737 files changed, 21674 insertions, 12142 deletions

diff --git a/Documentation/ABI/testing/sysfs-bus-css b/Documentation/ABI/testing/sysfs-bus-css
index 2979c40c10e9..966f8504bd7b 100644
--- a/Documentation/ABI/testing/sysfs-bus-css
+++ b/Documentation/ABI/testing/sysfs-bus-css
@@ -33,3 +33,26 @@ Description:	Contains the PIM/PAM/POM values, as reported by the
                 in sync with the values current in the channel subsystem).
                 Note: This is an I/O-subchannel specific attribute.
 Users:          s390-tools, HAL
+
+What:           /sys/bus/css/devices/.../driver_override
+Date:           June 2019
+Contact:        Cornelia Huck <cohuck@redhat.com>
+                linux-s390@vger.kernel.org
+Description:    This file allows the driver for a device to be specified. When
+                specified, only a driver with a name matching the value written
+                to driver_override will have an opportunity to bind to the
+                device. The override is specified by writing a string to the
+                driver_override file (echo vfio-ccw > driver_override) and
+                may be cleared with an empty string (echo > driver_override).
+                This returns the device to standard matching rules binding.
+                Writing to driver_override does not automatically unbind the
+                device from its current driver or make any attempt to
+                automatically load the specified driver.  If no driver with a
+                matching name is currently loaded in the kernel, the device
+                will not bind to any driver.  This also allows devices to
+                opt-out of driver binding using a driver_override name such as
+                "none".  Only a single driver may be specified in the override,
+                there is no support for parsing delimiters.
+                Note that unlike the mechanism of the same name for pci, this
+                file does not allow to override basic matching rules. I.e.,
+                the driver must still match the subchannel type of the device.
diff --git a/Documentation/ABI/testing/sysfs-devices-system-cpu b/Documentation/ABI/testing/sysfs-devices-system-cpu
index 1528239f69b2..923fe2001472 100644
--- a/Documentation/ABI/testing/sysfs-devices-system-cpu
+++ b/Documentation/ABI/testing/sysfs-devices-system-cpu
@@ -538,3 +538,26 @@ Description:	Intel Energy and Performance Bias Hint (EPB)
 
                 This attribute is present for all online CPUs supporting the
                 Intel EPB feature.
+
+What:           /sys/devices/system/cpu/umwait_control
+                /sys/devices/system/cpu/umwait_control/enable_c02
+                /sys/devices/system/cpu/umwait_control/max_time
+Date:           May 2019
+Contact:        Linux kernel mailing list <linux-kernel@vger.kernel.org>
+Description:    Umwait control
+
+                enable_c02: Read/write interface to control umwait C0.2 state
+                        Read returns C0.2 state status:
+                                0: C0.2 is disabled
+                                1: C0.2 is enabled
+
+                        Write 'y' or '1'  or 'on' to enable C0.2 state.
+                        Write 'n' or '0'  or 'off' to disable C0.2 state.
+
+                        The interface is case insensitive.
+
+                max_time: Read/write interface to control umwait maximum time
+                          in TSC-quanta that the CPU can reside in either C0.1
+                          or C0.2 state. The time is an unsigned 32-bit number.
+                          Note that a value of zero means there is no limit.
+                          Low order two bits must be zero.
diff --git a/Documentation/RCU/rcuref.txt b/Documentation/RCU/rcuref.txt
index 613033ff2b9b..5e6429d66c24 100644
--- a/Documentation/RCU/rcuref.txt
+++ b/Documentation/RCU/rcuref.txt
@@ -12,6 +12,7 @@ please read on.
 Reference counting on elements of lists which are protected by traditional
 reader/writer spinlocks or semaphores are straightforward:
 
+CODE LISTING A:
 1.                              2.
 add()                           search_and_reference()
 {                               {
@@ -28,7 +29,8 @@ add()				search_and_reference()
 release_referenced()                    delete()
 {                                       {
     ...                                     write_lock(&list_lock);
-    atomic_dec(&el->rc, relfunc)            ...
+    if(atomic_dec_and_test(&el->rc))        ...
+        kfree(el);
     ...                                     remove_element
 }                                           write_unlock(&list_lock);
                                             ...
@@ -44,6 +46,7 @@ search_and_reference() could potentially hold reference to an element which
 has already been deleted from the list/array.  Use atomic_inc_not_zero()
 in this scenario as follows:
 
+CODE LISTING B:
 1.                                      2.
 add()                                   search_and_reference()
 {                                       {
@@ -79,6 +82,7 @@ search_and_reference() code path.  In such cases, the
 atomic_dec_and_test() may be moved from delete() to el_free()
 as follows:
 
+CODE LISTING C:
 1.                                      2.
 add()                                   search_and_reference()
 {                                       {
@@ -114,6 +118,17 @@ element can therefore safely be freed.  This in turn guarantees that if
 any reader finds the element, that reader may safely acquire a reference
 without checking the value of the reference counter.
 
+A clear advantage of the RCU-based pattern in listing C over the one
+in listing B is that any call to search_and_reference() that locates
+a given object will succeed in obtaining a reference to that object,
+even given a concurrent invocation of delete() for that same object.
+Similarly, a clear advantage of both listings B and C over listing A is
+that a call to delete() is not delayed even if there are an arbitrarily
+large number of calls to search_and_reference() searching for the same
+object that delete() was invoked on.  Instead, all that is delayed is
+the eventual invocation of kfree(), which is usually not a problem on
+modern computer systems, even the small ones.
+
 In cases where delete() can sleep, synchronize_rcu() can be called from
 delete(), so that el_free() can be subsumed into delete as follows:
 
@@ -130,3 +145,7 @@ delete()
         kfree(el);
     ...
 }
+
+As additional examples in the kernel, the pattern in listing C is used by
+reference counting of struct pid, while the pattern in listing B is used by
+struct posix_acl.
diff --git a/Documentation/RCU/stallwarn.txt b/Documentation/RCU/stallwarn.txt
index 1ab70c37921f..13e88fc00f01 100644
--- a/Documentation/RCU/stallwarn.txt
+++ b/Documentation/RCU/stallwarn.txt
@@ -153,7 +153,7 @@ rcupdate.rcu_task_stall_timeout
         This boot/sysfs parameter controls the RCU-tasks stall warning
         interval.  A value of zero or less suppresses RCU-tasks stall
         warnings.  A positive value sets the stall-warning interval
-        in jiffies.  An RCU-tasks stall warning starts with the line:
+        in seconds.  An RCU-tasks stall warning starts with the line:
 
                 INFO: rcu_tasks detected stalls on tasks:
 
diff --git a/Documentation/RCU/whatisRCU.txt b/Documentation/RCU/whatisRCU.txt
index 981651a8b65d..7e1a8721637a 100644
--- a/Documentation/RCU/whatisRCU.txt
+++ b/Documentation/RCU/whatisRCU.txt
@@ -212,7 +212,7 @@ synchronize_rcu()
 
 rcu_assign_pointer()
 
-        typeof(p) rcu_assign_pointer(p, typeof(p) v);
+        void rcu_assign_pointer(p, typeof(p) v);
 
         Yes, rcu_assign_pointer() -is- implemented as a macro, though it
         would be cool to be able to declare a function in this manner.
@@ -220,9 +220,9 @@ rcu_assign_pointer()
 
         The updater uses this function to assign a new value to an
         RCU-protected pointer, in order to safely communicate the change
-        in value from the updater to the reader.  This function returns
-        the new value, and also executes any memory-barrier instructions
-        required for a given CPU architecture.
+        in value from the updater to the reader.  This macro does not
+        evaluate to an rvalue, but it does execute any memory-barrier
+        instructions required for a given CPU architecture.
 
         Perhaps just as important, it serves to document (1) which
         pointers are protected by RCU and (2) the point at which a
diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt
index 138f6664b2e2..e6e806285703 100644
--- a/Documentation/admin-guide/kernel-parameters.txt
+++ b/Documentation/admin-guide/kernel-parameters.txt
@@ -478,7 +478,7 @@
                         others).
 
         ccw_timeout_log [S390]
-                        See Documentation/s390/CommonIO for details.
+                        See Documentation/s390/common_io.rst for details.
 
         cgroup_disable= [KNL] Disable a particular controller
                         Format: {name of the controller(s) to disable}
@@ -516,7 +516,7 @@
                                 /selinux/checkreqprot.
 
         cio_ignore=     [S390]
-                        See Documentation/s390/CommonIO for details.
+                        See Documentation/s390/common_io.rst for details.
         clk_ignore_unused
                         [CLK]
                         Prevents the clock framework from automatically gating
@@ -3752,6 +3752,12 @@
                         the propagation of recent CPU-hotplug changes up
                         the rcu_node combining tree.
 
+        rcutree.use_softirq=    [KNL]
+                        If set to zero, move all RCU_SOFTIRQ processing to
+                        per-CPU rcuc kthreads.  Defaults to a non-zero
+                        value, meaning that RCU_SOFTIRQ is used by default.
+                        Specify rcutree.use_softirq=0 to use rcuc kthreads.
+
         rcutree.rcu_fanout_exact= [KNL]
                         Disable autobalancing of the rcu_node combining
                         tree.  This is used by rcutorture, and might
@@ -5100,13 +5106,12 @@
                         targets for exploits that can control RIP.
 
                         emulate     [default] Vsyscalls turn into traps and are
-                                    emulated reasonably safely.
+                                    emulated reasonably safely.  The vsyscall
+                                    page is readable.
 
-                        native      Vsyscalls are native syscall instructions.
-                                    This is a little bit faster than trapping
-                                    and makes a few dynamic recompilers work
-                                    better than they would in emulation mode.
-                                    It also makes exploits much easier to write.
+                        xonly       Vsyscalls turn into traps and are
+                                    emulated reasonably safely.  The vsyscall
+                                    page is not readable.
 
                         none        Vsyscalls don't work at all.  This makes
                                     them quite hard to use for exploits but
diff --git a/Documentation/arm64/elf_hwcaps.txt b/Documentation/arm64/elf_hwcaps.txt
index b73a2519ecf2..5ae2ef2c12f3 100644
--- a/Documentation/arm64/elf_hwcaps.txt
+++ b/Documentation/arm64/elf_hwcaps.txt
@@ -207,6 +207,10 @@ HWCAP_FLAGM
 
     Functionality implied by ID_AA64ISAR0_EL1.TS == 0b0001.
 
+HWCAP2_FLAGM2
+
+    Functionality implied by ID_AA64ISAR0_EL1.TS == 0b0010.
+
 HWCAP_SSBS
 
     Functionality implied by ID_AA64PFR1_EL1.SSBS == 0b0010.
@@ -223,6 +227,10 @@ HWCAP_PACG
     ID_AA64ISAR1_EL1.GPI == 0b0001, as described by
     Documentation/arm64/pointer-authentication.txt.
 
+HWCAP2_FRINT
+
+    Functionality implied by ID_AA64ISAR1_EL1.FRINTTS == 0b0001.
+
 
 4. Unused AT_HWCAP bits
 -----------------------
diff --git a/Documentation/atomic_t.txt b/Documentation/atomic_t.txt
index dca3fb0554db..0ab747e0d5ac 100644
--- a/Documentation/atomic_t.txt
+++ b/Documentation/atomic_t.txt
@@ -81,9 +81,11 @@ Non-RMW ops:
 
 The non-RMW ops are (typically) regular LOADs and STOREs and are canonically
 implemented using READ_ONCE(), WRITE_ONCE(), smp_load_acquire() and
-smp_store_release() respectively.
+smp_store_release() respectively. Therefore, if you find yourself only using
+the Non-RMW operations of atomic_t, you do not in fact need atomic_t at all
+and are doing it wrong.
 
-The one detail to this is that atomic_set{}() should be observable to the RMW
+A subtle detail of atomic_set{}() is that it should be observable to the RMW
 ops. That is:
 
   C atomic-set
@@ -187,13 +189,22 @@ The barriers:
 
   smp_mb__{before,after}_atomic()
 
-only apply to the RMW ops and can be used to augment/upgrade the ordering
-inherent to the used atomic op. These barriers provide a full smp_mb().
+only apply to the RMW atomic ops and can be used to augment/upgrade the
+ordering inherent to the op. These barriers act almost like a full smp_mb():
+smp_mb__before_atomic() orders all earlier accesses against the RMW op
+itself and all accesses following it, and smp_mb__after_atomic() orders all
+later accesses against the RMW op and all accesses preceding it. However,
+accesses between the smp_mb__{before,after}_atomic() and the RMW op are not
+ordered, so it is advisable to place the barrier right next to the RMW atomic
+op whenever possible.
 
 These helper barriers exist because architectures have varying implicit
 ordering on their SMP atomic primitives. For example our TSO architectures
 provide full ordered atomics and these barriers are no-ops.
 
+NOTE: when the atomic RmW ops are fully ordered, they should also imply a
+compiler barrier.
+
 Thus:
 
   atomic_fetch_add();
@@ -212,7 +223,9 @@ Further, while something like:
   atomic_dec(&X);
 
 is a 'typical' RELEASE pattern, the barrier is strictly stronger than
-a RELEASE. Similarly for something like:
+a RELEASE because it orders preceding instructions against both the read
+and write parts of the atomic_dec(), and against all following instructions
+as well. Similarly, something like:
 
   atomic_inc(&X);
   smp_mb__after_atomic();
@@ -244,7 +257,8 @@ strictly stronger than ACQUIRE. As illustrated:
 
 This should not happen; but a hypothetical atomic_inc_acquire() --
 (void)atomic_fetch_inc_acquire() for instance -- would allow the outcome,
-since then:
+because it would not order the W part of the RMW against the following
+WRITE_ONCE.  Thus:
 
   P1                    P2
 
diff --git a/Documentation/core-api/circular-buffers.rst b/Documentation/core-api/circular-buffers.rst
index 53e51caa3347..50966f66e398 100644
--- a/Documentation/core-api/circular-buffers.rst
+++ b/Documentation/core-api/circular-buffers.rst
@@ -3,7 +3,7 @@ Circular Buffers
 ================
 
 :Author: David Howells <dhowells@redhat.com>
-:Author: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
+:Author: Paul E. McKenney <paulmck@linux.ibm.com>
 
 
 Linux provides a number of features that can be used to implement circular
diff --git a/Documentation/core-api/timekeeping.rst b/Documentation/core-api/timekeeping.rst
index 93cbeb9daec0..20ee447a50f3 100644
--- a/Documentation/core-api/timekeeping.rst
+++ b/Documentation/core-api/timekeeping.rst
@@ -65,7 +65,7 @@ different format depending on what is required by the user:
 .. c:function:: u64 ktime_get_ns( void )
                 u64 ktime_get_boottime_ns( void )
                 u64 ktime_get_real_ns( void )
-                u64 ktime_get_tai_ns( void )
+                u64 ktime_get_clocktai_ns( void )
                 u64 ktime_get_raw_ns( void )
 
         Same as the plain ktime_get functions, but returning a u64 number
@@ -99,16 +99,20 @@ Coarse and fast_ns access
 
 Some additional variants exist for more specialized cases:
 
-.. c:function:: ktime_t ktime_get_coarse_boottime( void )
+.. c:function:: ktime_t ktime_get_coarse( void )
+                ktime_t ktime_get_coarse_boottime( void )
                 ktime_t ktime_get_coarse_real( void )
                 ktime_t ktime_get_coarse_clocktai( void )
-                ktime_t ktime_get_coarse_raw( void )
+
+.. c:function:: u64 ktime_get_coarse_ns( void )
+                u64 ktime_get_coarse_boottime_ns( void )
+                u64 ktime_get_coarse_real_ns( void )
+                u64 ktime_get_coarse_clocktai_ns( void )
 
 .. c:function:: void ktime_get_coarse_ts64( struct timespec64 * )
                 void ktime_get_coarse_boottime_ts64( struct timespec64 * )
                 void ktime_get_coarse_real_ts64( struct timespec64 * )
                 void ktime_get_coarse_clocktai_ts64( struct timespec64 * )
-                void ktime_get_coarse_raw_ts64( struct timespec64 * )
 
         These are quicker than the non-coarse versions, but less accurate,
         corresponding to CLOCK_MONONOTNIC_COARSE and CLOCK_REALTIME_COARSE
diff --git a/Documentation/devicetree/bindings/interrupt-controller/amazon,al-fic.txt b/Documentation/devicetree/bindings/interrupt-controller/amazon,al-fic.txt
new file mode 100644
index 000000000000..4e82fd575cec
--- /dev/null
+++ b/Documentation/devicetree/bindings/interrupt-controller/amazon,al-fic.txt
@@ -0,0 +1,29 @@
+Amazon's Annapurna Labs Fabric Interrupt Controller
+
+Required properties:
+
+- compatible: should be "amazon,al-fic"
+- reg: physical base address and size of the registers
+- interrupt-controller: identifies the node as an interrupt controller
+- #interrupt-cells: must be 2.
+  First cell defines the index of the interrupt within the controller.
+  Second cell is used to specify the trigger type and must be one of the
+  following:
+    - bits[3:0] trigger type and level flags
+        1 = low-to-high edge triggered
+        4 = active high level-sensitive
+- interrupt-parent: specifies the parent interrupt controller.
+- interrupts: describes which input line in the interrupt parent, this
+  fic's output is connected to. This field property depends on the parent's
+  binding
+
+Example:
+
+amazon_fic: interrupt-controller@0xfd8a8500 {
+        compatible = "amazon,al-fic";
+        interrupt-controller;
+        #interrupt-cells = <2>;
+        reg = <0x0 0xfd8a8500 0x0 0x1000>;
+        interrupt-parent = <&gic>;
+        interrupts = <GIC_SPI 0x0 IRQ_TYPE_LEVEL_HIGH>;
+};
diff --git a/Documentation/devicetree/bindings/interrupt-controller/amlogic,meson-gpio-intc.txt b/Documentation/devicetree/bindings/interrupt-controller/amlogic,meson-gpio-intc.txt
index 1502a51548bb..7d531d5fff29 100644
--- a/Documentation/devicetree/bindings/interrupt-controller/amlogic,meson-gpio-intc.txt
+++ b/Documentation/devicetree/bindings/interrupt-controller/amlogic,meson-gpio-intc.txt
@@ -15,6 +15,7 @@ Required properties:
     "amlogic,meson-gxbb-gpio-intc" for GXBB SoCs (S905) or
     "amlogic,meson-gxl-gpio-intc" for GXL SoCs (S905X, S912)
     "amlogic,meson-axg-gpio-intc" for AXG SoCs (A113D, A113X)
+    "amlogic,meson-g12a-gpio-intc" for G12A SoCs (S905D2, S905X2, S905Y2)
 - reg : Specifies base physical address and size of the registers.
 - interrupt-controller : Identifies the node as an interrupt controller.
 - #interrupt-cells : Specifies the number of cells needed to encode an
diff --git a/Documentation/devicetree/bindings/interrupt-controller/csky,mpintc.txt b/Documentation/devicetree/bindings/interrupt-controller/csky,mpintc.txt
index ab921f1698fb..e13405355166 100644
--- a/Documentation/devicetree/bindings/interrupt-controller/csky,mpintc.txt
+++ b/Documentation/devicetree/bindings/interrupt-controller/csky,mpintc.txt
@@ -6,11 +6,16 @@ C-SKY Multi-processors Interrupt Controller is designed for ck807/ck810/ck860
 SMP soc, and it also could be used in non-SMP system.
 
 Interrupt number definition:
-
   0-15  : software irq, and we use 15 as our IPI_IRQ.
  16-31  : private  irq, and we use 16 as the co-processor timer.
  31-1024: common irq for soc ip.
 
+Interrupt triger mode: (Defined in dt-bindings/interrupt-controller/irq.h)
+ IRQ_TYPE_LEVEL_HIGH (default)
+ IRQ_TYPE_LEVEL_LOW
+ IRQ_TYPE_EDGE_RISING
+ IRQ_TYPE_EDGE_FALLING
+
 =============================
 intc node bindings definition
 =============================
@@ -26,15 +31,22 @@ intc node bindings definition
         - #interrupt-cells
                 Usage: required
                 Value type: <u32>
-                Definition: must be <1>
+                Definition: <2>
         - interrupt-controller:
                 Usage: required
 
-Examples:
+Examples: ("interrupts = <irq_num IRQ_TYPE_XXX>")
 ---------
+#include <dt-bindings/interrupt-controller/irq.h>
 
         intc: interrupt-controller {
                 compatible = "csky,mpintc";
-                #interrupt-cells = <1>;
+                #interrupt-cells = <2>;
                 interrupt-controller;
         };
+
+        device: device-example {
+                ...
+                interrupts = <34 IRQ_TYPE_EDGE_RISING>;
+                interrupt-parent = <&intc>;
+        };
diff --git a/Documentation/devicetree/bindings/interrupt-controller/renesas,rza1-irqc.txt b/Documentation/devicetree/bindings/interrupt-controller/renesas,rza1-irqc.txt
new file mode 100644
index 000000000000..727b7e4cd6e0
--- /dev/null
+++ b/Documentation/devicetree/bindings/interrupt-controller/renesas,rza1-irqc.txt
@@ -0,0 +1,43 @@
+DT bindings for the Renesas RZ/A1 Interrupt Controller
+
+The RZ/A1 Interrupt Controller is a front-end for the GIC found on Renesas
+RZ/A1 and RZ/A2 SoCs:
+  - IRQ sense select for 8 external interrupts, 1:1-mapped to 8 GIC SPI
+    interrupts,
+  - NMI edge select.
+
+Required properties:
+  - compatible: Must be "renesas,<soctype>-irqc", and "renesas,rza1-irqc" as
+                fallback.
+                Examples with soctypes are:
+                  - "renesas,r7s72100-irqc" (RZ/A1H)
+                  - "renesas,r7s9210-irqc" (RZ/A2M)
+  - #interrupt-cells: Must be 2 (an interrupt index and flags, as defined
+                                 in interrupts.txt in this directory)
+  - #address-cells: Must be zero
+  - interrupt-controller: Marks the device as an interrupt controller
+  - reg: Base address and length of the memory resource used by the interrupt
+         controller
+  - interrupt-map: Specifies the mapping from external interrupts to GIC
+                   interrupts
+  - interrupt-map-mask: Must be <7 0>
+
+Example:
+
+        irqc: interrupt-controller@fcfef800 {
+                compatible = "renesas,r7s72100-irqc", "renesas,rza1-irqc";
+                #interrupt-cells = <2>;
+                #address-cells = <0>;
+                interrupt-controller;
+                reg = <0xfcfef800 0x6>;
+                interrupt-map =
+                        <0 0 &gic GIC_SPI 0 IRQ_TYPE_LEVEL_HIGH>,
+                        <1 0 &gic GIC_SPI 1 IRQ_TYPE_LEVEL_HIGH>,
+                        <2 0 &gic GIC_SPI 2 IRQ_TYPE_LEVEL_HIGH>,
+                        <3 0 &gic GIC_SPI 3 IRQ_TYPE_LEVEL_HIGH>,
+                        <4 0 &gic GIC_SPI 4 IRQ_TYPE_LEVEL_HIGH>,
+                        <5 0 &gic GIC_SPI 5 IRQ_TYPE_LEVEL_HIGH>,
+                        <6 0 &gic GIC_SPI 6 IRQ_TYPE_LEVEL_HIGH>,
+                        <7 0 &gic GIC_SPI 7 IRQ_TYPE_LEVEL_HIGH>;
+                interrupt-map-mask = <7 0>;
+        };
diff --git a/Documentation/devicetree/bindings/perf/fsl-imx-ddr.txt b/Documentation/devicetree/bindings/perf/fsl-imx-ddr.txt
new file mode 100644
index 000000000000..d77e3f26f9e6
--- /dev/null
+++ b/Documentation/devicetree/bindings/perf/fsl-imx-ddr.txt
@@ -0,0 +1,21 @@
+* Freescale(NXP) IMX8 DDR performance monitor
+
+Required properties:
+
+- compatible: should be one of:
+        "fsl,imx8-ddr-pmu"
+        "fsl,imx8m-ddr-pmu"
+
+- reg: physical address and size
+
+- interrupts: single interrupt
+        generated by the control block
+
+Example:
+
+        ddr-pmu@5c020000 {
+                compatible = "fsl,imx8-ddr-pmu";
+                reg = <0x5c020000 0x10000>;
+                interrupt-parent = <&gic>;
+                interrupts = <GIC_SPI 131 IRQ_TYPE_LEVEL_HIGH>;
+        };
diff --git a/Documentation/devicetree/bindings/riscv/cpus.yaml b/Documentation/devicetree/bindings/riscv/cpus.yaml
index 27f02ec4bb45..f97a4ecd7b91 100644
--- a/Documentation/devicetree/bindings/riscv/cpus.yaml
+++ b/Documentation/devicetree/bindings/riscv/cpus.yaml
@@ -152,17 +152,19 @@ examples:
   - |
     // Example 2: Spike ISA Simulator with 1 Hart
     cpus {
-            cpu@0 {
-                    device_type = "cpu";
-                    reg = <0>;
-                    compatible = "riscv";
-                    riscv,isa = "rv64imafdc";
-                    mmu-type = "riscv,sv48";
-                    interrupt-controller {
-                            #interrupt-cells = <1>;
-                            interrupt-controller;
-                            compatible = "riscv,cpu-intc";
-                    };
-            };
+        #address-cells = <1>;
+        #size-cells = <0>;
+        cpu@0 {
+                device_type = "cpu";
+                reg = <0>;
+                compatible = "riscv";
+                riscv,isa = "rv64imafdc";
+                mmu-type = "riscv,sv48";
+                interrupt-controller {
+                        #interrupt-cells = <1>;
+                        interrupt-controller;
+                        compatible = "riscv,cpu-intc";
+                };
+        };
     };
 ...
diff --git a/Documentation/devicetree/bindings/timer/nxp,sysctr-timer.txt b/Documentation/devicetree/bindings/timer/nxp,sysctr-timer.txt
new file mode 100644
index 000000000000..d57659996d62
--- /dev/null
+++ b/Documentation/devicetree/bindings/timer/nxp,sysctr-timer.txt
@@ -0,0 +1,25 @@
+NXP System Counter Module(sys_ctr)
+
+The system counter(sys_ctr) is a programmable system counter which provides
+a shared time base to Cortex A15, A7, A53, A73, etc. it is intended for use in
+applications where the counter is always powered and support multiple,
+unrelated clocks. The compare frame inside can be used for timer purpose.
+
+Required properties:
+
+- compatible :      should be "nxp,sysctr-timer"
+- reg :             Specifies the base physical address and size of the comapre
+                    frame and the counter control, read & compare.
+- interrupts :      should be the first compare frames' interrupt
+- clocks :          Specifies the counter clock.
+- clock-names:      Specifies the clock's name of this module
+
+Example:
+
+        system_counter: timer@306a0000 {
+                compatible = "nxp,sysctr-timer";
+                reg = <0x306a0000 0x20000>;/* system-counter-rd & compare */
+                clocks = <&clk_8m>;
+                clock-names = "per";
+                interrupts = <GIC_SPI 47 IRQ_TYPE_LEVEL_HIGH>;
+        };
diff --git a/Documentation/driver-api/s390-drivers.rst b/Documentation/driver-api/s390-drivers.rst
index 30e6aa7e160b..5158577bc29b 100644
--- a/Documentation/driver-api/s390-drivers.rst
+++ b/Documentation/driver-api/s390-drivers.rst
@@ -27,7 +27,7 @@ not strictly considered I/O devices. They are considered here as well,
 although they are not the focus of this document.
 
 Some additional information can also be found in the kernel source under
-Documentation/s390/driver-model.txt.
+Documentation/s390/driver-model.rst.
 
 The css bus
 ===========
@@ -38,7 +38,7 @@ into several categories:
 * Standard I/O subchannels, for use by the system. They have a child
   device on the ccw bus and are described below.
 * I/O subchannels bound to the vfio-ccw driver. See
-  Documentation/s390/vfio-ccw.txt.
+  Documentation/s390/vfio-ccw.rst.
 * Message subchannels. No Linux driver currently exists.
 * CHSC subchannels (at most one). The chsc subchannel driver can be used
   to send asynchronous chsc commands.
diff --git a/Documentation/locking/lockdep-design.txt b/Documentation/locking/lockdep-design.txt
index 39fae143c9cb..f189d130e543 100644
--- a/Documentation/locking/lockdep-design.txt
+++ b/Documentation/locking/lockdep-design.txt
@@ -15,34 +15,48 @@ tens of thousands of) instantiations. For example a lock in the inode
 struct is one class, while each inode has its own instantiation of that
 lock class.
 
-The validator tracks the 'state' of lock-classes, and it tracks
-dependencies between different lock-classes. The validator maintains a
-rolling proof that the state and the dependencies are correct.
-
-Unlike an lock instantiation, the lock-class itself never goes away: when
-a lock-class is used for the first time after bootup it gets registered,
-and all subsequent uses of that lock-class will be attached to this
-lock-class.
+The validator tracks the 'usage state' of lock-classes, and it tracks
+the dependencies between different lock-classes. Lock usage indicates
+how a lock is used with regard to its IRQ contexts, while lock
+dependency can be understood as lock order, where L1 -> L2 suggests that
+a task is attempting to acquire L2 while holding L1. From lockdep's
+perspective, the two locks (L1 and L2) are not necessarily related; that
+dependency just means the order ever happened. The validator maintains a
+continuing effort to prove lock usages and dependencies are correct or
+the validator will shoot a splat if incorrect.
+
+A lock-class's behavior is constructed by its instances collectively:
+when the first instance of a lock-class is used after bootup the class
+gets registered, then all (subsequent) instances will be mapped to the
+class and hence their usages and dependecies will contribute to those of
+the class. A lock-class does not go away when a lock instance does, but
+it can be removed if the memory space of the lock class (static or
+dynamic) is reclaimed, this happens for example when a module is
+unloaded or a workqueue is destroyed.
 
 State
 -----
 
-The validator tracks lock-class usage history into 4 * nSTATEs + 1 separate
-state bits:
+The validator tracks lock-class usage history and divides the usage into
+(4 usages * n STATEs + 1) categories:
 
+where the 4 usages can be:
 - 'ever held in STATE context'
 - 'ever held as readlock in STATE context'
 - 'ever held with STATE enabled'
 - 'ever held as readlock with STATE enabled'
 
-Where STATE can be either one of (kernel/locking/lockdep_states.h)
- - hardirq
- - softirq
+where the n STATEs are coded in kernel/locking/lockdep_states.h and as of
+now they include:
+- hardirq
+- softirq
 
+where the last 1 category is:
 - 'ever used'                                       [ == !unused        ]
 
-When locking rules are violated, these state bits are presented in the
-locking error messages, inside curlies. A contrived example:
+When locking rules are violated, these usage bits are presented in the
+locking error messages, inside curlies, with a total of 2 * n STATEs bits.
+A contrived example:
 
    modprobe/2287 is trying to acquire lock:
     (&sio_locks[i].lock){-.-.}, at: [<c02867fd>] mutex_lock+0x21/0x24
@@ -51,28 +65,67 @@ locking error messages, inside curlies. A contrived example:
     (&sio_locks[i].lock){-.-.}, at: [<c02867fd>] mutex_lock+0x21/0x24
 
 
-The bit position indicates STATE, STATE-read, for each of the states listed
-above, and the character displayed in each indicates:
+For a given lock, the bit positions from left to right indicate the usage
+of the lock and readlock (if exists), for each of the n STATEs listed
+above respectively, and the character displayed at each bit position
+indicates:
 
    '.'  acquired while irqs disabled and not in irq context
    '-'  acquired in irq context
    '+'  acquired with irqs enabled
    '?'  acquired in irq context with irqs enabled.
 
-Unused mutexes cannot be part of the cause of an error.
+The bits are illustrated with an example:
+
+    (&sio_locks[i].lock){-.-.}, at: [<c02867fd>] mutex_lock+0x21/0x24
+                         ||||
+                         ||| \-> softirq disabled and not in softirq context
+                         || \--> acquired in softirq context
+                         | \---> hardirq disabled and not in hardirq context
+                          \----> acquired in hardirq context
+
+
+For a given STATE, whether the lock is ever acquired in that STATE
+context and whether that STATE is enabled yields four possible cases as
+shown in the table below. The bit character is able to indicate which
+exact case is for the lock as of the reporting time.
+
+   -------------------------------------------
+  |              | irq enabled | irq disabled |
+  |-------------------------------------------|
+  | ever in irq  |      ?      |       -      |
+  |-------------------------------------------|
+  | never in irq |      +      |       .      |
+   -------------------------------------------
+
+The character '-' suggests irq is disabled because if otherwise the
+charactor '?' would have been shown instead. Similar deduction can be
+applied for '+' too.
+
+Unused locks (e.g., mutexes) cannot be part of the cause of an error.
 
 
 Single-lock state rules:
 ------------------------
 
+A lock is irq-safe means it was ever used in an irq context, while a lock
+is irq-unsafe means it was ever acquired with irq enabled.
+
 A softirq-unsafe lock-class is automatically hardirq-unsafe as well. The
-following states are exclusive, and only one of them is allowed to be
-set for any lock-class:
+following states must be exclusive: only one of them is allowed to be set
+for any lock-class based on its usage:
+
+ <hardirq-safe> or <hardirq-unsafe>
+ <softirq-safe> or <softirq-unsafe>
 
- <hardirq-safe> and <hardirq-unsafe>
- <softirq-safe> and <softirq-unsafe>
+This is because if a lock can be used in irq context (irq-safe) then it
+cannot be ever acquired with irq enabled (irq-unsafe). Otherwise, a
+deadlock may happen. For example, in the scenario that after this lock
+was acquired but before released, if the context is interrupted this
+lock will be attempted to acquire twice, which creates a deadlock,
+referred to as lock recursion deadlock.
 
-The validator detects and reports lock usage that violate these
+The validator detects and reports lock usage that violates these
 single-lock state rules.
 
 Multi-lock dependency rules:
@@ -81,15 +134,18 @@ Multi-lock dependency rules:
 The same lock-class must not be acquired twice, because this could lead
 to lock recursion deadlocks.
 
-Furthermore, two locks may not be taken in different order:
+Furthermore, two locks can not be taken in inverse order:
 
  <L1> -> <L2>
  <L2> -> <L1>
 
-because this could lead to lock inversion deadlocks. (The validator
-finds such dependencies in arbitrary complexity, i.e. there can be any
-other locking sequence between the acquire-lock operations, the
-validator will still track all dependencies between locks.)
+because this could lead to a deadlock - referred to as lock inversion
+deadlock - as attempts to acquire the two locks form a circle which
+could lead to the two contexts waiting for each other permanently. The
+validator will find such dependency circle in arbitrary complexity,
+i.e., there can be any other locking sequence between the acquire-lock
+operations; the validator will still find whether these locks can be
+acquired in a circular fashion.
 
 Furthermore, the following usage based lock dependencies are not allowed
 between any two lock-classes:
diff --git a/Documentation/memory-barriers.txt b/Documentation/memory-barriers.txt
index f70ebcdfe592..e4e07c8ab89e 100644
--- a/Documentation/memory-barriers.txt
+++ b/Documentation/memory-barriers.txt
@@ -3,7 +3,7 @@
                          ============================
 
 By: David Howells <dhowells@redhat.com>
-    Paul E. McKenney <paulmck@linux.vnet.ibm.com>
+    Paul E. McKenney <paulmck@linux.ibm.com>
     Will Deacon <will.deacon@arm.com>
     Peter Zijlstra <peterz@infradead.org>
 
diff --git a/Documentation/process/changes.rst b/Documentation/process/changes.rst
index 18735dc460a0..0a18075c485e 100644
--- a/Documentation/process/changes.rst
+++ b/Documentation/process/changes.rst
@@ -31,7 +31,7 @@ you probably needn't concern yourself with isdn4k-utils.
 ====================== ===============  ========================================
 GNU C                  4.6              gcc --version
 GNU make               3.81             make --version
-binutils               2.20             ld -v
+binutils               2.21             ld -v
 flex                   2.5.35           flex --version
 bison                  2.0              bison --version
 util-linux             2.10o            fdformat --version
@@ -77,9 +77,7 @@ You will need GNU make 3.81 or later to build the kernel.
 Binutils
 --------
 
-The build system has, as of 4.13, switched to using thin archives (`ar T`)
-rather than incremental linking (`ld -r`) for built-in.a intermediate steps.
-This requires binutils 2.20 or newer.
+Binutils 2.21 or newer is needed to build the kernel.
 
 pkg-config
 ----------
diff --git a/Documentation/s390/3270.txt b/Documentation/s390/3270.rst
index 7c715de99774..e09e77954238 100644
--- a/Documentation/s390/3270.txt
+++ b/Documentation/s390/3270.rst
@@ -1,13 +1,17 @@
+===============================
 IBM 3270 Display System support
+===============================
 
 This file describes the driver that supports local channel attachment
 of IBM 3270 devices.  It consists of three sections:
+
         * Introduction
         * Installation
         * Operation
 
 
-INTRODUCTION.
+Introduction
+============
 
 This paper describes installing and operating 3270 devices under
 Linux/390.  A 3270 device is a block-mode rows-and-columns terminal of
@@ -17,12 +21,12 @@ twenty and thirty years ago.
 You may have 3270s in-house and not know it.  If you're using the
 VM-ESA operating system, define a 3270 to your virtual machine by using
 the command "DEF GRAF <hex-address>"  This paper presumes you will be
-defining four 3270s with the CP/CMS commands
+defining four 3270s with the CP/CMS commands:
 
-        DEF GRAF 620
-        DEF GRAF 621
-        DEF GRAF 622
-        DEF GRAF 623
+        - DEF GRAF 620
+        - DEF GRAF 621
+        - DEF GRAF 622
+        - DEF GRAF 623
 
 Your network connection from VM-ESA allows you to use x3270, tn3270, or
 another 3270 emulator, started from an xterm window on your PC or
@@ -34,7 +38,8 @@ This paper covers installation of the driver and operation of a
 dialed-in x3270.
 
 
-INSTALLATION.
+Installation
+============
 
 You install the driver by installing a patch, doing a kernel build, and
 running the configuration script (config3270.sh, in this directory).
@@ -59,13 +64,15 @@ Use #CP TERM CONMODE 3270 to change it to 3270.  If you generate only
 at boot time to a 3270 if it is a 3215.
 
 In brief, these are the steps:
+
         1. Install the tub3270 patch
-        2. (If a module) add a line to a file in /etc/modprobe.d/*.conf
+        2. (If a module) add a line to a file in `/etc/modprobe.d/*.conf`
         3. (If VM) define devices with DEF GRAF
         4. Reboot
         5. Configure
 
 To test that everything works, assuming VM and x3270,
+
         1. Bring up an x3270 window.
         2. Use the DIAL command in that window.
         3. You should immediately see a Linux login screen.
@@ -74,7 +81,8 @@ Here are the installation steps in detail:
 
         1.  The 3270 driver is a part of the official Linux kernel
         source.  Build a tree with the kernel source and any necessary
-        patches.  Then do
+        patches.  Then do::
+
                 make oldconfig
                 (If you wish to disable 3215 console support, edit
                 .config; change CONFIG_TN3215's value to "n";
@@ -84,20 +92,22 @@ Here are the installation steps in detail:
                 make modules_install
 
         2. (Perform this step only if you have configured tub3270 as a
-        module.)  Add a line to a file /etc/modprobe.d/*.conf to automatically
+        module.)  Add a line to a file `/etc/modprobe.d/*.conf` to automatically
         load the driver when it's needed.  With this line added, you will see
         login prompts appear on your 3270s as soon as boot is complete (or
         with emulated 3270s, as soon as you dial into your vm guest using the
         command "DIAL <vmguestname>").  Since the line-mode major number is
-        227, the line to add should be:
+        227, the line to add should be::
+
                 alias char-major-227 tub3270
 
         3. Define graphic devices to your vm guest machine, if you
         haven't already.  Define them before you reboot (reipl):
-                DEFINE GRAF 620
-                DEFINE GRAF 621
-                DEFINE GRAF 622
-                DEFINE GRAF 623
+
+                - DEFINE GRAF 620
+                - DEFINE GRAF 621
+                - DEFINE GRAF 622
+                - DEFINE GRAF 623
 
         4. Reboot.  The reboot process scans hardware devices, including
         3270s, and this enables the tub3270 driver once loaded to respond
@@ -107,21 +117,23 @@ Here are the installation steps in detail:
 
         5. Run the 3270 configuration script config3270.  It is
         distributed in this same directory, Documentation/s390, as
-        config3270.sh.  Inspect the output script it produces,
+        config3270.sh.  Inspect the output script it produces,
         /tmp/mkdev3270, and then run that script.  This will create the
         necessary character special device files and make the necessary
         changes to /etc/inittab.
 
         Then notify /sbin/init that /etc/inittab has changed, by issuing
-        the telinit command with the q operand:
+        the telinit command with the q operand::
+
                 cd Documentation/s390
                 sh config3270.sh
                 sh /tmp/mkdev3270
                 telinit q
 
-        This should be sufficient for your first time.  If your 3270
+        This should be sufficient for your first time.  If your 3270
         configuration has changed and you're reusing config3270, you
-        should follow these steps:
+        should follow these steps::
+
                 Change 3270 configuration
                 Reboot
                 Run config3270 and /tmp/mkdev3270
@@ -132,8 +144,10 @@ Here are the testing steps in detail:
         1. Bring up an x3270 window, or use an actual hardware 3278 or
         3279, or use the 3270 emulator of your choice.  You would be
         running the emulator on your PC or workstation.  You would use
-        the command, for example,
+        the command, for example::
+
                 x3270 vm-esa-domain-name &
+
         if you wanted a 3278 Model 4 with 43 rows of 80 columns, the
         default model number.  The driver does not take advantage of
         extended attributes.
@@ -144,7 +158,8 @@ Here are the testing steps in detail:
 
         2. Use the DIAL command instead of the LOGIN command to connect
         to one of the virtual 3270s you defined with the DEF GRAF
-        commands:
+        commands::
+
                 dial my-vm-guest-name
 
         3. You should immediately see a login prompt from your
@@ -171,14 +186,17 @@ Here are the testing steps in detail:
         Wrong major number?  Wrong minor number?  There's your
         problem!
 
-        D. Do you get the message
+        D. Do you get the message::
+
                  "HCPDIA047E my-vm-guest-name 0620 does not exist"?
+
         If so, you must issue the command "DEF GRAF 620" from your VM
         3215 console and then reboot the system.
 
 
 
 OPERATION.
+==========
 
 The driver defines three areas on the 3270 screen:  the log area, the
 input area, and the status area.
@@ -203,8 +221,10 @@ which indicates no scrolling will occur.  (If you hit ENTER with "Linux
 Running" and nothing typed, the application receives a newline.)
 
 You may change the scrolling timeout value.  For example, the following
-command line:
+command line::
+
         echo scrolltime=60 > /proc/tty/driver/tty3270
+
 changes the scrolling timeout value to 60 sec.  Set scrolltime to 0 if
 you wish to prevent scrolling entirely.
 
@@ -228,7 +248,8 @@ cause an EOF also by typing "^D" and hitting ENTER.
 No PF key is preassigned to cause a job suspension, but you may cause a
 job suspension by typing "^Z" and hitting ENTER.  You may wish to
 assign this function to a PF key.  To make PF7 cause job suspension,
-execute the command:
+execute the command::
+
         echo pf7=^z > /proc/tty/driver/tty3270
 
 If the input you type does not end with the two characters "^n", the
@@ -243,8 +264,10 @@ command is entered into the stack only when the input area is not made
 invisible (such as for password entry) and it is not identical to the
 current top entry.  PF10 rotates backward through the command stack;
 PF11 rotates forward.  You may assign the backward function to any PF
-key (or PA key, for that matter), say, PA3, with the command:
+key (or PA key, for that matter), say, PA3, with the command::
+
         echo -e pa3=\\033k > /proc/tty/driver/tty3270
+
 This assigns the string ESC-k to PA3.  Similarly, the string ESC-j
 performs the forward function.  (Rationale:  In bash with vi-mode line
 editing, ESC-k and ESC-j retrieve backward and forward history.
@@ -252,15 +275,19 @@ Suggestions welcome.)
 
 Is a stack size of twenty commands not to your liking?  Change it on
 the fly.  To change to saving the last 100 commands, execute the
-command:
+command::
+
         echo recallsize=100 > /proc/tty/driver/tty3270
 
 Have a command you issue frequently?  Assign it to a PF or PA key!  Use
-the command
-        echo pf24="mkdir foobar; cd foobar" > /proc/tty/driver/tty3270 
+the command::
+
+        echo pf24="mkdir foobar; cd foobar" > /proc/tty/driver/tty3270
+
 to execute the commands mkdir foobar and cd foobar immediately when you
 hit PF24.  Want to see the command line first, before you execute it?
-Use the -n option of the echo command:
+Use the -n option of the echo command::
+
         echo -n pf24="mkdir foo; cd foo" > /proc/tty/driver/tty3270
 
 
diff --git a/Documentation/s390/Debugging390.txt b/Documentation/s390/Debugging390.txt
deleted file mode 100644
index 5ae7f868a007..000000000000
--- a/Documentation/s390/Debugging390.txt
+++ /dev/null
@@ -1,2142 +0,0 @@
-
-                  Debugging on Linux for s/390 & z/Architecture
-                                       by
-          Denis Joseph Barrow (djbarrow@de.ibm.com,barrow_dj@yahoo.com)
-    Copyright (C) 2000-2001 IBM Deutschland Entwicklung GmbH, IBM Corporation
-                        Best viewed with fixed width fonts
-
-Overview of Document:
-=====================
-This document is intended to give a good overview of how to debug Linux for
-s/390 and z/Architecture. It is not intended as a complete reference and not a
-tutorial on the fundamentals of C & assembly. It doesn't go into
-390 IO in any detail. It is intended to complement the documents in the
-reference section below & any other worthwhile references you get.
-
-It is intended like the Enterprise Systems Architecture/390 Reference Summary
-to be printed out & used as a quick cheat sheet self help style reference when
-problems occur.
-
-Contents
-========
-Register Set
-Address Spaces on Intel Linux
-Address Spaces on Linux for s/390 & z/Architecture
-The Linux for s/390 & z/Architecture Kernel Task Structure
-Register Usage & Stackframes on Linux for s/390 & z/Architecture
-A sample program with comments
-Compiling programs for debugging on Linux for s/390 & z/Architecture
-Debugging under VM
-s/390 & z/Architecture IO Overview
-Debugging IO on s/390 & z/Architecture under VM
-GDB on s/390 & z/Architecture
-Stack chaining in gdb by hand
-Examining core dumps
-ldd
-Debugging modules
-The proc file system
-SysRq
-References
-Special Thanks
-
-Register Set
-============
-The current architectures have the following registers.
- 
-16 General propose registers, 32 bit on s/390 and 64 bit on z/Architecture,
-r0-r15 (or gpr0-gpr15), used for arithmetic and addressing.
-
-16 Control registers, 32 bit on s/390 and 64 bit on z/Architecture, cr0-cr15,
-kernel usage only, used for memory management, interrupt control, debugging
-control etc.
-
-16 Access registers (ar0-ar15), 32 bit on both s/390 and z/Architecture,
-normally not used by normal programs but potentially could be used as
-temporary storage. These registers have a 1:1 association with general
-purpose registers and are designed to be used in the so-called access
-register mode to select different address spaces.
-Access register 0 (and access register 1 on z/Architecture, which needs a
-64 bit pointer) is currently used by the pthread library as a pointer to
-the current running threads private area.
-
-16 64 bit floating point registers (fp0-fp15 ) IEEE & HFP floating 
-point format compliant on G5 upwards & a Floating point control reg (FPC) 
-4  64 bit registers (fp0,fp2,fp4 & fp6) HFP only on older machines.
-Note:
-Linux (currently) always uses IEEE & emulates G5 IEEE format on older machines,
-( provided the kernel is configured for this ).
-
-
-The PSW is the most important register on the machine it
-is 64 bit on s/390 & 128 bit on z/Architecture & serves the roles of 
-a program counter (pc), condition code register,memory space designator.
-In IBM standard notation I am counting bit 0 as the MSB.
-It has several advantages over a normal program counter
-in that you can change address translation & program counter 
-in a single instruction. To change address translation,
-e.g. switching address translation off requires that you
-have a logical=physical mapping for the address you are
-currently running at.
-
-      Bit           Value
-s/390 z/Architecture
-0       0     Reserved ( must be 0 ) otherwise specification exception occurs.
-
-1       1     Program Event Recording 1 PER enabled, 
-              PER is used to facilitate debugging e.g. single stepping.
-
-2-4    2-4    Reserved ( must be 0 ). 
-
-5       5     Dynamic address translation 1=DAT on.
-
-6       6     Input/Output interrupt Mask
-
-7       7     External interrupt Mask used primarily for interprocessor
-              signalling and clock interrupts.
-
-8-11  8-11    PSW Key used for complex memory protection mechanism
-              (not used under linux)
-
-12      12    1 on s/390 0 on z/Architecture
-
-13      13    Machine Check Mask 1=enable machine check interrupts
-
-14      14    Wait State. Set this to 1 to stop the processor except for
-              interrupts and give  time to other LPARS. Used in CPU idle in
-              the kernel to increase overall usage of processor resources.
-
-15      15    Problem state ( if set to 1 certain instructions are disabled )
-              all linux user programs run with this bit 1 
-              ( useful info for debugging under VM ).
-
-16-17 16-17   Address Space Control
-
-              00 Primary Space Mode:
-              The register CR1 contains the primary address-space control ele-
-              ment (PASCE), which points to the primary space region/segment
-              table origin.
-
-              01 Access register mode
-
-              10 Secondary Space Mode:
-              The register CR7 contains the secondary address-space control
-              element (SASCE), which points to the secondary space region or
-              segment table origin.
-
-              11 Home Space Mode:
-              The register CR13 contains the home space address-space control
-              element (HASCE), which points to the home space region/segment
-              table origin.
-
-              See "Address Spaces on Linux for s/390 & z/Architecture" below
-              for more information about address space usage in Linux.
-
-18-19 18-19   Condition codes (CC)
-
-20    20      Fixed point overflow mask if 1=FPU exceptions for this event 
-              occur ( normally 0 ) 
-
-21    21      Decimal overflow mask if 1=FPU exceptions for this event occur 
-              ( normally 0 )
-
-22    22      Exponent underflow mask if 1=FPU exceptions for this event occur 
-              ( normally 0 )
-
-23    23      Significance Mask if 1=FPU exceptions for this event occur 
-              ( normally 0 )
-
-24-31 24-30   Reserved Must be 0.
-
-      31      Extended Addressing Mode
-      32      Basic Addressing Mode
-              Used to set addressing mode
-              PSW 31   PSW 32
-                0         0        24 bit
-                0         1        31 bit
-                1         1        64 bit
-
-32             1=31 bit addressing mode 0=24 bit addressing mode (for backward 
-               compatibility), linux always runs with this bit set to 1
-
-33-64          Instruction address.
-      33-63    Reserved must be 0
-      64-127   Address
-               In 24 bits mode bits 64-103=0 bits 104-127 Address 
-               In 31 bits mode bits 64-96=0 bits 97-127 Address
-               Note: unlike 31 bit mode on s/390 bit 96 must be zero
-               when loading the address with LPSWE otherwise a 
-               specification exception occurs, LPSW is fully backward
-               compatible.
-
-
-Prefix Page(s)
---------------
-This per cpu memory area is too intimately tied to the processor not to mention.
-It exists between the real addresses 0-4096 on s/390 and between 0-8192 on
-z/Architecture and is exchanged with one page on s/390 or two pages on
-z/Architecture in absolute storage by the set prefix instruction during Linux
-startup.
-This page is mapped to a different prefix for each processor in an SMP
-configuration (assuming the OS designer is sane of course).
-Bytes 0-512 (200 hex) on s/390 and 0-512, 4096-4544, 4604-5119 currently on
-z/Architecture are used by the processor itself for holding such information
-as exception indications and entry points for exceptions.
-Bytes after 0xc00 hex are used by linux for per processor globals on s/390 and
-z/Architecture (there is a gap on z/Architecture currently between 0xc00 and
-0x1000, too, which is used by Linux).
-The closest thing to this on traditional architectures is the interrupt
-vector table. This is a good thing & does simplify some of the kernel coding
-however it means that we now cannot catch stray NULL pointers in the
-kernel without hard coded checks.
-
-
-
-Address Spaces on Intel Linux
-=============================
-
-The traditional Intel Linux is approximately mapped as follows forgive
-the ascii art.
-0xFFFFFFFF 4GB Himem            *****************
-                                *               *
-                                * Kernel Space  *
-                                *               *
-                                *****************         ****************
-User Space Himem                *  User Stack   *         *              *
-(typically 0xC0000000 3GB )     *****************         *              *
-                                *  Shared Libs  *         * Next Process *
-                                *****************         *     to       *
-                                *               *   <==   *     Run      *  <==
-                                *  User Program *         *              *
-                                *   Data BSS    *         *              *
-                                *    Text       *         *              *
-                                *   Sections    *         *              *
-0x00000000                      *****************         ****************
-
-Now it is easy to see that on Intel it is quite easy to recognise a kernel
-address as being one greater than user space himem (in this case 0xC0000000),
-and addresses of less than this are the ones in the current running program on
-this processor (if an smp box).
-If using the virtual machine ( VM ) as a debugger it is quite difficult to
-know which user process is running as the address space you are looking at
-could be from any process in the run queue.
-
-The limitation of Intels addressing technique is that the linux
-kernel uses a very simple real address to virtual addressing technique
-of Real Address=Virtual Address-User Space Himem.
-This means that on Intel the kernel linux can typically only address
-Himem=0xFFFFFFFF-0xC0000000=1GB & this is all the RAM these machines
-can typically use.
-They can lower User Himem to 2GB or lower & thus be
-able to use 2GB of RAM however this shrinks the maximum size
-of User Space from 3GB to 2GB they have a no win limit of 4GB unless
-they go to 64 Bit.
-
-
-On 390 our limitations & strengths make us slightly different.
-For backward compatibility we are only allowed use 31 bits (2GB)
-of our 32 bit addresses, however, we use entirely separate address 
-spaces for the user & kernel.
-
-This means we can support 2GB of non Extended RAM on s/390, & more
-with the Extended memory management swap device & 
-currently 4TB of physical memory currently on z/Architecture.
-
-
-Address Spaces on Linux for s/390 & z/Architecture
-==================================================
-
-Our addressing scheme is basically as follows:
-
-                                   Primary Space               Home Space
-Himem 0x7fffffff 2GB on s/390    *****************          ****************
-currently 0x3ffffffffff (2^42)-1 *  User Stack   *          *              *
-on z/Architecture.               *****************          *              *
-                                 *  Shared Libs  *          *              *
-                                 *****************          *              *
-                                 *               *          *    Kernel    *  
-                                 *  User Program *          *              *
-                                 *   Data BSS    *          *              *
-                                 *    Text       *          *              *
-                                 *   Sections    *          *              *
-0x00000000                       *****************          ****************
-
-This also means that we need to look at the PSW problem state bit and the
-addressing mode to decide whether we are looking at user or kernel space.
-
-User space runs in primary address mode (or access register mode within
-the vdso code).
-
-The kernel usually also runs in home space mode, however when accessing
-user space the kernel switches to primary or secondary address mode if
-the mvcos instruction is not available or if a compare-and-swap (futex)
-instruction on a user space address is performed.
-
-When also looking at the ASCE control registers, this means:
-
-User space:
-- runs in primary or access register mode
-- cr1 contains the user asce
-- cr7 contains the user asce
-- cr13 contains the kernel asce
-
-Kernel space:
-- runs in home space mode
-- cr1 contains the user or kernel asce
-  -> the kernel asce is loaded when a uaccess requires primary or
-     secondary address mode
-- cr7 contains the user or kernel asce, (changed with set_fs())
-- cr13 contains the kernel asce
-
-In case of uaccess the kernel changes to:
-- primary space mode in case of a uaccess (copy_to_user) and uses
-  e.g. the mvcp instruction to access user space. However the kernel
-  will stay in home space mode if the mvcos instruction is available
-- secondary space mode in case of futex atomic operations, so that the
-  instructions come from primary address space and data from secondary
-  space
-
-In case of KVM, the kernel runs in home space mode, but cr1 gets switched
-to contain the gmap asce before the SIE instruction gets executed. When
-the SIE instruction is finished, cr1 will be switched back to contain the
-user asce.
-
-
-Virtual Addresses on s/390 & z/Architecture
-===========================================
-
-A virtual address on s/390 is made up of 3 parts
-The SX (segment index, roughly corresponding to the PGD & PMD in Linux
-terminology) being bits 1-11.
-The PX (page index, corresponding to the page table entry (pte) in Linux
-terminology) being bits 12-19.
-The remaining bits BX (the byte index are the offset in the page )
-i.e. bits 20 to 31.
-
-On z/Architecture in linux we currently make up an address from 4 parts.
-The region index bits (RX) 0-32 we currently use bits 22-32
-The segment index (SX) being bits 33-43
-The page index (PX) being bits  44-51
-The byte index (BX) being bits  52-63
-
-Notes:
-1) s/390 has no PMD so the PMD is really the PGD also.
-A lot of this stuff is defined in pgtable.h.
-
-2) Also seeing as s/390's page indexes are only 1k  in size 
-(bits 12-19 x 4 bytes per pte ) we use 1 ( page 4k )
-to make the best use of memory by updating 4 segment indices 
-entries each time we mess with a PMD & use offsets 
-0,1024,2048 & 3072 in this page as for our segment indexes.
-On z/Architecture our page indexes are now 2k in size
-( bits 12-19 x 8 bytes per pte ) we do a similar trick
-but only mess with 2 segment indices each time we mess with
-a PMD.
-
-3) As z/Architecture supports up to a massive 5-level page table lookup we
-can only use 3 currently on Linux ( as this is all the generic kernel
-currently supports ) however this may change in future
-this allows us to access ( according to my sums )
-4TB of virtual storage per process i.e.
-4096*512(PTES)*1024(PMDS)*2048(PGD) = 4398046511104 bytes,
-enough for another 2 or 3 of years I think :-).
-to do this we use a region-third-table designation type in
-our address space control registers.
- 
-
-The Linux for s/390 & z/Architecture Kernel Task Structure
-==========================================================
-Each process/thread under Linux for S390 has its own kernel task_struct
-defined in linux/include/linux/sched.h
-The S390 on initialisation & resuming of a process on a cpu sets
-the __LC_KERNEL_STACK variable in the spare prefix area for this cpu
-(which we use for per-processor globals).
-
-The kernel stack pointer is intimately tied with the task structure for
-each processor as follows.
-
-                      s/390
-            ************************
-            *  1 page kernel stack *
-            *        ( 4K )        *
-            ************************
-            *   1 page task_struct *        
-            *        ( 4K )        *
-8K aligned  ************************ 
-
-                 z/Architecture
-            ************************
-            *  2 page kernel stack *
-            *        ( 8K )        *
-            ************************
-            *  2 page task_struct  *        
-            *        ( 8K )        *
-16K aligned ************************ 
-
-What this means is that we don't need to dedicate any register or global
-variable to point to the current running process & can retrieve it with the
-following very simple construct for s/390 & one very similar for z/Architecture.
-
-static inline struct task_struct * get_current(void)
-{
-        struct task_struct *current;
-        __asm__("lhi   %0,-8192\n\t"
-                "nr    %0,15"
-                : "=r" (current) );
-        return current;
-}
-
-i.e. just anding the current kernel stack pointer with the mask -8192.
-Thankfully because Linux doesn't have support for nested IO interrupts
-& our devices have large buffers can survive interrupts being shut for 
-short amounts of time we don't need a separate stack for interrupts.
-
-
-
-
-Register Usage & Stackframes on Linux for s/390 & z/Architecture
-=================================================================
-Overview:
----------
-This is the code that gcc produces at the top & the bottom of
-each function. It usually is fairly consistent & similar from 
-function to function & if you know its layout you can probably
-make some headway in finding the ultimate cause of a problem
-after a crash without a source level debugger.
-
-Note: To follow stackframes requires a knowledge of C or Pascal &
-limited knowledge of one assembly language.
-
-It should be noted that there are some differences between the
-s/390 and z/Architecture stack layouts as the z/Architecture stack layout
-didn't have to maintain compatibility with older linkage formats.
-
-Glossary:
----------
-alloca:
-This is a built in compiler function for runtime allocation
-of extra space on the callers stack which is obviously freed
-up on function exit ( e.g. the caller may choose to allocate nothing
-of a buffer of 4k if required for temporary purposes ), it generates 
-very efficient code ( a few cycles  ) when compared to alternatives 
-like malloc.
-
-automatics: These are local variables on the stack,
-i.e they aren't in registers & they aren't static.
-
-back-chain:
-This is a pointer to the stack pointer before entering a
-framed functions ( see frameless function ) prologue got by 
-dereferencing the address of the current stack pointer,
- i.e. got by accessing the 32 bit value at the stack pointers
-current location.
-
-base-pointer:
-This is a pointer to the back of the literal pool which
-is an area just behind each procedure used to store constants
-in each function.
-
-call-clobbered: The caller probably needs to save these registers if there 
-is something of value in them, on the stack or elsewhere before making a 
-call to another procedure so that it can restore it later.
-
-epilogue:
-The code generated by the compiler to return to the caller.
-
-frameless-function
-A frameless function in Linux for s390 & z/Architecture is one which doesn't 
-need more than the register save area (96 bytes on s/390, 160 on z/Architecture)
-given to it by the caller.
-A frameless function never:
-1) Sets up a back chain.
-2) Calls alloca.
-3) Calls other normal functions
-4) Has automatics.
-
-GOT-pointer:
-This is a pointer to the global-offset-table in ELF
-( Executable Linkable Format, Linux'es most common executable format ),
-all globals & shared library objects are found using this pointer.
-
-lazy-binding
-ELF shared libraries are typically only loaded when routines in the shared
-library are actually first called at runtime. This is lazy binding.
-
-procedure-linkage-table
-This is a table found from the GOT which contains pointers to routines
-in other shared libraries which can't be called to by easier means.
-
-prologue:
-The code generated by the compiler to set up the stack frame.
-
-outgoing-args:
-This is extra area allocated on the stack of the calling function if the
-parameters for the callee's cannot all be put in registers, the same
-area can be reused by each function the caller calls.
-
-routine-descriptor:
-A COFF  executable format based concept of a procedure reference 
-actually being 8 bytes or more as opposed to a simple pointer to the routine.
-This is typically defined as follows
-Routine Descriptor offset 0=Pointer to Function
-Routine Descriptor offset 4=Pointer to Table of Contents
-The table of contents/TOC is roughly equivalent to a GOT pointer.
-& it means that shared libraries etc. can be shared between several
-environments each with their own TOC.
-
- 
-static-chain: This is used in nested functions a concept adopted from pascal 
-by gcc not used in ansi C or C++ ( although quite useful ), basically it
-is a pointer used to reference local variables of enclosing functions.
-You might come across this stuff once or twice in your lifetime.
-
-e.g.
-The function below should return 11 though gcc may get upset & toss warnings 
-about unused variables.
-int FunctionA(int a)
-{
-        int b;
-        FunctionC(int c)
-        {
-                b=c+1;
-        }
-        FunctionC(10);
-        return(b);
-}
-
-
-s/390 & z/Architecture Register usage
-=====================================
-r0       used by syscalls/assembly                  call-clobbered
-r1       used by syscalls/assembly                  call-clobbered
-r2       argument 0 / return value 0                call-clobbered
-r3       argument 1 / return value 1 (if long long) call-clobbered
-r4       argument 2                                 call-clobbered
-r5       argument 3                                 call-clobbered
-r6       argument 4                                 saved
-r7       pointer-to arguments 5 to ...              saved      
-r8       this & that                                saved
-r9       this & that                                saved
-r10      static-chain ( if nested function )        saved
-r11      frame-pointer ( if function used alloca )  saved
-r12      got-pointer                                saved
-r13      base-pointer                               saved
-r14      return-address                             saved
-r15      stack-pointer                              saved
-
-f0       argument 0 / return value ( float/double ) call-clobbered
-f2       argument 1                                 call-clobbered
-f4       z/Architecture argument 2                  saved
-f6       z/Architecture argument 3                  saved
-The remaining floating points
-f1,f3,f5 f7-f15 are call-clobbered.
-
-Notes:
-------
-1) The only requirement is that registers which are used
-by the callee are saved, e.g. the compiler is perfectly
-capable of using r11 for purposes other than a frame a
-frame pointer if a frame pointer is not needed.
-2) In functions with variable arguments e.g. printf the calling procedure 
-is identical to one without variable arguments & the same number of 
-parameters. However, the prologue of this function is somewhat more
-hairy owing to it having to move these parameters to the stack to
-get va_start, va_arg & va_end to work.
-3) Access registers are currently unused by gcc but are used in
-the kernel. Possibilities exist to use them at the moment for
-temporary storage but it isn't recommended.
-4) Only 4 of the floating point registers are used for
-parameter passing as older machines such as G3 only have only 4
-& it keeps the stack frame compatible with other compilers.
-However with IEEE floating point emulation under linux on the
-older machines you are free to use the other 12.
-5) A long long or double parameter cannot be have the 
-first 4 bytes in a register & the second four bytes in the 
-outgoing args area. It must be purely in the outgoing args
-area if crossing this boundary.
-6) Floating point parameters are mixed with outgoing args
-on the outgoing args area in the order the are passed in as parameters.
-7) Floating point arguments 2 & 3 are saved in the outgoing args area for 
-z/Architecture
-
-
-Stack Frame Layout
-------------------
-s/390     z/Architecture
-0         0             back chain ( a 0 here signifies end of back chain )
-4         8             eos ( end of stack, not used on Linux for S390 used in other linkage formats )
-8         16            glue used in other s/390 linkage formats for saved routine descriptors etc.
-12        24            glue used in other s/390 linkage formats for saved routine descriptors etc.
-16        32            scratch area
-20        40            scratch area
-24        48            saved r6 of caller function
-28        56            saved r7 of caller function
-32        64            saved r8 of caller function
-36        72            saved r9 of caller function
-40        80            saved r10 of caller function
-44        88            saved r11 of caller function
-48        96            saved r12 of caller function
-52        104           saved r13 of caller function
-56        112           saved r14 of caller function
-60        120           saved r15 of caller function
-64        128           saved f4 of caller function
-72        132           saved f6 of caller function
-80                      undefined
-96        160           outgoing args passed from caller to callee
-96+x      160+x         possible stack alignment ( 8 bytes desirable )
-96+x+y    160+x+y       alloca space of caller ( if used )
-96+x+y+z  160+x+y+z     automatics of caller ( if used )
-0                       back-chain
-
-A sample program with comments.
-===============================
-
-Comments on the function test
------------------------------
-1) It didn't need to set up a pointer to the constant pool gpr13 as it is not
-used ( :-( ).
-2) This is a frameless function & no stack is bought.
-3) The compiler was clever enough to recognise that it could return the
-value in r2 as well as use it for the passed in parameter ( :-) ).
-4) The basr ( branch relative & save ) trick works as follows the instruction 
-has a special case with r0,r0 with some instruction operands is understood as 
-the literal value 0, some risc architectures also do this ). So now
-we are branching to the next address & the address new program counter is
-in r13,so now we subtract the size of the function prologue we have executed
-+ the size of the literal pool to get to the top of the literal pool
-0040037c int test(int b)
-{                                                          # Function prologue below
-  40037c:       90 de f0 34     stm     %r13,%r14,52(%r15) # Save registers r13 & r14
-  400380:       0d d0           basr    %r13,%r0           # Set up pointer to constant pool using
-  400382:       a7 da ff fa     ahi     %r13,-6            # basr trick
-        return(5+b);
-                                                           # Huge main program
-  400386:       a7 2a 00 05     ahi     %r2,5              # add 5 to r2
-
-                                                           # Function epilogue below 
-  40038a:       98 de f0 34     lm      %r13,%r14,52(%r15) # restore registers r13 & 14
-  40038e:       07 fe           br      %r14               # return
-}
-
-Comments on the function main
------------------------------
-1) The compiler did this function optimally ( 8-) )
-
-Literal pool for main.
-400390: ff ff ff ec     .long 0xffffffec
-main(int argc,char *argv[])
-{                                                          # Function prologue below
-  400394:       90 bf f0 2c     stm     %r11,%r15,44(%r15) # Save necessary registers
-  400398:       18 0f           lr      %r0,%r15           # copy stack pointer to r0
-  40039a:       a7 fa ff a0     ahi     %r15,-96           # Make area for callee saving 
-  40039e:       0d d0           basr    %r13,%r0           # Set up r13 to point to
-  4003a0:       a7 da ff f0     ahi     %r13,-16           # literal pool
-  4003a4:       50 00 f0 00     st      %r0,0(%r15)        # Save backchain
-
-        return(test(5));                                   # Main Program Below
-  4003a8:       58 e0 d0 00     l       %r14,0(%r13)       # load relative address of test from
-                                                           # literal pool
-  4003ac:       a7 28 00 05     lhi     %r2,5              # Set first parameter to 5
-  4003b0:       4d ee d0 00     bas     %r14,0(%r14,%r13)  # jump to test setting r14 as return
-                                                           # address using branch & save instruction.
-
-                                                           # Function Epilogue below
-  4003b4:       98 bf f0 8c     lm      %r11,%r15,140(%r15)# Restore necessary registers.
-  4003b8:       07 fe           br      %r14               # return to do program exit 
-}
-
-
-Compiler updates
-----------------
-
-main(int argc,char *argv[])
-{
-  4004fc:       90 7f f0 1c             stm     %r7,%r15,28(%r15)
-  400500:       a7 d5 00 04             bras    %r13,400508 <main+0xc>
-  400504:       00 40 04 f4             .long   0x004004f4 
-  # compiler now puts constant pool in code to so it saves an instruction 
-  400508:       18 0f                   lr      %r0,%r15
-  40050a:       a7 fa ff a0             ahi     %r15,-96
-  40050e:       50 00 f0 00             st      %r0,0(%r15)
-        return(test(5));
-  400512:       58 10 d0 00             l       %r1,0(%r13)
-  400516:       a7 28 00 05             lhi     %r2,5
-  40051a:       0d e1                   basr    %r14,%r1
-  # compiler adds 1 extra instruction to epilogue this is done to
-  # avoid processor pipeline stalls owing to data dependencies on g5 &
-  # above as register 14 in the old code was needed directly after being loaded 
-  # by the lm   %r11,%r15,140(%r15) for the br %14.
-  40051c:       58 40 f0 98             l       %r4,152(%r15)
-  400520:       98 7f f0 7c             lm      %r7,%r15,124(%r15)
-  400524:       07 f4                   br      %r4
-}
-
-
-Hartmut ( our compiler developer ) also has been threatening to take out the
-stack backchain in optimised code as this also causes pipeline stalls, you
-have been warned.
-
-64 bit z/Architecture code disassembly
---------------------------------------
-
-If you understand the stuff above you'll understand the stuff
-below too so I'll avoid repeating myself & just say that 
-some of the instructions have g's on the end of them to indicate
-they are 64 bit & the stack offsets are a bigger, 
-the only other difference you'll find between 32 & 64 bit is that
-we now use f4 & f6 for floating point arguments on 64 bit.
-00000000800005b0 <test>:
-int test(int b)
-{
-        return(5+b);
-    800005b0:   a7 2a 00 05             ahi     %r2,5
-    800005b4:   b9 14 00 22             lgfr    %r2,%r2 # downcast to integer
-    800005b8:   07 fe                   br      %r14
-    800005ba:   07 07                   bcr     0,%r7
-
-
-}
-
-00000000800005bc <main>:
-main(int argc,char *argv[])
-{ 
-    800005bc:   eb bf f0 58 00 24       stmg    %r11,%r15,88(%r15)
-    800005c2:   b9 04 00 1f             lgr     %r1,%r15
-    800005c6:   a7 fb ff 60             aghi    %r15,-160
-    800005ca:   e3 10 f0 00 00 24       stg     %r1,0(%r15)
-        return(test(5));
-    800005d0:   a7 29 00 05             lghi    %r2,5
-    # brasl allows jumps > 64k & is overkill here bras would do fune
-    800005d4:   c0 e5 ff ff ff ee       brasl   %r14,800005b0 <test> 
-    800005da:   e3 40 f1 10 00 04       lg      %r4,272(%r15)
-    800005e0:   eb bf f0 f8 00 04       lmg     %r11,%r15,248(%r15)
-    800005e6:   07 f4                   br      %r4
-}
-
-
-
-Compiling programs for debugging on Linux for s/390 & z/Architecture
-====================================================================
--gdwarf-2 now works it should be considered the default debugging
-format for s/390 & z/Architecture as it is more reliable for debugging
-shared libraries,  normal -g debugging works much better now
-Thanks to the IBM java compiler developers bug reports. 
-
-This is typically done adding/appending the flags -g or -gdwarf-2 to the 
-CFLAGS & LDFLAGS variables Makefile of the program concerned.
-
-If using gdb & you would like accurate displays of registers &
- stack traces compile without optimisation i.e make sure
-that there is no -O2 or similar on the CFLAGS line of the Makefile &
-the emitted gcc commands, obviously this will produce worse code 
-( not advisable for shipment ) but it is an  aid to the debugging process.
-
-This aids debugging because the compiler will copy parameters passed in
-in registers onto the stack so backtracing & looking at passed in
-parameters will work, however some larger programs which use inline functions
-will not compile without optimisation.
-
-Debugging with optimisation has since much improved after fixing
-some bugs, please make sure you are using gdb-5.0 or later developed 
-after Nov'2000.
-
-
-
-Debugging under VM
-==================
-
-Notes
------
-Addresses & values in the VM debugger are always hex never decimal
-Address ranges are of the format <HexValue1>-<HexValue2> or
-<HexValue1>.<HexValue2>
-For example, the address range  0x2000 to 0x3000 can be described as 2000-3000
-or 2000.1000
-
-The VM Debugger is case insensitive.
-
-VM's strengths are usually other debuggers weaknesses you can get at any
-resource no matter how sensitive e.g. memory management resources, change
-address translation in the PSW. For kernel hacking you will reap dividends if
-you get good at it.
-
-The VM Debugger displays operators but not operands, and also the debugger
-displays useful information on the same line as the author of the code probably
-felt that it was a good idea not to go over the 80 columns on the screen.
-This isn't as unintuitive as it may seem as the s/390 instructions are easy to
-decode mentally and you can make a good guess at a lot of them as all the
-operands are nibble (half byte aligned).
-So if you have an objdump listing by hand, it is quite easy to follow, and if
-you don't have an objdump listing keep a copy of the s/390 Reference Summary
-or alternatively the s/390 principles of operation next to you.
-e.g. even I can guess that 
-0001AFF8' LR    180F        CC 0
-is a ( load register ) lr r0,r15 
-
-Also it is very easy to tell the length of a 390 instruction from the 2 most
-significant bits in the instruction (not that this info is really useful except
-if you are trying to make sense of a hexdump of code).
-Here is a table
-Bits                    Instruction Length
-------------------------------------------
-00                          2 Bytes
-01                          4 Bytes
-10                          4 Bytes
-11                          6 Bytes
-
-The debugger also displays other useful info on the same line such as the
-addresses being operated on destination addresses of branches & condition codes.
-e.g.  
-00019736' AHI   A7DAFF0E    CC 1
-000198BA' BRC   A7840004 -> 000198C2'   CC 0
-000198CE' STM   900EF068 >> 0FA95E78    CC 2
-
-
-
-Useful VM debugger commands
----------------------------
-
-I suppose I'd better mention this before I start
-to list the current active traces do 
-Q TR
-there can be a maximum of 255 of these per set
-( more about trace sets later ).
-To stop traces issue a
-TR END.
-To delete a particular breakpoint issue
-TR DEL <breakpoint number>
-
-The PA1 key drops to CP mode so you can issue debugger commands,
-Doing alt c (on my 3270 console at least ) clears the screen. 
-hitting b <enter> comes back to the running operating system
-from cp mode ( in our case linux ).
-It is typically useful to add shortcuts to your profile.exec file
-if you have one ( this is roughly equivalent to autoexec.bat in DOS ).
-file here are a few from mine.
-/* this gives me command history on issuing f12 */
-set pf12 retrieve 
-/* this continues */
-set pf8 imm b
-/* goes to trace set a */
-set pf1 imm tr goto a
-/* goes to trace set b */
-set pf2 imm tr goto b
-/* goes to trace set c */
-set pf3 imm tr goto c
-
-
-
-Instruction Tracing
--------------------
-Setting a simple breakpoint
-TR I PSWA <address>
-To debug a particular function try
-TR I R <function address range>
-TR I on its own will single step.
-TR I DATA <MNEMONIC> <OPTIONAL RANGE> will trace for particular mnemonics
-e.g.
-TR I DATA 4D R 0197BC.4000
-will trace for BAS'es ( opcode 4D ) in the range 0197BC.4000
-if you were inclined you could add traces for all branch instructions &
-suffix them with the run prefix so you would have a backtrace on screen 
-when a program crashes.
-TR BR <INTO OR FROM> will trace branches into or out of an address.
-e.g.
-TR BR INTO 0 is often quite useful if a program is getting awkward & deciding
-to branch to 0 & crashing as this will stop at the address before in jumps to 0.
-TR I R <address range> RUN cmd d g
-single steps a range of addresses but stays running &
-displays the gprs on each step.
-
-
-
-Displaying & modifying Registers
---------------------------------
-D G will display all the gprs
-Adding a extra G to all the commands is necessary to access the full 64 bit 
-content in VM on z/Architecture. Obviously this isn't required for access
-registers as these are still 32 bit.
-e.g. DGG instead of DG 
-D X will display all the control registers
-D AR will display all the access registers
-D AR4-7 will display access registers 4 to 7
-CPU ALL D G will display the GRPS of all CPUS in the configuration
-D PSW will display the current PSW
-st PSW 2000 will put the value 2000 into the PSW &
-cause crash your machine.
-D PREFIX displays the prefix offset
-
-
-Displaying Memory
------------------
-To display memory mapped using the current PSW's mapping try
-D <range>
-To make VM display a message each time it hits a particular address and
-continue try
-D I<range> will disassemble/display a range of instructions.
-ST addr 32 bit word will store a 32 bit aligned address
-D T<range> will display the EBCDIC in an address (if you are that way inclined)
-D R<range> will display real addresses ( without DAT ) but with prefixing.
-There are other complex options to display if you need to get at say home space
-but are in primary space the easiest thing to do is to temporarily
-modify the PSW to the other addressing mode, display the stuff & then
-restore it.
-
-
- 
-Hints
------
-If you want to issue a debugger command without halting your virtual machine
-with the PA1 key try prefixing the command with #CP e.g.
-#cp tr i pswa 2000
-also suffixing most debugger commands with RUN will cause them not
-to stop just display the mnemonic at the current instruction on the console.
-If you have several breakpoints you want to put into your program &
-you get fed up of cross referencing with System.map
-you can do the following trick for several symbols.
-grep do_signal System.map 
-which emits the following among other things
-0001f4e0 T do_signal 
-now you can do
-
-TR I PSWA 0001f4e0 cmd msg * do_signal
-This sends a message to your own console each time do_signal is entered.
-( As an aside I wrote a perl script once which automatically generated a REXX
-script with breakpoints on every kernel procedure, this isn't a good idea
-because there are thousands of these routines & VM can only set 255 breakpoints
-at a time so you nearly had to spend as long pruning the file down as you would 
-entering the msgs by hand), however, the trick might be useful for a single
-object file. In the 3270 terminal emulator x3270 there is a very useful option
-in the file menu called "Save Screen In File" - this is very good for keeping a
-copy of traces.
-
-From CMS help <command name> will give you online help on a particular command. 
-e.g. 
-HELP DISPLAY
-
-Also CP has a file called profile.exec which automatically gets called
-on startup of CMS ( like autoexec.bat ), keeping on a DOS analogy session
-CP has a feature similar to doskey, it may be useful for you to
-use profile.exec to define some keystrokes. 
-e.g.
-SET PF9 IMM B
-This does a single step in VM on pressing F8. 
-SET PF10  ^
-This sets up the ^ key.
-which can be used for ^c (ctrl-c),^z (ctrl-z) which can't be typed directly
-into some 3270 consoles.
-SET PF11 ^-
-This types the starting keystrokes for a sysrq see SysRq below.
-SET PF12 RETRIEVE
-This retrieves command history on pressing F12.
-
-
-Sometimes in VM the display is set up to scroll automatically this
-can be very annoying if there are messages you wish to look at
-to stop this do
-TERM MORE 255 255
-This will nearly stop automatic screen updates, however it will
-cause a denial of service if lots of messages go to the 3270 console,
-so it would be foolish to use this as the default on a production machine.
- 
-
-Tracing particular processes
-----------------------------
-The kernel's text segment is intentionally at an address in memory that it will
-very seldom collide with text segments of user programs ( thanks Martin ),
-this simplifies debugging the kernel.
-However it is quite common for user processes to have addresses which collide
-this can make debugging a particular process under VM painful under normal
-circumstances as the process may change when doing a 
-TR I R <address range>.
-Thankfully after reading VM's online help I figured out how to debug
-I particular process.
-
-Your first problem is to find the STD ( segment table designation )
-of the program you wish to debug.
-There are several ways you can do this here are a few
-1) objdump --syms <program to be debugged> | grep main
-To get the address of main in the program.
-tr i pswa <address of main>
-Start the program, if VM drops to CP on what looks like the entry
-point of the main function this is most likely the process you wish to debug.
-Now do a D X13 or D XG13 on z/Architecture.
-On 31 bit the STD is bits 1-19 ( the STO segment table origin ) 
-& 25-31 ( the STL segment table length ) of CR13.
-now type
-TR I R STD <CR13's value> 0.7fffffff
-e.g.
-TR I R STD 8F32E1FF 0.7fffffff
-Another very useful variation is
-TR STORE INTO STD <CR13's value> <address range>
-for finding out when a particular variable changes.
-
-An alternative way of finding the STD of a currently running process 
-is to do the following, ( this method is more complex but
-could be quite convenient if you aren't updating the kernel much &
-so your kernel structures will stay constant for a reasonable period of
-time ).
-
-grep task /proc/<pid>/status
-from this you should see something like
-task: 0f160000 ksp: 0f161de8 pt_regs: 0f161f68
-This now gives you a pointer to the task structure.
-Now make CC:="s390-gcc -g" kernel/sched.s
-To get the task_struct stabinfo.
-( task_struct is defined in include/linux/sched.h ).
-Now we want to look at
-task->active_mm->pgd
-on my machine the active_mm in the task structure stab is
-active_mm:(4,12),672,32
-its offset is 672/8=84=0x54
-the pgd member in the mm_struct stab is
-pgd:(4,6)=*(29,5),96,32
-so its offset is 96/8=12=0xc
-
-so we'll
-hexdump -s 0xf160054 /dev/mem | more
-i.e. task_struct+active_mm offset
-to look at the active_mm member
-f160054 0fee cc60 0019 e334 0000 0000 0000 0011
-hexdump -s 0x0feecc6c /dev/mem | more
-i.e. active_mm+pgd offset
-feecc6c 0f2c 0000 0000 0001 0000 0001 0000 0010
-we get something like
-now do 
-TR I R STD <pgd|0x7f> 0.7fffffff
-i.e. the 0x7f is added because the pgd only
-gives the page table origin & we need to set the low bits
-to the maximum possible segment table length.
-TR I R STD 0f2c007f 0.7fffffff
-on z/Architecture you'll probably need to do
-TR I R STD <pgd|0x7> 0.ffffffffffffffff
-to set the TableType to 0x1 & the Table length to 3.
-
-
-
-Tracing Program Exceptions
---------------------------
-If you get a crash which says something like
-illegal operation or specification exception followed by a register dump
-You can restart linux & trace these using the tr prog <range or value> trace
-option.
-
-
-The most common ones you will normally be tracing for is
-1=operation exception
-2=privileged operation exception
-4=protection exception
-5=addressing exception
-6=specification exception
-10=segment translation exception
-11=page translation exception
-
-The full list of these is on page 22 of the current s/390 Reference Summary.
-e.g.
-tr prog 10 will trace segment translation exceptions.
-tr prog on its own will trace all program interruption codes.
-
-Trace Sets
-----------
-On starting VM you are initially in the INITIAL trace set.
-You can do a Q TR to verify this.
-If you have a complex tracing situation where you wish to wait for instance 
-till a driver is open before you start tracing IO, but know in your
-heart that you are going to have to make several runs through the code till you
-have a clue whats going on. 
-
-What you can do is
-TR I PSWA <Driver open address>
-hit b to continue till breakpoint
-reach the breakpoint
-now do your
-TR GOTO B 
-TR IO 7c08-7c09 inst int run 
-or whatever the IO channels you wish to trace are & hit b
-
-To got back to the initial trace set do
-TR GOTO INITIAL
-& the TR I PSWA <Driver open address> will be the only active breakpoint again.
-
-
-Tracing linux syscalls under VM
--------------------------------
-Syscalls are implemented on Linux for S390 by the Supervisor call instruction
-(SVC). There 256 possibilities of these as the instruction is made up of a 0xA
-opcode and the second byte being the syscall number. They are traced using the
-simple command:
-TR SVC  <Optional value or range>
-the syscalls are defined in linux/arch/s390/include/asm/unistd.h
-e.g. to trace all file opens just do
-TR SVC 5 ( as this is the syscall number of open )
-
-
-SMP Specific commands
----------------------
-To find out how many cpus you have
-Q CPUS displays all the CPU's available to your virtual machine
-To find the cpu that the current cpu VM debugger commands are being directed at
-do Q CPU to change the current cpu VM debugger commands are being directed at do
-CPU <desired cpu no>
-
-On a SMP guest issue a command to all CPUs try prefixing the command with cpu
-all. To issue a command to a particular cpu try cpu <cpu number> e.g.
-CPU 01 TR I R 2000.3000
-If you are running on a guest with several cpus & you have a IO related problem
-& cannot follow the flow of code but you know it isn't smp related.
-from the bash prompt issue
-shutdown -h now or halt.
-do a Q CPUS to find out how many cpus you have
-detach each one of them from cp except cpu 0 
-by issuing a 
-DETACH CPU 01-(number of cpus in configuration)
-& boot linux again.
-TR SIGP will trace inter processor signal processor instructions.
-DEFINE CPU 01-(number in configuration) 
-will get your guests cpus back.
-
-
-Help for displaying ascii textstrings
--------------------------------------
-On the very latest VM Nucleus'es VM can now display ascii
-( thanks Neale for the hint ) by doing
-D TX<lowaddr>.<len>
-e.g.
-D TX0.100
-
-Alternatively
-=============
-Under older VM debuggers (I love EBDIC too) you can use following little
-program which converts a command line of hex digits to ascii text. It can be
-compiled under linux and you can copy the hex digits from your x3270 terminal
-to your xterm if you are debugging from a linuxbox.
-
-This is quite useful when looking at a parameter passed in as a text string
-under VM ( unless you are good at decoding ASCII in your head ).
-
-e.g. consider tracing an open syscall
-TR SVC 5
-We have stopped at a breakpoint
-000151B0' SVC   0A05     -> 0001909A'   CC 0
-
-D 20.8 to check the SVC old psw in the prefix area and see was it from userspace
-(for the layout of the prefix area consult the "Fixed Storage Locations"
-chapter of the s/390 Reference Summary if you have it available).
-V00000020  070C2000 800151B2
-The problem state bit wasn't set &  it's also too early in the boot sequence
-for it to be a userspace SVC if it was we would have to temporarily switch the 
-psw to user space addressing so we could get at the first parameter of the open
-in gpr2.
-Next do a 
-D G2
-GPR  2 =  00014CB4
-Now display what gpr2 is pointing to
-D 00014CB4.20
-V00014CB4  2F646576 2F636F6E 736F6C65 00001BF5
-V00014CC4  FC00014C B4001001 E0001000 B8070707
-Now copy the text till the first 00 hex ( which is the end of the string
-to an xterm & do hex2ascii on it.
-hex2ascii 2F646576 2F636F6E 736F6C65 00 
-outputs
-Decoded Hex:=/ d e v / c o n s o l e 0x00 
-We were opening the console device,
-
-You can compile the code below yourself for practice :-),
-/*
- *    hex2ascii.c
- *    a useful little tool for converting a hexadecimal command line to ascii
- *
- *    Author(s): Denis Joseph Barrow (djbarrow@de.ibm.com,barrow_dj@yahoo.com)
- *    (C) 2000 IBM Deutschland Entwicklung GmbH, IBM Corporation.
- */   
-#include <stdio.h>
-
-int main(int argc,char *argv[])
-{
-  int cnt1,cnt2,len,toggle=0;
-  int startcnt=1;
-  unsigned char c,hex;
-  
-  if(argc>1&&(strcmp(argv[1],"-a")==0))
-     startcnt=2;
-  printf("Decoded Hex:=");
-  for(cnt1=startcnt;cnt1<argc;cnt1++)
-  {
-    len=strlen(argv[cnt1]);
-    for(cnt2=0;cnt2<len;cnt2++)
-    {
-       c=argv[cnt1][cnt2];
-       if(c>='0'&&c<='9')
-          c=c-'0';
-       if(c>='A'&&c<='F')
-          c=c-'A'+10;
-       if(c>='a'&&c<='f')
-          c=c-'a'+10;
-       switch(toggle)
-       {
-          case 0:
-             hex=c<<4;
-             toggle=1;
-          break;
-          case 1:
-             hex+=c;
-             if(hex<32||hex>127)
-             {
-                if(startcnt==1)
-                   printf("0x%02X ",(int)hex);
-                else
-                   printf(".");
-             }
-             else
-             {
-               printf("%c",hex);
-               if(startcnt==1)
-                  printf(" ");
-             }
-             toggle=0;
-          break;
-       }
-    }
-  }
-  printf("\n");
-}
-
-
-
-
-Stack tracing under VM
-----------------------
-A basic backtrace
------------------
-
-Here are the tricks I use 9 out of 10 times it works pretty well,
-
-When your backchain reaches a dead end
---------------------------------------
-This can happen when an exception happens in the kernel and the kernel is
-entered twice. If you reach the NULL pointer at the end of the back chain you
-should be able to sniff further back if you follow the following tricks.
-1) A kernel address should be easy to recognise since it is in
-primary space & the problem state bit isn't set & also
-The Hi bit of the address is set.
-2) Another backchain should also be easy to recognise since it is an 
-address pointing to another address approximately 100 bytes or 0x70 hex
-behind the current stackpointer.
-
-
-Here is some practice.
-boot the kernel & hit PA1 at some random time
-d g to display the gprs, this should display something like
-GPR  0 =  00000001  00156018  0014359C  00000000
-GPR  4 =  00000001  001B8888  000003E0  00000000
-GPR  8 =  00100080  00100084  00000000  000FE000
-GPR 12 =  00010400  8001B2DC  8001B36A  000FFED8
-Note that GPR14 is a return address but as we are real men we are going to
-trace the stack.
-display 0x40 bytes after the stack pointer.
-
-V000FFED8  000FFF38 8001B838 80014C8E 000FFF38
-V000FFEE8  00000000 00000000 000003E0 00000000
-V000FFEF8  00100080 00100084 00000000 000FE000
-V000FFF08  00010400 8001B2DC 8001B36A 000FFED8
-
-
-Ah now look at whats in sp+56 (sp+0x38) this is 8001B36A our saved r14 if
-you look above at our stackframe & also agrees with GPR14.
-
-now backchain 
-d 000FFF38.40
-we now are taking the contents of SP to get our first backchain.
-
-V000FFF38  000FFFA0 00000000 00014995 00147094
-V000FFF48  00147090 001470A0 000003E0 00000000
-V000FFF58  00100080 00100084 00000000 001BF1D0
-V000FFF68  00010400 800149BA 80014CA6 000FFF38
-
-This displays a 2nd return address of 80014CA6
-
-now do d 000FFFA0.40 for our 3rd backchain
-
-V000FFFA0  04B52002 0001107F 00000000 00000000
-V000FFFB0  00000000 00000000 FF000000 0001107F
-V000FFFC0  00000000 00000000 00000000 00000000
-V000FFFD0  00010400 80010802 8001085A 000FFFA0
-
-
-our 3rd return address is 8001085A
-
-as the 04B52002 looks suspiciously like rubbish it is fair to assume that the
-kernel entry routines for the sake of optimisation don't set up a backchain.
-
-now look at System.map to see if the addresses make any sense.
-
-grep -i 0001b3 System.map
-outputs among other things
-0001b304 T cpu_idle 
-so 8001B36A
-is cpu_idle+0x66 ( quiet the cpu is asleep, don't wake it )
-
-
-grep -i 00014 System.map 
-produces among other things
-00014a78 T start_kernel  
-so 0014CA6 is start_kernel+some hex number I can't add in my head.
-
-grep -i 00108 System.map 
-this produces
-00010800 T _stext
-so   8001085A is _stext+0x5a
-
-Congrats you've done your first backchain.
-
-
-
-s/390 & z/Architecture IO Overview
-==================================
-
-I am not going to give a course in 390 IO architecture as this would take me
-quite a while and I'm no expert. Instead I'll give a 390 IO architecture
-summary for Dummies. If you have the s/390 principles of operation available
-read this instead. If nothing else you may find a few useful keywords in here
-and be able to use them on a web search engine to find more useful information.
-
-Unlike other bus architectures modern 390 systems do their IO using mostly
-fibre optics and devices such as tapes and disks can be shared between several
-mainframes. Also S390 can support up to 65536 devices while a high end PC based
-system might be choking with around 64.
-
-Here is some of the common IO terminology:
-
-Subchannel:
-This is the logical number most IO commands use to talk to an IO device. There
-can be up to 0x10000 (65536) of these in a configuration, typically there are a
-few hundred. Under VM for simplicity they are allocated contiguously, however
-on the native hardware they are not. They typically stay consistent between
-boots provided no new hardware is inserted or removed.
-Under Linux for s390 we use these as IRQ's and also when issuing an IO command
-(CLEAR SUBCHANNEL, HALT SUBCHANNEL, MODIFY SUBCHANNEL, RESUME SUBCHANNEL,
-START SUBCHANNEL, STORE SUBCHANNEL and TEST SUBCHANNEL). We use this as the ID
-of the device we wish to talk to. The most important of these instructions are
-START SUBCHANNEL (to start IO), TEST SUBCHANNEL (to check whether the IO
-completed successfully) and HALT SUBCHANNEL (to kill IO). A subchannel can have
-up to 8 channel paths to a device, this offers redundancy if one is not
-available.
-
-Device Number:
-This number remains static and is closely tied to the hardware. There are 65536
-of these, made up of a CHPID (Channel Path ID, the most significant 8 bits) and
-another lsb 8 bits. These remain static even if more devices are inserted or
-removed from the hardware. There is a 1 to 1 mapping between subchannels and
-device numbers, provided devices aren't inserted or removed.
-
-Channel Control Words:
-CCWs are linked lists of instructions initially pointed to by an operation
-request block (ORB), which is initially given to Start Subchannel (SSCH)
-command along with the subchannel number for the IO subsystem to process
-while the CPU continues executing normal code.
-CCWs come in two flavours, Format 0 (24 bit for backward compatibility) and
-Format 1 (31 bit). These are typically used to issue read and write (and many
-other) instructions. They consist of a length field and an absolute address
-field.
-Each IO typically gets 1 or 2 interrupts, one for channel end (primary status)
-when the channel is idle, and the second for device end (secondary status).
-Sometimes you get both concurrently. You check how the IO went on by issuing a
-TEST SUBCHANNEL at each interrupt, from which you receive an Interruption
-response block (IRB). If you get channel and device end status in the IRB
-without channel checks etc. your IO probably went okay. If you didn't you
-probably need to examine the IRB, extended status word etc.
-If an error occurs, more sophisticated control units have a facility known as
-concurrent sense. This means that if an error occurs Extended sense information
-will be presented in the Extended status word in the IRB. If not you have to
-issue a subsequent SENSE CCW command after the test subchannel.
-
-
-TPI (Test pending interrupt) can also be used for polled IO, but in
-multitasking multiprocessor systems it isn't recommended except for
-checking special cases (i.e. non looping checks for pending IO etc.).
-
-Store Subchannel and Modify Subchannel can be used to examine and modify
-operating characteristics of a subchannel (e.g. channel paths).
-
-Other IO related Terms:
-Sysplex: S390's Clustering Technology
-QDIO: S390's new high speed IO architecture to support devices such as gigabit
-ethernet, this architecture is also designed to be forward compatible with
-upcoming 64 bit machines.
-
-
-General Concepts 
-
-Input Output Processors (IOP's) are responsible for communicating between
-the mainframe CPU's & the channel & relieve the mainframe CPU's from the
-burden of communicating with IO devices directly, this allows the CPU's to 
-concentrate on data processing. 
-
-IOP's can use one or more links ( known as channel paths ) to talk to each 
-IO device. It first checks for path availability & chooses an available one,
-then starts ( & sometimes terminates IO ).
-There are two types of channel path: ESCON & the Parallel IO interface.
-
-IO devices are attached to control units, control units provide the
-logic to interface the channel paths & channel path IO protocols to 
-the IO devices, they can be integrated with the devices or housed separately
-& often talk to several similar devices ( typical examples would be raid 
-controllers or a control unit which connects to 1000 3270 terminals ).
-
-
-    +---------------------------------------------------------------+
-    | +-----+ +-----+ +-----+ +-----+  +----------+  +----------+   |
-    | | CPU | | CPU | | CPU | | CPU |  |  Main    |  | Expanded |   |
-    | |     | |     | |     | |     |  |  Memory  |  |  Storage |   |
-    | +-----+ +-----+ +-----+ +-----+  +----------+  +----------+   | 
-    |---------------------------------------------------------------+
-    |   IOP        |      IOP      |       IOP                      |
-    |---------------------------------------------------------------
-    | C | C | C | C | C | C | C | C | C | C | C | C | C | C | C | C | 
-    ----------------------------------------------------------------
-         ||                                              ||
-         ||  Bus & Tag Channel Path                      || ESCON
-         ||  ======================                      || Channel
-         ||  ||                  ||                      || Path
-    +----------+               +----------+         +----------+
-    |          |               |          |         |          |
-    |    CU    |               |    CU    |         |    CU    |
-    |          |               |          |         |          |
-    +----------+               +----------+         +----------+
-       |      |                     |                |       |
-+----------+ +----------+      +----------+   +----------+ +----------+
-|I/O Device| |I/O Device|      |I/O Device|   |I/O Device| |I/O Device|
-+----------+ +----------+      +----------+   +----------+ +----------+
-  CPU = Central Processing Unit    
-  C = Channel                      
-  IOP = IP Processor               
-  CU = Control Unit
-
-The 390 IO systems come in 2 flavours the current 390 machines support both
-
-The Older 360 & 370 Interface,sometimes called the Parallel I/O interface,
-sometimes called Bus-and Tag & sometimes Original Equipment Manufacturers
-Interface (OEMI).
-
-This byte wide Parallel channel path/bus has parity & data on the "Bus" cable 
-and control lines on the "Tag" cable. These can operate in byte multiplex mode
-for sharing between several slow devices or burst mode and monopolize the
-channel for the whole burst. Up to 256 devices can be addressed on one of these
-cables. These cables are about one inch in diameter. The maximum unextended
-length supported by these cables is 125 Meters but this can be extended up to
-2km with a fibre optic channel extended such as a 3044. The maximum burst speed
-supported is 4.5 megabytes per second. However, some really old processors
-support only transfer rates of 3.0, 2.0 & 1.0 MB/sec.
-One of these paths can be daisy chained to up to 8 control units.
-
-
-ESCON if fibre optic it is also called FICON 
-Was introduced by IBM in 1990. Has 2 fibre optic cables and uses either leds or
-lasers for communication at a signaling rate of up to 200 megabits/sec. As
-10bits are transferred for every 8 bits info this drops to 160 megabits/sec
-and to 18.6 Megabytes/sec once control info and CRC are added. ESCON only
-operates in burst mode.
- 
-ESCONs typical max cable length is 3km for the led version and 20km for the
-laser version known as XDF (extended distance facility). This can be further
-extended by using an ESCON director which triples the above mentioned ranges.
-Unlike Bus & Tag as ESCON is serial it uses a packet switching architecture,
-the standard Bus & Tag control protocol is however present within the packets.
-Up to 256 devices can be attached to each control unit that uses one of these
-interfaces.
-
-Common 390 Devices include:
-Network adapters typically OSA2,3172's,2116's & OSA-E gigabit ethernet adapters,
-Consoles 3270 & 3215 (a teletype emulated under linux for a line mode console).
-DASD's direct access storage devices ( otherwise known as hard disks ).
-Tape Drives.
-CTC ( Channel to Channel Adapters ),
-ESCON or Parallel Cables used as a very high speed serial link
-between 2 machines.
-
-
-Debugging IO on s/390 & z/Architecture under VM
-===============================================
-
-Now we are ready to go on with IO tracing commands under VM
-
-A few self explanatory queries:
-Q OSA
-Q CTC
-Q DISK ( This command is CMS specific )
-Q DASD
-
-
-
-
-
-
-Q OSA on my machine returns
-OSA  7C08 ON OSA   7C08 SUBCHANNEL = 0000
-OSA  7C09 ON OSA   7C09 SUBCHANNEL = 0001
-OSA  7C14 ON OSA   7C14 SUBCHANNEL = 0002
-OSA  7C15 ON OSA   7C15 SUBCHANNEL = 0003
-
-If you have a guest with certain privileges you may be able to see devices
-which don't belong to you. To avoid this, add the option V.
-e.g.
-Q V OSA
-
-Now using the device numbers returned by this command we will
-Trace the io starting up on the first device 7c08 & 7c09
-In our simplest case we can trace the 
-start subchannels
-like TR SSCH 7C08-7C09
-or the halt subchannels
-or TR HSCH 7C08-7C09
-MSCH's ,STSCH's I think you can guess the rest
-
-A good trick is tracing all the IO's and CCWS and spooling them into the reader
-of another VM guest so he can ftp the logfile back to his own machine. I'll do
-a small bit of this and give you a look at the output.
-
-1) Spool stdout to VM reader
-SP PRT TO (another vm guest ) or * for the local vm guest
-2) Fill the reader with the trace
-TR IO 7c08-7c09 INST INT CCW PRT RUN
-3) Start up linux 
-i 00c  
-4) Finish the trace
-TR END
-5) close the reader
-C PRT
-6) list reader contents
-RDRLIST
-7) copy it to linux4's minidisk 
-RECEIVE / LOG TXT A1 ( replace
-8)
-filel & press F11 to look at it
-You should see something like:
-
-00020942' SSCH  B2334000    0048813C    CC 0    SCH 0000    DEV 7C08
-          CPA 000FFDF0   PARM 00E2C9C4    KEY 0  FPI C0  LPM 80
-          CCW    000FFDF0  E4200100 00487FE8   0000  E4240100 ........
-          IDAL                                      43D8AFE8
-          IDAL                                      0FB76000
-00020B0A'   I/O DEV 7C08 -> 000197BC'   SCH 0000   PARM 00E2C9C4
-00021628' TSCH  B2354000 >> 00488164    CC 0    SCH 0000    DEV 7C08
-          CCWA 000FFDF8   DEV STS 0C  SCH STS 00  CNT 00EC
-           KEY 0   FPI C0  CC 0   CTLS 4007
-00022238' STSCH B2344000 >> 00488108    CC 0    SCH 0000    DEV 7C08
-
-If you don't like messing up your readed ( because you possibly booted from it )
-you can alternatively spool it to another readers guest.
-
-
-Other common VM device related commands
----------------------------------------------
-These commands are listed only because they have
-been of use to me in the past & may be of use to
-you too. For more complete info on each of the commands
-use type HELP <command> from CMS.
-detaching devices
-DET <devno range>
-ATT <devno range> <guest> 
-attach a device to guest * for your own guest
-READY <devno> cause VM to issue a fake interrupt.
-
-The VARY command is normally only available to VM administrators.
-VARY ON PATH <path> TO <devno range>
-VARY OFF PATH <PATH> FROM <devno range>
-This is used to switch on or off channel paths to devices.
-
-Q CHPID <channel path ID>
-This displays state of devices using this channel path
-D SCHIB <subchannel>
-This displays the subchannel information SCHIB block for the device.
-this I believe is also only available to administrators.
-DEFINE CTC <devno>
-defines a virtual CTC channel to channel connection
-2 need to be defined on each guest for the CTC driver to use.
-COUPLE  devno userid remote devno
-Joins a local virtual device to a remote virtual device
-( commonly used for the CTC driver ).
-
-Building a VM ramdisk under CMS which linux can use
-def vfb-<blocksize> <subchannel> <number blocks>
-blocksize is commonly 4096 for linux.
-Formatting it
-format <subchannel> <driver letter e.g. x> (blksize <blocksize>
-
-Sharing a disk between multiple guests
-LINK userid devno1 devno2 mode password
-
-
-
-GDB on S390
-===========
-N.B. if compiling for debugging gdb works better without optimisation 
-( see Compiling programs for debugging )
-
-invocation
-----------
-gdb <victim program> <optional corefile>
-
-Online help
------------
-help: gives help on commands
-e.g.
-help
-help display
-Note gdb's online help is very good use it.
-
-
-Assembly
---------
-info registers: displays registers other than floating point.
-info all-registers: displays floating points as well.
-disassemble: disassembles
-e.g.
-disassemble without parameters will disassemble the current function
-disassemble $pc $pc+10 
-
-Viewing & modifying variables
------------------------------
-print or p: displays variable or register
-e.g. p/x $sp will display the stack pointer
-
-display: prints variable or register each time program stops
-e.g.
-display/x $pc will display the program counter
-display argc
-
-undisplay : undo's display's
-
-info breakpoints: shows all current breakpoints
-
-info stack: shows stack back trace (if this doesn't work too well, I'll show
-you the stacktrace by hand below).
-
-info locals: displays local variables.
-
-info args: display current procedure arguments.
-
-set args: will set argc & argv each time the victim program is invoked.
-
-set <variable>=value
-set argc=100
-set $pc=0
-
-
-
-Modifying execution
--------------------
-step: steps n lines of sourcecode
-step steps 1 line.
-step 100 steps 100 lines of code.
-
-next: like step except this will not step into subroutines
-
-stepi: steps a single machine code instruction.
-e.g. stepi 100
-
-nexti: steps a single machine code instruction but will not step into
-subroutines.
-
-finish: will run until exit of the current routine
-
-run: (re)starts a program
-
-cont: continues a program
-
-quit: exits gdb.
-
-
-breakpoints
-------------
-
-break
-sets a breakpoint
-e.g.
-
-break main
-
-break *$pc
-
-break *0x400618
-
-Here's a really useful one for large programs
-rbr
-Set a breakpoint for all functions matching REGEXP
-e.g.
-rbr 390
-will set a breakpoint with all functions with 390 in their name.
-
-info breakpoints
-lists all breakpoints
-
-delete: delete breakpoint by number or delete them all
-e.g.
-delete 1 will delete the first breakpoint
-delete will delete them all
-
-watch: This will set a watchpoint ( usually hardware assisted ),
-This will watch a variable till it changes
-e.g.
-watch cnt, will watch the variable cnt till it changes.
-As an aside unfortunately gdb's, architecture independent watchpoint code
-is inconsistent & not very good, watchpoints usually work but not always.
-
-info watchpoints: Display currently active watchpoints
-
-condition: ( another useful one )
-Specify breakpoint number N to break only if COND is true.
-Usage is `condition N COND', where N is an integer and COND is an
-expression to be evaluated whenever breakpoint N is reached.
-
-
-
-User defined functions/macros
------------------------------
-define: ( Note this is very very useful,simple & powerful )
-usage define <name> <list of commands> end
-
-examples which you should consider putting into .gdbinit in your home directory
-define d
-stepi
-disassemble $pc $pc+10
-end
-
-define e
-nexti
-disassemble $pc $pc+10
-end
-
-
-Other hard to classify stuff
-----------------------------
-signal n:
-sends the victim program a signal.
-e.g. signal 3 will send a SIGQUIT.
-
-info signals:
-what gdb does when the victim receives certain signals.
-
-list:
-e.g.
-list lists current function source
-list 1,10 list first 10 lines of current file.
-list test.c:1,10
-
-
-directory:
-Adds directories to be searched for source if gdb cannot find the source.
-(note it is a bit sensitive about slashes)
-e.g. To add the root of the filesystem to the searchpath do
-directory //
-
-
-call <function>
-This calls a function in the victim program, this is pretty powerful
-e.g.
-(gdb) call printf("hello world")
-outputs:
-$1 = 11 
-
-You might now be thinking that the line above didn't work, something extra had
-to be done.
-(gdb) call fflush(stdout)
-hello world$2 = 0
-As an aside the debugger also calls malloc & free under the hood 
-to make space for the "hello world" string.
-
-
-
-hints
------
-1) command completion works just like bash 
-( if you are a bad typist like me this really helps )
-e.g. hit br <TAB> & cursor up & down :-).
-
-2) if you have a debugging problem that takes a few steps to recreate
-put the steps into a file called .gdbinit in your current working directory
-if you have defined a few extra useful user defined commands put these in 
-your home directory & they will be read each time gdb is launched.
-
-A typical .gdbinit file might be.
-break main
-run
-break runtime_exception
-cont 
-
-
-stack chaining in gdb by hand
------------------------------
-This is done using a the same trick described for VM 
-p/x (*($sp+56))&0x7fffffff get the first backchain.
-
-For z/Architecture
-Replace 56 with 112 & ignore the &0x7fffffff
-in the macros below & do nasty casts to longs like the following
-as gdb unfortunately deals with printed arguments as ints which
-messes up everything.
-i.e. here is a 3rd backchain dereference
-p/x *(long *)(***(long ***)$sp+112)
-
-
-this outputs 
-$5 = 0x528f18 
-on my machine.
-Now you can use 
-info symbol (*($sp+56))&0x7fffffff 
-you might see something like.
-rl_getc + 36 in section .text  telling you what is located at address 0x528f18
-Now do.
-p/x (*(*$sp+56))&0x7fffffff 
-This outputs
-$6 = 0x528ed0
-Now do.
-info symbol (*(*$sp+56))&0x7fffffff
-rl_read_key + 180 in section .text
-now do
-p/x (*(**$sp+56))&0x7fffffff
-& so on.
-
-Disassembling instructions without debug info
----------------------------------------------
-gdb typically complains if there is a lack of debugging
-symbols in the disassemble command with 
-"No function contains specified address." To get around
-this do 
-x/<number lines to disassemble>xi <address>
-e.g.
-x/20xi 0x400730
-
-
-
-Note: Remember gdb has history just like bash you don't need to retype the
-whole line just use the up & down arrows.
-
-
-
-For more info
--------------
-From your linuxbox do 
-man gdb or info gdb.
-
-core dumps
-----------
-What a core dump ?,
-A core dump is a file generated by the kernel (if allowed) which contains the
-registers and all active pages of the program which has crashed.
-From this file gdb will allow you to look at the registers, stack trace and
-memory of the program as if it just crashed on your system. It is usually
-called core and created in the current working directory.
-This is very useful in that a customer can mail a core dump to a technical
-support department and the technical support department can reconstruct what
-happened. Provided they have an identical copy of this program with debugging
-symbols compiled in and the source base of this build is available.
-In short it is far more useful than something like a crash log could ever hope
-to be.
-
-Why have I never seen one ?.
-Probably because you haven't used the command 
-ulimit -c unlimited in bash
-to allow core dumps, now do 
-ulimit -a 
-to verify that the limit was accepted.
-
-A sample core dump
-To create this I'm going to do
-ulimit -c unlimited
-gdb 
-to launch gdb (my victim app. ) now be bad & do the following from another 
-telnet/xterm session to the same machine
-ps -aux | grep gdb
-kill -SIGSEGV <gdb's pid>
-or alternatively use killall -SIGSEGV gdb if you have the killall command.
-Now look at the core dump.
-./gdb core
-Displays the following
-GNU gdb 4.18
-Copyright 1998 Free Software Foundation, Inc.
-GDB is free software, covered by the GNU General Public License, and you are
-welcome to change it and/or distribute copies of it under certain conditions.
-Type "show copying" to see the conditions.
-There is absolutely no warranty for GDB.  Type "show warranty" for details.
-This GDB was configured as "s390-ibm-linux"...
-Core was generated by `./gdb'.
-Program terminated with signal 11, Segmentation fault.
-Reading symbols from /usr/lib/libncurses.so.4...done.
-Reading symbols from /lib/libm.so.6...done.
-Reading symbols from /lib/libc.so.6...done.
-Reading symbols from /lib/ld-linux.so.2...done.
-#0  0x40126d1a in read () from /lib/libc.so.6
-Setting up the environment for debugging gdb.
-Breakpoint 1 at 0x4dc6f8: file utils.c, line 471.
-Breakpoint 2 at 0x4d87a4: file top.c, line 2609.
-(top-gdb) info stack
-#0  0x40126d1a in read () from /lib/libc.so.6
-#1  0x528f26 in rl_getc (stream=0x7ffffde8) at input.c:402
-#2  0x528ed0 in rl_read_key () at input.c:381
-#3  0x5167e6 in readline_internal_char () at readline.c:454
-#4  0x5168ee in readline_internal_charloop () at readline.c:507
-#5  0x51692c in readline_internal () at readline.c:521
-#6  0x5164fe in readline (prompt=0x7ffff810)
-    at readline.c:349
-#7  0x4d7a8a in command_line_input (prompt=0x564420 "(gdb) ", repeat=1,
-    annotation_suffix=0x4d6b44 "prompt") at top.c:2091
-#8  0x4d6cf0 in command_loop () at top.c:1345
-#9  0x4e25bc in main (argc=1, argv=0x7ffffdf4) at main.c:635
-
-
-LDD
-===
-This is a program which lists the shared libraries which a library needs,
-Note you also get the relocations of the shared library text segments which
-help when using objdump --source.
-e.g.
- ldd ./gdb
-outputs
-libncurses.so.4 => /usr/lib/libncurses.so.4 (0x40018000)
-libm.so.6 => /lib/libm.so.6 (0x4005e000)
-libc.so.6 => /lib/libc.so.6 (0x40084000)
-/lib/ld-linux.so.2 => /lib/ld-linux.so.2 (0x40000000)
-
-
-Debugging shared libraries
-==========================
-Most programs use shared libraries, however it can be very painful
-when you single step instruction into a function like printf for the 
-first time & you end up in functions like _dl_runtime_resolve this is
-the ld.so doing lazy binding, lazy binding is a concept in ELF where 
-shared library functions are not loaded into memory unless they are 
-actually used, great for saving memory but a pain to debug.
-To get around this either relink the program -static or exit gdb type 
-export LD_BIND_NOW=true this will stop lazy binding & restart the gdb'ing 
-the program in question.
- 
-
-
-Debugging modules
-=================
-As modules are dynamically loaded into the kernel their address can be
-anywhere to get around this use the -m option with insmod to emit a load
-map which can be piped into a file if required.
-
-The proc file system
-====================
-What is it ?.
-It is a filesystem created by the kernel with files which are created on demand
-by the kernel if read, or can be used to modify kernel parameters,
-it is a powerful concept.
-
-e.g.
-
-cat /proc/sys/net/ipv4/ip_forward 
-On my machine outputs 
-0 
-telling me ip_forwarding is not on to switch it on I can do
-echo 1 >  /proc/sys/net/ipv4/ip_forward
-cat it again
-cat /proc/sys/net/ipv4/ip_forward 
-On my machine now outputs
-1
-IP forwarding is on.
-There is a lot of useful info in here best found by going in and having a look
-around, so I'll take you through some entries I consider important.
-
-All the processes running on the machine have their own entry defined by
-/proc/<pid>
-So lets have a look at the init process
-cd /proc/1
-
-cat cmdline
-emits
-init [2]
-
-cd /proc/1/fd
-This contains numerical entries of all the open files,
-some of these you can cat e.g. stdout (2)
-
-cat /proc/29/maps
-on my machine emits
-
-00400000-00478000 r-xp 00000000 5f:00 4103       /bin/bash
-00478000-0047e000 rw-p 00077000 5f:00 4103       /bin/bash
-0047e000-00492000 rwxp 00000000 00:00 0
-40000000-40015000 r-xp 00000000 5f:00 14382      /lib/ld-2.1.2.so
-40015000-40016000 rw-p 00014000 5f:00 14382      /lib/ld-2.1.2.so
-40016000-40017000 rwxp 00000000 00:00 0
-40017000-40018000 rw-p 00000000 00:00 0
-40018000-4001b000 r-xp 00000000 5f:00 14435      /lib/libtermcap.so.2.0.8
-4001b000-4001c000 rw-p 00002000 5f:00 14435      /lib/libtermcap.so.2.0.8
-4001c000-4010d000 r-xp 00000000 5f:00 14387      /lib/libc-2.1.2.so
-4010d000-40111000 rw-p 000f0000 5f:00 14387      /lib/libc-2.1.2.so
-40111000-40114000 rw-p 00000000 00:00 0
-40114000-4011e000 r-xp 00000000 5f:00 14408      /lib/libnss_files-2.1.2.so
-4011e000-4011f000 rw-p 00009000 5f:00 14408      /lib/libnss_files-2.1.2.so
-7fffd000-80000000 rwxp ffffe000 00:00 0
-
-
-Showing us the shared libraries init uses where they are in memory
-& memory access permissions for each virtual memory area.
-
-/proc/1/cwd is a softlink to the current working directory.
-/proc/1/root is the root of the filesystem for this process. 
-
-/proc/1/mem is the current running processes memory which you
-can read & write to like a file.
-strace uses this sometimes as it is a bit faster than the
-rather inefficient ptrace interface for peeking at DATA.
-
-
-cat status 
-
-Name:   init
-State:  S (sleeping)
-Pid:    1
-PPid:   0
-Uid:    0       0       0       0
-Gid:    0       0       0       0
-Groups:
-VmSize:      408 kB
-VmLck:         0 kB
-VmRSS:       208 kB
-VmData:       24 kB
-VmStk:         8 kB
-VmExe:       368 kB
-VmLib:         0 kB
-SigPnd: 0000000000000000
-SigBlk: 0000000000000000
-SigIgn: 7fffffffd7f0d8fc
-SigCgt: 00000000280b2603
-CapInh: 00000000fffffeff
-CapPrm: 00000000ffffffff
-CapEff: 00000000fffffeff
-
-User PSW:    070de000 80414146
-task: 004b6000 tss: 004b62d8 ksp: 004b7ca8 pt_regs: 004b7f68
-User GPRS:
-00000400  00000000  0000000b  7ffffa90
-00000000  00000000  00000000  0045d9f4
-0045cafc  7ffffa90  7fffff18  0045cb08
-00010400  804039e8  80403af8  7ffff8b0
-User ACRS:
-00000000  00000000  00000000  00000000
-00000001  00000000  00000000  00000000
-00000000  00000000  00000000  00000000
-00000000  00000000  00000000  00000000
-Kernel BackChain  CallChain    BackChain  CallChain
-       004b7ca8   8002bd0c     004b7d18   8002b92c
-       004b7db8   8005cd50     004b7e38   8005d12a
-       004b7f08   80019114                     
-Showing among other things memory usage & status of some signals &
-the processes'es registers from the kernel task_structure
-as well as a backchain which may be useful if a process crashes
-in the kernel for some unknown reason.
-
-Some driver debugging techniques
-================================
-debug feature
--------------
-Some of our drivers now support a "debug feature" in
-/proc/s390dbf see s390dbf.txt in the linux/Documentation directory
-for more info.
-e.g. 
-to switch on the lcs "debug feature"
-echo 5 > /proc/s390dbf/lcs/level
-& then after the error occurred.
-cat /proc/s390dbf/lcs/sprintf >/logfile
-the logfile now contains some information which may help
-tech support resolve a problem in the field.
-
-
-
-high level debugging network drivers
-------------------------------------
-ifconfig is a quite useful command
-it gives the current state of network drivers.
-
-If you suspect your network device driver is dead
-one way to check is type 
-ifconfig <network device> 
-e.g. tr0
-You should see something like
-tr0       Link encap:16/4 Mbps Token Ring (New)  HWaddr 00:04:AC:20:8E:48
-          inet addr:9.164.185.132  Bcast:9.164.191.255  Mask:255.255.224.0
-          UP BROADCAST RUNNING MULTICAST  MTU:2000  Metric:1
-          RX packets:246134 errors:0 dropped:0 overruns:0 frame:0
-          TX packets:5 errors:0 dropped:0 overruns:0 carrier:0
-          collisions:0 txqueuelen:100
-
-if the device doesn't say up
-try
-/etc/rc.d/init.d/network start 
-( this starts the network stack & hopefully calls ifconfig tr0 up ).
-ifconfig looks at the output of /proc/net/dev and presents it in a more
-presentable form.
-Now ping the device from a machine in the same subnet.
-if the RX packets count & TX packets counts don't increment you probably
-have problems.
-next 
-cat /proc/net/arp
-Do you see any hardware addresses in the cache if not you may have problems.
-Next try
-ping -c 5 <broadcast_addr> i.e. the Bcast field above in the output of
-ifconfig. Do you see any replies from machines other than the local machine
-if not you may have problems. also if the TX packets count in ifconfig
-hasn't incremented either you have serious problems in your driver 
-(e.g. the txbusy field of the network device being stuck on ) 
-or you may have multiple network devices connected.
-
-
-chandev
--------
-There is a new device layer for channel devices, some
-drivers e.g. lcs are registered with this layer.
-If the device uses the channel device layer you'll be
-able to find what interrupts it uses & the current state 
-of the device.
-See the manpage chandev.8 &type cat /proc/chandev for more info.
-
-
-SysRq
-=====
-This is now supported by linux for s/390 & z/Architecture.
-To enable it do compile the kernel with 
-Kernel Hacking -> Magic SysRq Key Enabled
-echo "1" > /proc/sys/kernel/sysrq
-also type
-echo "8" >/proc/sys/kernel/printk
-To make printk output go to console.
-On 390 all commands are prefixed with
-^-
-e.g.
-^-t will show tasks.
-^-? or some unknown command will display help.
-The sysrq key reading is very picky ( I have to type the keys in an
- xterm session & paste them  into the x3270 console )
-& it may be wise to predefine the keys as described in the VM hints above
-
-This is particularly useful for syncing disks unmounting & rebooting
-if the machine gets partially hung.
-
-Read Documentation/admin-guide/sysrq.rst for more info
-
-References:
-===========
-Enterprise Systems Architecture Reference Summary
-Enterprise Systems Architecture Principles of Operation
-Hartmut Penners s390 stack frame sheet.
-IBM Mainframe Channel Attachment a technology brief from a CISCO webpage
-Various bits of man & info pages of Linux.
-Linux & GDB source.
-Various info & man pages.
-CMS Help on tracing commands.
-Linux for s/390 Elf Application Binary Interface
-Linux for z/Series Elf Application Binary Interface ( Both Highly Recommended )
-z/Architecture Principles of Operation SA22-7832-00
-Enterprise Systems Architecture/390 Reference Summary SA22-7209-01 & the
-Enterprise Systems Architecture/390 Principles of Operation SA22-7201-05
-
-Special Thanks
-==============
-Special thanks to Neale Ferguson who maintains a much
-prettier HTML version of this page at
-http://linuxvm.org/penguinvm/
-Bob Grainger Stefan Bader & others for reporting bugs
diff --git a/Documentation/s390/cds.txt b/Documentation/s390/cds.rst
index 480a78ef5a1e..7006d8209d2e 100644
--- a/Documentation/s390/cds.txt
+++ b/Documentation/s390/cds.rst
@@ -1,14 +1,18 @@
+===========================
 Linux for S/390 and zSeries
+===========================
 
 Common Device Support (CDS)
 Device Driver I/O Support Routines
 
-Authors : Ingo Adlung
-          Cornelia Huck
+Authors:
+        - Ingo Adlung
+        - Cornelia Huck
 
 Copyright, IBM Corp. 1999-2002
 
 Introduction
+============
 
 This document describes the common device support routines for Linux/390.
 Different than other hardware architectures, ESA/390 has defined a unified
@@ -27,18 +31,20 @@ Operation manual (IBM Form. No. SA22-7201).
 
 In order to build common device support for ESA/390 I/O interfaces, a
 functional layer was introduced that provides generic I/O access methods to
-the hardware. 
+the hardware.
 
-The common device support layer comprises the I/O support routines defined 
-below. Some of them implement common Linux device driver interfaces, while 
+The common device support layer comprises the I/O support routines defined
+below. Some of them implement common Linux device driver interfaces, while
 some of them are ESA/390 platform specific.
 
 Note:
-In order to write a driver for S/390, you also need to look into the interface
-described in Documentation/s390/driver-model.txt.
+  In order to write a driver for S/390, you also need to look into the interface
+  described in Documentation/s390/driver-model.rst.
 
 Note for porting drivers from 2.4:
+
 The major changes are:
+
 * The functions use a ccw_device instead of an irq (subchannel).
 * All drivers must define a ccw_driver (see driver-model.txt) and the associated
   functions.
@@ -57,19 +63,16 @@ The major changes are:
 ccw_device_get_ciw()
    get commands from extended sense data.
 
-ccw_device_start()      
-ccw_device_start_timeout()
-ccw_device_start_key()
-ccw_device_start_key_timeout()
+ccw_device_start(), ccw_device_start_timeout(), ccw_device_start_key(), ccw_device_start_key_timeout()
    initiate an I/O request.
 
 ccw_device_resume()
    resume channel program execution.
 
-ccw_device_halt()       
+ccw_device_halt()
    terminate the current I/O request processed on the device.
 
-do_IRQ()        
+do_IRQ()
    generic interrupt routine. This function is called by the interrupt entry
    routine whenever an I/O interrupt is presented to the system. The do_IRQ()
    routine determines the interrupt status and calls the device specific
@@ -82,12 +85,15 @@ first level interrupt handler only and does not comprise a device driver
 callable interface. Instead, the functional description of do_IO() also
 describes the input to the device specific interrupt handler.
 
-Note: All explanations apply also to the 64 bit architecture s390x.
+Note:
+        All explanations apply also to the 64 bit architecture s390x.
 
 
 Common Device Support (CDS) for Linux/390 Device Drivers
+========================================================
 
 General Information
+-------------------
 
 The following chapters describe the I/O related interface routines the
 Linux/390 common device support (CDS) provides to allow for device specific
@@ -101,6 +107,7 @@ can be found in the architecture specific C header file
 linux/arch/s390/include/asm/irq.h.
 
 Overview of CDS interface concepts
+----------------------------------
 
 Different to other hardware platforms, the ESA/390 architecture doesn't define
 interrupt lines managed by a specific interrupt controller and bus systems
@@ -126,7 +133,7 @@ has to call every single device driver registered on this IRQ in order to
 determine the device driver owning the device that raised the interrupt.
 
 Up to kernel 2.4, Linux/390 used to provide interfaces via the IRQ (subchannel).
-For internal use of the common I/O layer, these are still there. However, 
+For internal use of the common I/O layer, these are still there. However,
 device drivers should use the new calling interface via the ccw_device only.
 
 During its startup the Linux/390 system checks for peripheral devices. Each
@@ -134,7 +141,7 @@ of those devices is uniquely defined by a so called subchannel by the ESA/390
 channel subsystem. While the subchannel numbers are system generated, each
 subchannel also takes a user defined attribute, the so called device number.
 Both subchannel number and device number cannot exceed 65535. During sysfs
-initialisation, the information about control unit type and device types that 
+initialisation, the information about control unit type and device types that
 imply specific I/O commands (channel command words - CCWs) in order to operate
 the device are gathered. Device drivers can retrieve this set of hardware
 information during their initialization step to recognize the devices they
@@ -164,18 +171,26 @@ get_ciw() - get command information word
 This call enables a device driver to get information about supported commands
 from the extended SenseID data.
 
-struct ciw *
-ccw_device_get_ciw(struct ccw_device *cdev, __u32 cmd);
+::
 
-cdev - The ccw_device for which the command is to be retrieved.
-cmd  - The command type to be retrieved.
+  struct ciw *
+  ccw_device_get_ciw(struct ccw_device *cdev, __u32 cmd);
+
+====  ========================================================
+cdev  The ccw_device for which the command is to be retrieved.
+cmd   The command type to be retrieved.
+====  ========================================================
 
 ccw_device_get_ciw() returns:
-NULL    - No extended data available, invalid device or command not found.
-!NULL   - The command requested.
 
+=====  ================================================================
+ NULL  No extended data available, invalid device or command not found.
+!NULL  The command requested.
+=====  ================================================================
+
+::
 
-ccw_device_start() - Initiate I/O Request
+  ccw_device_start() - Initiate I/O Request
 
 The ccw_device_start() routines is the I/O request front-end processor. All
 device driver I/O requests must be issued using this routine. A device driver
@@ -186,93 +201,105 @@ This description also covers the status information passed to the device
 driver's interrupt handler as this is related to the rules (flags) defined
 with the associated I/O request when calling ccw_device_start().
 
-int ccw_device_start(struct ccw_device *cdev,
-                     struct ccw1 *cpa,
-                     unsigned long intparm,
-                     __u8 lpm,
-                     unsigned long flags);
-int ccw_device_start_timeout(struct ccw_device *cdev,
-                             struct ccw1 *cpa,
-                             unsigned long intparm,
-                             __u8 lpm,
-                             unsigned long flags,
-                             int expires);
-int ccw_device_start_key(struct ccw_device *cdev,
-                         struct ccw1 *cpa,
-                         unsigned long intparm,
-                         __u8 lpm,
-                         __u8 key,
-                         unsigned long flags);
-int ccw_device_start_key_timeout(struct ccw_device *cdev,
-                                 struct ccw1 *cpa,
-                                 unsigned long intparm,
-                                 __u8 lpm,
-                                 __u8 key,
-                                 unsigned long flags,
-                                 int expires);
-
-cdev         : ccw_device the I/O is destined for
-cpa          : logical start address of channel program
-user_intparm : user specific interrupt information; will be presented
-               back to the device driver's interrupt handler. Allows a
-               device driver to associate the interrupt with a
-               particular I/O request.
-lpm          : defines the channel path to be used for a specific I/O
-               request. A value of 0 will make cio use the opm.
-key          : the storage key to use for the I/O (useful for operating on a
-               storage with a storage key != default key)
-flag         : defines the action to be performed for I/O processing
-expires      : timeout value in jiffies. The common I/O layer will terminate
-               the running program after this and call the interrupt handler
-               with ERR_PTR(-ETIMEDOUT) as irb.
-
-Possible flag values are :
-
-DOIO_ALLOW_SUSPEND       - channel program may become suspended
-DOIO_DENY_PREFETCH       - don't allow for CCW prefetch; usually
-                           this implies the channel program might
-                           become modified
-DOIO_SUPPRESS_INTER     - don't call the handler on intermediate status
-
-The cpa parameter points to the first format 1 CCW of a channel program :
-
-struct ccw1 {
-      __u8  cmd_code;/* command code */
-      __u8  flags;   /* flags, like IDA addressing, etc. */
-      __u16 count;   /* byte count */
-      __u32 cda;     /* data address */
-} __attribute__ ((packed,aligned(8)));
-
-with the following CCW flags values defined :
-
-CCW_FLAG_DC        - data chaining
-CCW_FLAG_CC        - command chaining
-CCW_FLAG_SLI       - suppress incorrect length
-CCW_FLAG_SKIP      - skip
-CCW_FLAG_PCI       - PCI
-CCW_FLAG_IDA       - indirect addressing
-CCW_FLAG_SUSPEND   - suspend
+::
+
+  int ccw_device_start(struct ccw_device *cdev,
+                       struct ccw1 *cpa,
+                       unsigned long intparm,
+                       __u8 lpm,
+                       unsigned long flags);
+  int ccw_device_start_timeout(struct ccw_device *cdev,
+                               struct ccw1 *cpa,
+                               unsigned long intparm,
+                               __u8 lpm,
+                               unsigned long flags,
+                               int expires);
+  int ccw_device_start_key(struct ccw_device *cdev,
+                           struct ccw1 *cpa,
+                           unsigned long intparm,
+                           __u8 lpm,
+                           __u8 key,
+                           unsigned long flags);
+  int ccw_device_start_key_timeout(struct ccw_device *cdev,
+                                   struct ccw1 *cpa,
+                                   unsigned long intparm,
+                                   __u8 lpm,
+                                   __u8 key,
+                                   unsigned long flags,
+                                   int expires);
+
+============= =============================================================
+cdev          ccw_device the I/O is destined for
+cpa           logical start address of channel program
+user_intparm  user specific interrupt information; will be presented
+              back to the device driver's interrupt handler. Allows a
+              device driver to associate the interrupt with a
+              particular I/O request.
+lpm           defines the channel path to be used for a specific I/O
+              request. A value of 0 will make cio use the opm.
+key           the storage key to use for the I/O (useful for operating on a
+              storage with a storage key != default key)
+flag          defines the action to be performed for I/O processing
+expires       timeout value in jiffies. The common I/O layer will terminate
+              the running program after this and call the interrupt handler
+              with ERR_PTR(-ETIMEDOUT) as irb.
+============= =============================================================
+
+Possible flag values are:
+
+========================= =============================================
+DOIO_ALLOW_SUSPEND        channel program may become suspended
+DOIO_DENY_PREFETCH        don't allow for CCW prefetch; usually
+                          this implies the channel program might
+                          become modified
+DOIO_SUPPRESS_INTER       don't call the handler on intermediate status
+========================= =============================================
+
+The cpa parameter points to the first format 1 CCW of a channel program::
+
+  struct ccw1 {
+        __u8  cmd_code;/* command code */
+        __u8  flags;   /* flags, like IDA addressing, etc. */
+        __u16 count;   /* byte count */
+        __u32 cda;     /* data address */
+  } __attribute__ ((packed,aligned(8)));
+
+with the following CCW flags values defined:
+
+=================== =========================
+CCW_FLAG_DC         data chaining
+CCW_FLAG_CC         command chaining
+CCW_FLAG_SLI        suppress incorrect length
+CCW_FLAG_SKIP       skip
+CCW_FLAG_PCI        PCI
+CCW_FLAG_IDA        indirect addressing
+CCW_FLAG_SUSPEND    suspend
+=================== =========================
 
 
 Via ccw_device_set_options(), the device driver may specify the following
 options for the device:
 
-DOIO_EARLY_NOTIFICATION  - allow for early interrupt notification
-DOIO_REPORT_ALL          - report all interrupt conditions
+========================= ======================================
+DOIO_EARLY_NOTIFICATION   allow for early interrupt notification
+DOIO_REPORT_ALL           report all interrupt conditions
+========================= ======================================
 
 
-The ccw_device_start() function returns :
+The ccw_device_start() function returns:
 
-      0 - successful completion or request successfully initiated
--EBUSY  - The device is currently processing a previous I/O request, or there is
-          a status pending at the device.
--ENODEV - cdev is invalid, the device is not operational or the ccw_device is
-          not online.
+======== ======================================================================
+      0  successful completion or request successfully initiated
+ -EBUSY  The device is currently processing a previous I/O request, or there is
+         a status pending at the device.
+-ENODEV  cdev is invalid, the device is not operational or the ccw_device is
+         not online.
+======== ======================================================================
 
 When the I/O request completes, the CDS first level interrupt handler will
 accumulate the status in a struct irb and then call the device interrupt handler.
-The intparm field will contain the value the device driver has associated with a 
-particular I/O request. If a pending device status was recognized, 
+The intparm field will contain the value the device driver has associated with a
+particular I/O request. If a pending device status was recognized,
 intparm will be set to 0 (zero). This may happen during I/O initiation or delayed
 by an alert status notification. In any case this status is not related to the
 current (last) I/O request. In case of a delayed status notification no special
@@ -282,9 +309,11 @@ never started, even though ccw_device_start() returned with successful completio
 The irb may contain an error value, and the device driver should check for this
 first:
 
--ETIMEDOUT: the common I/O layer terminated the request after the specified
-            timeout value
--EIO:       the common I/O layer terminated the request due to an error state
+========== =================================================================
+-ETIMEDOUT the common I/O layer terminated the request after the specified
+           timeout value
+-EIO       the common I/O layer terminated the request due to an error state
+========== =================================================================
 
 If the concurrent sense flag in the extended status word (esw) in the irb is
 set, the field erw.scnt in the esw describes the number of device specific
@@ -294,6 +323,7 @@ sensing by the device driver itself is required.
 The device interrupt handler can use the following definitions to investigate
 the primary unit check source coded in sense byte 0 :
 
+======================= ====
 SNS0_CMD_REJECT         0x80
 SNS0_INTERVENTION_REQ   0x40
 SNS0_BUS_OUT_CHECK      0x20
@@ -301,36 +331,41 @@ SNS0_EQUIPMENT_CHECK    0x10
 SNS0_DATA_CHECK         0x08
 SNS0_OVERRUN            0x04
 SNS0_INCOMPL_DOMAIN     0x01
+======================= ====
 
 Depending on the device status, multiple of those values may be set together.
 Please refer to the device specific documentation for details.
 
 The irb->scsw.cstat field provides the (accumulated) subchannel status :
 
-SCHN_STAT_PCI            - program controlled interrupt
-SCHN_STAT_INCORR_LEN     - incorrect length
-SCHN_STAT_PROG_CHECK     - program check
-SCHN_STAT_PROT_CHECK     - protection check
-SCHN_STAT_CHN_DATA_CHK   - channel data check
-SCHN_STAT_CHN_CTRL_CHK   - channel control check
-SCHN_STAT_INTF_CTRL_CHK  - interface control check
-SCHN_STAT_CHAIN_CHECK    - chaining check
+========================= ============================
+SCHN_STAT_PCI             program controlled interrupt
+SCHN_STAT_INCORR_LEN      incorrect length
+SCHN_STAT_PROG_CHECK      program check
+SCHN_STAT_PROT_CHECK      protection check
+SCHN_STAT_CHN_DATA_CHK    channel data check
+SCHN_STAT_CHN_CTRL_CHK    channel control check
+SCHN_STAT_INTF_CTRL_CHK   interface control check
+SCHN_STAT_CHAIN_CHECK     chaining check
+========================= ============================
 
 The irb->scsw.dstat field provides the (accumulated) device status :
 
-DEV_STAT_ATTENTION   - attention
-DEV_STAT_STAT_MOD    - status modifier
-DEV_STAT_CU_END      - control unit end
-DEV_STAT_BUSY        - busy
-DEV_STAT_CHN_END     - channel end
-DEV_STAT_DEV_END     - device end
-DEV_STAT_UNIT_CHECK  - unit check
-DEV_STAT_UNIT_EXCEP  - unit exception
+===================== =================
+DEV_STAT_ATTENTION    attention
+DEV_STAT_STAT_MOD     status modifier
+DEV_STAT_CU_END       control unit end
+DEV_STAT_BUSY         busy
+DEV_STAT_CHN_END      channel end
+DEV_STAT_DEV_END      device end
+DEV_STAT_UNIT_CHECK   unit check
+DEV_STAT_UNIT_EXCEP   unit exception
+===================== =================
 
 Please see the ESA/390 Principles of Operation manual for details on the
 individual flag meanings.
 
-Usage Notes :
+Usage Notes:
 
 ccw_device_start() must be called disabled and with the ccw device lock held.
 
@@ -374,32 +409,39 @@ secondary status without error (alert status) is presented, this indicates
 successful completion for all overlapping ccw_device_start() requests that have
 been issued since the last secondary (final) status.
 
-Channel programs that intend to set the suspend flag on a channel command word 
-(CCW)  must start the I/O operation with the DOIO_ALLOW_SUSPEND option or the 
-suspend flag will cause a channel program check. At the time the channel program 
-becomes suspended an intermediate interrupt will be generated by the channel 
+Channel programs that intend to set the suspend flag on a channel command word
+(CCW)  must start the I/O operation with the DOIO_ALLOW_SUSPEND option or the
+suspend flag will cause a channel program check. At the time the channel program
+becomes suspended an intermediate interrupt will be generated by the channel
 subsystem.
 
-ccw_device_resume() - Resume Channel Program Execution 
+ccw_device_resume() - Resume Channel Program Execution
 
-If a device driver chooses to suspend the current channel program execution by 
-setting the CCW suspend flag on a particular CCW, the channel program execution 
-is suspended. In order to resume channel program execution the CIO layer 
-provides the ccw_device_resume() routine. 
+If a device driver chooses to suspend the current channel program execution by
+setting the CCW suspend flag on a particular CCW, the channel program execution
+is suspended. In order to resume channel program execution the CIO layer
+provides the ccw_device_resume() routine.
 
-int ccw_device_resume(struct ccw_device *cdev);
+::
 
-cdev - ccw_device the resume operation is requested for
+  int ccw_device_resume(struct ccw_device *cdev);
+
+====  ================================================
+cdev  ccw_device the resume operation is requested for
+====  ================================================
 
 The ccw_device_resume() function returns:
 
-        0  - suspended channel program is resumed
--EBUSY     - status pending
--ENODEV    - cdev invalid or not-operational subchannel 
--EINVAL    - resume function not applicable  
--ENOTCONN  - there is no I/O request pending for completion 
+=========   ==============================================
+        0   suspended channel program is resumed
+   -EBUSY   status pending
+  -ENODEV   cdev invalid or not-operational subchannel
+  -EINVAL   resume function not applicable
+-ENOTCONN   there is no I/O request pending for completion
+=========   ==============================================
 
 Usage Notes:
+
 Please have a look at the ccw_device_start() usage notes for more details on
 suspended channel programs.
 
@@ -412,22 +454,28 @@ command is provided.
 
 ccw_device_halt() must be called disabled and with the ccw device lock held.
 
-int ccw_device_halt(struct ccw_device *cdev,
-                    unsigned long intparm);
+::
+
+  int ccw_device_halt(struct ccw_device *cdev,
+                      unsigned long intparm);
 
-cdev    : ccw_device the halt operation is requested for
-intparm : interruption parameter; value is only used if no I/O
-          is outstanding, otherwise the intparm associated with
-          the I/O request is returned
+=======  =====================================================
+cdev     ccw_device the halt operation is requested for
+intparm  interruption parameter; value is only used if no I/O
+         is outstanding, otherwise the intparm associated with
+         the I/O request is returned
+=======  =====================================================
 
-The ccw_device_halt() function returns :
+The ccw_device_halt() function returns:
 
-      0 - request successfully initiated
--EBUSY  - the device is currently busy, or status pending.
--ENODEV - cdev invalid.
--EINVAL - The device is not operational or the ccw device is not online.
+=======  ==============================================================
+      0  request successfully initiated
+-EBUSY   the device is currently busy, or status pending.
+-ENODEV  cdev invalid.
+-EINVAL  The device is not operational or the ccw device is not online.
+=======  ==============================================================
 
-Usage Notes :
+Usage Notes:
 
 A device driver may write a never-ending channel program by writing a channel
 program that at its end loops back to its beginning by means of a transfer in
@@ -438,25 +486,34 @@ can then perform an appropriate action. Prior to interrupt of an outstanding
 read to a network device (with or without PCI flag) a ccw_device_halt()
 is required to end the pending operation.
 
-ccw_device_clear() - Terminage I/O Request Processing
+::
+
+  ccw_device_clear() - Terminage I/O Request Processing
 
 In order to terminate all I/O processing at the subchannel, the clear subchannel
 (CSCH) command is used. It can be issued via ccw_device_clear().
 
 ccw_device_clear() must be called disabled and with the ccw device lock held.
 
-int ccw_device_clear(struct ccw_device *cdev, unsigned long intparm);
+::
+
+  int ccw_device_clear(struct ccw_device *cdev, unsigned long intparm);
 
-cdev:    ccw_device the clear operation is requested for
-intparm: interruption parameter (see ccw_device_halt())
+======= ===============================================
+cdev    ccw_device the clear operation is requested for
+intparm interruption parameter (see ccw_device_halt())
+======= ===============================================
 
 The ccw_device_clear() function returns:
 
-      0 - request successfully initiated
--ENODEV - cdev invalid
--EINVAL - The device is not operational or the ccw device is not online.
+=======  ==============================================================
+      0  request successfully initiated
+-ENODEV  cdev invalid
+-EINVAL  The device is not operational or the ccw device is not online.
+=======  ==============================================================
 
 Miscellaneous Support Routines
+------------------------------
 
 This chapter describes various routines to be used in a Linux/390 device
 driver programming environment.
@@ -466,7 +523,8 @@ get_ccwdev_lock()
 Get the address of the device specific lock. This is then used in
 spin_lock() / spin_unlock() calls.
 
+::
 
-__u8 ccw_device_get_path_mask(struct ccw_device *cdev);
+  __u8 ccw_device_get_path_mask(struct ccw_device *cdev);
 
 Get the mask of the path currently available for cdev.
diff --git a/Documentation/s390/CommonIO b/Documentation/s390/common_io.rst
index 6e0f63f343b4..846485681ce7 100644
--- a/Documentation/s390/CommonIO
+++ b/Documentation/s390/common_io.rst
@@ -1,5 +1,9 @@
-S/390 common I/O-Layer - command line parameters, procfs and debugfs entries
-============================================================================
+======================
+S/390 common I/O-Layer
+======================
+
+command line parameters, procfs and debugfs entries
+===================================================
 
 Command line parameters
 -----------------------
@@ -13,7 +17,7 @@ Command line parameters
         device := {all | [!]ipldev | [!]condev | [!]<devno> | [!]<devno>-<devno>}
 
   The given devices will be ignored by the common I/O-layer; no detection
-  and device sensing will be done on any of those devices. The subchannel to 
+  and device sensing will be done on any of those devices. The subchannel to
   which the device in question is attached will be treated as if no device was
   attached.
 
@@ -28,14 +32,20 @@ Command line parameters
   keywords can be used to refer to the CCW based boot device and CCW console
   device respectively (these are probably useful only when combined with the '!'
   operator). The '!' operator will cause the I/O-layer to _not_ ignore a device.
-  The command line is parsed from left to right.
+  The command line
+  is parsed from left to right.
+
+  For example::
 
-  For example, 
         cio_ignore=0.0.0023-0.0.0042,0.0.4711
+
   will ignore all devices ranging from 0.0.0023 to 0.0.0042 and the device
   0.0.4711, if detected.
-  As another example,
+
+  As another example::
+
         cio_ignore=all,!0.0.4711,!0.0.fd00-0.0.fd02
+
   will ignore all devices but 0.0.4711, 0.0.fd00, 0.0.fd01, 0.0.fd02.
 
   By default, no devices are ignored.
@@ -48,40 +58,45 @@ Command line parameters
 
   Lists the ranges of devices (by bus id) which are ignored by common I/O.
 
-  You can un-ignore certain or all devices by piping to /proc/cio_ignore. 
-  "free all" will un-ignore all ignored devices, 
+  You can un-ignore certain or all devices by piping to /proc/cio_ignore.
+  "free all" will un-ignore all ignored devices,
   "free <device range>, <device range>, ..." will un-ignore the specified
   devices.
 
   For example, if devices 0.0.0023 to 0.0.0042 and 0.0.4711 are ignored,
+
   - echo free 0.0.0030-0.0.0032 > /proc/cio_ignore
     will un-ignore devices 0.0.0030 to 0.0.0032 and will leave devices 0.0.0023
     to 0.0.002f, 0.0.0033 to 0.0.0042 and 0.0.4711 ignored;
   - echo free 0.0.0041 > /proc/cio_ignore will furthermore un-ignore device
     0.0.0041;
-  - echo free all > /proc/cio_ignore will un-ignore all remaining ignored 
+  - echo free all > /proc/cio_ignore will un-ignore all remaining ignored
     devices.
 
-  When a device is un-ignored, device recognition and sensing is performed and 
+  When a device is un-ignored, device recognition and sensing is performed and
   the device driver will be notified if possible, so the device will become
   available to the system. Note that un-ignoring is performed asynchronously.
 
-  You can also add ranges of devices to be ignored by piping to 
+  You can also add ranges of devices to be ignored by piping to
   /proc/cio_ignore; "add <device range>, <device range>, ..." will ignore the
   specified devices.
 
   Note: While already known devices can be added to the list of devices to be
-        ignored, there will be no effect on then. However, if such a device
+        ignored, there will be no effect on then. However, if such a device
         disappears and then reappears, it will then be ignored. To make
         known devices go away, you need the "purge" command (see below).
 
-  For example,
+  For example::
+
         "echo add 0.0.a000-0.0.accc, 0.0.af00-0.0.afff > /proc/cio_ignore"
+
   will add 0.0.a000-0.0.accc and 0.0.af00-0.0.afff to the list of ignored
   devices.
 
-  You can remove already known but now ignored devices via
+  You can remove already known but now ignored devices via::
+
         "echo purge > /proc/cio_ignore"
+
   All devices ignored but still registered and not online (= not in use)
   will be deregistered and thus removed from the system.
 
@@ -115,11 +130,11 @@ debugfs entries
     Various debug messages from the common I/O-layer.
 
   - /sys/kernel/debug/s390dbf/cio_trace/hex_ascii
-    Logs the calling of functions in the common I/O-layer and, if applicable, 
+    Logs the calling of functions in the common I/O-layer and, if applicable,
     which subchannel they were called for, as well as dumps of some data
     structures (like irb in an error case).
 
-  The level of logging can be changed to be more or less verbose by piping to 
+  The level of logging can be changed to be more or less verbose by piping to
   /sys/kernel/debug/s390dbf/cio_*/level a number between 0 and 6; see the
-  documentation on the S/390 debug feature (Documentation/s390/s390dbf.txt)
+  documentation on the S/390 debug feature (Documentation/s390/s390dbf.rst)
   for details.
diff --git a/Documentation/s390/DASD b/Documentation/s390/dasd.rst
index 9963f1e9c98a..9e22247285c8 100644
--- a/Documentation/s390/DASD
+++ b/Documentation/s390/dasd.rst
@@ -1,4 +1,6 @@
+==================
 DASD device driver
+==================
 
 S/390's disk devices (DASDs) are managed by Linux via the DASD device
 driver. It is valid for all types of DASDs and represents them to
@@ -14,14 +16,14 @@ parameters are to be given in hexadecimal notation without a leading
 If you supply kernel parameters the different instances are processed
 in order of appearance and a minor number is reserved for any device
 covered by the supplied range up to 64 volumes. Additional DASDs are
-ignored. If you do not supply the 'dasd=' kernel parameter at all, the 
+ignored. If you do not supply the 'dasd=' kernel parameter at all, the
 DASD driver registers all supported DASDs of your system to a minor
 number in ascending order of the subchannel number.
 
 The driver currently supports ECKD-devices and there are stubs for
 support of the FBA and CKD architectures. For the FBA architecture
 only some smart data structures are missing to make the support
-complete. 
+complete.
 We performed our testing on 3380 and 3390 type disks of different
 sizes, under VM and on the bare hardware (LPAR), using internal disks
 of the multiprise as well as a RAMAC virtual array. Disks exported by
@@ -34,19 +36,22 @@ accessibility of the DASD from other OSs. In a later stage we will
 provide support of partitions, maybe VTOC oriented or using a kind of
 partition table in the label record.
 
-USAGE
+Usage
+=====
 
 -Low-level format (?CKD only)
 For using an ECKD-DASD as a Linux harddisk you have to low-level
 format the tracks by issuing the BLKDASDFORMAT-ioctl on that
 device. This will erase any data on that volume including IBM volume
-labels, VTOCs etc. The ioctl may take a 'struct format_data *' or
-'NULL' as an argument.  
-typedef struct {
+labels, VTOCs etc. The ioctl may take a `struct format_data *` or
+'NULL' as an argument::
+
+  typedef struct {
         int start_unit;
         int stop_unit;
         int blksize;
-} format_data_t;
+  } format_data_t;
+
 When a NULL argument is passed to the BLKDASDFORMAT ioctl the whole
 disk is formatted to a blocksize of 1024 bytes. Otherwise start_unit
 and stop_unit are the first and last track to be formatted. If
@@ -56,17 +61,23 @@ up to the last track. blksize can be any power of two between 512 and
 1kB blocks anyway and you gain approx. 50% of capacity increasing your
 blksize from 512 byte to 1kB.
 
--Make a filesystem
+Make a filesystem
+=================
+
 Then you can mk??fs the filesystem of your choice on that volume or
 partition. For reasons of sanity you should build your filesystem on
-the partition /dev/dd?1 instead of the whole volume. You only lose 3kB  
+the partition /dev/dd?1 instead of the whole volume. You only lose 3kB
 but may be sure that you can reuse your data after introduction of a
 real partition table.
 
