a81246856 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.h
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.h
@@ -637,6 +637,7 @@ void qlcnic_83xx_get_pauseparam(struct qlcnic_adapter *,
 int qlcnic_83xx_set_pauseparam(struct qlcnic_adapter *,
                                struct ethtool_pauseparam *);
 int qlcnic_83xx_test_link(struct qlcnic_adapter *);
+void qlcnic_83xx_get_port_type(struct qlcnic_adapter *adapter);
 int qlcnic_83xx_reg_test(struct qlcnic_adapter *);
 int qlcnic_83xx_get_regs_len(struct qlcnic_adapter *);
 int qlcnic_83xx_get_registers(struct qlcnic_adapter *, u32 *);
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_ethtool.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_ethtool.c
index 9a869c15d8bf..7f7deeaf1cf0 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_ethtool.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_ethtool.c
@@ -486,6 +486,9 @@ static int qlcnic_set_link_ksettings(struct net_device *dev,
         u32 ret = 0;
         struct qlcnic_adapter *adapter = netdev_priv(dev);
 
+        if (qlcnic_83xx_check(adapter))
+                qlcnic_83xx_get_port_type(adapter);
+
         if (adapter->ahw->port_type != QLCNIC_GBE)
                 return -EOPNOTSUPP;
 
diff --git a/drivers/net/ethernet/qualcomm/qca_spi.c b/drivers/net/ethernet/qualcomm/qca_spi.c
index 513e6c74e199..24ca7df15d07 100644
--- a/drivers/net/ethernet/qualcomm/qca_spi.c
+++ b/drivers/net/ethernet/qualcomm/qca_spi.c
@@ -296,8 +296,9 @@ qcaspi_receive(struct qcaspi *qca)
 
         /* Allocate rx SKB if we don't have one available. */
         if (!qca->rx_skb) {
-                qca->rx_skb = netdev_alloc_skb(net_dev,
-                                               net_dev->mtu + VLAN_ETH_HLEN);
+                qca->rx_skb = netdev_alloc_skb_ip_align(net_dev,
+                                                        net_dev->mtu +
+                                                        VLAN_ETH_HLEN);
                 if (!qca->rx_skb) {
                         netdev_dbg(net_dev, "out of RX resources\n");
                         qca->stats.out_of_mem++;
@@ -377,7 +378,7 @@ qcaspi_receive(struct qcaspi *qca)
                                         qca->rx_skb, qca->rx_skb->dev);
                                 qca->rx_skb->ip_summed = CHECKSUM_UNNECESSARY;
                                 netif_rx_ni(qca->rx_skb);
-                                qca->rx_skb = netdev_alloc_skb(net_dev,
+                                qca->rx_skb = netdev_alloc_skb_ip_align(net_dev,
                                         net_dev->mtu + VLAN_ETH_HLEN);
                                 if (!qca->rx_skb) {
                                         netdev_dbg(net_dev, "out of RX resources\n");
@@ -759,7 +760,8 @@ qcaspi_netdev_init(struct net_device *dev)
         if (!qca->rx_buffer)
                 return -ENOBUFS;
 
-        qca->rx_skb = netdev_alloc_skb(dev, qca->net_dev->mtu + VLAN_ETH_HLEN);
+        qca->rx_skb = netdev_alloc_skb_ip_align(dev, qca->net_dev->mtu +
+                                                VLAN_ETH_HLEN);
         if (!qca->rx_skb) {
                 kfree(qca->rx_buffer);
                 netdev_info(qca->net_dev, "Failed to allocate RX sk_buff.\n");
diff --git a/drivers/net/ethernet/sfc/nic.h b/drivers/net/ethernet/sfc/nic.h
index 7b916aa21bde..4d7fb8af880d 100644
--- a/drivers/net/ethernet/sfc/nic.h
+++ b/drivers/net/ethernet/sfc/nic.h
@@ -18,8 +18,12 @@
 #include "mcdi.h"
 
 enum {
-        EFX_REV_SIENA_A0 = 0,
-        EFX_REV_HUNT_A0 = 1,
+        /* Revisions 0-2 were Falcon A0, A1 and B0 respectively.
+         * They are not supported by this driver but these revision numbers
+         * form part of the ethtool API for register dumping.
+         */
+        EFX_REV_SIENA_A0 = 3,
+        EFX_REV_HUNT_A0 = 4,
 };
 
 static inline int efx_nic_rev(struct efx_nic *efx)
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
index cd8c60132390..a74c481401c4 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
@@ -3725,7 +3725,7 @@ static void sysfs_display_ring(void *head, int size, int extend_desc,
                         ep++;
                 } else {
                         seq_printf(seq, "%d [0x%x]: 0x%x 0x%x 0x%x 0x%x\n",
-                                   i, (unsigned int)virt_to_phys(ep),
+                                   i, (unsigned int)virt_to_phys(p),
                                    le32_to_cpu(p->des0), le32_to_cpu(p->des1),
                                    le32_to_cpu(p->des2), le32_to_cpu(p->des3));
                         p++;
diff --git a/drivers/net/ethernet/sun/ldmvsw.c b/drivers/net/ethernet/sun/ldmvsw.c
index 5a90fed06260..5b56c24b6ed2 100644
--- a/drivers/net/ethernet/sun/ldmvsw.c
+++ b/drivers/net/ethernet/sun/ldmvsw.c
@@ -411,13 +411,14 @@ static int vsw_port_remove(struct vio_dev *vdev)
 
         if (port) {
                 del_timer_sync(&port->vio.timer);
+                del_timer_sync(&port->clean_timer);
 
                 napi_disable(&port->napi);
+                unregister_netdev(port->dev);
 
                 list_del_rcu(&port->list);
 
                 synchronize_rcu();
-                del_timer_sync(&port->clean_timer);
                 spin_lock_irqsave(&port->vp->lock, flags);
                 sunvnet_port_rm_txq_common(port);
                 spin_unlock_irqrestore(&port->vp->lock, flags);
@@ -427,7 +428,6 @@ static int vsw_port_remove(struct vio_dev *vdev)
 
                 dev_set_drvdata(&vdev->dev, NULL);
 
-                unregister_netdev(port->dev);
                 free_netdev(port->dev);
         }
 
diff --git a/drivers/net/ethernet/ti/netcp_core.c b/drivers/net/ethernet/ti/netcp_core.c
index 729a7da90b5b..e6222e535019 100644
--- a/drivers/net/ethernet/ti/netcp_core.c
+++ b/drivers/net/ethernet/ti/netcp_core.c
@@ -1353,9 +1353,10 @@ int netcp_txpipe_open(struct netcp_tx_pipe *tx_pipe)
 
         tx_pipe->dma_channel = knav_dma_open_channel(dev,
                                 tx_pipe->dma_chan_name, &config);
-        if (IS_ERR_OR_NULL(tx_pipe->dma_channel)) {
+        if (IS_ERR(tx_pipe->dma_channel)) {
                 dev_err(dev, "failed opening tx chan(%s)\n",
                         tx_pipe->dma_chan_name);
+                ret = PTR_ERR(tx_pipe->dma_channel);
                 goto err;
         }
 
@@ -1673,9 +1674,10 @@ static int netcp_setup_navigator_resources(struct net_device *ndev)
 
         netcp->rx_channel = knav_dma_open_channel(netcp->netcp_device->device,
                                         netcp->dma_chan_name, &config);
-        if (IS_ERR_OR_NULL(netcp->rx_channel)) {
+        if (IS_ERR(netcp->rx_channel)) {
                 dev_err(netcp->ndev_dev, "failed opening rx chan(%s\n",
                         netcp->dma_chan_name);
+                ret = PTR_ERR(netcp->rx_channel);
                 goto fail;
         }
 
diff --git a/drivers/net/ethernet/ti/netcp_ethss.c b/drivers/net/ethernet/ti/netcp_ethss.c
index 897176fc5043..dd92950a4615 100644
--- a/drivers/net/ethernet/ti/netcp_ethss.c
+++ b/drivers/net/ethernet/ti/netcp_ethss.c
@@ -2651,7 +2651,6 @@ static int gbe_hwtstamp_set(struct gbe_intf *gbe_intf, struct ifreq *ifr)
         case HWTSTAMP_FILTER_NONE:
                 cpts_rx_enable(cpts, 0);
                 break;
-        case HWTSTAMP_FILTER_ALL:
         case HWTSTAMP_FILTER_PTP_V1_L4_EVENT:
         case HWTSTAMP_FILTER_PTP_V1_L4_SYNC:
         case HWTSTAMP_FILTER_PTP_V1_L4_DELAY_REQ:
diff --git a/drivers/net/irda/irda-usb.c b/drivers/net/irda/irda-usb.c
index 8716b8c07feb..6f3c805f7211 100644
--- a/drivers/net/irda/irda-usb.c
+++ b/drivers/net/irda/irda-usb.c
@@ -1077,7 +1077,7 @@ static int stir421x_patch_device(struct irda_usb_cb *self)
          * are "42101001.sb" or "42101002.sb"
          */
         sprintf(stir421x_fw_name, "4210%4X.sb",
-                self->usbdev->descriptor.bcdDevice);
+                le16_to_cpu(self->usbdev->descriptor.bcdDevice));
         ret = request_firmware(&fw, stir421x_fw_name, &self->usbdev->dev);
         if (ret < 0)
                 return ret;
diff --git a/drivers/net/macvlan.c b/drivers/net/macvlan.c
index b34eaaae03fd..346ad2ff3998 100644
--- a/drivers/net/macvlan.c
+++ b/drivers/net/macvlan.c
@@ -789,10 +789,12 @@ static int macvlan_change_mtu(struct net_device *dev, int new_mtu)
  */
 static struct lock_class_key macvlan_netdev_addr_lock_key;
 
-#define ALWAYS_ON_FEATURES \
-        (NETIF_F_SG | NETIF_F_HW_CSUM | NETIF_F_GSO_SOFTWARE | NETIF_F_LLTX | \
+#define ALWAYS_ON_OFFLOADS \
+        (NETIF_F_SG | NETIF_F_HW_CSUM | NETIF_F_GSO_SOFTWARE | \
          NETIF_F_GSO_ROBUST)
 
+#define ALWAYS_ON_FEATURES (ALWAYS_ON_OFFLOADS | NETIF_F_LLTX)
+
 #define MACVLAN_FEATURES \
         (NETIF_F_SG | NETIF_F_HW_CSUM | NETIF_F_HIGHDMA | NETIF_F_FRAGLIST | \
          NETIF_F_GSO | NETIF_F_TSO | NETIF_F_UFO | NETIF_F_LRO | \
@@ -827,6 +829,7 @@ static int macvlan_init(struct net_device *dev)
         dev->features           |= ALWAYS_ON_FEATURES;
         dev->hw_features        |= NETIF_F_LRO;
         dev->vlan_features      = lowerdev->vlan_features & MACVLAN_FEATURES;
+        dev->vlan_features      |= ALWAYS_ON_OFFLOADS;
         dev->gso_max_size       = lowerdev->gso_max_size;
         dev->gso_max_segs       = lowerdev->gso_max_segs;
         dev->hard_header_len    = lowerdev->hard_header_len;
diff --git a/drivers/net/phy/mdio-mux.c b/drivers/net/phy/mdio-mux.c
index 963838d4fac1..599ce24c514f 100644
--- a/drivers/net/phy/mdio-mux.c
+++ b/drivers/net/phy/mdio-mux.c
@@ -122,10 +122,9 @@ int mdio_mux_init(struct device *dev,
         pb = devm_kzalloc(dev, sizeof(*pb), GFP_KERNEL);
         if (pb == NULL) {
                 ret_val = -ENOMEM;
-                goto err_parent_bus;
+                goto err_pb_kz;
         }
 
-
         pb->switch_data = data;
         pb->switch_fn = switch_fn;
         pb->current_child = -1;
@@ -154,6 +153,7 @@ int mdio_mux_init(struct device *dev,
                 cb->mii_bus = mdiobus_alloc();
                 if (!cb->mii_bus) {
                         ret_val = -ENOMEM;
+                        devm_kfree(dev, cb);
                         of_node_put(child_bus_node);
                         break;
                 }
@@ -170,7 +170,6 @@ int mdio_mux_init(struct device *dev,
                         mdiobus_free(cb->mii_bus);
                         devm_kfree(dev, cb);
                 } else {
-                        of_node_get(child_bus_node);
                         cb->next = pb->children;
                         pb->children = cb;
                 }
@@ -181,9 +180,11 @@ int mdio_mux_init(struct device *dev,
                 return 0;
         }
 
+        devm_kfree(dev, pb);
+err_pb_kz:
         /* balance the reference of_mdio_find_bus() took */
-        put_device(&pb->mii_bus->dev);
-
+        if (!mux_bus)
+                put_device(&parent_bus->dev);
 err_parent_bus:
         of_node_put(parent_bus_node);
         return ret_val;
diff --git a/drivers/net/phy/mdio_bus.c b/drivers/net/phy/mdio_bus.c
index a898e5c4ef1b..8e73f5f36e71 100644
--- a/drivers/net/phy/mdio_bus.c
+++ b/drivers/net/phy/mdio_bus.c
@@ -364,9 +364,6 @@ int __mdiobus_register(struct mii_bus *bus, struct module *owner)
 
         mutex_init(&bus->mdio_lock);
 
-        if (bus->reset)
-                bus->reset(bus);
-
         /* de-assert bus level PHY GPIO resets */
         if (bus->num_reset_gpios > 0) {
                 bus->reset_gpiod = devm_kcalloc(&bus->dev,
@@ -396,6 +393,9 @@ int __mdiobus_register(struct mii_bus *bus, struct module *owner)
                 }
         }
 
+        if (bus->reset)
+                bus->reset(bus);
+
         for (i = 0; i < PHY_MAX_ADDR; i++) {
                 if ((bus->phy_mask & (1 << i)) == 0) {
                         struct phy_device *phydev;
diff --git a/drivers/net/usb/ch9200.c b/drivers/net/usb/ch9200.c
index c4f1c363e24b..9df3c1ffff35 100644
--- a/drivers/net/usb/ch9200.c
+++ b/drivers/net/usb/ch9200.c
@@ -310,8 +310,8 @@ static int get_mac_address(struct usbnet *dev, unsigned char *data)
         int rd_mac_len = 0;
 
         netdev_dbg(dev->net, "get_mac_address:\n\tusbnet VID:%0x PID:%0x\n",
-                   dev->udev->descriptor.idVendor,
-                   dev->udev->descriptor.idProduct);
+                   le16_to_cpu(dev->udev->descriptor.idVendor),
+                   le16_to_cpu(dev->udev->descriptor.idProduct));
 
         memset(mac_addr, 0, sizeof(mac_addr));
         rd_mac_len = control_read(dev, REQUEST_READ, 0,
diff --git a/drivers/net/vmxnet3/vmxnet3_drv.c b/drivers/net/vmxnet3/vmxnet3_drv.c
index 25bc764ae7dc..d1c7029ded7c 100644
--- a/drivers/net/vmxnet3/vmxnet3_drv.c
+++ b/drivers/net/vmxnet3/vmxnet3_drv.c
@@ -2962,6 +2962,11 @@ vmxnet3_force_close(struct vmxnet3_adapter *adapter)
         /* we need to enable NAPI, otherwise dev_close will deadlock */
         for (i = 0; i < adapter->num_rx_queues; i++)
                 napi_enable(&adapter->rx_queue[i].napi);
+        /*
+         * Need to clear the quiesce bit to ensure that vmxnet3_close
+         * can quiesce the device properly
+         */
+        clear_bit(VMXNET3_STATE_BIT_QUIESCED, &adapter->state);
         dev_close(adapter->netdev);
 }
 
diff --git a/drivers/net/vrf.c b/drivers/net/vrf.c
index ceda5861da78..db882493875c 100644
--- a/drivers/net/vrf.c
+++ b/drivers/net/vrf.c
@@ -989,6 +989,7 @@ static u32 vrf_fib_table(const struct net_device *dev)
 
 static int vrf_rcv_finish(struct net *net, struct sock *sk, struct sk_buff *skb)
 {
+        kfree_skb(skb);
         return 0;
 }
 
@@ -998,7 +999,7 @@ static struct sk_buff *vrf_rcv_nfhook(u8 pf, unsigned int hook,
 {
         struct net *net = dev_net(dev);
 
-        if (NF_HOOK(pf, hook, net, NULL, skb, dev, NULL, vrf_rcv_finish) < 0)
+        if (nf_hook(pf, hook, net, NULL, skb, dev, NULL, vrf_rcv_finish) != 1)
                 skb = NULL;    /* kfree_skb(skb) handled by nf code */
 
         return skb;
diff --git a/drivers/net/xen-netfront.c b/drivers/net/xen-netfront.c
index 6ffc482550c1..7b61adb6270c 100644
--- a/drivers/net/xen-netfront.c
+++ b/drivers/net/xen-netfront.c
@@ -1934,8 +1934,7 @@ abort_transaction_no_dev_fatal:
         xennet_disconnect_backend(info);
         xennet_destroy_queues(info);
  out:
-        unregister_netdev(info->netdev);
-        xennet_free_netdev(info->netdev);
+        device_unregister(&dev->dev);
         return err;
 }
 
diff --git a/drivers/s390/block/Kconfig b/drivers/s390/block/Kconfig
index 0acb8c2f9475..31f014b57bfc 100644
--- a/drivers/s390/block/Kconfig
+++ b/drivers/s390/block/Kconfig
@@ -82,10 +82,3 @@ config SCM_BLOCK
 
           To compile this driver as a module, choose M here: the
           module will be called scm_block.
-
-config SCM_BLOCK_CLUSTER_WRITE
-        def_bool y
-        prompt "SCM force cluster writes"
-        depends on SCM_BLOCK
-        help
-          Force writes to Storage Class Memory (SCM) to be in done in clusters.
diff --git a/drivers/s390/block/Makefile b/drivers/s390/block/Makefile
index c2f4e673e031..b64e2b32c753 100644
--- a/drivers/s390/block/Makefile
+++ b/drivers/s390/block/Makefile
@@ -19,7 +19,4 @@ obj-$(CONFIG_BLK_DEV_XPRAM) += xpram.o
 obj-$(CONFIG_DCSSBLK) += dcssblk.o
 
 scm_block-objs := scm_drv.o scm_blk.o
-ifdef CONFIG_SCM_BLOCK_CLUSTER_WRITE
-scm_block-objs += scm_blk_cluster.o
-endif
 obj-$(CONFIG_SCM_BLOCK) += scm_block.o
diff --git a/drivers/s390/block/dasd.c b/drivers/s390/block/dasd.c
index 6fb3fd5efc11..c72ac57940f4 100644
--- a/drivers/s390/block/dasd.c
+++ b/drivers/s390/block/dasd.c
@@ -1965,8 +1965,12 @@ static int __dasd_device_is_unusable(struct dasd_device *device,
 {
         int mask = ~(DASD_STOPPED_DC_WAIT | DASD_UNRESUMED_PM);
 
-        if (test_bit(DASD_FLAG_OFFLINE, &device->flags)) {
-                /* dasd is being set offline. */
+        if (test_bit(DASD_FLAG_OFFLINE, &device->flags) &&
+            !test_bit(DASD_FLAG_SAFE_OFFLINE_RUNNING, &device->flags)) {
+                /*
+                 * dasd is being set offline
+                 * but it is no safe offline where we have to allow I/O
+                 */
                 return 1;
         }
         if (device->stopped) {
@@ -3562,57 +3566,69 @@ int dasd_generic_set_offline(struct ccw_device *cdev)
                         else
                                 pr_warn("%s: The DASD cannot be set offline while it is in use\n",
                                         dev_name(&cdev->dev));
-                        clear_bit(DASD_FLAG_OFFLINE, &device->flags);
-                        goto out_busy;
+                        rc = -EBUSY;
+                        goto out_err;
                 }
         }
 
-        if (test_bit(DASD_FLAG_SAFE_OFFLINE_RUNNING, &device->flags)) {
-                /*
-                 * safe offline already running
-                 * could only be called by normal offline so safe_offline flag
-                 * needs to be removed to run normal offline and kill all I/O
-                 */
-                if (test_and_set_bit(DASD_FLAG_OFFLINE, &device->flags))
-                        /* Already doing normal offline processing */
-                        goto out_busy;
-                else
-                        clear_bit(DASD_FLAG_SAFE_OFFLINE, &device->flags);
-        } else {
-                if (test_bit(DASD_FLAG_OFFLINE, &device->flags))
-                        /* Already doing offline processing */
-                        goto out_busy;
+        /*
+         * Test if the offline processing is already running and exit if so.
+         * If a safe offline is being processed this could only be a normal
+         * offline that should be able to overtake the safe offline and
+         * cancel any I/O we do not want to wait for any longer
+         */
+        if (test_bit(DASD_FLAG_OFFLINE, &device->flags)) {
+                if (test_bit(DASD_FLAG_SAFE_OFFLINE_RUNNING, &device->flags)) {
+                        clear_bit(DASD_FLAG_SAFE_OFFLINE_RUNNING,
+                                  &device->flags);
+                } else {
+                        rc = -EBUSY;
+                        goto out_err;
+                }
         }
-
         set_bit(DASD_FLAG_OFFLINE, &device->flags);
-        spin_unlock_irqrestore(get_ccwdev_lock(cdev), flags);
 
         /*
-         * if safe_offline called set safe_offline_running flag and
+         * if safe_offline is called set safe_offline_running flag and
          * clear safe_offline so that a call to normal offline
          * can overrun safe_offline processing
          */
         if (test_and_clear_bit(DASD_FLAG_SAFE_OFFLINE, &device->flags) &&
             !test_and_set_bit(DASD_FLAG_SAFE_OFFLINE_RUNNING, &device->flags)) {
+                /* need to unlock here to wait for outstanding I/O */
+                spin_unlock_irqrestore(get_ccwdev_lock(cdev), flags);
                 /*
                  * If we want to set the device safe offline all IO operations
                  * should be finished before continuing the offline process
                  * so sync bdev first and then wait for our queues to become
                  * empty
                  */
-                /* sync blockdev and partitions */
                 if (device->block) {
                         rc = fsync_bdev(device->block->bdev);
                         if (rc != 0)
                                 goto interrupted;
                 }
-                /* schedule device tasklet and wait for completion */
                 dasd_schedule_device_bh(device);
                 rc = wait_event_interruptible(shutdown_waitq,
                                               _wait_for_empty_queues(device));
                 if (rc != 0)
                         goto interrupted;
+
+                /*
+                 * check if a normal offline process overtook the offline
+                 * processing in this case simply do nothing beside returning
+                 * that we got interrupted
+                 * otherwise mark safe offline as not running any longer and
+                 * continue with normal offline
+                 */
+                spin_lock_irqsave(get_ccwdev_lock(cdev), flags);
+                if (!test_bit(DASD_FLAG_SAFE_OFFLINE_RUNNING, &device->flags)) {
+                        rc = -ERESTARTSYS;
+                        goto out_err;
+                }
+                clear_bit(DASD_FLAG_SAFE_OFFLINE_RUNNING, &device->flags);
         }
+        spin_unlock_irqrestore(get_ccwdev_lock(cdev), flags);
 
         dasd_set_target_state(device, DASD_STATE_NEW);
         /* dasd_delete_device destroys the device reference. */
@@ -3624,22 +3640,18 @@ int dasd_generic_set_offline(struct ccw_device *cdev)
          */
         if (block)
                 dasd_free_block(block);
+
         return 0;
 
 interrupted:
         /* interrupted by signal */
-        clear_bit(DASD_FLAG_SAFE_OFFLINE, &device->flags);
+        spin_lock_irqsave(get_ccwdev_lock(cdev), flags);
         clear_bit(DASD_FLAG_SAFE_OFFLINE_RUNNING, &device->flags);
         clear_bit(DASD_FLAG_OFFLINE, &device->flags);
-        dasd_put_device(device);
-
-        return rc;
-
-out_busy:
+out_err:
         dasd_put_device(device);
         spin_unlock_irqrestore(get_ccwdev_lock(cdev), flags);
-
-        return -EBUSY;
+        return rc;
 }
 EXPORT_SYMBOL_GPL(dasd_generic_set_offline);
 
diff --git a/drivers/s390/block/dasd_devmap.c b/drivers/s390/block/dasd_devmap.c
index 1164b51d09f3..7c7351276d2e 100644
--- a/drivers/s390/block/dasd_devmap.c
+++ b/drivers/s390/block/dasd_devmap.c
@@ -315,45 +315,58 @@ static int __init dasd_parse_range(const char *range)
         char *features_str = NULL;
         char *from_str = NULL;
         char *to_str = NULL;
-        size_t len = strlen(range) + 1;
-        char tmp[len];
+        int rc = 0;
+        char *tmp;
 
-        strlcpy(tmp, range, len);
+        tmp = kstrdup(range, GFP_KERNEL);
+        if (!tmp)
+                return -ENOMEM;
 
-        if (dasd_evaluate_range_param(tmp, &from_str, &to_str, &features_str))
-                goto out_err;
+        if (dasd_evaluate_range_param(tmp, &from_str, &to_str, &features_str)) {
+                rc = -EINVAL;
+                goto out;
+        }
 
-        if (dasd_busid(from_str, &from_id0, &from_id1, &from))
-                goto out_err;
+        if (dasd_busid(from_str, &from_id0, &from_id1, &from)) {
+                rc = -EINVAL;
+                goto out;
+        }
 
         to = from;
         to_id0 = from_id0;
         to_id1 = from_id1;
         if (to_str) {
-                if (dasd_busid(to_str, &to_id0, &to_id1, &to))
-                        goto out_err;
+                if (dasd_busid(to_str, &to_id0, &to_id1, &to)) {
+                        rc = -EINVAL;
+                        goto out;
+                }
                 if (from_id0 != to_id0 || from_id1 != to_id1 || from > to) {
                         pr_err("%s is not a valid device range\n", range);
-                        goto out_err;
+                        rc = -EINVAL;
+                        goto out;
                 }
         }
 
         features = dasd_feature_list(features_str);
-        if (features < 0)
-                goto out_err;
+        if (features < 0) {
+                rc = -EINVAL;
+                goto out;
+        }
         /* each device in dasd= parameter should be set initially online */
         features |= DASD_FEATURE_INITIAL_ONLINE;
         while (from <= to) {
                 sprintf(bus_id, "%01x.%01x.%04x", from_id0, from_id1, from++);
                 devmap = dasd_add_busid(bus_id, features);
-                if (IS_ERR(devmap))
-                        return PTR_ERR(devmap);
+                if (IS_ERR(devmap)) {
+                        rc = PTR_ERR(devmap);
+                        goto out;
+                }
         }
 
-        return 0;
+out:
+        kfree(tmp);
 
-out_err:
-        return -EINVAL;
+        return rc;
 }
 
 /*
@@ -735,13 +748,22 @@ static ssize_t
 dasd_ro_show(struct device *dev, struct device_attribute *attr, char *buf)
 {
         struct dasd_devmap *devmap;
-        int ro_flag;
+        struct dasd_device *device;
+        int ro_flag = 0;
 
         devmap = dasd_find_busid(dev_name(dev));
-        if (!IS_ERR(devmap))
-                ro_flag = (devmap->features & DASD_FEATURE_READONLY) != 0;
-        else
-                ro_flag = (DASD_FEATURE_DEFAULT & DASD_FEATURE_READONLY) != 0;
+        if (IS_ERR(devmap))
+                goto out;
+
+        ro_flag = !!(devmap->features & DASD_FEATURE_READONLY);
+
+        spin_lock(&dasd_devmap_lock);
+        device = devmap->device;
+        if (device)
+                ro_flag |= test_bit(DASD_FLAG_DEVICE_RO, &device->flags);
+        spin_unlock(&dasd_devmap_lock);
+
+out:
         return snprintf(buf, PAGE_SIZE, ro_flag ? "1\n" : "0\n");
 }
 
@@ -764,7 +786,7 @@ dasd_ro_store(struct device *dev, struct device_attribute *attr,
 
         device = dasd_device_from_cdev(cdev);
         if (IS_ERR(device))
-                return PTR_ERR(device);
+                return count;
 
         spin_lock_irqsave(get_ccwdev_lock(cdev), flags);
         val = val || test_bit(DASD_FLAG_DEVICE_RO, &device->flags);
@@ -928,11 +950,14 @@ dasd_safe_offline_store(struct device *dev, struct device_attribute *attr,
 {
         struct ccw_device *cdev = to_ccwdev(dev);
         struct dasd_device *device;
+        unsigned long flags;
         int rc;
 
-        device = dasd_device_from_cdev(cdev);
+        spin_lock_irqsave(get_ccwdev_lock(cdev), flags);
+        device = dasd_device_from_cdev_locked(cdev);
         if (IS_ERR(device)) {
                 rc = PTR_ERR(device);
+                spin_unlock_irqrestore(get_ccwdev_lock(cdev), flags);
                 goto out;
         }
 
@@ -940,12 +965,14 @@ dasd_safe_offline_store(struct device *dev, struct device_attribute *attr,
             test_bit(DASD_FLAG_SAFE_OFFLINE_RUNNING, &device->flags)) {
                 /* Already doing offline processing */
                 dasd_put_device(device);
+                spin_unlock_irqrestore(get_ccwdev_lock(cdev), flags);
                 rc = -EBUSY;
                 goto out;
         }
 
         set_bit(DASD_FLAG_SAFE_OFFLINE, &device->flags);
         dasd_put_device(device);
+        spin_unlock_irqrestore(get_ccwdev_lock(cdev), flags);
 
         rc = ccw_device_set_offline(cdev);
 
diff --git a/drivers/s390/block/scm_blk.c b/drivers/s390/block/scm_blk.c
index 152de6817875..725f912fab41 100644
--- a/drivers/s390/block/scm_blk.c
+++ b/drivers/s390/block/scm_blk.c
@@ -13,6 +13,7 @@
 #include <linux/mempool.h>
 #include <linux/module.h>
 #include <linux/blkdev.h>
+#include <linux/blk-mq.h>
 #include <linux/genhd.h>
 #include <linux/slab.h>
 #include <linux/list.h>
@@ -42,7 +43,6 @@ static void __scm_free_rq(struct scm_request *scmrq)
         struct aob_rq_header *aobrq = to_aobrq(scmrq);
 
         free_page((unsigned long) scmrq->aob);
-        __scm_free_rq_cluster(scmrq);
         kfree(scmrq->request);
         kfree(aobrq);
 }
@@ -82,9 +82,6 @@ static int __scm_alloc_rq(void)
         if (!scmrq->request)
                 goto free;
 
-        if (__scm_alloc_rq_cluster(scmrq))
-                goto free;
-
         INIT_LIST_HEAD(&scmrq->list);
         spin_lock_irq(&list_lock);
         list_add(&scmrq->list, &inactive_requests);
@@ -114,13 +111,13 @@ static struct scm_request *scm_request_fetch(void)
 {
         struct scm_request *scmrq = NULL;
 
-        spin_lock(&list_lock);
+        spin_lock_irq(&list_lock);
         if (list_empty(&inactive_requests))
                 goto out;
         scmrq = list_first_entry(&inactive_requests, struct scm_request, list);
         list_del(&scmrq->list);
 out:
-        spin_unlock(&list_lock);
+        spin_unlock_irq(&list_lock);
         return scmrq;
 }
 
@@ -234,130 +231,123 @@ static inline void scm_request_init(struct scm_blk_dev *bdev,
         scmrq->error = 0;
         /* We don't use all msbs - place aidaws at the end of the aob page. */
         scmrq->next_aidaw = (void *) &aob->msb[nr_requests_per_io];
-        scm_request_cluster_init(scmrq);
 }
 
-static void scm_ensure_queue_restart(struct scm_blk_dev *bdev)
-{
-        if (atomic_read(&bdev->queued_reqs)) {
-                /* Queue restart is triggered by the next interrupt. */
-                return;
-        }
-        blk_delay_queue(bdev->rq, SCM_QUEUE_DELAY);
-}
-
-void scm_request_requeue(struct scm_request *scmrq)
+static void scm_request_requeue(struct scm_request *scmrq)
 {
         struct scm_blk_dev *bdev = scmrq->bdev;
         int i;
 
-        scm_release_cluster(scmrq);
         for (i = 0; i < nr_requests_per_io && scmrq->request[i]; i++)
-                blk_requeue_request(bdev->rq, scmrq->request[i]);
+                blk_mq_requeue_request(scmrq->request[i], false);
 
         atomic_dec(&bdev->queued_reqs);
         scm_request_done(scmrq);
-        scm_ensure_queue_restart(bdev);
+        blk_mq_kick_requeue_list(bdev->rq);
 }
 
-void scm_request_finish(struct scm_request *scmrq)
+static void scm_request_finish(struct scm_request *scmrq)
 {
         struct scm_blk_dev *bdev = scmrq->bdev;
         int i;
 
-        scm_release_cluster(scmrq);
-        for (i = 0; i < nr_requests_per_io && scmrq->request[i]; i++)
-                blk_end_request_all(scmrq->request[i], scmrq->error);
+        for (i = 0; i < nr_requests_per_io && scmrq->request[i]; i++) {
+                if (scmrq->error)
+                        blk_mq_end_request(scmrq->request[i], scmrq->error);
+                else
+                        blk_mq_complete_request(scmrq->request[i]);
+        }
 
         atomic_dec(&bdev->queued_reqs);
         scm_request_done(scmrq);
 }
 
-static int scm_request_start(struct scm_request *scmrq)
+static void scm_request_start(struct scm_request *scmrq)
 {
         struct scm_blk_dev *bdev = scmrq->bdev;
-        int ret;
 
         atomic_inc(&bdev->queued_reqs);
-        if (!scmrq->aob->request.msb_count) {
-                scm_request_requeue(scmrq);
-                return -EINVAL;
-        }
-
-        ret = eadm_start_aob(scmrq->aob);
-        if (ret) {
+        if (eadm_start_aob(scmrq->aob)) {
                 SCM_LOG(5, "no subchannel");
                 scm_request_requeue(scmrq);
         }
-        return ret;
 }
 
-static void scm_blk_request(struct request_queue *rq)
+struct scm_queue {
+        struct scm_request *scmrq;
+        spinlock_t lock;
+};
+
+static int scm_blk_request(struct blk_mq_hw_ctx *hctx,
+                           const struct blk_mq_queue_data *qd)
 {
-        struct scm_device *scmdev = rq->queuedata;
+        struct scm_device *scmdev = hctx->queue->queuedata;
         struct scm_blk_dev *bdev = dev_get_drvdata(&scmdev->dev);
-        struct scm_request *scmrq = NULL;
-        struct request *req;
+        struct scm_queue *sq = hctx->driver_data;
+        struct request *req = qd->rq;
+        struct scm_request *scmrq;
 
-        while ((req = blk_peek_request(rq))) {
-                if (!scm_permit_request(bdev, req))
-                        goto out;
+        spin_lock(&sq->lock);
+        if (!scm_permit_request(bdev, req)) {
+                spin_unlock(&sq->lock);
+                return BLK_MQ_RQ_QUEUE_BUSY;
+        }
 
+        scmrq = sq->scmrq;
+        if (!scmrq) {
+                scmrq = scm_request_fetch();
                 if (!scmrq) {
-                        scmrq = scm_request_fetch();
-                        if (!scmrq) {
-                                SCM_LOG(5, "no request");
-                                goto out;
-                        }
-                        scm_request_init(bdev, scmrq);
+                        SCM_LOG(5, "no request");
+                        spin_unlock(&sq->lock);
+                        return BLK_MQ_RQ_QUEUE_BUSY;
                 }
-                scm_request_set(scmrq, req);
+                scm_request_init(bdev, scmrq);
+                sq->scmrq = scmrq;
+        }
+        scm_request_set(scmrq, req);
 
-                if (!scm_reserve_cluster(scmrq)) {
-                        SCM_LOG(5, "cluster busy");
-                        scm_request_set(scmrq, NULL);
-                        if (scmrq->aob->request.msb_count)
-                                goto out;
+        if (scm_request_prepare(scmrq)) {
+                SCM_LOG(5, "aidaw alloc failed");
+                scm_request_set(scmrq, NULL);
 
-                        scm_request_done(scmrq);
-                        return;
-                }
+                if (scmrq->aob->request.msb_count)
+                        scm_request_start(scmrq);
 
-                if (scm_need_cluster_request(scmrq)) {
-                        if (scmrq->aob->request.msb_count) {
-                                /* Start cluster requests separately. */
-                                scm_request_set(scmrq, NULL);
-                                if (scm_request_start(scmrq))
-                                        return;
-                        } else {
-                                atomic_inc(&bdev->queued_reqs);
-                                blk_start_request(req);
-                                scm_initiate_cluster_request(scmrq);
-                        }
-                        scmrq = NULL;
-                        continue;
-                }
+                sq->scmrq = NULL;
+                spin_unlock(&sq->lock);
+                return BLK_MQ_RQ_QUEUE_BUSY;
+        }
+        blk_mq_start_request(req);
 
-                if (scm_request_prepare(scmrq)) {
-                        SCM_LOG(5, "aidaw alloc failed");
-                        scm_request_set(scmrq, NULL);
-                        goto out;
-                }
-                blk_start_request(req);
+        if (qd->last || scmrq->aob->request.msb_count == nr_requests_per_io) {
+                scm_request_start(scmrq);
+                sq->scmrq = NULL;
+        }
+        spin_unlock(&sq->lock);
+        return BLK_MQ_RQ_QUEUE_OK;
+}
 
-                if (scmrq->aob->request.msb_count < nr_requests_per_io)
-                        continue;
+static int scm_blk_init_hctx(struct blk_mq_hw_ctx *hctx, void *data,
+                             unsigned int idx)
+{
+        struct scm_queue *qd = kzalloc(sizeof(*qd), GFP_KERNEL);
 
-                if (scm_request_start(scmrq))
-                        return;
+        if (!qd)
+                return -ENOMEM;
 
-                scmrq = NULL;
-        }
-out:
-        if (scmrq)
-                scm_request_start(scmrq);
-        else
-                scm_ensure_queue_restart(bdev);
+        spin_lock_init(&qd->lock);
+        hctx->driver_data = qd;
+
+        return 0;
+}
+
+static void scm_blk_exit_hctx(struct blk_mq_hw_ctx *hctx, unsigned int idx)
+{
+        struct scm_queue *qd = hctx->driver_data;
+
+        WARN_ON(qd->scmrq);
+        kfree(hctx->driver_data);
+        hctx->driver_data = NULL;
 }
 
 static void __scmrq_log_error(struct scm_request *scmrq)
@@ -377,21 +367,6 @@ static void __scmrq_log_error(struct scm_request *scmrq)
                        scmrq->error);
 }
 
-void scm_blk_irq(struct scm_device *scmdev, void *data, int error)
-{
-        struct scm_request *scmrq = data;
-        struct scm_blk_dev *bdev = scmrq->bdev;
-
-        scmrq->error = error;
-        if (error)
-                __scmrq_log_error(scmrq);
-
-        spin_lock(&bdev->lock);
-        list_add_tail(&scmrq->list, &bdev->finished_requests);
-        spin_unlock(&bdev->lock);
-        tasklet_hi_schedule(&bdev->tasklet);
-}
-
 static void scm_blk_handle_error(struct scm_request *scmrq)
 {
         struct scm_blk_dev *bdev = scmrq->bdev;
@@ -419,54 +394,46 @@ restart:
                 return;
 
 requeue:
-        spin_lock_irqsave(&bdev->rq_lock, flags);
         scm_request_requeue(scmrq);
-        spin_unlock_irqrestore(&bdev->rq_lock, flags);
 }
 
-static void scm_blk_tasklet(struct scm_blk_dev *bdev)
+void scm_blk_irq(struct scm_device *scmdev, void *data, int error)
 {
-        struct scm_request *scmrq;
-        unsigned long flags;
-
-        spin_lock_irqsave(&bdev->lock, flags);
-        while (!list_empty(&bdev->finished_requests)) {
-                scmrq = list_first_entry(&bdev->finished_requests,
-                                         struct scm_request, list);
-                list_del(&scmrq->list);
-                spin_unlock_irqrestore(&bdev->lock, flags);
+        struct scm_request *scmrq = data;
 
-                if (scmrq->error && scmrq->retries-- > 0) {
+        scmrq->error = error;
+        if (error) {
+                __scmrq_log_error(scmrq);
+                if (scmrq->retries-- > 0) {
                         scm_blk_handle_error(scmrq);
-
-                        /* Request restarted or requeued, handle next. */
-                        spin_lock_irqsave(&bdev->lock, flags);
-                        continue;
+                        return;
                 }
+        }
 
-                if (scm_test_cluster_request(scmrq)) {
-                        scm_cluster_request_irq(scmrq);
-                        spin_lock_irqsave(&bdev->lock, flags);
-                        continue;
-                }
+        scm_request_finish(scmrq);
+}
 
-                scm_request_finish(scmrq);
-                spin_lock_irqsave(&bdev->lock, flags);
-        }
-        spin_unlock_irqrestore(&bdev->lock, flags);
-        /* Look out for more requests. */
-        blk_run_queue(bdev->rq);
+static void scm_blk_request_done(struct request *req)
+{
+        blk_mq_end_request(req, 0);
 }
 
 static const struct block_device_operations scm_blk_devops = {
         .owner = THIS_MODULE,
 };
 
+static const struct blk_mq_ops scm_mq_ops = {
+        .queue_rq = scm_blk_request,
+        .complete = scm_blk_request_done,
+        .init_hctx = scm_blk_init_hctx,
+        .exit_hctx = scm_blk_exit_hctx,
+};
+
 int scm_blk_dev_setup(struct scm_blk_dev *bdev, struct scm_device *scmdev)
 {
-        struct request_queue *rq;
-        int len, ret = -ENOMEM;
         unsigned int devindex, nr_max_blk;
+        struct request_queue *rq;
+        int len, ret;
 
         devindex = atomic_inc_return(&nr_devices) - 1;
         /* scma..scmz + scmaa..scmzz */
@@ -477,18 +444,23 @@ int scm_blk_dev_setup(struct scm_blk_dev *bdev, struct scm_device *scmdev)
 
         bdev->scmdev = scmdev;
         bdev->state = SCM_OPER;
-        spin_lock_init(&bdev->rq_lock);
         spin_lock_init(&bdev->lock);
-        INIT_LIST_HEAD(&bdev->finished_requests);
         atomic_set(&bdev->queued_reqs, 0);
-        tasklet_init(&bdev->tasklet,
-                     (void (*)(unsigned long)) scm_blk_tasklet,
-                     (unsigned long) bdev);
 
-        rq = blk_init_queue(scm_blk_request, &bdev->rq_lock);
-        if (!rq)
+        bdev->tag_set.ops = &scm_mq_ops;
+        bdev->tag_set.nr_hw_queues = nr_requests;
+        bdev->tag_set.queue_depth = nr_requests_per_io * nr_requests;
+        bdev->tag_set.flags = BLK_MQ_F_SHOULD_MERGE;
+
+        ret = blk_mq_alloc_tag_set(&bdev->tag_set);
+        if (ret)
                 goto out;
 
+        rq = blk_mq_init_queue(&bdev->tag_set);
+        if (IS_ERR(rq)) {
+                ret = PTR_ERR(rq);
+                goto out_tag;
+        }
         bdev->rq = rq;
         nr_max_blk = min(scmdev->nr_max_block,
                          (unsigned int) (PAGE_SIZE / sizeof(struct aidaw)));
@@ -498,12 +470,12 @@ int scm_blk_dev_setup(struct scm_blk_dev *bdev, struct scm_device *scmdev)
         blk_queue_max_segments(rq, nr_max_blk);
         queue_flag_set_unlocked(QUEUE_FLAG_NONROT, rq);
         queue_flag_clear_unlocked(QUEUE_FLAG_ADD_RANDOM, rq);
-        scm_blk_dev_cluster_setup(bdev);
 
         bdev->gendisk = alloc_disk(SCM_NR_PARTS);
-        if (!bdev->gendisk)
+        if (!bdev->gendisk) {
+                ret = -ENOMEM;
                 goto out_queue;
-
+        }
         rq->queuedata = scmdev;
         bdev->gendisk->private_data = scmdev;
         bdev->gendisk->fops = &scm_blk_devops;
@@ -528,6 +500,8 @@ int scm_blk_dev_setup(struct scm_blk_dev *bdev, struct scm_device *scmdev)
 
 out_queue:
         blk_cleanup_queue(rq);
+out_tag:
+        blk_mq_free_tag_set(&bdev->tag_set);
 out:
         atomic_dec(&nr_devices);
         return ret;
@@ -535,9 +509,9 @@ out:
 
 void scm_blk_dev_cleanup(struct scm_blk_dev *bdev)
 {
-        tasklet_kill(&bdev->tasklet);
         del_gendisk(bdev->gendisk);
         blk_cleanup_queue(bdev->gendisk->queue);
+        blk_mq_free_tag_set(&bdev->tag_set);
         put_disk(bdev->gendisk);
 }
 
@@ -558,7 +532,7 @@ static bool __init scm_blk_params_valid(void)
         if (!nr_requests_per_io || nr_requests_per_io > 64)
                 return false;
 
-        return scm_cluster_size_valid();
+        return true;
 }
 
 static int __init scm_blk_init(void)
diff --git a/drivers/s390/block/scm_blk.h b/drivers/s390/block/scm_blk.h
index 09218cdc5129..242d17a91920 100644
--- a/drivers/s390/block/scm_blk.h
+++ b/drivers/s390/block/scm_blk.h
@@ -4,6 +4,7 @@
 #include <linux/interrupt.h>
 #include <linux/spinlock.h>
 #include <linux/blkdev.h>
+#include <linux/blk-mq.h>
 #include <linux/genhd.h>
 #include <linux/list.h>
 
@@ -14,18 +15,14 @@
 #define SCM_QUEUE_DELAY 5
 
 struct scm_blk_dev {
-        struct tasklet_struct tasklet;
         struct request_queue *rq;
         struct gendisk *gendisk;
+        struct blk_mq_tag_set tag_set;
         struct scm_device *scmdev;
-        spinlock_t rq_lock;     /* guard the request queue */
-        spinlock_t lock;        /* guard the rest of the blockdev */
+        spinlock_t lock;
         atomic_t queued_reqs;
         enum {SCM_OPER, SCM_WR_PROHIBIT} state;
         struct list_head finished_requests;
-#ifdef CONFIG_SCM_BLOCK_CLUSTER_WRITE
-        struct list_head cluster_list;
-#endif
 };
 
 struct scm_request {
@@ -36,13 +33,6 @@ struct scm_request {
         struct list_head list;
         u8 retries;
         int error;
-#ifdef CONFIG_SCM_BLOCK_CLUSTER_WRITE
-        struct {
-                enum {CLUSTER_NONE, CLUSTER_READ, CLUSTER_WRITE} state;
-                struct list_head list;
-                void **buf;
-        } cluster;
-#endif
 };
 
 #define to_aobrq(rq) container_of((void *) rq, struct aob_rq_header, data)
@@ -52,55 +42,11 @@ void scm_blk_dev_cleanup(struct scm_blk_dev *);
 void scm_blk_set_available(struct scm_blk_dev *);
 void scm_blk_irq(struct scm_device *, void *, int);
 
-void scm_request_finish(struct scm_request *);
-void scm_request_requeue(struct scm_request *);
-
 struct aidaw *scm_aidaw_fetch(struct scm_request *scmrq, unsigned int bytes);
 
 int scm_drv_init(void);
 void scm_drv_cleanup(void);
 
-#ifdef CONFIG_SCM_BLOCK_CLUSTER_WRITE
-void __scm_free_rq_cluster(struct scm_request *);
-int __scm_alloc_rq_cluster(struct scm_request *);
-void scm_request_cluster_init(struct scm_request *);
-bool scm_reserve_cluster(struct scm_request *);
-void scm_release_cluster(struct scm_request *);
-void scm_blk_dev_cluster_setup(struct scm_blk_dev *);
-bool scm_need_cluster_request(struct scm_request *);
-void scm_initiate_cluster_request(struct scm_request *);
-void scm_cluster_request_irq(struct scm_request *);
-bool scm_test_cluster_request(struct scm_request *);
-bool scm_cluster_size_valid(void);
-#else /* CONFIG_SCM_BLOCK_CLUSTER_WRITE */
-static inline void __scm_free_rq_cluster(struct scm_request *scmrq) {}
-static inline int __scm_alloc_rq_cluster(struct scm_request *scmrq)
-{
-        return 0;
-}
-static inline void scm_request_cluster_init(struct scm_request *scmrq) {}
-static inline bool scm_reserve_cluster(struct scm_request *scmrq)
-{
-        return true;
-}
-static inline void scm_release_cluster(struct scm_request *scmrq) {}
-static inline void scm_blk_dev_cluster_setup(struct scm_blk_dev *bdev) {}
-static inline bool scm_need_cluster_request(struct scm_request *scmrq)
-{
-        return false;
-}
-static inline void scm_initiate_cluster_request(struct scm_request *scmrq) {}
-static inline void scm_cluster_request_irq(struct scm_request *scmrq) {}
-static inline bool scm_test_cluster_request(struct scm_request *scmrq)
-{
-        return false;
-}
-static inline bool scm_cluster_size_valid(void)
-{
-        return true;
-}
-#endif /* CONFIG_SCM_BLOCK_CLUSTER_WRITE */
-
 extern debug_info_t *scm_debug;
 