-BUGS:
+Bugs
+====
+
 - Performance sometimes is rather low because we don't fully exploit clustering
 
-TODO-List:
+TODO-List
+=========
+
 - Add IBM'S Disk layout to genhd
 - Enhance driver to use more than one major number
 - Enable usage as a module
diff --git a/Documentation/s390/debugging390.rst b/Documentation/s390/debugging390.rst
new file mode 100644
index 000000000000..d49305fd5e1a
--- /dev/null
+++ b/Documentation/s390/debugging390.rst
@@ -0,0 +1,2613 @@
+=============================================
+Debugging on Linux for s/390 & z/Architecture
+=============================================
+
+Denis Joseph Barrow (djbarrow@de.ibm.com,barrow_dj@yahoo.com)
+
+Copyright (C) 2000-2001 IBM Deutschland Entwicklung GmbH, IBM Corporation
+
+.. Best viewed with fixed width fonts
+
+Overview of Document:
+=====================
+This document is intended to give a good overview of how to debug Linux for
+s/390 and z/Architecture. It is not intended as a complete reference and not a
+tutorial on the fundamentals of C & assembly. It doesn't go into
+390 IO in any detail. It is intended to complement the documents in the
+reference section below & any other worthwhile references you get.
+
+It is intended like the Enterprise Systems Architecture/390 Reference Summary
+to be printed out & used as a quick cheat sheet self help style reference when
+problems occur.
+
+.. Contents
+   ========
+   Register Set
+   Address Spaces on Intel Linux
+   Address Spaces on Linux for s/390 & z/Architecture
+   The Linux for s/390 & z/Architecture Kernel Task Structure
+   Register Usage & Stackframes on Linux for s/390 & z/Architecture
+   A sample program with comments
+   Compiling programs for debugging on Linux for s/390 & z/Architecture
+   Debugging under VM
+   s/390 & z/Architecture IO Overview
+   Debugging IO on s/390 & z/Architecture under VM
+   GDB on s/390 & z/Architecture
+   Stack chaining in gdb by hand
+   Examining core dumps
+   ldd
+   Debugging modules
+   The proc file system
+   SysRq
+   References
+   Special Thanks
+
+Register Set
+============
+The current architectures have the following registers.
+
+16 General propose registers, 32 bit on s/390 and 64 bit on z/Architecture,
+r0-r15 (or gpr0-gpr15), used for arithmetic and addressing.
+
+16 Control registers, 32 bit on s/390 and 64 bit on z/Architecture, cr0-cr15,
+kernel usage only, used for memory management, interrupt control, debugging
+control etc.
+
+16 Access registers (ar0-ar15), 32 bit on both s/390 and z/Architecture,
+normally not used by normal programs but potentially could be used as
+temporary storage. These registers have a 1:1 association with general
+purpose registers and are designed to be used in the so-called access
+register mode to select different address spaces.
+Access register 0 (and access register 1 on z/Architecture, which needs a
+64 bit pointer) is currently used by the pthread library as a pointer to
+the current running threads private area.
+
+16 64-bit floating point registers (fp0-fp15 ) IEEE & HFP floating
+point format compliant on G5 upwards & a Floating point control reg (FPC)
+
+4  64-bit registers (fp0,fp2,fp4 & fp6) HFP only on older machines.
+
+Note:
+   Linux (currently) always uses IEEE & emulates G5 IEEE format on older
+   machines, ( provided the kernel is configured for this ).
+
+
+The PSW is the most important register on the machine it
+is 64 bit on s/390 & 128 bit on z/Architecture & serves the roles of
+a program counter (pc), condition code register,memory space designator.
+In IBM standard notation I am counting bit 0 as the MSB.
+It has several advantages over a normal program counter
+in that you can change address translation & program counter
+in a single instruction. To change address translation,
+e.g. switching address translation off requires that you
+have a logical=physical mapping for the address you are
+currently running at.
+
++-------------------------+-------------------------------------------------+
+|          Bit            |                                                 |
++--------+----------------+                     Value                       |
+| s/390  | z/Architecture |                                                 |
++========+================+=================================================+
+| 0      |     0          | Reserved (must be 0) otherwise specification    |
+|        |                | exception occurs.                               |
++--------+----------------+-------------------------------------------------+
+| 1      |     1          | Program Event Recording 1 PER enabled,          |
+|        |                | PER is used to facilitate debugging e.g.        |
+|        |                | single stepping.                                |
++--------+----------------+-------------------------------------------------+
+| 2-4    |    2-4         | Reserved (must be 0).                           |
++--------+----------------+-------------------------------------------------+
+| 5      |     5          | Dynamic address translation 1=DAT on.           |
++--------+----------------+-------------------------------------------------+
+| 6      |     6          | Input/Output interrupt Mask                     |
++--------+----------------+-------------------------------------------------+
+| 7      |     7          | External interrupt Mask used primarily for      |
+|        |                | interprocessor signalling and clock interrupts. |
++--------+----------------+-------------------------------------------------+
+| 8-11   |   8-11         | PSW Key used for complex memory protection      |
+|        |                | mechanism (not used under linux)                |
++--------+----------------+-------------------------------------------------+
+| 12     |     12         | 1 on s/390 0 on z/Architecture                  |
++--------+----------------+-------------------------------------------------+
+| 13     |     13         | Machine Check Mask 1=enable machine check       |
+|        |                | interrupts                                      |
++--------+----------------+-------------------------------------------------+
+| 14     |     14         | Wait State. Set this to 1 to stop the processor |
+|        |                | except for interrupts and give  time to other   |
+|        |                | LPARS. Used in CPU idle in the kernel to        |
+|        |                | increase overall usage of processor resources.  |
++--------+----------------+-------------------------------------------------+
+| 15     |     15         | Problem state (if set to 1 certain instructions |
+|        |                | are disabled). All linux user programs run with |
+|        |                | this bit 1 (useful info for debugging under VM).|
++--------+----------------+-------------------------------------------------+
+| 16-17  |    16-17       | Address Space Control                           |
+|        |                |                                                 |
+|        |                | 00 Primary Space Mode:                          |
+|        |                |                                                 |
+|        |                | The register CR1 contains the primary           |
+|        |                | address-space control element (PASCE), which    |
+|        |                | points to the primary space region/segment      |
+|        |                | table origin.                                   |
+|        |                |                                                 |
+|        |                | 01 Access register mode                         |
+|        |                |                                                 |
+|        |                | 10 Secondary Space Mode:                        |
+|        |                |                                                 |
+|        |                | The register CR7 contains the secondary         |
+|        |                | address-space control element (SASCE), which    |
+|        |                | points to the secondary space region or         |
+|        |                | segment table origin.                           |
+|        |                |                                                 |
+|        |                | 11 Home Space Mode:                             |
+|        |                |                                                 |
+|        |                | The register CR13 contains the home space       |
+|        |                | address-space control element (HASCE), which    |
+|        |                | points to the home space region/segment         |
+|        |                | table origin.                                   |
+|        |                |                                                 |
+|        |                | See "Address Spaces on Linux for s/390 &        |
+|        |                | z/Architecture" below for more information      |
+|        |                | about address space usage in Linux.             |
++--------+----------------+-------------------------------------------------+
+| 18-19  |    18-19       | Condition codes (CC)                            |
++--------+----------------+-------------------------------------------------+
+| 20     |    20          | Fixed point overflow mask if 1=FPU exceptions   |
+|        |                | for this event occur (normally 0)               |
++--------+----------------+-------------------------------------------------+
+| 21     |    21          | Decimal overflow mask if 1=FPU exceptions for   |
+|        |                | this event occur (normally 0)                   |
++--------+----------------+-------------------------------------------------+
+| 22     |    22          | Exponent underflow mask if 1=FPU exceptions     |
+|        |                | for this event occur (normally 0)               |
++--------+----------------+-------------------------------------------------+
+| 23     |    23          | Significance Mask if 1=FPU exceptions for this  |
+|        |                | event occur (normally 0)                        |
++--------+----------------+-------------------------------------------------+
+| 24-31  |    24-30       | Reserved Must be 0.                             |
+|        +----------------+-------------------------------------------------+
+|        |    31          | Extended Addressing Mode                        |
+|        +----------------+-------------------------------------------------+
+|        |    32          | Basic Addressing Mode                           |
+|        |                |                                                 |
+|        |                | Used to set addressing mode                     |
+|        |                |                                                 |
+|        |                |    +---------+----------+----------+            |
+|        |                |    | PSW 31  | PSW 32   |          |            |
+|        |                |    +---------+----------+----------+            |
+|        |                |    |   0     |    0     |  24 bit  |            |
+|        |                |    +---------+----------+----------+            |
+|        |                |    |   0     |    1     |  31 bit  |            |
+|        |                |    +---------+----------+----------+            |
+|        |                |    |   1     |    1     |  64 bit  |            |
+|        |                |    +---------+----------+----------+            |
++--------+----------------+-------------------------------------------------+
+| 32     |                | 1=31 bit addressing mode 0=24 bit addressing    |
+|        |                | mode (for backward compatibility), linux        |
+|        |                | always runs with this bit set to 1              |
++--------+----------------+-------------------------------------------------+
+| 33-64  |                | Instruction address.                            |
+|        +----------------+-------------------------------------------------+
+|        |    33-63       | Reserved must be 0                              |
+|        +----------------+-------------------------------------------------+
+|        |    64-127      | Address                                         |
+|        |                |                                                 |
+|        |                |   - In 24 bits mode bits 64-103=0 bits 104-127  |
+|        |                |     Address                                     |
+|        |                |   - In 31 bits mode bits 64-96=0 bits 97-127    |
+|        |                |     Address                                     |
+|        |                |                                                 |
+|        |                | Note:                                           |
+|        |                |     unlike 31 bit mode on s/390 bit 96 must be  |
+|        |                |     zero when loading the address with LPSWE    |
+|        |                |     otherwise a specification exception occurs, |
+|        |                |     LPSW is fully backward compatible.          |
++--------+----------------+-------------------------------------------------+
+
+Prefix Page(s)
+--------------
+This per cpu memory area is too intimately tied to the processor not to mention.
+It exists between the real addresses 0-4096 on s/390 and between 0-8192 on
+z/Architecture and is exchanged with one page on s/390 or two pages on
+z/Architecture in absolute storage by the set prefix instruction during Linux
+startup.
+
+This page is mapped to a different prefix for each processor in an SMP
+configuration (assuming the OS designer is sane of course).
+
+Bytes 0-512 (200 hex) on s/390 and 0-512, 4096-4544, 4604-5119 currently on
+z/Architecture are used by the processor itself for holding such information
+as exception indications and entry points for exceptions.
+
+Bytes after 0xc00 hex are used by linux for per processor globals on s/390 and
+z/Architecture (there is a gap on z/Architecture currently between 0xc00 and
+0x1000, too, which is used by Linux).
+
+The closest thing to this on traditional architectures is the interrupt
+vector table. This is a good thing & does simplify some of the kernel coding
+however it means that we now cannot catch stray NULL pointers in the
+kernel without hard coded checks.
+
+
+
+Address Spaces on Intel Linux
+=============================
+
+The traditional Intel Linux is approximately mapped as follows forgive
+the ascii art::
+
+  0xFFFFFFFF 4GB Himem          *****************
+                                *               *
+                                * Kernel Space  *
+                                *               *
+                                *****************         ****************
+  User Space Himem              *  User Stack   *         *              *
+  (typically 0xC0000000 3GB )   *****************         *              *
+                                *  Shared Libs  *         * Next Process *
+                                *****************         *     to       *
+                                *               *   <==   *     Run      *  <==
+                                *  User Program *         *              *
+                                *   Data BSS    *         *              *
+                                *    Text       *         *              *
+                                *   Sections    *         *              *
+  0x00000000                    *****************         ****************
+
+Now it is easy to see that on Intel it is quite easy to recognise a kernel
+address as being one greater than user space himem (in this case 0xC0000000),
+and addresses of less than this are the ones in the current running program on
+this processor (if an smp box).
+
+If using the virtual machine ( VM ) as a debugger it is quite difficult to
+know which user process is running as the address space you are looking at
+could be from any process in the run queue.
+
+The limitation of Intels addressing technique is that the linux
+kernel uses a very simple real address to virtual addressing technique
+of Real Address=Virtual Address-User Space Himem.
+This means that on Intel the kernel linux can typically only address
+Himem=0xFFFFFFFF-0xC0000000=1GB & this is all the RAM these machines
+can typically use.
+
+They can lower User Himem to 2GB or lower & thus be
+able to use 2GB of RAM however this shrinks the maximum size
+of User Space from 3GB to 2GB they have a no win limit of 4GB unless
+they go to 64 Bit.
+
+
+On 390 our limitations & strengths make us slightly different.
+For backward compatibility we are only allowed use 31 bits (2GB)
+of our 32 bit addresses, however, we use entirely separate address
+spaces for the user & kernel.
+
+This means we can support 2GB of non Extended RAM on s/390, & more
+with the Extended memory management swap device &
+currently 4TB of physical memory currently on z/Architecture.
+
+
+Address Spaces on Linux for s/390 & z/Architecture
+==================================================
+
+Our addressing scheme is basically as follows::
+
+                                   Primary Space               Home Space
+  Himem 0x7fffffff 2GB on s/390    *****************          ****************
+  currently 0x3ffffffffff (2^42)-1 *  User Stack   *          *              *
+  on z/Architecture.               *****************          *              *
+                                   *  Shared Libs  *          *              *
+                                   *****************          *              *
+                                   *               *          *    Kernel    *
+                                   *  User Program *          *              *
+                                   *   Data BSS    *          *              *
+                                   *    Text       *          *              *
+                                   *   Sections    *          *              *
+  0x00000000                       *****************          ****************
+
+This also means that we need to look at the PSW problem state bit and the
+addressing mode to decide whether we are looking at user or kernel space.
+
+User space runs in primary address mode (or access register mode within
+the vdso code).
+
+The kernel usually also runs in home space mode, however when accessing
+user space the kernel switches to primary or secondary address mode if
+the mvcos instruction is not available or if a compare-and-swap (futex)
+instruction on a user space address is performed.
+
+When also looking at the ASCE control registers, this means:
+
+User space:
+
+- runs in primary or access register mode
+- cr1 contains the user asce
+- cr7 contains the user asce
+- cr13 contains the kernel asce
+
+Kernel space:
+
+- runs in home space mode
+- cr1 contains the user or kernel asce
+
+  - the kernel asce is loaded when a uaccess requires primary or
+    secondary address mode
+
+- cr7 contains the user or kernel asce, (changed with set_fs())
+- cr13 contains the kernel asce
+
+In case of uaccess the kernel changes to:
+
+- primary space mode in case of a uaccess (copy_to_user) and uses
+  e.g. the mvcp instruction to access user space. However the kernel
+  will stay in home space mode if the mvcos instruction is available
+- secondary space mode in case of futex atomic operations, so that the
+  instructions come from primary address space and data from secondary
+  space
+
+In case of KVM, the kernel runs in home space mode, but cr1 gets switched
+to contain the gmap asce before the SIE instruction gets executed. When
+the SIE instruction is finished, cr1 will be switched back to contain the
+user asce.
+
+
+Virtual Addresses on s/390 & z/Architecture
+===========================================
+
+A virtual address on s/390 is made up of 3 parts
+The SX (segment index, roughly corresponding to the PGD & PMD in Linux
+terminology) being bits 1-11.
+
+The PX (page index, corresponding to the page table entry (pte) in Linux
+terminology) being bits 12-19.
+
+The remaining bits BX (the byte index are the offset in the page )
+i.e. bits 20 to 31.
+
+On z/Architecture in linux we currently make up an address from 4 parts.
+
+- The region index bits (RX) 0-32 we currently use bits 22-32
+- The segment index (SX) being bits 33-43
+- The page index (PX) being bits  44-51
+- The byte index (BX) being bits  52-63
+
+Notes:
+  1) s/390 has no PMD so the PMD is really the PGD also.
+     A lot of this stuff is defined in pgtable.h.
+
+  2) Also seeing as s/390's page indexes are only 1k  in size
+     (bits 12-19 x 4 bytes per pte ) we use 1 ( page 4k )
+     to make the best use of memory by updating 4 segment indices
+     entries each time we mess with a PMD & use offsets
+     0,1024,2048 & 3072 in this page as for our segment indexes.
+     On z/Architecture our page indexes are now 2k in size
+     ( bits 12-19 x 8 bytes per pte ) we do a similar trick
+     but only mess with 2 segment indices each time we mess with
+     a PMD.
+
+  3) As z/Architecture supports up to a massive 5-level page table lookup we
+     can only use 3 currently on Linux ( as this is all the generic kernel
+     currently supports ) however this may change in future
+     this allows us to access ( according to my sums )
+     4TB of virtual storage per process i.e.
+     4096*512(PTES)*1024(PMDS)*2048(PGD) = 4398046511104 bytes,
+     enough for another 2 or 3 of years I think :-).
+     to do this we use a region-third-table designation type in
+     our address space control registers.
+
+
+The Linux for s/390 & z/Architecture Kernel Task Structure
+==========================================================
+Each process/thread under Linux for S390 has its own kernel task_struct
+defined in linux/include/linux/sched.h
+The S390 on initialisation & resuming of a process on a cpu sets
+the __LC_KERNEL_STACK variable in the spare prefix area for this cpu
+(which we use for per-processor globals).
+
+The kernel stack pointer is intimately tied with the task structure for
+each processor as follows::
+
+                        s/390
+              ************************
+              *  1 page kernel stack *
+              *        ( 4K )        *
+              ************************
+              *   1 page task_struct *
+              *        ( 4K )        *
+  8K aligned  ************************
+
+                   z/Architecture
+              ************************
+              *  2 page kernel stack *
+              *        ( 8K )        *
+              ************************
+              *  2 page task_struct  *
+              *        ( 8K )        *
+  16K aligned ************************
+
+What this means is that we don't need to dedicate any register or global
+variable to point to the current running process & can retrieve it with the
+following very simple construct for s/390 & one very similar for
+z/Architecture::
+
+  static inline struct task_struct * get_current(void)
+  {
+        struct task_struct *current;
+        __asm__("lhi   %0,-8192\n\t"
+                "nr    %0,15"
+                : "=r" (current) );
+        return current;
+  }
+
+i.e. just anding the current kernel stack pointer with the mask -8192.
+Thankfully because Linux doesn't have support for nested IO interrupts
+& our devices have large buffers can survive interrupts being shut for
+short amounts of time we don't need a separate stack for interrupts.
+
+
+
+
+Register Usage & Stackframes on Linux for s/390 & z/Architecture
+=================================================================
+Overview:
+---------
+This is the code that gcc produces at the top & the bottom of
+each function. It usually is fairly consistent & similar from
+function to function & if you know its layout you can probably
+make some headway in finding the ultimate cause of a problem
+after a crash without a source level debugger.
+
+Note: To follow stackframes requires a knowledge of C or Pascal &
+limited knowledge of one assembly language.
+
+It should be noted that there are some differences between the
+s/390 and z/Architecture stack layouts as the z/Architecture stack layout
+didn't have to maintain compatibility with older linkage formats.
+
+Glossary:
+---------
+alloca:
+  This is a built in compiler function for runtime allocation
+  of extra space on the callers stack which is obviously freed
+  up on function exit ( e.g. the caller may choose to allocate nothing
+  of a buffer of 4k if required for temporary purposes ), it generates
+  very efficient code ( a few cycles  ) when compared to alternatives
+  like malloc.
+
+automatics:
+  These are local variables on the stack, i.e they aren't in registers &
+  they aren't static.
+
+back-chain:
+  This is a pointer to the stack pointer before entering a
+  framed functions ( see frameless function ) prologue got by
+  dereferencing the address of the current stack pointer,
+  i.e. got by accessing the 32 bit value at the stack pointers
+  current location.
+
+base-pointer:
+  This is a pointer to the back of the literal pool which
+  is an area just behind each procedure used to store constants
+  in each function.
+
+call-clobbered:
+  The caller probably needs to save these registers if there
+  is something of value in them, on the stack or elsewhere before making a
+  call to another procedure so that it can restore it later.
+
+epilogue:
+  The code generated by the compiler to return to the caller.
+
+frameless-function:
+  A frameless function in Linux for s390 & z/Architecture is one which doesn't
+  need more than the register save area (96 bytes on s/390, 160 on z/Architecture)
+  given to it by the caller.
+
+  A frameless function never:
+
+  1) Sets up a back chain.
+  2) Calls alloca.
+  3) Calls other normal functions
+  4) Has automatics.
+
+GOT-pointer:
+  This is a pointer to the global-offset-table in ELF
+  ( Executable Linkable Format, Linux'es most common executable format ),
+  all globals & shared library objects are found using this pointer.
+
+lazy-binding
+  ELF shared libraries are typically only loaded when routines in the shared
+  library are actually first called at runtime. This is lazy binding.
+
+procedure-linkage-table
+  This is a table found from the GOT which contains pointers to routines
+  in other shared libraries which can't be called to by easier means.
+
+prologue:
+  The code generated by the compiler to set up the stack frame.
+
+outgoing-args:
+  This is extra area allocated on the stack of the calling function if the
+  parameters for the callee's cannot all be put in registers, the same
+  area can be reused by each function the caller calls.
+
+routine-descriptor:
+  A COFF  executable format based concept of a procedure reference
+  actually being 8 bytes or more as opposed to a simple pointer to the routine.
+  This is typically defined as follows:
+
+  - Routine Descriptor offset 0=Pointer to Function
+  - Routine Descriptor offset 4=Pointer to Table of Contents
+
+  The table of contents/TOC is roughly equivalent to a GOT pointer.
+  & it means that shared libraries etc. can be shared between several
+  environments each with their own TOC.
+
+static-chain:
+  This is used in nested functions a concept adopted from pascal
+  by gcc not used in ansi C or C++ ( although quite useful ), basically it
+  is a pointer used to reference local variables of enclosing functions.
+  You might come across this stuff once or twice in your lifetime.
+
+  e.g.
+
+  The function below should return 11 though gcc may get upset & toss warnings
+  about unused variables::
+
+    int FunctionA(int a)
+    {
+        int b;
+        FunctionC(int c)
+        {
+                b=c+1;
+        }
+        FunctionC(10);
+        return(b);
+    }
+
+
+s/390 & z/Architecture Register usage
+=====================================
+
+======== ========================================== ===============
+r0       used by syscalls/assembly                  call-clobbered
+r1       used by syscalls/assembly                  call-clobbered
+r2       argument 0 / return value 0                call-clobbered
+r3       argument 1 / return value 1 (if long long) call-clobbered
+r4       argument 2                                 call-clobbered
+r5       argument 3                                 call-clobbered
+r6       argument 4                                 saved
+r7       pointer-to arguments 5 to ...              saved
+r8       this & that                                saved
+r9       this & that                                saved
+r10      static-chain ( if nested function )        saved
+r11      frame-pointer ( if function used alloca )  saved
+r12      got-pointer                                saved
+r13      base-pointer                               saved
+r14      return-address                             saved
+r15      stack-pointer                              saved
+
+f0       argument 0 / return value ( float/double ) call-clobbered
+f2       argument 1                                 call-clobbered
+f4       z/Architecture argument 2                  saved
+f6       z/Architecture argument 3                  saved
+======== ========================================== ===============
+
+The remaining floating points
+f1,f3,f5 f7-f15 are call-clobbered.
+
+Notes:
+------
+1) The only requirement is that registers which are used
+   by the callee are saved, e.g. the compiler is perfectly
+   capable of using r11 for purposes other than a frame a
+   frame pointer if a frame pointer is not needed.
+2) In functions with variable arguments e.g. printf the calling procedure
+   is identical to one without variable arguments & the same number of
+   parameters. However, the prologue of this function is somewhat more
+   hairy owing to it having to move these parameters to the stack to
+   get va_start, va_arg & va_end to work.
+3) Access registers are currently unused by gcc but are used in
+   the kernel. Possibilities exist to use them at the moment for
+   temporary storage but it isn't recommended.
+4) Only 4 of the floating point registers are used for
+   parameter passing as older machines such as G3 only have only 4
+   & it keeps the stack frame compatible with other compilers.
+   However with IEEE floating point emulation under linux on the
+   older machines you are free to use the other 12.
+5) A long long or double parameter cannot be have the
+   first 4 bytes in a register & the second four bytes in the
+   outgoing args area. It must be purely in the outgoing args
+   area if crossing this boundary.
+6) Floating point parameters are mixed with outgoing args
+   on the outgoing args area in the order the are passed in as parameters.
+7) Floating point arguments 2 & 3 are saved in the outgoing args area for
+   z/Architecture
+
+
+Stack Frame Layout
+------------------
+
+========= ============== ======================================================
+s/390     z/Architecture
+========= ============== ======================================================
+0         0              back chain ( a 0 here signifies end of back chain )
+4         8              eos ( end of stack, not used on Linux for S390 used
+                         in other linkage formats )
+8         16             glue used in other s/390 linkage formats for saved
+                         routine descriptors etc.
+12        24             glue used in other s/390 linkage formats for saved
+                         routine descriptors etc.
+16        32             scratch area
+20        40             scratch area
+24        48             saved r6 of caller function
+28        56             saved r7 of caller function
+32        64             saved r8 of caller function
+36        72             saved r9 of caller function
+40        80             saved r10 of caller function
+44        88             saved r11 of caller function
+48        96             saved r12 of caller function
+52        104            saved r13 of caller function
+56        112            saved r14 of caller function
+60        120            saved r15 of caller function
+64        128            saved f4 of caller function
+72        132            saved f6 of caller function
+80                       undefined
+96        160            outgoing args passed from caller to callee
+96+x      160+x          possible stack alignment ( 8 bytes desirable )
+96+x+y    160+x+y        alloca space of caller ( if used )
+96+x+y+z  160+x+y+z      automatics of caller ( if used )
+0                        back-chain
+========= ============== ======================================================
+
+A sample program with comments.
+===============================
+
+Comments on the function test
+-----------------------------
+1) It didn't need to set up a pointer to the constant pool gpr13 as it is not
+   used ( :-( ).
+2) This is a frameless function & no stack is bought.
+3) The compiler was clever enough to recognise that it could return the
+   value in r2 as well as use it for the passed in parameter ( :-) ).
+4) The basr ( branch relative & save ) trick works as follows the instruction
+   has a special case with r0,r0 with some instruction operands is understood as
+   the literal value 0, some risc architectures also do this ). So now
+   we are branching to the next address & the address new program counter is
+   in r13,so now we subtract the size of the function prologue we have executed
+   the size of the literal pool to get to the top of the literal pool::
+
+
+     0040037c int test(int b)
+     {                                                     # Function prologue below
+       40037c:  90 de f0 34     stm     %r13,%r14,52(%r15) # Save registers r13 & r14
+       400380:  0d d0           basr    %r13,%r0           # Set up pointer to constant pool using
+       400382:  a7 da ff fa     ahi     %r13,-6            # basr trick
+        return(5+b);
+                                                           # Huge main program
+       400386:  a7 2a 00 05     ahi     %r2,5              # add 5 to r2
+
+                                                           # Function epilogue below
+       40038a:  98 de f0 34     lm      %r13,%r14,52(%r15) # restore registers r13 & 14
+       40038e:  07 fe           br      %r14               # return
+     }
+
+Comments on the function main
+-----------------------------
+1) The compiler did this function optimally ( 8-) )::
+
+     Literal pool for main.
+     400390:    ff ff ff ec     .long 0xffffffec
+     main(int argc,char *argv[])
+     {                                                     # Function prologue below
+       400394:  90 bf f0 2c     stm     %r11,%r15,44(%r15) # Save necessary registers
+       400398:  18 0f           lr      %r0,%r15           # copy stack pointer to r0
+       40039a:  a7 fa ff a0     ahi     %r15,-96           # Make area for callee saving
+       40039e:  0d d0           basr    %r13,%r0           # Set up r13 to point to
+       4003a0:  a7 da ff f0     ahi     %r13,-16           # literal pool
+       4003a4:  50 00 f0 00     st      %r0,0(%r15)        # Save backchain
+
+        return(test(5));                                   # Main Program Below
+       4003a8:  58 e0 d0 00     l       %r14,0(%r13)       # load relative address of test from
+                                                           # literal pool
+       4003ac:  a7 28 00 05     lhi     %r2,5              # Set first parameter to 5
+       4003b0:  4d ee d0 00     bas     %r14,0(%r14,%r13)  # jump to test setting r14 as return
+                                                           # address using branch & save instruction.
+
+                                                           # Function Epilogue below
+       4003b4:  98 bf f0 8c     lm      %r11,%r15,140(%r15)# Restore necessary registers.
+       4003b8:  07 fe           br      %r14               # return to do program exit
+     }
+
+
+Compiler updates
+----------------
+
+::
+
+  main(int argc,char *argv[])
+  {
+    4004fc:     90 7f f0 1c             stm     %r7,%r15,28(%r15)
+    400500:     a7 d5 00 04             bras    %r13,400508 <main+0xc>
+    400504:     00 40 04 f4             .long   0x004004f4
+    # compiler now puts constant pool in code to so it saves an instruction
+    400508:     18 0f                   lr      %r0,%r15
+    40050a:     a7 fa ff a0             ahi     %r15,-96
+    40050e:     50 00 f0 00             st      %r0,0(%r15)
+        return(test(5));
+    400512:     58 10 d0 00             l       %r1,0(%r13)
+    400516:     a7 28 00 05             lhi     %r2,5
+    40051a:     0d e1                   basr    %r14,%r1
+    # compiler adds 1 extra instruction to epilogue this is done to
+    # avoid processor pipeline stalls owing to data dependencies on g5 &
+    # above as register 14 in the old code was needed directly after being loaded
+    # by the lm %r11,%r15,140(%r15) for the br %14.
+    40051c:     58 40 f0 98             l       %r4,152(%r15)
+    400520:     98 7f f0 7c             lm      %r7,%r15,124(%r15)
+    400524:     07 f4                   br      %r4
+  }
+
+
+Hartmut ( our compiler developer ) also has been threatening to take out the
+stack backchain in optimised code as this also causes pipeline stalls, you
+have been warned.
+
+64 bit z/Architecture code disassembly
+--------------------------------------
+
+If you understand the stuff above you'll understand the stuff
+below too so I'll avoid repeating myself & just say that
+some of the instructions have g's on the end of them to indicate
+they are 64 bit & the stack offsets are a bigger,
+the only other difference you'll find between 32 & 64 bit is that
+we now use f4 & f6 for floating point arguments on 64 bit::
+
+  00000000800005b0 <test>:
+  int test(int b)
+  {
+        return(5+b);
+      800005b0: a7 2a 00 05             ahi     %r2,5
+      800005b4: b9 14 00 22             lgfr    %r2,%r2 # downcast to integer
+      800005b8: 07 fe                   br      %r14
+      800005ba: 07 07                   bcr     0,%r7
+
+
+  }
+
+  00000000800005bc <main>:
+  main(int argc,char *argv[])
+  {
+      800005bc: eb bf f0 58 00 24       stmg    %r11,%r15,88(%r15)
+      800005c2: b9 04 00 1f             lgr     %r1,%r15
+      800005c6: a7 fb ff 60             aghi    %r15,-160
+      800005ca: e3 10 f0 00 00 24       stg     %r1,0(%r15)
+        return(test(5));
+      800005d0: a7 29 00 05             lghi    %r2,5
+      # brasl allows jumps > 64k & is overkill here bras would do fune
+      800005d4: c0 e5 ff ff ff ee       brasl   %r14,800005b0 <test>
+      800005da: e3 40 f1 10 00 04       lg      %r4,272(%r15)
+      800005e0: eb bf f0 f8 00 04       lmg     %r11,%r15,248(%r15)
+      800005e6: 07 f4                   br      %r4
+  }
+
+
+
+Compiling programs for debugging on Linux for s/390 & z/Architecture
+====================================================================
+-gdwarf-2 now works it should be considered the default debugging
+format for s/390 & z/Architecture as it is more reliable for debugging
+shared libraries,  normal -g debugging works much better now
+Thanks to the IBM java compiler developers bug reports.
+
+This is typically done adding/appending the flags -g or -gdwarf-2 to the
+CFLAGS & LDFLAGS variables Makefile of the program concerned.
+
+If using gdb & you would like accurate displays of registers &
+stack traces compile without optimisation i.e make sure
+that there is no -O2 or similar on the CFLAGS line of the Makefile &
+the emitted gcc commands, obviously this will produce worse code
+( not advisable for shipment ) but it is an  aid to the debugging process.
+
+This aids debugging because the compiler will copy parameters passed in
+in registers onto the stack so backtracing & looking at passed in
+parameters will work, however some larger programs which use inline functions
+will not compile without optimisation.
+
+Debugging with optimisation has since much improved after fixing
+some bugs, please make sure you are using gdb-5.0 or later developed
+after Nov'2000.
+
+
+
+Debugging under VM
+==================
+
+Notes
+-----
+Addresses & values in the VM debugger are always hex never decimal
+Address ranges are of the format <HexValue1>-<HexValue2> or
+<HexValue1>.<HexValue2>
+For example, the address range  0x2000 to 0x3000 can be described as 2000-3000
+or 2000.1000
+
+The VM Debugger is case insensitive.
+
+VM's strengths are usually other debuggers weaknesses you can get at any
+resource no matter how sensitive e.g. memory management resources, change
+address translation in the PSW. For kernel hacking you will reap dividends if
+you get good at it.
+
+The VM Debugger displays operators but not operands, and also the debugger
+displays useful information on the same line as the author of the code probably
+felt that it was a good idea not to go over the 80 columns on the screen.
+This isn't as unintuitive as it may seem as the s/390 instructions are easy to
+decode mentally and you can make a good guess at a lot of them as all the
+operands are nibble (half byte aligned).
+So if you have an objdump listing by hand, it is quite easy to follow, and if
+you don't have an objdump listing keep a copy of the s/390 Reference Summary
+or alternatively the s/390 principles of operation next to you.
+e.g. even I can guess that
+0001AFF8' LR    180F        CC 0
+is a ( load register ) lr r0,r15
+
+Also it is very easy to tell the length of a 390 instruction from the 2 most
+significant bits in the instruction (not that this info is really useful except
+if you are trying to make sense of a hexdump of code).
+Here is a table
+
+======================= ==================
+Bits                    Instruction Length
+======================= ==================
+00                          2 Bytes
+01                          4 Bytes
+10                          4 Bytes
+11                          6 Bytes
+======================= ==================
+
+The debugger also displays other useful info on the same line such as the
+addresses being operated on destination addresses of branches & condition codes.
+e.g.::
+
+  00019736' AHI   A7DAFF0E    CC 1
+  000198BA' BRC   A7840004 -> 000198C2'   CC 0
+  000198CE' STM   900EF068 >> 0FA95E78    CC 2
+
+
+
+Useful VM debugger commands
+---------------------------
+
+I suppose I'd better mention this before I start
+to list the current active traces do::
+
+        Q TR
+
+there can be a maximum of 255 of these per set
+( more about trace sets later ).
+
+To stop traces issue a::
+
+        TR END.
+
+To delete a particular breakpoint issue::
+
+        TR DEL <breakpoint number>
+
+The PA1 key drops to CP mode so you can issue debugger commands,
+Doing alt c (on my 3270 console at least ) clears the screen.
+
+hitting b <enter> comes back to the running operating system
+from cp mode ( in our case linux ).
+
+It is typically useful to add shortcuts to your profile.exec file
+if you have one ( this is roughly equivalent to autoexec.bat in DOS ).
+file here are a few from mine::
+
+  /* this gives me command history on issuing f12 */
+  set pf12 retrieve
+  /* this continues */
+  set pf8 imm b
+  /* goes to trace set a */
+  set pf1 imm tr goto a
+  /* goes to trace set b */
+  set pf2 imm tr goto b
+  /* goes to trace set c */
+  set pf3 imm tr goto c
+
+
+
+Instruction Tracing
+-------------------
+Setting a simple breakpoint::
+
+        TR I PSWA <address>
+
+To debug a particular function try::
+
+  TR I R <function address range>
+  TR I on its own will single step.
+  TR I DATA <MNEMONIC> <OPTIONAL RANGE> will trace for particular mnemonics
+
+e.g.::
+
+  TR I DATA 4D R 0197BC.4000
+
+will trace for BAS'es ( opcode 4D ) in the range 0197BC.4000
+
+if you were inclined you could add traces for all branch instructions &
+suffix them with the run prefix so you would have a backtrace on screen
+when a program crashes::
+
+        TR BR <INTO OR FROM> will trace branches into or out of an address.
+
+e.g.::
+
+        TR BR INTO 0
+
+is often quite useful if a program is getting awkward & deciding
+to branch to 0 & crashing as this will stop at the address before in jumps to 0.
+
+::
+
+        TR I R <address range> RUN cmd d g
+
+single steps a range of addresses but stays running &
+displays the gprs on each step.
+
+
+
+Displaying & modifying Registers
+--------------------------------
+D G
+        will display all the gprs
+
+Adding a extra G to all the commands is necessary to access the full 64 bit
+content in VM on z/Architecture. Obviously this isn't required for access
+registers as these are still 32 bit.
+
+e.g.
+
+DGG
+        instead of DG
+
+D X
+        will display all the control registers
+D AR
+        will display all the access registers
+D AR4-7
+        will display access registers 4 to 7
+CPU ALL D G
+        will display the GRPS of all CPUS in the configuration
+D PSW
+        will display the current PSW
+st PSW 2000
+        will put the value 2000 into the PSW & cause crash your machine.
+D PREFIX
+        displays the prefix offset
+
+
+Displaying Memory
+-----------------
+To display memory mapped using the current PSW's mapping try::
+
+   D <range>
+
+To make VM display a message each time it hits a particular address and
+continue try:
+
+D I<range>
+        will disassemble/display a range of instructions.
+
+ST addr 32 bit word
+        will store a 32 bit aligned address
+D T<range>
+        will display the EBCDIC in an address (if you are that way inclined)
+D R<range>
+        will display real addresses ( without DAT ) but with prefixing.
+
+There are other complex options to display if you need to get at say home space
+but are in primary space the easiest thing to do is to temporarily
+modify the PSW to the other addressing mode, display the stuff & then
+restore it.
+
+
+
+Hints
+-----
+If you want to issue a debugger command without halting your virtual machine
+with the PA1 key try prefixing the command with #CP e.g.::
+
+        #cp tr i pswa 2000
+
+also suffixing most debugger commands with RUN will cause them not
+to stop just display the mnemonic at the current instruction on the console.
+
+If you have several breakpoints you want to put into your program &
+you get fed up of cross referencing with System.map
+you can do the following trick for several symbols.
+
+::
+
+        grep do_signal System.map
+
+which emits the following among other things::
+
+        0001f4e0 T do_signal
+
+now you can do::
+
+        TR I PSWA 0001f4e0 cmd msg * do_signal
+
+This sends a message to your own console each time do_signal is entered.
+( As an aside I wrote a perl script once which automatically generated a REXX
+script with breakpoints on every kernel procedure, this isn't a good idea
+because there are thousands of these routines & VM can only set 255 breakpoints
+at a time so you nearly had to spend as long pruning the file down as you would
+entering the msgs by hand), however, the trick might be useful for a single
+object file. In the 3270 terminal emulator x3270 there is a very useful option
+in the file menu called "Save Screen In File" - this is very good for keeping a
+copy of traces.
+
+From CMS help <command name> will give you online help on a particular command.
+e.g.::
+
+        HELP DISPLAY
+
+Also CP has a file called profile.exec which automatically gets called
+on startup of CMS ( like autoexec.bat ), keeping on a DOS analogy session
+CP has a feature similar to doskey, it may be useful for you to
+use profile.exec to define some keystrokes.
+
+SET PF9 IMM B
+        This does a single step in VM on pressing F8.
+
+SET PF10  ^
+        This sets up the ^ key.
+        which can be used for ^c (ctrl-c),^z (ctrl-z) which can't be typed
+        directly into some 3270 consoles.
+
+SET PF11 ^-
+        This types the starting keystrokes for a sysrq see SysRq below.
+SET PF12 RETRIEVE
+        This retrieves command history on pressing F12.
+
+
+Sometimes in VM the display is set up to scroll automatically this
+can be very annoying if there are messages you wish to look at
+to stop this do
+
+TERM MORE 255 255
+  This will nearly stop automatic screen updates, however it will
+  cause a denial of service if lots of messages go to the 3270 console,
+  so it would be foolish to use this as the default on a production machine.
+
+
+Tracing particular processes
+----------------------------
+The kernel's text segment is intentionally at an address in memory that it will
+very seldom collide with text segments of user programs ( thanks Martin ),
+this simplifies debugging the kernel.
+However it is quite common for user processes to have addresses which collide
+this can make debugging a particular process under VM painful under normal
+circumstances as the process may change when doing a::
+
+        TR I R <address range>.
+
+Thankfully after reading VM's online help I figured out how to debug
+I particular process.
+
+Your first problem is to find the STD ( segment table designation )
+of the program you wish to debug.
+There are several ways you can do this here are a few
+
+Run::
+
+        objdump --syms <program to be debugged> | grep main
+
+To get the address of main in the program. Then::
+
+        tr i pswa <address of main>
+
+Start the program, if VM drops to CP on what looks like the entry
+point of the main function this is most likely the process you wish to debug.
+Now do a D X13 or D XG13 on z/Architecture.
+
+On 31 bit the STD is bits 1-19 ( the STO segment table origin )
+& 25-31 ( the STL segment table length ) of CR13.
+
+now type::
+
+        TR I R STD <CR13's value> 0.7fffffff
+
+e.g.::
+
+        TR I R STD 8F32E1FF 0.7fffffff
+
+Another very useful variation is::
+
+        TR STORE INTO STD <CR13's value> <address range>
+
+for finding out when a particular variable changes.
+
+An alternative way of finding the STD of a currently running process
+is to do the following, ( this method is more complex but
+could be quite convenient if you aren't updating the kernel much &
+so your kernel structures will stay constant for a reasonable period of
+time ).
+
+::
+
+        grep task /proc/<pid>/status
+
+from this you should see something like::
+
+        task: 0f160000 ksp: 0f161de8 pt_regs: 0f161f68
+
+This now gives you a pointer to the task structure.
+
+Now make::
+
+        CC:="s390-gcc -g" kernel/sched.s
+
+To get the task_struct stabinfo.
+
+( task_struct is defined in include/linux/sched.h ).
+
+Now we want to look at
+task->active_mm->pgd
+
+on my machine the active_mm in the task structure stab is
+active_mm:(4,12),672,32
+
+its offset is 672/8=84=0x54
+
+the pgd member in the mm_struct stab is
+pgd:(4,6)=*(29,5),96,32
+so its offset is 96/8=12=0xc
+
+so we'll::
+
+        hexdump -s 0xf160054 /dev/mem | more
+
+i.e. task_struct+active_mm offset
+to look at the active_mm member::
+
+        f160054 0fee cc60 0019 e334 0000 0000 0000 0011
+
+::
+
+        hexdump -s 0x0feecc6c /dev/mem | more
+
+i.e. active_mm+pgd offset::
+
+        feecc6c 0f2c 0000 0000 0001 0000 0001 0000 0010
+
+we get something like
+now do::
+
+        TR I R STD <pgd|0x7f> 0.7fffffff
+
+i.e. the 0x7f is added because the pgd only
+gives the page table origin & we need to set the low bits
+to the maximum possible segment table length.
+
+::
+
+        TR I R STD 0f2c007f 0.7fffffff
+
+on z/Architecture you'll probably need to do::
+
+        TR I R STD <pgd|0x7> 0.ffffffffffffffff
+
+to set the TableType to 0x1 & the Table length to 3.
+
+
+
+Tracing Program Exceptions
+--------------------------
+If you get a crash which says something like
+illegal operation or specification exception followed by a register dump
+You can restart linux & trace these using the tr prog <range or value> trace
+option.
+
+
+The most common ones you will normally be tracing for is:
+
+- 1=operation exception
+- 2=privileged operation exception
+- 4=protection exception
+- 5=addressing exception
+- 6=specification exception
+- 10=segment translation exception
+- 11=page translation exception
+
+The full list of these is on page 22 of the current s/390 Reference Summary.
+e.g.
+
+tr prog 10 will trace segment translation exceptions.
+
+tr prog on its own will trace all program interruption codes.
+
+Trace Sets
+----------
+On starting VM you are initially in the INITIAL trace set.
+You can do a Q TR to verify this.
+If you have a complex tracing situation where you wish to wait for instance
+till a driver is open before you start tracing IO, but know in your
+heart that you are going to have to make several runs through the code till you
+have a clue whats going on.
+
+What you can do is::
+
+        TR I PSWA <Driver open address>
+
+hit b to continue till breakpoint
+
+reach the breakpoint
+
+now do your::
+
+        TR GOTO B
+        TR IO 7c08-7c09 inst int run
+
+or whatever the IO channels you wish to trace are & hit b
+
+To got back to the initial trace set do::
+
+        TR GOTO INITIAL
+
+& the TR I PSWA <Driver open address> will be the only active breakpoint again.
+
+
+Tracing linux syscalls under VM
+-------------------------------
+Syscalls are implemented on Linux for S390 by the Supervisor call instruction
+(SVC). There 256 possibilities of these as the instruction is made up of a 0xA
+opcode and the second byte being the syscall number. They are traced using the
+simple command::
+
+        TR SVC  <Optional value or range>
+
+the syscalls are defined in linux/arch/s390/include/asm/unistd.h
+e.g. to trace all file opens just do::
+
+        TR SVC 5 ( as this is the syscall number of open )
+
+
+SMP Specific commands
+---------------------
+To find out how many cpus you have
+Q CPUS displays all the CPU's available to your virtual machine
+To find the cpu that the current cpu VM debugger commands are being directed at
+do Q CPU to change the current cpu VM debugger commands are being directed at
+do::
+
+        CPU <desired cpu no>
+
+On a SMP guest issue a command to all CPUs try prefixing the command with cpu
+all. To issue a command to a particular cpu try cpu <cpu number> e.g.::
+
+        CPU 01 TR I R 2000.3000
+
+If you are running on a guest with several cpus & you have a IO related problem
+& cannot follow the flow of code but you know it isn't smp related.
+
+from the bash prompt issue::
+
+        shutdown -h now or halt.
+
+do a::
+
+        Q CPUS
+
+to find out how many cpus you have detach each one of them from cp except
+cpu 0 by issuing a::
+
+        DETACH CPU 01-(number of cpus in configuration)
+
+& boot linux again.
+
+TR SIGP
+        will trace inter processor signal processor instructions.
+
+DEFINE CPU 01-(number in configuration)
+        will get your guests cpus back.
+
+
+Help for displaying ascii textstrings
+-------------------------------------
+On the very latest VM Nucleus'es VM can now display ascii
+( thanks Neale for the hint ) by doing::
+
+        D TX<lowaddr>.<len>
+
+e.g.::
+
+        D TX0.100
+
+Alternatively
+=============
+Under older VM debuggers (I love EBDIC too) you can use following little
+program which converts a command line of hex digits to ascii text. It can be
+compiled under linux and you can copy the hex digits from your x3270 terminal
+to your xterm if you are debugging from a linuxbox.
+
+This is quite useful when looking at a parameter passed in as a text string
+under VM ( unless you are good at decoding ASCII in your head ).
+
+e.g. consider tracing an open syscall::
+
+        TR SVC 5
+
+We have stopped at a breakpoint::
+
+        000151B0' SVC   0A05     -> 0001909A'   CC 0
+
+D 20.8 to check the SVC old psw in the prefix area and see was it from userspace
+(for the layout of the prefix area consult the "Fixed Storage Locations"
+chapter of the s/390 Reference Summary if you have it available).
+
+::
+
+  V00000020  070C2000 800151B2
+
+The problem state bit wasn't set &  it's also too early in the boot sequence
+for it to be a userspace SVC if it was we would have to temporarily switch the
+psw to user space addressing so we could get at the first parameter of the open
+in gpr2.
+
+Next do a::
+
+        D G2
+        GPR  2 =  00014CB4
+
+Now display what gpr2 is pointing to::
+
+        D 00014CB4.20
+        V00014CB4  2F646576 2F636F6E 736F6C65 00001BF5
+        V00014CC4  FC00014C B4001001 E0001000 B8070707
+
+Now copy the text till the first 00 hex ( which is the end of the string
+to an xterm & do hex2ascii on it::
+
+        hex2ascii 2F646576 2F636F6E 736F6C65 00
+
+outputs::
+
+        Decoded Hex:=/ d e v / c o n s o l e 0x00
+
+We were opening the console device,
+
+You can compile the code below yourself for practice :-),
+
+::
+
+  /*
+   *    hex2ascii.c
+   *    a useful little tool for converting a hexadecimal command line to ascii
+   *
+   *    Author(s): Denis Joseph Barrow (djbarrow@de.ibm.com,barrow_dj@yahoo.com)
+   *    (C) 2000 IBM Deutschland Entwicklung GmbH, IBM Corporation.
+   */
+  #include <stdio.h>
+
+  int main(int argc,char *argv[])
+  {
+    int cnt1,cnt2,len,toggle=0;
+    int startcnt=1;
+    unsigned char c,hex;
+
+    if(argc>1&&(strcmp(argv[1],"-a")==0))
+       startcnt=2;
+    printf("Decoded Hex:=");
+    for(cnt1=startcnt;cnt1<argc;cnt1++)
+    {
+      len=strlen(argv[cnt1]);
+      for(cnt2=0;cnt2<len;cnt2++)
+      {
+         c=argv[cnt1][cnt2];
+         if(c>='0'&&c<='9')
+          c=c-'0';
+         if(c>='A'&&c<='F')
+          c=c-'A'+10;
+         if(c>='a'&&c<='f')
+          c=c-'a'+10;
+         switch(toggle)
+         {
+          case 0:
+             hex=c<<4;
+             toggle=1;
+          break;
+          case 1:
+             hex+=c;
+             if(hex<32||hex>127)
+             {
+                if(startcnt==1)
+                   printf("0x%02X ",(int)hex);
+                else
+                   printf(".");
+             }
+             else
+             {
+               printf("%c",hex);
+               if(startcnt==1)
+                  printf(" ");
+             }
+             toggle=0;
+          break;
+         }
+      }
+    }
+    printf("\n");
+  }
+
+
+
+
+Stack tracing under VM
+----------------------
+A basic backtrace
+-----------------
+
+Here are the tricks I use 9 out of 10 times it works pretty well,
+
+When your backchain reaches a dead end
+--------------------------------------
+This can happen when an exception happens in the kernel and the kernel is
+entered twice. If you reach the NULL pointer at the end of the back chain you
+should be able to sniff further back if you follow the following tricks.
+1) A kernel address should be easy to recognise since it is in
+primary space & the problem state bit isn't set & also
+The Hi bit of the address is set.
+2) Another backchain should also be easy to recognise since it is an
+address pointing to another address approximately 100 bytes or 0x70 hex
+behind the current stackpointer.
+
+
+Here is some practice.
+
+boot the kernel & hit PA1 at some random time
+
+d g to display the gprs, this should display something like::
+
+  GPR  0 =  00000001  00156018  0014359C  00000000
+  GPR  4 =  00000001  001B8888  000003E0  00000000
+  GPR  8 =  00100080  00100084  00000000  000FE000
+  GPR 12 =  00010400  8001B2DC  8001B36A  000FFED8
+
+Note that GPR14 is a return address but as we are real men we are going to
+trace the stack.
+display 0x40 bytes after the stack pointer::
+
+  V000FFED8  000FFF38 8001B838 80014C8E 000FFF38
+  V000FFEE8  00000000 00000000 000003E0 00000000
+  V000FFEF8  00100080 00100084 00000000 000FE000
+  V000FFF08  00010400 8001B2DC 8001B36A 000FFED8
+
+
+Ah now look at whats in sp+56 (sp+0x38) this is 8001B36A our saved r14 if
+you look above at our stackframe & also agrees with GPR14.
+
+now backchain::
+
+        d 000FFF38.40
+
+we now are taking the contents of SP to get our first backchain::
+
+  V000FFF38  000FFFA0 00000000 00014995 00147094
+  V000FFF48  00147090 001470A0 000003E0 00000000
+  V000FFF58  00100080 00100084 00000000 001BF1D0
+  V000FFF68  00010400 800149BA 80014CA6 000FFF38
+
+This displays a 2nd return address of 80014CA6
+
+now do::
+
+        d 000FFFA0.40
+
+for our 3rd backchain::
+
+  V000FFFA0  04B52002 0001107F 00000000 00000000
+  V000FFFB0  00000000 00000000 FF000000 0001107F
+  V000FFFC0  00000000 00000000 00000000 00000000
+  V000FFFD0  00010400 80010802 8001085A 000FFFA0
+
+
+our 3rd return address is 8001085A
+
+as the 04B52002 looks suspiciously like rubbish it is fair to assume that the
+kernel entry routines for the sake of optimisation don't set up a backchain.
+
+now look at System.map to see if the addresses make any sense::
+
+        grep -i 0001b3 System.map
+
+outputs among other things::
+
+        0001b304 T cpu_idle
+
+so 8001B36A
+is cpu_idle+0x66 ( quiet the cpu is asleep, don't wake it )
+
+::
+
+        grep -i 00014 System.map
+
+produces among other things::
+
+        00014a78 T start_kernel
+
+so 0014CA6 is start_kernel+some hex number I can't add in my head.
+
+::
+
+        grep -i 00108 System.map
+
+this produces::
+
+        00010800 T _stext
+
+so   8001085A is _stext+0x5a
+
+Congrats you've done your first backchain.
+
+
+
+s/390 & z/Architecture IO Overview
+==================================
+
+I am not going to give a course in 390 IO architecture as this would take me
+quite a while and I'm no expert. Instead I'll give a 390 IO architecture
+summary for Dummies. If you have the s/390 principles of operation available
+read this instead. If nothing else you may find a few useful keywords in here
+and be able to use them on a web search engine to find more useful information.
+
+Unlike other bus architectures modern 390 systems do their IO using mostly
+fibre optics and devices such as tapes and disks can be shared between several
+mainframes. Also S390 can support up to 65536 devices while a high end PC based
+system might be choking with around 64.
+
+Here is some of the common IO terminology:
+
+Subchannel:
+  This is the logical number most IO commands use to talk to an IO device. There
+  can be up to 0x10000 (65536) of these in a configuration, typically there are a
+  few hundred. Under VM for simplicity they are allocated contiguously, however
+  on the native hardware they are not. They typically stay consistent between
+  boots provided no new hardware is inserted or removed.
+
+  Under Linux for s390 we use these as IRQ's and also when issuing an IO command
+  (CLEAR SUBCHANNEL, HALT SUBCHANNEL, MODIFY SUBCHANNEL, RESUME SUBCHANNEL,
+  START SUBCHANNEL, STORE SUBCHANNEL and TEST SUBCHANNEL). We use this as the ID
+  of the device we wish to talk to. The most important of these instructions are
+  START SUBCHANNEL (to start IO), TEST SUBCHANNEL (to check whether the IO
+  completed successfully) and HALT SUBCHANNEL (to kill IO). A subchannel can have
+  up to 8 channel paths to a device, this offers redundancy if one is not
+  available.
+
+Device Number:
+  This number remains static and is closely tied to the hardware. There are 65536
+  of these, made up of a CHPID (Channel Path ID, the most significant 8 bits) and
+  another lsb 8 bits. These remain static even if more devices are inserted or
+  removed from the hardware. There is a 1 to 1 mapping between subchannels and
+  device numbers, provided devices aren't inserted or removed.
+
+Channel Control Words:
+  CCWs are linked lists of instructions initially pointed to by an operation
+  request block (ORB), which is initially given to Start Subchannel (SSCH)
+  command along with the subchannel number for the IO subsystem to process
+  while the CPU continues executing normal code.
+  CCWs come in two flavours, Format 0 (24 bit for backward compatibility) and
+  Format 1 (31 bit). These are typically used to issue read and write (and many
+  other) instructions. They consist of a length field and an absolute address
+  field.
+
+  Each IO typically gets 1 or 2 interrupts, one for channel end (primary status)
+  when the channel is idle, and the second for device end (secondary status).
+  Sometimes you get both concurrently. You check how the IO went on by issuing a
+  TEST SUBCHANNEL at each interrupt, from which you receive an Interruption
+  response block (IRB). If you get channel and device end status in the IRB
+  without channel checks etc. your IO probably went okay. If you didn't you
+  probably need to examine the IRB, extended status word etc.
+  If an error occurs, more sophisticated control units have a facility known as
+  concurrent sense. This means that if an error occurs Extended sense information
+  will be presented in the Extended status word in the IRB. If not you have to
+  issue a subsequent SENSE CCW command after the test subchannel.
+
+
+TPI (Test pending interrupt) can also be used for polled IO, but in
+multitasking multiprocessor systems it isn't recommended except for
+checking special cases (i.e. non looping checks for pending IO etc.).
+
+Store Subchannel and Modify Subchannel can be used to examine and modify
+operating characteristics of a subchannel (e.g. channel paths).
+
+Other IO related Terms:
+
+Sysplex:
+  S390's Clustering Technology
+QDIO:
+  S390's new high speed IO architecture to support devices such as gigabit
+  ethernet, this architecture is also designed to be forward compatible with
+  upcoming 64 bit machines.
+
+
+General Concepts
+----------------
+
+Input Output Processors (IOP's) are responsible for communicating between
+the mainframe CPU's & the channel & relieve the mainframe CPU's from the
+burden of communicating with IO devices directly, this allows the CPU's to
+concentrate on data processing.
+
+IOP's can use one or more links ( known as channel paths ) to talk to each
+IO device. It first checks for path availability & chooses an available one,
+then starts ( & sometimes terminates IO ).
+There are two types of channel path: ESCON & the Parallel IO interface.
+
+IO devices are attached to control units, control units provide the
+logic to interface the channel paths & channel path IO protocols to
+the IO devices, they can be integrated with the devices or housed separately
+& often talk to several similar devices ( typical examples would be raid
+controllers or a control unit which connects to 1000 3270 terminals )::
+
+
+      +---------------------------------------------------------------+
+      | +-----+ +-----+ +-----+ +-----+  +----------+  +----------+   |
+      | | CPU | | CPU | | CPU | | CPU |  |  Main    |  | Expanded |   |
+      | |     | |     | |     | |     |  |  Memory  |  |  Storage |   |
+      | +-----+ +-----+ +-----+ +-----+  +----------+  +----------+   |
+      |---------------------------------------------------------------+
+      |   IOP        |      IOP      |       IOP                      |
+      |---------------------------------------------------------------
+      | C | C | C | C | C | C | C | C | C | C | C | C | C | C | C | C |
+      ----------------------------------------------------------------
+           ||                                              ||
+           ||  Bus & Tag Channel Path                      || ESCON
+           ||  ======================                      || Channel
+           ||  ||                  ||                      || Path
+      +----------+               +----------+         +----------+
+      |          |               |          |         |          |
+      |    CU    |               |    CU    |         |    CU    |
+      |          |               |          |         |          |
+      +----------+               +----------+         +----------+
+         |      |                     |                |       |
+  +----------+ +----------+      +----------+   +----------+ +----------+
+  |I/O Device| |I/O Device|      |I/O Device|   |I/O Device| |I/O Device|
+  +----------+ +----------+      +----------+   +----------+ +----------+
+    CPU = Central Processing Unit
+    C = Channel
+    IOP = IP Processor
+    CU = Control Unit
+
+The 390 IO systems come in 2 flavours the current 390 machines support both
+
+The Older 360 & 370 Interface,sometimes called the Parallel I/O interface,
+sometimes called Bus-and Tag & sometimes Original Equipment Manufacturers
+Interface (OEMI).
+
+This byte wide Parallel channel path/bus has parity & data on the "Bus" cable
+and control lines on the "Tag" cable. These can operate in byte multiplex mode
+for sharing between several slow devices or burst mode and monopolize the
+channel for the whole burst. Up to 256 devices can be addressed on one of these
+cables. These cables are about one inch in diameter. The maximum unextended
+length supported by these cables is 125 Meters but this can be extended up to
+2km with a fibre optic channel extended such as a 3044. The maximum burst speed
+supported is 4.5 megabytes per second. However, some really old processors
+support only transfer rates of 3.0, 2.0 & 1.0 MB/sec.
+One of these paths can be daisy chained to up to 8 control units.
+
+
+ESCON if fibre optic it is also called FICON
+Was introduced by IBM in 1990. Has 2 fibre optic cables and uses either leds or
+lasers for communication at a signaling rate of up to 200 megabits/sec. As
+10bits are transferred for every 8 bits info this drops to 160 megabits/sec
+and to 18.6 Megabytes/sec once control info and CRC are added. ESCON only
+operates in burst mode.
+
+ESCONs typical max cable length is 3km for the led version and 20km for the
+laser version known as XDF (extended distance facility). This can be further
+extended by using an ESCON director which triples the above mentioned ranges.
+Unlike Bus & Tag as ESCON is serial it uses a packet switching architecture,
+the standard Bus & Tag control protocol is however present within the packets.
+Up to 256 devices can be attached to each control unit that uses one of these
+interfaces.
+
+Common 390 Devices include:
+Network adapters typically OSA2,3172's,2116's & OSA-E gigabit ethernet adapters,
+Consoles 3270 & 3215 (a teletype emulated under linux for a line mode console).
+DASD's direct access storage devices ( otherwise known as hard disks ).
+Tape Drives.
+CTC ( Channel to Channel Adapters ),
+ESCON or Parallel Cables used as a very high speed serial link
+between 2 machines.
+
+
+Debugging IO on s/390 & z/Architecture under VM
+===============================================
+
+Now we are ready to go on with IO tracing commands under VM
+
+A few self explanatory queries::
+
+        Q OSA
+        Q CTC
+        Q DISK ( This command is CMS specific )
+        Q DASD
+
+Q OSA on my machine returns::
+
+        OSA  7C08 ON OSA   7C08 SUBCHANNEL = 0000
+        OSA  7C09 ON OSA   7C09 SUBCHANNEL = 0001
+        OSA  7C14 ON OSA   7C14 SUBCHANNEL = 0002
+        OSA  7C15 ON OSA   7C15 SUBCHANNEL = 0003
+
+If you have a guest with certain privileges you may be able to see devices
+which don't belong to you. To avoid this, add the option V.
+e.g.::
+
+        Q V OSA
+
+Now using the device numbers returned by this command we will
+Trace the io starting up on the first device 7c08 & 7c09
+In our simplest case we can trace the
+start subchannels
+like TR SSCH 7C08-7C09
+or the halt subchannels
+or TR HSCH 7C08-7C09
+MSCH's ,STSCH's I think you can guess the rest
+
+A good trick is tracing all the IO's and CCWS and spooling them into the reader
+of another VM guest so he can ftp the logfile back to his own machine. I'll do
+a small bit of this and give you a look at the output.
+
+1) Spool stdout to VM reader::
+
+        SP PRT TO (another vm guest ) or * for the local vm guest
+
+2) Fill the reader with the trace::
+
+        TR IO 7c08-7c09 INST INT CCW PRT RUN
+
+3) Start up linux::
+
+        i 00c
+4) Finish the trace::
+
+        TR END
+
+5) close the reader::
+
+        C PRT
+
+6) list reader contents::
+
+        RDRLIST
+
+7) copy it to linux4's minidisk::
+
+        RECEIVE / LOG TXT A1 ( replace
+
+8)
+filel & press F11 to look at it
+You should see something like::
+
+  00020942' SSCH  B2334000    0048813C    CC 0    SCH 0000    DEV 7C08
+            CPA 000FFDF0   PARM 00E2C9C4    KEY 0  FPI C0  LPM 80
+            CCW    000FFDF0  E4200100 00487FE8   0000  E4240100 ........
+            IDAL                                      43D8AFE8
+            IDAL                                      0FB76000
+  00020B0A'   I/O DEV 7C08 -> 000197BC'   SCH 0000   PARM 00E2C9C4
+  00021628' TSCH  B2354000 >> 00488164    CC 0    SCH 0000    DEV 7C08
+            CCWA 000FFDF8   DEV STS 0C  SCH STS 00  CNT 00EC
+             KEY 0   FPI C0  CC 0   CTLS 4007
+  00022238' STSCH B2344000 >> 00488108    CC 0    SCH 0000    DEV 7C08
+
+If you don't like messing up your readed ( because you possibly booted from it )
+you can alternatively spool it to another readers guest.
+
+
+Other common VM device related commands
+---------------------------------------------
+These commands are listed only because they have
+been of use to me in the past & may be of use to
+you too. For more complete info on each of the commands
+use type HELP <command> from CMS.
+
+detaching devices::
+
+        DET <devno range>
+        ATT <devno range> <guest>
+
+attach a device to guest * for your own guest
+
+READY <devno>
+        cause VM to issue a fake interrupt.
+
+The VARY command is normally only available to VM administrators::
+
+        VARY ON PATH <path> TO <devno range>
+        VARY OFF PATH <PATH> FROM <devno range>
+
+This is used to switch on or off channel paths to devices.
+
+Q CHPID <channel path ID>
+   This displays state of devices using this channel path
+
+D SCHIB <subchannel>
+   This displays the subchannel information SCHIB block for the device.
+   this I believe is also only available to administrators.
+
+DEFINE CTC <devno>
+  defines a virtual CTC channel to channel connection
+  2 need to be defined on each guest for the CTC driver to use.
+
+COUPLE  devno userid remote devno
+  Joins a local virtual device to a remote virtual device
+  ( commonly used for the CTC driver ).
+
+Building a VM ramdisk under CMS which linux can use::
+
+        def vfb-<blocksize> <subchannel> <number blocks>
+
+blocksize is commonly 4096 for linux.
+
+Formatting it::
+
+        format <subchannel> <driver letter e.g. x> (blksize <blocksize>
+
+Sharing a disk between multiple guests::
+
+        LINK userid devno1 devno2 mode password
+
+
+
+GDB on S390
+===========
+N.B. if compiling for debugging gdb works better without optimisation
+( see Compiling programs for debugging )
+
+invocation
+----------
+gdb <victim program> <optional corefile>
+
+Online help
+-----------
+help: gives help on commands
+
+e.g.::
+
+        help
+        help display
+
+Note gdb's online help is very good use it.
+
+
+Assembly
+--------
+info registers:
+  displays registers other than floating point.
+
+info all-registers:
+  displays floating points as well.
+
+disassemble:
+  disassembles
+
+e.g.::
+
+        disassemble without parameters will disassemble the current function
+        disassemble $pc $pc+10
+
+Viewing & modifying variables
+-----------------------------
+print or p:
+  displays variable or register
+
+e.g. p/x $sp will display the stack pointer
+
+display:
+  prints variable or register each time program stops
+
+e.g.::
+
+        display/x $pc will display the program counter
+        display argc
+
+undisplay:
+  undo's display's
+
+info breakpoints:
+  shows all current breakpoints
+
+info stack:
+  shows stack back trace (if this doesn't work too well, I'll show
+  you the stacktrace by hand below).
+
+info locals:
+  displays local variables.
+
+info args:
+  display current procedure arguments.
+
+set args:
+  will set argc & argv each time the victim program is invoked
+
+e.g.::
+
+        set <variable>=value
+        set argc=100
+        set $pc=0
+
+
+
+Modifying execution
+-------------------
+step:
+  steps n lines of sourcecode
+
+step
+  steps 1 line.
+
+step 100
+  steps 100 lines of code.
+
+next:
+        like step except this will not step into subroutines
+
+stepi:
+        steps a single machine code instruction.
+
+e.g.::
+
+        stepi 100
+
+nexti:
+        steps a single machine code instruction but will not step into
+        subroutines.
+
+finish:
+        will run until exit of the current routine
+
+run:
+        (re)starts a program
+
+cont:
+        continues a program
+
+quit:
+        exits gdb.
+
+
+breakpoints
+------------
+
+break
+  sets a breakpoint
+
+e.g.::
+
+        break main
+        break *$pc
+        break *0x400618
+
+Here's a really useful one for large programs
+
+rbr
+        Set a breakpoint for all functions matching REGEXP
+
+e.g.::
+
+        rbr 390
+
+will set a breakpoint with all functions with 390 in their name.
+
+info breakpoints
+        lists all breakpoints
+
+delete:
+        delete breakpoint by number or delete them all
+
+e.g.
+
+delete 1
+        will delete the first breakpoint
+
+
+delete
+        will delete them all
+
+watch:
+        This will set a watchpoint ( usually hardware assisted ),
+
+This will watch a variable till it changes
+
+e.g.
+
+watch cnt
+        will watch the variable cnt till it changes.
+
+As an aside unfortunately gdb's, architecture independent watchpoint code
+is inconsistent & not very good, watchpoints usually work but not always.
+
+info watchpoints:
+        Display currently active watchpoints
+
+condition: ( another useful one )
+        Specify breakpoint number N to break only if COND is true.
+
+Usage is `condition N COND`, where N is an integer and COND is an
+expression to be evaluated whenever breakpoint N is reached.
+
+
+
+User defined functions/macros
+-----------------------------
+define: ( Note this is very very useful,simple & powerful )
+
+usage define <name> <list of commands> end
+
+examples which you should consider putting into .gdbinit in your home
+directory::
+
+        define d
+        stepi
+        disassemble $pc $pc+10
+        end
+        define e
+        nexti
+        disassemble $pc $pc+10
+        end
+
+
+Other hard to classify stuff
+----------------------------
+signal n:
+   sends the victim program a signal.
+
+e.g. `signal 3` will send a SIGQUIT.
+
+info signals:
+        what gdb does when the victim receives certain signals.
+
+list:
+
+e.g.:
+
+list
+        lists current function source
+list 1,10
+        list first 10 lines of current file.
+
+list test.c:1,10
+
+
+directory:
+  Adds directories to be searched for source if gdb cannot find the source.
+  (note it is a bit sensitive about slashes)
+
+e.g. To add the root of the filesystem to the searchpath do::
+
+        directory //
+
+
+call <function>
+This calls a function in the victim program, this is pretty powerful
+e.g.
+(gdb) call printf("hello world")
+outputs:
+$1 = 11
+
+You might now be thinking that the line above didn't work, something extra had
+to be done.
+(gdb) call fflush(stdout)
+hello world$2 = 0
+As an aside the debugger also calls malloc & free under the hood
+to make space for the "hello world" string.
+
+
+
+hints
+-----
+1) command completion works just like bash
+   ( if you are a bad typist like me this really helps )
+
+e.g. hit br <TAB> & cursor up & down :-).
+
+2) if you have a debugging problem that takes a few steps to recreate
+put the steps into a file called .gdbinit in your current working directory
+if you have defined a few extra useful user defined commands put these in
+your home directory & they will be read each time gdb is launched.
+
+A typical .gdbinit file might be.::
+
+        break main
+        run
+        break runtime_exception
+        cont
+
+
+stack chaining in gdb by hand
+-----------------------------
+This is done using a the same trick described for VM::
+
+        p/x (*($sp+56))&0x7fffffff
+
+get the first backchain.
+
+For z/Architecture
+Replace 56 with 112 & ignore the &0x7fffffff
+in the macros below & do nasty casts to longs like the following
+as gdb unfortunately deals with printed arguments as ints which
+messes up everything.
+
+i.e. here is a 3rd backchain dereference::
+
+        p/x *(long *)(***(long ***)$sp+112)
+
+
+this outputs::
+
+        $5 = 0x528f18
+
+on my machine.
+
+Now you can use::
+
+        info symbol (*($sp+56))&0x7fffffff
+
+you might see something like::
+
+        rl_getc + 36 in section .text
+
+telling you what is located at address 0x528f18
+Now do::
+
+        p/x (*(*$sp+56))&0x7fffffff
+
+This outputs::
+
+        $6 = 0x528ed0
+
+Now do::
+
+        info symbol (*(*$sp+56))&0x7fffffff
+        rl_read_key + 180 in section .text
+
+now do::
+
+        p/x (*(**$sp+56))&0x7fffffff
+
+& so on.
+
+Disassembling instructions without debug info
+---------------------------------------------
+gdb typically complains if there is a lack of debugging
+symbols in the disassemble command with
+"No function contains specified address." To get around
+this do::
+
+        x/<number lines to disassemble>xi <address>
+
+e.g.::
+
+        x/20xi 0x400730
+
+
+
+Note:
+  Remember gdb has history just like bash you don't need to retype the
+  whole line just use the up & down arrows.
+
+
+
+For more info
+-------------
+From your linuxbox do::
+
+        man gdb
+
+or::
+
+        info gdb.
+
+core dumps
+----------
+
+What a core dump ?
+^^^^^^^^^^^^^^^^^^
+
+A core dump is a file generated by the kernel (if allowed) which contains the
+registers and all active pages of the program which has crashed.
+
+From this file gdb will allow you to look at the registers, stack trace and
+memory of the program as if it just crashed on your system. It is usually
+called core and created in the current working directory.
+
+This is very useful in that a customer can mail a core dump to a technical
+support department and the technical support department can reconstruct what
+happened. Provided they have an identical copy of this program with debugging
+symbols compiled in and the source base of this build is available.
+
+In short it is far more useful than something like a crash log could ever hope
+to be.
+
+Why have I never seen one ?
+^^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+Probably because you haven't used the command::
+
+        ulimit -c unlimited in bash
+
+to allow core dumps, now do::
+
+        ulimit -a
+
+to verify that the limit was accepted.
+
+A sample core dump
+   To create this I'm going to do::
+
+        ulimit -c unlimited
+        gdb
+
+to launch gdb (my victim app. ) now be bad & do the following from another
+telnet/xterm session to the same machine::
+
+        ps -aux | grep gdb
+        kill -SIGSEGV <gdb's pid>
+
+or alternatively use `killall -SIGSEGV gdb` if you have the killall command.
+
+Now look at the core dump::
+
+        ./gdb core
+
+Displays the following::
+
+  GNU gdb 4.18
+  Copyright 1998 Free Software Foundation, Inc.
+  GDB is free software, covered by the GNU General Public License, and you are
+  welcome to change it and/or distribute copies of it under certain conditions.
+  Type "show copying" to see the conditions.
+  There is absolutely no warranty for GDB.  Type "show warranty" for details.
+  This GDB was configured as "s390-ibm-linux"...
+  Core was generated by `./gdb'.
+  Program terminated with signal 11, Segmentation fault.
+  Reading symbols from /usr/lib/libncurses.so.4...done.
+  Reading symbols from /lib/libm.so.6...done.
+  Reading symbols from /lib/libc.so.6...done.
+  Reading symbols from /lib/ld-linux.so.2...done.
+  #0  0x40126d1a in read () from /lib/libc.so.6
+  Setting up the environment for debugging gdb.
+  Breakpoint 1 at 0x4dc6f8: file utils.c, line 471.
+  Breakpoint 2 at 0x4d87a4: file top.c, line 2609.
+  (top-gdb) info stack
+  #0  0x40126d1a in read () from /lib/libc.so.6
+  #1  0x528f26 in rl_getc (stream=0x7ffffde8) at input.c:402
+  #2  0x528ed0 in rl_read_key () at input.c:381
+  #3  0x5167e6 in readline_internal_char () at readline.c:454
+  #4  0x5168ee in readline_internal_charloop () at readline.c:507
+  #5  0x51692c in readline_internal () at readline.c:521
+  #6  0x5164fe in readline (prompt=0x7ffff810)
+      at readline.c:349
+  #7  0x4d7a8a in command_line_input (prompt=0x564420 "(gdb) ", repeat=1,
+      annotation_suffix=0x4d6b44 "prompt") at top.c:2091
+  #8  0x4d6cf0 in command_loop () at top.c:1345
+  #9  0x4e25bc in main (argc=1, argv=0x7ffffdf4) at main.c:635
+
+
+LDD
+===
+This is a program which lists the shared libraries which a library needs,
+Note you also get the relocations of the shared library text segments which
+help when using objdump --source.
+
+e.g.::
+
+        ldd ./gdb
+
+outputs::
+
+  libncurses.so.4 => /usr/lib/libncurses.so.4 (0x40018000)
+  libm.so.6 => /lib/libm.so.6 (0x4005e000)
+  libc.so.6 => /lib/libc.so.6 (0x40084000)
+  /lib/ld-linux.so.2 => /lib/ld-linux.so.2 (0x40000000)
+
+
+Debugging shared libraries
+==========================
+Most programs use shared libraries, however it can be very painful
+when you single step instruction into a function like printf for the
+first time & you end up in functions like _dl_runtime_resolve this is
+the ld.so doing lazy binding, lazy binding is a concept in ELF where
+shared library functions are not loaded into memory unless they are
+actually used, great for saving memory but a pain to debug.
+
+To get around this either relink the program -static or exit gdb type
+export LD_BIND_NOW=true this will stop lazy binding & restart the gdb'ing
+the program in question.
+
+
+
+Debugging modules
+=================
+As modules are dynamically loaded into the kernel their address can be
+anywhere to get around this use the -m option with insmod to emit a load
+map which can be piped into a file if required.
+
+The proc file system
+====================
+What is it ?.
+It is a filesystem created by the kernel with files which are created on demand
+by the kernel if read, or can be used to modify kernel parameters,
+it is a powerful concept.
+
+e.g.::
+
+        cat /proc/sys/net/ipv4/ip_forward
+
+On my machine outputs::
+
+        0
+
+telling me ip_forwarding is not on to switch it on I can do::
+
+        echo 1 >  /proc/sys/net/ipv4/ip_forward
+
+cat it again::
+
+        cat /proc/sys/net/ipv4/ip_forward
+
+On my machine now outputs::
+
+        1
+
+IP forwarding is on.
+
+There is a lot of useful info in here best found by going in and having a look
+around, so I'll take you through some entries I consider important.
+
+All the processes running on the machine have their own entry defined by
+/proc/<pid>
+
+So lets have a look at the init process::
+
+        cd /proc/1
+        cat cmdline
+
+emits::
+
+        init [2]
+
+::
+
+        cd /proc/1/fd
+
+This contains numerical entries of all the open files,
+some of these you can cat e.g. stdout (2)::
+
+        cat /proc/29/maps
+
+on my machine emits::
+
+  00400000-00478000 r-xp 00000000 5f:00 4103       /bin/bash
+  00478000-0047e000 rw-p 00077000 5f:00 4103       /bin/bash
+  0047e000-00492000 rwxp 00000000 00:00 0
+  40000000-40015000 r-xp 00000000 5f:00 14382      /lib/ld-2.1.2.so
+  40015000-40016000 rw-p 00014000 5f:00 14382      /lib/ld-2.1.2.so
+  40016000-40017000 rwxp 00000000 00:00 0
+  40017000-40018000 rw-p 00000000 00:00 0
+  40018000-4001b000 r-xp 00000000 5f:00 14435      /lib/libtermcap.so.2.0.8
+  4001b000-4001c000 rw-p 00002000 5f:00 14435      /lib/libtermcap.so.2.0.8
+  4001c000-4010d000 r-xp 00000000 5f:00 14387      /lib/libc-2.1.2.so
+  4010d000-40111000 rw-p 000f0000 5f:00 14387      /lib/libc-2.1.2.so
+  40111000-40114000 rw-p 00000000 00:00 0
+  40114000-4011e000 r-xp 00000000 5f:00 14408      /lib/libnss_files-2.1.2.so
+  4011e000-4011f000 rw-p 00009000 5f:00 14408      /lib/libnss_files-2.1.2.so
+  7fffd000-80000000 rwxp ffffe000 00:00 0
+
+
+Showing us the shared libraries init uses where they are in memory
+& memory access permissions for each virtual memory area.
+
+/proc/1/cwd is a softlink to the current working directory.
+
+/proc/1/root is the root of the filesystem for this process.
+
+/proc/1/mem is the current running processes memory which you
+can read & write to like a file.
+
+strace uses this sometimes as it is a bit faster than the
+rather inefficient ptrace interface for peeking at DATA.
+
+::
+
+  cat status
+
+  Name:   init
+  State:  S (sleeping)
+  Pid:    1
+  PPid:   0
+  Uid:    0       0       0       0
+  Gid:    0       0       0       0
+  Groups:
+  VmSize:      408 kB
+  VmLck:         0 kB
+  VmRSS:       208 kB
+  VmData:       24 kB
+  VmStk:         8 kB
+  VmExe:       368 kB
+  VmLib:         0 kB
+  SigPnd: 0000000000000000
+  SigBlk: 0000000000000000
+  SigIgn: 7fffffffd7f0d8fc
+  SigCgt: 00000000280b2603
+  CapInh: 00000000fffffeff
+  CapPrm: 00000000ffffffff
+  CapEff: 00000000fffffeff
+
+  User PSW:    070de000 80414146
+  task: 004b6000 tss: 004b62d8 ksp: 004b7ca8 pt_regs: 004b7f68
+  User GPRS:
+  00000400  00000000  0000000b  7ffffa90
+  00000000  00000000  00000000  0045d9f4
+  0045cafc  7ffffa90  7fffff18  0045cb08
+  00010400  804039e8  80403af8  7ffff8b0
+  User ACRS:
+  00000000  00000000  00000000  00000000
+  00000001  00000000  00000000  00000000
+  00000000  00000000  00000000  00000000
+  00000000  00000000  00000000  00000000
+  Kernel BackChain  CallChain    BackChain  CallChain
+         004b7ca8   8002bd0c     004b7d18   8002b92c
+         004b7db8   8005cd50     004b7e38   8005d12a
+         004b7f08   80019114
+
+Showing among other things memory usage & status of some signals &
+the processes'es registers from the kernel task_structure
+as well as a backchain which may be useful if a process crashes
+in the kernel for some unknown reason.
+
+Some driver debugging techniques
+================================
+debug feature
+-------------
+Some of our drivers now support a "debug feature" in
+/proc/s390dbf see s390dbf.txt in the linux/Documentation directory
+for more info.
+
+e.g.
+to switch on the lcs "debug feature"::
+
+        echo 5 > /proc/s390dbf/lcs/level
+
+& then after the error occurred::
+
+        cat /proc/s390dbf/lcs/sprintf >/logfile
+
+the logfile now contains some information which may help
+tech support resolve a problem in the field.
+
+
+
+high level debugging network drivers
+------------------------------------
+ifconfig is a quite useful command
+it gives the current state of network drivers.
+
+If you suspect your network device driver is dead
+one way to check is type::
+
+        ifconfig <network device>
+
+e.g. tr0
+
+You should see something like::
+
+        ifconfig tr0
+        tr0      Link encap:16/4 Mbps Token Ring (New)  HWaddr 00:04:AC:20:8E:48
+                inet addr:9.164.185.132  Bcast:9.164.191.255  Mask:255.255.224.0
+                UP BROADCAST RUNNING MULTICAST  MTU:2000  Metric:1
+                RX packets:246134 errors:0 dropped:0 overruns:0 frame:0
+                TX packets:5 errors:0 dropped:0 overruns:0 carrier:0
+                collisions:0 txqueuelen:100
+
+if the device doesn't say up
+try::
+
+        /etc/rc.d/init.d/network start
+
+( this starts the network stack & hopefully calls ifconfig tr0 up ).
+ifconfig looks at the output of /proc/net/dev and presents it in a more
+presentable form.
+
+Now ping the device from a machine in the same subnet.
+
+if the RX packets count & TX packets counts don't increment you probably
+have problems.
+
+next::
+
+        cat /proc/net/arp
+
+Do you see any hardware addresses in the cache if not you may have problems.
+Next try::
+
+        ping -c 5 <broadcast_addr>
+
+i.e. the Bcast field above in the output of
+ifconfig. Do you see any replies from machines other than the local machine
+if not you may have problems. also if the TX packets count in ifconfig
+hasn't incremented either you have serious problems in your driver
+(e.g. the txbusy field of the network device being stuck on )
+or you may have multiple network devices connected.
+
+
+chandev
+-------
+There is a new device layer for channel devices, some
+drivers e.g. lcs are registered with this layer.
+
+If the device uses the channel device layer you'll be
+able to find what interrupts it uses & the current state
+of the device.
+
+See the manpage chandev.8 &type cat /proc/chandev for more info.
+
+
+SysRq
+=====
+This is now supported by linux for s/390 & z/Architecture.
+
+To enable it do compile the kernel with::
+
+        Kernel Hacking -> Magic SysRq Key Enabled
+
+Then::
+
+        echo "1" > /proc/sys/kernel/sysrq
+
+also type::
+
+        echo "8" >/proc/sys/kernel/printk
+
+To make printk output go to console.
+
+On 390 all commands are prefixed with::
+
+        ^-
+
+e.g.::
+
+        ^-t will show tasks.
+        ^-? or some unknown command will display help.
+
+The sysrq key reading is very picky ( I have to type the keys in an
+xterm session & paste them  into the x3270 console )
+& it may be wise to predefine the keys as described in the VM hints above
+
+This is particularly useful for syncing disks unmounting & rebooting
+if the machine gets partially hung.
+
+Read Documentation/admin-guide/sysrq.rst for more info
+
+References:
+===========
+- Enterprise Systems Architecture Reference Summary
+- Enterprise Systems Architecture Principles of Operation
+- Hartmut Penners s390 stack frame sheet.
+- IBM Mainframe Channel Attachment a technology brief from a CISCO webpage
+- Various bits of man & info pages of Linux.
+- Linux & GDB source.
+- Various info & man pages.
+- CMS Help on tracing commands.
+- Linux for s/390 Elf Application Binary Interface
+- Linux for z/Series Elf Application Binary Interface ( Both Highly Recommended )
+- z/Architecture Principles of Operation SA22-7832-00
+- Enterprise Systems Architecture/390 Reference Summary SA22-7209-01 & the
+- Enterprise Systems Architecture/390 Principles of Operation SA22-7201-05
+
+Special Thanks
+==============
+Special thanks to Neale Ferguson who maintains a much
+prettier HTML version of this page at
+http://linuxvm.org/penguinvm/
+Bob Grainger Stefan Bader & others for reporting bugs
diff --git a/Documentation/s390/driver-model.txt b/Documentation/s390/driver-model.rst
index ed265cf54cde..ad4bc2dbea43 100644
--- a/Documentation/s390/driver-model.txt
+++ b/Documentation/s390/driver-model.rst
@@ -1,5 +1,6 @@
+=============================
 S/390 driver model interfaces
------------------------------
+=============================
 
 1. CCW devices
 --------------
@@ -7,13 +8,13 @@ S/390 driver model interfaces
 All devices which can be addressed by means of ccws are called 'CCW devices' -
 even if they aren't actually driven by ccws.
 
-All ccw devices are accessed via a subchannel, this is reflected in the 
-structures under devices/:
+All ccw devices are accessed via a subchannel, this is reflected in the
+structures under devices/::
 
-devices/
+  devices/
      - system/
      - css0/
-           - 0.0.0000/0.0.0815/
+           - 0.0.0000/0.0.0815/
            - 0.0.0001/0.0.4711/
            - 0.0.0002/
            - 0.1.0000/0.1.1234/
@@ -35,14 +36,18 @@ be found under bus/ccw/devices/.
 
 All ccw devices export some data via sysfs.
 
-cutype:     The control unit type / model.
+cutype:
+        The control unit type / model.
 
-devtype:    The device type / model, if applicable.
+devtype:
+        The device type / model, if applicable.
 
-availability: Can be 'good' or 'boxed'; 'no path' or 'no device' for
+availability:
+              Can be 'good' or 'boxed'; 'no path' or 'no device' for
               disconnected devices.
 
-online:     An interface to set the device online and offline.
+online:
+            An interface to set the device online and offline.
             In the special case of the device being disconnected (see the
             notify function under 1.2), piping 0 to online will forcibly delete
             the device.
@@ -52,9 +57,11 @@ The device drivers can add entries to export per-device data and interfaces.
 There is also some data exported on a per-subchannel basis (see under
 bus/css/devices/):
 
-chpids:     Via which chpids the device is connected.
+chpids:
+        Via which chpids the device is connected.
 
-pimpampom:  The path installed, path available and path operational masks.
+pimpampom:
+        The path installed, path available and path operational masks.
 
 There also might be additional data, for example for block devices.
 
@@ -74,77 +81,93 @@ b. After a. has been performed, if necessary, the device is finally brought up
 ------------------------------------
 
 The basic struct ccw_device and struct ccw_driver data structures can be found
-under include/asm/ccwdev.h.
+under include/asm/ccwdev.h::
 
-struct ccw_device {
-        spinlock_t *ccwlock;
-        struct ccw_device_private *private;
-        struct ccw_device_id id;        
+  struct ccw_device {
+        spinlock_t *ccwlock;
+        struct ccw_device_private *private;
+        struct ccw_device_id id;
 
-        struct ccw_driver *drv;         
-        struct device dev;              
+        struct ccw_driver *drv;
+        struct device dev;
         int online;
 
         void (*handler) (struct ccw_device *dev, unsigned long intparm,
-                         struct irb *irb);
-};
+                         struct irb *irb);
+  };
 
-struct ccw_driver {
-        struct module *owner;           
-        struct ccw_device_id *ids;      
-        int (*probe) (struct ccw_device *); 
+  struct ccw_driver {
+        struct module *owner;
+        struct ccw_device_id *ids;
+        int (*probe) (struct ccw_device *);
         int (*remove) (struct ccw_device *);
         int (*set_online) (struct ccw_device *);
         int (*set_offline) (struct ccw_device *);
         int (*notify) (struct ccw_device *, int);
         struct device_driver driver;
         char *name;
-};
+  };
 
 The 'private' field contains data needed for internal i/o operation only, and
 is not available to the device driver.
 
 Each driver should declare in a MODULE_DEVICE_TABLE into which CU types/models
 and/or device types/models it is interested. This information can later be found
-in the struct ccw_device_id fields:
+in the struct ccw_device_id fields::
 
-struct ccw_device_id {
-        __u16   match_flags;    
+  struct ccw_device_id {
+        __u16   match_flags;
 
-        __u16   cu_type;        
-        __u16   dev_type;       
-        __u8    cu_model;       
-        __u8    dev_model;      
+        __u16   cu_type;
+        __u16   dev_type;
+        __u8    cu_model;
+        __u8    dev_model;
 
         unsigned long driver_info;
-};
+  };
 
 The functions in ccw_driver should be used in the following way:
-probe:   This function is called by the device layer for each device the driver
+
+probe:
+         This function is called by the device layer for each device the driver
          is interested in. The driver should only allocate private structures
          to put in dev->driver_data and create attributes (if needed). Also,
          the interrupt handler (see below) should be set here.
 
-int (*probe) (struct ccw_device *cdev); 
+::
+
+  int (*probe) (struct ccw_device *cdev);
 
-Parameters:  cdev     - the device to be probed.
+Parameters:
+                cdev
+                        - the device to be probed.
 
 
-remove:  This function is called by the device layer upon removal of the driver,
+remove:
+         This function is called by the device layer upon removal of the driver,
          the device or the module. The driver should perform cleanups here.
 
-int (*remove) (struct ccw_device *cdev);
+::
 
-Parameters:   cdev    - the device to be removed.
+  int (*remove) (struct ccw_device *cdev);
 
+Parameters:
+                cdev
+                        - the device to be removed.
 
-set_online: This function is called by the common I/O layer when the device is
+
+set_online:
+            This function is called by the common I/O layer when the device is
             activated via the 'online' attribute. The driver should finally
             setup and activate the device here.
 
-int (*set_online) (struct ccw_device *);
+::
+
+  int (*set_online) (struct ccw_device *);
 
-Parameters:   cdev      - the device to be activated. The common layer has
+Parameters:
+                cdev
+                        - the device to be activated. The common layer has
                           verified that the device is not already online.
 
 
@@ -152,15 +175,22 @@ set_offline: This function is called by the common I/O layer when the device is
              de-activated via the 'online' attribute. The driver should shut
              down the device, but not de-allocate its private data.
 
-int (*set_offline) (struct ccw_device *);
+::
 
-Parameters:   cdev       - the device to be deactivated. The common layer has
+  int (*set_offline) (struct ccw_device *);
+
+Parameters:
+                cdev
+                        - the device to be deactivated. The common layer has
                            verified that the device is online.
 
 
-notify: This function is called by the common I/O layer for some state changes
+notify:
+        This function is called by the common I/O layer for some state changes
         of the device.
+
         Signalled to the driver are:
+
         * In online state, device detached (CIO_GONE) or last path gone
           (CIO_NO_PATH). The driver must return !0 to keep the device; for
           return code 0, the device will be deleted as usual (also when no
@@ -173,32 +203,40 @@ notify: This function is called by the common I/O layer for some state changes
           return code of the notify function the device driver signals if it
           wants the device back: !0 for keeping, 0 to make the device being
           removed and re-registered.
-        
-int (*notify) (struct ccw_device *, int);
 
-Parameters:   cdev    - the device whose state changed.
-              event   - the event that happened. This can be one of CIO_GONE,
-                        CIO_NO_PATH or CIO_OPER.
+::
+
+  int (*notify) (struct ccw_device *, int);
+
+Parameters:
+                cdev
+                        - the device whose state changed.
+
+                event
+                        - the event that happened. This can be one of CIO_GONE,
+                          CIO_NO_PATH or CIO_OPER.
 
 The handler field of the struct ccw_device is meant to be set to the interrupt
-handler for the device. In order to accommodate drivers which use several 
+handler for the device. In order to accommodate drivers which use several
 distinct handlers (e.g. multi subchannel devices), this is a member of ccw_device
 instead of ccw_driver.
 The handler is registered with the common layer during set_online() processing
 before the driver is called, and is deregistered during set_offline() after the
-driver has been called. Also, after registering / before deregistering, path 
+driver has been called. Also, after registering / before deregistering, path
 grouping resp. disbanding of the path group (if applicable) are performed.
 
-void (*handler) (struct ccw_device *dev, unsigned long intparm, struct irb *irb);
+::
 
-Parameters:     dev     - the device the handler is called for
+  void (*handler) (struct ccw_device *dev, unsigned long intparm, struct irb *irb);
+
+Parameters:     dev     - the device the handler is called for
                 intparm - the intparm which allows the device driver to identify
-                          the i/o the interrupt is associated with, or to recognize
-                          the interrupt as unsolicited.
-                irb     - interruption response block which contains the accumulated
-                          status.
+                          the i/o the interrupt is associated with, or to recognize
+                          the interrupt as unsolicited.
+                irb     - interruption response block which contains the accumulated
+                          status.
 
-The device driver is called from the common ccw_device layer and can retrieve 
+The device driver is called from the common ccw_device layer and can retrieve
 information about the interrupt from the irb parameter.
 
 
@@ -237,23 +275,27 @@ only the logical state and not the physical state, since we cannot track the
 latter consistently due to lacking machine support (we don't need to be aware
 of it anyway).
 
-status - Can be 'online' or 'offline'.
+status
+       - Can be 'online' or 'offline'.
          Piping 'on' or 'off' sets the chpid logically online/offline.
          Piping 'on' to an online chpid triggers path reprobing for all devices
          the chpid connects to. This can be used to force the kernel to re-use
          a channel path the user knows to be online, but the machine hasn't
          created a machine check for.
 
-type - The physical type of the channel path.
+type
+       - The physical type of the channel path.
 
-shared - Whether the channel path is shared.
+shared
+       - Whether the channel path is shared.
 
-cmg - The channel measurement group.
+cmg
+       - The channel measurement group.
 
 3. System devices
 -----------------
 
-3.1 xpram 
+3.1 xpram
 ---------
 
 xpram shows up under devices/system/ as 'xpram'.
@@ -279,9 +321,8 @@ Netiucv connections show up under devices/iucv/ as "netiucv<ifnum>". The interfa
 number is assigned sequentially to the connections defined via the 'connection'
 attribute.
 
-user                      - shows the connection partner.
-
-buffer                    - maximum buffer size.
-                            Pipe to it to change buffer size.
-
+user
+    - shows the connection partner.
 
+buffer
+    - maximum buffer size. Pipe to it to change buffer size.
diff --git a/Documentation/s390/index.rst b/Documentation/s390/index.rst
new file mode 100644
index 000000000000..1a914da2a07b
--- /dev/null
+++ b/Documentation/s390/index.rst
@@ -0,0 +1,30 @@
+:orphan:
+
+=================
+s390 Architecture
+=================
+
+.. toctree::
+    :maxdepth: 1
+
+    cds
+    3270
+    debugging390
+    driver-model
+    monreader
+    qeth
+    s390dbf
+    vfio-ap
+    vfio-ccw
+    zfcpdump
+    dasd
+    common_io
+
+    text_files
+
+.. only::  subproject and html
+
+   Indices
+   =======
+
+   * :ref:`genindex`
diff --git a/Documentation/s390/monreader.txt b/Documentation/s390/monreader.rst
index d3729585fdb0..1e857575c113 100644
--- a/Documentation/s390/monreader.txt
+++ b/Documentation/s390/monreader.rst
@@ -1,24 +1,26 @@
+=================================================
+Linux API for read access to z/VM Monitor Records
+=================================================
 
 Date  : 2004-Nov-26
+
 Author: Gerald Schaefer (geraldsc@de.ibm.com)
 
 
-             Linux API for read access to z/VM Monitor Records
-             =================================================
 
 
 Description
 ===========
 This item delivers a new Linux API in the form of a misc char device that is
 usable from user space and allows read access to the z/VM Monitor Records
-collected by the *MONITOR System Service of z/VM.
+collected by the `*MONITOR` System Service of z/VM.
 
 
 User Requirements
 =================
 The z/VM guest on which you want to access this API needs to be configured in
-order to allow IUCV connections to the *MONITOR service, i.e. it needs the
-IUCV *MONITOR statement in its user entry. If the monitor DCSS to be used is
+order to allow IUCV connections to the `*MONITOR` service, i.e. it needs the
+IUCV `*MONITOR` statement in its user entry. If the monitor DCSS to be used is
 restricted (likely), you also need the NAMESAVE <DCSS NAME> statement.
 This item will use the IUCV device driver to access the z/VM services, so you
 need a kernel with IUCV support. You also need z/VM version 4.4 or 5.1.
@@ -50,7 +52,9 @@ Your guest virtual storage has to end below the starting address of the DCSS
 and you have to specify the "mem=" kernel parameter in your parmfile with a
 value greater than the ending address of the DCSS.
 
-Example: DEF STOR 140M
+Example::
+
+        DEF STOR 140M
 
 This defines 140MB storage size for your guest, the parameter "mem=160M" is
 added to the parmfile.
@@ -66,24 +70,27 @@ kernel, the kernel parameter "monreader.mondcss=<DCSS NAME>" can be specified
 in the parmfile.
 
 The default name for the DCSS is "MONDCSS" if none is specified. In case that
-there are other users already connected to the *MONITOR service (e.g.
+there are other users already connected to the `*MONITOR` service (e.g.
 Performance Toolkit), the monitor DCSS is already defined and you have to use
 the same DCSS. The CP command Q MONITOR (Class E privileged) shows the name
 of the monitor DCSS, if already defined, and the users connected to the
-*MONITOR service.
+`*MONITOR` service.
 Refer to the "z/VM Performance" book (SC24-6109-00) on how to create a monitor
 DCSS if your z/VM doesn't have one already, you need Class E privileges to
 define and save a DCSS.
 
 Example:
 --------
-modprobe monreader mondcss=MYDCSS
+
+::
+
+        modprobe monreader mondcss=MYDCSS
 
 This loads the module and sets the DCSS name to "MYDCSS".
 
 NOTE:
 -----
-This API provides no interface to control the *MONITOR service, e.g. specify
+This API provides no interface to control the `*MONITOR` service, e.g. specify
 which data should be collected. This can be done by the CP command MONITOR
 (Class E privileged), see "CP Command and Utility Reference".
 
@@ -98,6 +105,7 @@ If your distribution does not support udev, a device node will not be created
 automatically and you have to create it manually after loading the module.
 Therefore you need to know the major and minor numbers of the device. These
 numbers can be found in /sys/class/misc/monreader/dev.
+
 Typing cat /sys/class/misc/monreader/dev will give an output of the form
 <major>:<minor>. The device node can be created via the mknod command, enter
 mknod <name> c <major> <minor>, where <name> is the name of the device node
@@ -105,10 +113,13 @@ to be created.
 
 Example:
 --------
-# modprobe monreader
-# cat /sys/class/misc/monreader/dev
-10:63
-# mknod /dev/monreader c 10 63
+
+::
+
+        # modprobe monreader
+        # cat /sys/class/misc/monreader/dev
+        10:63
+        # mknod /dev/monreader c 10 63
 
 This loads the module with the default monitor DCSS (MONDCSS) and creates a
 device node.
@@ -133,20 +144,21 @@ last byte of data. The start address is needed to handle "end-of-frame" records
 correctly (domain 1, record 13), i.e. it can be used to determine the record
 start offset relative to a 4K page (frame) boundary.
 
-See "Appendix A: *MONITOR" in the "z/VM Performance" document for a description
+See "Appendix A: `*MONITOR`" in the "z/VM Performance" document for a description
 of the monitor control element layout. The layout of the monitor records can
 be found here (z/VM 5.1): http://www.vm.ibm.com/pubs/mon510/index.html
 
-The layout of the data stream provided by the monreader device is as follows:
-...
-<0 byte read>
-<first MCE>              \
-<first set of records>    |
-...                       |- data set
-<last MCE>                |
-<last set of records>    /
-<0 byte read>
-...
+The layout of the data stream provided by the monreader device is as follows::
+
+        ...
+        <0 byte read>
+        <first MCE>              \
+        <first set of records>    |
+        ...                       |- data set
+        <last MCE>                |
+        <last set of records>    /
+        <0 byte read>
+        ...
 
 There may be more than one combination of MCE and corresponding record set
 within one data set and the end of each data set is indicated by a successful
@@ -165,15 +177,19 @@ As with most char devices, error conditions are indicated by returning a
 negative value for the number of bytes read. In this case, the errno variable
 indicates the error condition:
 
-EIO: reply failed, read data is invalid and the application
+EIO:
+     reply failed, read data is invalid and the application
      should discard the data read since the last successful read with 0 size.
-EFAULT: copy_to_user failed, read data is invalid and the application should
-        discard the data read since the last successful read with 0 size.
-EAGAIN: occurs on a non-blocking read if there is no data available at the
-        moment. There is no data missing or corrupted, just try again or rather
-        use polling for non-blocking reads.
-EOVERFLOW: message limit reached, the data read since the last successful
-           read with 0 size is valid but subsequent records may be missing.
+EFAULT:
+        copy_to_user failed, read data is invalid and the application should
+        discard the data read since the last successful read with 0 size.
+EAGAIN:
+        occurs on a non-blocking read if there is no data available at the
+        moment. There is no data missing or corrupted, just try again or rather
+        use polling for non-blocking reads.
+EOVERFLOW:
+           message limit reached, the data read since the last successful
+           read with 0 size is valid but subsequent records may be missing.
 
 In the last case (EOVERFLOW) there may be missing data, in the first two cases
 (EIO, EFAULT) there will be missing data. It's up to the application if it will
@@ -183,7 +199,7 @@ Open:
 -----
 Only one user is allowed to open the char device. If it is already in use, the
 open function will fail (return a negative value) and set errno to EBUSY.
-The open function may also fail if an IUCV connection to the *MONITOR service
+The open function may also fail if an IUCV connection to the `*MONITOR` service
 cannot be established. In this case errno will be set to EIO and an error
 message with an IPUSER SEVER code will be printed into syslog. The IPUSER SEVER
 codes are described in the "z/VM Performance" book, Appendix A.
@@ -194,4 +210,3 @@ As soon as the device is opened, incoming messages will be accepted and they
 will account for the message limit, i.e. opening the device without reading
 from it will provoke the "message limit reached" error (EOVERFLOW error code)
 eventually.
-
diff --git a/Documentation/s390/qeth.txt b/Documentation/s390/qeth.rst
index aa06fcf5f8c2..f02fdaa68de0 100644
--- a/Documentation/s390/qeth.txt
+++ b/Documentation/s390/qeth.rst
@@ -1,8 +1,12 @@
+=============================
 IBM s390 QDIO Ethernet Driver
+=============================
 
 OSA and HiperSockets Bridge Port Support
+========================================
 
 Uevents
+-------
 
 To generate the events the device must be assigned a role of either
 a primary or a secondary Bridge Port. For more information, see
@@ -13,12 +17,15 @@ of some configured Bridge Port device on the channel changes, a udev
 event with ACTION=CHANGE is emitted on behalf of the corresponding
 ccwgroup device. The event has the following attributes:
 
-BRIDGEPORT=statechange -  indicates that the Bridge Port device changed
+BRIDGEPORT=statechange
+  indicates that the Bridge Port device changed
   its state.
 
-ROLE={primary|secondary|none} - the role assigned to the port.
+ROLE={primary|secondary|none}
+  the role assigned to the port.
 
-STATE={active|standby|inactive} - the newly assumed state of the port.
+STATE={active|standby|inactive}
+  the newly assumed state of the port.
 
 When run on HiperSockets Bridge Capable Port hardware with host address
 notifications enabled, a udev event with ACTION=CHANGE is emitted.
@@ -26,25 +33,32 @@ It is emitted on behalf of the corresponding ccwgroup device when a host
 or a VLAN is registered or unregistered on the network served by the device.
 The event has the following attributes:
 
-BRIDGEDHOST={reset|register|deregister|abort} - host address
+BRIDGEDHOST={reset|register|deregister|abort}
+  host address
   notifications are started afresh, a new host or VLAN is registered or
   deregistered on the Bridge Port HiperSockets channel, or address
   notifications are aborted.
 
-VLAN=numeric-vlan-id - VLAN ID on which the event occurred. Not included
+VLAN=numeric-vlan-id
+  VLAN ID on which the event occurred. Not included
   if no VLAN is involved in the event.
 
-MAC=xx:xx:xx:xx:xx:xx - MAC address of the host that is being registered
+MAC=xx:xx:xx:xx:xx:xx
+  MAC address of the host that is being registered
   or deregistered from the HiperSockets channel. Not reported if the
   event reports the creation or destruction of a VLAN.
 
-NTOK_BUSID=x.y.zzzz - device bus ID (CSSID, SSID and device number).
+NTOK_BUSID=x.y.zzzz
+  device bus ID (CSSID, SSID and device number).
 
-NTOK_IID=xx - device IID.
+NTOK_IID=xx
+  device IID.
 
-NTOK_CHPID=xx - device CHPID.
+NTOK_CHPID=xx
+  device CHPID.
 
-NTOK_CHID=xxxx - device channel ID.
+NTOK_CHID=xxxx
+  device channel ID.
 
-Note that the NTOK_* attributes refer to devices other than  the one
+Note that the `NTOK_*` attributes refer to devices other than  the one
 connected to the system on which the OS is running.
diff --git a/Documentation/s390/s390dbf.rst b/Documentation/s390/s390dbf.rst
new file mode 100644
index 000000000000..cdb36842b898
--- /dev/null
+++ b/Documentation/s390/s390dbf.rst
@@ -0,0 +1,487 @@
+==================
+S390 Debug Feature
+==================
+
+files:
+      - arch/s390/kernel/debug.c
+      - arch/s390/include/asm/debug.h
+
+Description:
+------------
+The goal of this feature is to provide a kernel debug logging API
+where log records can be stored efficiently in memory, where each component
+(e.g. device drivers) can have one separate debug log.
+One purpose of this is to inspect the debug logs after a production system crash
+in order to analyze the reason for the crash.
+
+If the system still runs but only a subcomponent which uses dbf fails,
+it is possible to look at the debug logs on a live system via the Linux
+debugfs filesystem.
+
+The debug feature may also very useful for kernel and driver development.
+
+Design:
+-------
+Kernel components (e.g. device drivers) can register themselves at the debug
+feature with the function call :c:func:`debug_register()`.
+This function initializes a
+debug log for the caller. For each debug log exists a number of debug areas
+where exactly one is active at one time.  Each debug area consists of contiguous
+pages in memory. In the debug areas there are stored debug entries (log records)
+which are written by event- and exception-calls.
+
+An event-call writes the specified debug entry to the active debug
+area and updates the log pointer for the active area. If the end
+of the active debug area is reached, a wrap around is done (ring buffer)
+and the next debug entry will be written at the beginning of the active
+debug area.
+
+An exception-call writes the specified debug entry to the log and
+switches to the next debug area. This is done in order to be sure
+that the records which describe the origin of the exception are not
+overwritten when a wrap around for the current area occurs.
+
+The debug areas themselves are also ordered in form of a ring buffer.
+When an exception is thrown in the last debug area, the following debug
+entries are then written again in the very first area.
+
+There are four versions for the event- and exception-calls: One for
+logging raw data, one for text, one for numbers (unsigned int and long),
+and one for sprintf-like formatted strings.
+
+Each debug entry contains the following data:
+
+- Timestamp
+- Cpu-Number of calling task
+- Level of debug entry (0...6)
+- Return Address to caller
+- Flag, if entry is an exception or not
+
+The debug logs can be inspected in a live system through entries in
+the debugfs-filesystem. Under the toplevel directory "``s390dbf``" there is
+a directory for each registered component, which is named like the
+corresponding component. The debugfs normally should be mounted to
+``/sys/kernel/debug`` therefore the debug feature can be accessed under
+``/sys/kernel/debug/s390dbf``.
+
+The content of the directories are files which represent different views
+to the debug log. Each component can decide which views should be
+used through registering them with the function :c:func:`debug_register_view()`.
+Predefined views for hex/ascii, sprintf and raw binary data are provided.
+It is also possible to define other views. The content of
+a view can be inspected simply by reading the corresponding debugfs file.
+
+All debug logs have an actual debug level (range from 0 to 6).
+The default level is 3. Event and Exception functions have a :c:data:`level`
+parameter. Only debug entries with a level that is lower or equal
+than the actual level are written to the log. This means, when
+writing events, high priority log entries should have a low level
+value whereas low priority entries should have a high one.
+The actual debug level can be changed with the help of the debugfs-filesystem
+through writing a number string "x" to the ``level`` debugfs file which is
+provided for every debug log. Debugging can be switched off completely
+by using "-" on the ``level`` debugfs file.
+
+Example::
+
+        > echo "-" > /sys/kernel/debug/s390dbf/dasd/level
+
+It is also possible to deactivate the debug feature globally for every
+debug log. You can change the behavior using  2 sysctl parameters in
+``/proc/sys/s390dbf``:
+
+There are currently 2 possible triggers, which stop the debug feature
+globally. The first possibility is to use the ``debug_active`` sysctl. If
+set to 1 the debug feature is running. If ``debug_active`` is set to 0 the
+debug feature is turned off.
+
+The second trigger which stops the debug feature is a kernel oops.
+That prevents the debug feature from overwriting debug information that
+happened before the oops. After an oops you can reactivate the debug feature
+by piping 1 to ``/proc/sys/s390dbf/debug_active``. Nevertheless, it's not
+suggested to use an oopsed kernel in a production environment.
+
+If you want to disallow the deactivation of the debug feature, you can use
+the ``debug_stoppable`` sysctl. If you set ``debug_stoppable`` to 0 the debug
+feature cannot be stopped. If the debug feature is already stopped, it
+will stay deactivated.
+
+Kernel Interfaces:
+------------------
+
+.. kernel-doc:: arch/s390/kernel/debug.c
+.. kernel-doc:: arch/s390/include/asm/debug.h
+
+Predefined views:
+-----------------
+
+.. code-block:: c
+
+  extern struct debug_view debug_hex_ascii_view;
+
+  extern struct debug_view debug_raw_view;
+
+  extern struct debug_view debug_sprintf_view;
+
+Examples
+--------
+
+.. code-block:: c
+
+  /*
+   * hex_ascii- + raw-view Example
+   */
+
+  #include <linux/init.h>
+  #include <asm/debug.h>
+
+  static debug_info_t *debug_info;
+
+  static int init(void)
+  {
+      /* register 4 debug areas with one page each and 4 byte data field */
+
+      debug_info = debug_register("test", 1, 4, 4 );
+      debug_register_view(debug_info, &debug_hex_ascii_view);
+      debug_register_view(debug_info, &debug_raw_view);
+
+      debug_text_event(debug_info, 4 , "one ");
+      debug_int_exception(debug_info, 4, 4711);
+      debug_event(debug_info, 3, &debug_info, 4);
+
+      return 0;
+  }
+
+  static void cleanup(void)
+  {
+      debug_unregister(debug_info);
+  }
+
+  module_init(init);
+  module_exit(cleanup);
+
+.. code-block:: c
+
+  /*
+   * sprintf-view Example
+   */
+
+  #include <linux/init.h>
+  #include <asm/debug.h>
+
+  static debug_info_t *debug_info;
+
+  static int init(void)
+  {
+      /* register 4 debug areas with one page each and data field for */
+      /* format string pointer + 2 varargs (= 3 * sizeof(long))       */
+
+      debug_info = debug_register("test", 1, 4, sizeof(long) * 3);
+      debug_register_view(debug_info, &debug_sprintf_view);
+
+      debug_sprintf_event(debug_info, 2 , "first event in %s:%i\n",__FILE__,__LINE__);
+      debug_sprintf_exception(debug_info, 1, "pointer to debug info: %p\n",&debug_info);
+
+      return 0;
+  }
+
+  static void cleanup(void)
+  {
+      debug_unregister(debug_info);
+  }
+
+  module_init(init);
+  module_exit(cleanup);
+
+Debugfs Interface
+-----------------
+Views to the debug logs can be investigated through reading the corresponding
+debugfs-files:
+
+Example::
+
+  > ls /sys/kernel/debug/s390dbf/dasd
+  flush  hex_ascii  level pages raw
+  > cat /sys/kernel/debug/s390dbf/dasd/hex_ascii | sort -k2,2 -s
+  00 00974733272:680099 2 - 02 0006ad7e  07 ea 4a 90 | ....
+  00 00974733272:682210 2 - 02 0006ade6  46 52 45 45 | FREE
+  00 00974733272:682213 2 - 02 0006adf6  07 ea 4a 90 | ....
+  00 00974733272:682281 1 * 02 0006ab08  41 4c 4c 43 | EXCP
+  01 00974733272:682284 2 - 02 0006ab16  45 43 4b 44 | ECKD
+  01 00974733272:682287 2 - 02 0006ab28  00 00 00 04 | ....
+  01 00974733272:682289 2 - 02 0006ab3e  00 00 00 20 | ...
+  01 00974733272:682297 2 - 02 0006ad7e  07 ea 4a 90 | ....
+  01 00974733272:684384 2 - 00 0006ade6  46 52 45 45 | FREE
+  01 00974733272:684388 2 - 00 0006adf6  07 ea 4a 90 | ....
+
+See section about predefined views for explanation of the above output!
+
+Changing the debug level
+------------------------
+
+Example::
+
+
+  > cat /sys/kernel/debug/s390dbf/dasd/level
+  3
+  > echo "5" > /sys/kernel/debug/s390dbf/dasd/level
+  > cat /sys/kernel/debug/s390dbf/dasd/level
+  5
+
+Flushing debug areas
+--------------------
+Debug areas can be flushed with piping the number of the desired
+area (0...n) to the debugfs file "flush". When using "-" all debug areas
+are flushed.
+
+Examples:
+
+1. Flush debug area 0::
+
+     > echo "0" > /sys/kernel/debug/s390dbf/dasd/flush
+
+2. Flush all debug areas::
+
+     > echo "-" > /sys/kernel/debug/s390dbf/dasd/flush
+
+Changing the size of debug areas
+------------------------------------
+It is possible the change the size of debug areas through piping
+the number of pages to the debugfs file "pages". The resize request will
+also flush the debug areas.
+
+Example:
+
+Define 4 pages for the debug areas of debug feature "dasd"::
+
+  > echo "4" > /sys/kernel/debug/s390dbf/dasd/pages
+
+Stopping the debug feature
+--------------------------
+Example:
+
+1. Check if stopping is allowed::
+
+     > cat /proc/sys/s390dbf/debug_stoppable
+
+2. Stop debug feature::
+
+     > echo 0 > /proc/sys/s390dbf/debug_active
+
+crash Interface
+----------------
+The ``crash`` tool since v5.1.0 has a built-in command
+``s390dbf`` to display all the debug logs or export them to the file system.
+With this tool it is possible
+to investigate the debug logs on a live system and with a memory dump after
+a system crash.
+
+Investigating raw memory
+------------------------
+One last possibility to investigate the debug logs at a live
+system and after a system crash is to look at the raw memory
+under VM or at the Service Element.
+It is possible to find the anchor of the debug-logs through
+the ``debug_area_first`` symbol in the System map. Then one has
+to follow the correct pointers of the data-structures defined
+in debug.h and find the debug-areas in memory.
+Normally modules which use the debug feature will also have
+a global variable with the pointer to the debug-logs. Following
+this pointer it will also be possible to find the debug logs in
+memory.
+
+For this method it is recommended to use '16 * x + 4' byte (x = 0..n)
+for the length of the data field in :c:func:`debug_register()` in
+order to see the debug entries well formatted.
+
+
+Predefined Views
+----------------
+
+There are three predefined views: hex_ascii, raw and sprintf.
+The hex_ascii view shows the data field in hex and ascii representation
+(e.g. ``45 43 4b 44 | ECKD``).
+The raw view returns a bytestream as the debug areas are stored in memory.
+
+The sprintf view formats the debug entries in the same way as the sprintf
+function would do. The sprintf event/exception functions write to the
+debug entry a pointer to the format string (size = sizeof(long))
+and for each vararg a long value. So e.g. for a debug entry with a format
+string plus two varargs one would need to allocate a (3 * sizeof(long))
+byte data area in the debug_register() function.
+
+IMPORTANT:
+  Using "%s" in sprintf event functions is dangerous. You can only
+  use "%s" in the sprintf event functions, if the memory for the passed string
+  is available as long as the debug feature exists. The reason behind this is
+  that due to performance considerations only a pointer to the string is stored
+  in  the debug feature. If you log a string that is freed afterwards, you will
+  get an OOPS when inspecting the debug feature, because then the debug feature
+  will access the already freed memory.
+
+NOTE:
+  If using the sprintf view do NOT use other event/exception functions
+  than the sprintf-event and -exception functions.
+
+The format of the hex_ascii and sprintf view is as follows:
+
+- Number of area
+- Timestamp (formatted as seconds and microseconds since 00:00:00 Coordinated
+  Universal Time (UTC), January 1, 1970)
+- level of debug entry
+- Exception flag (* = Exception)
+- Cpu-Number of calling task
+- Return Address to caller
+- data field
+
+The format of the raw view is:
+
+- Header as described in debug.h
+- datafield
+
+A typical line of the hex_ascii view will look like the following (first line
+is only for explanation and will not be displayed when 'cating' the view)::
+
+  area  time           level exception cpu caller    data (hex + ascii)
+  --------------------------------------------------------------------------
+  00    00964419409:440690 1 -         00  88023fe
+
+
+Defining views
+--------------
+
+Views are specified with the 'debug_view' structure. There are defined
+callback functions which are used for reading and writing the debugfs files:
+
+.. code-block:: c
+
+  struct debug_view {
+        char name[DEBUG_MAX_PROCF_LEN];
+        debug_prolog_proc_t* prolog_proc;
+        debug_header_proc_t* header_proc;
+        debug_format_proc_t* format_proc;
+        debug_input_proc_t*  input_proc;
+        void*                private_data;
+  };
+
+where:
+
+.. code-block:: c
+
+  typedef int (debug_header_proc_t) (debug_info_t* id,
+                                     struct debug_view* view,
+                                     int area,
+                                     debug_entry_t* entry,
+                                     char* out_buf);
+
+  typedef int (debug_format_proc_t) (debug_info_t* id,
+                                     struct debug_view* view, char* out_buf,
+                                     const char* in_buf);
+  typedef int (debug_prolog_proc_t) (debug_info_t* id,
+                                     struct debug_view* view,
+                                     char* out_buf);
+  typedef int (debug_input_proc_t) (debug_info_t* id,
+                                    struct debug_view* view,
+                                    struct file* file, const char* user_buf,
+                                    size_t in_buf_size, loff_t* offset);
+
+
+The "private_data" member can be used as pointer to view specific data.
+It is not used by the debug feature itself.
+
+The output when reading a debugfs file is structured like this::
+
+  "prolog_proc output"
+
+  "header_proc output 1"  "format_proc output 1"
+  "header_proc output 2"  "format_proc output 2"
+  "header_proc output 3"  "format_proc output 3"
+  ...
+
+When a view is read from the debugfs, the Debug Feature calls the
+'prolog_proc' once for writing the prolog.
+Then 'header_proc' and 'format_proc' are called for each
+existing debug entry.
+
+The input_proc can be used to implement functionality when it is written to
+the view (e.g. like with ``echo "0" > /sys/kernel/debug/s390dbf/dasd/level``).
+
+For header_proc there can be used the default function
+:c:func:`debug_dflt_header_fn()` which is defined in debug.h.
+and which produces the same header output as the predefined views.
+E.g::
+
+  00 00964419409:440761 2 - 00 88023ec
+
+In order to see how to use the callback functions check the implementation
+of the default views!
+
+Example:
+
+.. code-block:: c
+
+  #include <asm/debug.h>
+
+  #define UNKNOWNSTR "data: %08x"
+
+  const char* messages[] =
+  {"This error...........\n",
+   "That error...........\n",
+   "Problem..............\n",
+   "Something went wrong.\n",
+   "Everything ok........\n",
+   NULL
+  };
+
+  static int debug_test_format_fn(
+     debug_info_t *id, struct debug_view *view,
+     char *out_buf, const char *in_buf
+  )
+  {
+    int i, rc = 0;
+
+    if (id->buf_size >= 4) {
+       int msg_nr = *((int*)in_buf);
+       if (msg_nr < sizeof(messages) / sizeof(char*) - 1)
+          rc += sprintf(out_buf, "%s", messages[msg_nr]);
+       else
+          rc += sprintf(out_buf, UNKNOWNSTR, msg_nr);
+    }
+    return rc;
+  }
+
+  struct debug_view debug_test_view = {
+    "myview",                 /* name of view */
+    NULL,                     /* no prolog */
+    &debug_dflt_header_fn,    /* default header for each entry */
+    &debug_test_format_fn,    /* our own format function */
+    NULL,                     /* no input function */
+    NULL                      /* no private data */
+  };
+
+test:
+=====
+
+.. code-block:: c
+
+  debug_info_t *debug_info;
+  int i;
+  ...
+  debug_info = debug_register("test", 0, 4, 4);
+  debug_register_view(debug_info, &debug_test_view);
+  for (i = 0; i < 10; i ++)
+    debug_int_event(debug_info, 1, i);
+
+::
+
+  > cat /sys/kernel/debug/s390dbf/test/myview
+  00 00964419734:611402 1 - 00 88042ca   This error...........
+  00 00964419734:611405 1 - 00 88042ca   That error...........
+  00 00964419734:611408 1 - 00 88042ca   Problem..............
+  00 00964419734:611411 1 - 00 88042ca   Something went wrong.
+  00 00964419734:611414 1 - 00 88042ca   Everything ok........
+  00 00964419734:611417 1 - 00 88042ca   data: 00000005
+  00 00964419734:611419 1 - 00 88042ca   data: 00000006
+  00 00964419734:611422 1 - 00 88042ca   data: 00000007
+  00 00964419734:611425 1 - 00 88042ca   data: 00000008
+  00 00964419734:611428 1 - 00 88042ca   data: 00000009
diff --git a/Documentation/s390/s390dbf.txt b/Documentation/s390/s390dbf.txt
deleted file mode 100644
index 61329fd62e89..000000000000
--- a/Documentation/s390/s390dbf.txt
+++ /dev/null
@@ -1,667 +0,0 @@
-S390 Debug Feature
-==================
-
-files: arch/s390/kernel/debug.c
-       arch/s390/include/asm/debug.h
-
-Description:
-------------
-The goal of this feature is to provide a kernel debug logging API 
-where log records can be stored efficiently in memory, where each component 
-(e.g. device drivers) can have one separate debug log.
-One purpose of this is to inspect the debug logs after a production system crash
-in order to analyze the reason for the crash.
-If the system still runs but only a subcomponent which uses dbf fails,
-it is possible to look at the debug logs on a live system via the Linux
-debugfs filesystem.
-The debug feature may also very useful for kernel and driver development.
-
-Design:
--------
-Kernel components (e.g. device drivers) can register themselves at the debug 
-feature with the function call debug_register(). This function initializes a 
-debug log for the caller. For each debug log exists a number of debug areas 
-where exactly one is active at one time.  Each debug area consists of contiguous
-pages in memory. In the debug areas there are stored debug entries (log records)
-which are written by event- and exception-calls. 
-
-An event-call writes the specified debug entry to the active debug
-area and updates the log pointer for the active area. If the end 
-of the active debug area is reached, a wrap around is done (ring buffer) 
-and the next debug entry will be written at the beginning of the active 
-debug area.
-
-An exception-call writes the specified debug entry to the log and
-switches to the next debug area. This is done in order to be sure
-that the records which describe the origin of the exception are not
-overwritten when a wrap around for the current area occurs.
-
-The debug areas themselves are also ordered in form of a ring buffer.
-When an exception is thrown in the last debug area, the following debug 
-entries are then written again in the very first area.
-
-There are three versions for the event- and exception-calls: One for
-logging raw data, one for text and one for numbers.
-
-Each debug entry contains the following data:
-
-- Timestamp
-- Cpu-Number of calling task
-- Level of debug entry (0...6)
-- Return Address to caller
-- Flag, if entry is an exception or not
-
-The debug logs can be inspected in a live system through entries in
-the debugfs-filesystem. Under the toplevel directory "s390dbf" there is
-a directory for each registered component, which is named like the
-corresponding component. The debugfs normally should be mounted to
-/sys/kernel/debug therefore the debug feature can be accessed under
-/sys/kernel/debug/s390dbf.
-
-The content of the directories are files which represent different views
-to the debug log. Each component can decide which views should be
-used through registering them with the function debug_register_view().
-Predefined views for hex/ascii, sprintf and raw binary data are provided.
-It is also possible to define other views. The content of
-a view can be inspected simply by reading the corresponding debugfs file.
-
-All debug logs have an actual debug level (range from 0 to 6).
-The default level is 3. Event and Exception functions have a 'level'
-parameter. Only debug entries with a level that is lower or equal
-than the actual level are written to the log. This means, when
-writing events, high priority log entries should have a low level
-value whereas low priority entries should have a high one.
-The actual debug level can be changed with the help of the debugfs-filesystem
-through writing a number string "x" to the 'level' debugfs file which is
-provided for every debug log. Debugging can be switched off completely
-by using "-" on the 'level' debugfs file.
-
-Example:
-
-> echo "-" > /sys/kernel/debug/s390dbf/dasd/level
-
-It is also possible to deactivate the debug feature globally for every
-debug log. You can change the behavior using  2 sysctl parameters in
-/proc/sys/s390dbf:
-There are currently 2 possible triggers, which stop the debug feature
-globally. The first possibility is to use the "debug_active" sysctl. If
-set to 1 the debug feature is running. If "debug_active" is set to 0 the
-debug feature is turned off.
-The second trigger which stops the debug feature is a kernel oops.
-That prevents the debug feature from overwriting debug information that
-happened before the oops. After an oops you can reactivate the debug feature
-by piping 1 to /proc/sys/s390dbf/debug_active. Nevertheless, its not
-suggested to use an oopsed kernel in a production environment.
-If you want to disallow the deactivation of the debug feature, you can use
-the "debug_stoppable" sysctl. If you set "debug_stoppable" to 0 the debug
-feature cannot be stopped. If the debug feature is already stopped, it
-will stay deactivated.
-
-Kernel Interfaces:
-------------------
-
-----------------------------------------------------------------------------
-debug_info_t *debug_register(char *name, int pages, int nr_areas,
-                             int buf_size);
-
-Parameter:    name:        Name of debug log (e.g. used for debugfs entry)
-              pages:       number of pages, which will be allocated per area
-              nr_areas:    number of debug areas
-              buf_size:    size of data area in each debug entry
-
-Return Value: Handle for generated debug area   
-              NULL if register failed 
-
-Description:  Allocates memory for a debug log     
-              Must not be called within an interrupt handler 
-
-----------------------------------------------------------------------------
-debug_info_t *debug_register_mode(char *name, int pages, int nr_areas,
-                                  int buf_size, mode_t mode, uid_t uid,
-                                  gid_t gid);
-
-Parameter:    name:        Name of debug log (e.g. used for debugfs entry)
-              pages:       Number of pages, which will be allocated per area
-              nr_areas:    Number of debug areas
-              buf_size:    Size of data area in each debug entry
-              mode:        File mode for debugfs files. E.g. S_IRWXUGO
-              uid:         User ID for debugfs files. Currently only 0 is
-                           supported.
-              gid:         Group ID for debugfs files. Currently only 0 is
-                           supported.
-
-Return Value: Handle for generated debug area
-              NULL if register failed
-
-Description:  Allocates memory for a debug log
-              Must not be called within an interrupt handler
-
----------------------------------------------------------------------------
-void debug_unregister (debug_info_t * id);
-
-Parameter:     id:   handle for debug log  
-
-Return Value:  none 
-
-Description:   frees memory for a debug log and removes all registered debug
-               views.
-               Must not be called within an interrupt handler 
-
----------------------------------------------------------------------------
-void debug_set_level (debug_info_t * id, int new_level);
-
-Parameter:     id:        handle for debug log  
-               new_level: new debug level 
-
-Return Value:  none 
-
-Description:   Sets new actual debug level if new_level is valid. 
-
----------------------------------------------------------------------------
-bool debug_level_enabled (debug_info_t * id, int level);
-
-Parameter:    id:         handle for debug log
-              level:      debug level
-
-Return Value: True if level is less or equal to the current debug level.
-
-Description:  Returns true if debug events for the specified level would be
-              logged. Otherwise returns false.
----------------------------------------------------------------------------
-void debug_stop_all(void);
-
-Parameter:     none
-
-Return Value:  none
-
-Description:   stops the debug feature if stopping is allowed. Currently
-               used in case of a kernel oops.
-
----------------------------------------------------------------------------
-debug_entry_t* debug_event (debug_info_t* id, int level, void* data, 
-                            int length);
-
-Parameter:     id:     handle for debug log  
-               level:  debug level           
-               data:   pointer to data for debug entry  
-               length: length of data in bytes       
-
-Return Value:  Address of written debug entry 
-
-Description:   writes debug entry to active debug area (if level <= actual 
-               debug level)    
-
----------------------------------------------------------------------------
-debug_entry_t* debug_int_event (debug_info_t * id, int level, 
-                                unsigned int data);
-debug_entry_t* debug_long_event(debug_info_t * id, int level,
-                                unsigned long data);
-
-Parameter:     id:     handle for debug log  
-               level:  debug level           
-               data:   integer value for debug entry           
-
-Return Value:  Address of written debug entry 
-
-Description:   writes debug entry to active debug area (if level <= actual 
-               debug level)    
-
----------------------------------------------------------------------------
-debug_entry_t* debug_text_event (debug_info_t * id, int level, 
-                                 const char* data);
-
-Parameter:     id:     handle for debug log  
-               level:  debug level           
-               data:   string for debug entry  
-
-Return Value:  Address of written debug entry 
-
-Description:   writes debug entry in ascii format to active debug area 
-               (if level <= actual debug level)     
-
----------------------------------------------------------------------------
-debug_entry_t* debug_sprintf_event (debug_info_t * id, int level, 
-                                    char* string,...);
-
-Parameter:     id:    handle for debug log 
-               level: debug level
-               string: format string for debug entry 
-               ...: varargs used as in sprintf()
-
-Return Value:  Address of written debug entry
-
-Description:   writes debug entry with format string and varargs (longs) to 
-               active debug area (if level $<=$ actual debug level). 
-               floats and long long datatypes cannot be used as varargs.
-
----------------------------------------------------------------------------
-
-debug_entry_t* debug_exception (debug_info_t* id, int level, void* data, 
-                                int length);
-
-Parameter:     id:     handle for debug log  
-               level:  debug level           
-               data:   pointer to data for debug entry  
-               length: length of data in bytes       
-
-Return Value:  Address of written debug entry 
-
-Description:   writes debug entry to active debug area (if level <= actual 
-               debug level) and switches to next debug area  
-
----------------------------------------------------------------------------
-debug_entry_t* debug_int_exception (debug_info_t * id, int level, 
-                                    unsigned int data);
-debug_entry_t* debug_long_exception(debug_info_t * id, int level,
-                                    unsigned long data);
-
-Parameter:     id:     handle for debug log  
-               level:  debug level           
-               data:   integer value for debug entry           
-
-Return Value:  Address of written debug entry 
-
-Description:   writes debug entry to active debug area (if level <= actual 
-               debug level) and switches to next debug area  
-
----------------------------------------------------------------------------
-debug_entry_t* debug_text_exception (debug_info_t * id, int level, 
-                                     const char* data);
-
-Parameter:     id:     handle for debug log  
-               level:  debug level           
-               data:   string for debug entry  
-
-Return Value:  Address of written debug entry 
-
-Description:   writes debug entry in ascii format to active debug area 
-               (if level <= actual debug level) and switches to next debug 
-               area  
-
----------------------------------------------------------------------------
-debug_entry_t* debug_sprintf_exception (debug_info_t * id, int level,
-                                        char* string,...);
-
-Parameter:     id:    handle for debug log  
-               level: debug level  
-               string: format string for debug entry  
-               ...: varargs used as in sprintf()
-
-Return Value:  Address of written debug entry 
-
-Description:   writes debug entry with format string and varargs (longs) to 
-               active debug area (if level $<=$ actual debug level) and
-               switches to next debug area. 
-               floats and long long datatypes cannot be used as varargs.
-
----------------------------------------------------------------------------
-
-int debug_register_view (debug_info_t * id, struct debug_view *view);
-
-Parameter:     id:    handle for debug log  
-               view:  pointer to debug view struct 
-
-Return Value:  0  : ok 
-               < 0: Error 
-
-Description:   registers new debug view and creates debugfs dir entry
-
----------------------------------------------------------------------------
-int debug_unregister_view (debug_info_t * id, struct debug_view *view); 
-
-Parameter:     id:    handle for debug log  
-               view:  pointer to debug view struct 
-
-Return Value:  0  : ok 
-               < 0: Error 
-
-Description:   unregisters debug view and removes debugfs dir entry
-
-
-
-Predefined views:
------------------
-
-extern struct debug_view debug_hex_ascii_view;
-extern struct debug_view debug_raw_view;
-extern struct debug_view debug_sprintf_view;
-
-Examples
---------
-
-/*
- * hex_ascii- + raw-view Example
- */
-
-#include <linux/init.h>
-#include <asm/debug.h>
-
-static debug_info_t* debug_info;
-
-static int init(void)
-{
-    /* register 4 debug areas with one page each and 4 byte data field */
-
-    debug_info = debug_register ("test", 1, 4, 4 );
-    debug_register_view(debug_info,&debug_hex_ascii_view);
-    debug_register_view(debug_info,&debug_raw_view);
-
-    debug_text_event(debug_info, 4 , "one ");
-    debug_int_exception(debug_info, 4, 4711);
-    debug_event(debug_info, 3, &debug_info, 4);
-
-    return 0;
-}
-
-static void cleanup(void)
-{
-    debug_unregister (debug_info);
-}
-
-module_init(init);
-module_exit(cleanup);
-
----------------------------------------------------------------------------
-
-/*
- * sprintf-view Example
- */
-
-#include <linux/init.h>
-#include <asm/debug.h>
-
-static debug_info_t* debug_info;
-
-static int init(void)
-{
-    /* register 4 debug areas with one page each and data field for */
-    /* format string pointer + 2 varargs (= 3 * sizeof(long))       */
-
-    debug_info = debug_register ("test", 1, 4, sizeof(long) * 3);
-    debug_register_view(debug_info,&debug_sprintf_view);
-
-    debug_sprintf_event(debug_info, 2 , "first event in %s:%i\n",__FILE__,__LINE__);
-    debug_sprintf_exception(debug_info, 1, "pointer to debug info: %p\n",&debug_info);
-
-    return 0;
-}
-
-static void cleanup(void)
-{
-    debug_unregister (debug_info);
-}
-
-module_init(init);
-module_exit(cleanup);
-
-
-
-Debugfs Interface
-----------------
-Views to the debug logs can be investigated through reading the corresponding 
-debugfs-files:
-
-Example:
-
-> ls /sys/kernel/debug/s390dbf/dasd
-flush  hex_ascii  level pages raw
-> cat /sys/kernel/debug/s390dbf/dasd/hex_ascii | sort -k2,2 -s
-00 00974733272:680099 2 - 02 0006ad7e  07 ea 4a 90 | ....
-00 00974733272:682210 2 - 02 0006ade6  46 52 45 45 | FREE
-00 00974733272:682213 2 - 02 0006adf6  07 ea 4a 90 | ....
-00 00974733272:682281 1 * 02 0006ab08  41 4c 4c 43 | EXCP 
-01 00974733272:682284 2 - 02 0006ab16  45 43 4b 44 | ECKD
-01 00974733272:682287 2 - 02 0006ab28  00 00 00 04 | ....
-01 00974733272:682289 2 - 02 0006ab3e  00 00 00 20 | ... 
-01 00974733272:682297 2 - 02 0006ad7e  07 ea 4a 90 | ....
-01 00974733272:684384 2 - 00 0006ade6  46 52 45 45 | FREE
-01 00974733272:684388 2 - 00 0006adf6  07 ea 4a 90 | ....
-
-See section about predefined views for explanation of the above output!
-
-Changing the debug level
-------------------------
-
-Example:
-
-
-> cat /sys/kernel/debug/s390dbf/dasd/level
-3
-> echo "5" > /sys/kernel/debug/s390dbf/dasd/level
-> cat /sys/kernel/debug/s390dbf/dasd/level
-5
-
-Flushing debug areas
---------------------
-Debug areas can be flushed with piping the number of the desired
-area (0...n) to the debugfs file "flush". When using "-" all debug areas
-are flushed.
-
-Examples:
-
-1. Flush debug area 0:
-> echo "0" > /sys/kernel/debug/s390dbf/dasd/flush
-
-2. Flush all debug areas:
-> echo "-" > /sys/kernel/debug/s390dbf/dasd/flush
-
-Changing the size of debug areas
-------------------------------------
-It is possible the change the size of debug areas through piping
-the number of pages to the debugfs file "pages". The resize request will
-also flush the debug areas.
-
-Example:
-
-Define 4 pages for the debug areas of debug feature "dasd":
-> echo "4" > /sys/kernel/debug/s390dbf/dasd/pages
-
-Stooping the debug feature
---------------------------
-Example:
-
-1. Check if stopping is allowed
-> cat /proc/sys/s390dbf/debug_stoppable
-2. Stop debug feature
-> echo 0 > /proc/sys/s390dbf/debug_active
-
-lcrash Interface
-----------------
-It is planned that the dump analysis tool lcrash gets an additional command
-'s390dbf' to display all the debug logs. With this tool it will be possible 
-to investigate the debug logs on a live system and with a memory dump after 
-a system crash.
-
-Investigating raw memory
-------------------------
-One last possibility to investigate the debug logs at a live
-system and after a system crash is to look at the raw memory
-under VM or at the Service Element.
-It is possible to find the anker of the debug-logs through
-the 'debug_area_first' symbol in the System map. Then one has
-to follow the correct pointers of the data-structures defined
-in debug.h and find the debug-areas in memory.
-Normally modules which use the debug feature will also have
-a global variable with the pointer to the debug-logs. Following
-this pointer it will also be possible to find the debug logs in
-memory.
-
-For this method it is recommended to use '16 * x + 4' byte (x = 0..n)
-for the length of the data field in debug_register() in
-order to see the debug entries well formatted.
-
-
-Predefined Views
-----------------
-
-There are three predefined views: hex_ascii, raw and sprintf. 
-The hex_ascii view shows the data field in hex and ascii representation 
-(e.g. '45 43 4b 44 | ECKD'). 
-The raw view returns a bytestream as the debug areas are stored in memory.
-
-The sprintf view formats the debug entries in the same way as the sprintf
-function would do. The sprintf event/exception functions write to the
-debug entry a pointer to the format string (size = sizeof(long)) 
-and for each vararg a long value. So e.g. for a debug entry with a format 
-string plus two varargs one would need to allocate a (3 * sizeof(long)) 
-byte data area in the debug_register() function.
-
-IMPORTANT: Using "%s" in sprintf event functions is dangerous. You can only
-use "%s" in the sprintf event functions, if the memory for the passed string is
-available as long as the debug feature exists. The reason behind this is that
-due to performance considerations only a pointer to the string is stored in
-the debug feature. If you log a string that is freed afterwards, you will get
-an OOPS when inspecting the debug feature, because then the debug feature will
-access the already freed memory.
-
-NOTE: If using the sprintf view do NOT use other event/exception functions
-than the sprintf-event and -exception functions.
-
-The format of the hex_ascii and sprintf view is as follows:
-- Number of area
-- Timestamp (formatted as seconds and microseconds since 00:00:00 Coordinated 
-  Universal Time (UTC), January 1, 1970)
-- level of debug entry
-- Exception flag (* = Exception)
-- Cpu-Number of calling task
-- Return Address to caller
-- data field
-
-The format of the raw view is:
-- Header as described in debug.h
-- datafield 
-
-A typical line of the hex_ascii view will look like the following (first line 
-is only for explanation and will not be displayed when 'cating' the view):
-
-area  time           level exception cpu caller    data (hex + ascii)
---------------------------------------------------------------------------
-00    00964419409:440690 1 -         00  88023fe   
-
-
-Defining views
---------------
-
-Views are specified with the 'debug_view' structure. There are defined
-callback functions which are used for reading and writing the debugfs files:
-
-struct debug_view {
-        char name[DEBUG_MAX_PROCF_LEN];  
-        debug_prolog_proc_t* prolog_proc; 
-        debug_header_proc_t* header_proc;
-        debug_format_proc_t* format_proc;
-        debug_input_proc_t*  input_proc;
-        void*                private_data;
-};
-
-where
-
-typedef int (debug_header_proc_t) (debug_info_t* id,
-                                   struct debug_view* view,
-                                   int area,
-                                   debug_entry_t* entry,
-                                   char* out_buf);
-
-typedef int (debug_format_proc_t) (debug_info_t* id,
-                                   struct debug_view* view, char* out_buf,
-                                   const char* in_buf);
-typedef int (debug_prolog_proc_t) (debug_info_t* id,
-                                   struct debug_view* view,
-                                   char* out_buf);
-typedef int (debug_input_proc_t) (debug_info_t* id,
-                                  struct debug_view* view,
-                                  struct file* file, const char* user_buf,
-                                  size_t in_buf_size, loff_t* offset);
-
-
-The "private_data" member can be used as pointer to view specific data.
-It is not used by the debug feature itself.
-
-The output when reading a debugfs file is structured like this:
-
-"prolog_proc output"
-
-"header_proc output 1"  "format_proc output 1"
-"header_proc output 2"  "format_proc output 2"
-"header_proc output 3"  "format_proc output 3"
-...
-
-When a view is read from the debugfs, the Debug Feature calls the
-'prolog_proc' once for writing the prolog.
-Then 'header_proc' and 'format_proc' are called for each 
-existing debug entry.
-
-The input_proc can be used to implement functionality when it is written to 
-the view (e.g. like with 'echo "0" > /sys/kernel/debug/s390dbf/dasd/level).
-
-For header_proc there can be used the default function
-debug_dflt_header_fn() which is defined in debug.h.
-and which produces the same header output as the predefined views.
-E.g:
-00 00964419409:440761 2 - 00 88023ec
-
-In order to see how to use the callback functions check the implementation
-of the default views!
-
-Example
-
-#include <asm/debug.h>
-
-#define UNKNOWNSTR "data: %08x"
-
-const char* messages[] =
-{"This error...........\n",
- "That error...........\n",
- "Problem..............\n",
- "Something went wrong.\n",
- "Everything ok........\n",
- NULL
-};
-
-static int debug_test_format_fn(
-   debug_info_t * id, struct debug_view *view, 
-   char *out_buf, const char *in_buf
-)
-{
-  int i, rc = 0;
-
-  if(id->buf_size >= 4) {
-     int msg_nr = *((int*)in_buf);
-     if(msg_nr < sizeof(messages)/sizeof(char*) - 1)
-        rc += sprintf(out_buf, "%s", messages[msg_nr]); 
-     else
-        rc += sprintf(out_buf, UNKNOWNSTR, msg_nr);
-  }
- out:
-   return rc;
-}
-
-struct debug_view debug_test_view = {
-  "myview",                 /* name of view */
-  NULL,                     /* no prolog */
-  &debug_dflt_header_fn,    /* default header for each entry */
-  &debug_test_format_fn,    /* our own format function */
-  NULL,                     /* no input function */
-  NULL                      /* no private data */
-};
-
-=====
-test:
-=====
-debug_info_t *debug_info;
-...
-debug_info = debug_register ("test", 0, 4, 4 ));
-debug_register_view(debug_info, &debug_test_view);
-for(i = 0; i < 10; i ++) debug_int_event(debug_info, 1, i);
-
-> cat /sys/kernel/debug/s390dbf/test/myview
-00 00964419734:611402 1 - 00 88042ca   This error...........
-00 00964419734:611405 1 - 00 88042ca   That error...........
-00 00964419734:611408 1 - 00 88042ca   Problem..............
-00 00964419734:611411 1 - 00 88042ca   Something went wrong.
-00 00964419734:611414 1 - 00 88042ca   Everything ok........
-00 00964419734:611417 1 - 00 88042ca   data: 00000005
-00 00964419734:611419 1 - 00 88042ca   data: 00000006
-00 00964419734:611422 1 - 00 88042ca   data: 00000007
-00 00964419734:611425 1 - 00 88042ca   data: 00000008
-00 00964419734:611428 1 - 00 88042ca   data: 00000009
diff --git a/Documentation/s390/text_files.rst b/Documentation/s390/text_files.rst
new file mode 100644
index 000000000000..c94d05d4fa17
--- /dev/null
+++ b/Documentation/s390/text_files.rst
@@ -0,0 +1,11 @@
+ibm 3270 changelog
+------------------
+
+.. include:: 3270.ChangeLog
+    :literal:
+
+ibm 3270 config3270.sh
+----------------------
+
+.. literalinclude:: config3270.sh
+    :language: shell
diff --git a/Documentation/s390/vfio-ap.txt b/Documentation/s390/vfio-ap.rst
index 65167cfe4485..b5c51f7c748d 100644
--- a/Documentation/s390/vfio-ap.txt
+++ b/Documentation/s390/vfio-ap.rst
@@ -1,4 +1,9 @@
-Introduction:
+===============================
+Adjunct Processor (AP) facility
+===============================
+
+
+Introduction
 ============
 The Adjunct Processor (AP) facility is an IBM Z cryptographic facility comprised
 of three AP instructions and from 1 up to 256 PCIe cryptographic adapter cards.
@@ -11,7 +16,7 @@ framework. This implementation relies considerably on the s390 virtualization
 facilities which do most of the hard work of providing direct access to AP
 devices.
 
-AP Architectural Overview:
+AP Architectural Overview
 =========================
 To facilitate the comprehension of the design, let's start with some
 definitions:
@@ -31,13 +36,13 @@ definitions:
   in the LPAR, the AP bus detects the AP adapter cards assigned to the LPAR and
   creates a sysfs device for each assigned adapter. For example, if AP adapters
   4 and 10 (0x0a) are assigned to the LPAR, the AP bus will create the following
-  sysfs device entries:
+  sysfs device entries::
 
     /sys/devices/ap/card04
     /sys/devices/ap/card0a
 
   Symbolic links to these devices will also be created in the AP bus devices
-  sub-directory:
+  sub-directory::
 
     /sys/bus/ap/devices/[card04]
     /sys/bus/ap/devices/[card04]
@@ -84,7 +89,7 @@ definitions:
   the cross product of the AP adapter and usage domain numbers detected when the
   AP bus module is loaded. For example, if adapters 4 and 10 (0x0a) and usage
   domains 6 and 71 (0x47) are assigned to the LPAR, the AP bus will create the
-  following sysfs entries:
+  following sysfs entries::
 
     /sys/devices/ap/card04/04.0006
     /sys/devices/ap/card04/04.0047
@@ -92,7 +97,7 @@ definitions:
     /sys/devices/ap/card0a/0a.0047
 
   The following symbolic links to these devices will be created in the AP bus
-  devices subdirectory:
+  devices subdirectory::
 
     /sys/bus/ap/devices/[04.0006]
     /sys/bus/ap/devices/[04.0047]
@@ -112,7 +117,7 @@ definitions:
   domain that is not one of the usage domains, but the modified domain
   must be one of the control domains.
 
-AP and SIE:
+AP and SIE
 ==========
 Let's now take a look at how AP instructions executed on a guest are interpreted
 by the hardware.
@@ -153,7 +158,7 @@ and 2 and usage domains 5 and 6 are assigned to a guest, the APQNs (1,5), (1,6),
 
 The APQNs can provide secure key functionality - i.e., a private key is stored
 on the adapter card for each of its domains - so each APQN must be assigned to
-at most one guest or to the linux host.
+at most one guest or to the linux host::
 
    Example 1: Valid configuration:
    ------------------------------
@@ -181,8 +186,8 @@ at most one guest or to the linux host.
    This is an invalid configuration because both guests have access to
    APQN (1,6).
 
-The Design:
-===========
+The Design
+==========
 The design introduces three new objects:
 
 1. AP matrix device
@@ -205,43 +210,43 @@ The VFIO AP (vfio_ap) device driver serves the following purposes:
 Reserve APQNs for exclusive use of KVM guests
 ---------------------------------------------
 The following block diagram illustrates the mechanism by which APQNs are
-reserved:
-
-                              +------------------+
-               7 remove       |                  |
-         +--------------------> cex4queue driver |
-         |                    |                  |
-         |                    +------------------+
-         |
-         |
-         |                    +------------------+          +-----------------+
-         |  5 register driver |                  | 3 create |                 |
-         |   +---------------->   Device core    +---------->  matrix device  |
-         |   |                |                  |          |                 |
-         |   |                +--------^---------+          +-----------------+
-         |   |                         |
-         |   |                         +-------------------+
-         |   | +-----------------------------------+       |
-         |   | |      4 register AP driver         |       | 2 register device
-         |   | |                                   |       |
-+--------+---+-v---+                      +--------+-------+-+
-|                  |                      |                  |
-|      ap_bus      +--------------------- >  vfio_ap driver  |
-|                  |       8 probe        |                  |
-+--------^---------+                      +--^--^------------+
-6 edit   |                                   |  |
-  apmask |     +-----------------------------+  | 9 mdev create
-  aqmask |     |           1 modprobe           |
-+--------+-----+---+           +----------------+-+         +------------------+
-|                  |           |                  |8 create |     mediated     |
-|      admin       |           | VFIO device core |--------->     matrix       |
-|                  +           |                  |         |     device       |
-+------+-+---------+           +--------^---------+         +--------^---------+
-       | |                              |                            |
-       | | 9 create vfio_ap-passthrough |                            |
-       | +------------------------------+                            |
-       +-------------------------------------------------------------+
-                   10  assign adapter/domain/control domain
+reserved::
+
+                                +------------------+
+                 7 remove       |                  |
+           +--------------------> cex4queue driver |
+           |                    |                  |
+           |                    +------------------+
+           |
+           |
+           |                    +------------------+          +----------------+
+           |  5 register driver |                  | 3 create |                |
+           |   +---------------->   Device core    +---------->  matrix device |
+           |   |                |                  |          |                |
+           |   |                +--------^---------+          +----------------+
+           |   |                         |
+           |   |                         +-------------------+
+           |   | +-----------------------------------+       |
+           |   | |      4 register AP driver         |       | 2 register device
+           |   | |                                   |       |
+  +--------+---+-v---+                      +--------+-------+-+
+  |                  |                      |                  |
+  |      ap_bus      +--------------------- >  vfio_ap driver  |
+  |                  |       8 probe        |                  |
+  +--------^---------+                      +--^--^------------+
+  6 edit   |                                   |  |
+    apmask |     +-----------------------------+  | 9 mdev create
+    aqmask |     |           1 modprobe           |
+  +--------+-----+---+           +----------------+-+         +----------------+
+  |                  |           |                  |8 create |     mediated   |
+  |      admin       |           | VFIO device core |--------->     matrix     |
+  |                  +           |                  |         |     device     |
+  +------+-+---------+           +--------^---------+         +--------^-------+
+         | |                              |                            |
+         | | 9 create vfio_ap-passthrough |                            |
+         | +------------------------------+                            |
+         +-------------------------------------------------------------+
+                     10  assign adapter/domain/control domain
 
 The process for reserving an AP queue for use by a KVM guest is:
 
@@ -250,7 +255,7 @@ The process for reserving an AP queue for use by a KVM guest is:
    device with the device core. This will serve as the parent device for
    all mediated matrix devices used to configure an AP matrix for a guest.
 3. The /sys/devices/vfio_ap/matrix device is created by the device core
-4  The vfio_ap device driver will register with the AP bus for AP queue devices
+4. The vfio_ap device driver will register with the AP bus for AP queue devices
    of type 10 and higher (CEX4 and newer). The driver will provide the vfio_ap
    driver's probe and remove callback interfaces. Devices older than CEX4 queues
    are not supported to simplify the implementation by not needlessly
@@ -266,13 +271,14 @@ The process for reserving an AP queue for use by a KVM guest is:
    it.
 9. The administrator creates a passthrough type mediated matrix device to be
    used by a guest
-10 The administrator assigns the adapters, usage domains and control domains
-   to be exclusively used by a guest.
+10. The administrator assigns the adapters, usage domains and control domains
+    to be exclusively used by a guest.
 
 Set up the VFIO mediated device interfaces
 ------------------------------------------
 The VFIO AP device driver utilizes the common interface of the VFIO mediated
 device core driver to:
+
 * Register an AP mediated bus driver to add a mediated matrix device to and
   remove it from a VFIO group.
 * Create and destroy a mediated matrix device
@@ -280,25 +286,25 @@ device core driver to:
 * Add a mediated matrix device to and remove it from an IOMMU group
 
 The following high-level block diagram shows the main components and interfaces
-of the VFIO AP mediated matrix device driver:
-
- +-------------+
- |             |
- | +---------+ | mdev_register_driver() +--------------+
- | |  Mdev   | +<-----------------------+              |
- | |  bus    | |                        | vfio_mdev.ko |
- | | driver  | +----------------------->+              |<-> VFIO user
- | +---------+ |    probe()/remove()    +--------------+    APIs
- |             |
- |  MDEV CORE  |
- |   MODULE    |
- |   mdev.ko   |
- | +---------+ | mdev_register_device() +--------------+
- | |Physical | +<-----------------------+              |
- | | device  | |                        |  vfio_ap.ko  |<-> matrix
- | |interface| +----------------------->+              |    device
- | +---------+ |       callback         +--------------+
- +-------------+
+of the VFIO AP mediated matrix device driver::
+
+   +-------------+
+   |             |
+   | +---------+ | mdev_register_driver() +--------------+
+   | |  Mdev   | +<-----------------------+              |
+   | |  bus    | |                        | vfio_mdev.ko |
+   | | driver  | +----------------------->+              |<-> VFIO user
+   | +---------+ |    probe()/remove()    +--------------+    APIs
+   |             |
+   |  MDEV CORE  |
+   |   MODULE    |
+   |   mdev.ko   |
+   | +---------+ | mdev_register_device() +--------------+
+   | |Physical | +<-----------------------+              |
+   | | device  | |                        |  vfio_ap.ko  |<-> matrix
+   | |interface| +----------------------->+              |    device
+   | +---------+ |       callback         +--------------+
+   +-------------+
 
 During initialization of the vfio_ap module, the matrix device is registered
 with an 'mdev_parent_ops' structure that provides the sysfs attribute
@@ -306,7 +312,8 @@ structures, mdev functions and callback interfaces for managing the mediated
 matrix device.
 
 * sysfs attribute structures:
-  * supported_type_groups
+
+  supported_type_groups
     The VFIO mediated device framework supports creation of user-defined
     mediated device types. These mediated device types are specified
     via the 'supported_type_groups' structure when a device is registered
@@ -318,61 +325,72 @@ matrix device.
 
     The VFIO AP device driver will register one mediated device type for
     passthrough devices:
+
       /sys/devices/vfio_ap/matrix/mdev_supported_types/vfio_ap-passthrough
+
     Only the read-only attributes required by the VFIO mdev framework will
-    be provided:
-        ... name
-        ... device_api
-        ... available_instances
-        ... device_api
-        Where:
-        * name: specifies the name of the mediated device type
-        * device_api: the mediated device type's API
-        * available_instances: the number of mediated matrix passthrough devices
-                               that can be created
-        * device_api: specifies the VFIO API
-  * mdev_attr_groups
+    be provided::
+
+        ... name
+        ... device_api
+        ... available_instances
+        ... device_api
+
+    Where:
+
+        * name:
+            specifies the name of the mediated device type
+        * device_api:
+            the mediated device type's API
+        * available_instances:
+            the number of mediated matrix passthrough devices
+            that can be created
+        * device_api:
+            specifies the VFIO API
+  mdev_attr_groups
     This attribute group identifies the user-defined sysfs attributes of the
     mediated device. When a device is registered with the VFIO mediated device
     framework, the sysfs attribute files identified in the 'mdev_attr_groups'
     structure will be created in the mediated matrix device's directory. The
     sysfs attributes for a mediated matrix device are:
-    * assign_adapter:
-    * unassign_adapter:
+
+    assign_adapter / unassign_adapter:
       Write-only attributes for assigning/unassigning an AP adapter to/from the
       mediated matrix device. To assign/unassign an adapter, the APID of the
       adapter is echoed to the respective attribute file.
-    * assign_domain:
-    * unassign_domain:
+    assign_domain / unassign_domain:
       Write-only attributes for assigning/unassigning an AP usage domain to/from
       the mediated matrix device. To assign/unassign a domain, the domain
       number of the the usage domain is echoed to the respective attribute
       file.
-    * matrix:
+    matrix:
       A read-only file for displaying the APQNs derived from the cross product
       of the adapter and domain numbers assigned to the mediated matrix device.
-    * assign_control_domain:
-    * unassign_control_domain:
+    assign_control_domain / unassign_control_domain:
       Write-only attributes for assigning/unassigning an AP control domain
       to/from the mediated matrix device. To assign/unassign a control domain,
       the ID of the domain to be assigned/unassigned is echoed to the respective
       attribute file.
-    * control_domains:
+    control_domains:
       A read-only file for displaying the control domain numbers assigned to the
       mediated matrix device.
 
 * functions:
-  * create:
+
+  create:
     allocates the ap_matrix_mdev structure used by the vfio_ap driver to:
+
     * Store the reference to the KVM structure for the guest using the mdev
     * Store the AP matrix configuration for the adapters, domains, and control
       domains assigned via the corresponding sysfs attributes files
-  * remove:
+
+  remove:
     deallocates the mediated matrix device's ap_matrix_mdev structure. This will
     be allowed only if a running guest is not using the mdev.
 
 * callback interfaces
-  * open:
+
+  open:
     The vfio_ap driver uses this callback to register a
     VFIO_GROUP_NOTIFY_SET_KVM notifier callback function for the mdev matrix
     device. The open is invoked when QEMU connects the VFIO iommu group
@@ -380,16 +398,17 @@ matrix device.
     to configure the KVM guest is provided via this callback. The KVM structure,
     is used to configure the guest's access to the AP matrix defined via the
     mediated matrix device's sysfs attribute files.
-  * release:
+  release:
     unregisters the VFIO_GROUP_NOTIFY_SET_KVM notifier callback function for the
     mdev matrix device and deconfigures the guest's AP matrix.
 