 #define SCM_LOG(imp, txt) do {                                  \
diff --git a/drivers/s390/block/scm_blk_cluster.c b/drivers/s390/block/scm_blk_cluster.c
deleted file mode 100644
index 7497ddde2dd6..000000000000
--- a/drivers/s390/block/scm_blk_cluster.c
+++ /dev/null
@@ -1,255 +0,0 @@
-/*
- * Block driver for s390 storage class memory.
- *
- * Copyright IBM Corp. 2012
- * Author(s): Sebastian Ott <sebott@linux.vnet.ibm.com>
- */
-
-#include <linux/spinlock.h>
-#include <linux/module.h>
-#include <linux/blkdev.h>
-#include <linux/genhd.h>
-#include <linux/slab.h>
-#include <linux/list.h>
-#include <asm/eadm.h>
-#include "scm_blk.h"
-
-static unsigned int write_cluster_size = 64;
-module_param(write_cluster_size, uint, S_IRUGO);
-MODULE_PARM_DESC(write_cluster_size,
-                 "Number of pages used for contiguous writes.");
-
-#define CLUSTER_SIZE (write_cluster_size * PAGE_SIZE)
-
-void __scm_free_rq_cluster(struct scm_request *scmrq)
-{
-        int i;
-
-        if (!scmrq->cluster.buf)
-                return;
-
-        for (i = 0; i < 2 * write_cluster_size; i++)
-                free_page((unsigned long) scmrq->cluster.buf[i]);
-
-        kfree(scmrq->cluster.buf);
-}
-
-int __scm_alloc_rq_cluster(struct scm_request *scmrq)
-{
-        int i;
-
-        scmrq->cluster.buf = kzalloc(sizeof(void *) * 2 * write_cluster_size,
-                                 GFP_KERNEL);
-        if (!scmrq->cluster.buf)
-                return -ENOMEM;
-
-        for (i = 0; i < 2 * write_cluster_size; i++) {
-                scmrq->cluster.buf[i] = (void *) get_zeroed_page(GFP_DMA);
-                if (!scmrq->cluster.buf[i])
-                        return -ENOMEM;
-        }
-        INIT_LIST_HEAD(&scmrq->cluster.list);
-        return 0;
-}
-
-void scm_request_cluster_init(struct scm_request *scmrq)
-{
-        scmrq->cluster.state = CLUSTER_NONE;
-}
-
-static bool clusters_intersect(struct request *A, struct request *B)
-{
-        unsigned long firstA, lastA, firstB, lastB;
-
-        firstA = ((u64) blk_rq_pos(A) << 9) / CLUSTER_SIZE;
-        lastA = (((u64) blk_rq_pos(A) << 9) +
-                    blk_rq_bytes(A) - 1) / CLUSTER_SIZE;
-
-        firstB = ((u64) blk_rq_pos(B) << 9) / CLUSTER_SIZE;
-        lastB = (((u64) blk_rq_pos(B) << 9) +
-                    blk_rq_bytes(B) - 1) / CLUSTER_SIZE;
-
-        return (firstB <= lastA && firstA <= lastB);
-}
-
-bool scm_reserve_cluster(struct scm_request *scmrq)
-{
-        struct request *req = scmrq->request[scmrq->aob->request.msb_count];
-        struct scm_blk_dev *bdev = scmrq->bdev;
-        struct scm_request *iter;
-        int pos, add = 1;
-
-        if (write_cluster_size == 0)
-                return true;
-
-        spin_lock(&bdev->lock);
-        list_for_each_entry(iter, &bdev->cluster_list, cluster.list) {
-                if (iter == scmrq) {
-                        /*
-                         * We don't have to use clusters_intersect here, since
-                         * cluster requests are always started separately.
-                         */
-                        add = 0;
-                        continue;
-                }
-                for (pos = 0; pos < iter->aob->request.msb_count; pos++) {
-                        if (clusters_intersect(req, iter->request[pos]) &&
-                            (rq_data_dir(req) == WRITE ||
-                             rq_data_dir(iter->request[pos]) == WRITE)) {
-                                spin_unlock(&bdev->lock);
-                                return false;
-                        }
-                }
-        }
-        if (add)
-                list_add(&scmrq->cluster.list, &bdev->cluster_list);
-        spin_unlock(&bdev->lock);
-
-        return true;
-}
-
-void scm_release_cluster(struct scm_request *scmrq)
-{
-        struct scm_blk_dev *bdev = scmrq->bdev;
-        unsigned long flags;
-
-        if (write_cluster_size == 0)
-                return;
-
-        spin_lock_irqsave(&bdev->lock, flags);
-        list_del(&scmrq->cluster.list);
-        spin_unlock_irqrestore(&bdev->lock, flags);
-}
-
-void scm_blk_dev_cluster_setup(struct scm_blk_dev *bdev)
-{
-        INIT_LIST_HEAD(&bdev->cluster_list);
-        blk_queue_io_opt(bdev->rq, CLUSTER_SIZE);
-}
-
-static int scm_prepare_cluster_request(struct scm_request *scmrq)
-{
-        struct scm_blk_dev *bdev = scmrq->bdev;
-        struct scm_device *scmdev = bdev->gendisk->private_data;
-        struct request *req = scmrq->request[0];
-        struct msb *msb = &scmrq->aob->msb[0];
-        struct req_iterator iter;
-        struct aidaw *aidaw;
-        struct bio_vec bv;
-        int i = 0;
-        u64 addr;
-
-        switch (scmrq->cluster.state) {
-        case CLUSTER_NONE:
-                scmrq->cluster.state = CLUSTER_READ;
-                /* fall through */
-        case CLUSTER_READ:
-                msb->bs = MSB_BS_4K;
-                msb->oc = MSB_OC_READ;
-                msb->flags = MSB_FLAG_IDA;
-                msb->blk_count = write_cluster_size;
-
-                addr = scmdev->address + ((u64) blk_rq_pos(req) << 9);
-                msb->scm_addr = round_down(addr, CLUSTER_SIZE);
-
-                if (msb->scm_addr !=
-                    round_down(addr + (u64) blk_rq_bytes(req) - 1,
-                               CLUSTER_SIZE))
-                        msb->blk_count = 2 * write_cluster_size;
-
-                aidaw = scm_aidaw_fetch(scmrq, msb->blk_count * PAGE_SIZE);
-                if (!aidaw)
-                        return -ENOMEM;
-
-                scmrq->aob->request.msb_count = 1;
-                msb->data_addr = (u64) aidaw;
-                for (i = 0; i < msb->blk_count; i++) {
-                        aidaw->data_addr = (u64) scmrq->cluster.buf[i];
-                        aidaw++;
-                }
-
-                break;
-        case CLUSTER_WRITE:
-                aidaw = (void *) msb->data_addr;
-                msb->oc = MSB_OC_WRITE;
-
-                for (addr = msb->scm_addr;
-                     addr < scmdev->address + ((u64) blk_rq_pos(req) << 9);
-                     addr += PAGE_SIZE) {
-                        aidaw->data_addr = (u64) scmrq->cluster.buf[i];
-                        aidaw++;
-                        i++;
-                }
-                rq_for_each_segment(bv, req, iter) {
-                        aidaw->data_addr = (u64) page_address(bv.bv_page);
-                        aidaw++;
-                        i++;
-                }
-                for (; i < msb->blk_count; i++) {
-                        aidaw->data_addr = (u64) scmrq->cluster.buf[i];
-                        aidaw++;
-                }
-                break;
-        }
-        return 0;
-}
-
-bool scm_need_cluster_request(struct scm_request *scmrq)
-{
-        int pos = scmrq->aob->request.msb_count;
-
-        if (rq_data_dir(scmrq->request[pos]) == READ)
-                return false;
-
-        return blk_rq_bytes(scmrq->request[pos]) < CLUSTER_SIZE;
-}
-
-/* Called with queue lock held. */
-void scm_initiate_cluster_request(struct scm_request *scmrq)
-{
-        if (scm_prepare_cluster_request(scmrq))
-                goto requeue;
-        if (eadm_start_aob(scmrq->aob))
-                goto requeue;
-        return;
-requeue:
-        scm_request_requeue(scmrq);
-}
-
-bool scm_test_cluster_request(struct scm_request *scmrq)
-{
-        return scmrq->cluster.state != CLUSTER_NONE;
-}
-
-void scm_cluster_request_irq(struct scm_request *scmrq)
-{
-        struct scm_blk_dev *bdev = scmrq->bdev;
-        unsigned long flags;
-
-        switch (scmrq->cluster.state) {
-        case CLUSTER_NONE:
-                BUG();
-                break;
-        case CLUSTER_READ:
-                if (scmrq->error) {
-                        scm_request_finish(scmrq);
-                        break;
-                }
-                scmrq->cluster.state = CLUSTER_WRITE;
-                spin_lock_irqsave(&bdev->rq_lock, flags);
-                scm_initiate_cluster_request(scmrq);
-                spin_unlock_irqrestore(&bdev->rq_lock, flags);
-                break;
-        case CLUSTER_WRITE:
-                scm_request_finish(scmrq);
-                break;
-        }
-}
-
-bool scm_cluster_size_valid(void)
-{
-        if (write_cluster_size == 1 || write_cluster_size > 128)
-                return false;
-
-        return !(write_cluster_size & (write_cluster_size - 1));
-}
diff --git a/drivers/s390/cio/ccwgroup.c b/drivers/s390/cio/ccwgroup.c
index e443b0d0b236..34b9ad6b3143 100644
--- a/drivers/s390/cio/ccwgroup.c
+++ b/drivers/s390/cio/ccwgroup.c
@@ -35,7 +35,7 @@ static struct bus_type ccwgroup_bus_type;
 static void __ccwgroup_remove_symlinks(struct ccwgroup_device *gdev)
 {
         int i;
-        char str[8];
+        char str[16];
 
         for (i = 0; i < gdev->count; i++) {
                 sprintf(str, "cdev%d", i);
@@ -238,7 +238,7 @@ static void ccwgroup_release(struct device *dev)
 
 static int __ccwgroup_create_symlinks(struct ccwgroup_device *gdev)
 {
-        char str[8];
+        char str[16];
         int i, rc;
 
         for (i = 0; i < gdev->count; i++) {
diff --git a/drivers/s390/cio/css.c b/drivers/s390/cio/css.c
index e2aa944eb566..d3e504c3c362 100644
--- a/drivers/s390/cio/css.c
+++ b/drivers/s390/cio/css.c
@@ -296,6 +296,51 @@ static const struct attribute_group *default_subch_attr_groups[] = {
         NULL,
 };
 
+static ssize_t chpids_show(struct device *dev,
+                           struct device_attribute *attr,
+                           char *buf)
+{
+        struct subchannel *sch = to_subchannel(dev);
+        struct chsc_ssd_info *ssd = &sch->ssd_info;
+        ssize_t ret = 0;
+        int mask;
+        int chp;
+
+        for (chp = 0; chp < 8; chp++) {
+                mask = 0x80 >> chp;
+                if (ssd->path_mask & mask)
+                        ret += sprintf(buf + ret, "%02x ", ssd->chpid[chp].id);
+                else
+                        ret += sprintf(buf + ret, "00 ");
+        }
+        ret += sprintf(buf + ret, "\n");
+        return ret;
+}
+static DEVICE_ATTR(chpids, 0444, chpids_show, NULL);
+
+static ssize_t pimpampom_show(struct device *dev,
+                              struct device_attribute *attr,
+                              char *buf)
+{
+        struct subchannel *sch = to_subchannel(dev);
+        struct pmcw *pmcw = &sch->schib.pmcw;
+
+        return sprintf(buf, "%02x %02x %02x\n",
+                       pmcw->pim, pmcw->pam, pmcw->pom);
+}
+static DEVICE_ATTR(pimpampom, 0444, pimpampom_show, NULL);
+
+static struct attribute *io_subchannel_type_attrs[] = {
+        &dev_attr_chpids.attr,
+        &dev_attr_pimpampom.attr,
+        NULL,
+};
+ATTRIBUTE_GROUPS(io_subchannel_type);
+
+static const struct device_type io_subchannel_type = {
+        .groups = io_subchannel_type_groups,
+};
+
 int css_register_subchannel(struct subchannel *sch)
 {
         int ret;
@@ -304,6 +349,10 @@ int css_register_subchannel(struct subchannel *sch)
         sch->dev.parent = &channel_subsystems[0]->device;
         sch->dev.bus = &css_bus_type;
         sch->dev.groups = default_subch_attr_groups;
+
+        if (sch->st == SUBCHANNEL_TYPE_IO)
+                sch->dev.type = &io_subchannel_type;
+
         /*
          * We don't want to generate uevents for I/O subchannels that don't
          * have a working ccw device behind them since they will be
diff --git a/drivers/s390/cio/device.c b/drivers/s390/cio/device.c
index b8006ea9099c..7be01a58b44f 100644
--- a/drivers/s390/cio/device.c
+++ b/drivers/s390/cio/device.c
@@ -208,44 +208,6 @@ int __init io_subchannel_init(void)
 
 /************************ device handling **************************/
 
-/*
- * A ccw_device has some interfaces in sysfs in addition to the
- * standard ones.
- * The following entries are designed to export the information which
- * resided in 2.4 in /proc/subchannels. Subchannel and device number
- * are obvious, so they don't have an entry :)
- * TODO: Split chpids and pimpampom up? Where is "in use" in the tree?
- */
-static ssize_t
-chpids_show (struct device * dev, struct device_attribute *attr, char * buf)
-{
-        struct subchannel *sch = to_subchannel(dev);
-        struct chsc_ssd_info *ssd = &sch->ssd_info;
-        ssize_t ret = 0;
-        int chp;
-        int mask;
-
-        for (chp = 0; chp < 8; chp++) {
-                mask = 0x80 >> chp;
-                if (ssd->path_mask & mask)
-                        ret += sprintf(buf + ret, "%02x ", ssd->chpid[chp].id);
-                else
-                        ret += sprintf(buf + ret, "00 ");
-        }
-        ret += sprintf (buf+ret, "\n");
-        return min((ssize_t)PAGE_SIZE, ret);
-}
-
-static ssize_t
-pimpampom_show (struct device * dev, struct device_attribute *attr, char * buf)
-{
-        struct subchannel *sch = to_subchannel(dev);
-        struct pmcw *pmcw = &sch->schib.pmcw;
-
-        return sprintf (buf, "%02x %02x %02x\n",
-                        pmcw->pim, pmcw->pam, pmcw->pom);
-}
-
 static ssize_t
 devtype_show (struct device *dev, struct device_attribute *attr, char *buf)
 {
@@ -636,8 +598,6 @@ static ssize_t vpm_show(struct device *dev, struct device_attribute *attr,
         return sprintf(buf, "%02x\n", sch->vpm);
 }
 
-static DEVICE_ATTR(chpids, 0444, chpids_show, NULL);
-static DEVICE_ATTR(pimpampom, 0444, pimpampom_show, NULL);
 static DEVICE_ATTR(devtype, 0444, devtype_show, NULL);
 static DEVICE_ATTR(cutype, 0444, cutype_show, NULL);
 static DEVICE_ATTR(modalias, 0444, modalias_show, NULL);
@@ -647,8 +607,6 @@ static DEVICE_ATTR(logging, 0200, NULL, initiate_logging);
 static DEVICE_ATTR(vpm, 0444, vpm_show, NULL);
 
 static struct attribute *io_subchannel_attrs[] = {
-        &dev_attr_chpids.attr,
-        &dev_attr_pimpampom.attr,
         &dev_attr_logging.attr,
         &dev_attr_vpm.attr,
         NULL,
diff --git a/drivers/s390/cio/qdio_debug.h b/drivers/s390/cio/qdio_debug.h
index f33ce8577619..1d595d17bf11 100644
--- a/drivers/s390/cio/qdio_debug.h
+++ b/drivers/s390/cio/qdio_debug.h
@@ -11,7 +11,7 @@
 #include "qdio.h"
 
 /* that gives us 15 characters in the text event views */
-#define QDIO_DBF_LEN    16
+#define QDIO_DBF_LEN    32
 
 extern debug_info_t *qdio_dbf_setup;
 extern debug_info_t *qdio_dbf_error;
diff --git a/drivers/s390/cio/vfio_ccw_drv.c b/drivers/s390/cio/vfio_ccw_drv.c
index e90dd43d2a55..a25367ebaa89 100644
--- a/drivers/s390/cio/vfio_ccw_drv.c
+++ b/drivers/s390/cio/vfio_ccw_drv.c
@@ -90,54 +90,6 @@ static void vfio_ccw_sch_io_todo(struct work_struct *work)
 }
 
 /*
- * Sysfs interfaces
- */
-static ssize_t chpids_show(struct device *dev,
-                           struct device_attribute *attr,
-                           char *buf)
-{
-        struct subchannel *sch = to_subchannel(dev);
-        struct chsc_ssd_info *ssd = &sch->ssd_info;
-        ssize_t ret = 0;
-        int chp;
-        int mask;
-
-        for (chp = 0; chp < 8; chp++) {
-                mask = 0x80 >> chp;
-                if (ssd->path_mask & mask)
-                        ret += sprintf(buf + ret, "%02x ", ssd->chpid[chp].id);
-                else
-                        ret += sprintf(buf + ret, "00 ");
-        }
-        ret += sprintf(buf+ret, "\n");
-        return ret;
-}
-
-static ssize_t pimpampom_show(struct device *dev,
-                              struct device_attribute *attr,
-                              char *buf)
-{
-        struct subchannel *sch = to_subchannel(dev);
-        struct pmcw *pmcw = &sch->schib.pmcw;
-
-        return sprintf(buf, "%02x %02x %02x\n",
-                       pmcw->pim, pmcw->pam, pmcw->pom);
-}
-
-static DEVICE_ATTR(chpids, 0444, chpids_show, NULL);
-static DEVICE_ATTR(pimpampom, 0444, pimpampom_show, NULL);
-
-static struct attribute *vfio_subchannel_attrs[] = {
-        &dev_attr_chpids.attr,
-        &dev_attr_pimpampom.attr,
-        NULL,
-};
-
-static struct attribute_group vfio_subchannel_attr_group = {
-        .attrs = vfio_subchannel_attrs,
-};
-
-/*
  * Css driver callbacks
  */
 static void vfio_ccw_sch_irq(struct subchannel *sch)
@@ -174,13 +126,9 @@ static int vfio_ccw_sch_probe(struct subchannel *sch)
         if (ret)
                 goto out_free;
 
-        ret = sysfs_create_group(&sch->dev.kobj, &vfio_subchannel_attr_group);
-        if (ret)
-                goto out_disable;
-
         ret = vfio_ccw_mdev_reg(sch);
         if (ret)
-                goto out_rm_group;
+                goto out_disable;
 
         INIT_WORK(&private->io_work, vfio_ccw_sch_io_todo);
         atomic_set(&private->avail, 1);
@@ -188,8 +136,6 @@ static int vfio_ccw_sch_probe(struct subchannel *sch)
 
         return 0;
 
-out_rm_group:
-        sysfs_remove_group(&sch->dev.kobj, &vfio_subchannel_attr_group);
 out_disable:
         cio_disable_subchannel(sch);
 out_free:
@@ -206,8 +152,6 @@ static int vfio_ccw_sch_remove(struct subchannel *sch)
 
         vfio_ccw_mdev_unreg(sch);
 
-        sysfs_remove_group(&sch->dev.kobj, &vfio_subchannel_attr_group);
-
         dev_set_drvdata(&sch->dev, NULL);
 
         kfree(private);
diff --git a/drivers/s390/cio/vfio_ccw_ops.c b/drivers/s390/cio/vfio_ccw_ops.c
index e72abbc18ee3..a66a317f3e4f 100644
--- a/drivers/s390/cio/vfio_ccw_ops.c
+++ b/drivers/s390/cio/vfio_ccw_ops.c
@@ -70,14 +70,14 @@ static ssize_t name_show(struct kobject *kobj, struct device *dev, char *buf)
 {
         return sprintf(buf, "I/O subchannel (Non-QDIO)\n");
 }
-MDEV_TYPE_ATTR_RO(name);
+static MDEV_TYPE_ATTR_RO(name);
 
 static ssize_t device_api_show(struct kobject *kobj, struct device *dev,
                                char *buf)
 {
         return sprintf(buf, "%s\n", VFIO_DEVICE_API_CCW_STRING);
 }
-MDEV_TYPE_ATTR_RO(device_api);
+static MDEV_TYPE_ATTR_RO(device_api);
 
 static ssize_t available_instances_show(struct kobject *kobj,
                                         struct device *dev, char *buf)
@@ -86,7 +86,7 @@ static ssize_t available_instances_show(struct kobject *kobj,
 
         return sprintf(buf, "%d\n", atomic_read(&private->avail));
 }
-MDEV_TYPE_ATTR_RO(available_instances);
+static MDEV_TYPE_ATTR_RO(available_instances);
 
 static struct attribute *mdev_types_attrs[] = {
         &mdev_type_attr_name.attr,
@@ -100,7 +100,7 @@ static struct attribute_group mdev_type_group = {
         .attrs = mdev_types_attrs,
 };
 
-struct attribute_group *mdev_type_groups[] = {
+static struct attribute_group *mdev_type_groups[] = {
         &mdev_type_group,
         NULL,
 };
@@ -152,7 +152,7 @@ static int vfio_ccw_mdev_open(struct mdev_device *mdev)
                                       &events, &private->nb);
 }
 
-void vfio_ccw_mdev_release(struct mdev_device *mdev)
+static void vfio_ccw_mdev_release(struct mdev_device *mdev)
 {
         struct vfio_ccw_private *private =
                 dev_get_drvdata(mdev_parent_dev(mdev));
@@ -233,7 +233,7 @@ static int vfio_ccw_mdev_get_region_info(struct vfio_region_info *info,
         }
 }
 
-int vfio_ccw_mdev_get_irq_info(struct vfio_irq_info *info)
+static int vfio_ccw_mdev_get_irq_info(struct vfio_irq_info *info)
 {
         if (info->index != VFIO_CCW_IO_IRQ_INDEX)
                 return -EINVAL;
diff --git a/drivers/s390/crypto/ap_bus.c b/drivers/s390/crypto/ap_bus.c
index 9be4596d8a08..6dee598979e7 100644
--- a/drivers/s390/crypto/ap_bus.c
+++ b/drivers/s390/crypto/ap_bus.c
@@ -668,10 +668,28 @@ static int ap_device_probe(struct device *dev)
         struct ap_driver *ap_drv = to_ap_drv(dev->driver);
         int rc;
 
+        /* Add queue/card to list of active queues/cards */
+        spin_lock_bh(&ap_list_lock);
+        if (is_card_dev(dev))
+                list_add(&to_ap_card(dev)->list, &ap_card_list);
+        else
+                list_add(&to_ap_queue(dev)->list,
+                         &to_ap_queue(dev)->card->queues);
+        spin_unlock_bh(&ap_list_lock);
+
         ap_dev->drv = ap_drv;
         rc = ap_drv->probe ? ap_drv->probe(ap_dev) : -ENODEV;
-        if (rc)
+
+        if (rc) {
+                spin_lock_bh(&ap_list_lock);
+                if (is_card_dev(dev))
+                        list_del_init(&to_ap_card(dev)->list);
+                else
+                        list_del_init(&to_ap_queue(dev)->list);
+                spin_unlock_bh(&ap_list_lock);
                 ap_dev->drv = NULL;
+        }
+
         return rc;
 }
 
@@ -680,14 +698,17 @@ static int ap_device_remove(struct device *dev)
         struct ap_device *ap_dev = to_ap_dev(dev);
         struct ap_driver *ap_drv = ap_dev->drv;
 
+        if (ap_drv->remove)
+                ap_drv->remove(ap_dev);
+
+        /* Remove queue/card from list of active queues/cards */
         spin_lock_bh(&ap_list_lock);
         if (is_card_dev(dev))
                 list_del_init(&to_ap_card(dev)->list);
         else
                 list_del_init(&to_ap_queue(dev)->list);
         spin_unlock_bh(&ap_list_lock);
-        if (ap_drv->remove)
-                ap_drv->remove(ap_dev);
+
         return 0;
 }
 
@@ -745,7 +766,7 @@ static ssize_t ap_domain_store(struct bus_type *bus,
         ap_domain_index = domain;
         spin_unlock_bh(&ap_domain_lock);
 
-        AP_DBF(DBF_DEBUG, "store new default domain=%d\n", domain);
+        AP_DBF(DBF_DEBUG, "stored new default domain=%d\n", domain);
 
         return count;
 }
@@ -931,6 +952,7 @@ static int ap_select_domain(void)
         }
         if (best_domain >= 0){
                 ap_domain_index = best_domain;
+                AP_DBF(DBF_DEBUG, "new ap_domain_index=%d\n", ap_domain_index);
                 spin_unlock_bh(&ap_domain_lock);
                 return 0;
         }
@@ -967,7 +989,7 @@ static void ap_scan_bus(struct work_struct *unused)
         ap_qid_t qid;
         int depth = 0, type = 0;
         unsigned int functions = 0;
-        int rc, id, dom, borked, domains;
+        int rc, id, dom, borked, domains, defdomdevs = 0;
 
         AP_DBF(DBF_DEBUG, "ap_scan_bus running\n");
 