-Configure the APM, AQM and ADM in the CRYCB:
+Configure the APM, AQM and ADM in the CRYCB
 -------------------------------------------
 Configuring the AP matrix for a KVM guest will be performed when the
 VFIO_GROUP_NOTIFY_SET_KVM notifier callback is invoked. The notifier
 function is called when QEMU connects to KVM. The guest's AP matrix is
 configured via it's CRYCB by:
+
 * Setting the bits in the APM corresponding to the APIDs assigned to the
   mediated matrix device via its 'assign_adapter' interface.
 * Setting the bits in the AQM corresponding to the domains assigned to the
@@ -418,12 +437,12 @@ available to a KVM guest via the following CPU model features:
 
 Note: If the user chooses to specify a CPU model different than the 'host'
 model to QEMU, the CPU model features and facilities need to be turned on
-explicitly; for example:
+explicitly; for example::
 
      /usr/bin/qemu-system-s390x ... -cpu z13,ap=on,apqci=on,apft=on
 
 A guest can be precluded from using AP features/facilities by turning them off
-explicitly; for example:
+explicitly; for example::
 
      /usr/bin/qemu-system-s390x ... -cpu host,ap=off,apqci=off,apft=off
 
@@ -435,7 +454,7 @@ the APFT facility is not installed on the guest, then the probe of device
 drivers will fail since only type 10 and newer devices can be configured for
 guest use.
 
-Example:
+Example
 =======
 Let's now provide an example to illustrate how KVM guests may be given
 access to AP facilities. For this example, we will show how to configure
@@ -444,30 +463,36 @@ look like this:
 
 Guest1
 ------
+=========== ===== ============
 CARD.DOMAIN TYPE  MODE
-------------------------------
+=========== ===== ============
 05          CEX5C CCA-Coproc
 05.0004     CEX5C CCA-Coproc
 05.00ab     CEX5C CCA-Coproc
 06          CEX5A Accelerator
 06.0004     CEX5A Accelerator
 06.00ab     CEX5C CCA-Coproc
+=========== ===== ============
 
 Guest2
 ------
+=========== ===== ============
 CARD.DOMAIN TYPE  MODE
-------------------------------
+=========== ===== ============
 05          CEX5A Accelerator
 05.0047     CEX5A Accelerator
 05.00ff     CEX5A Accelerator
+=========== ===== ============
 
 Guest2
 ------
+=========== ===== ============
 CARD.DOMAIN TYPE  MODE
-------------------------------
+=========== ===== ============
 06          CEX5A Accelerator
 06.0047     CEX5A Accelerator
 06.00ff     CEX5A Accelerator
+=========== ===== ============
 
 These are the steps:
 
@@ -492,25 +517,26 @@ These are the steps:
    * VFIO_MDEV_DEVICE
    * KVM
 
-   If using make menuconfig select the following to build the vfio_ap module:
-   -> Device Drivers
-      -> IOMMU Hardware Support
-         select S390 AP IOMMU Support
-      -> VFIO Non-Privileged userspace driver framework
-         -> Mediated device driver frramework
-            -> VFIO driver for Mediated devices
-   -> I/O subsystem
-      -> VFIO support for AP devices
+   If using make menuconfig select the following to build the vfio_ap module::
+
+     -> Device Drivers
+        -> IOMMU Hardware Support
+           select S390 AP IOMMU Support
+        -> VFIO Non-Privileged userspace driver framework
+           -> Mediated device driver frramework
+              -> VFIO driver for Mediated devices
+     -> I/O subsystem
+        -> VFIO support for AP devices
 
 2. Secure the AP queues to be used by the three guests so that the host can not
    access them. To secure them, there are two sysfs files that specify
    bitmasks marking a subset of the APQN range as 'usable by the default AP
    queue device drivers' or 'not usable by the default device drivers' and thus
    available for use by the vfio_ap device driver'. The location of the sysfs
-   files containing the masks are:
+   files containing the masks are::
 
-   /sys/bus/ap/apmask
-   /sys/bus/ap/aqmask
+     /sys/bus/ap/apmask
+     /sys/bus/ap/aqmask
 
    The 'apmask' is a 256-bit mask that identifies a set of AP adapter IDs
    (APID). Each bit in the mask, from left to right (i.e., from most significant
@@ -526,7 +552,7 @@ These are the steps:
    queue device drivers; otherwise, the APQI is usable by the vfio_ap device
    driver.
 
-   Take, for example, the following mask:
+   Take, for example, the following mask::
 
       0x7dffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff
 
@@ -548,68 +574,70 @@ These are the steps:
       respective sysfs mask file in one of two formats:
 
       * An absolute hex string starting with 0x - like "0x12345678" - sets
-        the mask. If the given string is shorter than the mask, it is padded
-        with 0s on the right; for example, specifying a mask value of 0x41 is
-        the same as specifying:
+        the mask. If the given string is shorter than the mask, it is padded
+        with 0s on the right; for example, specifying a mask value of 0x41 is
+        the same as specifying::
 
-           0x4100000000000000000000000000000000000000000000000000000000000000
+           0x4100000000000000000000000000000000000000000000000000000000000000
 
-        Keep in mind that the mask reads from left to right (i.e., most
-        significant to least significant bit in big endian order), so the mask
-        above identifies device numbers 1 and 7 (01000001).
+        Keep in mind that the mask reads from left to right (i.e., most
+        significant to least significant bit in big endian order), so the mask
+        above identifies device numbers 1 and 7 (01000001).
 
-        If the string is longer than the mask, the operation is terminated with
-        an error (EINVAL).
+        If the string is longer than the mask, the operation is terminated with
+        an error (EINVAL).
 
       * Individual bits in the mask can be switched on and off by specifying
-        each bit number to be switched in a comma separated list. Each bit
-        number string must be prepended with a ('+') or minus ('-') to indicate
-        the corresponding bit is to be switched on ('+') or off ('-'). Some
-        valid values are:
+        each bit number to be switched in a comma separated list. Each bit
+        number string must be prepended with a ('+') or minus ('-') to indicate
+        the corresponding bit is to be switched on ('+') or off ('-'). Some
+        valid values are:
 
-           "+0"    switches bit 0 on
-           "-13"   switches bit 13 off
-           "+0x41" switches bit 65 on
-           "-0xff" switches bit 255 off
+           - "+0"    switches bit 0 on
+           - "-13"   switches bit 13 off
+           - "+0x41" switches bit 65 on
+           - "-0xff" switches bit 255 off
 
-           The following example:
-              +0,-6,+0x47,-0xf0
+        The following example:
 
-              Switches bits 0 and 71 (0x47) on
-              Switches bits 6 and 240 (0xf0) off
+              +0,-6,+0x47,-0xf0
 
-        Note that the bits not specified in the list remain as they were before
-        the operation.
+        Switches bits 0 and 71 (0x47) on
+
+        Switches bits 6 and 240 (0xf0) off
+
+        Note that the bits not specified in the list remain as they were before
+        the operation.
 
    2. The masks can also be changed at boot time via parameters on the kernel
       command line like this:
 
-         ap.apmask=0xffff ap.aqmask=0x40
+         ap.apmask=0xffff ap.aqmask=0x40
 
-         This would create the following masks:
+         This would create the following masks::
 
-            apmask:
-            0xffff000000000000000000000000000000000000000000000000000000000000
+            apmask:
+            0xffff000000000000000000000000000000000000000000000000000000000000
 
-            aqmask:
-            0x4000000000000000000000000000000000000000000000000000000000000000
+            aqmask:
+            0x4000000000000000000000000000000000000000000000000000000000000000
 
-         Resulting in these two pools:
+         Resulting in these two pools::
 
-            default drivers pool:    adapter 0-15, domain 1
-            alternate drivers pool:  adapter 16-255, domains 0, 2-255
+            default drivers pool:    adapter 0-15, domain 1
+            alternate drivers pool:  adapter 16-255, domains 0, 2-255
 
-   Securing the APQNs for our example:
-   ----------------------------------
+Securing the APQNs for our example
+----------------------------------
    To secure the AP queues 05.0004, 05.0047, 05.00ab, 05.00ff, 06.0004, 06.0047,
    06.00ab, and 06.00ff for use by the vfio_ap device driver, the corresponding
-   APQNs can either be removed from the default masks:
+   APQNs can either be removed from the default masks::
 
       echo -5,-6 > /sys/bus/ap/apmask
 
       echo -4,-0x47,-0xab,-0xff > /sys/bus/ap/aqmask
 
-   Or the masks can be set as follows:
+   Or the masks can be set as follows::
 
       echo 0xf9ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff \
       > apmask
@@ -620,19 +648,19 @@ These are the steps:
    This will result in AP queues 05.0004, 05.0047, 05.00ab, 05.00ff, 06.0004,
    06.0047, 06.00ab, and 06.00ff getting bound to the vfio_ap device driver. The
    sysfs directory for the vfio_ap device driver will now contain symbolic links
-   to the AP queue devices bound to it:
-
-   /sys/bus/ap
-   ... [drivers]
-   ...... [vfio_ap]
-   ......... [05.0004]
-   ......... [05.0047]
-   ......... [05.00ab]
-   ......... [05.00ff]
-   ......... [06.0004]
-   ......... [06.0047]
-   ......... [06.00ab]
-   ......... [06.00ff]
+   to the AP queue devices bound to it::
+
+     /sys/bus/ap
+     ... [drivers]
+     ...... [vfio_ap]
+     ......... [05.0004]
+     ......... [05.0047]
+     ......... [05.00ab]
+     ......... [05.00ff]
+     ......... [06.0004]
+     ......... [06.0047]
+     ......... [06.00ab]
+     ......... [06.00ff]
 
    Keep in mind that only type 10 and newer adapters (i.e., CEX4 and later)
    can be bound to the vfio_ap device driver. The reason for this is to
@@ -645,96 +673,96 @@ These are the steps:
    queue device can be read from the parent card's sysfs directory. For example,
    to see the hardware type of the queue 05.0004:
 
-   cat /sys/bus/ap/devices/card05/hwtype
+     cat /sys/bus/ap/devices/card05/hwtype
 
    The hwtype must be 10 or higher (CEX4 or newer) in order to be bound to the
    vfio_ap device driver.
 
 3. Create the mediated devices needed to configure the AP matrixes for the
    three guests and to provide an interface to the vfio_ap driver for
-   use by the guests:
+   use by the guests::
 
-   /sys/devices/vfio_ap/matrix/
-   --- [mdev_supported_types]
-   ------ [vfio_ap-passthrough] (passthrough mediated matrix device type)
-   --------- create
-   --------- [devices]
+     /sys/devices/vfio_ap/matrix/
+     --- [mdev_supported_types]
+     ------ [vfio_ap-passthrough] (passthrough mediated matrix device type)
+     --------- create
+     --------- [devices]
 
-   To create the mediated devices for the three guests:
+   To create the mediated devices for the three guests::
 
         uuidgen > create
         uuidgen > create
         uuidgen > create
 
-        or
+        or
 
-        echo $uuid1 > create
-        echo $uuid2 > create
-        echo $uuid3 > create
+        echo $uuid1 > create
+        echo $uuid2 > create
+        echo $uuid3 > create
 
    This will create three mediated devices in the [devices] subdirectory named
    after the UUID written to the create attribute file. We call them $uuid1,
-   $uuid2 and $uuid3 and this is the sysfs directory structure after creation:
-
-   /sys/devices/vfio_ap/matrix/
-   --- [mdev_supported_types]
-   ------ [vfio_ap-passthrough]
-   --------- [devices]
-   ------------ [$uuid1]
-   --------------- assign_adapter
-   --------------- assign_control_domain
-   --------------- assign_domain
-   --------------- matrix
-   --------------- unassign_adapter
-   --------------- unassign_control_domain
-   --------------- unassign_domain
-
-   ------------ [$uuid2]
-   --------------- assign_adapter
-   --------------- assign_control_domain
-   --------------- assign_domain
-   --------------- matrix
-   --------------- unassign_adapter
-   ----------------unassign_control_domain
-   ----------------unassign_domain
-
-   ------------ [$uuid3]
-   --------------- assign_adapter
-   --------------- assign_control_domain
-   --------------- assign_domain
-   --------------- matrix
-   --------------- unassign_adapter
-   ----------------unassign_control_domain
-   ----------------unassign_domain
+   $uuid2 and $uuid3 and this is the sysfs directory structure after creation::
+
+     /sys/devices/vfio_ap/matrix/
+     --- [mdev_supported_types]
+     ------ [vfio_ap-passthrough]
+     --------- [devices]
+     ------------ [$uuid1]
+     --------------- assign_adapter
+     --------------- assign_control_domain
+     --------------- assign_domain
+     --------------- matrix
+     --------------- unassign_adapter
+     --------------- unassign_control_domain
+     --------------- unassign_domain
+
+     ------------ [$uuid2]
+     --------------- assign_adapter
+     --------------- assign_control_domain
+     --------------- assign_domain
+     --------------- matrix
+     --------------- unassign_adapter
+     ----------------unassign_control_domain
+     ----------------unassign_domain
+
+     ------------ [$uuid3]
+     --------------- assign_adapter
+     --------------- assign_control_domain
+     --------------- assign_domain
+     --------------- matrix
+     --------------- unassign_adapter
+     ----------------unassign_control_domain
+     ----------------unassign_domain
 
 4. The administrator now needs to configure the matrixes for the mediated
    devices $uuid1 (for Guest1), $uuid2 (for Guest2) and $uuid3 (for Guest3).
 
-   This is how the matrix is configured for Guest1:
+   This is how the matrix is configured for Guest1::
 
       echo 5 > assign_adapter
       echo 6 > assign_adapter
       echo 4 > assign_domain
       echo 0xab > assign_domain
 
-      Control domains can similarly be assigned using the assign_control_domain
-      sysfs file.
+   Control domains can similarly be assigned using the assign_control_domain
+   sysfs file.
 
-      If a mistake is made configuring an adapter, domain or control domain,
-      you can use the unassign_xxx files to unassign the adapter, domain or
-      control domain.
+   If a mistake is made configuring an adapter, domain or control domain,
+   you can use the unassign_xxx files to unassign the adapter, domain or
+   control domain.
 
-      To display the matrix configuration for Guest1:
+   To display the matrix configuration for Guest1::
 
-         cat matrix
+         cat matrix
 
-   This is how the matrix is configured for Guest2:
+   This is how the matrix is configured for Guest2::
 
       echo 5 > assign_adapter
       echo 0x47 > assign_domain
       echo 0xff > assign_domain
 
-   This is how the matrix is configured for Guest3:
+   This is how the matrix is configured for Guest3::
 
       echo 6 > assign_adapter
       echo 0x47 > assign_domain
@@ -783,24 +811,24 @@ These are the steps:
    configured for the system. If a control domain number higher than the maximum
    is specified, the operation will terminate with an error (ENODEV).
 
-5. Start Guest1:
+5. Start Guest1::
 
-   /usr/bin/qemu-system-s390x ... -cpu host,ap=on,apqci=on,apft=on \
-      -device vfio-ap,sysfsdev=/sys/devices/vfio_ap/matrix/$uuid1 ...
+     /usr/bin/qemu-system-s390x ... -cpu host,ap=on,apqci=on,apft=on \
+        -device vfio-ap,sysfsdev=/sys/devices/vfio_ap/matrix/$uuid1 ...
 
-7. Start Guest2:
+7. Start Guest2::
 
-   /usr/bin/qemu-system-s390x ... -cpu host,ap=on,apqci=on,apft=on \
-      -device vfio-ap,sysfsdev=/sys/devices/vfio_ap/matrix/$uuid2 ...
+     /usr/bin/qemu-system-s390x ... -cpu host,ap=on,apqci=on,apft=on \
+        -device vfio-ap,sysfsdev=/sys/devices/vfio_ap/matrix/$uuid2 ...
 
-7. Start Guest3:
+7. Start Guest3::
 
-   /usr/bin/qemu-system-s390x ... -cpu host,ap=on,apqci=on,apft=on \
-      -device vfio-ap,sysfsdev=/sys/devices/vfio_ap/matrix/$uuid3 ...
+     /usr/bin/qemu-system-s390x ... -cpu host,ap=on,apqci=on,apft=on \
+        -device vfio-ap,sysfsdev=/sys/devices/vfio_ap/matrix/$uuid3 ...
 
 When the guest is shut down, the mediated matrix devices may be removed.
 
-Using our example again, to remove the mediated matrix device $uuid1:
+Using our example again, to remove the mediated matrix device $uuid1::
 
    /sys/devices/vfio_ap/matrix/
       --- [mdev_supported_types]
@@ -809,18 +837,19 @@ Using our example again, to remove the mediated matrix device $uuid1:
       ------------ [$uuid1]
       --------------- remove
 
+::
 
    echo 1 > remove
 
-   This will remove all of the mdev matrix device's sysfs structures including
-   the mdev device itself. To recreate and reconfigure the mdev matrix device,
-   all of the steps starting with step 3 will have to be performed again. Note
-   that the remove will fail if a guest using the mdev is still running.
+This will remove all of the mdev matrix device's sysfs structures including
+the mdev device itself. To recreate and reconfigure the mdev matrix device,
+all of the steps starting with step 3 will have to be performed again. Note
+that the remove will fail if a guest using the mdev is still running.
 
-   It is not necessary to remove an mdev matrix device, but one may want to
-   remove it if no guest will use it during the remaining lifetime of the linux
-   host. If the mdev matrix device is removed, one may want to also reconfigure
-   the pool of adapters and queues reserved for use by the default drivers.
+It is not necessary to remove an mdev matrix device, but one may want to
+remove it if no guest will use it during the remaining lifetime of the linux
+host. If the mdev matrix device is removed, one may want to also reconfigure
+the pool of adapters and queues reserved for use by the default drivers.
 
 Limitations
 ===========
diff --git a/Documentation/s390/vfio-ccw.txt b/Documentation/s390/vfio-ccw.rst
index 2be11ad864ff..1f6d0b56d53e 100644
--- a/Documentation/s390/vfio-ccw.txt
+++ b/Documentation/s390/vfio-ccw.rst
@@ -1,3 +1,4 @@
+==================================
 vfio-ccw: the basic infrastructure
 ==================================
 
@@ -11,9 +12,11 @@ virtual machine, while vfio is the means.
 Different than other hardware architectures, s390 has defined a unified
 I/O access method, which is so called Channel I/O. It has its own access
 patterns:
+
 - Channel programs run asynchronously on a separate (co)processor.
 - The channel subsystem will access any memory designated by the caller
   in the channel program directly, i.e. there is no iommu involved.
+
 Thus when we introduce vfio support for these devices, we realize it
 with a mediated device (mdev) implementation. The vfio mdev will be
 added to an iommu group, so as to make itself able to be managed by the
@@ -24,6 +27,7 @@ to perform I/O instructions.
 
 This document does not intend to explain the s390 I/O architecture in
 every detail. More information/reference could be found here:
+
 - A good start to know Channel I/O in general:
   https://en.wikipedia.org/wiki/Channel_I/O
 - s390 architecture:
@@ -80,6 +84,7 @@ until interrupted. The I/O completion result is received by the
 interrupt handler in the form of interrupt response block (IRB).
 
 Back to vfio-ccw, in short:
+
 - ORBs and channel programs are built in guest kernel (with guest
   physical addresses).
 - ORBs and channel programs are passed to the host kernel.
@@ -106,6 +111,7 @@ it gets sent to hardware.
 
 Within this implementation, we have two drivers for two types of
 devices:
+
 - The vfio_ccw driver for the physical subchannel device.
   This is an I/O subchannel driver for the real subchannel device.  It
   realizes a group of callbacks and registers to the mdev framework as a
@@ -137,7 +143,7 @@ devices:
   vfio_pin_pages and a vfio_unpin_pages interfaces from the vfio iommu
   backend for the physical devices to pin and unpin pages by demand.
 
-Below is a high Level block diagram.
+Below is a high Level block diagram::
 
  +-------------+
  |             |
@@ -158,6 +164,7 @@ Below is a high Level block diagram.
  +-------------+
 
 The process of how these work together.
+
 1. vfio_ccw.ko drives the physical I/O subchannel, and registers the
    physical device (with callbacks) to mdev framework.
    When vfio_ccw probing the subchannel device, it registers device
@@ -178,17 +185,17 @@ vfio-ccw I/O region
 
 An I/O region is used to accept channel program request from user
 space and store I/O interrupt result for user space to retrieve. The
-definition of the region is:
-
-struct ccw_io_region {
-#define ORB_AREA_SIZE 12
-        __u8    orb_area[ORB_AREA_SIZE];
-#define SCSW_AREA_SIZE 12
-        __u8    scsw_area[SCSW_AREA_SIZE];
-#define IRB_AREA_SIZE 96
-        __u8    irb_area[IRB_AREA_SIZE];
-        __u32   ret_code;
-} __packed;
+definition of the region is::
+
+  struct ccw_io_region {
+  #define ORB_AREA_SIZE 12
+          __u8    orb_area[ORB_AREA_SIZE];
+  #define SCSW_AREA_SIZE 12
+          __u8    scsw_area[SCSW_AREA_SIZE];
+  #define IRB_AREA_SIZE 96
+          __u8    irb_area[IRB_AREA_SIZE];
+          __u32   ret_code;
+  } __packed;
 
 While starting an I/O request, orb_area should be filled with the
 guest ORB, and scsw_area should be filled with the SCSW of the Virtual
@@ -205,7 +212,7 @@ vfio-ccw follows what vfio-pci did on the s390 platform and uses
 vfio-iommu-type1 as the vfio iommu backend.
 
 * CCW translation APIs
-  A group of APIs (start with 'cp_') to do CCW translation. The CCWs
+  A group of APIs (start with `cp_`) to do CCW translation. The CCWs
   passed in by a user space program are organized with their guest
   physical memory addresses. These APIs will copy the CCWs into kernel
   space, and assemble a runnable kernel channel program by updating the
@@ -217,12 +224,14 @@ vfio-iommu-type1 as the vfio iommu backend.
   This driver utilizes the CCW translation APIs and introduces
   vfio_ccw, which is the driver for the I/O subchannel devices you want
   to pass through.
-  vfio_ccw implements the following vfio ioctls:
+  vfio_ccw implements the following vfio ioctls::
+
     VFIO_DEVICE_GET_INFO
     VFIO_DEVICE_GET_IRQ_INFO
     VFIO_DEVICE_GET_REGION_INFO
     VFIO_DEVICE_RESET
     VFIO_DEVICE_SET_IRQS
+
   This provides an I/O region, so that the user space program can pass a
   channel program to the kernel, to do further CCW translation before
   issuing them to a real device.
@@ -236,32 +245,49 @@ bit more detail how an I/O request triggered by the QEMU guest will be
 handled (without error handling).
 
 Explanation:
-Q1-Q7: QEMU side process.
-K1-K5: Kernel side process.
 
-Q1. Get I/O region info during initialization.
-Q2. Setup event notifier and handler to handle I/O completion.
+- Q1-Q7: QEMU side process.
+- K1-K5: Kernel side process.
+
+Q1.
+    Get I/O region info during initialization.
+
+Q2.
+    Setup event notifier and handler to handle I/O completion.
 
 ... ...
 
-Q3. Intercept a ssch instruction.
-Q4. Write the guest channel program and ORB to the I/O region.
-    K1. Copy from guest to kernel.
-    K2. Translate the guest channel program to a host kernel space
-        channel program, which becomes runnable for a real device.
-    K3. With the necessary information contained in the orb passed in
-        by QEMU, issue the ccwchain to the device.
-    K4. Return the ssch CC code.
-Q5. Return the CC code to the guest.
+Q3.
+    Intercept a ssch instruction.
+Q4.
+    Write the guest channel program and ORB to the I/O region.
+
+    K1.
+        Copy from guest to kernel.
+    K2.
+        Translate the guest channel program to a host kernel space
+        channel program, which becomes runnable for a real device.
+    K3.
+        With the necessary information contained in the orb passed in
+        by QEMU, issue the ccwchain to the device.
+    K4.
+        Return the ssch CC code.
+Q5.
+    Return the CC code to the guest.
 
 ... ...
 
-    K5. Interrupt handler gets the I/O result and write the result to
-        the I/O region.
-    K6. Signal QEMU to retrieve the result.
-Q6. Get the signal and event handler reads out the result from the I/O
+    K5.
+        Interrupt handler gets the I/O result and write the result to
+        the I/O region.
+    K6.
+        Signal QEMU to retrieve the result.
+
+Q6.
+    Get the signal and event handler reads out the result from the I/O
     region.
-Q7. Update the irb for the guest.
+Q7.
+    Update the irb for the guest.
 
 Limitations
 -----------
@@ -295,6 +321,6 @@ Reference
 1. ESA/s390 Principles of Operation manual (IBM Form. No. SA22-7832)
 2. ESA/390 Common I/O Device Commands manual (IBM Form. No. SA22-7204)
 3. https://en.wikipedia.org/wiki/Channel_I/O
-4. Documentation/s390/cds.txt
+4. Documentation/s390/cds.rst
 5. Documentation/vfio.txt
 6. Documentation/vfio-mediated-device.txt
diff --git a/Documentation/s390/zfcpdump.txt b/Documentation/s390/zfcpdump.rst
index b064aa59714d..54e8e7caf7e7 100644
--- a/Documentation/s390/zfcpdump.txt
+++ b/Documentation/s390/zfcpdump.rst
@@ -1,4 +1,6 @@
+==================================
 The s390 SCSI dump tool (zfcpdump)
+==================================
 
 System z machines (z900 or higher) provide hardware support for creating system
 dumps on SCSI disks. The dump process is initiated by booting a dump tool, which
diff --git a/Documentation/sysctl/kernel.txt b/Documentation/sysctl/kernel.txt
index f0c86fbb3b48..5af8b131ccbc 100644
--- a/Documentation/sysctl/kernel.txt
+++ b/Documentation/sysctl/kernel.txt
@@ -23,7 +23,6 @@ show up in /proc/sys/kernel:
 - auto_msgmni
 - bootloader_type            [ X86 only ]
 - bootloader_version         [ X86 only ]
-- callhome                   [ S390 only ]
 - cap_last_cap
 - core_pattern
 - core_pipe_limit
@@ -171,21 +170,6 @@ Documentation/x86/boot.txt for additional information.
 
 ==============================================================
 
-callhome:
-
-Controls the kernel's callhome behavior in case of a kernel panic.
-
-The s390 hardware allows an operating system to send a notification
-to a service organization (callhome) in case of an operating system panic.
-
-When the value in this file is 0 (which is the default behavior)
-nothing happens in case of a kernel panic. If this value is set to "1"
-the complete kernel oops message is send to the IBM customer service
-organization in case the mainframe the Linux operating system is running
-on has a service contract with IBM.
-
-==============================================================
-
 cap_last_cap
 
 Highest valid capability of the running kernel.  Exports
diff --git a/Documentation/translations/ko_KR/memory-barriers.txt b/Documentation/translations/ko_KR/memory-barriers.txt
index db0b9d8619f1..5f3c74dcad43 100644
--- a/Documentation/translations/ko_KR/memory-barriers.txt
+++ b/Documentation/translations/ko_KR/memory-barriers.txt
@@ -24,7 +24,7 @@ Documentation/memory-barriers.txt
                          =========================
 
 저자: David Howells <dhowells@redhat.com>
-      Paul E. McKenney <paulmck@linux.vnet.ibm.com>
+      Paul E. McKenney <paulmck@linux.ibm.com>
       Will Deacon <will.deacon@arm.com>
       Peter Zijlstra <peterz@infradead.org>
 
diff --git a/MAINTAINERS b/MAINTAINERS
index d0ed735994a5..a2b97d38a704 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -1306,6 +1306,12 @@ S:	Maintained
 F:      Documentation/devicetree/bindings/interrupt-controller/arm,vic.txt
 F:      drivers/irqchip/irq-vic.c
 
+AMAZON ANNAPURNA LABS FIC DRIVER
+M:      Talel Shenhar <talel@amazon.com>
+S:      Maintained
+F:      Documentation/devicetree/bindings/interrupt-controller/amazon,al-fic.txt
+F:      drivers/irqchip/irq-al-fic.c
+
 ARM SMMU DRIVERS
 M:      Will Deacon <will@kernel.org>
 R:      Robin Murphy <robin.murphy@arm.com>
@@ -3122,6 +3128,7 @@ F:	arch/arm/mach-bcm/
 BROADCOM BCM2835 ARM ARCHITECTURE
 M:      Eric Anholt <eric@anholt.net>
 M:      Stefan Wahren <wahrenst@gmx.net>
+L:      bcm-kernel-feedback-list@broadcom.com
 L:      linux-rpi-kernel@lists.infradead.org (moderated for non-subscribers)
 L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
 T:      git git://github.com/anholt/linux
@@ -3151,6 +3158,7 @@ F:	arch/arm/boot/dts/bcm953012*
 
 BROADCOM BCM53573 ARM ARCHITECTURE
 M:      Rafał Miłecki <rafal@milecki.pl>
+L:      bcm-kernel-feedback-list@broadcom.com
 L:      linux-arm-kernel@lists.infradead.org
 S:      Maintained
 F:      arch/arm/boot/dts/bcm53573*
@@ -3940,6 +3948,14 @@ M:	Miguel Ojeda <miguel.ojeda.sandonis@gmail.com>
 S:      Maintained
 F:      .clang-format
 
+CLANG/LLVM BUILD SUPPORT
+L:      clang-built-linux@googlegroups.com
+W:      https://clangbuiltlinux.github.io/
+B:      https://github.com/ClangBuiltLinux/linux/issues
+C:      irc://chat.freenode.net/clangbuiltlinux
+S:      Supported
+K:      \b(?i:clang|llvm)\b
+
 CLEANCACHE API
 M:      Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
 L:      linux-kernel@vger.kernel.org
@@ -6327,6 +6343,13 @@ L:	linux-i2c@vger.kernel.org
 S:      Maintained
 F:      drivers/i2c/busses/i2c-cpm.c
 
+FREESCALE IMX DDR PMU DRIVER
+M:      Frank Li <Frank.li@nxp.com>
+L:      linux-arm-kernel@lists.infradead.org
+S:      Maintained
+F:      drivers/perf/fsl_imx8_ddr_perf.c
+F:      Documentation/devicetree/bindings/perf/fsl-imx-ddr.txt
+
 FREESCALE IMX LPI2C DRIVER
 M:      Dong Aisheng <aisheng.dong@nxp.com>
 L:      linux-i2c@vger.kernel.org
@@ -6664,6 +6687,18 @@ L:	kvm@vger.kernel.org
 S:      Supported
 F:      drivers/uio/uio_pci_generic.c
 
+GENERIC VDSO LIBRARY:
+M:      Andy Lutomirski <luto@kernel.org>
+M:      Thomas Gleixner <tglx@linutronix.de>
+M:      Vincenzo Frascino <vincenzo.frascino@arm.com>
+L:      linux-kernel@vger.kernel.org
+T:      git git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git timers/vdso
+S:      Maintained
+F:      lib/vdso/
+F:      kernel/time/vsyscall.c
+F:      include/vdso/
+F:      include/asm-generic/vdso/vsyscall.h
+
 GENWQE (IBM Generic Workqueue Card)
 M:      Frank Haverkamp <haver@linux.ibm.com>
 S:      Supported
@@ -7301,6 +7336,7 @@ F:	arch/x86/include/asm/trace/hyperv.h
 F:      arch/x86/include/asm/hyperv-tlfs.h
 F:      arch/x86/kernel/cpu/mshyperv.c
 F:      arch/x86/hyperv
+F:      drivers/clocksource/hyperv_timer.c
 F:      drivers/hid/hid-hyperv.c
 F:      drivers/hv/
 F:      drivers/input/serio/hyperv-keyboard.c
@@ -7311,6 +7347,7 @@ F:	drivers/uio/uio_hv_generic.c
 F:      drivers/video/fbdev/hyperv_fb.c
 F:      drivers/iommu/hyperv_iommu.c
 F:      net/vmw_vsock/hyperv_transport.c
+F:      include/clocksource/hyperv_timer.h
 F:      include/linux/hyperv.h
 F:      include/uapi/linux/hyperv.h
 F:      tools/hv/
@@ -7800,7 +7837,7 @@ INGENIC JZ4780 NAND DRIVER
 M:      Harvey Hunt <harveyhuntnexus@gmail.com>
 L:      linux-mtd@lists.infradead.org
 S:      Maintained
-F:      drivers/mtd/nand/raw/jz4780_*
+F:      drivers/mtd/nand/raw/ingenic/
 
 INOTIFY
 M:      Jan Kara <jack@suse.cz>
@@ -13701,7 +13738,7 @@ L:	linux-s390@vger.kernel.org
 L:      kvm@vger.kernel.org
 S:      Supported
 F:      drivers/s390/cio/vfio_ccw*
-F:      Documentation/s390/vfio-ccw.txt
+F:      Documentation/s390/vfio-ccw.rst
 F:      include/uapi/linux/vfio_ccw.h
 
 S390 ZCRYPT DRIVER
@@ -13721,7 +13758,7 @@ S:	Supported
 F:      drivers/s390/crypto/vfio_ap_drv.c
 F:      drivers/s390/crypto/vfio_ap_private.h
 F:      drivers/s390/crypto/vfio_ap_ops.c
-F:      Documentation/s390/vfio-ap.txt
+F:      Documentation/s390/vfio-ap.rst
 
 S390 ZFCP DRIVER
 M:      Steffen Maier <maier@linux.ibm.com>
@@ -15493,6 +15530,7 @@ F:	drivers/dma/tegra*
 
 TEGRA I2C DRIVER
 M:      Laxman Dewangan <ldewangan@nvidia.com>
+R:      Dmitry Osipenko <digetx@gmail.com>
 S:      Supported
 F:      drivers/i2c/busses/i2c-tegra.c
 
@@ -17485,6 +17523,12 @@ Q:	https://patchwork.linuxtv.org/project/linux-media/list/
 S:      Maintained
 F:      drivers/media/dvb-frontends/zd1301_demod*
 
+ZHAOXIN PROCESSOR SUPPORT
+M:      Tony W Wang-oc <TonyWWang-oc@zhaoxin.com>
+L:      linux-kernel@vger.kernel.org
+S:      Maintained
+F:      arch/x86/kernel/cpu/zhaoxin.c
+
 ZPOOL COMPRESSED PAGE STORAGE API
 M:      Dan Streetman <ddstreet@ieee.org>
 L:      linux-mm@kvack.org
diff --git a/Makefile b/Makefile
index 7a7c17eb0cbf..3e4868a6498b 100644
--- a/Makefile
+++ b/Makefile
@@ -2,8 +2,8 @@
 VERSION = 5
 PATCHLEVEL = 2
 SUBLEVEL = 0
-EXTRAVERSION = -rc6
-NAME = Golden Lions
+EXTRAVERSION =
+NAME = Bobtail Squid
 
 # *DOCUMENTATION*
 # To see a list of typical targets execute "make help"
diff --git a/arch/alpha/include/asm/atomic.h b/arch/alpha/include/asm/atomic.h
index 150a1c5d6a2c..2144530d1428 100644
--- a/arch/alpha/include/asm/atomic.h
+++ b/arch/alpha/include/asm/atomic.h
@@ -93,9 +93,9 @@ static inline int atomic_fetch_##op##_relaxed(int i, atomic_t *v)	\
 }
 
 #define ATOMIC64_OP(op, asm_op)                                         \
-static __inline__ void atomic64_##op(long i, atomic64_t * v)            \
+static __inline__ void atomic64_##op(s64 i, atomic64_t * v)             \
 {                                                                       \
-        unsigned long temp;                                             \
+        s64 temp;                                                       \
         __asm__ __volatile__(                                           \
         "1:     ldq_l %0,%1\n"                                          \
         "       " #asm_op " %0,%2,%0\n"                                 \
@@ -109,9 +109,9 @@ static __inline__ void atomic64_##op(long i, atomic64_t * v)		\
 }                                                                       \
 
 #define ATOMIC64_OP_RETURN(op, asm_op)                                  \
-static __inline__ long atomic64_##op##_return_relaxed(long i, atomic64_t * v)   \
+static __inline__ s64 atomic64_##op##_return_relaxed(s64 i, atomic64_t * v)     \
 {                                                                       \
-        long temp, result;                                              \
+        s64 temp, result;                                               \
         __asm__ __volatile__(                                           \
         "1:     ldq_l %0,%1\n"                                          \
         "       " #asm_op " %0,%3,%2\n"                                 \
@@ -128,9 +128,9 @@ static __inline__ long atomic64_##op##_return_relaxed(long i, atomic64_t * v)	\
 }
 
 #define ATOMIC64_FETCH_OP(op, asm_op)                                   \
-static __inline__ long atomic64_fetch_##op##_relaxed(long i, atomic64_t * v)    \
+static __inline__ s64 atomic64_fetch_##op##_relaxed(s64 i, atomic64_t * v)      \
 {                                                                       \
-        long temp, result;                                              \
+        s64 temp, result;                                               \
         __asm__ __volatile__(                                           \
         "1:     ldq_l %2,%1\n"                                          \
         "       " #asm_op " %2,%3,%0\n"                                 \
@@ -246,9 +246,9 @@ static __inline__ int atomic_fetch_add_unless(atomic_t *v, int a, int u)
  * Atomically adds @a to @v, so long as it was not @u.
  * Returns the old value of @v.
  */
-static __inline__ long atomic64_fetch_add_unless(atomic64_t *v, long a, long u)
+static __inline__ s64 atomic64_fetch_add_unless(atomic64_t *v, s64 a, s64 u)
 {
-        long c, new, old;
+        s64 c, new, old;
         smp_mb();
         __asm__ __volatile__(
         "1:     ldq_l   %[old],%[mem]\n"
@@ -276,9 +276,9 @@ static __inline__ long atomic64_fetch_add_unless(atomic64_t *v, long a, long u)
  * The function returns the old value of *v minus 1, even if
  * the atomic variable, v, was not decremented.
  */
-static inline long atomic64_dec_if_positive(atomic64_t *v)
+static inline s64 atomic64_dec_if_positive(atomic64_t *v)
 {
-        long old, tmp;
+        s64 old, tmp;
         smp_mb();
         __asm__ __volatile__(
         "1:     ldq_l   %[old],%[mem]\n"
diff --git a/arch/alpha/kernel/smp.c b/arch/alpha/kernel/smp.c
index d0dccae53ba9..5f90df30be20 100644
--- a/arch/alpha/kernel/smp.c
+++ b/arch/alpha/kernel/smp.c
@@ -614,8 +614,7 @@ void
 smp_imb(void)
 {
         /* Must wait other processors to flush their icache before continue. */
-        if (on_each_cpu(ipi_imb, NULL, 1))
-                printk(KERN_CRIT "smp_imb: timed out\n");
+        on_each_cpu(ipi_imb, NULL, 1);
 }
 EXPORT_SYMBOL(smp_imb);
 
@@ -630,9 +629,7 @@ flush_tlb_all(void)
 {
         /* Although we don't have any data to pass, we do want to
            synchronize with the other processors.  */
-        if (on_each_cpu(ipi_flush_tlb_all, NULL, 1)) {
-                printk(KERN_CRIT "flush_tlb_all: timed out\n");
-        }
+        on_each_cpu(ipi_flush_tlb_all, NULL, 1);
 }
 
 #define asn_locked() (cpu_data[smp_processor_id()].asn_lock)
@@ -667,9 +664,7 @@ flush_tlb_mm(struct mm_struct *mm)
                 }
         }
 
-        if (smp_call_function(ipi_flush_tlb_mm, mm, 1)) {
-                printk(KERN_CRIT "flush_tlb_mm: timed out\n");
-        }
+        smp_call_function(ipi_flush_tlb_mm, mm, 1);
 
         preempt_enable();
 }
@@ -720,9 +715,7 @@ flush_tlb_page(struct vm_area_struct *vma, unsigned long addr)
         data.mm = mm;
         data.addr = addr;
 
-        if (smp_call_function(ipi_flush_tlb_page, &data, 1)) {
-                printk(KERN_CRIT "flush_tlb_page: timed out\n");
-        }
+        smp_call_function(ipi_flush_tlb_page, &data, 1);
 
         preempt_enable();
 }
@@ -772,9 +765,7 @@ flush_icache_user_range(struct vm_area_struct *vma, struct page *page,
                 }
         }
 
-        if (smp_call_function(ipi_flush_icache_page, mm, 1)) {
-                printk(KERN_CRIT "flush_icache_page: timed out\n");
-        }
+        smp_call_function(ipi_flush_icache_page, mm, 1);
 
         preempt_enable();
 }
diff --git a/arch/alpha/oprofile/common.c b/arch/alpha/oprofile/common.c
index 310a4ce1dccc..1b1259c7d7d1 100644
--- a/arch/alpha/oprofile/common.c
+++ b/arch/alpha/oprofile/common.c
@@ -65,7 +65,7 @@ op_axp_setup(void)
         model->reg_setup(&reg, ctr, &sys);
 
         /* Configure the registers on all cpus.  */
-        (void)smp_call_function(model->cpu_setup, &reg, 1);
+        smp_call_function(model->cpu_setup, &reg, 1);
         model->cpu_setup(&reg);
         return 0;
 }
@@ -86,7 +86,7 @@ op_axp_cpu_start(void *dummy)
 static int
 op_axp_start(void)
 {
-        (void)smp_call_function(op_axp_cpu_start, NULL, 1);
+        smp_call_function(op_axp_cpu_start, NULL, 1);
         op_axp_cpu_start(NULL);
         return 0;
 }
@@ -101,7 +101,7 @@ op_axp_cpu_stop(void *dummy)
 static void
 op_axp_stop(void)
 {
-        (void)smp_call_function(op_axp_cpu_stop, NULL, 1);
+        smp_call_function(op_axp_cpu_stop, NULL, 1);
         op_axp_cpu_stop(NULL);
 }
 
diff --git a/arch/arc/Makefile b/arch/arc/Makefile
index 480af1af9e63..03a0b19c92cd 100644
--- a/arch/arc/Makefile
+++ b/arch/arc/Makefile
@@ -5,6 +5,10 @@
 
 KBUILD_DEFCONFIG := nsim_hs_defconfig
 
+ifeq ($(CROSS_COMPILE),)
+CROSS_COMPILE := $(call cc-cross-prefix, arc-linux- arceb-linux-)
+endif
+
 cflags-y        += -fno-common -pipe -fno-builtin -mmedium-calls -D__linux__
 cflags-$(CONFIG_ISA_ARCOMPACT)  += -mA7
 cflags-$(CONFIG_ISA_ARCV2)      += -mcpu=hs38
diff --git a/arch/arc/include/asm/atomic.h b/arch/arc/include/asm/atomic.h
index 17cf1c657cb3..7298ce84762e 100644
--- a/arch/arc/include/asm/atomic.h
+++ b/arch/arc/include/asm/atomic.h
@@ -321,14 +321,14 @@ ATOMIC_OPS(xor, ^=, CTOP_INST_AXOR_DI_R2_R2_R3)
  */
 
 typedef struct {
-        aligned_u64 counter;
+        s64 __aligned(8) counter;
 } atomic64_t;
 
 #define ATOMIC64_INIT(a) { (a) }
 
-static inline long long atomic64_read(const atomic64_t *v)
+static inline s64 atomic64_read(const atomic64_t *v)
 {
-        unsigned long long val;
+        s64 val;
 
         __asm__ __volatile__(
         "       ldd   %0, [%1]  \n"
@@ -338,7 +338,7 @@ static inline long long atomic64_read(const atomic64_t *v)
         return val;
 }
 
-static inline void atomic64_set(atomic64_t *v, long long a)
+static inline void atomic64_set(atomic64_t *v, s64 a)
 {
         /*
          * This could have been a simple assignment in "C" but would need
@@ -359,9 +359,9 @@ static inline void atomic64_set(atomic64_t *v, long long a)
 }
 
 #define ATOMIC64_OP(op, op1, op2)                                       \
-static inline void atomic64_##op(long long a, atomic64_t *v)            \
+static inline void atomic64_##op(s64 a, atomic64_t *v)                  \
 {                                                                       \
-        unsigned long long val;                                         \
+        s64 val;                                                        \
                                                                         \
         __asm__ __volatile__(                                           \
         "1:                             \n"                             \
@@ -372,13 +372,13 @@ static inline void atomic64_##op(long long a, atomic64_t *v)		\
         "       bnz     1b              \n"                             \
         : "=&r"(val)                                                    \
         : "r"(&v->counter), "ir"(a)                                     \
-        : "cc");                                                \
+        : "cc");                                                        \
 }                                                                       \
 
 #define ATOMIC64_OP_RETURN(op, op1, op2)                                \
-static inline long long atomic64_##op##_return(long long a, atomic64_t *v)      \
+static inline s64 atomic64_##op##_return(s64 a, atomic64_t *v)          \
 {                                                                       \
-        unsigned long long val;                                         \
+        s64 val;                                                        \
                                                                         \
         smp_mb();                                                       \
                                                                         \
@@ -399,9 +399,9 @@ static inline long long atomic64_##op##_return(long long a, atomic64_t *v)	\
 }
 
 #define ATOMIC64_FETCH_OP(op, op1, op2)                                 \
-static inline long long atomic64_fetch_##op(long long a, atomic64_t *v) \
+static inline s64 atomic64_fetch_##op(s64 a, atomic64_t *v)             \
 {                                                                       \
-        unsigned long long val, orig;                                   \
+        s64 val, orig;                                                  \
                                                                         \
         smp_mb();                                                       \
                                                                         \
@@ -441,10 +441,10 @@ ATOMIC64_OPS(xor, xor, xor)
 #undef ATOMIC64_OP_RETURN
 #undef ATOMIC64_OP
 
-static inline long long
-atomic64_cmpxchg(atomic64_t *ptr, long long expected, long long new)
+static inline s64
+atomic64_cmpxchg(atomic64_t *ptr, s64 expected, s64 new)
 {
-        long long prev;
+        s64 prev;
 
         smp_mb();
 
@@ -464,9 +464,9 @@ atomic64_cmpxchg(atomic64_t *ptr, long long expected, long long new)
         return prev;
 }
 
-static inline long long atomic64_xchg(atomic64_t *ptr, long long new)
+static inline s64 atomic64_xchg(atomic64_t *ptr, s64 new)
 {
-        long long prev;
+        s64 prev;
 
         smp_mb();
 
@@ -492,9 +492,9 @@ static inline long long atomic64_xchg(atomic64_t *ptr, long long new)
  * the atomic variable, v, was not decremented.
  */
 
-static inline long long atomic64_dec_if_positive(atomic64_t *v)
+static inline s64 atomic64_dec_if_positive(atomic64_t *v)
 {
-        long long val;
+        s64 val;
 
         smp_mb();
 
@@ -525,10 +525,9 @@ static inline long long atomic64_dec_if_positive(atomic64_t *v)
  * Atomically adds @a to @v, if it was not @u.
  * Returns the old value of @v
  */
-static inline long long atomic64_fetch_add_unless(atomic64_t *v, long long a,
-                                                  long long u)
+static inline s64 atomic64_fetch_add_unless(atomic64_t *v, s64 a, s64 u)
 {
-        long long old, temp;
+        s64 old, temp;
 
         smp_mb();
 
diff --git a/arch/arc/plat-hsdk/platform.c b/arch/arc/plat-hsdk/platform.c
index 6a91a742ab3d..7dd2dd335cf6 100644
--- a/arch/arc/plat-hsdk/platform.c
+++ b/arch/arc/plat-hsdk/platform.c
@@ -32,8 +32,6 @@ static void __init hsdk_init_per_cpu(unsigned int cpu)
 
 #define ARC_PERIPHERAL_BASE     0xf0000000
 #define CREG_BASE               (ARC_PERIPHERAL_BASE + 0x1000)
-#define CREG_PAE                (CREG_BASE + 0x180)
-#define CREG_PAE_UPDATE         (CREG_BASE + 0x194)
 
 #define SDIO_BASE               (ARC_PERIPHERAL_BASE + 0xA000)
 #define SDIO_UHS_REG_EXT        (SDIO_BASE + 0x108)
@@ -99,20 +97,167 @@ static void __init hsdk_enable_gpio_intc_wire(void)
         iowrite32(GPIO_INT_CONNECTED_MASK, (void __iomem *) GPIO_INTEN);
 }
 
-static void __init hsdk_init_early(void)
+enum hsdk_axi_masters {
+        M_HS_CORE = 0,
+        M_HS_RTT,
+        M_AXI_TUN,
+        M_HDMI_VIDEO,
+        M_HDMI_AUDIO,
+        M_USB_HOST,
+        M_ETHERNET,
+        M_SDIO,
+        M_GPU,
+        M_DMAC_0,
+        M_DMAC_1,
+        M_DVFS
+};
+
+#define UPDATE_VAL      1
+
+/*
+ * This is modified configuration of AXI bridge. Default settings
+ * are specified in "Table 111 CREG Address Decoder register reset values".
+ *
+ * AXI_M_m_SLV{0|1} - Slave Select register for master 'm'.
+ * Possible slaves are:
+ *  - 0  => no slave selected
+ *  - 1  => DDR controller port #1
+ *  - 2  => SRAM controller
+ *  - 3  => AXI tunnel
+ *  - 4  => EBI controller
+ *  - 5  => ROM controller
+ *  - 6  => AXI2APB bridge
+ *  - 7  => DDR controller port #2
+ *  - 8  => DDR controller port #3
+ *  - 9  => HS38x4 IOC
+ *  - 10 => HS38x4 DMI
+ * AXI_M_m_OFFSET{0|1} - Addr Offset register for master 'm'
+ *
+ * Please read ARC HS Development IC Specification, section 17.2 for more
+ * information about apertures configuration.
+ *
+ * m    master          AXI_M_m_SLV0    AXI_M_m_SLV1    AXI_M_m_OFFSET0 AXI_M_m_OFFSET1
+ * 0    HS (CBU)        0x11111111      0x63111111      0xFEDCBA98      0x0E543210
+ * 1    HS (RTT)        0x77777777      0x77777777      0xFEDCBA98      0x76543210
+ * 2    AXI Tunnel      0x88888888      0x88888888      0xFEDCBA98      0x76543210
+ * 3    HDMI-VIDEO      0x77777777      0x77777777      0xFEDCBA98      0x76543210
+ * 4    HDMI-ADUIO      0x77777777      0x77777777      0xFEDCBA98      0x76543210
+ * 5    USB-HOST        0x77777777      0x77999999      0xFEDCBA98      0x76DCBA98
+ * 6    ETHERNET        0x77777777      0x77999999      0xFEDCBA98      0x76DCBA98
+ * 7    SDIO            0x77777777      0x77999999      0xFEDCBA98      0x76DCBA98
+ * 8    GPU             0x77777777      0x77777777      0xFEDCBA98      0x76543210
+ * 9    DMAC (port #1)  0x77777777      0x77777777      0xFEDCBA98      0x76543210
+ * 10   DMAC (port #2)  0x77777777      0x77777777      0xFEDCBA98      0x76543210
+ * 11   DVFS            0x00000000      0x60000000      0x00000000      0x00000000
+ */
+
+#define CREG_AXI_M_SLV0(m)  ((void __iomem *)(CREG_BASE + 0x20 * (m)))
+#define CREG_AXI_M_SLV1(m)  ((void __iomem *)(CREG_BASE + 0x20 * (m) + 0x04))
+#define CREG_AXI_M_OFT0(m)  ((void __iomem *)(CREG_BASE + 0x20 * (m) + 0x08))
+#define CREG_AXI_M_OFT1(m)  ((void __iomem *)(CREG_BASE + 0x20 * (m) + 0x0C))
+#define CREG_AXI_M_UPDT(m)  ((void __iomem *)(CREG_BASE + 0x20 * (m) + 0x14))
+
+#define CREG_AXI_M_HS_CORE_BOOT ((void __iomem *)(CREG_BASE + 0x010))
+
+#define CREG_PAE                ((void __iomem *)(CREG_BASE + 0x180))
+#define CREG_PAE_UPDT           ((void __iomem *)(CREG_BASE + 0x194))
+
+static void __init hsdk_init_memory_bridge(void)
 {
+        u32 reg;
+
+        /*
+         * M_HS_CORE has one unique register - BOOT.
+         * We need to clean boot mirror (BOOT[1:0]) bits in them to avoid first
+         * aperture to be masked by 'boot mirror'.
+         */
+        reg = readl(CREG_AXI_M_HS_CORE_BOOT) & (~0x3);
+        writel(reg, CREG_AXI_M_HS_CORE_BOOT);
+        writel(0x11111111, CREG_AXI_M_SLV0(M_HS_CORE));
+        writel(0x63111111, CREG_AXI_M_SLV1(M_HS_CORE));
+        writel(0xFEDCBA98, CREG_AXI_M_OFT0(M_HS_CORE));
+        writel(0x0E543210, CREG_AXI_M_OFT1(M_HS_CORE));
+        writel(UPDATE_VAL, CREG_AXI_M_UPDT(M_HS_CORE));
+
+        writel(0x77777777, CREG_AXI_M_SLV0(M_HS_RTT));
+        writel(0x77777777, CREG_AXI_M_SLV1(M_HS_RTT));
+        writel(0xFEDCBA98, CREG_AXI_M_OFT0(M_HS_RTT));
+        writel(0x76543210, CREG_AXI_M_OFT1(M_HS_RTT));
+        writel(UPDATE_VAL, CREG_AXI_M_UPDT(M_HS_RTT));
+
+        writel(0x88888888, CREG_AXI_M_SLV0(M_AXI_TUN));
+        writel(0x88888888, CREG_AXI_M_SLV1(M_AXI_TUN));
+        writel(0xFEDCBA98, CREG_AXI_M_OFT0(M_AXI_TUN));
+        writel(0x76543210, CREG_AXI_M_OFT1(M_AXI_TUN));
+        writel(UPDATE_VAL, CREG_AXI_M_UPDT(M_AXI_TUN));
+
+        writel(0x77777777, CREG_AXI_M_SLV0(M_HDMI_VIDEO));
+        writel(0x77777777, CREG_AXI_M_SLV1(M_HDMI_VIDEO));
+        writel(0xFEDCBA98, CREG_AXI_M_OFT0(M_HDMI_VIDEO));
+        writel(0x76543210, CREG_AXI_M_OFT1(M_HDMI_VIDEO));
+        writel(UPDATE_VAL, CREG_AXI_M_UPDT(M_HDMI_VIDEO));
+
+        writel(0x77777777, CREG_AXI_M_SLV0(M_HDMI_AUDIO));
+        writel(0x77777777, CREG_AXI_M_SLV1(M_HDMI_AUDIO));
+        writel(0xFEDCBA98, CREG_AXI_M_OFT0(M_HDMI_AUDIO));
+        writel(0x76543210, CREG_AXI_M_OFT1(M_HDMI_AUDIO));
+        writel(UPDATE_VAL, CREG_AXI_M_UPDT(M_HDMI_AUDIO));
+
+        writel(0x77777777, CREG_AXI_M_SLV0(M_USB_HOST));
+        writel(0x77999999, CREG_AXI_M_SLV1(M_USB_HOST));
+        writel(0xFEDCBA98, CREG_AXI_M_OFT0(M_USB_HOST));
+        writel(0x76DCBA98, CREG_AXI_M_OFT1(M_USB_HOST));
+        writel(UPDATE_VAL, CREG_AXI_M_UPDT(M_USB_HOST));
+
+        writel(0x77777777, CREG_AXI_M_SLV0(M_ETHERNET));
+        writel(0x77999999, CREG_AXI_M_SLV1(M_ETHERNET));
+        writel(0xFEDCBA98, CREG_AXI_M_OFT0(M_ETHERNET));
+        writel(0x76DCBA98, CREG_AXI_M_OFT1(M_ETHERNET));
+        writel(UPDATE_VAL, CREG_AXI_M_UPDT(M_ETHERNET));
+
+        writel(0x77777777, CREG_AXI_M_SLV0(M_SDIO));
+        writel(0x77999999, CREG_AXI_M_SLV1(M_SDIO));
+        writel(0xFEDCBA98, CREG_AXI_M_OFT0(M_SDIO));
+        writel(0x76DCBA98, CREG_AXI_M_OFT1(M_SDIO));
+        writel(UPDATE_VAL, CREG_AXI_M_UPDT(M_SDIO));
+
+        writel(0x77777777, CREG_AXI_M_SLV0(M_GPU));
+        writel(0x77777777, CREG_AXI_M_SLV1(M_GPU));
+        writel(0xFEDCBA98, CREG_AXI_M_OFT0(M_GPU));
+        writel(0x76543210, CREG_AXI_M_OFT1(M_GPU));
+        writel(UPDATE_VAL, CREG_AXI_M_UPDT(M_GPU));
+
+        writel(0x77777777, CREG_AXI_M_SLV0(M_DMAC_0));
+        writel(0x77777777, CREG_AXI_M_SLV1(M_DMAC_0));
+        writel(0xFEDCBA98, CREG_AXI_M_OFT0(M_DMAC_0));
+        writel(0x76543210, CREG_AXI_M_OFT1(M_DMAC_0));
+        writel(UPDATE_VAL, CREG_AXI_M_UPDT(M_DMAC_0));
+
+        writel(0x77777777, CREG_AXI_M_SLV0(M_DMAC_1));
+        writel(0x77777777, CREG_AXI_M_SLV1(M_DMAC_1));
+        writel(0xFEDCBA98, CREG_AXI_M_OFT0(M_DMAC_1));
+        writel(0x76543210, CREG_AXI_M_OFT1(M_DMAC_1));
+        writel(UPDATE_VAL, CREG_AXI_M_UPDT(M_DMAC_1));
+
+        writel(0x00000000, CREG_AXI_M_SLV0(M_DVFS));
+        writel(0x60000000, CREG_AXI_M_SLV1(M_DVFS));
+        writel(0x00000000, CREG_AXI_M_OFT0(M_DVFS));
+        writel(0x00000000, CREG_AXI_M_OFT1(M_DVFS));
+        writel(UPDATE_VAL, CREG_AXI_M_UPDT(M_DVFS));
+
         /*
          * PAE remapping for DMA clients does not work due to an RTL bug, so
          * CREG_PAE register must be programmed to all zeroes, otherwise it
          * will cause problems with DMA to/from peripherals even if PAE40 is
          * not used.
          */
+        writel(0x00000000, CREG_PAE);
+        writel(UPDATE_VAL, CREG_PAE_UPDT);
+}
 
-        /* Default is 1, which means "PAE offset = 4GByte" */
-        writel_relaxed(0, (void __iomem *) CREG_PAE);
-
-        /* Really apply settings made above */
-        writel(1, (void __iomem *) CREG_PAE_UPDATE);
+static void __init hsdk_init_early(void)
+{
+        hsdk_init_memory_bridge();
 
         /*
          * Switch SDIO external ciu clock divider from default div-by-8 to
diff --git a/arch/arm/boot/dts/armada-xp-98dx3236.dtsi b/arch/arm/boot/dts/armada-xp-98dx3236.dtsi
index 59753470cd34..267d0c178e55 100644
--- a/arch/arm/boot/dts/armada-xp-98dx3236.dtsi
+++ b/arch/arm/boot/dts/armada-xp-98dx3236.dtsi
@@ -336,3 +336,11 @@
         status = "disabled";
 };
 
+&uart0 {
+        compatible = "marvell,armada-38x-uart";
+};
+
+&uart1 {
+        compatible = "marvell,armada-38x-uart";
+};
+
diff --git a/arch/arm/boot/dts/gemini-dlink-dir-685.dts b/arch/arm/boot/dts/gemini-dlink-dir-685.dts
index cfbfbc91a1e1..3613f05f8a80 100644
--- a/arch/arm/boot/dts/gemini-dlink-dir-685.dts
+++ b/arch/arm/boot/dts/gemini-dlink-dir-685.dts
@@ -20,7 +20,7 @@
         };
 
         chosen {
-                bootargs = "console=ttyS0,19200n8 root=/dev/sda1 rw rootwait";
+                bootargs = "console=ttyS0,19200n8 root=/dev/sda1 rw rootwait consoleblank=300";
                 stdout-path = "uart0:19200n8";
         };
 
diff --git a/arch/arm/boot/dts/gemini-dlink-dns-313.dts b/arch/arm/boot/dts/gemini-dlink-dns-313.dts
index b12504e10f0b..360642a02a48 100644
--- a/arch/arm/boot/dts/gemini-dlink-dns-313.dts
+++ b/arch/arm/boot/dts/gemini-dlink-dns-313.dts
@@ -11,7 +11,7 @@
 
 / {
         model = "D-Link DNS-313 1-Bay Network Storage Enclosure";
-        compatible = "dlink,dir-313", "cortina,gemini";
+        compatible = "dlink,dns-313", "cortina,gemini";
         #address-cells = <1>;
         #size-cells = <1>;
 
diff --git a/arch/arm/boot/dts/imx6ul.dtsi b/arch/arm/boot/dts/imx6ul.dtsi
index bbf010c73336..a7f6d1d58e20 100644
--- a/arch/arm/boot/dts/imx6ul.dtsi
+++ b/arch/arm/boot/dts/imx6ul.dtsi
@@ -358,7 +358,7 @@
                         pwm1: pwm@2080000 {
                                 compatible = "fsl,imx6ul-pwm", "fsl,imx27-pwm";
                                 reg = <0x02080000 0x4000>;
-                                interrupts = <GIC_SPI 115 IRQ_TYPE_LEVEL_HIGH>;
+                                interrupts = <GIC_SPI 83 IRQ_TYPE_LEVEL_HIGH>;
                                 clocks = <&clks IMX6UL_CLK_PWM1>,
                                          <&clks IMX6UL_CLK_PWM1>;
                                 clock-names = "ipg", "per";
@@ -369,7 +369,7 @@
                         pwm2: pwm@2084000 {
                                 compatible = "fsl,imx6ul-pwm", "fsl,imx27-pwm";
                                 reg = <0x02084000 0x4000>;
-                                interrupts = <GIC_SPI 116 IRQ_TYPE_LEVEL_HIGH>;
+                                interrupts = <GIC_SPI 84 IRQ_TYPE_LEVEL_HIGH>;
                                 clocks = <&clks IMX6UL_CLK_PWM2>,
                                          <&clks IMX6UL_CLK_PWM2>;
                                 clock-names = "ipg", "per";
@@ -380,7 +380,7 @@
                         pwm3: pwm@2088000 {
                                 compatible = "fsl,imx6ul-pwm", "fsl,imx27-pwm";
                                 reg = <0x02088000 0x4000>;
-                                interrupts = <GIC_SPI 117 IRQ_TYPE_LEVEL_HIGH>;
+                                interrupts = <GIC_SPI 85 IRQ_TYPE_LEVEL_HIGH>;
                                 clocks = <&clks IMX6UL_CLK_PWM3>,
                                          <&clks IMX6UL_CLK_PWM3>;
                                 clock-names = "ipg", "per";
@@ -391,7 +391,7 @@
                         pwm4: pwm@208c000 {
                                 compatible = "fsl,imx6ul-pwm", "fsl,imx27-pwm";
                                 reg = <0x0208c000 0x4000>;
-                                interrupts = <GIC_SPI 118 IRQ_TYPE_LEVEL_HIGH>;
+                                interrupts = <GIC_SPI 86 IRQ_TYPE_LEVEL_HIGH>;
                                 clocks = <&clks IMX6UL_CLK_PWM4>,
                                          <&clks IMX6UL_CLK_PWM4>;
                                 clock-names = "ipg", "per";
diff --git a/arch/arm/boot/dts/meson8.dtsi b/arch/arm/boot/dts/meson8.dtsi
index 7ef442462ea4..40c11b6b217a 100644
--- a/arch/arm/boot/dts/meson8.dtsi
+++ b/arch/arm/boot/dts/meson8.dtsi
@@ -248,8 +248,8 @@
                                      <GIC_SPI 167 IRQ_TYPE_LEVEL_HIGH>,
                                      <GIC_SPI 168 IRQ_TYPE_LEVEL_HIGH>,
                                      <GIC_SPI 169 IRQ_TYPE_LEVEL_HIGH>,
-                                     <GIC_SPI 172 IRQ_TYPE_LEVEL_HIGH>,
-                                     <GIC_SPI 173 IRQ_TYPE_LEVEL_HIGH>,
+                                     <GIC_SPI 170 IRQ_TYPE_LEVEL_HIGH>,
+                                     <GIC_SPI 171 IRQ_TYPE_LEVEL_HIGH>,
                                      <GIC_SPI 172 IRQ_TYPE_LEVEL_HIGH>,
                                      <GIC_SPI 173 IRQ_TYPE_LEVEL_HIGH>,
                                      <GIC_SPI 174 IRQ_TYPE_LEVEL_HIGH>,
@@ -264,7 +264,6 @@
                         clocks = <&clkc CLKID_CLK81>, <&clkc CLKID_MALI>;
                         clock-names = "bus", "core";
                         operating-points-v2 = <&gpu_opp_table>;
-                        switch-delay = <0xffff>;
                 };
         };
 }; /* end of / */
diff --git a/arch/arm/boot/dts/meson8b.dtsi b/arch/arm/boot/dts/meson8b.dtsi
index 800cd65fc50a..ec67f49116d9 100644
--- a/arch/arm/boot/dts/meson8b.dtsi
+++ b/arch/arm/boot/dts/meson8b.dtsi
@@ -163,23 +163,23 @@
 
                 opp-255000000 {
                         opp-hz = /bits/ 64 <255000000>;
-                        opp-microvolt = <1150000>;
+                        opp-microvolt = <1100000>;
                 };
                 opp-364300000 {
                         opp-hz = /bits/ 64 <364300000>;
-                        opp-microvolt = <1150000>;
+                        opp-microvolt = <1100000>;
                 };
                 opp-425000000 {
                         opp-hz = /bits/ 64 <425000000>;
-                        opp-microvolt = <1150000>;
+                        opp-microvolt = <1100000>;
                 };
                 opp-510000000 {
                         opp-hz = /bits/ 64 <510000000>;
-                        opp-microvolt = <1150000>;
+                        opp-microvolt = <1100000>;
                 };
                 opp-637500000 {
                         opp-hz = /bits/ 64 <637500000>;
-                        opp-microvolt = <1150000>;
+                        opp-microvolt = <1100000>;
                         turbo-mode;
                 };
         };
@@ -229,7 +229,6 @@
                         clocks = <&clkc CLKID_CLK81>, <&clkc CLKID_MALI>;
                         clock-names = "bus", "core";
                         operating-points-v2 = <&gpu_opp_table>;
-                        switch-delay = <0xffff>;
                 };
         };
 }; /* end of / */
diff --git a/arch/arm/common/bL_switcher.c b/arch/arm/common/bL_switcher.c
index 13e561737ca8..746e1fce777e 100644
--- a/arch/arm/common/bL_switcher.c
+++ b/arch/arm/common/bL_switcher.c
@@ -539,16 +539,14 @@ static void bL_switcher_trace_trigger_cpu(void *__always_unused info)
 
 int bL_switcher_trace_trigger(void)
 {
-        int ret;
-
         preempt_disable();
 
         bL_switcher_trace_trigger_cpu(NULL);
-        ret = smp_call_function(bL_switcher_trace_trigger_cpu, NULL, true);
+        smp_call_function(bL_switcher_trace_trigger_cpu, NULL, true);
 
         preempt_enable();
 
-        return ret;
+        return 0;
 }
 EXPORT_SYMBOL_GPL(bL_switcher_trace_trigger);
 
diff --git a/arch/arm/include/asm/arch_timer.h b/arch/arm/include/asm/arch_timer.h
index 4b66ecd6be99..99175812d903 100644
--- a/arch/arm/include/asm/arch_timer.h
+++ b/arch/arm/include/asm/arch_timer.h
@@ -4,6 +4,7 @@
 
 #include <asm/barrier.h>
 #include <asm/errno.h>
+#include <asm/hwcap.h>
 #include <linux/clocksource.h>
 #include <linux/init.h>
 #include <linux/types.h>
@@ -124,6 +125,15 @@ static inline void arch_timer_set_cntkctl(u32 cntkctl)
         isb();
 }
 
+static inline void arch_timer_set_evtstrm_feature(void)
+{
+        elf_hwcap |= HWCAP_EVTSTRM;
+}
+
+static inline bool arch_timer_have_evtstrm_feature(void)
+{
+        return elf_hwcap & HWCAP_EVTSTRM;
+}
 #endif
 
 #endif
diff --git a/arch/arm/include/asm/atomic.h b/arch/arm/include/asm/atomic.h
index 50c3ac5f0809..75bb2c543e59 100644
--- a/arch/arm/include/asm/atomic.h
+++ b/arch/arm/include/asm/atomic.h
@@ -246,15 +246,15 @@ ATOMIC_OPS(xor, ^=, eor)
 
 #ifndef CONFIG_GENERIC_ATOMIC64
 typedef struct {
-        long long counter;
+        s64 counter;
 } atomic64_t;
 
 #define ATOMIC64_INIT(i) { (i) }
 
 #ifdef CONFIG_ARM_LPAE
-static inline long long atomic64_read(const atomic64_t *v)
+static inline s64 atomic64_read(const atomic64_t *v)
 {
-        long long result;
+        s64 result;
 
         __asm__ __volatile__("@ atomic64_read\n"
 "       ldrd    %0, %H0, [%1]"
@@ -265,7 +265,7 @@ static inline long long atomic64_read(const atomic64_t *v)
         return result;
 }
 
-static inline void atomic64_set(atomic64_t *v, long long i)
+static inline void atomic64_set(atomic64_t *v, s64 i)
 {
         __asm__ __volatile__("@ atomic64_set\n"
 "       strd    %2, %H2, [%1]"
@@ -274,9 +274,9 @@ static inline void atomic64_set(atomic64_t *v, long long i)
         );
 }
 #else
-static inline long long atomic64_read(const atomic64_t *v)
+static inline s64 atomic64_read(const atomic64_t *v)
 {
-        long long result;
+        s64 result;
 
         __asm__ __volatile__("@ atomic64_read\n"
 "       ldrexd  %0, %H0, [%1]"
@@ -287,9 +287,9 @@ static inline long long atomic64_read(const atomic64_t *v)
         return result;
 }
 
-static inline void atomic64_set(atomic64_t *v, long long i)
+static inline void atomic64_set(atomic64_t *v, s64 i)
 {
-        long long tmp;
+        s64 tmp;
 
         prefetchw(&v->counter);
         __asm__ __volatile__("@ atomic64_set\n"
@@ -304,9 +304,9 @@ static inline void atomic64_set(atomic64_t *v, long long i)
 #endif
 
 #define ATOMIC64_OP(op, op1, op2)                                       \
-static inline void atomic64_##op(long long i, atomic64_t *v)            \
+static inline void atomic64_##op(s64 i, atomic64_t *v)                  \
 {                                                                       \
-        long long result;                                               \
+        s64 result;                                                     \
         unsigned long tmp;                                              \
                                                                         \
         prefetchw(&v->counter);                                         \
@@ -323,10 +323,10 @@ static inline void atomic64_##op(long long i, atomic64_t *v)		\
 }                                                                       \
 
 #define ATOMIC64_OP_RETURN(op, op1, op2)                                \
-static inline long long                                                 \
-atomic64_##op##_return_relaxed(long long i, atomic64_t *v)              \
+static inline s64                                                       \
+atomic64_##op##_return_relaxed(s64 i, atomic64_t *v)                    \
 {                                                                       \
-        long long result;                                               \
+        s64 result;                                                     \
         unsigned long tmp;                                              \
                                                                         \
         prefetchw(&v->counter);                                         \
@@ -346,10 +346,10 @@ atomic64_##op##_return_relaxed(long long i, atomic64_t *v)		\
 }
 
 #define ATOMIC64_FETCH_OP(op, op1, op2)                                 \
-static inline long long                                                 \
-atomic64_fetch_##op##_relaxed(long long i, atomic64_t *v)               \
+static inline s64                                                       \
+atomic64_fetch_##op##_relaxed(s64 i, atomic64_t *v)                     \
 {                                                                       \
-        long long result, val;                                          \
+        s64 result, val;                                                \
         unsigned long tmp;                                              \
                                                                         \
         prefetchw(&v->counter);                                         \
@@ -403,10 +403,9 @@ ATOMIC64_OPS(xor, eor, eor)
 #undef ATOMIC64_OP_RETURN
 #undef ATOMIC64_OP
 
-static inline long long
-atomic64_cmpxchg_relaxed(atomic64_t *ptr, long long old, long long new)
+static inline s64 atomic64_cmpxchg_relaxed(atomic64_t *ptr, s64 old, s64 new)
 {
-        long long oldval;
+        s64 oldval;
         unsigned long res;
 
         prefetchw(&ptr->counter);
@@ -427,9 +426,9 @@ atomic64_cmpxchg_relaxed(atomic64_t *ptr, long long old, long long new)
 }
 #define atomic64_cmpxchg_relaxed        atomic64_cmpxchg_relaxed
 
-static inline long long atomic64_xchg_relaxed(atomic64_t *ptr, long long new)
+static inline s64 atomic64_xchg_relaxed(atomic64_t *ptr, s64 new)
 {
-        long long result;
+        s64 result;
         unsigned long tmp;
 
         prefetchw(&ptr->counter);
@@ -447,9 +446,9 @@ static inline long long atomic64_xchg_relaxed(atomic64_t *ptr, long long new)
 }
 #define atomic64_xchg_relaxed           atomic64_xchg_relaxed
 
-static inline long long atomic64_dec_if_positive(atomic64_t *v)
+static inline s64 atomic64_dec_if_positive(atomic64_t *v)
 {
-        long long result;
+        s64 result;
         unsigned long tmp;
 
         smp_mb();
@@ -475,10 +474,9 @@ static inline long long atomic64_dec_if_positive(atomic64_t *v)
 }
 #define atomic64_dec_if_positive atomic64_dec_if_positive
 
-static inline long long atomic64_fetch_add_unless(atomic64_t *v, long long a,
-                                                  long long u)
+static inline s64 atomic64_fetch_add_unless(atomic64_t *v, s64 a, s64 u)
 {
-        long long oldval, newval;
+        s64 oldval, newval;
         unsigned long tmp;
 
         smp_mb();
diff --git a/arch/arm/mach-davinci/board-da830-evm.c b/arch/arm/mach-davinci/board-da830-evm.c
index 51a892702e27..a273ab25c668 100644
--- a/arch/arm/mach-davinci/board-da830-evm.c
+++ b/arch/arm/mach-davinci/board-da830-evm.c
@@ -61,6 +61,9 @@ static struct regulator_consumer_supply da830_evm_usb_supplies[] = {
 static struct regulator_init_data da830_evm_usb_vbus_data = {
         .consumer_supplies      = da830_evm_usb_supplies,
         .num_consumer_supplies  = ARRAY_SIZE(da830_evm_usb_supplies),
+        .constraints    = {
+                .valid_ops_mask = REGULATOR_CHANGE_STATUS,
+        },
 };
 
 static struct fixed_voltage_config da830_evm_usb_vbus = {
@@ -88,7 +91,7 @@ static struct gpiod_lookup_table da830_evm_usb_oc_gpio_lookup = {
 static struct gpiod_lookup_table da830_evm_usb_vbus_gpio_lookup = {
         .dev_id         = "reg-fixed-voltage.0",
         .table = {
-                GPIO_LOOKUP("davinci_gpio", ON_BD_USB_DRV, "vbus", 0),
+                GPIO_LOOKUP("davinci_gpio", ON_BD_USB_DRV, NULL, 0),
                 { }
         },
 };
diff --git a/arch/arm/mach-davinci/board-omapl138-hawk.c b/arch/arm/mach-davinci/board-omapl138-hawk.c
index db177a6a7e48..5390a8630cf0 100644
--- a/arch/arm/mach-davinci/board-omapl138-hawk.c
+++ b/arch/arm/mach-davinci/board-omapl138-hawk.c
@@ -306,6 +306,9 @@ static struct regulator_consumer_supply hawk_usb_supplies[] = {
 static struct regulator_init_data hawk_usb_vbus_data = {
         .consumer_supplies      = hawk_usb_supplies,
         .num_consumer_supplies  = ARRAY_SIZE(hawk_usb_supplies),
+        .constraints    = {
+                .valid_ops_mask = REGULATOR_CHANGE_STATUS,
+        },
 };
 
 static struct fixed_voltage_config hawk_usb_vbus = {
diff --git a/arch/arm/mach-omap2/prm3xxx.c b/arch/arm/mach-omap2/prm3xxx.c
index fd4a3bf27993..1b442b128569 100644
--- a/arch/arm/mach-omap2/prm3xxx.c
+++ b/arch/arm/mach-omap2/prm3xxx.c
@@ -430,7 +430,7 @@ static void omap3_prm_reconfigure_io_chain(void)
  * registers, and omap3xxx_prm_reconfigure_io_chain() must be called.
  * No return value.
  */
-static void __init omap3xxx_prm_enable_io_wakeup(void)
+static void omap3xxx_prm_enable_io_wakeup(void)
 {
         if (prm_features & PRM_HAS_IO_WAKEUP)
                 omap2_prm_set_mod_reg_bits(OMAP3430_EN_IO_MASK, WKUP_MOD,
diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig
index 697ea0510729..c1734e444fb8 100644
--- a/arch/arm64/Kconfig
+++ b/arch/arm64/Kconfig
@@ -26,6 +26,7 @@ config ARM64
         select ARCH_HAS_MEMBARRIER_SYNC_CORE
         select ARCH_HAS_PTE_SPECIAL
         select ARCH_HAS_SETUP_DMA_OPS
+        select ARCH_HAS_SET_DIRECT_MAP
         select ARCH_HAS_SET_MEMORY
         select ARCH_HAS_STRICT_KERNEL_RWX
         select ARCH_HAS_STRICT_MODULE_RWX
@@ -107,6 +108,8 @@ config ARM64
         select GENERIC_STRNCPY_FROM_USER
         select GENERIC_STRNLEN_USER
         select GENERIC_TIME_VSYSCALL
+        select GENERIC_GETTIMEOFDAY
+        select GENERIC_COMPAT_VDSO if (!CPU_BIG_ENDIAN && COMPAT)
         select HANDLE_DOMAIN_IRQ
         select HARDIRQS_SW_RESEND
         select HAVE_PCI
@@ -160,6 +163,7 @@ config ARM64
         select HAVE_SYSCALL_TRACEPOINTS
         select HAVE_KPROBES
         select HAVE_KRETPROBES
+        select HAVE_GENERIC_VDSO
         select IOMMU_DMA if IOMMU_SUPPORT
         select IRQ_DOMAIN
         select IRQ_FORCED_THREADING
@@ -260,7 +264,8 @@ config GENERIC_CALIBRATE_DELAY
         def_bool y
 
 config ZONE_DMA32
-        def_bool y
+        bool "Support DMA32 zone" if EXPERT
+        default y
 
 config HAVE_GENERIC_GUP
         def_bool y
@@ -933,7 +938,6 @@ config PARAVIRT
 config PARAVIRT_TIME_ACCOUNTING
         bool "Paravirtual steal time accounting"
         select PARAVIRT
-        default n
         help
           Select this option to enable fine granularity task steal time
           accounting. Time spent executing other tasks in parallel with
@@ -1418,12 +1422,27 @@ config ARM64_SVE
           KVM in the same kernel image.
 
 config ARM64_MODULE_PLTS
-        bool
+        bool "Use PLTs to allow module memory to spill over into vmalloc area"
+        depends on MODULES
         select HAVE_MOD_ARCH_SPECIFIC
+        help
+          Allocate PLTs when loading modules so that jumps and calls whose
+          targets are too far away for their relative offsets to be encoded
+          in the instructions themselves can be bounced via veneers in the
+          module's PLT. This allows modules to be allocated in the generic
+          vmalloc area after the dedicated module memory area has been
+          exhausted.
+
+          When running with address space randomization (KASLR), the module
+          region itself may be too far away for ordinary relative jumps and
+          calls, and so in that case, module PLTs are required and cannot be
+          disabled.
+
+          Specific errata workaround(s) might also force module PLTs to be
+          enabled (ARM64_ERRATUM_843419).
 
 config ARM64_PSEUDO_NMI
         bool "Support for NMI-like interrupts"
-        depends on BROKEN # 1556553607-46531-1-git-send-email-julien.thierry@arm.com
         select CONFIG_ARM_GIC_V3
         help
           Adds support for mimicking Non-Maskable Interrupts through the use of
@@ -1436,6 +1455,17 @@ config ARM64_PSEUDO_NMI
 
           If unsure, say N
 
+if ARM64_PSEUDO_NMI
+config ARM64_DEBUG_PRIORITY_MASKING
+        bool "Debug interrupt priority masking"
+        help
+          This adds runtime checks to functions enabling/disabling
+          interrupts when using priority masking. The additional checks verify
+          the validity of ICC_PMR_EL1 when calling concerned functions.
+
+          If unsure, say N
+endif
+
 config RELOCATABLE
         bool
         help
diff --git a/arch/arm64/Makefile b/arch/arm64/Makefile
index e9d2e578cbe6..e3d3fd0a4268 100644
--- a/arch/arm64/Makefile
+++ b/arch/arm64/Makefile
@@ -49,10 +49,26 @@ $(warning Detected assembler with broken .inst; disassembly will be unreliable)
   endif
 endif
 
-KBUILD_CFLAGS   += -mgeneral-regs-only $(lseinstr) $(brokengasinst)
+ifeq ($(CONFIG_GENERIC_COMPAT_VDSO), y)
+  CROSS_COMPILE_COMPAT ?= $(CONFIG_CROSS_COMPILE_COMPAT_VDSO:"%"=%)
+
+  ifeq ($(CONFIG_CC_IS_CLANG), y)
+    $(warning CROSS_COMPILE_COMPAT is clang, the compat vDSO will not be built)
+  else ifeq ($(CROSS_COMPILE_COMPAT),)
+    $(warning CROSS_COMPILE_COMPAT not defined or empty, the compat vDSO will not be built)
+  else ifeq ($(shell which $(CROSS_COMPILE_COMPAT)gcc 2> /dev/null),)
+    $(error $(CROSS_COMPILE_COMPAT)gcc not found, check CROSS_COMPILE_COMPAT)
+  else
+    export CROSS_COMPILE_COMPAT
+    export CONFIG_COMPAT_VDSO := y
+    compat_vdso := -DCONFIG_COMPAT_VDSO=1
+  endif
+endif
+
+KBUILD_CFLAGS   += -mgeneral-regs-only $(lseinstr) $(brokengasinst) $(compat_vdso)
 KBUILD_CFLAGS   += -fno-asynchronous-unwind-tables
 KBUILD_CFLAGS   += $(call cc-disable-warning, psabi)
-KBUILD_AFLAGS   += $(lseinstr) $(brokengasinst)
+KBUILD_AFLAGS   += $(lseinstr) $(brokengasinst) $(compat_vdso)
 
 KBUILD_CFLAGS   += $(call cc-option,-mabi=lp64)
 KBUILD_AFLAGS   += $(call cc-option,-mabi=lp64)
@@ -164,6 +180,9 @@ ifeq ($(KBUILD_EXTMOD),)
 prepare: vdso_prepare
 vdso_prepare: prepare0
         $(Q)$(MAKE) $(build)=arch/arm64/kernel/vdso include/generated/vdso-offsets.h
+        $(if $(CONFIG_COMPAT_VDSO),$(Q)$(MAKE) \
+                $(build)=arch/arm64/kernel/vdso32  \
+                include/generated/vdso32-offsets.h)
 endif
 
 define archhelp
diff --git a/arch/arm64/boot/dts/freescale/fsl-ls1028a.dtsi b/arch/arm64/boot/dts/freescale/fsl-ls1028a.dtsi
index b04581249f0b..bf7f845447ed 100644
--- a/arch/arm64/boot/dts/freescale/fsl-ls1028a.dtsi
+++ b/arch/arm64/boot/dts/freescale/fsl-ls1028a.dtsi
@@ -28,7 +28,7 @@
                         enable-method = "psci";
                         clocks = <&clockgen 1 0>;
                         next-level-cache = <&l2>;
-                        cpu-idle-states = <&CPU_PH20>;
+                        cpu-idle-states = <&CPU_PW20>;
                 };
 
                 cpu1: cpu@1 {
@@ -38,7 +38,7 @@
                         enable-method = "psci";
                         clocks = <&clockgen 1 0>;
                         next-level-cache = <&l2>;
-                        cpu-idle-states = <&CPU_PH20>;
+                        cpu-idle-states = <&CPU_PW20>;
                 };
 
                 l2: l2-cache {
@@ -53,13 +53,13 @@
                  */
                 entry-method = "arm,psci";
 
-                CPU_PH20: cpu-ph20 {
-                        compatible = "arm,idle-state";
-                        idle-state-name = "PH20";
-                        arm,psci-suspend-param = <0x00010000>;
-                        entry-latency-us = <1000>;
-                        exit-latency-us = <1000>;
-                        min-residency-us = <3000>;
+                CPU_PW20: cpu-pw20 {
+                          compatible = "arm,idle-state";
+                          idle-state-name = "PW20";
+                          arm,psci-suspend-param = <0x0>;
+                          entry-latency-us = <2000>;
+                          exit-latency-us = <2000>;
+                          min-residency-us = <6000>;
                 };
         };
 
diff --git a/arch/arm64/configs/defconfig b/arch/arm64/configs/defconfig
index 4d583514258c..dd827e64e5fe 100644
--- a/arch/arm64/configs/defconfig
+++ b/arch/arm64/configs/defconfig
@@ -68,6 +68,7 @@ CONFIG_KEXEC=y
 CONFIG_CRASH_DUMP=y
 CONFIG_XEN=y
 CONFIG_COMPAT=y
+CONFIG_RANDOMIZE_BASE=y
 CONFIG_HIBERNATION=y
 CONFIG_WQ_POWER_EFFICIENT_DEFAULT=y
 CONFIG_ARM_CPUIDLE=y
@@ -613,6 +614,7 @@ CONFIG_RTC_DRV_TEGRA=y
 CONFIG_RTC_DRV_IMX_SC=m
 CONFIG_RTC_DRV_XGENE=y
 CONFIG_DMADEVICES=y
+CONFIG_FSL_EDMA=y
 CONFIG_DMA_BCM2835=m
 CONFIG_K3_DMA=y
 CONFIG_MV_XOR=y
diff --git a/arch/arm64/include/asm/acpi.h b/arch/arm64/include/asm/acpi.h
index ada0bc480a1b..b263e239cb59 100644
--- a/arch/arm64/include/asm/acpi.h
+++ b/arch/arm64/include/asm/acpi.h
@@ -38,6 +38,9 @@
         (!(entry) || (entry)->header.length < ACPI_MADT_GICC_MIN_LENGTH || \
         (unsigned long)(entry) + (entry)->header.length > (end))
 
+#define ACPI_MADT_GICC_SPE  (ACPI_OFFSET(struct acpi_madt_generic_interrupt, \
+        spe_interrupt) + sizeof(u16))
+
 /* Basic configuration for ACPI */
 #ifdef  CONFIG_ACPI
 pgprot_t __acpi_get_mem_attribute(phys_addr_t addr);
diff --git a/arch/arm64/include/asm/arch_gicv3.h b/arch/arm64/include/asm/arch_gicv3.h
index 2247908e55d6..79155a8cfe7c 100644
--- a/arch/arm64/include/asm/arch_gicv3.h
+++ b/arch/arm64/include/asm/arch_gicv3.h
@@ -152,7 +152,9 @@ static inline bool gic_prio_masking_enabled(void)
 
 static inline void gic_pmr_mask_irqs(void)
 {
-        BUILD_BUG_ON(GICD_INT_DEF_PRI <= GIC_PRIO_IRQOFF);
+        BUILD_BUG_ON(GICD_INT_DEF_PRI < (GIC_PRIO_IRQOFF |
+                                         GIC_PRIO_PSR_I_SET));
+        BUILD_BUG_ON(GICD_INT_DEF_PRI >= GIC_PRIO_IRQON);
         gic_write_pmr(GIC_PRIO_IRQOFF);
 }
 
diff --git a/arch/arm64/include/asm/arch_timer.h b/arch/arm64/include/asm/arch_timer.h
index 6756178c27db..7ae54d7d333a 100644
--- a/arch/arm64/include/asm/arch_timer.h
+++ b/arch/arm64/include/asm/arch_timer.h
@@ -9,6 +9,7 @@
 #define __ASM_ARCH_TIMER_H
 
 #include <asm/barrier.h>
+#include <asm/hwcap.h>
 #include <asm/sysreg.h>
 
 #include <linux/bug.h>
@@ -229,4 +230,16 @@ static inline int arch_timer_arch_init(void)
         return 0;
 }
 
+static inline void arch_timer_set_evtstrm_feature(void)
+{
+        cpu_set_named_feature(EVTSTRM);
+#ifdef CONFIG_COMPAT
+        compat_elf_hwcap |= COMPAT_HWCAP_EVTSTRM;
+#endif
+}
+
+static inline bool arch_timer_have_evtstrm_feature(void)
+{
+        return cpu_have_named_feature(EVTSTRM);
+}
 #endif
diff --git a/arch/arm64/include/asm/atomic_ll_sc.h b/arch/arm64/include/asm/atomic_ll_sc.h
index 23c378606aed..c8c850bc3dfb 100644
--- a/arch/arm64/include/asm/atomic_ll_sc.h
+++ b/arch/arm64/include/asm/atomic_ll_sc.h
@@ -122,9 +122,9 @@ ATOMIC_OPS(xor, eor)
 
 #define ATOMIC64_OP(op, asm_op)                                         \
 __LL_SC_INLINE void                                                     \
-__LL_SC_PREFIX(arch_atomic64_##op(long i, atomic64_t *v))               \
+__LL_SC_PREFIX(arch_atomic64_##op(s64 i, atomic64_t *v))                \
 {                                                                       \
-        long result;                                                    \
+        s64 result;                                                     \
         unsigned long tmp;                                              \
                                                                         \
         asm volatile("// atomic64_" #op "\n"                            \
@@ -139,10 +139,10 @@ __LL_SC_PREFIX(arch_atomic64_##op(long i, atomic64_t *v))		\
 __LL_SC_EXPORT(arch_atomic64_##op);
 
 #define ATOMIC64_OP_RETURN(name, mb, acq, rel, cl, op, asm_op)          \
-__LL_SC_INLINE long                                                     \
-__LL_SC_PREFIX(arch_atomic64_##op##_return##name(long i, atomic64_t *v))\
+__LL_SC_INLINE s64                                                      \
+__LL_SC_PREFIX(arch_atomic64_##op##_return##name(s64 i, atomic64_t *v))\
 {                                                                       \
-        long result;                                                    \
+        s64 result;                                                     \
         unsigned long tmp;                                              \
                                                                         \
         asm volatile("// atomic64_" #op "_return" #name "\n"            \
@@ -161,10 +161,10 @@ __LL_SC_PREFIX(arch_atomic64_##op##_return##name(long i, atomic64_t *v))\
 __LL_SC_EXPORT(arch_atomic64_##op##_return##name);
 
 #define ATOMIC64_FETCH_OP(name, mb, acq, rel, cl, op, asm_op)           \
-__LL_SC_INLINE long                                                     \
-__LL_SC_PREFIX(arch_atomic64_fetch_##op##name(long i, atomic64_t *v))   \
+__LL_SC_INLINE s64                                                      \
+__LL_SC_PREFIX(arch_atomic64_fetch_##op##name(s64 i, atomic64_t *v))    \
 {                                                                       \
-        long result, val;                                               \
+        s64 result, val;                                                \
         unsigned long tmp;                                              \
                                                                         \
         asm volatile("// atomic64_fetch_" #op #name "\n"                \
@@ -214,10 +214,10 @@ ATOMIC64_OPS(xor, eor)
 #undef ATOMIC64_OP_RETURN
 #undef ATOMIC64_OP
 
-__LL_SC_INLINE long
+__LL_SC_INLINE s64
 __LL_SC_PREFIX(arch_atomic64_dec_if_positive(atomic64_t *v))
 {
-        long result;
+        s64 result;
         unsigned long tmp;
 
         asm volatile("// atomic64_dec_if_positive\n"
diff --git a/arch/arm64/include/asm/atomic_lse.h b/arch/arm64/include/asm/atomic_lse.h
index 45e030d54332..69acb1c19a15 100644
--- a/arch/arm64/include/asm/atomic_lse.h
+++ b/arch/arm64/include/asm/atomic_lse.h
@@ -213,9 +213,9 @@ ATOMIC_FETCH_OP_SUB(        , al, "memory")
 
 #define __LL_SC_ATOMIC64(op)    __LL_SC_CALL(arch_atomic64_##op)
 #define ATOMIC64_OP(op, asm_op)                                         \
-static inline void arch_atomic64_##op(long i, atomic64_t *v)            \
+static inline void arch_atomic64_##op(s64 i, atomic64_t *v)             \
 {                                                                       \
-        register long x0 asm ("x0") = i;                                \
+        register s64 x0 asm ("x0") = i;                                 \
         register atomic64_t *x1 asm ("x1") = v;                         \
                                                                         \
         asm volatile(ARM64_LSE_ATOMIC_INSN(__LL_SC_ATOMIC64(op),        \
@@ -233,9 +233,9 @@ ATOMIC64_OP(add, stadd)
 #undef ATOMIC64_OP
 
 #define ATOMIC64_FETCH_OP(name, mb, op, asm_op, cl...)                  \
-static inline long arch_atomic64_fetch_##op##name(long i, atomic64_t *v)\
+static inline s64 arch_atomic64_fetch_##op##name(s64 i, atomic64_t *v)  \
 {                                                                       \
-        register long x0 asm ("x0") = i;                                \
+        register s64 x0 asm ("x0") = i;                                 \
         register atomic64_t *x1 asm ("x1") = v;                         \
                                                                         \
         asm volatile(ARM64_LSE_ATOMIC_INSN(                             \
@@ -265,9 +265,9 @@ ATOMIC64_FETCH_OPS(add, ldadd)
 #undef ATOMIC64_FETCH_OPS
 
 #define ATOMIC64_OP_ADD_RETURN(name, mb, cl...)                         \
-static inline long arch_atomic64_add_return##name(long i, atomic64_t *v)\
+static inline s64 arch_atomic64_add_return##name(s64 i, atomic64_t *v)  \
 {                                                                       \
-        register long x0 asm ("x0") = i;                                \
+        register s64 x0 asm ("x0") = i;                                 \
         register atomic64_t *x1 asm ("x1") = v;                         \
                                                                         \
         asm volatile(ARM64_LSE_ATOMIC_INSN(                             \
@@ -291,9 +291,9 @@ ATOMIC64_OP_ADD_RETURN(        , al, "memory")
 
 #undef ATOMIC64_OP_ADD_RETURN
 
-static inline void arch_atomic64_and(long i, atomic64_t *v)
+static inline void arch_atomic64_and(s64 i, atomic64_t *v)
 {
-        register long x0 asm ("x0") = i;
+        register s64 x0 asm ("x0") = i;
         register atomic64_t *x1 asm ("x1") = v;
 
         asm volatile(ARM64_LSE_ATOMIC_INSN(
@@ -309,9 +309,9 @@ static inline void arch_atomic64_and(long i, atomic64_t *v)
 }
 
 #define ATOMIC64_FETCH_OP_AND(name, mb, cl...)                          \
-static inline long arch_atomic64_fetch_and##name(long i, atomic64_t *v) \
+static inline s64 arch_atomic64_fetch_and##name(s64 i, atomic64_t *v)   \
 {                                                                       \
-        register long x0 asm ("x0") = i;                                \
+        register s64 x0 asm ("x0") = i;                                 \
         register atomic64_t *x1 asm ("x1") = v;                         \
                                                                         \
         asm volatile(ARM64_LSE_ATOMIC_INSN(                             \
@@ -335,9 +335,9 @@ ATOMIC64_FETCH_OP_AND(        , al, "memory")
 
 #undef ATOMIC64_FETCH_OP_AND
 
-static inline void arch_atomic64_sub(long i, atomic64_t *v)
+static inline void arch_atomic64_sub(s64 i, atomic64_t *v)
 {
-        register long x0 asm ("x0") = i;
+        register s64 x0 asm ("x0") = i;
         register atomic64_t *x1 asm ("x1") = v;
 
         asm volatile(ARM64_LSE_ATOMIC_INSN(
@@ -353,9 +353,9 @@ static inline void arch_atomic64_sub(long i, atomic64_t *v)
 }
 
 #define ATOMIC64_OP_SUB_RETURN(name, mb, cl...)                         \
-static inline long arch_atomic64_sub_return##name(long i, atomic64_t *v)\
+static inline s64 arch_atomic64_sub_return##name(s64 i, atomic64_t *v)  \
 {                                                                       \
-        register long x0 asm ("x0") = i;                                \
+        register s64 x0 asm ("x0") = i;                                 \
         register atomic64_t *x1 asm ("x1") = v;                         \
                                                                         \
         asm volatile(ARM64_LSE_ATOMIC_INSN(                             \
@@ -381,9 +381,9 @@ ATOMIC64_OP_SUB_RETURN(        , al, "memory")
 #undef ATOMIC64_OP_SUB_RETURN
 
 #define ATOMIC64_FETCH_OP_SUB(name, mb, cl...)                          \
-static inline long arch_atomic64_fetch_sub##name(long i, atomic64_t *v) \
+static inline s64 arch_atomic64_fetch_sub##name(s64 i, atomic64_t *v)   \
 {                                                                       \
-        register long x0 asm ("x0") = i;                                \
+        register s64 x0 asm ("x0") = i;                                 \
         register atomic64_t *x1 asm ("x1") = v;                         \
                                                                         \
         asm volatile(ARM64_LSE_ATOMIC_INSN(                             \
@@ -407,7 +407,7 @@ ATOMIC64_FETCH_OP_SUB(        , al, "memory")
 
 #undef ATOMIC64_FETCH_OP_SUB
 
-static inline long arch_atomic64_dec_if_positive(atomic64_t *v)
+static inline s64 arch_atomic64_dec_if_positive(atomic64_t *v)
 {
         register long x0 asm ("x0") = (long)v;
 
diff --git a/arch/arm64/include/asm/cache.h b/arch/arm64/include/asm/cache.h
index a05db636981a..64eeaa41e7ca 100644
--- a/arch/arm64/include/asm/cache.h
+++ b/arch/arm64/include/asm/cache.h
@@ -80,12 +80,15 @@ static inline u32 cache_type_cwg(void)
 
 #define __read_mostly __attribute__((__section__(".data..read_mostly")))
 
-static inline int cache_line_size(void)
+static inline int cache_line_size_of_cpu(void)
 {
         u32 cwg = cache_type_cwg();
+
         return cwg ? 4 << cwg : ARCH_DMA_MINALIGN;
 }
 
+int cache_line_size(void);
+
 /*
  * Read the effective value of CTR_EL0.
  *
diff --git a/arch/arm64/include/asm/cacheflush.h b/arch/arm64/include/asm/cacheflush.h
index 1fe4467442aa..665c78e0665a 100644
--- a/arch/arm64/include/asm/cacheflush.h
+++ b/arch/arm64/include/asm/cacheflush.h
@@ -176,4 +176,7 @@ static inline void flush_cache_vunmap(unsigned long start, unsigned long end)
 
 int set_memory_valid(unsigned long addr, int numpages, int enable);
 
+int set_direct_map_invalid_noflush(struct page *page);
+int set_direct_map_default_noflush(struct page *page);
+
 #endif
diff --git a/arch/arm64/include/asm/cpufeature.h b/arch/arm64/include/asm/cpufeature.h
index 373799b7982f..3d8db50d9ae2 100644
--- a/arch/arm64/include/asm/cpufeature.h
+++ b/arch/arm64/include/asm/cpufeature.h
@@ -614,6 +614,12 @@ static inline bool system_uses_irq_prio_masking(void)
                cpus_have_const_cap(ARM64_HAS_IRQ_PRIO_MASKING);
 }
 
+static inline bool system_has_prio_mask_debugging(void)
+{
+        return IS_ENABLED(CONFIG_ARM64_DEBUG_PRIORITY_MASKING) &&
+               system_uses_irq_prio_masking();
+}
+
 #define ARM64_SSBD_UNKNOWN              -1
 #define ARM64_SSBD_FORCE_DISABLE        0
 #define ARM64_SSBD_KERNEL               1
diff --git a/arch/arm64/include/asm/daifflags.h b/arch/arm64/include/asm/daifflags.h
index 6dd8a8723525..987926ed535e 100644
--- a/arch/arm64/include/asm/daifflags.h
+++ b/arch/arm64/include/asm/daifflags.h
@@ -7,6 +7,7 @@
 
 #include <linux/irqflags.h>
 
+#include <asm/arch_gicv3.h>
 #include <asm/cpufeature.h>
 
 #define DAIF_PROCCTX            0
@@ -16,11 +17,20 @@
 /* mask/save/unmask/restore all exceptions, including interrupts. */
 static inline void local_daif_mask(void)
 {
+        WARN_ON(system_has_prio_mask_debugging() &&
+                (read_sysreg_s(SYS_ICC_PMR_EL1) == (GIC_PRIO_IRQOFF |
+                                                    GIC_PRIO_PSR_I_SET)));
+
         asm volatile(
                 "msr    daifset, #0xf           // local_daif_mask\n"
                 :
                 :
                 : "memory");
+
+        /* Don't really care for a dsb here, we don't intend to enable IRQs */
+        if (system_uses_irq_prio_masking())
+                gic_write_pmr(GIC_PRIO_IRQON | GIC_PRIO_PSR_I_SET);
+
         trace_hardirqs_off();
 }
 
@@ -32,7 +42,7 @@ static inline unsigned long local_daif_save(void)
 
         if (system_uses_irq_prio_masking()) {
                 /* If IRQs are masked with PMR, reflect it in the flags */
-                if (read_sysreg_s(SYS_ICC_PMR_EL1) <= GIC_PRIO_IRQOFF)
+                if (read_sysreg_s(SYS_ICC_PMR_EL1) != GIC_PRIO_IRQON)
                         flags |= PSR_I_BIT;
         }
 
@@ -45,39 +55,50 @@ static inline void local_daif_restore(unsigned long flags)
 {
         bool irq_disabled = flags & PSR_I_BIT;
 
+        WARN_ON(system_has_prio_mask_debugging() &&
+                !(read_sysreg(daif) & PSR_I_BIT));
+
         if (!irq_disabled) {
                 trace_hardirqs_on();
 
-                if (system_uses_irq_prio_masking())
-                        arch_local_irq_enable();
-        } else if (!(flags & PSR_A_BIT)) {
-                /*
-                 * If interrupts are disabled but we can take
-                 * asynchronous errors, we can take NMIs
-                 */
                 if (system_uses_irq_prio_masking()) {
-                        flags &= ~PSR_I_BIT;
+                        gic_write_pmr(GIC_PRIO_IRQON);
+                        dsb(sy);
+                }
+        } else if (system_uses_irq_prio_masking()) {
+                u64 pmr;
+
+                if (!(flags & PSR_A_BIT)) {
                         /*
-                         * There has been concern that the write to daif
-                         * might be reordered before this write to PMR.
-                         * From the ARM ARM DDI 0487D.a, section D1.7.1
-                         * "Accessing PSTATE fields":
-                         *   Writes to the PSTATE fields have side-effects on
-                         *   various aspects of the PE operation. All of these
-                         *   side-effects are guaranteed:
-                         *     - Not to be visible to earlier instructions in
-                         *       the execution stream.
-                         *     - To be visible to later instructions in the
-                         *       execution stream
-                         *
-                         * Also, writes to PMR are self-synchronizing, so no
-                         * interrupts with a lower priority than PMR is signaled
-                         * to the PE after the write.
-                         *
-                         * So we don't need additional synchronization here.
+                         * If interrupts are disabled but we can take
+                         * asynchronous errors, we can take NMIs
                          */
-                        arch_local_irq_disable();
+                        flags &= ~PSR_I_BIT;
+                        pmr = GIC_PRIO_IRQOFF;
+                } else {
+                        pmr = GIC_PRIO_IRQON | GIC_PRIO_PSR_I_SET;
                 }
+
+                /*
+                 * There has been concern that the write to daif
+                 * might be reordered before this write to PMR.
+                 * From the ARM ARM DDI 0487D.a, section D1.7.1
+                 * "Accessing PSTATE fields":
+                 *   Writes to the PSTATE fields have side-effects on
+                 *   various aspects of the PE operation. All of these
+                 *   side-effects are guaranteed:
+                 *     - Not to be visible to earlier instructions in
+                 *       the execution stream.
+                 *     - To be visible to later instructions in the
+                 *       execution stream
+                 *
+                 * Also, writes to PMR are self-synchronizing, so no
+                 * interrupts with a lower priority than PMR is signaled
+                 * to the PE after the write.
+                 *
+                 * So we don't need additional synchronization here.
+                 */
+                gic_write_pmr(pmr);
         }
 
         write_sysreg(flags, daif);
diff --git a/arch/arm64/include/asm/elf.h b/arch/arm64/include/asm/elf.h
index 325d9515c0f8..3c7037c6ba9b 100644
--- a/arch/arm64/include/asm/elf.h
+++ b/arch/arm64/include/asm/elf.h
@@ -202,7 +202,21 @@ typedef compat_elf_greg_t		compat_elf_gregset_t[COMPAT_ELF_NGREG];
 ({                                                                      \
         set_thread_flag(TIF_32BIT);                                     \
  })
+#ifdef CONFIG_GENERIC_COMPAT_VDSO
+#define COMPAT_ARCH_DLINFO                                              \
+do {                                                                    \
+        /*                                                              \
+         * Note that we use Elf64_Off instead of elf_addr_t because     \
+         * elf_addr_t in compat is defined as Elf32_Addr and casting    \
+         * current->mm->context.vdso to it triggers a cast warning of   \
+         * cast from pointer to integer of different size.              \
+         */                                                             \
+        NEW_AUX_ENT(AT_SYSINFO_EHDR,                                    \
+                        (Elf64_Off)current->mm->context.vdso);          \
+} while (0)
+#else
 #define COMPAT_ARCH_DLINFO
+#endif
 extern int aarch32_setup_additional_pages(struct linux_binprm *bprm,
                                           int uses_interp);
 #define compat_arch_setup_additional_pages \
diff --git a/arch/arm64/include/asm/fpsimd.h b/arch/arm64/include/asm/fpsimd.h
index 897029c8e9b5..b6a2c352f4c3 100644
--- a/arch/arm64/include/asm/fpsimd.h
+++ b/arch/arm64/include/asm/fpsimd.h
@@ -37,8 +37,6 @@ struct task_struct;
 extern void fpsimd_save_state(struct user_fpsimd_state *state);
 extern void fpsimd_load_state(struct user_fpsimd_state *state);
 
-extern void fpsimd_save(void);
-
 extern void fpsimd_thread_switch(struct task_struct *next);
 extern void fpsimd_flush_thread(void);
 
@@ -52,8 +50,7 @@ extern void fpsimd_bind_state_to_cpu(struct user_fpsimd_state *state,
                                      void *sve_state, unsigned int sve_vl);
 
 extern void fpsimd_flush_task_state(struct task_struct *target);
-extern void fpsimd_flush_cpu_state(void);
-extern void sve_flush_cpu_state(void);
+extern void fpsimd_save_and_flush_cpu_state(void);
 
 /* Maximum VL that SVE VL-agnostic software can transparently support */
 #define SVE_VL_ARCH_MAX 0x100
diff --git a/arch/arm64/include/asm/hwcap.h b/arch/arm64/include/asm/hwcap.h
index e5d9420cd258..3d2f2472a36c 100644
--- a/arch/arm64/include/asm/hwcap.h
+++ b/arch/arm64/include/asm/hwcap.h
@@ -84,6 +84,8 @@
 #define KERNEL_HWCAP_SVEBITPERM         __khwcap2_feature(SVEBITPERM)
 #define KERNEL_HWCAP_SVESHA3            __khwcap2_feature(SVESHA3)
 #define KERNEL_HWCAP_SVESM4             __khwcap2_feature(SVESM4)
+#define KERNEL_HWCAP_FLAGM2             __khwcap2_feature(FLAGM2)
+#define KERNEL_HWCAP_FRINT              __khwcap2_feature(FRINT)
 
 /*
  * This yields a mask that user programs can use to figure out what
diff --git a/arch/arm64/include/asm/irqflags.h b/arch/arm64/include/asm/irqflags.h
index 66853fde60f9..7872f260c9ee 100644
--- a/arch/arm64/include/asm/irqflags.h
+++ b/arch/arm64/include/asm/irqflags.h
@@ -29,6 +29,12 @@
  */
 static inline void arch_local_irq_enable(void)
 {
+        if (system_has_prio_mask_debugging()) {
+                u32 pmr = read_sysreg_s(SYS_ICC_PMR_EL1);
+
+                WARN_ON_ONCE(pmr != GIC_PRIO_IRQON && pmr != GIC_PRIO_IRQOFF);
+        }
+
         asm volatile(ALTERNATIVE(
                 "msr    daifclr, #2             // arch_local_irq_enable\n"
                 "nop",
@@ -42,6 +48,12 @@ static inline void arch_local_irq_enable(void)
 
 static inline void arch_local_irq_disable(void)
 {
+        if (system_has_prio_mask_debugging()) {
+                u32 pmr = read_sysreg_s(SYS_ICC_PMR_EL1);
+
+                WARN_ON_ONCE(pmr != GIC_PRIO_IRQON && pmr != GIC_PRIO_IRQOFF);
+        }
+
         asm volatile(ALTERNATIVE(
                 "msr    daifset, #2             // arch_local_irq_disable",
                 __msr_s(SYS_ICC_PMR_EL1, "%0"),
@@ -56,43 +68,46 @@ static inline void arch_local_irq_disable(void)
  */
 static inline unsigned long arch_local_save_flags(void)
 {
-        unsigned long daif_bits;
         unsigned long flags;
 
-        daif_bits = read_sysreg(daif);
-
-        /*
-         * The asm is logically equivalent to:
-         *
-         * if (system_uses_irq_prio_masking())
-         *      flags = (daif_bits & PSR_I_BIT) ?
-         *                      GIC_PRIO_IRQOFF :
-         *                      read_sysreg_s(SYS_ICC_PMR_EL1);
-         * else
-         *      flags = daif_bits;
-         */
         asm volatile(ALTERNATIVE(
-                        "mov    %0, %1\n"
-                        "nop\n"
-                        "nop",
-                        __mrs_s("%0", SYS_ICC_PMR_EL1)
-                        "ands   %1, %1, " __stringify(PSR_I_BIT) "\n"
-                        "csel   %0, %0, %2, eq",
-                        ARM64_HAS_IRQ_PRIO_MASKING)
-                : "=&r" (flags), "+r" (daif_bits)
-                : "r" ((unsigned long) GIC_PRIO_IRQOFF)
+                "mrs    %0, daif",
+                __mrs_s("%0", SYS_ICC_PMR_EL1),
+                ARM64_HAS_IRQ_PRIO_MASKING)
+                : "=&r" (flags)
+                :
                 : "memory");
 
         return flags;
 }
 
+static inline int arch_irqs_disabled_flags(unsigned long flags)
+{
+        int res;
+
+        asm volatile(ALTERNATIVE(
+                "and    %w0, %w1, #" __stringify(PSR_I_BIT),
+                "eor    %w0, %w1, #" __stringify(GIC_PRIO_IRQON),
+                ARM64_HAS_IRQ_PRIO_MASKING)
+                : "=&r" (res)
+                : "r" ((int) flags)
+                : "memory");
+
+        return res;
+}
+
 static inline unsigned long arch_local_irq_save(void)
 {
         unsigned long flags;
 
         flags = arch_local_save_flags();
 
-        arch_local_irq_disable();
+        /*
+         * There are too many states with IRQs disabled, just keep the current
+         * state if interrupts are already disabled/masked.
+         */
+        if (!arch_irqs_disabled_flags(flags))
+                arch_local_irq_disable();
 
         return flags;
 }
@@ -108,26 +123,10 @@ static inline void arch_local_irq_restore(unsigned long flags)
                         __msr_s(SYS_ICC_PMR_EL1, "%0")
                         "dsb    sy",
                         ARM64_HAS_IRQ_PRIO_MASKING)
-                : "+r" (flags)
                 :
+                : "r" (flags)
                 : "memory");
 }
 
-static inline int arch_irqs_disabled_flags(unsigned long flags)
-{
-        int res;
-
-        asm volatile(ALTERNATIVE(
-                        "and    %w0, %w1, #" __stringify(PSR_I_BIT) "\n"
-                        "nop",
-                        "cmp    %w1, #" __stringify(GIC_PRIO_IRQOFF) "\n"
-                        "cset   %w0, ls",
-                        ARM64_HAS_IRQ_PRIO_MASKING)
-                : "=&r" (res)
-                : "r" ((int) flags)
-                : "memory");
-
-        return res;
-}
 #endif
 #endif
diff --git a/arch/arm64/include/asm/kvm_host.h b/arch/arm64/include/asm/kvm_host.h
index c328191aa202..9f19c354b165 100644
--- a/arch/arm64/include/asm/kvm_host.h
+++ b/arch/arm64/include/asm/kvm_host.h
@@ -597,11 +597,12 @@ static inline void kvm_arm_vhe_guest_enter(void)
          * will not signal the CPU of interrupts of lower priority, and the
          * only way to get out will be via guest exceptions.
          * Naturally, we want to avoid this.
+         *
+         * local_daif_mask() already sets GIC_PRIO_PSR_I_SET, we just need a
+         * dsb to ensure the redistributor is forwards EL2 IRQs to the CPU.
          */
-        if (system_uses_irq_prio_masking()) {
-                gic_write_pmr(GIC_PRIO_IRQON);
+        if (system_uses_irq_prio_masking())
                 dsb(sy);
-        }
 }
 
 static inline void kvm_arm_vhe_guest_exit(void)
diff --git a/arch/arm64/include/asm/pgtable-hwdef.h b/arch/arm64/include/asm/pgtable-hwdef.h
index 30e5e67749e5..db92950bb1a0 100644
--- a/arch/arm64/include/asm/pgtable-hwdef.h
+++ b/arch/arm64/include/asm/pgtable-hwdef.h
@@ -115,7 +115,6 @@
  * Level 2 descriptor (PMD).
  */
 #define PMD_TYPE_MASK           (_AT(pmdval_t, 3) << 0)
-#define PMD_TYPE_FAULT          (_AT(pmdval_t, 0) << 0)
 #define PMD_TYPE_TABLE          (_AT(pmdval_t, 3) << 0)
 #define PMD_TYPE_SECT           (_AT(pmdval_t, 1) << 0)
 #define PMD_TABLE_BIT           (_AT(pmdval_t, 1) << 1)
@@ -142,8 +141,8 @@
 /*
  * Level 3 descriptor (PTE).
  */
+#define PTE_VALID               (_AT(pteval_t, 1) << 0)
 #define PTE_TYPE_MASK           (_AT(pteval_t, 3) << 0)
-#define PTE_TYPE_FAULT          (_AT(pteval_t, 0) << 0)
 #define PTE_TYPE_PAGE           (_AT(pteval_t, 3) << 0)
 #define PTE_TABLE_BIT           (_AT(pteval_t, 1) << 1)
 #define PTE_USER                (_AT(pteval_t, 1) << 6)         /* AP[1] */
diff --git a/arch/arm64/include/asm/pgtable-prot.h b/arch/arm64/include/asm/pgtable-prot.h
index c81583be034b..f318258a14be 100644
--- a/arch/arm64/include/asm/pgtable-prot.h
+++ b/arch/arm64/include/asm/pgtable-prot.h
@@ -13,7 +13,6 @@
 /*
  * Software defined PTE bits definition.
  */
-#define PTE_VALID               (_AT(pteval_t, 1) << 0)
 #define PTE_WRITE               (PTE_DBM)                /* same as DBM (51) */
 #define PTE_DIRTY               (_AT(pteval_t, 1) << 55)
 #define PTE_SPECIAL             (_AT(pteval_t, 1) << 56)
diff --git a/arch/arm64/include/asm/pgtable.h b/arch/arm64/include/asm/pgtable.h
index fca26759081a..3052381baaeb 100644
--- a/arch/arm64/include/asm/pgtable.h
+++ b/arch/arm64/include/asm/pgtable.h
@@ -235,29 +235,42 @@ extern void __sync_icache_dcache(pte_t pteval);
  *
  *   PTE_DIRTY || (PTE_WRITE && !PTE_RDONLY)
  */
-static inline void set_pte_at(struct mm_struct *mm, unsigned long addr,
-                              pte_t *ptep, pte_t pte)
+
+static inline void __check_racy_pte_update(struct mm_struct *mm, pte_t *ptep,
+                                           pte_t pte)
 {
         pte_t old_pte;
 
-        if (pte_present(pte) && pte_user_exec(pte) && !pte_special(pte))
-                __sync_icache_dcache(pte);
+        if (!IS_ENABLED(CONFIG_DEBUG_VM))
+                return;
+
+        old_pte = READ_ONCE(*ptep);
+
+        if (!pte_valid(old_pte) || !pte_valid(pte))
+                return;
+        if (mm != current->active_mm && atomic_read(&mm->mm_users) <= 1)
+                return;
 
         /*
-         * If the existing pte is valid, check for potential race with
-         * hardware updates of the pte (ptep_set_access_flags safely changes
-         * valid ptes without going through an invalid entry).
+         * Check for potential race with hardware updates of the pte
+         * (ptep_set_access_flags safely changes valid ptes without going
+         * through an invalid entry).
          */
-        old_pte = READ_ONCE(*ptep);
-        if (IS_ENABLED(CONFIG_DEBUG_VM) && pte_valid(old_pte) && pte_valid(pte) &&
-           (mm == current->active_mm || atomic_read(&mm->mm_users) > 1)) {
-                VM_WARN_ONCE(!pte_young(pte),
-                             "%s: racy access flag clearing: 0x%016llx -> 0x%016llx",
-                             __func__, pte_val(old_pte), pte_val(pte));
-                VM_WARN_ONCE(pte_write(old_pte) && !pte_dirty(pte),
-                             "%s: racy dirty state clearing: 0x%016llx -> 0x%016llx",
-                             __func__, pte_val(old_pte), pte_val(pte));
-        }
+        VM_WARN_ONCE(!pte_young(pte),
+                     "%s: racy access flag clearing: 0x%016llx -> 0x%016llx",
+                     __func__, pte_val(old_pte), pte_val(pte));
+        VM_WARN_ONCE(pte_write(old_pte) && !pte_dirty(pte),
+                     "%s: racy dirty state clearing: 0x%016llx -> 0x%016llx",
+                     __func__, pte_val(old_pte), pte_val(pte));
+}
+
+static inline void set_pte_at(struct mm_struct *mm, unsigned long addr,
+                              pte_t *ptep, pte_t pte)
+{
+        if (pte_present(pte) && pte_user_exec(pte) && !pte_special(pte))
+                __sync_icache_dcache(pte);
+
+        __check_racy_pte_update(mm, ptep, pte);
 
         set_pte(ptep, pte);
 }
@@ -324,9 +337,14 @@ static inline pmd_t pte_pmd(pte_t pte)
         return __pmd(pte_val(pte));
 }
 
-static inline pgprot_t mk_sect_prot(pgprot_t prot)
+static inline pgprot_t mk_pud_sect_prot(pgprot_t prot)
+{
+        return __pgprot((pgprot_val(prot) & ~PUD_TABLE_BIT) | PUD_TYPE_SECT);
+}
+
+static inline pgprot_t mk_pmd_sect_prot(pgprot_t prot)
 {
-        return __pgprot(pgprot_val(prot) & ~PTE_TABLE_BIT);
+        return __pgprot((pgprot_val(prot) & ~PMD_TABLE_BIT) | PMD_TYPE_SECT);
 }
 
 #ifdef CONFIG_NUMA_BALANCING
diff --git a/arch/arm64/include/asm/ptrace.h b/arch/arm64/include/asm/ptrace.h
index dad858b6adc6..81693244f58d 100644
--- a/arch/arm64/include/asm/ptrace.h
+++ b/arch/arm64/include/asm/ptrace.h
@@ -24,9 +24,15 @@
  * means masking more IRQs (or at least that the same IRQs remain masked).
  *
  * To mask interrupts, we clear the most significant bit of PMR.
+ *
+ * Some code sections either automatically switch back to PSR.I or explicitly
+ * require to not use priority masking. If bit GIC_PRIO_PSR_I_SET is included
+ * in the  the priority mask, it indicates that PSR.I should be set and
+ * interrupt disabling temporarily does not rely on IRQ priorities.
  */
-#define GIC_PRIO_IRQON          0xf0
-#define GIC_PRIO_IRQOFF         (GIC_PRIO_IRQON & ~0x80)
+#define GIC_PRIO_IRQON                  0xc0
+#define GIC_PRIO_IRQOFF                 (GIC_PRIO_IRQON & ~0x80)
+#define GIC_PRIO_PSR_I_SET              (1 << 4)
 
 /* Additional SPSR bits not exposed in the UABI */
 #define PSR_IL_BIT              (1 << 20)
diff --git a/arch/arm64/include/asm/signal32.h b/arch/arm64/include/asm/signal32.h
index 0418c67f2b8b..bd43d1cf724b 100644
--- a/arch/arm64/include/asm/signal32.h
+++ b/arch/arm64/include/asm/signal32.h
@@ -9,6 +9,52 @@
 #ifdef CONFIG_COMPAT
 #include <linux/compat.h>
 
+struct compat_sigcontext {
+        /* We always set these two fields to 0 */
+        compat_ulong_t                  trap_no;
+        compat_ulong_t                  error_code;
+
+        compat_ulong_t                  oldmask;
+        compat_ulong_t                  arm_r0;
+        compat_ulong_t                  arm_r1;
+        compat_ulong_t                  arm_r2;
+        compat_ulong_t                  arm_r3;
+        compat_ulong_t                  arm_r4;
+        compat_ulong_t                  arm_r5;
+        compat_ulong_t                  arm_r6;
+        compat_ulong_t                  arm_r7;
+        compat_ulong_t                  arm_r8;
+        compat_ulong_t                  arm_r9;
+        compat_ulong_t                  arm_r10;
+        compat_ulong_t                  arm_fp;
+        compat_ulong_t                  arm_ip;
+        compat_ulong_t                  arm_sp;
+        compat_ulong_t                  arm_lr;
+        compat_ulong_t                  arm_pc;
+        compat_ulong_t                  arm_cpsr;
+        compat_ulong_t                  fault_address;
+};
+
+struct compat_ucontext {
+        compat_ulong_t                  uc_flags;
+        compat_uptr_t                   uc_link;
+        compat_stack_t                  uc_stack;
+        struct compat_sigcontext        uc_mcontext;
+        compat_sigset_t                 uc_sigmask;
+        int                             __unused[32 - (sizeof(compat_sigset_t) / sizeof(int))];
+        compat_ulong_t                  uc_regspace[128] __attribute__((__aligned__(8)));
+};
+
+struct compat_sigframe {
+        struct compat_ucontext  uc;
+        compat_ulong_t          retcode[2];
+};
+
+struct compat_rt_sigframe {
+        struct compat_siginfo info;
+        struct compat_sigframe sig;
+};
+
 int compat_setup_frame(int usig, struct ksignal *ksig, sigset_t *set,
                        struct pt_regs *regs);
 int compat_setup_rt_frame(int usig, struct ksignal *ksig, sigset_t *set,
diff --git a/arch/arm64/include/asm/simd.h b/arch/arm64/include/asm/simd.h
index 7e245b9e03a5..7434844036d3 100644
--- a/arch/arm64/include/asm/simd.h
+++ b/arch/arm64/include/asm/simd.h
@@ -12,9 +12,9 @@
 #include <linux/preempt.h>
 #include <linux/types.h>
 
-#ifdef CONFIG_KERNEL_MODE_NEON
+DECLARE_PER_CPU(bool, fpsimd_context_busy);
 
-DECLARE_PER_CPU(bool, kernel_neon_busy);
+#ifdef CONFIG_KERNEL_MODE_NEON
 
 /*
  * may_use_simd - whether it is allowable at this time to issue SIMD
@@ -26,15 +26,15 @@ DECLARE_PER_CPU(bool, kernel_neon_busy);
 static __must_check inline bool may_use_simd(void)
 {
         /*
-         * kernel_neon_busy is only set while preemption is disabled,
+         * fpsimd_context_busy is only set while preemption is disabled,
          * and is clear whenever preemption is enabled. Since
-         * this_cpu_read() is atomic w.r.t. preemption, kernel_neon_busy
+         * this_cpu_read() is atomic w.r.t. preemption, fpsimd_context_busy
          * cannot change under our feet -- if it's set we cannot be
          * migrated, and if it's clear we cannot be migrated to a CPU
          * where it is set.
          */
         return !in_irq() && !irqs_disabled() && !in_nmi() &&
-                !this_cpu_read(kernel_neon_busy);
+                !this_cpu_read(fpsimd_context_busy);
 }
 
 #else /* ! CONFIG_KERNEL_MODE_NEON */
diff --git a/arch/arm64/include/asm/sysreg.h b/arch/arm64/include/asm/sysreg.h
index cd7f7ce1a56a..d0bd4ffcf2c4 100644
--- a/arch/arm64/include/asm/sysreg.h
+++ b/arch/arm64/include/asm/sysreg.h
@@ -549,6 +549,7 @@
 
 /* id_aa64isar1 */
 #define ID_AA64ISAR1_SB_SHIFT           36
+#define ID_AA64ISAR1_FRINTTS_SHIFT      32
 #define ID_AA64ISAR1_GPI_SHIFT          28
 #define ID_AA64ISAR1_GPA_SHIFT          24
 #define ID_AA64ISAR1_LRCPC_SHIFT        20
diff --git a/arch/arm64/include/asm/thread_info.h b/arch/arm64/include/asm/thread_info.h
index 2372e97db29c..180b34ec5965 100644
--- a/arch/arm64/include/asm/thread_info.h
+++ b/arch/arm64/include/asm/thread_info.h
@@ -65,6 +65,7 @@ void arch_release_task_struct(struct task_struct *tsk);
  *  TIF_SYSCALL_TRACEPOINT - syscall tracepoint for ftrace
  *  TIF_SYSCALL_AUDIT   - syscall auditing
  *  TIF_SECCOMP         - syscall secure computing
+ *  TIF_SYSCALL_EMU     - syscall emulation active
  *  TIF_SIGPENDING      - signal pending
  *  TIF_NEED_RESCHED    - rescheduling necessary
  *  TIF_NOTIFY_RESUME   - callback before returning to user
@@ -80,6 +81,7 @@ void arch_release_task_struct(struct task_struct *tsk);
 #define TIF_SYSCALL_AUDIT       9
 #define TIF_SYSCALL_TRACEPOINT  10
 #define TIF_SECCOMP             11
+#define TIF_SYSCALL_EMU         12
 #define TIF_MEMDIE              18      /* is terminating due to OOM killer */
 #define TIF_FREEZE              19
 #define TIF_RESTORE_SIGMASK     20
@@ -98,6 +100,7 @@ void arch_release_task_struct(struct task_struct *tsk);
 #define _TIF_SYSCALL_AUDIT      (1 << TIF_SYSCALL_AUDIT)
 #define _TIF_SYSCALL_TRACEPOINT (1 << TIF_SYSCALL_TRACEPOINT)
 #define _TIF_SECCOMP            (1 << TIF_SECCOMP)
+#define _TIF_SYSCALL_EMU        (1 << TIF_SYSCALL_EMU)
 #define _TIF_UPROBE             (1 << TIF_UPROBE)
 #define _TIF_FSCHECK            (1 << TIF_FSCHECK)
 #define _TIF_32BIT              (1 << TIF_32BIT)
@@ -109,7 +112,7 @@ void arch_release_task_struct(struct task_struct *tsk);
 
 #define _TIF_SYSCALL_WORK       (_TIF_SYSCALL_TRACE | _TIF_SYSCALL_AUDIT | \
                                  _TIF_SYSCALL_TRACEPOINT | _TIF_SECCOMP | \
-                                 _TIF_NOHZ)
+                                 _TIF_NOHZ | _TIF_SYSCALL_EMU)
 
 #define INIT_THREAD_INFO(tsk)                                           \
 {                                                                       \
diff --git a/arch/arm64/include/asm/unistd.h b/arch/arm64/include/asm/unistd.h
index c9f8dd421c5f..2a23614198f1 100644
--- a/arch/arm64/include/asm/unistd.h
+++ b/arch/arm64/include/asm/unistd.h
@@ -22,8 +22,13 @@
 #define __NR_compat_exit                1
 #define __NR_compat_read                3
 #define __NR_compat_write               4
+#define __NR_compat_gettimeofday        78
 #define __NR_compat_sigreturn           119
 #define __NR_compat_rt_sigreturn        173
+#define __NR_compat_clock_getres        247
+#define __NR_compat_clock_gettime       263
+#define __NR_compat_clock_gettime64     403
+#define __NR_compat_clock_getres_time64 406
 
 /*
  * The following SVCs are ARM private.
diff --git a/arch/arm64/include/asm/vdso.h b/arch/arm64/include/asm/vdso.h
index 1f94ec19903c..9c15e0a06301 100644
--- a/arch/arm64/include/asm/vdso.h
+++ b/arch/arm64/include/asm/vdso.h
@@ -17,6 +17,9 @@
 #ifndef __ASSEMBLY__
 
 #include <generated/vdso-offsets.h>
+#ifdef CONFIG_COMPAT_VDSO
+#include <generated/vdso32-offsets.h>
+#endif
 
 #define VDSO_SYMBOL(base, name)                                            \
 ({                                                                         \
diff --git a/arch/arm64/include/asm/vdso/compat_barrier.h b/arch/arm64/include/asm/vdso/compat_barrier.h
new file mode 100644
index 000000000000..fb60a88b5ed4
--- /dev/null
+++ b/arch/arm64/include/asm/vdso/compat_barrier.h
@@ -0,0 +1,44 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+/*
+ * Copyright (C) 2018 ARM Limited
+ */
+#ifndef __COMPAT_BARRIER_H
+#define __COMPAT_BARRIER_H
+
+#ifndef __ASSEMBLY__
+/*
+ * Warning: This code is meant to be used with
+ * ENABLE_COMPAT_VDSO only.
+ */
+#ifndef ENABLE_COMPAT_VDSO
+#error This header is meant to be used with ENABLE_COMPAT_VDSO only
+#endif
+
+#ifdef dmb
+#undef dmb
+#endif
+
+#define dmb(option) __asm__ __volatile__ ("dmb " #option : : : "memory")
+
+#if __LINUX_ARM_ARCH__ >= 8
+#define aarch32_smp_mb()        dmb(ish)
+#define aarch32_smp_rmb()       dmb(ishld)
+#define aarch32_smp_wmb()       dmb(ishst)
+#else
+#define aarch32_smp_mb()        dmb(ish)
+#define aarch32_smp_rmb()       aarch32_smp_mb()
+#define aarch32_smp_wmb()       dmb(ishst)
+#endif
+
+
+#undef smp_mb
+#undef smp_rmb
+#undef smp_wmb
+
+#define smp_mb()        aarch32_smp_mb()
+#define smp_rmb()       aarch32_smp_rmb()
+#define smp_wmb()       aarch32_smp_wmb()
+
+#endif /* !__ASSEMBLY__ */
+
+#endif /* __COMPAT_BARRIER_H */
diff --git a/arch/arm64/include/asm/vdso/compat_gettimeofday.h b/arch/arm64/include/asm/vdso/compat_gettimeofday.h
new file mode 100644
index 000000000000..f4812777f5c5
--- /dev/null
+++ b/arch/arm64/include/asm/vdso/compat_gettimeofday.h
@@ -0,0 +1,126 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+/*
+ * Copyright (C) 2018 ARM Limited
+ */
+#ifndef __ASM_VDSO_GETTIMEOFDAY_H
+#define __ASM_VDSO_GETTIMEOFDAY_H
+
+#ifndef __ASSEMBLY__
+
+#include <asm/unistd.h>
+#include <uapi/linux/time.h>
+
+#include <asm/vdso/compat_barrier.h>
+
+#define __VDSO_USE_SYSCALL              ULLONG_MAX
+
+#define VDSO_HAS_CLOCK_GETRES           1
+
+static __always_inline
+int gettimeofday_fallback(struct __kernel_old_timeval *_tv,
+                          struct timezone *_tz)
+{
+        register struct timezone *tz asm("r1") = _tz;
+        register struct __kernel_old_timeval *tv asm("r0") = _tv;
+        register long ret asm ("r0");
+        register long nr asm("r7") = __NR_compat_gettimeofday;
+
+        asm volatile(
+        "       swi #0\n"
+        : "=r" (ret)
+        : "r" (tv), "r" (tz), "r" (nr)
+        : "memory");
+
+        return ret;
+}
+
+static __always_inline
+long clock_gettime_fallback(clockid_t _clkid, struct __kernel_timespec *_ts)
+{
+        register struct __kernel_timespec *ts asm("r1") = _ts;
+        register clockid_t clkid asm("r0") = _clkid;
+        register long ret asm ("r0");
+        register long nr asm("r7") = __NR_compat_clock_gettime64;
+
+        asm volatile(
+        "       swi #0\n"
+        : "=r" (ret)
+        : "r" (clkid), "r" (ts), "r" (nr)
+        : "memory");
+
+        return ret;
+}
+
+static __always_inline
+int clock_getres_fallback(clockid_t _clkid, struct __kernel_timespec *_ts)
+{
+        register struct __kernel_timespec *ts asm("r1") = _ts;
+        register clockid_t clkid asm("r0") = _clkid;
+        register long ret asm ("r0");
+        register long nr asm("r7") = __NR_compat_clock_getres_time64;
+
+        /* The checks below are required for ABI consistency with arm */
+        if ((_clkid >= MAX_CLOCKS) && (_ts == NULL))
+                return -EINVAL;
+
+        asm volatile(
+        "       swi #0\n"
+        : "=r" (ret)
+        : "r" (clkid), "r" (ts), "r" (nr)
+        : "memory");
+
+        return ret;
+}
+
+static __always_inline u64 __arch_get_hw_counter(s32 clock_mode)
+{
+        u64 res;
+
+        /*
+         * clock_mode == 0 implies that vDSO are enabled otherwise
+         * fallback on syscall.
+         */
+        if (clock_mode)
+                return __VDSO_USE_SYSCALL;
+
+        /*
+         * This isb() is required to prevent that the counter value
+         * is speculated.
+         */
+        isb();
+        asm volatile("mrrc p15, 1, %Q0, %R0, c14" : "=r" (res));
+        /*
+         * This isb() is required to prevent that the seq lock is
+         * speculated.
+         */
+        isb();
+
+        return res;
+}
+
+static __always_inline const struct vdso_data *__arch_get_vdso_data(void)
+{
+        const struct vdso_data *ret;
+
+        /*
+         * This simply puts &_vdso_data into ret. The reason why we don't use
+         * `ret = _vdso_data` is that the compiler tends to optimise this in a
+         * very suboptimal way: instead of keeping &_vdso_data in a register,
+         * it goes through a relocation almost every time _vdso_data must be
+         * accessed (even in subfunctions). This is both time and space
+         * consuming: each relocation uses a word in the code section, and it
+         * has to be loaded at runtime.
+         *
+         * This trick hides the assignment from the compiler. Since it cannot
+         * track where the pointer comes from, it will only use one relocation
+         * where __arch_get_vdso_data() is called, and then keep the result in
+         * a register.
+         */
+        asm volatile("mov %0, %1" : "=r"(ret) : "r"(_vdso_data));
+
+        return ret;
+}
+
+#endif /* !__ASSEMBLY__ */
+
+#endif /* __ASM_VDSO_GETTIMEOFDAY_H */
diff --git a/arch/arm64/include/asm/vdso/gettimeofday.h b/arch/arm64/include/asm/vdso/gettimeofday.h
new file mode 100644
index 000000000000..b08f476b72b4
--- /dev/null
+++ b/arch/arm64/include/asm/vdso/gettimeofday.h
@@ -0,0 +1,103 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+/*
+ * Copyright (C) 2018 ARM Limited
+ */
+#ifndef __ASM_VDSO_GETTIMEOFDAY_H
+#define __ASM_VDSO_GETTIMEOFDAY_H
+
+#ifndef __ASSEMBLY__
+
+#include <asm/unistd.h>
+#include <uapi/linux/time.h>
+
+#define __VDSO_USE_SYSCALL              ULLONG_MAX
+
+#define VDSO_HAS_CLOCK_GETRES           1
+
+static __always_inline
+int gettimeofday_fallback(struct __kernel_old_timeval *_tv,
+                          struct timezone *_tz)
+{
+        register struct timezone *tz asm("x1") = _tz;
+        register struct __kernel_old_timeval *tv asm("x0") = _tv;
+        register long ret asm ("x0");
+        register long nr asm("x8") = __NR_gettimeofday;
+
+        asm volatile(
+        "       svc #0\n"
+        : "=r" (ret)
+        : "r" (tv), "r" (tz), "r" (nr)
+        : "memory");
+
+        return ret;
+}
+
+static __always_inline
+long clock_gettime_fallback(clockid_t _clkid, struct __kernel_timespec *_ts)
+{
+        register struct __kernel_timespec *ts asm("x1") = _ts;
+        register clockid_t clkid asm("x0") = _clkid;
+        register long ret asm ("x0");
+        register long nr asm("x8") = __NR_clock_gettime;
+
+        asm volatile(
+        "       svc #0\n"
+        : "=r" (ret)
+        : "r" (clkid), "r" (ts), "r" (nr)
+        : "memory");
+
+        return ret;
+}
+
+static __always_inline
+int clock_getres_fallback(clockid_t _clkid, struct __kernel_timespec *_ts)
+{
+        register struct __kernel_timespec *ts asm("x1") = _ts;
+        register clockid_t clkid asm("x0") = _clkid;
+        register long ret asm ("x0");
+        register long nr asm("x8") = __NR_clock_getres;
+
+        asm volatile(
+        "       svc #0\n"
+        : "=r" (ret)
+        : "r" (clkid), "r" (ts), "r" (nr)
+        : "memory");
+
+        return ret;
+}
+
+static __always_inline u64 __arch_get_hw_counter(s32 clock_mode)
+{
+        u64 res;
+
+        /*
+         * clock_mode == 0 implies that vDSO are enabled otherwise
+         * fallback on syscall.
+         */
+        if (clock_mode)
+                return __VDSO_USE_SYSCALL;
+
+        /*
+         * This isb() is required to prevent that the counter value
+         * is speculated.
+         */
+        isb();
+        asm volatile("mrs %0, cntvct_el0" : "=r" (res) :: "memory");
+        /*
+         * This isb() is required to prevent that the seq lock is
+         * speculated.#
+         */
+        isb();
+
+        return res;
+}
+
+static __always_inline
+const struct vdso_data *__arch_get_vdso_data(void)
+{
+        return _vdso_data;
+}
+
+#endif /* !__ASSEMBLY__ */
+
+#endif /* __ASM_VDSO_GETTIMEOFDAY_H */
diff --git a/arch/arm64/include/asm/vdso/vsyscall.h b/arch/arm64/include/asm/vdso/vsyscall.h
new file mode 100644
index 000000000000..0c731bfc7c8c
--- /dev/null
+++ b/arch/arm64/include/asm/vdso/vsyscall.h
@@ -0,0 +1,53 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+#ifndef __ASM_VDSO_VSYSCALL_H
+#define __ASM_VDSO_VSYSCALL_H
+
+#ifndef __ASSEMBLY__
+
+#include <linux/timekeeper_internal.h>
+#include <vdso/datapage.h>
+
+#define VDSO_PRECISION_MASK     ~(0xFF00ULL<<48)
+
+extern struct vdso_data *vdso_data;
+
+/*
+ * Update the vDSO data page to keep in sync with kernel timekeeping.
+ */
+static __always_inline
+struct vdso_data *__arm64_get_k_vdso_data(void)
+{
+        return vdso_data;
+}
+#define __arch_get_k_vdso_data __arm64_get_k_vdso_data
+
+static __always_inline
+int __arm64_get_clock_mode(struct timekeeper *tk)
+{
+        u32 use_syscall = !tk->tkr_mono.clock->archdata.vdso_direct;
+
+        return use_syscall;
+}
+#define __arch_get_clock_mode __arm64_get_clock_mode
+
+static __always_inline
+int __arm64_use_vsyscall(struct vdso_data *vdata)
+{
+        return !vdata[CS_HRES_COARSE].clock_mode;
+}
+#define __arch_use_vsyscall __arm64_use_vsyscall
+
+static __always_inline
+void __arm64_update_vsyscall(struct vdso_data *vdata, struct timekeeper *tk)
+{
+        vdata[CS_HRES_COARSE].mask      = VDSO_PRECISION_MASK;
+        vdata[CS_RAW].mask              = VDSO_PRECISION_MASK;
+}
+#define __arch_update_vsyscall __arm64_update_vsyscall
+
+/* The asm-generic header needs to be included after the definitions above */
+#include <asm-generic/vdso/vsyscall.h>
+
+#endif /* !__ASSEMBLY__ */
+
+#endif /* __ASM_VDSO_VSYSCALL_H */
diff --git a/arch/arm64/include/uapi/asm/hwcap.h b/arch/arm64/include/uapi/asm/hwcap.h
index 1a772b162191..a1e72886b30c 100644
--- a/arch/arm64/include/uapi/asm/hwcap.h
+++ b/arch/arm64/include/uapi/asm/hwcap.h
@@ -63,5 +63,7 @@
 #define HWCAP2_SVEBITPERM       (1 << 4)
 #define HWCAP2_SVESHA3          (1 << 5)
 #define HWCAP2_SVESM4           (1 << 6)
+#define HWCAP2_FLAGM2           (1 << 7)
+#define HWCAP2_FRINT            (1 << 8)
 
 #endif /* _UAPI__ASM_HWCAP_H */
diff --git a/arch/arm64/include/uapi/asm/ptrace.h b/arch/arm64/include/uapi/asm/ptrace.h
index e932284993d4..7ed9294e2004 100644
--- a/arch/arm64/include/uapi/asm/ptrace.h
+++ b/arch/arm64/include/uapi/asm/ptrace.h
@@ -62,6 +62,9 @@
 #define PSR_x           0x0000ff00      /* Extension            */
 #define PSR_c           0x000000ff      /* Control              */
 
+/* syscall emulation path in ptrace */
+#define PTRACE_SYSEMU             31
+#define PTRACE_SYSEMU_SINGLESTEP  32
 
 #ifndef __ASSEMBLY__
 
diff --git a/arch/arm64/kernel/Makefile b/arch/arm64/kernel/Makefile
index 9e7dcb2c31c7..478491f07b4f 100644
--- a/arch/arm64/kernel/Makefile
+++ b/arch/arm64/kernel/Makefile
@@ -28,7 +28,10 @@ $(obj)/%.stub.o: $(obj)/%.o FORCE
         $(call if_changed,objcopy)
 
 obj-$(CONFIG_COMPAT)                    += sys32.o signal32.o                   \
-                                           sigreturn32.o sys_compat.o
+                                           sys_compat.o
+ifneq ($(CONFIG_COMPAT_VDSO), y)
+obj-$(CONFIG_COMPAT)                    += sigreturn32.o
+endif
 obj-$(CONFIG_KUSER_HELPERS)             += kuser32.o
 obj-$(CONFIG_FUNCTION_TRACER)           += ftrace.o entry-ftrace.o
 obj-$(CONFIG_MODULES)                   += module.o
@@ -62,6 +65,7 @@ obj-$(CONFIG_ARM64_SSBD)		+= ssbd.o
 obj-$(CONFIG_ARM64_PTR_AUTH)            += pointer_auth.o
 
 obj-y                                   += vdso/ probes/
+obj-$(CONFIG_COMPAT_VDSO)               += vdso32/
 head-y                                  := head.o
 extra-y                                 += $(head-y) vmlinux.lds
 
diff --git a/arch/arm64/kernel/acpi.c b/arch/arm64/kernel/acpi.c
index 2804330c95dc..3a58e9db5cfe 100644
--- a/arch/arm64/kernel/acpi.c
+++ b/arch/arm64/kernel/acpi.c
@@ -152,10 +152,14 @@ static int __init acpi_fadt_sanity_check(void)
          */
         if (table->revision < 5 ||
            (table->revision == 5 && fadt->minor_revision < 1)) {
-                pr_err("Unsupported FADT revision %d.%d, should be 5.1+\n",
+                pr_err(FW_BUG "Unsupported FADT revision %d.%d, should be 5.1+\n",
                        table->revision, fadt->minor_revision);
-                ret = -EINVAL;
-                goto out;
+
+                if (!fadt->arm_boot_flags) {
+                        ret = -EINVAL;
+                        goto out;
+                }
+                pr_err("FADT has ARM boot flags set, assuming 5.1\n");
         }
 
         if (!(fadt->flags & ACPI_FADT_HW_REDUCED)) {
diff --git a/arch/arm64/kernel/asm-offsets.c b/arch/arm64/kernel/asm-offsets.c
index 02f08768c298..214685760e1c 100644
--- a/arch/arm64/kernel/asm-offsets.c
+++ b/arch/arm64/kernel/asm-offsets.c
@@ -18,9 +18,9 @@
 #include <asm/fixmap.h>
 #include <asm/thread_info.h>
 #include <asm/memory.h>
+#include <asm/signal32.h>
 #include <asm/smp_plat.h>
 #include <asm/suspend.h>
-#include <asm/vdso_datapage.h>
 #include <linux/kbuild.h>
 #include <linux/arm-smccc.h>
 
@@ -66,6 +66,11 @@ int main(void)
   DEFINE(S_STACKFRAME,          offsetof(struct pt_regs, stackframe));
   DEFINE(S_FRAME_SIZE,          sizeof(struct pt_regs));
   BLANK();
+#ifdef CONFIG_COMPAT
+  DEFINE(COMPAT_SIGFRAME_REGS_OFFSET,           offsetof(struct compat_sigframe, uc.uc_mcontext.arm_r0));
+  DEFINE(COMPAT_RT_SIGFRAME_REGS_OFFSET,        offsetof(struct compat_rt_sigframe, sig.uc.uc_mcontext.arm_r0));
+  BLANK();
+#endif
   DEFINE(MM_CONTEXT_ID,         offsetof(struct mm_struct, context.id.counter));
   BLANK();
   DEFINE(VMA_VM_MM,             offsetof(struct vm_area_struct, vm_mm));
@@ -80,33 +85,6 @@ int main(void)
   BLANK();
   DEFINE(PREEMPT_DISABLE_OFFSET, PREEMPT_DISABLE_OFFSET);
   BLANK();
-  DEFINE(CLOCK_REALTIME,        CLOCK_REALTIME);
-  DEFINE(CLOCK_MONOTONIC,       CLOCK_MONOTONIC);
-  DEFINE(CLOCK_MONOTONIC_RAW,   CLOCK_MONOTONIC_RAW);
-  DEFINE(CLOCK_REALTIME_RES,    offsetof(struct vdso_data, hrtimer_res));
-  DEFINE(CLOCK_REALTIME_COARSE, CLOCK_REALTIME_COARSE);
-  DEFINE(CLOCK_MONOTONIC_COARSE,CLOCK_MONOTONIC_COARSE);
-  DEFINE(CLOCK_COARSE_RES,      LOW_RES_NSEC);
-  DEFINE(NSEC_PER_SEC,          NSEC_PER_SEC);
-  BLANK();
-  DEFINE(VDSO_CS_CYCLE_LAST,    offsetof(struct vdso_data, cs_cycle_last));
-  DEFINE(VDSO_RAW_TIME_SEC,     offsetof(struct vdso_data, raw_time_sec));
-  DEFINE(VDSO_XTIME_CLK_SEC,    offsetof(struct vdso_data, xtime_clock_sec));
-  DEFINE(VDSO_XTIME_CRS_SEC,    offsetof(struct vdso_data, xtime_coarse_sec));
-  DEFINE(VDSO_XTIME_CRS_NSEC,   offsetof(struct vdso_data, xtime_coarse_nsec));
-  DEFINE(VDSO_WTM_CLK_SEC,      offsetof(struct vdso_data, wtm_clock_sec));
-  DEFINE(VDSO_TB_SEQ_COUNT,     offsetof(struct vdso_data, tb_seq_count));
-  DEFINE(VDSO_CS_MONO_MULT,     offsetof(struct vdso_data, cs_mono_mult));
-  DEFINE(VDSO_CS_SHIFT,         offsetof(struct vdso_data, cs_shift));
-  DEFINE(VDSO_TZ_MINWEST,       offsetof(struct vdso_data, tz_minuteswest));
-  DEFINE(VDSO_USE_SYSCALL,      offsetof(struct vdso_data, use_syscall));
-  BLANK();
-  DEFINE(TVAL_TV_SEC,           offsetof(struct timeval, tv_sec));
-  DEFINE(TSPEC_TV_SEC,          offsetof(struct timespec, tv_sec));
-  BLANK();
-  DEFINE(TZ_MINWEST,            offsetof(struct timezone, tz_minuteswest));
-  DEFINE(TZ_DSTTIME,            offsetof(struct timezone, tz_dsttime));
-  BLANK();
   DEFINE(CPU_BOOT_STACK,        offsetof(struct secondary_data, stack));
   DEFINE(CPU_BOOT_TASK,         offsetof(struct secondary_data, task));
   BLANK();
diff --git a/arch/arm64/kernel/cacheinfo.c b/arch/arm64/kernel/cacheinfo.c
index 880d79904d36..7fa6828bb488 100644
--- a/arch/arm64/kernel/cacheinfo.c
+++ b/arch/arm64/kernel/cacheinfo.c
@@ -17,6 +17,15 @@
 #define CLIDR_CTYPE(clidr, level)       \
         (((clidr) & CLIDR_CTYPE_MASK(level)) >> CLIDR_CTYPE_SHIFT(level))
 
+int cache_line_size(void)
+{
+        if (coherency_max_size != 0)
+                return coherency_max_size;
+
+        return cache_line_size_of_cpu();
+}
+EXPORT_SYMBOL_GPL(cache_line_size);
+
 static inline enum cache_type get_cache_type(int level)
 {
         u64 clidr;
diff --git a/arch/arm64/kernel/cpufeature.c b/arch/arm64/kernel/cpufeature.c
index aabdabf52fdb..f29f36a65175 100644
--- a/arch/arm64/kernel/cpufeature.c
+++ b/arch/arm64/kernel/cpufeature.c
@@ -1184,14 +1184,14 @@ static struct undef_hook ssbs_emulation_hook = {
 static void cpu_enable_ssbs(const struct arm64_cpu_capabilities *__unused)
 {
         static bool undef_hook_registered = false;
-        static DEFINE_SPINLOCK(hook_lock);
+        static DEFINE_RAW_SPINLOCK(hook_lock);
 
-        spin_lock(&hook_lock);
+        raw_spin_lock(&hook_lock);
         if (!undef_hook_registered) {
                 register_undef_hook(&ssbs_emulation_hook);
                 undef_hook_registered = true;
         }
-        spin_unlock(&hook_lock);
+        raw_spin_unlock(&hook_lock);
 
         if (arm64_get_ssbd_state() == ARM64_SSBD_FORCE_DISABLE) {
                 sysreg_clear_set(sctlr_el1, 0, SCTLR_ELx_DSSBS);
@@ -1618,6 +1618,7 @@ static const struct arm64_cpu_capabilities arm64_elf_hwcaps[] = {
         HWCAP_CAP(SYS_ID_AA64ISAR0_EL1, ID_AA64ISAR0_DP_SHIFT, FTR_UNSIGNED, 1, CAP_HWCAP, KERNEL_HWCAP_ASIMDDP),
         HWCAP_CAP(SYS_ID_AA64ISAR0_EL1, ID_AA64ISAR0_FHM_SHIFT, FTR_UNSIGNED, 1, CAP_HWCAP, KERNEL_HWCAP_ASIMDFHM),
         HWCAP_CAP(SYS_ID_AA64ISAR0_EL1, ID_AA64ISAR0_TS_SHIFT, FTR_UNSIGNED, 1, CAP_HWCAP, KERNEL_HWCAP_FLAGM),
+        HWCAP_CAP(SYS_ID_AA64ISAR0_EL1, ID_AA64ISAR0_TS_SHIFT, FTR_UNSIGNED, 2, CAP_HWCAP, KERNEL_HWCAP_FLAGM2),
         HWCAP_CAP(SYS_ID_AA64PFR0_EL1, ID_AA64PFR0_FP_SHIFT, FTR_SIGNED, 0, CAP_HWCAP, KERNEL_HWCAP_FP),
         HWCAP_CAP(SYS_ID_AA64PFR0_EL1, ID_AA64PFR0_FP_SHIFT, FTR_SIGNED, 1, CAP_HWCAP, KERNEL_HWCAP_FPHP),
         HWCAP_CAP(SYS_ID_AA64PFR0_EL1, ID_AA64PFR0_ASIMD_SHIFT, FTR_SIGNED, 0, CAP_HWCAP, KERNEL_HWCAP_ASIMD),
@@ -1629,6 +1630,7 @@ static const struct arm64_cpu_capabilities arm64_elf_hwcaps[] = {
         HWCAP_CAP(SYS_ID_AA64ISAR1_EL1, ID_AA64ISAR1_FCMA_SHIFT, FTR_UNSIGNED, 1, CAP_HWCAP, KERNEL_HWCAP_FCMA),
         HWCAP_CAP(SYS_ID_AA64ISAR1_EL1, ID_AA64ISAR1_LRCPC_SHIFT, FTR_UNSIGNED, 1, CAP_HWCAP, KERNEL_HWCAP_LRCPC),
         HWCAP_CAP(SYS_ID_AA64ISAR1_EL1, ID_AA64ISAR1_LRCPC_SHIFT, FTR_UNSIGNED, 2, CAP_HWCAP, KERNEL_HWCAP_ILRCPC),
+        HWCAP_CAP(SYS_ID_AA64ISAR1_EL1, ID_AA64ISAR1_FRINTTS_SHIFT, FTR_UNSIGNED, 1, CAP_HWCAP, KERNEL_HWCAP_FRINT),
         HWCAP_CAP(SYS_ID_AA64ISAR1_EL1, ID_AA64ISAR1_SB_SHIFT, FTR_UNSIGNED, 1, CAP_HWCAP, KERNEL_HWCAP_SB),
         HWCAP_CAP(SYS_ID_AA64MMFR2_EL1, ID_AA64MMFR2_AT_SHIFT, FTR_UNSIGNED, 1, CAP_HWCAP, KERNEL_HWCAP_USCAT),
 #ifdef CONFIG_ARM64_SVE
diff --git a/arch/arm64/kernel/cpuinfo.c b/arch/arm64/kernel/cpuinfo.c
index 0593665fc7b4..876055e37352 100644
--- a/arch/arm64/kernel/cpuinfo.c
+++ b/arch/arm64/kernel/cpuinfo.c
@@ -82,6 +82,8 @@ static const char *const hwcap_str[] = {
         "svebitperm",
         "svesha3",
         "svesm4",
+        "flagm2",
+        "frint",
         NULL
 };
 
diff --git a/arch/arm64/kernel/entry.S b/arch/arm64/kernel/entry.S
index 2df8d0a1d980..9cdc4592da3e 100644
--- a/arch/arm64/kernel/entry.S
+++ b/arch/arm64/kernel/entry.S
@@ -247,6 +247,7 @@ alternative_else_nop_endif
         /*
          * Registers that may be useful after this macro is invoked:
          *
+         * x20 - ICC_PMR_EL1
          * x21 - aborted SP
          * x22 - aborted PC
          * x23 - aborted PSTATE
@@ -424,6 +425,38 @@ tsk	.req	x28		// current thread_info
         irq_stack_exit
         .endm
 
+#ifdef CONFIG_ARM64_PSEUDO_NMI
+        /*
+         * Set res to 0 if irqs were unmasked in interrupted context.
+         * Otherwise set res to non-0 value.
+         */
+        .macro  test_irqs_unmasked res:req, pmr:req
+alternative_if ARM64_HAS_IRQ_PRIO_MASKING
+        sub     \res, \pmr, #GIC_PRIO_IRQON
+alternative_else
+        mov     \res, xzr
+alternative_endif
+        .endm
+#endif
+
+        .macro  gic_prio_kentry_setup, tmp:req
+#ifdef CONFIG_ARM64_PSEUDO_NMI
+        alternative_if ARM64_HAS_IRQ_PRIO_MASKING
+        mov     \tmp, #(GIC_PRIO_PSR_I_SET | GIC_PRIO_IRQON)
+        msr_s   SYS_ICC_PMR_EL1, \tmp
+        alternative_else_nop_endif
+#endif
+        .endm
+
+        .macro  gic_prio_irq_setup, pmr:req, tmp:req
+#ifdef CONFIG_ARM64_PSEUDO_NMI
+        alternative_if ARM64_HAS_IRQ_PRIO_MASKING
+        orr     \tmp, \pmr, #GIC_PRIO_PSR_I_SET
+        msr_s   SYS_ICC_PMR_EL1, \tmp
+        alternative_else_nop_endif
+#endif
+        .endm
+
         .text
 
 /*
@@ -602,6 +635,7 @@ el1_dbg:
         cmp     x24, #ESR_ELx_EC_BRK64          // if BRK64
         cinc    x24, x24, eq                    // set bit '0'
         tbz     x24, #0, el1_inv                // EL1 only
+        gic_prio_kentry_setup tmp=x3
         mrs     x0, far_el1
         mov     x2, sp                          // struct pt_regs
         bl      do_debug_exception
@@ -619,20 +653,18 @@ ENDPROC(el1_sync)
         .align  6
 el1_irq:
         kernel_entry 1
+        gic_prio_irq_setup pmr=x20, tmp=x1
         enable_da_f
-#ifdef CONFIG_TRACE_IRQFLAGS
+
 #ifdef CONFIG_ARM64_PSEUDO_NMI
-alternative_if ARM64_HAS_IRQ_PRIO_MASKING
-        ldr     x20, [sp, #S_PMR_SAVE]
-alternative_else
-        mov     x20, #GIC_PRIO_IRQON
-alternative_endif
-        cmp     x20, #GIC_PRIO_IRQOFF
-        /* Irqs were disabled, don't trace */
-        b.ls    1f
+        test_irqs_unmasked      res=x0, pmr=x20
+        cbz     x0, 1f
+        bl      asm_nmi_enter
+1:
 #endif
+
+#ifdef CONFIG_TRACE_IRQFLAGS
         bl      trace_hardirqs_off
-1:
 #endif
 
         irq_handler
@@ -651,14 +683,23 @@ alternative_else_nop_endif
         bl      preempt_schedule_irq            // irq en/disable is done inside
 1:
 #endif
-#ifdef CONFIG_TRACE_IRQFLAGS
+
 #ifdef CONFIG_ARM64_PSEUDO_NMI
         /*
-         * if IRQs were disabled when we received the interrupt, we have an NMI
-         * and we are not re-enabling interrupt upon eret. Skip tracing.
+         * When using IRQ priority masking, we can get spurious interrupts while
+         * PMR is set to GIC_PRIO_IRQOFF. An NMI might also have occurred in a
+         * section with interrupts disabled. Skip tracing in those cases.
          */
-        cmp     x20, #GIC_PRIO_IRQOFF
-        b.ls    1f
+        test_irqs_unmasked      res=x0, pmr=x20
+        cbz     x0, 1f
+        bl      asm_nmi_exit
+1:
+#endif
+
+#ifdef CONFIG_TRACE_IRQFLAGS
+#ifdef CONFIG_ARM64_PSEUDO_NMI
+        test_irqs_unmasked      res=x0, pmr=x20
+        cbnz    x0, 1f
 #endif
         bl      trace_hardirqs_on
 1:
@@ -776,6 +817,7 @@ el0_ia:
          * Instruction abort handling
          */
         mrs     x26, far_el1
+        gic_prio_kentry_setup tmp=x0
         enable_da_f
 #ifdef CONFIG_TRACE_IRQFLAGS
         bl      trace_hardirqs_off
@@ -821,6 +863,7 @@ el0_sp_pc:
          * Stack or PC alignment exception handling
          */
         mrs     x26, far_el1
+        gic_prio_kentry_setup tmp=x0
         enable_da_f
 #ifdef CONFIG_TRACE_IRQFLAGS
         bl      trace_hardirqs_off
@@ -855,11 +898,12 @@ el0_dbg:
          * Debug exception handling
          */
         tbnz    x24, #0, el0_inv                // EL0 only
+        gic_prio_kentry_setup tmp=x3
         mrs     x0, far_el1
         mov     x1, x25
         mov     x2, sp
         bl      do_debug_exception
-        enable_daif
+        enable_da_f
         ct_user_exit
         b       ret_to_user
 el0_inv:
@@ -876,7 +920,9 @@ ENDPROC(el0_sync)
 el0_irq:
         kernel_entry 0
 el0_irq_naked:
+        gic_prio_irq_setup pmr=x20, tmp=x0
         enable_da_f
+
 #ifdef CONFIG_TRACE_IRQFLAGS
         bl      trace_hardirqs_off
 #endif
@@ -898,6 +944,7 @@ ENDPROC(el0_irq)
 el1_error:
         kernel_entry 1
         mrs     x1, esr_el1
+        gic_prio_kentry_setup tmp=x2
         enable_dbg
         mov     x0, sp
         bl      do_serror
@@ -908,10 +955,11 @@ el0_error:
         kernel_entry 0
 el0_error_naked:
         mrs     x1, esr_el1
+        gic_prio_kentry_setup tmp=x2
         enable_dbg
         mov     x0, sp
         bl      do_serror
-        enable_daif
+        enable_da_f
         ct_user_exit
         b       ret_to_user
 ENDPROC(el0_error)
@@ -932,6 +980,7 @@ work_pending:
  */
 ret_to_user:
         disable_daif
+        gic_prio_kentry_setup tmp=x3
         ldr     x1, [tsk, #TSK_TI_FLAGS]
         and     x2, x1, #_TIF_WORK_MASK
         cbnz    x2, work_pending
@@ -948,6 +997,7 @@ ENDPROC(ret_to_user)
  */
         .align  6
 el0_svc:
+        gic_prio_kentry_setup tmp=x1
         mov     x0, sp
         bl      el0_svc_handler
         b       ret_to_user
diff --git a/arch/arm64/kernel/fpsimd.c b/arch/arm64/kernel/fpsimd.c
index 0cfcf5c237c5..eec4776ae5f0 100644
--- a/arch/arm64/kernel/fpsimd.c
+++ b/arch/arm64/kernel/fpsimd.c
@@ -82,7 +82,8 @@
  * To prevent this from racing with the manipulation of the task's FPSIMD state
  * from task context and thereby corrupting the state, it is necessary to
  * protect any manipulation of a task's fpsimd_state or TIF_FOREIGN_FPSTATE
- * flag with local_bh_disable() unless softirqs are already masked.
+ * flag with {, __}get_cpu_fpsimd_context(). This will still allow softirqs to
+ * run but prevent them to use FPSIMD.
  *
  * For a certain task, the sequence may look something like this:
  * - the task gets scheduled in; if both the task's fpsimd_cpu field
@@ -145,6 +146,56 @@ extern void __percpu *efi_sve_state;
 
 #endif /* ! CONFIG_ARM64_SVE */
 
+DEFINE_PER_CPU(bool, fpsimd_context_busy);
+EXPORT_PER_CPU_SYMBOL(fpsimd_context_busy);
+
+static void __get_cpu_fpsimd_context(void)
+{
+        bool busy = __this_cpu_xchg(fpsimd_context_busy, true);
+
+        WARN_ON(busy);
+}
+
+/*
+ * Claim ownership of the CPU FPSIMD context for use by the calling context.
+ *
+ * The caller may freely manipulate the FPSIMD context metadata until
+ * put_cpu_fpsimd_context() is called.
+ *
+ * The double-underscore version must only be called if you know the task
+ * can't be preempted.
+ */
+static void get_cpu_fpsimd_context(void)
+{
+        preempt_disable();
+        __get_cpu_fpsimd_context();
+}
+
+static void __put_cpu_fpsimd_context(void)
+{
+        bool busy = __this_cpu_xchg(fpsimd_context_busy, false);
+
+        WARN_ON(!busy); /* No matching get_cpu_fpsimd_context()? */
+}
+
+/*
+ * Release the CPU FPSIMD context.
+ *
+ * Must be called from a context in which get_cpu_fpsimd_context() was
+ * previously called, with no call to put_cpu_fpsimd_context() in the
+ * meantime.
+ */
+static void put_cpu_fpsimd_context(void)
+{
+        __put_cpu_fpsimd_context();
+        preempt_enable();
+}
+
+static bool have_cpu_fpsimd_context(void)
+{
+        return !preemptible() && __this_cpu_read(fpsimd_context_busy);
+}
+
 /*
  * Call __sve_free() directly only if you know task can't be scheduled
  * or preempted.
@@ -215,12 +266,10 @@ static void sve_free(struct task_struct *task)
  * This function should be called only when the FPSIMD/SVE state in
  * thread_struct is known to be up to date, when preparing to enter
  * userspace.
- *
- * Softirqs (and preemption) must be disabled.
  */
 static void task_fpsimd_load(void)
 {
-        WARN_ON(!in_softirq() && !irqs_disabled());
+        WARN_ON(!have_cpu_fpsimd_context());
 
         if (system_supports_sve() && test_thread_flag(TIF_SVE))
                 sve_load_state(sve_pffr(&current->thread),
@@ -233,16 +282,14 @@ static void task_fpsimd_load(void)
 /*
  * Ensure FPSIMD/SVE storage in memory for the loaded context is up to
  * date with respect to the CPU registers.
- *
- * Softirqs (and preemption) must be disabled.
  */
-void fpsimd_save(void)
+static void fpsimd_save(void)
 {
         struct fpsimd_last_state_struct const *last =
                 this_cpu_ptr(&fpsimd_last_state);
         /* set by fpsimd_bind_task_to_cpu() or fpsimd_bind_state_to_cpu() */
 
-        WARN_ON(!in_softirq() && !irqs_disabled());
+        WARN_ON(!have_cpu_fpsimd_context());
 
         if (!test_thread_flag(TIF_FOREIGN_FPSTATE)) {
                 if (system_supports_sve() && test_thread_flag(TIF_SVE)) {
@@ -364,7 +411,8 @@ static __uint128_t arm64_cpu_to_le128(__uint128_t x)
  * task->thread.sve_state.
  *
  * Task can be a non-runnable task, or current.  In the latter case,
- * softirqs (and preemption) must be disabled.
+ * the caller must have ownership of the cpu FPSIMD context before calling
+ * this function.
  * task->thread.sve_state must point to at least sve_state_size(task)
  * bytes of allocated kernel memory.
  * task->thread.uw.fpsimd_state must be up to date before calling this
@@ -393,7 +441,8 @@ static void fpsimd_to_sve(struct task_struct *task)
  * task->thread.uw.fpsimd_state.
  *
  * Task can be a non-runnable task, or current.  In the latter case,
- * softirqs (and preemption) must be disabled.
+ * the caller must have ownership of the cpu FPSIMD context before calling
+ * this function.
  * task->thread.sve_state must point to at least sve_state_size(task)
  * bytes of allocated kernel memory.
  * task->thread.sve_state must be up to date before calling this function.
@@ -557,7 +606,7 @@ int sve_set_vector_length(struct task_struct *task,
          * non-SVE thread.
          */
         if (task == current) {
-                local_bh_disable();
+                get_cpu_fpsimd_context();
 
                 fpsimd_save();
         }
@@ -567,7 +616,7 @@ int sve_set_vector_length(struct task_struct *task,
                 sve_to_fpsimd(task);
 
         if (task == current)
-                local_bh_enable();
+                put_cpu_fpsimd_context();
 
         /*
          * Force reallocation of task SVE state to the correct size
@@ -880,7 +929,7 @@ asmlinkage void do_sve_acc(unsigned int esr, struct pt_regs *regs)
 
         sve_alloc(current);
 
-        local_bh_disable();
+        get_cpu_fpsimd_context();
 
         fpsimd_save();
 
@@ -891,7 +940,7 @@ asmlinkage void do_sve_acc(unsigned int esr, struct pt_regs *regs)
         if (test_and_set_thread_flag(TIF_SVE))
                 WARN_ON(1); /* SVE access shouldn't have trapped */
 
-        local_bh_enable();
+        put_cpu_fpsimd_context();
 }
 
 /*
@@ -935,6 +984,8 @@ void fpsimd_thread_switch(struct task_struct *next)
         if (!system_supports_fpsimd())
                 return;
 
+        __get_cpu_fpsimd_context();
+
         /* Save unsaved fpsimd state, if any: */
         fpsimd_save();
 
@@ -949,6 +1000,8 @@ void fpsimd_thread_switch(struct task_struct *next)
 
         update_tsk_thread_flag(next, TIF_FOREIGN_FPSTATE,
                                wrong_task || wrong_cpu);
+
+        __put_cpu_fpsimd_context();
 }
 
 void fpsimd_flush_thread(void)
@@ -958,7 +1011,7 @@ void fpsimd_flush_thread(void)
         if (!system_supports_fpsimd())
                 return;
 
-        local_bh_disable();
+        get_cpu_fpsimd_context();
 
         fpsimd_flush_task_state(current);
         memset(&current->thread.uw.fpsimd_state, 0,
@@ -999,7 +1052,7 @@ void fpsimd_flush_thread(void)
                         current->thread.sve_vl_onexec = 0;
         }
 
-        local_bh_enable();
+        put_cpu_fpsimd_context();
 }
 
 /*
@@ -1011,9 +1064,9 @@ void fpsimd_preserve_current_state(void)
         if (!system_supports_fpsimd())
                 return;
 
-        local_bh_disable();
+        get_cpu_fpsimd_context();
         fpsimd_save();
-        local_bh_enable();
+        put_cpu_fpsimd_context();
 }
 
 /*
@@ -1030,7 +1083,8 @@ void fpsimd_signal_preserve_current_state(void)
 
 /*
  * Associate current's FPSIMD context with this cpu
- * Preemption must be disabled when calling this function.
+ * The caller must have ownership of the cpu FPSIMD context before calling
+ * this function.
  */
 void fpsimd_bind_task_to_cpu(void)
 {
@@ -1076,14 +1130,14 @@ void fpsimd_restore_current_state(void)
         if (!system_supports_fpsimd())
                 return;
 
-        local_bh_disable();
+        get_cpu_fpsimd_context();
 
         if (test_and_clear_thread_flag(TIF_FOREIGN_FPSTATE)) {
                 task_fpsimd_load();
                 fpsimd_bind_task_to_cpu();
         }
 
-        local_bh_enable();
+        put_cpu_fpsimd_context();
 }
 
 /*
@@ -1096,7 +1150,7 @@ void fpsimd_update_current_state(struct user_fpsimd_state const *state)
         if (!system_supports_fpsimd())
                 return;
 
-        local_bh_disable();
+        get_cpu_fpsimd_context();
 
         current->thread.uw.fpsimd_state = *state;
         if (system_supports_sve() && test_thread_flag(TIF_SVE))
@@ -1107,7 +1161,7 @@ void fpsimd_update_current_state(struct user_fpsimd_state const *state)
 
         clear_thread_flag(TIF_FOREIGN_FPSTATE);
 
-        local_bh_enable();
+        put_cpu_fpsimd_context();
 }
 
 /*
@@ -1133,18 +1187,29 @@ void fpsimd_flush_task_state(struct task_struct *t)
 
 /*
  * Invalidate any task's FPSIMD state that is present on this cpu.
- * This function must be called with softirqs disabled.
+ * The FPSIMD context should be acquired with get_cpu_fpsimd_context()
+ * before calling this function.
  */
-void fpsimd_flush_cpu_state(void)
+static void fpsimd_flush_cpu_state(void)
 {
         __this_cpu_write(fpsimd_last_state.st, NULL);
         set_thread_flag(TIF_FOREIGN_FPSTATE);
 }
 
-#ifdef CONFIG_KERNEL_MODE_NEON
+/*
+ * Save the FPSIMD state to memory and invalidate cpu view.
+ * This function must be called with preemption disabled.
+ */
+void fpsimd_save_and_flush_cpu_state(void)
+{
+        WARN_ON(preemptible());
+        __get_cpu_fpsimd_context();
+        fpsimd_save();
+        fpsimd_flush_cpu_state();
+        __put_cpu_fpsimd_context();
+}
 
-DEFINE_PER_CPU(bool, kernel_neon_busy);
-EXPORT_PER_CPU_SYMBOL(kernel_neon_busy);
+#ifdef CONFIG_KERNEL_MODE_NEON
 
 /*
  * Kernel-side NEON support functions
@@ -1170,19 +1235,13 @@ void kernel_neon_begin(void)
 
         BUG_ON(!may_use_simd());
 
-        local_bh_disable();
-
-        __this_cpu_write(kernel_neon_busy, true);
+        get_cpu_fpsimd_context();
 
         /* Save unsaved fpsimd state, if any: */
         fpsimd_save();
 
         /* Invalidate any task state remaining in the fpsimd regs: */
         fpsimd_flush_cpu_state();
-
-        preempt_disable();
-
-        local_bh_enable();
 }
 EXPORT_SYMBOL(kernel_neon_begin);
 
@@ -1197,15 +1256,10 @@ EXPORT_SYMBOL(kernel_neon_begin);
  */
 void kernel_neon_end(void)
 {
-        bool busy;
-
         if (!system_supports_fpsimd())
                 return;
 
-        busy = __this_cpu_xchg(kernel_neon_busy, false);
-        WARN_ON(!busy); /* No matching kernel_neon_begin()? */
-
-        preempt_enable();
+        put_cpu_fpsimd_context();
 }
 EXPORT_SYMBOL(kernel_neon_end);
 
@@ -1297,8 +1351,7 @@ static int fpsimd_cpu_pm_notifier(struct notifier_block *self,
 {
         switch (cmd) {
         case CPU_PM_ENTER:
-                fpsimd_save();
-                fpsimd_flush_cpu_state();
+                fpsimd_save_and_flush_cpu_state();
                 break;
         case CPU_PM_EXIT:
                 break;
diff --git a/arch/arm64/kernel/image.h b/arch/arm64/kernel/image.h
index 04ca08086d35..2b85c0d6fa3d 100644
--- a/arch/arm64/kernel/image.h
+++ b/arch/arm64/kernel/image.h
@@ -67,7 +67,11 @@
 
 #ifdef CONFIG_EFI
 
-__efistub_stext_offset = stext - _text;
+/*
+ * Use ABSOLUTE() to avoid ld.lld treating this as a relative symbol:
+ * https://github.com/ClangBuiltLinux/linux/issues/561
+ */
+__efistub_stext_offset = ABSOLUTE(stext - _text);
 
 /*
  * The EFI stub has its own symbol namespace prefixed by __efistub_, to
diff --git a/arch/arm64/kernel/irq.c b/arch/arm64/kernel/irq.c
index c70034fbd4ce..04a327ccf84d 100644
--- a/arch/arm64/kernel/irq.c
+++ b/arch/arm64/kernel/irq.c
@@ -16,8 +16,10 @@
 #include <linux/smp.h>
 #include <linux/init.h>
 #include <linux/irqchip.h>
+#include <linux/kprobes.h>
 #include <linux/seq_file.h>
 #include <linux/vmalloc.h>
+#include <asm/daifflags.h>
 #include <asm/vmap_stack.h>
 
 unsigned long irq_err_count;
@@ -64,4 +66,28 @@ void __init init_IRQ(void)
         irqchip_init();
         if (!handle_arch_irq)
                 panic("No interrupt controller found.");
+
+        if (system_uses_irq_prio_masking()) {
+                /*
+                 * Now that we have a stack for our IRQ handler, set
+                 * the PMR/PSR pair to a consistent state.
+                 */
+                WARN_ON(read_sysreg(daif) & PSR_A_BIT);
+                local_daif_restore(DAIF_PROCCTX_NOIRQ);
+        }
+}
+
+/*
+ * Stubs to make nmi_enter/exit() code callable from ASM
+ */
+asmlinkage void notrace asm_nmi_enter(void)
+{
+        nmi_enter();
+}
+NOKPROBE_SYMBOL(asm_nmi_enter);
+
+asmlinkage void notrace asm_nmi_exit(void)
+{
+        nmi_exit();
 }
+NOKPROBE_SYMBOL(asm_nmi_exit);
diff --git a/arch/arm64/kernel/module.c b/arch/arm64/kernel/module.c
index e23a68a5808f..46e643e30708 100644
--- a/arch/arm64/kernel/module.c
+++ b/arch/arm64/kernel/module.c
@@ -21,6 +21,7 @@
 
 void *module_alloc(unsigned long size)
 {
+        u64 module_alloc_end = module_alloc_base + MODULES_VSIZE;
         gfp_t gfp_mask = GFP_KERNEL;
         void *p;
 
@@ -28,9 +29,12 @@ void *module_alloc(unsigned long size)
         if (IS_ENABLED(CONFIG_ARM64_MODULE_PLTS))
                 gfp_mask |= __GFP_NOWARN;
 
+        if (IS_ENABLED(CONFIG_KASAN))
+                /* don't exceed the static module region - see below */
+                module_alloc_end = MODULES_END;
+
         p = __vmalloc_node_range(size, MODULE_ALIGN, module_alloc_base,
-                                module_alloc_base + MODULES_VSIZE,
-                                gfp_mask, PAGE_KERNEL_EXEC, 0,
+                                module_alloc_end, gfp_mask, PAGE_KERNEL, 0,
                                 NUMA_NO_NODE, __builtin_return_address(0));
 
         if (!p && IS_ENABLED(CONFIG_ARM64_MODULE_PLTS) &&
@@ -46,7 +50,7 @@ void *module_alloc(unsigned long size)
                  */
                 p = __vmalloc_node_range(size, MODULE_ALIGN, module_alloc_base,
                                 module_alloc_base + SZ_2G, GFP_KERNEL,
-                                PAGE_KERNEL_EXEC, 0, NUMA_NO_NODE,
+                                PAGE_KERNEL, 0, NUMA_NO_NODE,
                                 __builtin_return_address(0));
 
         if (p && (kasan_module_alloc(p, size) < 0)) {
diff --git a/arch/arm64/kernel/probes/kprobes.c b/arch/arm64/kernel/probes/kprobes.c
index 88ce502c8e6f..bd5dfffca272 100644
--- a/arch/arm64/kernel/probes/kprobes.c
+++ b/arch/arm64/kernel/probes/kprobes.c
@@ -122,8 +122,10 @@ void *alloc_insn_page(void)
         void *page;
 
         page = vmalloc_exec(PAGE_SIZE);
-        if (page)
+        if (page) {
                 set_memory_ro((unsigned long)page, 1);
+                set_vm_flush_reset_perms(page);
+        }
 
         return page;
 }
diff --git a/arch/arm64/kernel/process.c b/arch/arm64/kernel/process.c
index 9856395ccdb7..6a869d9f304f 100644
--- a/arch/arm64/kernel/process.c
+++ b/arch/arm64/kernel/process.c
@@ -83,7 +83,7 @@ static void __cpu_do_idle_irqprio(void)
          * be raised.
          */
         pmr = gic_read_pmr();
-        gic_write_pmr(GIC_PRIO_IRQON);
+        gic_write_pmr(GIC_PRIO_IRQON | GIC_PRIO_PSR_I_SET);
 
         __cpu_do_idle();
 
diff --git a/arch/arm64/kernel/ptrace.c b/arch/arm64/kernel/ptrace.c
index da2441d7b066..3cf3b135027e 100644
--- a/arch/arm64/kernel/ptrace.c
+++ b/arch/arm64/kernel/ptrace.c
@@ -1808,8 +1808,12 @@ static void tracehook_report_syscall(struct pt_regs *regs,
 
 int syscall_trace_enter(struct pt_regs *regs)
 {
-        if (test_thread_flag(TIF_SYSCALL_TRACE))
+        if (test_thread_flag(TIF_SYSCALL_TRACE) ||
+                test_thread_flag(TIF_SYSCALL_EMU)) {
                 tracehook_report_syscall(regs, PTRACE_SYSCALL_ENTER);
+                if (!in_syscall(regs) || test_thread_flag(TIF_SYSCALL_EMU))
+                        return -1;
+        }
 
         /* Do the secure computing after ptrace; failures should be fast. */
         if (secure_computing(NULL) == -1)
diff --git a/arch/arm64/kernel/signal32.c b/arch/arm64/kernel/signal32.c
index 331d1e5acad4..12a585386c2f 100644
--- a/arch/arm64/kernel/signal32.c
+++ b/arch/arm64/kernel/signal32.c
@@ -18,42 +18,7 @@
 #include <asm/traps.h>
 #include <linux/uaccess.h>
 #include <asm/unistd.h>
-
-struct compat_sigcontext {
-        /* We always set these two fields to 0 */
-        compat_ulong_t                  trap_no;
-        compat_ulong_t                  error_code;
-
-        compat_ulong_t                  oldmask;
-        compat_ulong_t                  arm_r0;
-        compat_ulong_t                  arm_r1;
-        compat_ulong_t                  arm_r2;
-        compat_ulong_t                  arm_r3;
-        compat_ulong_t                  arm_r4;
-        compat_ulong_t                  arm_r5;
-        compat_ulong_t                  arm_r6;
-        compat_ulong_t                  arm_r7;
-        compat_ulong_t                  arm_r8;
-        compat_ulong_t                  arm_r9;
-        compat_ulong_t                  arm_r10;
-        compat_ulong_t                  arm_fp;
-        compat_ulong_t                  arm_ip;
-        compat_ulong_t                  arm_sp;
-        compat_ulong_t                  arm_lr;
-        compat_ulong_t                  arm_pc;
-        compat_ulong_t                  arm_cpsr;
-        compat_ulong_t                  fault_address;
-};
-
-struct compat_ucontext {
-        compat_ulong_t                  uc_flags;
-        compat_uptr_t                   uc_link;
-        compat_stack_t                  uc_stack;
-        struct compat_sigcontext        uc_mcontext;
-        compat_sigset_t                 uc_sigmask;
-        int             __unused[32 - (sizeof (compat_sigset_t) / sizeof (int))];
-        compat_ulong_t  uc_regspace[128] __attribute__((__aligned__(8)));
-};
+#include <asm/vdso.h>
 
 struct compat_vfp_sigframe {
         compat_ulong_t  magic;
@@ -81,16 +46,6 @@ struct compat_aux_sigframe {
         unsigned long                   end_magic;
 } __attribute__((__aligned__(8)));
 
-struct compat_sigframe {
-        struct compat_ucontext  uc;
-        compat_ulong_t          retcode[2];
-};
-
-struct compat_rt_sigframe {
-        struct compat_siginfo info;
-        struct compat_sigframe sig;
-};
-
 #define _BLOCKABLE (~(sigmask(SIGKILL) | sigmask(SIGSTOP)))
 
 static inline int put_sigset_t(compat_sigset_t __user *uset, sigset_t *set)
@@ -387,6 +342,30 @@ static void compat_setup_return(struct pt_regs *regs, struct k_sigaction *ka,
                 retcode = ptr_to_compat(ka->sa.sa_restorer);
         } else {
                 /* Set up sigreturn pointer */
+#ifdef CONFIG_COMPAT_VDSO
+                void *vdso_base = current->mm->context.vdso;
+                void *vdso_trampoline;
+
+                if (ka->sa.sa_flags & SA_SIGINFO) {
+                        if (thumb) {
+                                vdso_trampoline = VDSO_SYMBOL(vdso_base,
+                                                        compat_rt_sigreturn_thumb);
+                        } else {
+                                vdso_trampoline = VDSO_SYMBOL(vdso_base,
+                                                        compat_rt_sigreturn_arm);
+                        }
+                } else {
+                        if (thumb) {
+                                vdso_trampoline = VDSO_SYMBOL(vdso_base,
+                                                        compat_sigreturn_thumb);
+                        } else {
+                                vdso_trampoline = VDSO_SYMBOL(vdso_base,
+                                                        compat_sigreturn_arm);
+                        }
+                }
+
+                retcode = ptr_to_compat(vdso_trampoline) + thumb;
+#else
                 unsigned int idx = thumb << 1;
 
                 if (ka->sa.sa_flags & SA_SIGINFO)
@@ -394,6 +373,7 @@ static void compat_setup_return(struct pt_regs *regs, struct k_sigaction *ka,
 
                 retcode = (unsigned long)current->mm->context.vdso +
                           (idx << 2) + thumb;
+#endif
         }
 
         regs->regs[0]   = usig;
diff --git a/arch/arm64/kernel/sleep.S b/arch/arm64/kernel/sleep.S
index 3e53ffa07994..f5b04dd8a710 100644
--- a/arch/arm64/kernel/sleep.S
+++ b/arch/arm64/kernel/sleep.S
@@ -27,7 +27,7 @@
  *      aff0 = mpidr_masked & 0xff;
  *      aff1 = mpidr_masked & 0xff00;
  *      aff2 = mpidr_masked & 0xff0000;
- *      aff2 = mpidr_masked & 0xff00000000;
+ *      aff3 = mpidr_masked & 0xff00000000;
  *      dst = (aff0 >> rs0 | aff1 >> rs1 | aff2 >> rs2 | aff3 >> rs3);
  *}
  * Input registers: rs0, rs1, rs2, rs3, mpidr, mask
diff --git a/arch/arm64/kernel/smp.c b/arch/arm64/kernel/smp.c
index 6dcf9607d770..9286ee6749e8 100644
--- a/arch/arm64/kernel/smp.c
+++ b/arch/arm64/kernel/smp.c
@@ -181,11 +181,7 @@ static void init_gic_priority_masking(void)
 
         WARN_ON(!(cpuflags & PSR_I_BIT));
 
-        gic_write_pmr(GIC_PRIO_IRQOFF);
-
-        /* We can only unmask PSR.I if we can take aborts */
-        if (!(cpuflags & PSR_A_BIT))
-                write_sysreg(cpuflags & ~PSR_I_BIT, daif);
+        gic_write_pmr(GIC_PRIO_IRQON | GIC_PRIO_PSR_I_SET);
 }
 
 /*
@@ -834,18 +830,23 @@ void arch_irq_work_raise(void)
 }
 #endif
 
-/*
- * ipi_cpu_stop - handle IPI from smp_send_stop()
- */
-static void ipi_cpu_stop(unsigned int cpu)
+static void local_cpu_stop(void)
 {
-        set_cpu_online(cpu, false);
+        set_cpu_online(smp_processor_id(), false);
 
         local_daif_mask();
         sdei_mask_local_cpu();
+        cpu_park_loop();
+}
 
-        while (1)
-                cpu_relax();
+/*
+ * We need to implement panic_smp_self_stop() for parallel panic() calls, so
+ * that cpu_online_mask gets correctly updated and smp_send_stop() can skip
+ * CPUs that have already stopped themselves.
+ */
+void panic_smp_self_stop(void)
+{
+        local_cpu_stop();
 }
 
 #ifdef CONFIG_KEXEC_CORE
@@ -898,7 +899,7 @@ void handle_IPI(int ipinr, struct pt_regs *regs)
 
         case IPI_CPU_STOP:
                 irq_enter();
-                ipi_cpu_stop(cpu);
+                local_cpu_stop();
                 irq_exit();
                 break;
 
diff --git a/arch/arm64/kernel/traps.c b/arch/arm64/kernel/traps.c
index 985721a1264c..a835a1a53826 100644
--- a/arch/arm64/kernel/traps.c
+++ b/arch/arm64/kernel/traps.c
@@ -55,16 +55,19 @@ static void dump_backtrace_entry(unsigned long where)
         printk(" %pS\n", (void *)where);
 }
 
-static void __dump_instr(const char *lvl, struct pt_regs *regs)
+static void dump_kernel_instr(const char *lvl, struct pt_regs *regs)
 {
         unsigned long addr = instruction_pointer(regs);
         char str[sizeof("00000000 ") * 5 + 2 + 1], *p = str;
         int i;
 
+        if (user_mode(regs))
+                return;
+
         for (i = -4; i < 1; i++) {
                 unsigned int val, bad;
 
-                bad = get_user(val, &((u32 *)addr)[i]);
+                bad = aarch64_insn_read(&((u32 *)addr)[i], &val);
 
                 if (!bad)
                         p += sprintf(p, i == 0 ? "(%08x) " : "%08x ", val);
@@ -73,19 +76,8 @@ static void __dump_instr(const char *lvl, struct pt_regs *regs)
                         break;
                 }
         }
-        printk("%sCode: %s\n", lvl, str);
-}
 
-static void dump_instr(const char *lvl, struct pt_regs *regs)
-{
-        if (!user_mode(regs)) {
-                mm_segment_t fs = get_fs();
-                set_fs(KERNEL_DS);
-                __dump_instr(lvl, regs);
-                set_fs(fs);
-        } else {
-                __dump_instr(lvl, regs);
-        }
+        printk("%sCode: %s\n", lvl, str);
 }
 
 void dump_backtrace(struct pt_regs *regs, struct task_struct *tsk)
@@ -171,8 +163,7 @@ static int __die(const char *str, int err, struct pt_regs *regs)
         print_modules();
         show_regs(regs);
 
-        if (!user_mode(regs))
-                dump_instr(KERN_EMERG, regs);
+        dump_kernel_instr(KERN_EMERG, regs);
 
         return ret;
 }
diff --git a/arch/arm64/kernel/vdso.c b/arch/arm64/kernel/vdso.c
index 663b166241d0..354b11e27c07 100644
--- a/arch/arm64/kernel/vdso.c
+++ b/arch/arm64/kernel/vdso.c
@@ -20,41 +20,212 @@
 #include <linux/slab.h>
 #include <linux/timekeeper_internal.h>
 #include <linux/vmalloc.h>
+#include <vdso/datapage.h>
+#include <vdso/helpers.h>
+#include <vdso/vsyscall.h>
 
 #include <asm/cacheflush.h>
 #include <asm/signal32.h>
 #include <asm/vdso.h>
-#include <asm/vdso_datapage.h>
 
 extern char vdso_start[], vdso_end[];
-static unsigned long vdso_pages __ro_after_init;
+#ifdef CONFIG_COMPAT_VDSO
+extern char vdso32_start[], vdso32_end[];
+#endif /* CONFIG_COMPAT_VDSO */
+
+/* vdso_lookup arch_index */
+enum arch_vdso_type {
+        ARM64_VDSO = 0,
+#ifdef CONFIG_COMPAT_VDSO
+        ARM64_VDSO32 = 1,
+#endif /* CONFIG_COMPAT_VDSO */
+};
+#ifdef CONFIG_COMPAT_VDSO
+#define VDSO_TYPES              (ARM64_VDSO32 + 1)
+#else
+#define VDSO_TYPES              (ARM64_VDSO + 1)
+#endif /* CONFIG_COMPAT_VDSO */
+
+struct __vdso_abi {
+        const char *name;
+        const char *vdso_code_start;
+        const char *vdso_code_end;
+        unsigned long vdso_pages;
+        /* Data Mapping */
+        struct vm_special_mapping *dm;
+        /* Code Mapping */
+        struct vm_special_mapping *cm;
+};
+
+static struct __vdso_abi vdso_lookup[VDSO_TYPES] __ro_after_init = {
+        {
+                .name = "vdso",
+                .vdso_code_start = vdso_start,
+                .vdso_code_end = vdso_end,
+        },
+#ifdef CONFIG_COMPAT_VDSO
+        {
+                .name = "vdso32",
+                .vdso_code_start = vdso32_start,
+                .vdso_code_end = vdso32_end,
+        },
+#endif /* CONFIG_COMPAT_VDSO */
+};
 
 /*
  * The vDSO data page.
  */
 static union {
-        struct vdso_data        data;
+        struct vdso_data        data[CS_BASES];
         u8                      page[PAGE_SIZE];
 } vdso_data_store __page_aligned_data;
-struct vdso_data *vdso_data = &vdso_data_store.data;
+struct vdso_data *vdso_data = vdso_data_store.data;
+
+static int __vdso_remap(enum arch_vdso_type arch_index,
+                        const struct vm_special_mapping *sm,
+                        struct vm_area_struct *new_vma)
+{
+        unsigned long new_size = new_vma->vm_end - new_vma->vm_start;
+        unsigned long vdso_size = vdso_lookup[arch_index].vdso_code_end -
+                                  vdso_lookup[arch_index].vdso_code_start;
+
+        if (vdso_size != new_size)
+                return -EINVAL;
+
+        current->mm->context.vdso = (void *)new_vma->vm_start;
+
+        return 0;
+}
+
+static int __vdso_init(enum arch_vdso_type arch_index)
+{
+        int i;
+        struct page **vdso_pagelist;
+        unsigned long pfn;
+
+        if (memcmp(vdso_lookup[arch_index].vdso_code_start, "\177ELF", 4)) {
+                pr_err("vDSO is not a valid ELF object!\n");
+                return -EINVAL;
+        }
+
+        vdso_lookup[arch_index].vdso_pages = (
+                        vdso_lookup[arch_index].vdso_code_end -
+                        vdso_lookup[arch_index].vdso_code_start) >>
+                        PAGE_SHIFT;
+
+        /* Allocate the vDSO pagelist, plus a page for the data. */
+        vdso_pagelist = kcalloc(vdso_lookup[arch_index].vdso_pages + 1,
+                                sizeof(struct page *),
+                                GFP_KERNEL);
+        if (vdso_pagelist == NULL)
+                return -ENOMEM;
+
+        /* Grab the vDSO data page. */
+        vdso_pagelist[0] = phys_to_page(__pa_symbol(vdso_data));
+
+
+        /* Grab the vDSO code pages. */
+        pfn = sym_to_pfn(vdso_lookup[arch_index].vdso_code_start);
+
+        for (i = 0; i < vdso_lookup[arch_index].vdso_pages; i++)
+                vdso_pagelist[i + 1] = pfn_to_page(pfn + i);
+
+        vdso_lookup[arch_index].dm->pages = &vdso_pagelist[0];
+        vdso_lookup[arch_index].cm->pages = &vdso_pagelist[1];
+
+        return 0;
+}
+
+static int __setup_additional_pages(enum arch_vdso_type arch_index,
+                                    struct mm_struct *mm,
+                                    struct linux_binprm *bprm,
+                                    int uses_interp)
+{
+        unsigned long vdso_base, vdso_text_len, vdso_mapping_len;
+        void *ret;
+
+        vdso_text_len = vdso_lookup[arch_index].vdso_pages << PAGE_SHIFT;
+        /* Be sure to map the data page */
+        vdso_mapping_len = vdso_text_len + PAGE_SIZE;
+
+        vdso_base = get_unmapped_area(NULL, 0, vdso_mapping_len, 0, 0);
+        if (IS_ERR_VALUE(vdso_base)) {
+                ret = ERR_PTR(vdso_base);
+                goto up_fail;
+        }
+
+        ret = _install_special_mapping(mm, vdso_base, PAGE_SIZE,
+                                       VM_READ|VM_MAYREAD,
+                                       vdso_lookup[arch_index].dm);
+        if (IS_ERR(ret))
+                goto up_fail;
+
+        vdso_base += PAGE_SIZE;
+        mm->context.vdso = (void *)vdso_base;
+        ret = _install_special_mapping(mm, vdso_base, vdso_text_len,
+                                       VM_READ|VM_EXEC|
+                                       VM_MAYREAD|VM_MAYWRITE|VM_MAYEXEC,
+                                       vdso_lookup[arch_index].cm);
+        if (IS_ERR(ret))
+                goto up_fail;
+
+        return 0;
+
+up_fail:
+        mm->context.vdso = NULL;
+        return PTR_ERR(ret);
+}
 
 #ifdef CONFIG_COMPAT
 /*
  * Create and map the vectors page for AArch32 tasks.
  */
+#ifdef CONFIG_COMPAT_VDSO
+static int aarch32_vdso_mremap(const struct vm_special_mapping *sm,
+                struct vm_area_struct *new_vma)
+{
+        return __vdso_remap(ARM64_VDSO32, sm, new_vma);
+}
+#endif /* CONFIG_COMPAT_VDSO */
+
+/*
+ * aarch32_vdso_pages:
+ * 0 - kuser helpers
+ * 1 - sigreturn code
+ * or (CONFIG_COMPAT_VDSO):
+ * 0 - kuser helpers
+ * 1 - vdso data
+ * 2 - vdso code
+ */
 #define C_VECTORS       0
+#ifdef CONFIG_COMPAT_VDSO
+#define C_VVAR          1
+#define C_VDSO          2
+#define C_PAGES         (C_VDSO + 1)
+#else
 #define C_SIGPAGE       1
 #define C_PAGES         (C_SIGPAGE + 1)
+#endif /* CONFIG_COMPAT_VDSO */
 static struct page *aarch32_vdso_pages[C_PAGES] __ro_after_init;
-static const struct vm_special_mapping aarch32_vdso_spec[C_PAGES] = {
+static struct vm_special_mapping aarch32_vdso_spec[C_PAGES] = {
         {
                 .name   = "[vectors]", /* ABI */
                 .pages  = &aarch32_vdso_pages[C_VECTORS],
         },
+#ifdef CONFIG_COMPAT_VDSO
+        {
+                .name = "[vvar]",
+        },
+        {
+                .name = "[vdso]",
+                .mremap = aarch32_vdso_mremap,
+        },
+#else
         {
                 .name   = "[sigpage]", /* ABI */
                 .pages  = &aarch32_vdso_pages[C_SIGPAGE],
         },
+#endif /* CONFIG_COMPAT_VDSO */
 };
 
 static int aarch32_alloc_kuser_vdso_page(void)
@@ -77,7 +248,33 @@ static int aarch32_alloc_kuser_vdso_page(void)
         return 0;
 }
 
-static int __init aarch32_alloc_vdso_pages(void)
+#ifdef CONFIG_COMPAT_VDSO
+static int __aarch32_alloc_vdso_pages(void)
+{
+        int ret;
+
+        vdso_lookup[ARM64_VDSO32].dm = &aarch32_vdso_spec[C_VVAR];
+        vdso_lookup[ARM64_VDSO32].cm = &aarch32_vdso_spec[C_VDSO];
+
+        ret = __vdso_init(ARM64_VDSO32);
+        if (ret)
+                return ret;
+
+        ret = aarch32_alloc_kuser_vdso_page();
+        if (ret) {
+                unsigned long c_vvar =
+                        (unsigned long)page_to_virt(aarch32_vdso_pages[C_VVAR]);
+                unsigned long c_vdso =
+                        (unsigned long)page_to_virt(aarch32_vdso_pages[C_VDSO]);
+
+                free_page(c_vvar);
+                free_page(c_vdso);
+        }
+
+        return ret;
+}
+#else
+static int __aarch32_alloc_vdso_pages(void)
 {
         extern char __aarch32_sigret_code_start[], __aarch32_sigret_code_end[];
         int sigret_sz = __aarch32_sigret_code_end - __aarch32_sigret_code_start;
@@ -98,6 +295,12 @@ static int __init aarch32_alloc_vdso_pages(void)
 
         return ret;
 }
+#endif /* CONFIG_COMPAT_VDSO */
+
+static int __init aarch32_alloc_vdso_pages(void)
+{
+        return __aarch32_alloc_vdso_pages();
+}
 arch_initcall(aarch32_alloc_vdso_pages);
 
 static int aarch32_kuser_helpers_setup(struct mm_struct *mm)
@@ -119,6 +322,7 @@ static int aarch32_kuser_helpers_setup(struct mm_struct *mm)
         return PTR_ERR_OR_ZERO(ret);
 }
 
+#ifndef CONFIG_COMPAT_VDSO
 static int aarch32_sigreturn_setup(struct mm_struct *mm)
 {
         unsigned long addr;
@@ -146,6 +350,7 @@ static int aarch32_sigreturn_setup(struct mm_struct *mm)
 out:
         return PTR_ERR_OR_ZERO(ret);
 }
+#endif /* !CONFIG_COMPAT_VDSO */
 
 int aarch32_setup_additional_pages(struct linux_binprm *bprm, int uses_interp)
 {
@@ -159,7 +364,14 @@ int aarch32_setup_additional_pages(struct linux_binprm *bprm, int uses_interp)
         if (ret)
                 goto out;
 
+#ifdef CONFIG_COMPAT_VDSO
+        ret = __setup_additional_pages(ARM64_VDSO32,
+                                       mm,
+                                       bprm,
+                                       uses_interp);
+#else
         ret = aarch32_sigreturn_setup(mm);
+#endif /* CONFIG_COMPAT_VDSO */
 
 out:
         up_write(&mm->mmap_sem);
@@ -170,18 +382,18 @@ out:
 static int vdso_mremap(const struct vm_special_mapping *sm,
                 struct vm_area_struct *new_vma)
 {
-        unsigned long new_size = new_vma->vm_end - new_vma->vm_start;
-        unsigned long vdso_size = vdso_end - vdso_start;
-
-        if (vdso_size != new_size)
-                return -EINVAL;
-
-        current->mm->context.vdso = (void *)new_vma->vm_start;
-
-        return 0;
+        return __vdso_remap(ARM64_VDSO, sm, new_vma);
 }
 
-static struct vm_special_mapping vdso_spec[2] __ro_after_init = {
+/*
+ * aarch64_vdso_pages:
+ * 0 - vvar
+ * 1 - vdso
+ */
+#define A_VVAR          0
+#define A_VDSO          1
+#define A_PAGES         (A_VDSO + 1)
+static struct vm_special_mapping vdso_spec[A_PAGES] __ro_after_init = {
         {
                 .name   = "[vvar]",
         },
@@ -193,37 +405,10 @@ static struct vm_special_mapping vdso_spec[2] __ro_after_init = {
 
 static int __init vdso_init(void)
 {
-        int i;
-        struct page **vdso_pagelist;
-        unsigned long pfn;
-
-        if (memcmp(vdso_start, "\177ELF", 4)) {
-                pr_err("vDSO is not a valid ELF object!\n");
-                return -EINVAL;
-        }
-
-        vdso_pages = (vdso_end - vdso_start) >> PAGE_SHIFT;
-
-        /* Allocate the vDSO pagelist, plus a page for the data. */
-        vdso_pagelist = kcalloc(vdso_pages + 1, sizeof(struct page *),
-                                GFP_KERNEL);
-        if (vdso_pagelist == NULL)
-                return -ENOMEM;
-
-        /* Grab the vDSO data page. */
-        vdso_pagelist[0] = phys_to_page(__pa_symbol(vdso_data));
-
-
-        /* Grab the vDSO code pages. */
-        pfn = sym_to_pfn(vdso_start);
-
-        for (i = 0; i < vdso_pages; i++)
-                vdso_pagelist[i + 1] = pfn_to_page(pfn + i);
+        vdso_lookup[ARM64_VDSO].dm = &vdso_spec[A_VVAR];
+        vdso_lookup[ARM64_VDSO].cm = &vdso_spec[A_VDSO];
 
-        vdso_spec[0].pages = &vdso_pagelist[0];
-        vdso_spec[1].pages = &vdso_pagelist[1];
-
-        return 0;
+        return __vdso_init(ARM64_VDSO);
 }
 arch_initcall(vdso_init);
 
@@ -231,84 +416,17 @@ int arch_setup_additional_pages(struct linux_binprm *bprm,
                                 int uses_interp)
 {
         struct mm_struct *mm = current->mm;
-        unsigned long vdso_base, vdso_text_len, vdso_mapping_len;
-        void *ret;
-
-        vdso_text_len = vdso_pages << PAGE_SHIFT;
-        /* Be sure to map the data page */
-        vdso_mapping_len = vdso_text_len + PAGE_SIZE;
+        int ret;
 
         if (down_write_killable(&mm->mmap_sem))
                 return -EINTR;
-        vdso_base = get_unmapped_area(NULL, 0, vdso_mapping_len, 0, 0);
-        if (IS_ERR_VALUE(vdso_base)) {
-                ret = ERR_PTR(vdso_base);
-                goto up_fail;
-        }
-        ret = _install_special_mapping(mm, vdso_base, PAGE_SIZE,
-                                       VM_READ|VM_MAYREAD,
-                                       &vdso_spec[0]);
-        if (IS_ERR(ret))
-                goto up_fail;
-
-        vdso_base += PAGE_SIZE;
-        mm->context.vdso = (void *)vdso_base;
-        ret = _install_special_mapping(mm, vdso_base, vdso_text_len,
-                                       VM_READ|VM_EXEC|
-                                       VM_MAYREAD|VM_MAYWRITE|VM_MAYEXEC,
-                                       &vdso_spec[1]);
-        if (IS_ERR(ret))
-                goto up_fail;
 
+        ret = __setup_additional_pages(ARM64_VDSO,
+                                       mm,
+                                       bprm,
+                                       uses_interp);
 
         up_write(&mm->mmap_sem);
-        return 0;
-
-up_fail:
-        mm->context.vdso = NULL;
-        up_write(&mm->mmap_sem);
-        return PTR_ERR(ret);
-}
 
-/*
- * Update the vDSO data page to keep in sync with kernel timekeeping.
- */
-void update_vsyscall(struct timekeeper *tk)
-{
-        u32 use_syscall = !tk->tkr_mono.clock->archdata.vdso_direct;
-
-        ++vdso_data->tb_seq_count;
-        smp_wmb();
-
-        vdso_data->use_syscall                  = use_syscall;
-        vdso_data->xtime_coarse_sec             = tk->xtime_sec;
-        vdso_data->xtime_coarse_nsec            = tk->tkr_mono.xtime_nsec >>
-                                                        tk->tkr_mono.shift;
-        vdso_data->wtm_clock_sec                = tk->wall_to_monotonic.tv_sec;
-        vdso_data->wtm_clock_nsec               = tk->wall_to_monotonic.tv_nsec;
-
-        /* Read without the seqlock held by clock_getres() */
-        WRITE_ONCE(vdso_data->hrtimer_res, hrtimer_resolution);
-
-        if (!use_syscall) {
-                /* tkr_mono.cycle_last == tkr_raw.cycle_last */
-                vdso_data->cs_cycle_last        = tk->tkr_mono.cycle_last;
-                vdso_data->raw_time_sec         = tk->raw_sec;
-                vdso_data->raw_time_nsec        = tk->tkr_raw.xtime_nsec;
-                vdso_data->xtime_clock_sec      = tk->xtime_sec;
-                vdso_data->xtime_clock_nsec     = tk->tkr_mono.xtime_nsec;
-                vdso_data->cs_mono_mult         = tk->tkr_mono.mult;
-                vdso_data->cs_raw_mult          = tk->tkr_raw.mult;
-                /* tkr_mono.shift == tkr_raw.shift */
-                vdso_data->cs_shift             = tk->tkr_mono.shift;
-        }
-
-        smp_wmb();
-        ++vdso_data->tb_seq_count;
-}
-
-void update_vsyscall_tz(void)
-{
-        vdso_data->tz_minuteswest       = sys_tz.tz_minuteswest;
-        vdso_data->tz_dsttime           = sys_tz.tz_dsttime;
+        return ret;
 }
diff --git a/arch/arm64/kernel/vdso/Makefile b/arch/arm64/kernel/vdso/Makefile
index fa230ff09aa1..4ab863045188 100644
--- a/arch/arm64/kernel/vdso/Makefile
+++ b/arch/arm64/kernel/vdso/Makefile
@@ -6,7 +6,12 @@
 # Heavily based on the vDSO Makefiles for other archs.
 #
 
-obj-vdso := gettimeofday.o note.o sigreturn.o
+# Absolute relocation type $(ARCH_REL_TYPE_ABS) needs to be defined before
+# the inclusion of generic Makefile.
+ARCH_REL_TYPE_ABS := R_AARCH64_JUMP_SLOT|R_AARCH64_GLOB_DAT|R_AARCH64_ABS64
+include $(srctree)/lib/vdso/Makefile
+
+obj-vdso := vgettimeofday.o note.o sigreturn.o
 
 # Build rules
 targets := $(obj-vdso) vdso.so vdso.so.dbg
@@ -15,6 +20,31 @@ obj-vdso := $(addprefix $(obj)/, $(obj-vdso))
 ldflags-y := -shared -nostdlib -soname=linux-vdso.so.1 --hash-style=sysv \
                 --build-id -n -T
 
+ccflags-y := -fno-common -fno-builtin -fno-stack-protector -ffixed-x18
+ccflags-y += -DDISABLE_BRANCH_PROFILING
+
+VDSO_LDFLAGS := -Bsymbolic
+
+CFLAGS_REMOVE_vgettimeofday.o = $(CC_FLAGS_FTRACE) -Os
+KBUILD_CFLAGS                   += $(DISABLE_LTO)
+KASAN_SANITIZE                  := n
+UBSAN_SANITIZE                  := n
+OBJECT_FILES_NON_STANDARD       := y
+KCOV_INSTRUMENT                 := n
+
+ifeq ($(c-gettimeofday-y),)
+CFLAGS_vgettimeofday.o = -O2 -mcmodel=tiny
+else
+CFLAGS_vgettimeofday.o = -O2 -mcmodel=tiny -include $(c-gettimeofday-y)
+endif
+
+# Clang versions less than 8 do not support -mcmodel=tiny
+ifeq ($(CONFIG_CC_IS_CLANG), y)
+  ifeq ($(shell test $(CONFIG_CLANG_VERSION) -lt 80000; echo $$?),0)
+    CFLAGS_REMOVE_vgettimeofday.o += -mcmodel=tiny
+  endif
+endif
+
 # Disable gcov profiling for VDSO code
 GCOV_PROFILE := n
 
@@ -28,6 +58,7 @@ $(obj)/vdso.o : $(obj)/vdso.so
 # Link rule for the .so file, .lds has to be first
 $(obj)/vdso.so.dbg: $(obj)/vdso.lds $(obj-vdso) FORCE
         $(call if_changed,ld)
+        $(call if_changed,vdso_check)
 
 # Strip rule for the .so file
 $(obj)/%.so: OBJCOPYFLAGS := -S
@@ -42,13 +73,9 @@ quiet_cmd_vdsosym = VDSOSYM $@
 include/generated/vdso-offsets.h: $(obj)/vdso.so.dbg FORCE
         $(call if_changed,vdsosym)
 
-# Assembly rules for the .S files
-$(obj-vdso): %.o: %.S FORCE
-        $(call if_changed_dep,vdsoas)
-
 # Actual build commands
-quiet_cmd_vdsoas = VDSOA   $@
-      cmd_vdsoas = $(CC) $(a_flags) -c -o $@ $<
+quiet_cmd_vdsocc = VDSOCC   $@
+      cmd_vdsocc = $(CC) $(a_flags) $(c_flags) -c -o $@ $<
 
 # Install commands for the unstripped file
 quiet_cmd_vdso_install = INSTALL $@
diff --git a/arch/arm64/kernel/vdso/gettimeofday.S b/arch/arm64/kernel/vdso/gettimeofday.S
index 80f780f56e0d..e69de29bb2d1 100644
--- a/arch/arm64/kernel/vdso/gettimeofday.S
+++ b/arch/arm64/kernel/vdso/gettimeofday.S
@@ -1,323 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0-only */
-/*
- * Userspace implementations of gettimeofday() and friends.
- *
- * Copyright (C) 2012 ARM Limited
- *
- * Author: Will Deacon <will.deacon@arm.com>
- */
-
-#include <linux/linkage.h>
-#include <asm/asm-offsets.h>
-#include <asm/unistd.h>
-
-#define NSEC_PER_SEC_LO16       0xca00
-#define NSEC_PER_SEC_HI16       0x3b9a
-
-vdso_data       .req    x6
-seqcnt          .req    w7
-w_tmp           .req    w8
-x_tmp           .req    x8
-
-/*
- * Conventions for macro arguments:
- * - An argument is write-only if its name starts with "res".
- * - All other arguments are read-only, unless otherwise specified.
- */
-
-        .macro  seqcnt_acquire
-9999:   ldr     seqcnt, [vdso_data, #VDSO_TB_SEQ_COUNT]
-        tbnz    seqcnt, #0, 9999b
-        dmb     ishld
-        .endm
-
-        .macro  seqcnt_check fail
-        dmb     ishld
-        ldr     w_tmp, [vdso_data, #VDSO_TB_SEQ_COUNT]
-        cmp     w_tmp, seqcnt
-        b.ne    \fail
-        .endm
-
-        .macro  syscall_check fail
-        ldr     w_tmp, [vdso_data, #VDSO_USE_SYSCALL]
-        cbnz    w_tmp, \fail
-        .endm
-
-        .macro get_nsec_per_sec res
-        mov     \res, #NSEC_PER_SEC_LO16
-        movk    \res, #NSEC_PER_SEC_HI16, lsl #16
-        .endm
-
-        /*
-         * Returns the clock delta, in nanoseconds left-shifted by the clock
-         * shift.
-         */
-        .macro  get_clock_shifted_nsec res, cycle_last, mult
-        /* Read the virtual counter. */
-        isb
-        mrs     x_tmp, cntvct_el0
-        /* Calculate cycle delta and convert to ns. */
-        sub     \res, x_tmp, \cycle_last
-        /* We can only guarantee 56 bits of precision. */
-        movn    x_tmp, #0xff00, lsl #48
-        and     \res, x_tmp, \res
-        mul     \res, \res, \mult
-        /*
-         * Fake address dependency from the value computed from the counter
-         * register to subsequent data page accesses so that the sequence
-         * locking also orders the read of the counter.
-         */
-        and     x_tmp, \res, xzr
-        add     vdso_data, vdso_data, x_tmp
-        .endm
-
-        /*
-         * Returns in res_{sec,nsec} the REALTIME timespec, based on the
-         * "wall time" (xtime) and the clock_mono delta.
-         */
-        .macro  get_ts_realtime res_sec, res_nsec, \
-                        clock_nsec, xtime_sec, xtime_nsec, nsec_to_sec
-        add     \res_nsec, \clock_nsec, \xtime_nsec
-        udiv    x_tmp, \res_nsec, \nsec_to_sec
-        add     \res_sec, \xtime_sec, x_tmp
-        msub    \res_nsec, x_tmp, \nsec_to_sec, \res_nsec
-        .endm
-
-        /*
-         * Returns in res_{sec,nsec} the timespec based on the clock_raw delta,
-         * used for CLOCK_MONOTONIC_RAW.
-         */
-        .macro  get_ts_clock_raw res_sec, res_nsec, clock_nsec, nsec_to_sec
-        udiv    \res_sec, \clock_nsec, \nsec_to_sec
-        msub    \res_nsec, \res_sec, \nsec_to_sec, \clock_nsec
-        .endm
-
-        /* sec and nsec are modified in place. */
-        .macro add_ts sec, nsec, ts_sec, ts_nsec, nsec_to_sec
-        /* Add timespec. */
-        add     \sec, \sec, \ts_sec
-        add     \nsec, \nsec, \ts_nsec
-
-        /* Normalise the new timespec. */
-        cmp     \nsec, \nsec_to_sec
-        b.lt    9999f
-        sub     \nsec, \nsec, \nsec_to_sec
-        add     \sec, \sec, #1
-9999:
-        cmp     \nsec, #0
-        b.ge    9998f
-        add     \nsec, \nsec, \nsec_to_sec
-        sub     \sec, \sec, #1
-9998:
-        .endm
-
-        .macro clock_gettime_return, shift=0
-        .if \shift == 1
-        lsr     x11, x11, x12
-        .endif
-        stp     x10, x11, [x1, #TSPEC_TV_SEC]
-        mov     x0, xzr
-        ret
-        .endm
-
-        .macro jump_slot jumptable, index, label
-        .if (. - \jumptable) != 4 * (\index)
-        .error "Jump slot index mismatch"
-        .endif
-        b       \label
-        .endm
-
-        .text
-
-/* int __kernel_gettimeofday(struct timeval *tv, struct timezone *tz); */
-ENTRY(__kernel_gettimeofday)
-        .cfi_startproc
-        adr     vdso_data, _vdso_data
-        /* If tv is NULL, skip to the timezone code. */
-        cbz     x0, 2f
-
-        /* Compute the time of day. */
-1:      seqcnt_acquire
-        syscall_check fail=4f
-        ldr     x10, [vdso_data, #VDSO_CS_CYCLE_LAST]
-        /* w11 = cs_mono_mult, w12 = cs_shift */
-        ldp     w11, w12, [vdso_data, #VDSO_CS_MONO_MULT]
-        ldp     x13, x14, [vdso_data, #VDSO_XTIME_CLK_SEC]
-
-        get_nsec_per_sec res=x9
-        lsl     x9, x9, x12
-
-        get_clock_shifted_nsec res=x15, cycle_last=x10, mult=x11
-        seqcnt_check fail=1b
-        get_ts_realtime res_sec=x10, res_nsec=x11, \
-                clock_nsec=x15, xtime_sec=x13, xtime_nsec=x14, nsec_to_sec=x9
-
-        /* Convert ns to us. */
-        mov     x13, #1000
-        lsl     x13, x13, x12
-        udiv    x11, x11, x13
-        stp     x10, x11, [x0, #TVAL_TV_SEC]
-2:
-        /* If tz is NULL, return 0. */
-        cbz     x1, 3f
-        ldp     w4, w5, [vdso_data, #VDSO_TZ_MINWEST]
-        stp     w4, w5, [x1, #TZ_MINWEST]
-3:
-        mov     x0, xzr
-        ret
-4:
-        /* Syscall fallback. */
-        mov     x8, #__NR_gettimeofday
-        svc     #0
-        ret
-        .cfi_endproc
-ENDPROC(__kernel_gettimeofday)
-
-#define JUMPSLOT_MAX CLOCK_MONOTONIC_COARSE
-
-/* int __kernel_clock_gettime(clockid_t clock_id, struct timespec *tp); */
-ENTRY(__kernel_clock_gettime)
-        .cfi_startproc
-        cmp     w0, #JUMPSLOT_MAX
-        b.hi    syscall
-        adr     vdso_data, _vdso_data
-        adr     x_tmp, jumptable
-        add     x_tmp, x_tmp, w0, uxtw #2
-        br      x_tmp
-
-        ALIGN
-jumptable:
-        jump_slot jumptable, CLOCK_REALTIME, realtime
-        jump_slot jumptable, CLOCK_MONOTONIC, monotonic
-        b       syscall
-        b       syscall
-        jump_slot jumptable, CLOCK_MONOTONIC_RAW, monotonic_raw
-        jump_slot jumptable, CLOCK_REALTIME_COARSE, realtime_coarse
-        jump_slot jumptable, CLOCK_MONOTONIC_COARSE, monotonic_coarse
-
-        .if (. - jumptable) != 4 * (JUMPSLOT_MAX + 1)
-        .error  "Wrong jumptable size"
-        .endif
-
-        ALIGN
-realtime:
-        seqcnt_acquire
-        syscall_check fail=syscall
-        ldr     x10, [vdso_data, #VDSO_CS_CYCLE_LAST]
-        /* w11 = cs_mono_mult, w12 = cs_shift */
-        ldp     w11, w12, [vdso_data, #VDSO_CS_MONO_MULT]
-        ldp     x13, x14, [vdso_data, #VDSO_XTIME_CLK_SEC]
-
-        /* All computations are done with left-shifted nsecs. */
-        get_nsec_per_sec res=x9
-        lsl     x9, x9, x12
-
-        get_clock_shifted_nsec res=x15, cycle_last=x10, mult=x11
-        seqcnt_check fail=realtime
-        get_ts_realtime res_sec=x10, res_nsec=x11, \
-                clock_nsec=x15, xtime_sec=x13, xtime_nsec=x14, nsec_to_sec=x9
-        clock_gettime_return, shift=1
-
-        ALIGN
-monotonic:
-        seqcnt_acquire
-        syscall_check fail=syscall
-        ldr     x10, [vdso_data, #VDSO_CS_CYCLE_LAST]
-        /* w11 = cs_mono_mult, w12 = cs_shift */
-        ldp     w11, w12, [vdso_data, #VDSO_CS_MONO_MULT]
-        ldp     x13, x14, [vdso_data, #VDSO_XTIME_CLK_SEC]
-        ldp     x3, x4, [vdso_data, #VDSO_WTM_CLK_SEC]
-
-        /* All computations are done with left-shifted nsecs. */
-        lsl     x4, x4, x12
-        get_nsec_per_sec res=x9
-        lsl     x9, x9, x12
-
-        get_clock_shifted_nsec res=x15, cycle_last=x10, mult=x11
-        seqcnt_check fail=monotonic
-        get_ts_realtime res_sec=x10, res_nsec=x11, \
-                clock_nsec=x15, xtime_sec=x13, xtime_nsec=x14, nsec_to_sec=x9
-
-        add_ts sec=x10, nsec=x11, ts_sec=x3, ts_nsec=x4, nsec_to_sec=x9
-        clock_gettime_return, shift=1
-
-        ALIGN
-monotonic_raw:
-        seqcnt_acquire
-        syscall_check fail=syscall
-        ldr     x10, [vdso_data, #VDSO_CS_CYCLE_LAST]
-        /* w11 = cs_raw_mult, w12 = cs_shift */
-        ldp     w12, w11, [vdso_data, #VDSO_CS_SHIFT]
-        ldp     x13, x14, [vdso_data, #VDSO_RAW_TIME_SEC]
-
-        /* All computations are done with left-shifted nsecs. */
-        get_nsec_per_sec res=x9
-        lsl     x9, x9, x12
-
-        get_clock_shifted_nsec res=x15, cycle_last=x10, mult=x11
-        seqcnt_check fail=monotonic_raw
-        get_ts_clock_raw res_sec=x10, res_nsec=x11, \
-                clock_nsec=x15, nsec_to_sec=x9
-
-        add_ts sec=x10, nsec=x11, ts_sec=x13, ts_nsec=x14, nsec_to_sec=x9
-        clock_gettime_return, shift=1
-
-        ALIGN
-realtime_coarse:
-        seqcnt_acquire
-        ldp     x10, x11, [vdso_data, #VDSO_XTIME_CRS_SEC]
-        seqcnt_check fail=realtime_coarse
-        clock_gettime_return
-
-        ALIGN
-monotonic_coarse:
-        seqcnt_acquire
-        ldp     x10, x11, [vdso_data, #VDSO_XTIME_CRS_SEC]
-        ldp     x13, x14, [vdso_data, #VDSO_WTM_CLK_SEC]
-        seqcnt_check fail=monotonic_coarse
-
-        /* Computations are done in (non-shifted) nsecs. */
-        get_nsec_per_sec res=x9
-        add_ts sec=x10, nsec=x11, ts_sec=x13, ts_nsec=x14, nsec_to_sec=x9
-        clock_gettime_return
-
-        ALIGN
-syscall: /* Syscall fallback. */
-        mov     x8, #__NR_clock_gettime
-        svc     #0
-        ret
-        .cfi_endproc
-ENDPROC(__kernel_clock_gettime)
-
-/* int __kernel_clock_getres(clockid_t clock_id, struct timespec *res); */
-ENTRY(__kernel_clock_getres)
-        .cfi_startproc
-        cmp     w0, #CLOCK_REALTIME
-        ccmp    w0, #CLOCK_MONOTONIC, #0x4, ne
-        ccmp    w0, #CLOCK_MONOTONIC_RAW, #0x4, ne
-        b.ne    1f
-
-        adr     vdso_data, _vdso_data
-        ldr     w2, [vdso_data, #CLOCK_REALTIME_RES]
-        b       2f
-1:
-        cmp     w0, #CLOCK_REALTIME_COARSE
-        ccmp    w0, #CLOCK_MONOTONIC_COARSE, #0x4, ne
-        b.ne    4f
-        ldr     x2, 5f
-2:
-        cbz     x1, 3f
-        stp     xzr, x2, [x1]
-
-3:      /* res == NULL. */
-        mov     w0, wzr
-        ret
-
-4:      /* Syscall fallback. */
-        mov     x8, #__NR_clock_getres
-        svc     #0
-        ret
-5:
-        .quad   CLOCK_COARSE_RES
-        .cfi_endproc
-ENDPROC(__kernel_clock_getres)
diff --git a/arch/arm64/kernel/vdso/vgettimeofday.c b/arch/arm64/kernel/vdso/vgettimeofday.c
new file mode 100644
index 000000000000..747635501a14
--- /dev/null
+++ b/arch/arm64/kernel/vdso/vgettimeofday.c
@@ -0,0 +1,27 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * ARM64 userspace implementations of gettimeofday() and similar.
+ *
+ * Copyright (C) 2018 ARM Limited
+ *
+ */
+#include <linux/time.h>
+#include <linux/types.h>
+
+int __kernel_clock_gettime(clockid_t clock,
+                           struct __kernel_timespec *ts)
+{
+        return __cvdso_clock_gettime(clock, ts);
+}
+
+int __kernel_gettimeofday(struct __kernel_old_timeval *tv,
+                          struct timezone *tz)
+{
+        return __cvdso_gettimeofday(tv, tz);
+}
+
+int __kernel_clock_getres(clockid_t clock_id,
+                          struct __kernel_timespec *res)
+{
+        return __cvdso_clock_getres(clock_id, res);
+}
diff --git a/arch/arm64/kernel/vdso32/.gitignore b/arch/arm64/kernel/vdso32/.gitignore
new file mode 100644
index 000000000000..4fea950fa5ed
--- /dev/null
+++ b/arch/arm64/kernel/vdso32/.gitignore
@@ -0,0 +1,2 @@
+vdso.lds
+vdso.so.raw
diff --git a/arch/arm64/kernel/vdso32/Makefile b/arch/arm64/kernel/vdso32/Makefile
new file mode 100644
index 000000000000..288c14d30b45
--- /dev/null
+++ b/arch/arm64/kernel/vdso32/Makefile
@@ -0,0 +1,186 @@
+# SPDX-License-Identifier: GPL-2.0
+#
+# Makefile for vdso32
+#
+
+# Absolute relocation type $(ARCH_REL_TYPE_ABS) needs to be defined before
+# the inclusion of generic Makefile.
+ARCH_REL_TYPE_ABS := R_ARM_JUMP_SLOT|R_ARM_GLOB_DAT|R_ARM_ABS32
+include $(srctree)/lib/vdso/Makefile
+
+COMPATCC := $(CROSS_COMPILE_COMPAT)gcc
+
+# Same as cc-*option, but using COMPATCC instead of CC
+cc32-option = $(call try-run,\
+        $(COMPATCC) $(1) -c -x c /dev/null -o "$$TMP",$(1),$(2))
+cc32-disable-warning = $(call try-run,\
+        $(COMPATCC) -W$(strip $(1)) -c -x c /dev/null -o "$$TMP",-Wno-$(strip $(1)))
+cc32-ldoption = $(call try-run,\
+        $(COMPATCC) $(1) -nostdlib -x c /dev/null -o "$$TMP",$(1),$(2))
+
+# We cannot use the global flags to compile the vDSO files, the main reason
+# being that the 32-bit compiler may be older than the main (64-bit) compiler
+# and therefore may not understand flags set using $(cc-option ...). Besides,
+# arch-specific options should be taken from the arm Makefile instead of the
+# arm64 one.
+# As a result we set our own flags here.
+
+# From top-level Makefile
+# NOSTDINC_FLAGS
+VDSO_CPPFLAGS := -nostdinc -isystem $(shell $(COMPATCC) -print-file-name=include)
+VDSO_CPPFLAGS += $(LINUXINCLUDE)
+VDSO_CPPFLAGS += $(KBUILD_CPPFLAGS)
+
+# Common C and assembly flags
+# From top-level Makefile
+VDSO_CAFLAGS := $(VDSO_CPPFLAGS)
+VDSO_CAFLAGS += $(call cc32-option,-fno-PIE)
+ifdef CONFIG_DEBUG_INFO
+VDSO_CAFLAGS += -g
+endif
+ifeq ($(shell $(CONFIG_SHELL) $(srctree)/scripts/gcc-goto.sh $(COMPATCC)), y)
+VDSO_CAFLAGS += -DCC_HAVE_ASM_GOTO
+endif
+
+# From arm Makefile
+VDSO_CAFLAGS += $(call cc32-option,-fno-dwarf2-cfi-asm)
+VDSO_CAFLAGS += -mabi=aapcs-linux -mfloat-abi=soft
+ifeq ($(CONFIG_CPU_BIG_ENDIAN), y)
+VDSO_CAFLAGS += -mbig-endian
+else
+VDSO_CAFLAGS += -mlittle-endian
+endif
+
+# From arm vDSO Makefile
+VDSO_CAFLAGS += -fPIC -fno-builtin -fno-stack-protector
+VDSO_CAFLAGS += -DDISABLE_BRANCH_PROFILING
+
+# Try to compile for ARMv8. If the compiler is too old and doesn't support it,
+# fall back to v7. There is no easy way to check for what architecture the code
+# is being compiled, so define a macro specifying that (see arch/arm/Makefile).
+VDSO_CAFLAGS += $(call cc32-option,-march=armv8-a -D__LINUX_ARM_ARCH__=8,\
+                                   -march=armv7-a -D__LINUX_ARM_ARCH__=7)
+
+VDSO_CFLAGS := $(VDSO_CAFLAGS)
+VDSO_CFLAGS += -DENABLE_COMPAT_VDSO=1
+# KBUILD_CFLAGS from top-level Makefile
+VDSO_CFLAGS += -Wall -Wundef -Wstrict-prototypes -Wno-trigraphs \
+               -fno-strict-aliasing -fno-common \
+               -Werror-implicit-function-declaration \
+               -Wno-format-security \
+               -std=gnu89
+VDSO_CFLAGS  += -O2
+# Some useful compiler-dependent flags from top-level Makefile
+VDSO_CFLAGS += $(call cc32-option,-Wdeclaration-after-statement,)
+VDSO_CFLAGS += $(call cc32-option,-Wno-pointer-sign)
+VDSO_CFLAGS += $(call cc32-option,-fno-strict-overflow)
+VDSO_CFLAGS += $(call cc32-option,-Werror=strict-prototypes)
+VDSO_CFLAGS += $(call cc32-option,-Werror=date-time)
+VDSO_CFLAGS += $(call cc32-option,-Werror=incompatible-pointer-types)
+
+# The 32-bit compiler does not provide 128-bit integers, which are used in
+# some headers that are indirectly included from the vDSO code.
+# This hack makes the compiler happy and should trigger a warning/error if
+# variables of such type are referenced.
+VDSO_CFLAGS += -D__uint128_t='void*'
+# Silence some warnings coming from headers that operate on long's
+# (on GCC 4.8 or older, there is unfortunately no way to silence this warning)
+VDSO_CFLAGS += $(call cc32-disable-warning,shift-count-overflow)
+VDSO_CFLAGS += -Wno-int-to-pointer-cast
+
+VDSO_AFLAGS := $(VDSO_CAFLAGS)
+VDSO_AFLAGS += -D__ASSEMBLY__
+
+VDSO_LDFLAGS := $(VDSO_CPPFLAGS)
+# From arm vDSO Makefile
+VDSO_LDFLAGS += -Wl,-Bsymbolic -Wl,--no-undefined -Wl,-soname=linux-vdso.so.1
+VDSO_LDFLAGS += -Wl,-z,max-page-size=4096 -Wl,-z,common-page-size=4096
+VDSO_LDFLAGS += -nostdlib -shared -mfloat-abi=soft
+VDSO_LDFLAGS += $(call cc32-ldoption,-Wl$(comma)--hash-style=sysv)
+VDSO_LDFLAGS += $(call cc32-ldoption,-Wl$(comma)--build-id)
+VDSO_LDFLAGS += $(call cc32-ldoption,-fuse-ld=bfd)
+
+
+# Borrow vdsomunge.c from the arm vDSO
+# We have to use a relative path because scripts/Makefile.host prefixes
+# $(hostprogs-y) with $(obj)
+munge := ../../../arm/vdso/vdsomunge
+hostprogs-y := $(munge)
+
+c-obj-vdso := note.o
+c-obj-vdso-gettimeofday := vgettimeofday.o
+asm-obj-vdso := sigreturn.o
+
+ifneq ($(c-gettimeofday-y),)
+VDSO_CFLAGS_gettimeofday_o += -include $(c-gettimeofday-y)
+endif
+
+VDSO_CFLAGS_REMOVE_vgettimeofday.o = $(CC_FLAGS_FTRACE) -Os
+
+# Build rules
+targets := $(c-obj-vdso) $(c-obj-vdso-gettimeofday) $(asm-obj-vdso) vdso.so vdso.so.dbg vdso.so.raw
+c-obj-vdso := $(addprefix $(obj)/, $(c-obj-vdso))
+c-obj-vdso-gettimeofday := $(addprefix $(obj)/, $(c-obj-vdso-gettimeofday))
+asm-obj-vdso := $(addprefix $(obj)/, $(asm-obj-vdso))
+obj-vdso := $(c-obj-vdso) $(c-obj-vdso-gettimeofday) $(asm-obj-vdso)
+
+obj-y += vdso.o
+extra-y += vdso.lds
+CPPFLAGS_vdso.lds += -P -C -U$(ARCH)
+
+# Force dependency (vdso.s includes vdso.so through incbin)
+$(obj)/vdso.o: $(obj)/vdso.so
+
+include/generated/vdso32-offsets.h: $(obj)/vdso.so.dbg FORCE
+        $(call if_changed,vdsosym)
+
+# Strip rule for vdso.so
+$(obj)/vdso.so: OBJCOPYFLAGS := -S
+$(obj)/vdso.so: $(obj)/vdso.so.dbg FORCE
+        $(call if_changed,objcopy)
+
+$(obj)/vdso.so.dbg: $(obj)/vdso.so.raw $(obj)/$(munge) FORCE
+        $(call if_changed,vdsomunge)
+
+# Link rule for the .so file, .lds has to be first
+$(obj)/vdso.so.raw: $(src)/vdso.lds $(obj-vdso) FORCE
+        $(call if_changed,vdsold)
+        $(call if_changed,vdso_check)
+
+# Compilation rules for the vDSO sources
+$(c-obj-vdso): %.o: %.c FORCE
+        $(call if_changed_dep,vdsocc)
+$(c-obj-vdso-gettimeofday): %.o: %.c FORCE
+        $(call if_changed_dep,vdsocc_gettimeofday)
+$(asm-obj-vdso): %.o: %.S FORCE
+        $(call if_changed_dep,vdsoas)
+
+# Actual build commands
+quiet_cmd_vdsold = VDSOL   $@
+      cmd_vdsold = $(COMPATCC) -Wp,-MD,$(depfile) $(VDSO_LDFLAGS) \
+                   -Wl,-T $(filter %.lds,$^) $(filter %.o,$^) -o $@
+quiet_cmd_vdsocc = VDSOC   $@
+      cmd_vdsocc = $(COMPATCC) -Wp,-MD,$(depfile) $(VDSO_CFLAGS) -c -o $@ $<
+quiet_cmd_vdsocc_gettimeofday = VDSOC_GTD   $@
+      cmd_vdsocc_gettimeofday = $(COMPATCC) -Wp,-MD,$(depfile) $(VDSO_CFLAGS) $(VDSO_CFLAGS_gettimeofday_o) -c -o $@ $<
+quiet_cmd_vdsoas = VDSOA   $@
+      cmd_vdsoas = $(COMPATCC) -Wp,-MD,$(depfile) $(VDSO_AFLAGS) -c -o $@ $<
+
+quiet_cmd_vdsomunge = MUNGE   $@
+      cmd_vdsomunge = $(obj)/$(munge) $< $@
+
+# Generate vDSO offsets using helper script (borrowed from the 64-bit vDSO)
+gen-vdsosym := $(srctree)/$(src)/../vdso/gen_vdso_offsets.sh
+quiet_cmd_vdsosym = VDSOSYM $@
+# The AArch64 nm should be able to read an AArch32 binary
+      cmd_vdsosym = $(NM) $< | $(gen-vdsosym) | LC_ALL=C sort > $@
+
+# Install commands for the unstripped file
+quiet_cmd_vdso_install = INSTALL $@
+      cmd_vdso_install = cp $(obj)/$@.dbg $(MODLIB)/vdso/vdso32.so
+
+vdso.so: $(obj)/vdso.so.dbg
+        @mkdir -p $(MODLIB)/vdso
+        $(call cmd,vdso_install)
+
+vdso_install: vdso.so
diff --git a/arch/arm64/kernel/vdso32/note.c b/arch/arm64/kernel/vdso32/note.c
new file mode 100644
index 000000000000..eff5bf9efb8b
--- /dev/null
+++ b/arch/arm64/kernel/vdso32/note.c
@@ -0,0 +1,15 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * Copyright (C) 2012-2018 ARM Limited
+ *
+ * This supplies .note.* sections to go into the PT_NOTE inside the vDSO text.
+ * Here we can supply some information useful to userland.
+ */
+
+#include <linux/uts.h>
+#include <linux/version.h>
+#include <linux/elfnote.h>
+#include <linux/build-salt.h>
+
+ELFNOTE32("Linux", 0, LINUX_VERSION_CODE);
+BUILD_SALT;
diff --git a/arch/arm64/kernel/vdso32/sigreturn.S b/arch/arm64/kernel/vdso32/sigreturn.S
new file mode 100644
index 000000000000..1a81277c2d09
--- /dev/null
+++ b/arch/arm64/kernel/vdso32/sigreturn.S
@@ -0,0 +1,62 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+/*
+ * This file provides both A32 and T32 versions, in accordance with the
+ * arm sigreturn code.
+ *
+ * Copyright (C) 2018 ARM Limited
+ */
+
+#include <linux/linkage.h>
+#include <asm/asm-offsets.h>
+#include <asm/unistd.h>
+
+#define ARM_ENTRY(name)         \
+        ENTRY(name)
+
+#define ARM_ENDPROC(name)       \
+        .type name, %function;  \
+        END(name)
+
+        .text
+
+        .arm
+        .fnstart
+        .save {r0-r15}
+        .pad #COMPAT_SIGFRAME_REGS_OFFSET
+        nop
+ARM_ENTRY(__kernel_sigreturn_arm)
+        mov r7, #__NR_compat_sigreturn
+        svc #0
+        .fnend
+ARM_ENDPROC(__kernel_sigreturn_arm)
+
+        .fnstart
+        .save {r0-r15}
+        .pad #COMPAT_RT_SIGFRAME_REGS_OFFSET
+        nop
+ARM_ENTRY(__kernel_rt_sigreturn_arm)
+        mov r7, #__NR_compat_rt_sigreturn
+        svc #0
+        .fnend
+ARM_ENDPROC(__kernel_rt_sigreturn_arm)
+
+        .thumb
+        .fnstart
+        .save {r0-r15}
+        .pad #COMPAT_SIGFRAME_REGS_OFFSET
+        nop
+ARM_ENTRY(__kernel_sigreturn_thumb)
+        mov r7, #__NR_compat_sigreturn
+        svc #0
+        .fnend
+ARM_ENDPROC(__kernel_sigreturn_thumb)
+
+        .fnstart
+        .save {r0-r15}
+        .pad #COMPAT_RT_SIGFRAME_REGS_OFFSET
+        nop
+ARM_ENTRY(__kernel_rt_sigreturn_thumb)
+        mov r7, #__NR_compat_rt_sigreturn
+        svc #0
+        .fnend
+ARM_ENDPROC(__kernel_rt_sigreturn_thumb)
diff --git a/arch/arm64/kernel/vdso32/vdso.S b/arch/arm64/kernel/vdso32/vdso.S
new file mode 100644
index 000000000000..e72ac7bc4c04
--- /dev/null
+++ b/arch/arm64/kernel/vdso32/vdso.S
@@ -0,0 +1,19 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+/*
+ * Copyright (C) 2012 ARM Limited
+ */
+
+#include <linux/init.h>
+#include <linux/linkage.h>
+#include <linux/const.h>
+#include <asm/page.h>
+
+        .globl vdso32_start, vdso32_end
+        .section .rodata
+        .balign PAGE_SIZE
+vdso32_start:
+        .incbin "arch/arm64/kernel/vdso32/vdso.so"
+        .balign PAGE_SIZE
+vdso32_end:
+
+        .previous
diff --git a/arch/arm64/kernel/vdso32/vdso.lds.S b/arch/arm64/kernel/vdso32/vdso.lds.S
new file mode 100644
index 000000000000..a3944927eaeb
--- /dev/null
+++ b/arch/arm64/kernel/vdso32/vdso.lds.S
@@ -0,0 +1,82 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+/*
+ * Adapted from arm64 version.
+ *
+ * GNU linker script for the VDSO library.
+ * Heavily based on the vDSO linker scripts for other archs.
+ *
+ * Copyright (C) 2012-2018 ARM Limited
+ */
+
+#include <linux/const.h>
+#include <asm/page.h>
+#include <asm/vdso.h>
+
+OUTPUT_FORMAT("elf32-littlearm", "elf32-bigarm", "elf32-littlearm")
+OUTPUT_ARCH(arm)
+
+SECTIONS
+{
+        PROVIDE_HIDDEN(_vdso_data = . - PAGE_SIZE);
+        . = VDSO_LBASE + SIZEOF_HEADERS;
+
+        .hash           : { *(.hash) }                  :text
+        .gnu.hash       : { *(.gnu.hash) }
+        .dynsym         : { *(.dynsym) }
+        .dynstr         : { *(.dynstr) }
+        .gnu.version    : { *(.gnu.version) }
+        .gnu.version_d  : { *(.gnu.version_d) }
+        .gnu.version_r  : { *(.gnu.version_r) }
+
+        .note           : { *(.note.*) }                :text   :note
+
+        .dynamic        : { *(.dynamic) }               :text   :dynamic
+
+        .rodata         : { *(.rodata*) }               :text
+
+        .text           : { *(.text*) }                 :text   =0xe7f001f2
+
+        .got            : { *(.got) }
+        .rel.plt        : { *(.rel.plt) }
+
+        /DISCARD/       : {
+                *(.note.GNU-stack)
+                *(.data .data.* .gnu.linkonce.d.* .sdata*)
+                *(.bss .sbss .dynbss .dynsbss)
+        }
+}
+
+/*
+ * We must supply the ELF program headers explicitly to get just one
+ * PT_LOAD segment, and set the flags explicitly to make segments read-only.
+ */
+PHDRS
+{
+        text            PT_LOAD         FLAGS(5) FILEHDR PHDRS; /* PF_R|PF_X */
+        dynamic         PT_DYNAMIC      FLAGS(4);               /* PF_R */
+        note            PT_NOTE         FLAGS(4);               /* PF_R */
+}
+
+VERSION
+{
+        LINUX_2.6 {
+        global:
+                __vdso_clock_gettime;
+                __vdso_gettimeofday;
+                __vdso_clock_getres;
+                __kernel_sigreturn_arm;
+                __kernel_sigreturn_thumb;
+                __kernel_rt_sigreturn_arm;
+                __kernel_rt_sigreturn_thumb;
+                __vdso_clock_gettime64;
+        local: *;
+        };
+}
+
+/*
+ * Make the sigreturn code visible to the kernel.
+ */
+VDSO_compat_sigreturn_arm       = __kernel_sigreturn_arm;
+VDSO_compat_sigreturn_thumb     = __kernel_sigreturn_thumb;
+VDSO_compat_rt_sigreturn_arm    = __kernel_rt_sigreturn_arm;
+VDSO_compat_rt_sigreturn_thumb  = __kernel_rt_sigreturn_thumb;
diff --git a/arch/arm64/kernel/vdso32/vgettimeofday.c b/arch/arm64/kernel/vdso32/vgettimeofday.c
new file mode 100644
index 000000000000..54fc1c2ce93f
--- /dev/null
+++ b/arch/arm64/kernel/vdso32/vgettimeofday.c
@@ -0,0 +1,59 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * ARM64 compat userspace implementations of gettimeofday() and similar.
+ *
+ * Copyright (C) 2018 ARM Limited
+ *
+ */
+#include <linux/time.h>
+#include <linux/types.h>
+
+int __vdso_clock_gettime(clockid_t clock,
+                         struct old_timespec32 *ts)
+{
+        /* The checks below are required for ABI consistency with arm */
+        if ((u32)ts >= TASK_SIZE_32)
+                return -EFAULT;
+
+        return __cvdso_clock_gettime32(clock, ts);
+}
+
+int __vdso_clock_gettime64(clockid_t clock,
+                           struct __kernel_timespec *ts)
+{
+        /* The checks below are required for ABI consistency with arm */
+        if ((u32)ts >= TASK_SIZE_32)
+                return -EFAULT;
+
+        return __cvdso_clock_gettime(clock, ts);
+}
+
+int __vdso_gettimeofday(struct __kernel_old_timeval *tv,
+                        struct timezone *tz)
+{
+        return __cvdso_gettimeofday(tv, tz);
+}
+
+int __vdso_clock_getres(clockid_t clock_id,
+                        struct old_timespec32 *res)
+{
+        /* The checks below are required for ABI consistency with arm */
+        if ((u32)res >= TASK_SIZE_32)
+                return -EFAULT;
+
+        return __cvdso_clock_getres_time32(clock_id, res);
+}
+
+/* Avoid unresolved references emitted by GCC */
+
+void __aeabi_unwind_cpp_pr0(void)
+{
+}
+
+void __aeabi_unwind_cpp_pr1(void)
+{
+}
+
+void __aeabi_unwind_cpp_pr2(void)
+{
+}
diff --git a/arch/arm64/kvm/fpsimd.c b/arch/arm64/kvm/fpsimd.c
index 6e3c9c8b2df9..525010504f9d 100644
--- a/arch/arm64/kvm/fpsimd.c
+++ b/arch/arm64/kvm/fpsimd.c
@@ -112,9 +112,7 @@ void kvm_arch_vcpu_put_fp(struct kvm_vcpu *vcpu)
         if (vcpu->arch.flags & KVM_ARM64_FP_ENABLED) {
                 u64 *guest_zcr = &vcpu->arch.ctxt.sys_regs[ZCR_EL1];
 
-                /* Clean guest FP state to memory and invalidate cpu view */
-                fpsimd_save();
-                fpsimd_flush_cpu_state();
+                fpsimd_save_and_flush_cpu_state();
 
                 if (guest_has_sve)
                         *guest_zcr = read_sysreg_s(SYS_ZCR_EL12);
diff --git a/arch/arm64/kvm/guest.c b/arch/arm64/kvm/guest.c
index c2afa7982047..dfd626447482 100644
--- a/arch/arm64/kvm/guest.c
+++ b/arch/arm64/kvm/guest.c
@@ -208,7 +208,7 @@ out:
 
 #define vq_word(vq) (((vq) - SVE_VQ_MIN) / 64)
 #define vq_mask(vq) ((u64)1 << ((vq) - SVE_VQ_MIN) % 64)
-#define vq_present(vqs, vq) ((vqs)[vq_word(vq)] & vq_mask(vq))
+#define vq_present(vqs, vq) (!!((vqs)[vq_word(vq)] & vq_mask(vq)))
 
 static int get_sve_vls(struct kvm_vcpu *vcpu, const struct kvm_one_reg *reg)
 {
diff --git a/arch/arm64/kvm/hyp/switch.c b/arch/arm64/kvm/hyp/switch.c
index b0041812bca9..58f281b6ca4a 100644
--- a/arch/arm64/kvm/hyp/switch.c
+++ b/arch/arm64/kvm/hyp/switch.c
@@ -604,7 +604,7 @@ int __hyp_text __kvm_vcpu_run_nvhe(struct kvm_vcpu *vcpu)
          * Naturally, we want to avoid this.
          */
         if (system_uses_irq_prio_masking()) {
-                gic_write_pmr(GIC_PRIO_IRQON);
+                gic_write_pmr(GIC_PRIO_IRQON | GIC_PRIO_PSR_I_SET);
                 dsb(sy);
         }
 
diff --git a/arch/arm64/mm/dma-mapping.c b/arch/arm64/mm/dma-mapping.c
index 5992eb9a9a08..1d17dbeafe76 100644
--- a/arch/arm64/mm/dma-mapping.c
+++ b/arch/arm64/mm/dma-mapping.c
@@ -80,10 +80,6 @@ static int __swiotlb_mmap_pfn(struct vm_area_struct *vma,
 
 static int __init arm64_dma_init(void)
 {
-        WARN_TAINT(ARCH_DMA_MINALIGN < cache_line_size(),
-                   TAINT_CPU_OUT_OF_SPEC,
-                   "ARCH_DMA_MINALIGN smaller than CTR_EL0.CWG (%d < %d)",
-                   ARCH_DMA_MINALIGN, cache_line_size());
         return dma_atomic_pool_init(GFP_DMA32, __pgprot(PROT_NORMAL_NC));
 }
 arch_initcall(arm64_dma_init);
@@ -461,6 +457,14 @@ static void __iommu_setup_dma_ops(struct device *dev, u64 dma_base, u64 size,
 void arch_setup_dma_ops(struct device *dev, u64 dma_base, u64 size,
                         const struct iommu_ops *iommu, bool coherent)
 {
+        int cls = cache_line_size_of_cpu();
+
+        WARN_TAINT(!coherent && cls > ARCH_DMA_MINALIGN,
+                   TAINT_CPU_OUT_OF_SPEC,
+                   "%s %s: ARCH_DMA_MINALIGN smaller than CTR_EL0.CWG (%d < %d)",
+                   dev_driver_string(dev), dev_name(dev),
+                   ARCH_DMA_MINALIGN, cls);
+
         dev->dma_coherent = coherent;
         __iommu_setup_dma_ops(dev, dma_base, size, iommu);
 
diff --git a/arch/arm64/mm/fault.c b/arch/arm64/mm/fault.c
index 2d115016feb4..c8c61b1eb479 100644
--- a/arch/arm64/mm/fault.c
+++ b/arch/arm64/mm/fault.c
@@ -384,40 +384,31 @@ static void do_bad_area(unsigned long addr, unsigned int esr, struct pt_regs *re
 #define VM_FAULT_BADACCESS      0x020000
 
 static vm_fault_t __do_page_fault(struct mm_struct *mm, unsigned long addr,
-                           unsigned int mm_flags, unsigned long vm_flags,
-                           struct task_struct *tsk)
+                           unsigned int mm_flags, unsigned long vm_flags)
 {
-        struct vm_area_struct *vma;
-        vm_fault_t fault;
+        struct vm_area_struct *vma = find_vma(mm, addr);
 
-        vma = find_vma(mm, addr);
-        fault = VM_FAULT_BADMAP;
         if (unlikely(!vma))
-                goto out;
-        if (unlikely(vma->vm_start > addr))
-                goto check_stack;
+                return VM_FAULT_BADMAP;
 
         /*
          * Ok, we have a good vm_area for this memory access, so we can handle
          * it.
          */
-good_area:
+        if (unlikely(vma->vm_start > addr)) {
+                if (!(vma->vm_flags & VM_GROWSDOWN))
+                        return VM_FAULT_BADMAP;
+                if (expand_stack(vma, addr))
+                        return VM_FAULT_BADMAP;
+        }
+
         /*
          * Check that the permissions on the VMA allow for the fault which
          * occurred.
          */
-        if (!(vma->vm_flags & vm_flags)) {
-                fault = VM_FAULT_BADACCESS;
-                goto out;
-        }
-
+        if (!(vma->vm_flags & vm_flags))
+                return VM_FAULT_BADACCESS;
         return handle_mm_fault(vma, addr & PAGE_MASK, mm_flags);
-
-check_stack:
-        if (vma->vm_flags & VM_GROWSDOWN && !expand_stack(vma, addr))
-                goto good_area;
-out:
-        return fault;
 }
 
 static bool is_el0_instruction_abort(unsigned int esr)
@@ -425,12 +416,20 @@ static bool is_el0_instruction_abort(unsigned int esr)
         return ESR_ELx_EC(esr) == ESR_ELx_EC_IABT_LOW;
 }
 
+/*
+ * Note: not valid for EL1 DC IVAC, but we never use that such that it
+ * should fault. EL0 cannot issue DC IVAC (undef).
+ */
+static bool is_write_abort(unsigned int esr)
+{
+        return (esr & ESR_ELx_WNR) && !(esr & ESR_ELx_CM);
+}
+
 static int __kprobes do_page_fault(unsigned long addr, unsigned int esr,
                                    struct pt_regs *regs)
 {
         const struct fault_info *inf;
-        struct task_struct *tsk;
-        struct mm_struct *mm;
+        struct mm_struct *mm = current->mm;
         vm_fault_t fault, major = 0;
         unsigned long vm_flags = VM_READ | VM_WRITE;
         unsigned int mm_flags = FAULT_FLAG_ALLOW_RETRY | FAULT_FLAG_KILLABLE;
@@ -438,9 +437,6 @@ static int __kprobes do_page_fault(unsigned long addr, unsigned int esr,
         if (notify_page_fault(regs, esr))
                 return 0;
 
-        tsk = current;
-        mm  = tsk->mm;
-
         /*
          * If we're in an interrupt or have no user context, we must not take
          * the fault.
@@ -453,7 +449,8 @@ static int __kprobes do_page_fault(unsigned long addr, unsigned int esr,
 
         if (is_el0_instruction_abort(esr)) {
                 vm_flags = VM_EXEC;
-        } else if ((esr & ESR_ELx_WNR) && !(esr & ESR_ELx_CM)) {
+                mm_flags |= FAULT_FLAG_INSTRUCTION;
+        } else if (is_write_abort(esr)) {
                 vm_flags = VM_WRITE;
                 mm_flags |= FAULT_FLAG_WRITE;
         }
@@ -492,12 +489,14 @@ retry:
                  */
                 might_sleep();
 #ifdef CONFIG_DEBUG_VM
-                if (!user_mode(regs) && !search_exception_tables(regs->pc))
+                if (!user_mode(regs) && !search_exception_tables(regs->pc)) {
+                        up_read(&mm->mmap_sem);
                         goto no_context;
+                }
 #endif
         }
 
-        fault = __do_page_fault(mm, addr, mm_flags, vm_flags, tsk);
+        fault = __do_page_fault(mm, addr, mm_flags, vm_flags);
         major |= fault & VM_FAULT_MAJOR;
 
         if (fault & VM_FAULT_RETRY) {
@@ -537,11 +536,11 @@ retry:
                  * that point.
                  */
                 if (major) {
-                        tsk->maj_flt++;
+                        current->maj_flt++;
                         perf_sw_event(PERF_COUNT_SW_PAGE_FAULTS_MAJ, 1, regs,
                                       addr);
                 } else {
-                        tsk->min_flt++;
+                        current->min_flt++;
                         perf_sw_event(PERF_COUNT_SW_PAGE_FAULTS_MIN, 1, regs,
                                       addr);
                 }
diff --git a/arch/arm64/mm/hugetlbpage.c b/arch/arm64/mm/hugetlbpage.c
index f475e54fbc43..bbeb6a5a6ba6 100644
--- a/arch/arm64/mm/hugetlbpage.c
+++ b/arch/arm64/mm/hugetlbpage.c
@@ -228,7 +228,7 @@ pte_t *huge_pte_alloc(struct mm_struct *mm,
 
         if (sz == PUD_SIZE) {
                 ptep = (pte_t *)pudp;
-        } else if (sz == (PAGE_SIZE * CONT_PTES)) {
+        } else if (sz == (CONT_PTE_SIZE)) {
                 pmdp = pmd_alloc(mm, pudp, addr);
 
                 WARN_ON(addr & (sz - 1));
@@ -246,7 +246,7 @@ pte_t *huge_pte_alloc(struct mm_struct *mm,
                         ptep = huge_pmd_share(mm, addr, pudp);
                 else
                         ptep = (pte_t *)pmd_alloc(mm, pudp, addr);
-        } else if (sz == (PMD_SIZE * CONT_PMDS)) {
+        } else if (sz == (CONT_PMD_SIZE)) {
                 pmdp = pmd_alloc(mm, pudp, addr);
                 WARN_ON(addr & (sz - 1));
                 return (pte_t *)pmdp;
@@ -454,9 +454,9 @@ static int __init hugetlbpage_init(void)
 #ifdef CONFIG_ARM64_4K_PAGES
         add_huge_page_size(PUD_SIZE);
 #endif
-        add_huge_page_size(PMD_SIZE * CONT_PMDS);
+        add_huge_page_size(CONT_PMD_SIZE);
         add_huge_page_size(PMD_SIZE);
-        add_huge_page_size(PAGE_SIZE * CONT_PTES);
+        add_huge_page_size(CONT_PTE_SIZE);
 
         return 0;
 }
@@ -470,9 +470,9 @@ static __init int setup_hugepagesz(char *opt)
 #ifdef CONFIG_ARM64_4K_PAGES
         case PUD_SIZE:
 #endif
-        case PMD_SIZE * CONT_PMDS:
+        case CONT_PMD_SIZE:
         case PMD_SIZE:
-        case PAGE_SIZE * CONT_PTES:
+        case CONT_PTE_SIZE:
                 add_huge_page_size(ps);
                 return 1;
         }
diff --git a/arch/arm64/mm/init.c b/arch/arm64/mm/init.c
index 749c9b269f08..f3c795278def 100644
--- a/arch/arm64/mm/init.c
+++ b/arch/arm64/mm/init.c
@@ -180,8 +180,9 @@ static void __init zone_sizes_init(unsigned long min, unsigned long max)
 {
         unsigned long max_zone_pfns[MAX_NR_ZONES]  = {0};
 
-        if (IS_ENABLED(CONFIG_ZONE_DMA32))
-                max_zone_pfns[ZONE_DMA32] = PFN_DOWN(max_zone_dma_phys());
+#ifdef CONFIG_ZONE_DMA32
+        max_zone_pfns[ZONE_DMA32] = PFN_DOWN(max_zone_dma_phys());
+#endif
         max_zone_pfns[ZONE_NORMAL] = max;
 
         free_area_init_nodes(max_zone_pfns);
diff --git a/arch/arm64/mm/mmu.c b/arch/arm64/mm/mmu.c
index e5ae8663f230..3645f29bd814 100644
--- a/arch/arm64/mm/mmu.c
+++ b/arch/arm64/mm/mmu.c
@@ -765,7 +765,7 @@ int __meminit vmemmap_populate(unsigned long start, unsigned long end, int node,
 
         return 0;
 }
-#endif  /* CONFIG_ARM64_64K_PAGES */
+#endif  /* !ARM64_SWAPPER_USES_SECTION_MAPS */
 void vmemmap_free(unsigned long start, unsigned long end,
                 struct vmem_altmap *altmap)
 {
@@ -960,32 +960,28 @@ int __init arch_ioremap_pmd_supported(void)
 
 int pud_set_huge(pud_t *pudp, phys_addr_t phys, pgprot_t prot)
 {
-        pgprot_t sect_prot = __pgprot(PUD_TYPE_SECT |
-                                        pgprot_val(mk_sect_prot(prot)));
-        pud_t new_pud = pfn_pud(__phys_to_pfn(phys), sect_prot);
+        pud_t new_pud = pfn_pud(__phys_to_pfn(phys), mk_pud_sect_prot(prot));
 
         /* Only allow permission changes for now */
         if (!pgattr_change_is_safe(READ_ONCE(pud_val(*pudp)),
                                    pud_val(new_pud)))
                 return 0;
 
-        BUG_ON(phys & ~PUD_MASK);
+        VM_BUG_ON(phys & ~PUD_MASK);
         set_pud(pudp, new_pud);
         return 1;
 }
 
 int pmd_set_huge(pmd_t *pmdp, phys_addr_t phys, pgprot_t prot)
 {
-        pgprot_t sect_prot = __pgprot(PMD_TYPE_SECT |
-                                        pgprot_val(mk_sect_prot(prot)));
-        pmd_t new_pmd = pfn_pmd(__phys_to_pfn(phys), sect_prot);
+        pmd_t new_pmd = pfn_pmd(__phys_to_pfn(phys), mk_pmd_sect_prot(prot));
 
         /* Only allow permission changes for now */
         if (!pgattr_change_is_safe(READ_ONCE(pmd_val(*pmdp)),
                                    pmd_val(new_pmd)))
                 return 0;
 
-        BUG_ON(phys & ~PMD_MASK);
+        VM_BUG_ON(phys & ~PMD_MASK);
         set_pmd(pmdp, new_pmd);
         return 1;
 }
diff --git a/arch/arm64/mm/pageattr.c b/arch/arm64/mm/pageattr.c
index 47b057bfa803..fcdcf6cd7677 100644
--- a/arch/arm64/mm/pageattr.c
+++ b/arch/arm64/mm/pageattr.c
@@ -151,17 +151,48 @@ int set_memory_valid(unsigned long addr, int numpages, int enable)
                                         __pgprot(PTE_VALID));
 }
 
-#ifdef CONFIG_DEBUG_PAGEALLOC
+int set_direct_map_invalid_noflush(struct page *page)
+{
+        struct page_change_data data = {
+                .set_mask = __pgprot(0),
+                .clear_mask = __pgprot(PTE_VALID),
+        };
+
+        if (!rodata_full)
+                return 0;
+
+        return apply_to_page_range(&init_mm,
+                                   (unsigned long)page_address(page),
+                                   PAGE_SIZE, change_page_range, &data);
+}
+
+int set_direct_map_default_noflush(struct page *page)
+{
+        struct page_change_data data = {
+                .set_mask = __pgprot(PTE_VALID | PTE_WRITE),
+                .clear_mask = __pgprot(PTE_RDONLY),
+        };
+
+        if (!rodata_full)
+                return 0;
+
+        return apply_to_page_range(&init_mm,
+                                   (unsigned long)page_address(page),
+                                   PAGE_SIZE, change_page_range, &data);
+}
+
 void __kernel_map_pages(struct page *page, int numpages, int enable)
 {
+        if (!debug_pagealloc_enabled() && !rodata_full)
+                return;
+
         set_memory_valid((unsigned long)page_address(page), numpages, enable);
 }
-#ifdef CONFIG_HIBERNATION
+
 /*
- * When built with CONFIG_DEBUG_PAGEALLOC and CONFIG_HIBERNATION, this function
- * is used to determine if a linear map page has been marked as not-valid by
- * CONFIG_DEBUG_PAGEALLOC. Walk the page table and check the PTE_VALID bit.
- * This is based on kern_addr_valid(), which almost does what we need.
+ * This function is used to determine if a linear map page has been marked as
+ * not-valid. Walk the page table and check the PTE_VALID bit. This is based
+ * on kern_addr_valid(), which almost does what we need.
  *
  * Because this is only called on the kernel linear map,  p?d_sect() implies
  * p?d_present(). When debug_pagealloc is enabled, sections mappings are
@@ -175,6 +206,9 @@ bool kernel_page_present(struct page *page)
         pte_t *ptep;
         unsigned long addr = (unsigned long)page_address(page);
 
+        if (!debug_pagealloc_enabled() && !rodata_full)
+                return true;
+
         pgdp = pgd_offset_k(addr);
         if (pgd_none(READ_ONCE(*pgdp)))
                 return false;
@@ -196,5 +230,3 @@ bool kernel_page_present(struct page *page)
         ptep = pte_offset_kernel(pmdp, addr);
         return pte_valid(READ_ONCE(*ptep));
 }
-#endif /* CONFIG_HIBERNATION */
-#endif /* CONFIG_DEBUG_PAGEALLOC */
diff --git a/arch/arm64/net/bpf_jit_comp.c b/arch/arm64/net/bpf_jit_comp.c
index 87c568807925..f5b437f8a22b 100644
--- a/arch/arm64/net/bpf_jit_comp.c
+++ b/arch/arm64/net/bpf_jit_comp.c
@@ -970,7 +970,7 @@ void *bpf_jit_alloc_exec(unsigned long size)
 {
         return __vmalloc_node_range(size, PAGE_SIZE, BPF_JIT_REGION_START,
                                     BPF_JIT_REGION_END, GFP_KERNEL,
-                                    PAGE_KERNEL_EXEC, 0, NUMA_NO_NODE,
+                                    PAGE_KERNEL, 0, NUMA_NO_NODE,
                                     __builtin_return_address(0));
 }
 
diff --git a/arch/csky/kernel/signal.c b/arch/csky/kernel/signal.c
index 04a43cfd4e09..d47a3381aad8 100644
--- a/arch/csky/kernel/signal.c
+++ b/arch/csky/kernel/signal.c
@@ -39,6 +39,11 @@ static int save_fpu_state(struct sigcontext __user *sc)
 #endif
 
 struct rt_sigframe {
+        /*
+         * pad[3] is compatible with the same struct defined in
+         * gcc/libgcc/config/csky/linux-unwind.h
+         */
+        int pad[3];
         struct siginfo info;
         struct ucontext uc;
 };
diff --git a/arch/ia64/include/asm/atomic.h b/arch/ia64/include/asm/atomic.h
index 206530d0751b..50440f3ddc43 100644
--- a/arch/ia64/include/asm/atomic.h
+++ b/arch/ia64/include/asm/atomic.h
@@ -124,10 +124,10 @@ ATOMIC_FETCH_OP(xor, ^)
 #undef ATOMIC_OP
 
 #define ATOMIC64_OP(op, c_op)                                           \
-static __inline__ long                                                  \
-ia64_atomic64_##op (__s64 i, atomic64_t *v)                             \
+static __inline__ s64                                                   \
+ia64_atomic64_##op (s64 i, atomic64_t *v)                               \
 {                                                                       \
-        __s64 old, new;                                                 \
+        s64 old, new;                                                   \
         CMPXCHG_BUGCHECK_DECL                                           \
                                                                         \
         do {                                                            \
@@ -139,10 +139,10 @@ ia64_atomic64_##op (__s64 i, atomic64_t *v)				\
 }
 
 #define ATOMIC64_FETCH_OP(op, c_op)                                     \
-static __inline__ long                                                  \
-ia64_atomic64_fetch_##op (__s64 i, atomic64_t *v)                       \
+static __inline__ s64                                                   \
+ia64_atomic64_fetch_##op (s64 i, atomic64_t *v)                         \
 {                                                                       \
-        __s64 old, new;                                                 \
+        s64 old, new;                                                   \
         CMPXCHG_BUGCHECK_DECL                                           \
                                                                         \
         do {                                                            \
@@ -162,7 +162,7 @@ ATOMIC64_OPS(sub, -)
 
 #define atomic64_add_return(i,v)                                        \
 ({                                                                      \
-        long __ia64_aar_i = (i);                                        \
+        s64 __ia64_aar_i = (i);                                         \
         __ia64_atomic_const(i)                                          \
                 ? ia64_fetch_and_add(__ia64_aar_i, &(v)->counter)       \
                 : ia64_atomic64_add(__ia64_aar_i, v);                   \
@@ -170,7 +170,7 @@ ATOMIC64_OPS(sub, -)
 
 #define atomic64_sub_return(i,v)                                        \
 ({                                                                      \
-        long __ia64_asr_i = (i);                                        \
+        s64 __ia64_asr_i = (i);                                         \
         __ia64_atomic_const(i)                                          \
                 ? ia64_fetch_and_add(-__ia64_asr_i, &(v)->counter)      \
                 : ia64_atomic64_sub(__ia64_asr_i, v);                   \
@@ -178,7 +178,7 @@ ATOMIC64_OPS(sub, -)
 
 #define atomic64_fetch_add(i,v)                                         \
 ({                                                                      \
-        long __ia64_aar_i = (i);                                        \
+        s64 __ia64_aar_i = (i);                                         \
         __ia64_atomic_const(i)                                          \
                 ? ia64_fetchadd(__ia64_aar_i, &(v)->counter, acq)       \
                 : ia64_atomic64_fetch_add(__ia64_aar_i, v);             \
@@ -186,7 +186,7 @@ ATOMIC64_OPS(sub, -)
 
 #define atomic64_fetch_sub(i,v)                                         \
 ({                                                                      \
-        long __ia64_asr_i = (i);                                        \
+        s64 __ia64_asr_i = (i);                                         \
         __ia64_atomic_const(i)                                          \
                 ? ia64_fetchadd(-__ia64_asr_i, &(v)->counter, acq)      \
                 : ia64_atomic64_fetch_sub(__ia64_asr_i, v);             \
diff --git a/arch/ia64/kernel/perfmon.c b/arch/ia64/kernel/perfmon.c
index 58a6337c0690..7c52bd2695a2 100644
--- a/arch/ia64/kernel/perfmon.c
+++ b/arch/ia64/kernel/perfmon.c
@@ -6390,11 +6390,7 @@ pfm_install_alt_pmu_interrupt(pfm_intr_handler_desc_t *hdl)
         }
 
         /* save the current system wide pmu states */
-        ret = on_each_cpu(pfm_alt_save_pmu_state, NULL, 1);
-        if (ret) {
-                DPRINT(("on_each_cpu() failed: %d\n", ret));
-                goto cleanup_reserve;
-        }
+        on_each_cpu(pfm_alt_save_pmu_state, NULL, 1);
 
         /* officially change to the alternate interrupt handler */
         pfm_alt_intr_handler = hdl;
@@ -6421,7 +6417,6 @@ int
 pfm_remove_alt_pmu_interrupt(pfm_intr_handler_desc_t *hdl)
 {
         int i;
-        int ret;
 
         if (hdl == NULL) return -EINVAL;
 
@@ -6435,10 +6430,7 @@ pfm_remove_alt_pmu_interrupt(pfm_intr_handler_desc_t *hdl)
 
         pfm_alt_intr_handler = NULL;
 
-        ret = on_each_cpu(pfm_alt_restore_pmu_state, NULL, 1);
-        if (ret) {
-                DPRINT(("on_each_cpu() failed: %d\n", ret));
-        }
+        on_each_cpu(pfm_alt_restore_pmu_state, NULL, 1);
 
         for_each_online_cpu(i) {
                 pfm_unreserve_session(NULL, 1, i);
diff --git a/arch/ia64/kernel/uncached.c b/arch/ia64/kernel/uncached.c
index edcdfc149311..16c6d377c502 100644
--- a/arch/ia64/kernel/uncached.c
+++ b/arch/ia64/kernel/uncached.c
@@ -121,8 +121,8 @@ static int uncached_add_chunk(struct uncached_pool *uc_pool, int nid)
         status = ia64_pal_prefetch_visibility(PAL_VISIBILITY_PHYSICAL);
         if (status == PAL_VISIBILITY_OK_REMOTE_NEEDED) {
                 atomic_set(&uc_pool->status, 0);
-                status = smp_call_function(uncached_ipi_visibility, uc_pool, 1);
-                if (status || atomic_read(&uc_pool->status))
+                smp_call_function(uncached_ipi_visibility, uc_pool, 1);
+                if (atomic_read(&uc_pool->status))
                         goto failed;
         } else if (status != PAL_VISIBILITY_OK)
                 goto failed;
@@ -143,8 +143,8 @@ static int uncached_add_chunk(struct uncached_pool *uc_pool, int nid)
         if (status != PAL_STATUS_SUCCESS)
                 goto failed;
         atomic_set(&uc_pool->status, 0);
-        status = smp_call_function(uncached_ipi_mc_drain, uc_pool, 1);
-        if (status || atomic_read(&uc_pool->status))
+        smp_call_function(uncached_ipi_mc_drain, uc_pool, 1);
+        if (atomic_read(&uc_pool->status))
                 goto failed;
 
         /*
diff --git a/arch/m68k/Kconfig b/arch/m68k/Kconfig
index 218e037ef901..00f5c98a5e05 100644
--- a/arch/m68k/Kconfig
+++ b/arch/m68k/Kconfig
@@ -3,10 +3,13 @@ config M68K
         bool
         default y
         select ARCH_32BIT_OFF_T
+        select ARCH_HAS_DMA_MMAP_PGPROT if MMU && !COLDFIRE
+        select ARCH_HAS_DMA_PREP_COHERENT
         select ARCH_HAS_SYNC_DMA_FOR_DEVICE if HAS_DMA
         select ARCH_MIGHT_HAVE_PC_PARPORT if ISA
         select ARCH_NO_COHERENT_DMA_MMAP if !MMU
         select ARCH_NO_PREEMPT if !COLDFIRE
+        select DMA_DIRECT_REMAP if HAS_DMA && MMU && !COLDFIRE
         select HAVE_IDE
         select HAVE_AOUT if MMU
         select HAVE_DEBUG_BUGVERBOSE
diff --git a/arch/m68k/configs/amiga_defconfig b/arch/m68k/configs/amiga_defconfig
index fea392cfcf1b..04e0f211afb3 100644
--- a/arch/m68k/configs/amiga_defconfig
+++ b/arch/m68k/configs/amiga_defconfig
@@ -71,9 +71,6 @@ CONFIG_INET_AH=m
 CONFIG_INET_ESP=m
 CONFIG_INET_ESP_OFFLOAD=m
 CONFIG_INET_IPCOMP=m
-CONFIG_INET_XFRM_MODE_TRANSPORT=m
-CONFIG_INET_XFRM_MODE_TUNNEL=m
-CONFIG_INET_XFRM_MODE_BEET=m
 CONFIG_INET_DIAG=m
 CONFIG_INET_UDP_DIAG=m
 CONFIG_INET_RAW_DIAG=m
@@ -205,7 +202,6 @@ CONFIG_IP_SET_HASH_NETNET=m
 CONFIG_IP_SET_HASH_NETPORT=m
 CONFIG_IP_SET_HASH_NETIFACE=m
 CONFIG_IP_SET_LIST_SET=m
-CONFIG_NFT_CHAIN_ROUTE_IPV4=m
 CONFIG_NFT_DUP_IPV4=m
 CONFIG_NFT_FIB_IPV4=m
 CONFIG_NF_TABLES_ARP=y
@@ -231,7 +227,6 @@ CONFIG_IP_NF_RAW=m
 CONFIG_IP_NF_ARPTABLES=m
 CONFIG_IP_NF_ARPFILTER=m
 CONFIG_IP_NF_ARP_MANGLE=m
-CONFIG_NFT_CHAIN_ROUTE_IPV6=m
 CONFIG_NFT_DUP_IPV6=m
 CONFIG_NFT_FIB_IPV6=m
 CONFIG_NF_FLOW_TABLE_IPV6=m
@@ -308,7 +303,6 @@ CONFIG_AF_KCM=m
 # CONFIG_WIRELESS is not set
 CONFIG_PSAMPLE=m
 CONFIG_NET_IFE=m
-# CONFIG_UEVENT_HELPER is not set
 CONFIG_DEVTMPFS=y
 CONFIG_DEVTMPFS_MOUNT=y
 CONFIG_TEST_ASYNC_DRIVER_PROBE=m
@@ -436,6 +430,8 @@ CONFIG_FB_AMIGA_OCS=y
 CONFIG_FB_AMIGA_ECS=y
 CONFIG_FB_AMIGA_AGA=y
 CONFIG_FB_FM2=y
+# CONFIG_LCD_CLASS_DEVICE is not set
+# CONFIG_BACKLIGHT_CLASS_DEVICE is not set
 CONFIG_FRAMEBUFFER_CONSOLE=y
 CONFIG_LOGO=y
 CONFIG_SOUND=m
@@ -553,13 +549,14 @@ CONFIG_NLS_MAC_TURKISH=m
 CONFIG_DLM=m
 CONFIG_ENCRYPTED_KEYS=m
 CONFIG_HARDENED_USERCOPY=y
-CONFIG_CRYPTO_RSA=m
-CONFIG_CRYPTO_DH=m
-CONFIG_CRYPTO_ECDH=m
 CONFIG_CRYPTO_MANAGER=y
 CONFIG_CRYPTO_USER=m
 CONFIG_CRYPTO_CRYPTD=m
 CONFIG_CRYPTO_TEST=m
+CONFIG_CRYPTO_RSA=m
+CONFIG_CRYPTO_DH=m
+CONFIG_CRYPTO_ECDH=m
+CONFIG_CRYPTO_ECRDSA=m
 CONFIG_CRYPTO_CHACHA20POLY1305=m
 CONFIG_CRYPTO_AEGIS128=m
 CONFIG_CRYPTO_AEGIS128L=m
@@ -583,7 +580,6 @@ CONFIG_CRYPTO_RMD256=m
 CONFIG_CRYPTO_RMD320=m
 CONFIG_CRYPTO_SHA3=m
 CONFIG_CRYPTO_SM3=m
-CONFIG_CRYPTO_STREEBOG=m
 CONFIG_CRYPTO_TGR192=m
 CONFIG_CRYPTO_WP512=m
 CONFIG_CRYPTO_AES_TI=m
@@ -626,6 +622,7 @@ CONFIG_ATOMIC64_SELFTEST=m
 CONFIG_ASYNC_RAID6_TEST=m
 CONFIG_TEST_HEXDUMP=m
 CONFIG_TEST_STRING_HELPERS=m
+CONFIG_TEST_STRSCPY=m
 CONFIG_TEST_KSTRTOX=m
 CONFIG_TEST_PRINTF=m
 CONFIG_TEST_BITMAP=m
diff --git a/arch/m68k/configs/apollo_defconfig b/arch/m68k/configs/apollo_defconfig
index 2474d267460e..c6abbb535878 100644
--- a/arch/m68k/configs/apollo_defconfig
+++ b/arch/m68k/configs/apollo_defconfig
@@ -67,9 +67,6 @@ CONFIG_INET_AH=m
 CONFIG_INET_ESP=m
 CONFIG_INET_ESP_OFFLOAD=m
 CONFIG_INET_IPCOMP=m
-CONFIG_INET_XFRM_MODE_TRANSPORT=m
-CONFIG_INET_XFRM_MODE_TUNNEL=m
-CONFIG_INET_XFRM_MODE_BEET=m
 CONFIG_INET_DIAG=m
 CONFIG_INET_UDP_DIAG=m
 CONFIG_INET_RAW_DIAG=m
@@ -201,7 +198,6 @@ CONFIG_IP_SET_HASH_NETNET=m
 CONFIG_IP_SET_HASH_NETPORT=m
 CONFIG_IP_SET_HASH_NETIFACE=m
 CONFIG_IP_SET_LIST_SET=m
-CONFIG_NFT_CHAIN_ROUTE_IPV4=m
 CONFIG_NFT_DUP_IPV4=m
 CONFIG_NFT_FIB_IPV4=m
 CONFIG_NF_TABLES_ARP=y
@@ -227,7 +223,6 @@ CONFIG_IP_NF_RAW=m
 CONFIG_IP_NF_ARPTABLES=m
 CONFIG_IP_NF_ARPFILTER=m
 CONFIG_IP_NF_ARP_MANGLE=m
-CONFIG_NFT_CHAIN_ROUTE_IPV6=m
 CONFIG_NFT_DUP_IPV6=m
 CONFIG_NFT_FIB_IPV6=m
 CONFIG_NF_FLOW_TABLE_IPV6=m
@@ -304,7 +299,6 @@ CONFIG_AF_KCM=m
 # CONFIG_WIRELESS is not set
 CONFIG_PSAMPLE=m
 CONFIG_NET_IFE=m
-# CONFIG_UEVENT_HELPER is not set
 CONFIG_DEVTMPFS=y
 CONFIG_DEVTMPFS_MOUNT=y
 CONFIG_TEST_ASYNC_DRIVER_PROBE=m
@@ -397,6 +391,8 @@ CONFIG_PPS_CLIENT_LDISC=m
 CONFIG_PTP_1588_CLOCK=m
 # CONFIG_HWMON is not set
 CONFIG_FB=y
+# CONFIG_LCD_CLASS_DEVICE is not set
+# CONFIG_BACKLIGHT_CLASS_DEVICE is not set
 CONFIG_FRAMEBUFFER_CONSOLE=y
 CONFIG_LOGO=y
 # CONFIG_LOGO_LINUX_VGA16 is not set
@@ -513,13 +509,14 @@ CONFIG_NLS_MAC_TURKISH=m
 CONFIG_DLM=m
 CONFIG_ENCRYPTED_KEYS=m
 CONFIG_HARDENED_USERCOPY=y
-CONFIG_CRYPTO_RSA=m
-CONFIG_CRYPTO_DH=m
-CONFIG_CRYPTO_ECDH=m
 CONFIG_CRYPTO_MANAGER=y
 CONFIG_CRYPTO_USER=m
 CONFIG_CRYPTO_CRYPTD=m
 CONFIG_CRYPTO_TEST=m
+CONFIG_CRYPTO_RSA=m
+CONFIG_CRYPTO_DH=m
+CONFIG_CRYPTO_ECDH=m
+CONFIG_CRYPTO_ECRDSA=m
 CONFIG_CRYPTO_CHACHA20POLY1305=m
 CONFIG_CRYPTO_AEGIS128=m
 CONFIG_CRYPTO_AEGIS128L=m
@@ -543,7 +540,6 @@ CONFIG_CRYPTO_RMD256=m
 CONFIG_CRYPTO_RMD320=m
 CONFIG_CRYPTO_SHA3=m
 CONFIG_CRYPTO_SM3=m
-CONFIG_CRYPTO_STREEBOG=m
 CONFIG_CRYPTO_TGR192=m
 CONFIG_CRYPTO_WP512=m
 CONFIG_CRYPTO_AES_TI=m
@@ -586,6 +582,7 @@ CONFIG_ATOMIC64_SELFTEST=m
 CONFIG_ASYNC_RAID6_TEST=m
 CONFIG_TEST_HEXDUMP=m
 CONFIG_TEST_STRING_HELPERS=m
+CONFIG_TEST_STRSCPY=m
 CONFIG_TEST_KSTRTOX=m
 CONFIG_TEST_PRINTF=m
 CONFIG_TEST_BITMAP=m
diff --git a/arch/m68k/configs/atari_defconfig b/arch/m68k/configs/atari_defconfig
index 0fc7d2992fe0..06ae65bad177 100644
--- a/arch/m68k/configs/atari_defconfig
+++ b/arch/m68k/configs/atari_defconfig
@@ -74,9 +74,6 @@ CONFIG_INET_AH=m
 CONFIG_INET_ESP=m
 CONFIG_INET_ESP_OFFLOAD=m
 CONFIG_INET_IPCOMP=m
-CONFIG_INET_XFRM_MODE_TRANSPORT=m
-CONFIG_INET_XFRM_MODE_TUNNEL=m
-CONFIG_INET_XFRM_MODE_BEET=m
 CONFIG_INET_DIAG=m
 CONFIG_INET_UDP_DIAG=m
 CONFIG_INET_RAW_DIAG=m
@@ -208,7 +205,6 @@ CONFIG_IP_SET_HASH_NETNET=m
 CONFIG_IP_SET_HASH_NETPORT=m
 CONFIG_IP_SET_HASH_NETIFACE=m
 CONFIG_IP_SET_LIST_SET=m
-CONFIG_NFT_CHAIN_ROUTE_IPV4=m
 CONFIG_NFT_DUP_IPV4=m
 CONFIG_NFT_FIB_IPV4=m
 CONFIG_NF_TABLES_ARP=y
@@ -234,7 +230,6 @@ CONFIG_IP_NF_RAW=m
 CONFIG_IP_NF_ARPTABLES=m
 CONFIG_IP_NF_ARPFILTER=m
 CONFIG_IP_NF_ARP_MANGLE=m
-CONFIG_NFT_CHAIN_ROUTE_IPV6=m
 CONFIG_NFT_DUP_IPV6=m
 CONFIG_NFT_FIB_IPV6=m
 CONFIG_NF_FLOW_TABLE_IPV6=m
@@ -311,7 +306,6 @@ CONFIG_AF_KCM=m
 # CONFIG_WIRELESS is not set
 CONFIG_PSAMPLE=m
 CONFIG_NET_IFE=m
-# CONFIG_UEVENT_HELPER is not set
 CONFIG_DEVTMPFS=y
 CONFIG_DEVTMPFS_MOUNT=y
 CONFIG_TEST_ASYNC_DRIVER_PROBE=m
@@ -421,6 +415,8 @@ CONFIG_PTP_1588_CLOCK=m
 # CONFIG_HWMON is not set
 CONFIG_FB=y
 CONFIG_FB_ATARI=y
+# CONFIG_LCD_CLASS_DEVICE is not set
+# CONFIG_BACKLIGHT_CLASS_DEVICE is not set
 CONFIG_FRAMEBUFFER_CONSOLE=y
 CONFIG_LOGO=y
 CONFIG_SOUND=m
@@ -535,13 +531,14 @@ CONFIG_NLS_MAC_TURKISH=m
 CONFIG_DLM=m
 CONFIG_ENCRYPTED_KEYS=m
 CONFIG_HARDENED_USERCOPY=y
-CONFIG_CRYPTO_RSA=m
-CONFIG_CRYPTO_DH=m
-CONFIG_CRYPTO_ECDH=m
 CONFIG_CRYPTO_MANAGER=y
 CONFIG_CRYPTO_USER=m
 CONFIG_CRYPTO_CRYPTD=m
 CONFIG_CRYPTO_TEST=m
+CONFIG_CRYPTO_RSA=m
+CONFIG_CRYPTO_DH=m
+CONFIG_CRYPTO_ECDH=m
+CONFIG_CRYPTO_ECRDSA=m
 CONFIG_CRYPTO_CHACHA20POLY1305=m
 CONFIG_CRYPTO_AEGIS128=m
 CONFIG_CRYPTO_AEGIS128L=m
@@ -565,7 +562,6 @@ CONFIG_CRYPTO_RMD256=m
 CONFIG_CRYPTO_RMD320=m
 CONFIG_CRYPTO_SHA3=m
 CONFIG_CRYPTO_SM3=m
-CONFIG_CRYPTO_STREEBOG=m
 CONFIG_CRYPTO_TGR192=m
 CONFIG_CRYPTO_WP512=m
 CONFIG_CRYPTO_AES_TI=m
@@ -608,6 +604,7 @@ CONFIG_ATOMIC64_SELFTEST=m
 CONFIG_ASYNC_RAID6_TEST=m
 CONFIG_TEST_HEXDUMP=m
 CONFIG_TEST_STRING_HELPERS=m
+CONFIG_TEST_STRSCPY=m
 CONFIG_TEST_KSTRTOX=m
 CONFIG_TEST_PRINTF=m
 CONFIG_TEST_BITMAP=m
diff --git a/arch/m68k/configs/bvme6000_defconfig b/arch/m68k/configs/bvme6000_defconfig
index 699df9fdf866..5616b94053b6 100644
--- a/arch/m68k/configs/bvme6000_defconfig
+++ b/arch/m68k/configs/bvme6000_defconfig
@@ -64,9 +64,6 @@ CONFIG_INET_AH=m
 CONFIG_INET_ESP=m
 CONFIG_INET_ESP_OFFLOAD=m
 CONFIG_INET_IPCOMP=m
-CONFIG_INET_XFRM_MODE_TRANSPORT=m
-CONFIG_INET_XFRM_MODE_TUNNEL=m
-CONFIG_INET_XFRM_MODE_BEET=m
 CONFIG_INET_DIAG=m
 CONFIG_INET_UDP_DIAG=m
 CONFIG_INET_RAW_DIAG=m
@@ -198,7 +195,6 @@ CONFIG_IP_SET_HASH_NETNET=m
 CONFIG_IP_SET_HASH_NETPORT=m
 CONFIG_IP_SET_HASH_NETIFACE=m
 CONFIG_IP_SET_LIST_SET=m
-CONFIG_NFT_CHAIN_ROUTE_IPV4=m
 CONFIG_NFT_DUP_IPV4=m
 CONFIG_NFT_FIB_IPV4=m
 CONFIG_NF_TABLES_ARP=y
@@ -224,7 +220,6 @@ CONFIG_IP_NF_RAW=m
 CONFIG_IP_NF_ARPTABLES=m
 CONFIG_IP_NF_ARPFILTER=m
 CONFIG_IP_NF_ARP_MANGLE=m
-CONFIG_NFT_CHAIN_ROUTE_IPV6=m
 CONFIG_NFT_DUP_IPV6=m
 CONFIG_NFT_FIB_IPV6=m
 CONFIG_NF_FLOW_TABLE_IPV6=m
@@ -301,7 +296,6 @@ CONFIG_AF_KCM=m
 # CONFIG_WIRELESS is not set
 CONFIG_PSAMPLE=m
 CONFIG_NET_IFE=m
-# CONFIG_UEVENT_HELPER is not set
 CONFIG_DEVTMPFS=y
 CONFIG_DEVTMPFS_MOUNT=y
 CONFIG_TEST_ASYNC_DRIVER_PROBE=m
@@ -394,6 +388,8 @@ CONFIG_NTP_PPS=y
 CONFIG_PPS_CLIENT_LDISC=m
 CONFIG_PTP_1588_CLOCK=m
 # CONFIG_HWMON is not set
+# CONFIG_LCD_CLASS_DEVICE is not set
+# CONFIG_BACKLIGHT_CLASS_DEVICE is not set
 CONFIG_HID=m
 CONFIG_HIDRAW=y
 CONFIG_UHID=m
@@ -506,13 +502,14 @@ CONFIG_NLS_MAC_TURKISH=m
 CONFIG_DLM=m
 CONFIG_ENCRYPTED_KEYS=m
 CONFIG_HARDENED_USERCOPY=y
-CONFIG_CRYPTO_RSA=m
-CONFIG_CRYPTO_DH=m
-CONFIG_CRYPTO_ECDH=m
 CONFIG_CRYPTO_MANAGER=y
 CONFIG_CRYPTO_USER=m
 CONFIG_CRYPTO_CRYPTD=m
 CONFIG_CRYPTO_TEST=m
+CONFIG_CRYPTO_RSA=m
+CONFIG_CRYPTO_DH=m
+CONFIG_CRYPTO_ECDH=m
+CONFIG_CRYPTO_ECRDSA=m
 CONFIG_CRYPTO_CHACHA20POLY1305=m
 CONFIG_CRYPTO_AEGIS128=m
 CONFIG_CRYPTO_AEGIS128L=m
@@ -536,7 +533,6 @@ CONFIG_CRYPTO_RMD256=m
 CONFIG_CRYPTO_RMD320=m
 CONFIG_CRYPTO_SHA3=m
 CONFIG_CRYPTO_SM3=m
-CONFIG_CRYPTO_STREEBOG=m
 CONFIG_CRYPTO_TGR192=m
 CONFIG_CRYPTO_WP512=m
 CONFIG_CRYPTO_AES_TI=m
@@ -579,6 +575,7 @@ CONFIG_ATOMIC64_SELFTEST=m
 CONFIG_ASYNC_RAID6_TEST=m
 CONFIG_TEST_HEXDUMP=m
 CONFIG_TEST_STRING_HELPERS=m
+CONFIG_TEST_STRSCPY=m
 CONFIG_TEST_KSTRTOX=m
 CONFIG_TEST_PRINTF=m
 CONFIG_TEST_BITMAP=m
diff --git a/arch/m68k/configs/hp300_defconfig b/arch/m68k/configs/hp300_defconfig
index b50802255324..1106521f3b56 100644
--- a/arch/m68k/configs/hp300_defconfig
+++ b/arch/m68k/configs/hp300_defconfig
@@ -66,9 +66,6 @@ CONFIG_INET_AH=m
 CONFIG_INET_ESP=m
 CONFIG_INET_ESP_OFFLOAD=m
 CONFIG_INET_IPCOMP=m
-CONFIG_INET_XFRM_MODE_TRANSPORT=m
-CONFIG_INET_XFRM_MODE_TUNNEL=m
-CONFIG_INET_XFRM_MODE_BEET=m
 CONFIG_INET_DIAG=m
 CONFIG_INET_UDP_DIAG=m
 CONFIG_INET_RAW_DIAG=m
@@ -200,7 +197,6 @@ CONFIG_IP_SET_HASH_NETNET=m
 CONFIG_IP_SET_HASH_NETPORT=m
 CONFIG_IP_SET_HASH_NETIFACE=m
 CONFIG_IP_SET_LIST_SET=m
-CONFIG_NFT_CHAIN_ROUTE_IPV4=m
 CONFIG_NFT_DUP_IPV4=m
 CONFIG_NFT_FIB_IPV4=m
 CONFIG_NF_TABLES_ARP=y
@@ -226,7 +222,6 @@ CONFIG_IP_NF_RAW=m
 CONFIG_IP_NF_ARPTABLES=m
 CONFIG_IP_NF_ARPFILTER=m
 CONFIG_IP_NF_ARP_MANGLE=m
-CONFIG_NFT_CHAIN_ROUTE_IPV6=m
 CONFIG_NFT_DUP_IPV6=m
 CONFIG_NFT_FIB_IPV6=m
 CONFIG_NF_FLOW_TABLE_IPV6=m
@@ -303,7 +298,6 @@ CONFIG_AF_KCM=m
 # CONFIG_WIRELESS is not set
 CONFIG_PSAMPLE=m
 CONFIG_NET_IFE=m
-# CONFIG_UEVENT_HELPER is not set
 CONFIG_DEVTMPFS=y
 CONFIG_DEVTMPFS_MOUNT=y
 CONFIG_TEST_ASYNC_DRIVER_PROBE=m
@@ -399,6 +393,8 @@ CONFIG_PPS_CLIENT_LDISC=m
 CONFIG_PTP_1588_CLOCK=m
 # CONFIG_HWMON is not set
 CONFIG_FB=y
+# CONFIG_LCD_CLASS_DEVICE is not set
+# CONFIG_BACKLIGHT_CLASS_DEVICE is not set
 CONFIG_FRAMEBUFFER_CONSOLE=y
 CONFIG_LOGO=y
 # CONFIG_LOGO_LINUX_MONO is not set
@@ -515,13 +511,14 @@ CONFIG_NLS_MAC_TURKISH=m
 CONFIG_DLM=m
 CONFIG_ENCRYPTED_KEYS=m
 CONFIG_HARDENED_USERCOPY=y
-CONFIG_CRYPTO_RSA=m
-CONFIG_CRYPTO_DH=m
-CONFIG_CRYPTO_ECDH=m
 CONFIG_CRYPTO_MANAGER=y
 CONFIG_CRYPTO_USER=m
 CONFIG_CRYPTO_CRYPTD=m
 CONFIG_CRYPTO_TEST=m
+CONFIG_CRYPTO_RSA=m
+CONFIG_CRYPTO_DH=m
+CONFIG_CRYPTO_ECDH=m
+CONFIG_CRYPTO_ECRDSA=m
 CONFIG_CRYPTO_CHACHA20POLY1305=m
 CONFIG_CRYPTO_AEGIS128=m
 CONFIG_CRYPTO_AEGIS128L=m
@@ -545,7 +542,6 @@ CONFIG_CRYPTO_RMD256=m
 CONFIG_CRYPTO_RMD320=m
 CONFIG_CRYPTO_SHA3=m
 CONFIG_CRYPTO_SM3=m
-CONFIG_CRYPTO_STREEBOG=m
 CONFIG_CRYPTO_TGR192=m
 CONFIG_CRYPTO_WP512=m
 CONFIG_CRYPTO_AES_TI=m
@@ -588,6 +584,7 @@ CONFIG_ATOMIC64_SELFTEST=m
 CONFIG_ASYNC_RAID6_TEST=m
 CONFIG_TEST_HEXDUMP=m
 CONFIG_TEST_STRING_HELPERS=m
+CONFIG_TEST_STRSCPY=m
 CONFIG_TEST_KSTRTOX=m
 CONFIG_TEST_PRINTF=m
 CONFIG_TEST_BITMAP=m
diff --git a/arch/m68k/configs/mac_defconfig b/arch/m68k/configs/mac_defconfig
index 04e7d70f6030..226c6c063cd4 100644
--- a/arch/m68k/configs/mac_defconfig
+++ b/arch/m68k/configs/mac_defconfig
@@ -65,9 +65,6 @@ CONFIG_INET_AH=m
 CONFIG_INET_ESP=m
 CONFIG_INET_ESP_OFFLOAD=m
 CONFIG_INET_IPCOMP=m
-CONFIG_INET_XFRM_MODE_TRANSPORT=m
-CONFIG_INET_XFRM_MODE_TUNNEL=m
-CONFIG_INET_XFRM_MODE_BEET=m
 CONFIG_INET_DIAG=m
 CONFIG_INET_UDP_DIAG=m
 CONFIG_INET_RAW_DIAG=m
@@ -199,7 +196,6 @@ CONFIG_IP_SET_HASH_NETNET=m
 CONFIG_IP_SET_HASH_NETPORT=m
 CONFIG_IP_SET_HASH_NETIFACE=m
 CONFIG_IP_SET_LIST_SET=m
-CONFIG_NFT_CHAIN_ROUTE_IPV4=m
 CONFIG_NFT_DUP_IPV4=m
 CONFIG_NFT_FIB_IPV4=m
 CONFIG_NF_TABLES_ARP=y
@@ -225,7 +221,6 @@ CONFIG_IP_NF_RAW=m
 CONFIG_IP_NF_ARPTABLES=m
 CONFIG_IP_NF_ARPFILTER=m
 CONFIG_IP_NF_ARP_MANGLE=m
-CONFIG_NFT_CHAIN_ROUTE_IPV6=m
 CONFIG_NFT_DUP_IPV6=m
 CONFIG_NFT_FIB_IPV6=m
 CONFIG_NF_FLOW_TABLE_IPV6=m
@@ -305,7 +300,6 @@ CONFIG_AF_KCM=m
 # CONFIG_WIRELESS is not set
 CONFIG_PSAMPLE=m
 CONFIG_NET_IFE=m
-# CONFIG_UEVENT_HELPER is not set
 CONFIG_DEVTMPFS=y
 CONFIG_DEVTMPFS_MOUNT=y
 CONFIG_TEST_ASYNC_DRIVER_PROBE=m
@@ -423,6 +417,8 @@ CONFIG_PTP_1588_CLOCK=m
 CONFIG_FB=y
 CONFIG_FB_VALKYRIE=y
 CONFIG_FB_MAC=y
+# CONFIG_LCD_CLASS_DEVICE is not set
+# CONFIG_BACKLIGHT_CLASS_DEVICE is not set
 CONFIG_FRAMEBUFFER_CONSOLE=y
 CONFIG_LOGO=y
 CONFIG_HID=m
@@ -537,13 +533,14 @@ CONFIG_NLS_MAC_TURKISH=m
 CONFIG_DLM=m
 CONFIG_ENCRYPTED_KEYS=m
 CONFIG_HARDENED_USERCOPY=y
-CONFIG_CRYPTO_RSA=m
-CONFIG_CRYPTO_DH=m
-CONFIG_CRYPTO_ECDH=m
 CONFIG_CRYPTO_MANAGER=y
 CONFIG_CRYPTO_USER=m
 CONFIG_CRYPTO_CRYPTD=m
 CONFIG_CRYPTO_TEST=m
+CONFIG_CRYPTO_RSA=m
+CONFIG_CRYPTO_DH=m
+CONFIG_CRYPTO_ECDH=m
+CONFIG_CRYPTO_ECRDSA=m
 CONFIG_CRYPTO_CHACHA20POLY1305=m
 CONFIG_CRYPTO_AEGIS128=m
 CONFIG_CRYPTO_AEGIS128L=m
@@ -567,7 +564,6 @@ CONFIG_CRYPTO_RMD256=m
 CONFIG_CRYPTO_RMD320=m
 CONFIG_CRYPTO_SHA3=m
 CONFIG_CRYPTO_SM3=m
-CONFIG_CRYPTO_STREEBOG=m
 CONFIG_CRYPTO_TGR192=m
 CONFIG_CRYPTO_WP512=m
 CONFIG_CRYPTO_AES_TI=m
@@ -610,6 +606,7 @@ CONFIG_ATOMIC64_SELFTEST=m
 CONFIG_ASYNC_RAID6_TEST=m
 CONFIG_TEST_HEXDUMP=m
 CONFIG_TEST_STRING_HELPERS=m
+CONFIG_TEST_STRSCPY=m
 CONFIG_TEST_KSTRTOX=m
 CONFIG_TEST_PRINTF=m
 CONFIG_TEST_BITMAP=m
diff --git a/arch/m68k/configs/multi_defconfig b/arch/m68k/configs/multi_defconfig
index 5e1cc4c17852..39f603417928 100644
--- a/arch/m68k/configs/multi_defconfig
+++ b/arch/m68k/configs/multi_defconfig
@@ -85,9 +85,6 @@ CONFIG_INET_AH=m
 CONFIG_INET_ESP=m
 CONFIG_INET_ESP_OFFLOAD=m
 CONFIG_INET_IPCOMP=m
-CONFIG_INET_XFRM_MODE_TRANSPORT=m
-CONFIG_INET_XFRM_MODE_TUNNEL=m
-CONFIG_INET_XFRM_MODE_BEET=m
 CONFIG_INET_DIAG=m
 CONFIG_INET_UDP_DIAG=m
 CONFIG_INET_RAW_DIAG=m
@@ -219,7 +216,6 @@ CONFIG_IP_SET_HASH_NETNET=m
 CONFIG_IP_SET_HASH_NETPORT=m
 CONFIG_IP_SET_HASH_NETIFACE=m
 CONFIG_IP_SET_LIST_SET=m
-CONFIG_NFT_CHAIN_ROUTE_IPV4=m
 CONFIG_NFT_DUP_IPV4=m
 CONFIG_NFT_FIB_IPV4=m
 CONFIG_NF_TABLES_ARP=y
@@ -245,7 +241,6 @@ CONFIG_IP_NF_RAW=m
 CONFIG_IP_NF_ARPTABLES=m
 CONFIG_IP_NF_ARPFILTER=m
 CONFIG_IP_NF_ARP_MANGLE=m
-CONFIG_NFT_CHAIN_ROUTE_IPV6=m
 CONFIG_NFT_DUP_IPV6=m
 CONFIG_NFT_FIB_IPV6=m
 CONFIG_NF_FLOW_TABLE_IPV6=m
@@ -325,7 +320,6 @@ CONFIG_AF_KCM=m
 # CONFIG_WIRELESS is not set
 CONFIG_PSAMPLE=m
 CONFIG_NET_IFE=m
-# CONFIG_UEVENT_HELPER is not set
 CONFIG_DEVTMPFS=y
 CONFIG_DEVTMPFS_MOUNT=y
 CONFIG_TEST_ASYNC_DRIVER_PROBE=m
@@ -499,6 +493,8 @@ CONFIG_FB_FM2=y
 CONFIG_FB_ATARI=y
 CONFIG_FB_VALKYRIE=y
 CONFIG_FB_MAC=y
+# CONFIG_LCD_CLASS_DEVICE is not set
+# CONFIG_BACKLIGHT_CLASS_DEVICE is not set
 CONFIG_FRAMEBUFFER_CONSOLE=y
 CONFIG_LOGO=y
 CONFIG_SOUND=m
@@ -619,13 +615,14 @@ CONFIG_NLS_MAC_TURKISH=m
 CONFIG_DLM=m
 CONFIG_ENCRYPTED_KEYS=m
 CONFIG_HARDENED_USERCOPY=y
-CONFIG_CRYPTO_RSA=m
-CONFIG_CRYPTO_DH=m
-CONFIG_CRYPTO_ECDH=m
 CONFIG_CRYPTO_MANAGER=y
 CONFIG_CRYPTO_USER=m
 CONFIG_CRYPTO_CRYPTD=m
 CONFIG_CRYPTO_TEST=m
+CONFIG_CRYPTO_RSA=m
+CONFIG_CRYPTO_DH=m
+CONFIG_CRYPTO_ECDH=m
+CONFIG_CRYPTO_ECRDSA=m
 CONFIG_CRYPTO_CHACHA20POLY1305=m
 CONFIG_CRYPTO_AEGIS128=m
 CONFIG_CRYPTO_AEGIS128L=m
@@ -649,7 +646,6 @@ CONFIG_CRYPTO_RMD256=m
 CONFIG_CRYPTO_RMD320=m
 CONFIG_CRYPTO_SHA3=m
 CONFIG_CRYPTO_SM3=m
-CONFIG_CRYPTO_STREEBOG=m
 CONFIG_CRYPTO_TGR192=m
 CONFIG_CRYPTO_WP512=m
 CONFIG_CRYPTO_AES_TI=m
@@ -692,6 +688,7 @@ CONFIG_ATOMIC64_SELFTEST=m
 CONFIG_ASYNC_RAID6_TEST=m
 CONFIG_TEST_HEXDUMP=m
 CONFIG_TEST_STRING_HELPERS=m
+CONFIG_TEST_STRSCPY=m
 CONFIG_TEST_KSTRTOX=m
 CONFIG_TEST_PRINTF=m
 CONFIG_TEST_BITMAP=m
diff --git a/arch/m68k/configs/mvme147_defconfig b/arch/m68k/configs/mvme147_defconfig
index 170ac8792c2d..175a607f576c 100644
--- a/arch/m68k/configs/mvme147_defconfig
+++ b/arch/m68k/configs/mvme147_defconfig
@@ -63,9 +63,6 @@ CONFIG_INET_AH=m
 CONFIG_INET_ESP=m
 CONFIG_INET_ESP_OFFLOAD=m
 CONFIG_INET_IPCOMP=m
-CONFIG_INET_XFRM_MODE_TRANSPORT=m
-CONFIG_INET_XFRM_MODE_TUNNEL=m
-CONFIG_INET_XFRM_MODE_BEET=m
 CONFIG_INET_DIAG=m
 CONFIG_INET_UDP_DIAG=m
 CONFIG_INET_RAW_DIAG=m
@@ -197,7 +194,6 @@ CONFIG_IP_SET_HASH_NETNET=m
 CONFIG_IP_SET_HASH_NETPORT=m
 CONFIG_IP_SET_HASH_NETIFACE=m
 CONFIG_IP_SET_LIST_SET=m
-CONFIG_NFT_CHAIN_ROUTE_IPV4=m
 CONFIG_NFT_DUP_IPV4=m
 CONFIG_NFT_FIB_IPV4=m
 CONFIG_NF_TABLES_ARP=y
@@ -223,7 +219,6 @@ CONFIG_IP_NF_RAW=m
 CONFIG_IP_NF_ARPTABLES=m
 CONFIG_IP_NF_ARPFILTER=m
 CONFIG_IP_NF_ARP_MANGLE=m
-CONFIG_NFT_CHAIN_ROUTE_IPV6=m
 CONFIG_NFT_DUP_IPV6=m
 CONFIG_NFT_FIB_IPV6=m
 CONFIG_NF_FLOW_TABLE_IPV6=m
@@ -300,7 +295,6 @@ CONFIG_AF_KCM=m
 # CONFIG_WIRELESS is not set
 CONFIG_PSAMPLE=m
 CONFIG_NET_IFE=m
-# CONFIG_UEVENT_HELPER is not set
 CONFIG_DEVTMPFS=y
 CONFIG_DEVTMPFS_MOUNT=y
 CONFIG_TEST_ASYNC_DRIVER_PROBE=m
@@ -393,6 +387,8 @@ CONFIG_NTP_PPS=y
 CONFIG_PPS_CLIENT_LDISC=m
 CONFIG_PTP_1588_CLOCK=m
 # CONFIG_HWMON is not set
+# CONFIG_LCD_CLASS_DEVICE is not set
+# CONFIG_BACKLIGHT_CLASS_DEVICE is not set
 CONFIG_HID=m
 CONFIG_HIDRAW=y
 CONFIG_UHID=m
@@ -505,13 +501,14 @@ CONFIG_NLS_MAC_TURKISH=m
 CONFIG_DLM=m
 CONFIG_ENCRYPTED_KEYS=m
 CONFIG_HARDENED_USERCOPY=y
-CONFIG_CRYPTO_RSA=m
-CONFIG_CRYPTO_DH=m
-CONFIG_CRYPTO_ECDH=m
 CONFIG_CRYPTO_MANAGER=y
 CONFIG_CRYPTO_USER=m
 CONFIG_CRYPTO_CRYPTD=m
 CONFIG_CRYPTO_TEST=m
+CONFIG_CRYPTO_RSA=m
+CONFIG_CRYPTO_DH=m
+CONFIG_CRYPTO_ECDH=m
+CONFIG_CRYPTO_ECRDSA=m
 CONFIG_CRYPTO_CHACHA20POLY1305=m
 CONFIG_CRYPTO_AEGIS128=m
 CONFIG_CRYPTO_AEGIS128L=m
@@ -535,7 +532,6 @@ CONFIG_CRYPTO_RMD256=m
 CONFIG_CRYPTO_RMD320=m
 CONFIG_CRYPTO_SHA3=m
 CONFIG_CRYPTO_SM3=m
-CONFIG_CRYPTO_STREEBOG=m
 CONFIG_CRYPTO_TGR192=m
 CONFIG_CRYPTO_WP512=m
 CONFIG_CRYPTO_AES_TI=m
@@ -578,6 +574,7 @@ CONFIG_ATOMIC64_SELFTEST=m
 CONFIG_ASYNC_RAID6_TEST=m
 CONFIG_TEST_HEXDUMP=m
 CONFIG_TEST_STRING_HELPERS=m
+CONFIG_TEST_STRSCPY=m
 CONFIG_TEST_KSTRTOX=m
 CONFIG_TEST_PRINTF=m
 CONFIG_TEST_BITMAP=m
diff --git a/arch/m68k/configs/mvme16x_defconfig b/arch/m68k/configs/mvme16x_defconfig
index d865592a423e..f41c34d3cdd0 100644
--- a/arch/m68k/configs/mvme16x_defconfig
+++ b/arch/m68k/configs/mvme16x_defconfig
@@ -64,9 +64,6 @@ CONFIG_INET_AH=m
 CONFIG_INET_ESP=m
 CONFIG_INET_ESP_OFFLOAD=m
 CONFIG_INET_IPCOMP=m
-CONFIG_INET_XFRM_MODE_TRANSPORT=m
-CONFIG_INET_XFRM_MODE_TUNNEL=m
-CONFIG_INET_XFRM_MODE_BEET=m
 CONFIG_INET_DIAG=m
 CONFIG_INET_UDP_DIAG=m
 CONFIG_INET_RAW_DIAG=m
@@ -198,7 +195,6 @@ CONFIG_IP_SET_HASH_NETNET=m
 CONFIG_IP_SET_HASH_NETPORT=m
 CONFIG_IP_SET_HASH_NETIFACE=m
 CONFIG_IP_SET_LIST_SET=m
-CONFIG_NFT_CHAIN_ROUTE_IPV4=m
 CONFIG_NFT_DUP_IPV4=m
 CONFIG_NFT_FIB_IPV4=m
 CONFIG_NF_TABLES_ARP=y
@@ -224,7 +220,6 @@ CONFIG_IP_NF_RAW=m
 CONFIG_IP_NF_ARPTABLES=m
 CONFIG_IP_NF_ARPFILTER=m
 CONFIG_IP_NF_ARP_MANGLE=m
-CONFIG_NFT_CHAIN_ROUTE_IPV6=m
 CONFIG_NFT_DUP_IPV6=m
 CONFIG_NFT_FIB_IPV6=m
 CONFIG_NF_FLOW_TABLE_IPV6=m
@@ -301,7 +296,6 @@ CONFIG_AF_KCM=m
 # CONFIG_WIRELESS is not set
 CONFIG_PSAMPLE=m
 CONFIG_NET_IFE=m
-# CONFIG_UEVENT_HELPER is not set
 CONFIG_DEVTMPFS=y
 CONFIG_DEVTMPFS_MOUNT=y
 CONFIG_TEST_ASYNC_DRIVER_PROBE=m
@@ -394,6 +388,8 @@ CONFIG_NTP_PPS=y
 CONFIG_PPS_CLIENT_LDISC=m
 CONFIG_PTP_1588_CLOCK=m
 # CONFIG_HWMON is not set
+# CONFIG_LCD_CLASS_DEVICE is not set
+# CONFIG_BACKLIGHT_CLASS_DEVICE is not set
 CONFIG_HID=m
 CONFIG_HIDRAW=y
 CONFIG_UHID=m
@@ -506,13 +502,14 @@ CONFIG_NLS_MAC_TURKISH=m
 CONFIG_DLM=m
 CONFIG_ENCRYPTED_KEYS=m
 CONFIG_HARDENED_USERCOPY=y
-CONFIG_CRYPTO_RSA=m
-CONFIG_CRYPTO_DH=m
-CONFIG_CRYPTO_ECDH=m
 CONFIG_CRYPTO_MANAGER=y
 CONFIG_CRYPTO_USER=m
 CONFIG_CRYPTO_CRYPTD=m
 CONFIG_CRYPTO_TEST=m
+CONFIG_CRYPTO_RSA=m
+CONFIG_CRYPTO_DH=m
+CONFIG_CRYPTO_ECDH=m
+CONFIG_CRYPTO_ECRDSA=m
 CONFIG_CRYPTO_CHACHA20POLY1305=m
 CONFIG_CRYPTO_AEGIS128=m
 CONFIG_CRYPTO_AEGIS128L=m
@@ -536,7 +533,6 @@ CONFIG_CRYPTO_RMD256=m
 CONFIG_CRYPTO_RMD320=m
 CONFIG_CRYPTO_SHA3=m
 CONFIG_CRYPTO_SM3=m
-CONFIG_CRYPTO_STREEBOG=m
 CONFIG_CRYPTO_TGR192=m
 CONFIG_CRYPTO_WP512=m
 CONFIG_CRYPTO_AES_TI=m
@@ -579,6 +575,7 @@ CONFIG_ATOMIC64_SELFTEST=m
 CONFIG_ASYNC_RAID6_TEST=m
 CONFIG_TEST_HEXDUMP=m
 CONFIG_TEST_STRING_HELPERS=m
+CONFIG_TEST_STRSCPY=m
 CONFIG_TEST_KSTRTOX=m
 CONFIG_TEST_PRINTF=m
 CONFIG_TEST_BITMAP=m
diff --git a/arch/m68k/configs/q40_defconfig b/arch/m68k/configs/q40_defconfig
index 034a9de90484..c9d2cb0a1cf4 100644
--- a/arch/m68k/configs/q40_defconfig
+++ b/arch/m68k/configs/q40_defconfig
@@ -65,9 +65,6 @@ CONFIG_INET_AH=m
 CONFIG_INET_ESP=m
 CONFIG_INET_ESP_OFFLOAD=m
 CONFIG_INET_IPCOMP=m
-CONFIG_INET_XFRM_MODE_TRANSPORT=m
-CONFIG_INET_XFRM_MODE_TUNNEL=m
-CONFIG_INET_XFRM_MODE_BEET=m
 CONFIG_INET_DIAG=m
 CONFIG_INET_UDP_DIAG=m
 CONFIG_INET_RAW_DIAG=m
@@ -199,7 +196,6 @@ CONFIG_IP_SET_HASH_NETNET=m
 CONFIG_IP_SET_HASH_NETPORT=m
 CONFIG_IP_SET_HASH_NETIFACE=m
 CONFIG_IP_SET_LIST_SET=m
-CONFIG_NFT_CHAIN_ROUTE_IPV4=m
 CONFIG_NFT_DUP_IPV4=m
 CONFIG_NFT_FIB_IPV4=m
 CONFIG_NF_TABLES_ARP=y
@@ -225,7 +221,6 @@ CONFIG_IP_NF_RAW=m
 CONFIG_IP_NF_ARPTABLES=m
 CONFIG_IP_NF_ARPFILTER=m
 CONFIG_IP_NF_ARP_MANGLE=m
-CONFIG_NFT_CHAIN_ROUTE_IPV6=m
 CONFIG_NFT_DUP_IPV6=m
 CONFIG_NFT_FIB_IPV6=m
 CONFIG_NF_FLOW_TABLE_IPV6=m
@@ -302,7 +297,6 @@ CONFIG_AF_KCM=m
 # CONFIG_WIRELESS is not set
 CONFIG_PSAMPLE=m
 CONFIG_NET_IFE=m
-# CONFIG_UEVENT_HELPER is not set
 CONFIG_DEVTMPFS=y
 CONFIG_DEVTMPFS_MOUNT=y
 CONFIG_TEST_ASYNC_DRIVER_PROBE=m
@@ -408,6 +402,8 @@ CONFIG_PPS_CLIENT_PARPORT=m
 CONFIG_PTP_1588_CLOCK=m
 # CONFIG_HWMON is not set
 CONFIG_FB=y
+# CONFIG_LCD_CLASS_DEVICE is not set
+# CONFIG_BACKLIGHT_CLASS_DEVICE is not set
 CONFIG_FRAMEBUFFER_CONSOLE=y
 CONFIG_LOGO=y
 CONFIG_SOUND=m
@@ -524,13 +520,14 @@ CONFIG_NLS_MAC_TURKISH=m
 CONFIG_DLM=m
 CONFIG_ENCRYPTED_KEYS=m
 CONFIG_HARDENED_USERCOPY=y
-CONFIG_CRYPTO_RSA=m
-CONFIG_CRYPTO_DH=m
-CONFIG_CRYPTO_ECDH=m
 CONFIG_CRYPTO_MANAGER=y
 CONFIG_CRYPTO_USER=m
 CONFIG_CRYPTO_CRYPTD=m
 CONFIG_CRYPTO_TEST=m
+CONFIG_CRYPTO_RSA=m
+CONFIG_CRYPTO_DH=m
+CONFIG_CRYPTO_ECDH=m
+CONFIG_CRYPTO_ECRDSA=m
 CONFIG_CRYPTO_CHACHA20POLY1305=m
 CONFIG_CRYPTO_AEGIS128=m
 CONFIG_CRYPTO_AEGIS128L=m
@@ -554,7 +551,6 @@ CONFIG_CRYPTO_RMD256=m
 CONFIG_CRYPTO_RMD320=m
 CONFIG_CRYPTO_SHA3=m
 CONFIG_CRYPTO_SM3=m
-CONFIG_CRYPTO_STREEBOG=m
 CONFIG_CRYPTO_TGR192=m
 CONFIG_CRYPTO_WP512=m
 CONFIG_CRYPTO_AES_TI=m
@@ -597,6 +593,7 @@ CONFIG_ATOMIC64_SELFTEST=m
 CONFIG_ASYNC_RAID6_TEST=m
 CONFIG_TEST_HEXDUMP=m
 CONFIG_TEST_STRING_HELPERS=m
+CONFIG_TEST_STRSCPY=m
 CONFIG_TEST_KSTRTOX=m
 CONFIG_TEST_PRINTF=m
 CONFIG_TEST_BITMAP=m
diff --git a/arch/m68k/configs/sun3_defconfig b/arch/m68k/configs/sun3_defconfig
index 49be0f9fcd8d..79a64fdd6bf0 100644
--- a/arch/m68k/configs/sun3_defconfig
+++ b/arch/m68k/configs/sun3_defconfig
@@ -61,9 +61,6 @@ CONFIG_INET_AH=m
 CONFIG_INET_ESP=m
 CONFIG_INET_ESP_OFFLOAD=m
 CONFIG_INET_IPCOMP=m
-CONFIG_INET_XFRM_MODE_TRANSPORT=m
-CONFIG_INET_XFRM_MODE_TUNNEL=m
-CONFIG_INET_XFRM_MODE_BEET=m
 CONFIG_INET_DIAG=m
 CONFIG_INET_UDP_DIAG=m
 CONFIG_INET_RAW_DIAG=m
@@ -195,7 +192,6 @@ CONFIG_IP_SET_HASH_NETNET=m
 CONFIG_IP_SET_HASH_NETPORT=m
 CONFIG_IP_SET_HASH_NETIFACE=m
 CONFIG_IP_SET_LIST_SET=m
-CONFIG_NFT_CHAIN_ROUTE_IPV4=m
 CONFIG_NFT_DUP_IPV4=m
 CONFIG_NFT_FIB_IPV4=m
 CONFIG_NF_TABLES_ARP=y
@@ -221,7 +217,6 @@ CONFIG_IP_NF_RAW=m
 CONFIG_IP_NF_ARPTABLES=m
 CONFIG_IP_NF_ARPFILTER=m
 CONFIG_IP_NF_ARP_MANGLE=m
-CONFIG_NFT_CHAIN_ROUTE_IPV6=m
 CONFIG_NFT_DUP_IPV6=m
 CONFIG_NFT_FIB_IPV6=m
 CONFIG_NF_FLOW_TABLE_IPV6=m
@@ -298,7 +293,6 @@ CONFIG_AF_KCM=m
 # CONFIG_WIRELESS is not set
 CONFIG_PSAMPLE=m
 CONFIG_NET_IFE=m
-# CONFIG_UEVENT_HELPER is not set
 CONFIG_DEVTMPFS=y
 CONFIG_DEVTMPFS_MOUNT=y
 CONFIG_TEST_ASYNC_DRIVER_PROBE=m
@@ -394,6 +388,8 @@ CONFIG_PPS_CLIENT_LDISC=m
 CONFIG_PTP_1588_CLOCK=m
 # CONFIG_HWMON is not set
 CONFIG_FB=y
+# CONFIG_LCD_CLASS_DEVICE is not set
+# CONFIG_BACKLIGHT_CLASS_DEVICE is not set
 CONFIG_FRAMEBUFFER_CONSOLE=y
 CONFIG_LOGO=y
 CONFIG_HID=m
@@ -508,13 +504,14 @@ CONFIG_NLS_MAC_TURKISH=m
 CONFIG_DLM=m
 CONFIG_ENCRYPTED_KEYS=m
 CONFIG_HARDENED_USERCOPY=y
-CONFIG_CRYPTO_RSA=m
-CONFIG_CRYPTO_DH=m
-CONFIG_CRYPTO_ECDH=m
 CONFIG_CRYPTO_MANAGER=y
 CONFIG_CRYPTO_USER=m
 CONFIG_CRYPTO_CRYPTD=m
 CONFIG_CRYPTO_TEST=m
+CONFIG_CRYPTO_RSA=m
+CONFIG_CRYPTO_DH=m
+CONFIG_CRYPTO_ECDH=m
+CONFIG_CRYPTO_ECRDSA=m
 CONFIG_CRYPTO_CHACHA20POLY1305=m
 CONFIG_CRYPTO_AEGIS128=m
 CONFIG_CRYPTO_AEGIS128L=m
@@ -538,7 +535,6 @@ CONFIG_CRYPTO_RMD256=m
 CONFIG_CRYPTO_RMD320=m
 CONFIG_CRYPTO_SHA3=m
 CONFIG_CRYPTO_SM3=m
-CONFIG_CRYPTO_STREEBOG=m
 CONFIG_CRYPTO_TGR192=m
 CONFIG_CRYPTO_WP512=m
 CONFIG_CRYPTO_AES_TI=m
@@ -581,6 +577,7 @@ CONFIG_ATOMIC64_SELFTEST=m
 CONFIG_ASYNC_RAID6_TEST=m
 CONFIG_TEST_HEXDUMP=m
 CONFIG_TEST_STRING_HELPERS=m
+CONFIG_TEST_STRSCPY=m
 CONFIG_TEST_KSTRTOX=m
 CONFIG_TEST_PRINTF=m
 CONFIG_TEST_BITMAP=m
diff --git a/arch/m68k/configs/sun3x_defconfig b/arch/m68k/configs/sun3x_defconfig
index a71acf4a6004..e3402a5d165b 100644
--- a/arch/m68k/configs/sun3x_defconfig
+++ b/arch/m68k/configs/sun3x_defconfig
@@ -61,9 +61,6 @@ CONFIG_INET_AH=m
 CONFIG_INET_ESP=m
 CONFIG_INET_ESP_OFFLOAD=m
 CONFIG_INET_IPCOMP=m
-CONFIG_INET_XFRM_MODE_TRANSPORT=m
-CONFIG_INET_XFRM_MODE_TUNNEL=m
-CONFIG_INET_XFRM_MODE_BEET=m
 CONFIG_INET_DIAG=m
 CONFIG_INET_UDP_DIAG=m
 CONFIG_INET_RAW_DIAG=m
@@ -195,7 +192,6 @@ CONFIG_IP_SET_HASH_NETNET=m
 CONFIG_IP_SET_HASH_NETPORT=m
 CONFIG_IP_SET_HASH_NETIFACE=m
 CONFIG_IP_SET_LIST_SET=m
-CONFIG_NFT_CHAIN_ROUTE_IPV4=m
 CONFIG_NFT_DUP_IPV4=m
 CONFIG_NFT_FIB_IPV4=m
 CONFIG_NF_TABLES_ARP=y
@@ -221,7 +217,6 @@ CONFIG_IP_NF_RAW=m
 CONFIG_IP_NF_ARPTABLES=m
 CONFIG_IP_NF_ARPFILTER=m
 CONFIG_IP_NF_ARP_MANGLE=m
-CONFIG_NFT_CHAIN_ROUTE_IPV6=m
 CONFIG_NFT_DUP_IPV6=m
 CONFIG_NFT_FIB_IPV6=m
 CONFIG_NF_FLOW_TABLE_IPV6=m
@@ -298,7 +293,6 @@ CONFIG_AF_KCM=m
 # CONFIG_WIRELESS is not set
 CONFIG_PSAMPLE=m
 CONFIG_NET_IFE=m
-# CONFIG_UEVENT_HELPER is not set
 CONFIG_DEVTMPFS=y
 CONFIG_DEVTMPFS_MOUNT=y
 CONFIG_TEST_ASYNC_DRIVER_PROBE=m
@@ -393,6 +387,8 @@ CONFIG_PPS_CLIENT_LDISC=m
 CONFIG_PTP_1588_CLOCK=m
 # CONFIG_HWMON is not set
 CONFIG_FB=y
+# CONFIG_LCD_CLASS_DEVICE is not set
+# CONFIG_BACKLIGHT_CLASS_DEVICE is not set
 CONFIG_FRAMEBUFFER_CONSOLE=y
 CONFIG_LOGO=y
 CONFIG_HID=m
@@ -507,13 +503,14 @@ CONFIG_NLS_MAC_TURKISH=m
 CONFIG_DLM=m
 CONFIG_ENCRYPTED_KEYS=m
 CONFIG_HARDENED_USERCOPY=y
-CONFIG_CRYPTO_RSA=m
-CONFIG_CRYPTO_DH=m
-CONFIG_CRYPTO_ECDH=m
 CONFIG_CRYPTO_MANAGER=y
 CONFIG_CRYPTO_USER=m
 CONFIG_CRYPTO_CRYPTD=m
 CONFIG_CRYPTO_TEST=m
+CONFIG_CRYPTO_RSA=m
+CONFIG_CRYPTO_DH=m
+CONFIG_CRYPTO_ECDH=m
+CONFIG_CRYPTO_ECRDSA=m
 CONFIG_CRYPTO_CHACHA20POLY1305=m
 CONFIG_CRYPTO_AEGIS128=m
 CONFIG_CRYPTO_AEGIS128L=m
@@ -537,7 +534,6 @@ CONFIG_CRYPTO_RMD256=m
 CONFIG_CRYPTO_RMD320=m
 CONFIG_CRYPTO_SHA3=m
 CONFIG_CRYPTO_SM3=m
-CONFIG_CRYPTO_STREEBOG=m
 CONFIG_CRYPTO_TGR192=m
 CONFIG_CRYPTO_WP512=m
 CONFIG_CRYPTO_AES_TI=m
@@ -580,6 +576,7 @@ CONFIG_ATOMIC64_SELFTEST=m
 CONFIG_ASYNC_RAID6_TEST=m
 CONFIG_TEST_HEXDUMP=m
 CONFIG_TEST_STRING_HELPERS=m
+CONFIG_TEST_STRSCPY=m
 CONFIG_TEST_KSTRTOX=m
 CONFIG_TEST_PRINTF=m
 CONFIG_TEST_BITMAP=m
diff --git a/arch/m68k/kernel/dma.c b/arch/m68k/kernel/dma.c
index b4aa853051bd..30cd59caf037 100644
--- a/arch/m68k/kernel/dma.c
+++ b/arch/m68k/kernel/dma.c
@@ -18,57 +18,22 @@
 #include <asm/pgalloc.h>
 