@@ -1031,6 +1053,8 @@ static void ap_scan_bus(struct work_struct *unused)
                                 put_device(dev);
                                 if (!borked) {
                                         domains++;
+                                        if (dom == ap_domain_index)
+                                                defdomdevs++;
                                         continue;
                                 }
                         }
@@ -1056,10 +1080,6 @@ static void ap_scan_bus(struct work_struct *unused)
                                 }
                                 /* get it and thus adjust reference counter */
                                 get_device(&ac->ap_dev.device);
-                                /* Add card device to card list */
-                                spin_lock_bh(&ap_list_lock);
-                                list_add(&ac->list, &ap_card_list);
-                                spin_unlock_bh(&ap_list_lock);
                         }
                         /* now create the new queue device */
                         aq = ap_queue_create(qid, type);
@@ -1070,10 +1090,6 @@ static void ap_scan_bus(struct work_struct *unused)
                         aq->ap_dev.device.parent = &ac->ap_dev.device;
                         dev_set_name(&aq->ap_dev.device,
                                      "%02x.%04x", id, dom);
-                        /* Add queue device to card queue list */
-                        spin_lock_bh(&ap_list_lock);
-                        list_add(&aq->list, &ac->queues);
-                        spin_unlock_bh(&ap_list_lock);
                         /* Start with a device reset */
                         spin_lock_bh(&aq->lock);
                         ap_wait(ap_sm_event(aq, AP_EVENT_POLL));
@@ -1081,13 +1097,12 @@ static void ap_scan_bus(struct work_struct *unused)
                         /* Register device */
                         rc = device_register(&aq->ap_dev.device);
                         if (rc) {
-                                spin_lock_bh(&ap_list_lock);
-                                list_del_init(&aq->list);
-                                spin_unlock_bh(&ap_list_lock);
                                 put_device(&aq->ap_dev.device);
                                 continue;
                         }
                         domains++;
+                        if (dom == ap_domain_index)
+                                defdomdevs++;
                 } /* end domain loop */
                 if (ac) {
                         /* remove card dev if there are no queue devices */
@@ -1096,6 +1111,11 @@ static void ap_scan_bus(struct work_struct *unused)
                         put_device(&ac->ap_dev.device);
                 }
         } /* end device loop */
+
+        if (defdomdevs < 1)
+                AP_DBF(DBF_INFO, "no queue device with default domain %d available\n",
+                       ap_domain_index);
+
 out:
         mod_timer(&ap_config_timer, jiffies + ap_config_time * HZ);
 }
@@ -1164,14 +1184,14 @@ int __init ap_module_init(void)
         ap_init_configuration();
 
         if (ap_configuration)
-                max_domain_id = ap_max_domain_id ? : (AP_DOMAINS - 1);
+                max_domain_id =
+                        ap_max_domain_id ? ap_max_domain_id : AP_DOMAINS - 1;
         else
                 max_domain_id = 15;
         if (ap_domain_index < -1 || ap_domain_index > max_domain_id) {
                 pr_warn("%d is not a valid cryptographic domain\n",
                         ap_domain_index);
-                rc = -EINVAL;
-                goto out_free;
+                ap_domain_index = -1;
         }
         /* In resume callback we need to know if the user had set the domain.
          * If so, we can not just reset it.
@@ -1244,7 +1264,6 @@ out:
         unregister_reset_call(&ap_reset_call);
         if (ap_using_interrupts())
                 unregister_adapter_interrupt(&ap_airq);
-out_free:
         kfree(ap_configuration);
         return rc;
 }
diff --git a/drivers/s390/crypto/ap_card.c b/drivers/s390/crypto/ap_card.c
index cfa161ccc74e..836efac96813 100644
--- a/drivers/s390/crypto/ap_card.c
+++ b/drivers/s390/crypto/ap_card.c
@@ -160,7 +160,14 @@ static struct device_type ap_card_type = {
 
 static void ap_card_device_release(struct device *dev)
 {
-        kfree(to_ap_card(dev));
+        struct ap_card *ac = to_ap_card(dev);
+
+        if (!list_empty(&ac->list)) {
+                spin_lock_bh(&ap_list_lock);
+                list_del_init(&ac->list);
+                spin_unlock_bh(&ap_list_lock);
+        }
+        kfree(ac);
 }
 
 struct ap_card *ap_card_create(int id, int queue_depth, int device_type,
diff --git a/drivers/s390/crypto/ap_queue.c b/drivers/s390/crypto/ap_queue.c
index 480c58a63769..0f1a5d02acb0 100644
--- a/drivers/s390/crypto/ap_queue.c
+++ b/drivers/s390/crypto/ap_queue.c
@@ -584,7 +584,14 @@ static struct device_type ap_queue_type = {
 
 static void ap_queue_device_release(struct device *dev)
 {
-        kfree(to_ap_queue(dev));
+        struct ap_queue *aq = to_ap_queue(dev);
+
+        if (!list_empty(&aq->list)) {
+                spin_lock_bh(&ap_list_lock);
+                list_del_init(&aq->list);
+                spin_unlock_bh(&ap_list_lock);
+        }
+        kfree(aq);
 }
 
 struct ap_queue *ap_queue_create(ap_qid_t qid, int device_type)
diff --git a/drivers/s390/crypto/pkey_api.c b/drivers/s390/crypto/pkey_api.c
index ea86da8c75f9..f61fa47135a6 100644
--- a/drivers/s390/crypto/pkey_api.c
+++ b/drivers/s390/crypto/pkey_api.c
@@ -178,9 +178,9 @@ static inline void prep_xcrb(struct ica_xcRB *pxcrb,
         pxcrb->user_defined = (cardnr == 0xFFFF ? AUTOSELECT : cardnr);
         pxcrb->request_control_blk_length =
                 preqcblk->cprb_len + preqcblk->req_parml;
-        pxcrb->request_control_blk_addr = (void *) preqcblk;
+        pxcrb->request_control_blk_addr = (void __user *) preqcblk;
         pxcrb->reply_control_blk_length = preqcblk->rpl_msgbl;
-        pxcrb->reply_control_blk_addr = (void *) prepcblk;
+        pxcrb->reply_control_blk_addr = (void __user *) prepcblk;
 }
 
 /*
@@ -1194,7 +1194,7 @@ static struct miscdevice pkey_dev = {
 /*
  * Module init
  */
-int __init pkey_init(void)
+static int __init pkey_init(void)
 {
         cpacf_mask_t pckmo_functions;
 
diff --git a/drivers/s390/crypto/zcrypt_api.c b/drivers/s390/crypto/zcrypt_api.c
index 93015f85d4a6..b1c27e28859b 100644
--- a/drivers/s390/crypto/zcrypt_api.c
+++ b/drivers/s390/crypto/zcrypt_api.c
@@ -821,8 +821,10 @@ static long zcrypt_unlocked_ioctl(struct file *filp, unsigned int cmd,
                         do {
                                 rc = zcrypt_rsa_modexpo(&mex);
                         } while (rc == -EAGAIN);
-                if (rc)
+                if (rc) {
+                        ZCRYPT_DBF(DBF_DEBUG, "ioctl ICARSAMODEXPO rc=%d", rc);
                         return rc;
+                }
                 return put_user(mex.outputdatalength, &umex->outputdatalength);
         }
         case ICARSACRT: {
@@ -838,8 +840,10 @@ static long zcrypt_unlocked_ioctl(struct file *filp, unsigned int cmd,
                         do {
                                 rc = zcrypt_rsa_crt(&crt);
                         } while (rc == -EAGAIN);
-                if (rc)
+                if (rc) {
+                        ZCRYPT_DBF(DBF_DEBUG, "ioctl ICARSACRT rc=%d", rc);
                         return rc;
+                }
                 return put_user(crt.outputdatalength, &ucrt->outputdatalength);
         }
         case ZSECSENDCPRB: {
@@ -855,6 +859,8 @@ static long zcrypt_unlocked_ioctl(struct file *filp, unsigned int cmd,
                         do {
                                 rc = zcrypt_send_cprb(&xcRB);
                         } while (rc == -EAGAIN);
+                if (rc)
+                        ZCRYPT_DBF(DBF_DEBUG, "ioctl ZSENDCPRB rc=%d", rc);
                 if (copy_to_user(uxcRB, &xcRB, sizeof(xcRB)))
                         return -EFAULT;
                 return rc;
@@ -872,6 +878,8 @@ static long zcrypt_unlocked_ioctl(struct file *filp, unsigned int cmd,
                         do {
                                 rc = zcrypt_send_ep11_cprb(&xcrb);
                         } while (rc == -EAGAIN);
+                if (rc)
+                        ZCRYPT_DBF(DBF_DEBUG, "ioctl ZSENDEP11CPRB rc=%d", rc);
                 if (copy_to_user(uxcrb, &xcrb, sizeof(xcrb)))
                         return -EFAULT;
                 return rc;
diff --git a/drivers/s390/crypto/zcrypt_cca_key.h b/drivers/s390/crypto/zcrypt_cca_key.h
index ca0cdbe46368..12cff6262566 100644
--- a/drivers/s390/crypto/zcrypt_cca_key.h
+++ b/drivers/s390/crypto/zcrypt_cca_key.h
@@ -48,26 +48,6 @@ struct cca_token_hdr {
 
 #define CCA_TKN_HDR_ID_EXT 0x1E
 
-/**
- * mapping for the cca private ME section
- */
-struct cca_private_ext_ME_sec {
-        unsigned char  section_identifier;
-        unsigned char  version;
-        unsigned short section_length;
-        unsigned char  private_key_hash[20];
-        unsigned char  reserved1[4];
-        unsigned char  key_format;
-        unsigned char  reserved2;
-        unsigned char  key_name_hash[20];
-        unsigned char  key_use_flags[4];
-        unsigned char  reserved3[6];
-        unsigned char  reserved4[24];
-        unsigned char  confounder[24];
-        unsigned char  exponent[128];
-        unsigned char  modulus[128];
-} __attribute__((packed));
-
 #define CCA_PVT_USAGE_ALL 0x80
 
 /**
@@ -124,77 +104,6 @@ struct cca_pvt_ext_CRT_sec {
 #define CCA_PVT_EXT_CRT_SEC_FMT_CL 0x40
 
 /**
- * Set up private key fields of a type6 MEX message.
- * Note that all numerics in the key token are big-endian,
- * while the entries in the key block header are little-endian.
- *
- * @mex: pointer to user input data
- * @p: pointer to memory area for the key
- *
- * Returns the size of the key area or -EFAULT
- */
-static inline int zcrypt_type6_mex_key_de(struct ica_rsa_modexpo *mex,
-                                          void *p, int big_endian)
-{
-        static struct cca_token_hdr static_pvt_me_hdr = {
-                .token_identifier       =  0x1E,
-                .token_length           =  0x0183,
-        };
-        static struct cca_private_ext_ME_sec static_pvt_me_sec = {
-                .section_identifier     =  0x02,
-                .section_length         =  0x016C,
-                .key_use_flags          = {0x80,0x00,0x00,0x00},
-        };
-        static struct cca_public_sec static_pub_me_sec = {
-                .section_identifier     =  0x04,
-                .section_length         =  0x000F,
-                .exponent_len           =  0x0003,
-        };
-        static char pk_exponent[3] = { 0x01, 0x00, 0x01 };
-        struct {
-                struct T6_keyBlock_hdr t6_hdr;
-                struct cca_token_hdr pvtMeHdr;
-                struct cca_private_ext_ME_sec pvtMeSec;
-                struct cca_public_sec pubMeSec;
-                char exponent[3];
-        } __attribute__((packed)) *key = p;
-        unsigned char *temp;
-
-        memset(key, 0, sizeof(*key));
-
-        if (big_endian) {
-                key->t6_hdr.blen = cpu_to_be16(0x189);
-                key->t6_hdr.ulen = cpu_to_be16(0x189 - 2);
-        } else {
-                key->t6_hdr.blen = cpu_to_le16(0x189);
-                key->t6_hdr.ulen = cpu_to_le16(0x189 - 2);
-        }
-        key->pvtMeHdr = static_pvt_me_hdr;
-        key->pvtMeSec = static_pvt_me_sec;
-        key->pubMeSec = static_pub_me_sec;
-        /*
-         * In a private key, the modulus doesn't appear in the public
-         * section. So, an arbitrary public exponent of 0x010001 will be
-         * used.
-         */
-        memcpy(key->exponent, pk_exponent, 3);
-
-        /* key parameter block */
-        temp = key->pvtMeSec.exponent +
-                sizeof(key->pvtMeSec.exponent) - mex->inputdatalength;
-        if (copy_from_user(temp, mex->b_key, mex->inputdatalength))
-                return -EFAULT;
-
-        /* modulus */
-        temp = key->pvtMeSec.modulus +
-                sizeof(key->pvtMeSec.modulus) - mex->inputdatalength;
-        if (copy_from_user(temp, mex->n_modulus, mex->inputdatalength))
-                return -EFAULT;
-        key->pubMeSec.modulus_bit_len = 8 * mex->inputdatalength;
-        return sizeof(*key);
-}
-
-/**
  * Set up private key fields of a type6 MEX message. The _pad variant
  * strips leading zeroes from the b_key.
  * Note that all numerics in the key token are big-endian,
@@ -205,8 +114,7 @@ static inline int zcrypt_type6_mex_key_de(struct ica_rsa_modexpo *mex,
  *
  * Returns the size of the key area or -EFAULT
  */
-static inline int zcrypt_type6_mex_key_en(struct ica_rsa_modexpo *mex,
-                                          void *p, int big_endian)
+static inline int zcrypt_type6_mex_key_en(struct ica_rsa_modexpo *mex, void *p)
 {
         static struct cca_token_hdr static_pub_hdr = {
                 .token_identifier       =  0x1E,
@@ -251,13 +159,8 @@ static inline int zcrypt_type6_mex_key_en(struct ica_rsa_modexpo *mex,
                                         2*mex->inputdatalength - i;
         key->pubHdr.token_length =
                 key->pubSec.section_length + sizeof(key->pubHdr);
-        if (big_endian) {
-                key->t6_hdr.ulen = cpu_to_be16(key->pubHdr.token_length + 4);
-                key->t6_hdr.blen = cpu_to_be16(key->pubHdr.token_length + 6);
-        } else {
-                key->t6_hdr.ulen = cpu_to_le16(key->pubHdr.token_length + 4);
-                key->t6_hdr.blen = cpu_to_le16(key->pubHdr.token_length + 6);
-        }
+        key->t6_hdr.ulen = key->pubHdr.token_length + 4;
+        key->t6_hdr.blen = key->pubHdr.token_length + 6;
         return sizeof(*key) + 2*mex->inputdatalength - i;
 }
 
@@ -271,8 +174,7 @@ static inline int zcrypt_type6_mex_key_en(struct ica_rsa_modexpo *mex,
  *
  * Returns the size of the key area or -EFAULT
  */
-static inline int zcrypt_type6_crt_key(struct ica_rsa_modexpo_crt *crt,
-                                       void *p, int big_endian)
+static inline int zcrypt_type6_crt_key(struct ica_rsa_modexpo_crt *crt, void *p)
 {
         static struct cca_public_sec static_cca_pub_sec = {
                 .section_identifier = 4,
@@ -298,13 +200,8 @@ static inline int zcrypt_type6_crt_key(struct ica_rsa_modexpo_crt *crt,
         size = sizeof(*key) + key_len + sizeof(*pub) + 3;
 
         /* parameter block.key block */
-        if (big_endian) {
-                key->t6_hdr.blen = cpu_to_be16(size);
-                key->t6_hdr.ulen = cpu_to_be16(size - 2);
-        } else {
-                key->t6_hdr.blen = cpu_to_le16(size);
-                key->t6_hdr.ulen = cpu_to_le16(size - 2);
-        }
+        key->t6_hdr.blen = size;
+        key->t6_hdr.ulen = size - 2;
 
         /* key token header */
         key->token.token_identifier = CCA_TKN_HDR_ID_EXT;
diff --git a/drivers/s390/crypto/zcrypt_msgtype6.c b/drivers/s390/crypto/zcrypt_msgtype6.c
index e5563ffeb839..4fddb4319481 100644
--- a/drivers/s390/crypto/zcrypt_msgtype6.c
+++ b/drivers/s390/crypto/zcrypt_msgtype6.c
@@ -291,7 +291,7 @@ static int ICAMEX_msg_to_type6MEX_msgX(struct zcrypt_queue *zq,
                 return -EFAULT;
 
         /* Set up key which is located after the variable length text. */
-        size = zcrypt_type6_mex_key_en(mex, msg->text+mex->inputdatalength, 1);
+        size = zcrypt_type6_mex_key_en(mex, msg->text+mex->inputdatalength);
         if (size < 0)
                 return size;
         size += sizeof(*msg) + mex->inputdatalength;
@@ -353,7 +353,7 @@ static int ICACRT_msg_to_type6CRT_msgX(struct zcrypt_queue *zq,
                 return -EFAULT;
 
         /* Set up key which is located after the variable length text. */
-        size = zcrypt_type6_crt_key(crt, msg->text + crt->inputdatalength, 1);
+        size = zcrypt_type6_crt_key(crt, msg->text + crt->inputdatalength);
         if (size < 0)
                 return size;
         size += sizeof(*msg) + crt->inputdatalength;    /* total size of msg */
diff --git a/drivers/s390/net/qeth_core.h b/drivers/s390/net/qeth_core.h
index f6aa21176d89..30bc6105aac3 100644
--- a/drivers/s390/net/qeth_core.h
+++ b/drivers/s390/net/qeth_core.h
@@ -701,6 +701,7 @@ enum qeth_discipline_id {
 };
 
 struct qeth_discipline {
+        const struct device_type *devtype;
         void (*start_poll)(struct ccw_device *, int, unsigned long);
         qdio_handler_t *input_handler;
         qdio_handler_t *output_handler;
@@ -875,6 +876,9 @@ extern struct qeth_discipline qeth_l2_discipline;
 extern struct qeth_discipline qeth_l3_discipline;
 extern const struct attribute_group *qeth_generic_attr_groups[];
 extern const struct attribute_group *qeth_osn_attr_groups[];
+extern const struct attribute_group qeth_device_attr_group;
+extern const struct attribute_group qeth_device_blkt_group;
+extern const struct device_type qeth_generic_devtype;
 extern struct workqueue_struct *qeth_wq;
 
 int qeth_card_hw_is_reachable(struct qeth_card *);
diff --git a/drivers/s390/net/qeth_core_main.c b/drivers/s390/net/qeth_core_main.c
index 38114a8d56e0..fc6d85f2b38d 100644
--- a/drivers/s390/net/qeth_core_main.c
+++ b/drivers/s390/net/qeth_core_main.c
@@ -5530,10 +5530,12 @@ void qeth_core_free_discipline(struct qeth_card *card)
         card->discipline = NULL;
 }
 
-static const struct device_type qeth_generic_devtype = {
+const struct device_type qeth_generic_devtype = {
         .name = "qeth_generic",
         .groups = qeth_generic_attr_groups,
 };
+EXPORT_SYMBOL_GPL(qeth_generic_devtype);
+
 static const struct device_type qeth_osn_devtype = {
         .name = "qeth_osn",
         .groups = qeth_osn_attr_groups,
@@ -5659,23 +5661,22 @@ static int qeth_core_probe_device(struct ccwgroup_device *gdev)
                 goto err_card;
         }
 
-        if (card->info.type == QETH_CARD_TYPE_OSN)
-                gdev->dev.type = &qeth_osn_devtype;
-        else
-                gdev->dev.type = &qeth_generic_devtype;
-
         switch (card->info.type) {
         case QETH_CARD_TYPE_OSN:
         case QETH_CARD_TYPE_OSM:
                 rc = qeth_core_load_discipline(card, QETH_DISCIPLINE_LAYER2);
                 if (rc)
                         goto err_card;
+
+                gdev->dev.type = (card->info.type != QETH_CARD_TYPE_OSN)
+                                        ? card->discipline->devtype
+                                        : &qeth_osn_devtype;
                 rc = card->discipline->setup(card->gdev);
                 if (rc)
                         goto err_disc;
-        case QETH_CARD_TYPE_OSD:
-        case QETH_CARD_TYPE_OSX:
+                break;
         default:
+                gdev->dev.type = &qeth_generic_devtype;
                 break;
         }
 
@@ -5731,8 +5732,10 @@ static int qeth_core_set_online(struct ccwgroup_device *gdev)
                 if (rc)
                         goto err;
                 rc = card->discipline->setup(card->gdev);
-                if (rc)
+                if (rc) {
+                        qeth_core_free_discipline(card);
                         goto err;
+                }
         }
         rc = card->discipline->set_online(gdev);
 err:
diff --git a/drivers/s390/net/qeth_core_sys.c b/drivers/s390/net/qeth_core_sys.c
index 75b29fd2fcf4..db6a285d41e0 100644
--- a/drivers/s390/net/qeth_core_sys.c
+++ b/drivers/s390/net/qeth_core_sys.c
@@ -413,12 +413,16 @@ static ssize_t qeth_dev_layer2_store(struct device *dev,
 
         if (card->options.layer2 == newdis)
                 goto out;
-        else {
-                card->info.mac_bits  = 0;
-                if (card->discipline) {
-                        card->discipline->remove(card->gdev);
-                        qeth_core_free_discipline(card);
-                }
+        if (card->info.type == QETH_CARD_TYPE_OSM) {
+                /* fixed layer, can't switch */
+                rc = -EOPNOTSUPP;
+                goto out;
+        }
+
+        card->info.mac_bits = 0;
+        if (card->discipline) {
+                card->discipline->remove(card->gdev);
+                qeth_core_free_discipline(card);
         }
 
         rc = qeth_core_load_discipline(card, newdis);
@@ -426,6 +430,8 @@ static ssize_t qeth_dev_layer2_store(struct device *dev,
                 goto out;
 
         rc = card->discipline->setup(card->gdev);
+        if (rc)
+                qeth_core_free_discipline(card);
 out:
         mutex_unlock(&card->discipline_mutex);
         return rc ? rc : count;
@@ -703,10 +709,11 @@ static struct attribute *qeth_blkt_device_attrs[] = {
         &dev_attr_inter_jumbo.attr,
         NULL,
 };
-static struct attribute_group qeth_device_blkt_group = {
+const struct attribute_group qeth_device_blkt_group = {
         .name = "blkt",
         .attrs = qeth_blkt_device_attrs,
 };
+EXPORT_SYMBOL_GPL(qeth_device_blkt_group);
 
 static struct attribute *qeth_device_attrs[] = {
         &dev_attr_state.attr,
@@ -726,9 +733,10 @@ static struct attribute *qeth_device_attrs[] = {
         &dev_attr_switch_attrs.attr,
         NULL,
 };
-static struct attribute_group qeth_device_attr_group = {
+const struct attribute_group qeth_device_attr_group = {
         .attrs = qeth_device_attrs,
 };
+EXPORT_SYMBOL_GPL(qeth_device_attr_group);
 
 const struct attribute_group *qeth_generic_attr_groups[] = {
         &qeth_device_attr_group,
diff --git a/drivers/s390/net/qeth_l2.h b/drivers/s390/net/qeth_l2.h
index 29d9fb3890ad..0d59f9a45ea9 100644
--- a/drivers/s390/net/qeth_l2.h
+++ b/drivers/s390/net/qeth_l2.h
@@ -8,6 +8,8 @@
 
 #include "qeth_core.h"
 
+extern const struct attribute_group *qeth_l2_attr_groups[];
+
 int qeth_l2_create_device_attributes(struct device *);
 void qeth_l2_remove_device_attributes(struct device *);
 void qeth_l2_setup_bridgeport_attrs(struct qeth_card *card);
diff --git a/drivers/s390/net/qeth_l2_main.c b/drivers/s390/net/qeth_l2_main.c
index 1b07f382d74c..bd2df62a5cdf 100644
--- a/drivers/s390/net/qeth_l2_main.c
+++ b/drivers/s390/net/qeth_l2_main.c
@@ -880,11 +880,21 @@ static int qeth_l2_stop(struct net_device *dev)
         return 0;
 }
 
+static const struct device_type qeth_l2_devtype = {
+        .name = "qeth_layer2",
+        .groups = qeth_l2_attr_groups,
+};
+
 static int qeth_l2_probe_device(struct ccwgroup_device *gdev)
 {
         struct qeth_card *card = dev_get_drvdata(&gdev->dev);
+        int rc;
 
-        qeth_l2_create_device_attributes(&gdev->dev);
+        if (gdev->dev.type == &qeth_generic_devtype) {
+                rc = qeth_l2_create_device_attributes(&gdev->dev);
+                if (rc)
+                        return rc;
+        }
         INIT_LIST_HEAD(&card->vid_list);
         hash_init(card->mac_htable);
         card->options.layer2 = 1;
@@ -896,7 +906,8 @@ static void qeth_l2_remove_device(struct ccwgroup_device *cgdev)
 {
         struct qeth_card *card = dev_get_drvdata(&cgdev->dev);
 
-        qeth_l2_remove_device_attributes(&cgdev->dev);
+        if (cgdev->dev.type == &qeth_generic_devtype)
+                qeth_l2_remove_device_attributes(&cgdev->dev);
         qeth_set_allowed_threads(card, 0, 1);
         wait_event(card->wait_q, qeth_threads_running(card, 0xffffffff) == 0);
 
@@ -954,7 +965,6 @@ static int qeth_l2_setup_netdev(struct qeth_card *card)
         case QETH_CARD_TYPE_OSN:
                 card->dev = alloc_netdev(0, "osn%d", NET_NAME_UNKNOWN,
                                          ether_setup);
-                card->dev->flags |= IFF_NOARP;
                 break;
         default:
                 card->dev = alloc_etherdev(0);
@@ -969,9 +979,12 @@ static int qeth_l2_setup_netdev(struct qeth_card *card)
         card->dev->min_mtu = 64;
         card->dev->max_mtu = ETH_MAX_MTU;
         card->dev->netdev_ops = &qeth_l2_netdev_ops;
-        card->dev->ethtool_ops =
-                (card->info.type != QETH_CARD_TYPE_OSN) ?
-                &qeth_l2_ethtool_ops : &qeth_l2_osn_ops;
+        if (card->info.type == QETH_CARD_TYPE_OSN) {
+                card->dev->ethtool_ops = &qeth_l2_osn_ops;
+                card->dev->flags |= IFF_NOARP;
+        } else {
+                card->dev->ethtool_ops = &qeth_l2_ethtool_ops;
+        }
         card->dev->features |= NETIF_F_HW_VLAN_CTAG_FILTER;
         if (card->info.type == QETH_CARD_TYPE_OSD && !card->info.guestlan) {
                 card->dev->hw_features = NETIF_F_SG;
@@ -1269,6 +1282,7 @@ static int qeth_l2_control_event(struct qeth_card *card,
 }
 
 struct qeth_discipline qeth_l2_discipline = {
+        .devtype = &qeth_l2_devtype,
         .start_poll = qeth_qdio_start_poll,
         .input_handler = (qdio_handler_t *) qeth_qdio_input_handler,
         .output_handler = (qdio_handler_t *) qeth_qdio_output_handler,
diff --git a/drivers/s390/net/qeth_l2_sys.c b/drivers/s390/net/qeth_l2_sys.c
index 687972356d6b..9696baa49e2d 100644
--- a/drivers/s390/net/qeth_l2_sys.c
+++ b/drivers/s390/net/qeth_l2_sys.c
@@ -269,3 +269,11 @@ void qeth_l2_setup_bridgeport_attrs(struct qeth_card *card)
         } else
                 qeth_bridgeport_an_set(card, 0);
 }
+
+const struct attribute_group *qeth_l2_attr_groups[] = {
+        &qeth_device_attr_group,
+        &qeth_device_blkt_group,
+        /* l2 specific, see l2_{create,remove}_device_attributes(): */
+        &qeth_l2_bridgeport_attr_group,
+        NULL,
+};
diff --git a/drivers/s390/net/qeth_l3_main.c b/drivers/s390/net/qeth_l3_main.c
index 6e0354ef4b86..d8df1e635163 100644
--- a/drivers/s390/net/qeth_l3_main.c
+++ b/drivers/s390/net/qeth_l3_main.c
@@ -3039,8 +3039,13 @@ static int qeth_l3_setup_netdev(struct qeth_card *card)
 static int qeth_l3_probe_device(struct ccwgroup_device *gdev)
 {
         struct qeth_card *card = dev_get_drvdata(&gdev->dev);
+        int rc;
 
-        qeth_l3_create_device_attributes(&gdev->dev);
+        rc = qeth_l3_create_device_attributes(&gdev->dev);
+        if (rc)
+                return rc;
+        hash_init(card->ip_htable);
+        hash_init(card->ip_mc_htable);
         card->options.layer2 = 0;
         card->info.hwtrap = 0;
         return 0;
@@ -3306,6 +3311,7 @@ static int qeth_l3_control_event(struct qeth_card *card,
 }
 
 struct qeth_discipline qeth_l3_discipline = {
+        .devtype = &qeth_generic_devtype,
         .start_poll = qeth_qdio_start_poll,
         .input_handler = (qdio_handler_t *) qeth_qdio_input_handler,
         .output_handler = (qdio_handler_t *) qeth_qdio_output_handler,
diff --git a/drivers/s390/virtio/virtio_ccw.c b/drivers/s390/virtio/virtio_ccw.c
index 2a76ea78a0bf..b18fe2014cf2 100644
--- a/drivers/s390/virtio/virtio_ccw.c
+++ b/drivers/s390/virtio/virtio_ccw.c
@@ -87,7 +87,7 @@ struct vq_info_block {
 } __packed;
 
 struct virtio_feature_desc {
-        __u32 features;
+        __le32 features;
         __u8 index;
 } __packed;
 
diff --git a/drivers/soc/ti/knav_dma.c b/drivers/soc/ti/knav_dma.c
index ecebe2eecc3a..026182d3b27c 100644
--- a/drivers/soc/ti/knav_dma.c
+++ b/drivers/soc/ti/knav_dma.c
@@ -413,7 +413,7 @@ static int of_channel_match_helper(struct device_node *np, const char *name,
  * @name:       slave channel name
  * @config:     dma configuration parameters
  *
- * Returns pointer to appropriate DMA channel on success or NULL.
+ * Returns pointer to appropriate DMA channel on success or error.
  */
 void *knav_dma_open_channel(struct device *dev, const char *name,
                                         struct knav_dma_cfg *config)
diff --git a/drivers/tty/hvc/Kconfig b/drivers/tty/hvc/Kconfig
index 574da15fe618..b8d5ea0ae26b 100644
--- a/drivers/tty/hvc/Kconfig
+++ b/drivers/tty/hvc/Kconfig
@@ -44,7 +44,7 @@ config HVC_RTAS
 
 config HVC_IUCV
         bool "z/VM IUCV Hypervisor console support (VM only)"
-        depends on S390
+        depends on S390 && NET
         select HVC_DRIVER
         select IUCV
         default y
diff --git a/fs/cifs/cifsacl.c b/fs/cifs/cifsacl.c
index 15bac390dff9..b98436f5c7c7 100644
--- a/fs/cifs/cifsacl.c
+++ b/fs/cifs/cifsacl.c
@@ -1135,20 +1135,19 @@ cifs_acl_to_fattr(struct cifs_sb_info *cifs_sb, struct cifs_fattr *fattr,
         u32 acllen = 0;
         int rc = 0;
         struct tcon_link *tlink = cifs_sb_tlink(cifs_sb);
-        struct cifs_tcon *tcon;
+        struct smb_version_operations *ops;
 
         cifs_dbg(NOISY, "converting ACL to mode for %s\n", path);
 
         if (IS_ERR(tlink))
                 return PTR_ERR(tlink);
-        tcon = tlink_tcon(tlink);
 
-        if (pfid && (tcon->ses->server->ops->get_acl_by_fid))
-                pntsd = tcon->ses->server->ops->get_acl_by_fid(cifs_sb, pfid,
-                                                          &acllen);
-        else if (tcon->ses->server->ops->get_acl)
-                pntsd = tcon->ses->server->ops->get_acl(cifs_sb, inode, path,
-                                                        &acllen);
+        ops = tlink_tcon(tlink)->ses->server->ops;
+
+        if (pfid && (ops->get_acl_by_fid))
+                pntsd = ops->get_acl_by_fid(cifs_sb, pfid, &acllen);
+        else if (ops->get_acl)
+                pntsd = ops->get_acl(cifs_sb, inode, path, &acllen);
         else {
                 cifs_put_tlink(tlink);
                 return -EOPNOTSUPP;
@@ -1181,23 +1180,23 @@ id_mode_to_cifs_acl(struct inode *inode, const char *path, __u64 nmode,
         struct cifs_ntsd *pnntsd = NULL; /* modified acl to be sent to server */
         struct cifs_sb_info *cifs_sb = CIFS_SB(inode->i_sb);
         struct tcon_link *tlink = cifs_sb_tlink(cifs_sb);
-        struct cifs_tcon *tcon;
+        struct smb_version_operations *ops;
 
         if (IS_ERR(tlink))
                 return PTR_ERR(tlink);
-        tcon = tlink_tcon(tlink);
+
+        ops = tlink_tcon(tlink)->ses->server->ops;
 
         cifs_dbg(NOISY, "set ACL from mode for %s\n", path);
 
         /* Get the security descriptor */
 
-        if (tcon->ses->server->ops->get_acl == NULL) {
+        if (ops->get_acl == NULL) {
                 cifs_put_tlink(tlink);
                 return -EOPNOTSUPP;
         }
 
-        pntsd = tcon->ses->server->ops->get_acl(cifs_sb, inode, path,
-                                                &secdesclen);
+        pntsd = ops->get_acl(cifs_sb, inode, path, &secdesclen);
         if (IS_ERR(pntsd)) {
                 rc = PTR_ERR(pntsd);
                 cifs_dbg(VFS, "%s: error %d getting sec desc\n", __func__, rc);
@@ -1224,13 +1223,12 @@ id_mode_to_cifs_acl(struct inode *inode, const char *path, __u64 nmode,
 
         cifs_dbg(NOISY, "build_sec_desc rc: %d\n", rc);
 
-        if (tcon->ses->server->ops->set_acl == NULL)
+        if (ops->set_acl == NULL)
                 rc = -EOPNOTSUPP;
 
         if (!rc) {
                 /* Set the security descriptor */
-                rc = tcon->ses->server->ops->set_acl(pnntsd, secdesclen, inode,
-                                                     path, aclflag);
+                rc = ops->set_acl(pnntsd, secdesclen, inode, path, aclflag);
                 cifs_dbg(NOISY, "set_cifs_acl rc: %d\n", rc);
         }
         cifs_put_tlink(tlink);
diff --git a/fs/cifs/cifsglob.h b/fs/cifs/cifsglob.h
index 8be55be70faf..bcc7d9acad64 100644
--- a/fs/cifs/cifsglob.h
+++ b/fs/cifs/cifsglob.h
@@ -418,7 +418,7 @@ struct smb_version_operations {
         int (*validate_negotiate)(const unsigned int, struct cifs_tcon *);
         ssize_t (*query_all_EAs)(const unsigned int, struct cifs_tcon *,
                         const unsigned char *, const unsigned char *, char *,
-                        size_t, const struct nls_table *, int);
+                        size_t, struct cifs_sb_info *);
         int (*set_EA)(const unsigned int, struct cifs_tcon *, const char *,
                         const char *, const void *, const __u16,
                         const struct nls_table *, int);
diff --git a/fs/cifs/cifsproto.h b/fs/cifs/cifsproto.h
index e49958c3f8bb..6eb3147132e3 100644
--- a/fs/cifs/cifsproto.h
+++ b/fs/cifs/cifsproto.h
@@ -480,8 +480,7 @@ extern int CIFSSMBCopy(unsigned int xid,
 extern ssize_t CIFSSMBQAllEAs(const unsigned int xid, struct cifs_tcon *tcon,
                         const unsigned char *searchName,
                         const unsigned char *ea_name, char *EAData,
-                        size_t bufsize, const struct nls_table *nls_codepage,
-                        int remap_special_chars);
+                        size_t bufsize, struct cifs_sb_info *cifs_sb);
 extern int CIFSSMBSetEA(const unsigned int xid, struct cifs_tcon *tcon,
                 const char *fileName, const char *ea_name,
                 const void *ea_value, const __u16 ea_value_len,
diff --git a/fs/cifs/cifssmb.c b/fs/cifs/cifssmb.c
index 4c01b3f9abf0..fbb0d4cbda41 100644
--- a/fs/cifs/cifssmb.c
+++ b/fs/cifs/cifssmb.c
@@ -697,9 +697,7 @@ cifs_echo_callback(struct mid_q_entry *mid)
 {
         struct TCP_Server_Info *server = mid->callback_data;
 
-        mutex_lock(&server->srv_mutex);
         DeleteMidQEntry(mid);
-        mutex_unlock(&server->srv_mutex);
         add_credits(server, 1, CIFS_ECHO_OP);
 }
 
@@ -1599,9 +1597,7 @@ cifs_readv_callback(struct mid_q_entry *mid)
         }
 
         queue_work(cifsiod_wq, &rdata->work);
-        mutex_lock(&server->srv_mutex);
         DeleteMidQEntry(mid);
-        mutex_unlock(&server->srv_mutex);
         add_credits(server, 1, 0);
 }
 
@@ -2058,7 +2054,6 @@ cifs_writev_callback(struct mid_q_entry *mid)
 {
         struct cifs_writedata *wdata = mid->callback_data;
         struct cifs_tcon *tcon = tlink_tcon(wdata->cfile->tlink);
-        struct TCP_Server_Info *server = tcon->ses->server;
         unsigned int written;
         WRITE_RSP *smb = (WRITE_RSP *)mid->resp_buf;
 
@@ -2095,9 +2090,7 @@ cifs_writev_callback(struct mid_q_entry *mid)
         }
 
         queue_work(cifsiod_wq, &wdata->work);
-        mutex_lock(&server->srv_mutex);
         DeleteMidQEntry(mid);
-        mutex_unlock(&server->srv_mutex);
         add_credits(tcon->ses->server, 1, 0);
 }
 
@@ -6076,11 +6069,13 @@ ssize_t
 CIFSSMBQAllEAs(const unsigned int xid, struct cifs_tcon *tcon,
                 const unsigned char *searchName, const unsigned char *ea_name,
                 char *EAData, size_t buf_size,
-                const struct nls_table *nls_codepage, int remap)
+                struct cifs_sb_info *cifs_sb)
 {
                 /* BB assumes one setup word */
         TRANSACTION2_QPI_REQ *pSMB = NULL;
         TRANSACTION2_QPI_RSP *pSMBr = NULL;
+        int remap = cifs_remap(cifs_sb);
+        struct nls_table *nls_codepage = cifs_sb->local_nls;
         int rc = 0;
         int bytes_returned;
         int list_len;
diff --git a/fs/cifs/file.c b/fs/cifs/file.c
index 6ef78ad838e6..0fd081bd2a2f 100644
--- a/fs/cifs/file.c
+++ b/fs/cifs/file.c
@@ -582,7 +582,7 @@ cifs_relock_file(struct cifsFileInfo *cfile)
         struct cifs_tcon *tcon = tlink_tcon(cfile->tlink);
         int rc = 0;
 
-        down_read(&cinode->lock_sem);
+        down_read_nested(&cinode->lock_sem, SINGLE_DEPTH_NESTING);
         if (cinode->can_cache_brlcks) {
                 /* can cache locks - no need to relock */
                 up_read(&cinode->lock_sem);
diff --git a/fs/cifs/inode.c b/fs/cifs/inode.c
index c3b2fa0b2ec8..4d1fcd76d022 100644
--- a/fs/cifs/inode.c
+++ b/fs/cifs/inode.c
@@ -563,8 +563,7 @@ static int cifs_sfu_mode(struct cifs_fattr *fattr, const unsigned char *path,
 
         rc = tcon->ses->server->ops->query_all_EAs(xid, tcon, path,
                         "SETFILEBITS", ea_value, 4 /* size of buf */,
-                        cifs_sb->local_nls,
-                        cifs_remap(cifs_sb));
+                        cifs_sb);
         cifs_put_tlink(tlink);
         if (rc < 0)
                 return (int)rc;
diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c
index 48ff7703b919..e4afdaae743f 100644
--- a/fs/cifs/smb2pdu.c
+++ b/fs/cifs/smb2pdu.c
@@ -1240,15 +1240,19 @@ SMB2_tcon(const unsigned int xid, struct cifs_ses *ses, const char *tree,
                 goto tcon_exit;
         }
 
-        if (rsp->ShareType & SMB2_SHARE_TYPE_DISK)
+        switch (rsp->ShareType) {
+        case SMB2_SHARE_TYPE_DISK:
                 cifs_dbg(FYI, "connection to disk share\n");
-        else if (rsp->ShareType & SMB2_SHARE_TYPE_PIPE) {
+                break;
+        case SMB2_SHARE_TYPE_PIPE:
                 tcon->ipc = true;
                 cifs_dbg(FYI, "connection to pipe share\n");
-        } else if (rsp->ShareType & SMB2_SHARE_TYPE_PRINT) {
-                tcon->print = true;
+                break;
+        case SMB2_SHARE_TYPE_PRINT:
+                tcon->ipc = true;
                 cifs_dbg(FYI, "connection to printer\n");
-        } else {
+                break;
+        default:
                 cifs_dbg(VFS, "unknown share type %d\n", rsp->ShareType);
                 rc = -EOPNOTSUPP;
                 goto tcon_error_exit;
@@ -2173,9 +2177,7 @@ smb2_echo_callback(struct mid_q_entry *mid)
         if (mid->mid_state == MID_RESPONSE_RECEIVED)
                 credits_received = le16_to_cpu(rsp->hdr.sync_hdr.CreditRequest);
 
-        mutex_lock(&server->srv_mutex);
         DeleteMidQEntry(mid);
-        mutex_unlock(&server->srv_mutex);
         add_credits(server, credits_received, CIFS_ECHO_OP);
 }
 
@@ -2433,9 +2435,7 @@ smb2_readv_callback(struct mid_q_entry *mid)
                 cifs_stats_fail_inc(tcon, SMB2_READ_HE);
 
         queue_work(cifsiod_wq, &rdata->work);
-        mutex_lock(&server->srv_mutex);
         DeleteMidQEntry(mid);
-        mutex_unlock(&server->srv_mutex);
         add_credits(server, credits_received, 0);
 }
 
@@ -2594,7 +2594,6 @@ smb2_writev_callback(struct mid_q_entry *mid)
 {
         struct cifs_writedata *wdata = mid->callback_data;
         struct cifs_tcon *tcon = tlink_tcon(wdata->cfile->tlink);
-        struct TCP_Server_Info *server = tcon->ses->server;
         unsigned int written;
         struct smb2_write_rsp *rsp = (struct smb2_write_rsp *)mid->resp_buf;
         unsigned int credits_received = 1;
@@ -2634,9 +2633,7 @@ smb2_writev_callback(struct mid_q_entry *mid)
                 cifs_stats_fail_inc(tcon, SMB2_WRITE_HE);
 
         queue_work(cifsiod_wq, &wdata->work);
-        mutex_lock(&server->srv_mutex);
         DeleteMidQEntry(mid);
-        mutex_unlock(&server->srv_mutex);
         add_credits(tcon->ses->server, credits_received, 0);
 }
 
diff --git a/fs/cifs/transport.c b/fs/cifs/transport.c
index 4d64b5b8fc9c..47a125ece11e 100644
--- a/fs/cifs/transport.c
+++ b/fs/cifs/transport.c
@@ -94,7 +94,7 @@ DeleteMidQEntry(struct mid_q_entry *midEntry)
         now = jiffies;
         /* commands taking longer than one second are indications that
            something is wrong, unless it is quite a slow link or server */
-        if ((now - midEntry->when_alloc) > HZ) {
+        if (time_after(now, midEntry->when_alloc + HZ)) {
                 if ((cifsFYI & CIFS_TIMER) && (midEntry->command != command)) {
                         pr_debug(" CIFS slow rsp: cmd %d mid %llu",
                                midEntry->command, midEntry->mid);
@@ -613,9 +613,7 @@ cifs_sync_mid_result(struct mid_q_entry *mid, struct TCP_Server_Info *server)
         }
         spin_unlock(&GlobalMid_Lock);
 
-        mutex_lock(&server->srv_mutex);
         DeleteMidQEntry(mid);
-        mutex_unlock(&server->srv_mutex);
         return rc;
 }
 
diff --git a/fs/cifs/xattr.c b/fs/cifs/xattr.c
index 20af5187ba63..3cb5c9e2d4e7 100644
--- a/fs/cifs/xattr.c
+++ b/fs/cifs/xattr.c
@@ -235,8 +235,7 @@ static int cifs_xattr_get(const struct xattr_handler *handler,
 
                 if (pTcon->ses->server->ops->query_all_EAs)
                         rc = pTcon->ses->server->ops->query_all_EAs(xid, pTcon,
-                                full_path, name, value, size,
-                                cifs_sb->local_nls, cifs_remap(cifs_sb));
+                                full_path, name, value, size, cifs_sb);
                 break;
 
         case XATTR_CIFS_ACL: {
@@ -336,8 +335,7 @@ ssize_t cifs_listxattr(struct dentry *direntry, char *data, size_t buf_size)
 
         if (pTcon->ses->server->ops->query_all_EAs)
                 rc = pTcon->ses->server->ops->query_all_EAs(xid, pTcon,
-                                full_path, NULL, data, buf_size,
-                                cifs_sb->local_nls, cifs_remap(cifs_sb));
+                                full_path, NULL, data, buf_size, cifs_sb);
 list_ea_exit:
         kfree(full_path);
         free_xid(xid);
diff --git a/include/linux/bpf_verifier.h b/include/linux/bpf_verifier.h
index 5efb4db44e1e..d5093b52b485 100644
--- a/include/linux/bpf_verifier.h
+++ b/include/linux/bpf_verifier.h
@@ -40,6 +40,9 @@ struct bpf_reg_state {
          */
         s64 min_value;
         u64 max_value;
+        u32 min_align;
+        u32 aux_off;
+        u32 aux_off_align;
 };
 
 enum bpf_stack_slot_type {
@@ -87,6 +90,7 @@ struct bpf_verifier_env {
         struct bpf_prog *prog;          /* eBPF program being verified */
         struct bpf_verifier_stack_elem *head; /* stack of verifier states to be processed */
         int stack_size;                 /* number of states to be processed */
+        bool strict_alignment;          /* perform strict pointer alignment checks */
         struct bpf_verifier_state cur_state; /* current verifier state */
         struct bpf_verifier_state_list **explored_states; /* search pruning optimization */
         const struct bpf_ext_analyzer_ops *analyzer_ops; /* external analyzer ops */
diff --git a/include/linux/mlx5/fs.h b/include/linux/mlx5/fs.h
index 1b166d2e19c5..b25e7baa273e 100644
--- a/include/linux/mlx5/fs.h
+++ b/include/linux/mlx5/fs.h
@@ -109,7 +109,6 @@ struct mlx5_flow_table_attr {
         int max_fte;
         u32 level;
         u32 flags;
-        u32 underlay_qpn;
 };
 
 struct mlx5_flow_table *
@@ -167,4 +166,7 @@ struct mlx5_fc *mlx5_fc_create(struct mlx5_core_dev *dev, bool aging);
 void mlx5_fc_destroy(struct mlx5_core_dev *dev, struct mlx5_fc *counter);
 void mlx5_fc_query_cached(struct mlx5_fc *counter,
                           u64 *bytes, u64 *packets, u64 *lastuse);
+int mlx5_fs_add_rx_underlay_qpn(struct mlx5_core_dev *dev, u32 underlay_qpn);
+int mlx5_fs_remove_rx_underlay_qpn(struct mlx5_core_dev *dev, u32 underlay_qpn);
+
 #endif
diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
index 9c23bd2efb56..3f39d27decf4 100644
--- a/include/linux/netdevice.h
+++ b/include/linux/netdevice.h
@@ -3296,11 +3296,15 @@ int dev_get_phys_port_id(struct net_device *dev,
 int dev_get_phys_port_name(struct net_device *dev,
                            char *name, size_t len);
 int dev_change_proto_down(struct net_device *dev, bool proto_down);
-int dev_change_xdp_fd(struct net_device *dev, struct netlink_ext_ack *extack,
-                      int fd, u32 flags);
 struct sk_buff *validate_xmit_skb_list(struct sk_buff *skb, struct net_device *dev);
 struct sk_buff *dev_hard_start_xmit(struct sk_buff *skb, struct net_device *dev,
                                     struct netdev_queue *txq, int *ret);
+
+typedef int (*xdp_op_t)(struct net_device *dev, struct netdev_xdp *xdp);
+int dev_change_xdp_fd(struct net_device *dev, struct netlink_ext_ack *extack,
+                      int fd, u32 flags);
+bool __dev_xdp_attached(struct net_device *dev, xdp_op_t xdp_op);
+
 int __dev_forward_skb(struct net_device *dev, struct sk_buff *skb);
 int dev_forward_skb(struct net_device *dev, struct sk_buff *skb);
 bool is_skb_forwardable(const struct net_device *dev,
diff --git a/include/uapi/linux/bpf.h b/include/uapi/linux/bpf.h
index 945a1f5f63c5..94dfa9def355 100644
--- a/include/uapi/linux/bpf.h
+++ b/include/uapi/linux/bpf.h
@@ -132,6 +132,13 @@ enum bpf_attach_type {
  */
 #define BPF_F_ALLOW_OVERRIDE    (1U << 0)
 
+/* If BPF_F_STRICT_ALIGNMENT is used in BPF_PROG_LOAD command, the
+ * verifier will perform strict alignment checking as if the kernel
+ * has been built with CONFIG_EFFICIENT_UNALIGNED_ACCESS not set,
+ * and NET_IP_ALIGN defined to 2.
+ */
+#define BPF_F_STRICT_ALIGNMENT  (1U << 0)
+
 #define BPF_PSEUDO_MAP_FD       1
 
 /* flags for BPF_MAP_UPDATE_ELEM command */
@@ -177,6 +184,7 @@ union bpf_attr {
                 __u32           log_size;       /* size of user buffer */
                 __aligned_u64   log_buf;        /* user supplied buffer */
                 __u32           kern_version;   /* checked when prog_type=kprobe */
+                __u32           prog_flags;
         };
 
         struct { /* anonymous struct used by BPF_OBJ_* commands */
diff --git a/include/uapi/linux/if_link.h b/include/uapi/linux/if_link.h
index 8e56ac70e0d1..15ac20382aba 100644
--- a/include/uapi/linux/if_link.h
+++ b/include/uapi/linux/if_link.h
@@ -888,9 +888,18 @@ enum {
 /* XDP section */
 