 #if defined(CONFIG_MMU) && !defined(CONFIG_COLDFIRE)
-
-void *arch_dma_alloc(struct device *dev, size_t size, dma_addr_t *handle,
-                gfp_t flag, unsigned long attrs)
+void arch_dma_prep_coherent(struct page *page, size_t size)
 {
-        struct page *page, **map;
-        pgprot_t pgprot;
-        void *addr;
-        int i, order;
-
-        pr_debug("dma_alloc_coherent: %d,%x\n", size, flag);
-
-        size = PAGE_ALIGN(size);
-        order = get_order(size);
-
-        page = alloc_pages(flag | __GFP_ZERO, order);
-        if (!page)
-                return NULL;
-
-        *handle = page_to_phys(page);
-        map = kmalloc(sizeof(struct page *) << order, flag & ~__GFP_DMA);
-        if (!map) {
-                __free_pages(page, order);
-                return NULL;
-        }
-        split_page(page, order);
-
-        order = 1 << order;
-        size >>= PAGE_SHIFT;
-        map[0] = page;
-        for (i = 1; i < size; i++)
-                map[i] = page + i;
-        for (; i < order; i++)
-                __free_page(page + i);
-        pgprot = __pgprot(_PAGE_PRESENT | _PAGE_ACCESSED | _PAGE_DIRTY);
-        if (CPU_IS_040_OR_060)
-                pgprot_val(pgprot) |= _PAGE_GLOBAL040 | _PAGE_NOCACHE_S;
-        else
-                pgprot_val(pgprot) |= _PAGE_NOCACHE030;
-        addr = vmap(map, size, VM_MAP, pgprot);
-        kfree(map);
-
-        return addr;
+        cache_push(page_to_phys(page), size);
 }
 
-void arch_dma_free(struct device *dev, size_t size, void *addr,
-                dma_addr_t handle, unsigned long attrs)
+pgprot_t arch_dma_mmap_pgprot(struct device *dev, pgprot_t prot,
+                unsigned long attrs)
 {
-        pr_debug("dma_free_coherent: %p, %x\n", addr, handle);
-        vfree(addr);
+        if (CPU_IS_040_OR_060) {
+                pgprot_val(prot) &= ~_PAGE_CACHE040;
+                pgprot_val(prot) |= _PAGE_GLOBAL040 | _PAGE_NOCACHE_S;
+        } else {
+                pgprot_val(prot) |= _PAGE_NOCACHE030;
+        }
+        return prot;
 }
-
 #else
 
 #include <asm/cacheflush.h>
diff --git a/arch/mips/Makefile b/arch/mips/Makefile
index 8f4486c4415b..eceff9b75b22 100644
--- a/arch/mips/Makefile
+++ b/arch/mips/Makefile
@@ -17,6 +17,7 @@ archscripts: scripts_basic
         $(Q)$(MAKE) $(build)=arch/mips/boot/tools relocs
 
 KBUILD_DEFCONFIG := 32r2el_defconfig
+KBUILD_DTBS      := dtbs
 
 #
 # Select the object file format to substitute into the linker script.
@@ -384,7 +385,7 @@ quiet_cmd_64 = OBJCOPY $@
 vmlinux.64: vmlinux
         $(call cmd,64)
 
-all:    $(all-y)
+all:    $(all-y) $(KBUILD_DTBS)
 
 # boot
 $(boot-y): $(vmlinux-32) FORCE
diff --git a/arch/mips/boot/compressed/Makefile b/arch/mips/boot/compressed/Makefile
index 3c453a1f1ff1..172801ed35b8 100644
--- a/arch/mips/boot/compressed/Makefile
+++ b/arch/mips/boot/compressed/Makefile
@@ -78,6 +78,8 @@ OBJCOPYFLAGS_piggy.o := --add-section=.image=$(obj)/vmlinux.bin.z \
 $(obj)/piggy.o: $(obj)/dummy.o $(obj)/vmlinux.bin.z FORCE
         $(call if_changed,objcopy)
 
+HOSTCFLAGS_calc_vmlinuz_load_addr.o += $(LINUXINCLUDE)
+
 # Calculate the load address of the compressed kernel image
 hostprogs-y := calc_vmlinuz_load_addr
 
diff --git a/arch/mips/boot/compressed/calc_vmlinuz_load_addr.c b/arch/mips/boot/compressed/calc_vmlinuz_load_addr.c
index 240f1d12df75..080b926d2623 100644
--- a/arch/mips/boot/compressed/calc_vmlinuz_load_addr.c
+++ b/arch/mips/boot/compressed/calc_vmlinuz_load_addr.c
@@ -9,7 +9,7 @@
 #include <stdint.h>
 #include <stdio.h>
 #include <stdlib.h>
-#include "../../../../include/linux/sizes.h"
+#include <linux/sizes.h>
 
 int main(int argc, char *argv[])
 {
diff --git a/arch/mips/include/asm/atomic.h b/arch/mips/include/asm/atomic.h
index 94096299fc56..9a82dd11c0e9 100644
--- a/arch/mips/include/asm/atomic.h
+++ b/arch/mips/include/asm/atomic.h
@@ -254,10 +254,10 @@ static __inline__ int atomic_sub_if_positive(int i, atomic_t * v)
 #define atomic64_set(v, i)      WRITE_ONCE((v)->counter, (i))
 
 #define ATOMIC64_OP(op, c_op, asm_op)                                         \
-static __inline__ void atomic64_##op(long i, atomic64_t * v)                  \
+static __inline__ void atomic64_##op(s64 i, atomic64_t * v)                   \
 {                                                                             \
         if (kernel_uses_llsc) {                                               \
-                long temp;                                                    \
+                s64 temp;                                                     \
                                                                               \
                 loongson_llsc_mb();                                           \
                 __asm__ __volatile__(                                         \
@@ -280,12 +280,12 @@ static __inline__ void atomic64_##op(long i, atomic64_t * v)		      \
 }
 
 #define ATOMIC64_OP_RETURN(op, c_op, asm_op)                                  \
-static __inline__ long atomic64_##op##_return_relaxed(long i, atomic64_t * v) \
+static __inline__ s64 atomic64_##op##_return_relaxed(s64 i, atomic64_t * v)   \
 {                                                                             \
-        long result;                                                          \
+        s64 result;                                                           \
                                                                               \
         if (kernel_uses_llsc) {                                               \
-                long temp;                                                    \
+                s64 temp;                                                     \
                                                                               \
                 loongson_llsc_mb();                                           \
                 __asm__ __volatile__(                                         \
@@ -314,12 +314,12 @@ static __inline__ long atomic64_##op##_return_relaxed(long i, atomic64_t * v) \
 }
 
 #define ATOMIC64_FETCH_OP(op, c_op, asm_op)                                   \
-static __inline__ long atomic64_fetch_##op##_relaxed(long i, atomic64_t * v)  \
+static __inline__ s64 atomic64_fetch_##op##_relaxed(s64 i, atomic64_t * v)    \
 {                                                                             \
-        long result;                                                          \
+        s64 result;                                                           \
                                                                               \
         if (kernel_uses_llsc) {                                               \
-                long temp;                                                    \
+                s64 temp;                                                     \
                                                                               \
                 loongson_llsc_mb();                                           \
                 __asm__ __volatile__(                                         \
@@ -386,14 +386,14 @@ ATOMIC64_OPS(xor, ^=, xor)
  * Atomically test @v and subtract @i if @v is greater or equal than @i.
  * The function returns the old value of @v minus @i.
  */
-static __inline__ long atomic64_sub_if_positive(long i, atomic64_t * v)
+static __inline__ s64 atomic64_sub_if_positive(s64 i, atomic64_t * v)
 {
-        long result;
+        s64 result;
 
         smp_mb__before_llsc();
 
         if (kernel_uses_llsc) {
-                long temp;
+                s64 temp;
 
                 __asm__ __volatile__(
                 "       .set    push                                    \n"
diff --git a/arch/mips/include/asm/mach-ath79/ar933x_uart.h b/arch/mips/include/asm/mach-ath79/ar933x_uart.h
index b8f8af7dc47c..cacf3545e018 100644
--- a/arch/mips/include/asm/mach-ath79/ar933x_uart.h
+++ b/arch/mips/include/asm/mach-ath79/ar933x_uart.h
@@ -24,8 +24,8 @@
 #define AR933X_UART_CS_PARITY_S         0
 #define AR933X_UART_CS_PARITY_M         0x3
 #define   AR933X_UART_CS_PARITY_NONE    0
-#define   AR933X_UART_CS_PARITY_ODD     1
-#define   AR933X_UART_CS_PARITY_EVEN    2
+#define   AR933X_UART_CS_PARITY_ODD     2
+#define   AR933X_UART_CS_PARITY_EVEN    3
 #define AR933X_UART_CS_IF_MODE_S        2
 #define AR933X_UART_CS_IF_MODE_M        0x3
 #define   AR933X_UART_CS_IF_MODE_NONE   0
diff --git a/arch/mips/include/asm/mips-gic.h b/arch/mips/include/asm/mips-gic.h
index 75a1cdee1331..084cac1c5ea2 100644
--- a/arch/mips/include/asm/mips-gic.h
+++ b/arch/mips/include/asm/mips-gic.h
@@ -311,6 +311,36 @@ static inline bool mips_gic_present(void)
 }
 
 /**
+ * mips_gic_vx_map_reg() - Return GIC_Vx_<intr>_MAP register offset
+ * @intr: A GIC local interrupt
+ *
+ * Determine the index of the GIC_VL_<intr>_MAP or GIC_VO_<intr>_MAP register
+ * within the block of GIC map registers. This is almost the same as the order
+ * of interrupts in the pending & mask registers, as used by enum
+ * mips_gic_local_interrupt, but moves the FDC interrupt & thus offsets the
+ * interrupts after it...
+ *
+ * Return: The map register index corresponding to @intr.
+ *
+ * The return value is suitable for use with the (read|write)_gic_v[lo]_map
+ * accessor functions.
+ */
+static inline unsigned int
+mips_gic_vx_map_reg(enum mips_gic_local_interrupt intr)
+{
+        /* WD, Compare & Timer are 1:1 */
+        if (intr <= GIC_LOCAL_INT_TIMER)
+                return intr;
+
+        /* FDC moves to after Timer... */
+        if (intr == GIC_LOCAL_INT_FDC)
+                return GIC_LOCAL_INT_TIMER + 1;
+
+        /* As a result everything else is offset by 1 */
+        return intr + 1;
+}
+
+/**
  * gic_get_c0_compare_int() - Return cp0 count/compare interrupt virq
  *
  * Determine the virq number to use for the coprocessor 0 count/compare
diff --git a/arch/mips/mm/mmap.c b/arch/mips/mm/mmap.c
index 50ee7213b432..d79f2b432318 100644
--- a/arch/mips/mm/mmap.c
+++ b/arch/mips/mm/mmap.c
@@ -203,7 +203,7 @@ unsigned long arch_randomize_brk(struct mm_struct *mm)
 
 bool __virt_addr_valid(const volatile void *kaddr)
 {
-        unsigned long vaddr = (unsigned long)vaddr;
+        unsigned long vaddr = (unsigned long)kaddr;
 
         if ((vaddr < PAGE_OFFSET) || (vaddr >= MAP_BASE))
                 return false;
diff --git a/arch/mips/mm/tlbex.c b/arch/mips/mm/tlbex.c
index 65b6e85447b1..144ceb0fba88 100644
--- a/arch/mips/mm/tlbex.c
+++ b/arch/mips/mm/tlbex.c
@@ -391,6 +391,7 @@ static struct work_registers build_get_work_registers(u32 **p)
 static void build_restore_work_registers(u32 **p)
 {
         if (scratch_reg >= 0) {
+                uasm_i_ehb(p);
                 UASM_i_MFC0(p, 1, c0_kscratch(), scratch_reg);
                 return;
         }
@@ -668,10 +669,12 @@ static void build_restore_pagemask(u32 **p, struct uasm_reloc **r,
                         uasm_i_mtc0(p, 0, C0_PAGEMASK);
                         uasm_il_b(p, r, lid);
                 }
-                if (scratch_reg >= 0)
+                if (scratch_reg >= 0) {
+                        uasm_i_ehb(p);
                         UASM_i_MFC0(p, 1, c0_kscratch(), scratch_reg);
-                else
+                } else {
                         UASM_i_LW(p, 1, scratchpad_offset(0), 0);
+                }
         } else {
                 /* Reset default page size */
                 if (PM_DEFAULT_MASK >> 16) {
@@ -938,10 +941,12 @@ build_get_pgd_vmalloc64(u32 **p, struct uasm_label **l, struct uasm_reloc **r,
                 uasm_i_jr(p, ptr);
 
                 if (mode == refill_scratch) {
-                        if (scratch_reg >= 0)
+                        if (scratch_reg >= 0) {
+                                uasm_i_ehb(p);
                                 UASM_i_MFC0(p, 1, c0_kscratch(), scratch_reg);
-                        else
+                        } else {
                                 UASM_i_LW(p, 1, scratchpad_offset(0), 0);
+                        }
                 } else {
                         uasm_i_nop(p);
                 }
@@ -1258,6 +1263,7 @@ build_fast_tlb_refill_handler (u32 **p, struct uasm_label **l,
         UASM_i_MTC0(p, odd, C0_ENTRYLO1); /* load it */
 
         if (c0_scratch_reg >= 0) {
+                uasm_i_ehb(p);
                 UASM_i_MFC0(p, scratch, c0_kscratch(), c0_scratch_reg);
                 build_tlb_write_entry(p, l, r, tlb_random);
                 uasm_l_leave(l, *p);
@@ -1603,15 +1609,17 @@ static void build_setup_pgd(void)
                 uasm_i_dinsm(&p, a0, 0, 29, 64 - 29);
                 uasm_l_tlbl_goaround1(&l, p);
                 UASM_i_SLL(&p, a0, a0, 11);
-                uasm_i_jr(&p, 31);
                 UASM_i_MTC0(&p, a0, C0_CONTEXT);
+                uasm_i_jr(&p, 31);
+                uasm_i_ehb(&p);
         } else {
                 /* PGD in c0_KScratch */
-                uasm_i_jr(&p, 31);
                 if (cpu_has_ldpte)
                         UASM_i_MTC0(&p, a0, C0_PWBASE);
                 else
                         UASM_i_MTC0(&p, a0, c0_kscratch(), pgd_reg);
+                uasm_i_jr(&p, 31);
+                uasm_i_ehb(&p);
         }
 #else
 #ifdef CONFIG_SMP
@@ -1625,13 +1633,16 @@ static void build_setup_pgd(void)
         UASM_i_LA_mostly(&p, a2, pgdc);
         UASM_i_SW(&p, a0, uasm_rel_lo(pgdc), a2);
 #endif /* SMP */
-        uasm_i_jr(&p, 31);
 
         /* if pgd_reg is allocated, save PGD also to scratch register */
-        if (pgd_reg != -1)
+        if (pgd_reg != -1) {
                 UASM_i_MTC0(&p, a0, c0_kscratch(), pgd_reg);
-        else
+                uasm_i_jr(&p, 31);
+                uasm_i_ehb(&p);
+        } else {
+                uasm_i_jr(&p, 31);
                 uasm_i_nop(&p);
+        }
 #endif
         if (p >= (u32 *)tlbmiss_handler_setup_pgd_end)
                 panic("tlbmiss_handler_setup_pgd space exceeded");
diff --git a/arch/parisc/kernel/module.c b/arch/parisc/kernel/module.c
index f241ded9239b..1f0f29a289d3 100644
--- a/arch/parisc/kernel/module.c
+++ b/arch/parisc/kernel/module.c
@@ -786,6 +786,10 @@ int apply_relocate_add(Elf_Shdr *sechdrs,
                         /* 32-bit PC relative address */
                         *loc = val - dot - 8 + addend;
                         break;
+                case R_PARISC_PCREL64:
+                        /* 64-bit PC relative address */
+                        *loc64 = val - dot - 8 + addend;
+                        break;
                 case R_PARISC_DIR64:
                         /* 64-bit effective address */
                         *loc64 = val + addend;
diff --git a/arch/powerpc/include/asm/atomic.h b/arch/powerpc/include/asm/atomic.h
index 52eafaf74054..31c231ea56b7 100644
--- a/arch/powerpc/include/asm/atomic.h
+++ b/arch/powerpc/include/asm/atomic.h
@@ -297,24 +297,24 @@ static __inline__ int atomic_dec_if_positive(atomic_t *v)
 
 #define ATOMIC64_INIT(i)        { (i) }
 
-static __inline__ long atomic64_read(const atomic64_t *v)
+static __inline__ s64 atomic64_read(const atomic64_t *v)
 {
-        long t;
+        s64 t;
 
         __asm__ __volatile__("ld%U1%X1 %0,%1" : "=r"(t) : "m"(v->counter));
 
         return t;
 }
 
-static __inline__ void atomic64_set(atomic64_t *v, long i)
+static __inline__ void atomic64_set(atomic64_t *v, s64 i)
 {
         __asm__ __volatile__("std%U0%X0 %1,%0" : "=m"(v->counter) : "r"(i));
 }
 
 #define ATOMIC64_OP(op, asm_op)                                         \
-static __inline__ void atomic64_##op(long a, atomic64_t *v)             \
+static __inline__ void atomic64_##op(s64 a, atomic64_t *v)              \
 {                                                                       \
-        long t;                                                         \
+        s64 t;                                                          \
                                                                         \
         __asm__ __volatile__(                                           \
 "1:     ldarx   %0,0,%3         # atomic64_" #op "\n"                   \
@@ -327,10 +327,10 @@ static __inline__ void atomic64_##op(long a, atomic64_t *v)		\
 }
 
 #define ATOMIC64_OP_RETURN_RELAXED(op, asm_op)                          \
-static inline long                                                      \
-atomic64_##op##_return_relaxed(long a, atomic64_t *v)                   \
+static inline s64                                                       \
+atomic64_##op##_return_relaxed(s64 a, atomic64_t *v)                    \
 {                                                                       \
-        long t;                                                         \
+        s64 t;                                                          \
                                                                         \
         __asm__ __volatile__(                                           \
 "1:     ldarx   %0,0,%3         # atomic64_" #op "_return_relaxed\n"    \
@@ -345,10 +345,10 @@ atomic64_##op##_return_relaxed(long a, atomic64_t *v)			\
 }
 
 #define ATOMIC64_FETCH_OP_RELAXED(op, asm_op)                           \
-static inline long                                                      \
-atomic64_fetch_##op##_relaxed(long a, atomic64_t *v)                    \
+static inline s64                                                       \
+atomic64_fetch_##op##_relaxed(s64 a, atomic64_t *v)                     \
 {                                                                       \
-        long res, t;                                                    \
+        s64 res, t;                                                     \
                                                                         \
         __asm__ __volatile__(                                           \
 "1:     ldarx   %0,0,%4         # atomic64_fetch_" #op "_relaxed\n"     \
@@ -396,7 +396,7 @@ ATOMIC64_OPS(xor, xor)
 
 static __inline__ void atomic64_inc(atomic64_t *v)
 {
-        long t;
+        s64 t;
 
         __asm__ __volatile__(
 "1:     ldarx   %0,0,%2         # atomic64_inc\n\
@@ -409,9 +409,9 @@ static __inline__ void atomic64_inc(atomic64_t *v)
 }
 #define atomic64_inc atomic64_inc
 
-static __inline__ long atomic64_inc_return_relaxed(atomic64_t *v)
+static __inline__ s64 atomic64_inc_return_relaxed(atomic64_t *v)
 {
-        long t;
+        s64 t;
 
         __asm__ __volatile__(
 "1:     ldarx   %0,0,%2         # atomic64_inc_return_relaxed\n"
@@ -427,7 +427,7 @@ static __inline__ long atomic64_inc_return_relaxed(atomic64_t *v)
 
 static __inline__ void atomic64_dec(atomic64_t *v)
 {
-        long t;
+        s64 t;
 
         __asm__ __volatile__(
 "1:     ldarx   %0,0,%2         # atomic64_dec\n\
@@ -440,9 +440,9 @@ static __inline__ void atomic64_dec(atomic64_t *v)
 }
 #define atomic64_dec atomic64_dec
 
-static __inline__ long atomic64_dec_return_relaxed(atomic64_t *v)
+static __inline__ s64 atomic64_dec_return_relaxed(atomic64_t *v)
 {
-        long t;
+        s64 t;
 
         __asm__ __volatile__(
 "1:     ldarx   %0,0,%2         # atomic64_dec_return_relaxed\n"
@@ -463,9 +463,9 @@ static __inline__ long atomic64_dec_return_relaxed(atomic64_t *v)
  * Atomically test *v and decrement if it is greater than 0.
  * The function returns the old value of *v minus 1.
  */
-static __inline__ long atomic64_dec_if_positive(atomic64_t *v)
+static __inline__ s64 atomic64_dec_if_positive(atomic64_t *v)
 {
-        long t;
+        s64 t;
 
         __asm__ __volatile__(
         PPC_ATOMIC_ENTRY_BARRIER
@@ -502,9 +502,9 @@ static __inline__ long atomic64_dec_if_positive(atomic64_t *v)
  * Atomically adds @a to @v, so long as it was not @u.
  * Returns the old value of @v.
  */
-static __inline__ long atomic64_fetch_add_unless(atomic64_t *v, long a, long u)
+static __inline__ s64 atomic64_fetch_add_unless(atomic64_t *v, s64 a, s64 u)
 {
-        long t;
+        s64 t;
 
         __asm__ __volatile__ (
         PPC_ATOMIC_ENTRY_BARRIER
@@ -534,7 +534,7 @@ static __inline__ long atomic64_fetch_add_unless(atomic64_t *v, long a, long u)
  */
 static __inline__ int atomic64_inc_not_zero(atomic64_t *v)
 {
-        long t1, t2;
+        s64 t1, t2;
 
         __asm__ __volatile__ (
         PPC_ATOMIC_ENTRY_BARRIER
diff --git a/arch/powerpc/include/asm/processor.h b/arch/powerpc/include/asm/processor.h
index ef573fe9873e..a9993e7a443b 100644
--- a/arch/powerpc/include/asm/processor.h
+++ b/arch/powerpc/include/asm/processor.h
@@ -346,8 +346,6 @@ static inline unsigned long __pack_fe01(unsigned int fpmode)
 
 #define spin_cpu_relax()        barrier()
 
-#define spin_cpu_yield()        spin_cpu_relax()
-
 #define spin_end()      HMT_medium()
 
 #define spin_until_cond(cond)                                   \
diff --git a/arch/powerpc/kernel/exceptions-64s.S b/arch/powerpc/kernel/exceptions-64s.S
index 6b86055e5251..73ba246ca11d 100644
--- a/arch/powerpc/kernel/exceptions-64s.S
+++ b/arch/powerpc/kernel/exceptions-64s.S
@@ -315,7 +315,7 @@ TRAMP_REAL_BEGIN(machine_check_common_early)
         mfspr   r11,SPRN_DSISR          /* Save DSISR */
         std     r11,_DSISR(r1)
         std     r9,_CCR(r1)             /* Save CR in stackframe */
-        kuap_save_amr_and_lock r9, r10, cr1
+        /* We don't touch AMR here, we never go to virtual mode */
         /* Save r9 through r13 from EXMC save area to stack frame. */
         EXCEPTION_PROLOG_COMMON_2(PACA_EXMC)
         mfmsr   r11                     /* get MSR value */
diff --git a/arch/powerpc/kernel/ptrace.c b/arch/powerpc/kernel/ptrace.c
index 684b0b315c32..8c92febf5f44 100644
--- a/arch/powerpc/kernel/ptrace.c
+++ b/arch/powerpc/kernel/ptrace.c
@@ -2521,7 +2521,6 @@ void ptrace_disable(struct task_struct *child)
 {
         /* make sure the single step bit is not set. */
         user_disable_single_step(child);
-        clear_tsk_thread_flag(child, TIF_SYSCALL_EMU);
 }
 
 #ifdef CONFIG_PPC_ADV_DEBUG_REGS
diff --git a/arch/powerpc/kernel/rtas.c b/arch/powerpc/kernel/rtas.c
index b824f4c69622..0ab4c72515c4 100644
--- a/arch/powerpc/kernel/rtas.c
+++ b/arch/powerpc/kernel/rtas.c
@@ -990,8 +990,7 @@ int rtas_ibm_suspend_me(u64 handle)
         /* Call function on all CPUs.  One of us will make the
          * rtas call
          */
-        if (on_each_cpu(rtas_percpu_suspend_me, &data, 0))
-                atomic_set(&data.error, -EINVAL);
+        on_each_cpu(rtas_percpu_suspend_me, &data, 0);
 
         wait_for_completion(&done);
 
diff --git a/arch/powerpc/mm/book3s64/mmu_context.c b/arch/powerpc/mm/book3s64/mmu_context.c
index bb70391401f7..794404d50a85 100644
--- a/arch/powerpc/mm/book3s64/mmu_context.c
+++ b/arch/powerpc/mm/book3s64/mmu_context.c
@@ -50,20 +50,52 @@ EXPORT_SYMBOL_GPL(hash__alloc_context_id);
 
 void slb_setup_new_exec(void);
 
+static int realloc_context_ids(mm_context_t *ctx)
+{
+        int i, id;
+
+        /*
+         * id 0 (aka. ctx->id) is special, we always allocate a new one, even if
+         * there wasn't one allocated previously (which happens in the exec
+         * case where ctx is newly allocated).
+         *
+         * We have to be a bit careful here. We must keep the existing ids in
+         * the array, so that we can test if they're non-zero to decide if we
+         * need to allocate a new one. However in case of error we must free the
+         * ids we've allocated but *not* any of the existing ones (or risk a
+         * UAF). That's why we decrement i at the start of the error handling
+         * loop, to skip the id that we just tested but couldn't reallocate.
+         */
+        for (i = 0; i < ARRAY_SIZE(ctx->extended_id); i++) {
+                if (i == 0 || ctx->extended_id[i]) {
+                        id = hash__alloc_context_id();
+                        if (id < 0)
+                                goto error;
+
+                        ctx->extended_id[i] = id;
+                }
+        }
+
+        /* The caller expects us to return id */
+        return ctx->id;
+
+error:
+        for (i--; i >= 0; i--) {
+                if (ctx->extended_id[i])
+                        ida_free(&mmu_context_ida, ctx->extended_id[i]);
+        }
+
+        return id;
+}
+
 static int hash__init_new_context(struct mm_struct *mm)
 {
         int index;
 
-        index = hash__alloc_context_id();
-        if (index < 0)
-                return index;
-
         mm->context.hash_context = kmalloc(sizeof(struct hash_mm_context),
                                            GFP_KERNEL);
-        if (!mm->context.hash_context) {
-                ida_free(&mmu_context_ida, index);
+        if (!mm->context.hash_context)
                 return -ENOMEM;
-        }
 
         /*
          * The old code would re-promote on fork, we don't do that when using
@@ -91,13 +123,20 @@ static int hash__init_new_context(struct mm_struct *mm)
                         mm->context.hash_context->spt = kmalloc(sizeof(struct subpage_prot_table),
                                                                 GFP_KERNEL);
                         if (!mm->context.hash_context->spt) {
-                                ida_free(&mmu_context_ida, index);
                                 kfree(mm->context.hash_context);
                                 return -ENOMEM;
                         }
                 }
 #endif
+        }
 
+        index = realloc_context_ids(&mm->context);
+        if (index < 0) {
+#ifdef CONFIG_PPC_SUBPAGE_PROT
+                kfree(mm->context.hash_context->spt);
+#endif
+                kfree(mm->context.hash_context);
+                return index;
         }
 
         pkey_mm_init(mm);
diff --git a/arch/riscv/boot/dts/sifive/fu540-c000.dtsi b/arch/riscv/boot/dts/sifive/fu540-c000.dtsi
index 3c06ee4b2b29..40983491b95f 100644
--- a/arch/riscv/boot/dts/sifive/fu540-c000.dtsi
+++ b/arch/riscv/boot/dts/sifive/fu540-c000.dtsi
@@ -163,6 +163,7 @@
                         interrupt-parent = <&plic0>;
                         interrupts = <4>;
                         clocks = <&prci PRCI_CLK_TLCLK>;
+                        status = "disabled";
                 };
                 uart1: serial@10011000 {
                         compatible = "sifive,fu540-c000-uart", "sifive,uart0";
@@ -170,6 +171,7 @@
                         interrupt-parent = <&plic0>;
                         interrupts = <5>;
                         clocks = <&prci PRCI_CLK_TLCLK>;
+                        status = "disabled";
                 };
                 i2c0: i2c@10030000 {
                         compatible = "sifive,fu540-c000-i2c", "sifive,i2c0";
@@ -181,6 +183,7 @@
                         reg-io-width = <1>;
                         #address-cells = <1>;
                         #size-cells = <0>;
+                        status = "disabled";
                 };
                 qspi0: spi@10040000 {
                         compatible = "sifive,fu540-c000-spi", "sifive,spi0";
@@ -191,6 +194,7 @@
                         clocks = <&prci PRCI_CLK_TLCLK>;
                         #address-cells = <1>;
                         #size-cells = <0>;
+                        status = "disabled";
                 };
                 qspi1: spi@10041000 {
                         compatible = "sifive,fu540-c000-spi", "sifive,spi0";
@@ -201,6 +205,7 @@
                         clocks = <&prci PRCI_CLK_TLCLK>;
                         #address-cells = <1>;
                         #size-cells = <0>;
+                        status = "disabled";
                 };
                 qspi2: spi@10050000 {
                         compatible = "sifive,fu540-c000-spi", "sifive,spi0";
@@ -210,6 +215,7 @@
                         clocks = <&prci PRCI_CLK_TLCLK>;
                         #address-cells = <1>;
                         #size-cells = <0>;
+                        status = "disabled";
                 };
         };
 };
diff --git a/arch/riscv/boot/dts/sifive/hifive-unleashed-a00.dts b/arch/riscv/boot/dts/sifive/hifive-unleashed-a00.dts
index 4da88707e28f..0b55c53c08c7 100644
--- a/arch/riscv/boot/dts/sifive/hifive-unleashed-a00.dts
+++ b/arch/riscv/boot/dts/sifive/hifive-unleashed-a00.dts
@@ -42,7 +42,20 @@
         };
 };
 
+&uart0 {
+        status = "okay";
+};
+
+&uart1 {
+        status = "okay";
+};
+
+&i2c0 {
+        status = "okay";
+};
+
 &qspi0 {
+        status = "okay";
         flash@0 {
                 compatible = "issi,is25wp256", "jedec,spi-nor";
                 reg = <0>;
diff --git a/arch/riscv/configs/defconfig b/arch/riscv/configs/defconfig
index 4f02967e55de..04944fb4fa7a 100644
--- a/arch/riscv/configs/defconfig
+++ b/arch/riscv/configs/defconfig
@@ -69,6 +69,7 @@ CONFIG_VIRTIO_MMIO=y
 CONFIG_CLK_SIFIVE=y
 CONFIG_CLK_SIFIVE_FU540_PRCI=y
 CONFIG_SIFIVE_PLIC=y
+CONFIG_SPI_SIFIVE=y
 CONFIG_EXT4_FS=y
 CONFIG_EXT4_FS_POSIX_ACL=y
 CONFIG_AUTOFS4_FS=y
@@ -84,4 +85,8 @@ CONFIG_ROOT_NFS=y
 CONFIG_CRYPTO_USER_API_HASH=y
 CONFIG_CRYPTO_DEV_VIRTIO=y
 CONFIG_PRINTK_TIME=y
+CONFIG_SPI=y
+CONFIG_MMC_SPI=y
+CONFIG_MMC=y
+CONFIG_DEVTMPFS_MOUNT=y
 # CONFIG_RCU_TRACE is not set
diff --git a/arch/riscv/include/asm/atomic.h b/arch/riscv/include/asm/atomic.h
index 9038aeb900a6..96f95c9ebd97 100644
--- a/arch/riscv/include/asm/atomic.h
+++ b/arch/riscv/include/asm/atomic.h
@@ -38,11 +38,11 @@ static __always_inline void atomic_set(atomic_t *v, int i)
 
 #ifndef CONFIG_GENERIC_ATOMIC64
 #define ATOMIC64_INIT(i) { (i) }
-static __always_inline long atomic64_read(const atomic64_t *v)
+static __always_inline s64 atomic64_read(const atomic64_t *v)
 {
         return READ_ONCE(v->counter);
 }
-static __always_inline void atomic64_set(atomic64_t *v, long i)
+static __always_inline void atomic64_set(atomic64_t *v, s64 i)
 {
         WRITE_ONCE(v->counter, i);
 }
@@ -66,11 +66,11 @@ void atomic##prefix##_##op(c_type i, atomic##prefix##_t *v)		\
 
 #ifdef CONFIG_GENERIC_ATOMIC64
 #define ATOMIC_OPS(op, asm_op, I)                                       \
-        ATOMIC_OP (op, asm_op, I, w,  int,   )
+        ATOMIC_OP (op, asm_op, I, w, int,   )
 #else
 #define ATOMIC_OPS(op, asm_op, I)                                       \
-        ATOMIC_OP (op, asm_op, I, w,  int,   )                          \
-        ATOMIC_OP (op, asm_op, I, d, long, 64)
+        ATOMIC_OP (op, asm_op, I, w, int,   )                           \
+        ATOMIC_OP (op, asm_op, I, d, s64, 64)
 #endif
 
 ATOMIC_OPS(add, add,  i)
@@ -127,14 +127,14 @@ c_type atomic##prefix##_##op##_return(c_type i, atomic##prefix##_t *v)	\
 
 #ifdef CONFIG_GENERIC_ATOMIC64
 #define ATOMIC_OPS(op, asm_op, c_op, I)                                 \
-        ATOMIC_FETCH_OP( op, asm_op,       I, w,  int,   )              \
-        ATOMIC_OP_RETURN(op, asm_op, c_op, I, w,  int,   )
+        ATOMIC_FETCH_OP( op, asm_op,       I, w, int,   )               \
+        ATOMIC_OP_RETURN(op, asm_op, c_op, I, w, int,   )
 #else
 #define ATOMIC_OPS(op, asm_op, c_op, I)                                 \
-        ATOMIC_FETCH_OP( op, asm_op,       I, w,  int,   )              \
-        ATOMIC_OP_RETURN(op, asm_op, c_op, I, w,  int,   )              \
-        ATOMIC_FETCH_OP( op, asm_op,       I, d, long, 64)              \
-        ATOMIC_OP_RETURN(op, asm_op, c_op, I, d, long, 64)
+        ATOMIC_FETCH_OP( op, asm_op,       I, w, int,   )               \
+        ATOMIC_OP_RETURN(op, asm_op, c_op, I, w, int,   )               \
+        ATOMIC_FETCH_OP( op, asm_op,       I, d, s64, 64)               \
+        ATOMIC_OP_RETURN(op, asm_op, c_op, I, d, s64, 64)
 #endif
 
 ATOMIC_OPS(add, add, +,  i)
@@ -166,11 +166,11 @@ ATOMIC_OPS(sub, add, +, -i)
 
 #ifdef CONFIG_GENERIC_ATOMIC64
 #define ATOMIC_OPS(op, asm_op, I)                                       \
-        ATOMIC_FETCH_OP(op, asm_op, I, w,  int,   )
+        ATOMIC_FETCH_OP(op, asm_op, I, w, int,   )
 #else
 #define ATOMIC_OPS(op, asm_op, I)                                       \
-        ATOMIC_FETCH_OP(op, asm_op, I, w,  int,   )                     \
-        ATOMIC_FETCH_OP(op, asm_op, I, d, long, 64)
+        ATOMIC_FETCH_OP(op, asm_op, I, w, int,   )                      \
+        ATOMIC_FETCH_OP(op, asm_op, I, d, s64, 64)
 #endif
 
 ATOMIC_OPS(and, and, i)
@@ -219,9 +219,10 @@ static __always_inline int atomic_fetch_add_unless(atomic_t *v, int a, int u)
 #define atomic_fetch_add_unless atomic_fetch_add_unless
 
 #ifndef CONFIG_GENERIC_ATOMIC64
-static __always_inline long atomic64_fetch_add_unless(atomic64_t *v, long a, long u)
+static __always_inline s64 atomic64_fetch_add_unless(atomic64_t *v, s64 a, s64 u)
 {
-       long prev, rc;
+       s64 prev;
+       long rc;
 
         __asm__ __volatile__ (
                 "0:     lr.d     %[p],  %[c]\n"
@@ -290,11 +291,11 @@ c_t atomic##prefix##_cmpxchg(atomic##prefix##_t *v, c_t o, c_t n)	\
 
 #ifdef CONFIG_GENERIC_ATOMIC64
 #define ATOMIC_OPS()                                                    \
-        ATOMIC_OP( int,   , 4)
+        ATOMIC_OP(int,   , 4)
 #else
 #define ATOMIC_OPS()                                                    \
-        ATOMIC_OP( int,   , 4)                                          \
-        ATOMIC_OP(long, 64, 8)
+        ATOMIC_OP(int,   , 4)                                           \
+        ATOMIC_OP(s64, 64, 8)
 #endif
 
 ATOMIC_OPS()
@@ -332,9 +333,10 @@ static __always_inline int atomic_sub_if_positive(atomic_t *v, int offset)
 #define atomic_dec_if_positive(v)       atomic_sub_if_positive(v, 1)
 
 #ifndef CONFIG_GENERIC_ATOMIC64
-static __always_inline long atomic64_sub_if_positive(atomic64_t *v, int offset)
+static __always_inline s64 atomic64_sub_if_positive(atomic64_t *v, s64 offset)
 {
-       long prev, rc;
+       s64 prev;
+       long rc;
 
         __asm__ __volatile__ (
                 "0:     lr.d     %[p],  %[c]\n"
diff --git a/arch/riscv/mm/fault.c b/arch/riscv/mm/fault.c
index 3e2708c626a8..f960c3f4ce47 100644
--- a/arch/riscv/mm/fault.c
+++ b/arch/riscv/mm/fault.c
@@ -272,9 +272,6 @@ vmalloc_fault:
                  * entries, but in RISC-V, SFENCE.VMA specifies an
                  * ordering constraint, not a cache flush; it is
                  * necessary even after writing invalid entries.
-                 * Relying on flush_tlb_fix_spurious_fault would
-                 * suffice, but the extra traps reduce
-                 * performance. So, eagerly SFENCE.VMA.
                  */
                 local_flush_tlb_page(addr);
 
diff --git a/arch/s390/Kconfig b/arch/s390/Kconfig
index 109243fdb6ec..fdb4246265a5 100644
--- a/arch/s390/Kconfig
+++ b/arch/s390/Kconfig
@@ -1,4 +1,7 @@
 # SPDX-License-Identifier: GPL-2.0
+config ARCH_HAS_MEM_ENCRYPT
+        def_bool y
+
 config MMU
         def_bool y
 
@@ -30,7 +33,7 @@ config GENERIC_BUG_RELATIVE_POINTERS
         def_bool y
 
 config GENERIC_LOCKBREAK
-        def_bool y if SMP && PREEMPT
+        def_bool y if PREEMPT
 
 config PGSTE
         def_bool y if KVM
@@ -113,7 +116,6 @@ config S390
         select DYNAMIC_FTRACE if FUNCTION_TRACER
         select GENERIC_CLOCKEVENTS
         select GENERIC_CPU_AUTOPROBE
-        select GENERIC_CPU_DEVICES if !SMP
         select GENERIC_CPU_VULNERABILITIES
         select GENERIC_FIND_FIRST_BIT
         select GENERIC_SMP_IDLE_THREAD
@@ -187,6 +189,8 @@ config S390
         select VIRT_CPU_ACCOUNTING
         select ARCH_HAS_SCALED_CPUTIME
         select HAVE_NMI
+        select SWIOTLB
+        select GENERIC_ALLOCATOR
 
 
 config SCHED_OMIT_FRAME_POINTER
@@ -399,27 +403,10 @@ config SYSVIPC_COMPAT
 
 config SMP
         def_bool y
-        prompt "Symmetric multi-processing support"
-        ---help---
-          This enables support for systems with more than one CPU. If you have
-          a system with only one CPU, like most personal computers, say N. If
-          you have a system with more than one CPU, say Y.
-
-          If you say N here, the kernel will run on uni- and multiprocessor
-          machines, but will use only one CPU of a multiprocessor machine. If
-          you say Y here, the kernel will run on many, but not all,
-          uniprocessor machines. On a uniprocessor machine, the kernel
-          will run faster if you say N here.
-
-          See also the SMP-HOWTO available at
-          <http://www.tldp.org/docs.html#howto>.
-
-          Even if you don't know what to do here, say Y.
 
 config NR_CPUS
         int "Maximum number of CPUs (2-512)"
         range 2 512
-        depends on SMP
         default "64"
         help
           This allows you to specify the maximum number of CPUs which this
@@ -431,12 +418,6 @@ config NR_CPUS
 
 config HOTPLUG_CPU
         def_bool y
-        prompt "Support for hot-pluggable CPUs"
-        depends on SMP
-        help
-          Say Y here to be able to turn CPUs off and on. CPUs
-          can be controlled through /sys/devices/system/cpu/cpu#.
-          Say N if you want to disable CPU hotplug.
 
 # Some NUMA nodes have memory ranges that span
 # other nodes.  Even though a pfn is valid and
@@ -448,7 +429,7 @@ config NODES_SPAN_OTHER_NODES
 
 config NUMA
         bool "NUMA support"
-        depends on SMP && SCHED_TOPOLOGY
+        depends on SCHED_TOPOLOGY
         default n
         help
           Enable NUMA support
@@ -523,7 +504,6 @@ config SCHED_DRAWER
 config SCHED_TOPOLOGY
         def_bool y
         prompt "Topology scheduler support"
-        depends on SMP
         select SCHED_SMT
         select SCHED_MC
         select SCHED_BOOK
@@ -763,7 +743,7 @@ config PCI_NR_FUNCTIONS
           This allows you to specify the maximum number of PCI functions which
           this kernel will support.
 
-endif   # PCI
+endif # PCI
 
 config HAS_IOMEM
         def_bool PCI
@@ -829,16 +809,15 @@ menu "Dump support"
 
 config CRASH_DUMP
         bool "kernel crash dumps"
-        depends on SMP
         select KEXEC
         help
           Generate crash dump after being started by kexec.
           Crash dump kernels are loaded in the main kernel with kexec-tools
           into a specially reserved region and then later executed after
           a crash by kdump/kexec.
-          Refer to <file:Documentation/s390/zfcpdump.txt> for more details on this.
+          Refer to <file:Documentation/s390/zfcpdump.rst> for more details on this.
           This option also enables s390 zfcpdump.
-          See also <file:Documentation/s390/zfcpdump.txt>
+          See also <file:Documentation/s390/zfcpdump.rst>
 
 endmenu
 
diff --git a/arch/s390/configs/debug_defconfig b/arch/s390/configs/debug_defconfig
index b0920b35f87b..a6dc01a22048 100644
--- a/arch/s390/configs/debug_defconfig
+++ b/arch/s390/configs/debug_defconfig
@@ -88,6 +88,7 @@ CONFIG_HOTPLUG_PCI=y
 CONFIG_HOTPLUG_PCI_S390=y
 CONFIG_CHSC_SCH=y
 CONFIG_VFIO_AP=m
+CONFIG_VFIO_CCW=m
 CONFIG_CRASH_DUMP=y
 CONFIG_BINFMT_MISC=m
 CONFIG_HIBERNATION=y
@@ -498,6 +499,7 @@ CONFIG_VIRTIO_PCI=m
 CONFIG_VIRTIO_BALLOON=m
 CONFIG_VIRTIO_INPUT=y
 CONFIG_S390_AP_IOMMU=y
+CONFIG_S390_CCW_IOMMU=y
 CONFIG_EXT4_FS=y
 CONFIG_EXT4_FS_POSIX_ACL=y
 CONFIG_EXT4_FS_SECURITY=y
diff --git a/arch/s390/configs/defconfig b/arch/s390/configs/defconfig
index c59b922cb6c5..e4bc40073003 100644
--- a/arch/s390/configs/defconfig
+++ b/arch/s390/configs/defconfig
@@ -1,21 +1,22 @@
 CONFIG_SYSVIPC=y
 CONFIG_POSIX_MQUEUE=y
-CONFIG_USELIB=y
 CONFIG_AUDIT=y
 CONFIG_NO_HZ_IDLE=y
 CONFIG_HIGH_RES_TIMERS=y
+CONFIG_BSD_PROCESS_ACCT=y
+CONFIG_BSD_PROCESS_ACCT_V3=y
 CONFIG_TASKSTATS=y
 CONFIG_TASK_DELAY_ACCT=y
 CONFIG_TASK_XACCT=y
 CONFIG_TASK_IO_ACCOUNTING=y
-# CONFIG_CPU_ISOLATION is not set
 CONFIG_IKCONFIG=y
 CONFIG_IKCONFIG_PROC=y
-CONFIG_CGROUPS=y
+CONFIG_NUMA_BALANCING=y
+# CONFIG_NUMA_BALANCING_DEFAULT_ENABLED is not set
 CONFIG_MEMCG=y
 CONFIG_MEMCG_SWAP=y
 CONFIG_BLK_CGROUP=y
-CONFIG_CGROUP_SCHED=y
+CONFIG_CFS_BANDWIDTH=y
 CONFIG_RT_GROUP_SCHED=y
 CONFIG_CGROUP_PIDS=y
 CONFIG_CGROUP_FREEZER=y
@@ -26,98 +27,402 @@ CONFIG_CGROUP_CPUACCT=y
 CONFIG_CGROUP_PERF=y
 CONFIG_NAMESPACES=y
 CONFIG_USER_NS=y
-CONFIG_CHECKPOINT_RESTORE=y
+CONFIG_SCHED_AUTOGROUP=y
 CONFIG_BLK_DEV_INITRD=y
 CONFIG_EXPERT=y
 # CONFIG_SYSFS_SYSCALL is not set
+CONFIG_CHECKPOINT_RESTORE=y
 CONFIG_BPF_SYSCALL=y
 CONFIG_USERFAULTFD=y
 # CONFIG_COMPAT_BRK is not set
 CONFIG_PROFILING=y
-CONFIG_LIVEPATCH=y
-CONFIG_NR_CPUS=256
-CONFIG_NUMA=y
-CONFIG_HZ_100=y
-CONFIG_KEXEC_FILE=y
-CONFIG_KEXEC_VERIFY_SIG=y
-CONFIG_CRASH_DUMP=y
-CONFIG_HIBERNATION=y
-CONFIG_PM_DEBUG=y
-CONFIG_CMM=m
-CONFIG_OPROFILE=y
+CONFIG_OPROFILE=m
 CONFIG_KPROBES=y
 CONFIG_JUMP_LABEL=y
-CONFIG_STATIC_KEYS_SELFTEST=y
 CONFIG_MODULES=y
+CONFIG_MODULE_FORCE_LOAD=y
 CONFIG_MODULE_UNLOAD=y
+CONFIG_MODULE_FORCE_UNLOAD=y
+CONFIG_MODVERSIONS=y
+CONFIG_MODULE_SRCVERSION_ALL=y
+CONFIG_MODULE_SIG=y
+CONFIG_MODULE_SIG_SHA256=y
 CONFIG_BLK_DEV_INTEGRITY=y
+CONFIG_BLK_DEV_THROTTLING=y
+CONFIG_BLK_WBT=y
+CONFIG_BLK_WBT_SQ=y
 CONFIG_PARTITION_ADVANCED=y
 CONFIG_IBM_PARTITION=y
+CONFIG_BSD_DISKLABEL=y
+CONFIG_MINIX_SUBPARTITION=y
+CONFIG_SOLARIS_X86_PARTITION=y
+CONFIG_UNIXWARE_DISKLABEL=y
+CONFIG_CFQ_GROUP_IOSCHED=y
 CONFIG_DEFAULT_DEADLINE=y
-CONFIG_BINFMT_MISC=m
+CONFIG_LIVEPATCH=y
+CONFIG_TUNE_ZEC12=y
+CONFIG_NR_CPUS=512
+CONFIG_NUMA=y
+CONFIG_HZ_100=y
+CONFIG_KEXEC_FILE=y
+CONFIG_KEXEC_VERIFY_SIG=y
+CONFIG_EXPOLINE=y
+CONFIG_EXPOLINE_AUTO=y
 CONFIG_MEMORY_HOTPLUG=y
 CONFIG_MEMORY_HOTREMOVE=y
 CONFIG_KSM=y
 CONFIG_TRANSPARENT_HUGEPAGE=y
 CONFIG_CLEANCACHE=y
 CONFIG_FRONTSWAP=y
+CONFIG_MEM_SOFT_DIRTY=y
 CONFIG_ZSWAP=y
 CONFIG_ZBUD=m
 CONFIG_ZSMALLOC=m
 CONFIG_ZSMALLOC_STAT=y
+CONFIG_DEFERRED_STRUCT_PAGE_INIT=y
 CONFIG_IDLE_PAGE_TRACKING=y
+CONFIG_PCI=y
+CONFIG_HOTPLUG_PCI=y
+CONFIG_HOTPLUG_PCI_S390=y
+CONFIG_CHSC_SCH=y
+CONFIG_VFIO_AP=m
+CONFIG_VFIO_CCW=m
+CONFIG_CRASH_DUMP=y
+CONFIG_BINFMT_MISC=m
+CONFIG_HIBERNATION=y
+CONFIG_PM_DEBUG=y
 CONFIG_NET=y
 CONFIG_PACKET=y
+CONFIG_PACKET_DIAG=m
 CONFIG_UNIX=y
-CONFIG_NET_KEY=y
+CONFIG_UNIX_DIAG=m
+CONFIG_XFRM_USER=m
+CONFIG_NET_KEY=m
+CONFIG_SMC=m
+CONFIG_SMC_DIAG=m
 CONFIG_INET=y
 CONFIG_IP_MULTICAST=y
+CONFIG_IP_ADVANCED_ROUTER=y
+CONFIG_IP_MULTIPLE_TABLES=y
+CONFIG_IP_ROUTE_MULTIPATH=y
+CONFIG_IP_ROUTE_VERBOSE=y
+CONFIG_NET_IPIP=m
+CONFIG_NET_IPGRE_DEMUX=m
+CONFIG_NET_IPGRE=m
+CONFIG_NET_IPGRE_BROADCAST=y
+CONFIG_IP_MROUTE=y
+CONFIG_IP_MROUTE_MULTIPLE_TABLES=y
+CONFIG_IP_PIMSM_V1=y
+CONFIG_IP_PIMSM_V2=y
+CONFIG_SYN_COOKIES=y
+CONFIG_NET_IPVTI=m
+CONFIG_INET_AH=m
+CONFIG_INET_ESP=m
+CONFIG_INET_IPCOMP=m
+CONFIG_INET_XFRM_MODE_TRANSPORT=m
+CONFIG_INET_XFRM_MODE_TUNNEL=m
+CONFIG_INET_XFRM_MODE_BEET=m
+CONFIG_INET_DIAG=m
+CONFIG_INET_UDP_DIAG=m
+CONFIG_TCP_CONG_ADVANCED=y
+CONFIG_TCP_CONG_HSTCP=m
+CONFIG_TCP_CONG_HYBLA=m
+CONFIG_TCP_CONG_SCALABLE=m
+CONFIG_TCP_CONG_LP=m
+CONFIG_TCP_CONG_VENO=m
+CONFIG_TCP_CONG_YEAH=m
+CONFIG_TCP_CONG_ILLINOIS=m
+CONFIG_IPV6_ROUTER_PREF=y
+CONFIG_INET6_AH=m
+CONFIG_INET6_ESP=m
+CONFIG_INET6_IPCOMP=m
+CONFIG_IPV6_MIP6=m
+CONFIG_INET6_XFRM_MODE_TRANSPORT=m
+CONFIG_INET6_XFRM_MODE_TUNNEL=m
+CONFIG_INET6_XFRM_MODE_BEET=m
+CONFIG_INET6_XFRM_MODE_ROUTEOPTIMIZATION=m
+CONFIG_IPV6_VTI=m
+CONFIG_IPV6_SIT=m
+CONFIG_IPV6_GRE=m
+CONFIG_IPV6_MULTIPLE_TABLES=y
+CONFIG_IPV6_SUBTREES=y
+CONFIG_NETFILTER=y
+CONFIG_NF_CONNTRACK=m
+CONFIG_NF_CONNTRACK_SECMARK=y
+CONFIG_NF_CONNTRACK_EVENTS=y
+CONFIG_NF_CONNTRACK_TIMEOUT=y
+CONFIG_NF_CONNTRACK_TIMESTAMP=y
+CONFIG_NF_CONNTRACK_AMANDA=m
+CONFIG_NF_CONNTRACK_FTP=m
+CONFIG_NF_CONNTRACK_H323=m
+CONFIG_NF_CONNTRACK_IRC=m
+CONFIG_NF_CONNTRACK_NETBIOS_NS=m
+CONFIG_NF_CONNTRACK_SNMP=m
+CONFIG_NF_CONNTRACK_PPTP=m
+CONFIG_NF_CONNTRACK_SANE=m
+CONFIG_NF_CONNTRACK_SIP=m
+CONFIG_NF_CONNTRACK_TFTP=m
+CONFIG_NF_CT_NETLINK=m
+CONFIG_NF_CT_NETLINK_TIMEOUT=m
+CONFIG_NF_TABLES=m
+CONFIG_NFT_CT=m
+CONFIG_NFT_COUNTER=m
+CONFIG_NFT_LOG=m
+CONFIG_NFT_LIMIT=m
+CONFIG_NFT_NAT=m
+CONFIG_NFT_COMPAT=m
+CONFIG_NFT_HASH=m
+CONFIG_NETFILTER_XT_SET=m
+CONFIG_NETFILTER_XT_TARGET_AUDIT=m
+CONFIG_NETFILTER_XT_TARGET_CHECKSUM=m
+CONFIG_NETFILTER_XT_TARGET_CLASSIFY=m
+CONFIG_NETFILTER_XT_TARGET_CONNMARK=m
+CONFIG_NETFILTER_XT_TARGET_CONNSECMARK=m
+CONFIG_NETFILTER_XT_TARGET_CT=m
+CONFIG_NETFILTER_XT_TARGET_DSCP=m
+CONFIG_NETFILTER_XT_TARGET_HMARK=m
+CONFIG_NETFILTER_XT_TARGET_IDLETIMER=m
+CONFIG_NETFILTER_XT_TARGET_LOG=m
+CONFIG_NETFILTER_XT_TARGET_MARK=m
+CONFIG_NETFILTER_XT_TARGET_NFLOG=m
+CONFIG_NETFILTER_XT_TARGET_NFQUEUE=m
+CONFIG_NETFILTER_XT_TARGET_TEE=m
+CONFIG_NETFILTER_XT_TARGET_TPROXY=m
+CONFIG_NETFILTER_XT_TARGET_TRACE=m
+CONFIG_NETFILTER_XT_TARGET_SECMARK=m
+CONFIG_NETFILTER_XT_TARGET_TCPMSS=m
+CONFIG_NETFILTER_XT_TARGET_TCPOPTSTRIP=m
+CONFIG_NETFILTER_XT_MATCH_ADDRTYPE=m
+CONFIG_NETFILTER_XT_MATCH_BPF=m
+CONFIG_NETFILTER_XT_MATCH_CLUSTER=m
+CONFIG_NETFILTER_XT_MATCH_COMMENT=m
+CONFIG_NETFILTER_XT_MATCH_CONNBYTES=m
+CONFIG_NETFILTER_XT_MATCH_CONNLABEL=m
+CONFIG_NETFILTER_XT_MATCH_CONNLIMIT=m
+CONFIG_NETFILTER_XT_MATCH_CONNMARK=m
+CONFIG_NETFILTER_XT_MATCH_CONNTRACK=m
+CONFIG_NETFILTER_XT_MATCH_CPU=m
+CONFIG_NETFILTER_XT_MATCH_DCCP=m
+CONFIG_NETFILTER_XT_MATCH_DEVGROUP=m
+CONFIG_NETFILTER_XT_MATCH_DSCP=m
+CONFIG_NETFILTER_XT_MATCH_ESP=m
+CONFIG_NETFILTER_XT_MATCH_HASHLIMIT=m
+CONFIG_NETFILTER_XT_MATCH_HELPER=m
+CONFIG_NETFILTER_XT_MATCH_IPRANGE=m
+CONFIG_NETFILTER_XT_MATCH_IPVS=m
+CONFIG_NETFILTER_XT_MATCH_LENGTH=m
+CONFIG_NETFILTER_XT_MATCH_LIMIT=m
+CONFIG_NETFILTER_XT_MATCH_MAC=m
+CONFIG_NETFILTER_XT_MATCH_MARK=m
+CONFIG_NETFILTER_XT_MATCH_MULTIPORT=m
+CONFIG_NETFILTER_XT_MATCH_NFACCT=m
+CONFIG_NETFILTER_XT_MATCH_OSF=m
+CONFIG_NETFILTER_XT_MATCH_OWNER=m
+CONFIG_NETFILTER_XT_MATCH_POLICY=m
+CONFIG_NETFILTER_XT_MATCH_PHYSDEV=m
+CONFIG_NETFILTER_XT_MATCH_PKTTYPE=m
+CONFIG_NETFILTER_XT_MATCH_QUOTA=m
+CONFIG_NETFILTER_XT_MATCH_RATEEST=m
+CONFIG_NETFILTER_XT_MATCH_REALM=m
+CONFIG_NETFILTER_XT_MATCH_RECENT=m
+CONFIG_NETFILTER_XT_MATCH_STATE=m
+CONFIG_NETFILTER_XT_MATCH_STATISTIC=m
+CONFIG_NETFILTER_XT_MATCH_STRING=m
+CONFIG_NETFILTER_XT_MATCH_TCPMSS=m
+CONFIG_NETFILTER_XT_MATCH_TIME=m
+CONFIG_NETFILTER_XT_MATCH_U32=m
+CONFIG_IP_SET=m
+CONFIG_IP_SET_BITMAP_IP=m
+CONFIG_IP_SET_BITMAP_IPMAC=m
+CONFIG_IP_SET_BITMAP_PORT=m
+CONFIG_IP_SET_HASH_IP=m
+CONFIG_IP_SET_HASH_IPPORT=m
+CONFIG_IP_SET_HASH_IPPORTIP=m
+CONFIG_IP_SET_HASH_IPPORTNET=m
+CONFIG_IP_SET_HASH_NETPORTNET=m
+CONFIG_IP_SET_HASH_NET=m
+CONFIG_IP_SET_HASH_NETNET=m
+CONFIG_IP_SET_HASH_NETPORT=m
+CONFIG_IP_SET_HASH_NETIFACE=m
+CONFIG_IP_SET_LIST_SET=m
+CONFIG_IP_VS=m
+CONFIG_IP_VS_PROTO_TCP=y
+CONFIG_IP_VS_PROTO_UDP=y
+CONFIG_IP_VS_PROTO_ESP=y
+CONFIG_IP_VS_PROTO_AH=y
+CONFIG_IP_VS_RR=m
+CONFIG_IP_VS_WRR=m
+CONFIG_IP_VS_LC=m
+CONFIG_IP_VS_WLC=m
+CONFIG_IP_VS_LBLC=m
+CONFIG_IP_VS_LBLCR=m
+CONFIG_IP_VS_DH=m
+CONFIG_IP_VS_SH=m
+CONFIG_IP_VS_SED=m
+CONFIG_IP_VS_NQ=m
+CONFIG_IP_VS_FTP=m
+CONFIG_IP_VS_PE_SIP=m
+CONFIG_NF_CONNTRACK_IPV4=m
+CONFIG_NF_TABLES_IPV4=y
+CONFIG_NFT_CHAIN_ROUTE_IPV4=m
+CONFIG_NF_TABLES_ARP=y
+CONFIG_NFT_CHAIN_NAT_IPV4=m
+CONFIG_IP_NF_IPTABLES=m
+CONFIG_IP_NF_MATCH_AH=m
+CONFIG_IP_NF_MATCH_ECN=m
+CONFIG_IP_NF_MATCH_RPFILTER=m
+CONFIG_IP_NF_MATCH_TTL=m
+CONFIG_IP_NF_FILTER=m
+CONFIG_IP_NF_TARGET_REJECT=m
+CONFIG_IP_NF_NAT=m
+CONFIG_IP_NF_TARGET_MASQUERADE=m
+CONFIG_IP_NF_MANGLE=m
+CONFIG_IP_NF_TARGET_CLUSTERIP=m
+CONFIG_IP_NF_TARGET_ECN=m
+CONFIG_IP_NF_TARGET_TTL=m
+CONFIG_IP_NF_RAW=m
+CONFIG_IP_NF_SECURITY=m
+CONFIG_IP_NF_ARPTABLES=m
+CONFIG_IP_NF_ARPFILTER=m
+CONFIG_IP_NF_ARP_MANGLE=m
+CONFIG_NF_CONNTRACK_IPV6=m
+CONFIG_NF_TABLES_IPV6=y
+CONFIG_NFT_CHAIN_ROUTE_IPV6=m
+CONFIG_NFT_CHAIN_NAT_IPV6=m
+CONFIG_IP6_NF_IPTABLES=m
+CONFIG_IP6_NF_MATCH_AH=m
+CONFIG_IP6_NF_MATCH_EUI64=m
+CONFIG_IP6_NF_MATCH_FRAG=m
+CONFIG_IP6_NF_MATCH_OPTS=m
+CONFIG_IP6_NF_MATCH_HL=m
+CONFIG_IP6_NF_MATCH_IPV6HEADER=m
+CONFIG_IP6_NF_MATCH_MH=m
+CONFIG_IP6_NF_MATCH_RPFILTER=m
+CONFIG_IP6_NF_MATCH_RT=m
+CONFIG_IP6_NF_TARGET_HL=m
+CONFIG_IP6_NF_FILTER=m
+CONFIG_IP6_NF_TARGET_REJECT=m
+CONFIG_IP6_NF_MANGLE=m
+CONFIG_IP6_NF_RAW=m
+CONFIG_IP6_NF_SECURITY=m
+CONFIG_IP6_NF_NAT=m
+CONFIG_IP6_NF_TARGET_MASQUERADE=m
+CONFIG_NF_TABLES_BRIDGE=y
+CONFIG_RDS=m
+CONFIG_RDS_RDMA=m
+CONFIG_RDS_TCP=m
 CONFIG_L2TP=m
 CONFIG_L2TP_DEBUGFS=m
-CONFIG_VLAN_8021Q=y
+CONFIG_L2TP_V3=y
+CONFIG_L2TP_IP=m
+CONFIG_L2TP_ETH=m
+CONFIG_BRIDGE=m
+CONFIG_VLAN_8021Q=m
+CONFIG_VLAN_8021Q_GVRP=y
 CONFIG_NET_SCHED=y
 CONFIG_NET_SCH_CBQ=m
+CONFIG_NET_SCH_HTB=m
+CONFIG_NET_SCH_HFSC=m
 CONFIG_NET_SCH_PRIO=m
+CONFIG_NET_SCH_MULTIQ=m
 CONFIG_NET_SCH_RED=m
+CONFIG_NET_SCH_SFB=m
 CONFIG_NET_SCH_SFQ=m
 CONFIG_NET_SCH_TEQL=m
 CONFIG_NET_SCH_TBF=m
 CONFIG_NET_SCH_GRED=m
 CONFIG_NET_SCH_DSMARK=m
+CONFIG_NET_SCH_NETEM=m
+CONFIG_NET_SCH_DRR=m
+CONFIG_NET_SCH_MQPRIO=m
+CONFIG_NET_SCH_CHOKE=m
+CONFIG_NET_SCH_QFQ=m
+CONFIG_NET_SCH_CODEL=m
+CONFIG_NET_SCH_FQ_CODEL=m
+CONFIG_NET_SCH_INGRESS=m
+CONFIG_NET_SCH_PLUG=m
+CONFIG_NET_CLS_BASIC=m
 CONFIG_NET_CLS_TCINDEX=m
 CONFIG_NET_CLS_ROUTE4=m
 CONFIG_NET_CLS_FW=m
 CONFIG_NET_CLS_U32=m
+CONFIG_CLS_U32_PERF=y
 CONFIG_CLS_U32_MARK=y
 CONFIG_NET_CLS_RSVP=m
 CONFIG_NET_CLS_RSVP6=m
+CONFIG_NET_CLS_FLOW=m
+CONFIG_NET_CLS_CGROUP=y
+CONFIG_NET_CLS_BPF=m
 CONFIG_NET_CLS_ACT=y
-CONFIG_NET_ACT_POLICE=y
+CONFIG_NET_ACT_POLICE=m
+CONFIG_NET_ACT_GACT=m
+CONFIG_GACT_PROB=y
+CONFIG_NET_ACT_MIRRED=m
+CONFIG_NET_ACT_IPT=m
+CONFIG_NET_ACT_NAT=m
+CONFIG_NET_ACT_PEDIT=m
+CONFIG_NET_ACT_SIMP=m
+CONFIG_NET_ACT_SKBEDIT=m
+CONFIG_NET_ACT_CSUM=m
+CONFIG_DNS_RESOLVER=y
+CONFIG_OPENVSWITCH=m
+CONFIG_VSOCKETS=m
+CONFIG_VIRTIO_VSOCKETS=m
+CONFIG_NETLINK_DIAG=m
+CONFIG_CGROUP_NET_PRIO=y
 CONFIG_BPF_JIT=y
-CONFIG_UEVENT_HELPER_PATH="/sbin/hotplug"
+CONFIG_NET_PKTGEN=m
 CONFIG_DEVTMPFS=y
+CONFIG_DMA_CMA=y
+CONFIG_CMA_SIZE_MBYTES=0
+CONFIG_CONNECTOR=y
+CONFIG_ZRAM=m
 CONFIG_BLK_DEV_LOOP=m
+CONFIG_BLK_DEV_CRYPTOLOOP=m
+CONFIG_BLK_DEV_DRBD=m
 CONFIG_BLK_DEV_NBD=m
 CONFIG_BLK_DEV_RAM=y
+CONFIG_BLK_DEV_RAM_SIZE=32768
 CONFIG_VIRTIO_BLK=y
+CONFIG_BLK_DEV_RBD=m
+CONFIG_BLK_DEV_NVME=m
+CONFIG_ENCLOSURE_SERVICES=m
+CONFIG_GENWQE=m
+CONFIG_RAID_ATTRS=m
 CONFIG_SCSI=y
-# CONFIG_SCSI_MQ_DEFAULT is not set
 CONFIG_BLK_DEV_SD=y
-CONFIG_CHR_DEV_ST=y
-CONFIG_BLK_DEV_SR=y
-CONFIG_BLK_DEV_SR_VENDOR=y
+CONFIG_CHR_DEV_ST=m
+CONFIG_CHR_DEV_OSST=m
+CONFIG_BLK_DEV_SR=m
 CONFIG_CHR_DEV_SG=y
+CONFIG_CHR_DEV_SCH=m
+CONFIG_SCSI_ENCLOSURE=m
 CONFIG_SCSI_CONSTANTS=y
 CONFIG_SCSI_LOGGING=y
+CONFIG_SCSI_SPI_ATTRS=m
 CONFIG_SCSI_FC_ATTRS=y
+CONFIG_SCSI_SAS_LIBSAS=m
+CONFIG_SCSI_SRP_ATTRS=m
+CONFIG_ISCSI_TCP=m
+CONFIG_SCSI_DEBUG=m
 CONFIG_ZFCP=y
-CONFIG_SCSI_VIRTIO=y
+CONFIG_SCSI_VIRTIO=m
+CONFIG_SCSI_DH=y
+CONFIG_SCSI_DH_RDAC=m
+CONFIG_SCSI_DH_HP_SW=m
+CONFIG_SCSI_DH_EMC=m
+CONFIG_SCSI_DH_ALUA=m
+CONFIG_SCSI_OSD_INITIATOR=m
+CONFIG_SCSI_OSD_ULD=m
 CONFIG_MD=y
+CONFIG_BLK_DEV_MD=y
 CONFIG_MD_LINEAR=m
 CONFIG_MD_MULTIPATH=m
-CONFIG_BLK_DEV_DM=y
+CONFIG_MD_FAULTY=m
+CONFIG_BLK_DEV_DM=m
 CONFIG_DM_CRYPT=m
 CONFIG_DM_SNAPSHOT=m
+CONFIG_DM_THIN_PROVISIONING=m
 CONFIG_DM_MIRROR=m
 CONFIG_DM_LOG_USERSPACE=m
 CONFIG_DM_RAID=m
@@ -125,71 +430,216 @@ CONFIG_DM_ZERO=m
 CONFIG_DM_MULTIPATH=m
 CONFIG_DM_MULTIPATH_QL=m
 CONFIG_DM_MULTIPATH_ST=m
+CONFIG_DM_DELAY=m
 CONFIG_DM_UEVENT=y
+CONFIG_DM_FLAKEY=m
 CONFIG_DM_VERITY=m
 CONFIG_DM_SWITCH=m
 CONFIG_NETDEVICES=y
 CONFIG_BONDING=m
 CONFIG_DUMMY=m
 CONFIG_EQUALIZER=m
+CONFIG_IFB=m
+CONFIG_MACVLAN=m
+CONFIG_MACVTAP=m
+CONFIG_VXLAN=m
 CONFIG_TUN=m
-CONFIG_VIRTIO_NET=y
-# CONFIG_NET_VENDOR_ALACRITECH is not set
-# CONFIG_NET_VENDOR_AURORA is not set
-# CONFIG_NET_VENDOR_CORTINA is not set
-# CONFIG_NET_VENDOR_SOLARFLARE is not set
-# CONFIG_NET_VENDOR_SOCIONEXT is not set
-# CONFIG_NET_VENDOR_SYNOPSYS is not set
-# CONFIG_INPUT is not set
+CONFIG_VETH=m
+CONFIG_VIRTIO_NET=m
+CONFIG_NLMON=m
+# CONFIG_NET_VENDOR_ARC is not set
+# CONFIG_NET_VENDOR_CHELSIO is not set
+# CONFIG_NET_VENDOR_INTEL is not set
+# CONFIG_NET_VENDOR_MARVELL is not set
+CONFIG_MLX4_EN=m
+CONFIG_MLX5_CORE=m
+CONFIG_MLX5_CORE_EN=y
+# CONFIG_NET_VENDOR_NATSEMI is not set
+CONFIG_PPP=m
+CONFIG_PPP_BSDCOMP=m
+CONFIG_PPP_DEFLATE=m
+CONFIG_PPP_MPPE=m
+CONFIG_PPPOE=m
+CONFIG_PPTP=m
+CONFIG_PPPOL2TP=m
+CONFIG_PPP_ASYNC=m
+CONFIG_PPP_SYNC_TTY=m
+CONFIG_ISM=m
+CONFIG_INPUT_EVDEV=y
+# CONFIG_INPUT_KEYBOARD is not set
+# CONFIG_INPUT_MOUSE is not set
 # CONFIG_SERIO is not set
-# CONFIG_VT is not set
-CONFIG_DEVKMEM=y
+CONFIG_LEGACY_PTY_COUNT=0
+CONFIG_HW_RANDOM_VIRTIO=m
 CONFIG_RAW_DRIVER=m
-CONFIG_VIRTIO_BALLOON=y
+CONFIG_HANGCHECK_TIMER=m
+CONFIG_TN3270_FS=y
+# CONFIG_HWMON is not set
+CONFIG_WATCHDOG=y
+CONFIG_WATCHDOG_NOWAYOUT=y
+CONFIG_SOFT_WATCHDOG=m
+CONFIG_DIAG288_WATCHDOG=m
+CONFIG_DRM=y
+CONFIG_DRM_VIRTIO_GPU=y
+CONFIG_FRAMEBUFFER_CONSOLE=y
+# CONFIG_HID is not set
+# CONFIG_USB_SUPPORT is not set
+CONFIG_INFINIBAND=m
+CONFIG_INFINIBAND_USER_ACCESS=m
+CONFIG_MLX4_INFINIBAND=m
+CONFIG_MLX5_INFINIBAND=m
+CONFIG_VFIO=m
+CONFIG_VFIO_PCI=m
+CONFIG_VFIO_MDEV=m
+CONFIG_VFIO_MDEV_DEVICE=m
+CONFIG_VIRTIO_PCI=m
+CONFIG_VIRTIO_BALLOON=m
+CONFIG_VIRTIO_INPUT=y
+CONFIG_S390_AP_IOMMU=y
+CONFIG_S390_CCW_IOMMU=y
 CONFIG_EXT4_FS=y
 CONFIG_EXT4_FS_POSIX_ACL=y
 CONFIG_EXT4_FS_SECURITY=y
+CONFIG_JBD2_DEBUG=y
+CONFIG_JFS_FS=m
+CONFIG_JFS_POSIX_ACL=y
+CONFIG_JFS_SECURITY=y
+CONFIG_JFS_STATISTICS=y
 CONFIG_XFS_FS=y
 CONFIG_XFS_QUOTA=y
 CONFIG_XFS_POSIX_ACL=y
 CONFIG_XFS_RT=y
+CONFIG_GFS2_FS=m
+CONFIG_GFS2_FS_LOCKING_DLM=y
+CONFIG_OCFS2_FS=m
 CONFIG_BTRFS_FS=y
 CONFIG_BTRFS_FS_POSIX_ACL=y
+CONFIG_NILFS2_FS=m
+CONFIG_FS_DAX=y
+CONFIG_EXPORTFS_BLOCK_OPS=y
+CONFIG_FS_ENCRYPTION=y
 CONFIG_FANOTIFY=y
+CONFIG_FANOTIFY_ACCESS_PERMISSIONS=y
+CONFIG_QUOTA_NETLINK_INTERFACE=y
+CONFIG_QFMT_V1=m
+CONFIG_QFMT_V2=m
+CONFIG_AUTOFS4_FS=m
 CONFIG_FUSE_FS=y
+CONFIG_CUSE=m
+CONFIG_OVERLAY_FS=m
+CONFIG_FSCACHE=m
+CONFIG_CACHEFILES=m
+CONFIG_ISO9660_FS=y
+CONFIG_JOLIET=y
+CONFIG_ZISOFS=y
+CONFIG_UDF_FS=m
+CONFIG_MSDOS_FS=m
+CONFIG_VFAT_FS=m
+CONFIG_NTFS_FS=m
+CONFIG_NTFS_RW=y
 CONFIG_PROC_KCORE=y
 CONFIG_TMPFS=y
 CONFIG_TMPFS_POSIX_ACL=y
 CONFIG_HUGETLBFS=y
-# CONFIG_NETWORK_FILESYSTEMS is not set
+CONFIG_CONFIGFS_FS=m
+CONFIG_ECRYPT_FS=m
+CONFIG_CRAMFS=m
+CONFIG_SQUASHFS=m
+CONFIG_SQUASHFS_XATTR=y
+CONFIG_SQUASHFS_LZO=y
+CONFIG_SQUASHFS_XZ=y
+CONFIG_ROMFS_FS=m
+CONFIG_NFS_FS=m
+CONFIG_NFS_V3_ACL=y
+CONFIG_NFS_V4=m
+CONFIG_NFS_SWAP=y
+CONFIG_NFSD=m
+CONFIG_NFSD_V3_ACL=y
+CONFIG_NFSD_V4=y
+CONFIG_NFSD_V4_SECURITY_LABEL=y
+CONFIG_CIFS=m
+CONFIG_CIFS_STATS=y
+CONFIG_CIFS_STATS2=y
+CONFIG_CIFS_WEAK_PW_HASH=y
+CONFIG_CIFS_UPCALL=y
+CONFIG_CIFS_XATTR=y
+CONFIG_CIFS_POSIX=y
+# CONFIG_CIFS_DEBUG is not set
+CONFIG_CIFS_DFS_UPCALL=y
+CONFIG_NLS_DEFAULT="utf8"
+CONFIG_NLS_CODEPAGE_437=m
+CONFIG_NLS_CODEPAGE_850=m
+CONFIG_NLS_ASCII=m
+CONFIG_NLS_ISO8859_1=m
+CONFIG_NLS_ISO8859_15=m
+CONFIG_NLS_UTF8=m
+CONFIG_DLM=m
+CONFIG_PRINTK_TIME=y
+CONFIG_DEBUG_INFO=y
+CONFIG_DEBUG_INFO_DWARF4=y
+CONFIG_GDB_SCRIPTS=y
+# CONFIG_ENABLE_MUST_CHECK is not set
+CONFIG_FRAME_WARN=1024
+CONFIG_UNUSED_SYMBOLS=y
+CONFIG_MAGIC_SYSRQ=y
+CONFIG_DEBUG_MEMORY_INIT=y
+CONFIG_PANIC_ON_OOPS=y
+CONFIG_RCU_TORTURE_TEST=m
+CONFIG_RCU_CPU_STALL_TIMEOUT=60
+CONFIG_LATENCYTOP=y
+CONFIG_SCHED_TRACER=y
+CONFIG_FTRACE_SYSCALLS=y
+CONFIG_STACK_TRACER=y
+CONFIG_BLK_DEV_IO_TRACE=y
+CONFIG_FUNCTION_PROFILER=y
+CONFIG_HIST_TRIGGERS=y
+CONFIG_LKDTM=m
+CONFIG_PERCPU_TEST=m
+CONFIG_ATOMIC64_SELFTEST=y
+CONFIG_TEST_BPF=m
+CONFIG_BUG_ON_DATA_CORRUPTION=y
+CONFIG_S390_PTDUMP=y
+CONFIG_PERSISTENT_KEYRINGS=y
+CONFIG_BIG_KEYS=y
+CONFIG_ENCRYPTED_KEYS=m
+CONFIG_SECURITY=y
+CONFIG_SECURITY_NETWORK=y
+CONFIG_SECURITY_SELINUX=y
+CONFIG_SECURITY_SELINUX_BOOTPARAM=y
+CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE=0
+CONFIG_SECURITY_SELINUX_DISABLE=y
+CONFIG_INTEGRITY_SIGNATURE=y
+CONFIG_INTEGRITY_ASYMMETRIC_KEYS=y
+CONFIG_IMA=y
+CONFIG_IMA_DEFAULT_HASH_SHA256=y
+CONFIG_IMA_WRITE_POLICY=y
+CONFIG_IMA_APPRAISE=y
+CONFIG_CRYPTO_FIPS=y
+CONFIG_CRYPTO_DH=m
+CONFIG_CRYPTO_ECDH=m
+CONFIG_CRYPTO_USER=m
+# CONFIG_CRYPTO_MANAGER_DISABLE_TESTS is not set
+CONFIG_CRYPTO_PCRYPT=m
 CONFIG_CRYPTO_CRYPTD=m
-CONFIG_CRYPTO_AUTHENC=m
 CONFIG_CRYPTO_TEST=m
-CONFIG_CRYPTO_CCM=m
-CONFIG_CRYPTO_GCM=m
-CONFIG_CRYPTO_CBC=y
-CONFIG_CRYPTO_CFB=m
-CONFIG_CRYPTO_CTS=m
+CONFIG_CRYPTO_CHACHA20POLY1305=m
 CONFIG_CRYPTO_LRW=m
-CONFIG_CRYPTO_OFB=m
 CONFIG_CRYPTO_PCBC=m
-CONFIG_CRYPTO_XTS=m
-CONFIG_CRYPTO_CMAC=m
+CONFIG_CRYPTO_KEYWRAP=m
 CONFIG_CRYPTO_XCBC=m
 CONFIG_CRYPTO_VMAC=m
 CONFIG_CRYPTO_CRC32=m
-CONFIG_CRYPTO_MD4=m
 CONFIG_CRYPTO_MICHAEL_MIC=m
 CONFIG_CRYPTO_RMD128=m
 CONFIG_CRYPTO_RMD160=m
 CONFIG_CRYPTO_RMD256=m
 CONFIG_CRYPTO_RMD320=m
-CONFIG_CRYPTO_SHA256=y
 CONFIG_CRYPTO_SHA512=m
+CONFIG_CRYPTO_SHA3=m
 CONFIG_CRYPTO_TGR192=m
 CONFIG_CRYPTO_WP512=m
+CONFIG_CRYPTO_AES_TI=m
 CONFIG_CRYPTO_ANUBIS=m
-CONFIG_CRYPTO_ARC4=m
 CONFIG_CRYPTO_BLOWFISH=m
 CONFIG_CRYPTO_CAMELLIA=m
 CONFIG_CRYPTO_CAST5=m
@@ -199,16 +649,16 @@ CONFIG_CRYPTO_KHAZAD=m
 CONFIG_CRYPTO_SALSA20=m
 CONFIG_CRYPTO_SEED=m
 CONFIG_CRYPTO_SERPENT=m
-CONFIG_CRYPTO_SM4=m
 CONFIG_CRYPTO_TEA=m
 CONFIG_CRYPTO_TWOFISH=m
-CONFIG_CRYPTO_DEFLATE=m
+CONFIG_CRYPTO_842=m
 CONFIG_CRYPTO_LZ4=m
 CONFIG_CRYPTO_LZ4HC=m
 CONFIG_CRYPTO_ANSI_CPRNG=m
 CONFIG_CRYPTO_USER_API_HASH=m
 CONFIG_CRYPTO_USER_API_SKCIPHER=m
 CONFIG_CRYPTO_USER_API_RNG=m
+CONFIG_CRYPTO_USER_API_AEAD=m
 CONFIG_ZCRYPT=m
 CONFIG_PKEY=m
 CONFIG_CRYPTO_PAES_S390=m
@@ -217,38 +667,14 @@ CONFIG_CRYPTO_SHA256_S390=m
 CONFIG_CRYPTO_SHA512_S390=m
 CONFIG_CRYPTO_DES_S390=m
 CONFIG_CRYPTO_AES_S390=m
+CONFIG_CRYPTO_GHASH_S390=m
 CONFIG_CRYPTO_CRC32_S390=y
 CONFIG_CRC7=m
-# CONFIG_XZ_DEC_X86 is not set
-# CONFIG_XZ_DEC_POWERPC is not set
-# CONFIG_XZ_DEC_IA64 is not set
-# CONFIG_XZ_DEC_ARM is not set
-# CONFIG_XZ_DEC_ARMTHUMB is not set
-# CONFIG_XZ_DEC_SPARC is not set
-CONFIG_DEBUG_INFO=y
-CONFIG_DEBUG_INFO_DWARF4=y
-CONFIG_GDB_SCRIPTS=y
-CONFIG_UNUSED_SYMBOLS=y
-CONFIG_DEBUG_SECTION_MISMATCH=y
-CONFIG_DEBUG_FORCE_WEAK_PER_CPU=y
-CONFIG_MAGIC_SYSRQ=y
-CONFIG_DEBUG_PAGEALLOC=y
-CONFIG_DETECT_HUNG_TASK=y
-CONFIG_PANIC_ON_OOPS=y
-CONFIG_PROVE_LOCKING=y
-CONFIG_LOCK_STAT=y
-CONFIG_DEBUG_LOCKDEP=y
-CONFIG_DEBUG_ATOMIC_SLEEP=y
-CONFIG_DEBUG_LIST=y
-CONFIG_DEBUG_SG=y
-CONFIG_DEBUG_NOTIFIERS=y
-CONFIG_RCU_CPU_STALL_TIMEOUT=60
-CONFIG_LATENCYTOP=y
-CONFIG_SCHED_TRACER=y
-CONFIG_FTRACE_SYSCALLS=y
-CONFIG_TRACER_SNAPSHOT_PER_CPU_SWAP=y
-CONFIG_STACK_TRACER=y
-CONFIG_BLK_DEV_IO_TRACE=y
-CONFIG_FUNCTION_PROFILER=y
-# CONFIG_RUNTIME_TESTING_MENU is not set
-CONFIG_S390_PTDUMP=y
+CONFIG_CRC8=m
+CONFIG_CORDIC=m
+CONFIG_CMM=m
+CONFIG_APPLDATA_BASE=y
+CONFIG_KVM=m
+CONFIG_KVM_S390_UCONTROL=y
+CONFIG_VHOST_NET=m
+CONFIG_VHOST_VSOCK=m
diff --git a/arch/s390/configs/performance_defconfig b/arch/s390/configs/performance_defconfig
deleted file mode 100644
index 09aa5cb14873..000000000000
--- a/arch/s390/configs/performance_defconfig
+++ /dev/null
@@ -1,678 +0,0 @@
-CONFIG_SYSVIPC=y
-CONFIG_POSIX_MQUEUE=y
-CONFIG_AUDIT=y
-CONFIG_NO_HZ_IDLE=y
-CONFIG_HIGH_RES_TIMERS=y
-CONFIG_BSD_PROCESS_ACCT=y
-CONFIG_BSD_PROCESS_ACCT_V3=y
-CONFIG_TASKSTATS=y
-CONFIG_TASK_DELAY_ACCT=y
-CONFIG_TASK_XACCT=y
-CONFIG_TASK_IO_ACCOUNTING=y
-CONFIG_IKCONFIG=y
-CONFIG_IKCONFIG_PROC=y
-CONFIG_NUMA_BALANCING=y
-# CONFIG_NUMA_BALANCING_DEFAULT_ENABLED is not set
-CONFIG_MEMCG=y
-CONFIG_MEMCG_SWAP=y
-CONFIG_BLK_CGROUP=y
-CONFIG_CFS_BANDWIDTH=y
-CONFIG_RT_GROUP_SCHED=y
-CONFIG_CGROUP_PIDS=y
-CONFIG_CGROUP_FREEZER=y
-CONFIG_CGROUP_HUGETLB=y
-CONFIG_CPUSETS=y
-CONFIG_CGROUP_DEVICE=y
-CONFIG_CGROUP_CPUACCT=y
-CONFIG_CGROUP_PERF=y
-CONFIG_NAMESPACES=y
-CONFIG_USER_NS=y
-CONFIG_SCHED_AUTOGROUP=y
-CONFIG_BLK_DEV_INITRD=y
-CONFIG_EXPERT=y
-# CONFIG_SYSFS_SYSCALL is not set
-CONFIG_CHECKPOINT_RESTORE=y
-CONFIG_BPF_SYSCALL=y
-CONFIG_USERFAULTFD=y
-# CONFIG_COMPAT_BRK is not set
-CONFIG_PROFILING=y
-CONFIG_OPROFILE=m
-CONFIG_KPROBES=y
-CONFIG_JUMP_LABEL=y
-CONFIG_MODULES=y
-CONFIG_MODULE_FORCE_LOAD=y
-CONFIG_MODULE_UNLOAD=y
-CONFIG_MODULE_FORCE_UNLOAD=y
-CONFIG_MODVERSIONS=y
-CONFIG_MODULE_SRCVERSION_ALL=y
-CONFIG_MODULE_SIG=y
-CONFIG_MODULE_SIG_SHA256=y
-CONFIG_BLK_DEV_INTEGRITY=y
-CONFIG_BLK_DEV_THROTTLING=y
-CONFIG_BLK_WBT=y
-CONFIG_BLK_WBT_SQ=y
-CONFIG_PARTITION_ADVANCED=y
-CONFIG_IBM_PARTITION=y
-CONFIG_BSD_DISKLABEL=y
-CONFIG_MINIX_SUBPARTITION=y
-CONFIG_SOLARIS_X86_PARTITION=y
-CONFIG_UNIXWARE_DISKLABEL=y
-CONFIG_CFQ_GROUP_IOSCHED=y
-CONFIG_DEFAULT_DEADLINE=y
-CONFIG_LIVEPATCH=y
-CONFIG_TUNE_ZEC12=y
-CONFIG_NR_CPUS=512
-CONFIG_NUMA=y
-CONFIG_HZ_100=y
-CONFIG_KEXEC_FILE=y
-CONFIG_KEXEC_VERIFY_SIG=y
-CONFIG_EXPOLINE=y
-CONFIG_EXPOLINE_AUTO=y
-CONFIG_MEMORY_HOTPLUG=y
-CONFIG_MEMORY_HOTREMOVE=y
-CONFIG_KSM=y
-CONFIG_TRANSPARENT_HUGEPAGE=y
-CONFIG_CLEANCACHE=y
-CONFIG_FRONTSWAP=y
-CONFIG_MEM_SOFT_DIRTY=y
-CONFIG_ZSWAP=y
-CONFIG_ZBUD=m
-CONFIG_ZSMALLOC=m
-CONFIG_ZSMALLOC_STAT=y
-CONFIG_DEFERRED_STRUCT_PAGE_INIT=y
-CONFIG_IDLE_PAGE_TRACKING=y
-CONFIG_PCI=y
-CONFIG_HOTPLUG_PCI=y
-CONFIG_HOTPLUG_PCI_S390=y
-CONFIG_CHSC_SCH=y
-CONFIG_VFIO_AP=m
-CONFIG_CRASH_DUMP=y
-CONFIG_BINFMT_MISC=m
-CONFIG_HIBERNATION=y
-CONFIG_PM_DEBUG=y
-CONFIG_NET=y
-CONFIG_PACKET=y
-CONFIG_PACKET_DIAG=m
-CONFIG_UNIX=y
-CONFIG_UNIX_DIAG=m
-CONFIG_XFRM_USER=m
-CONFIG_NET_KEY=m
-CONFIG_SMC=m
-CONFIG_SMC_DIAG=m
-CONFIG_INET=y
-CONFIG_IP_MULTICAST=y
-CONFIG_IP_ADVANCED_ROUTER=y
-CONFIG_IP_MULTIPLE_TABLES=y
-CONFIG_IP_ROUTE_MULTIPATH=y
-CONFIG_IP_ROUTE_VERBOSE=y
-CONFIG_NET_IPIP=m
-CONFIG_NET_IPGRE_DEMUX=m
-CONFIG_NET_IPGRE=m
-CONFIG_NET_IPGRE_BROADCAST=y
-CONFIG_IP_MROUTE=y
-CONFIG_IP_MROUTE_MULTIPLE_TABLES=y
-CONFIG_IP_PIMSM_V1=y
-CONFIG_IP_PIMSM_V2=y
-CONFIG_SYN_COOKIES=y
-CONFIG_NET_IPVTI=m
-CONFIG_INET_AH=m
-CONFIG_INET_ESP=m
-CONFIG_INET_IPCOMP=m
-CONFIG_INET_XFRM_MODE_TRANSPORT=m
-CONFIG_INET_XFRM_MODE_TUNNEL=m
-CONFIG_INET_XFRM_MODE_BEET=m
-CONFIG_INET_DIAG=m
-CONFIG_INET_UDP_DIAG=m
-CONFIG_TCP_CONG_ADVANCED=y
-CONFIG_TCP_CONG_HSTCP=m
-CONFIG_TCP_CONG_HYBLA=m
-CONFIG_TCP_CONG_SCALABLE=m
-CONFIG_TCP_CONG_LP=m
-CONFIG_TCP_CONG_VENO=m
-CONFIG_TCP_CONG_YEAH=m
-CONFIG_TCP_CONG_ILLINOIS=m
-CONFIG_IPV6_ROUTER_PREF=y
-CONFIG_INET6_AH=m
-CONFIG_INET6_ESP=m
-CONFIG_INET6_IPCOMP=m
-CONFIG_IPV6_MIP6=m
-CONFIG_INET6_XFRM_MODE_TRANSPORT=m
-CONFIG_INET6_XFRM_MODE_TUNNEL=m
-CONFIG_INET6_XFRM_MODE_BEET=m
-CONFIG_INET6_XFRM_MODE_ROUTEOPTIMIZATION=m
-CONFIG_IPV6_VTI=m
-CONFIG_IPV6_SIT=m
-CONFIG_IPV6_GRE=m
-CONFIG_IPV6_MULTIPLE_TABLES=y
-CONFIG_IPV6_SUBTREES=y
-CONFIG_NETFILTER=y
-CONFIG_NF_CONNTRACK=m
-CONFIG_NF_CONNTRACK_SECMARK=y
-CONFIG_NF_CONNTRACK_EVENTS=y
-CONFIG_NF_CONNTRACK_TIMEOUT=y
-CONFIG_NF_CONNTRACK_TIMESTAMP=y
-CONFIG_NF_CONNTRACK_AMANDA=m
-CONFIG_NF_CONNTRACK_FTP=m
-CONFIG_NF_CONNTRACK_H323=m
-CONFIG_NF_CONNTRACK_IRC=m
-CONFIG_NF_CONNTRACK_NETBIOS_NS=m
-CONFIG_NF_CONNTRACK_SNMP=m
-CONFIG_NF_CONNTRACK_PPTP=m
-CONFIG_NF_CONNTRACK_SANE=m
-CONFIG_NF_CONNTRACK_SIP=m
-CONFIG_NF_CONNTRACK_TFTP=m
-CONFIG_NF_CT_NETLINK=m
-CONFIG_NF_CT_NETLINK_TIMEOUT=m
-CONFIG_NF_TABLES=m
-CONFIG_NFT_CT=m
-CONFIG_NFT_COUNTER=m
-CONFIG_NFT_LOG=m
-CONFIG_NFT_LIMIT=m
-CONFIG_NFT_NAT=m
-CONFIG_NFT_COMPAT=m
-CONFIG_NFT_HASH=m
-CONFIG_NETFILTER_XT_SET=m
-CONFIG_NETFILTER_XT_TARGET_AUDIT=m
-CONFIG_NETFILTER_XT_TARGET_CHECKSUM=m
-CONFIG_NETFILTER_XT_TARGET_CLASSIFY=m
-CONFIG_NETFILTER_XT_TARGET_CONNMARK=m
-CONFIG_NETFILTER_XT_TARGET_CONNSECMARK=m
-CONFIG_NETFILTER_XT_TARGET_CT=m
-CONFIG_NETFILTER_XT_TARGET_DSCP=m
-CONFIG_NETFILTER_XT_TARGET_HMARK=m
-CONFIG_NETFILTER_XT_TARGET_IDLETIMER=m
-CONFIG_NETFILTER_XT_TARGET_LOG=m
-CONFIG_NETFILTER_XT_TARGET_MARK=m
-CONFIG_NETFILTER_XT_TARGET_NFLOG=m
-CONFIG_NETFILTER_XT_TARGET_NFQUEUE=m
-CONFIG_NETFILTER_XT_TARGET_TEE=m
-CONFIG_NETFILTER_XT_TARGET_TPROXY=m
-CONFIG_NETFILTER_XT_TARGET_TRACE=m
-CONFIG_NETFILTER_XT_TARGET_SECMARK=m
-CONFIG_NETFILTER_XT_TARGET_TCPMSS=m
-CONFIG_NETFILTER_XT_TARGET_TCPOPTSTRIP=m
-CONFIG_NETFILTER_XT_MATCH_ADDRTYPE=m
-CONFIG_NETFILTER_XT_MATCH_BPF=m
-CONFIG_NETFILTER_XT_MATCH_CLUSTER=m
-CONFIG_NETFILTER_XT_MATCH_COMMENT=m
-CONFIG_NETFILTER_XT_MATCH_CONNBYTES=m
-CONFIG_NETFILTER_XT_MATCH_CONNLABEL=m
-CONFIG_NETFILTER_XT_MATCH_CONNLIMIT=m
-CONFIG_NETFILTER_XT_MATCH_CONNMARK=m
-CONFIG_NETFILTER_XT_MATCH_CONNTRACK=m
-CONFIG_NETFILTER_XT_MATCH_CPU=m
-CONFIG_NETFILTER_XT_MATCH_DCCP=m
-CONFIG_NETFILTER_XT_MATCH_DEVGROUP=m
-CONFIG_NETFILTER_XT_MATCH_DSCP=m
-CONFIG_NETFILTER_XT_MATCH_ESP=m
-CONFIG_NETFILTER_XT_MATCH_HASHLIMIT=m
-CONFIG_NETFILTER_XT_MATCH_HELPER=m
-CONFIG_NETFILTER_XT_MATCH_IPRANGE=m
-CONFIG_NETFILTER_XT_MATCH_IPVS=m
-CONFIG_NETFILTER_XT_MATCH_LENGTH=m
-CONFIG_NETFILTER_XT_MATCH_LIMIT=m
-CONFIG_NETFILTER_XT_MATCH_MAC=m
-CONFIG_NETFILTER_XT_MATCH_MARK=m
-CONFIG_NETFILTER_XT_MATCH_MULTIPORT=m
-CONFIG_NETFILTER_XT_MATCH_NFACCT=m
-CONFIG_NETFILTER_XT_MATCH_OSF=m
-CONFIG_NETFILTER_XT_MATCH_OWNER=m
-CONFIG_NETFILTER_XT_MATCH_POLICY=m
-CONFIG_NETFILTER_XT_MATCH_PHYSDEV=m
-CONFIG_NETFILTER_XT_MATCH_PKTTYPE=m
-CONFIG_NETFILTER_XT_MATCH_QUOTA=m
-CONFIG_NETFILTER_XT_MATCH_RATEEST=m
-CONFIG_NETFILTER_XT_MATCH_REALM=m
-CONFIG_NETFILTER_XT_MATCH_RECENT=m
-CONFIG_NETFILTER_XT_MATCH_STATE=m
-CONFIG_NETFILTER_XT_MATCH_STATISTIC=m
-CONFIG_NETFILTER_XT_MATCH_STRING=m
-CONFIG_NETFILTER_XT_MATCH_TCPMSS=m
-CONFIG_NETFILTER_XT_MATCH_TIME=m
-CONFIG_NETFILTER_XT_MATCH_U32=m
-CONFIG_IP_SET=m
-CONFIG_IP_SET_BITMAP_IP=m
-CONFIG_IP_SET_BITMAP_IPMAC=m
-CONFIG_IP_SET_BITMAP_PORT=m
-CONFIG_IP_SET_HASH_IP=m
-CONFIG_IP_SET_HASH_IPPORT=m
-CONFIG_IP_SET_HASH_IPPORTIP=m
-CONFIG_IP_SET_HASH_IPPORTNET=m
-CONFIG_IP_SET_HASH_NETPORTNET=m
-CONFIG_IP_SET_HASH_NET=m
-CONFIG_IP_SET_HASH_NETNET=m
-CONFIG_IP_SET_HASH_NETPORT=m
-CONFIG_IP_SET_HASH_NETIFACE=m
-CONFIG_IP_SET_LIST_SET=m
-CONFIG_IP_VS=m
-CONFIG_IP_VS_PROTO_TCP=y
-CONFIG_IP_VS_PROTO_UDP=y
-CONFIG_IP_VS_PROTO_ESP=y
-CONFIG_IP_VS_PROTO_AH=y
-CONFIG_IP_VS_RR=m
-CONFIG_IP_VS_WRR=m
-CONFIG_IP_VS_LC=m
-CONFIG_IP_VS_WLC=m
-CONFIG_IP_VS_LBLC=m
-CONFIG_IP_VS_LBLCR=m
-CONFIG_IP_VS_DH=m
-CONFIG_IP_VS_SH=m
-CONFIG_IP_VS_SED=m
-CONFIG_IP_VS_NQ=m
-CONFIG_IP_VS_FTP=m
-CONFIG_IP_VS_PE_SIP=m
-CONFIG_NF_CONNTRACK_IPV4=m
-CONFIG_NF_TABLES_IPV4=y
-CONFIG_NFT_CHAIN_ROUTE_IPV4=m
-CONFIG_NF_TABLES_ARP=y
-CONFIG_NFT_CHAIN_NAT_IPV4=m
-CONFIG_IP_NF_IPTABLES=m
-CONFIG_IP_NF_MATCH_AH=m
-CONFIG_IP_NF_MATCH_ECN=m
-CONFIG_IP_NF_MATCH_RPFILTER=m
-CONFIG_IP_NF_MATCH_TTL=m
-CONFIG_IP_NF_FILTER=m
-CONFIG_IP_NF_TARGET_REJECT=m
-CONFIG_IP_NF_NAT=m
-CONFIG_IP_NF_TARGET_MASQUERADE=m
-CONFIG_IP_NF_MANGLE=m
-CONFIG_IP_NF_TARGET_CLUSTERIP=m
-CONFIG_IP_NF_TARGET_ECN=m
-CONFIG_IP_NF_TARGET_TTL=m
-CONFIG_IP_NF_RAW=m
-CONFIG_IP_NF_SECURITY=m
-CONFIG_IP_NF_ARPTABLES=m
-CONFIG_IP_NF_ARPFILTER=m
-CONFIG_IP_NF_ARP_MANGLE=m
-CONFIG_NF_CONNTRACK_IPV6=m
-CONFIG_NF_TABLES_IPV6=y
-CONFIG_NFT_CHAIN_ROUTE_IPV6=m
-CONFIG_NFT_CHAIN_NAT_IPV6=m
-CONFIG_IP6_NF_IPTABLES=m
-CONFIG_IP6_NF_MATCH_AH=m
-CONFIG_IP6_NF_MATCH_EUI64=m
-CONFIG_IP6_NF_MATCH_FRAG=m
-CONFIG_IP6_NF_MATCH_OPTS=m
-CONFIG_IP6_NF_MATCH_HL=m
-CONFIG_IP6_NF_MATCH_IPV6HEADER=m
-CONFIG_IP6_NF_MATCH_MH=m
-CONFIG_IP6_NF_MATCH_RPFILTER=m
-CONFIG_IP6_NF_MATCH_RT=m
-CONFIG_IP6_NF_TARGET_HL=m
-CONFIG_IP6_NF_FILTER=m
-CONFIG_IP6_NF_TARGET_REJECT=m
-CONFIG_IP6_NF_MANGLE=m
-CONFIG_IP6_NF_RAW=m
-CONFIG_IP6_NF_SECURITY=m
-CONFIG_IP6_NF_NAT=m
-CONFIG_IP6_NF_TARGET_MASQUERADE=m
-CONFIG_NF_TABLES_BRIDGE=y
-CONFIG_RDS=m
-CONFIG_RDS_RDMA=m
-CONFIG_RDS_TCP=m
-CONFIG_L2TP=m
-CONFIG_L2TP_DEBUGFS=m
-CONFIG_L2TP_V3=y
-CONFIG_L2TP_IP=m
-CONFIG_L2TP_ETH=m
-CONFIG_BRIDGE=m
-CONFIG_VLAN_8021Q=m
-CONFIG_VLAN_8021Q_GVRP=y
-CONFIG_NET_SCHED=y
-CONFIG_NET_SCH_CBQ=m
-CONFIG_NET_SCH_HTB=m
-CONFIG_NET_SCH_HFSC=m
-CONFIG_NET_SCH_PRIO=m
-CONFIG_NET_SCH_MULTIQ=m
-CONFIG_NET_SCH_RED=m
-CONFIG_NET_SCH_SFB=m
-CONFIG_NET_SCH_SFQ=m
-CONFIG_NET_SCH_TEQL=m
-CONFIG_NET_SCH_TBF=m
-CONFIG_NET_SCH_GRED=m
-CONFIG_NET_SCH_DSMARK=m
-CONFIG_NET_SCH_NETEM=m
-CONFIG_NET_SCH_DRR=m
-CONFIG_NET_SCH_MQPRIO=m
-CONFIG_NET_SCH_CHOKE=m
-CONFIG_NET_SCH_QFQ=m
-CONFIG_NET_SCH_CODEL=m
-CONFIG_NET_SCH_FQ_CODEL=m
-CONFIG_NET_SCH_INGRESS=m
-CONFIG_NET_SCH_PLUG=m
-CONFIG_NET_CLS_BASIC=m
-CONFIG_NET_CLS_TCINDEX=m
-CONFIG_NET_CLS_ROUTE4=m
-CONFIG_NET_CLS_FW=m
-CONFIG_NET_CLS_U32=m
-CONFIG_CLS_U32_PERF=y
-CONFIG_CLS_U32_MARK=y
-CONFIG_NET_CLS_RSVP=m
-CONFIG_NET_CLS_RSVP6=m
-CONFIG_NET_CLS_FLOW=m
-CONFIG_NET_CLS_CGROUP=y
-CONFIG_NET_CLS_BPF=m
-CONFIG_NET_CLS_ACT=y
-CONFIG_NET_ACT_POLICE=m
-CONFIG_NET_ACT_GACT=m
-CONFIG_GACT_PROB=y
-CONFIG_NET_ACT_MIRRED=m
-CONFIG_NET_ACT_IPT=m
-CONFIG_NET_ACT_NAT=m
-CONFIG_NET_ACT_PEDIT=m
-CONFIG_NET_ACT_SIMP=m
-CONFIG_NET_ACT_SKBEDIT=m
-CONFIG_NET_ACT_CSUM=m
-CONFIG_DNS_RESOLVER=y
-CONFIG_OPENVSWITCH=m
-CONFIG_VSOCKETS=m
-CONFIG_VIRTIO_VSOCKETS=m
-CONFIG_NETLINK_DIAG=m
-CONFIG_CGROUP_NET_PRIO=y
-CONFIG_BPF_JIT=y
-CONFIG_NET_PKTGEN=m
-CONFIG_DEVTMPFS=y
-CONFIG_DMA_CMA=y
-CONFIG_CMA_SIZE_MBYTES=0
-CONFIG_CONNECTOR=y
-CONFIG_ZRAM=m
-CONFIG_BLK_DEV_LOOP=m
-CONFIG_BLK_DEV_CRYPTOLOOP=m
-CONFIG_BLK_DEV_DRBD=m
-CONFIG_BLK_DEV_NBD=m
-CONFIG_BLK_DEV_RAM=y
-CONFIG_BLK_DEV_RAM_SIZE=32768
-CONFIG_VIRTIO_BLK=y
-CONFIG_BLK_DEV_RBD=m
-CONFIG_BLK_DEV_NVME=m
-CONFIG_ENCLOSURE_SERVICES=m
-CONFIG_GENWQE=m
-CONFIG_RAID_ATTRS=m
-CONFIG_SCSI=y
-CONFIG_BLK_DEV_SD=y
-CONFIG_CHR_DEV_ST=m
-CONFIG_CHR_DEV_OSST=m
-CONFIG_BLK_DEV_SR=m
-CONFIG_CHR_DEV_SG=y
-CONFIG_CHR_DEV_SCH=m
-CONFIG_SCSI_ENCLOSURE=m
-CONFIG_SCSI_CONSTANTS=y
-CONFIG_SCSI_LOGGING=y
-CONFIG_SCSI_SPI_ATTRS=m
-CONFIG_SCSI_FC_ATTRS=y
-CONFIG_SCSI_SAS_LIBSAS=m
-CONFIG_SCSI_SRP_ATTRS=m
-CONFIG_ISCSI_TCP=m
-CONFIG_SCSI_DEBUG=m
-CONFIG_ZFCP=y
-CONFIG_SCSI_VIRTIO=m
-CONFIG_SCSI_DH=y
-CONFIG_SCSI_DH_RDAC=m
-CONFIG_SCSI_DH_HP_SW=m
-CONFIG_SCSI_DH_EMC=m
-CONFIG_SCSI_DH_ALUA=m
-CONFIG_SCSI_OSD_INITIATOR=m
-CONFIG_SCSI_OSD_ULD=m
-CONFIG_MD=y
-CONFIG_BLK_DEV_MD=y
-CONFIG_MD_LINEAR=m
-CONFIG_MD_MULTIPATH=m
-CONFIG_MD_FAULTY=m
-CONFIG_BLK_DEV_DM=m
-CONFIG_DM_CRYPT=m
-CONFIG_DM_SNAPSHOT=m
-CONFIG_DM_THIN_PROVISIONING=m
-CONFIG_DM_MIRROR=m
-CONFIG_DM_LOG_USERSPACE=m
-CONFIG_DM_RAID=m
-CONFIG_DM_ZERO=m
-CONFIG_DM_MULTIPATH=m
-CONFIG_DM_MULTIPATH_QL=m
-CONFIG_DM_MULTIPATH_ST=m
-CONFIG_DM_DELAY=m
-CONFIG_DM_UEVENT=y
-CONFIG_DM_FLAKEY=m
-CONFIG_DM_VERITY=m
-CONFIG_DM_SWITCH=m
-CONFIG_NETDEVICES=y
-CONFIG_BONDING=m
-CONFIG_DUMMY=m
-CONFIG_EQUALIZER=m
-CONFIG_IFB=m
-CONFIG_MACVLAN=m
-CONFIG_MACVTAP=m
-CONFIG_VXLAN=m
-CONFIG_TUN=m
-CONFIG_VETH=m
-CONFIG_VIRTIO_NET=m
-CONFIG_NLMON=m
-# CONFIG_NET_VENDOR_ARC is not set
-# CONFIG_NET_VENDOR_CHELSIO is not set
-# CONFIG_NET_VENDOR_INTEL is not set
-# CONFIG_NET_VENDOR_MARVELL is not set
-CONFIG_MLX4_EN=m
-CONFIG_MLX5_CORE=m
-CONFIG_MLX5_CORE_EN=y
-# CONFIG_NET_VENDOR_NATSEMI is not set
-CONFIG_PPP=m
-CONFIG_PPP_BSDCOMP=m
-CONFIG_PPP_DEFLATE=m
-CONFIG_PPP_MPPE=m
-CONFIG_PPPOE=m
-CONFIG_PPTP=m
-CONFIG_PPPOL2TP=m
-CONFIG_PPP_ASYNC=m
-CONFIG_PPP_SYNC_TTY=m
-CONFIG_ISM=m
-CONFIG_INPUT_EVDEV=y
-# CONFIG_INPUT_KEYBOARD is not set
-# CONFIG_INPUT_MOUSE is not set
-# CONFIG_SERIO is not set
-CONFIG_LEGACY_PTY_COUNT=0
-CONFIG_HW_RANDOM_VIRTIO=m
-CONFIG_RAW_DRIVER=m
-CONFIG_HANGCHECK_TIMER=m
-CONFIG_TN3270_FS=y
-# CONFIG_HWMON is not set
-CONFIG_WATCHDOG=y
-CONFIG_WATCHDOG_NOWAYOUT=y
-CONFIG_SOFT_WATCHDOG=m
-CONFIG_DIAG288_WATCHDOG=m
-CONFIG_DRM=y
-CONFIG_DRM_VIRTIO_GPU=y
-CONFIG_FRAMEBUFFER_CONSOLE=y
-# CONFIG_HID is not set
-# CONFIG_USB_SUPPORT is not set
-CONFIG_INFINIBAND=m
-CONFIG_INFINIBAND_USER_ACCESS=m
-CONFIG_MLX4_INFINIBAND=m
-CONFIG_MLX5_INFINIBAND=m
-CONFIG_VFIO=m
-CONFIG_VFIO_PCI=m
-CONFIG_VFIO_MDEV=m
-CONFIG_VFIO_MDEV_DEVICE=m
-CONFIG_VIRTIO_PCI=m
-CONFIG_VIRTIO_BALLOON=m
-CONFIG_VIRTIO_INPUT=y
-CONFIG_S390_AP_IOMMU=y
-CONFIG_EXT4_FS=y
-CONFIG_EXT4_FS_POSIX_ACL=y
-CONFIG_EXT4_FS_SECURITY=y
-CONFIG_JBD2_DEBUG=y
-CONFIG_JFS_FS=m
-CONFIG_JFS_POSIX_ACL=y
-CONFIG_JFS_SECURITY=y
-CONFIG_JFS_STATISTICS=y
-CONFIG_XFS_FS=y
-CONFIG_XFS_QUOTA=y
-CONFIG_XFS_POSIX_ACL=y
-CONFIG_XFS_RT=y
-CONFIG_GFS2_FS=m
-CONFIG_GFS2_FS_LOCKING_DLM=y
-CONFIG_OCFS2_FS=m
-CONFIG_BTRFS_FS=y
-CONFIG_BTRFS_FS_POSIX_ACL=y
-CONFIG_NILFS2_FS=m
-CONFIG_FS_DAX=y
-CONFIG_EXPORTFS_BLOCK_OPS=y
-CONFIG_FS_ENCRYPTION=y
-CONFIG_FANOTIFY=y
-CONFIG_FANOTIFY_ACCESS_PERMISSIONS=y
-CONFIG_QUOTA_NETLINK_INTERFACE=y
-CONFIG_QFMT_V1=m
-CONFIG_QFMT_V2=m
-CONFIG_AUTOFS4_FS=m
-CONFIG_FUSE_FS=y
-CONFIG_CUSE=m
-CONFIG_OVERLAY_FS=m
-CONFIG_FSCACHE=m
-CONFIG_CACHEFILES=m
-CONFIG_ISO9660_FS=y
-CONFIG_JOLIET=y
-CONFIG_ZISOFS=y
-CONFIG_UDF_FS=m
-CONFIG_MSDOS_FS=m
-CONFIG_VFAT_FS=m
-CONFIG_NTFS_FS=m
-CONFIG_NTFS_RW=y
-CONFIG_PROC_KCORE=y
-CONFIG_TMPFS=y
-CONFIG_TMPFS_POSIX_ACL=y
-CONFIG_HUGETLBFS=y
-CONFIG_CONFIGFS_FS=m
-CONFIG_ECRYPT_FS=m
-CONFIG_CRAMFS=m
-CONFIG_SQUASHFS=m
-CONFIG_SQUASHFS_XATTR=y
-CONFIG_SQUASHFS_LZO=y
-CONFIG_SQUASHFS_XZ=y
-CONFIG_ROMFS_FS=m
-CONFIG_NFS_FS=m
-CONFIG_NFS_V3_ACL=y
-CONFIG_NFS_V4=m
-CONFIG_NFS_SWAP=y
-CONFIG_NFSD=m
-CONFIG_NFSD_V3_ACL=y
-CONFIG_NFSD_V4=y
-CONFIG_NFSD_V4_SECURITY_LABEL=y
-CONFIG_CIFS=m
-CONFIG_CIFS_STATS=y
-CONFIG_CIFS_STATS2=y
-CONFIG_CIFS_WEAK_PW_HASH=y
-CONFIG_CIFS_UPCALL=y
-CONFIG_CIFS_XATTR=y
-CONFIG_CIFS_POSIX=y
-# CONFIG_CIFS_DEBUG is not set
-CONFIG_CIFS_DFS_UPCALL=y
-CONFIG_NLS_DEFAULT="utf8"
-CONFIG_NLS_CODEPAGE_437=m
-CONFIG_NLS_CODEPAGE_850=m
-CONFIG_NLS_ASCII=m
-CONFIG_NLS_ISO8859_1=m
-CONFIG_NLS_ISO8859_15=m
-CONFIG_NLS_UTF8=m
-CONFIG_DLM=m
-CONFIG_PRINTK_TIME=y
-CONFIG_DEBUG_INFO=y
-CONFIG_DEBUG_INFO_DWARF4=y
-CONFIG_GDB_SCRIPTS=y
-# CONFIG_ENABLE_MUST_CHECK is not set
-CONFIG_FRAME_WARN=1024
-CONFIG_UNUSED_SYMBOLS=y
-CONFIG_MAGIC_SYSRQ=y
-CONFIG_DEBUG_MEMORY_INIT=y
-CONFIG_PANIC_ON_OOPS=y
-CONFIG_RCU_TORTURE_TEST=m
-CONFIG_RCU_CPU_STALL_TIMEOUT=60
-CONFIG_LATENCYTOP=y
-CONFIG_SCHED_TRACER=y
-CONFIG_FTRACE_SYSCALLS=y
-CONFIG_STACK_TRACER=y
-CONFIG_BLK_DEV_IO_TRACE=y
-CONFIG_FUNCTION_PROFILER=y
-CONFIG_HIST_TRIGGERS=y
-CONFIG_LKDTM=m
-CONFIG_PERCPU_TEST=m
-CONFIG_ATOMIC64_SELFTEST=y
-CONFIG_TEST_BPF=m
-CONFIG_BUG_ON_DATA_CORRUPTION=y
-CONFIG_S390_PTDUMP=y
-CONFIG_PERSISTENT_KEYRINGS=y
-CONFIG_BIG_KEYS=y
-CONFIG_ENCRYPTED_KEYS=m
-CONFIG_SECURITY=y
-CONFIG_SECURITY_NETWORK=y
-CONFIG_SECURITY_SELINUX=y
-CONFIG_SECURITY_SELINUX_BOOTPARAM=y
-CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE=0
-CONFIG_SECURITY_SELINUX_DISABLE=y
-CONFIG_INTEGRITY_SIGNATURE=y
-CONFIG_INTEGRITY_ASYMMETRIC_KEYS=y
-CONFIG_IMA=y
-CONFIG_IMA_DEFAULT_HASH_SHA256=y
-CONFIG_IMA_WRITE_POLICY=y
-CONFIG_IMA_APPRAISE=y
-CONFIG_CRYPTO_FIPS=y
-CONFIG_CRYPTO_DH=m
-CONFIG_CRYPTO_ECDH=m
-CONFIG_CRYPTO_USER=m
-# CONFIG_CRYPTO_MANAGER_DISABLE_TESTS is not set
-CONFIG_CRYPTO_PCRYPT=m
-CONFIG_CRYPTO_CRYPTD=m
-CONFIG_CRYPTO_TEST=m
-CONFIG_CRYPTO_CHACHA20POLY1305=m
-CONFIG_CRYPTO_LRW=m
-CONFIG_CRYPTO_PCBC=m
-CONFIG_CRYPTO_KEYWRAP=m
-CONFIG_CRYPTO_XCBC=m
-CONFIG_CRYPTO_VMAC=m
-CONFIG_CRYPTO_CRC32=m
-CONFIG_CRYPTO_MICHAEL_MIC=m
-CONFIG_CRYPTO_RMD128=m
-CONFIG_CRYPTO_RMD160=m
-CONFIG_CRYPTO_RMD256=m
-CONFIG_CRYPTO_RMD320=m
-CONFIG_CRYPTO_SHA512=m
-CONFIG_CRYPTO_SHA3=m
-CONFIG_CRYPTO_TGR192=m
-CONFIG_CRYPTO_WP512=m
-CONFIG_CRYPTO_AES_TI=m
-CONFIG_CRYPTO_ANUBIS=m
-CONFIG_CRYPTO_BLOWFISH=m
-CONFIG_CRYPTO_CAMELLIA=m
-CONFIG_CRYPTO_CAST5=m
-CONFIG_CRYPTO_CAST6=m
-CONFIG_CRYPTO_FCRYPT=m
-CONFIG_CRYPTO_KHAZAD=m
-CONFIG_CRYPTO_SALSA20=m
-CONFIG_CRYPTO_SEED=m
-CONFIG_CRYPTO_SERPENT=m
-CONFIG_CRYPTO_TEA=m
-CONFIG_CRYPTO_TWOFISH=m
-CONFIG_CRYPTO_842=m
-CONFIG_CRYPTO_LZ4=m
-CONFIG_CRYPTO_LZ4HC=m
-CONFIG_CRYPTO_ANSI_CPRNG=m
-CONFIG_CRYPTO_USER_API_HASH=m
-CONFIG_CRYPTO_USER_API_SKCIPHER=m
-CONFIG_CRYPTO_USER_API_RNG=m
-CONFIG_CRYPTO_USER_API_AEAD=m
-CONFIG_ZCRYPT=m
-CONFIG_PKEY=m
-CONFIG_CRYPTO_PAES_S390=m
-CONFIG_CRYPTO_SHA1_S390=m
-CONFIG_CRYPTO_SHA256_S390=m
-CONFIG_CRYPTO_SHA512_S390=m
-CONFIG_CRYPTO_DES_S390=m
-CONFIG_CRYPTO_AES_S390=m
-CONFIG_CRYPTO_GHASH_S390=m
-CONFIG_CRYPTO_CRC32_S390=y
-CONFIG_CRC7=m
-CONFIG_CRC8=m
-CONFIG_CORDIC=m
-CONFIG_CMM=m
-CONFIG_APPLDATA_BASE=y
-CONFIG_KVM=m
-CONFIG_KVM_S390_UCONTROL=y
-CONFIG_VHOST_NET=m
-CONFIG_VHOST_VSOCK=m
diff --git a/arch/s390/configs/zfcpdump_defconfig b/arch/s390/configs/zfcpdump_defconfig
index 7dc7f58c4287..d92bab844b73 100644
--- a/arch/s390/configs/zfcpdump_defconfig
+++ b/arch/s390/configs/zfcpdump_defconfig
@@ -24,7 +24,6 @@ CONFIG_CRASH_DUMP=y
 # CONFIG_SECCOMP is not set
 CONFIG_NET=y
 # CONFIG_IUCV is not set
-CONFIG_UEVENT_HELPER_PATH="/sbin/hotplug"
 CONFIG_DEVTMPFS=y
 CONFIG_BLK_DEV_RAM=y
 # CONFIG_BLK_DEV_XPRAM is not set
diff --git a/arch/s390/crypto/ghash_s390.c b/arch/s390/crypto/ghash_s390.c
index 86aed30fad3a..eeeb6a7737a4 100644
--- a/arch/s390/crypto/ghash_s390.c
+++ b/arch/s390/crypto/ghash_s390.c
@@ -137,7 +137,7 @@ static struct shash_alg ghash_alg = {
 static int __init ghash_mod_init(void)
 {
         if (!cpacf_query_func(CPACF_KIMD, CPACF_KIMD_GHASH))
-                return -EOPNOTSUPP;
+                return -ENODEV;
 
         return crypto_register_shash(&ghash_alg);
 }
diff --git a/arch/s390/crypto/prng.c b/arch/s390/crypto/prng.c
index 12cca467af7d..d977643fa627 100644
--- a/arch/s390/crypto/prng.c
+++ b/arch/s390/crypto/prng.c
@@ -824,7 +824,7 @@ static int __init prng_init(void)
 
         /* check if the CPU has a PRNG */
         if (!cpacf_query_func(CPACF_KMC, CPACF_KMC_PRNG))
-                return -EOPNOTSUPP;
+                return -ENODEV;
 
         /* check if TRNG subfunction is available */
         if (cpacf_query_func(CPACF_PRNO, CPACF_PRNO_TRNG))
@@ -837,7 +837,7 @@ static int __init prng_init(void)
                         if (prng_mode == PRNG_MODE_SHA512) {
                                 pr_err("The prng module cannot "
                                        "start in SHA-512 mode\n");
-                                return -EOPNOTSUPP;
+                                return -ENODEV;
                         }
                         prng_mode = PRNG_MODE_TDES;
                 } else
diff --git a/arch/s390/crypto/sha1_s390.c b/arch/s390/crypto/sha1_s390.c
index 009572e8276d..7c15542d3685 100644
--- a/arch/s390/crypto/sha1_s390.c
+++ b/arch/s390/crypto/sha1_s390.c
@@ -86,7 +86,7 @@ static struct shash_alg alg = {
 static int __init sha1_s390_init(void)
 {
         if (!cpacf_query_func(CPACF_KIMD, CPACF_KIMD_SHA_1))
-                return -EOPNOTSUPP;
+                return -ENODEV;
         return crypto_register_shash(&alg);
 }
 
diff --git a/arch/s390/crypto/sha256_s390.c b/arch/s390/crypto/sha256_s390.c
index 62833a1d8724..af7505148f80 100644
--- a/arch/s390/crypto/sha256_s390.c
+++ b/arch/s390/crypto/sha256_s390.c
@@ -117,7 +117,7 @@ static int __init sha256_s390_init(void)
         int ret;
 
         if (!cpacf_query_func(CPACF_KIMD, CPACF_KIMD_SHA_256))
-                return -EOPNOTSUPP;
+                return -ENODEV;
         ret = crypto_register_shash(&sha256_alg);
         if (ret < 0)
                 goto out;
diff --git a/arch/s390/crypto/sha512_s390.c b/arch/s390/crypto/sha512_s390.c
index be589c340d15..ad29db085a18 100644
--- a/arch/s390/crypto/sha512_s390.c
+++ b/arch/s390/crypto/sha512_s390.c
@@ -127,7 +127,7 @@ static int __init init(void)
         int ret;
 
         if (!cpacf_query_func(CPACF_KIMD, CPACF_KIMD_SHA_512))
-                return -EOPNOTSUPP;
+                return -ENODEV;
         if ((ret = crypto_register_shash(&sha512_alg)) < 0)
                 goto out;
         if ((ret = crypto_register_shash(&sha384_alg)) < 0)
diff --git a/arch/s390/include/asm/airq.h b/arch/s390/include/asm/airq.h
index c10d2ee2dfda..01936fdfaddb 100644
--- a/arch/s390/include/asm/airq.h
+++ b/arch/s390/include/asm/airq.h
@@ -11,6 +11,7 @@
 #define _ASM_S390_AIRQ_H
 
 #include <linux/bit_spinlock.h>
+#include <linux/dma-mapping.h>
 
 struct airq_struct {
         struct hlist_node list;         /* Handler queueing. */
@@ -29,6 +30,7 @@ void unregister_adapter_interrupt(struct airq_struct *airq);
 /* Adapter interrupt bit vector */
 struct airq_iv {
         unsigned long *vector;  /* Adapter interrupt bit vector */
+        dma_addr_t vector_dma; /* Adapter interrupt bit vector dma */
         unsigned long *avail;   /* Allocation bit mask for the bit vector */
         unsigned long *bitlock; /* Lock bit mask for the bit vector */
         unsigned long *ptr;     /* Pointer associated with each bit */
diff --git a/arch/s390/include/asm/atomic.h b/arch/s390/include/asm/atomic.h
index fd20ab5d4cf7..491ad53a0d4e 100644
--- a/arch/s390/include/asm/atomic.h
+++ b/arch/s390/include/asm/atomic.h
@@ -84,9 +84,9 @@ static inline int atomic_cmpxchg(atomic_t *v, int old, int new)
 
 #define ATOMIC64_INIT(i)  { (i) }
 
-static inline long atomic64_read(const atomic64_t *v)
+static inline s64 atomic64_read(const atomic64_t *v)
 {
-        long c;
+        s64 c;
 
         asm volatile(
                 "       lg      %0,%1\n"
@@ -94,49 +94,49 @@ static inline long atomic64_read(const atomic64_t *v)
         return c;
 }
 
-static inline void atomic64_set(atomic64_t *v, long i)
+static inline void atomic64_set(atomic64_t *v, s64 i)
 {
         asm volatile(
                 "       stg     %1,%0\n"
                 : "=Q" (v->counter) : "d" (i));
 }
 
-static inline long atomic64_add_return(long i, atomic64_t *v)
+static inline s64 atomic64_add_return(s64 i, atomic64_t *v)
 {
-        return __atomic64_add_barrier(i, &v->counter) + i;
+        return __atomic64_add_barrier(i, (long *)&v->counter) + i;
 }
 
-static inline long atomic64_fetch_add(long i, atomic64_t *v)
+static inline s64 atomic64_fetch_add(s64 i, atomic64_t *v)
 {
-        return __atomic64_add_barrier(i, &v->counter);
+        return __atomic64_add_barrier(i, (long *)&v->counter);
 }
 
-static inline void atomic64_add(long i, atomic64_t *v)
+static inline void atomic64_add(s64 i, atomic64_t *v)
 {
 #ifdef CONFIG_HAVE_MARCH_Z196_FEATURES
         if (__builtin_constant_p(i) && (i > -129) && (i < 128)) {
-                __atomic64_add_const(i, &v->counter);
+                __atomic64_add_const(i, (long *)&v->counter);
                 return;
         }
 #endif
-        __atomic64_add(i, &v->counter);
+        __atomic64_add(i, (long *)&v->counter);
 }
 
 #define atomic64_xchg(v, new) (xchg(&((v)->counter), new))
 
-static inline long atomic64_cmpxchg(atomic64_t *v, long old, long new)
+static inline s64 atomic64_cmpxchg(atomic64_t *v, s64 old, s64 new)
 {
-        return __atomic64_cmpxchg(&v->counter, old, new);
+        return __atomic64_cmpxchg((long *)&v->counter, old, new);
 }
 
 #define ATOMIC64_OPS(op)                                                \
-static inline void atomic64_##op(long i, atomic64_t *v)                 \
+static inline void atomic64_##op(s64 i, atomic64_t *v)                  \
 {                                                                       \
-        __atomic64_##op(i, &v->counter);                                \
+        __atomic64_##op(i, (long *)&v->counter);                        \
 }                                                                       \
-static inline long atomic64_fetch_##op(long i, atomic64_t *v)           \
+static inline long atomic64_fetch_##op(s64 i, atomic64_t *v)            \
 {                                                                       \
-        return __atomic64_##op##_barrier(i, &v->counter);               \
+        return __atomic64_##op##_barrier(i, (long *)&v->counter);       \
 }
 
 ATOMIC64_OPS(and)
@@ -145,8 +145,8 @@ ATOMIC64_OPS(xor)
 
 #undef ATOMIC64_OPS
 
-#define atomic64_sub_return(_i, _v)     atomic64_add_return(-(long)(_i), _v)
-#define atomic64_fetch_sub(_i, _v)      atomic64_fetch_add(-(long)(_i), _v)
-#define atomic64_sub(_i, _v)            atomic64_add(-(long)(_i), _v)
+#define atomic64_sub_return(_i, _v)     atomic64_add_return(-(s64)(_i), _v)
+#define atomic64_fetch_sub(_i, _v)      atomic64_fetch_add(-(s64)(_i), _v)
+#define atomic64_sub(_i, _v)            atomic64_add(-(s64)(_i), _v)
 
 #endif /* __ARCH_S390_ATOMIC__  */
diff --git a/arch/s390/include/asm/ccwdev.h b/arch/s390/include/asm/ccwdev.h
index a29dd430fb40..865ce1cb86d5 100644
--- a/arch/s390/include/asm/ccwdev.h
+++ b/arch/s390/include/asm/ccwdev.h
@@ -226,6 +226,10 @@ extern int ccw_device_enable_console(struct ccw_device *);
 extern void ccw_device_wait_idle(struct ccw_device *);
 extern int ccw_device_force_console(struct ccw_device *);
 
+extern void *ccw_device_dma_zalloc(struct ccw_device *cdev, size_t size);
+extern void ccw_device_dma_free(struct ccw_device *cdev,
+                                void *cpu_addr, size_t size);
+
 int ccw_device_siosl(struct ccw_device *);
 
 extern void ccw_device_get_schid(struct ccw_device *, struct subchannel_id *);
diff --git a/arch/s390/include/asm/cio.h b/arch/s390/include/asm/cio.h
index 1727180e8ca1..b5bfb3123cb1 100644
--- a/arch/s390/include/asm/cio.h
+++ b/arch/s390/include/asm/cio.h
@@ -7,6 +7,7 @@
 
 #include <linux/spinlock.h>
 #include <linux/bitops.h>
+#include <linux/genalloc.h>
 #include <asm/types.h>
 
 #define LPM_ANYPATH 0xff
@@ -264,6 +265,36 @@ struct ciw {
 #define CIW_TYPE_RNI    0x2     /* read node identifier */
 
 /*
+ * Node Descriptor as defined in SA22-7204, "Common I/O-Device Commands"
+ */
+
+#define ND_VALIDITY_VALID       0
+#define ND_VALIDITY_OUTDATED    1
+#define ND_VALIDITY_INVALID     2
+
+struct node_descriptor {
+        /* Flags. */
+        union {
+                struct {
+                        u32 validity:3;
+                        u32 reserved:5;
+                } __packed;
+                u8 byte0;
+        } __packed;
+
+        /* Node parameters. */
+        u32 params:24;
+
+        /* Node ID. */
+        char type[6];
+        char model[3];
+        char manufacturer[3];
+        char plant[2];
+        char seq[12];
+        u16 tag;
+} __packed;
+
+/*
  * Flags used as input parameters for do_IO()
  */
 #define DOIO_ALLOW_SUSPEND       0x0001 /* allow for channel prog. suspend */
@@ -328,6 +359,16 @@ static inline u8 pathmask_to_pos(u8 mask)
 void channel_subsystem_reinit(void);
 extern void css_schedule_reprobe(void);
 
+extern void *cio_dma_zalloc(size_t size);
+extern void cio_dma_free(void *cpu_addr, size_t size);
+extern struct device *cio_get_dma_css_dev(void);
+
+void *cio_gp_dma_zalloc(struct gen_pool *gp_dma, struct device *dma_dev,
+                        size_t size);
+void cio_gp_dma_free(struct gen_pool *gp_dma, void *cpu_addr, size_t size);
+void cio_gp_dma_destroy(struct gen_pool *gp_dma, struct device *dma_dev);
+struct gen_pool *cio_gp_dma_create(struct device *dma_dev, int nr_pages);
+
 /* Function from drivers/s390/cio/chsc.c */
 int chsc_sstpc(void *page, unsigned int op, u16 ctrl, u64 *clock_delta);
 int chsc_sstpi(void *page, void *result, size_t size);
diff --git a/arch/s390/include/asm/ctl_reg.h b/arch/s390/include/asm/ctl_reg.h
index 3bda757317cf..0cf6b53587db 100644
--- a/arch/s390/include/asm/ctl_reg.h
+++ b/arch/s390/include/asm/ctl_reg.h
@@ -112,13 +112,8 @@ union ctlreg2 {
         };
 };
 
-#ifdef CONFIG_SMP
-# define ctl_set_bit(cr, bit) smp_ctl_set_bit(cr, bit)
-# define ctl_clear_bit(cr, bit) smp_ctl_clear_bit(cr, bit)
-#else
-# define ctl_set_bit(cr, bit) __ctl_set_bit(cr, bit)
-# define ctl_clear_bit(cr, bit) __ctl_clear_bit(cr, bit)
-#endif
+#define ctl_set_bit(cr, bit) smp_ctl_set_bit(cr, bit)
+#define ctl_clear_bit(cr, bit) smp_ctl_clear_bit(cr, bit)
 
 #endif /* __ASSEMBLY__ */
 #endif /* __ASM_CTL_REG_H */
diff --git a/arch/s390/include/asm/debug.h b/arch/s390/include/asm/debug.h
index c305d39f5016..310134015541 100644
--- a/arch/s390/include/asm/debug.h
+++ b/arch/s390/include/asm/debug.h
@@ -107,13 +107,37 @@ void debug_unregister(debug_info_t *id);
 void debug_set_level(debug_info_t *id, int new_level);
 
 void debug_set_critical(void);
+
 void debug_stop_all(void);
 
+/**
+ * debug_level_enabled() - Returns true if debug events for the specified
+ *                         level would be logged. Otherwise returns false.
+ *
+ * @id:         handle for debug log
+ * @level:      debug level
+ *
+ * Return:
+ * - %true if level is less or equal to the current debug level.
+ */
 static inline bool debug_level_enabled(debug_info_t *id, int level)
 {
         return level <= id->level;
 }
 
+/**
+ * debug_event() - writes binary debug entry to active debug area
+ *                 (if level <= actual debug level)
+ *
+ * @id:         handle for debug log
+ * @level:      debug level
+ * @data:       pointer to data for debug entry
+ * @length:     length of data in bytes
+ *
+ * Return:
+ * - Address of written debug entry
+ * - %NULL if error
+ */
 static inline debug_entry_t *debug_event(debug_info_t *id, int level,
                                          void *data, int length)
 {
@@ -122,6 +146,18 @@ static inline debug_entry_t *debug_event(debug_info_t *id, int level,
         return debug_event_common(id, level, data, length);
 }
 
+/**
+ * debug_int_event() - writes unsigned integer debug entry to active debug area
+ *                     (if level <= actual debug level)
+ *
+ * @id:         handle for debug log
+ * @level:      debug level
+ * @tag:        integer value for debug entry
+ *
+ * Return:
+ * - Address of written debug entry
+ * - %NULL if error
+ */
 static inline debug_entry_t *debug_int_event(debug_info_t *id, int level,
                                              unsigned int tag)
 {
@@ -132,6 +168,18 @@ static inline debug_entry_t *debug_int_event(debug_info_t *id, int level,
         return debug_event_common(id, level, &t, sizeof(unsigned int));
 }
 
+/**
+ * debug_long_event() - writes unsigned long debug entry to active debug area
+ *                     (if level <= actual debug level)
+ *
+ * @id:         handle for debug log
+ * @level:      debug level
+ * @tag:        long integer value for debug entry
+ *
+ * Return:
+ * - Address of written debug entry
+ * - %NULL if error
+ */
 static inline debug_entry_t *debug_long_event(debug_info_t *id, int level,
                                               unsigned long tag)
 {
@@ -142,6 +190,18 @@ static inline debug_entry_t *debug_long_event(debug_info_t *id, int level,
         return debug_event_common(id, level, &t, sizeof(unsigned long));
 }
 
+/**
+ * debug_text_event() - writes string debug entry in ascii format to active
+ *                      debug area (if level <= actual debug level)
+ *
+ * @id:         handle for debug log
+ * @level:      debug level
+ * @txt:        string for debug entry
+ *
+ * Return:
+ * - Address of written debug entry
+ * - %NULL if error
+ */
 static inline debug_entry_t *debug_text_event(debug_info_t *id, int level,
                                               const char *txt)
 {
@@ -152,12 +212,28 @@ static inline debug_entry_t *debug_text_event(debug_info_t *id, int level,
 
 /*
  * IMPORTANT: Use "%s" in sprintf format strings with care! Only pointers are
- * stored in the s390dbf. See Documentation/s390/s390dbf.txt for more details!
+ * stored in the s390dbf. See Documentation/s390/s390dbf.rst for more details!
  */
 extern debug_entry_t *
 __debug_sprintf_event(debug_info_t *id, int level, char *string, ...)
         __attribute__ ((format(printf, 3, 4)));
 
+/**
+ * debug_sprintf_event() - writes debug entry with format string
+ *                         and varargs (longs) to active debug area
+ *                         (if level $<=$ actual debug level).
+ *
+ * @_id:        handle for debug log
+ * @_level:     debug level
+ * @_fmt:       format string for debug entry
+ * @...:        varargs used as in sprintf()
+ *
+ * Return:
+ * - Address of written debug entry
+ * - %NULL if error
+ *
+ * floats and long long datatypes cannot be used as varargs.
+ */
 #define debug_sprintf_event(_id, _level, _fmt, ...)                     \
 ({                                                                      \
         debug_entry_t *__ret;                                           \
@@ -172,6 +248,20 @@ __debug_sprintf_event(debug_info_t *id, int level, char *string, ...)
         __ret;                                                          \
 })
 
+/**
+ * debug_exception() - writes binary debug entry to active debug area
+ *                     (if level <= actual debug level)
+ *                     and switches to next debug area
+ *
+ * @id:         handle for debug log
+ * @level:      debug level
+ * @data:       pointer to data for debug entry
+ * @length:     length of data in bytes
+ *
+ * Return:
+ * - Address of written debug entry
+ * - %NULL if error
+ */
 static inline debug_entry_t *debug_exception(debug_info_t *id, int level,
                                              void *data, int length)
 {
@@ -180,6 +270,19 @@ static inline debug_entry_t *debug_exception(debug_info_t *id, int level,
         return debug_exception_common(id, level, data, length);
 }
 
+/**
+ * debug_int_exception() - writes unsigned int debug entry to active debug area
+ *                         (if level <= actual debug level)
+ *                         and switches to next debug area
+ *
+ * @id:         handle for debug log
+ * @level:      debug level
+ * @tag:        integer value for debug entry
+ *
+ * Return:
+ * - Address of written debug entry
+ * - %NULL if error
+ */
 static inline debug_entry_t *debug_int_exception(debug_info_t *id, int level,
                                                  unsigned int tag)
 {
@@ -190,6 +293,19 @@ static inline debug_entry_t *debug_int_exception(debug_info_t *id, int level,
         return debug_exception_common(id, level, &t, sizeof(unsigned int));
 }
 
+/**
+ * debug_long_exception() - writes long debug entry to active debug area
+ *                         (if level <= actual debug level)
+ *                         and switches to next debug area
+ *
+ * @id:         handle for debug log
+ * @level:      debug level
+ * @tag:        long integer value for debug entry
+ *
+ * Return:
+ * - Address of written debug entry
+ * - %NULL if error
+ */
 static inline debug_entry_t *debug_long_exception (debug_info_t *id, int level,
                                                    unsigned long tag)
 {
@@ -200,6 +316,20 @@ static inline debug_entry_t *debug_long_exception (debug_info_t *id, int level,
         return debug_exception_common(id, level, &t, sizeof(unsigned long));
 }
 
+/**
+ * debug_text_exception() - writes string debug entry in ascii format to active
+ *                          debug area (if level <= actual debug level)
+ *                          and switches to next debug area
+ * area
+ *
+ * @id: handle for debug log
+ * @level:      debug level
+ * @txt:        string for debug entry
+ *
+ * Return:
+ * - Address of written debug entry
+ * - %NULL if error
+ */
 static inline debug_entry_t *debug_text_exception(debug_info_t *id, int level,
                                                   const char *txt)
 {
@@ -210,12 +340,30 @@ static inline debug_entry_t *debug_text_exception(debug_info_t *id, int level,
 
 /*
  * IMPORTANT: Use "%s" in sprintf format strings with care! Only pointers are
- * stored in the s390dbf. See Documentation/s390/s390dbf.txt for more details!
+ * stored in the s390dbf. See Documentation/s390/s390dbf.rst for more details!
  */
 extern debug_entry_t *
 __debug_sprintf_exception(debug_info_t *id, int level, char *string, ...)
         __attribute__ ((format(printf, 3, 4)));
 