 #define XDP_FLAGS_UPDATE_IF_NOEXIST     (1U << 0)
-#define XDP_FLAGS_SKB_MODE              (2U << 0)
+#define XDP_FLAGS_SKB_MODE              (1U << 1)
+#define XDP_FLAGS_DRV_MODE              (1U << 2)
 #define XDP_FLAGS_MASK                  (XDP_FLAGS_UPDATE_IF_NOEXIST | \
-                                         XDP_FLAGS_SKB_MODE)
+                                         XDP_FLAGS_SKB_MODE | \
+                                         XDP_FLAGS_DRV_MODE)
+
+/* These are stored into IFLA_XDP_ATTACHED on dump. */
+enum {
+        XDP_ATTACHED_NONE = 0,
+        XDP_ATTACHED_DRV,
+        XDP_ATTACHED_SKB,
+};
 
 enum {
         IFLA_XDP_UNSPEC,
diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c
index fd2411fd6914..265a0d854e33 100644
--- a/kernel/bpf/syscall.c
+++ b/kernel/bpf/syscall.c
@@ -783,7 +783,7 @@ struct bpf_prog *bpf_prog_get_type(u32 ufd, enum bpf_prog_type type)
 EXPORT_SYMBOL_GPL(bpf_prog_get_type);
 
 /* last field in 'union bpf_attr' used by this command */
-#define BPF_PROG_LOAD_LAST_FIELD kern_version
+#define BPF_PROG_LOAD_LAST_FIELD prog_flags
 
 static int bpf_prog_load(union bpf_attr *attr)
 {
@@ -796,6 +796,9 @@ static int bpf_prog_load(union bpf_attr *attr)
         if (CHECK_ATTR(BPF_PROG_LOAD))
                 return -EINVAL;
 
+        if (attr->prog_flags & ~BPF_F_STRICT_ALIGNMENT)
+                return -EINVAL;
+
         /* copy eBPF program license from user space */
         if (strncpy_from_user(license, u64_to_user_ptr(attr->license),
                               sizeof(license) - 1) < 0)
diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index c5b56c92f8e2..39f2dcbc4cbc 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -241,6 +241,12 @@ static void print_verifier_state(struct bpf_verifier_state *state)
                 if (reg->max_value != BPF_REGISTER_MAX_RANGE)
                         verbose(",max_value=%llu",
                                 (unsigned long long)reg->max_value);
+                if (reg->min_align)
+                        verbose(",min_align=%u", reg->min_align);
+                if (reg->aux_off)
+                        verbose(",aux_off=%u", reg->aux_off);
+                if (reg->aux_off_align)
+                        verbose(",aux_off_align=%u", reg->aux_off_align);
         }
         for (i = 0; i < MAX_BPF_STACK; i += BPF_REG_SIZE) {
                 if (state->stack_slot_type[i] == STACK_SPILL)
@@ -466,6 +472,9 @@ static void init_reg_state(struct bpf_reg_state *regs)
                 regs[i].imm = 0;
                 regs[i].min_value = BPF_REGISTER_MIN_RANGE;
                 regs[i].max_value = BPF_REGISTER_MAX_RANGE;
+                regs[i].min_align = 0;
+                regs[i].aux_off = 0;
+                regs[i].aux_off_align = 0;
         }
 
         /* frame pointer */
@@ -492,6 +501,7 @@ static void reset_reg_range_values(struct bpf_reg_state *regs, u32 regno)
 {
         regs[regno].min_value = BPF_REGISTER_MIN_RANGE;
         regs[regno].max_value = BPF_REGISTER_MAX_RANGE;
+        regs[regno].min_align = 0;
 }
 
 static void mark_reg_unknown_value_and_range(struct bpf_reg_state *regs,
@@ -779,17 +789,33 @@ static bool is_pointer_value(struct bpf_verifier_env *env, int regno)
 }
 
 static int check_pkt_ptr_alignment(const struct bpf_reg_state *reg,
-                                   int off, int size)
+                                   int off, int size, bool strict)
 {
-        if (reg->id && size != 1) {
-                verbose("Unknown alignment. Only byte-sized access allowed in packet access.\n");
-                return -EACCES;
+        int ip_align;
+        int reg_off;
+
+        /* Byte size accesses are always allowed. */
+        if (!strict || size == 1)
+                return 0;
+
+        reg_off = reg->off;
+        if (reg->id) {
+                if (reg->aux_off_align % size) {
+                        verbose("Packet access is only %u byte aligned, %d byte access not allowed\n",
+                                reg->aux_off_align, size);
+                        return -EACCES;
+                }
+                reg_off += reg->aux_off;
         }
 
-        /* skb->data is NET_IP_ALIGN-ed */
-        if ((NET_IP_ALIGN + reg->off + off) % size != 0) {
+        /* skb->data is NET_IP_ALIGN-ed, but for strict alignment checking
+         * we force this to 2 which is universally what architectures use
+         * when they don't set CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS.
+         */
+        ip_align = strict ? 2 : NET_IP_ALIGN;
+        if ((ip_align + reg_off + off) % size != 0) {
                 verbose("misaligned packet access off %d+%d+%d size %d\n",
-                        NET_IP_ALIGN, reg->off, off, size);
+                        ip_align, reg_off, off, size);
                 return -EACCES;
         }
 
@@ -797,9 +823,9 @@ static int check_pkt_ptr_alignment(const struct bpf_reg_state *reg,
 }
 
 static int check_val_ptr_alignment(const struct bpf_reg_state *reg,
-                                   int size)
+                                   int size, bool strict)
 {
-        if (size != 1) {
+        if (strict && size != 1) {
                 verbose("Unknown alignment. Only byte-sized access allowed in value access.\n");
                 return -EACCES;
         }
@@ -807,16 +833,20 @@ static int check_val_ptr_alignment(const struct bpf_reg_state *reg,
         return 0;
 }
 
-static int check_ptr_alignment(const struct bpf_reg_state *reg,
+static int check_ptr_alignment(struct bpf_verifier_env *env,
+                               const struct bpf_reg_state *reg,
                                int off, int size)
 {
+        bool strict = env->strict_alignment;
+
+        if (!IS_ENABLED(CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS))
+                strict = true;
+
         switch (reg->type) {
         case PTR_TO_PACKET:
-                return IS_ENABLED(CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS) ? 0 :
-                       check_pkt_ptr_alignment(reg, off, size);
+                return check_pkt_ptr_alignment(reg, off, size, strict);
         case PTR_TO_MAP_VALUE_ADJ:
-                return IS_ENABLED(CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS) ? 0 :
-                       check_val_ptr_alignment(reg, size);
+                return check_val_ptr_alignment(reg, size, strict);
         default:
                 if (off % size != 0) {
                         verbose("misaligned access off %d size %d\n",
@@ -849,7 +879,7 @@ static int check_mem_access(struct bpf_verifier_env *env, u32 regno, int off,
         if (size < 0)
                 return size;
 
-        err = check_ptr_alignment(reg, off, size);
+        err = check_ptr_alignment(env, reg, off, size);
         if (err)
                 return err;
 
@@ -883,6 +913,8 @@ static int check_mem_access(struct bpf_verifier_env *env, u32 regno, int off,
                                                          value_regno);
                         /* note that reg.[id|off|range] == 0 */
                         state->regs[value_regno].type = reg_type;
+                        state->regs[value_regno].aux_off = 0;
+                        state->regs[value_regno].aux_off_align = 0;
                 }
 
         } else if (reg->type == FRAME_PTR || reg->type == PTR_TO_STACK) {
@@ -1455,6 +1487,8 @@ add_imm:
                  */
                 dst_reg->off += imm;
         } else {
+                bool had_id;
+
                 if (src_reg->type == PTR_TO_PACKET) {
                         /* R6=pkt(id=0,off=0,r=62) R7=imm22; r7 += r6 */
                         tmp_reg = *dst_reg;  /* save r7 state */
@@ -1488,14 +1522,23 @@ add_imm:
                                 src_reg->imm);
                         return -EACCES;
                 }
+
+                had_id = (dst_reg->id != 0);
+
                 /* dst_reg stays as pkt_ptr type and since some positive
                  * integer value was added to the pointer, increment its 'id'
                  */
                 dst_reg->id = ++env->id_gen;
 
-                /* something was added to pkt_ptr, set range and off to zero */
+                /* something was added to pkt_ptr, set range to zero */
+                dst_reg->aux_off += dst_reg->off;
                 dst_reg->off = 0;
                 dst_reg->range = 0;
+                if (had_id)
+                        dst_reg->aux_off_align = min(dst_reg->aux_off_align,
+                                                     src_reg->min_align);
+                else
+                        dst_reg->aux_off_align = src_reg->min_align;
         }
         return 0;
 }
@@ -1669,6 +1712,13 @@ static void check_reg_overflow(struct bpf_reg_state *reg)
                 reg->min_value = BPF_REGISTER_MIN_RANGE;
 }
 
+static u32 calc_align(u32 imm)
+{
+        if (!imm)
+                return 1U << 31;
+        return imm - ((imm - 1) & imm);
+}
+
 static void adjust_reg_min_max_vals(struct bpf_verifier_env *env,
                                     struct bpf_insn *insn)
 {
@@ -1676,8 +1726,10 @@ static void adjust_reg_min_max_vals(struct bpf_verifier_env *env,
         s64 min_val = BPF_REGISTER_MIN_RANGE;
         u64 max_val = BPF_REGISTER_MAX_RANGE;
         u8 opcode = BPF_OP(insn->code);
+        u32 dst_align, src_align;
 
         dst_reg = &regs[insn->dst_reg];
+        src_align = 0;
         if (BPF_SRC(insn->code) == BPF_X) {
                 check_reg_overflow(&regs[insn->src_reg]);
                 min_val = regs[insn->src_reg].min_value;
@@ -1693,12 +1745,18 @@ static void adjust_reg_min_max_vals(struct bpf_verifier_env *env,
                     regs[insn->src_reg].type != UNKNOWN_VALUE) {
                         min_val = BPF_REGISTER_MIN_RANGE;
                         max_val = BPF_REGISTER_MAX_RANGE;
+                        src_align = 0;
+                } else {
+                        src_align = regs[insn->src_reg].min_align;
                 }
         } else if (insn->imm < BPF_REGISTER_MAX_RANGE &&
                    (s64)insn->imm > BPF_REGISTER_MIN_RANGE) {
                 min_val = max_val = insn->imm;
+                src_align = calc_align(insn->imm);
         }
 
+        dst_align = dst_reg->min_align;
+
         /* We don't know anything about what was done to this register, mark it
          * as unknown.
          */
@@ -1723,18 +1781,21 @@ static void adjust_reg_min_max_vals(struct bpf_verifier_env *env,
                         dst_reg->min_value += min_val;
                 if (dst_reg->max_value != BPF_REGISTER_MAX_RANGE)
                         dst_reg->max_value += max_val;
+                dst_reg->min_align = min(src_align, dst_align);
                 break;
         case BPF_SUB:
                 if (dst_reg->min_value != BPF_REGISTER_MIN_RANGE)
                         dst_reg->min_value -= min_val;
                 if (dst_reg->max_value != BPF_REGISTER_MAX_RANGE)
                         dst_reg->max_value -= max_val;
+                dst_reg->min_align = min(src_align, dst_align);
                 break;
         case BPF_MUL:
                 if (dst_reg->min_value != BPF_REGISTER_MIN_RANGE)
                         dst_reg->min_value *= min_val;
                 if (dst_reg->max_value != BPF_REGISTER_MAX_RANGE)
                         dst_reg->max_value *= max_val;
+                dst_reg->min_align = max(src_align, dst_align);
                 break;
         case BPF_AND:
                 /* Disallow AND'ing of negative numbers, ain't nobody got time
@@ -1746,17 +1807,23 @@ static void adjust_reg_min_max_vals(struct bpf_verifier_env *env,
                 else
                         dst_reg->min_value = 0;
                 dst_reg->max_value = max_val;
+                dst_reg->min_align = max(src_align, dst_align);
                 break;
         case BPF_LSH:
                 /* Gotta have special overflow logic here, if we're shifting
                  * more than MAX_RANGE then just assume we have an invalid
                  * range.
                  */
-                if (min_val > ilog2(BPF_REGISTER_MAX_RANGE))
+                if (min_val > ilog2(BPF_REGISTER_MAX_RANGE)) {
                         dst_reg->min_value = BPF_REGISTER_MIN_RANGE;
-                else if (dst_reg->min_value != BPF_REGISTER_MIN_RANGE)
-                        dst_reg->min_value <<= min_val;
-
+                        dst_reg->min_align = 1;
+                } else {
+                        if (dst_reg->min_value != BPF_REGISTER_MIN_RANGE)
+                                dst_reg->min_value <<= min_val;
+                        if (!dst_reg->min_align)
+                                dst_reg->min_align = 1;
+                        dst_reg->min_align <<= min_val;
+                }
                 if (max_val > ilog2(BPF_REGISTER_MAX_RANGE))
                         dst_reg->max_value = BPF_REGISTER_MAX_RANGE;
                 else if (dst_reg->max_value != BPF_REGISTER_MAX_RANGE)
@@ -1766,11 +1833,19 @@ static void adjust_reg_min_max_vals(struct bpf_verifier_env *env,
                 /* RSH by a negative number is undefined, and the BPF_RSH is an
                  * unsigned shift, so make the appropriate casts.
                  */
-                if (min_val < 0 || dst_reg->min_value < 0)
+                if (min_val < 0 || dst_reg->min_value < 0) {
                         dst_reg->min_value = BPF_REGISTER_MIN_RANGE;
-                else
+                } else {
                         dst_reg->min_value =
                                 (u64)(dst_reg->min_value) >> min_val;
+                }
+                if (min_val < 0) {
+                        dst_reg->min_align = 1;
+                } else {
+                        dst_reg->min_align >>= (u64) min_val;
+                        if (!dst_reg->min_align)
+                                dst_reg->min_align = 1;
+                }
                 if (dst_reg->max_value != BPF_REGISTER_MAX_RANGE)
                         dst_reg->max_value >>= max_val;
                 break;
@@ -1872,6 +1947,7 @@ static int check_alu_op(struct bpf_verifier_env *env, struct bpf_insn *insn)
                         regs[insn->dst_reg].imm = insn->imm;
                         regs[insn->dst_reg].max_value = insn->imm;
                         regs[insn->dst_reg].min_value = insn->imm;
+                        regs[insn->dst_reg].min_align = calc_align(insn->imm);
                 }
 
         } else if (opcode > BPF_END) {
@@ -2856,8 +2932,12 @@ static int do_check(struct bpf_verifier_env *env)
                         goto process_bpf_exit;
                 }
 
-                if (log_level && do_print_state) {
-                        verbose("\nfrom %d to %d:", prev_insn_idx, insn_idx);
+                if (log_level > 1 || (log_level && do_print_state)) {
+                        if (log_level > 1)
+                                verbose("%d:", insn_idx);
+                        else
+                                verbose("\nfrom %d to %d:",
+                                        prev_insn_idx, insn_idx);
                         print_verifier_state(&env->cur_state);
                         do_print_state = false;
                 }
@@ -3494,6 +3574,10 @@ int bpf_check(struct bpf_prog **prog, union bpf_attr *attr)
         } else {
                 log_level = 0;
         }
+        if (attr->prog_flags & BPF_F_STRICT_ALIGNMENT)
+                env->strict_alignment = true;
+        else
+                env->strict_alignment = false;
 
         ret = replace_map_fd_with_map_ptr(env);
         if (ret < 0)
@@ -3599,6 +3683,7 @@ int bpf_analyzer(struct bpf_prog *prog, const struct bpf_ext_analyzer_ops *ops,
         mutex_lock(&bpf_verifier_lock);
 
         log_level = 0;
+        env->strict_alignment = false;
 
         env->explored_states = kcalloc(env->prog->len,
                                        sizeof(struct bpf_verifier_state_list *),
diff --git a/net/core/dev.c b/net/core/dev.c
index 96cf83da0d66..fca407b4a6ea 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -6852,6 +6852,32 @@ int dev_change_proto_down(struct net_device *dev, bool proto_down)
 }
 EXPORT_SYMBOL(dev_change_proto_down);
 
+bool __dev_xdp_attached(struct net_device *dev, xdp_op_t xdp_op)
+{
+        struct netdev_xdp xdp;
+
+        memset(&xdp, 0, sizeof(xdp));
+        xdp.command = XDP_QUERY_PROG;
+
+        /* Query must always succeed. */
+        WARN_ON(xdp_op(dev, &xdp) < 0);
+        return xdp.prog_attached;
+}
+
+static int dev_xdp_install(struct net_device *dev, xdp_op_t xdp_op,
+                           struct netlink_ext_ack *extack,
+                           struct bpf_prog *prog)
+{
+        struct netdev_xdp xdp;
+
+        memset(&xdp, 0, sizeof(xdp));
+        xdp.command = XDP_SETUP_PROG;
+        xdp.extack = extack;
+        xdp.prog = prog;
+
+        return xdp_op(dev, &xdp);
+}
+
 /**
  *      dev_change_xdp_fd - set or clear a bpf program for a device rx path
  *      @dev: device
@@ -6864,41 +6890,34 @@ EXPORT_SYMBOL(dev_change_proto_down);
 int dev_change_xdp_fd(struct net_device *dev, struct netlink_ext_ack *extack,
                       int fd, u32 flags)
 {
-        int (*xdp_op)(struct net_device *dev, struct netdev_xdp *xdp);
         const struct net_device_ops *ops = dev->netdev_ops;
         struct bpf_prog *prog = NULL;
-        struct netdev_xdp xdp;
+        xdp_op_t xdp_op, xdp_chk;
         int err;
 
         ASSERT_RTNL();
 
-        xdp_op = ops->ndo_xdp;
+        xdp_op = xdp_chk = ops->ndo_xdp;
+        if (!xdp_op && (flags & XDP_FLAGS_DRV_MODE))
+                return -EOPNOTSUPP;
         if (!xdp_op || (flags & XDP_FLAGS_SKB_MODE))
                 xdp_op = generic_xdp_install;
+        if (xdp_op == xdp_chk)
+                xdp_chk = generic_xdp_install;
 
         if (fd >= 0) {
-                if (flags & XDP_FLAGS_UPDATE_IF_NOEXIST) {
-                        memset(&xdp, 0, sizeof(xdp));
-                        xdp.command = XDP_QUERY_PROG;
-
-                        err = xdp_op(dev, &xdp);
-                        if (err < 0)
-                                return err;
-                        if (xdp.prog_attached)
-                                return -EBUSY;
-                }
+                if (xdp_chk && __dev_xdp_attached(dev, xdp_chk))
+                        return -EEXIST;
+                if ((flags & XDP_FLAGS_UPDATE_IF_NOEXIST) &&
+                    __dev_xdp_attached(dev, xdp_op))
+                        return -EBUSY;
 
                 prog = bpf_prog_get_type(fd, BPF_PROG_TYPE_XDP);
                 if (IS_ERR(prog))
                         return PTR_ERR(prog);
         }
 
-        memset(&xdp, 0, sizeof(xdp));
-        xdp.command = XDP_SETUP_PROG;
-        xdp.extack = extack;
-        xdp.prog = prog;
-
-        err = xdp_op(dev, &xdp);
+        err = dev_xdp_install(dev, xdp_op, extack, prog);
         if (err < 0 && prog)
                 bpf_prog_put(prog);
 
diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
index bcb0f610ee42..d7f82c3450b1 100644
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -899,8 +899,7 @@ static size_t rtnl_port_size(const struct net_device *dev,
 static size_t rtnl_xdp_size(void)
 {
         size_t xdp_size = nla_total_size(0) +   /* nest IFLA_XDP */
-                          nla_total_size(1) +   /* XDP_ATTACHED */
-                          nla_total_size(4);    /* XDP_FLAGS */
+                          nla_total_size(1);    /* XDP_ATTACHED */
 
         return xdp_size;
 }
@@ -1247,37 +1246,34 @@ static int rtnl_fill_link_ifmap(struct sk_buff *skb, struct net_device *dev)
         return 0;
 }
 
+static u8 rtnl_xdp_attached_mode(struct net_device *dev)
+{
+        const struct net_device_ops *ops = dev->netdev_ops;
+
+        ASSERT_RTNL();
+
+        if (rcu_access_pointer(dev->xdp_prog))
+                return XDP_ATTACHED_SKB;
+        if (ops->ndo_xdp && __dev_xdp_attached(dev, ops->ndo_xdp))
+                return XDP_ATTACHED_DRV;
+
+        return XDP_ATTACHED_NONE;
+}
+
 static int rtnl_xdp_fill(struct sk_buff *skb, struct net_device *dev)
 {
         struct nlattr *xdp;
-        u32 xdp_flags = 0;
-        u8 val = 0;
         int err;
 
         xdp = nla_nest_start(skb, IFLA_XDP);
         if (!xdp)
                 return -EMSGSIZE;
-        if (rcu_access_pointer(dev->xdp_prog)) {
-                xdp_flags = XDP_FLAGS_SKB_MODE;
-                val = 1;
-        } else if (dev->netdev_ops->ndo_xdp) {
-                struct netdev_xdp xdp_op = {};
-
-                xdp_op.command = XDP_QUERY_PROG;
-                err = dev->netdev_ops->ndo_xdp(dev, &xdp_op);
-                if (err)
-                        goto err_cancel;
-                val = xdp_op.prog_attached;
-        }
-        err = nla_put_u8(skb, IFLA_XDP_ATTACHED, val);
+
+        err = nla_put_u8(skb, IFLA_XDP_ATTACHED,
+                         rtnl_xdp_attached_mode(dev));
         if (err)
                 goto err_cancel;
 
-        if (xdp_flags) {
-                err = nla_put_u32(skb, IFLA_XDP_FLAGS, xdp_flags);
-                if (err)
-                        goto err_cancel;
-        }
         nla_nest_end(skb, xdp);
         return 0;
 
@@ -2199,6 +2195,11 @@ static int do_setlink(const struct sk_buff *skb,
                                 err = -EINVAL;
                                 goto errout;
                         }
+                        if ((xdp_flags & XDP_FLAGS_SKB_MODE) &&
+                            (xdp_flags & XDP_FLAGS_DRV_MODE)) {
+                                err = -EINVAL;
+                                goto errout;
+                        }
                 }
 
                 if (xdp[IFLA_XDP_FD]) {
diff --git a/net/core/sock.c b/net/core/sock.c
index 79c6aee6af9b..e43e71d7856b 100644
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -1803,28 +1803,24 @@ EXPORT_SYMBOL(skb_set_owner_w);
  * delay queue. We want to allow the owner socket to send more
  * packets, as if they were already TX completed by a typical driver.
  * But we also want to keep skb->sk set because some packet schedulers
- * rely on it (sch_fq for example). So we set skb->truesize to a small
- * amount (1) and decrease sk_wmem_alloc accordingly.
+ * rely on it (sch_fq for example).
  */
 void skb_orphan_partial(struct sk_buff *skb)
 {
-        /* If this skb is a TCP pure ACK or already went here,
-         * we have nothing to do. 2 is already a very small truesize.
-         */
-        if (skb->truesize <= 2)
+        if (skb_is_tcp_pure_ack(skb))
                 return;
 
-        /* TCP stack sets skb->ooo_okay based on sk_wmem_alloc,
-         * so we do not completely orphan skb, but transfert all
-         * accounted bytes but one, to avoid unexpected reorders.
-         */
         if (skb->destructor == sock_wfree
 #ifdef CONFIG_INET
             || skb->destructor == tcp_wfree
 #endif
                 ) {
-                atomic_sub(skb->truesize - 1, &skb->sk->sk_wmem_alloc);
-                skb->truesize = 1;
+                struct sock *sk = skb->sk;
+
+                if (atomic_inc_not_zero(&sk->sk_refcnt)) {
+                        atomic_sub(skb->truesize, &sk->sk_wmem_alloc);
+                        skb->destructor = sock_efree;
+                }
         } else {
                 skb_orphan(skb);
         }
diff --git a/net/dccp/ipv6.c b/net/dccp/ipv6.c
index 840f14aaa016..992621172220 100644
--- a/net/dccp/ipv6.c
+++ b/net/dccp/ipv6.c
@@ -426,6 +426,9 @@ static struct sock *dccp_v6_request_recv_sock(const struct sock *sk,
                 newsk->sk_backlog_rcv = dccp_v4_do_rcv;
                 newnp->pktoptions  = NULL;
                 newnp->opt         = NULL;
+                newnp->ipv6_mc_list = NULL;
+                newnp->ipv6_ac_list = NULL;
+                newnp->ipv6_fl_list = NULL;
                 newnp->mcast_oif   = inet6_iif(skb);
                 newnp->mcast_hops  = ipv6_hdr(skb)->hop_limit;
 
@@ -490,6 +493,9 @@ static struct sock *dccp_v6_request_recv_sock(const struct sock *sk,
         /* Clone RX bits */
         newnp->rxopt.all = np->rxopt.all;
 