+
+/**
+ * debug_sprintf_exception() - writes debug entry with format string and
+ *                             varargs (longs) to active debug area
+ *                             (if level <= actual debug level)
+ *                             and switches to next debug area.
+ *
+ * @_id:        handle for debug log
+ * @_level:     debug level
+ * @_fmt:       format string for debug entry
+ * @...:        varargs used as in sprintf()
+ *
+ * Return:
+ * - Address of written debug entry
+ * - %NULL if error
+ *
+ * floats and long long datatypes cannot be used as varargs.
+ */
 #define debug_sprintf_exception(_id, _level, _fmt, ...)                 \
 ({                                                                      \
         debug_entry_t *__ret;                                           \
@@ -231,6 +379,7 @@ __debug_sprintf_exception(debug_info_t *id, int level, char *string, ...)
 })
 
 int debug_register_view(debug_info_t *id, struct debug_view *view);
+
 int debug_unregister_view(debug_info_t *id, struct debug_view *view);
 
 /*
diff --git a/arch/s390/include/asm/facility.h b/arch/s390/include/asm/facility.h
index e78cda94456b..68c476b20b57 100644
--- a/arch/s390/include/asm/facility.h
+++ b/arch/s390/include/asm/facility.h
@@ -59,6 +59,18 @@ static inline int test_facility(unsigned long nr)
         return __test_facility(nr, &S390_lowcore.stfle_fac_list);
 }
 
+static inline unsigned long __stfle_asm(u64 *stfle_fac_list, int size)
+{
+        register unsigned long reg0 asm("0") = size - 1;
+
+        asm volatile(
+                ".insn s,0xb2b00000,0(%1)" /* stfle */
+                : "+d" (reg0)
+                : "a" (stfle_fac_list)
+                : "memory", "cc");
+        return reg0;
+}
+
 /**
  * stfle - Store facility list extended
  * @stfle_fac_list: array where facility list can be stored
@@ -75,13 +87,8 @@ static inline void __stfle(u64 *stfle_fac_list, int size)
         memcpy(stfle_fac_list, &S390_lowcore.stfl_fac_list, 4);
         if (S390_lowcore.stfl_fac_list & 0x01000000) {
                 /* More facility bits available with stfle */
-                register unsigned long reg0 asm("0") = size - 1;
-
-                asm volatile(".insn s,0xb2b00000,0(%1)" /* stfle */
-                             : "+d" (reg0)
-                             : "a" (stfle_fac_list)
-                             : "memory", "cc");
-                nr = (reg0 + 1) * 8; /* # bytes stored by stfle */
+                nr = __stfle_asm(stfle_fac_list, size);
+                nr = min_t(unsigned long, (nr + 1) * 8, size * 8);
         }
         memset((char *) stfle_fac_list + nr, 0, size * 8 - nr);
 }
diff --git a/arch/s390/include/asm/idals.h b/arch/s390/include/asm/idals.h
index 15578fd762f6..6fb7aced104a 100644
--- a/arch/s390/include/asm/idals.h
+++ b/arch/s390/include/asm/idals.h
@@ -122,8 +122,7 @@ idal_buffer_alloc(size_t size, int page_order)
 
         nr_ptrs = (size + IDA_BLOCK_SIZE - 1) >> IDA_SIZE_LOG;
         nr_chunks = (4096 << page_order) >> IDA_SIZE_LOG;
-        ib = kmalloc(sizeof(struct idal_buffer) + nr_ptrs*sizeof(void *),
-                     GFP_DMA | GFP_KERNEL);
+        ib = kmalloc(struct_size(ib, data, nr_ptrs), GFP_DMA | GFP_KERNEL);
         if (ib == NULL)
                 return ERR_PTR(-ENOMEM);
         ib->size = size;
diff --git a/arch/s390/include/asm/kvm_host.h b/arch/s390/include/asm/kvm_host.h
index 2b00a3ebee08..4a928e2c667b 100644
--- a/arch/s390/include/asm/kvm_host.h
+++ b/arch/s390/include/asm/kvm_host.h
@@ -18,6 +18,7 @@
 #include <linux/kvm_host.h>
 #include <linux/kvm.h>
 #include <linux/seqlock.h>
+#include <linux/module.h>
 #include <asm/debug.h>
 #include <asm/cpu.h>
 #include <asm/fpu/api.h>
@@ -720,8 +721,14 @@ struct kvm_s390_cpu_model {
         unsigned short ibc;
 };
 
+struct kvm_s390_module_hook {
+        int (*hook)(struct kvm_vcpu *vcpu);
+        struct module *owner;
+};
+
 struct kvm_s390_crypto {
         struct kvm_s390_crypto_cb *crycb;
+        struct kvm_s390_module_hook *pqap_hook;
         __u32 crycbd;
         __u8 aes_kw;
         __u8 dea_kw;
diff --git a/arch/s390/include/asm/mem_encrypt.h b/arch/s390/include/asm/mem_encrypt.h
new file mode 100644
index 000000000000..3eb018508190
--- /dev/null
+++ b/arch/s390/include/asm/mem_encrypt.h
@@ -0,0 +1,17 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+#ifndef S390_MEM_ENCRYPT_H__
+#define S390_MEM_ENCRYPT_H__
+
+#ifndef __ASSEMBLY__
+
+#define sme_me_mask     0ULL
+
+static inline bool sme_active(void) { return false; }
+extern bool sev_active(void);
+
+int set_memory_encrypted(unsigned long addr, int numpages);
+int set_memory_decrypted(unsigned long addr, int numpages);
+
+#endif  /* __ASSEMBLY__ */
+
+#endif  /* S390_MEM_ENCRYPT_H__ */
diff --git a/arch/s390/include/asm/pci.h b/arch/s390/include/asm/pci.h
index 305befd55326..a2399eff84ca 100644
--- a/arch/s390/include/asm/pci.h
+++ b/arch/s390/include/asm/pci.h
@@ -194,6 +194,11 @@ int zpci_init_iommu(struct zpci_dev *zdev);
 void zpci_destroy_iommu(struct zpci_dev *zdev);
 
 #ifdef CONFIG_PCI
+static inline bool zpci_use_mio(struct zpci_dev *zdev)
+{
+        return static_branch_likely(&have_mio) && zdev->mio_capable;
+}
+
 /* Error handling and recovery */
 void zpci_event_error(void *);
 void zpci_event_availability(void *);
diff --git a/arch/s390/include/asm/percpu.h b/arch/s390/include/asm/percpu.h
index 0095ddb58ff6..50b4ce8cddfd 100644
--- a/arch/s390/include/asm/percpu.h
+++ b/arch/s390/include/asm/percpu.h
@@ -16,7 +16,7 @@
  * per cpu area, use weak definitions to force the compiler to
  * generate external references.
  */
-#if defined(CONFIG_SMP) && defined(MODULE)
+#if defined(MODULE)
 #define ARCH_NEEDS_WEAK_PER_CPU
 #endif
 
diff --git a/arch/s390/include/asm/processor.h b/arch/s390/include/asm/processor.h
index b0fcbc37b637..14883b1562e0 100644
--- a/arch/s390/include/asm/processor.h
+++ b/arch/s390/include/asm/processor.h
@@ -36,6 +36,7 @@
 
 #ifndef __ASSEMBLY__
 
+#include <linux/cpumask.h>
 #include <linux/linkage.h>
 #include <linux/irqflags.h>
 #include <asm/cpu.h>
@@ -221,12 +222,6 @@ static __no_kasan_or_inline unsigned short stap(void)
         return cpu_address;
 }
 
-/*
- * Give up the time slice of the virtual PU.
- */
-#define cpu_relax_yield cpu_relax_yield
-void cpu_relax_yield(void);
-
 #define cpu_relax() barrier()
 
 #define ECAG_CACHE_ATTRIBUTE    0
diff --git a/arch/s390/include/asm/smp.h b/arch/s390/include/asm/smp.h
index 3907ead27ffa..b157a81fb977 100644
--- a/arch/s390/include/asm/smp.h
+++ b/arch/s390/include/asm/smp.h
@@ -9,9 +9,6 @@
 #define __ASM_SMP_H
 
 #include <asm/sigp.h>
-
-#ifdef CONFIG_SMP
-
 #include <asm/lowcore.h>
 
 #define raw_smp_processor_id()  (S390_lowcore.cpu_nr)
@@ -40,33 +37,6 @@ extern int smp_cpu_get_polarization(int cpu);
 extern void smp_fill_possible_mask(void);
 extern void smp_detect_cpus(void);
 
-#else /* CONFIG_SMP */
-
-#define smp_cpu_mtid    0
-
-static inline void smp_call_ipl_cpu(void (*func)(void *), void *data)
-{
-        func(data);
-}
-
-static inline void smp_call_online_cpu(void (*func)(void *), void *data)
-{
-        func(data);
-}
-
-static inline void smp_emergency_stop(void)
-{
-}
-
-static inline int smp_find_processor_id(u16 address) { return 0; }
-static inline int smp_store_status(int cpu) { return 0; }
-static inline int smp_vcpu_scheduled(int cpu) { return 1; }
-static inline void smp_yield_cpu(int cpu) { }
-static inline void smp_fill_possible_mask(void) { }
-static inline void smp_detect_cpus(void) { }
-
-#endif /* CONFIG_SMP */
-
 static inline void smp_stop_cpu(void)
 {
         u16 pcpu = stap();
@@ -83,14 +53,9 @@ static inline int smp_get_base_cpu(int cpu)
         return cpu - (cpu % (smp_cpu_mtid + 1));
 }
 
-#ifdef CONFIG_HOTPLUG_CPU
 extern int smp_rescan_cpus(void);
 extern void __noreturn cpu_die(void);
 extern void __cpu_die(unsigned int cpu);
 extern int __cpu_disable(void);
-#else
-static inline int smp_rescan_cpus(void) { return 0; }
-static inline void cpu_die(void) { }
-#endif
 
 #endif /* __ASM_SMP_H */
diff --git a/arch/s390/include/asm/spinlock.h b/arch/s390/include/asm/spinlock.h
index 0a29588aa00b..c02bff33f6c7 100644
--- a/arch/s390/include/asm/spinlock.h
+++ b/arch/s390/include/asm/spinlock.h
@@ -20,11 +20,7 @@
 
 extern int spin_retry;
 
-#ifndef CONFIG_SMP
-static inline bool arch_vcpu_is_preempted(int cpu) { return false; }
-#else
 bool arch_vcpu_is_preempted(int cpu);
-#endif
 
 #define vcpu_is_preempted arch_vcpu_is_preempted
 
diff --git a/arch/s390/include/asm/tlbflush.h b/arch/s390/include/asm/tlbflush.h
index 8c840f0904f3..82703e03f35d 100644
--- a/arch/s390/include/asm/tlbflush.h
+++ b/arch/s390/include/asm/tlbflush.h
@@ -32,7 +32,6 @@ static inline void __tlb_flush_idte(unsigned long asce)
                 : : "a" (opt), "a" (asce) : "cc");
 }
 
-#ifdef CONFIG_SMP
 void smp_ptlb_all(void);
 
 /*
@@ -83,22 +82,6 @@ static inline void __tlb_flush_kernel(void)
         else
                 __tlb_flush_global();
 }
-#else
-#define __tlb_flush_global()    __tlb_flush_local()
-
-/*
- * Flush TLB entries for a specific ASCE on all CPUs.
- */
-static inline void __tlb_flush_mm(struct mm_struct *mm)
-{
-        __tlb_flush_local();
-}
-
-static inline void __tlb_flush_kernel(void)
-{
-        __tlb_flush_local();
-}
-#endif
 
 static inline void __tlb_flush_mm_lazy(struct mm_struct * mm)
 {
diff --git a/arch/s390/include/asm/unwind.h b/arch/s390/include/asm/unwind.h
index 6eb2ef105d87..d827b5b9a32c 100644
--- a/arch/s390/include/asm/unwind.h
+++ b/arch/s390/include/asm/unwind.h
@@ -79,23 +79,4 @@ static inline void unwind_module_init(struct module *mod, void *orc_ip,
                                       size_t orc_ip_size, void *orc,
                                       size_t orc_size) {}
 
-#ifdef CONFIG_KASAN
-/*
- * This disables KASAN checking when reading a value from another task's stack,
- * since the other task could be running on another CPU and could have poisoned
- * the stack in the meantime.
- */
-#define READ_ONCE_TASK_STACK(task, x)                   \
-({                                                      \
-        unsigned long val;                              \
-        if (task == current)                            \
-                val = READ_ONCE(x);                     \
-        else                                            \
-                val = READ_ONCE_NOCHECK(x);             \
-        val;                                            \
-})
-#else
-#define READ_ONCE_TASK_STACK(task, x) READ_ONCE(x)
-#endif
-
 #endif /* _ASM_S390_UNWIND_H */
diff --git a/arch/s390/include/uapi/asm/runtime_instr.h b/arch/s390/include/uapi/asm/runtime_instr.h
index 45c9ec984e6b..455da46e3193 100644
--- a/arch/s390/include/uapi/asm/runtime_instr.h
+++ b/arch/s390/include/uapi/asm/runtime_instr.h
@@ -57,7 +57,7 @@ struct runtime_instr_cb {
         __u64 sf;
         __u64 rsic;
         __u64 reserved8;
-} __packed __aligned(8);
+} __attribute__((__packed__, __aligned__(8)));
 
 static inline void load_runtime_instr_cb(struct runtime_instr_cb *cb)
 {
diff --git a/arch/s390/kernel/Makefile b/arch/s390/kernel/Makefile
index b0478d01a0c5..0f255b54b051 100644
--- a/arch/s390/kernel/Makefile
+++ b/arch/s390/kernel/Makefile
@@ -53,6 +53,7 @@ obj-y	+= sysinfo.o lgr.o os_info.o machine_kexec.o pgm_check.o
 obj-y   += runtime_instr.o cache.o fpu.o dumpstack.o guarded_storage.o sthyi.o
 obj-y   += entry.o reipl.o relocate_kernel.o kdebugfs.o alternative.o
 obj-y   += nospec-branch.o ipl_vmparm.o machine_kexec_reloc.o unwind_bc.o
+obj-y   += smp.o
 
 extra-y                         += head64.o vmlinux.lds
 
@@ -60,7 +61,6 @@ obj-$(CONFIG_SYSFS)		+= nospec-sysfs.o
 CFLAGS_REMOVE_nospec-branch.o   += $(CC_FLAGS_EXPOLINE)
 
 obj-$(CONFIG_MODULES)           += module.o
-obj-$(CONFIG_SMP)               += smp.o
 obj-$(CONFIG_SCHED_TOPOLOGY)    += topology.o
 obj-$(CONFIG_HIBERNATION)       += suspend.o swsusp.o
 obj-$(CONFIG_AUDIT)             += audit.o
diff --git a/arch/s390/kernel/debug.c b/arch/s390/kernel/debug.c
index 0ebf08c3b35e..6d321f5f101d 100644
--- a/arch/s390/kernel/debug.c
+++ b/arch/s390/kernel/debug.c
@@ -647,11 +647,23 @@ static int debug_close(struct inode *inode, struct file *file)
         return 0; /* success */
 }
 
-/*
- * debug_register_mode:
- * - Creates and initializes debug area for the caller
- *   The mode parameter allows to specify access rights for the s390dbf files
- * - Returns handle for debug area
+/**
+ * debug_register_mode() - creates and initializes debug area.
+ *
+ * @name:       Name of debug log (e.g. used for debugfs entry)
+ * @pages_per_area:     Number of pages, which will be allocated per area
+ * @nr_areas:   Number of debug areas
+ * @buf_size:   Size of data area in each debug entry
+ * @mode:       File mode for debugfs files. E.g. S_IRWXUGO
+ * @uid:        User ID for debugfs files. Currently only 0 is supported.
+ * @gid:        Group ID for debugfs files. Currently only 0 is supported.
+ *
+ * Return:
+ * - Handle for generated debug area
+ * - %NULL if register failed
+ *
+ * Allocates memory for a debug log.
+ * Must not be called within an interrupt handler.
  */
 debug_info_t *debug_register_mode(const char *name, int pages_per_area,
                                   int nr_areas, int buf_size, umode_t mode,
@@ -681,10 +693,21 @@ out:
 }
 EXPORT_SYMBOL(debug_register_mode);
 
-/*
- * debug_register:
- * - creates and initializes debug area for the caller
- * - returns handle for debug area
+/**
+ * debug_register() - creates and initializes debug area with default file mode.
+ *
+ * @name:       Name of debug log (e.g. used for debugfs entry)
+ * @pages_per_area:     Number of pages, which will be allocated per area
+ * @nr_areas:   Number of debug areas
+ * @buf_size:   Size of data area in each debug entry
+ *
+ * Return:
+ * - Handle for generated debug area
+ * - %NULL if register failed
+ *
+ * Allocates memory for a debug log.
+ * The debugfs file mode access permissions are read and write for user.
+ * Must not be called within an interrupt handler.
  */
 debug_info_t *debug_register(const char *name, int pages_per_area,
                              int nr_areas, int buf_size)
@@ -694,9 +717,13 @@ debug_info_t *debug_register(const char *name, int pages_per_area,
 }
 EXPORT_SYMBOL(debug_register);
 
-/*
- * debug_unregister:
- * - give back debug area
+/**
+ * debug_unregister() - give back debug area.
+ *
+ * @id:         handle for debug log
+ *
+ * Return:
+ *    none
  */
 void debug_unregister(debug_info_t *id)
 {
@@ -745,9 +772,14 @@ out:
         return rc;
 }
 
-/*
- * debug_set_level:
- * - set actual debug level
+/**
+ * debug_set_level() - Sets new actual debug level if new_level is valid.
+ *
+ * @id:         handle for debug log
+ * @new_level:  new debug level
+ *
+ * Return:
+ *    none
  */
 void debug_set_level(debug_info_t *id, int new_level)
 {
@@ -873,6 +905,14 @@ static struct ctl_table s390dbf_dir_table[] = {
 
 static struct ctl_table_header *s390dbf_sysctl_header;
 
+/**
+ * debug_stop_all() - stops the debug feature if stopping is allowed.
+ *
+ * Return:
+ * -   none
+ *
+ * Currently used in case of a kernel oops.
+ */
 void debug_stop_all(void)
 {
         if (debug_stoppable)
@@ -880,6 +920,17 @@ void debug_stop_all(void)
 }
 EXPORT_SYMBOL(debug_stop_all);
 
+/**
+ * debug_set_critical() - event/exception functions try lock instead of spin.
+ *
+ * Return:
+ * -   none
+ *
+ * Currently used in case of stopping all CPUs but the current one.
+ * Once in this state, functions to write a debug entry for an
+ * event or exception no longer spin on the debug area lock,
+ * but only try to get it and fail if they do not get the lock.
+ */
 void debug_set_critical(void)
 {
         debug_critical = 1;
@@ -1036,8 +1087,16 @@ debug_entry_t *__debug_sprintf_exception(debug_info_t *id, int level, char *stri
 }
 EXPORT_SYMBOL(__debug_sprintf_exception);
 
-/*
- * debug_register_view:
+/**
+ * debug_register_view() - registers new debug view and creates debugfs
+ *                         dir entry
+ *
+ * @id:         handle for debug log
+ * @view:       pointer to debug view struct
+ *
+ * Return:
+ * -   0  : ok
+ * -   < 0: Error
  */
 int debug_register_view(debug_info_t *id, struct debug_view *view)
 {
@@ -1077,8 +1136,16 @@ out:
 }
 EXPORT_SYMBOL(debug_register_view);
 
-/*
- * debug_unregister_view:
+/**
+ * debug_unregister_view() - unregisters debug view and removes debugfs
+ *                           dir entry
+ *
+ * @id:         handle for debug log
+ * @view:       pointer to debug view struct
+ *
+ * Return:
+ * -   0  : ok
+ * -   < 0: Error
  */
 int debug_unregister_view(debug_info_t *id, struct debug_view *view)
 {
diff --git a/arch/s390/kernel/dis.c b/arch/s390/kernel/dis.c
index b2c68fbf2634..7abe6ae261b4 100644
--- a/arch/s390/kernel/dis.c
+++ b/arch/s390/kernel/dis.c
@@ -242,6 +242,7 @@ static const unsigned char formats[][6] = {
         [INSTR_RRF_U0FF]     = { F_24, U4_16, F_28, 0, 0, 0 },
         [INSTR_RRF_U0RF]     = { R_24, U4_16, F_28, 0, 0, 0 },
         [INSTR_RRF_U0RR]     = { R_24, R_28, U4_16, 0, 0, 0 },
+        [INSTR_RRF_URR]      = { R_24, R_28, U8_16, 0, 0, 0 },
         [INSTR_RRF_UUFF]     = { F_24, U4_16, F_28, U4_20, 0, 0 },
         [INSTR_RRF_UUFR]     = { F_24, U4_16, R_28, U4_20, 0, 0 },
         [INSTR_RRF_UURF]     = { R_24, U4_16, F_28, U4_20, 0, 0 },
@@ -306,7 +307,7 @@ static const unsigned char formats[][6] = {
         [INSTR_VRI_VVV0UU2]  = { V_8, V_12, V_16, U8_28, U4_24, 0 },
         [INSTR_VRR_0V]       = { V_12, 0, 0, 0, 0, 0 },
         [INSTR_VRR_0VV0U]    = { V_12, V_16, U4_24, 0, 0, 0 },
-        [INSTR_VRR_RV0U]     = { R_8, V_12, U4_24, 0, 0, 0 },
+        [INSTR_VRR_RV0UU]    = { R_8, V_12, U4_24, U4_28, 0, 0 },
         [INSTR_VRR_VRR]      = { V_8, R_12, R_16, 0, 0, 0 },
         [INSTR_VRR_VV]       = { V_8, V_12, 0, 0, 0, 0 },
         [INSTR_VRR_VV0U]     = { V_8, V_12, U4_32, 0, 0, 0 },
@@ -326,10 +327,8 @@ static const unsigned char formats[][6] = {
         [INSTR_VRS_RVRDU]    = { R_8, V_12, D_20, B_16, U4_32, 0 },
         [INSTR_VRS_VRRD]     = { V_8, R_12, D_20, B_16, 0, 0 },
         [INSTR_VRS_VRRDU]    = { V_8, R_12, D_20, B_16, U4_32, 0 },
-        [INSTR_VRS_VVRD]     = { V_8, V_12, D_20, B_16, 0, 0 },
         [INSTR_VRS_VVRDU]    = { V_8, V_12, D_20, B_16, U4_32, 0 },
         [INSTR_VRV_VVXRDU]   = { V_8, D_20, VX_12, B_16, U4_32, 0 },
-        [INSTR_VRX_VRRD]     = { V_8, D_20, X_12, B_16, 0, 0 },
         [INSTR_VRX_VRRDU]    = { V_8, D_20, X_12, B_16, U4_32, 0 },
         [INSTR_VRX_VV]       = { V_8, V_12, 0, 0, 0, 0 },
         [INSTR_VSI_URDV]     = { V_32, D_20, B_16, U8_8, 0, 0 },
diff --git a/arch/s390/kernel/dumpstack.c b/arch/s390/kernel/dumpstack.c
index 9e87b68be21c..ac06c3949ab3 100644
--- a/arch/s390/kernel/dumpstack.c
+++ b/arch/s390/kernel/dumpstack.c
@@ -199,9 +199,7 @@ void die(struct pt_regs *regs, const char *str)
 #ifdef CONFIG_PREEMPT
         pr_cont("PREEMPT ");
 #endif
-#ifdef CONFIG_SMP
         pr_cont("SMP ");
-#endif
         if (debug_pagealloc_enabled())
                 pr_cont("DEBUG_PAGEALLOC");
         pr_cont("\n");
diff --git a/arch/s390/kernel/entry.S b/arch/s390/kernel/entry.S
index 3f4d272577d3..270d1d145761 100644
--- a/arch/s390/kernel/entry.S
+++ b/arch/s390/kernel/entry.S
@@ -986,14 +986,12 @@ ENTRY(psw_idle)
         stg     %r3,__SF_EMPTY(%r15)
         larl    %r1,.Lpsw_idle_lpsw+4
         stg     %r1,__SF_EMPTY+8(%r15)
-#ifdef CONFIG_SMP
         larl    %r1,smp_cpu_mtid
         llgf    %r1,0(%r1)
         ltgr    %r1,%r1
         jz      .Lpsw_idle_stcctm
         .insn   rsy,0xeb0000000017,%r1,5,__SF_EMPTY+16(%r15)
 .Lpsw_idle_stcctm:
-#endif
         oi      __LC_CPU_FLAGS+7,_CIF_ENABLED_WAIT
         BPON
         STCK    __CLOCK_IDLE_ENTER(%r2)
@@ -1468,7 +1466,6 @@ ENDPROC(cleanup_critical)
         mvc     __CLOCK_IDLE_ENTER(8,%r2),__CLOCK_IDLE_EXIT(%r2)
         mvc     __TIMER_IDLE_ENTER(8,%r2),__TIMER_IDLE_EXIT(%r2)
 1:      # calculate idle cycles
-#ifdef CONFIG_SMP
         clg     %r9,BASED(.Lcleanup_idle_insn)
         jl      3f
         larl    %r1,smp_cpu_mtid
@@ -1486,7 +1483,6 @@ ENDPROC(cleanup_critical)
         la      %r3,8(%r3)
         la      %r4,8(%r4)
         brct    %r1,2b
-#endif
 3:      # account system time going idle
         lg      %r9,__LC_STEAL_TIMER
         alg     %r9,__CLOCK_IDLE_ENTER(%r2)
diff --git a/arch/s390/kernel/jump_label.c b/arch/s390/kernel/jump_label.c
index 3f10b56bd5a3..ab584e8e3527 100644
--- a/arch/s390/kernel/jump_label.c
+++ b/arch/s390/kernel/jump_label.c
@@ -15,16 +15,11 @@ struct insn {
         s32 offset;
 } __packed;
 
-struct insn_args {
-        struct jump_entry *entry;
-        enum jump_label_type type;
-};
-
 static void jump_label_make_nop(struct jump_entry *entry, struct insn *insn)
 {
-        /* brcl 0,0 */
+        /* brcl 0,offset */
         insn->opcode = 0xc004;
-        insn->offset = 0;
+        insn->offset = (jump_entry_target(entry) - jump_entry_code(entry)) >> 1;
 }
 
 static void jump_label_make_branch(struct jump_entry *entry, struct insn *insn)
@@ -77,23 +72,15 @@ static void __jump_label_transform(struct jump_entry *entry,
         s390_kernel_write(code, &new, sizeof(new));
 }
 
-static int __sm_arch_jump_label_transform(void *data)
+static void __jump_label_sync(void *dummy)
 {
-        struct insn_args *args = data;
-
-        __jump_label_transform(args->entry, args->type, 0);
-        return 0;
 }
 
 void arch_jump_label_transform(struct jump_entry *entry,
                                enum jump_label_type type)
 {
-        struct insn_args args;
-
-        args.entry = entry;
-        args.type = type;
-
-        stop_machine_cpuslocked(__sm_arch_jump_label_transform, &args, NULL);
+        __jump_label_transform(entry, type, 0);
+        smp_call_function(__jump_label_sync, NULL, 1);
 }
 
 void arch_jump_label_transform_static(struct jump_entry *entry,
diff --git a/arch/s390/kernel/machine_kexec.c b/arch/s390/kernel/machine_kexec.c
index 8a1ae140c5e2..444a19125a81 100644
--- a/arch/s390/kernel/machine_kexec.c
+++ b/arch/s390/kernel/machine_kexec.c
@@ -141,7 +141,6 @@ static noinline void __machine_kdump(void *image)
          */
         store_status(__do_machine_kdump, image);
 }
-#endif
 
 static unsigned long do_start_kdump(unsigned long addr)
 {
@@ -155,6 +154,8 @@ static unsigned long do_start_kdump(unsigned long addr)
         return rc;
 }
 
+#endif /* CONFIG_CRASH_DUMP */
+
 /*
  * Check if kdump checksums are valid: We call purgatory with parameter "0"
  */
diff --git a/arch/s390/kernel/processor.c b/arch/s390/kernel/processor.c
index 5de13307b703..6ebc2117c66c 100644
--- a/arch/s390/kernel/processor.c
+++ b/arch/s390/kernel/processor.c
@@ -7,6 +7,7 @@
 #define KMSG_COMPONENT "cpu"
 #define pr_fmt(fmt) KMSG_COMPONENT ": " fmt
 
+#include <linux/stop_machine.h>
 #include <linux/cpufeature.h>
 #include <linux/bitops.h>
 #include <linux/kernel.h>
@@ -31,6 +32,7 @@ struct cpu_info {
 };
 
 static DEFINE_PER_CPU(struct cpu_info, cpu_info);
+static DEFINE_PER_CPU(int, cpu_relax_retry);
 
 static bool machine_has_cpu_mhz;
 
@@ -58,15 +60,20 @@ void s390_update_cpu_mhz(void)
                 on_each_cpu(update_cpu_mhz, NULL, 0);
 }
 
-void notrace cpu_relax_yield(void)
+void notrace stop_machine_yield(const struct cpumask *cpumask)
 {
-        if (!smp_cpu_mtid && MACHINE_HAS_DIAG44) {
-                diag_stat_inc(DIAG_STAT_X044);
-                asm volatile("diag 0,0,0x44");
+        int cpu, this_cpu;
+
+        this_cpu = smp_processor_id();
+        if (__this_cpu_inc_return(cpu_relax_retry) >= spin_retry) {
+                __this_cpu_write(cpu_relax_retry, 0);
+                cpu = cpumask_next_wrap(this_cpu, cpumask, this_cpu, false);
+                if (cpu >= nr_cpu_ids)
+                        return;
+                if (arch_vcpu_is_preempted(cpu))
+                        smp_yield_cpu(cpu);
         }
-        barrier();
 }
-EXPORT_SYMBOL(cpu_relax_yield);
 
 /*
  * cpu_init - initializes state that is per-CPU.
diff --git a/arch/s390/kernel/setup.c b/arch/s390/kernel/setup.c
index f8544d517430..2b94b0ad3588 100644
--- a/arch/s390/kernel/setup.c
+++ b/arch/s390/kernel/setup.c
@@ -461,11 +461,9 @@ static void __init setup_lowcore_dat_off(void)
         mem_assign_absolute(S390_lowcore.restart_source, lc->restart_source);
         mem_assign_absolute(S390_lowcore.restart_psw, lc->restart_psw);
 
-#ifdef CONFIG_SMP
         lc->spinlock_lockval = arch_spin_lockval(0);
         lc->spinlock_index = 0;
         arch_spin_lock_setup(0);
-#endif
         lc->br_r1_trampoline = 0x07f1;  /* br %r1 */
 
         set_prefix((u32)(unsigned long) lc);
diff --git a/arch/s390/kernel/smp.c b/arch/s390/kernel/smp.c
index 35fafa2b91a8..44974654cbd0 100644
--- a/arch/s390/kernel/smp.c
+++ b/arch/s390/kernel/smp.c
@@ -232,8 +232,6 @@ out:
         return -ENOMEM;
 }
 
-#ifdef CONFIG_HOTPLUG_CPU
-
 static void pcpu_free_lowcore(struct pcpu *pcpu)
 {
         unsigned long async_stack, nodat_stack, lowcore;
@@ -253,8 +251,6 @@ static void pcpu_free_lowcore(struct pcpu *pcpu)
         free_pages(lowcore, LC_ORDER);
 }
 
-#endif /* CONFIG_HOTPLUG_CPU */
-
 static void pcpu_prepare_secondary(struct pcpu *pcpu, int cpu)
 {
         struct lowcore *lc = pcpu->lowcore;
@@ -418,7 +414,7 @@ void smp_yield_cpu(int cpu)
                 diag_stat_inc_norecursion(DIAG_STAT_X09C);
                 asm volatile("diag %0,0,0x9c"
                              : : "d" (pcpu_devices[cpu].address));
-        } else if (MACHINE_HAS_DIAG44) {
+        } else if (MACHINE_HAS_DIAG44 && !smp_cpu_mtid) {
                 diag_stat_inc_norecursion(DIAG_STAT_X044);
                 asm volatile("diag 0,0,0x44");
         }
@@ -895,8 +891,6 @@ static int __init _setup_possible_cpus(char *s)
 }
 early_param("possible_cpus", _setup_possible_cpus);
 
-#ifdef CONFIG_HOTPLUG_CPU
-
 int __cpu_disable(void)
 {
         unsigned long cregs[16];
@@ -937,8 +931,6 @@ void __noreturn cpu_die(void)
         for (;;) ;
 }
 
-#endif /* CONFIG_HOTPLUG_CPU */
-
 void __init smp_fill_possible_mask(void)
 {
         unsigned int possible, sclp_max, cpu;
@@ -996,7 +988,6 @@ int setup_profiling_timer(unsigned int multiplier)
         return 0;
 }
 
-#ifdef CONFIG_HOTPLUG_CPU
 static ssize_t cpu_configure_show(struct device *dev,
                                   struct device_attribute *attr, char *buf)
 {
@@ -1073,7 +1064,6 @@ out:
         return rc ? rc : count;
 }
 static DEVICE_ATTR(configure, 0644, cpu_configure_show, cpu_configure_store);
-#endif /* CONFIG_HOTPLUG_CPU */
 
 static ssize_t show_cpu_address(struct device *dev,
                                 struct device_attribute *attr, char *buf)
@@ -1083,9 +1073,7 @@ static ssize_t show_cpu_address(struct device *dev,
 static DEVICE_ATTR(address, 0444, show_cpu_address, NULL);
 
 static struct attribute *cpu_common_attrs[] = {
-#ifdef CONFIG_HOTPLUG_CPU
         &dev_attr_configure.attr,
-#endif
         &dev_attr_address.attr,
         NULL,
 };
@@ -1144,15 +1132,11 @@ static int smp_add_present_cpu(int cpu)
 out_topology:
         sysfs_remove_group(&s->kobj, &cpu_common_attr_group);
 out_cpu:
-#ifdef CONFIG_HOTPLUG_CPU
         unregister_cpu(c);
-#endif
 out:
         return rc;
 }
 
-#ifdef CONFIG_HOTPLUG_CPU
-
 int __ref smp_rescan_cpus(void)
 {
         struct sclp_core_info *info;
@@ -1188,17 +1172,14 @@ static ssize_t __ref rescan_store(struct device *dev,
         return rc ? rc : count;
 }
 static DEVICE_ATTR_WO(rescan);
-#endif /* CONFIG_HOTPLUG_CPU */
 
 static int __init s390_smp_init(void)
 {
         int cpu, rc = 0;
 
-#ifdef CONFIG_HOTPLUG_CPU
         rc = device_create_file(cpu_subsys.dev_root, &dev_attr_rescan);
         if (rc)
                 return rc;
-#endif
         for_each_present_cpu(cpu) {
                 rc = smp_add_present_cpu(cpu);
                 if (rc)
diff --git a/arch/s390/kernel/swsusp.S b/arch/s390/kernel/swsusp.S
index 19a3c427801a..a7baf0b5f818 100644
--- a/arch/s390/kernel/swsusp.S
+++ b/arch/s390/kernel/swsusp.S
@@ -162,7 +162,6 @@ ENTRY(swsusp_arch_resume)
         larl    %r1,__swsusp_reset_dma
         lg      %r1,0(%r1)
         BASR_EX %r14,%r1
-#ifdef CONFIG_SMP
         larl    %r1,smp_cpu_mt_shift
         icm     %r1,15,0(%r1)
         jz      smt_done
@@ -172,7 +171,6 @@ smt_loop:
         brc     8,smt_done                      /* accepted */
         brc     2,smt_loop                      /* busy, try again */
 smt_done:
-#endif
         larl    %r1,.Lnew_pgm_check_psw
         lpswe   0(%r1)
 pgm_check_entry:
diff --git a/arch/s390/kernel/traps.c b/arch/s390/kernel/traps.c
index 82e81a9f7112..4736b6ec0ad2 100644
--- a/arch/s390/kernel/traps.c
+++ b/arch/s390/kernel/traps.c
@@ -229,17 +229,11 @@ void vector_exception(struct pt_regs *regs)
 
 void data_exception(struct pt_regs *regs)
 {
-        int signal = 0;
-
         save_fpu_regs();
         if (current->thread.fpu.fpc & FPC_DXC_MASK)
-                signal = SIGFPE;
-        else
-                signal = SIGILL;
-        if (signal == SIGFPE)
                 do_fp_trap(regs, current->thread.fpu.fpc);
-        else if (signal)
-                do_trap(regs, signal, ILL_ILLOPN, "data exception");
+        else
+                do_trap(regs, SIGILL, ILL_ILLOPN, "data exception");
 }
 
 void space_switch_exception(struct pt_regs *regs)
diff --git a/arch/s390/kernel/unwind_bc.c b/arch/s390/kernel/unwind_bc.c
index 57fd4e902f1f..3ce8a0808059 100644
--- a/arch/s390/kernel/unwind_bc.c
+++ b/arch/s390/kernel/unwind_bc.c
@@ -46,18 +46,18 @@ bool unwind_next_frame(struct unwind_state *state)
 
         regs = state->regs;
         if (unlikely(regs)) {
-                sp = READ_ONCE_TASK_STACK(state->task, regs->gprs[15]);
+                sp = READ_ONCE_NOCHECK(regs->gprs[15]);
                 if (unlikely(outside_of_stack(state, sp))) {
                         if (!update_stack_info(state, sp))
                                 goto out_err;
                 }
                 sf = (struct stack_frame *) sp;
-                ip = READ_ONCE_TASK_STACK(state->task, sf->gprs[8]);
+                ip = READ_ONCE_NOCHECK(sf->gprs[8]);
                 reliable = false;
                 regs = NULL;
         } else {
                 sf = (struct stack_frame *) state->sp;
-                sp = READ_ONCE_TASK_STACK(state->task, sf->back_chain);
+                sp = READ_ONCE_NOCHECK(sf->back_chain);
                 if (likely(sp)) {
                         /* Non-zero back-chain points to the previous frame */
                         if (unlikely(outside_of_stack(state, sp))) {
@@ -65,7 +65,7 @@ bool unwind_next_frame(struct unwind_state *state)
                                         goto out_err;
                         }
                         sf = (struct stack_frame *) sp;
-                        ip = READ_ONCE_TASK_STACK(state->task, sf->gprs[8]);
+                        ip = READ_ONCE_NOCHECK(sf->gprs[8]);
                         reliable = true;
                 } else {
                         /* No back-chain, look for a pt_regs structure */
@@ -73,9 +73,9 @@ bool unwind_next_frame(struct unwind_state *state)
                         if (!on_stack(info, sp, sizeof(struct pt_regs)))
                                 goto out_stop;
                         regs = (struct pt_regs *) sp;
-                        if (user_mode(regs))
+                        if (READ_ONCE_NOCHECK(regs->psw.mask) & PSW_MASK_PSTATE)
                                 goto out_stop;
-                        ip = READ_ONCE_TASK_STACK(state->task, regs->psw.addr);
+                        ip = READ_ONCE_NOCHECK(regs->psw.addr);
                         reliable = true;
                 }
         }
@@ -132,11 +132,11 @@ void __unwind_start(struct unwind_state *state, struct task_struct *task,
 
         /* Get the instruction pointer from pt_regs or the stack frame */
         if (regs) {
-                ip = READ_ONCE_TASK_STACK(state->task, regs->psw.addr);
+                ip = READ_ONCE_NOCHECK(regs->psw.addr);
                 reliable = true;
         } else {
                 sf = (struct stack_frame *) sp;
-                ip = READ_ONCE_TASK_STACK(state->task, sf->gprs[8]);
+                ip = READ_ONCE_NOCHECK(sf->gprs[8]);
                 reliable = false;
         }
 
diff --git a/arch/s390/kvm/kvm-s390.c b/arch/s390/kvm/kvm-s390.c
index 28ebd647784c..1c4113f0f2a8 100644
--- a/arch/s390/kvm/kvm-s390.c
+++ b/arch/s390/kvm/kvm-s390.c
@@ -2461,6 +2461,9 @@ int kvm_arch_init_vm(struct kvm *kvm, unsigned long type)
                 set_kvm_facility(kvm->arch.model.fac_list, 147);
         }
 
+        if (css_general_characteristics.aiv && test_facility(65))
+                set_kvm_facility(kvm->arch.model.fac_mask, 65);
+
         kvm->arch.model.cpuid = kvm_s390_get_initial_cpuid();
         kvm->arch.model.ibc = sclp.ibc & 0x0fff;
 
diff --git a/arch/s390/kvm/priv.c b/arch/s390/kvm/priv.c
index 8679bd74d337..ed52ffa8d5d4 100644
--- a/arch/s390/kvm/priv.c
+++ b/arch/s390/kvm/priv.c
@@ -27,6 +27,7 @@
 #include <asm/io.h>
 #include <asm/ptrace.h>
 #include <asm/sclp.h>
+#include <asm/ap.h>
 #include "gaccess.h"
 #include "kvm-s390.h"
 #include "trace.h"
@@ -592,6 +593,89 @@ static int handle_io_inst(struct kvm_vcpu *vcpu)
         }
 }
 
+/*
+ * handle_pqap: Handling pqap interception
+ * @vcpu: the vcpu having issue the pqap instruction
+ *
+ * We now support PQAP/AQIC instructions and we need to correctly
+ * answer the guest even if no dedicated driver's hook is available.
+ *
+ * The intercepting code calls a dedicated callback for this instruction
+ * if a driver did register one in the CRYPTO satellite of the
+ * SIE block.
+ *
+ * If no callback is available, the queues are not available, return this
+ * response code to the caller and set CC to 3.
+ * Else return the response code returned by the callback.
+ */
+static int handle_pqap(struct kvm_vcpu *vcpu)
+{
+        struct ap_queue_status status = {};
+        unsigned long reg0;
+        int ret;
+        uint8_t fc;
+
+        /* Verify that the AP instruction are available */
+        if (!ap_instructions_available())
+                return -EOPNOTSUPP;
+        /* Verify that the guest is allowed to use AP instructions */
+        if (!(vcpu->arch.sie_block->eca & ECA_APIE))
+                return -EOPNOTSUPP;
+        /*
+         * The only possibly intercepted functions when AP instructions are
+         * available for the guest are AQIC and TAPQ with the t bit set
+         * since we do not set IC.3 (FIII) we currently will only intercept
+         * the AQIC function code.
+         */
+        reg0 = vcpu->run->s.regs.gprs[0];
+        fc = (reg0 >> 24) & 0xff;
+        if (WARN_ON_ONCE(fc != 0x03))
+                return -EOPNOTSUPP;
+
+        /* PQAP instruction is allowed for guest kernel only */
+        if (vcpu->arch.sie_block->gpsw.mask & PSW_MASK_PSTATE)
+                return kvm_s390_inject_program_int(vcpu, PGM_PRIVILEGED_OP);
+
+        /* Common PQAP instruction specification exceptions */
+        /* bits 41-47 must all be zeros */
+        if (reg0 & 0x007f0000UL)
+                return kvm_s390_inject_program_int(vcpu, PGM_SPECIFICATION);
+        /* APFT not install and T bit set */
+        if (!test_kvm_facility(vcpu->kvm, 15) && (reg0 & 0x00800000UL))
+                return kvm_s390_inject_program_int(vcpu, PGM_SPECIFICATION);
+        /* APXA not installed and APID greater 64 or APQI greater 16 */
+        if (!(vcpu->kvm->arch.crypto.crycbd & 0x02) && (reg0 & 0x0000c0f0UL))
+                return kvm_s390_inject_program_int(vcpu, PGM_SPECIFICATION);
+
+        /* AQIC function code specific exception */
+        /* facility 65 not present for AQIC function code */
+        if (!test_kvm_facility(vcpu->kvm, 65))
+                return kvm_s390_inject_program_int(vcpu, PGM_SPECIFICATION);
+
+        /*
+         * Verify that the hook callback is registered, lock the owner
+         * and call the hook.
+         */
+        if (vcpu->kvm->arch.crypto.pqap_hook) {
+                if (!try_module_get(vcpu->kvm->arch.crypto.pqap_hook->owner))
+                        return -EOPNOTSUPP;
+                ret = vcpu->kvm->arch.crypto.pqap_hook->hook(vcpu);
+                module_put(vcpu->kvm->arch.crypto.pqap_hook->owner);
+                if (!ret && vcpu->run->s.regs.gprs[1] & 0x00ff0000)
+                        kvm_s390_set_psw_cc(vcpu, 3);
+                return ret;
+        }
+        /*
+         * A vfio_driver must register a hook.
+         * No hook means no driver to enable the SIE CRYCB and no queues.
+         * We send this response to the guest.
+         */
+        status.response_code = 0x01;
+        memcpy(&vcpu->run->s.regs.gprs[1], &status, sizeof(status));
+        kvm_s390_set_psw_cc(vcpu, 3);
+        return 0;
+}
+
 static int handle_stfl(struct kvm_vcpu *vcpu)
 {
         int rc;
@@ -878,6 +962,8 @@ int kvm_s390_handle_b2(struct kvm_vcpu *vcpu)
                 return handle_sthyi(vcpu);
         case 0x7d:
                 return handle_stsi(vcpu);
+        case 0xaf:
+                return handle_pqap(vcpu);
         case 0xb1:
                 return handle_stfl(vcpu);
         case 0xb2:
diff --git a/arch/s390/lib/Makefile b/arch/s390/lib/Makefile
index 5418d10dc2a8..a1ec63abfb95 100644
--- a/arch/s390/lib/Makefile
+++ b/arch/s390/lib/Makefile
@@ -3,9 +3,8 @@
 # Makefile for s390-specific library files..
 #
 
-lib-y += delay.o string.o uaccess.o find.o
+lib-y += delay.o string.o uaccess.o find.o spinlock.o
 obj-y += mem.o xor.o
-lib-$(CONFIG_SMP) += spinlock.o
 lib-$(CONFIG_KPROBES) += probes.o
 lib-$(CONFIG_UPROBES) += probes.o
 
diff --git a/arch/s390/mm/init.c b/arch/s390/mm/init.c
index 14d1eae9fe43..f0bee6af3960 100644
--- a/arch/s390/mm/init.c
+++ b/arch/s390/mm/init.c
@@ -18,6 +18,7 @@
 #include <linux/mman.h>
 #include <linux/mm.h>
 #include <linux/swap.h>
+#include <linux/swiotlb.h>
 #include <linux/smp.h>
 #include <linux/init.h>
 #include <linux/pagemap.h>
@@ -29,6 +30,7 @@
 #include <linux/export.h>
 #include <linux/cma.h>
 #include <linux/gfp.h>
+#include <linux/dma-mapping.h>
 #include <asm/processor.h>
 #include <linux/uaccess.h>
 #include <asm/pgtable.h>
@@ -42,6 +44,8 @@
 #include <asm/sclp.h>
 #include <asm/set_memory.h>
 #include <asm/kasan.h>
+#include <asm/dma-mapping.h>
+#include <asm/uv.h>
 
 pgd_t swapper_pg_dir[PTRS_PER_PGD] __section(.bss..swapper_pg_dir);
 
@@ -128,6 +132,47 @@ void mark_rodata_ro(void)
         pr_info("Write protected read-only-after-init data: %luk\n", size >> 10);
 }
 
+int set_memory_encrypted(unsigned long addr, int numpages)
+{
+        int i;
+
+        /* make specified pages unshared, (swiotlb, dma_free) */
+        for (i = 0; i < numpages; ++i) {
+                uv_remove_shared(addr);
+                addr += PAGE_SIZE;
+        }
+        return 0;
+}
+
+int set_memory_decrypted(unsigned long addr, int numpages)
+{
+        int i;
+        /* make specified pages shared (swiotlb, dma_alloca) */
+        for (i = 0; i < numpages; ++i) {
+                uv_set_shared(addr);
+                addr += PAGE_SIZE;
+        }
+        return 0;
+}
+
+/* are we a protected virtualization guest? */
+bool sev_active(void)
+{
+        return is_prot_virt_guest();
+}
+
+/* protected virtualization */
+static void pv_init(void)
+{
+        if (!is_prot_virt_guest())
+                return;
+
+        /* make sure bounce buffers are shared */
+        swiotlb_init(1);
+        swiotlb_update_mem_attributes();
+        swiotlb_force = SWIOTLB_FORCE;
+}
+
 void __init mem_init(void)
 {
         cpumask_set_cpu(0, &init_mm.context.cpu_attach_mask);
@@ -136,6 +181,8 @@ void __init mem_init(void)
         set_max_mapnr(max_low_pfn);
         high_memory = (void *) __va(max_low_pfn * PAGE_SIZE);
 
+        pv_init();
+
         /* Setup guest page hinting */
         cmma_init();
 
diff --git a/arch/s390/mm/maccess.c b/arch/s390/mm/maccess.c
index 818deeb1ebc3..1864a8bb9622 100644
--- a/arch/s390/mm/maccess.c
+++ b/arch/s390/mm/maccess.c
@@ -52,21 +52,22 @@ static notrace long s390_kernel_write_odd(void *dst, const void *src, size_t siz
  * Therefore we have a read-modify-write sequence: the function reads eight
  * bytes from destination at an eight byte boundary, modifies the bytes
  * requested and writes the result back in a loop.
- *
- * Note: this means that this function may not be called concurrently on
- *       several cpus with overlapping words, since this may potentially
- *       cause data corruption.
  */
+static DEFINE_SPINLOCK(s390_kernel_write_lock);
+
 void notrace s390_kernel_write(void *dst, const void *src, size_t size)
 {
+        unsigned long flags;
         long copied;
 
+        spin_lock_irqsave(&s390_kernel_write_lock, flags);
         while (size) {
                 copied = s390_kernel_write_odd(dst, src, size);
                 dst += copied;
                 src += copied;
                 size -= copied;
         }
+        spin_unlock_irqrestore(&s390_kernel_write_lock, flags);
 }
 
 static int __memcpy_real(void *dest, void *src, size_t count)
diff --git a/arch/s390/mm/mmap.c b/arch/s390/mm/mmap.c
index 687f2a4d3459..cbc718ba6d78 100644
--- a/arch/s390/mm/mmap.c
+++ b/arch/s390/mm/mmap.c
@@ -24,8 +24,6 @@ static unsigned long stack_maxrandom_size(void)
 {
         if (!(current->flags & PF_RANDOMIZE))
                 return 0;
-        if (current->personality & ADDR_NO_RANDOMIZE)
-                return 0;
         return STACK_RND_MASK << PAGE_SHIFT;
 }
 
diff --git a/arch/s390/pci/pci.c b/arch/s390/pci/pci.c
index 86ca7f88fb22..b8a64cbb5dea 100644
--- a/arch/s390/pci/pci.c
+++ b/arch/s390/pci/pci.c
@@ -421,12 +421,12 @@ static void zpci_map_resources(struct pci_dev *pdev)
                 if (!len)
                         continue;
 
-                if (static_branch_likely(&have_mio))
+                if (zpci_use_mio(zdev))
                         pdev->resource[i].start =
                                 (resource_size_t __force) zdev->bars[i].mio_wb;
                 else
-                        pdev->resource[i].start =
-                                (resource_size_t __force) pci_iomap(pdev, i, 0);
+                        pdev->resource[i].start = (resource_size_t __force)
+                                pci_iomap_range_fh(pdev, i, 0, 0);
                 pdev->resource[i].end = pdev->resource[i].start + len - 1;
         }
 
@@ -444,18 +444,19 @@ static void zpci_map_resources(struct pci_dev *pdev)
 
 static void zpci_unmap_resources(struct pci_dev *pdev)
 {
+        struct zpci_dev *zdev = to_zpci(pdev);
         resource_size_t len;
         int i;
 
-        if (static_branch_likely(&have_mio))
+        if (zpci_use_mio(zdev))
                 return;
 
         for (i = 0; i < PCI_BAR_COUNT; i++) {
                 len = pci_resource_len(pdev, i);
                 if (!len)
                         continue;
-                pci_iounmap(pdev, (void __iomem __force *)
-                            pdev->resource[i].start);
+                pci_iounmap_fh(pdev, (void __iomem __force *)
+                               pdev->resource[i].start);
         }
 }
 
@@ -528,7 +529,7 @@ static int zpci_setup_bus_resources(struct zpci_dev *zdev,
                 if (zdev->bars[i].val & 4)
                         flags |= IORESOURCE_MEM_64;
 
-                if (static_branch_likely(&have_mio))
+                if (zpci_use_mio(zdev))
                         addr = (unsigned long) zdev->bars[i].mio_wb;
                 else
                         addr = ZPCI_ADDR(entry);
diff --git a/arch/s390/pci/pci_clp.c b/arch/s390/pci/pci_clp.c
index d03631dba7c2..9bdff4defef1 100644
--- a/arch/s390/pci/pci_clp.c
+++ b/arch/s390/pci/pci_clp.c
@@ -291,7 +291,7 @@ int clp_enable_fh(struct zpci_dev *zdev, u8 nr_dma_as)
                 goto out;
 
         zdev->fh = fh;
-        if (zdev->mio_capable) {
+        if (zpci_use_mio(zdev)) {
                 rc = clp_set_pci_fn(&fh, nr_dma_as, CLP_SET_ENABLE_MIO);
                 zpci_dbg(3, "ena mio fid:%x, fh:%x, rc:%d\n", zdev->fid, fh, rc);
                 if (rc)
diff --git a/arch/s390/pci/pci_debug.c b/arch/s390/pci/pci_debug.c
index 6b48ca7760a7..3408c0df3ebf 100644
--- a/arch/s390/pci/pci_debug.c
+++ b/arch/s390/pci/pci_debug.c
@@ -74,7 +74,7 @@ static void pci_sw_counter_show(struct seq_file *m)
         int i;
 
         for (i = 0; i < ARRAY_SIZE(pci_sw_names); i++, counter++)
-                seq_printf(m, "%26s:\t%lu\n", pci_sw_names[i],
+                seq_printf(m, "%26s:\t%llu\n", pci_sw_names[i],
                            atomic64_read(counter));
 }
 
diff --git a/arch/s390/purgatory/.gitignore b/arch/s390/purgatory/.gitignore
index e9e66f178a6d..04a03433c720 100644
--- a/arch/s390/purgatory/.gitignore
+++ b/arch/s390/purgatory/.gitignore
@@ -1,2 +1,3 @@
-kexec-purgatory.c
+purgatory
+purgatory.lds
 purgatory.ro
diff --git a/arch/s390/tools/Makefile b/arch/s390/tools/Makefile
index 2342b84b3386..b5e35e8f999a 100644
--- a/arch/s390/tools/Makefile
+++ b/arch/s390/tools/Makefile
@@ -6,7 +6,6 @@
 kapi := arch/$(ARCH)/include/generated/asm
 kapi-hdrs-y := $(kapi)/facility-defs.h $(kapi)/dis-defs.h
 
-targets += $(addprefix ../../../,$(kapi-hdrs-y))
 PHONY += kapi
 
 kapi:   $(kapi-hdrs-y)
@@ -14,11 +13,7 @@ kapi:	$(kapi-hdrs-y)
 hostprogs-y                 += gen_facilities
 hostprogs-y                 += gen_opcode_table
 
-HOSTCFLAGS_gen_facilities.o += -Wall $(LINUXINCLUDE)
-HOSTCFLAGS_gen_opcode_table.o += -Wall $(LINUXINCLUDE)
-
-# Ensure output directory exists
-_dummy := $(shell [ -d '$(kapi)' ] || mkdir -p '$(kapi)')
+HOSTCFLAGS_gen_facilities.o += $(LINUXINCLUDE)
 
 filechk_facility-defs.h = $(obj)/gen_facilities
 
diff --git a/arch/s390/tools/opcodes.txt b/arch/s390/tools/opcodes.txt
index 64638b764d1c..46d8ed96cf06 100644
--- a/arch/s390/tools/opcodes.txt
+++ b/arch/s390/tools/opcodes.txt
@@ -520,6 +520,9 @@ b92e	km	RRE_RR
 b92f    kmc     RRE_RR
 b930    cgfr    RRE_RR
 b931    clgfr   RRE_RR
+b938    sortl   RRE_RR
+b939    dfltcc  RRF_R0RR2
+b93a    kdsa    RRE_RR
 b93c    ppno    RRE_RR
 b93e    kimd    RRE_RR
 b93f    klmd    RRE_RR
@@ -538,8 +541,16 @@ b95a	cxlgtr	RRF_UUFR
 b95b    cxlftr  RRF_UUFR
 b960    cgrt    RRF_U0RR
 b961    clgrt   RRF_U0RR
+b964    nngrk   RRF_R0RR2
+b965    ocgrk   RRF_R0RR2
+b966    nogrk   RRF_R0RR2
+b967    nxgrk   RRF_R0RR2
 b972    crt     RRF_U0RR
 b973    clrt    RRF_U0RR
+b974    nnrk    RRF_R0RR2
+b975    ocrk    RRF_R0RR2
+b976    nork    RRF_R0RR2
+b977    nxrk    RRF_R0RR2
 b980    ngr     RRE_RR
 b981    ogr     RRE_RR
 b982    xgr     RRE_RR
@@ -573,6 +584,7 @@ b99f	ssair	RRE_R0
 b9a0    clp     RRF_U0RR
 b9a1    tpei    RRE_RR
 b9a2    ptf     RRE_R0
+b9a4    uvc     RRF_URR
 b9aa    lptea   RRF_RURR2
 b9ab    essa    RRF_U0RR
 b9ac    irbm    RRE_RR
@@ -585,6 +597,7 @@ b9b3	cu42	RRE_RR
 b9bd    trtre   RRF_U0RR
 b9be    srstu   RRE_RR
 b9bf    trte    RRF_U0RR
+b9c0    selhhhr RRF_RURR
 b9c8    ahhhr   RRF_R0RR2
 b9c9    shhhr   RRF_R0RR2
 b9ca    alhhhr  RRF_R0RR2
@@ -594,6 +607,9 @@ b9cf	clhhr	RRE_RR
 b9d0    pcistg  RRE_RR
 b9d2    pcilg   RRE_RR
 b9d3    rpcit   RRE_RR
+b9d4    pcistgi RRE_RR
+b9d5    pciwb   RRE_00
+b9d6    pcilgi  RRE_RR
 b9d8    ahhlr   RRF_R0RR2
 b9d9    shhlr   RRF_R0RR2
 b9da    alhhlr  RRF_R0RR2
@@ -601,9 +617,11 @@ b9db	slhhlr	RRF_R0RR2
 b9dd    chlr    RRE_RR
 b9df    clhlr   RRE_RR
 b9e0    locfhr  RRF_U0RR
-b9e1    popcnt  RRE_RR
+b9e1    popcnt  RRF_U0RR
 b9e2    locgr   RRF_U0RR
+b9e3    selgr   RRF_RURR
 b9e4    ngrk    RRF_R0RR2
+b9e5    ncgrk   RRF_R0RR2
 b9e6    ogrk    RRF_R0RR2
 b9e7    xgrk    RRF_R0RR2
 b9e8    agrk    RRF_R0RR2
@@ -612,8 +630,10 @@ b9ea	algrk	RRF_R0RR2
 b9eb    slgrk   RRF_R0RR2
 b9ec    mgrk    RRF_R0RR2
 b9ed    msgrkc  RRF_R0RR2
+b9f0    selr    RRF_RURR
 b9f2    locr    RRF_U0RR
 b9f4    nrk     RRF_R0RR2
+b9f5    ncrk    RRF_R0RR2
 b9f6    ork     RRF_R0RR2
 b9f7    xrk     RRF_R0RR2
 b9f8    ark     RRF_R0RR2
@@ -822,6 +842,7 @@ e3d4	stpcifc	RXY_RRRD
 e500    lasp    SSE_RDRD
 e501    tprot   SSE_RDRD
 e502    strag   SSE_RDRD
+e50a    mvcrl   SSE_RDRD
 e50e    mvcsk   SSE_RDRD
 e50f    mvcdk   SSE_RDRD
 e544    mvhhi   SIL_RDI
@@ -835,6 +856,18 @@ e55c	chsi	SIL_RDI
 e55d    clfhsi  SIL_RDU
 e560    tbegin  SIL_RDU
 e561    tbeginc SIL_RDU
+e601    vlebrh  VRX_VRRDU
+e602    vlebrg  VRX_VRRDU
+e603    vlebrf  VRX_VRRDU
+e604    vllebrz VRX_VRRDU
+e605    vlbrrep VRX_VRRDU
+e606    vlbr    VRX_VRRDU
+e607    vler    VRX_VRRDU
+e609    vstebrh VRX_VRRDU
+e60a    vstebrg VRX_VRRDU
+e60b    vstebrf VRX_VRRDU
+e60e    vstbr   VRX_VRRDU
+e60f    vster   VRX_VRRDU
 e634    vpkz    VSI_URDV
 e635    vlrl    VSI_URDV
 e637    vlrlr   VRS_RRDV
@@ -842,8 +875,8 @@ e63c	vupkz	VSI_URDV
 e63d    vstrl   VSI_URDV
 e63f    vstrlr  VRS_RRDV
 e649    vlip    VRI_V0UU2
-e650    vcvb    VRR_RV0U
-e652    vcvbg   VRR_RV0U
+e650    vcvb    VRR_RV0UU
+e652    vcvbg   VRR_RV0UU
 e658    vcvd    VRI_VR0UU
 e659    vsrp    VRI_VVUUU2
 e65a    vcvdg   VRI_VR0UU
@@ -863,13 +896,13 @@ e702	vleg	VRX_VRRDU
 e703    vlef    VRX_VRRDU
 e704    vllez   VRX_VRRDU
 e705    vlrep   VRX_VRRDU
-e706    vl      VRX_VRRD
+e706    vl      VRX_VRRDU
 e707    vlbb    VRX_VRRDU
 e708    vsteb   VRX_VRRDU
 e709    vsteh   VRX_VRRDU
 e70a    vsteg   VRX_VRRDU
 e70b    vstef   VRX_VRRDU
-e70e    vst     VRX_VRRD
+e70e    vst     VRX_VRRDU
 e712    vgeg    VRV_VVXRDU
 e713    vgef    VRV_VVXRDU
 e71a    vsceg   VRV_VVXRDU
@@ -879,11 +912,11 @@ e722	vlvg	VRS_VRRDU
 e727    lcbb    RXE_RRRDU
 e730    vesl    VRS_VVRDU
 e733    verll   VRS_VVRDU
-e736    vlm     VRS_VVRD
+e736    vlm     VRS_VVRDU
 e737    vll     VRS_VRRD
 e738    vesrl   VRS_VVRDU
 e73a    vesra   VRS_VVRDU
-e73e    vstm    VRS_VVRD
+e73e    vstm    VRS_VVRDU
 e73f    vstl    VRS_VRRD
 e740    vleib   VRI_V0IU
 e741    vleih   VRI_V0IU
@@ -932,7 +965,10 @@ e781	vfene	VRR_VVV0U0U
 e782    vfae    VRR_VVV0U0U
 e784    vpdi    VRR_VVV0U
 e785    vbperm  VRR_VVV
+e786    vsld    VRI_VVV0U
+e787    vsrd    VRI_VVV0U
 e78a    vstrc   VRR_VVVUU0V
+e78b    vstrs   VRR_VVVUU0V
 e78c    vperm   VRR_VVV0V
 e78d    vsel    VRR_VVV0V
 e78e    vfms    VRR_VVVU0UV
@@ -1060,6 +1096,7 @@ eb9b	stamy	RSY_AARD
 ebc0    tp      RSL_R0RD
 ebd0    pcistb  RSY_RRRD
 ebd1    sic     RSY_RRRD
+ebd4    pcistbi RSY_RRRD
 ebdc    srak    RSY_RRRD
 ebdd    slak    RSY_RRRD
 ebde    srlk    RSY_RRRD
diff --git a/arch/sparc/include/asm/atomic_64.h b/arch/sparc/include/asm/atomic_64.h
index 6963482c81d8..b60448397d4f 100644
--- a/arch/sparc/include/asm/atomic_64.h
+++ b/arch/sparc/include/asm/atomic_64.h
@@ -23,15 +23,15 @@
 
 #define ATOMIC_OP(op)                                                   \
 void atomic_##op(int, atomic_t *);                                      \
-void atomic64_##op(long, atomic64_t *);
+void atomic64_##op(s64, atomic64_t *);
 
 #define ATOMIC_OP_RETURN(op)                                            \
 int atomic_##op##_return(int, atomic_t *);                              \
-long atomic64_##op##_return(long, atomic64_t *);
+s64 atomic64_##op##_return(s64, atomic64_t *);
 
 #define ATOMIC_FETCH_OP(op)                                             \
 int atomic_fetch_##op(int, atomic_t *);                                 \
-long atomic64_fetch_##op(long, atomic64_t *);
+s64 atomic64_fetch_##op(s64, atomic64_t *);
 
 #define ATOMIC_OPS(op) ATOMIC_OP(op) ATOMIC_OP_RETURN(op) ATOMIC_FETCH_OP(op)
 
@@ -61,7 +61,7 @@ static inline int atomic_xchg(atomic_t *v, int new)
         ((__typeof__((v)->counter))cmpxchg(&((v)->counter), (o), (n)))
 #define atomic64_xchg(v, new) (xchg(&((v)->counter), new))
 
-long atomic64_dec_if_positive(atomic64_t *v);
+s64 atomic64_dec_if_positive(atomic64_t *v);
 #define atomic64_dec_if_positive atomic64_dec_if_positive
 
 #endif /* !(__ARCH_SPARC64_ATOMIC__) */
diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
index 2bbbd4d1ba31..fbabf59692ff 100644
--- a/arch/x86/Kconfig
+++ b/arch/x86/Kconfig
@@ -17,6 +17,7 @@ config X86_32
         select HAVE_DEBUG_STACKOVERFLOW
         select MODULES_USE_ELF_REL
         select OLD_SIGACTION
+        select GENERIC_VDSO_32
 
 config X86_64
         def_bool y
@@ -121,6 +122,7 @@ config X86
         select GENERIC_STRNCPY_FROM_USER
         select GENERIC_STRNLEN_USER
         select GENERIC_TIME_VSYSCALL
+        select GENERIC_GETTIMEOFDAY
         select HARDLOCKUP_CHECK_TIMESTAMP       if X86_64
         select HAVE_ACPI_APEI                   if ACPI
         select HAVE_ACPI_APEI_NMI               if ACPI
@@ -202,6 +204,7 @@ config X86
         select HAVE_SYSCALL_TRACEPOINTS
         select HAVE_UNSTABLE_SCHED_CLOCK
         select HAVE_USER_RETURN_NOTIFIER
+        select HAVE_GENERIC_VDSO
         select HOTPLUG_SMT                      if SMP
         select IRQ_FORCED_THREADING
         select NEED_SG_DMA_LENGTH
@@ -2285,7 +2288,7 @@ config COMPAT_VDSO
 choice
         prompt "vsyscall table for legacy applications"
         depends on X86_64
-        default LEGACY_VSYSCALL_EMULATE
+        default LEGACY_VSYSCALL_XONLY
         help
           Legacy user code that does not know how to find the vDSO expects
           to be able to issue three syscalls by calling fixed addresses in
@@ -2293,23 +2296,38 @@ choice
           it can be used to assist security vulnerability exploitation.
 
           This setting can be changed at boot time via the kernel command
-          line parameter vsyscall=[emulate|none].
+          line parameter vsyscall=[emulate|xonly|none].
 
           On a system with recent enough glibc (2.14 or newer) and no
           static binaries, you can say None without a performance penalty
           to improve security.
 
-          If unsure, select "Emulate".
+          If unsure, select "Emulate execution only".
 
         config LEGACY_VSYSCALL_EMULATE
-                bool "Emulate"
+                bool "Full emulation"
                 help
-                  The kernel traps and emulates calls into the fixed
-                  vsyscall address mapping. This makes the mapping
-                  non-executable, but it still contains known contents,
-                  which could be used in certain rare security vulnerability
-                  exploits. This configuration is recommended when userspace
-                  still uses the vsyscall area.
+                  The kernel traps and emulates calls into the fixed vsyscall
+                  address mapping. This makes the mapping non-executable, but
+                  it still contains readable known contents, which could be
+                  used in certain rare security vulnerability exploits. This
+                  configuration is recommended when using legacy userspace
+                  that still uses vsyscalls along with legacy binary
+                  instrumentation tools that require code to be readable.
+
+                  An example of this type of legacy userspace is running
+                  Pin on an old binary that still uses vsyscalls.
+
+        config LEGACY_VSYSCALL_XONLY
+                bool "Emulate execution only"
+                help
+                  The kernel traps and emulates calls into the fixed vsyscall
+                  address mapping and does not allow reads.  This
+                  configuration is recommended when userspace might use the
+                  legacy vsyscall area but support for legacy binary
+                  instrumentation of legacy code is not needed.  It mitigates
+                  certain uses of the vsyscall area as an ASLR-bypassing
+                  buffer.
 
         config LEGACY_VSYSCALL_NONE
                 bool "None"
diff --git a/arch/x86/Kconfig.cpu b/arch/x86/Kconfig.cpu
index 6adce15268bd..8e29c991ba3e 100644
--- a/arch/x86/Kconfig.cpu
+++ b/arch/x86/Kconfig.cpu
@@ -480,3 +480,16 @@ config CPU_SUP_UMC_32
           CPU might render the kernel unbootable.
 
           If unsure, say N.
+
+config CPU_SUP_ZHAOXIN
+        default y
+        bool "Support Zhaoxin processors" if PROCESSOR_SELECT
+        help
+          This enables detection, tunings and quirks for Zhaoxin processors
+
+          You need this enabled if you want your kernel to run on a
+          Zhaoxin CPU. Disabling this option on other types of CPUs
+          makes the kernel a tiny bit smaller. Disabling it on a Zhaoxin
+          CPU might render the kernel unbootable.
+
+          If unsure, say N.
diff --git a/arch/x86/entry/common.c b/arch/x86/entry/common.c
index 2418804e66b4..536b574b6161 100644
--- a/arch/x86/entry/common.c
+++ b/arch/x86/entry/common.c
@@ -72,23 +72,18 @@ static long syscall_trace_enter(struct pt_regs *regs)
 
         struct thread_info *ti = current_thread_info();
         unsigned long ret = 0;
-        bool emulated = false;
         u32 work;
 
         if (IS_ENABLED(CONFIG_DEBUG_ENTRY))
                 BUG_ON(regs != task_pt_regs(current));
 
-        work = READ_ONCE(ti->flags) & _TIF_WORK_SYSCALL_ENTRY;
+        work = READ_ONCE(ti->flags);
 
-        if (unlikely(work & _TIF_SYSCALL_EMU))
-                emulated = true;
-
-        if ((emulated || (work & _TIF_SYSCALL_TRACE)) &&
-            tracehook_report_syscall_entry(regs))
-                return -1L;
-
-        if (emulated)
-                return -1L;
+        if (work & (_TIF_SYSCALL_TRACE | _TIF_SYSCALL_EMU)) {
+                ret = tracehook_report_syscall_entry(regs);
+                if (ret || (work & _TIF_SYSCALL_EMU))
+                        return -1L;
+        }
 
 #ifdef CONFIG_SECCOMP
         /*
diff --git a/arch/x86/entry/entry_32.S b/arch/x86/entry/entry_32.S
index 7b23431be5cb..44c6e6f54bf7 100644
--- a/arch/x86/entry/entry_32.S
+++ b/arch/x86/entry/entry_32.S
@@ -1104,6 +1104,30 @@ ENTRY(irq_entries_start)
     .endr
 END(irq_entries_start)
 
+#ifdef CONFIG_X86_LOCAL_APIC
+        .align 8
+ENTRY(spurious_entries_start)
+    vector=FIRST_SYSTEM_VECTOR
+    .rept (NR_VECTORS - FIRST_SYSTEM_VECTOR)
+        pushl   $(~vector+0x80)                 /* Note: always in signed byte range */
+    vector=vector+1
+        jmp     common_spurious
+        .align  8
+    .endr
+END(spurious_entries_start)
+
+common_spurious:
+        ASM_CLAC
+        addl    $-0x80, (%esp)                  /* Adjust vector into the [-256, -1] range */
+        SAVE_ALL switch_stacks=1
+        ENCODE_FRAME_POINTER
+        TRACE_IRQS_OFF
+        movl    %esp, %eax
+        call    smp_spurious_interrupt
+        jmp     ret_from_intr
+ENDPROC(common_interrupt)
+#endif
+
 /*
  * the CPU automatically disables interrupts when executing an IRQ vector,
  * so IRQ-flags tracing has to follow that:
diff --git a/arch/x86/entry/entry_64.S b/arch/x86/entry/entry_64.S
index 11aa3b2afa4d..15f0749d0a15 100644
--- a/arch/x86/entry/entry_64.S
+++ b/arch/x86/entry/entry_64.S
@@ -375,6 +375,18 @@ ENTRY(irq_entries_start)
     .endr
 END(irq_entries_start)
 
+        .align 8
+ENTRY(spurious_entries_start)
+    vector=FIRST_SYSTEM_VECTOR
+    .rept (NR_VECTORS - FIRST_SYSTEM_VECTOR)
+        UNWIND_HINT_IRET_REGS
+        pushq   $(~vector+0x80)                 /* Note: always in signed byte range */
+        jmp     common_spurious
+        .align  8
+        vector=vector+1
+    .endr
+END(spurious_entries_start)
+
 .macro DEBUG_ENTRY_ASSERT_IRQS_OFF
 #ifdef CONFIG_DEBUG_ENTRY
         pushq %rax
@@ -571,10 +583,20 @@ _ASM_NOKPROBE(interrupt_entry)
 
 /* Interrupt entry/exit. */
 
-        /*
-         * The interrupt stubs push (~vector+0x80) onto the stack and
-         * then jump to common_interrupt.
-         */
+/*
+ * The interrupt stubs push (~vector+0x80) onto the stack and
+ * then jump to common_spurious/interrupt.
+ */
+common_spurious:
+        addq    $-0x80, (%rsp)                  /* Adjust vector to [-256, -1] range */
+        call    interrupt_entry
+        UNWIND_HINT_REGS indirect=1
+        call    smp_spurious_interrupt          /* rdi points to pt_regs */
+        jmp     ret_from_intr
+END(common_spurious)
+_ASM_NOKPROBE(common_spurious)
+
+/* common_interrupt is a hotpath. Align it */
         .p2align CONFIG_X86_L1_CACHE_SHIFT
 common_interrupt:
         addq    $-0x80, (%rsp)                  /* Adjust vector to [-256, -1] range */
@@ -1670,11 +1692,17 @@ nmi_restore:
         iretq
 END(nmi)
 
+#ifndef CONFIG_IA32_EMULATION
+/*
+ * This handles SYSCALL from 32-bit code.  There is no way to program
+ * MSRs to fully disable 32-bit SYSCALL.
+ */
 ENTRY(ignore_sysret)
         UNWIND_HINT_EMPTY
         mov     $-ENOSYS, %eax
         sysret
 END(ignore_sysret)
+#endif
 
 ENTRY(rewind_stack_do_exit)
         UNWIND_HINT_FUNC
diff --git a/arch/x86/entry/vdso/Makefile b/arch/x86/entry/vdso/Makefile
index 42fe42e82baf..39106111be86 100644
--- a/arch/x86/entry/vdso/Makefile
+++ b/arch/x86/entry/vdso/Makefile
@@ -3,6 +3,12 @@
 # Building vDSO images for x86.
 #
 
+# Absolute relocation type $(ARCH_REL_TYPE_ABS) needs to be defined before
+# the inclusion of generic Makefile.
+ARCH_REL_TYPE_ABS := R_X86_64_JUMP_SLOT|R_X86_64_GLOB_DAT|R_X86_64_RELATIVE|
+ARCH_REL_TYPE_ABS += R_386_GLOB_DAT|R_386_JMP_SLOT|R_386_RELATIVE
+include $(srctree)/lib/vdso/Makefile
+
 KBUILD_CFLAGS += $(DISABLE_LTO)
 KASAN_SANITIZE                  := n
 UBSAN_SANITIZE                  := n
@@ -51,6 +57,7 @@ VDSO_LDFLAGS_vdso.lds = -m elf_x86_64 -soname linux-vdso.so.1 --no-undefined \
 
 $(obj)/vdso64.so.dbg: $(obj)/vdso.lds $(vobjs) FORCE
         $(call if_changed,vdso)
+        $(call if_changed,vdso_check)
 
 HOST_EXTRACFLAGS += -I$(srctree)/tools/include -I$(srctree)/include/uapi -I$(srctree)/arch/$(SUBARCH)/include/uapi
 hostprogs-y                     += vdso2c
@@ -121,6 +128,7 @@ $(obj)/%.so: $(obj)/%.so.dbg FORCE
 
 $(obj)/vdsox32.so.dbg: $(obj)/vdsox32.lds $(vobjx32s) FORCE
         $(call if_changed,vdso)
+        $(call if_changed,vdso_check)
 
 CPPFLAGS_vdso32.lds = $(CPPFLAGS_vdso.lds)
 VDSO_LDFLAGS_vdso32.lds = -m elf_i386 -soname linux-gate.so.1
@@ -160,6 +168,7 @@ $(obj)/vdso32.so.dbg: FORCE \
                       $(obj)/vdso32/system_call.o \
                       $(obj)/vdso32/sigreturn.o
         $(call if_changed,vdso)
+        $(call if_changed,vdso_check)
 
 #
 # The DSO images are built using a special linker script.
diff --git a/arch/x86/entry/vdso/vclock_gettime.c b/arch/x86/entry/vdso/vclock_gettime.c
index 4aed41f638bb..d9ff616bb0f6 100644
--- a/arch/x86/entry/vdso/vclock_gettime.c
+++ b/arch/x86/entry/vdso/vclock_gettime.c
@@ -1,251 +1,85 @@
 // SPDX-License-Identifier: GPL-2.0-only
 /*
- * Copyright 2006 Andi Kleen, SUSE Labs.
- *
  * Fast user context implementation of clock_gettime, gettimeofday, and time.
  *
+ * Copyright 2006 Andi Kleen, SUSE Labs.
+ * Copyright 2019 ARM Limited
+ *
  * 32 Bit compat layer by Stefani Seibold <stefani@seibold.net>
  *  sponsored by Rohde & Schwarz GmbH & Co. KG Munich/Germany
- *
- * The code should have no internal unresolved relocations.
- * Check with readelf after changing.
  */
-
-#include <uapi/linux/time.h>
-#include <asm/vgtod.h>
-#include <asm/vvar.h>
-#include <asm/unistd.h>
-#include <asm/msr.h>
-#include <asm/pvclock.h>
-#include <asm/mshyperv.h>
-#include <linux/math64.h>
 #include <linux/time.h>
 #include <linux/kernel.h>
+#include <linux/types.h>
 
-#define gtod (&VVAR(vsyscall_gtod_data))
+#include "../../../../lib/vdso/gettimeofday.c"
 
-extern int __vdso_clock_gettime(clockid_t clock, struct timespec *ts);
-extern int __vdso_gettimeofday(struct timeval *tv, struct timezone *tz);
+extern int __vdso_gettimeofday(struct __kernel_old_timeval *tv, struct timezone *tz);
 extern time_t __vdso_time(time_t *t);
 
-#ifdef CONFIG_PARAVIRT_CLOCK
-extern u8 pvclock_page[PAGE_SIZE]
-        __attribute__((visibility("hidden")));
-#endif
-
-#ifdef CONFIG_HYPERV_TSCPAGE
-extern u8 hvclock_page[PAGE_SIZE]
-        __attribute__((visibility("hidden")));
-#endif
-
-#ifndef BUILD_VDSO32
-
-notrace static long vdso_fallback_gettime(long clock, struct timespec *ts)
+int __vdso_gettimeofday(struct __kernel_old_timeval *tv, struct timezone *tz)
 {
-        long ret;
-        asm ("syscall" : "=a" (ret), "=m" (*ts) :
-             "0" (__NR_clock_gettime), "D" (clock), "S" (ts) :
-             "rcx", "r11");
-        return ret;
+        return __cvdso_gettimeofday(tv, tz);
 }
 
-#else
+int gettimeofday(struct __kernel_old_timeval *, struct timezone *)
+        __attribute__((weak, alias("__vdso_gettimeofday")));
 
-notrace static long vdso_fallback_gettime(long clock, struct timespec *ts)
+time_t __vdso_time(time_t *t)
 {
-        long ret;
-
-        asm (
-                "mov %%ebx, %%edx \n"
-                "mov %[clock], %%ebx \n"
-                "call __kernel_vsyscall \n"
-                "mov %%edx, %%ebx \n"
-                : "=a" (ret), "=m" (*ts)
-                : "0" (__NR_clock_gettime), [clock] "g" (clock), "c" (ts)
-                : "edx");
-        return ret;
+        return __cvdso_time(t);
 }
 
-#endif
+time_t time(time_t *t)  __attribute__((weak, alias("__vdso_time")));
 
-#ifdef CONFIG_PARAVIRT_CLOCK
-static notrace const struct pvclock_vsyscall_time_info *get_pvti0(void)
-{
-        return (const struct pvclock_vsyscall_time_info *)&pvclock_page;
-}
 
-static notrace u64 vread_pvclock(void)
-{
-        const struct pvclock_vcpu_time_info *pvti = &get_pvti0()->pvti;
-        u32 version;
-        u64 ret;
-
-        /*
-         * Note: The kernel and hypervisor must guarantee that cpu ID
-         * number maps 1:1 to per-CPU pvclock time info.
-         *
-         * Because the hypervisor is entirely unaware of guest userspace
-         * preemption, it cannot guarantee that per-CPU pvclock time
-         * info is updated if the underlying CPU changes or that that
-         * version is increased whenever underlying CPU changes.
-         *
-         * On KVM, we are guaranteed that pvti updates for any vCPU are
-         * atomic as seen by *all* vCPUs.  This is an even stronger
-         * guarantee than we get with a normal seqlock.
-         *
-         * On Xen, we don't appear to have that guarantee, but Xen still
-         * supplies a valid seqlock using the version field.
-         *
-         * We only do pvclock vdso timing at all if
-         * PVCLOCK_TSC_STABLE_BIT is set, and we interpret that bit to
-         * mean that all vCPUs have matching pvti and that the TSC is
-         * synced, so we can just look at vCPU 0's pvti.
-         */
-
-        do {
-                version = pvclock_read_begin(pvti);
-
-                if (unlikely(!(pvti->flags & PVCLOCK_TSC_STABLE_BIT)))
-                        return U64_MAX;
-
-                ret = __pvclock_read_cycles(pvti, rdtsc_ordered());
-        } while (pvclock_read_retry(pvti, version));
-
-        return ret;
-}
-#endif
-#ifdef CONFIG_HYPERV_TSCPAGE
-static notrace u64 vread_hvclock(void)
-{
-        const struct ms_hyperv_tsc_page *tsc_pg =
-                (const struct ms_hyperv_tsc_page *)&hvclock_page;
+#if defined(CONFIG_X86_64) && !defined(BUILD_VDSO32_64)
+/* both 64-bit and x32 use these */
+extern int __vdso_clock_gettime(clockid_t clock, struct __kernel_timespec *ts);
+extern int __vdso_clock_getres(clockid_t clock, struct __kernel_timespec *res);
 
-        return hv_read_tsc_page(tsc_pg);
-}
-#endif
-
-notrace static inline u64 vgetcyc(int mode)
+int __vdso_clock_gettime(clockid_t clock, struct __kernel_timespec *ts)
 {
-        if (mode == VCLOCK_TSC)
-                return (u64)rdtsc_ordered();
-
-        /*
-         * For any memory-mapped vclock type, we need to make sure that gcc
-         * doesn't cleverly hoist a load before the mode check.  Otherwise we
-         * might end up touching the memory-mapped page even if the vclock in
-         * question isn't enabled, which will segfault.  Hence the barriers.
-         */
-#ifdef CONFIG_PARAVIRT_CLOCK
-        if (mode == VCLOCK_PVCLOCK) {
-                barrier();
-                return vread_pvclock();
-        }
-#endif
-#ifdef CONFIG_HYPERV_TSCPAGE
-        if (mode == VCLOCK_HVCLOCK) {
-                barrier();
-                return vread_hvclock();
-        }
-#endif
-        return U64_MAX;
+        return __cvdso_clock_gettime(clock, ts);
 }
 
-notrace static int do_hres(clockid_t clk, struct timespec *ts)
-{
-        struct vgtod_ts *base = &gtod->basetime[clk];
-        u64 cycles, last, sec, ns;
-        unsigned int seq;
-
-        do {
-                seq = gtod_read_begin(gtod);
-                cycles = vgetcyc(gtod->vclock_mode);
-                ns = base->nsec;
-                last = gtod->cycle_last;
-                if (unlikely((s64)cycles < 0))
-                        return vdso_fallback_gettime(clk, ts);
-                if (cycles > last)
-                        ns += (cycles - last) * gtod->mult;
-                ns >>= gtod->shift;
-                sec = base->sec;
-        } while (unlikely(gtod_read_retry(gtod, seq)));
-
-        /*
-         * Do this outside the loop: a race inside the loop could result
-         * in __iter_div_u64_rem() being extremely slow.
-         */
-        ts->tv_sec = sec + __iter_div_u64_rem(ns, NSEC_PER_SEC, &ns);
-        ts->tv_nsec = ns;
-
-        return 0;
-}
+int clock_gettime(clockid_t, struct __kernel_timespec *)
+        __attribute__((weak, alias("__vdso_clock_gettime")));
 
-notrace static void do_coarse(clockid_t clk, struct timespec *ts)
+int __vdso_clock_getres(clockid_t clock,
+                        struct __kernel_timespec *res)
 {
-        struct vgtod_ts *base = &gtod->basetime[clk];
-        unsigned int seq;
-
-        do {
-                seq = gtod_read_begin(gtod);
-                ts->tv_sec = base->sec;
-                ts->tv_nsec = base->nsec;
-        } while (unlikely(gtod_read_retry(gtod, seq)));
+        return __cvdso_clock_getres(clock, res);
 }
+int clock_getres(clockid_t, struct __kernel_timespec *)
+        __attribute__((weak, alias("__vdso_clock_getres")));
 
-notrace int __vdso_clock_gettime(clockid_t clock, struct timespec *ts)
+#else
+/* i386 only */
+extern int __vdso_clock_gettime(clockid_t clock, struct old_timespec32 *ts);
+extern int __vdso_clock_getres(clockid_t clock, struct old_timespec32 *res);
+
+int __vdso_clock_gettime(clockid_t clock, struct old_timespec32 *ts)
 {
-        unsigned int msk;
-
-        /* Sort out negative (CPU/FD) and invalid clocks */
-        if (unlikely((unsigned int) clock >= MAX_CLOCKS))
-                return vdso_fallback_gettime(clock, ts);
-
-        /*
-         * Convert the clockid to a bitmask and use it to check which
-         * clocks are handled in the VDSO directly.
-         */
-        msk = 1U << clock;
-        if (likely(msk & VGTOD_HRES)) {
-                return do_hres(clock, ts);
-        } else if (msk & VGTOD_COARSE) {
-                do_coarse(clock, ts);
-                return 0;
-        }
-        return vdso_fallback_gettime(clock, ts);
+        return __cvdso_clock_gettime32(clock, ts);
 }
 
-int clock_gettime(clockid_t, struct timespec *)
+int clock_gettime(clockid_t, struct old_timespec32 *)
         __attribute__((weak, alias("__vdso_clock_gettime")));
 
-notrace int __vdso_gettimeofday(struct timeval *tv, struct timezone *tz)
+int __vdso_clock_gettime64(clockid_t clock, struct __kernel_timespec *ts)
 {
-        if (likely(tv != NULL)) {
-                struct timespec *ts = (struct timespec *) tv;
-
-                do_hres(CLOCK_REALTIME, ts);
-                tv->tv_usec /= 1000;
-        }
-        if (unlikely(tz != NULL)) {
-                tz->tz_minuteswest = gtod->tz_minuteswest;
-                tz->tz_dsttime = gtod->tz_dsttime;
-        }
-
-        return 0;
+        return __cvdso_clock_gettime(clock, ts);
 }
-int gettimeofday(struct timeval *, struct timezone *)
-        __attribute__((weak, alias("__vdso_gettimeofday")));
 
-/*
- * This will break when the xtime seconds get inaccurate, but that is
- * unlikely
- */
-notrace time_t __vdso_time(time_t *t)
-{
-        /* This is atomic on x86 so we don't need any locks. */
-        time_t result = READ_ONCE(gtod->basetime[CLOCK_REALTIME].sec);
+int clock_gettime64(clockid_t, struct __kernel_timespec *)
+        __attribute__((weak, alias("__vdso_clock_gettime64")));
 
-        if (t)
-                *t = result;
-        return result;
+int __vdso_clock_getres(clockid_t clock, struct old_timespec32 *res)
+{
+        return __cvdso_clock_getres_time32(clock, res);
 }
-time_t time(time_t *t)
-        __attribute__((weak, alias("__vdso_time")));
+
+int clock_getres(clockid_t, struct old_timespec32 *)
+        __attribute__((weak, alias("__vdso_clock_getres")));
+#endif
diff --git a/arch/x86/entry/vdso/vdso.lds.S b/arch/x86/entry/vdso/vdso.lds.S
index d3a2dce4cfa9..36b644e16272 100644
--- a/arch/x86/entry/vdso/vdso.lds.S
+++ b/arch/x86/entry/vdso/vdso.lds.S
@@ -25,6 +25,8 @@ VERSION {
                 __vdso_getcpu;
                 time;
                 __vdso_time;
+                clock_getres;
+                __vdso_clock_getres;
         local: *;
         };
 }
diff --git a/arch/x86/entry/vdso/vdso32/vdso32.lds.S b/arch/x86/entry/vdso/vdso32/vdso32.lds.S
index 422764a81d32..c7720995ab1a 100644
--- a/arch/x86/entry/vdso/vdso32/vdso32.lds.S
+++ b/arch/x86/entry/vdso/vdso32/vdso32.lds.S
@@ -26,6 +26,8 @@ VERSION
                 __vdso_clock_gettime;
                 __vdso_gettimeofday;
                 __vdso_time;
+                __vdso_clock_getres;
+                __vdso_clock_gettime64;
         };
 
         LINUX_2.5 {
diff --git a/arch/x86/entry/vdso/vdsox32.lds.S b/arch/x86/entry/vdso/vdsox32.lds.S
index 05cd1c5c4a15..16a8050a4fb6 100644
--- a/arch/x86/entry/vdso/vdsox32.lds.S
+++ b/arch/x86/entry/vdso/vdsox32.lds.S
@@ -21,6 +21,7 @@ VERSION {
                 __vdso_gettimeofday;
                 __vdso_getcpu;
                 __vdso_time;
+                __vdso_clock_getres;
         local: *;
         };
 }
diff --git a/arch/x86/entry/vdso/vma.c b/arch/x86/entry/vdso/vma.c
index 8db1f594e8b1..349a61d8bf34 100644
--- a/arch/x86/entry/vdso/vma.c
+++ b/arch/x86/entry/vdso/vma.c
@@ -22,7 +22,7 @@
 #include <asm/page.h>
 #include <asm/desc.h>
 #include <asm/cpufeature.h>
-#include <asm/mshyperv.h>
+#include <clocksource/hyperv_timer.h>
 
 #if defined(CONFIG_X86_64)
 unsigned int __read_mostly vdso64_enabled = 1;
diff --git a/arch/x86/entry/vsyscall/Makefile b/arch/x86/entry/vsyscall/Makefile
index 1ac4dd116c26..93c1b3e949a7 100644
--- a/arch/x86/entry/vsyscall/Makefile
+++ b/arch/x86/entry/vsyscall/Makefile
@@ -2,7 +2,5 @@
 #
 # Makefile for the x86 low level vsyscall code
 #
-obj-y                                   := vsyscall_gtod.o
-
 obj-$(CONFIG_X86_VSYSCALL_EMULATION)    += vsyscall_64.o vsyscall_emu_64.o
 
diff --git a/arch/x86/entry/vsyscall/vsyscall_64.c b/arch/x86/entry/vsyscall/vsyscall_64.c
index d9d81ad7a400..07003f3f1bfc 100644
--- a/arch/x86/entry/vsyscall/vsyscall_64.c
+++ b/arch/x86/entry/vsyscall/vsyscall_64.c
@@ -42,9 +42,11 @@
 #define CREATE_TRACE_POINTS
 #include "vsyscall_trace.h"
 
-static enum { EMULATE, NONE } vsyscall_mode =
+static enum { EMULATE, XONLY, NONE } vsyscall_mode __ro_after_init =
 #ifdef CONFIG_LEGACY_VSYSCALL_NONE
         NONE;
+#elif defined(CONFIG_LEGACY_VSYSCALL_XONLY)
+        XONLY;
 #else
         EMULATE;
 #endif
@@ -54,6 +56,8 @@ static int __init vsyscall_setup(char *str)
         if (str) {
                 if (!strcmp("emulate", str))
                         vsyscall_mode = EMULATE;
+                else if (!strcmp("xonly", str))
+                        vsyscall_mode = XONLY;
                 else if (!strcmp("none", str))
                         vsyscall_mode = NONE;
                 else
@@ -113,7 +117,8 @@ static bool write_ok_or_segv(unsigned long ptr, size_t size)
         }
 }
 
-bool emulate_vsyscall(struct pt_regs *regs, unsigned long address)
+bool emulate_vsyscall(unsigned long error_code,
+                      struct pt_regs *regs, unsigned long address)
 {
         struct task_struct *tsk;
         unsigned long caller;
@@ -122,6 +127,22 @@ bool emulate_vsyscall(struct pt_regs *regs, unsigned long address)
         long ret;
         unsigned long orig_dx;
 
+        /* Write faults or kernel-privilege faults never get fixed up. */
+        if ((error_code & (X86_PF_WRITE | X86_PF_USER)) != X86_PF_USER)
+                return false;
+
+        if (!(error_code & X86_PF_INSTR)) {
+                /* Failed vsyscall read */
+                if (vsyscall_mode == EMULATE)
+                        return false;
+
+                /*
+                 * User code tried and failed to read the vsyscall page.
+                 */
+                warn_bad_vsyscall(KERN_INFO, regs, "vsyscall read attempt denied -- look up the vsyscall kernel parameter if you need a workaround");
+                return false;
+        }
+
         /*
          * No point in checking CS -- the only way to get here is a user mode
          * trap to a high address, which means that we're in 64-bit user code.
@@ -284,7 +305,7 @@ static const char *gate_vma_name(struct vm_area_struct *vma)
 static const struct vm_operations_struct gate_vma_ops = {
         .name = gate_vma_name,
 };
-static struct vm_area_struct gate_vma = {
+static struct vm_area_struct gate_vma __ro_after_init = {
         .vm_start       = VSYSCALL_ADDR,
         .vm_end         = VSYSCALL_ADDR + PAGE_SIZE,
         .vm_page_prot   = PAGE_READONLY_EXEC,
@@ -357,12 +378,20 @@ void __init map_vsyscall(void)
         extern char __vsyscall_page;
         unsigned long physaddr_vsyscall = __pa_symbol(&__vsyscall_page);
 
-        if (vsyscall_mode != NONE) {
+        /*
+         * For full emulation, the page needs to exist for real.  In
+         * execute-only mode, there is no PTE at all backing the vsyscall
+         * page.
+         */
+        if (vsyscall_mode == EMULATE) {
                 __set_fixmap(VSYSCALL_PAGE, physaddr_vsyscall,
                              PAGE_KERNEL_VVAR);
                 set_vsyscall_pgtable_user_bits(swapper_pg_dir);
         }
 
+        if (vsyscall_mode == XONLY)
+                gate_vma.vm_flags = VM_EXEC;
+
         BUILD_BUG_ON((unsigned long)__fix_to_virt(VSYSCALL_PAGE) !=
                      (unsigned long)VSYSCALL_ADDR);
 }
diff --git a/arch/x86/entry/vsyscall/vsyscall_gtod.c b/arch/x86/entry/vsyscall/vsyscall_gtod.c
deleted file mode 100644
index cfcdba082feb..000000000000
--- a/arch/x86/entry/vsyscall/vsyscall_gtod.c
+++ /dev/null
@@ -1,83 +0,0 @@
-// SPDX-License-Identifier: GPL-2.0
-/*
- *  Copyright (C) 2001 Andrea Arcangeli <andrea@suse.de> SuSE
- *  Copyright 2003 Andi Kleen, SuSE Labs.
- *
- *  Modified for x86 32 bit architecture by
- *  Stefani Seibold <stefani@seibold.net>
- *  sponsored by Rohde & Schwarz GmbH & Co. KG Munich/Germany
- *
- *  Thanks to hpa@transmeta.com for some useful hint.
- *  Special thanks to Ingo Molnar for his early experience with
- *  a different vsyscall implementation for Linux/IA32 and for the name.
- *
- */
-
-#include <linux/timekeeper_internal.h>
-#include <asm/vgtod.h>
-#include <asm/vvar.h>
-
-int vclocks_used __read_mostly;
-
-DEFINE_VVAR(struct vsyscall_gtod_data, vsyscall_gtod_data);
-
-void update_vsyscall_tz(void)
-{
-        vsyscall_gtod_data.tz_minuteswest = sys_tz.tz_minuteswest;
-        vsyscall_gtod_data.tz_dsttime = sys_tz.tz_dsttime;
-}
-
-void update_vsyscall(struct timekeeper *tk)
-{
-        int vclock_mode = tk->tkr_mono.clock->archdata.vclock_mode;
-        struct vsyscall_gtod_data *vdata = &vsyscall_gtod_data;
-        struct vgtod_ts *base;
-        u64 nsec;
-
-        /* Mark the new vclock used. */
-        BUILD_BUG_ON(VCLOCK_MAX >= 32);
-        WRITE_ONCE(vclocks_used, READ_ONCE(vclocks_used) | (1 << vclock_mode));
-
-        gtod_write_begin(vdata);
-
-        /* copy vsyscall data */
-        vdata->vclock_mode      = vclock_mode;
-        vdata->cycle_last       = tk->tkr_mono.cycle_last;
-        vdata->mask             = tk->tkr_mono.mask;
-        vdata->mult             = tk->tkr_mono.mult;
-        vdata->shift            = tk->tkr_mono.shift;
-
-        base = &vdata->basetime[CLOCK_REALTIME];
-        base->sec = tk->xtime_sec;
-        base->nsec = tk->tkr_mono.xtime_nsec;
-
-        base = &vdata->basetime[CLOCK_TAI];
-        base->sec = tk->xtime_sec + (s64)tk->tai_offset;
-        base->nsec = tk->tkr_mono.xtime_nsec;
-
-        base = &vdata->basetime[CLOCK_MONOTONIC];
-        base->sec = tk->xtime_sec + tk->wall_to_monotonic.tv_sec;
-        nsec = tk->tkr_mono.xtime_nsec;
-        nsec += ((u64)tk->wall_to_monotonic.tv_nsec << tk->tkr_mono.shift);
-        while (nsec >= (((u64)NSEC_PER_SEC) << tk->tkr_mono.shift)) {
-                nsec -= ((u64)NSEC_PER_SEC) << tk->tkr_mono.shift;
-                base->sec++;
-        }
-        base->nsec = nsec;
-
-        base = &vdata->basetime[CLOCK_REALTIME_COARSE];
-        base->sec = tk->xtime_sec;
-        base->nsec = tk->tkr_mono.xtime_nsec >> tk->tkr_mono.shift;
-
-        base = &vdata->basetime[CLOCK_MONOTONIC_COARSE];
-        base->sec = tk->xtime_sec + tk->wall_to_monotonic.tv_sec;
-        nsec = tk->tkr_mono.xtime_nsec >> tk->tkr_mono.shift;
-        nsec += tk->wall_to_monotonic.tv_nsec;
-        while (nsec >= NSEC_PER_SEC) {
-                nsec -= NSEC_PER_SEC;
-                base->sec++;
-        }
-        base->nsec = nsec;
-
-        gtod_write_end(vdata);
-}
diff --git a/arch/x86/events/core.c b/arch/x86/events/core.c
index f315425d8468..ceb712b0a1c6 100644
--- a/arch/x86/events/core.c
+++ b/arch/x86/events/core.c
@@ -561,14 +561,14 @@ int x86_pmu_hw_config(struct perf_event *event)
         }
 
         /* sample_regs_user never support XMM registers */
-        if (unlikely(event->attr.sample_regs_user & PEBS_XMM_REGS))
+        if (unlikely(event->attr.sample_regs_user & PERF_REG_EXTENDED_MASK))
                 return -EINVAL;
         /*
          * Besides the general purpose registers, XMM registers may
          * be collected in PEBS on some platforms, e.g. Icelake
          */
-        if (unlikely(event->attr.sample_regs_intr & PEBS_XMM_REGS)) {
-                if (x86_pmu.pebs_no_xmm_regs)
+        if (unlikely(event->attr.sample_regs_intr & PERF_REG_EXTENDED_MASK)) {
+                if (!(event->pmu->capabilities & PERF_PMU_CAP_EXTENDED_REGS))
                         return -EINVAL;
 
                 if (!event->attr.precise_ip)
@@ -2179,7 +2179,7 @@ static void x86_pmu_event_mapped(struct perf_event *event, struct mm_struct *mm)
          * For now, this can't happen because all callers hold mmap_sem
          * for write.  If this changes, we'll need a different solution.
          */
-        lockdep_assert_held_exclusive(&mm->mmap_sem);
+        lockdep_assert_held_write(&mm->mmap_sem);
 
         if (atomic_inc_return(&mm->context.perf_rdpmc_allowed) == 1)
                 on_each_cpu_mask(mm_cpumask(mm), refresh_pce, NULL, 1);
@@ -2402,13 +2402,13 @@ perf_callchain_kernel(struct perf_callchain_entry_ctx *entry, struct pt_regs *re
                 return;
         }
 
-        if (perf_hw_regs(regs)) {
-                if (perf_callchain_store(entry, regs->ip))
-                        return;
+        if (perf_callchain_store(entry, regs->ip))
+                return;
+
+        if (perf_hw_regs(regs))
                 unwind_start(&state, current, regs, NULL);
-        } else {
+        else
                 unwind_start(&state, current, NULL, (void *)regs->sp);
-        }
 
         for (; !unwind_done(&state); unwind_next_frame(&state)) {
                 addr = unwind_get_return_address(&state);
diff --git a/arch/x86/events/intel/ds.c b/arch/x86/events/intel/ds.c
index 7acc526b4ad2..505c73dc6a73 100644
--- a/arch/x86/events/intel/ds.c
+++ b/arch/x86/events/intel/ds.c
@@ -987,7 +987,7 @@ static u64 pebs_update_adaptive_cfg(struct perf_event *event)
                 pebs_data_cfg |= PEBS_DATACFG_GP;
 
         if ((sample_type & PERF_SAMPLE_REGS_INTR) &&
-            (attr->sample_regs_intr & PEBS_XMM_REGS))
+            (attr->sample_regs_intr & PERF_REG_EXTENDED_MASK))
                 pebs_data_cfg |= PEBS_DATACFG_XMMS;
 
         if (sample_type & PERF_SAMPLE_BRANCH_STACK) {
@@ -1964,10 +1964,9 @@ void __init intel_ds_init(void)
         x86_pmu.bts  = boot_cpu_has(X86_FEATURE_BTS);
         x86_pmu.pebs = boot_cpu_has(X86_FEATURE_PEBS);
         x86_pmu.pebs_buffer_size = PEBS_BUFFER_SIZE;
-        if (x86_pmu.version <= 4) {
+        if (x86_pmu.version <= 4)
                 x86_pmu.pebs_no_isolation = 1;
-                x86_pmu.pebs_no_xmm_regs = 1;
-        }
+
         if (x86_pmu.pebs) {
                 char pebs_type = x86_pmu.intel_cap.pebs_trap ?  '+' : '-';
                 char *pebs_qual = "";
@@ -2020,9 +2019,9 @@ void __init intel_ds_init(void)
                                         PERF_SAMPLE_TIME;
                                 x86_pmu.flags |= PMU_FL_PEBS_ALL;
                                 pebs_qual = "-baseline";
+                                x86_get_pmu()->capabilities |= PERF_PMU_CAP_EXTENDED_REGS;
                         } else {
                                 /* Only basic record supported */
-                                x86_pmu.pebs_no_xmm_regs = 1;
                                 x86_pmu.large_pebs_flags &=
                                         ~(PERF_SAMPLE_ADDR |
                                           PERF_SAMPLE_TIME |
diff --git a/arch/x86/events/intel/uncore.c b/arch/x86/events/intel/uncore.c
index 9e3fbd47cb56..089bfcdf2f7f 100644
--- a/arch/x86/events/intel/uncore.c
+++ b/arch/x86/events/intel/uncore.c
@@ -1400,6 +1400,7 @@ static const struct x86_cpu_id intel_uncore_match[] __initconst = {
         X86_UNCORE_MODEL_MATCH(INTEL_FAM6_KABYLAKE_MOBILE, skl_uncore_init),
         X86_UNCORE_MODEL_MATCH(INTEL_FAM6_KABYLAKE_DESKTOP, skl_uncore_init),
         X86_UNCORE_MODEL_MATCH(INTEL_FAM6_ICELAKE_MOBILE, icl_uncore_init),
+        X86_UNCORE_MODEL_MATCH(INTEL_FAM6_ICELAKE_NNPI, icl_uncore_init),
         {},
 };
 
diff --git a/arch/x86/events/perf_event.h b/arch/x86/events/perf_event.h
index a6ac2f4f76fc..4e346856ee19 100644
--- a/arch/x86/events/perf_event.h
+++ b/arch/x86/events/perf_event.h
@@ -121,24 +121,6 @@ struct amd_nb {
          (1ULL << PERF_REG_X86_R14)   | \
          (1ULL << PERF_REG_X86_R15))
 
-#define PEBS_XMM_REGS                   \
-        ((1ULL << PERF_REG_X86_XMM0)  | \
-         (1ULL << PERF_REG_X86_XMM1)  | \
-         (1ULL << PERF_REG_X86_XMM2)  | \
-         (1ULL << PERF_REG_X86_XMM3)  | \
-         (1ULL << PERF_REG_X86_XMM4)  | \
-         (1ULL << PERF_REG_X86_XMM5)  | \
-         (1ULL << PERF_REG_X86_XMM6)  | \
-         (1ULL << PERF_REG_X86_XMM7)  | \
-         (1ULL << PERF_REG_X86_XMM8)  | \
-         (1ULL << PERF_REG_X86_XMM9)  | \
-         (1ULL << PERF_REG_X86_XMM10) | \
-         (1ULL << PERF_REG_X86_XMM11) | \
-         (1ULL << PERF_REG_X86_XMM12) | \
-         (1ULL << PERF_REG_X86_XMM13) | \
-         (1ULL << PERF_REG_X86_XMM14) | \
-         (1ULL << PERF_REG_X86_XMM15))
-
 /*
  * Per register state.
  */
@@ -668,8 +650,7 @@ struct x86_pmu {
                         pebs_broken             :1,
                         pebs_prec_dist          :1,
                         pebs_no_tlb             :1,
-                        pebs_no_isolation       :1,
-                        pebs_no_xmm_regs        :1;
+                        pebs_no_isolation       :1;
         int             pebs_record_size;
         int             pebs_buffer_size;
         int             max_pebs_events;
diff --git a/arch/x86/hyperv/hv_init.c b/arch/x86/hyperv/hv_init.c
index 1608050e9df9..0e033ef11a9f 100644
--- a/arch/x86/hyperv/hv_init.c
+++ b/arch/x86/hyperv/hv_init.c
@@ -17,64 +17,13 @@
 #include <linux/version.h>
 #include <linux/vmalloc.h>
 #include <linux/mm.h>
-#include <linux/clockchips.h>
 #include <linux/hyperv.h>
 #include <linux/slab.h>
 #include <linux/cpuhotplug.h>
-
-#ifdef CONFIG_HYPERV_TSCPAGE
-
-static struct ms_hyperv_tsc_page *tsc_pg;
-
-struct ms_hyperv_tsc_page *hv_get_tsc_page(void)
-{
-        return tsc_pg;
-}
-EXPORT_SYMBOL_GPL(hv_get_tsc_page);
-
-static u64 read_hv_clock_tsc(struct clocksource *arg)
-{
-        u64 current_tick = hv_read_tsc_page(tsc_pg);
-
-        if (current_tick == U64_MAX)
-                rdmsrl(HV_X64_MSR_TIME_REF_COUNT, current_tick);
-
-        return current_tick;
-}
-
-static struct clocksource hyperv_cs_tsc = {
-                .name           = "hyperv_clocksource_tsc_page",
-                .rating         = 400,
-                .read           = read_hv_clock_tsc,
-                .mask           = CLOCKSOURCE_MASK(64),
-                .flags          = CLOCK_SOURCE_IS_CONTINUOUS,
-};
-#endif
-
-static u64 read_hv_clock_msr(struct clocksource *arg)
-{
-        u64 current_tick;
-        /*
-         * Read the partition counter to get the current tick count. This count
-         * is set to 0 when the partition is created and is incremented in
-         * 100 nanosecond units.
-         */
-        rdmsrl(HV_X64_MSR_TIME_REF_COUNT, current_tick);
-        return current_tick;
-}
-
-static struct clocksource hyperv_cs_msr = {
-        .name           = "hyperv_clocksource_msr",
-        .rating         = 400,
-        .read           = read_hv_clock_msr,
-        .mask           = CLOCKSOURCE_MASK(64),
-        .flags          = CLOCK_SOURCE_IS_CONTINUOUS,
-};
+#include <clocksource/hyperv_timer.h>
 
 void *hv_hypercall_pg;
 EXPORT_SYMBOL_GPL(hv_hypercall_pg);
-struct clocksource *hyperv_cs;
-EXPORT_SYMBOL_GPL(hyperv_cs);
 
 u32 *hv_vp_index;
 EXPORT_SYMBOL_GPL(hv_vp_index);
@@ -343,42 +292,8 @@ void __init hyperv_init(void)
 
         x86_init.pci.arch_init = hv_pci_init;
 
-        /*
-         * Register Hyper-V specific clocksource.
-         */
-#ifdef CONFIG_HYPERV_TSCPAGE
-        if (ms_hyperv.features & HV_MSR_REFERENCE_TSC_AVAILABLE) {
-                union hv_x64_msr_hypercall_contents tsc_msr;
-
-                tsc_pg = __vmalloc(PAGE_SIZE, GFP_KERNEL, PAGE_KERNEL);
-                if (!tsc_pg)
-                        goto register_msr_cs;
-
-                hyperv_cs = &hyperv_cs_tsc;
-
-                rdmsrl(HV_X64_MSR_REFERENCE_TSC, tsc_msr.as_uint64);
-
-                tsc_msr.enable = 1;
-                tsc_msr.guest_physical_address = vmalloc_to_pfn(tsc_pg);
-
-                wrmsrl(HV_X64_MSR_REFERENCE_TSC, tsc_msr.as_uint64);
-
-                hyperv_cs_tsc.archdata.vclock_mode = VCLOCK_HVCLOCK;
-
-                clocksource_register_hz(&hyperv_cs_tsc, NSEC_PER_SEC/100);
-                return;
-        }
-register_msr_cs:
-#endif
-        /*
-         * For 32 bit guests just use the MSR based mechanism for reading
-         * the partition counter.
-         */
-
-        hyperv_cs = &hyperv_cs_msr;
-        if (ms_hyperv.features & HV_MSR_TIME_REF_COUNT_AVAILABLE)
-                clocksource_register_hz(&hyperv_cs_msr, NSEC_PER_SEC/100);
-
+        /* Register Hyper-V specific clocksource */
+        hv_init_clocksource();
         return;
 
 remove_cpuhp_state:
diff --git a/arch/x86/include/asm/apic.h b/arch/x86/include/asm/apic.h
index 1340fa53b575..050e5f9ebf81 100644
--- a/arch/x86/include/asm/apic.h
+++ b/arch/x86/include/asm/apic.h
@@ -53,7 +53,7 @@ extern unsigned int apic_verbosity;
 extern int local_apic_timer_c2_ok;
 
 extern int disable_apic;
-extern unsigned int lapic_timer_frequency;
+extern unsigned int lapic_timer_period;
 
 extern enum apic_intr_mode_id apic_intr_mode;
 enum apic_intr_mode_id {
@@ -155,7 +155,6 @@ static inline int apic_force_enable(unsigned long addr)
 extern int apic_force_enable(unsigned long addr);
 #endif
 
-extern void apic_bsp_setup(bool upmode);
 extern void apic_ap_setup(void);
 
 /*
@@ -175,6 +174,7 @@ extern void lapic_assign_system_vectors(void);
 extern void lapic_assign_legacy_vector(unsigned int isairq, bool replace);
 extern void lapic_online(void);
 extern void lapic_offline(void);
+extern bool apic_needs_pit(void);
 
 #else /* !CONFIG_X86_LOCAL_APIC */
 static inline void lapic_shutdown(void) { }
@@ -188,6 +188,7 @@ static inline void init_bsp_APIC(void) { }
 static inline void apic_intr_mode_init(void) { }
 static inline void lapic_assign_system_vectors(void) { }
 static inline void lapic_assign_legacy_vector(unsigned int i, bool r) { }
+static inline bool apic_needs_pit(void) { return true; }
 #endif /* !CONFIG_X86_LOCAL_APIC */
 
 #ifdef CONFIG_X86_X2APIC
diff --git a/arch/x86/include/asm/atomic.h b/arch/x86/include/asm/atomic.h
index ea3d95275b43..115127c7ad28 100644
--- a/arch/x86/include/asm/atomic.h
+++ b/arch/x86/include/asm/atomic.h
@@ -54,7 +54,7 @@ static __always_inline void arch_atomic_add(int i, atomic_t *v)
 {
         asm volatile(LOCK_PREFIX "addl %1,%0"
                      : "+m" (v->counter)
-                     : "ir" (i));
+                     : "ir" (i) : "memory");
 }
 
 /**
@@ -68,7 +68,7 @@ static __always_inline void arch_atomic_sub(int i, atomic_t *v)
 {
         asm volatile(LOCK_PREFIX "subl %1,%0"
                      : "+m" (v->counter)
-                     : "ir" (i));
+                     : "ir" (i) : "memory");
 }
 
 /**
@@ -95,7 +95,7 @@ static __always_inline bool arch_atomic_sub_and_test(int i, atomic_t *v)
 static __always_inline void arch_atomic_inc(atomic_t *v)
 {
         asm volatile(LOCK_PREFIX "incl %0"
-                     : "+m" (v->counter));
+                     : "+m" (v->counter) :: "memory");
 }
 #define arch_atomic_inc arch_atomic_inc
 
@@ -108,7 +108,7 @@ static __always_inline void arch_atomic_inc(atomic_t *v)
 static __always_inline void arch_atomic_dec(atomic_t *v)
 {
         asm volatile(LOCK_PREFIX "decl %0"
-                     : "+m" (v->counter));
+                     : "+m" (v->counter) :: "memory");
 }
 #define arch_atomic_dec arch_atomic_dec
 
diff --git a/arch/x86/include/asm/atomic64_32.h b/arch/x86/include/asm/atomic64_32.h
index 6a5b0ec460da..52cfaecb13f9 100644
--- a/arch/x86/include/asm/atomic64_32.h
+++ b/arch/x86/include/asm/atomic64_32.h
@@ -9,7 +9,7 @@
 /* An 64bit atomic type */
 
 typedef struct {
-        u64 __aligned(8) counter;
+        s64 __aligned(8) counter;
 } atomic64_t;
 
 #define ATOMIC64_INIT(val)      { (val) }
@@ -71,8 +71,7 @@ ATOMIC64_DECL(add_unless);
  * the old value.
  */
 
-static inline long long arch_atomic64_cmpxchg(atomic64_t *v, long long o,
-                                              long long n)
+static inline s64 arch_atomic64_cmpxchg(atomic64_t *v, s64 o, s64 n)
 {
         return arch_cmpxchg64(&v->counter, o, n);
 }
@@ -85,9 +84,9 @@ static inline long long arch_atomic64_cmpxchg(atomic64_t *v, long long o,
  * Atomically xchgs the value of @v to @n and returns
  * the old value.
  */
-static inline long long arch_atomic64_xchg(atomic64_t *v, long long n)
+static inline s64 arch_atomic64_xchg(atomic64_t *v, s64 n)
 {
-        long long o;
+        s64 o;
         unsigned high = (unsigned)(n >> 32);
         unsigned low = (unsigned)n;
         alternative_atomic64(xchg, "=&A" (o),
@@ -103,7 +102,7 @@ static inline long long arch_atomic64_xchg(atomic64_t *v, long long n)
  *
  * Atomically sets the value of @v to @n.
  */
-static inline void arch_atomic64_set(atomic64_t *v, long long i)
+static inline void arch_atomic64_set(atomic64_t *v, s64 i)
 {
         unsigned high = (unsigned)(i >> 32);
         unsigned low = (unsigned)i;
@@ -118,9 +117,9 @@ static inline void arch_atomic64_set(atomic64_t *v, long long i)
  *
  * Atomically reads the value of @v and returns it.
  */
-static inline long long arch_atomic64_read(const atomic64_t *v)
+static inline s64 arch_atomic64_read(const atomic64_t *v)
 {
-        long long r;
+        s64 r;
         alternative_atomic64(read, "=&A" (r), "c" (v) : "memory");
         return r;
 }
@@ -132,7 +131,7 @@ static inline long long arch_atomic64_read(const atomic64_t *v)
  *
  * Atomically adds @i to @v and returns @i + *@v
  */
-static inline long long arch_atomic64_add_return(long long i, atomic64_t *v)
+static inline s64 arch_atomic64_add_return(s64 i, atomic64_t *v)
 {
         alternative_atomic64(add_return,
                              ASM_OUTPUT2("+A" (i), "+c" (v)),
@@ -143,7 +142,7 @@ static inline long long arch_atomic64_add_return(long long i, atomic64_t *v)
 /*
  * Other variants with different arithmetic operators:
  */
-static inline long long arch_atomic64_sub_return(long long i, atomic64_t *v)
+static inline s64 arch_atomic64_sub_return(s64 i, atomic64_t *v)
 {
         alternative_atomic64(sub_return,
                              ASM_OUTPUT2("+A" (i), "+c" (v)),
@@ -151,18 +150,18 @@ static inline long long arch_atomic64_sub_return(long long i, atomic64_t *v)
         return i;
 }
 
-static inline long long arch_atomic64_inc_return(atomic64_t *v)
+static inline s64 arch_atomic64_inc_return(atomic64_t *v)
 {
-        long long a;
+        s64 a;
         alternative_atomic64(inc_return, "=&A" (a),
                              "S" (v) : "memory", "ecx");
         return a;
 }
 #define arch_atomic64_inc_return arch_atomic64_inc_return
 
-static inline long long arch_atomic64_dec_return(atomic64_t *v)
+static inline s64 arch_atomic64_dec_return(atomic64_t *v)
 {
-        long long a;
+        s64 a;
         alternative_atomic64(dec_return, "=&A" (a),
                              "S" (v) : "memory", "ecx");
         return a;
@@ -176,7 +175,7 @@ static inline long long arch_atomic64_dec_return(atomic64_t *v)
  *
  * Atomically adds @i to @v.
  */
-static inline long long arch_atomic64_add(long long i, atomic64_t *v)
+static inline s64 arch_atomic64_add(s64 i, atomic64_t *v)
 {
         __alternative_atomic64(add, add_return,
                                ASM_OUTPUT2("+A" (i), "+c" (v)),
@@ -191,7 +190,7 @@ static inline long long arch_atomic64_add(long long i, atomic64_t *v)
  *
  * Atomically subtracts @i from @v.
  */
-static inline long long arch_atomic64_sub(long long i, atomic64_t *v)
+static inline s64 arch_atomic64_sub(s64 i, atomic64_t *v)
 {
         __alternative_atomic64(sub, sub_return,
                                ASM_OUTPUT2("+A" (i), "+c" (v)),
@@ -234,8 +233,7 @@ static inline void arch_atomic64_dec(atomic64_t *v)
  * Atomically adds @a to @v, so long as it was not @u.
  * Returns non-zero if the add was done, zero otherwise.
  */
-static inline int arch_atomic64_add_unless(atomic64_t *v, long long a,
-                                           long long u)
+static inline int arch_atomic64_add_unless(atomic64_t *v, s64 a, s64 u)
 {
         unsigned low = (unsigned)u;
         unsigned high = (unsigned)(u >> 32);
@@ -254,9 +252,9 @@ static inline int arch_atomic64_inc_not_zero(atomic64_t *v)
 }
 #define arch_atomic64_inc_not_zero arch_atomic64_inc_not_zero
 
-static inline long long arch_atomic64_dec_if_positive(atomic64_t *v)
+static inline s64 arch_atomic64_dec_if_positive(atomic64_t *v)
 {
-        long long r;
+        s64 r;
         alternative_atomic64(dec_if_positive, "=&A" (r),
                              "S" (v) : "ecx", "memory");
         return r;
@@ -266,17 +264,17 @@ static inline long long arch_atomic64_dec_if_positive(atomic64_t *v)
 #undef alternative_atomic64
 #undef __alternative_atomic64
 
-static inline void arch_atomic64_and(long long i, atomic64_t *v)
+static inline void arch_atomic64_and(s64 i, atomic64_t *v)
 {
-        long long old, c = 0;
+        s64 old, c = 0;
 
         while ((old = arch_atomic64_cmpxchg(v, c, c & i)) != c)
                 c = old;
 }
 
-static inline long long arch_atomic64_fetch_and(long long i, atomic64_t *v)
+static inline s64 arch_atomic64_fetch_and(s64 i, atomic64_t *v)
 {
-        long long old, c = 0;
+        s64 old, c = 0;
 
         while ((old = arch_atomic64_cmpxchg(v, c, c & i)) != c)
                 c = old;
@@ -284,17 +282,17 @@ static inline long long arch_atomic64_fetch_and(long long i, atomic64_t *v)
         return old;
 }
 
-static inline void arch_atomic64_or(long long i, atomic64_t *v)
+static inline void arch_atomic64_or(s64 i, atomic64_t *v)
 {
-        long long old, c = 0;
+        s64 old, c = 0;
 
         while ((old = arch_atomic64_cmpxchg(v, c, c | i)) != c)
                 c = old;
 }
 
-static inline long long arch_atomic64_fetch_or(long long i, atomic64_t *v)
+static inline s64 arch_atomic64_fetch_or(s64 i, atomic64_t *v)
 {
-        long long old, c = 0;
+        s64 old, c = 0;
 
         while ((old = arch_atomic64_cmpxchg(v, c, c | i)) != c)
                 c = old;
@@ -302,17 +300,17 @@ static inline long long arch_atomic64_fetch_or(long long i, atomic64_t *v)
         return old;
 }
 
-static inline void arch_atomic64_xor(long long i, atomic64_t *v)
+static inline void arch_atomic64_xor(s64 i, atomic64_t *v)
 {
-        long long old, c = 0;
+        s64 old, c = 0;
 
         while ((old = arch_atomic64_cmpxchg(v, c, c ^ i)) != c)
                 c = old;
 }
 
-static inline long long arch_atomic64_fetch_xor(long long i, atomic64_t *v)
+static inline s64 arch_atomic64_fetch_xor(s64 i, atomic64_t *v)
 {
-        long long old, c = 0;
+        s64 old, c = 0;
 
         while ((old = arch_atomic64_cmpxchg(v, c, c ^ i)) != c)
                 c = old;
@@ -320,9 +318,9 @@ static inline long long arch_atomic64_fetch_xor(long long i, atomic64_t *v)
         return old;
 }
 
-static inline long long arch_atomic64_fetch_add(long long i, atomic64_t *v)
+static inline s64 arch_atomic64_fetch_add(s64 i, atomic64_t *v)
 {
-        long long old, c = 0;
+        s64 old, c = 0;
 
         while ((old = arch_atomic64_cmpxchg(v, c, c + i)) != c)
                 c = old;
diff --git a/arch/x86/include/asm/atomic64_64.h b/arch/x86/include/asm/atomic64_64.h
index dadc20adba21..95c6ceac66b9 100644
--- a/arch/x86/include/asm/atomic64_64.h
+++ b/arch/x86/include/asm/atomic64_64.h
@@ -17,7 +17,7 @@
  * Atomically reads the value of @v.
  * Doesn't imply a read memory barrier.
  */
-static inline long arch_atomic64_read(const atomic64_t *v)
+static inline s64 arch_atomic64_read(const atomic64_t *v)
 {
         return READ_ONCE((v)->counter);
 }
@@ -29,7 +29,7 @@ static inline long arch_atomic64_read(const atomic64_t *v)
  *
  * Atomically sets the value of @v to @i.
  */
-static inline void arch_atomic64_set(atomic64_t *v, long i)
+static inline void arch_atomic64_set(atomic64_t *v, s64 i)
 {
         WRITE_ONCE(v->counter, i);
 }
@@ -41,11 +41,11 @@ static inline void arch_atomic64_set(atomic64_t *v, long i)
  *
  * Atomically adds @i to @v.
  */
-static __always_inline void arch_atomic64_add(long i, atomic64_t *v)
+static __always_inline void arch_atomic64_add(s64 i, atomic64_t *v)
 {
         asm volatile(LOCK_PREFIX "addq %1,%0"
                      : "=m" (v->counter)
-                     : "er" (i), "m" (v->counter));
+                     : "er" (i), "m" (v->counter) : "memory");
 }
 
 /**
@@ -55,11 +55,11 @@ static __always_inline void arch_atomic64_add(long i, atomic64_t *v)
  *
  * Atomically subtracts @i from @v.
  */
-static inline void arch_atomic64_sub(long i, atomic64_t *v)
+static inline void arch_atomic64_sub(s64 i, atomic64_t *v)
 {
         asm volatile(LOCK_PREFIX "subq %1,%0"
                      : "=m" (v->counter)
-                     : "er" (i), "m" (v->counter));
+                     : "er" (i), "m" (v->counter) : "memory");
 }
 
 /**
@@ -71,7 +71,7 @@ static inline void arch_atomic64_sub(long i, atomic64_t *v)
  * true if the result is zero, or false for all
  * other cases.
  */
-static inline bool arch_atomic64_sub_and_test(long i, atomic64_t *v)
+static inline bool arch_atomic64_sub_and_test(s64 i, atomic64_t *v)
 {
         return GEN_BINARY_RMWcc(LOCK_PREFIX "subq", v->counter, e, "er", i);
 }
@@ -87,7 +87,7 @@ static __always_inline void arch_atomic64_inc(atomic64_t *v)
 {
         asm volatile(LOCK_PREFIX "incq %0"
                      : "=m" (v->counter)
-                     : "m" (v->counter));
+                     : "m" (v->counter) : "memory");
 }
 #define arch_atomic64_inc arch_atomic64_inc
 
@@ -101,7 +101,7 @@ static __always_inline void arch_atomic64_dec(atomic64_t *v)
 {
         asm volatile(LOCK_PREFIX "decq %0"
                      : "=m" (v->counter)
-                     : "m" (v->counter));
+                     : "m" (v->counter) : "memory");
 }
 #define arch_atomic64_dec arch_atomic64_dec
 
@@ -142,7 +142,7 @@ static inline bool arch_atomic64_inc_and_test(atomic64_t *v)
  * if the result is negative, or false when
  * result is greater than or equal to zero.
  */
-static inline bool arch_atomic64_add_negative(long i, atomic64_t *v)
+static inline bool arch_atomic64_add_negative(s64 i, atomic64_t *v)
 {
         return GEN_BINARY_RMWcc(LOCK_PREFIX "addq", v->counter, s, "er", i);
 }
@@ -155,43 +155,43 @@ static inline bool arch_atomic64_add_negative(long i, atomic64_t *v)
  *
  * Atomically adds @i to @v and returns @i + @v
  */
-static __always_inline long arch_atomic64_add_return(long i, atomic64_t *v)
+static __always_inline s64 arch_atomic64_add_return(s64 i, atomic64_t *v)
 {
         return i + xadd(&v->counter, i);
 }
 
-static inline long arch_atomic64_sub_return(long i, atomic64_t *v)
+static inline s64 arch_atomic64_sub_return(s64 i, atomic64_t *v)
 {
         return arch_atomic64_add_return(-i, v);
 }
 
-static inline long arch_atomic64_fetch_add(long i, atomic64_t *v)
+static inline s64 arch_atomic64_fetch_add(s64 i, atomic64_t *v)
 {
         return xadd(&v->counter, i);
 }
 
-static inline long arch_atomic64_fetch_sub(long i, atomic64_t *v)
+static inline s64 arch_atomic64_fetch_sub(s64 i, atomic64_t *v)
 {
         return xadd(&v->counter, -i);
 }
 
-static inline long arch_atomic64_cmpxchg(atomic64_t *v, long old, long new)
+static inline s64 arch_atomic64_cmpxchg(atomic64_t *v, s64 old, s64 new)
 {
         return arch_cmpxchg(&v->counter, old, new);
 }
 
 #define arch_atomic64_try_cmpxchg arch_atomic64_try_cmpxchg
-static __always_inline bool arch_atomic64_try_cmpxchg(atomic64_t *v, s64 *old, long new)
+static __always_inline bool arch_atomic64_try_cmpxchg(atomic64_t *v, s64 *old, s64 new)
 {
         return try_cmpxchg(&v->counter, old, new);
 }
 
-static inline long arch_atomic64_xchg(atomic64_t *v, long new)
+static inline s64 arch_atomic64_xchg(atomic64_t *v, s64 new)
 {
         return arch_xchg(&v->counter, new);
 }
 
-static inline void arch_atomic64_and(long i, atomic64_t *v)
+static inline void arch_atomic64_and(s64 i, atomic64_t *v)
 {
         asm volatile(LOCK_PREFIX "andq %1,%0"
                         : "+m" (v->counter)
@@ -199,7 +199,7 @@ static inline void arch_atomic64_and(long i, atomic64_t *v)
                         : "memory");
 }
 
-static inline long arch_atomic64_fetch_and(long i, atomic64_t *v)
+static inline s64 arch_atomic64_fetch_and(s64 i, atomic64_t *v)
 {
         s64 val = arch_atomic64_read(v);
 
@@ -208,7 +208,7 @@ static inline long arch_atomic64_fetch_and(long i, atomic64_t *v)
         return val;
 }
 
-static inline void arch_atomic64_or(long i, atomic64_t *v)
+static inline void arch_atomic64_or(s64 i, atomic64_t *v)
 {
         asm volatile(LOCK_PREFIX "orq %1,%0"
                         : "+m" (v->counter)
@@ -216,7 +216,7 @@ static inline void arch_atomic64_or(long i, atomic64_t *v)
                         : "memory");
 }
 
-static inline long arch_atomic64_fetch_or(long i, atomic64_t *v)
+static inline s64 arch_atomic64_fetch_or(s64 i, atomic64_t *v)
 {
         s64 val = arch_atomic64_read(v);
 
@@ -225,7 +225,7 @@ static inline long arch_atomic64_fetch_or(long i, atomic64_t *v)
         return val;
 }
 
-static inline void arch_atomic64_xor(long i, atomic64_t *v)
+static inline void arch_atomic64_xor(s64 i, atomic64_t *v)
 {
         asm volatile(LOCK_PREFIX "xorq %1,%0"
                         : "+m" (v->counter)
@@ -233,7 +233,7 @@ static inline void arch_atomic64_xor(long i, atomic64_t *v)
                         : "memory");
 }
 
-static inline long arch_atomic64_fetch_xor(long i, atomic64_t *v)
+static inline s64 arch_atomic64_fetch_xor(s64 i, atomic64_t *v)
 {
         s64 val = arch_atomic64_read(v);
 
diff --git a/arch/x86/include/asm/barrier.h b/arch/x86/include/asm/barrier.h
index 14de0432d288..84f848c2541a 100644
--- a/arch/x86/include/asm/barrier.h
+++ b/arch/x86/include/asm/barrier.h
@@ -80,8 +80,8 @@ do {									\
 })
 
 /* Atomic operations are already serializing on x86 */
-#define __smp_mb__before_atomic()       barrier()
-#define __smp_mb__after_atomic()        barrier()
+#define __smp_mb__before_atomic()       do { } while (0)
+#define __smp_mb__after_atomic()        do { } while (0)
 
 #include <asm-generic/barrier.h>
 
diff --git a/arch/x86/include/asm/cpufeature.h b/arch/x86/include/asm/cpufeature.h
index 1d337c51f7e6..58acda503817 100644
--- a/arch/x86/include/asm/cpufeature.h
+++ b/arch/x86/include/asm/cpufeature.h
@@ -22,8 +22,8 @@ enum cpuid_leafs
         CPUID_LNX_3,
         CPUID_7_0_EBX,
         CPUID_D_1_EAX,
-        CPUID_F_0_EDX,
-        CPUID_F_1_EDX,
+        CPUID_LNX_4,
+        CPUID_7_1_EAX,
         CPUID_8000_0008_EBX,
         CPUID_6_EAX,
         CPUID_8000_000A_EDX,
diff --git a/arch/x86/include/asm/cpufeatures.h b/arch/x86/include/asm/cpufeatures.h
index 75f27ee2c263..998c2cc08363 100644
--- a/arch/x86/include/asm/cpufeatures.h
+++ b/arch/x86/include/asm/cpufeatures.h
@@ -239,12 +239,14 @@
 #define X86_FEATURE_BMI1                ( 9*32+ 3) /* 1st group bit manipulation extensions */
 #define X86_FEATURE_HLE                 ( 9*32+ 4) /* Hardware Lock Elision */
 #define X86_FEATURE_AVX2                ( 9*32+ 5) /* AVX2 instructions */
+#define X86_FEATURE_FDP_EXCPTN_ONLY     ( 9*32+ 6) /* "" FPU data pointer updated only on x87 exceptions */
 #define X86_FEATURE_SMEP                ( 9*32+ 7) /* Supervisor Mode Execution Protection */
 #define X86_FEATURE_BMI2                ( 9*32+ 8) /* 2nd group bit manipulation extensions */
 #define X86_FEATURE_ERMS                ( 9*32+ 9) /* Enhanced REP MOVSB/STOSB instructions */
 #define X86_FEATURE_INVPCID             ( 9*32+10) /* Invalidate Processor Context ID */
 #define X86_FEATURE_RTM                 ( 9*32+11) /* Restricted Transactional Memory */
 #define X86_FEATURE_CQM                 ( 9*32+12) /* Cache QoS Monitoring */
+#define X86_FEATURE_ZERO_FCS_FDS        ( 9*32+13) /* "" Zero out FPU CS and FPU DS */
 #define X86_FEATURE_MPX                 ( 9*32+14) /* Memory Protection Extension */
 #define X86_FEATURE_RDT_A               ( 9*32+15) /* Resource Director Technology Allocation */
 #define X86_FEATURE_AVX512F             ( 9*32+16) /* AVX-512 Foundation */
@@ -269,13 +271,19 @@
 #define X86_FEATURE_XGETBV1             (10*32+ 2) /* XGETBV with ECX = 1 instruction */
 #define X86_FEATURE_XSAVES              (10*32+ 3) /* XSAVES/XRSTORS instructions */
 
-/* Intel-defined CPU QoS Sub-leaf, CPUID level 0x0000000F:0 (EDX), word 11 */
-#define X86_FEATURE_CQM_LLC             (11*32+ 1) /* LLC QoS if 1 */
+/*
+ * Extended auxiliary flags: Linux defined - for features scattered in various
+ * CPUID levels like 0xf, etc.
+ *
+ * Reuse free bits when adding new feature flags!
+ */
+#define X86_FEATURE_CQM_LLC             (11*32+ 0) /* LLC QoS if 1 */
+#define X86_FEATURE_CQM_OCCUP_LLC       (11*32+ 1) /* LLC occupancy monitoring */
+#define X86_FEATURE_CQM_MBM_TOTAL       (11*32+ 2) /* LLC Total MBM monitoring */
+#define X86_FEATURE_CQM_MBM_LOCAL       (11*32+ 3) /* LLC Local MBM monitoring */
 
-/* Intel-defined CPU QoS Sub-leaf, CPUID level 0x0000000F:1 (EDX), word 12 */
-#define X86_FEATURE_CQM_OCCUP_LLC       (12*32+ 0) /* LLC occupancy monitoring */
-#define X86_FEATURE_CQM_MBM_TOTAL       (12*32+ 1) /* LLC Total MBM monitoring */
-#define X86_FEATURE_CQM_MBM_LOCAL       (12*32+ 2) /* LLC Local MBM monitoring */
+/* Intel-defined CPU features, CPUID level 0x00000007:1 (EAX), word 12 */
+#define X86_FEATURE_AVX512_BF16         (12*32+ 5) /* AVX512 BFLOAT16 instructions */
 
 /* AMD-defined CPU features, CPUID level 0x80000008 (EBX), word 13 */
 #define X86_FEATURE_CLZERO              (13*32+ 0) /* CLZERO instruction */
@@ -322,6 +330,7 @@
 #define X86_FEATURE_UMIP                (16*32+ 2) /* User Mode Instruction Protection */
 #define X86_FEATURE_PKU                 (16*32+ 3) /* Protection Keys for Userspace */
 #define X86_FEATURE_OSPKE               (16*32+ 4) /* OS Protection Keys Enable */
+#define X86_FEATURE_WAITPKG             (16*32+ 5) /* UMONITOR/UMWAIT/TPAUSE Instructions */
 #define X86_FEATURE_AVX512_VBMI2        (16*32+ 6) /* Additional AVX512 Vector Bit Manipulation Instructions */
 #define X86_FEATURE_GFNI                (16*32+ 8) /* Galois Field New Instructions */
 #define X86_FEATURE_VAES                (16*32+ 9) /* Vector AES */
diff --git a/arch/x86/include/asm/fpu/xstate.h b/arch/x86/include/asm/fpu/xstate.h
index 7e42b285c856..c6136d79f8c0 100644
--- a/arch/x86/include/asm/fpu/xstate.h
+++ b/arch/x86/include/asm/fpu/xstate.h
@@ -47,7 +47,6 @@ extern u64 xstate_fx_sw_bytes[USER_XSTATE_FX_SW_WORDS];
 extern void __init update_regset_xstate_info(unsigned int size,
                                              u64 xstate_mask);
 
-void fpu__xstate_clear_all_cpu_caps(void);
 void *get_xsave_addr(struct xregs_state *xsave, int xfeature_nr);
 const void *get_xsave_field_ptr(int xfeature_nr);
 int using_compacted_format(void);
diff --git a/arch/x86/include/asm/hpet.h b/arch/x86/include/asm/hpet.h
index 67385d56d4f4..6352dee37cda 100644
--- a/arch/x86/include/asm/hpet.h
+++ b/arch/x86/include/asm/hpet.h
@@ -75,16 +75,15 @@ extern unsigned int hpet_readl(unsigned int a);
 extern void force_hpet_resume(void);
 
 struct irq_data;
-struct hpet_dev;
+struct hpet_channel;
 struct irq_domain;
 
 extern void hpet_msi_unmask(struct irq_data *data);
 extern void hpet_msi_mask(struct irq_data *data);
-extern void hpet_msi_write(struct hpet_dev *hdev, struct msi_msg *msg);
-extern void hpet_msi_read(struct hpet_dev *hdev, struct msi_msg *msg);
+extern void hpet_msi_write(struct hpet_channel *hc, struct msi_msg *msg);
 extern struct irq_domain *hpet_create_irq_domain(int hpet_id);
 extern int hpet_assign_irq(struct irq_domain *domain,
-                           struct hpet_dev *dev, int dev_num);
+                           struct hpet_channel *hc, int dev_num);
 
 #ifdef CONFIG_HPET_EMULATE_RTC
 
diff --git a/arch/x86/include/asm/hw_irq.h b/arch/x86/include/asm/hw_irq.h
index 32e666e1231e..cbd97e22d2f3 100644
--- a/arch/x86/include/asm/hw_irq.h
+++ b/arch/x86/include/asm/hw_irq.h
@@ -150,8 +150,11 @@ extern char irq_entries_start[];
 #define trace_irq_entries_start irq_entries_start
 #endif
 
+extern char spurious_entries_start[];
+
 #define VECTOR_UNUSED           NULL
-#define VECTOR_RETRIGGERED      ((void *)~0UL)
+#define VECTOR_SHUTDOWN         ((void *)~0UL)
+#define VECTOR_RETRIGGERED      ((void *)~1UL)
 
 typedef struct irq_desc* vector_irq_t[NR_VECTORS];
 DECLARE_PER_CPU(vector_irq_t, vector_irq);
diff --git a/arch/x86/include/asm/hyperv-tlfs.h b/arch/x86/include/asm/hyperv-tlfs.h
index cdf44aa9a501..af78cd72b8f3 100644
--- a/arch/x86/include/asm/hyperv-tlfs.h
+++ b/arch/x86/include/asm/hyperv-tlfs.h
@@ -401,6 +401,12 @@ enum HV_GENERIC_SET_FORMAT {
 #define HV_STATUS_INVALID_CONNECTION_ID         18
 #define HV_STATUS_INSUFFICIENT_BUFFERS          19
 
+/*
+ * The Hyper-V TimeRefCount register and the TSC
+ * page provide a guest VM clock with 100ns tick rate
+ */
+#define HV_CLOCK_HZ (NSEC_PER_SEC/100)
+
 typedef struct _HV_REFERENCE_TSC_PAGE {
         __u32 tsc_sequence;
         __u32 res1;
diff --git a/arch/x86/include/asm/intel-family.h b/arch/x86/include/asm/intel-family.h
index 310118805f57..0278aa66ef62 100644
--- a/arch/x86/include/asm/intel-family.h
+++ b/arch/x86/include/asm/intel-family.h
@@ -56,6 +56,7 @@
 #define INTEL_FAM6_ICELAKE_XEON_D       0x6C
 #define INTEL_FAM6_ICELAKE_DESKTOP      0x7D
 #define INTEL_FAM6_ICELAKE_MOBILE       0x7E
+#define INTEL_FAM6_ICELAKE_NNPI         0x9D
 
 /* "Small Core" Processors (Atom) */
 
@@ -76,6 +77,7 @@
 #define INTEL_FAM6_ATOM_GOLDMONT        0x5C /* Apollo Lake */
 #define INTEL_FAM6_ATOM_GOLDMONT_X      0x5F /* Denverton */
 #define INTEL_FAM6_ATOM_GOLDMONT_PLUS   0x7A /* Gemini Lake */
+
 #define INTEL_FAM6_ATOM_TREMONT_X       0x86 /* Jacobsville */
 
 /* Xeon Phi */
diff --git a/arch/x86/include/asm/irq_regs.h b/arch/x86/include/asm/irq_regs.h
index 8f3bee821e6c..187ce59aea28 100644
--- a/arch/x86/include/asm/irq_regs.h
+++ b/arch/x86/include/asm/irq_regs.h
@@ -16,7 +16,7 @@ DECLARE_PER_CPU(struct pt_regs *, irq_regs);
 
 static inline struct pt_regs *get_irq_regs(void)
 {
-        return this_cpu_read(irq_regs);
+        return __this_cpu_read(irq_regs);
 }
 
 static inline struct pt_regs *set_irq_regs(struct pt_regs *new_regs)
@@ -24,7 +24,7 @@ static inline struct pt_regs *set_irq_regs(struct pt_regs *new_regs)
         struct pt_regs *old_regs;
 
         old_regs = get_irq_regs();
-        this_cpu_write(irq_regs, new_regs);
+        __this_cpu_write(irq_regs, new_regs);
 
         return old_regs;
 }
diff --git a/arch/x86/include/asm/jump_label.h b/arch/x86/include/asm/jump_label.h
index 65191ce8e1cf..06c3cc22a058 100644
--- a/arch/x86/include/asm/jump_label.h
+++ b/arch/x86/include/asm/jump_label.h
@@ -2,6 +2,8 @@
 #ifndef _ASM_X86_JUMP_LABEL_H
 #define _ASM_X86_JUMP_LABEL_H
 
+#define HAVE_JUMP_LABEL_BATCH
+
 #define JUMP_LABEL_NOP_SIZE 5
 
 #ifdef CONFIG_X86_64
diff --git a/arch/x86/include/asm/mshyperv.h b/arch/x86/include/asm/mshyperv.h
index cc60e617931c..f4fa8a9d5d0b 100644
--- a/arch/x86/include/asm/mshyperv.h
+++ b/arch/x86/include/asm/mshyperv.h
@@ -105,6 +105,17 @@ static inline void vmbus_signal_eom(struct hv_message *msg, u32 old_msg_type)
 #define hv_get_crash_ctl(val) \
         rdmsrl(HV_X64_MSR_CRASH_CTL, val)
 
+#define hv_get_time_ref_count(val) \
+        rdmsrl(HV_X64_MSR_TIME_REF_COUNT, val)
+
+#define hv_get_reference_tsc(val) \
+        rdmsrl(HV_X64_MSR_REFERENCE_TSC, val)
+#define hv_set_reference_tsc(val) \
+        wrmsrl(HV_X64_MSR_REFERENCE_TSC, val)
+#define hv_set_clocksource_vdso(val) \
+        ((val).archdata.vclock_mode = VCLOCK_HVCLOCK)
+#define hv_get_raw_timer() rdtsc_ordered()
+
 void hyperv_callback_vector(void);
 void hyperv_reenlightenment_vector(void);
 #ifdef CONFIG_TRACING
@@ -133,7 +144,6 @@ static inline void hv_disable_stimer0_percpu_irq(int irq) {}
 
 
 #if IS_ENABLED(CONFIG_HYPERV)
-extern struct clocksource *hyperv_cs;
 extern void *hv_hypercall_pg;
 extern void  __percpu  **hyperv_pcpu_input_arg;
 
@@ -387,73 +397,4 @@ static inline int hyperv_flush_guest_mapping_range(u64 as,
 }
 #endif /* CONFIG_HYPERV */
 
-#ifdef CONFIG_HYPERV_TSCPAGE
-struct ms_hyperv_tsc_page *hv_get_tsc_page(void);
-static inline u64 hv_read_tsc_page_tsc(const struct ms_hyperv_tsc_page *tsc_pg,
-                                       u64 *cur_tsc)
-{
-        u64 scale, offset;
-        u32 sequence;
-
-        /*
-         * The protocol for reading Hyper-V TSC page is specified in Hypervisor
-         * Top-Level Functional Specification ver. 3.0 and above. To get the
-         * reference time we must do the following:
-         * - READ ReferenceTscSequence
-         *   A special '0' value indicates the time source is unreliable and we
-         *   need to use something else. The currently published specification
-         *   versions (up to 4.0b) contain a mistake and wrongly claim '-1'
-         *   instead of '0' as the special value, see commit c35b82ef0294.
-         * - ReferenceTime =
-         *        ((RDTSC() * ReferenceTscScale) >> 64) + ReferenceTscOffset
-         * - READ ReferenceTscSequence again. In case its value has changed
-         *   since our first reading we need to discard ReferenceTime and repeat
-         *   the whole sequence as the hypervisor was updating the page in
-         *   between.
-         */
-        do {
-                sequence = READ_ONCE(tsc_pg->tsc_sequence);
-                if (!sequence)
-                        return U64_MAX;
-                /*
-                 * Make sure we read sequence before we read other values from
-                 * TSC page.
-                 */
-                smp_rmb();
-
-                scale = READ_ONCE(tsc_pg->tsc_scale);
-                offset = READ_ONCE(tsc_pg->tsc_offset);
-                *cur_tsc = rdtsc_ordered();
-
-                /*
-                 * Make sure we read sequence after we read all other values
-                 * from TSC page.
-                 */
-                smp_rmb();
-
-        } while (READ_ONCE(tsc_pg->tsc_sequence) != sequence);
-
-        return mul_u64_u64_shr(*cur_tsc, scale, 64) + offset;
-}
-
-static inline u64 hv_read_tsc_page(const struct ms_hyperv_tsc_page *tsc_pg)
-{
-        u64 cur_tsc;
-
-        return hv_read_tsc_page_tsc(tsc_pg, &cur_tsc);
-}
-
-#else
-static inline struct ms_hyperv_tsc_page *hv_get_tsc_page(void)
-{
-        return NULL;
-}
-
-static inline u64 hv_read_tsc_page_tsc(const struct ms_hyperv_tsc_page *tsc_pg,
-                                       u64 *cur_tsc)
-{
-        BUG();
-        return U64_MAX;
-}
-#endif
 #endif
diff --git a/arch/x86/include/asm/msr-index.h b/arch/x86/include/asm/msr-index.h
index 979ef971cc78..6b4fc2788078 100644
--- a/arch/x86/include/asm/msr-index.h
+++ b/arch/x86/include/asm/msr-index.h
@@ -61,6 +61,15 @@
 #define MSR_PLATFORM_INFO_CPUID_FAULT_BIT       31
 #define MSR_PLATFORM_INFO_CPUID_FAULT           BIT_ULL(MSR_PLATFORM_INFO_CPUID_FAULT_BIT)
 
+#define MSR_IA32_UMWAIT_CONTROL                 0xe1
+#define MSR_IA32_UMWAIT_CONTROL_C02_DISABLE     BIT(0)
+#define MSR_IA32_UMWAIT_CONTROL_RESERVED        BIT(1)
+/*
+ * The time field is bit[31:2], but representing a 32bit value with
+ * bit[1:0] zero.
+ */
+#define MSR_IA32_UMWAIT_CONTROL_TIME_MASK       (~0x03U)
+
 #define MSR_PKG_CST_CONFIG_CONTROL      0x000000e2
 #define NHM_C3_AUTO_DEMOTE              (1UL << 25)
 #define NHM_C1_AUTO_DEMOTE              (1UL << 26)
diff --git a/arch/x86/include/asm/mwait.h b/arch/x86/include/asm/mwait.h
index eb0f80ce8524..e28f8b723b5c 100644
--- a/arch/x86/include/asm/mwait.h
+++ b/arch/x86/include/asm/mwait.h
@@ -86,9 +86,9 @@ static inline void __mwaitx(unsigned long eax, unsigned long ebx,
 
 static inline void __sti_mwait(unsigned long eax, unsigned long ecx)
 {
-        mds_idle_clear_cpu_buffers();
-
         trace_hardirqs_on();
+
+        mds_idle_clear_cpu_buffers();
         /* "mwait %eax, %ecx;" */
         asm volatile("sti; .byte 0x0f, 0x01, 0xc9;"
                      :: "a" (eax), "c" (ecx));
diff --git a/arch/x86/include/asm/percpu.h b/arch/x86/include/asm/percpu.h
index 1a19d11cfbbd..2278797c769d 100644
--- a/arch/x86/include/asm/percpu.h
+++ b/arch/x86/include/asm/percpu.h
@@ -87,7 +87,7 @@
  * don't give an lvalue though). */
 extern void __bad_percpu_size(void);
 
-#define percpu_to_op(op, var, val)                      \
+#define percpu_to_op(qual, op, var, val)                \
 do {                                                    \
         typedef typeof(var) pto_T__;                    \
         if (0) {                                        \
@@ -97,22 +97,22 @@ do {							\
         }                                               \
         switch (sizeof(var)) {                          \
         case 1:                                         \
-                asm(op "b %1,"__percpu_arg(0)           \
+                asm qual (op "b %1,"__percpu_arg(0)     \
                     : "+m" (var)                        \
                     : "qi" ((pto_T__)(val)));           \
                 break;                                  \
         case 2:                                         \
-                asm(op "w %1,"__percpu_arg(0)           \
+                asm qual (op "w %1,"__percpu_arg(0)     \
                     : "+m" (var)                        \
                     : "ri" ((pto_T__)(val)));           \
                 break;                                  \
         case 4:                                         \
-                asm(op "l %1,"__percpu_arg(0)           \
+                asm qual (op "l %1,"__percpu_arg(0)     \
                     : "+m" (var)                        \
                     : "ri" ((pto_T__)(val)));           \
                 break;                                  \
         case 8:                                         \
-                asm(op "q %1,"__percpu_arg(0)           \
+                asm qual (op "q %1,"__percpu_arg(0)     \
                     : "+m" (var)                        \
                     : "re" ((pto_T__)(val)));           \
                 break;                                  \
@@ -124,7 +124,7 @@ do {							\
  * Generate a percpu add to memory instruction and optimize code
  * if one is added or subtracted.
  */
-#define percpu_add_op(var, val)                                         \
+#define percpu_add_op(qual, var, val)                                   \
 do {                                                                    \
         typedef typeof(var) pao_T__;                                    \
         const int pao_ID__ = (__builtin_constant_p(val) &&              \
@@ -138,41 +138,41 @@ do {									\
         switch (sizeof(var)) {                                          \
         case 1:                                                         \
                 if (pao_ID__ == 1)                                      \
-                        asm("incb "__percpu_arg(0) : "+m" (var));       \
+                        asm qual ("incb "__percpu_arg(0) : "+m" (var)); \
                 else if (pao_ID__ == -1)                                \
-                        asm("decb "__percpu_arg(0) : "+m" (var));       \
+                        asm qual ("decb "__percpu_arg(0) : "+m" (var)); \
                 else                                                    \
-                        asm("addb %1, "__percpu_arg(0)                  \
+                        asm qual ("addb %1, "__percpu_arg(0)            \
                             : "+m" (var)                                \
                             : "qi" ((pao_T__)(val)));                   \
                 break;                                                  \
         case 2:                                                         \
                 if (pao_ID__ == 1)                                      \
-                        asm("incw "__percpu_arg(0) : "+m" (var));       \
+                        asm qual ("incw "__percpu_arg(0) : "+m" (var)); \
                 else if (pao_ID__ == -1)                                \
-                        asm("decw "__percpu_arg(0) : "+m" (var));       \
+                        asm qual ("decw "__percpu_arg(0) : "+m" (var)); \
                 else                                                    \
-                        asm("addw %1, "__percpu_arg(0)                  \
+                        asm qual ("addw %1, "__percpu_arg(0)            \
                             : "+m" (var)                                \
                             : "ri" ((pao_T__)(val)));                   \
                 break;                                                  \
         case 4:                                                         \
                 if (pao_ID__ == 1)                                      \
-                        asm("incl "__percpu_arg(0) : "+m" (var));       \
+                        asm qual ("incl "__percpu_arg(0) : "+m" (var)); \
                 else if (pao_ID__ == -1)                                \
-                        asm("decl "__percpu_arg(0) : "+m" (var));       \
+                        asm qual ("decl "__percpu_arg(0) : "+m" (var)); \
                 else                                                    \
-                        asm("addl %1, "__percpu_arg(0)                  \
+                        asm qual ("addl %1, "__percpu_arg(0)            \
                             : "+m" (var)                                \
                             : "ri" ((pao_T__)(val)));                   \
                 break;                                                  \
         case 8:                                                         \
                 if (pao_ID__ == 1)                                      \
-                        asm("incq "__percpu_arg(0) : "+m" (var));       \
+                        asm qual ("incq "__percpu_arg(0) : "+m" (var)); \
                 else if (pao_ID__ == -1)                                \
-                        asm("decq "__percpu_arg(0) : "+m" (var));       \
+                        asm qual ("decq "__percpu_arg(0) : "+m" (var)); \
                 else                                                    \
-                        asm("addq %1, "__percpu_arg(0)                  \
+                        asm qual ("addq %1, "__percpu_arg(0)            \
                             : "+m" (var)                                \
                             : "re" ((pao_T__)(val)));                   \
                 break;                                                  \
@@ -180,27 +180,27 @@ do {									\
         }                                                               \
 } while (0)
 
-#define percpu_from_op(op, var)                         \
+#define percpu_from_op(qual, op, var)                   \
 ({                                                      \
         typeof(var) pfo_ret__;                          \
         switch (sizeof(var)) {                          \
         case 1:                                         \
-                asm volatile(op "b "__percpu_arg(1)",%0"\
+                asm qual (op "b "__percpu_arg(1)",%0"   \
                     : "=q" (pfo_ret__)                  \
                     : "m" (var));                       \
                 break;                                  \
         case 2:                                         \
-                asm volatile(op "w "__percpu_arg(1)",%0"\
+                asm qual (op "w "__percpu_arg(1)",%0"   \
                     : "=r" (pfo_ret__)                  \
                     : "m" (var));                       \
                 break;                                  \
         case 4:                                         \
-                asm volatile(op "l "__percpu_arg(1)",%0"\
+                asm qual (op "l "__percpu_arg(1)",%0"   \
                     : "=r" (pfo_ret__)                  \
                     : "m" (var));                       \
                 break;                                  \
         case 8:                                         \
-                asm volatile(op "q "__percpu_arg(1)",%0"\
+                asm qual (op "q "__percpu_arg(1)",%0"   \
                     : "=r" (pfo_ret__)                  \
                     : "m" (var));                       \
                 break;                                  \
@@ -238,23 +238,23 @@ do {									\
         pfo_ret__;                                      \
 })
 
-#define percpu_unary_op(op, var)                        \
+#define percpu_unary_op(qual, op, var)                  \
 ({                                                      \
         switch (sizeof(var)) {                          \
         case 1:                                         \
-                asm(op "b "__percpu_arg(0)              \
+                asm qual (op "b "__percpu_arg(0)        \
                     : "+m" (var));                      \
                 break;                                  \
         case 2:                                         \
-                asm(op "w "__percpu_arg(0)              \
+                asm qual (op "w "__percpu_arg(0)        \
                     : "+m" (var));                      \
                 break;                                  \
         case 4:                                         \
-                asm(op "l "__percpu_arg(0)              \
+                asm qual (op "l "__percpu_arg(0)        \
                     : "+m" (var));                      \
                 break;                                  \
         case 8:                                         \
-                asm(op "q "__percpu_arg(0)              \
+                asm qual (op "q "__percpu_arg(0)        \
                     : "+m" (var));                      \
                 break;                                  \
         default: __bad_percpu_size();                   \
@@ -264,27 +264,27 @@ do {									\
 /*
  * Add return operation
  */
-#define percpu_add_return_op(var, val)                                  \
+#define percpu_add_return_op(qual, var, val)                            \
 ({                                                                      \
         typeof(var) paro_ret__ = val;                                   \
         switch (sizeof(var)) {                                          \
         case 1:                                                         \
-                asm("xaddb %0, "__percpu_arg(1)                         \
+                asm qual ("xaddb %0, "__percpu_arg(1)                   \
                             : "+q" (paro_ret__), "+m" (var)             \
                             : : "memory");                              \
                 break;                                                  \
         case 2:                                                         \
-                asm("xaddw %0, "__percpu_arg(1)                         \
+                asm qual ("xaddw %0, "__percpu_arg(1)                   \
                             : "+r" (paro_ret__), "+m" (var)             \
                             : : "memory");                              \
                 break;                                                  \
         case 4:                                                         \
-                asm("xaddl %0, "__percpu_arg(1)                         \
+                asm qual ("xaddl %0, "__percpu_arg(1)                   \
                             : "+r" (paro_ret__), "+m" (var)             \
                             : : "memory");                              \
                 break;                                                  \
         case 8:                                                         \
-                asm("xaddq %0, "__percpu_arg(1)                         \
+                asm qual ("xaddq %0, "__percpu_arg(1)                   \
                             : "+re" (paro_ret__), "+m" (var)            \
                             : : "memory");                              \
                 break;                                                  \
@@ -299,13 +299,13 @@ do {									\
  * expensive due to the implied lock prefix.  The processor cannot prefetch
  * cachelines if xchg is used.
  */
-#define percpu_xchg_op(var, nval)                                       \
+#define percpu_xchg_op(qual, var, nval)                                 \
 ({                                                                      \
         typeof(var) pxo_ret__;                                          \
         typeof(var) pxo_new__ = (nval);                                 \
         switch (sizeof(var)) {                                          \
         case 1:                                                         \
-                asm("\n\tmov "__percpu_arg(1)",%%al"                    \
+                asm qual ("\n\tmov "__percpu_arg(1)",%%al"              \
                     "\n1:\tcmpxchgb %2, "__percpu_arg(1)                \
                     "\n\tjnz 1b"                                        \
                             : "=&a" (pxo_ret__), "+m" (var)             \
@@ -313,7 +313,7 @@ do {									\
                             : "memory");                                \
                 break;                                                  \
         case 2:                                                         \
-                asm("\n\tmov "__percpu_arg(1)",%%ax"                    \
+                asm qual ("\n\tmov "__percpu_arg(1)",%%ax"              \
                     "\n1:\tcmpxchgw %2, "__percpu_arg(1)                \
                     "\n\tjnz 1b"                                        \
                             : "=&a" (pxo_ret__), "+m" (var)             \
@@ -321,7 +321,7 @@ do {									\
                             : "memory");                                \
                 break;                                                  \
         case 4:                                                         \
-                asm("\n\tmov "__percpu_arg(1)",%%eax"                   \
+                asm qual ("\n\tmov "__percpu_arg(1)",%%eax"             \
                     "\n1:\tcmpxchgl %2, "__percpu_arg(1)                \
                     "\n\tjnz 1b"                                        \
                             : "=&a" (pxo_ret__), "+m" (var)             \
@@ -329,7 +329,7 @@ do {									\
                             : "memory");                                \
                 break;                                                  \
         case 8:                                                         \
-                asm("\n\tmov "__percpu_arg(1)",%%rax"                   \
+                asm qual ("\n\tmov "__percpu_arg(1)",%%rax"             \
                     "\n1:\tcmpxchgq %2, "__percpu_arg(1)                \
                     "\n\tjnz 1b"                                        \
                             : "=&a" (pxo_ret__), "+m" (var)             \
@@ -345,32 +345,32 @@ do {									\
  * cmpxchg has no such implied lock semantics as a result it is much
  * more efficient for cpu local operations.
  */
-#define percpu_cmpxchg_op(var, oval, nval)                              \
+#define percpu_cmpxchg_op(qual, var, oval, nval)                        \
 ({                                                                      \
         typeof(var) pco_ret__;                                          \
         typeof(var) pco_old__ = (oval);                                 \
         typeof(var) pco_new__ = (nval);                                 \
         switch (sizeof(var)) {                                          \
         case 1:                                                         \
-                asm("cmpxchgb %2, "__percpu_arg(1)                      \
+                asm qual ("cmpxchgb %2, "__percpu_arg(1)                \
                             : "=a" (pco_ret__), "+m" (var)              \
                             : "q" (pco_new__), "0" (pco_old__)          \
                             : "memory");                                \
                 break;                                                  \
         case 2:                                                         \
-                asm("cmpxchgw %2, "__percpu_arg(1)                      \
+                asm qual ("cmpxchgw %2, "__percpu_arg(1)                \
                             : "=a" (pco_ret__), "+m" (var)              \
                             : "r" (pco_new__), "0" (pco_old__)          \
                             : "memory");                                \
                 break;                                                  \
         case 4:                                                         \
-                asm("cmpxchgl %2, "__percpu_arg(1)                      \
+                asm qual ("cmpxchgl %2, "__percpu_arg(1)                \
                             : "=a" (pco_ret__), "+m" (var)              \
                             : "r" (pco_new__), "0" (pco_old__)          \
                             : "memory");                                \
                 break;                                                  \
         case 8:                                                         \
-                asm("cmpxchgq %2, "__percpu_arg(1)                      \
+                asm qual ("cmpxchgq %2, "__percpu_arg(1)                \
                             : "=a" (pco_ret__), "+m" (var)              \
                             : "r" (pco_new__), "0" (pco_old__)          \
                             : "memory");                                \
@@ -391,58 +391,70 @@ do {									\
  */
 #define this_cpu_read_stable(var)       percpu_stable_op("mov", var)
 
-#define raw_cpu_read_1(pcp)             percpu_from_op("mov", pcp)
-#define raw_cpu_read_2(pcp)             percpu_from_op("mov", pcp)
-#define raw_cpu_read_4(pcp)             percpu_from_op("mov", pcp)
-
-#define raw_cpu_write_1(pcp, val)       percpu_to_op("mov", (pcp), val)
-#define raw_cpu_write_2(pcp, val)       percpu_to_op("mov", (pcp), val)
-#define raw_cpu_write_4(pcp, val)       percpu_to_op("mov", (pcp), val)
-#define raw_cpu_add_1(pcp, val)         percpu_add_op((pcp), val)
-#define raw_cpu_add_2(pcp, val)         percpu_add_op((pcp), val)
-#define raw_cpu_add_4(pcp, val)         percpu_add_op((pcp), val)
-#define raw_cpu_and_1(pcp, val)         percpu_to_op("and", (pcp), val)
-#define raw_cpu_and_2(pcp, val)         percpu_to_op("and", (pcp), val)
-#define raw_cpu_and_4(pcp, val)         percpu_to_op("and", (pcp), val)
-#define raw_cpu_or_1(pcp, val)          percpu_to_op("or", (pcp), val)
-#define raw_cpu_or_2(pcp, val)          percpu_to_op("or", (pcp), val)
-#define raw_cpu_or_4(pcp, val)          percpu_to_op("or", (pcp), val)
-#define raw_cpu_xchg_1(pcp, val)        percpu_xchg_op(pcp, val)
-#define raw_cpu_xchg_2(pcp, val)        percpu_xchg_op(pcp, val)
-#define raw_cpu_xchg_4(pcp, val)        percpu_xchg_op(pcp, val)
-
-#define this_cpu_read_1(pcp)            percpu_from_op("mov", pcp)
-#define this_cpu_read_2(pcp)            percpu_from_op("mov", pcp)
-#define this_cpu_read_4(pcp)            percpu_from_op("mov", pcp)
-#define this_cpu_write_1(pcp, val)      percpu_to_op("mov", (pcp), val)
-#define this_cpu_write_2(pcp, val)      percpu_to_op("mov", (pcp), val)
-#define this_cpu_write_4(pcp, val)      percpu_to_op("mov", (pcp), val)
-#define this_cpu_add_1(pcp, val)        percpu_add_op((pcp), val)
-#define this_cpu_add_2(pcp, val)        percpu_add_op((pcp), val)
-#define this_cpu_add_4(pcp, val)        percpu_add_op((pcp), val)
-#define this_cpu_and_1(pcp, val)        percpu_to_op("and", (pcp), val)
-#define this_cpu_and_2(pcp, val)        percpu_to_op("and", (pcp), val)
-#define this_cpu_and_4(pcp, val)        percpu_to_op("and", (pcp), val)
-#define this_cpu_or_1(pcp, val)         percpu_to_op("or", (pcp), val)
-#define this_cpu_or_2(pcp, val)         percpu_to_op("or", (pcp), val)
-#define this_cpu_or_4(pcp, val)         percpu_to_op("or", (pcp), val)
-#define this_cpu_xchg_1(pcp, nval)      percpu_xchg_op(pcp, nval)
-#define this_cpu_xchg_2(pcp, nval)      percpu_xchg_op(pcp, nval)
-#define this_cpu_xchg_4(pcp, nval)      percpu_xchg_op(pcp, nval)
-
-#define raw_cpu_add_return_1(pcp, val)          percpu_add_return_op(pcp, val)
-#define raw_cpu_add_return_2(pcp, val)          percpu_add_return_op(pcp, val)
-#define raw_cpu_add_return_4(pcp, val)          percpu_add_return_op(pcp, val)
-#define raw_cpu_cmpxchg_1(pcp, oval, nval)      percpu_cmpxchg_op(pcp, oval, nval)
-#define raw_cpu_cmpxchg_2(pcp, oval, nval)      percpu_cmpxchg_op(pcp, oval, nval)
-#define raw_cpu_cmpxchg_4(pcp, oval, nval)      percpu_cmpxchg_op(pcp, oval, nval)
-
-#define this_cpu_add_return_1(pcp, val)         percpu_add_return_op(pcp, val)
-#define this_cpu_add_return_2(pcp, val)         percpu_add_return_op(pcp, val)
-#define this_cpu_add_return_4(pcp, val)         percpu_add_return_op(pcp, val)
-#define this_cpu_cmpxchg_1(pcp, oval, nval)     percpu_cmpxchg_op(pcp, oval, nval)
-#define this_cpu_cmpxchg_2(pcp, oval, nval)     percpu_cmpxchg_op(pcp, oval, nval)
-#define this_cpu_cmpxchg_4(pcp, oval, nval)     percpu_cmpxchg_op(pcp, oval, nval)
+#define raw_cpu_read_1(pcp)             percpu_from_op(, "mov", pcp)
+#define raw_cpu_read_2(pcp)             percpu_from_op(, "mov", pcp)
+#define raw_cpu_read_4(pcp)             percpu_from_op(, "mov", pcp)
+
+#define raw_cpu_write_1(pcp, val)       percpu_to_op(, "mov", (pcp), val)
+#define raw_cpu_write_2(pcp, val)       percpu_to_op(, "mov", (pcp), val)
+#define raw_cpu_write_4(pcp, val)       percpu_to_op(, "mov", (pcp), val)
+#define raw_cpu_add_1(pcp, val)         percpu_add_op(, (pcp), val)
+#define raw_cpu_add_2(pcp, val)         percpu_add_op(, (pcp), val)
+#define raw_cpu_add_4(pcp, val)         percpu_add_op(, (pcp), val)
+#define raw_cpu_and_1(pcp, val)         percpu_to_op(, "and", (pcp), val)
+#define raw_cpu_and_2(pcp, val)         percpu_to_op(, "and", (pcp), val)
+#define raw_cpu_and_4(pcp, val)         percpu_to_op(, "and", (pcp), val)
+#define raw_cpu_or_1(pcp, val)          percpu_to_op(, "or", (pcp), val)
+#define raw_cpu_or_2(pcp, val)          percpu_to_op(, "or", (pcp), val)
+#define raw_cpu_or_4(pcp, val)          percpu_to_op(, "or", (pcp), val)
+
+/*
+ * raw_cpu_xchg() can use a load-store since it is not required to be
+ * IRQ-safe.
+ */
+#define raw_percpu_xchg_op(var, nval)                                   \
+({                                                                      \
+        typeof(var) pxo_ret__ = raw_cpu_read(var);                      \
+        raw_cpu_write(var, (nval));                                     \
+        pxo_ret__;                                                      \
+})
+
+#define raw_cpu_xchg_1(pcp, val)        raw_percpu_xchg_op(pcp, val)
+#define raw_cpu_xchg_2(pcp, val)        raw_percpu_xchg_op(pcp, val)
+#define raw_cpu_xchg_4(pcp, val)        raw_percpu_xchg_op(pcp, val)
+
+#define this_cpu_read_1(pcp)            percpu_from_op(volatile, "mov", pcp)
+#define this_cpu_read_2(pcp)            percpu_from_op(volatile, "mov", pcp)
+#define this_cpu_read_4(pcp)            percpu_from_op(volatile, "mov", pcp)
+#define this_cpu_write_1(pcp, val)      percpu_to_op(volatile, "mov", (pcp), val)
+#define this_cpu_write_2(pcp, val)      percpu_to_op(volatile, "mov", (pcp), val)
+#define this_cpu_write_4(pcp, val)      percpu_to_op(volatile, "mov", (pcp), val)
+#define this_cpu_add_1(pcp, val)        percpu_add_op(volatile, (pcp), val)
+#define this_cpu_add_2(pcp, val)        percpu_add_op(volatile, (pcp), val)
+#define this_cpu_add_4(pcp, val)        percpu_add_op(volatile, (pcp), val)
+#define this_cpu_and_1(pcp, val)        percpu_to_op(volatile, "and", (pcp), val)
+#define this_cpu_and_2(pcp, val)        percpu_to_op(volatile, "and", (pcp), val)
+#define this_cpu_and_4(pcp, val)        percpu_to_op(volatile, "and", (pcp), val)
+#define this_cpu_or_1(pcp, val)         percpu_to_op(volatile, "or", (pcp), val)
+#define this_cpu_or_2(pcp, val)         percpu_to_op(volatile, "or", (pcp), val)
+#define this_cpu_or_4(pcp, val)         percpu_to_op(volatile, "or", (pcp), val)
+#define this_cpu_xchg_1(pcp, nval)      percpu_xchg_op(volatile, pcp, nval)
+#define this_cpu_xchg_2(pcp, nval)      percpu_xchg_op(volatile, pcp, nval)
+#define this_cpu_xchg_4(pcp, nval)      percpu_xchg_op(volatile, pcp, nval)
+
+#define raw_cpu_add_return_1(pcp, val)          percpu_add_return_op(, pcp, val)
+#define raw_cpu_add_return_2(pcp, val)          percpu_add_return_op(, pcp, val)
+#define raw_cpu_add_return_4(pcp, val)          percpu_add_return_op(, pcp, val)
+#define raw_cpu_cmpxchg_1(pcp, oval, nval)      percpu_cmpxchg_op(, pcp, oval, nval)
+#define raw_cpu_cmpxchg_2(pcp, oval, nval)      percpu_cmpxchg_op(, pcp, oval, nval)
+#define raw_cpu_cmpxchg_4(pcp, oval, nval)      percpu_cmpxchg_op(, pcp, oval, nval)
+
+#define this_cpu_add_return_1(pcp, val)         percpu_add_return_op(volatile, pcp, val)
+#define this_cpu_add_return_2(pcp, val)         percpu_add_return_op(volatile, pcp, val)
+#define this_cpu_add_return_4(pcp, val)         percpu_add_return_op(volatile, pcp, val)
+#define this_cpu_cmpxchg_1(pcp, oval, nval)     percpu_cmpxchg_op(volatile, pcp, oval, nval)
+#define this_cpu_cmpxchg_2(pcp, oval, nval)     percpu_cmpxchg_op(volatile, pcp, oval, nval)
+#define this_cpu_cmpxchg_4(pcp, oval, nval)     percpu_cmpxchg_op(volatile, pcp, oval, nval)
 
 #ifdef CONFIG_X86_CMPXCHG64
 #define percpu_cmpxchg8b_double(pcp1, pcp2, o1, o2, n1, n2)             \
@@ -466,23 +478,23 @@ do {									\
  * 32 bit must fall back to generic operations.
  */
 #ifdef CONFIG_X86_64
-#define raw_cpu_read_8(pcp)                     percpu_from_op("mov", pcp)
-#define raw_cpu_write_8(pcp, val)               percpu_to_op("mov", (pcp), val)
-#define raw_cpu_add_8(pcp, val)                 percpu_add_op((pcp), val)
-#define raw_cpu_and_8(pcp, val)                 percpu_to_op("and", (pcp), val)
-#define raw_cpu_or_8(pcp, val)                  percpu_to_op("or", (pcp), val)
-#define raw_cpu_add_return_8(pcp, val)          percpu_add_return_op(pcp, val)
-#define raw_cpu_xchg_8(pcp, nval)               percpu_xchg_op(pcp, nval)
-#define raw_cpu_cmpxchg_8(pcp, oval, nval)      percpu_cmpxchg_op(pcp, oval, nval)
-
-#define this_cpu_read_8(pcp)                    percpu_from_op("mov", pcp)
-#define this_cpu_write_8(pcp, val)              percpu_to_op("mov", (pcp), val)
-#define this_cpu_add_8(pcp, val)                percpu_add_op((pcp), val)
-#define this_cpu_and_8(pcp, val)                percpu_to_op("and", (pcp), val)
-#define this_cpu_or_8(pcp, val)                 percpu_to_op("or", (pcp), val)
-#define this_cpu_add_return_8(pcp, val)         percpu_add_return_op(pcp, val)
-#define this_cpu_xchg_8(pcp, nval)              percpu_xchg_op(pcp, nval)
-#define this_cpu_cmpxchg_8(pcp, oval, nval)     percpu_cmpxchg_op(pcp, oval, nval)
+#define raw_cpu_read_8(pcp)                     percpu_from_op(, "mov", pcp)
+#define raw_cpu_write_8(pcp, val)               percpu_to_op(, "mov", (pcp), val)
+#define raw_cpu_add_8(pcp, val)                 percpu_add_op(, (pcp), val)
+#define raw_cpu_and_8(pcp, val)                 percpu_to_op(, "and", (pcp), val)
+#define raw_cpu_or_8(pcp, val)                  percpu_to_op(, "or", (pcp), val)
+#define raw_cpu_add_return_8(pcp, val)          percpu_add_return_op(, pcp, val)
+#define raw_cpu_xchg_8(pcp, nval)               raw_percpu_xchg_op(pcp, nval)
+#define raw_cpu_cmpxchg_8(pcp, oval, nval)      percpu_cmpxchg_op(, pcp, oval, nval)
+
+#define this_cpu_read_8(pcp)                    percpu_from_op(volatile, "mov", pcp)
+#define this_cpu_write_8(pcp, val)              percpu_to_op(volatile, "mov", (pcp), val)
+#define this_cpu_add_8(pcp, val)                percpu_add_op(volatile, (pcp), val)
+#define this_cpu_and_8(pcp, val)                percpu_to_op(volatile, "and", (pcp), val)
+#define this_cpu_or_8(pcp, val)                 percpu_to_op(volatile, "or", (pcp), val)
+#define this_cpu_add_return_8(pcp, val)         percpu_add_return_op(volatile, pcp, val)
+#define this_cpu_xchg_8(pcp, nval)              percpu_xchg_op(volatile, pcp, nval)
+#define this_cpu_cmpxchg_8(pcp, oval, nval)     percpu_cmpxchg_op(volatile, pcp, oval, nval)
 
 /*
  * Pretty complex macro to generate cmpxchg16 instruction.  The instruction
diff --git a/arch/x86/include/asm/processor.h b/arch/x86/include/asm/processor.h
index c34a35c78618..e57d2ca2ed87 100644
--- a/arch/x86/include/asm/processor.h
+++ b/arch/x86/include/asm/processor.h
@@ -144,7 +144,8 @@ enum cpuid_regs_idx {
 #define X86_VENDOR_TRANSMETA    7
 #define X86_VENDOR_NSC          8
 #define X86_VENDOR_HYGON        9
-#define X86_VENDOR_NUM          10
+#define X86_VENDOR_ZHAOXIN      10
+#define X86_VENDOR_NUM          11
 
 #define X86_VENDOR_UNKNOWN      0xff
 
diff --git a/arch/x86/include/asm/pvclock.h b/arch/x86/include/asm/pvclock.h
index b6033680d458..19b695ff2c68 100644
--- a/arch/x86/include/asm/pvclock.h
+++ b/arch/x86/include/asm/pvclock.h
@@ -2,7 +2,7 @@
 #ifndef _ASM_X86_PVCLOCK_H
 #define _ASM_X86_PVCLOCK_H
 
-#include <linux/clocksource.h>
+#include <asm/clocksource.h>
 #include <asm/pvclock-abi.h>
 
 /* some helper functions for xen and kvm pv clock sources */
diff --git a/arch/x86/include/asm/smp.h b/arch/x86/include/asm/smp.h
index da545df207b2..0d3fe060a44f 100644
--- a/arch/x86/include/asm/smp.h
+++ b/arch/x86/include/asm/smp.h
@@ -162,7 +162,8 @@ __visible void smp_call_function_single_interrupt(struct pt_regs *r);
  * from the initial startup. We map APIC_BASE very early in page_setup(),
  * so this is correct in the x86 case.
  */
-#define raw_smp_processor_id() (this_cpu_read(cpu_number))
+#define raw_smp_processor_id()  this_cpu_read(cpu_number)
+#define __smp_processor_id() __this_cpu_read(cpu_number)
 
 #ifdef CONFIG_X86_32
 extern int safe_smp_processor_id(void);
diff --git a/arch/x86/include/asm/text-patching.h b/arch/x86/include/asm/text-patching.h
index 880b5515b1d6..d83e9f771d86 100644
--- a/arch/x86/include/asm/text-patching.h
+++ b/arch/x86/include/asm/text-patching.h
@@ -18,6 +18,20 @@ static inline void apply_paravirt(struct paravirt_patch_site *start,
 #define __parainstructions_end  NULL
 #endif
 
+/*
+ * Currently, the max observed size in the kernel code is
+ * JUMP_LABEL_NOP_SIZE/RELATIVEJUMP_SIZE, which are 5.
+ * Raise it if needed.
+ */
+#define POKE_MAX_OPCODE_SIZE    5
+
+struct text_poke_loc {
+        void *detour;
+        void *addr;
+        size_t len;
+        const char opcode[POKE_MAX_OPCODE_SIZE];
+};
+
 extern void text_poke_early(void *addr, const void *opcode, size_t len);
 
 /*
@@ -38,6 +52,7 @@ extern void *text_poke(void *addr, const void *opcode, size_t len);
 extern void *text_poke_kgdb(void *addr, const void *opcode, size_t len);
 extern int poke_int3_handler(struct pt_regs *regs);
 extern void text_poke_bp(void *addr, const void *opcode, size_t len, void *handler);
+extern void text_poke_bp_batch(struct text_poke_loc *tp, unsigned int nr_entries);
 extern int after_bootmem;
 extern __ro_after_init struct mm_struct *poking_mm;
 extern __ro_after_init unsigned long poking_addr;
diff --git a/arch/x86/include/asm/time.h b/arch/x86/include/asm/time.h
index cef818b16045..8ac563abb567 100644
--- a/arch/x86/include/asm/time.h
+++ b/arch/x86/include/asm/time.h
@@ -7,6 +7,7 @@
 
 extern void hpet_time_init(void);
 extern void time_init(void);
+extern bool pit_timer_init(void);
 
 extern struct clock_event_device *global_clock_event;
 
diff --git a/arch/x86/include/asm/vdso/gettimeofday.h b/arch/x86/include/asm/vdso/gettimeofday.h
new file mode 100644
index 000000000000..ae91429129a6
--- /dev/null
+++ b/arch/x86/include/asm/vdso/gettimeofday.h
@@ -0,0 +1,261 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+/*
+ * Fast user context implementation of clock_gettime, gettimeofday, and time.
+ *
+ * Copyright (C) 2019 ARM Limited.
+ * Copyright 2006 Andi Kleen, SUSE Labs.
+ * 32 Bit compat layer by Stefani Seibold <stefani@seibold.net>
+ *  sponsored by Rohde & Schwarz GmbH & Co. KG Munich/Germany
+ */
+#ifndef __ASM_VDSO_GETTIMEOFDAY_H
+#define __ASM_VDSO_GETTIMEOFDAY_H
+
+#ifndef __ASSEMBLY__
+
+#include <uapi/linux/time.h>
+#include <asm/vgtod.h>
+#include <asm/vvar.h>
+#include <asm/unistd.h>
+#include <asm/msr.h>
+#include <asm/pvclock.h>
+#include <clocksource/hyperv_timer.h>
+
+#define __vdso_data (VVAR(_vdso_data))
+
+#define VDSO_HAS_TIME 1
+
+#define VDSO_HAS_CLOCK_GETRES 1
+
+/*
+ * Declare the memory-mapped vclock data pages.  These come from hypervisors.
+ * If we ever reintroduce something like direct access to an MMIO clock like
+ * the HPET again, it will go here as well.
+ *
+ * A load from any of these pages will segfault if the clock in question is
+ * disabled, so appropriate compiler barriers and checks need to be used
+ * to prevent stray loads.
+ *
+ * These declarations MUST NOT be const.  The compiler will assume that
+ * an extern const variable has genuinely constant contents, and the
+ * resulting code won't work, since the whole point is that these pages
+ * change over time, possibly while we're accessing them.
+ */
+
+#ifdef CONFIG_PARAVIRT_CLOCK
+/*
+ * This is the vCPU 0 pvclock page.  We only use pvclock from the vDSO
+ * if the hypervisor tells us that all vCPUs can get valid data from the
+ * vCPU 0 page.
+ */
+extern struct pvclock_vsyscall_time_info pvclock_page
+        __attribute__((visibility("hidden")));
+#endif
+
+#ifdef CONFIG_HYPERV_TSCPAGE
+extern struct ms_hyperv_tsc_page hvclock_page
+        __attribute__((visibility("hidden")));
+#endif
+
+#ifndef BUILD_VDSO32
+
+static __always_inline
+long clock_gettime_fallback(clockid_t _clkid, struct __kernel_timespec *_ts)
+{
+        long ret;
+
+        asm ("syscall" : "=a" (ret), "=m" (*_ts) :
+             "0" (__NR_clock_gettime), "D" (_clkid), "S" (_ts) :
+             "rcx", "r11");
+
+        return ret;
+}
+
+static __always_inline
+long gettimeofday_fallback(struct __kernel_old_timeval *_tv,
+                           struct timezone *_tz)
+{
+        long ret;
+
+        asm("syscall" : "=a" (ret) :
+            "0" (__NR_gettimeofday), "D" (_tv), "S" (_tz) : "memory");
+
+        return ret;
+}
+
+static __always_inline
+long clock_getres_fallback(clockid_t _clkid, struct __kernel_timespec *_ts)
+{
+        long ret;
+
+        asm ("syscall" : "=a" (ret), "=m" (*_ts) :
+             "0" (__NR_clock_getres), "D" (_clkid), "S" (_ts) :
+             "rcx", "r11");
+
+        return ret;
+}
+
+#else
+
+static __always_inline
+long clock_gettime_fallback(clockid_t _clkid, struct __kernel_timespec *_ts)
+{
+        long ret;
+
+        asm (
+                "mov %%ebx, %%edx \n"
+                "mov %[clock], %%ebx \n"
+                "call __kernel_vsyscall \n"
+                "mov %%edx, %%ebx \n"
+                : "=a" (ret), "=m" (*_ts)
+                : "0" (__NR_clock_gettime64), [clock] "g" (_clkid), "c" (_ts)
+                : "edx");
+
+        return ret;
+}
+
+static __always_inline
+long gettimeofday_fallback(struct __kernel_old_timeval *_tv,
+                           struct timezone *_tz)
+{
+        long ret;
+
+        asm(
+                "mov %%ebx, %%edx \n"
+                "mov %2, %%ebx \n"
+                "call __kernel_vsyscall \n"
+                "mov %%edx, %%ebx \n"
+                : "=a" (ret)
+                : "0" (__NR_gettimeofday), "g" (_tv), "c" (_tz)
+                : "memory", "edx");
+
+        return ret;
+}
+
+static __always_inline long
+clock_getres_fallback(clockid_t _clkid, struct __kernel_timespec *_ts)
+{
+        long ret;
+
+        asm (
+                "mov %%ebx, %%edx \n"
+                "mov %[clock], %%ebx \n"
+                "call __kernel_vsyscall \n"
+                "mov %%edx, %%ebx \n"
+                : "=a" (ret), "=m" (*_ts)
+                : "0" (__NR_clock_getres_time64), [clock] "g" (_clkid), "c" (_ts)
+                : "edx");
+
+        return ret;
+}
+
+#endif
+
+#ifdef CONFIG_PARAVIRT_CLOCK
+static u64 vread_pvclock(void)
+{
+        const struct pvclock_vcpu_time_info *pvti = &pvclock_page.pvti;
+        u32 version;
+        u64 ret;
+
+        /*
+         * Note: The kernel and hypervisor must guarantee that cpu ID
+         * number maps 1:1 to per-CPU pvclock time info.
+         *
+         * Because the hypervisor is entirely unaware of guest userspace
+         * preemption, it cannot guarantee that per-CPU pvclock time
+         * info is updated if the underlying CPU changes or that that
+         * version is increased whenever underlying CPU changes.
+         *
+         * On KVM, we are guaranteed that pvti updates for any vCPU are
+         * atomic as seen by *all* vCPUs.  This is an even stronger
+         * guarantee than we get with a normal seqlock.
+         *
+         * On Xen, we don't appear to have that guarantee, but Xen still
+         * supplies a valid seqlock using the version field.
+         *
+         * We only do pvclock vdso timing at all if
+         * PVCLOCK_TSC_STABLE_BIT is set, and we interpret that bit to
+         * mean that all vCPUs have matching pvti and that the TSC is
+         * synced, so we can just look at vCPU 0's pvti.
+         */
+
+        do {
+                version = pvclock_read_begin(pvti);
+
+                if (unlikely(!(pvti->flags & PVCLOCK_TSC_STABLE_BIT)))
+                        return U64_MAX;
+
+                ret = __pvclock_read_cycles(pvti, rdtsc_ordered());
+        } while (pvclock_read_retry(pvti, version));
+
+        return ret;
+}
+#endif
+
+#ifdef CONFIG_HYPERV_TSCPAGE
+static u64 vread_hvclock(void)
+{
+        return hv_read_tsc_page(&hvclock_page);
+}
+#endif
+
+static inline u64 __arch_get_hw_counter(s32 clock_mode)
+{
+        if (clock_mode == VCLOCK_TSC)
+                return (u64)rdtsc_ordered();
+        /*
+         * For any memory-mapped vclock type, we need to make sure that gcc
+         * doesn't cleverly hoist a load before the mode check.  Otherwise we
+         * might end up touching the memory-mapped page even if the vclock in
+         * question isn't enabled, which will segfault.  Hence the barriers.
+         */
+#ifdef CONFIG_PARAVIRT_CLOCK
+        if (clock_mode == VCLOCK_PVCLOCK) {
+                barrier();
+                return vread_pvclock();
+        }
+#endif
+#ifdef CONFIG_HYPERV_TSCPAGE
+        if (clock_mode == VCLOCK_HVCLOCK) {
+                barrier();
+                return vread_hvclock();
+        }
+#endif
+        return U64_MAX;
+}
+
+static __always_inline const struct vdso_data *__arch_get_vdso_data(void)
+{
+        return __vdso_data;
+}
+
+/*
+ * x86 specific delta calculation.
+ *
+ * The regular implementation assumes that clocksource reads are globally
+ * monotonic. The TSC can be slightly off across sockets which can cause
+ * the regular delta calculation (@cycles - @last) to return a huge time
+ * jump.
+ *
+ * Therefore it needs to be verified that @cycles are greater than
+ * @last. If not then use @last, which is the base time of the current
+ * conversion period.
+ *
+ * This variant also removes the masking of the subtraction because the
+ * clocksource mask of all VDSO capable clocksources on x86 is U64_MAX
+ * which would result in a pointless operation. The compiler cannot
+ * optimize it away as the mask comes from the vdso data and is not compile
+ * time constant.
+ */
+static __always_inline
+u64 vdso_calc_delta(u64 cycles, u64 last, u64 mask, u32 mult)
+{
+        if (cycles > last)
+                return (cycles - last) * mult;
+        return 0;
+}
+#define vdso_calc_delta vdso_calc_delta
+
+#endif /* !__ASSEMBLY__ */
+
+#endif /* __ASM_VDSO_GETTIMEOFDAY_H */
diff --git a/arch/x86/include/asm/vdso/vsyscall.h b/arch/x86/include/asm/vdso/vsyscall.h
new file mode 100644
index 000000000000..0026ab2123ce
--- /dev/null
+++ b/arch/x86/include/asm/vdso/vsyscall.h
@@ -0,0 +1,44 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+#ifndef __ASM_VDSO_VSYSCALL_H
+#define __ASM_VDSO_VSYSCALL_H
+
+#ifndef __ASSEMBLY__
+
+#include <linux/hrtimer.h>
+#include <linux/timekeeper_internal.h>
+#include <vdso/datapage.h>
+#include <asm/vgtod.h>
+#include <asm/vvar.h>
+
+int vclocks_used __read_mostly;
+
+DEFINE_VVAR(struct vdso_data, _vdso_data);
+/*
+ * Update the vDSO data page to keep in sync with kernel timekeeping.
+ */
+static __always_inline
+struct vdso_data *__x86_get_k_vdso_data(void)
+{
+        return _vdso_data;
+}
+#define __arch_get_k_vdso_data __x86_get_k_vdso_data
+
+static __always_inline
+int __x86_get_clock_mode(struct timekeeper *tk)
+{
+        int vclock_mode = tk->tkr_mono.clock->archdata.vclock_mode;
+
+        /* Mark the new vclock used. */
+        BUILD_BUG_ON(VCLOCK_MAX >= 32);
+        WRITE_ONCE(vclocks_used, READ_ONCE(vclocks_used) | (1 << vclock_mode));
+
+        return vclock_mode;
+}
+#define __arch_get_clock_mode __x86_get_clock_mode
+
+/* The asm-generic header needs to be included after the definitions above */
+#include <asm-generic/vdso/vsyscall.h>
+
+#endif /* !__ASSEMBLY__ */
+
+#endif /* __ASM_VDSO_VSYSCALL_H */
diff --git a/arch/x86/include/asm/vgtod.h b/arch/x86/include/asm/vgtod.h
index 913a133f8e6f..a2638c6124ed 100644
--- a/arch/x86/include/asm/vgtod.h
+++ b/arch/x86/include/asm/vgtod.h
@@ -3,7 +3,9 @@
 #define _ASM_X86_VGTOD_H
 
 #include <linux/compiler.h>
-#include <linux/clocksource.h>
+#include <asm/clocksource.h>
+#include <vdso/datapage.h>
+#include <vdso/helpers.h>
 
 #include <uapi/linux/time.h>
 
@@ -13,81 +15,10 @@ typedef u64 gtod_long_t;
 typedef unsigned long gtod_long_t;
 #endif
 
-/*
- * There is one of these objects in the vvar page for each
- * vDSO-accelerated clockid.  For high-resolution clocks, this encodes
- * the time corresponding to vsyscall_gtod_data.cycle_last.  For coarse
- * clocks, this encodes the actual time.
- *
- * To confuse the reader, for high-resolution clocks, nsec is left-shifted
- * by vsyscall_gtod_data.shift.
- */
-struct vgtod_ts {
-        u64             sec;
-        u64             nsec;
-};
-
-#define VGTOD_BASES     (CLOCK_TAI + 1)
-#define VGTOD_HRES      (BIT(CLOCK_REALTIME) | BIT(CLOCK_MONOTONIC) | BIT(CLOCK_TAI))
-#define VGTOD_COARSE    (BIT(CLOCK_REALTIME_COARSE) | BIT(CLOCK_MONOTONIC_COARSE))
-
-/*
- * vsyscall_gtod_data will be accessed by 32 and 64 bit code at the same time
- * so be carefull by modifying this structure.
- */
-struct vsyscall_gtod_data {
-        unsigned int    seq;
-
-        int             vclock_mode;
-        u64             cycle_last;
-        u64             mask;
-        u32             mult;
-        u32             shift;
-
-        struct vgtod_ts basetime[VGTOD_BASES];
-
-        int             tz_minuteswest;
-        int             tz_dsttime;
-};
-extern struct vsyscall_gtod_data vsyscall_gtod_data;
-
 extern int vclocks_used;
 static inline bool vclock_was_used(int vclock)
 {
         return READ_ONCE(vclocks_used) & (1 << vclock);
 }
 
-static inline unsigned int gtod_read_begin(const struct vsyscall_gtod_data *s)
-{
-        unsigned int ret;
-
-repeat:
-        ret = READ_ONCE(s->seq);
-        if (unlikely(ret & 1)) {
-                cpu_relax();
-                goto repeat;
-        }
-        smp_rmb();
-        return ret;
-}
-
-static inline int gtod_read_retry(const struct vsyscall_gtod_data *s,
-                                  unsigned int start)
-{
-        smp_rmb();
-        return unlikely(s->seq != start);
-}
-
-static inline void gtod_write_begin(struct vsyscall_gtod_data *s)
-{
-        ++s->seq;
-        smp_wmb();
-}
-
-static inline void gtod_write_end(struct vsyscall_gtod_data *s)
-{
-        smp_wmb();
-        ++s->seq;
-}
-
 #endif /* _ASM_X86_VGTOD_H */
diff --git a/arch/x86/include/asm/vsyscall.h b/arch/x86/include/asm/vsyscall.h
index b986b2ca688a..ab60a71a8dcb 100644
--- a/arch/x86/include/asm/vsyscall.h
+++ b/arch/x86/include/asm/vsyscall.h
@@ -13,10 +13,12 @@ extern void set_vsyscall_pgtable_user_bits(pgd_t *root);
  * Called on instruction fetch fault in vsyscall page.
  * Returns true if handled.
  */
-extern bool emulate_vsyscall(struct pt_regs *regs, unsigned long address);
+extern bool emulate_vsyscall(unsigned long error_code,
+                             struct pt_regs *regs, unsigned long address);
 #else
 static inline void map_vsyscall(void) {}
-static inline bool emulate_vsyscall(struct pt_regs *regs, unsigned long address)
+static inline bool emulate_vsyscall(unsigned long error_code,
+                                    struct pt_regs *regs, unsigned long address)
 {
         return false;
 }
diff --git a/arch/x86/include/asm/vvar.h b/arch/x86/include/asm/vvar.h
index e474f5c6e387..32f5d9a0b90e 100644
--- a/arch/x86/include/asm/vvar.h
+++ b/arch/x86/include/asm/vvar.h
@@ -32,19 +32,20 @@
 extern char __vvar_page;
 
 #define DECLARE_VVAR(offset, type, name)                                \
-        extern type vvar_ ## name __attribute__((visibility("hidden")));
+        extern type vvar_ ## name[CS_BASES]                             \
+        __attribute__((visibility("hidden")));
 
 #define VVAR(name) (vvar_ ## name)
 
 #define DEFINE_VVAR(type, name)                                         \
-        type name                                                       \
+        type name[CS_BASES]                                             \
         __attribute__((section(".vvar_" #name), aligned(16))) __visible
 
 #endif
 
 /* DECLARE_VVAR(offset, type, name) */
 
-DECLARE_VVAR(128, struct vsyscall_gtod_data, vsyscall_gtod_data)
+DECLARE_VVAR(128, struct vdso_data, _vdso_data)
 
 #undef DECLARE_VVAR
 
diff --git a/arch/x86/include/uapi/asm/perf_regs.h b/arch/x86/include/uapi/asm/perf_regs.h
index ac67bbea10ca..7c9d2bb3833b 100644
--- a/arch/x86/include/uapi/asm/perf_regs.h
+++ b/arch/x86/include/uapi/asm/perf_regs.h
@@ -52,4 +52,7 @@ enum perf_event_x86_regs {
         /* These include both GPRs and XMMX registers */
         PERF_REG_X86_XMM_MAX = PERF_REG_X86_XMM15 + 2,
 };
+
+#define PERF_REG_EXTENDED_MASK  (~((1ULL << PERF_REG_X86_XMM0) - 1))
+
 #endif /* _ASM_X86_PERF_REGS_H */
diff --git a/arch/x86/kernel/acpi/cstate.c b/arch/x86/kernel/acpi/cstate.c
index a5e5484988fd..caf2edccbad2 100644
--- a/arch/x86/kernel/acpi/cstate.c
+++ b/arch/x86/kernel/acpi/cstate.c
@@ -64,6 +64,21 @@ void acpi_processor_power_init_bm_check(struct acpi_processor_flags *flags,
                     c->x86_stepping >= 0x0e))
                         flags->bm_check = 1;
         }
+
+        if (c->x86_vendor == X86_VENDOR_ZHAOXIN) {
+                /*
+                 * All Zhaoxin CPUs that support C3 share cache.
+                 * And caches should not be flushed by software while
+                 * entering C3 type state.
+                 */
+                flags->bm_check = 1;
+                /*
+                 * On all recent Zhaoxin platforms, ARB_DISABLE is a nop.
+                 * So, set bm_control to zero to indicate that ARB_DISABLE
+                 * is not required while entering C3 type state.
+                 */
+                flags->bm_control = 0;
+        }
 }
 EXPORT_SYMBOL(acpi_processor_power_init_bm_check);
 
diff --git a/arch/x86/kernel/alternative.c b/arch/x86/kernel/alternative.c
index 390596b761e3..bd542f9b0953 100644
--- a/arch/x86/kernel/alternative.c
+++ b/arch/x86/kernel/alternative.c
@@ -14,6 +14,7 @@
 #include <linux/kdebug.h>
 #include <linux/kprobes.h>
 #include <linux/mmu_context.h>
+#include <linux/bsearch.h>
 #include <asm/text-patching.h>
 #include <asm/alternative.h>
 #include <asm/sections.h>
@@ -848,81 +849,133 @@ static void do_sync_core(void *info)
         sync_core();
 }
 
-static bool bp_patching_in_progress;
-static void *bp_int3_handler, *bp_int3_addr;
+static struct bp_patching_desc {
+        struct text_poke_loc *vec;
+        int nr_entries;
+} bp_patching;
+
+static int patch_cmp(const void *key, const void *elt)
+{
+        struct text_poke_loc *tp = (struct text_poke_loc *) elt;
+
+        if (key < tp->addr)
+                return -1;
+        if (key > tp->addr)
+                return 1;
+        return 0;
+}
+NOKPROBE_SYMBOL(patch_cmp);
 
 int poke_int3_handler(struct pt_regs *regs)
 {
+        struct text_poke_loc *tp;
+        unsigned char int3 = 0xcc;
+        void *ip;
+
         /*
          * Having observed our INT3 instruction, we now must observe
-         * bp_patching_in_progress.
+         * bp_patching.nr_entries.
          *
-         *      in_progress = TRUE              INT3
+         *      nr_entries != 0                 INT3
          *      WMB                             RMB
-         *      write INT3                      if (in_progress)
+         *      write INT3                      if (nr_entries)
          *
-         * Idem for bp_int3_handler.
+         * Idem for other elements in bp_patching.
          */
         smp_rmb();
 
-        if (likely(!bp_patching_in_progress))
+        if (likely(!bp_patching.nr_entries))
                 return 0;
 
-        if (user_mode(regs) || regs->ip != (unsigned long)bp_int3_addr)
+        if (user_mode(regs))
                 return 0;
 
-        /* set up the specified breakpoint handler */
-        regs->ip = (unsigned long) bp_int3_handler;
+        /*
+         * Discount the sizeof(int3). See text_poke_bp_batch().
+         */
+        ip = (void *) regs->ip - sizeof(int3);
+
+        /*
+         * Skip the binary search if there is a single member in the vector.
+         */
+        if (unlikely(bp_patching.nr_entries > 1)) {
+                tp = bsearch(ip, bp_patching.vec, bp_patching.nr_entries,
+                             sizeof(struct text_poke_loc),
+                             patch_cmp);
+                if (!tp)
+                        return 0;
+        } else {
+                tp = bp_patching.vec;
+                if (tp->addr != ip)
+                        return 0;
+        }
+
+        /* set up the specified breakpoint detour */
+        regs->ip = (unsigned long) tp->detour;
 
         return 1;
 }
 NOKPROBE_SYMBOL(poke_int3_handler);
 
 /**
- * text_poke_bp() -- update instructions on live kernel on SMP
- * @addr:       address to patch
- * @opcode:     opcode of new instruction
- * @len:        length to copy
- * @handler:    address to jump to when the temporary breakpoint is hit
+ * text_poke_bp_batch() -- update instructions on live kernel on SMP
+ * @tp:                 vector of instructions to patch
+ * @nr_entries:         number of entries in the vector
  *
  * Modify multi-byte instruction by using int3 breakpoint on SMP.
  * We completely avoid stop_machine() here, and achieve the
  * synchronization using int3 breakpoint.
  *
  * The way it is done:
- *      - add a int3 trap to the address that will be patched
+ *      - For each entry in the vector:
+ *              - add a int3 trap to the address that will be patched
  *      - sync cores
- *      - update all but the first byte of the patched range
+ *      - For each entry in the vector:
+ *              - update all but the first byte of the patched range
  *      - sync cores
- *      - replace the first byte (int3) by the first byte of
- *        replacing opcode
+ *      - For each entry in the vector:
+ *              - replace the first byte (int3) by the first byte of
+ *                replacing opcode
  *      - sync cores
  */
-void text_poke_bp(void *addr, const void *opcode, size_t len, void *handler)
+void text_poke_bp_batch(struct text_poke_loc *tp, unsigned int nr_entries)
 {
+        int patched_all_but_first = 0;
         unsigned char int3 = 0xcc;
-
-        bp_int3_handler = handler;
-        bp_int3_addr = (u8 *)addr + sizeof(int3);
-        bp_patching_in_progress = true;
+        unsigned int i;
 
         lockdep_assert_held(&text_mutex);
 
+        bp_patching.vec = tp;
+        bp_patching.nr_entries = nr_entries;
+
         /*
          * Corresponding read barrier in int3 notifier for making sure the
-         * in_progress and handler are correctly ordered wrt. patching.
+         * nr_entries and handler are correctly ordered wrt. patching.
          */
         smp_wmb();
 
-        text_poke(addr, &int3, sizeof(int3));
+        /*
+         * First step: add a int3 trap to the address that will be patched.
+         */
+        for (i = 0; i < nr_entries; i++)
+                text_poke(tp[i].addr, &int3, sizeof(int3));
 
         on_each_cpu(do_sync_core, NULL, 1);
 
-        if (len - sizeof(int3) > 0) {
-                /* patch all but the first byte */
-                text_poke((char *)addr + sizeof(int3),
-                          (const char *) opcode + sizeof(int3),
-                          len - sizeof(int3));
+        /*
+         * Second step: update all but the first byte of the patched range.
+         */
+        for (i = 0; i < nr_entries; i++) {
+                if (tp[i].len - sizeof(int3) > 0) {
+                        text_poke((char *)tp[i].addr + sizeof(int3),
+                                  (const char *)tp[i].opcode + sizeof(int3),
+                                  tp[i].len - sizeof(int3));
+                        patched_all_but_first++;
+                }
+        }
+
+        if (patched_all_but_first) {
                 /*
                  * According to Intel, this core syncing is very likely
                  * not necessary and we'd be safe even without it. But
@@ -931,14 +984,47 @@ void text_poke_bp(void *addr, const void *opcode, size_t len, void *handler)
                 on_each_cpu(do_sync_core, NULL, 1);
         }
 
-        /* patch the first byte */
-        text_poke(addr, opcode, sizeof(int3));
+        /*
+         * Third step: replace the first byte (int3) by the first byte of
+         * replacing opcode.
+         */
+        for (i = 0; i < nr_entries; i++)
+                text_poke(tp[i].addr, tp[i].opcode, sizeof(int3));
 
         on_each_cpu(do_sync_core, NULL, 1);
         /*
          * sync_core() implies an smp_mb() and orders this store against
          * the writing of the new instruction.
          */
-        bp_patching_in_progress = false;
+        bp_patching.vec = NULL;
+        bp_patching.nr_entries = 0;
 }
 
+/**
+ * text_poke_bp() -- update instructions on live kernel on SMP
+ * @addr:       address to patch
+ * @opcode:     opcode of new instruction
+ * @len:        length to copy
+ * @handler:    address to jump to when the temporary breakpoint is hit
+ *
+ * Update a single instruction with the vector in the stack, avoiding
+ * dynamically allocated memory. This function should be used when it is
+ * not possible to allocate memory.
+ */
+void text_poke_bp(void *addr, const void *opcode, size_t len, void *handler)
+{
+        struct text_poke_loc tp = {
+                .detour = handler,
+                .addr = addr,
+                .len = len,
+        };
+
+        if (len > POKE_MAX_OPCODE_SIZE) {
+                WARN_ONCE(1, "len is larger than %d\n", POKE_MAX_OPCODE_SIZE);
+                return;
+        }
+
+        memcpy((void *)tp.opcode, opcode, len);
+
+        text_poke_bp_batch(&tp, 1);
+}
diff --git a/arch/x86/kernel/apic/apic.c b/arch/x86/kernel/apic/apic.c
index 177aa8ef2afa..1bd91cb7b320 100644
--- a/arch/x86/kernel/apic/apic.c
+++ b/arch/x86/kernel/apic/apic.c
@@ -195,7 +195,7 @@ static struct resource lapic_resource = {
         .flags = IORESOURCE_MEM | IORESOURCE_BUSY,
 };
 
-unsigned int lapic_timer_frequency = 0;
+unsigned int lapic_timer_period = 0;
 
 static void apic_pm_activate(void);
 
@@ -501,7 +501,7 @@ lapic_timer_set_periodic_oneshot(struct clock_event_device *evt, bool oneshot)
         if (evt->features & CLOCK_EVT_FEAT_DUMMY)
                 return 0;
 
-        __setup_APIC_LVTT(lapic_timer_frequency, oneshot, 1);
+        __setup_APIC_LVTT(lapic_timer_period, oneshot, 1);
         return 0;
 }
 
@@ -805,11 +805,11 @@ calibrate_by_pmtimer(long deltapm, long *delta, long *deltatsc)
 
 static int __init lapic_init_clockevent(void)
 {
-        if (!lapic_timer_frequency)
+        if (!lapic_timer_period)
                 return -1;
 
         /* Calculate the scaled math multiplication factor */
-        lapic_clockevent.mult = div_sc(lapic_timer_frequency/APIC_DIVISOR,
+        lapic_clockevent.mult = div_sc(lapic_timer_period/APIC_DIVISOR,
                                         TICK_NSEC, lapic_clockevent.shift);
         lapic_clockevent.max_delta_ns =
                 clockevent_delta2ns(0x7FFFFFFF, &lapic_clockevent);
@@ -821,6 +821,33 @@ static int __init lapic_init_clockevent(void)
         return 0;
 }
 
+bool __init apic_needs_pit(void)
+{
+        /*
+         * If the frequencies are not known, PIT is required for both TSC
+         * and apic timer calibration.
+         */
+        if (!tsc_khz || !cpu_khz)
+                return true;
+
+        /* Is there an APIC at all? */
+        if (!boot_cpu_has(X86_FEATURE_APIC))
+                return true;
+
+        /* Deadline timer is based on TSC so no further PIT action required */
+        if (boot_cpu_has(X86_FEATURE_TSC_DEADLINE_TIMER))
+                return false;
+
+        /* APIC timer disabled? */
+        if (disable_apic_timer)
+                return true;
+        /*
+         * The APIC timer frequency is known already, no PIT calibration
+         * required. If unknown, let the PIT be initialized.
+         */
+        return lapic_timer_period == 0;
+}
+
 static int __init calibrate_APIC_clock(void)
 {
         struct clock_event_device *levt = this_cpu_ptr(&lapic_events);
@@ -839,7 +866,7 @@ static int __init calibrate_APIC_clock(void)
          */
         if (!lapic_init_clockevent()) {
                 apic_printk(APIC_VERBOSE, "lapic timer already calibrated %d\n",
-                            lapic_timer_frequency);
+                            lapic_timer_period);
                 /*
                  * Direct calibration methods must have an always running
                  * local APIC timer, no need for broadcast timer.
@@ -884,13 +911,13 @@ static int __init calibrate_APIC_clock(void)
         pm_referenced = !calibrate_by_pmtimer(lapic_cal_pm2 - lapic_cal_pm1,
                                         &delta, &deltatsc);
 
-        lapic_timer_frequency = (delta * APIC_DIVISOR) / LAPIC_CAL_LOOPS;
+        lapic_timer_period = (delta * APIC_DIVISOR) / LAPIC_CAL_LOOPS;
         lapic_init_clockevent();
 
         apic_printk(APIC_VERBOSE, "..... delta %ld\n", delta);
         apic_printk(APIC_VERBOSE, "..... mult: %u\n", lapic_clockevent.mult);
         apic_printk(APIC_VERBOSE, "..... calibration result: %u\n",
-                    lapic_timer_frequency);
+                    lapic_timer_period);
 
         if (boot_cpu_has(X86_FEATURE_TSC)) {
                 apic_printk(APIC_VERBOSE, "..... CPU clock speed is "
@@ -901,13 +928,13 @@ static int __init calibrate_APIC_clock(void)
 
         apic_printk(APIC_VERBOSE, "..... host bus clock speed is "
                     "%u.%04u MHz.\n",
-                    lapic_timer_frequency / (1000000 / HZ),
-                    lapic_timer_frequency % (1000000 / HZ));
+                    lapic_timer_period / (1000000 / HZ),
+                    lapic_timer_period % (1000000 / HZ));
 
         /*
          * Do a sanity check on the APIC calibration result
          */
-        if (lapic_timer_frequency < (1000000 / HZ)) {
+        if (lapic_timer_period < (1000000 / HZ)) {
                 local_irq_enable();
                 pr_warning("APIC frequency too slow, disabling apic timer\n");
                 return -1;
@@ -1351,6 +1378,8 @@ void __init init_bsp_APIC(void)
         apic_write(APIC_LVT1, value);
 }
 
+static void __init apic_bsp_setup(bool upmode);
+
 /* Init the interrupt delivery mode for the BSP */
 void __init apic_intr_mode_init(void)
 {
@@ -1464,7 +1493,8 @@ static void apic_pending_intr_clear(void)
                 if (queued) {
                         if (boot_cpu_has(X86_FEATURE_TSC) && cpu_khz) {
                                 ntsc = rdtsc();
-                                max_loops = (cpu_khz << 10) - (ntsc - tsc);
+                                max_loops = (long long)cpu_khz << 10;
+                                max_loops -= ntsc - tsc;
                         } else {
                                 max_loops--;
                         }
@@ -2040,21 +2070,32 @@ __visible void __irq_entry smp_spurious_interrupt(struct pt_regs *regs)
         entering_irq();
         trace_spurious_apic_entry(vector);
 
+        inc_irq_stat(irq_spurious_count);
+
+        /*
+         * If this is a spurious interrupt then do not acknowledge
+         */
+        if (vector == SPURIOUS_APIC_VECTOR) {
+                /* See SDM vol 3 */
+                pr_info("Spurious APIC interrupt (vector 0xFF) on CPU#%d, should never happen.\n",
+                        smp_processor_id());
+                goto out;
+        }
+
         /*
-         * Check if this really is a spurious interrupt and ACK it
-         * if it is a vectored one.  Just in case...
-         * Spurious interrupts should not be ACKed.
+         * If it is a vectored one, verify it's set in the ISR. If set,
+         * acknowledge it.
          */
         v = apic_read(APIC_ISR + ((vector & ~0x1f) >> 1));
-        if (v & (1 << (vector & 0x1f)))
+        if (v & (1 << (vector & 0x1f))) {
+                pr_info("Spurious interrupt (vector 0x%02x) on CPU#%d. Acked\n",
+                        vector, smp_processor_id());
                 ack_APIC_irq();
-
-        inc_irq_stat(irq_spurious_count);
-
-        /* see sw-dev-man vol 3, chapter 7.4.13.5 */
-        pr_info("spurious APIC interrupt through vector %02x on CPU#%d, "
-                "should never happen.\n", vector, smp_processor_id());
-
+        } else {
+                pr_info("Spurious interrupt (vector 0x%02x) on CPU#%d. Not pending!\n",
+                        vector, smp_processor_id());
+        }
+out:
         trace_spurious_apic_exit(vector);
         exiting_irq();
 }
@@ -2415,11 +2456,8 @@ static void __init apic_bsp_up_setup(void)
 /**
  * apic_bsp_setup - Setup function for local apic and io-apic
  * @upmode:             Force UP mode (for APIC_init_uniprocessor)
- *
- * Returns:
- * apic_id of BSP APIC
  */
-void __init apic_bsp_setup(bool upmode)
+static void __init apic_bsp_setup(bool upmode)
 {
         connect_bsp_APIC();
         if (upmode)
diff --git a/arch/x86/kernel/apic/apic_flat_64.c b/arch/x86/kernel/apic/apic_flat_64.c
index bf083c3f1d73..bbdca603f94a 100644
--- a/arch/x86/kernel/apic/apic_flat_64.c
+++ b/arch/x86/kernel/apic/apic_flat_64.c
@@ -78,7 +78,7 @@ flat_send_IPI_mask_allbutself(const struct cpumask *cpumask, int vector)
         int cpu = smp_processor_id();
 
         if (cpu < BITS_PER_LONG)
-                clear_bit(cpu, &mask);
+                __clear_bit(cpu, &mask);
 
         _flat_send_IPI_mask(mask, vector);
 }
@@ -92,7 +92,7 @@ static void flat_send_IPI_allbutself(int vector)
                         unsigned long mask = cpumask_bits(cpu_online_mask)[0];
 
                         if (cpu < BITS_PER_LONG)
-                                clear_bit(cpu, &mask);
+                                __clear_bit(cpu, &mask);
 
                         _flat_send_IPI_mask(mask, vector);
                 }
diff --git a/arch/x86/kernel/apic/io_apic.c b/arch/x86/kernel/apic/io_apic.c
index 53aa234a6803..c7bb6c69f21c 100644
--- a/arch/x86/kernel/apic/io_apic.c
+++ b/arch/x86/kernel/apic/io_apic.c
@@ -58,6 +58,7 @@
 #include <asm/acpi.h>
 #include <asm/dma.h>
 #include <asm/timer.h>
+#include <asm/time.h>
 #include <asm/i8259.h>
 #include <asm/setup.h>
 #include <asm/irq_remapping.h>
@@ -1893,6 +1894,50 @@ static int ioapic_set_affinity(struct irq_data *irq_data,
         return ret;
 }
 
+/*
+ * Interrupt shutdown masks the ioapic pin, but the interrupt might already
+ * be in flight, but not yet serviced by the target CPU. That means
+ * __synchronize_hardirq() would return and claim that everything is calmed
+ * down. So free_irq() would proceed and deactivate the interrupt and free
+ * resources.
+ *
+ * Once the target CPU comes around to service it it will find a cleared
+ * vector and complain. While the spurious interrupt is harmless, the full
+ * release of resources might prevent the interrupt from being acknowledged
+ * which keeps the hardware in a weird state.
+ *
+ * Verify that the corresponding Remote-IRR bits are clear.
+ */
+static int ioapic_irq_get_chip_state(struct irq_data *irqd,
+                                   enum irqchip_irq_state which,
+                                   bool *state)
+{
+        struct mp_chip_data *mcd = irqd->chip_data;
+        struct IO_APIC_route_entry rentry;
+        struct irq_pin_list *p;
+
+        if (which != IRQCHIP_STATE_ACTIVE)
+                return -EINVAL;
+
+        *state = false;
+        raw_spin_lock(&ioapic_lock);
+        for_each_irq_pin(p, mcd->irq_2_pin) {
+                rentry = __ioapic_read_entry(p->apic, p->pin);
+                /*
+                 * The remote IRR is only valid in level trigger mode. It's
+                 * meaning is undefined for edge triggered interrupts and
+                 * irrelevant because the IO-APIC treats them as fire and
+                 * forget.
+                 */
+                if (rentry.irr && rentry.trigger) {
+                        *state = true;
+                        break;
+                }
+        }
+        raw_spin_unlock(&ioapic_lock);
+        return 0;
+}
+
 static struct irq_chip ioapic_chip __read_mostly = {
         .name                   = "IO-APIC",
         .irq_startup            = startup_ioapic_irq,
@@ -1902,6 +1947,7 @@ static struct irq_chip ioapic_chip __read_mostly = {
         .irq_eoi                = ioapic_ack_level,
         .irq_set_affinity       = ioapic_set_affinity,
         .irq_retrigger          = irq_chip_retrigger_hierarchy,
+        .irq_get_irqchip_state  = ioapic_irq_get_chip_state,
         .flags                  = IRQCHIP_SKIP_SET_WAKE,
 };
 
@@ -1914,6 +1960,7 @@ static struct irq_chip ioapic_ir_chip __read_mostly = {
         .irq_eoi                = ioapic_ir_ack_level,
         .irq_set_affinity       = ioapic_set_affinity,
         .irq_retrigger          = irq_chip_retrigger_hierarchy,
+        .irq_get_irqchip_state  = ioapic_irq_get_chip_state,
         .flags                  = IRQCHIP_SKIP_SET_WAKE,
 };
 
@@ -2083,6 +2130,9 @@ static inline void __init check_timer(void)
         unsigned long flags;
         int no_pin1 = 0;
 
+        if (!global_clock_event)
+                return;
+
         local_irq_save(flags);
 
         /*
diff --git a/arch/x86/kernel/apic/msi.c b/arch/x86/kernel/apic/msi.c
index dad0dd759de2..7f7533462474 100644
--- a/arch/x86/kernel/apic/msi.c
+++ b/arch/x86/kernel/apic/msi.c
@@ -370,14 +370,14 @@ struct irq_domain *hpet_create_irq_domain(int hpet_id)
         return d;
 }
 
-int hpet_assign_irq(struct irq_domain *domain, struct hpet_dev *dev,
+int hpet_assign_irq(struct irq_domain *domain, struct hpet_channel *hc,
                     int dev_num)
 {
         struct irq_alloc_info info;
 
         init_irq_alloc_info(&info, NULL);
         info.type = X86_IRQ_ALLOC_TYPE_HPET;
-        info.hpet_data = dev;
+        info.hpet_data = hc;
         info.hpet_id = hpet_dev_id(domain);
         info.hpet_index = dev_num;
 
diff --git a/arch/x86/kernel/apic/vector.c b/arch/x86/kernel/apic/vector.c
index e7cb78aed644..fdacb864c3dd 100644
--- a/arch/x86/kernel/apic/vector.c
+++ b/arch/x86/kernel/apic/vector.c
@@ -340,7 +340,7 @@ static void clear_irq_vector(struct irq_data *irqd)
         trace_vector_clear(irqd->irq, vector, apicd->cpu, apicd->prev_vector,
                            apicd->prev_cpu);
 
-        per_cpu(vector_irq, apicd->cpu)[vector] = VECTOR_UNUSED;
+        per_cpu(vector_irq, apicd->cpu)[vector] = VECTOR_SHUTDOWN;
         irq_matrix_free(vector_matrix, apicd->cpu, vector, managed);
         apicd->vector = 0;
 
@@ -349,7 +349,7 @@ static void clear_irq_vector(struct irq_data *irqd)
         if (!vector)
                 return;
 
-        per_cpu(vector_irq, apicd->prev_cpu)[vector] = VECTOR_UNUSED;
+        per_cpu(vector_irq, apicd->prev_cpu)[vector] = VECTOR_SHUTDOWN;
         irq_matrix_free(vector_matrix, apicd->prev_cpu, vector, managed);
         apicd->prev_vector = 0;
         apicd->move_in_progress = 0;
diff --git a/arch/x86/kernel/apic/x2apic_cluster.c b/arch/x86/kernel/apic/x2apic_cluster.c
index 7685444a106b..609e499387a1 100644
--- a/arch/x86/kernel/apic/x2apic_cluster.c
+++ b/arch/x86/kernel/apic/x2apic_cluster.c
@@ -50,7 +50,7 @@ __x2apic_send_IPI_mask(const struct cpumask *mask, int vector, int apic_dest)
         cpumask_copy(tmpmsk, mask);
         /* If IPI should not be sent to self, clear current CPU */
         if (apic_dest != APIC_DEST_ALLINC)
-                cpumask_clear_cpu(smp_processor_id(), tmpmsk);
+                __cpumask_clear_cpu(smp_processor_id(), tmpmsk);
 
         /* Collapse cpus in a cluster so a single IPI per cluster is sent */
         for_each_cpu(cpu, tmpmsk) {
diff --git a/arch/x86/kernel/cpu/Makefile b/arch/x86/kernel/cpu/Makefile
index 5102bf7c8192..4b4eb06e117c 100644
--- a/arch/x86/kernel/cpu/Makefile
+++ b/arch/x86/kernel/cpu/Makefile
@@ -24,6 +24,7 @@ obj-y			+= match.o
 obj-y                   += bugs.o
 obj-y                   += aperfmperf.o
 obj-y                   += cpuid-deps.o
+obj-y                   += umwait.o
 
 obj-$(CONFIG_PROC_FS)   += proc.o
 obj-$(CONFIG_X86_FEATURE_NAMES) += capflags.o powerflags.o
@@ -38,6 +39,7 @@ obj-$(CONFIG_CPU_SUP_CYRIX_32)		+= cyrix.o
 obj-$(CONFIG_CPU_SUP_CENTAUR)           += centaur.o
 obj-$(CONFIG_CPU_SUP_TRANSMETA_32)      += transmeta.o
 obj-$(CONFIG_CPU_SUP_UMC_32)            += umc.o
+obj-$(CONFIG_CPU_SUP_ZHAOXIN)           += zhaoxin.o
 
 obj-$(CONFIG_X86_MCE)                   += mce/
 obj-$(CONFIG_MTRR)                      += mtrr/
diff --git a/arch/x86/kernel/cpu/aperfmperf.c b/arch/x86/kernel/cpu/aperfmperf.c
index e71a6ff8a67e..e2f319dc992d 100644
--- a/arch/x86/kernel/cpu/aperfmperf.c
+++ b/arch/x86/kernel/cpu/aperfmperf.c
@@ -13,6 +13,7 @@
 #include <linux/percpu.h>
 #include <linux/cpufreq.h>
 #include <linux/smp.h>
+#include <linux/sched/isolation.h>
 
 #include "cpu.h"
 
@@ -85,6 +86,9 @@ unsigned int aperfmperf_get_khz(int cpu)
         if (!boot_cpu_has(X86_FEATURE_APERFMPERF))
                 return 0;
 
+        if (!housekeeping_cpu(cpu, HK_FLAG_MISC))
+                return 0;
+
         aperfmperf_snapshot_cpu(cpu, ktime_get(), true);
         return per_cpu(samples.khz, cpu);
 }
@@ -101,9 +105,12 @@ void arch_freq_prepare_all(void)
         if (!boot_cpu_has(X86_FEATURE_APERFMPERF))
                 return;
 
-        for_each_online_cpu(cpu)
+        for_each_online_cpu(cpu) {
+                if (!housekeeping_cpu(cpu, HK_FLAG_MISC))
+                        continue;
                 if (!aperfmperf_snapshot_cpu(cpu, now, false))
                         wait = true;
+        }
 
         if (wait)
                 msleep(APERFMPERF_REFRESH_DELAY_MS);
@@ -117,6 +124,9 @@ unsigned int arch_freq_get_on_cpu(int cpu)
         if (!boot_cpu_has(X86_FEATURE_APERFMPERF))
                 return 0;
 
+        if (!housekeeping_cpu(cpu, HK_FLAG_MISC))
+                return 0;
+
         if (aperfmperf_snapshot_cpu(cpu, ktime_get(), true))
                 return per_cpu(samples.khz, cpu);
 
diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c
index 03b4cc0ec3a7..66ca906aa790 100644
--- a/arch/x86/kernel/cpu/bugs.c
+++ b/arch/x86/kernel/cpu/bugs.c
@@ -836,6 +836,16 @@ static enum ssb_mitigation __init __ssb_select_mitigation(void)
         }
 
         /*
+         * If SSBD is controlled by the SPEC_CTRL MSR, then set the proper
+         * bit in the mask to allow guests to use the mitigation even in the
+         * case where the host does not enable it.
+         */
+        if (static_cpu_has(X86_FEATURE_SPEC_CTRL_SSBD) ||
+            static_cpu_has(X86_FEATURE_AMD_SSBD)) {
+                x86_spec_ctrl_mask |= SPEC_CTRL_SSBD;
+        }
+
+        /*
          * We have three CPU feature flags that are in play here:
          *  - X86_BUG_SPEC_STORE_BYPASS - CPU is susceptible.
          *  - X86_FEATURE_SSBD - CPU is able to turn off speculative store bypass
@@ -852,7 +862,6 @@ static enum ssb_mitigation __init __ssb_select_mitigation(void)
                         x86_amd_ssb_disable();
                 } else {
                         x86_spec_ctrl_base |= SPEC_CTRL_SSBD;
-                        x86_spec_ctrl_mask |= SPEC_CTRL_SSBD;
                         wrmsrl(MSR_IA32_SPEC_CTRL, x86_spec_ctrl_base);
                 }
         }
diff --git a/arch/x86/kernel/cpu/cacheinfo.c b/arch/x86/kernel/cpu/cacheinfo.c
index 395d46f78582..c7503be92f35 100644
--- a/arch/x86/kernel/cpu/cacheinfo.c
+++ b/arch/x86/kernel/cpu/cacheinfo.c
@@ -658,8 +658,7 @@ void cacheinfo_amd_init_llc_id(struct cpuinfo_x86 *c, int cpu, u8 node_id)
         if (c->x86 < 0x17) {
                 /* LLC is at the node level. */
                 per_cpu(cpu_llc_id, cpu) = node_id;
-        } else if (c->x86 == 0x17 &&
-                   c->x86_model >= 0 && c->x86_model <= 0x1F) {
+        } else if (c->x86 == 0x17 && c->x86_model <= 0x1F) {
                 /*
                  * LLC is at the core complex level.
                  * Core complex ID is ApicId[3] for these processors.
diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c
index 2c57fffebf9b..dad20bc891d5 100644
--- a/arch/x86/kernel/cpu/common.c
+++ b/arch/x86/kernel/cpu/common.c
@@ -801,6 +801,30 @@ static void init_speculation_control(struct cpuinfo_x86 *c)
         }
 }
 
+static void init_cqm(struct cpuinfo_x86 *c)
+{
+        if (!cpu_has(c, X86_FEATURE_CQM_LLC)) {
+                c->x86_cache_max_rmid  = -1;
+                c->x86_cache_occ_scale = -1;
+                return;
+        }
+
+        /* will be overridden if occupancy monitoring exists */
+        c->x86_cache_max_rmid = cpuid_ebx(0xf);
+
+        if (cpu_has(c, X86_FEATURE_CQM_OCCUP_LLC) ||
+            cpu_has(c, X86_FEATURE_CQM_MBM_TOTAL) ||
+            cpu_has(c, X86_FEATURE_CQM_MBM_LOCAL)) {
+                u32 eax, ebx, ecx, edx;
+
+                /* QoS sub-leaf, EAX=0Fh, ECX=1 */
+                cpuid_count(0xf, 1, &eax, &ebx, &ecx, &edx);
+
+                c->x86_cache_max_rmid  = ecx;
+                c->x86_cache_occ_scale = ebx;
+        }
+}
+
 void get_cpu_cap(struct cpuinfo_x86 *c)
 {
         u32 eax, ebx, ecx, edx;
@@ -823,6 +847,12 @@ void get_cpu_cap(struct cpuinfo_x86 *c)
                 c->x86_capability[CPUID_7_0_EBX] = ebx;
                 c->x86_capability[CPUID_7_ECX] = ecx;
                 c->x86_capability[CPUID_7_EDX] = edx;
+
+                /* Check valid sub-leaf index before accessing it */
+                if (eax >= 1) {
+                        cpuid_count(0x00000007, 1, &eax, &ebx, &ecx, &edx);
+                        c->x86_capability[CPUID_7_1_EAX] = eax;
+                }
         }
 
         /* Extended state features: level 0x0000000d */
@@ -832,33 +862,6 @@ void get_cpu_cap(struct cpuinfo_x86 *c)
                 c->x86_capability[CPUID_D_1_EAX] = eax;
         }
 
-        /* Additional Intel-defined flags: level 0x0000000F */
-        if (c->cpuid_level >= 0x0000000F) {
-
-                /* QoS sub-leaf, EAX=0Fh, ECX=0 */
-                cpuid_count(0x0000000F, 0, &eax, &ebx, &ecx, &edx);
-                c->x86_capability[CPUID_F_0_EDX] = edx;
-
-                if (cpu_has(c, X86_FEATURE_CQM_LLC)) {
-                        /* will be overridden if occupancy monitoring exists */
-                        c->x86_cache_max_rmid = ebx;
-
-                        /* QoS sub-leaf, EAX=0Fh, ECX=1 */
-                        cpuid_count(0x0000000F, 1, &eax, &ebx, &ecx, &edx);
-                        c->x86_capability[CPUID_F_1_EDX] = edx;
-
-                        if ((cpu_has(c, X86_FEATURE_CQM_OCCUP_LLC)) ||
-                              ((cpu_has(c, X86_FEATURE_CQM_MBM_TOTAL)) ||
-                               (cpu_has(c, X86_FEATURE_CQM_MBM_LOCAL)))) {
-                                c->x86_cache_max_rmid = ecx;
-                                c->x86_cache_occ_scale = ebx;
-                        }
-                } else {
-                        c->x86_cache_max_rmid = -1;
-                        c->x86_cache_occ_scale = -1;
-                }
-        }
-
         /* AMD-defined flags: level 0x80000001 */
         eax = cpuid_eax(0x80000000);
         c->extended_cpuid_level = eax;
@@ -889,6 +892,7 @@ void get_cpu_cap(struct cpuinfo_x86 *c)
 
         init_scattered_cpuid_features(c);
         init_speculation_control(c);
+        init_cqm(c);
 
         /*
          * Clear/Set all flags overridden by options, after probe.
diff --git a/arch/x86/kernel/cpu/cpuid-deps.c b/arch/x86/kernel/cpu/cpuid-deps.c
index 2c0bd38a44ab..b5353244749b 100644
--- a/arch/x86/kernel/cpu/cpuid-deps.c
+++ b/arch/x86/kernel/cpu/cpuid-deps.c
@@ -20,6 +20,7 @@ struct cpuid_dep {
  * but it's difficult to tell that to the init reference checker.
  */
 static const struct cpuid_dep cpuid_deps[] = {
+        { X86_FEATURE_FXSR,             X86_FEATURE_FPU       },
         { X86_FEATURE_XSAVEOPT,         X86_FEATURE_XSAVE     },
         { X86_FEATURE_XSAVEC,           X86_FEATURE_XSAVE     },
         { X86_FEATURE_XSAVES,           X86_FEATURE_XSAVE     },
@@ -27,7 +28,11 @@ static const struct cpuid_dep cpuid_deps[] = {
         { X86_FEATURE_PKU,              X86_FEATURE_XSAVE     },
         { X86_FEATURE_MPX,              X86_FEATURE_XSAVE     },
         { X86_FEATURE_XGETBV1,          X86_FEATURE_XSAVE     },
+        { X86_FEATURE_CMOV,             X86_FEATURE_FXSR      },
+        { X86_FEATURE_MMX,              X86_FEATURE_FXSR      },
+        { X86_FEATURE_MMXEXT,           X86_FEATURE_MMX       },
         { X86_FEATURE_FXSR_OPT,         X86_FEATURE_FXSR      },
+        { X86_FEATURE_XSAVE,            X86_FEATURE_FXSR      },
         { X86_FEATURE_XMM,              X86_FEATURE_FXSR      },
         { X86_FEATURE_XMM2,             X86_FEATURE_XMM       },
         { X86_FEATURE_XMM3,             X86_FEATURE_XMM2      },
@@ -59,6 +64,10 @@ static const struct cpuid_dep cpuid_deps[] = {
         { X86_FEATURE_AVX512_4VNNIW,    X86_FEATURE_AVX512F   },
         { X86_FEATURE_AVX512_4FMAPS,    X86_FEATURE_AVX512F   },
         { X86_FEATURE_AVX512_VPOPCNTDQ, X86_FEATURE_AVX512F   },
+        { X86_FEATURE_CQM_OCCUP_LLC,    X86_FEATURE_CQM_LLC   },
+        { X86_FEATURE_CQM_MBM_TOTAL,    X86_FEATURE_CQM_LLC   },
+        { X86_FEATURE_CQM_MBM_LOCAL,    X86_FEATURE_CQM_LLC   },
+        { X86_FEATURE_AVX512_BF16,      X86_FEATURE_AVX512VL  },
         {}
 };
 
diff --git a/arch/x86/kernel/cpu/intel.c b/arch/x86/kernel/cpu/intel.c
index f17c1a714779..8d6d92ebeb54 100644
--- a/arch/x86/kernel/cpu/intel.c
+++ b/arch/x86/kernel/cpu/intel.c
@@ -66,6 +66,32 @@ void check_mpx_erratum(struct cpuinfo_x86 *c)
         }
 }
 
+/*
+ * Processors which have self-snooping capability can handle conflicting
+ * memory type across CPUs by snooping its own cache. However, there exists
+ * CPU models in which having conflicting memory types still leads to
+ * unpredictable behavior, machine check errors, or hangs. Clear this
+ * feature to prevent its use on machines with known erratas.
+ */
+static void check_memory_type_self_snoop_errata(struct cpuinfo_x86 *c)
+{
+        switch (c->x86_model) {
+        case INTEL_FAM6_CORE_YONAH:
+        case INTEL_FAM6_CORE2_MEROM:
+        case INTEL_FAM6_CORE2_MEROM_L:
+        case INTEL_FAM6_CORE2_PENRYN:
+        case INTEL_FAM6_CORE2_DUNNINGTON:
+        case INTEL_FAM6_NEHALEM:
+        case INTEL_FAM6_NEHALEM_G:
+        case INTEL_FAM6_NEHALEM_EP:
+        case INTEL_FAM6_NEHALEM_EX:
+        case INTEL_FAM6_WESTMERE:
+        case INTEL_FAM6_WESTMERE_EP:
+        case INTEL_FAM6_SANDYBRIDGE:
+                setup_clear_cpu_cap(X86_FEATURE_SELFSNOOP);
+        }
+}
+
 static bool ring3mwait_disabled __read_mostly;
 
 static int __init ring3mwait_disable(char *__unused)
@@ -304,6 +330,7 @@ static void early_init_intel(struct cpuinfo_x86 *c)
         }
 
         check_mpx_erratum(c);
+        check_memory_type_self_snoop_errata(c);
 
         /*
          * Get the number of SMT siblings early from the extended topology
diff --git a/arch/x86/kernel/cpu/mce/amd.c b/arch/x86/kernel/cpu/mce/amd.c
index 785050af85e5..6ea7fdc82f3c 100644
--- a/arch/x86/kernel/cpu/mce/amd.c
+++ b/arch/x86/kernel/cpu/mce/amd.c
@@ -99,11 +99,6 @@ static struct smca_bank_name smca_names[] = {
         [SMCA_PCIE]     = { "pcie",             "PCI Express Unit" },
 };
 
-static u32 smca_bank_addrs[MAX_NR_BANKS][NR_BLOCKS] __ro_after_init =
-{
-        [0 ... MAX_NR_BANKS - 1] = { [0 ... NR_BLOCKS - 1] = -1 }
-};
-
 static const char *smca_get_name(enum smca_bank_types t)
 {
         if (t >= N_SMCA_BANK_TYPES)
@@ -197,6 +192,9 @@ static char buf_mcatype[MAX_MCATYPE_NAME_LEN];
 static DEFINE_PER_CPU(struct threshold_bank **, threshold_banks);
 static DEFINE_PER_CPU(unsigned int, bank_map);  /* see which banks are on */
 
+/* Map of banks that have more than MCA_MISC0 available. */
+static DEFINE_PER_CPU(u32, smca_misc_banks_map);
+
 static void amd_threshold_interrupt(void);
 static void amd_deferred_error_interrupt(void);
 
@@ -206,6 +204,28 @@ static void default_deferred_error_interrupt(void)
 }
 void (*deferred_error_int_vector)(void) = default_deferred_error_interrupt;
 
+static void smca_set_misc_banks_map(unsigned int bank, unsigned int cpu)
+{
+        u32 low, high;
+
+        /*
+         * For SMCA enabled processors, BLKPTR field of the first MISC register
+         * (MCx_MISC0) indicates presence of additional MISC regs set (MISC1-4).
+         */
+        if (rdmsr_safe(MSR_AMD64_SMCA_MCx_CONFIG(bank), &low, &high))
+                return;
+
+        if (!(low & MCI_CONFIG_MCAX))
+                return;
+
+        if (rdmsr_safe(MSR_AMD64_SMCA_MCx_MISC(bank), &low, &high))
+                return;
+
+        if (low & MASK_BLKPTR_LO)
+                per_cpu(smca_misc_banks_map, cpu) |= BIT(bank);
+
+}
+
 static void smca_configure(unsigned int bank, unsigned int cpu)
 {
         unsigned int i, hwid_mcatype;
@@ -243,6 +263,8 @@ static void smca_configure(unsigned int bank, unsigned int cpu)
                 wrmsr(smca_config, low, high);
         }
 
+        smca_set_misc_banks_map(bank, cpu);
+
         /* Return early if this bank was already initialized. */
         if (smca_banks[bank].hwid)
                 return;
@@ -453,50 +475,29 @@ static void deferred_error_interrupt_enable(struct cpuinfo_x86 *c)
         wrmsr(MSR_CU_DEF_ERR, low, high);
 }
 
-static u32 smca_get_block_address(unsigned int bank, unsigned int block)
+static u32 smca_get_block_address(unsigned int bank, unsigned int block,
+                                  unsigned int cpu)
 {
-        u32 low, high;
-        u32 addr = 0;
-
-        if (smca_get_bank_type(bank) == SMCA_RESERVED)
-                return addr;
-
         if (!block)
                 return MSR_AMD64_SMCA_MCx_MISC(bank);
 
-        /* Check our cache first: */
-        if (smca_bank_addrs[bank][block] != -1)
-                return smca_bank_addrs[bank][block];
-
-        /*
-         * For SMCA enabled processors, BLKPTR field of the first MISC register
-         * (MCx_MISC0) indicates presence of additional MISC regs set (MISC1-4).
-         */
-        if (rdmsr_safe(MSR_AMD64_SMCA_MCx_CONFIG(bank), &low, &high))
-                goto out;
-
-        if (!(low & MCI_CONFIG_MCAX))
-                goto out;
-
-        if (!rdmsr_safe(MSR_AMD64_SMCA_MCx_MISC(bank), &low, &high) &&
-            (low & MASK_BLKPTR_LO))
-                addr = MSR_AMD64_SMCA_MCx_MISCy(bank, block - 1);
+        if (!(per_cpu(smca_misc_banks_map, cpu) & BIT(bank)))
+                return 0;
 
-out:
-        smca_bank_addrs[bank][block] = addr;
-        return addr;
+        return MSR_AMD64_SMCA_MCx_MISCy(bank, block - 1);
 }
 
 static u32 get_block_address(u32 current_addr, u32 low, u32 high,
-                             unsigned int bank, unsigned int block)
+                             unsigned int bank, unsigned int block,
+                             unsigned int cpu)
 {
         u32 addr = 0, offset = 0;
 
-        if ((bank >= mca_cfg.banks) || (block >= NR_BLOCKS))
+        if ((bank >= per_cpu(mce_num_banks, cpu)) || (block >= NR_BLOCKS))
                 return addr;
 
         if (mce_flags.smca)
-                return smca_get_block_address(bank, block);
+                return smca_get_block_address(bank, block, cpu);
 
         /* Fall back to method we used for older processors: */
         switch (block) {
@@ -624,18 +625,19 @@ void disable_err_thresholding(struct cpuinfo_x86 *c, unsigned int bank)
 /* cpu init entry point, called from mce.c with preempt off */
 void mce_amd_feature_init(struct cpuinfo_x86 *c)
 {
-        u32 low = 0, high = 0, address = 0;
         unsigned int bank, block, cpu = smp_processor_id();
+        u32 low = 0, high = 0, address = 0;
         int offset = -1;
 
-        for (bank = 0; bank < mca_cfg.banks; ++bank) {
+
+        for (bank = 0; bank < this_cpu_read(mce_num_banks); ++bank) {
                 if (mce_flags.smca)
                         smca_configure(bank, cpu);
 
                 disable_err_thresholding(c, bank);
 
                 for (block = 0; block < NR_BLOCKS; ++block) {
-                        address = get_block_address(address, low, high, bank, block);
+                        address = get_block_address(address, low, high, bank, block, cpu);
                         if (!address)
                                 break;
 
@@ -973,7 +975,7 @@ static void amd_deferred_error_interrupt(void)
 {
         unsigned int bank;
 
-        for (bank = 0; bank < mca_cfg.banks; ++bank)
+        for (bank = 0; bank < this_cpu_read(mce_num_banks); ++bank)
                 log_error_deferred(bank);
 }
 
@@ -1014,7 +1016,7 @@ static void amd_threshold_interrupt(void)
         struct threshold_block *first_block = NULL, *block = NULL, *tmp = NULL;
         unsigned int bank, cpu = smp_processor_id();
 
-        for (bank = 0; bank < mca_cfg.banks; ++bank) {
+        for (bank = 0; bank < this_cpu_read(mce_num_banks); ++bank) {
                 if (!(per_cpu(bank_map, cpu) & (1 << bank)))
                         continue;
 
@@ -1201,7 +1203,7 @@ static int allocate_threshold_blocks(unsigned int cpu, unsigned int bank,
         u32 low, high;
         int err;
 
-        if ((bank >= mca_cfg.banks) || (block >= NR_BLOCKS))
+        if ((bank >= per_cpu(mce_num_banks, cpu)) || (block >= NR_BLOCKS))
                 return 0;
 
         if (rdmsr_safe_on_cpu(cpu, address, &low, &high))
@@ -1252,7 +1254,7 @@ static int allocate_threshold_blocks(unsigned int cpu, unsigned int bank,
         if (err)
                 goto out_free;
 recurse:
-        address = get_block_address(address, low, high, bank, ++block);
+        address = get_block_address(address, low, high, bank, ++block, cpu);
         if (!address)
                 return 0;
 
@@ -1435,7 +1437,7 @@ int mce_threshold_remove_device(unsigned int cpu)
 {
         unsigned int bank;
 
-        for (bank = 0; bank < mca_cfg.banks; ++bank) {
+        for (bank = 0; bank < per_cpu(mce_num_banks, cpu); ++bank) {
                 if (!(per_cpu(bank_map, cpu) & (1 << bank)))
                         continue;
                 threshold_remove_bank(cpu, bank);
@@ -1456,14 +1458,14 @@ int mce_threshold_create_device(unsigned int cpu)
         if (bp)
                 return 0;
 
-        bp = kcalloc(mca_cfg.banks, sizeof(struct threshold_bank *),
+        bp = kcalloc(per_cpu(mce_num_banks, cpu), sizeof(struct threshold_bank *),
                      GFP_KERNEL);
         if (!bp)
                 return -ENOMEM;
 
         per_cpu(threshold_banks, cpu) = bp;
 
-        for (bank = 0; bank < mca_cfg.banks; ++bank) {
+        for (bank = 0; bank < per_cpu(mce_num_banks, cpu); ++bank) {
                 if (!(per_cpu(bank_map, cpu) & (1 << bank)))
                         continue;
                 err = threshold_create_bank(cpu, bank);
diff --git a/arch/x86/kernel/cpu/mce/core.c b/arch/x86/kernel/cpu/mce/core.c
index 282916f3b8d8..066562a1ea20 100644
--- a/arch/x86/kernel/cpu/mce/core.c
+++ b/arch/x86/kernel/cpu/mce/core.c
@@ -65,7 +65,23 @@ static DEFINE_MUTEX(mce_sysfs_mutex);
 
 DEFINE_PER_CPU(unsigned, mce_exception_count);
 
-struct mce_bank *mce_banks __read_mostly;
+DEFINE_PER_CPU_READ_MOSTLY(unsigned int, mce_num_banks);
+
+struct mce_bank {
+        u64                     ctl;                    /* subevents to enable */
+        bool                    init;                   /* initialise bank? */
+};
+static DEFINE_PER_CPU_READ_MOSTLY(struct mce_bank[MAX_NR_BANKS], mce_banks_array);
+
+#define ATTR_LEN               16
+/* One object for each MCE bank, shared by all CPUs */
+struct mce_bank_dev {
+        struct device_attribute attr;                   /* device attribute */
+        char                    attrname[ATTR_LEN];     /* attribute name */
+        u8                      bank;                   /* bank number */
+};
+static struct mce_bank_dev mce_bank_devs[MAX_NR_BANKS];
+
 struct mce_vendor_flags mce_flags __read_mostly;
 
 struct mca_config mca_cfg __read_mostly = {
@@ -675,6 +691,7 @@ DEFINE_PER_CPU(unsigned, mce_poll_count);
  */
 bool machine_check_poll(enum mcp_flags flags, mce_banks_t *b)
 {
+        struct mce_bank *mce_banks = this_cpu_ptr(mce_banks_array);
         bool error_seen = false;
         struct mce m;
         int i;
@@ -686,7 +703,7 @@ bool machine_check_poll(enum mcp_flags flags, mce_banks_t *b)
         if (flags & MCP_TIMESTAMP)
                 m.tsc = rdtsc();
 
-        for (i = 0; i < mca_cfg.banks; i++) {
+        for (i = 0; i < this_cpu_read(mce_num_banks); i++) {
                 if (!mce_banks[i].ctl || !test_bit(i, *b))
                         continue;
 
@@ -788,7 +805,7 @@ static int mce_no_way_out(struct mce *m, char **msg, unsigned long *validp,
         char *tmp;
         int i;
 
-        for (i = 0; i < mca_cfg.banks; i++) {
+        for (i = 0; i < this_cpu_read(mce_num_banks); i++) {
                 m->status = mce_rdmsrl(msr_ops.status(i));
                 if (!(m->status & MCI_STATUS_VAL))
                         continue;
@@ -1068,7 +1085,7 @@ static void mce_clear_state(unsigned long *toclear)
 {
         int i;
 
-        for (i = 0; i < mca_cfg.banks; i++) {
+        for (i = 0; i < this_cpu_read(mce_num_banks); i++) {
                 if (test_bit(i, toclear))
                         mce_wrmsrl(msr_ops.status(i), 0);
         }
@@ -1122,10 +1139,11 @@ static void __mc_scan_banks(struct mce *m, struct mce *final,
                             unsigned long *toclear, unsigned long *valid_banks,
                             int no_way_out, int *worst)
 {
+        struct mce_bank *mce_banks = this_cpu_ptr(mce_banks_array);
         struct mca_config *cfg = &mca_cfg;
         int severity, i;
 
-        for (i = 0; i < cfg->banks; i++) {
+        for (i = 0; i < this_cpu_read(mce_num_banks); i++) {
                 __clear_bit(i, toclear);
                 if (!test_bit(i, valid_banks))
                         continue;
@@ -1463,27 +1481,29 @@ int mce_notify_irq(void)
 }
 EXPORT_SYMBOL_GPL(mce_notify_irq);
 
-static int __mcheck_cpu_mce_banks_init(void)
+static void __mcheck_cpu_mce_banks_init(void)
 {
+        struct mce_bank *mce_banks = this_cpu_ptr(mce_banks_array);
+        u8 n_banks = this_cpu_read(mce_num_banks);
         int i;
 
-        mce_banks = kcalloc(MAX_NR_BANKS, sizeof(struct mce_bank), GFP_KERNEL);
-        if (!mce_banks)
-                return -ENOMEM;
-
-        for (i = 0; i < MAX_NR_BANKS; i++) {
+        for (i = 0; i < n_banks; i++) {
                 struct mce_bank *b = &mce_banks[i];
 
+                /*
+                 * Init them all, __mcheck_cpu_apply_quirks() is going to apply
+                 * the required vendor quirks before
+                 * __mcheck_cpu_init_clear_banks() does the final bank setup.
+                 */
                 b->ctl = -1ULL;
                 b->init = 1;
         }
-        return 0;
 }
 
 /*
  * Initialize Machine Checks for a CPU.
  */
-static int __mcheck_cpu_cap_init(void)
+static void __mcheck_cpu_cap_init(void)
 {
         u64 cap;
         u8 b;
@@ -1491,16 +1511,16 @@ static int __mcheck_cpu_cap_init(void)
         rdmsrl(MSR_IA32_MCG_CAP, cap);
 
         b = cap & MCG_BANKCNT_MASK;
-        if (WARN_ON_ONCE(b > MAX_NR_BANKS))
+
+        if (b > MAX_NR_BANKS) {
+                pr_warn("CPU%d: Using only %u machine check banks out of %u\n",
+                        smp_processor_id(), MAX_NR_BANKS, b);
                 b = MAX_NR_BANKS;
+        }
 
-        mca_cfg.banks = max(mca_cfg.banks, b);
+        this_cpu_write(mce_num_banks, b);
 
-        if (!mce_banks) {
-                int err = __mcheck_cpu_mce_banks_init();
-                if (err)
-                        return err;
-        }
+        __mcheck_cpu_mce_banks_init();
 
         /* Use accurate RIP reporting if available. */
         if ((cap & MCG_EXT_P) && MCG_EXT_CNT(cap) >= 9)
@@ -1508,8 +1528,6 @@ static int __mcheck_cpu_cap_init(void)
 
         if (cap & MCG_SER_P)
                 mca_cfg.ser = 1;
-
-        return 0;
 }
 
 static void __mcheck_cpu_init_generic(void)
@@ -1536,9 +1554,10 @@ static void __mcheck_cpu_init_generic(void)
 
 static void __mcheck_cpu_init_clear_banks(void)
 {
+        struct mce_bank *mce_banks = this_cpu_ptr(mce_banks_array);
         int i;
 
-        for (i = 0; i < mca_cfg.banks; i++) {
+        for (i = 0; i < this_cpu_read(mce_num_banks); i++) {
                 struct mce_bank *b = &mce_banks[i];
 
                 if (!b->init)
@@ -1549,6 +1568,33 @@ static void __mcheck_cpu_init_clear_banks(void)
 }
 
 /*
+ * Do a final check to see if there are any unused/RAZ banks.
+ *
+ * This must be done after the banks have been initialized and any quirks have
+ * been applied.
+ *
+ * Do not call this from any user-initiated flows, e.g. CPU hotplug or sysfs.
+ * Otherwise, a user who disables a bank will not be able to re-enable it
+ * without a system reboot.
+ */
+static void __mcheck_cpu_check_banks(void)
+{
+        struct mce_bank *mce_banks = this_cpu_ptr(mce_banks_array);
+        u64 msrval;
+        int i;
+
+        for (i = 0; i < this_cpu_read(mce_num_banks); i++) {
+                struct mce_bank *b = &mce_banks[i];
+
+                if (!b->init)
+                        continue;
+
+                rdmsrl(msr_ops.ctl(i), msrval);
+                b->init = !!msrval;
+        }
+}
+
+/*
  * During IFU recovery Sandy Bridge -EP4S processors set the RIPV and
  * EIPV bits in MCG_STATUS to zero on the affected logical processor (SDM
  * Vol 3B Table 15-20). But this confuses both the code that determines
@@ -1579,6 +1625,7 @@ static void quirk_sandybridge_ifu(int bank, struct mce *m, struct pt_regs *regs)
 /* Add per CPU specific workarounds here */
 static int __mcheck_cpu_apply_quirks(struct cpuinfo_x86 *c)
 {
+        struct mce_bank *mce_banks = this_cpu_ptr(mce_banks_array);
         struct mca_config *cfg = &mca_cfg;
 
         if (c->x86_vendor == X86_VENDOR_UNKNOWN) {
@@ -1588,7 +1635,7 @@ static int __mcheck_cpu_apply_quirks(struct cpuinfo_x86 *c)
 
         /* This should be disabled by the BIOS, but isn't always */
         if (c->x86_vendor == X86_VENDOR_AMD) {
-                if (c->x86 == 15 && cfg->banks > 4) {
+                if (c->x86 == 15 && this_cpu_read(mce_num_banks) > 4) {
                         /*
                          * disable GART TBL walk error reporting, which
                          * trips off incorrectly with the IOMMU & 3ware
@@ -1607,7 +1654,7 @@ static int __mcheck_cpu_apply_quirks(struct cpuinfo_x86 *c)
                  * Various K7s with broken bank 0 around. Always disable
                  * by default.
                  */
-                if (c->x86 == 6 && cfg->banks > 0)
+                if (c->x86 == 6 && this_cpu_read(mce_num_banks) > 0)
                         mce_banks[0].ctl = 0;
 
                 /*
@@ -1629,7 +1676,7 @@ static int __mcheck_cpu_apply_quirks(struct cpuinfo_x86 *c)
                  * valid event later, merely don't write CTL0.
                  */
 
-                if (c->x86 == 6 && c->x86_model < 0x1A && cfg->banks > 0)
+                if (c->x86 == 6 && c->x86_model < 0x1A && this_cpu_read(mce_num_banks) > 0)
                         mce_banks[0].init = 0;
 
                 /*
@@ -1815,7 +1862,9 @@ void mcheck_cpu_init(struct cpuinfo_x86 *c)
         if (!mce_available(c))
                 return;
 
-        if (__mcheck_cpu_cap_init() < 0 || __mcheck_cpu_apply_quirks(c) < 0) {
+        __mcheck_cpu_cap_init();
+
+        if (__mcheck_cpu_apply_quirks(c) < 0) {
                 mca_cfg.disabled = 1;
                 return;
         }
@@ -1832,6 +1881,7 @@ void mcheck_cpu_init(struct cpuinfo_x86 *c)
         __mcheck_cpu_init_generic();
         __mcheck_cpu_init_vendor(c);
         __mcheck_cpu_init_clear_banks();
+        __mcheck_cpu_check_banks();
         __mcheck_cpu_setup_timer();
 }
 
@@ -1863,7 +1913,7 @@ static void __mce_disable_bank(void *arg)
 
 void mce_disable_bank(int bank)
 {
-        if (bank >= mca_cfg.banks) {
+        if (bank >= this_cpu_read(mce_num_banks)) {
                 pr_warn(FW_BUG
                         "Ignoring request to disable invalid MCA bank %d.\n",
                         bank);
@@ -1949,9 +1999,10 @@ int __init mcheck_init(void)
  */
 static void mce_disable_error_reporting(void)
 {
+        struct mce_bank *mce_banks = this_cpu_ptr(mce_banks_array);
         int i;
 
-        for (i = 0; i < mca_cfg.banks; i++) {
+        for (i = 0; i < this_cpu_read(mce_num_banks); i++) {
                 struct mce_bank *b = &mce_banks[i];
 
                 if (b->init)
@@ -2051,26 +2102,47 @@ static struct bus_type mce_subsys = {
 
 DEFINE_PER_CPU(struct device *, mce_device);
 
-static inline struct mce_bank *attr_to_bank(struct device_attribute *attr)
+static inline struct mce_bank_dev *attr_to_bank(struct device_attribute *attr)
 {
-        return container_of(attr, struct mce_bank, attr);
+        return container_of(attr, struct mce_bank_dev, attr);
 }
 
 static ssize_t show_bank(struct device *s, struct device_attribute *attr,
                          char *buf)
 {
-        return sprintf(buf, "%llx\n", attr_to_bank(attr)->ctl);
+        u8 bank = attr_to_bank(attr)->bank;
+        struct mce_bank *b;
+
+        if (bank >= per_cpu(mce_num_banks, s->id))
+                return -EINVAL;
+
+        b = &per_cpu(mce_banks_array, s->id)[bank];
+
+        if (!b->init)
+                return -ENODEV;
+
+        return sprintf(buf, "%llx\n", b->ctl);
 }
 
 static ssize_t set_bank(struct device *s, struct device_attribute *attr,
                         const char *buf, size_t size)
 {
+        u8 bank = attr_to_bank(attr)->bank;
+        struct mce_bank *b;
         u64 new;
 
         if (kstrtou64(buf, 0, &new) < 0)
                 return -EINVAL;
 
-        attr_to_bank(attr)->ctl = new;
+        if (bank >= per_cpu(mce_num_banks, s->id))
+                return -EINVAL;
+
+        b = &per_cpu(mce_banks_array, s->id)[bank];
+
+        if (!b->init)
+                return -ENODEV;
+
+        b->ctl = new;
         mce_restart();
 
         return size;
@@ -2185,7 +2257,7 @@ static void mce_device_release(struct device *dev)
         kfree(dev);
 }
 
-/* Per cpu device init. All of the cpus still share the same ctrl bank: */
+/* Per CPU device init. All of the CPUs still share the same bank device: */
 static int mce_device_create(unsigned int cpu)
 {
         struct device *dev;
@@ -2217,8 +2289,8 @@ static int mce_device_create(unsigned int cpu)
                 if (err)
                         goto error;
         }
-        for (j = 0; j < mca_cfg.banks; j++) {
-                err = device_create_file(dev, &mce_banks[j].attr);
+        for (j = 0; j < per_cpu(mce_num_banks, cpu); j++) {
+                err = device_create_file(dev, &mce_bank_devs[j].attr);
                 if (err)
                         goto error2;
         }
@@ -2228,7 +2300,7 @@ static int mce_device_create(unsigned int cpu)
         return 0;
 error2:
         while (--j >= 0)
-                device_remove_file(dev, &mce_banks[j].attr);
+                device_remove_file(dev, &mce_bank_devs[j].attr);
 error:
         while (--i >= 0)
                 device_remove_file(dev, mce_device_attrs[i]);
@@ -2249,8 +2321,8 @@ static void mce_device_remove(unsigned int cpu)
         for (i = 0; mce_device_attrs[i]; i++)
                 device_remove_file(dev, mce_device_attrs[i]);
 
-        for (i = 0; i < mca_cfg.banks; i++)
-                device_remove_file(dev, &mce_banks[i].attr);
+        for (i = 0; i < per_cpu(mce_num_banks, cpu); i++)
+                device_remove_file(dev, &mce_bank_devs[i].attr);
 
         device_unregister(dev);
         cpumask_clear_cpu(cpu, mce_device_initialized);
@@ -2271,6 +2343,7 @@ static void mce_disable_cpu(void)
 
 static void mce_reenable_cpu(void)
 {
+        struct mce_bank *mce_banks = this_cpu_ptr(mce_banks_array);
         int i;
 
         if (!mce_available(raw_cpu_ptr(&cpu_info)))
@@ -2278,7 +2351,7 @@ static void mce_reenable_cpu(void)
 
         if (!cpuhp_tasks_frozen)
                 cmci_reenable();
-        for (i = 0; i < mca_cfg.banks; i++) {
+        for (i = 0; i < this_cpu_read(mce_num_banks); i++) {
                 struct mce_bank *b = &mce_banks[i];
 
                 if (b->init)
@@ -2328,10 +2401,12 @@ static __init void mce_init_banks(void)
 {
         int i;
 
-        for (i = 0; i < mca_cfg.banks; i++) {
-                struct mce_bank *b = &mce_banks[i];
+        for (i = 0; i < MAX_NR_BANKS; i++) {
+                struct mce_bank_dev *b = &mce_bank_devs[i];
                 struct device_attribute *a = &b->attr;
 
+                b->bank = i;
+
                 sysfs_attr_init(&a->attr);
                 a->attr.name    = b->attrname;
                 snprintf(b->attrname, ATTR_LEN, "bank%d", i);
@@ -2441,22 +2516,16 @@ static int fake_panic_set(void *data, u64 val)
 DEFINE_DEBUGFS_ATTRIBUTE(fake_panic_fops, fake_panic_get, fake_panic_set,
                          "%llu\n");
 
-static int __init mcheck_debugfs_init(void)
+static void __init mcheck_debugfs_init(void)
 {
-        struct dentry *dmce, *ffake_panic;
+        struct dentry *dmce;
 
         dmce = mce_get_debugfs_dir();
-        if (!dmce)
-                return -ENOMEM;
-        ffake_panic = debugfs_create_file_unsafe("fake_panic", 0444, dmce,
-                                                 NULL, &fake_panic_fops);
-        if (!ffake_panic)
-                return -ENOMEM;
-
-        return 0;
+        debugfs_create_file_unsafe("fake_panic", 0444, dmce, NULL,
+                                   &fake_panic_fops);
 }
 #else
-static int __init mcheck_debugfs_init(void) { return -EINVAL; }
+static void __init mcheck_debugfs_init(void) { }
 #endif
 
 DEFINE_STATIC_KEY_FALSE(mcsafe_key);
@@ -2464,8 +2533,6 @@ EXPORT_SYMBOL_GPL(mcsafe_key);
 
 static int __init mcheck_late_init(void)
 {
-        pr_info("Using %d MCE banks\n", mca_cfg.banks);
-
         if (mca_cfg.recovery)
                 static_branch_inc(&mcsafe_key);
 
diff --git a/arch/x86/kernel/cpu/mce/inject.c b/arch/x86/kernel/cpu/mce/inject.c
index 5d108f70f315..1f30117b24ba 100644
--- a/arch/x86/kernel/cpu/mce/inject.c
+++ b/arch/x86/kernel/cpu/mce/inject.c
@@ -645,7 +645,6 @@ static const struct file_operations readme_fops = {
 
 static struct dfs_node {
         char *name;
-        struct dentry *d;
         const struct file_operations *fops;
         umode_t perm;
 } dfs_fls[] = {
@@ -659,49 +658,23 @@ static struct dfs_node {
         { .name = "README",     .fops = &readme_fops, .perm = S_IRUSR | S_IRGRP | S_IROTH },
 };
 
-static int __init debugfs_init(void)
+static void __init debugfs_init(void)
 {
         unsigned int i;
 
         dfs_inj = debugfs_create_dir("mce-inject", NULL);
-        if (!dfs_inj)
-                return -EINVAL;
-
-        for (i = 0; i < ARRAY_SIZE(dfs_fls); i++) {
-                dfs_fls[i].d = debugfs_create_file(dfs_fls[i].name,
-                                                    dfs_fls[i].perm,
-                                                    dfs_inj,
-                                                    &i_mce,
-                                                    dfs_fls[i].fops);
-
-                if (!dfs_fls[i].d)
-                        goto err_dfs_add;
-        }
-
-        return 0;
-
-err_dfs_add:
-        while (i-- > 0)
-                debugfs_remove(dfs_fls[i].d);
 
-        debugfs_remove(dfs_inj);
-        dfs_inj = NULL;
-
-        return -ENODEV;
+        for (i = 0; i < ARRAY_SIZE(dfs_fls); i++)
+                debugfs_create_file(dfs_fls[i].name, dfs_fls[i].perm, dfs_inj,
+                                    &i_mce, dfs_fls[i].fops);
 }
 
 static int __init inject_init(void)
 {
-        int err;
-
         if (!alloc_cpumask_var(&mce_inject_cpumask, GFP_KERNEL))
                 return -ENOMEM;
 
-        err = debugfs_init();
-        if (err) {
-                free_cpumask_var(mce_inject_cpumask);
-                return err;
-        }
+        debugfs_init();
 
         register_nmi_handler(NMI_LOCAL, mce_raise_notify, 0, "mce_notify");
         mce_register_injector_chain(&inject_nb);
diff --git a/arch/x86/kernel/cpu/mce/internal.h b/arch/x86/kernel/cpu/mce/internal.h
index a34b55baa7aa..43031db429d2 100644
--- a/arch/x86/kernel/cpu/mce/internal.h
+++ b/arch/x86/kernel/cpu/mce/internal.h
@@ -22,17 +22,8 @@ enum severity_level {
 
 extern struct blocking_notifier_head x86_mce_decoder_chain;
 
-#define ATTR_LEN                16
 #define INITIAL_CHECK_INTERVAL  5 * 60 /* 5 minutes */
 
-/* One object for each MCE bank, shared by all CPUs */
-struct mce_bank {
-        u64                     ctl;                    /* subevents to enable */
-        unsigned char init;                             /* initialise bank? */
-        struct device_attribute attr;                   /* device attribute */
-        char                    attrname[ATTR_LEN];     /* attribute name */
-};
-
 struct mce_evt_llist {
         struct llist_node llnode;
         struct mce mce;
@@ -47,7 +38,6 @@ struct llist_node *mce_gen_pool_prepare_records(void);
 extern int (*mce_severity)(struct mce *a, int tolerant, char **msg, bool is_excp);
 struct dentry *mce_get_debugfs_dir(void);
 
-extern struct mce_bank *mce_banks;
 extern mce_banks_t mce_banks_ce_disabled;
 
 #ifdef CONFIG_X86_MCE_INTEL
@@ -128,7 +118,6 @@ struct mca_config {
               bios_cmci_threshold       : 1,
               __reserved                : 59;
 
-        u8 banks;
         s8 bootlog;
         int tolerant;
         int monarch_timeout;
@@ -137,6 +126,7 @@ struct mca_config {
 };
 
 extern struct mca_config mca_cfg;
+DECLARE_PER_CPU_READ_MOSTLY(unsigned int, mce_num_banks);
 
 struct mce_vendor_flags {
         /*
diff --git a/arch/x86/kernel/cpu/mce/severity.c b/arch/x86/kernel/cpu/mce/severity.c
index 2d33a26d257e..210f1f5db5f7 100644
--- a/arch/x86/kernel/cpu/mce/severity.c
+++ b/arch/x86/kernel/cpu/mce/severity.c
@@ -400,21 +400,13 @@ static const struct file_operations severities_coverage_fops = {
 
 static int __init severities_debugfs_init(void)
 {
-        struct dentry *dmce, *fsev;
+        struct dentry *dmce;
 
         dmce = mce_get_debugfs_dir();
-        if (!dmce)
-                goto err_out;
-
-        fsev = debugfs_create_file("severities-coverage", 0444, dmce, NULL,
-                                   &severities_coverage_fops);
-        if (!fsev)
-                goto err_out;
 
+        debugfs_create_file("severities-coverage", 0444, dmce, NULL,
+                            &severities_coverage_fops);
         return 0;
-
-err_out:
-        return -ENOMEM;
 }
 late_initcall(severities_debugfs_init);
 #endif /* CONFIG_DEBUG_FS */
diff --git a/arch/x86/kernel/cpu/microcode/core.c b/arch/x86/kernel/cpu/microcode/core.c
index a813987b5552..cb0fdcaf1415 100644
--- a/arch/x86/kernel/cpu/microcode/core.c
+++ b/arch/x86/kernel/cpu/microcode/core.c
@@ -789,13 +789,16 @@ static struct syscore_ops mc_syscore_ops = {
         .resume                 = mc_bp_resume,
 };
 
-static int mc_cpu_online(unsigned int cpu)
+static int mc_cpu_starting(unsigned int cpu)
 {
-        struct device *dev;
-
-        dev = get_cpu_device(cpu);
         microcode_update_cpu(cpu);
         pr_debug("CPU%d added\n", cpu);
+        return 0;
+}
+
+static int mc_cpu_online(unsigned int cpu)
+{
+        struct device *dev = get_cpu_device(cpu);
 
         if (sysfs_create_group(&dev->kobj, &mc_attr_group))
                 pr_err("Failed to create group for CPU%d\n", cpu);
@@ -872,7 +875,9 @@ int __init microcode_init(void)
                 goto out_ucode_group;
 
         register_syscore_ops(&mc_syscore_ops);
-        cpuhp_setup_state_nocalls(CPUHP_AP_MICROCODE_LOADER, "x86/microcode:online",
+        cpuhp_setup_state_nocalls(CPUHP_AP_MICROCODE_LOADER, "x86/microcode:starting",
+                                  mc_cpu_starting, NULL);
+        cpuhp_setup_state_nocalls(CPUHP_AP_ONLINE_DYN, "x86/microcode:online",
                                   mc_cpu_online, mc_cpu_down_prep);
 
         pr_info("Microcode Update Driver: v%s.", DRIVER_VERSION);
diff --git a/arch/x86/kernel/cpu/mshyperv.c b/arch/x86/kernel/cpu/mshyperv.c
index 7df29f08871b..062f77279ce3 100644
--- a/arch/x86/kernel/cpu/mshyperv.c
+++ b/arch/x86/kernel/cpu/mshyperv.c
@@ -17,6 +17,7 @@
 #include <linux/irq.h>
 #include <linux/kexec.h>
 #include <linux/i8253.h>
+#include <linux/random.h>
 #include <asm/processor.h>
 #include <asm/hypervisor.h>
 #include <asm/hyperv-tlfs.h>
@@ -80,6 +81,7 @@ __visible void __irq_entry hv_stimer0_vector_handler(struct pt_regs *regs)
         inc_irq_stat(hyperv_stimer0_count);
         if (hv_stimer0_handler)
                 hv_stimer0_handler();
+        add_interrupt_randomness(HYPERV_STIMER0_VECTOR, 0);
         ack_APIC_irq();
 
         exiting_irq();
@@ -89,7 +91,7 @@ __visible void __irq_entry hv_stimer0_vector_handler(struct pt_regs *regs)
 int hv_setup_stimer0_irq(int *irq, int *vector, void (*handler)(void))
 {
         *vector = HYPERV_STIMER0_VECTOR;
-        *irq = 0;   /* Unused on x86/x64 */
+        *irq = -1;   /* Unused on x86/x64 */
         hv_stimer0_handler = handler;
         return 0;
 }
@@ -266,9 +268,9 @@ static void __init ms_hyperv_init_platform(void)
 
                 rdmsrl(HV_X64_MSR_APIC_FREQUENCY, hv_lapic_frequency);
                 hv_lapic_frequency = div_u64(hv_lapic_frequency, HZ);
-                lapic_timer_frequency = hv_lapic_frequency;
+                lapic_timer_period = hv_lapic_frequency;
                 pr_info("Hyper-V: LAPIC Timer Frequency: %#x\n",
-                        lapic_timer_frequency);
+                        lapic_timer_period);
         }
 
         register_nmi_handler(NMI_UNKNOWN, hv_nmi_unknown, NMI_FLAG_FIRST,
diff --git a/arch/x86/kernel/cpu/mtrr/generic.c b/arch/x86/kernel/cpu/mtrr/generic.c
index 9356c1c9024d..aa5c064a6a22 100644
--- a/arch/x86/kernel/cpu/mtrr/generic.c
+++ b/arch/x86/kernel/cpu/mtrr/generic.c
@@ -743,7 +743,15 @@ static void prepare_set(void) __acquires(set_atomicity_lock)
         /* Enter the no-fill (CD=1, NW=0) cache mode and flush caches. */
         cr0 = read_cr0() | X86_CR0_CD;
         write_cr0(cr0);
-        wbinvd();
+
+        /*
+         * Cache flushing is the most time-consuming step when programming
+         * the MTRRs. Fortunately, as per the Intel Software Development
+         * Manual, we can skip it if the processor supports cache self-
+         * snooping.
+         */
+        if (!static_cpu_has(X86_FEATURE_SELFSNOOP))
+                wbinvd();
 
         /* Save value of CR4 and clear Page Global Enable (bit 7) */
         if (boot_cpu_has(X86_FEATURE_PGE)) {
@@ -760,7 +768,10 @@ static void prepare_set(void) __acquires(set_atomicity_lock)
 
         /* Disable MTRRs, and set the default type to uncached */
         mtrr_wrmsr(MSR_MTRRdefType, deftype_lo & ~0xcff, deftype_hi);
-        wbinvd();
+
+        /* Again, only flush caches if we have to. */
+        if (!static_cpu_has(X86_FEATURE_SELFSNOOP))
+                wbinvd();
 }
 
 static void post_set(void) __releases(set_atomicity_lock)
diff --git a/arch/x86/kernel/cpu/resctrl/rdtgroup.c b/arch/x86/kernel/cpu/resctrl/rdtgroup.c
index 2131b8bbaad7..2f4824793798 100644
--- a/arch/x86/kernel/cpu/resctrl/rdtgroup.c
+++ b/arch/x86/kernel/cpu/resctrl/rdtgroup.c
@@ -796,8 +796,12 @@ static int rdt_bit_usage_show(struct kernfs_open_file *of,
                               struct seq_file *seq, void *v)
 {
         struct rdt_resource *r = of->kn->parent->priv;
-        u32 sw_shareable = 0, hw_shareable = 0;
-        u32 exclusive = 0, pseudo_locked = 0;
+        /*
+         * Use unsigned long even though only 32 bits are used to ensure
+         * test_bit() is used safely.
+         */
+        unsigned long sw_shareable = 0, hw_shareable = 0;
+        unsigned long exclusive = 0, pseudo_locked = 0;
         struct rdt_domain *dom;
         int i, hwb, swb, excl, psl;
         enum rdtgrp_mode mode;
@@ -842,10 +846,10 @@ static int rdt_bit_usage_show(struct kernfs_open_file *of,
                 }
                 for (i = r->cache.cbm_len - 1; i >= 0; i--) {
                         pseudo_locked = dom->plr ? dom->plr->cbm : 0;
-                        hwb = test_bit(i, (unsigned long *)&hw_shareable);
-                        swb = test_bit(i, (unsigned long *)&sw_shareable);
-                        excl = test_bit(i, (unsigned long *)&exclusive);
-                        psl = test_bit(i, (unsigned long *)&pseudo_locked);
+                        hwb = test_bit(i, &hw_shareable);
+                        swb = test_bit(i, &sw_shareable);
+                        excl = test_bit(i, &exclusive);
+                        psl = test_bit(i, &pseudo_locked);
                         if (hwb && swb)
                                 seq_putc(seq, 'X');
                         else if (hwb && !swb)
@@ -2486,26 +2490,19 @@ out_destroy:
  */
 static void cbm_ensure_valid(u32 *_val, struct rdt_resource *r)
 {
-        /*
-         * Convert the u32 _val to an unsigned long required by all the bit
-         * operations within this function. No more than 32 bits of this
-         * converted value can be accessed because all bit operations are
-         * additionally provided with cbm_len that is initialized during
-         * hardware enumeration using five bits from the EAX register and
-         * thus never can exceed 32 bits.
-         */
-        unsigned long *val = (unsigned long *)_val;
+        unsigned long val = *_val;
         unsigned int cbm_len = r->cache.cbm_len;
         unsigned long first_bit, zero_bit;
 
-        if (*val == 0)
+        if (val == 0)
                 return;
 
-        first_bit = find_first_bit(val, cbm_len);
-        zero_bit = find_next_zero_bit(val, cbm_len, first_bit);
+        first_bit = find_first_bit(&val, cbm_len);
+        zero_bit = find_next_zero_bit(&val, cbm_len, first_bit);
 
         /* Clear any remaining bits to ensure contiguous region */
-        bitmap_clear(val, zero_bit, cbm_len - zero_bit);
+        bitmap_clear(&val, zero_bit, cbm_len - zero_bit);
+        *_val = (u32)val;
 }
 
 /*
diff --git a/arch/x86/kernel/cpu/scattered.c b/arch/x86/kernel/cpu/scattered.c
index 94aa1c72ca98..adf9b71386ef 100644
--- a/arch/x86/kernel/cpu/scattered.c
+++ b/arch/x86/kernel/cpu/scattered.c
@@ -26,6 +26,10 @@ struct cpuid_bit {
 static const struct cpuid_bit cpuid_bits[] = {
         { X86_FEATURE_APERFMPERF,       CPUID_ECX,  0, 0x00000006, 0 },
         { X86_FEATURE_EPB,              CPUID_ECX,  3, 0x00000006, 0 },
+        { X86_FEATURE_CQM_LLC,          CPUID_EDX,  1, 0x0000000f, 0 },
+        { X86_FEATURE_CQM_OCCUP_LLC,    CPUID_EDX,  0, 0x0000000f, 1 },
+        { X86_FEATURE_CQM_MBM_TOTAL,    CPUID_EDX,  1, 0x0000000f, 1 },
+        { X86_FEATURE_CQM_MBM_LOCAL,    CPUID_EDX,  2, 0x0000000f, 1 },
         { X86_FEATURE_CAT_L3,           CPUID_EBX,  1, 0x00000010, 0 },
         { X86_FEATURE_CAT_L2,           CPUID_EBX,  2, 0x00000010, 0 },
         { X86_FEATURE_CDP_L3,           CPUID_ECX,  2, 0x00000010, 1 },
diff --git a/arch/x86/kernel/cpu/umwait.c b/arch/x86/kernel/cpu/umwait.c
new file mode 100644
index 000000000000..6a204e7336c1
--- /dev/null
+++ b/arch/x86/kernel/cpu/umwait.c
@@ -0,0 +1,200 @@
+// SPDX-License-Identifier: GPL-2.0
+#include <linux/syscore_ops.h>
+#include <linux/suspend.h>
+#include <linux/cpu.h>
+
+#include <asm/msr.h>
+
+#define UMWAIT_C02_ENABLE       0
+
+#define UMWAIT_CTRL_VAL(max_time, c02_disable)                          \
+        (((max_time) & MSR_IA32_UMWAIT_CONTROL_TIME_MASK) |             \
+        ((c02_disable) & MSR_IA32_UMWAIT_CONTROL_C02_DISABLE))
+
+/*
+ * Cache IA32_UMWAIT_CONTROL MSR. This is a systemwide control. By default,
+ * umwait max time is 100000 in TSC-quanta and C0.2 is enabled
+ */
+static u32 umwait_control_cached = UMWAIT_CTRL_VAL(100000, UMWAIT_C02_ENABLE);
+
+/*
+ * Serialize access to umwait_control_cached and IA32_UMWAIT_CONTROL MSR in
+ * the sysfs write functions.
+ */
+static DEFINE_MUTEX(umwait_lock);
+
+static void umwait_update_control_msr(void * unused)
+{
+        lockdep_assert_irqs_disabled();
+        wrmsr(MSR_IA32_UMWAIT_CONTROL, READ_ONCE(umwait_control_cached), 0);
+}
+
+/*
+ * The CPU hotplug callback sets the control MSR to the global control
+ * value.
+ *
+ * Disable interrupts so the read of umwait_control_cached and the WRMSR
+ * are protected against a concurrent sysfs write. Otherwise the sysfs
+ * write could update the cached value after it had been read on this CPU
+ * and issue the IPI before the old value had been written. The IPI would
+ * interrupt, write the new value and after return from IPI the previous
+ * value would be written by this CPU.
+ *
+ * With interrupts disabled the upcoming CPU either sees the new control
+ * value or the IPI is updating this CPU to the new control value after
+ * interrupts have been reenabled.
+ */
+static int umwait_cpu_online(unsigned int cpu)
+{
+        local_irq_disable();
+        umwait_update_control_msr(NULL);
+        local_irq_enable();
+        return 0;
+}
+
+/*
+ * On resume, restore IA32_UMWAIT_CONTROL MSR on the boot processor which
+ * is the only active CPU at this time. The MSR is set up on the APs via the
+ * CPU hotplug callback.
+ *
+ * This function is invoked on resume from suspend and hibernation. On
+ * resume from suspend the restore should be not required, but we neither
+ * trust the firmware nor does it matter if the same value is written
+ * again.
+ */
+static void umwait_syscore_resume(void)
+{
+        umwait_update_control_msr(NULL);
+}
+
+static struct syscore_ops umwait_syscore_ops = {
+        .resume = umwait_syscore_resume,
+};
+
+/* sysfs interface */
+
+/*
+ * When bit 0 in IA32_UMWAIT_CONTROL MSR is 1, C0.2 is disabled.
+ * Otherwise, C0.2 is enabled.
+ */
+static inline bool umwait_ctrl_c02_enabled(u32 ctrl)
+{
+        return !(ctrl & MSR_IA32_UMWAIT_CONTROL_C02_DISABLE);
+}
+
+static inline u32 umwait_ctrl_max_time(u32 ctrl)
+{
+        return ctrl & MSR_IA32_UMWAIT_CONTROL_TIME_MASK;
+}
+
+static inline void umwait_update_control(u32 maxtime, bool c02_enable)
+{
+        u32 ctrl = maxtime & MSR_IA32_UMWAIT_CONTROL_TIME_MASK;
+
+        if (!c02_enable)
+                ctrl |= MSR_IA32_UMWAIT_CONTROL_C02_DISABLE;
+
+        WRITE_ONCE(umwait_control_cached, ctrl);
+        /* Propagate to all CPUs */
+        on_each_cpu(umwait_update_control_msr, NULL, 1);
+}
+
+static ssize_t
+enable_c02_show(struct device *dev, struct device_attribute *attr, char *buf)
+{
+        u32 ctrl = READ_ONCE(umwait_control_cached);
+
+        return sprintf(buf, "%d\n", umwait_ctrl_c02_enabled(ctrl));
+}
+
+static ssize_t enable_c02_store(struct device *dev,
+                                struct device_attribute *attr,
+                                const char *buf, size_t count)
+{
+        bool c02_enable;
+        u32 ctrl;
+        int ret;
+
+        ret = kstrtobool(buf, &c02_enable);
+        if (ret)
+                return ret;
+
+        mutex_lock(&umwait_lock);
+
+        ctrl = READ_ONCE(umwait_control_cached);
+        if (c02_enable != umwait_ctrl_c02_enabled(ctrl))
+                umwait_update_control(ctrl, c02_enable);
+
+        mutex_unlock(&umwait_lock);
+
+        return count;
+}
+static DEVICE_ATTR_RW(enable_c02);
+
+static ssize_t
+max_time_show(struct device *kobj, struct device_attribute *attr, char *buf)
+{
+        u32 ctrl = READ_ONCE(umwait_control_cached);
+
+        return sprintf(buf, "%u\n", umwait_ctrl_max_time(ctrl));
+}
+
+static ssize_t max_time_store(struct device *kobj,
+                              struct device_attribute *attr,
+                              const char *buf, size_t count)
+{
+        u32 max_time, ctrl;
+        int ret;
+
+        ret = kstrtou32(buf, 0, &max_time);
+        if (ret)
+                return ret;
+
+        /* bits[1:0] must be zero */
+        if (max_time & ~MSR_IA32_UMWAIT_CONTROL_TIME_MASK)
+                return -EINVAL;
+
+        mutex_lock(&umwait_lock);
+
+        ctrl = READ_ONCE(umwait_control_cached);
+        if (max_time != umwait_ctrl_max_time(ctrl))
+                umwait_update_control(max_time, umwait_ctrl_c02_enabled(ctrl));
+
+        mutex_unlock(&umwait_lock);
+
+        return count;
+}
+static DEVICE_ATTR_RW(max_time);
+
+static struct attribute *umwait_attrs[] = {
+        &dev_attr_enable_c02.attr,
+        &dev_attr_max_time.attr,
+        NULL
+};
+
+static struct attribute_group umwait_attr_group = {
+        .attrs = umwait_attrs,
+        .name = "umwait_control",
+};
+
+static int __init umwait_init(void)
+{
+        struct device *dev;
+        int ret;
+
+        if (!boot_cpu_has(X86_FEATURE_WAITPKG))
+                return -ENODEV;
+
+        ret = cpuhp_setup_state(CPUHP_AP_ONLINE_DYN, "umwait:online",
+                                umwait_cpu_online, NULL);
+
+        register_syscore_ops(&umwait_syscore_ops);
+
+        /*
+         * Add umwait control interface. Ignore failure, so at least the
+         * default values are set up in case the machine manages to boot.
+         */
+        dev = cpu_subsys.dev_root;
+        return sysfs_create_group(&dev->kobj, &umwait_attr_group);
+}
+device_initcall(umwait_init);
diff --git a/arch/x86/kernel/cpu/vmware.c b/arch/x86/kernel/cpu/vmware.c
index 0eda91f8eeac..3c648476d4fb 100644
--- a/arch/x86/kernel/cpu/vmware.c
+++ b/arch/x86/kernel/cpu/vmware.c
@@ -157,7 +157,7 @@ static void __init vmware_platform_setup(void)
 
 #ifdef CONFIG_X86_LOCAL_APIC
                 /* Skip lapic calibration since we know the bus frequency. */
-                lapic_timer_frequency = ecx / HZ;
+                lapic_timer_period = ecx / HZ;
                 pr_info("Host bus clock speed read from hypervisor : %u Hz\n",
                         ecx);
 #endif
diff --git a/arch/x86/kernel/cpu/zhaoxin.c b/arch/x86/kernel/cpu/zhaoxin.c
new file mode 100644
index 000000000000..8e6f2f4b4afe
--- /dev/null
+++ b/arch/x86/kernel/cpu/zhaoxin.c
@@ -0,0 +1,167 @@
+// SPDX-License-Identifier: GPL-2.0
+#include <linux/sched.h>
+#include <linux/sched/clock.h>
+
+#include <asm/cpufeature.h>
+
+#include "cpu.h"
+
+#define MSR_ZHAOXIN_FCR57 0x00001257
+
+#define ACE_PRESENT     (1 << 6)
+#define ACE_ENABLED     (1 << 7)
+#define ACE_FCR         (1 << 7)        /* MSR_ZHAOXIN_FCR */
+
+#define RNG_PRESENT     (1 << 2)
+#define RNG_ENABLED     (1 << 3)
+#define RNG_ENABLE      (1 << 8)        /* MSR_ZHAOXIN_RNG */
+
+#define X86_VMX_FEATURE_PROC_CTLS_TPR_SHADOW    0x00200000
+#define X86_VMX_FEATURE_PROC_CTLS_VNMI          0x00400000
+#define X86_VMX_FEATURE_PROC_CTLS_2ND_CTLS      0x80000000
+#define X86_VMX_FEATURE_PROC_CTLS2_VIRT_APIC    0x00000001
+#define X86_VMX_FEATURE_PROC_CTLS2_EPT          0x00000002
+#define X86_VMX_FEATURE_PROC_CTLS2_VPID         0x00000020
+
+static void init_zhaoxin_cap(struct cpuinfo_x86 *c)
+{
+        u32  lo, hi;
+
+        /* Test for Extended Feature Flags presence */
+        if (cpuid_eax(0xC0000000) >= 0xC0000001) {
+                u32 tmp = cpuid_edx(0xC0000001);
+
+                /* Enable ACE unit, if present and disabled */
+                if ((tmp & (ACE_PRESENT | ACE_ENABLED)) == ACE_PRESENT) {
+                        rdmsr(MSR_ZHAOXIN_FCR57, lo, hi);
+                        /* Enable ACE unit */
+                        lo |= ACE_FCR;
+                        wrmsr(MSR_ZHAOXIN_FCR57, lo, hi);
+                        pr_info("CPU: Enabled ACE h/w crypto\n");
+                }
+
+                /* Enable RNG unit, if present and disabled */
+                if ((tmp & (RNG_PRESENT | RNG_ENABLED)) == RNG_PRESENT) {
+                        rdmsr(MSR_ZHAOXIN_FCR57, lo, hi);
+                        /* Enable RNG unit */
+                        lo |= RNG_ENABLE;
+                        wrmsr(MSR_ZHAOXIN_FCR57, lo, hi);
+                        pr_info("CPU: Enabled h/w RNG\n");
+                }
+
+                /*
+                 * Store Extended Feature Flags as word 5 of the CPU
+                 * capability bit array
+                 */
+                c->x86_capability[CPUID_C000_0001_EDX] = cpuid_edx(0xC0000001);
+        }
+
+        if (c->x86 >= 0x6)
+                set_cpu_cap(c, X86_FEATURE_REP_GOOD);
+
+        cpu_detect_cache_sizes(c);
+}
+
+static void early_init_zhaoxin(struct cpuinfo_x86 *c)
+{
+        if (c->x86 >= 0x6)
+                set_cpu_cap(c, X86_FEATURE_CONSTANT_TSC);
+#ifdef CONFIG_X86_64
+        set_cpu_cap(c, X86_FEATURE_SYSENTER32);
+#endif
+        if (c->x86_power & (1 << 8)) {
+                set_cpu_cap(c, X86_FEATURE_CONSTANT_TSC);
+                set_cpu_cap(c, X86_FEATURE_NONSTOP_TSC);
+        }
+
+        if (c->cpuid_level >= 0x00000001) {
+                u32 eax, ebx, ecx, edx;
+
+                cpuid(0x00000001, &eax, &ebx, &ecx, &edx);
+                /*
+                 * If HTT (EDX[28]) is set EBX[16:23] contain the number of
+                 * apicids which are reserved per package. Store the resulting
+                 * shift value for the package management code.
+                 */
+                if (edx & (1U << 28))
+                        c->x86_coreid_bits = get_count_order((ebx >> 16) & 0xff);
+        }
+
+}
+
+static void zhaoxin_detect_vmx_virtcap(struct cpuinfo_x86 *c)
+{
+        u32 vmx_msr_low, vmx_msr_high, msr_ctl, msr_ctl2;
+
+        rdmsr(MSR_IA32_VMX_PROCBASED_CTLS, vmx_msr_low, vmx_msr_high);
+        msr_ctl = vmx_msr_high | vmx_msr_low;
+
+        if (msr_ctl & X86_VMX_FEATURE_PROC_CTLS_TPR_SHADOW)
+                set_cpu_cap(c, X86_FEATURE_TPR_SHADOW);
+        if (msr_ctl & X86_VMX_FEATURE_PROC_CTLS_VNMI)
+                set_cpu_cap(c, X86_FEATURE_VNMI);
+        if (msr_ctl & X86_VMX_FEATURE_PROC_CTLS_2ND_CTLS) {
+                rdmsr(MSR_IA32_VMX_PROCBASED_CTLS2,
+                      vmx_msr_low, vmx_msr_high);
+                msr_ctl2 = vmx_msr_high | vmx_msr_low;
+                if ((msr_ctl2 & X86_VMX_FEATURE_PROC_CTLS2_VIRT_APIC) &&
+                    (msr_ctl & X86_VMX_FEATURE_PROC_CTLS_TPR_SHADOW))
+                        set_cpu_cap(c, X86_FEATURE_FLEXPRIORITY);
+                if (msr_ctl2 & X86_VMX_FEATURE_PROC_CTLS2_EPT)
+                        set_cpu_cap(c, X86_FEATURE_EPT);
+                if (msr_ctl2 & X86_VMX_FEATURE_PROC_CTLS2_VPID)
+                        set_cpu_cap(c, X86_FEATURE_VPID);
+        }
+}
+
+static void init_zhaoxin(struct cpuinfo_x86 *c)
+{
+        early_init_zhaoxin(c);
+        init_intel_cacheinfo(c);
+        detect_num_cpu_cores(c);
+#ifdef CONFIG_X86_32
+        detect_ht(c);
+#endif
+
+        if (c->cpuid_level > 9) {
+                unsigned int eax = cpuid_eax(10);
+
+                /*
+                 * Check for version and the number of counters
+                 * Version(eax[7:0]) can't be 0;
+                 * Counters(eax[15:8]) should be greater than 1;
+                 */
+                if ((eax & 0xff) && (((eax >> 8) & 0xff) > 1))
+                        set_cpu_cap(c, X86_FEATURE_ARCH_PERFMON);
+        }
+
+        if (c->x86 >= 0x6)
+                init_zhaoxin_cap(c);
+#ifdef CONFIG_X86_64
+        set_cpu_cap(c, X86_FEATURE_LFENCE_RDTSC);
+#endif
+
+        if (cpu_has(c, X86_FEATURE_VMX))
+                zhaoxin_detect_vmx_virtcap(c);
+}
+
+#ifdef CONFIG_X86_32
+static unsigned int
+zhaoxin_size_cache(struct cpuinfo_x86 *c, unsigned int size)
+{
+        return size;
+}
+#endif
+
+static const struct cpu_dev zhaoxin_cpu_dev = {
+        .c_vendor       = "zhaoxin",
+        .c_ident        = { "  Shanghai  " },
+        .c_early_init   = early_init_zhaoxin,
+        .c_init         = init_zhaoxin,
+#ifdef CONFIG_X86_32
+        .legacy_cache_size = zhaoxin_size_cache,
+#endif
+        .c_x86_vendor   = X86_VENDOR_ZHAOXIN,
+};
+
+cpu_dev_register(zhaoxin_cpu_dev);
diff --git a/arch/x86/kernel/fpu/core.c b/arch/x86/kernel/fpu/core.c
index 649fbc3fcf9f..12c70840980e 100644
--- a/arch/x86/kernel/fpu/core.c
+++ b/arch/x86/kernel/fpu/core.c
@@ -43,18 +43,6 @@ static DEFINE_PER_CPU(bool, in_kernel_fpu);
  */
 DEFINE_PER_CPU(struct fpu *, fpu_fpregs_owner_ctx);
 
-static void kernel_fpu_disable(void)
-{
-        WARN_ON_FPU(this_cpu_read(in_kernel_fpu));
-        this_cpu_write(in_kernel_fpu, true);
-}
-
-static void kernel_fpu_enable(void)
-{
-        WARN_ON_FPU(!this_cpu_read(in_kernel_fpu));
-        this_cpu_write(in_kernel_fpu, false);
-}
-
 static bool kernel_fpu_disabled(void)
 {
         return this_cpu_read(in_kernel_fpu);
@@ -94,42 +82,33 @@ bool irq_fpu_usable(void)
 }
 EXPORT_SYMBOL(irq_fpu_usable);
 
-static void __kernel_fpu_begin(void)
+void kernel_fpu_begin(void)
 {
-        struct fpu *fpu = &current->thread.fpu;
+        preempt_disable();
 
         WARN_ON_FPU(!irq_fpu_usable());
+        WARN_ON_FPU(this_cpu_read(in_kernel_fpu));
 
-        kernel_fpu_disable();
+        this_cpu_write(in_kernel_fpu, true);
 
-        if (!(current->flags & PF_KTHREAD)) {
-                if (!test_thread_flag(TIF_NEED_FPU_LOAD)) {
-                        set_thread_flag(TIF_NEED_FPU_LOAD);
-                        /*
-                         * Ignore return value -- we don't care if reg state
-                         * is clobbered.
-                         */
-                        copy_fpregs_to_fpstate(fpu);
-                }
+        if (!(current->flags & PF_KTHREAD) &&
+            !test_thread_flag(TIF_NEED_FPU_LOAD)) {
+                set_thread_flag(TIF_NEED_FPU_LOAD);
+                /*
+                 * Ignore return value -- we don't care if reg state
+                 * is clobbered.
+                 */
+                copy_fpregs_to_fpstate(&current->thread.fpu);
         }
         __cpu_invalidate_fpregs_state();
 }
-
-static void __kernel_fpu_end(void)
-{
-        kernel_fpu_enable();
-}
-
-void kernel_fpu_begin(void)
-{
-        preempt_disable();
-        __kernel_fpu_begin();
-}
 EXPORT_SYMBOL_GPL(kernel_fpu_begin);
 
 void kernel_fpu_end(void)
 {
-        __kernel_fpu_end();
+        WARN_ON_FPU(!this_cpu_read(in_kernel_fpu));
+
+        this_cpu_write(in_kernel_fpu, false);
         preempt_enable();
 }
 EXPORT_SYMBOL_GPL(kernel_fpu_end);
@@ -155,7 +134,6 @@ void fpu__save(struct fpu *fpu)
         trace_x86_fpu_after_save(fpu);
         fpregs_unlock();
 }
-EXPORT_SYMBOL_GPL(fpu__save);
 
 /*
  * Legacy x87 fpstate state init:
diff --git a/arch/x86/kernel/fpu/init.c b/arch/x86/kernel/fpu/init.c
index ef0030e3fe6b..6ce7e0a23268 100644
--- a/arch/x86/kernel/fpu/init.c
+++ b/arch/x86/kernel/fpu/init.c
@@ -204,12 +204,6 @@ static void __init fpu__init_system_xstate_size_legacy(void)
          */
 
         if (!boot_cpu_has(X86_FEATURE_FPU)) {
-                /*
-                 * Disable xsave as we do not support it if i387
-                 * emulation is enabled.
-                 */
-                setup_clear_cpu_cap(X86_FEATURE_XSAVE);
-                setup_clear_cpu_cap(X86_FEATURE_XSAVEOPT);
                 fpu_kernel_xstate_size = sizeof(struct swregs_state);
         } else {
                 if (boot_cpu_has(X86_FEATURE_FXSR))
@@ -252,17 +246,20 @@ static void __init fpu__init_parse_early_param(void)
         char *argptr = arg;
         int bit;
 
+#ifdef CONFIG_X86_32
         if (cmdline_find_option_bool(boot_command_line, "no387"))
+#ifdef CONFIG_MATH_EMULATION
                 setup_clear_cpu_cap(X86_FEATURE_FPU);
+#else
+                pr_err("Option 'no387' required CONFIG_MATH_EMULATION enabled.\n");
+#endif
 
-        if (cmdline_find_option_bool(boot_command_line, "nofxsr")) {
+        if (cmdline_find_option_bool(boot_command_line, "nofxsr"))
                 setup_clear_cpu_cap(X86_FEATURE_FXSR);
-                setup_clear_cpu_cap(X86_FEATURE_FXSR_OPT);
-                setup_clear_cpu_cap(X86_FEATURE_XMM);
-        }
+#endif
 
         if (cmdline_find_option_bool(boot_command_line, "noxsave"))
-                fpu__xstate_clear_all_cpu_caps();
+                setup_clear_cpu_cap(X86_FEATURE_XSAVE);
 
         if (cmdline_find_option_bool(boot_command_line, "noxsaveopt"))
                 setup_clear_cpu_cap(X86_FEATURE_XSAVEOPT);
diff --git a/arch/x86/kernel/fpu/xstate.c b/arch/x86/kernel/fpu/xstate.c
index 3c36dd1784db..7b4c52aa929f 100644
--- a/arch/x86/kernel/fpu/xstate.c
+++ b/arch/x86/kernel/fpu/xstate.c
@@ -68,15 +68,6 @@ static unsigned int xstate_comp_offsets[sizeof(xfeatures_mask)*8];
 unsigned int fpu_user_xstate_size;
 
 /*
- * Clear all of the X86_FEATURE_* bits that are unavailable
- * when the CPU has no XSAVE support.
- */
-void fpu__xstate_clear_all_cpu_caps(void)
-{
-        setup_clear_cpu_cap(X86_FEATURE_XSAVE);
-}
-
-/*
  * Return whether the system supports a given xfeature.
  *
  * Also return the name of the (most advanced) feature that the caller requested:
@@ -709,7 +700,7 @@ static void fpu__init_disable_system_xstate(void)
 {
         xfeatures_mask = 0;
         cr4_clear_bits(X86_CR4_OSXSAVE);
-        fpu__xstate_clear_all_cpu_caps();
+        setup_clear_cpu_cap(X86_FEATURE_XSAVE);
 }
 
 /*
diff --git a/arch/x86/kernel/ftrace.c b/arch/x86/kernel/ftrace.c
index 0927bb158ffc..76228525acd0 100644
--- a/arch/x86/kernel/ftrace.c
+++ b/arch/x86/kernel/ftrace.c
@@ -22,6 +22,7 @@
 #include <linux/init.h>
 #include <linux/list.h>
 #include <linux/module.h>
+#include <linux/memory.h>
 
 #include <trace/syscall.h>
 
@@ -34,16 +35,25 @@
 #ifdef CONFIG_DYNAMIC_FTRACE
 
 int ftrace_arch_code_modify_prepare(void)
+    __acquires(&text_mutex)
 {
+        /*
+         * Need to grab text_mutex to prevent a race from module loading
+         * and live kernel patching from changing the text permissions while
+         * ftrace has it set to "read/write".
+         */
+        mutex_lock(&text_mutex);
         set_kernel_text_rw();
         set_all_modules_text_rw();
         return 0;
 }
 
 int ftrace_arch_code_modify_post_process(void)
+    __releases(&text_mutex)
 {
         set_all_modules_text_ro();
         set_kernel_text_ro();
+        mutex_unlock(&text_mutex);
         return 0;
 }
 
diff --git a/arch/x86/kernel/head64.c b/arch/x86/kernel/head64.c
index 16b1cbd3a61e..29ffa495bd1c 100644
--- a/arch/x86/kernel/head64.c
+++ b/arch/x86/kernel/head64.c
@@ -184,24 +184,25 @@ unsigned long __head __startup_64(unsigned long physaddr,
         pgtable_flags = _KERNPG_TABLE_NOENC + sme_get_me_mask();
 
         if (la57) {
-                p4d = fixup_pointer(early_dynamic_pgts[next_early_pgt++], physaddr);
+                p4d = fixup_pointer(early_dynamic_pgts[(*next_pgt_ptr)++],
+                                    physaddr);
 
                 i = (physaddr >> PGDIR_SHIFT) % PTRS_PER_PGD;
                 pgd[i + 0] = (pgdval_t)p4d + pgtable_flags;
                 pgd[i + 1] = (pgdval_t)p4d + pgtable_flags;
 
-                i = (physaddr >> P4D_SHIFT) % PTRS_PER_P4D;
-                p4d[i + 0] = (pgdval_t)pud + pgtable_flags;
-                p4d[i + 1] = (pgdval_t)pud + pgtable_flags;
+                i = physaddr >> P4D_SHIFT;
+                p4d[(i + 0) % PTRS_PER_P4D] = (pgdval_t)pud + pgtable_flags;
+                p4d[(i + 1) % PTRS_PER_P4D] = (pgdval_t)pud + pgtable_flags;
         } else {
                 i = (physaddr >> PGDIR_SHIFT) % PTRS_PER_PGD;
                 pgd[i + 0] = (pgdval_t)pud + pgtable_flags;
                 pgd[i + 1] = (pgdval_t)pud + pgtable_flags;
         }
 
-        i = (physaddr >> PUD_SHIFT) % PTRS_PER_PUD;
-        pud[i + 0] = (pudval_t)pmd + pgtable_flags;
-        pud[i + 1] = (pudval_t)pmd + pgtable_flags;
+        i = physaddr >> PUD_SHIFT;
+        pud[(i + 0) % PTRS_PER_PUD] = (pudval_t)pmd + pgtable_flags;
+        pud[(i + 1) % PTRS_PER_PUD] = (pudval_t)pmd + pgtable_flags;
 
         pmd_entry = __PAGE_KERNEL_LARGE_EXEC & ~_PAGE_GLOBAL;
         /* Filter out unsupported __PAGE_KERNEL_* bits: */
@@ -211,8 +212,9 @@ unsigned long __head __startup_64(unsigned long physaddr,
         pmd_entry +=  physaddr;
 
         for (i = 0; i < DIV_ROUND_UP(_end - _text, PMD_SIZE); i++) {
-                int idx = i + (physaddr >> PMD_SHIFT) % PTRS_PER_PMD;
-                pmd[idx] = pmd_entry + i * PMD_SIZE;
+                int idx = i + (physaddr >> PMD_SHIFT);
+
+                pmd[idx % PTRS_PER_PMD] = pmd_entry + i * PMD_SIZE;
         }
 
         /*
diff --git a/arch/x86/kernel/hpet.c b/arch/x86/kernel/hpet.c
index a0573f2e7763..c43e96a938d0 100644
--- a/arch/x86/kernel/hpet.c
+++ b/arch/x86/kernel/hpet.c
@@ -1,32 +1,44 @@
 // SPDX-License-Identifier: GPL-2.0-only
-#include <linux/clocksource.h>
 #include <linux/clockchips.h>
 #include <linux/interrupt.h>
-#include <linux/irq.h>
 #include <linux/export.h>
 #include <linux/delay.h>
-#include <linux/errno.h>
-#include <linux/i8253.h>
-#include <linux/slab.h>
 #include <linux/hpet.h>
-#include <linux/init.h>
 #include <linux/cpu.h>
-#include <linux/pm.h>
-#include <linux/io.h>
+#include <linux/irq.h>
 
-#include <asm/cpufeature.h>
-#include <asm/irqdomain.h>
-#include <asm/fixmap.h>
 #include <asm/hpet.h>
 #include <asm/time.h>
 
-#define HPET_MASK                       CLOCKSOURCE_MASK(32)
+#undef  pr_fmt
+#define pr_fmt(fmt) "hpet: " fmt
 
-#define HPET_DEV_USED_BIT               2
-#define HPET_DEV_USED                   (1 << HPET_DEV_USED_BIT)
-#define HPET_DEV_VALID                  0x8
-#define HPET_DEV_FSB_CAP                0x1000
-#define HPET_DEV_PERI_CAP               0x2000
+enum hpet_mode {
+        HPET_MODE_UNUSED,
+        HPET_MODE_LEGACY,
+        HPET_MODE_CLOCKEVT,
+        HPET_MODE_DEVICE,
+};
+
+struct hpet_channel {
+        struct clock_event_device       evt;
+        unsigned int                    num;
+        unsigned int                    cpu;
+        unsigned int                    irq;
+        unsigned int                    in_use;
+        enum hpet_mode                  mode;
+        unsigned int                    boot_cfg;
+        char                            name[10];
+};
+
+struct hpet_base {
+        unsigned int                    nr_channels;
+        unsigned int                    nr_clockevents;
+        unsigned int                    boot_cfg;
+        struct hpet_channel             *channels;
+};
+
+#define HPET_MASK                       CLOCKSOURCE_MASK(32)
 
 #define HPET_MIN_CYCLES                 128
 #define HPET_MIN_PROG_DELTA             (HPET_MIN_CYCLES + (HPET_MIN_CYCLES >> 1))
@@ -39,22 +51,25 @@ u8					hpet_blockid; /* OS timer block num */
 bool                                    hpet_msi_disable;
 
 #ifdef CONFIG_PCI_MSI
-static unsigned int                     hpet_num_timers;
+static DEFINE_PER_CPU(struct hpet_channel *, cpu_hpet_channel);
+static struct irq_domain                *hpet_domain;
 #endif
+
 static void __iomem                     *hpet_virt_address;
 
-struct hpet_dev {
-        struct clock_event_device       evt;
-        unsigned int                    num;
-        int                             cpu;
-        unsigned int                    irq;
-        unsigned int                    flags;
-        char                            name[10];
-};
+static struct hpet_base                 hpet_base;
+
+static bool                             hpet_legacy_int_enabled;
+static unsigned long                    hpet_freq;
 
-static inline struct hpet_dev *EVT_TO_HPET_DEV(struct clock_event_device *evtdev)
+bool                                    boot_hpet_disable;
+bool                                    hpet_force_user;
+static bool                             hpet_verbose;
+
+static inline
+struct hpet_channel *clockevent_to_channel(struct clock_event_device *evt)
 {
-        return container_of(evtdev, struct hpet_dev, evt);
+        return container_of(evt, struct hpet_channel, evt);
 }
 
 inline unsigned int hpet_readl(unsigned int a)
@@ -67,10 +82,6 @@ static inline void hpet_writel(unsigned int d, unsigned int a)
         writel(d, hpet_virt_address + a);
 }
 
-#ifdef CONFIG_X86_64
-#include <asm/pgtable.h>
-#endif
-
 static inline void hpet_set_mapping(void)
 {
         hpet_virt_address = ioremap_nocache(hpet_address, HPET_MMAP_SIZE);
@@ -85,10 +96,6 @@ static inline void hpet_clear_mapping(void)
 /*
  * HPET command line enable / disable
  */
-bool boot_hpet_disable;
-bool hpet_force_user;
-static bool hpet_verbose;
-
 static int __init hpet_setup(char *str)
 {
         while (str) {
@@ -120,13 +127,8 @@ static inline int is_hpet_capable(void)
         return !boot_hpet_disable && hpet_address;
 }
 
-/*
- * HPET timer interrupt enable / disable
- */
-static bool hpet_legacy_int_enabled;
-
 /**
- * is_hpet_enabled - check whether the hpet timer interrupt is enabled
+ * is_hpet_enabled - Check whether the legacy HPET timer interrupt is enabled
  */
 int is_hpet_enabled(void)
 {
@@ -136,32 +138,36 @@ EXPORT_SYMBOL_GPL(is_hpet_enabled);
 
 static void _hpet_print_config(const char *function, int line)
 {
-        u32 i, timers, l, h;
-        printk(KERN_INFO "hpet: %s(%d):\n", function, line);
-        l = hpet_readl(HPET_ID);
-        h = hpet_readl(HPET_PERIOD);
-        timers = ((l & HPET_ID_NUMBER) >> HPET_ID_NUMBER_SHIFT) + 1;
-        printk(KERN_INFO "hpet: ID: 0x%x, PERIOD: 0x%x\n", l, h);
-        l = hpet_readl(HPET_CFG);
-        h = hpet_readl(HPET_STATUS);
-        printk(KERN_INFO "hpet: CFG: 0x%x, STATUS: 0x%x\n", l, h);
+        u32 i, id, period, cfg, status, channels, l, h;
+
+        pr_info("%s(%d):\n", function, line);
+
+        id = hpet_readl(HPET_ID);
+        period = hpet_readl(HPET_PERIOD);
+        pr_info("ID: 0x%x, PERIOD: 0x%x\n", id, period);
+
+        cfg = hpet_readl(HPET_CFG);
+        status = hpet_readl(HPET_STATUS);
+        pr_info("CFG: 0x%x, STATUS: 0x%x\n", cfg, status);
+
         l = hpet_readl(HPET_COUNTER);
         h = hpet_readl(HPET_COUNTER+4);
-        printk(KERN_INFO "hpet: COUNTER_l: 0x%x, COUNTER_h: 0x%x\n", l, h);
+        pr_info("COUNTER_l: 0x%x, COUNTER_h: 0x%x\n", l, h);
+
+        channels = ((id & HPET_ID_NUMBER) >> HPET_ID_NUMBER_SHIFT) + 1;
 
-        for (i = 0; i < timers; i++) {
+        for (i = 0; i < channels; i++) {
                 l = hpet_readl(HPET_Tn_CFG(i));
                 h = hpet_readl(HPET_Tn_CFG(i)+4);
-                printk(KERN_INFO "hpet: T%d: CFG_l: 0x%x, CFG_h: 0x%x\n",
-                       i, l, h);
+                pr_info("T%d: CFG_l: 0x%x, CFG_h: 0x%x\n", i, l, h);
+
                 l = hpet_readl(HPET_Tn_CMP(i));
                 h = hpet_readl(HPET_Tn_CMP(i)+4);
-                printk(KERN_INFO "hpet: T%d: CMP_l: 0x%x, CMP_h: 0x%x\n",
-                       i, l, h);
+                pr_info("T%d: CMP_l: 0x%x, CMP_h: 0x%x\n", i, l, h);
+
                 l = hpet_readl(HPET_Tn_ROUTE(i));
                 h = hpet_readl(HPET_Tn_ROUTE(i)+4);
-                printk(KERN_INFO "hpet: T%d ROUTE_l: 0x%x, ROUTE_h: 0x%x\n",
-                       i, l, h);
+                pr_info("T%d ROUTE_l: 0x%x, ROUTE_h: 0x%x\n", i, l, h);
         }
 }
 
@@ -172,31 +178,20 @@ do {								\
 } while (0)
 