+        newnp->ipv6_mc_list = NULL;
+        newnp->ipv6_ac_list = NULL;
+        newnp->ipv6_fl_list = NULL;
         newnp->pktoptions = NULL;
         newnp->opt        = NULL;
         newnp->mcast_oif  = inet6_iif(skb);
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index 5a3ad09e2786..06e2dbc2b4a2 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -1179,13 +1179,14 @@ static int tcp_match_skb_to_sack(struct sock *sk, struct sk_buff *skb,
                  */
                 if (pkt_len > mss) {
                         unsigned int new_len = (pkt_len / mss) * mss;
-                        if (!in_sack && new_len < pkt_len) {
+                        if (!in_sack && new_len < pkt_len)
                                 new_len += mss;
-                                if (new_len >= skb->len)
-                                        return 0;
-                        }
                         pkt_len = new_len;
                 }
+
+                if (pkt_len >= skb->len && !in_sack)
+                        return 0;
+
                 err = tcp_fragment(sk, skb, pkt_len, mss, GFP_ATOMIC);
                 if (err < 0)
                         return err;
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index 8d297a79b568..6a4fb1e629fb 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -1022,7 +1022,10 @@ ipv6_add_addr(struct inet6_dev *idev, const struct in6_addr *addr,
         INIT_HLIST_NODE(&ifa->addr_lst);
         ifa->scope = scope;
         ifa->prefix_len = pfxlen;
-        ifa->flags = flags | IFA_F_TENTATIVE;
+        ifa->flags = flags;
+        /* No need to add the TENTATIVE flag for addresses with NODAD */
+        if (!(flags & IFA_F_NODAD))
+                ifa->flags |= IFA_F_TENTATIVE;
         ifa->valid_lft = valid_lft;
         ifa->prefered_lft = prefered_lft;
         ifa->cstamp = ifa->tstamp = jiffies;
diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index 7a8237acd210..4f4310a36a04 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -1062,6 +1062,7 @@ static struct sock *tcp_v6_syn_recv_sock(const struct sock *sk, struct sk_buff *
                 newtp->af_specific = &tcp_sock_ipv6_mapped_specific;
 #endif
 
+                newnp->ipv6_mc_list = NULL;
                 newnp->ipv6_ac_list = NULL;
                 newnp->ipv6_fl_list = NULL;
                 newnp->pktoptions  = NULL;
@@ -1131,6 +1132,7 @@ static struct sock *tcp_v6_syn_recv_sock(const struct sock *sk, struct sk_buff *
            First: no IPv4 options.
          */
         newinet->inet_opt = NULL;
+        newnp->ipv6_mc_list = NULL;
         newnp->ipv6_ac_list = NULL;
         newnp->ipv6_fl_list = NULL;
 
diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
index f4001763134d..e3eeed19cc7a 100644
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -2658,13 +2658,6 @@ static int tpacket_snd(struct packet_sock *po, struct msghdr *msg)
                 dev = dev_get_by_index(sock_net(&po->sk), saddr->sll_ifindex);
         }
 
-        sockc.tsflags = po->sk.sk_tsflags;
-        if (msg->msg_controllen) {
-                err = sock_cmsg_send(&po->sk, msg, &sockc);
-                if (unlikely(err))
-                        goto out;
-        }
-
         err = -ENXIO;
         if (unlikely(dev == NULL))
                 goto out;
@@ -2672,6 +2665,13 @@ static int tpacket_snd(struct packet_sock *po, struct msghdr *msg)
         if (unlikely(!(dev->flags & IFF_UP)))
                 goto out_put;
 
+        sockc.tsflags = po->sk.sk_tsflags;
+        if (msg->msg_controllen) {
+                err = sock_cmsg_send(&po->sk, msg, &sockc);
+                if (unlikely(err))
+                        goto out_put;
+        }
+
         if (po->sk.sk_socket->type == SOCK_RAW)
                 reserve = dev->hard_header_len;
         size_max = po->tx_ring.frame_size
diff --git a/net/sched/sch_api.c b/net/sched/sch_api.c
index bbe57d57b67f..e88342fde1bc 100644
--- a/net/sched/sch_api.c
+++ b/net/sched/sch_api.c
@@ -1831,6 +1831,12 @@ static int tc_dump_tclass_root(struct Qdisc *root, struct sk_buff *skb,
         if (!qdisc_dev(root))
                 return 0;
 
+        if (tcm->tcm_parent) {
+                q = qdisc_match_from_root(root, TC_H_MAJ(tcm->tcm_parent));
+                if (q && tc_dump_tclass_qdisc(q, skb, tcm, cb, t_p, s_t) < 0)
+                        return -1;
+                return 0;
+        }
         hash_for_each(qdisc_dev(root)->qdisc_hash, b, q, hash) {
                 if (tc_dump_tclass_qdisc(q, skb, tcm, cb, t_p, s_t) < 0)
                         return -1;
diff --git a/net/sctp/ipv6.c b/net/sctp/ipv6.c
index 961ee59f696a..142b70e959af 100644
--- a/net/sctp/ipv6.c
+++ b/net/sctp/ipv6.c
@@ -240,12 +240,10 @@ static void sctp_v6_get_dst(struct sctp_transport *t, union sctp_addr *saddr,
         struct sctp_bind_addr *bp;
         struct ipv6_pinfo *np = inet6_sk(sk);
         struct sctp_sockaddr_entry *laddr;
-        union sctp_addr *baddr = NULL;
         union sctp_addr *daddr = &t->ipaddr;
         union sctp_addr dst_saddr;
         struct in6_addr *final_p, final;
         __u8 matchlen = 0;
-        __u8 bmatchlen;
         sctp_scope_t scope;
 
         memset(fl6, 0, sizeof(struct flowi6));
@@ -312,23 +310,37 @@ static void sctp_v6_get_dst(struct sctp_transport *t, union sctp_addr *saddr,
          */
         rcu_read_lock();
         list_for_each_entry_rcu(laddr, &bp->address_list, list) {
-                if (!laddr->valid)
+                struct dst_entry *bdst;
+                __u8 bmatchlen;
+
+                if (!laddr->valid ||
+                    laddr->state != SCTP_ADDR_SRC ||
+                    laddr->a.sa.sa_family != AF_INET6 ||
+                    scope > sctp_scope(&laddr->a))
                         continue;
-                if ((laddr->state == SCTP_ADDR_SRC) &&
-                    (laddr->a.sa.sa_family == AF_INET6) &&
-                    (scope <= sctp_scope(&laddr->a))) {
-                        bmatchlen = sctp_v6_addr_match_len(daddr, &laddr->a);
-                        if (!baddr || (matchlen < bmatchlen)) {
-                                baddr = &laddr->a;
-                                matchlen = bmatchlen;
-                        }
-                }
-        }
-        if (baddr) {
-                fl6->saddr = baddr->v6.sin6_addr;
-                fl6->fl6_sport = baddr->v6.sin6_port;
+
+                fl6->saddr = laddr->a.v6.sin6_addr;
+                fl6->fl6_sport = laddr->a.v6.sin6_port;
                 final_p = fl6_update_dst(fl6, rcu_dereference(np->opt), &final);
-                dst = ip6_dst_lookup_flow(sk, fl6, final_p);
+                bdst = ip6_dst_lookup_flow(sk, fl6, final_p);
+
+                if (!IS_ERR(bdst) &&
+                    ipv6_chk_addr(dev_net(bdst->dev),
+                                  &laddr->a.v6.sin6_addr, bdst->dev, 1)) {
+                        if (!IS_ERR_OR_NULL(dst))
+                                dst_release(dst);
+                        dst = bdst;
+                        break;
+                }
+
+                bmatchlen = sctp_v6_addr_match_len(daddr, &laddr->a);
+                if (matchlen > bmatchlen)
+                        continue;
+
+                if (!IS_ERR_OR_NULL(dst))
+                        dst_release(dst);
+                dst = bdst;
+                matchlen = bmatchlen;
         }
         rcu_read_unlock();
 
diff --git a/net/tipc/socket.c b/net/tipc/socket.c
index 0d4f2f455a7c..1b92b72e812f 100644
--- a/net/tipc/socket.c
+++ b/net/tipc/socket.c
@@ -362,25 +362,25 @@ static int tipc_sk_sock_err(struct socket *sock, long *timeout)
         return 0;
 }
 
-#define tipc_wait_for_cond(sock_, timeout_, condition_)                 \
-({                                                                      \
-        int rc_ = 0;                                                    \
-        int done_ = 0;                                                  \
-                                                                        \
-        while (!(condition_) && !done_) {                               \
-                struct sock *sk_ = sock->sk;                            \
-                DEFINE_WAIT_FUNC(wait_, woken_wake_function);           \
-                                                                        \
-                rc_ = tipc_sk_sock_err(sock_, timeout_);                \
-                if (rc_)                                                \
-                        break;                                          \
-                prepare_to_wait(sk_sleep(sk_), &wait_,                  \
-                                TASK_INTERRUPTIBLE);                    \
-                done_ = sk_wait_event(sk_, timeout_,                    \
-                                      (condition_), &wait_);            \
-                remove_wait_queue(sk_sleep(sk_), &wait_);               \
-        }                                                               \
-        rc_;                                                            \
+#define tipc_wait_for_cond(sock_, timeo_, condition_)                          \
+({                                                                             \
+        struct sock *sk_;                                                      \
+        int rc_;                                                               \
+                                                                               \
+        while ((rc_ = !(condition_))) {                                        \
+                DEFINE_WAIT_FUNC(wait_, woken_wake_function);                  \
+                sk_ = (sock_)->sk;                                             \
+                rc_ = tipc_sk_sock_err((sock_), timeo_);                       \
+                if (rc_)                                                       \
+                        break;                                                 \
+                prepare_to_wait(sk_sleep(sk_), &wait_, TASK_INTERRUPTIBLE);    \
+                release_sock(sk_);                                             \
+                *(timeo_) = wait_woken(&wait_, TASK_INTERRUPTIBLE, *(timeo_)); \
+                sched_annotate_sleep();                                        \
+                lock_sock(sk_);                                                \
+                remove_wait_queue(sk_sleep(sk_), &wait_);                      \
+        }                                                                      \
+        rc_;                                                                   \
 })
 
 /**
diff --git a/samples/bpf/cookie_uid_helper_example.c b/samples/bpf/cookie_uid_helper_example.c
index b08ab4e88929..9d751e209f31 100644
--- a/samples/bpf/cookie_uid_helper_example.c
+++ b/samples/bpf/cookie_uid_helper_example.c
@@ -306,7 +306,9 @@ int main(int argc, char *argv[])
         prog_attach_iptables(argv[2]);
         if (cfg_test_traffic) {
                 if (signal(SIGINT, finish) == SIG_ERR)
-                        error(1, errno, "register handler failed");
+                        error(1, errno, "register SIGINT handler failed");
+                if (signal(SIGTERM, finish) == SIG_ERR)
+                        error(1, errno, "register SIGTERM handler failed");
                 while (!test_finish) {
                         print_table();
                         printf("\n");
diff --git a/samples/bpf/offwaketime_user.c b/samples/bpf/offwaketime_user.c
index 9cce2a66bd66..512f87a5fd20 100644
--- a/samples/bpf/offwaketime_user.c
+++ b/samples/bpf/offwaketime_user.c
@@ -100,6 +100,7 @@ int main(int argc, char **argv)
         setrlimit(RLIMIT_MEMLOCK, &r);
 
         signal(SIGINT, int_exit);
+        signal(SIGTERM, int_exit);
 
         if (load_kallsyms()) {
                 printf("failed to process /proc/kallsyms\n");
diff --git a/samples/bpf/sampleip_user.c b/samples/bpf/sampleip_user.c
index be59d7dcbdde..4ed690b907ff 100644
--- a/samples/bpf/sampleip_user.c
+++ b/samples/bpf/sampleip_user.c
@@ -180,6 +180,7 @@ int main(int argc, char **argv)
                 return 1;
         }
         signal(SIGINT, int_exit);
+        signal(SIGTERM, int_exit);
 
         /* do sampling */
         printf("Sampling at %d Hertz for %d seconds. Ctrl-C also ends.\n",
diff --git a/samples/bpf/trace_event_user.c b/samples/bpf/trace_event_user.c
index 0c5561d193a4..fa4336423da5 100644
--- a/samples/bpf/trace_event_user.c
+++ b/samples/bpf/trace_event_user.c
@@ -192,6 +192,7 @@ int main(int argc, char **argv)
         setrlimit(RLIMIT_MEMLOCK, &r);
 
         signal(SIGINT, int_exit);
+        signal(SIGTERM, int_exit);
 
         if (load_kallsyms()) {
                 printf("failed to process /proc/kallsyms\n");
diff --git a/samples/bpf/tracex2_user.c b/samples/bpf/tracex2_user.c
index 7fee0f1ba9a3..7321a3f253c9 100644
--- a/samples/bpf/tracex2_user.c
+++ b/samples/bpf/tracex2_user.c
@@ -127,6 +127,7 @@ int main(int ac, char **argv)
         }
 
         signal(SIGINT, int_exit);
+        signal(SIGTERM, int_exit);
 
         /* start 'ping' in the background to have some kfree_skb events */
         f = popen("ping -c5 localhost", "r");
diff --git a/samples/bpf/xdp1_user.c b/samples/bpf/xdp1_user.c
index 378850c70eb8..2431c0321b71 100644
--- a/samples/bpf/xdp1_user.c
+++ b/samples/bpf/xdp1_user.c
@@ -62,13 +62,14 @@ static void usage(const char *prog)
         fprintf(stderr,
                 "usage: %s [OPTS] IFINDEX\n\n"
                 "OPTS:\n"
-                "    -S    use skb-mode\n",
+                "    -S    use skb-mode\n"
+                "    -N    enforce native mode\n",
                 prog);
 }
 
 int main(int argc, char **argv)
 {
-        const char *optstr = "S";
+        const char *optstr = "SN";
         char filename[256];
         int opt;
 
@@ -77,6 +78,9 @@ int main(int argc, char **argv)
                 case 'S':
                         xdp_flags |= XDP_FLAGS_SKB_MODE;
                         break;
+                case 'N':
+                        xdp_flags |= XDP_FLAGS_DRV_MODE;
+                        break;
                 default:
                         usage(basename(argv[0]));
                         return 1;
@@ -102,6 +106,7 @@ int main(int argc, char **argv)
         }
 
         signal(SIGINT, int_exit);
+        signal(SIGTERM, int_exit);
 
         if (set_link_xdp_fd(ifindex, prog_fd[0], xdp_flags) < 0) {
                 printf("link set xdp fd failed\n");
diff --git a/samples/bpf/xdp_tx_iptunnel_user.c b/samples/bpf/xdp_tx_iptunnel_user.c
index 92b8bde9337c..715cd12eaca5 100644
--- a/samples/bpf/xdp_tx_iptunnel_user.c
+++ b/samples/bpf/xdp_tx_iptunnel_user.c
@@ -79,6 +79,8 @@ static void usage(const char *cmd)
         printf("    -m <dest-MAC> Used in sending the IP Tunneled pkt\n");
         printf("    -T <stop-after-X-seconds> Default: 0 (forever)\n");
         printf("    -P <IP-Protocol> Default is TCP\n");
+        printf("    -S use skb-mode\n");
+        printf("    -N enforce native mode\n");
         printf("    -h Display this help\n");
 }
 
@@ -138,7 +140,7 @@ int main(int argc, char **argv)
 {
         unsigned char opt_flags[256] = {};
         unsigned int kill_after_s = 0;
-        const char *optstr = "i:a:p:s:d:m:T:P:Sh";
+        const char *optstr = "i:a:p:s:d:m:T:P:SNh";
         int min_port = 0, max_port = 0;
         struct iptnl_info tnl = {};
         struct rlimit r = {RLIM_INFINITY, RLIM_INFINITY};
@@ -206,6 +208,9 @@ int main(int argc, char **argv)
                 case 'S':
                         xdp_flags |= XDP_FLAGS_SKB_MODE;
                         break;
+                case 'N':
+                        xdp_flags |= XDP_FLAGS_DRV_MODE;
+                        break;
                 default:
                         usage(argv[0]);
                         return 1;
@@ -239,6 +244,7 @@ int main(int argc, char **argv)
         }
 
         signal(SIGINT, int_exit);
+        signal(SIGTERM, int_exit);
 
         while (min_port <= max_port) {
                 vip.dport = htons(min_port++);
diff --git a/tools/build/feature/test-bpf.c b/tools/build/feature/test-bpf.c
index ebc6dceddb58..7598361ef1f1 100644
--- a/tools/build/feature/test-bpf.c
+++ b/tools/build/feature/test-bpf.c
@@ -29,6 +29,7 @@ int main(void)
         attr.log_size = 0;
         attr.log_level = 0;
         attr.kern_version = 0;
+        attr.prog_flags = 0;
 
         /*
          * Test existence of __NR_bpf and BPF_PROG_LOAD.
diff --git a/tools/include/uapi/linux/bpf.h b/tools/include/uapi/linux/bpf.h
index e553529929f6..94dfa9def355 100644
--- a/tools/include/uapi/linux/bpf.h
+++ b/tools/include/uapi/linux/bpf.h
@@ -132,6 +132,13 @@ enum bpf_attach_type {
  */
 #define BPF_F_ALLOW_OVERRIDE    (1U << 0)
 
+/* If BPF_F_STRICT_ALIGNMENT is used in BPF_PROG_LOAD command, the
+ * verifier will perform strict alignment checking as if the kernel
+ * has been built with CONFIG_EFFICIENT_UNALIGNED_ACCESS not set,
+ * and NET_IP_ALIGN defined to 2.
+ */
+#define BPF_F_STRICT_ALIGNMENT  (1U << 0)
+
 #define BPF_PSEUDO_MAP_FD       1
 
 /* flags for BPF_MAP_UPDATE_ELEM command */
@@ -177,6 +184,7 @@ union bpf_attr {
                 __u32           log_size;       /* size of user buffer */
                 __aligned_u64   log_buf;        /* user supplied buffer */
                 __u32           kern_version;   /* checked when prog_type=kprobe */
+                __u32           prog_flags;
         };
 
         struct { /* anonymous struct used by BPF_OBJ_* commands */
@@ -481,8 +489,7 @@ union bpf_attr {
  * u32 bpf_get_socket_uid(skb)
  *     Get the owner uid of the socket stored inside sk_buff.
  *     @skb: pointer to skb
- *     Return: uid of the socket owner on success or 0 if the socket pointer
- *     inside sk_buff is NULL
+ *     Return: uid of the socket owner on success or overflowuid if failed.
  */
 #define __BPF_FUNC_MAPPER(FN)           \
         FN(unspec),                     \
diff --git a/tools/lib/bpf/bpf.c b/tools/lib/bpf/bpf.c
index 4fe444b8092e..6e178987af8e 100644
--- a/tools/lib/bpf/bpf.c
+++ b/tools/lib/bpf/bpf.c
@@ -117,6 +117,28 @@ int bpf_load_program(enum bpf_prog_type type, const struct bpf_insn *insns,
         return sys_bpf(BPF_PROG_LOAD, &attr, sizeof(attr));
 }
 
+int bpf_verify_program(enum bpf_prog_type type, const struct bpf_insn *insns,
+                       size_t insns_cnt, int strict_alignment,
+                       const char *license, __u32 kern_version,
+                       char *log_buf, size_t log_buf_sz)
+{
+        union bpf_attr attr;
+
+        bzero(&attr, sizeof(attr));
+        attr.prog_type = type;
+        attr.insn_cnt = (__u32)insns_cnt;
+        attr.insns = ptr_to_u64(insns);
+        attr.license = ptr_to_u64(license);
+        attr.log_buf = ptr_to_u64(log_buf);
+        attr.log_size = log_buf_sz;
+        attr.log_level = 2;
+        log_buf[0] = 0;
+        attr.kern_version = kern_version;
+        attr.prog_flags = strict_alignment ? BPF_F_STRICT_ALIGNMENT : 0;
+
+        return sys_bpf(BPF_PROG_LOAD, &attr, sizeof(attr));
+}
+
 int bpf_map_update_elem(int fd, const void *key, const void *value,
                         __u64 flags)
 {
diff --git a/tools/lib/bpf/bpf.h b/tools/lib/bpf/bpf.h
index edb4daeff7a5..972bd8333eb7 100644
--- a/tools/lib/bpf/bpf.h
+++ b/tools/lib/bpf/bpf.h
@@ -35,6 +35,10 @@ int bpf_load_program(enum bpf_prog_type type, const struct bpf_insn *insns,
                      size_t insns_cnt, const char *license,
                      __u32 kern_version, char *log_buf,
                      size_t log_buf_sz);
+int bpf_verify_program(enum bpf_prog_type type, const struct bpf_insn *insns,
+                       size_t insns_cnt, int strict_alignment,
+                       const char *license, __u32 kern_version,
+                       char *log_buf, size_t log_buf_sz);
 
 int bpf_map_update_elem(int fd, const void *key, const void *value,
                         __u64 flags);
diff --git a/tools/testing/selftests/bpf/Makefile b/tools/testing/selftests/bpf/Makefile
index 91edd0566237..f389b02d43a0 100644
--- a/tools/testing/selftests/bpf/Makefile
+++ b/tools/testing/selftests/bpf/Makefile
@@ -11,7 +11,8 @@ endif
 CFLAGS += -Wall -O2 -I$(APIDIR) -I$(LIBDIR) -I$(GENDIR) $(GENFLAGS) -I../../../include
 LDLIBS += -lcap -lelf
 
-TEST_GEN_PROGS = test_verifier test_tag test_maps test_lru_map test_lpm_map test_progs
+TEST_GEN_PROGS = test_verifier test_tag test_maps test_lru_map test_lpm_map test_progs \
+        test_align
 
 TEST_GEN_FILES = test_pkt_access.o test_xdp.o test_l4lb.o test_tcp_estats.o
 
@@ -34,6 +35,7 @@ $(BPFOBJ): force
 CLANG ?= clang
 
 %.o: %.c
-        $(CLANG) -I. -I../../../include/uapi -I../../../../samples/bpf/ \
+        $(CLANG) -I. -I./include/uapi -I../../../include/uapi \
+                -I../../../../samples/bpf/ \
                 -Wno-compare-distinct-pointer-types \
                 -O2 -target bpf -c $< -o $@
diff --git a/tools/testing/selftests/bpf/include/uapi/linux/types.h b/tools/testing/selftests/bpf/include/uapi/linux/types.h
new file mode 100644
index 000000000000..fbd16a7554af
--- /dev/null
+++ b/tools/testing/selftests/bpf/include/uapi/linux/types.h
@@ -0,0 +1,6 @@
+#ifndef _UAPI_LINUX_TYPES_H
+#define _UAPI_LINUX_TYPES_H
+
+#include <asm-generic/int-ll64.h>
+
+#endif /* _UAPI_LINUX_TYPES_H */
diff --git a/tools/testing/selftests/bpf/test_align.c b/tools/testing/selftests/bpf/test_align.c
new file mode 100644
index 000000000000..9644d4e069de
--- /dev/null
+++ b/tools/testing/selftests/bpf/test_align.c
@@ -0,0 +1,453 @@
+#include <asm/types.h>
+#include <linux/types.h>
+#include <stdint.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <unistd.h>
+#include <errno.h>
+#include <string.h>
+#include <stddef.h>
+#include <stdbool.h>
+
+#include <linux/unistd.h>
+#include <linux/filter.h>
+#include <linux/bpf_perf_event.h>
+#include <linux/bpf.h>
+
+#include <bpf/bpf.h>
+
+#include "../../../include/linux/filter.h"
+
+#ifndef ARRAY_SIZE
+# define ARRAY_SIZE(x) (sizeof(x) / sizeof((x)[0]))
+#endif
+
+#define MAX_INSNS       512
+#define MAX_MATCHES     16
+
+struct bpf_align_test {
+        const char *descr;
+        struct bpf_insn insns[MAX_INSNS];
+        enum {
+                UNDEF,
+                ACCEPT,
+                REJECT
+        } result;
+        enum bpf_prog_type prog_type;
+        const char *matches[MAX_MATCHES];
+};
+
+static struct bpf_align_test tests[] = {
+        {
+                .descr = "mov",
+                .insns = {
+                        BPF_MOV64_IMM(BPF_REG_3, 2),
+                        BPF_MOV64_IMM(BPF_REG_3, 4),
+                        BPF_MOV64_IMM(BPF_REG_3, 8),
+                        BPF_MOV64_IMM(BPF_REG_3, 16),
+                        BPF_MOV64_IMM(BPF_REG_3, 32),
+                        BPF_MOV64_IMM(BPF_REG_0, 0),
+                        BPF_EXIT_INSN(),
+                },
+                .prog_type = BPF_PROG_TYPE_SCHED_CLS,
+                .matches = {
+                        "1: R1=ctx R3=imm2,min_value=2,max_value=2,min_align=2 R10=fp",
+                        "2: R1=ctx R3=imm4,min_value=4,max_value=4,min_align=4 R10=fp",
+                        "3: R1=ctx R3=imm8,min_value=8,max_value=8,min_align=8 R10=fp",
+                        "4: R1=ctx R3=imm16,min_value=16,max_value=16,min_align=16 R10=fp",
+                        "5: R1=ctx R3=imm32,min_value=32,max_value=32,min_align=32 R10=fp",
+                },
+        },
+        {
+                .descr = "shift",
+                .insns = {
+                        BPF_MOV64_IMM(BPF_REG_3, 1),
+                        BPF_ALU64_IMM(BPF_LSH, BPF_REG_3, 1),
+                        BPF_ALU64_IMM(BPF_LSH, BPF_REG_3, 1),
+                        BPF_ALU64_IMM(BPF_LSH, BPF_REG_3, 1),
+                        BPF_ALU64_IMM(BPF_LSH, BPF_REG_3, 1),
+                        BPF_ALU64_IMM(BPF_RSH, BPF_REG_3, 4),
+                        BPF_MOV64_IMM(BPF_REG_4, 32),
+                        BPF_ALU64_IMM(BPF_RSH, BPF_REG_4, 1),
+                        BPF_ALU64_IMM(BPF_RSH, BPF_REG_4, 1),
+                        BPF_ALU64_IMM(BPF_RSH, BPF_REG_4, 1),
+                        BPF_ALU64_IMM(BPF_RSH, BPF_REG_4, 1),
+                        BPF_MOV64_IMM(BPF_REG_0, 0),
+                        BPF_EXIT_INSN(),
+                },
+                .prog_type = BPF_PROG_TYPE_SCHED_CLS,
+                .matches = {
+                        "1: R1=ctx R3=imm1,min_value=1,max_value=1,min_align=1 R10=fp",
+                        "2: R1=ctx R3=imm2,min_value=2,max_value=2,min_align=2 R10=fp",
+                        "3: R1=ctx R3=imm4,min_value=4,max_value=4,min_align=4 R10=fp",
+                        "4: R1=ctx R3=imm8,min_value=8,max_value=8,min_align=8 R10=fp",
+                        "5: R1=ctx R3=imm16,min_value=16,max_value=16,min_align=16 R10=fp",
+                        "6: R1=ctx R3=imm1,min_value=1,max_value=1,min_align=1 R10=fp",
+                        "7: R1=ctx R3=imm1,min_value=1,max_value=1,min_align=1 R4=imm32,min_value=32,max_value=32,min_align=32 R10=fp",
+                        "8: R1=ctx R3=imm1,min_value=1,max_value=1,min_align=1 R4=imm16,min_value=16,max_value=16,min_align=16 R10=fp",
+                        "9: R1=ctx R3=imm1,min_value=1,max_value=1,min_align=1 R4=imm8,min_value=8,max_value=8,min_align=8 R10=fp",
+                        "10: R1=ctx R3=imm1,min_value=1,max_value=1,min_align=1 R4=imm4,min_value=4,max_value=4,min_align=4 R10=fp",
+                        "11: R1=ctx R3=imm1,min_value=1,max_value=1,min_align=1 R4=imm2,min_value=2,max_value=2,min_align=2 R10=fp",
+                },
+        },
+        {
+                .descr = "addsub",
+                .insns = {
+                        BPF_MOV64_IMM(BPF_REG_3, 4),
+                        BPF_ALU64_IMM(BPF_ADD, BPF_REG_3, 4),
+                        BPF_ALU64_IMM(BPF_ADD, BPF_REG_3, 2),
+                        BPF_MOV64_IMM(BPF_REG_4, 8),
+                        BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 4),
+                        BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 2),
+                        BPF_MOV64_IMM(BPF_REG_0, 0),
+                        BPF_EXIT_INSN(),
+                },
+                .prog_type = BPF_PROG_TYPE_SCHED_CLS,
+                .matches = {
+                        "1: R1=ctx R3=imm4,min_value=4,max_value=4,min_align=4 R10=fp",
+                        "2: R1=ctx R3=imm8,min_value=8,max_value=8,min_align=4 R10=fp",
+                        "3: R1=ctx R3=imm10,min_value=10,max_value=10,min_align=2 R10=fp",
+                        "4: R1=ctx R3=imm10,min_value=10,max_value=10,min_align=2 R4=imm8,min_value=8,max_value=8,min_align=8 R10=fp",
+                        "5: R1=ctx R3=imm10,min_value=10,max_value=10,min_align=2 R4=imm12,min_value=12,max_value=12,min_align=4 R10=fp",
+                        "6: R1=ctx R3=imm10,min_value=10,max_value=10,min_align=2 R4=imm14,min_value=14,max_value=14,min_align=2 R10=fp",
+                },
+        },
+        {
+                .descr = "mul",
+                .insns = {
+                        BPF_MOV64_IMM(BPF_REG_3, 7),
+                        BPF_ALU64_IMM(BPF_MUL, BPF_REG_3, 1),
+                        BPF_ALU64_IMM(BPF_MUL, BPF_REG_3, 2),
+                        BPF_ALU64_IMM(BPF_MUL, BPF_REG_3, 4),
+                        BPF_MOV64_IMM(BPF_REG_0, 0),
+                        BPF_EXIT_INSN(),
+                },
+                .prog_type = BPF_PROG_TYPE_SCHED_CLS,
+                .matches = {
+                        "1: R1=ctx R3=imm7,min_value=7,max_value=7,min_align=1 R10=fp",
+                        "2: R1=ctx R3=imm7,min_value=7,max_value=7,min_align=1 R10=fp",
+                        "3: R1=ctx R3=imm14,min_value=14,max_value=14,min_align=2 R10=fp",
+                        "4: R1=ctx R3=imm56,min_value=56,max_value=56,min_align=4 R10=fp",
+                },
+        },
+
+#define PREP_PKT_POINTERS \
+        BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, \
+                    offsetof(struct __sk_buff, data)), \
+        BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, \
+                    offsetof(struct __sk_buff, data_end))
+
+#define LOAD_UNKNOWN(DST_REG) \
+        PREP_PKT_POINTERS, \
+        BPF_MOV64_REG(BPF_REG_0, BPF_REG_2), \
+        BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8), \
+        BPF_JMP_REG(BPF_JGE, BPF_REG_3, BPF_REG_0, 1), \
+        BPF_EXIT_INSN(), \
+        BPF_LDX_MEM(BPF_B, DST_REG, BPF_REG_2, 0)
+
+        {
+                .descr = "unknown shift",
+                .insns = {
+                        LOAD_UNKNOWN(BPF_REG_3),
+                        BPF_ALU64_IMM(BPF_LSH, BPF_REG_3, 1),
+                        BPF_ALU64_IMM(BPF_LSH, BPF_REG_3, 1),
+                        BPF_ALU64_IMM(BPF_LSH, BPF_REG_3, 1),
+                        BPF_ALU64_IMM(BPF_LSH, BPF_REG_3, 1),
+                        LOAD_UNKNOWN(BPF_REG_4),
+                        BPF_ALU64_IMM(BPF_LSH, BPF_REG_4, 5),
+                        BPF_ALU64_IMM(BPF_RSH, BPF_REG_4, 1),
+                        BPF_ALU64_IMM(BPF_RSH, BPF_REG_4, 1),
+                        BPF_ALU64_IMM(BPF_RSH, BPF_REG_4, 1),
+                        BPF_ALU64_IMM(BPF_RSH, BPF_REG_4, 1),
+                        BPF_MOV64_IMM(BPF_REG_0, 0),
+                        BPF_EXIT_INSN(),
+                },
+                .prog_type = BPF_PROG_TYPE_SCHED_CLS,
+                .matches = {
+                        "7: R0=pkt(id=0,off=8,r=8) R1=ctx R2=pkt(id=0,off=0,r=8) R3=inv56 R10=fp",
+                        "8: R0=pkt(id=0,off=8,r=8) R1=ctx R2=pkt(id=0,off=0,r=8) R3=inv55,min_align=2 R10=fp",
+                        "9: R0=pkt(id=0,off=8,r=8) R1=ctx R2=pkt(id=0,off=0,r=8) R3=inv54,min_align=4 R10=fp",
+                        "10: R0=pkt(id=0,off=8,r=8) R1=ctx R2=pkt(id=0,off=0,r=8) R3=inv53,min_align=8 R10=fp",
+                        "11: R0=pkt(id=0,off=8,r=8) R1=ctx R2=pkt(id=0,off=0,r=8) R3=inv52,min_align=16 R10=fp",
+                        "18: R0=pkt(id=0,off=8,r=8) R1=ctx R2=pkt(id=0,off=0,r=8) R3=pkt_end R4=inv56 R10=fp",
+                        "19: R0=pkt(id=0,off=8,r=8) R1=ctx R2=pkt(id=0,off=0,r=8) R3=pkt_end R4=inv51,min_align=32 R10=fp",
+                        "20: R0=pkt(id=0,off=8,r=8) R1=ctx R2=pkt(id=0,off=0,r=8) R3=pkt_end R4=inv52,min_align=16 R10=fp",
+                        "21: R0=pkt(id=0,off=8,r=8) R1=ctx R2=pkt(id=0,off=0,r=8) R3=pkt_end R4=inv53,min_align=8 R10=fp",
+                        "22: R0=pkt(id=0,off=8,r=8) R1=ctx R2=pkt(id=0,off=0,r=8) R3=pkt_end R4=inv54,min_align=4 R10=fp",
+                        "23: R0=pkt(id=0,off=8,r=8) R1=ctx R2=pkt(id=0,off=0,r=8) R3=pkt_end R4=inv55,min_align=2 R10=fp",
+                },
+        },
+        {
+                .descr = "unknown mul",
+                .insns = {
+                        LOAD_UNKNOWN(BPF_REG_3),
+                        BPF_MOV64_REG(BPF_REG_4, BPF_REG_3),
+                        BPF_ALU64_IMM(BPF_MUL, BPF_REG_4, 1),
+                        BPF_MOV64_REG(BPF_REG_4, BPF_REG_3),
+                        BPF_ALU64_IMM(BPF_MUL, BPF_REG_4, 2),
+                        BPF_MOV64_REG(BPF_REG_4, BPF_REG_3),
+                        BPF_ALU64_IMM(BPF_MUL, BPF_REG_4, 4),
+                        BPF_MOV64_REG(BPF_REG_4, BPF_REG_3),
+                        BPF_ALU64_IMM(BPF_MUL, BPF_REG_4, 8),
+                        BPF_ALU64_IMM(BPF_MUL, BPF_REG_4, 2),
+                        BPF_MOV64_IMM(BPF_REG_0, 0),
+                        BPF_EXIT_INSN(),
+                },
+                .prog_type = BPF_PROG_TYPE_SCHED_CLS,
+                .matches = {
+                        "7: R0=pkt(id=0,off=8,r=8) R1=ctx R2=pkt(id=0,off=0,r=8) R3=inv56 R10=fp",
+                        "8: R0=pkt(id=0,off=8,r=8) R1=ctx R2=pkt(id=0,off=0,r=8) R3=inv56 R4=inv56 R10=fp",
+                        "9: R0=pkt(id=0,off=8,r=8) R1=ctx R2=pkt(id=0,off=0,r=8) R3=inv56 R4=inv55,min_align=1 R10=fp",
+                        "10: R0=pkt(id=0,off=8,r=8) R1=ctx R2=pkt(id=0,off=0,r=8) R3=inv56 R4=inv56 R10=fp",
+                        "11: R0=pkt(id=0,off=8,r=8) R1=ctx R2=pkt(id=0,off=0,r=8) R3=inv56 R4=inv54,min_align=2 R10=fp",
+                        "12: R0=pkt(id=0,off=8,r=8) R1=ctx R2=pkt(id=0,off=0,r=8) R3=inv56 R4=inv56 R10=fp",
+                        "13: R0=pkt(id=0,off=8,r=8) R1=ctx R2=pkt(id=0,off=0,r=8) R3=inv56 R4=inv53,min_align=4 R10=fp",
+                        "14: R0=pkt(id=0,off=8,r=8) R1=ctx R2=pkt(id=0,off=0,r=8) R3=inv56 R4=inv56 R10=fp",
+                        "15: R0=pkt(id=0,off=8,r=8) R1=ctx R2=pkt(id=0,off=0,r=8) R3=inv56 R4=inv52,min_align=8 R10=fp",
+                        "16: R0=pkt(id=0,off=8,r=8) R1=ctx R2=pkt(id=0,off=0,r=8) R3=inv56 R4=inv50,min_align=8 R10=fp"
+                },
+        },
+        {
+                .descr = "packet const offset",
+                .insns = {
+                        PREP_PKT_POINTERS,
+                        BPF_MOV64_REG(BPF_REG_5, BPF_REG_2),
+
+                        BPF_MOV64_IMM(BPF_REG_0, 0),
+
+                        /* Skip over ethernet header.  */
+                        BPF_ALU64_IMM(BPF_ADD, BPF_REG_5, 14),
+                        BPF_MOV64_REG(BPF_REG_4, BPF_REG_5),
+                        BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 4),
+                        BPF_JMP_REG(BPF_JGE, BPF_REG_3, BPF_REG_4, 1),
+                        BPF_EXIT_INSN(),
+
+                        BPF_LDX_MEM(BPF_B, BPF_REG_4, BPF_REG_5, 0),
+                        BPF_LDX_MEM(BPF_B, BPF_REG_4, BPF_REG_5, 1),
+                        BPF_LDX_MEM(BPF_B, BPF_REG_4, BPF_REG_5, 2),
+                        BPF_LDX_MEM(BPF_B, BPF_REG_4, BPF_REG_5, 3),
+                        BPF_LDX_MEM(BPF_H, BPF_REG_4, BPF_REG_5, 0),
+                        BPF_LDX_MEM(BPF_H, BPF_REG_4, BPF_REG_5, 2),
+                        BPF_LDX_MEM(BPF_W, BPF_REG_4, BPF_REG_5, 0),
+
+                        BPF_MOV64_IMM(BPF_REG_0, 0),
+                        BPF_EXIT_INSN(),
+                },
+                .prog_type = BPF_PROG_TYPE_SCHED_CLS,
+                .matches = {
+                        "4: R0=imm0,min_value=0,max_value=0,min_align=2147483648 R1=ctx R2=pkt(id=0,off=0,r=0) R3=pkt_end R5=pkt(id=0,off=0,r=0) R10=fp",
+                        "5: R0=imm0,min_value=0,max_value=0,min_align=2147483648 R1=ctx R2=pkt(id=0,off=0,r=0) R3=pkt_end R5=pkt(id=0,off=14,r=0) R10=fp",
+                        "6: R0=imm0,min_value=0,max_value=0,min_align=2147483648 R1=ctx R2=pkt(id=0,off=0,r=0) R3=pkt_end R4=pkt(id=0,off=14,r=0) R5=pkt(id=0,off=14,r=0) R10=fp",
+                        "10: R0=imm0,min_value=0,max_value=0,min_align=2147483648 R1=ctx R2=pkt(id=0,off=0,r=18) R3=pkt_end R4=inv56 R5=pkt(id=0,off=14,r=18) R10=fp",
+                        "14: R0=imm0,min_value=0,max_value=0,min_align=2147483648 R1=ctx R2=pkt(id=0,off=0,r=18) R3=pkt_end R4=inv48 R5=pkt(id=0,off=14,r=18) R10=fp",
+                        "15: R0=imm0,min_value=0,max_value=0,min_align=2147483648 R1=ctx R2=pkt(id=0,off=0,r=18) R3=pkt_end R4=inv48 R5=pkt(id=0,off=14,r=18) R10=fp",
+                },
+        },
+        {
+                .descr = "packet variable offset",
+                .insns = {
+                        LOAD_UNKNOWN(BPF_REG_6),
+                        BPF_ALU64_IMM(BPF_LSH, BPF_REG_6, 2),
+
+                        /* First, add a constant to the R5 packet pointer,
+                         * then a variable with a known alignment.
+                         */
+                        BPF_MOV64_REG(BPF_REG_5, BPF_REG_2),
+                        BPF_ALU64_IMM(BPF_ADD, BPF_REG_5, 14),
+                        BPF_ALU64_REG(BPF_ADD, BPF_REG_5, BPF_REG_6),
+                        BPF_MOV64_REG(BPF_REG_4, BPF_REG_5),
+                        BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 4),
+                        BPF_JMP_REG(BPF_JGE, BPF_REG_3, BPF_REG_4, 1),
+                        BPF_EXIT_INSN(),
+                        BPF_LDX_MEM(BPF_W, BPF_REG_4, BPF_REG_5, 0),
+
+                        /* Now, test in the other direction.  Adding first
+                         * the variable offset to R5, then the constant.
+                         */
+                        BPF_MOV64_REG(BPF_REG_5, BPF_REG_2),
+                        BPF_ALU64_REG(BPF_ADD, BPF_REG_5, BPF_REG_6),
+                        BPF_ALU64_IMM(BPF_ADD, BPF_REG_5, 14),
+                        BPF_MOV64_REG(BPF_REG_4, BPF_REG_5),
+                        BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 4),
+                        BPF_JMP_REG(BPF_JGE, BPF_REG_3, BPF_REG_4, 1),
+                        BPF_EXIT_INSN(),
+                        BPF_LDX_MEM(BPF_W, BPF_REG_4, BPF_REG_5, 0),
+
+                        /* Test multiple accumulations of unknown values
+                         * into a packet pointer.
+                         */
+                        BPF_MOV64_REG(BPF_REG_5, BPF_REG_2),
+                        BPF_ALU64_IMM(BPF_ADD, BPF_REG_5, 14),
+                        BPF_ALU64_REG(BPF_ADD, BPF_REG_5, BPF_REG_6),
+                        BPF_ALU64_IMM(BPF_ADD, BPF_REG_5, 4),
+                        BPF_ALU64_REG(BPF_ADD, BPF_REG_5, BPF_REG_6),
+                        BPF_MOV64_REG(BPF_REG_4, BPF_REG_5),
+                        BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 4),
+                        BPF_JMP_REG(BPF_JGE, BPF_REG_3, BPF_REG_4, 1),
+                        BPF_EXIT_INSN(),
+                        BPF_LDX_MEM(BPF_W, BPF_REG_4, BPF_REG_5, 0),
+
+                        BPF_MOV64_IMM(BPF_REG_0, 0),
+                        BPF_EXIT_INSN(),
+                },
+                .prog_type = BPF_PROG_TYPE_SCHED_CLS,
+                .matches = {
+                        /* Calculated offset in R6 has unknown value, but known
+                         * alignment of 4.
+                         */
+                        "8: R0=pkt(id=0,off=8,r=8) R1=ctx R2=pkt(id=0,off=0,r=8) R3=pkt_end R6=inv54,min_align=4 R10=fp",
+
+                        /* Offset is added to packet pointer R5, resulting in known
+                         * auxiliary alignment and offset.
+                         */
+                        "11: R0=pkt(id=0,off=8,r=8) R1=ctx R2=pkt(id=0,off=0,r=8) R3=pkt_end R5=pkt(id=1,off=0,r=0),aux_off=14,aux_off_align=4 R6=inv54,min_align=4 R10=fp",
+
+                        /* At the time the word size load is performed from R5,
+                         * it's total offset is NET_IP_ALIGN + reg->off (0) +
+                         * reg->aux_off (14) which is 16.  Then the variable
+                         * offset is considered using reg->aux_off_align which
+                         * is 4 and meets the load's requirements.
+                         */
+                        "15: R0=pkt(id=0,off=8,r=8) R1=ctx R2=pkt(id=0,off=0,r=8) R3=pkt_end R4=pkt(id=1,off=4,r=4),aux_off=14,aux_off_align=4 R5=pkt(id=1,off=0,r=4),aux_off=14,aux_off_align=4 R6=inv54,min_align=4 R10=fp",
+
+
+                        /* Variable offset is added to R5 packet pointer,
+                         * resulting in auxiliary alignment of 4.
+                         */
+                        "18: R0=pkt(id=0,off=8,r=8) R1=ctx R2=pkt(id=0,off=0,r=8) R3=pkt_end R4=inv,aux_off=14,aux_off_align=4 R5=pkt(id=2,off=0,r=0),aux_off_align=4 R6=inv54,min_align=4 R10=fp",
+
+                        /* Constant offset is added to R5, resulting in
+                         * reg->off of 14.
+                         */
+                        "19: R0=pkt(id=0,off=8,r=8) R1=ctx R2=pkt(id=0,off=0,r=8) R3=pkt_end R4=inv,aux_off=14,aux_off_align=4 R5=pkt(id=2,off=14,r=0),aux_off_align=4 R6=inv54,min_align=4 R10=fp",
+
+                        /* At the time the word size load is performed from R5,
+                         * it's total offset is NET_IP_ALIGN + reg->off (14) which
+                         * is 16.  Then the variable offset is considered using
+                         * reg->aux_off_align which is 4 and meets the load's
+                         * requirements.
+                         */
+                        "23: R0=pkt(id=0,off=8,r=8) R1=ctx R2=pkt(id=0,off=0,r=8) R3=pkt_end R4=pkt(id=2,off=18,r=18),aux_off_align=4 R5=pkt(id=2,off=14,r=18),aux_off_align=4 R6=inv54,min_align=4 R10=fp",
+
+                        /* Constant offset is added to R5 packet pointer,
+                         * resulting in reg->off value of 14.
+                         */
+                        "26: R0=pkt(id=0,off=8,r=8) R1=ctx R2=pkt(id=0,off=0,r=8) R3=pkt_end R4=inv,aux_off_align=4 R5=pkt(id=0,off=14,r=8) R6=inv54,min_align=4 R10=fp",
+                        /* Variable offset is added to R5, resulting in an
+                         * auxiliary offset of 14, and an auxiliary alignment of 4.
+                         */
+                        "27: R0=pkt(id=0,off=8,r=8) R1=ctx R2=pkt(id=0,off=0,r=8) R3=pkt_end R4=inv,aux_off_align=4 R5=pkt(id=3,off=0,r=0),aux_off=14,aux_off_align=4 R6=inv54,min_align=4 R10=fp",
+                        /* Constant is added to R5 again, setting reg->off to 4. */
+                        "28: R0=pkt(id=0,off=8,r=8) R1=ctx R2=pkt(id=0,off=0,r=8) R3=pkt_end R4=inv,aux_off_align=4 R5=pkt(id=3,off=4,r=0),aux_off=14,aux_off_align=4 R6=inv54,min_align=4 R10=fp",
+                        /* And once more we add a variable, which causes an accumulation
+                         * of reg->off into reg->aux_off_align, with resulting value of
+                         * 18.  The auxiliary alignment stays at 4.
+                         */
+                        "29: R0=pkt(id=0,off=8,r=8) R1=ctx R2=pkt(id=0,off=0,r=8) R3=pkt_end R4=inv,aux_off_align=4 R5=pkt(id=4,off=0,r=0),aux_off=18,aux_off_align=4 R6=inv54,min_align=4 R10=fp",
+                        /* At the time the word size load is performed from R5,
+                         * it's total offset is NET_IP_ALIGN + reg->off (0) +
+                         * reg->aux_off (18) which is 20.  Then the variable offset
+                         * is considered using reg->aux_off_align which is 4 and meets
+                         * the load's requirements.
+                         */
+                        "33: R0=pkt(id=0,off=8,r=8) R1=ctx R2=pkt(id=0,off=0,r=8) R3=pkt_end R4=pkt(id=4,off=4,r=4),aux_off=18,aux_off_align=4 R5=pkt(id=4,off=0,r=4),aux_off=18,aux_off_align=4 R6=inv54,min_align=4 R10=fp",
+                },
+        },
+};
+
+static int probe_filter_length(const struct bpf_insn *fp)
+{
+        int len;
+
+        for (len = MAX_INSNS - 1; len > 0; --len)
+                if (fp[len].code != 0 || fp[len].imm != 0)
+                        break;
+        return len + 1;
+}
+
+static char bpf_vlog[32768];
+
+static int do_test_single(struct bpf_align_test *test)
+{
+        struct bpf_insn *prog = test->insns;
+        int prog_type = test->prog_type;
+        int prog_len, i;
+        int fd_prog;
+        int ret;
+
+        prog_len = probe_filter_length(prog);
+        fd_prog = bpf_verify_program(prog_type ? : BPF_PROG_TYPE_SOCKET_FILTER,
+                                     prog, prog_len, 1, "GPL", 0,
+                                     bpf_vlog, sizeof(bpf_vlog));
+        if (fd_prog < 0) {
+                printf("Failed to load program.\n");
+                printf("%s", bpf_vlog);
+                ret = 1;
+        } else {
+                ret = 0;
+                for (i = 0; i < MAX_MATCHES; i++) {
+                        const char *t, *m = test->matches[i];
+
+                        if (!m)
+                                break;
+                        t = strstr(bpf_vlog, m);
+                        if (!t) {
+                                printf("Failed to find match: %s\n", m);
+                                ret = 1;
+                                printf("%s", bpf_vlog);
+                                break;
+                        }
+                }
+                close(fd_prog);
+        }
+        return ret;
+}
+
+static int do_test(unsigned int from, unsigned int to)
+{
+        int all_pass = 0;
+        int all_fail = 0;
+        unsigned int i;
+
+        for (i = from; i < to; i++) {
+                struct bpf_align_test *test = &tests[i];
+                int fail;
+
+                printf("Test %3d: %s ... ",
+                       i, test->descr);
+                fail = do_test_single(test);
+                if (fail) {
+                        all_fail++;
+                        printf("FAIL\n");
+                } else {
+                        all_pass++;
+                        printf("PASS\n");
+                }
+        }
+        printf("Results: %d pass %d fail\n",
+               all_pass, all_fail);
+        return 0;
+}
+
+int main(int argc, char **argv)
+{
+        unsigned int from = 0, to = ARRAY_SIZE(tests);
+
+        if (argc == 3) {
+                unsigned int l = atoi(argv[argc - 2]);
+                unsigned int u = atoi(argv[argc - 1]);
+
+                if (l < to && u < to) {
+                        from = l;
+                        to   = u + 1;
+                }
+        } else if (argc == 2) {
+                unsigned int t = atoi(argv[argc - 1]);
+
+                if (t < to) {
+                        from = t;
+                        to   = t + 1;
+                }
+        }
+        return do_test(from, to);
+}