 /*
- * When the hpet driver (/dev/hpet) is enabled, we need to reserve
+ * When the HPET driver (/dev/hpet) is enabled, we need to reserve
  * timer 0 and timer 1 in case of RTC emulation.
  */
 #ifdef CONFIG_HPET
 
-static void hpet_reserve_msi_timers(struct hpet_data *hd);
-
-static void hpet_reserve_platform_timers(unsigned int id)
+static void __init hpet_reserve_platform_timers(void)
 {
-        struct hpet __iomem *hpet = hpet_virt_address;
-        struct hpet_timer __iomem *timer = &hpet->hpet_timers[2];
-        unsigned int nrtimers, i;
         struct hpet_data hd;
-
-        nrtimers = ((id & HPET_ID_NUMBER) >> HPET_ID_NUMBER_SHIFT) + 1;
+        unsigned int i;
 
         memset(&hd, 0, sizeof(hd));
         hd.hd_phys_address      = hpet_address;
-        hd.hd_address           = hpet;
-        hd.hd_nirqs             = nrtimers;
-        hpet_reserve_timer(&hd, 0);
-
-#ifdef CONFIG_HPET_EMULATE_RTC
-        hpet_reserve_timer(&hd, 1);
-#endif
+        hd.hd_address           = hpet_virt_address;
+        hd.hd_nirqs             = hpet_base.nr_channels;
 
         /*
          * NOTE that hd_irq[] reflects IOAPIC input pins (LEGACY_8254
@@ -206,30 +201,52 @@ static void hpet_reserve_platform_timers(unsigned int id)
         hd.hd_irq[0] = HPET_LEGACY_8254;
         hd.hd_irq[1] = HPET_LEGACY_RTC;
 
-        for (i = 2; i < nrtimers; timer++, i++) {
-                hd.hd_irq[i] = (readl(&timer->hpet_config) &
-                        Tn_INT_ROUTE_CNF_MASK) >> Tn_INT_ROUTE_CNF_SHIFT;
-        }
+        for (i = 0; i < hpet_base.nr_channels; i++) {
+                struct hpet_channel *hc = hpet_base.channels + i;
+
+                if (i >= 2)
+                        hd.hd_irq[i] = hc->irq;
 
-        hpet_reserve_msi_timers(&hd);
+                switch (hc->mode) {
+                case HPET_MODE_UNUSED:
+                case HPET_MODE_DEVICE:
+                        hc->mode = HPET_MODE_DEVICE;
+                        break;
+                case HPET_MODE_CLOCKEVT:
+                case HPET_MODE_LEGACY:
+                        hpet_reserve_timer(&hd, hc->num);
+                        break;
+                }
+        }
 
         hpet_alloc(&hd);
+}
 
+static void __init hpet_select_device_channel(void)
+{
+        int i;
+
+        for (i = 0; i < hpet_base.nr_channels; i++) {
+                struct hpet_channel *hc = hpet_base.channels + i;
+
+                /* Associate the first unused channel to /dev/hpet */
+                if (hc->mode == HPET_MODE_UNUSED) {
+                        hc->mode = HPET_MODE_DEVICE;
+                        return;
+                }
+        }
 }
+
 #else
-static void hpet_reserve_platform_timers(unsigned int id) { }
+static inline void hpet_reserve_platform_timers(void) { }
+static inline void hpet_select_device_channel(void) {}
 #endif
 
-/*
- * Common hpet info
- */
-static unsigned long hpet_freq;
-
-static struct clock_event_device hpet_clockevent;
-
+/* Common HPET functions */
 static void hpet_stop_counter(void)
 {
         u32 cfg = hpet_readl(HPET_CFG);
+
         cfg &= ~HPET_CFG_ENABLE;
         hpet_writel(cfg, HPET_CFG);
 }
@@ -243,6 +260,7 @@ static void hpet_reset_counter(void)
 static void hpet_start_counter(void)
 {
         unsigned int cfg = hpet_readl(HPET_CFG);
+
         cfg |= HPET_CFG_ENABLE;
         hpet_writel(cfg, HPET_CFG);
 }
@@ -274,24 +292,9 @@ static void hpet_enable_legacy_int(void)
         hpet_legacy_int_enabled = true;
 }
 
-static void hpet_legacy_clockevent_register(void)
-{
-        /* Start HPET legacy interrupts */
-        hpet_enable_legacy_int();
-
-        /*
-         * Start hpet with the boot cpu mask and make it
-         * global after the IO_APIC has been initialized.
-         */
-        hpet_clockevent.cpumask = cpumask_of(boot_cpu_data.cpu_index);
-        clockevents_config_and_register(&hpet_clockevent, hpet_freq,
-                                        HPET_MIN_PROG_DELTA, 0x7FFFFFFF);
-        global_clock_event = &hpet_clockevent;
-        printk(KERN_DEBUG "hpet clockevent registered\n");
-}
-
-static int hpet_set_periodic(struct clock_event_device *evt, int timer)
+static int hpet_clkevt_set_state_periodic(struct clock_event_device *evt)
 {
+        unsigned int channel = clockevent_to_channel(evt)->num;
         unsigned int cfg, cmp, now;
         uint64_t delta;
 
@@ -300,11 +303,11 @@ static int hpet_set_periodic(struct clock_event_device *evt, int timer)
         delta >>= evt->shift;
         now = hpet_readl(HPET_COUNTER);
         cmp = now + (unsigned int)delta;
-        cfg = hpet_readl(HPET_Tn_CFG(timer));
+        cfg = hpet_readl(HPET_Tn_CFG(channel));
         cfg |= HPET_TN_ENABLE | HPET_TN_PERIODIC | HPET_TN_SETVAL |
                HPET_TN_32BIT;
-        hpet_writel(cfg, HPET_Tn_CFG(timer));
-        hpet_writel(cmp, HPET_Tn_CMP(timer));
+        hpet_writel(cfg, HPET_Tn_CFG(channel));
+        hpet_writel(cmp, HPET_Tn_CMP(channel));
         udelay(1);
         /*
          * HPET on AMD 81xx needs a second write (with HPET_TN_SETVAL
@@ -313,52 +316,55 @@ static int hpet_set_periodic(struct clock_event_device *evt, int timer)
          * (See AMD-8111 HyperTransport I/O Hub Data Sheet,
          * Publication # 24674)
          */
-        hpet_writel((unsigned int)delta, HPET_Tn_CMP(timer));
+        hpet_writel((unsigned int)delta, HPET_Tn_CMP(channel));
         hpet_start_counter();
         hpet_print_config();
 
         return 0;
 }
 
-static int hpet_set_oneshot(struct clock_event_device *evt, int timer)
+static int hpet_clkevt_set_state_oneshot(struct clock_event_device *evt)
 {
+        unsigned int channel = clockevent_to_channel(evt)->num;
         unsigned int cfg;
 
-        cfg = hpet_readl(HPET_Tn_CFG(timer));
+        cfg = hpet_readl(HPET_Tn_CFG(channel));
         cfg &= ~HPET_TN_PERIODIC;
         cfg |= HPET_TN_ENABLE | HPET_TN_32BIT;
-        hpet_writel(cfg, HPET_Tn_CFG(timer));
+        hpet_writel(cfg, HPET_Tn_CFG(channel));
 
         return 0;
 }
 
-static int hpet_shutdown(struct clock_event_device *evt, int timer)
+static int hpet_clkevt_set_state_shutdown(struct clock_event_device *evt)
 {
+        unsigned int channel = clockevent_to_channel(evt)->num;
         unsigned int cfg;
 
-        cfg = hpet_readl(HPET_Tn_CFG(timer));
+        cfg = hpet_readl(HPET_Tn_CFG(channel));
         cfg &= ~HPET_TN_ENABLE;
-        hpet_writel(cfg, HPET_Tn_CFG(timer));
+        hpet_writel(cfg, HPET_Tn_CFG(channel));
 
         return 0;
 }
 
-static int hpet_resume(struct clock_event_device *evt)
+static int hpet_clkevt_legacy_resume(struct clock_event_device *evt)
 {
         hpet_enable_legacy_int();
         hpet_print_config();
         return 0;
 }
 
-static int hpet_next_event(unsigned long delta,
-                           struct clock_event_device *evt, int timer)
+static int
+hpet_clkevt_set_next_event(unsigned long delta, struct clock_event_device *evt)
 {
+        unsigned int channel = clockevent_to_channel(evt)->num;
         u32 cnt;
         s32 res;
 
         cnt = hpet_readl(HPET_COUNTER);
         cnt += (u32) delta;
-        hpet_writel(cnt, HPET_Tn_CMP(timer));
+        hpet_writel(cnt, HPET_Tn_CMP(channel));
 
         /*
          * HPETs are a complete disaster. The compare register is
@@ -387,360 +393,250 @@ static int hpet_next_event(unsigned long delta,
         return res < HPET_MIN_CYCLES ? -ETIME : 0;
 }
 
-static int hpet_legacy_shutdown(struct clock_event_device *evt)
+static void hpet_init_clockevent(struct hpet_channel *hc, unsigned int rating)
 {
-        return hpet_shutdown(evt, 0);
-}
+        struct clock_event_device *evt = &hc->evt;
 
-static int hpet_legacy_set_oneshot(struct clock_event_device *evt)
-{
-        return hpet_set_oneshot(evt, 0);
-}
+        evt->rating             = rating;
+        evt->irq                = hc->irq;
+        evt->name               = hc->name;
+        evt->cpumask            = cpumask_of(hc->cpu);
+        evt->set_state_oneshot  = hpet_clkevt_set_state_oneshot;
+        evt->set_next_event     = hpet_clkevt_set_next_event;
+        evt->set_state_shutdown = hpet_clkevt_set_state_shutdown;
 
-static int hpet_legacy_set_periodic(struct clock_event_device *evt)
-{
-        return hpet_set_periodic(evt, 0);
+        evt->features = CLOCK_EVT_FEAT_ONESHOT;
+        if (hc->boot_cfg & HPET_TN_PERIODIC) {
+                evt->features           |= CLOCK_EVT_FEAT_PERIODIC;
+                evt->set_state_periodic = hpet_clkevt_set_state_periodic;
+        }
 }
 
-static int hpet_legacy_resume(struct clock_event_device *evt)
+static void __init hpet_legacy_clockevent_register(struct hpet_channel *hc)
 {
-        return hpet_resume(evt);
-}
+        /*
+         * Start HPET with the boot CPU's cpumask and make it global after
+         * the IO_APIC has been initialized.
+         */
+        hc->cpu = boot_cpu_data.cpu_index;
+        strncpy(hc->name, "hpet", sizeof(hc->name));
+        hpet_init_clockevent(hc, 50);
 
-static int hpet_legacy_next_event(unsigned long delta,
-                        struct clock_event_device *evt)
-{
-        return hpet_next_event(delta, evt, 0);
-}
+        hc->evt.tick_resume     = hpet_clkevt_legacy_resume;
 
-/*
- * The hpet clock event device
- */
-static struct clock_event_device hpet_clockevent = {
-        .name                   = "hpet",
-        .features               = CLOCK_EVT_FEAT_PERIODIC |
-                                  CLOCK_EVT_FEAT_ONESHOT,
-        .set_state_periodic     = hpet_legacy_set_periodic,
-        .set_state_oneshot      = hpet_legacy_set_oneshot,
-        .set_state_shutdown     = hpet_legacy_shutdown,
-        .tick_resume            = hpet_legacy_resume,
-        .set_next_event         = hpet_legacy_next_event,
-        .irq                    = 0,
-        .rating                 = 50,
-};
+        /*
+         * Legacy horrors and sins from the past. HPET used periodic mode
+         * unconditionally forever on the legacy channel 0. Removing the
+         * below hack and using the conditional in hpet_init_clockevent()
+         * makes at least Qemu and one hardware machine fail to boot.
+         * There are two issues which cause the boot failure:
+         *
+         * #1 After the timer delivery test in IOAPIC and the IOAPIC setup
+         *    the next interrupt is not delivered despite the HPET channel
+         *    being programmed correctly. Reprogramming the HPET after
+         *    switching to IOAPIC makes it work again. After fixing this,
+         *    the next issue surfaces:
+         *
+         * #2 Due to the unconditional periodic mode availability the Local
+         *    APIC timer calibration can hijack the global clockevents
+         *    event handler without causing damage. Using oneshot at this
+         *    stage makes if hang because the HPET does not get
+         *    reprogrammed due to the handler hijacking. Duh, stupid me!
+         *
+         * Both issues require major surgery and especially the kick HPET
+         * again after enabling IOAPIC results in really nasty hackery.
+         * This 'assume periodic works' magic has survived since HPET
+         * support got added, so it's questionable whether this should be
+         * fixed. Both Qemu and the failing hardware machine support
+         * periodic mode despite the fact that both don't advertise it in
+         * the configuration register and both need that extra kick after
+         * switching to IOAPIC. Seems to be a feature...
+         */
+        hc->evt.features                |= CLOCK_EVT_FEAT_PERIODIC;
+        hc->evt.set_state_periodic      = hpet_clkevt_set_state_periodic;
+
+        /* Start HPET legacy interrupts */
+        hpet_enable_legacy_int();
+
+        clockevents_config_and_register(&hc->evt, hpet_freq,
+                                        HPET_MIN_PROG_DELTA, 0x7FFFFFFF);
+        global_clock_event = &hc->evt;
+        pr_debug("Clockevent registered\n");
+}
 
 /*
  * HPET MSI Support
  */
 #ifdef CONFIG_PCI_MSI
 
-static DEFINE_PER_CPU(struct hpet_dev *, cpu_hpet_dev);
-static struct hpet_dev  *hpet_devs;
-static struct irq_domain *hpet_domain;
-
 void hpet_msi_unmask(struct irq_data *data)
 {
-        struct hpet_dev *hdev = irq_data_get_irq_handler_data(data);
+        struct hpet_channel *hc = irq_data_get_irq_handler_data(data);
         unsigned int cfg;
 
-        /* unmask it */
-        cfg = hpet_readl(HPET_Tn_CFG(hdev->num));
+        cfg = hpet_readl(HPET_Tn_CFG(hc->num));
         cfg |= HPET_TN_ENABLE | HPET_TN_FSB;
-        hpet_writel(cfg, HPET_Tn_CFG(hdev->num));
+        hpet_writel(cfg, HPET_Tn_CFG(hc->num));
 }
 
 void hpet_msi_mask(struct irq_data *data)
 {
-        struct hpet_dev *hdev = irq_data_get_irq_handler_data(data);
+        struct hpet_channel *hc = irq_data_get_irq_handler_data(data);
         unsigned int cfg;
 
-        /* mask it */
-        cfg = hpet_readl(HPET_Tn_CFG(hdev->num));
+        cfg = hpet_readl(HPET_Tn_CFG(hc->num));
         cfg &= ~(HPET_TN_ENABLE | HPET_TN_FSB);
-        hpet_writel(cfg, HPET_Tn_CFG(hdev->num));
-}
-
-void hpet_msi_write(struct hpet_dev *hdev, struct msi_msg *msg)
-{
-        hpet_writel(msg->data, HPET_Tn_ROUTE(hdev->num));
-        hpet_writel(msg->address_lo, HPET_Tn_ROUTE(hdev->num) + 4);
+        hpet_writel(cfg, HPET_Tn_CFG(hc->num));
 }
 
-void hpet_msi_read(struct hpet_dev *hdev, struct msi_msg *msg)
+void hpet_msi_write(struct hpet_channel *hc, struct msi_msg *msg)
 {
-        msg->data = hpet_readl(HPET_Tn_ROUTE(hdev->num));
-        msg->address_lo = hpet_readl(HPET_Tn_ROUTE(hdev->num) + 4);
-        msg->address_hi = 0;
+        hpet_writel(msg->data, HPET_Tn_ROUTE(hc->num));
+        hpet_writel(msg->address_lo, HPET_Tn_ROUTE(hc->num) + 4);
 }
 
-static int hpet_msi_shutdown(struct clock_event_device *evt)
+static int hpet_clkevt_msi_resume(struct clock_event_device *evt)
 {
-        struct hpet_dev *hdev = EVT_TO_HPET_DEV(evt);
-
-        return hpet_shutdown(evt, hdev->num);
-}
-
-static int hpet_msi_set_oneshot(struct clock_event_device *evt)
-{
-        struct hpet_dev *hdev = EVT_TO_HPET_DEV(evt);
-
-        return hpet_set_oneshot(evt, hdev->num);
-}
-
-static int hpet_msi_set_periodic(struct clock_event_device *evt)
-{
-        struct hpet_dev *hdev = EVT_TO_HPET_DEV(evt);
-
-        return hpet_set_periodic(evt, hdev->num);
-}
-
-static int hpet_msi_resume(struct clock_event_device *evt)
-{
-        struct hpet_dev *hdev = EVT_TO_HPET_DEV(evt);
-        struct irq_data *data = irq_get_irq_data(hdev->irq);
+        struct hpet_channel *hc = clockevent_to_channel(evt);
+        struct irq_data *data = irq_get_irq_data(hc->irq);
         struct msi_msg msg;
 
         /* Restore the MSI msg and unmask the interrupt */
         irq_chip_compose_msi_msg(data, &msg);
-        hpet_msi_write(hdev, &msg);
+        hpet_msi_write(hc, &msg);
         hpet_msi_unmask(data);
         return 0;
 }
 
-static int hpet_msi_next_event(unsigned long delta,
-                                struct clock_event_device *evt)
-{
-        struct hpet_dev *hdev = EVT_TO_HPET_DEV(evt);
-        return hpet_next_event(delta, evt, hdev->num);
-}
-
-static irqreturn_t hpet_interrupt_handler(int irq, void *data)
+static irqreturn_t hpet_msi_interrupt_handler(int irq, void *data)
 {
-        struct hpet_dev *dev = (struct hpet_dev *)data;
-        struct clock_event_device *hevt = &dev->evt;
+        struct hpet_channel *hc = data;
+        struct clock_event_device *evt = &hc->evt;
 
-        if (!hevt->event_handler) {
-                printk(KERN_INFO "Spurious HPET timer interrupt on HPET timer %d\n",
-                                dev->num);
+        if (!evt->event_handler) {
+                pr_info("Spurious interrupt HPET channel %d\n", hc->num);
                 return IRQ_HANDLED;
         }
 
-        hevt->event_handler(hevt);
+        evt->event_handler(evt);
         return IRQ_HANDLED;
 }
 
-static int hpet_setup_irq(struct hpet_dev *dev)
+static int hpet_setup_msi_irq(struct hpet_channel *hc)
 {
-
-        if (request_irq(dev->irq, hpet_interrupt_handler,
+        if (request_irq(hc->irq, hpet_msi_interrupt_handler,
                         IRQF_TIMER | IRQF_NOBALANCING,
-                        dev->name, dev))
+                        hc->name, hc))
                 return -1;
 
-        disable_irq(dev->irq);
-        irq_set_affinity(dev->irq, cpumask_of(dev->cpu));
-        enable_irq(dev->irq);
+        disable_irq(hc->irq);
+        irq_set_affinity(hc->irq, cpumask_of(hc->cpu));
+        enable_irq(hc->irq);
 
-        printk(KERN_DEBUG "hpet: %s irq %d for MSI\n",
-                         dev->name, dev->irq);
+        pr_debug("%s irq %u for MSI\n", hc->name, hc->irq);
 
         return 0;
 }
 
-/* This should be called in specific @cpu */
-static void init_one_hpet_msi_clockevent(struct hpet_dev *hdev, int cpu)
+/* Invoked from the hotplug callback on @cpu */
+static void init_one_hpet_msi_clockevent(struct hpet_channel *hc, int cpu)
 {
-        struct clock_event_device *evt = &hdev->evt;
-
-        WARN_ON(cpu != smp_processor_id());
-        if (!(hdev->flags & HPET_DEV_VALID))
-                return;
-
-        hdev->cpu = cpu;
-        per_cpu(cpu_hpet_dev, cpu) = hdev;
-        evt->name = hdev->name;
-        hpet_setup_irq(hdev);
-        evt->irq = hdev->irq;
+        struct clock_event_device *evt = &hc->evt;
 
-        evt->rating = 110;
-        evt->features = CLOCK_EVT_FEAT_ONESHOT;
-        if (hdev->flags & HPET_DEV_PERI_CAP) {
-                evt->features |= CLOCK_EVT_FEAT_PERIODIC;
-                evt->set_state_periodic = hpet_msi_set_periodic;
-        }
+        hc->cpu = cpu;
+        per_cpu(cpu_hpet_channel, cpu) = hc;
+        hpet_setup_msi_irq(hc);
 
-        evt->set_state_shutdown = hpet_msi_shutdown;
-        evt->set_state_oneshot = hpet_msi_set_oneshot;
-        evt->tick_resume = hpet_msi_resume;
-        evt->set_next_event = hpet_msi_next_event;
-        evt->cpumask = cpumask_of(hdev->cpu);
+        hpet_init_clockevent(hc, 110);
+        evt->tick_resume = hpet_clkevt_msi_resume;
 
         clockevents_config_and_register(evt, hpet_freq, HPET_MIN_PROG_DELTA,
                                         0x7FFFFFFF);
 }
 
-#ifdef CONFIG_HPET
-/* Reserve at least one timer for userspace (/dev/hpet) */
-#define RESERVE_TIMERS 1
-#else
-#define RESERVE_TIMERS 0
-#endif
-
-static void hpet_msi_capability_lookup(unsigned int start_timer)
+static struct hpet_channel *hpet_get_unused_clockevent(void)
 {
-        unsigned int id;
-        unsigned int num_timers;
-        unsigned int num_timers_used = 0;
-        int i, irq;
-
-        if (hpet_msi_disable)
-                return;
-
-        if (boot_cpu_has(X86_FEATURE_ARAT))
-                return;
-        id = hpet_readl(HPET_ID);
-
-        num_timers = ((id & HPET_ID_NUMBER) >> HPET_ID_NUMBER_SHIFT);
-        num_timers++; /* Value read out starts from 0 */
-        hpet_print_config();
-
-        hpet_domain = hpet_create_irq_domain(hpet_blockid);
-        if (!hpet_domain)
-                return;
-
-        hpet_devs = kcalloc(num_timers, sizeof(struct hpet_dev), GFP_KERNEL);
-        if (!hpet_devs)
-                return;
-
-        hpet_num_timers = num_timers;
-
-        for (i = start_timer; i < num_timers - RESERVE_TIMERS; i++) {
-                struct hpet_dev *hdev = &hpet_devs[num_timers_used];
-                unsigned int cfg = hpet_readl(HPET_Tn_CFG(i));
-
-                /* Only consider HPET timer with MSI support */
-                if (!(cfg & HPET_TN_FSB_CAP))
-                        continue;
+        int i;
 
-                hdev->flags = 0;
-                if (cfg & HPET_TN_PERIODIC_CAP)
-                        hdev->flags |= HPET_DEV_PERI_CAP;
-                sprintf(hdev->name, "hpet%d", i);
-                hdev->num = i;
+        for (i = 0; i < hpet_base.nr_channels; i++) {
+                struct hpet_channel *hc = hpet_base.channels + i;
 
-                irq = hpet_assign_irq(hpet_domain, hdev, hdev->num);
-                if (irq <= 0)
+                if (hc->mode != HPET_MODE_CLOCKEVT || hc->in_use)
                         continue;
-
-                hdev->irq = irq;
-                hdev->flags |= HPET_DEV_FSB_CAP;
-                hdev->flags |= HPET_DEV_VALID;
-                num_timers_used++;
-                if (num_timers_used == num_possible_cpus())
-                        break;
+                hc->in_use = 1;
+                return hc;
         }
-
-        printk(KERN_INFO "HPET: %d timers in total, %d timers will be used for per-cpu timer\n",
-                num_timers, num_timers_used);
+        return NULL;
 }
 
-#ifdef CONFIG_HPET
-static void hpet_reserve_msi_timers(struct hpet_data *hd)
+static int hpet_cpuhp_online(unsigned int cpu)
 {
-        int i;
-
-        if (!hpet_devs)
-                return;
+        struct hpet_channel *hc = hpet_get_unused_clockevent();
 
-        for (i = 0; i < hpet_num_timers; i++) {
-                struct hpet_dev *hdev = &hpet_devs[i];
+        if (hc)
+                init_one_hpet_msi_clockevent(hc, cpu);
+        return 0;
+}
 
-                if (!(hdev->flags & HPET_DEV_VALID))
-                        continue;
+static int hpet_cpuhp_dead(unsigned int cpu)
+{
+        struct hpet_channel *hc = per_cpu(cpu_hpet_channel, cpu);
 
-                hd->hd_irq[hdev->num] = hdev->irq;
-                hpet_reserve_timer(hd, hdev->num);
-        }
+        if (!hc)
+                return 0;
+        free_irq(hc->irq, hc);
+        hc->in_use = 0;
+        per_cpu(cpu_hpet_channel, cpu) = NULL;
+        return 0;
 }
-#endif
 
-static struct hpet_dev *hpet_get_unused_timer(void)
+static void __init hpet_select_clockevents(void)
 {
-        int i;
+        unsigned int i;
 
-        if (!hpet_devs)
-                return NULL;
+        hpet_base.nr_clockevents = 0;
 
-        for (i = 0; i < hpet_num_timers; i++) {
-                struct hpet_dev *hdev = &hpet_devs[i];
+        /* No point if MSI is disabled or CPU has an Always Runing APIC Timer */
+        if (hpet_msi_disable || boot_cpu_has(X86_FEATURE_ARAT))
+                return;
 
-                if (!(hdev->flags & HPET_DEV_VALID))
-                        continue;
-                if (test_and_set_bit(HPET_DEV_USED_BIT,
-                        (unsigned long *)&hdev->flags))
-                        continue;
-                return hdev;
-        }
-        return NULL;
-}
+        hpet_print_config();
 
-struct hpet_work_struct {
-        struct delayed_work work;
-        struct completion complete;
-};
+        hpet_domain = hpet_create_irq_domain(hpet_blockid);
+        if (!hpet_domain)
+                return;
 
-static void hpet_work(struct work_struct *w)
-{
-        struct hpet_dev *hdev;
-        int cpu = smp_processor_id();
-        struct hpet_work_struct *hpet_work;
+        for (i = 0; i < hpet_base.nr_channels; i++) {
+                struct hpet_channel *hc = hpet_base.channels + i;
+                int irq;
 
-        hpet_work = container_of(w, struct hpet_work_struct, work.work);
+                if (hc->mode != HPET_MODE_UNUSED)
+                        continue;
 
-        hdev = hpet_get_unused_timer();
-        if (hdev)
-                init_one_hpet_msi_clockevent(hdev, cpu);
+                /* Only consider HPET channel with MSI support */
+                if (!(hc->boot_cfg & HPET_TN_FSB_CAP))
+                        continue;
 
-        complete(&hpet_work->complete);
-}
+                sprintf(hc->name, "hpet%d", i);
 
-static int hpet_cpuhp_online(unsigned int cpu)
-{
-        struct hpet_work_struct work;
-
-        INIT_DELAYED_WORK_ONSTACK(&work.work, hpet_work);
-        init_completion(&work.complete);
-        /* FIXME: add schedule_work_on() */
-        schedule_delayed_work_on(cpu, &work.work, 0);
-        wait_for_completion(&work.complete);
-        destroy_delayed_work_on_stack(&work.work);
-        return 0;
-}
+                irq = hpet_assign_irq(hpet_domain, hc, hc->num);
+                if (irq <= 0)
+                        continue;
 
-static int hpet_cpuhp_dead(unsigned int cpu)
-{
-        struct hpet_dev *hdev = per_cpu(cpu_hpet_dev, cpu);
+                hc->irq = irq;
+                hc->mode = HPET_MODE_CLOCKEVT;
 
-        if (!hdev)
-                return 0;
-        free_irq(hdev->irq, hdev);
-        hdev->flags &= ~HPET_DEV_USED;
-        per_cpu(cpu_hpet_dev, cpu) = NULL;
-        return 0;
-}
-#else
+                if (++hpet_base.nr_clockevents == num_possible_cpus())
+                        break;
+        }
 
-static void hpet_msi_capability_lookup(unsigned int start_timer)
-{
-        return;
+        pr_info("%d channels of %d reserved for per-cpu timers\n",
+                hpet_base.nr_channels, hpet_base.nr_clockevents);
 }
 
-#ifdef CONFIG_HPET
-static void hpet_reserve_msi_timers(struct hpet_data *hd)
-{
-        return;
-}
-#endif
+#else
+
+static inline void hpet_select_clockevents(void) { }
 
 #define hpet_cpuhp_online       NULL
 #define hpet_cpuhp_dead         NULL
@@ -754,10 +650,10 @@ static void hpet_reserve_msi_timers(struct hpet_data *hd)
 /*
  * Reading the HPET counter is a very slow operation. If a large number of
  * CPUs are trying to access the HPET counter simultaneously, it can cause
- * massive delay and slow down system performance dramatically. This may
+ * massive delays and slow down system performance dramatically. This may
  * happen when HPET is the default clock source instead of TSC. For a
  * really large system with hundreds of CPUs, the slowdown may be so
- * severe that it may actually crash the system because of a NMI watchdog
+ * severe, that it can actually crash the system because of a NMI watchdog
  * soft lockup, for example.
  *
  * If multiple CPUs are trying to access the HPET counter at the same time,
@@ -766,10 +662,9 @@ static void hpet_reserve_msi_timers(struct hpet_data *hd)
  *
  * This special feature is only enabled on x86-64 systems. It is unlikely
  * that 32-bit x86 systems will have enough CPUs to require this feature
- * with its associated locking overhead. And we also need 64-bit atomic
- * read.
+ * with its associated locking overhead. We also need 64-bit atomic read.
  *
- * The lock and the hpet value are stored together and can be read in a
+ * The lock and the HPET value are stored together and can be read in a
  * single atomic 64-bit read. It is explicitly assumed that arch_spinlock_t
  * is 32 bits in size.
  */
@@ -858,15 +753,40 @@ static struct clocksource clocksource_hpet = {
         .resume         = hpet_resume_counter,
 };
 
-static int hpet_clocksource_register(void)
+/*
+ * AMD SB700 based systems with spread spectrum enabled use a SMM based
+ * HPET emulation to provide proper frequency setting.
+ *
+ * On such systems the SMM code is initialized with the first HPET register
+ * access and takes some time to complete. During this time the config
+ * register reads 0xffffffff. We check for max 1000 loops whether the
+ * config register reads a non-0xffffffff value to make sure that the
+ * HPET is up and running before we proceed any further.
+ *
+ * A counting loop is safe, as the HPET access takes thousands of CPU cycles.
+ *
+ * On non-SB700 based machines this check is only done once and has no
+ * side effects.
+ */
+static bool __init hpet_cfg_working(void)
 {
-        u64 start, now;
-        u64 t1;
+        int i;
+
+        for (i = 0; i < 1000; i++) {
+                if (hpet_readl(HPET_CFG) != 0xFFFFFFFF)
+                        return true;
+        }
+
+        pr_warn("Config register invalid. Disabling HPET\n");
+        return false;
+}
+
+static bool __init hpet_counting(void)
+{
+        u64 start, now, t1;
 
-        /* Start the counter */
         hpet_restart_counter();
 
-        /* Verify whether hpet counter works */
         t1 = hpet_readl(HPET_COUNTER);
         start = rdtsc();
 
@@ -877,30 +797,24 @@ static int hpet_clocksource_register(void)
          * 1 GHz == 200us
          */
         do {
-                rep_nop();
+                if (t1 != hpet_readl(HPET_COUNTER))
+                        return true;
                 now = rdtsc();
         } while ((now - start) < 200000UL);
 
-        if (t1 == hpet_readl(HPET_COUNTER)) {
-                printk(KERN_WARNING
-                       "HPET counter not counting. HPET disabled\n");
-                return -ENODEV;
-        }
-
-        clocksource_register_hz(&clocksource_hpet, (u32)hpet_freq);
-        return 0;
+        pr_warn("Counter not counting. HPET disabled\n");
+        return false;
 }
 
-static u32 *hpet_boot_cfg;
-
 /**
  * hpet_enable - Try to setup the HPET timer. Returns 1 on success.
  */
 int __init hpet_enable(void)
 {
-        u32 hpet_period, cfg, id;
+        u32 hpet_period, cfg, id, irq;
+        unsigned int i, channels;
+        struct hpet_channel *hc;
         u64 freq;
-        unsigned int i, last;
 
         if (!is_hpet_capable())
                 return 0;
@@ -909,40 +823,22 @@ int __init hpet_enable(void)
         if (!hpet_virt_address)
                 return 0;
 
+        /* Validate that the config register is working */
+        if (!hpet_cfg_working())
+                goto out_nohpet;
+
+        /* Validate that the counter is counting */
+        if (!hpet_counting())
+                goto out_nohpet;
+
         /*
          * Read the period and check for a sane value:
          */
         hpet_period = hpet_readl(HPET_PERIOD);
-
-        /*
-         * AMD SB700 based systems with spread spectrum enabled use a
-         * SMM based HPET emulation to provide proper frequency
-         * setting. The SMM code is initialized with the first HPET
-         * register access and takes some time to complete. During
-         * this time the config register reads 0xffffffff. We check
-         * for max. 1000 loops whether the config register reads a non
-         * 0xffffffff value to make sure that HPET is up and running
-         * before we go further. A counting loop is safe, as the HPET
-         * access takes thousands of CPU cycles. On non SB700 based
-         * machines this check is only done once and has no side
-         * effects.
-         */
-        for (i = 0; hpet_readl(HPET_CFG) == 0xFFFFFFFF; i++) {
-                if (i == 1000) {
-                        printk(KERN_WARNING
-                               "HPET config register value = 0xFFFFFFFF. "
-                               "Disabling HPET\n");
-                        goto out_nohpet;
-                }
-        }
-
         if (hpet_period < HPET_MIN_PERIOD || hpet_period > HPET_MAX_PERIOD)
                 goto out_nohpet;
 
-        /*
-         * The period is a femto seconds value. Convert it to a
-         * frequency.
-         */
+        /* The period is a femtoseconds value. Convert it to a frequency. */
         freq = FSEC_PER_SEC;
         do_div(freq, hpet_period);
         hpet_freq = freq;
@@ -954,72 +850,90 @@ int __init hpet_enable(void)
         id = hpet_readl(HPET_ID);
         hpet_print_config();
 
-        last = (id & HPET_ID_NUMBER) >> HPET_ID_NUMBER_SHIFT;
+        /* This is the HPET channel number which is zero based */
+        channels = ((id & HPET_ID_NUMBER) >> HPET_ID_NUMBER_SHIFT) + 1;
 
-#ifdef CONFIG_HPET_EMULATE_RTC
         /*
          * The legacy routing mode needs at least two channels, tick timer
          * and the rtc emulation channel.
          */
-        if (!last)
+        if (IS_ENABLED(CONFIG_HPET_EMULATE_RTC) && channels < 2)
                 goto out_nohpet;
-#endif
 
+        hc = kcalloc(channels, sizeof(*hc), GFP_KERNEL);
+        if (!hc) {
+                pr_warn("Disabling HPET.\n");
+                goto out_nohpet;
+        }
+        hpet_base.channels = hc;
+        hpet_base.nr_channels = channels;
+
+        /* Read, store and sanitize the global configuration */
         cfg = hpet_readl(HPET_CFG);
-        hpet_boot_cfg = kmalloc_array(last + 2, sizeof(*hpet_boot_cfg),
-                                      GFP_KERNEL);
-        if (hpet_boot_cfg)
-                *hpet_boot_cfg = cfg;
-        else
-                pr_warn("HPET initial state will not be saved\n");
+        hpet_base.boot_cfg = cfg;
         cfg &= ~(HPET_CFG_ENABLE | HPET_CFG_LEGACY);
         hpet_writel(cfg, HPET_CFG);
         if (cfg)
-                pr_warn("Unrecognized bits %#x set in global cfg\n", cfg);
+                pr_warn("Global config: Unknown bits %#x\n", cfg);
+
+        /* Read, store and sanitize the per channel configuration */
+        for (i = 0; i < channels; i++, hc++) {
+                hc->num = i;
 
-        for (i = 0; i <= last; ++i) {
                 cfg = hpet_readl(HPET_Tn_CFG(i));
-                if (hpet_boot_cfg)
-                        hpet_boot_cfg[i + 1] = cfg;
+                hc->boot_cfg = cfg;
+                irq = (cfg & Tn_INT_ROUTE_CNF_MASK) >> Tn_INT_ROUTE_CNF_SHIFT;
+                hc->irq = irq;
+
                 cfg &= ~(HPET_TN_ENABLE | HPET_TN_LEVEL | HPET_TN_FSB);
                 hpet_writel(cfg, HPET_Tn_CFG(i));
+
                 cfg &= ~(HPET_TN_PERIODIC | HPET_TN_PERIODIC_CAP
                          | HPET_TN_64BIT_CAP | HPET_TN_32BIT | HPET_TN_ROUTE
                          | HPET_TN_FSB | HPET_TN_FSB_CAP);
                 if (cfg)
-                        pr_warn("Unrecognized bits %#x set in cfg#%u\n",
-                                cfg, i);
+                        pr_warn("Channel #%u config: Unknown bits %#x\n", i, cfg);
         }
         hpet_print_config();
 
-        if (hpet_clocksource_register())
-                goto out_nohpet;
+        clocksource_register_hz(&clocksource_hpet, (u32)hpet_freq);
 
         if (id & HPET_ID_LEGSUP) {
-                hpet_legacy_clockevent_register();
+                hpet_legacy_clockevent_register(&hpet_base.channels[0]);
+                hpet_base.channels[0].mode = HPET_MODE_LEGACY;
+                if (IS_ENABLED(CONFIG_HPET_EMULATE_RTC))
+                        hpet_base.channels[1].mode = HPET_MODE_LEGACY;
                 return 1;
         }
         return 0;
 
 out_nohpet:
+        kfree(hpet_base.channels);
+        hpet_base.channels = NULL;
+        hpet_base.nr_channels = 0;
         hpet_clear_mapping();
         hpet_address = 0;
         return 0;
 }
 
 /*
- * Needs to be late, as the reserve_timer code calls kalloc !
+ * The late initialization runs after the PCI quirks have been invoked
+ * which might have detected a system on which the HPET can be enforced.
+ *
+ * Also, the MSI machinery is not working yet when the HPET is initialized
+ * early.
  *
- * Not a problem on i386 as hpet_enable is called from late_time_init,
- * but on x86_64 it is necessary !
+ * If the HPET is enabled, then:
+ *
+ *  1) Reserve one channel for /dev/hpet if CONFIG_HPET=y
+ *  2) Reserve up to num_possible_cpus() channels as per CPU clockevents
+ *  3) Setup /dev/hpet if CONFIG_HPET=y
+ *  4) Register hotplug callbacks when clockevents are available
  */
 static __init int hpet_late_init(void)
 {
         int ret;
 
-        if (boot_hpet_disable)
-                return -ENODEV;
-
         if (!hpet_address) {
                 if (!force_hpet_address)
                         return -ENODEV;
@@ -1031,21 +945,14 @@ static __init int hpet_late_init(void)
         if (!hpet_virt_address)
                 return -ENODEV;
 
-        if (hpet_readl(HPET_ID) & HPET_ID_LEGSUP)
-                hpet_msi_capability_lookup(2);
-        else
-                hpet_msi_capability_lookup(0);
-
-        hpet_reserve_platform_timers(hpet_readl(HPET_ID));
+        hpet_select_device_channel();
+        hpet_select_clockevents();
+        hpet_reserve_platform_timers();
         hpet_print_config();
 
-        if (hpet_msi_disable)
+        if (!hpet_base.nr_clockevents)
                 return 0;
 
-        if (boot_cpu_has(X86_FEATURE_ARAT))
-                return 0;
-
-        /* This notifier should be called after workqueue is ready */
         ret = cpuhp_setup_state(CPUHP_AP_X86_HPET_ONLINE, "x86/hpet:online",
                                 hpet_cpuhp_online, NULL);
         if (ret)
@@ -1064,47 +971,47 @@ fs_initcall(hpet_late_init);
 
 void hpet_disable(void)
 {
-        if (is_hpet_capable() && hpet_virt_address) {
-                unsigned int cfg = hpet_readl(HPET_CFG), id, last;
-
-                if (hpet_boot_cfg)
-                        cfg = *hpet_boot_cfg;
-                else if (hpet_legacy_int_enabled) {
-                        cfg &= ~HPET_CFG_LEGACY;
-                        hpet_legacy_int_enabled = false;
-                }
-                cfg &= ~HPET_CFG_ENABLE;
-                hpet_writel(cfg, HPET_CFG);
+        unsigned int i;
+        u32 cfg;
 
-                if (!hpet_boot_cfg)
-                        return;
+        if (!is_hpet_capable() || !hpet_virt_address)
+                return;
 
-                id = hpet_readl(HPET_ID);
-                last = ((id & HPET_ID_NUMBER) >> HPET_ID_NUMBER_SHIFT);
+        /* Restore boot configuration with the enable bit cleared */
+        cfg = hpet_base.boot_cfg;
+        cfg &= ~HPET_CFG_ENABLE;
+        hpet_writel(cfg, HPET_CFG);
 
-                for (id = 0; id <= last; ++id)
-                        hpet_writel(hpet_boot_cfg[id + 1], HPET_Tn_CFG(id));
+        /* Restore the channel boot configuration */
+        for (i = 0; i < hpet_base.nr_channels; i++)
+                hpet_writel(hpet_base.channels[i].boot_cfg, HPET_Tn_CFG(i));
 
-                if (*hpet_boot_cfg & HPET_CFG_ENABLE)
-                        hpet_writel(*hpet_boot_cfg, HPET_CFG);
-        }
+        /* If the HPET was enabled at boot time, reenable it */
+        if (hpet_base.boot_cfg & HPET_CFG_ENABLE)
+                hpet_writel(hpet_base.boot_cfg, HPET_CFG);
 }
 
 #ifdef CONFIG_HPET_EMULATE_RTC
 
-/* HPET in LegacyReplacement Mode eats up RTC interrupt line. When, HPET
+/*
+ * HPET in LegacyReplacement mode eats up the RTC interrupt line. When HPET
  * is enabled, we support RTC interrupt functionality in software.
+ *
  * RTC has 3 kinds of interrupts:
- * 1) Update Interrupt - generate an interrupt, every sec, when RTC clock
- *    is updated
- * 2) Alarm Interrupt - generate an interrupt at a specific time of day
- * 3) Periodic Interrupt - generate periodic interrupt, with frequencies
- *    2Hz-8192Hz (2Hz-64Hz for non-root user) (all freqs in powers of 2)
- * (1) and (2) above are implemented using polling at a frequency of
- * 64 Hz. The exact frequency is a tradeoff between accuracy and interrupt
- * overhead. (DEFAULT_RTC_INT_FREQ)
- * For (3), we use interrupts at 64Hz or user specified periodic
- * frequency, whichever is higher.
+ *
+ *  1) Update Interrupt - generate an interrupt, every second, when the
+ *     RTC clock is updated
+ *  2) Alarm Interrupt - generate an interrupt at a specific time of day
+ *  3) Periodic Interrupt - generate periodic interrupt, with frequencies
+ *     2Hz-8192Hz (2Hz-64Hz for non-root user) (all frequencies in powers of 2)
+ *
+ * (1) and (2) above are implemented using polling at a frequency of 64 Hz:
+ * DEFAULT_RTC_INT_FREQ.
+ *
+ * The exact frequency is a tradeoff between accuracy and interrupt overhead.
+ *
+ * For (3), we use interrupts at 64 Hz, or the user specified periodic frequency,
+ * if it's higher.
  */
 #include <linux/mc146818rtc.h>
 #include <linux/rtc.h>
@@ -1125,7 +1032,7 @@ static unsigned long hpet_pie_limit;
 static rtc_irq_handler irq_handler;
 
 /*
- * Check that the hpet counter c1 is ahead of the c2
+ * Check that the HPET counter c1 is ahead of c2
  */
 static inline int hpet_cnt_ahead(u32 c1, u32 c2)
 {
@@ -1163,8 +1070,8 @@ void hpet_unregister_irq_handler(rtc_irq_handler handler)
 EXPORT_SYMBOL_GPL(hpet_unregister_irq_handler);
 
 /*
- * Timer 1 for RTC emulation. We use one shot mode, as periodic mode
- * is not supported by all HPET implementations for timer 1.
+ * Channel 1 for RTC emulation. We use one shot mode, as periodic mode
+ * is not supported by all HPET implementations for channel 1.
  *
  * hpet_rtc_timer_init() is called when the rtc is initialized.
  */
@@ -1177,10 +1084,11 @@ int hpet_rtc_timer_init(void)
                 return 0;
 
         if (!hpet_default_delta) {
+                struct clock_event_device *evt = &hpet_base.channels[0].evt;
                 uint64_t clc;
 
-                clc = (uint64_t) hpet_clockevent.mult * NSEC_PER_SEC;
-                clc >>= hpet_clockevent.shift + DEFAULT_RTC_SHIFT;
+                clc = (uint64_t) evt->mult * NSEC_PER_SEC;
+                clc >>= evt->shift + DEFAULT_RTC_SHIFT;
                 hpet_default_delta = clc;
         }
 
@@ -1209,6 +1117,7 @@ EXPORT_SYMBOL_GPL(hpet_rtc_timer_init);
 static void hpet_disable_rtc_channel(void)
 {
         u32 cfg = hpet_readl(HPET_T1_CFG);
+
         cfg &= ~HPET_TN_ENABLE;
         hpet_writel(cfg, HPET_T1_CFG);
 }
@@ -1250,8 +1159,7 @@ int hpet_set_rtc_irq_bit(unsigned long bit_mask)
 }
 EXPORT_SYMBOL_GPL(hpet_set_rtc_irq_bit);
 
-int hpet_set_alarm_time(unsigned char hrs, unsigned char min,
-                        unsigned char sec)
+int hpet_set_alarm_time(unsigned char hrs, unsigned char min, unsigned char sec)
 {
         if (!is_hpet_enabled())
                 return 0;
@@ -1271,15 +1179,18 @@ int hpet_set_periodic_freq(unsigned long freq)
         if (!is_hpet_enabled())
                 return 0;
 
-        if (freq <= DEFAULT_RTC_INT_FREQ)
+        if (freq <= DEFAULT_RTC_INT_FREQ) {
                 hpet_pie_limit = DEFAULT_RTC_INT_FREQ / freq;
-        else {
-                clc = (uint64_t) hpet_clockevent.mult * NSEC_PER_SEC;
+        } else {
+                struct clock_event_device *evt = &hpet_base.channels[0].evt;
+
+                clc = (uint64_t) evt->mult * NSEC_PER_SEC;
                 do_div(clc, freq);
-                clc >>= hpet_clockevent.shift;
+                clc >>= evt->shift;
                 hpet_pie_delta = clc;
                 hpet_pie_limit = 0;
         }
+
         return 1;
 }
 EXPORT_SYMBOL_GPL(hpet_set_periodic_freq);
@@ -1317,8 +1228,7 @@ static void hpet_rtc_timer_reinit(void)
                 if (hpet_rtc_flags & RTC_PIE)
                         hpet_pie_count += lost_ints;
                 if (printk_ratelimit())
-                        printk(KERN_WARNING "hpet1: lost %d rtc interrupts\n",
-                                lost_ints);
+                        pr_warn("Lost %d RTC interrupts\n", lost_ints);
         }
 }
 
@@ -1340,8 +1250,7 @@ irqreturn_t hpet_rtc_interrupt(int irq, void *dev_id)
                 hpet_prev_update_sec = curr_time.tm_sec;
         }
 
-        if (hpet_rtc_flags & RTC_PIE &&
-            ++hpet_pie_count >= hpet_pie_limit) {
+        if (hpet_rtc_flags & RTC_PIE && ++hpet_pie_count >= hpet_pie_limit) {
                 rtc_int_flag |= RTC_PF;
                 hpet_pie_count = 0;
         }
@@ -1350,7 +1259,7 @@ irqreturn_t hpet_rtc_interrupt(int irq, void *dev_id)
             (curr_time.tm_sec == hpet_alarm_time.tm_sec) &&
             (curr_time.tm_min == hpet_alarm_time.tm_min) &&
             (curr_time.tm_hour == hpet_alarm_time.tm_hour))
-                        rtc_int_flag |= RTC_AF;
+                rtc_int_flag |= RTC_AF;
 
         if (rtc_int_flag) {
                 rtc_int_flag |= (RTC_IRQF | (RTC_NUM_INTS << 8));
diff --git a/arch/x86/kernel/i8253.c b/arch/x86/kernel/i8253.c
index 0d307a657abb..2b7999a1a50a 100644
--- a/arch/x86/kernel/i8253.c
+++ b/arch/x86/kernel/i8253.c
@@ -8,6 +8,7 @@
 #include <linux/timex.h>
 #include <linux/i8253.h>
 
+#include <asm/apic.h>
 #include <asm/hpet.h>
 #include <asm/time.h>
 #include <asm/smp.h>
@@ -18,10 +19,32 @@
  */
 struct clock_event_device *global_clock_event;
 
-void __init setup_pit_timer(void)
+/*
+ * Modern chipsets can disable the PIT clock which makes it unusable. It
+ * would be possible to enable the clock but the registers are chipset
+ * specific and not discoverable. Avoid the whack a mole game.
+ *
+ * These platforms have discoverable TSC/CPU frequencies but this also
+ * requires to know the local APIC timer frequency as it normally is
+ * calibrated against the PIT interrupt.
+ */
+static bool __init use_pit(void)
+{
+        if (!IS_ENABLED(CONFIG_X86_TSC) || !boot_cpu_has(X86_FEATURE_TSC))
+                return true;
+
+        /* This also returns true when APIC is disabled */
+        return apic_needs_pit();
+}
+
+bool __init pit_timer_init(void)
 {
+        if (!use_pit())
+                return false;
+
         clockevent_i8253_init(true);
         global_clock_event = &i8253_clockevent;
+        return true;
 }
 
 #ifndef CONFIG_X86_64
diff --git a/arch/x86/kernel/idt.c b/arch/x86/kernel/idt.c
index d2482bbbe3d0..87ef69a72c52 100644
--- a/arch/x86/kernel/idt.c
+++ b/arch/x86/kernel/idt.c
@@ -319,7 +319,8 @@ void __init idt_setup_apic_and_irq_gates(void)
 #ifdef CONFIG_X86_LOCAL_APIC
         for_each_clear_bit_from(i, system_vectors, NR_VECTORS) {
                 set_bit(i, system_vectors);
-                set_intr_gate(i, spurious_interrupt);
+                entry = spurious_entries_start + 8 * (i - FIRST_SYSTEM_VECTOR);
+                set_intr_gate(i, entry);
         }
 #endif
 }
diff --git a/arch/x86/kernel/irq.c b/arch/x86/kernel/irq.c
index 9b68b5b00ac9..cc496eb7a8d2 100644
--- a/arch/x86/kernel/irq.c
+++ b/arch/x86/kernel/irq.c
@@ -247,7 +247,7 @@ __visible unsigned int __irq_entry do_IRQ(struct pt_regs *regs)
         if (!handle_irq(desc, regs)) {
                 ack_APIC_irq();
 
-                if (desc != VECTOR_RETRIGGERED) {
+                if (desc != VECTOR_RETRIGGERED && desc != VECTOR_SHUTDOWN) {
                         pr_emerg_ratelimited("%s: %d.%d No irq handler for vector\n",
                                              __func__, smp_processor_id(),
                                              vector);
diff --git a/arch/x86/kernel/jailhouse.c b/arch/x86/kernel/jailhouse.c
index 1b2ee55a2dfb..ba95bc70460d 100644
--- a/arch/x86/kernel/jailhouse.c
+++ b/arch/x86/kernel/jailhouse.c
@@ -45,7 +45,7 @@ static void jailhouse_get_wallclock(struct timespec64 *now)
 
 static void __init jailhouse_timer_init(void)
 {
-        lapic_timer_frequency = setup_data.apic_khz * (1000 / HZ);
+        lapic_timer_period = setup_data.apic_khz * (1000 / HZ);
 }
 
 static unsigned long jailhouse_get_tsc(void)
diff --git a/arch/x86/kernel/jump_label.c b/arch/x86/kernel/jump_label.c
index e631c358f7f4..044053235302 100644
--- a/arch/x86/kernel/jump_label.c
+++ b/arch/x86/kernel/jump_label.c
@@ -35,41 +35,43 @@ static void bug_at(unsigned char *ip, int line)
         BUG();
 }
 
-static void __ref __jump_label_transform(struct jump_entry *entry,
-                                         enum jump_label_type type,
-                                         int init)
+static void __jump_label_set_jump_code(struct jump_entry *entry,
+                                       enum jump_label_type type,
+                                       union jump_code_union *code,
+                                       int init)
 {
-        union jump_code_union jmp;
         const unsigned char default_nop[] = { STATIC_KEY_INIT_NOP };
         const unsigned char *ideal_nop = ideal_nops[NOP_ATOMIC5];
-        const void *expect, *code;
+        const void *expect;
         int line;
 
-        jmp.jump = 0xe9;
-        jmp.offset = jump_entry_target(entry) -
-                     (jump_entry_code(entry) + JUMP_LABEL_NOP_SIZE);
+        code->jump = 0xe9;
+        code->offset = jump_entry_target(entry) -
+                       (jump_entry_code(entry) + JUMP_LABEL_NOP_SIZE);
 
-        if (type == JUMP_LABEL_JMP) {
-                if (init) {
-                        expect = default_nop; line = __LINE__;
-                } else {
-                        expect = ideal_nop; line = __LINE__;
-                }
-
-                code = &jmp.code;
+        if (init) {
+                expect = default_nop; line = __LINE__;
+        } else if (type == JUMP_LABEL_JMP) {
+                expect = ideal_nop; line = __LINE__;
         } else {
-                if (init) {
-                        expect = default_nop; line = __LINE__;
-                } else {
-                        expect = &jmp.code; line = __LINE__;
-                }
-
-                code = ideal_nop;
+                expect = code->code; line = __LINE__;
         }
 
         if (memcmp((void *)jump_entry_code(entry), expect, JUMP_LABEL_NOP_SIZE))
                 bug_at((void *)jump_entry_code(entry), line);
 
+        if (type == JUMP_LABEL_NOP)
+                memcpy(code, ideal_nop, JUMP_LABEL_NOP_SIZE);
+}
+
+static void __ref __jump_label_transform(struct jump_entry *entry,
+                                         enum jump_label_type type,
+                                         int init)
+{
+        union jump_code_union code;
+
+        __jump_label_set_jump_code(entry, type, &code, init);
+
         /*
          * As long as only a single processor is running and the code is still
          * not marked as RO, text_poke_early() can be used; Checking that
@@ -82,12 +84,12 @@ static void __ref __jump_label_transform(struct jump_entry *entry,
          * always nop being the 'currently valid' instruction
          */
         if (init || system_state == SYSTEM_BOOTING) {
-                text_poke_early((void *)jump_entry_code(entry), code,
+                text_poke_early((void *)jump_entry_code(entry), &code,
                                 JUMP_LABEL_NOP_SIZE);
                 return;
         }
 
-        text_poke_bp((void *)jump_entry_code(entry), code, JUMP_LABEL_NOP_SIZE,
+        text_poke_bp((void *)jump_entry_code(entry), &code, JUMP_LABEL_NOP_SIZE,
                      (void *)jump_entry_code(entry) + JUMP_LABEL_NOP_SIZE);
 }
 
@@ -99,6 +101,75 @@ void arch_jump_label_transform(struct jump_entry *entry,
         mutex_unlock(&text_mutex);
 }
 
+#define TP_VEC_MAX (PAGE_SIZE / sizeof(struct text_poke_loc))
+static struct text_poke_loc tp_vec[TP_VEC_MAX];
+static int tp_vec_nr;
+
+bool arch_jump_label_transform_queue(struct jump_entry *entry,
+                                     enum jump_label_type type)
+{
+        struct text_poke_loc *tp;
+        void *entry_code;
+
+        if (system_state == SYSTEM_BOOTING) {
+                /*
+                 * Fallback to the non-batching mode.
+                 */
+                arch_jump_label_transform(entry, type);
+                return true;
+        }
+
+        /*
+         * No more space in the vector, tell upper layer to apply
+         * the queue before continuing.
+         */
+        if (tp_vec_nr == TP_VEC_MAX)
+                return false;
+
+        tp = &tp_vec[tp_vec_nr];
+
+        entry_code = (void *)jump_entry_code(entry);
+
+        /*
+         * The INT3 handler will do a bsearch in the queue, so we need entries
+         * to be sorted. We can survive an unsorted list by rejecting the entry,
+         * forcing the generic jump_label code to apply the queue. Warning once,
+         * to raise the attention to the case of an unsorted entry that is
+         * better not happen, because, in the worst case we will perform in the
+         * same way as we do without batching - with some more overhead.
+         */
+        if (tp_vec_nr > 0) {
+                int prev = tp_vec_nr - 1;
+                struct text_poke_loc *prev_tp = &tp_vec[prev];
+
+                if (WARN_ON_ONCE(prev_tp->addr > entry_code))
+                        return false;
+        }
+
+        __jump_label_set_jump_code(entry, type,
+                                   (union jump_code_union *) &tp->opcode, 0);
+
+        tp->addr = entry_code;
+        tp->detour = entry_code + JUMP_LABEL_NOP_SIZE;
+        tp->len = JUMP_LABEL_NOP_SIZE;
+
+        tp_vec_nr++;
+
+        return true;
+}
+
+void arch_jump_label_transform_apply(void)
+{
+        if (!tp_vec_nr)
+                return;
+
+        mutex_lock(&text_mutex);
+        text_poke_bp_batch(tp_vec, tp_vec_nr);
+        mutex_unlock(&text_mutex);
+
+        tp_vec_nr = 0;
+}
+
 static enum {
         JL_STATE_START,
         JL_STATE_NO_UPDATE,
diff --git a/arch/x86/kernel/perf_regs.c b/arch/x86/kernel/perf_regs.c
index 07c30ee17425..bb7e1132290b 100644
--- a/arch/x86/kernel/perf_regs.c
+++ b/arch/x86/kernel/perf_regs.c
@@ -74,6 +74,9 @@ u64 perf_reg_value(struct pt_regs *regs, int idx)
         return regs_get_register(regs, pt_regs_offset[idx]);
 }
 
+#define PERF_REG_X86_RESERVED   (((1ULL << PERF_REG_X86_XMM0) - 1) & \
+                                 ~((1ULL << PERF_REG_X86_MAX) - 1))
+
 #ifdef CONFIG_X86_32
 #define REG_NOSUPPORT ((1ULL << PERF_REG_X86_R8) | \
                        (1ULL << PERF_REG_X86_R9) | \
@@ -86,7 +89,7 @@ u64 perf_reg_value(struct pt_regs *regs, int idx)
 
 int perf_reg_validate(u64 mask)
 {
-        if (!mask || (mask & REG_NOSUPPORT))
+        if (!mask || (mask & (REG_NOSUPPORT | PERF_REG_X86_RESERVED)))
                 return -EINVAL;
 
         return 0;
@@ -112,7 +115,7 @@ void perf_get_regs_user(struct perf_regs *regs_user,
 
 int perf_reg_validate(u64 mask)
 {
-        if (!mask || (mask & REG_NOSUPPORT))
+        if (!mask || (mask & (REG_NOSUPPORT | PERF_REG_X86_RESERVED)))
                 return -EINVAL;
 
         return 0;
diff --git a/arch/x86/kernel/ptrace.c b/arch/x86/kernel/ptrace.c
index a166c960bc9e..ee9099061d01 100644
--- a/arch/x86/kernel/ptrace.c
+++ b/arch/x86/kernel/ptrace.c
@@ -25,6 +25,7 @@
 #include <linux/rcupdate.h>
 #include <linux/export.h>
 #include <linux/context_tracking.h>
+#include <linux/nospec.h>
 
 #include <linux/uaccess.h>
 #include <asm/pgtable.h>
@@ -397,22 +398,12 @@ static int putreg(struct task_struct *child,
         case offsetof(struct user_regs_struct,fs_base):
                 if (value >= TASK_SIZE_MAX)
                         return -EIO;
-                /*
-                 * When changing the FS base, use do_arch_prctl_64()
-                 * to set the index to zero and to set the base
-                 * as requested.
-                 */
-                if (child->thread.fsbase != value)
-                        return do_arch_prctl_64(child, ARCH_SET_FS, value);
+                x86_fsbase_write_task(child, value);
                 return 0;
         case offsetof(struct user_regs_struct,gs_base):
-                /*
-                 * Exactly the same here as the %fs handling above.
-                 */
                 if (value >= TASK_SIZE_MAX)
                         return -EIO;
-                if (child->thread.gsbase != value)
-                        return do_arch_prctl_64(child, ARCH_SET_GS, value);
+                x86_gsbase_write_task(child, value);
                 return 0;
 #endif
         }
@@ -645,7 +636,8 @@ static unsigned long ptrace_get_debugreg(struct task_struct *tsk, int n)
         unsigned long val = 0;
 
         if (n < HBP_NUM) {
-                struct perf_event *bp = thread->ptrace_bps[n];
+                int index = array_index_nospec(n, HBP_NUM);
+                struct perf_event *bp = thread->ptrace_bps[index];
 
                 if (bp)
                         val = bp->hw.info.address;
@@ -747,9 +739,6 @@ static int ioperm_get(struct task_struct *target,
 void ptrace_disable(struct task_struct *child)
 {
         user_disable_single_step(child);
-#ifdef TIF_SYSCALL_EMU
-        clear_tsk_thread_flag(child, TIF_SYSCALL_EMU);
-#endif
 }
 
 #if defined CONFIG_X86_32 || defined CONFIG_IA32_EMULATION
diff --git a/arch/x86/kernel/pvclock.c b/arch/x86/kernel/pvclock.c
index 0ff3e294d0e5..10125358b9c4 100644
--- a/arch/x86/kernel/pvclock.c
+++ b/arch/x86/kernel/pvclock.c
@@ -3,6 +3,7 @@
 
 */
 
+#include <linux/clocksource.h>
 #include <linux/kernel.h>
 #include <linux/percpu.h>
 #include <linux/notifier.h>
diff --git a/arch/x86/kernel/smp.c b/arch/x86/kernel/smp.c
index 4693e2f3a03e..96421f97e75c 100644
--- a/arch/x86/kernel/smp.c
+++ b/arch/x86/kernel/smp.c
@@ -144,7 +144,7 @@ void native_send_call_func_ipi(const struct cpumask *mask)
         }
 
         cpumask_copy(allbutself, cpu_online_mask);
-        cpumask_clear_cpu(smp_processor_id(), allbutself);
+        __cpumask_clear_cpu(smp_processor_id(), allbutself);
 
         if (cpumask_equal(mask, allbutself) &&
             cpumask_equal(cpu_online_mask, cpu_callout_mask))
diff --git a/arch/x86/kernel/time.c b/arch/x86/kernel/time.c
index 0e14f6c0d35e..07c0e960b3f3 100644
--- a/arch/x86/kernel/time.c
+++ b/arch/x86/kernel/time.c
@@ -82,8 +82,11 @@ static void __init setup_default_timer_irq(void)
 /* Default timer init function */
 void __init hpet_time_init(void)
 {
-        if (!hpet_enable())
-                setup_pit_timer();
+        if (!hpet_enable()) {
+                if (!pit_timer_init())
+                        return;
+        }
+
         setup_default_timer_irq();
 }
 
diff --git a/arch/x86/kernel/tls.c b/arch/x86/kernel/tls.c
index a5b802a12212..71d3fef1edc9 100644
--- a/arch/x86/kernel/tls.c
+++ b/arch/x86/kernel/tls.c
@@ -5,6 +5,7 @@
 #include <linux/user.h>
 #include <linux/regset.h>
 #include <linux/syscalls.h>
+#include <linux/nospec.h>
 
 #include <linux/uaccess.h>
 #include <asm/desc.h>
@@ -220,6 +221,7 @@ int do_get_thread_area(struct task_struct *p, int idx,
                        struct user_desc __user *u_info)
 {
         struct user_desc info;
+        int index;
 
         if (idx == -1 && get_user(idx, &u_info->entry_number))
                 return -EFAULT;
@@ -227,8 +229,11 @@ int do_get_thread_area(struct task_struct *p, int idx,
         if (idx < GDT_ENTRY_TLS_MIN || idx > GDT_ENTRY_TLS_MAX)
                 return -EINVAL;
 
-        fill_user_desc(&info, idx,
-                       &p->thread.tls_array[idx - GDT_ENTRY_TLS_MIN]);
+        index = idx - GDT_ENTRY_TLS_MIN;
+        index = array_index_nospec(index,
+                        GDT_ENTRY_TLS_MAX - GDT_ENTRY_TLS_MIN + 1);
+
+        fill_user_desc(&info, idx, &p->thread.tls_array[index]);
 
         if (copy_to_user(u_info, &info, sizeof(info)))
                 return -EFAULT;
diff --git a/arch/x86/kernel/tsc.c b/arch/x86/kernel/tsc.c
index 0b29e58f288e..59b57605e66c 100644
--- a/arch/x86/kernel/tsc.c
+++ b/arch/x86/kernel/tsc.c
@@ -632,31 +632,38 @@ unsigned long native_calibrate_tsc(void)
 
         crystal_khz = ecx_hz / 1000;
 
-        if (crystal_khz == 0) {
-                switch (boot_cpu_data.x86_model) {
-                case INTEL_FAM6_SKYLAKE_MOBILE:
-                case INTEL_FAM6_SKYLAKE_DESKTOP:
-                case INTEL_FAM6_KABYLAKE_MOBILE:
-                case INTEL_FAM6_KABYLAKE_DESKTOP:
-                        crystal_khz = 24000;    /* 24.0 MHz */
-                        break;
-                case INTEL_FAM6_ATOM_GOLDMONT_X:
-                        crystal_khz = 25000;    /* 25.0 MHz */
-                        break;
-                case INTEL_FAM6_ATOM_GOLDMONT:
-                        crystal_khz = 19200;    /* 19.2 MHz */
-                        break;
-                }
-        }
+        /*
+         * Denverton SoCs don't report crystal clock, and also don't support
+         * CPUID.0x16 for the calculation below, so hardcode the 25MHz crystal
+         * clock.
+         */
+        if (crystal_khz == 0 &&
+                        boot_cpu_data.x86_model == INTEL_FAM6_ATOM_GOLDMONT_X)
+                crystal_khz = 25000;
 
-        if (crystal_khz == 0)
-                return 0;
         /*
-         * TSC frequency determined by CPUID is a "hardware reported"
+         * TSC frequency reported directly by CPUID is a "hardware reported"
          * frequency and is the most accurate one so far we have. This
          * is considered a known frequency.
          */
-        setup_force_cpu_cap(X86_FEATURE_TSC_KNOWN_FREQ);
+        if (crystal_khz != 0)
+                setup_force_cpu_cap(X86_FEATURE_TSC_KNOWN_FREQ);
+
+        /*
+         * Some Intel SoCs like Skylake and Kabylake don't report the crystal
+         * clock, but we can easily calculate it to a high degree of accuracy
+         * by considering the crystal ratio and the CPU speed.
+         */
+        if (crystal_khz == 0 && boot_cpu_data.cpuid_level >= 0x16) {
+                unsigned int eax_base_mhz, ebx, ecx, edx;
+
+                cpuid(0x16, &eax_base_mhz, &ebx, &ecx, &edx);
+                crystal_khz = eax_base_mhz * 1000 *
+                        eax_denominator / ebx_numerator;
+        }
+
+        if (crystal_khz == 0)
+                return 0;
 
         /*
          * For Atom SoCs TSC is the only reliable clocksource.
@@ -665,6 +672,16 @@ unsigned long native_calibrate_tsc(void)
         if (boot_cpu_data.x86_model == INTEL_FAM6_ATOM_GOLDMONT)
                 setup_force_cpu_cap(X86_FEATURE_TSC_RELIABLE);
 
+#ifdef CONFIG_X86_LOCAL_APIC
+        /*
+         * The local APIC appears to be fed by the core crystal clock
+         * (which sounds entirely sensible). We can set the global
+         * lapic_timer_period here to avoid having to calibrate the APIC
+         * timer later.
+         */
+        lapic_timer_period = crystal_khz * 1000 / HZ;
+#endif
+
         return crystal_khz * ebx_numerator / eax_denominator;
 }
 
diff --git a/arch/x86/kernel/tsc_msr.c b/arch/x86/kernel/tsc_msr.c
index 3d0e9aeea7c8..067858fe4db8 100644
--- a/arch/x86/kernel/tsc_msr.c
+++ b/arch/x86/kernel/tsc_msr.c
@@ -71,7 +71,7 @@ static const struct x86_cpu_id tsc_msr_cpu_ids[] = {
 /*
  * MSR-based CPU/TSC frequency discovery for certain CPUs.
  *
- * Set global "lapic_timer_frequency" to bus_clock_cycles/jiffy
+ * Set global "lapic_timer_period" to bus_clock_cycles/jiffy
  * Return processor base frequency in KHz, or 0 on failure.
  */
 unsigned long cpu_khz_from_msr(void)
@@ -104,7 +104,7 @@ unsigned long cpu_khz_from_msr(void)
         res = freq * ratio;
 
 #ifdef CONFIG_X86_LOCAL_APIC
-        lapic_timer_frequency = (freq * 1000) / HZ;
+        lapic_timer_period = (freq * 1000) / HZ;
 #endif
 
         /*
diff --git a/arch/x86/kernel/unwind_orc.c b/arch/x86/kernel/unwind_orc.c
index 33b66b5c5aec..72b997eaa1fc 100644
--- a/arch/x86/kernel/unwind_orc.c
+++ b/arch/x86/kernel/unwind_orc.c
@@ -82,9 +82,9 @@ static struct orc_entry *orc_find(unsigned long ip);
  * But they are copies of the ftrace entries that are static and
  * defined in ftrace_*.S, which do have orc entries.
  *
- * If the undwinder comes across a ftrace trampoline, then find the
+ * If the unwinder comes across a ftrace trampoline, then find the
  * ftrace function that was used to create it, and use that ftrace
- * function's orc entrie, as the placement of the return code in
+ * function's orc entry, as the placement of the return code in
  * the stack will be identical.
  */
 static struct orc_entry *orc_ftrace_find(unsigned long ip)
@@ -128,6 +128,16 @@ static struct orc_entry null_orc_entry = {
         .type = ORC_TYPE_CALL
 };
 
+/* Fake frame pointer entry -- used as a fallback for generated code */
+static struct orc_entry orc_fp_entry = {
+        .type           = ORC_TYPE_CALL,
+        .sp_reg         = ORC_REG_BP,
+        .sp_offset      = 16,
+        .bp_reg         = ORC_REG_PREV_SP,
+        .bp_offset      = -16,
+        .end            = 0,
+};
+
 static struct orc_entry *orc_find(unsigned long ip)
 {
         static struct orc_entry *orc;
@@ -392,8 +402,16 @@ bool unwind_next_frame(struct unwind_state *state)
          * calls and calls to noreturn functions.
          */
         orc = orc_find(state->signal ? state->ip : state->ip - 1);
-        if (!orc)
-                goto err;
+        if (!orc) {
+                /*
+                 * As a fallback, try to assume this code uses a frame pointer.
+                 * This is useful for generated code, like BPF, which ORC
+                 * doesn't know about.  This is just a guess, so the rest of
+                 * the unwind is no longer considered reliable.
+                 */
+                orc = &orc_fp_entry;
+                state->error = true;
+        }
 
         /* End-of-stack check for kernel threads: */
         if (orc->sp_reg == ORC_REG_UNDEFINED) {
diff --git a/arch/x86/kvm/cpuid.h b/arch/x86/kvm/cpuid.h
index 9a327d5b6d1f..d78a61408243 100644
--- a/arch/x86/kvm/cpuid.h
+++ b/arch/x86/kvm/cpuid.h
@@ -47,8 +47,6 @@ static const struct cpuid_reg reverse_cpuid[] = {
         [CPUID_8000_0001_ECX] = {0x80000001, 0, CPUID_ECX},
         [CPUID_7_0_EBX]       = {         7, 0, CPUID_EBX},
         [CPUID_D_1_EAX]       = {       0xd, 1, CPUID_EAX},
-        [CPUID_F_0_EDX]       = {       0xf, 0, CPUID_EDX},
-        [CPUID_F_1_EDX]       = {       0xf, 1, CPUID_EDX},
         [CPUID_8000_0008_EBX] = {0x80000008, 0, CPUID_EBX},
         [CPUID_6_EAX]         = {         6, 0, CPUID_EAX},
         [CPUID_8000_000A_EDX] = {0x8000000a, 0, CPUID_EDX},
diff --git a/arch/x86/kvm/lapic.c b/arch/x86/kvm/lapic.c
index a21c440ff356..4dabc318adb8 100644
--- a/arch/x86/kvm/lapic.c
+++ b/arch/x86/kvm/lapic.c
@@ -2339,7 +2339,7 @@ int kvm_apic_has_interrupt(struct kvm_vcpu *vcpu)
         struct kvm_lapic *apic = vcpu->arch.apic;
         u32 ppr;
 
-        if (!apic_enabled(apic))
+        if (!kvm_apic_hw_enabled(apic))
                 return -1;
 
         __apic_update_ppr(apic, &ppr);
diff --git a/arch/x86/kvm/pmu.c b/arch/x86/kvm/pmu.c
index 132d149494d6..ab73a9a639ae 100644
--- a/arch/x86/kvm/pmu.c
+++ b/arch/x86/kvm/pmu.c
@@ -261,10 +261,10 @@ static int kvm_pmu_rdpmc_vmware(struct kvm_vcpu *vcpu, unsigned idx, u64 *data)
                 ctr_val = rdtsc();
                 break;
         case VMWARE_BACKDOOR_PMC_REAL_TIME:
-                ctr_val = ktime_get_boot_ns();
+                ctr_val = ktime_get_boottime_ns();
                 break;
         case VMWARE_BACKDOOR_PMC_APPARENT_TIME:
-                ctr_val = ktime_get_boot_ns() +
+                ctr_val = ktime_get_boottime_ns() +
                         vcpu->kvm->arch.kvmclock_offset;
                 break;
         default:
diff --git a/arch/x86/kvm/vmx/nested.c b/arch/x86/kvm/vmx/nested.c
index 5f9c1a200201..46af3a5e9209 100644
--- a/arch/x86/kvm/vmx/nested.c
+++ b/arch/x86/kvm/vmx/nested.c
@@ -5240,9 +5240,6 @@ static int vmx_get_nested_state(struct kvm_vcpu *vcpu,
         vmx = to_vmx(vcpu);
         vmcs12 = get_vmcs12(vcpu);
 
-        if (nested_vmx_allowed(vcpu) && vmx->nested.enlightened_vmcs_enabled)
-                kvm_state.flags |= KVM_STATE_NESTED_EVMCS;
-
         if (nested_vmx_allowed(vcpu) &&
             (vmx->nested.vmxon || vmx->nested.smm.vmxon)) {
                 kvm_state.hdr.vmx.vmxon_pa = vmx->nested.vmxon_ptr;
@@ -5251,6 +5248,9 @@ static int vmx_get_nested_state(struct kvm_vcpu *vcpu,
                 if (vmx_has_valid_vmcs12(vcpu)) {
                         kvm_state.size += sizeof(user_vmx_nested_state->vmcs12);
 
+                        if (vmx->nested.hv_evmcs)
+                                kvm_state.flags |= KVM_STATE_NESTED_EVMCS;
+
                         if (is_guest_mode(vcpu) &&
                             nested_cpu_has_shadow_vmcs(vmcs12) &&
                             vmcs12->vmcs_link_pointer != -1ull)
@@ -5350,6 +5350,15 @@ static int vmx_set_nested_state(struct kvm_vcpu *vcpu,
                 if (kvm_state->hdr.vmx.vmcs12_pa != -1ull)
                         return -EINVAL;
 
+                /*
+                 * KVM_STATE_NESTED_EVMCS used to signal that KVM should
+                 * enable eVMCS capability on vCPU. However, since then
+                 * code was changed such that flag signals vmcs12 should
+                 * be copied into eVMCS in guest memory.
+                 *
+                 * To preserve backwards compatability, allow user
+                 * to set this flag even when there is no VMXON region.
+                 */
                 if (kvm_state->flags & ~KVM_STATE_NESTED_EVMCS)
                         return -EINVAL;
         } else {
@@ -5358,7 +5367,7 @@ static int vmx_set_nested_state(struct kvm_vcpu *vcpu,
 
                 if (!page_address_valid(vcpu, kvm_state->hdr.vmx.vmxon_pa))
                         return -EINVAL;
-        }
+        }
 
         if ((kvm_state->hdr.vmx.smm.flags & KVM_STATE_NESTED_SMM_GUEST_MODE) &&
             (kvm_state->flags & KVM_STATE_NESTED_GUEST_MODE))
@@ -5373,20 +5382,21 @@ static int vmx_set_nested_state(struct kvm_vcpu *vcpu,
          * nor can VMLAUNCH/VMRESUME be pending.  Outside SMM, SMM flags
          * must be zero.
          */
-        if (is_smm(vcpu) ? kvm_state->flags : kvm_state->hdr.vmx.smm.flags)
+        if (is_smm(vcpu) ?
+                (kvm_state->flags &
+                 (KVM_STATE_NESTED_GUEST_MODE | KVM_STATE_NESTED_RUN_PENDING))
+                : kvm_state->hdr.vmx.smm.flags)
                 return -EINVAL;
 
         if ((kvm_state->hdr.vmx.smm.flags & KVM_STATE_NESTED_SMM_GUEST_MODE) &&
             !(kvm_state->hdr.vmx.smm.flags & KVM_STATE_NESTED_SMM_VMXON))
                 return -EINVAL;
 
-        vmx_leave_nested(vcpu);
-        if (kvm_state->flags & KVM_STATE_NESTED_EVMCS) {
-                if (!nested_vmx_allowed(vcpu))
+        if ((kvm_state->flags & KVM_STATE_NESTED_EVMCS) &&
+                (!nested_vmx_allowed(vcpu) || !vmx->nested.enlightened_vmcs_enabled))
                         return -EINVAL;
 
-                nested_enable_evmcs(vcpu, NULL);
-        }
+        vmx_leave_nested(vcpu);
 
         if (kvm_state->hdr.vmx.vmxon_pa == -1ull)
                 return 0;
diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
index 9857992d4e58..63bb1ee8258e 100644
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -67,6 +67,7 @@
 #include <asm/mshyperv.h>
 #include <asm/hypervisor.h>
 #include <asm/intel_pt.h>
+#include <clocksource/hyperv_timer.h>
 
 #define CREATE_TRACE_POINTS
 #include "trace.h"
@@ -1554,7 +1555,7 @@ static int set_tsc_khz(struct kvm_vcpu *vcpu, u32 user_tsc_khz, bool scale)
                         vcpu->arch.tsc_always_catchup = 1;
                         return 0;
                 } else {
-                        WARN(1, "user requested TSC rate below hardware speed\n");
+                        pr_warn_ratelimited("user requested TSC rate below hardware speed\n");
                         return -1;
                 }
         }
@@ -1564,8 +1565,8 @@ static int set_tsc_khz(struct kvm_vcpu *vcpu, u32 user_tsc_khz, bool scale)
                                 user_tsc_khz, tsc_khz);
 
         if (ratio == 0 || ratio >= kvm_max_tsc_scaling_ratio) {
-                WARN_ONCE(1, "Invalid TSC scaling ratio - virtual-tsc-khz=%u\n",
-                          user_tsc_khz);
+                pr_warn_ratelimited("Invalid TSC scaling ratio - virtual-tsc-khz=%u\n",
+                                    user_tsc_khz);
                 return -1;
         }
 
@@ -1728,7 +1729,7 @@ void kvm_write_tsc(struct kvm_vcpu *vcpu, struct msr_data *msr)
 
         raw_spin_lock_irqsave(&kvm->arch.tsc_write_lock, flags);
         offset = kvm_compute_tsc_offset(vcpu, data);
-        ns = ktime_get_boot_ns();
+        ns = ktime_get_boottime_ns();
         elapsed = ns - kvm->arch.last_tsc_nsec;
 
         if (vcpu->arch.virtual_tsc_khz) {
@@ -2070,7 +2071,7 @@ u64 get_kvmclock_ns(struct kvm *kvm)
         spin_lock(&ka->pvclock_gtod_sync_lock);
         if (!ka->use_master_clock) {
                 spin_unlock(&ka->pvclock_gtod_sync_lock);
-                return ktime_get_boot_ns() + ka->kvmclock_offset;
+                return ktime_get_boottime_ns() + ka->kvmclock_offset;
         }
 
         hv_clock.tsc_timestamp = ka->master_cycle_now;
@@ -2086,7 +2087,7 @@ u64 get_kvmclock_ns(struct kvm *kvm)
                                    &hv_clock.tsc_to_system_mul);
                 ret = __pvclock_read_cycles(&hv_clock, rdtsc());
         } else
-                ret = ktime_get_boot_ns() + ka->kvmclock_offset;
+                ret = ktime_get_boottime_ns() + ka->kvmclock_offset;
 
         put_cpu();
 
@@ -2185,7 +2186,7 @@ static int kvm_guest_time_update(struct kvm_vcpu *v)
         }
         if (!use_master_clock) {
                 host_tsc = rdtsc();
-                kernel_ns = ktime_get_boot_ns();
+                kernel_ns = ktime_get_boottime_ns();
         }
 
         tsc_timestamp = kvm_read_l1_tsc(v, host_tsc);
@@ -9015,7 +9016,7 @@ int kvm_arch_hardware_enable(void)
          * before any KVM threads can be running.  Unfortunately, we can't
          * bring the TSCs fully up to date with real time, as we aren't yet far
          * enough into CPU bringup that we know how much real time has actually
-         * elapsed; our helper function, ktime_get_boot_ns() will be using boot
+         * elapsed; our helper function, ktime_get_boottime_ns() will be using boot
          * variables that haven't been updated yet.
          *
          * So we simply find the maximum observed TSC above, then record the
@@ -9243,7 +9244,7 @@ int kvm_arch_init_vm(struct kvm *kvm, unsigned long type)
         mutex_init(&kvm->arch.apic_map_lock);
         spin_lock_init(&kvm->arch.pvclock_gtod_sync_lock);
 
-        kvm->arch.kvmclock_offset = -ktime_get_boot_ns();
+        kvm->arch.kvmclock_offset = -ktime_get_boottime_ns();
         pvclock_update_vm_gtod_copy(kvm);
 
         kvm->arch.guest_can_read_msr_platform_info = true;
diff --git a/arch/x86/lib/cache-smp.c b/arch/x86/lib/cache-smp.c
index 1811fa4a1b1a..7c48ff4ae8d1 100644
--- a/arch/x86/lib/cache-smp.c
+++ b/arch/x86/lib/cache-smp.c
@@ -15,6 +15,7 @@ EXPORT_SYMBOL(wbinvd_on_cpu);
 
 int wbinvd_on_all_cpus(void)
 {
-        return on_each_cpu(__wbinvd, NULL, 1);
+        on_each_cpu(__wbinvd, NULL, 1);
+        return 0;
 }
 EXPORT_SYMBOL(wbinvd_on_all_cpus);
diff --git a/arch/x86/mm/fault.c b/arch/x86/mm/fault.c
index 46df4c6aae46..58e4f1f00bbc 100644
--- a/arch/x86/mm/fault.c
+++ b/arch/x86/mm/fault.c
@@ -710,6 +710,10 @@ static void set_signal_archinfo(unsigned long address,
          * To avoid leaking information about the kernel page
          * table layout, pretend that user-mode accesses to
          * kernel addresses are always protection faults.
+         *
+         * NB: This means that failed vsyscalls with vsyscall=none
+         * will have the PROT bit.  This doesn't leak any
+         * information and does not appear to cause any problems.
          */
         if (address >= TASK_SIZE_MAX)
                 error_code |= X86_PF_PROT;
@@ -1369,16 +1373,18 @@ void do_user_addr_fault(struct pt_regs *regs,
 
 #ifdef CONFIG_X86_64
         /*
-         * Instruction fetch faults in the vsyscall page might need
-         * emulation.  The vsyscall page is at a high address
-         * (>PAGE_OFFSET), but is considered to be part of the user
-         * address space.
+         * Faults in the vsyscall page might need emulation.  The
+         * vsyscall page is at a high address (>PAGE_OFFSET), but is
+         * considered to be part of the user address space.
          *
          * The vsyscall page does not have a "real" VMA, so do this
          * emulation before we go searching for VMAs.
+         *
+         * PKRU never rejects instruction fetches, so we don't need
+         * to consider the PF_PK bit.
          */
-        if ((hw_error_code & X86_PF_INSTR) && is_vsyscall_vaddr(address)) {
-                if (emulate_vsyscall(regs, address))
+        if (is_vsyscall_vaddr(address)) {
+                if (emulate_vsyscall(hw_error_code, regs, address))
                         return;
         }
 #endif
diff --git a/arch/x86/mm/init_64.c b/arch/x86/mm/init_64.c
index 693aaf28d5fe..0f01c7b1d217 100644
--- a/arch/x86/mm/init_64.c
+++ b/arch/x86/mm/init_64.c
@@ -671,23 +671,25 @@ static unsigned long __meminit
 phys_p4d_init(p4d_t *p4d_page, unsigned long paddr, unsigned long paddr_end,
               unsigned long page_size_mask, bool init)
 {
-        unsigned long paddr_next, paddr_last = paddr_end;
-        unsigned long vaddr = (unsigned long)__va(paddr);
-        int i = p4d_index(vaddr);
+        unsigned long vaddr, vaddr_end, vaddr_next, paddr_next, paddr_last;
+
+        paddr_last = paddr_end;
+        vaddr = (unsigned long)__va(paddr);
+        vaddr_end = (unsigned long)__va(paddr_end);
 
         if (!pgtable_l5_enabled())
                 return phys_pud_init((pud_t *) p4d_page, paddr, paddr_end,
                                      page_size_mask, init);
 
-        for (; i < PTRS_PER_P4D; i++, paddr = paddr_next) {
-                p4d_t *p4d;
+        for (; vaddr < vaddr_end; vaddr = vaddr_next) {
+                p4d_t *p4d = p4d_page + p4d_index(vaddr);
                 pud_t *pud;
 
-                vaddr = (unsigned long)__va(paddr);
-                p4d = p4d_page + p4d_index(vaddr);
-                paddr_next = (paddr & P4D_MASK) + P4D_SIZE;
+                vaddr_next = (vaddr & P4D_MASK) + P4D_SIZE;
+                paddr = __pa(vaddr);
 
                 if (paddr >= paddr_end) {
+                        paddr_next = __pa(vaddr_next);
                         if (!after_bootmem &&
                             !e820__mapped_any(paddr & P4D_MASK, paddr_next,
                                              E820_TYPE_RAM) &&
@@ -699,13 +701,13 @@ phys_p4d_init(p4d_t *p4d_page, unsigned long paddr, unsigned long paddr_end,
 
                 if (!p4d_none(*p4d)) {
                         pud = pud_offset(p4d, 0);
-                        paddr_last = phys_pud_init(pud, paddr, paddr_end,
-                                                   page_size_mask, init);
+                        paddr_last = phys_pud_init(pud, paddr, __pa(vaddr_end),
+                                        page_size_mask, init);
                         continue;
                 }
 
                 pud = alloc_low_page();
-                paddr_last = phys_pud_init(pud, paddr, paddr_end,
+                paddr_last = phys_pud_init(pud, paddr, __pa(vaddr_end),
                                            page_size_mask, init);
 
                 spin_lock(&init_mm.page_table_lock);
diff --git a/arch/x86/platform/efi/quirks.c b/arch/x86/platform/efi/quirks.c
index 632b83885867..3b9fd679cea9 100644
--- a/arch/x86/platform/efi/quirks.c
+++ b/arch/x86/platform/efi/quirks.c
@@ -728,7 +728,7 @@ void efi_recover_from_page_fault(unsigned long phys_addr)
          * Address range 0x0000 - 0x0fff is always mapped in the efi_pgd, so
          * page faulting on these addresses isn't expected.
          */
-        if (phys_addr >= 0x0000 && phys_addr <= 0x0fff)
+        if (phys_addr <= 0x0fff)
                 return;
 
         /*
diff --git a/arch/x86/ras/Kconfig b/arch/x86/ras/Kconfig
index a9c3db125222..9ad6842de4b4 100644
--- a/arch/x86/ras/Kconfig
+++ b/arch/x86/ras/Kconfig
@@ -11,3 +11,13 @@ config RAS_CEC
 
           Bear in mind that this is absolutely useless if your platform doesn't
           have ECC DIMMs and doesn't have DRAM ECC checking enabled in the BIOS.
+
+config RAS_CEC_DEBUG
+        bool "CEC debugging machinery"
+        default n
+        depends on RAS_CEC
+        help
+          Add extra files to (debugfs)/ras/cec to test the correctable error
+          collector feature. "pfn" is a writable file that allows user to
+          simulate an error in a particular page frame. "array" is a read-only
+          file that dumps out the current state of all pages logged so far.
diff --git a/block/bfq-iosched.c b/block/bfq-iosched.c
index f8d430f88d25..f9269ae6da9c 100644
--- a/block/bfq-iosched.c
+++ b/block/bfq-iosched.c
@@ -240,7 +240,7 @@ static struct kmem_cache *bfq_pool;
  * containing only random (seeky) I/O are prevented from being tagged
  * as soft real-time.
  */
-#define BFQQ_TOTALLY_SEEKY(bfqq)        (bfqq->seek_history & -1)
+#define BFQQ_TOTALLY_SEEKY(bfqq)        (bfqq->seek_history == -1)
 
 /* Min number of samples required to perform peak-rate update */
 #define BFQ_RATE_MIN_SAMPLES    32
diff --git a/block/blk-mq-debugfs.c b/block/blk-mq-debugfs.c
index 2489ddbb21db..3afe327f816f 100644
--- a/block/blk-mq-debugfs.c
+++ b/block/blk-mq-debugfs.c
@@ -934,6 +934,13 @@ void blk_mq_debugfs_register_sched(struct request_queue *q)
 {
         struct elevator_type *e = q->elevator->type;
 
+        /*
+         * If the parent directory has not been created yet, return, we will be
+         * called again later on and the directory/files will be created then.
+         */
+        if (!q->debugfs_dir)
+                return;
+
         if (!e->queue_debugfs_attrs)
                 return;
 
diff --git a/crypto/cryptd.c b/crypto/cryptd.c
index 1ce1bf6d3bab..5f76c6e222c6 100644
--- a/crypto/cryptd.c
+++ b/crypto/cryptd.c
@@ -388,6 +388,7 @@ static void cryptd_skcipher_free(struct skcipher_instance *inst)
         struct skcipherd_instance_ctx *ctx = skcipher_instance_ctx(inst);
 
         crypto_drop_skcipher(&ctx->spawn);
+        kfree(inst);
 }
 
 static int cryptd_create_skcipher(struct crypto_template *tmpl,
diff --git a/crypto/crypto_user_base.c b/crypto/crypto_user_base.c
index d5d5d155340b..c65e39005ce2 100644
--- a/crypto/crypto_user_base.c
+++ b/crypto/crypto_user_base.c
@@ -44,6 +44,9 @@ struct crypto_alg *crypto_alg_match(struct crypto_user_alg *p, int exact)
         list_for_each_entry(q, &crypto_alg_list, cra_list) {
                 int match = 0;
 
+                if (crypto_is_larval(q))
+                        continue;
+
                 if ((q->cra_flags ^ p->cru_type) & p->cru_mask)
                         continue;
 
diff --git a/drivers/acpi/acpi_pad.c b/drivers/acpi/acpi_pad.c
index 6b3f1217a237..e7dc0133f817 100644
--- a/drivers/acpi/acpi_pad.c
+++ b/drivers/acpi/acpi_pad.c
@@ -64,6 +64,7 @@ static void power_saving_mwait_init(void)
         case X86_VENDOR_HYGON:
         case X86_VENDOR_AMD:
         case X86_VENDOR_INTEL:
+        case X86_VENDOR_ZHAOXIN:
                 /*
                  * AMD Fam10h TSC will tick in all
                  * C/P/S0/S1 states when this bit is set.
diff --git a/drivers/acpi/irq.c b/drivers/acpi/irq.c
index 89690a471360..e209081d644b 100644
--- a/drivers/acpi/irq.c
+++ b/drivers/acpi/irq.c
@@ -292,3 +292,29 @@ void __init acpi_set_irq_model(enum acpi_irq_model_id model,
         acpi_irq_model = model;
         acpi_gsi_domain_id = fwnode;
 }
+
+/**
+ * acpi_irq_create_hierarchy - Create a hierarchical IRQ domain with the default
+ *                             GSI domain as its parent.
+ * @flags:      Irq domain flags associated with the domain
+ * @size:       Size of the domain.
+ * @fwnode:     Optional fwnode of the interrupt controller
+ * @ops:        Pointer to the interrupt domain callbacks
+ * @host_data:  Controller private data pointer
+ */
+struct irq_domain *acpi_irq_create_hierarchy(unsigned int flags,
+                                             unsigned int size,
+                                             struct fwnode_handle *fwnode,
+                                             const struct irq_domain_ops *ops,
+                                             void *host_data)
+{
+        struct irq_domain *d = irq_find_matching_fwnode(acpi_gsi_domain_id,
+                                                        DOMAIN_BUS_ANY);
+
+        if (!d)
+                return NULL;
+
+        return irq_domain_create_hierarchy(d, flags, size, fwnode, ops,
+                                           host_data);
+}
+EXPORT_SYMBOL_GPL(acpi_irq_create_hierarchy);
diff --git a/drivers/acpi/pptt.c b/drivers/acpi/pptt.c
index b72e6afaa8fb..1e7ac0bd0d3a 100644
--- a/drivers/acpi/pptt.c
+++ b/drivers/acpi/pptt.c
@@ -432,17 +432,40 @@ static void cache_setup_acpi_cpu(struct acpi_table_header *table,
         }
 }
 
+static bool flag_identical(struct acpi_table_header *table_hdr,
+                           struct acpi_pptt_processor *cpu)
+{
+        struct acpi_pptt_processor *next;
+
+        /* heterogeneous machines must use PPTT revision > 1 */
+        if (table_hdr->revision < 2)
+                return false;
+
+        /* Locate the last node in the tree with IDENTICAL set */
+        if (cpu->flags & ACPI_PPTT_ACPI_IDENTICAL) {
+                next = fetch_pptt_node(table_hdr, cpu->parent);
+                if (!(next && next->flags & ACPI_PPTT_ACPI_IDENTICAL))
+                        return true;
+        }
+
+        return false;
+}
+
 /* Passing level values greater than this will result in search termination */
 #define PPTT_ABORT_PACKAGE 0xFF
 
-static struct acpi_pptt_processor *acpi_find_processor_package_id(struct acpi_table_header *table_hdr,
-                                                                  struct acpi_pptt_processor *cpu,
-                                                                  int level, int flag)
+static struct acpi_pptt_processor *acpi_find_processor_tag(struct acpi_table_header *table_hdr,
+                                                           struct acpi_pptt_processor *cpu,
+                                                           int level, int flag)
 {
         struct acpi_pptt_processor *prev_node;
 
         while (cpu && level) {
-                if (cpu->flags & flag)
+                /* special case the identical flag to find last identical */
+                if (flag == ACPI_PPTT_ACPI_IDENTICAL) {
+                        if (flag_identical(table_hdr, cpu))
+                                break;
+                } else if (cpu->flags & flag)
                         break;
                 pr_debug("level %d\n", level);
                 prev_node = fetch_pptt_node(table_hdr, cpu->parent);
@@ -480,8 +503,8 @@ static int topology_get_acpi_cpu_tag(struct acpi_table_header *table,
 
         cpu_node = acpi_find_processor_node(table, acpi_cpu_id);
         if (cpu_node) {
-                cpu_node = acpi_find_processor_package_id(table, cpu_node,
-                                                          level, flag);
+                cpu_node = acpi_find_processor_tag(table, cpu_node,
+                                                   level, flag);
                 /*
                  * As per specification if the processor structure represents
                  * an actual processor, then ACPI processor ID must be valid.
@@ -660,3 +683,29 @@ int find_acpi_cpu_topology_package(unsigned int cpu)
         return find_acpi_cpu_topology_tag(cpu, PPTT_ABORT_PACKAGE,
                                           ACPI_PPTT_PHYSICAL_PACKAGE);
 }
+
+/**
+ * find_acpi_cpu_topology_hetero_id() - Get a core architecture tag
+ * @cpu: Kernel logical CPU number
+ *
+ * Determine a unique heterogeneous tag for the given CPU. CPUs with the same
+ * implementation should have matching tags.
+ *
+ * The returned tag can be used to group peers with identical implementation.
+ *
+ * The search terminates when a level is found with the identical implementation
+ * flag set or we reach a root node.
+ *
+ * Due to limitations in the PPTT data structure, there may be rare situations
+ * where two cores in a heterogeneous machine may be identical, but won't have
+ * the same tag.
+ *
+ * Return: -ENOENT if the PPTT doesn't exist, or the CPU cannot be found.
+ * Otherwise returns a value which represents a group of identical cores
+ * similar to this CPU.
+ */
+int find_acpi_cpu_topology_hetero_id(unsigned int cpu)
+{
+        return find_acpi_cpu_topology_tag(cpu, PPTT_ABORT_PACKAGE,
+                                          ACPI_PPTT_ACPI_IDENTICAL);
+}
diff --git a/drivers/acpi/processor_idle.c b/drivers/acpi/processor_idle.c
index e387a258d649..ed56c6d20b08 100644
--- a/drivers/acpi/processor_idle.c
+++ b/drivers/acpi/processor_idle.c
@@ -196,6 +196,7 @@ static void tsc_check_state(int state)
         case X86_VENDOR_AMD:
         case X86_VENDOR_INTEL:
         case X86_VENDOR_CENTAUR:
+        case X86_VENDOR_ZHAOXIN:
                 /*
                  * AMD Fam10h TSC will tick in all
                  * C/P/S0/S1 states when this bit is set.
diff --git a/drivers/auxdisplay/cfag12864bfb.c b/drivers/auxdisplay/cfag12864bfb.c
index 40c8a552a478..4074886b7bc8 100644
--- a/drivers/auxdisplay/cfag12864bfb.c
+++ b/drivers/auxdisplay/cfag12864bfb.c
@@ -52,8 +52,9 @@ static const struct fb_var_screeninfo cfag12864bfb_var = {
 
 static int cfag12864bfb_mmap(struct fb_info *info, struct vm_area_struct *vma)
 {
-        return vm_insert_page(vma, vma->vm_start,
-                virt_to_page(cfag12864b_buffer));
+        struct page *pages = virt_to_page(cfag12864b_buffer);
+
+        return vm_map_pages_zero(vma, &pages, 1);
 }
 
 static struct fb_ops cfag12864bfb_ops = {
diff --git a/drivers/auxdisplay/ht16k33.c b/drivers/auxdisplay/ht16k33.c
index 21393ec3b9a4..9c0bb771751d 100644
--- a/drivers/auxdisplay/ht16k33.c
+++ b/drivers/auxdisplay/ht16k33.c
@@ -223,9 +223,9 @@ static const struct backlight_ops ht16k33_bl_ops = {
 static int ht16k33_mmap(struct fb_info *info, struct vm_area_struct *vma)
 {
         struct ht16k33_priv *priv = info->par;
+        struct page *pages = virt_to_page(priv->fbdev.buffer);
 
-        return vm_insert_page(vma, vma->vm_start,
-                              virt_to_page(priv->fbdev.buffer));
+        return vm_map_pages_zero(vma, &pages, 1);
 }
 
 static struct fb_ops ht16k33_fb_ops = {
diff --git a/drivers/base/cacheinfo.c b/drivers/base/cacheinfo.c
index a7359535caf5..8827c60f51e2 100644
--- a/drivers/base/cacheinfo.c
+++ b/drivers/base/cacheinfo.c
@@ -213,6 +213,8 @@ int __weak cache_setup_acpi(unsigned int cpu)
         return -ENOTSUPP;
 }
 
+unsigned int coherency_max_size;
+
 static int cache_shared_cpu_map_setup(unsigned int cpu)
 {
         struct cpu_cacheinfo *this_cpu_ci = get_cpu_cacheinfo(cpu);
@@ -251,6 +253,9 @@ static int cache_shared_cpu_map_setup(unsigned int cpu)
                                 cpumask_set_cpu(i, &this_leaf->shared_cpu_map);
                         }
                 }
+                /* record the maximum cache line size */
+                if (this_leaf->coherency_line_size > coherency_max_size)
+                        coherency_max_size = this_leaf->coherency_line_size;
         }
 
         return 0;
diff --git a/drivers/char/agp/generic.c b/drivers/char/agp/generic.c
index 658664a5a5aa..df1edb5ec0ad 100644
--- a/drivers/char/agp/generic.c
+++ b/drivers/char/agp/generic.c
@@ -1311,8 +1311,7 @@ static void ipi_handler(void *null)
 
 void global_cache_flush(void)
 {
-        if (on_each_cpu(ipi_handler, NULL, 1) != 0)
-                panic(PFX "timed out waiting for the other CPUs!\n");
+        on_each_cpu(ipi_handler, NULL, 1);
 }
 EXPORT_SYMBOL(global_cache_flush);
 
diff --git a/drivers/clk/clk.c b/drivers/clk/clk.c
index aa51756fd4d6..87b410d6e51d 100644
--- a/drivers/clk/clk.c
+++ b/drivers/clk/clk.c
@@ -368,7 +368,7 @@ static struct clk_core *clk_core_get(struct clk_core *core, u8 p_index)
         const char *dev_id = dev ? dev_name(dev) : NULL;
         struct device_node *np = core->of_node;
 
-        if (np && index >= 0)
+        if (np && (name || index >= 0))
                 hw = of_clk_get_hw(np, index, name);
 
         /*
diff --git a/drivers/clk/meson/g12a.c b/drivers/clk/meson/g12a.c
index 739f64fdf1e3..206fafd299ea 100644
--- a/drivers/clk/meson/g12a.c
+++ b/drivers/clk/meson/g12a.c
@@ -2734,8 +2734,8 @@ static struct clk_hw_onecell_data g12a_hw_onecell_data = {
                 [CLKID_MALI_1_DIV]              = &g12a_mali_1_div.hw,
                 [CLKID_MALI_1]                  = &g12a_mali_1.hw,
                 [CLKID_MALI]                    = &g12a_mali.hw,
-                [CLKID_MPLL_5OM_DIV]            = &g12a_mpll_50m_div.hw,
-                [CLKID_MPLL_5OM]                = &g12a_mpll_50m.hw,
+                [CLKID_MPLL_50M_DIV]            = &g12a_mpll_50m_div.hw,
+                [CLKID_MPLL_50M]                = &g12a_mpll_50m.hw,
                 [CLKID_SYS_PLL_DIV16_EN]        = &g12a_sys_pll_div16_en.hw,
                 [CLKID_SYS_PLL_DIV16]           = &g12a_sys_pll_div16.hw,
                 [CLKID_CPU_CLK_DYN0_SEL]        = &g12a_cpu_clk_premux0.hw,
diff --git a/drivers/clk/meson/g12a.h b/drivers/clk/meson/g12a.h
index 39c41af70804..bcc05cd9882f 100644
--- a/drivers/clk/meson/g12a.h
+++ b/drivers/clk/meson/g12a.h
@@ -166,7 +166,7 @@
 #define CLKID_HDMI_DIV                          167
 #define CLKID_MALI_0_DIV                        170
 #define CLKID_MALI_1_DIV                        173
-#define CLKID_MPLL_5OM_DIV                      176
+#define CLKID_MPLL_50M_DIV                      176
 #define CLKID_SYS_PLL_DIV16_EN                  178
 #define CLKID_SYS_PLL_DIV16                     179
 #define CLKID_CPU_CLK_DYN0_SEL                  180
diff --git a/drivers/clk/meson/meson8b.c b/drivers/clk/meson/meson8b.c
index 37cf0f01bb5d..62cd3a7f1f65 100644
--- a/drivers/clk/meson/meson8b.c
+++ b/drivers/clk/meson/meson8b.c
@@ -1761,7 +1761,7 @@ static struct clk_regmap meson8m2_gp_pll = {
         },
 };
 
-static const char * const mmeson8b_vpu_0_1_parent_names[] = {
+static const char * const meson8b_vpu_0_1_parent_names[] = {
         "fclk_div4", "fclk_div3", "fclk_div5", "fclk_div7"
 };
 
@@ -1778,8 +1778,8 @@ static struct clk_regmap meson8b_vpu_0_sel = {
         .hw.init = &(struct clk_init_data){
                 .name = "vpu_0_sel",
                 .ops = &clk_regmap_mux_ops,
-                .parent_names = mmeson8b_vpu_0_1_parent_names,
-                .num_parents = ARRAY_SIZE(mmeson8b_vpu_0_1_parent_names),
+                .parent_names = meson8b_vpu_0_1_parent_names,
+                .num_parents = ARRAY_SIZE(meson8b_vpu_0_1_parent_names),
                 .flags = CLK_SET_RATE_PARENT,
         },
 };
@@ -1837,8 +1837,8 @@ static struct clk_regmap meson8b_vpu_1_sel = {
         .hw.init = &(struct clk_init_data){
                 .name = "vpu_1_sel",
                 .ops = &clk_regmap_mux_ops,
-                .parent_names = mmeson8b_vpu_0_1_parent_names,
-                .num_parents = ARRAY_SIZE(mmeson8b_vpu_0_1_parent_names),
+                .parent_names = meson8b_vpu_0_1_parent_names,
+                .num_parents = ARRAY_SIZE(meson8b_vpu_0_1_parent_names),
                 .flags = CLK_SET_RATE_PARENT,
         },
 };
diff --git a/drivers/clk/socfpga/clk-s10.c b/drivers/clk/socfpga/clk-s10.c
index 8281dfbf38c2..5bed36e12951 100644
--- a/drivers/clk/socfpga/clk-s10.c
+++ b/drivers/clk/socfpga/clk-s10.c
@@ -103,9 +103,9 @@ static const struct stratix10_perip_cnt_clock s10_main_perip_cnt_clks[] = {
         { STRATIX10_NOC_CLK, "noc_clk", NULL, noc_mux, ARRAY_SIZE(noc_mux),
           0, 0, 0, 0x3C, 1},
         { STRATIX10_EMAC_A_FREE_CLK, "emaca_free_clk", NULL, emaca_free_mux, ARRAY_SIZE(emaca_free_mux),
-          0, 0, 4, 0xB0, 0},
+          0, 0, 2, 0xB0, 0},
         { STRATIX10_EMAC_B_FREE_CLK, "emacb_free_clk", NULL, emacb_free_mux, ARRAY_SIZE(emacb_free_mux),
-          0, 0, 4, 0xB0, 1},
+          0, 0, 2, 0xB0, 1},
         { STRATIX10_EMAC_PTP_FREE_CLK, "emac_ptp_free_clk", NULL, emac_ptp_free_mux,
           ARRAY_SIZE(emac_ptp_free_mux), 0, 0, 4, 0xB0, 2},
         { STRATIX10_GPIO_DB_FREE_CLK, "gpio_db_free_clk", NULL, gpio_db_free_mux,
diff --git a/drivers/clk/tegra/clk-tegra210.c b/drivers/clk/tegra/clk-tegra210.c
index e1ba62d2b1a0..ac1d27a8c650 100644
--- a/drivers/clk/tegra/clk-tegra210.c
+++ b/drivers/clk/tegra/clk-tegra210.c
@@ -3366,6 +3366,8 @@ static struct tegra_clk_init_table init_table[] __initdata = {
         { TEGRA210_CLK_I2S3_SYNC, TEGRA210_CLK_CLK_MAX, 24576000, 0 },
         { TEGRA210_CLK_I2S4_SYNC, TEGRA210_CLK_CLK_MAX, 24576000, 0 },
         { TEGRA210_CLK_VIMCLK_SYNC, TEGRA210_CLK_CLK_MAX, 24576000, 0 },
+        { TEGRA210_CLK_HDA, TEGRA210_CLK_PLL_P, 51000000, 0 },
+        { TEGRA210_CLK_HDA2CODEC_2X, TEGRA210_CLK_PLL_P, 48000000, 0 },
         /* This MUST be the last entry. */
         { TEGRA210_CLK_CLK_MAX, TEGRA210_CLK_CLK_MAX, 0, 0 },
 };
diff --git a/drivers/clk/ti/clkctrl.c b/drivers/clk/ti/clkctrl.c
index 8e834317c97d..975995eea15c 100644
--- a/drivers/clk/ti/clkctrl.c
+++ b/drivers/clk/ti/clkctrl.c
@@ -229,6 +229,7 @@ static struct clk_hw *_ti_omap4_clkctrl_xlate(struct of_phandle_args *clkspec,
 {
         struct omap_clkctrl_provider *provider = data;
         struct omap_clkctrl_clk *entry;
+        bool found = false;
 
         if (clkspec->args_count != 2)
                 return ERR_PTR(-EINVAL);
@@ -238,11 +239,13 @@ static struct clk_hw *_ti_omap4_clkctrl_xlate(struct of_phandle_args *clkspec,
 
         list_for_each_entry(entry, &provider->clocks, node) {
                 if (entry->reg_offset == clkspec->args[0] &&
-                    entry->bit_offset == clkspec->args[1])
+                    entry->bit_offset == clkspec->args[1]) {
+                        found = true;
                         break;
+                }
         }
 
-        if (!entry)
+        if (!found)
                 return ERR_PTR(-EINVAL);
 
         return entry->clk;
diff --git a/drivers/clocksource/Kconfig b/drivers/clocksource/Kconfig
index 3300739edce4..5e9317dc3d39 100644
--- a/drivers/clocksource/Kconfig
+++ b/drivers/clocksource/Kconfig
@@ -43,6 +43,11 @@ config BCM_KONA_TIMER
         help
           Enables the support for the BCM Kona mobile timer driver.
 
+config DAVINCI_TIMER
+        bool "Texas Instruments DaVinci timer driver" if COMPILE_TEST
+        help
+          Enables the support for the TI DaVinci timer driver.
+
 config DIGICOLOR_TIMER
         bool "Digicolor timer driver" if COMPILE_TEST
         select CLKSRC_MMIO
@@ -140,7 +145,7 @@ config TEGRA_TIMER
         bool "Tegra timer driver" if COMPILE_TEST
         select CLKSRC_MMIO
         select TIMER_OF
-        depends on ARM || ARM64
+        depends on ARCH_TEGRA || COMPILE_TEST
         help
           Enables support for the Tegra driver.
 
@@ -617,6 +622,13 @@ config CLKSRC_IMX_TPM
           Enable this option to use IMX Timer/PWM Module (TPM) timer as
           clocksource.
 
+config TIMER_IMX_SYS_CTR
+        bool "i.MX system counter timer" if COMPILE_TEST
+        select TIMER_OF
+        help
+          Enable this option to use i.MX system counter timer as a
+          clockevent.
+
 config CLKSRC_ST_LPC
         bool "Low power clocksource found in the LPC" if COMPILE_TEST
         select TIMER_OF if OF
diff --git a/drivers/clocksource/Makefile b/drivers/clocksource/Makefile
index 236858fa7fbf..2e7936e7833f 100644
--- a/drivers/clocksource/Makefile
+++ b/drivers/clocksource/Makefile
@@ -15,6 +15,7 @@ obj-$(CONFIG_SH_TIMER_TMU)	+= sh_tmu.o
 obj-$(CONFIG_EM_TIMER_STI)      += em_sti.o
 obj-$(CONFIG_CLKBLD_I8253)      += i8253.o
 obj-$(CONFIG_CLKSRC_MMIO)       += mmio.o
+obj-$(CONFIG_DAVINCI_TIMER)     += timer-davinci.o
 obj-$(CONFIG_DIGICOLOR_TIMER)   += timer-digicolor.o
 obj-$(CONFIG_OMAP_DM_TIMER)     += timer-ti-dm.o
 obj-$(CONFIG_DW_APB_TIMER)      += dw_apb_timer.o
@@ -36,7 +37,7 @@ obj-$(CONFIG_U300_TIMER)	+= timer-u300.o
 obj-$(CONFIG_SUN4I_TIMER)       += timer-sun4i.o
 obj-$(CONFIG_SUN5I_HSTIMER)     += timer-sun5i.o
 obj-$(CONFIG_MESON6_TIMER)      += timer-meson6.o
-obj-$(CONFIG_TEGRA_TIMER)       += timer-tegra20.o
+obj-$(CONFIG_TEGRA_TIMER)       += timer-tegra.o
 obj-$(CONFIG_VT8500_TIMER)      += timer-vt8500.o
 obj-$(CONFIG_NSPIRE_TIMER)      += timer-zevio.o
 obj-$(CONFIG_BCM_KONA_TIMER)    += bcm_kona_timer.o
@@ -74,6 +75,7 @@ obj-$(CONFIG_CLKSRC_MIPS_GIC)		+= mips-gic-timer.o
 obj-$(CONFIG_CLKSRC_TANGO_XTAL)         += timer-tango-xtal.o
 obj-$(CONFIG_CLKSRC_IMX_GPT)            += timer-imx-gpt.o
 obj-$(CONFIG_CLKSRC_IMX_TPM)            += timer-imx-tpm.o
+obj-$(CONFIG_TIMER_IMX_SYS_CTR)         += timer-imx-sysctr.o
 obj-$(CONFIG_ASM9260_TIMER)             += asm9260_timer.o
 obj-$(CONFIG_H8300_TMR8)                += h8300_timer8.o
 obj-$(CONFIG_H8300_TMR16)               += h8300_timer16.o
@@ -84,3 +86,4 @@ obj-$(CONFIG_ATCPIT100_TIMER)		+= timer-atcpit100.o
 obj-$(CONFIG_RISCV_TIMER)               += timer-riscv.o
 obj-$(CONFIG_CSKY_MP_TIMER)             += timer-mp-csky.o
 obj-$(CONFIG_GX6605S_TIMER)             += timer-gx6605s.o
+obj-$(CONFIG_HYPERV_TIMER)              += hyperv_timer.o
diff --git a/drivers/clocksource/arc_timer.c b/drivers/clocksource/arc_timer.c
index ebfbccefc7b3..b29b5a75333e 100644
--- a/drivers/clocksource/arc_timer.c
+++ b/drivers/clocksource/arc_timer.c
@@ -13,6 +13,7 @@
  */
 
 #include <linux/interrupt.h>
+#include <linux/bits.h>
 #include <linux/clk.h>
 #include <linux/clk-provider.h>
 #include <linux/clocksource.h>
@@ -139,7 +140,7 @@ static u64 arc_read_rtc(struct clocksource *cs)
                 l = read_aux_reg(AUX_RTC_LOW);
                 h = read_aux_reg(AUX_RTC_HIGH);
                 status = read_aux_reg(AUX_RTC_CTRL);
-        } while (!(status & _BITUL(31)));
+        } while (!(status & BIT(31)));
 
         return (((u64)h) << 32) | l;
 }
diff --git a/drivers/clocksource/arm_arch_timer.c b/drivers/clocksource/arm_arch_timer.c
index 07e57a49d1e8..9a5464c625b4 100644
--- a/drivers/clocksource/arm_arch_timer.c
+++ b/drivers/clocksource/arm_arch_timer.c
@@ -801,14 +801,7 @@ static void arch_timer_evtstrm_enable(int divider)
         cntkctl |= (divider << ARCH_TIMER_EVT_TRIGGER_SHIFT)
                         | ARCH_TIMER_VIRT_EVT_EN;
         arch_timer_set_cntkctl(cntkctl);
-#ifdef CONFIG_ARM64
-        cpu_set_named_feature(EVTSTRM);
-#else
-        elf_hwcap |= HWCAP_EVTSTRM;
-#endif
-#ifdef CONFIG_COMPAT
-        compat_elf_hwcap |= COMPAT_HWCAP_EVTSTRM;
-#endif
+        arch_timer_set_evtstrm_feature();
         cpumask_set_cpu(smp_processor_id(), &evtstrm_available);
 }
 
@@ -1037,11 +1030,7 @@ static int arch_timer_cpu_pm_notify(struct notifier_block *self,
         } else if (action == CPU_PM_ENTER_FAILED || action == CPU_PM_EXIT) {
                 arch_timer_set_cntkctl(__this_cpu_read(saved_cntkctl));
 
-#ifdef CONFIG_ARM64
-                if (cpu_have_named_feature(EVTSTRM))
-#else
-                if (elf_hwcap & HWCAP_EVTSTRM)
-#endif
+                if (arch_timer_have_evtstrm_feature())
                         cpumask_set_cpu(smp_processor_id(), &evtstrm_available);
         }
         return NOTIFY_OK;
diff --git a/drivers/clocksource/exynos_mct.c b/drivers/clocksource/exynos_mct.c
index e8eab16b154b..74cb299f5089 100644
--- a/drivers/clocksource/exynos_mct.c
+++ b/drivers/clocksource/exynos_mct.c
@@ -206,7 +206,7 @@ static void exynos4_frc_resume(struct clocksource *cs)
 
 static struct clocksource mct_frc = {
         .name           = "mct-frc",
-        .rating         = 400,
+        .rating         = 450,  /* use value higher than ARM arch timer */
         .read           = exynos4_frc_read,
         .mask           = CLOCKSOURCE_MASK(32),
         .flags          = CLOCK_SOURCE_IS_CONTINUOUS,
@@ -461,7 +461,7 @@ static int exynos4_mct_starting_cpu(unsigned int cpu)
         evt->set_state_oneshot_stopped = set_state_shutdown;
         evt->tick_resume = set_state_shutdown;
         evt->features = CLOCK_EVT_FEAT_PERIODIC | CLOCK_EVT_FEAT_ONESHOT;
-        evt->rating = 450;
+        evt->rating = 500;      /* use value higher than ARM arch timer */
 
         exynos4_mct_write(TICK_BASE_CNT, mevt->base + MCT_L_TCNTB_OFFSET);
 
diff --git a/drivers/clocksource/hyperv_timer.c b/drivers/clocksource/hyperv_timer.c
new file mode 100644
index 000000000000..ba2c79e6a0ee
--- /dev/null
+++ b/drivers/clocksource/hyperv_timer.c
@@ -0,0 +1,339 @@
+// SPDX-License-Identifier: GPL-2.0
+
+/*
+ * Clocksource driver for the synthetic counter and timers
+ * provided by the Hyper-V hypervisor to guest VMs, as described
+ * in the Hyper-V Top Level Functional Spec (TLFS). This driver
+ * is instruction set architecture independent.
+ *
+ * Copyright (C) 2019, Microsoft, Inc.
+ *
+ * Author:  Michael Kelley <mikelley@microsoft.com>
+ */
+
+#include <linux/percpu.h>
+#include <linux/cpumask.h>
+#include <linux/clockchips.h>
+#include <linux/clocksource.h>
+#include <linux/sched_clock.h>
+#include <linux/mm.h>
+#include <clocksource/hyperv_timer.h>
+#include <asm/hyperv-tlfs.h>
+#include <asm/mshyperv.h>
+
+static struct clock_event_device __percpu *hv_clock_event;
+
+/*
+ * If false, we're using the old mechanism for stimer0 interrupts
+ * where it sends a VMbus message when it expires. The old
+ * mechanism is used when running on older versions of Hyper-V
+ * that don't support Direct Mode. While Hyper-V provides
+ * four stimer's per CPU, Linux uses only stimer0.
+ */
+static bool direct_mode_enabled;
+
+static int stimer0_irq;
+static int stimer0_vector;
+static int stimer0_message_sint;
+
+/*
+ * ISR for when stimer0 is operating in Direct Mode.  Direct Mode
+ * does not use VMbus or any VMbus messages, so process here and not
+ * in the VMbus driver code.
+ */
+void hv_stimer0_isr(void)
+{
+        struct clock_event_device *ce;
+
+        ce = this_cpu_ptr(hv_clock_event);
+        ce->event_handler(ce);
+}
+EXPORT_SYMBOL_GPL(hv_stimer0_isr);
+
+static int hv_ce_set_next_event(unsigned long delta,
+                                struct clock_event_device *evt)
+{
+        u64 current_tick;
+
+        current_tick = hyperv_cs->read(NULL);
+        current_tick += delta;
+        hv_init_timer(0, current_tick);
+        return 0;
+}
+
+static int hv_ce_shutdown(struct clock_event_device *evt)
+{
+        hv_init_timer(0, 0);
+        hv_init_timer_config(0, 0);
+        if (direct_mode_enabled)
+                hv_disable_stimer0_percpu_irq(stimer0_irq);
+
+        return 0;
+}
+
+static int hv_ce_set_oneshot(struct clock_event_device *evt)
+{
+        union hv_stimer_config timer_cfg;
+
+        timer_cfg.as_uint64 = 0;
+        timer_cfg.enable = 1;
+        timer_cfg.auto_enable = 1;
+        if (direct_mode_enabled) {
+                /*
+                 * When it expires, the timer will directly interrupt
+                 * on the specified hardware vector/IRQ.
+                 */
+                timer_cfg.direct_mode = 1;
+                timer_cfg.apic_vector = stimer0_vector;
+                hv_enable_stimer0_percpu_irq(stimer0_irq);
+        } else {
+                /*
+                 * When it expires, the timer will generate a VMbus message,
+                 * to be handled by the normal VMbus interrupt handler.
+                 */
+                timer_cfg.direct_mode = 0;
+                timer_cfg.sintx = stimer0_message_sint;
+        }
+        hv_init_timer_config(0, timer_cfg.as_uint64);
+        return 0;
+}
+
+/*
+ * hv_stimer_init - Per-cpu initialization of the clockevent
+ */
+void hv_stimer_init(unsigned int cpu)
+{
+        struct clock_event_device *ce;
+
+        /*
+         * Synthetic timers are always available except on old versions of
+         * Hyper-V on x86.  In that case, just return as Linux will use a
+         * clocksource based on emulated PIT or LAPIC timer hardware.
+         */
+        if (!(ms_hyperv.features & HV_MSR_SYNTIMER_AVAILABLE))
+                return;
+
+        ce = per_cpu_ptr(hv_clock_event, cpu);
+        ce->name = "Hyper-V clockevent";
+        ce->features = CLOCK_EVT_FEAT_ONESHOT;
+        ce->cpumask = cpumask_of(cpu);
+        ce->rating = 1000;
+        ce->set_state_shutdown = hv_ce_shutdown;
+        ce->set_state_oneshot = hv_ce_set_oneshot;
+        ce->set_next_event = hv_ce_set_next_event;
+
+        clockevents_config_and_register(ce,
+                                        HV_CLOCK_HZ,
+                                        HV_MIN_DELTA_TICKS,
+                                        HV_MAX_MAX_DELTA_TICKS);
+}
+EXPORT_SYMBOL_GPL(hv_stimer_init);
+
+/*
+ * hv_stimer_cleanup - Per-cpu cleanup of the clockevent
+ */
+void hv_stimer_cleanup(unsigned int cpu)
+{
+        struct clock_event_device *ce;
+
+        /* Turn off clockevent device */
+        if (ms_hyperv.features & HV_MSR_SYNTIMER_AVAILABLE) {
+                ce = per_cpu_ptr(hv_clock_event, cpu);
+                hv_ce_shutdown(ce);
+        }
+}
+EXPORT_SYMBOL_GPL(hv_stimer_cleanup);
+
+/* hv_stimer_alloc - Global initialization of the clockevent and stimer0 */
+int hv_stimer_alloc(int sint)
+{
+        int ret;
+
+        hv_clock_event = alloc_percpu(struct clock_event_device);
+        if (!hv_clock_event)
+                return -ENOMEM;
+
+        direct_mode_enabled = ms_hyperv.misc_features &
+                        HV_STIMER_DIRECT_MODE_AVAILABLE;
+        if (direct_mode_enabled) {
+                ret = hv_setup_stimer0_irq(&stimer0_irq, &stimer0_vector,
+                                hv_stimer0_isr);
+                if (ret) {
+                        free_percpu(hv_clock_event);
+                        hv_clock_event = NULL;
+                        return ret;
+                }
+        }
+
+        stimer0_message_sint = sint;
+        return 0;
+}
+EXPORT_SYMBOL_GPL(hv_stimer_alloc);
+
+/* hv_stimer_free - Free global resources allocated by hv_stimer_alloc() */
+void hv_stimer_free(void)
+{
+        if (direct_mode_enabled && (stimer0_irq != 0)) {
+                hv_remove_stimer0_irq(stimer0_irq);
+                stimer0_irq = 0;
+        }
+        free_percpu(hv_clock_event);
+        hv_clock_event = NULL;
+}
+EXPORT_SYMBOL_GPL(hv_stimer_free);
+
+/*
+ * Do a global cleanup of clockevents for the cases of kexec and
+ * vmbus exit
+ */
+void hv_stimer_global_cleanup(void)
+{
+        int     cpu;
+        struct clock_event_device *ce;
+
+        if (ms_hyperv.features & HV_MSR_SYNTIMER_AVAILABLE) {
+                for_each_present_cpu(cpu) {
+                        ce = per_cpu_ptr(hv_clock_event, cpu);
+                        clockevents_unbind_device(ce, cpu);
+                }
+        }
+        hv_stimer_free();
+}
+EXPORT_SYMBOL_GPL(hv_stimer_global_cleanup);
+
+/*
+ * Code and definitions for the Hyper-V clocksources.  Two
+ * clocksources are defined: one that reads the Hyper-V defined MSR, and
+ * the other that uses the TSC reference page feature as defined in the
+ * TLFS.  The MSR version is for compatibility with old versions of
+ * Hyper-V and 32-bit x86.  The TSC reference page version is preferred.
+ */
+
+struct clocksource *hyperv_cs;
+EXPORT_SYMBOL_GPL(hyperv_cs);
+
+#ifdef CONFIG_HYPERV_TSCPAGE
+
+static struct ms_hyperv_tsc_page *tsc_pg;
+
+struct ms_hyperv_tsc_page *hv_get_tsc_page(void)
+{
+        return tsc_pg;
+}
+EXPORT_SYMBOL_GPL(hv_get_tsc_page);
+
+static u64 notrace read_hv_sched_clock_tsc(void)
+{
+        u64 current_tick = hv_read_tsc_page(tsc_pg);
+
+        if (current_tick == U64_MAX)
+                hv_get_time_ref_count(current_tick);
+
+        return current_tick;
+}
+
+static u64 read_hv_clock_tsc(struct clocksource *arg)
+{
+        return read_hv_sched_clock_tsc();
+}
+
+static struct clocksource hyperv_cs_tsc = {
+        .name   = "hyperv_clocksource_tsc_page",
+        .rating = 400,
+        .read   = read_hv_clock_tsc,
+        .mask   = CLOCKSOURCE_MASK(64),
+        .flags  = CLOCK_SOURCE_IS_CONTINUOUS,
+};
+#endif
+
+static u64 notrace read_hv_sched_clock_msr(void)
+{
+        u64 current_tick;
+        /*
+         * Read the partition counter to get the current tick count. This count
+         * is set to 0 when the partition is created and is incremented in
+         * 100 nanosecond units.
+         */
+        hv_get_time_ref_count(current_tick);
+        return current_tick;
+}
+
+static u64 read_hv_clock_msr(struct clocksource *arg)
+{
+        return read_hv_sched_clock_msr();
+}
+
+static struct clocksource hyperv_cs_msr = {
+        .name   = "hyperv_clocksource_msr",
+        .rating = 400,
+        .read   = read_hv_clock_msr,
+        .mask   = CLOCKSOURCE_MASK(64),
+        .flags  = CLOCK_SOURCE_IS_CONTINUOUS,
+};
+
+#ifdef CONFIG_HYPERV_TSCPAGE
+static bool __init hv_init_tsc_clocksource(void)
+{
+        u64             tsc_msr;
+        phys_addr_t     phys_addr;
+
+        if (!(ms_hyperv.features & HV_MSR_REFERENCE_TSC_AVAILABLE))
+                return false;
+
+        tsc_pg = vmalloc(PAGE_SIZE);
+        if (!tsc_pg)
+                return false;
+
+        hyperv_cs = &hyperv_cs_tsc;
+        phys_addr = page_to_phys(vmalloc_to_page(tsc_pg));
+
+        /*
+         * The Hyper-V TLFS specifies to preserve the value of reserved
+         * bits in registers. So read the existing value, preserve the
+         * low order 12 bits, and add in the guest physical address
+         * (which already has at least the low 12 bits set to zero since
+         * it is page aligned). Also set the "enable" bit, which is bit 0.
+         */
+        hv_get_reference_tsc(tsc_msr);
+        tsc_msr &= GENMASK_ULL(11, 0);
+        tsc_msr = tsc_msr | 0x1 | (u64)phys_addr;
+        hv_set_reference_tsc(tsc_msr);
+
+        hv_set_clocksource_vdso(hyperv_cs_tsc);
+        clocksource_register_hz(&hyperv_cs_tsc, NSEC_PER_SEC/100);
+
+        /* sched_clock_register is needed on ARM64 but is a no-op on x86 */
+        sched_clock_register(read_hv_sched_clock_tsc, 64, HV_CLOCK_HZ);
+        return true;
+}
+#else
+static bool __init hv_init_tsc_clocksource(void)
+{
+        return false;
+}
+#endif
+
+
+void __init hv_init_clocksource(void)
+{
+        /*
+         * Try to set up the TSC page clocksource. If it succeeds, we're
+         * done. Otherwise, set up the MSR clocksoruce.  At least one of
+         * these will always be available except on very old versions of
+         * Hyper-V on x86.  In that case we won't have a Hyper-V
+         * clocksource, but Linux will still run with a clocksource based
+         * on the emulated PIT or LAPIC timer.
+         */
+        if (hv_init_tsc_clocksource())
+                return;
+
+        if (!(ms_hyperv.features & HV_MSR_TIME_REF_COUNT_AVAILABLE))
+                return;
+
+        hyperv_cs = &hyperv_cs_msr;
+        clocksource_register_hz(&hyperv_cs_msr, NSEC_PER_SEC/100);
+
+        /* sched_clock_register is needed on ARM64 but is a no-op on x86 */
+        sched_clock_register(read_hv_sched_clock_msr, 64, HV_CLOCK_HZ);
+}
+EXPORT_SYMBOL_GPL(hv_init_clocksource);
diff --git a/drivers/clocksource/timer-davinci.c b/drivers/clocksource/timer-davinci.c
new file mode 100644
index 000000000000..62745c962049
--- /dev/null
+++ b/drivers/clocksource/timer-davinci.c
@@ -0,0 +1,369 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * TI DaVinci clocksource driver
+ *
+ * Copyright (C) 2019 Texas Instruments
+ * Author: Bartosz Golaszewski <bgolaszewski@baylibre.com>
+ * (with tiny parts adopted from code by Kevin Hilman <khilman@baylibre.com>)
+ */
+
+#include <linux/clk.h>
+#include <linux/clockchips.h>
+#include <linux/interrupt.h>
+#include <linux/kernel.h>
+#include <linux/of_address.h>
+#include <linux/of_irq.h>
+#include <linux/sched_clock.h>
+
+#include <clocksource/timer-davinci.h>
+
+#undef pr_fmt
+#define pr_fmt(fmt) "%s: " fmt "\n", __func__
+
+#define DAVINCI_TIMER_REG_TIM12                 0x10
+#define DAVINCI_TIMER_REG_TIM34                 0x14
+#define DAVINCI_TIMER_REG_PRD12                 0x18
+#define DAVINCI_TIMER_REG_PRD34                 0x1c
+#define DAVINCI_TIMER_REG_TCR                   0x20
+#define DAVINCI_TIMER_REG_TGCR                  0x24
+
+#define DAVINCI_TIMER_TIMMODE_MASK              GENMASK(3, 2)
+#define DAVINCI_TIMER_RESET_MASK                GENMASK(1, 0)
+#define DAVINCI_TIMER_TIMMODE_32BIT_UNCHAINED   BIT(2)
+#define DAVINCI_TIMER_UNRESET                   GENMASK(1, 0)
+
+#define DAVINCI_TIMER_ENAMODE_MASK              GENMASK(1, 0)
+#define DAVINCI_TIMER_ENAMODE_DISABLED          0x00
+#define DAVINCI_TIMER_ENAMODE_ONESHOT           BIT(0)
+#define DAVINCI_TIMER_ENAMODE_PERIODIC          BIT(1)
+
+#define DAVINCI_TIMER_ENAMODE_SHIFT_TIM12       6
+#define DAVINCI_TIMER_ENAMODE_SHIFT_TIM34       22
+
+#define DAVINCI_TIMER_MIN_DELTA                 0x01
+#define DAVINCI_TIMER_MAX_DELTA                 0xfffffffe
+
+#define DAVINCI_TIMER_CLKSRC_BITS               32
+
+#define DAVINCI_TIMER_TGCR_DEFAULT \
+                (DAVINCI_TIMER_TIMMODE_32BIT_UNCHAINED | DAVINCI_TIMER_UNRESET)
+
+struct davinci_clockevent {
+        struct clock_event_device dev;
+        void __iomem *base;
+        unsigned int cmp_off;
+};
+
+/*
+ * This must be globally accessible by davinci_timer_read_sched_clock(), so
+ * let's keep it here.
+ */
+static struct {
+        struct clocksource dev;
+        void __iomem *base;
+        unsigned int tim_off;
+} davinci_clocksource;
+
+static struct davinci_clockevent *
+to_davinci_clockevent(struct clock_event_device *clockevent)
+{
+        return container_of(clockevent, struct davinci_clockevent, dev);
+}
+
+static unsigned int
+davinci_clockevent_read(struct davinci_clockevent *clockevent,
+                        unsigned int reg)
+{
+        return readl_relaxed(clockevent->base + reg);
+}
+
+static void davinci_clockevent_write(struct davinci_clockevent *clockevent,
+                                     unsigned int reg, unsigned int val)
+{
+        writel_relaxed(val, clockevent->base + reg);
+}
+
+static void davinci_tim12_shutdown(void __iomem *base)
+{
+        unsigned int tcr;
+
+        tcr = DAVINCI_TIMER_ENAMODE_DISABLED <<
+                DAVINCI_TIMER_ENAMODE_SHIFT_TIM12;
+        /*
+         * This function is only ever called if we're using both timer
+         * halves. In this case TIM34 runs in periodic mode and we must
+         * not modify it.
+         */
+        tcr |= DAVINCI_TIMER_ENAMODE_PERIODIC <<
+                DAVINCI_TIMER_ENAMODE_SHIFT_TIM34;
+
+        writel_relaxed(tcr, base + DAVINCI_TIMER_REG_TCR);
+}
+
+static void davinci_tim12_set_oneshot(void __iomem *base)
+{
+        unsigned int tcr;
+
+        tcr = DAVINCI_TIMER_ENAMODE_ONESHOT <<
+                DAVINCI_TIMER_ENAMODE_SHIFT_TIM12;
+        /* Same as above. */
+        tcr |= DAVINCI_TIMER_ENAMODE_PERIODIC <<
+                DAVINCI_TIMER_ENAMODE_SHIFT_TIM34;
+
+        writel_relaxed(tcr, base + DAVINCI_TIMER_REG_TCR);
+}
+
+static int davinci_clockevent_shutdown(struct clock_event_device *dev)
+{
+        struct davinci_clockevent *clockevent;
+
+        clockevent = to_davinci_clockevent(dev);
+
+        davinci_tim12_shutdown(clockevent->base);
+
+        return 0;
+}
+
+static int davinci_clockevent_set_oneshot(struct clock_event_device *dev)
+{
+        struct davinci_clockevent *clockevent = to_davinci_clockevent(dev);
+
+        davinci_clockevent_write(clockevent, DAVINCI_TIMER_REG_TIM12, 0x0);
+
+        davinci_tim12_set_oneshot(clockevent->base);
+
+        return 0;
+}
+
+static int
+davinci_clockevent_set_next_event_std(unsigned long cycles,
+                                      struct clock_event_device *dev)
+{
+        struct davinci_clockevent *clockevent = to_davinci_clockevent(dev);
+
+        davinci_clockevent_shutdown(dev);
+
+        davinci_clockevent_write(clockevent, DAVINCI_TIMER_REG_TIM12, 0x0);
+        davinci_clockevent_write(clockevent, DAVINCI_TIMER_REG_PRD12, cycles);
+
+        davinci_clockevent_set_oneshot(dev);
+
+        return 0;
+}
+
+static int
+davinci_clockevent_set_next_event_cmp(unsigned long cycles,
+                                      struct clock_event_device *dev)
+{
+        struct davinci_clockevent *clockevent = to_davinci_clockevent(dev);
+        unsigned int curr_time;
+
+        curr_time = davinci_clockevent_read(clockevent,
+                                            DAVINCI_TIMER_REG_TIM12);
+        davinci_clockevent_write(clockevent,
+                                 clockevent->cmp_off, curr_time + cycles);
+
+        return 0;
+}
+
+static irqreturn_t davinci_timer_irq_timer(int irq, void *data)
+{
+        struct davinci_clockevent *clockevent = data;
+
+        if (!clockevent_state_oneshot(&clockevent->dev))
+                davinci_tim12_shutdown(clockevent->base);
+
+        clockevent->dev.event_handler(&clockevent->dev);
+
+        return IRQ_HANDLED;
+}
+
+static u64 notrace davinci_timer_read_sched_clock(void)
+{
+        return readl_relaxed(davinci_clocksource.base +
+                             davinci_clocksource.tim_off);
+}
+
+static u64 davinci_clocksource_read(struct clocksource *dev)
+{
+        return davinci_timer_read_sched_clock();
+}
+
+/*
+ * Standard use-case: we're using tim12 for clockevent and tim34 for
+ * clocksource. The default is making the former run in oneshot mode
+ * and the latter in periodic mode.
+ */
+static void davinci_clocksource_init_tim34(void __iomem *base)
+{
+        int tcr;
+
+        tcr = DAVINCI_TIMER_ENAMODE_PERIODIC <<
+                DAVINCI_TIMER_ENAMODE_SHIFT_TIM34;
+        tcr |= DAVINCI_TIMER_ENAMODE_ONESHOT <<
+                DAVINCI_TIMER_ENAMODE_SHIFT_TIM12;
+
+        writel_relaxed(0x0, base + DAVINCI_TIMER_REG_TIM34);
+        writel_relaxed(UINT_MAX, base + DAVINCI_TIMER_REG_PRD34);
+        writel_relaxed(tcr, base + DAVINCI_TIMER_REG_TCR);
+}
+
+/*
+ * Special use-case on da830: the DSP may use tim34. We're using tim12 for
+ * both clocksource and clockevent. We set tim12 to periodic and don't touch
+ * tim34.
+ */
+static void davinci_clocksource_init_tim12(void __iomem *base)
+{
+        unsigned int tcr;
+
+        tcr = DAVINCI_TIMER_ENAMODE_PERIODIC <<
+                DAVINCI_TIMER_ENAMODE_SHIFT_TIM12;
+
+        writel_relaxed(0x0, base + DAVINCI_TIMER_REG_TIM12);
+        writel_relaxed(UINT_MAX, base + DAVINCI_TIMER_REG_PRD12);
+        writel_relaxed(tcr, base + DAVINCI_TIMER_REG_TCR);
+}
+
+static void davinci_timer_init(void __iomem *base)
+{
+        /* Set clock to internal mode and disable it. */
+        writel_relaxed(0x0, base + DAVINCI_TIMER_REG_TCR);
+        /*
+         * Reset both 32-bit timers, set no prescaler for timer 34, set the
+         * timer to dual 32-bit unchained mode, unreset both 32-bit timers.
+         */
+        writel_relaxed(DAVINCI_TIMER_TGCR_DEFAULT,
+                       base + DAVINCI_TIMER_REG_TGCR);
+        /* Init both counters to zero. */
+        writel_relaxed(0x0, base + DAVINCI_TIMER_REG_TIM12);
+        writel_relaxed(0x0, base + DAVINCI_TIMER_REG_TIM34);
+}
+
+int __init davinci_timer_register(struct clk *clk,
+                                  const struct davinci_timer_cfg *timer_cfg)
+{
+        struct davinci_clockevent *clockevent;
+        unsigned int tick_rate;
+        void __iomem *base;
+        int rv;
+
+        rv = clk_prepare_enable(clk);
+        if (rv) {
+                pr_err("Unable to prepare and enable the timer clock");
+                return rv;
+        }
+
+        if (!request_mem_region(timer_cfg->reg.start,
+                                resource_size(&timer_cfg->reg),
+                                "davinci-timer")) {
+                pr_err("Unable to request memory region");
+                return -EBUSY;
+        }
+
+        base = ioremap(timer_cfg->reg.start, resource_size(&timer_cfg->reg));
+        if (!base) {
+                pr_err("Unable to map the register range");
+                return -ENOMEM;
+        }
+
+        davinci_timer_init(base);
+        tick_rate = clk_get_rate(clk);
+
+        clockevent = kzalloc(sizeof(*clockevent), GFP_KERNEL | __GFP_NOFAIL);
+        if (!clockevent) {
+                pr_err("Error allocating memory for clockevent data");
+                return -ENOMEM;
+        }
+
+        clockevent->dev.name = "tim12";
+        clockevent->dev.features = CLOCK_EVT_FEAT_ONESHOT;
+        clockevent->dev.cpumask = cpumask_of(0);
+        clockevent->base = base;
+
+        if (timer_cfg->cmp_off) {
+                clockevent->cmp_off = timer_cfg->cmp_off;
+                clockevent->dev.set_next_event =
+                                davinci_clockevent_set_next_event_cmp;
+        } else {
+                clockevent->dev.set_next_event =
+                                davinci_clockevent_set_next_event_std;
+                clockevent->dev.set_state_oneshot =
+                                davinci_clockevent_set_oneshot;
+                clockevent->dev.set_state_shutdown =
+                                davinci_clockevent_shutdown;
+        }
+
+        rv = request_irq(timer_cfg->irq[DAVINCI_TIMER_CLOCKEVENT_IRQ].start,
+                         davinci_timer_irq_timer, IRQF_TIMER,
+                         "clockevent/tim12", clockevent);
+        if (rv) {
+                pr_err("Unable to request the clockevent interrupt");
+                return rv;
+        }
+
+        clockevents_config_and_register(&clockevent->dev, tick_rate,
+                                        DAVINCI_TIMER_MIN_DELTA,
+                                        DAVINCI_TIMER_MAX_DELTA);
+
+        davinci_clocksource.dev.rating = 300;
+        davinci_clocksource.dev.read = davinci_clocksource_read;
+        davinci_clocksource.dev.mask =
+                        CLOCKSOURCE_MASK(DAVINCI_TIMER_CLKSRC_BITS);
+        davinci_clocksource.dev.flags = CLOCK_SOURCE_IS_CONTINUOUS;
+        davinci_clocksource.base = base;
+
+        if (timer_cfg->cmp_off) {
+                davinci_clocksource.dev.name = "tim12";
+                davinci_clocksource.tim_off = DAVINCI_TIMER_REG_TIM12;
+                davinci_clocksource_init_tim12(base);
+        } else {
+                davinci_clocksource.dev.name = "tim34";
+                davinci_clocksource.tim_off = DAVINCI_TIMER_REG_TIM34;
+                davinci_clocksource_init_tim34(base);
+        }
+
+        rv = clocksource_register_hz(&davinci_clocksource.dev, tick_rate);
+        if (rv) {
+                pr_err("Unable to register clocksource");
+                return rv;
+        }
+
+        sched_clock_register(davinci_timer_read_sched_clock,
+                             DAVINCI_TIMER_CLKSRC_BITS, tick_rate);
+
+        return 0;
+}
+
+static int __init of_davinci_timer_register(struct device_node *np)
+{
+        struct davinci_timer_cfg timer_cfg = { };
+        struct clk *clk;
+        int rv;
+
+        rv = of_address_to_resource(np, 0, &timer_cfg.reg);
+        if (rv) {
+                pr_err("Unable to get the register range for timer");
+                return rv;
+        }
+
+        rv = of_irq_to_resource_table(np, timer_cfg.irq,
+                                      DAVINCI_TIMER_NUM_IRQS);
+        if (rv != DAVINCI_TIMER_NUM_IRQS) {
+                pr_err("Unable to get the interrupts for timer");
+                return rv;
+        }
+
+        clk = of_clk_get(np, 0);
+        if (IS_ERR(clk)) {
+                pr_err("Unable to get the timer clock");
+                return PTR_ERR(clk);
+        }
+
+        rv = davinci_timer_register(clk, &timer_cfg);
+        if (rv)
+                clk_put(clk);
+
+        return rv;
+}
+TIMER_OF_DECLARE(davinci_timer, "ti,da830-timer", of_davinci_timer_register);
diff --git a/drivers/clocksource/timer-imx-sysctr.c b/drivers/clocksource/timer-imx-sysctr.c
new file mode 100644
index 000000000000..fd7d68066efb
--- /dev/null
+++ b/drivers/clocksource/timer-imx-sysctr.c
@@ -0,0 +1,145 @@
+// SPDX-License-Identifier: GPL-2.0+
+//
+// Copyright 2017-2019 NXP
+
+#include <linux/interrupt.h>
+#include <linux/clockchips.h>
+#include <linux/of_address.h>
+#include <linux/of_irq.h>
+
+#include "timer-of.h"
+
+#define CMP_OFFSET      0x10000
+
+#define CNTCV_LO        0x8
+#define CNTCV_HI        0xc
+#define CMPCV_LO        (CMP_OFFSET + 0x20)
+#define CMPCV_HI        (CMP_OFFSET + 0x24)
+#define CMPCR           (CMP_OFFSET + 0x2c)
+
+#define SYS_CTR_EN              0x1
+#define SYS_CTR_IRQ_MASK        0x2
+
+static void __iomem *sys_ctr_base;
+static u32 cmpcr;
+
+static void sysctr_timer_enable(bool enable)
+{
+        writel(enable ? cmpcr | SYS_CTR_EN : cmpcr, sys_ctr_base + CMPCR);
+}
+
+static void sysctr_irq_acknowledge(void)
+{
+        /*
+         * clear the enable bit(EN =0) will clear
+         * the status bit(ISTAT = 0), then the interrupt
+         * signal will be negated(acknowledged).
+         */
+        sysctr_timer_enable(false);
+}
+
+static inline u64 sysctr_read_counter(void)
+{
+        u32 cnt_hi, tmp_hi, cnt_lo;
+
+        do {
+                cnt_hi = readl_relaxed(sys_ctr_base + CNTCV_HI);
+                cnt_lo = readl_relaxed(sys_ctr_base + CNTCV_LO);
+                tmp_hi = readl_relaxed(sys_ctr_base + CNTCV_HI);
+        } while (tmp_hi != cnt_hi);
+
+        return  ((u64) cnt_hi << 32) | cnt_lo;
+}
+
+static int sysctr_set_next_event(unsigned long delta,
+                                 struct clock_event_device *evt)
+{
+        u32 cmp_hi, cmp_lo;
+        u64 next;
+
+        sysctr_timer_enable(false);
+
+        next = sysctr_read_counter();
+
+        next += delta;
+
+        cmp_hi = (next >> 32) & 0x00fffff;
+        cmp_lo = next & 0xffffffff;
+
+        writel_relaxed(cmp_hi, sys_ctr_base + CMPCV_HI);
+        writel_relaxed(cmp_lo, sys_ctr_base + CMPCV_LO);
+
+        sysctr_timer_enable(true);
+
+        return 0;
+}
+
+static int sysctr_set_state_oneshot(struct clock_event_device *evt)
+{
+        return 0;
+}
+
+static int sysctr_set_state_shutdown(struct clock_event_device *evt)
+{
+        sysctr_timer_enable(false);
+
+        return 0;
+}
+
+static irqreturn_t sysctr_timer_interrupt(int irq, void *dev_id)
+{
+        struct clock_event_device *evt = dev_id;
+
+        sysctr_irq_acknowledge();
+
+        evt->event_handler(evt);
+
+        return IRQ_HANDLED;
+}
+
+static struct timer_of to_sysctr = {
+        .flags = TIMER_OF_IRQ | TIMER_OF_CLOCK | TIMER_OF_BASE,
+        .clkevt = {
+                .name                   = "i.MX system counter timer",
+                .features               = CLOCK_EVT_FEAT_ONESHOT |
+                                                CLOCK_EVT_FEAT_DYNIRQ,
+                .set_state_oneshot      = sysctr_set_state_oneshot,
+                .set_next_event         = sysctr_set_next_event,
+                .set_state_shutdown     = sysctr_set_state_shutdown,
+                .rating                 = 200,
+        },
+        .of_irq = {
+                .handler                = sysctr_timer_interrupt,
+                .flags                  = IRQF_TIMER | IRQF_IRQPOLL,
+        },
+        .of_clk = {
+                .name = "per",
+        },
+};
+
+static void __init sysctr_clockevent_init(void)
+{
+        to_sysctr.clkevt.cpumask = cpumask_of(0);
+
+        clockevents_config_and_register(&to_sysctr.clkevt,
+                                        timer_of_rate(&to_sysctr),
+                                        0xff, 0x7fffffff);
+}
+
+static int __init sysctr_timer_init(struct device_node *np)
+{
+        int ret = 0;
+
+        ret = timer_of_init(np, &to_sysctr);
+        if (ret)
+                return ret;
+
+        sys_ctr_base = timer_of_base(&to_sysctr);
+        cmpcr = readl(sys_ctr_base + CMPCR);
+        cmpcr &= ~SYS_CTR_EN;
+
+        sysctr_clockevent_init();
+
+        return 0;
+}
+TIMER_OF_DECLARE(sysctr_timer, "nxp,sysctr-timer", sysctr_timer_init);
diff --git a/drivers/clocksource/timer-ixp4xx.c b/drivers/clocksource/timer-ixp4xx.c
index 5c2190b654cd..9396745e1c17 100644
--- a/drivers/clocksource/timer-ixp4xx.c
+++ b/drivers/clocksource/timer-ixp4xx.c
@@ -75,14 +75,19 @@ to_ixp4xx_timer(struct clock_event_device *evt)
         return container_of(evt, struct ixp4xx_timer, clkevt);
 }
 
-static u64 notrace ixp4xx_read_sched_clock(void)
+static unsigned long ixp4xx_read_timer(void)
 {
         return __raw_readl(local_ixp4xx_timer->base + IXP4XX_OSTS_OFFSET);
 }
 
+static u64 notrace ixp4xx_read_sched_clock(void)
+{
+        return ixp4xx_read_timer();
+}
+
 static u64 ixp4xx_clocksource_read(struct clocksource *c)
 {
-        return __raw_readl(local_ixp4xx_timer->base + IXP4XX_OSTS_OFFSET);
+        return ixp4xx_read_timer();
 }
 
 static irqreturn_t ixp4xx_timer_interrupt(int irq, void *dev_id)
@@ -224,6 +229,13 @@ static __init int ixp4xx_timer_register(void __iomem *base,
 
         sched_clock_register(ixp4xx_read_sched_clock, 32, timer_freq);
 
+#ifdef CONFIG_ARM
+        /* Also use this timer for delays */
+        tmr->delay_timer.read_current_timer = ixp4xx_read_timer;
+        tmr->delay_timer.freq = timer_freq;
+        register_current_timer_delay(&tmr->delay_timer);
+#endif
+
         return 0;
 }
 
diff --git a/drivers/clocksource/timer-meson6.c b/drivers/clocksource/timer-meson6.c
index 84bd9479c3f8..9e8b467c71da 100644
--- a/drivers/clocksource/timer-meson6.c
+++ b/drivers/clocksource/timer-meson6.c
@@ -1,13 +1,10 @@
+// SPDX-License-Identifier: GPL-2.0
 /*
  * Amlogic Meson6 SoCs timer handling.
  *
  * Copyright (C) 2014 Carlo Caione <carlo@caione.org>
  *
  * Based on code from Amlogic, Inc
- *
- * This file is licensed under the terms of the GNU General Public
- * License version 2.  This program is licensed "as is" without any
- * warranty of any kind, whether express or implied.
  */
 
 #include <linux/bitfield.h>
diff --git a/drivers/clocksource/timer-tegra.c b/drivers/clocksource/timer-tegra.c
new file mode 100644
index 000000000000..e9635c25eef4
--- /dev/null
+++ b/drivers/clocksource/timer-tegra.c
@@ -0,0 +1,416 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (C) 2010 Google, Inc.
+ *
+ * Author:
+ *      Colin Cross <ccross@google.com>
+ */
+
+#define pr_fmt(fmt)     "tegra-timer: " fmt
+
+#include <linux/clk.h>
+#include <linux/clockchips.h>
+#include <linux/cpu.h>
+#include <linux/cpumask.h>
+#include <linux/delay.h>
+#include <linux/err.h>
+#include <linux/interrupt.h>
+#include <linux/of_address.h>
+#include <linux/of_irq.h>
+#include <linux/percpu.h>
+#include <linux/sched_clock.h>
+#include <linux/time.h>
+
+#include "timer-of.h"
+
+#define RTC_SECONDS             0x08
+#define RTC_SHADOW_SECONDS      0x0c
+#define RTC_MILLISECONDS        0x10
+
+#define TIMERUS_CNTR_1US        0x10
+#define TIMERUS_USEC_CFG        0x14
+#define TIMERUS_CNTR_FREEZE     0x4c
+
+#define TIMER_PTV               0x0
+#define TIMER_PTV_EN            BIT(31)
+#define TIMER_PTV_PER           BIT(30)
+#define TIMER_PCR               0x4
+#define TIMER_PCR_INTR_CLR      BIT(30)
+
+#define TIMER1_BASE             0x00
+#define TIMER2_BASE             0x08
+#define TIMER3_BASE             0x50
+#define TIMER4_BASE             0x58
+#define TIMER10_BASE            0x90
+
+#define TIMER1_IRQ_IDX          0
+#define TIMER10_IRQ_IDX         10
+
+#define TIMER_1MHz              1000000
+
+static u32 usec_config;
+static void __iomem *timer_reg_base;
+
+static int tegra_timer_set_next_event(unsigned long cycles,
+                                      struct clock_event_device *evt)
+{
+        void __iomem *reg_base = timer_of_base(to_timer_of(evt));
+
+        /*
+         * Tegra's timer uses n+1 scheme for the counter, i.e. timer will
+         * fire after one tick if 0 is loaded.
+         *
+         * The minimum and maximum numbers of oneshot ticks are defined
+         * by clockevents_config_and_register(1, 0x1fffffff + 1) invocation
+         * below in the code. Hence the cycles (ticks) can't be outside of
+         * a range supportable by hardware.
+         */
+        writel_relaxed(TIMER_PTV_EN | (cycles - 1), reg_base + TIMER_PTV);
+
+        return 0;
+}
+
+static int tegra_timer_shutdown(struct clock_event_device *evt)
+{
+        void __iomem *reg_base = timer_of_base(to_timer_of(evt));
+
+        writel_relaxed(0, reg_base + TIMER_PTV);
+
+        return 0;
+}
+
+static int tegra_timer_set_periodic(struct clock_event_device *evt)
+{
+        void __iomem *reg_base = timer_of_base(to_timer_of(evt));
+        unsigned long period = timer_of_period(to_timer_of(evt));
+
+        writel_relaxed(TIMER_PTV_EN | TIMER_PTV_PER | (period - 1),
+                       reg_base + TIMER_PTV);
+
+        return 0;
+}
+
+static irqreturn_t tegra_timer_isr(int irq, void *dev_id)
+{
+        struct clock_event_device *evt = dev_id;
+        void __iomem *reg_base = timer_of_base(to_timer_of(evt));
+
+        writel_relaxed(TIMER_PCR_INTR_CLR, reg_base + TIMER_PCR);
+        evt->event_handler(evt);
+
+        return IRQ_HANDLED;
+}
+
+static void tegra_timer_suspend(struct clock_event_device *evt)
+{
+        void __iomem *reg_base = timer_of_base(to_timer_of(evt));
+
+        writel_relaxed(TIMER_PCR_INTR_CLR, reg_base + TIMER_PCR);
+}
+
+static void tegra_timer_resume(struct clock_event_device *evt)
+{
+        writel_relaxed(usec_config, timer_reg_base + TIMERUS_USEC_CFG);
+}
+
+static DEFINE_PER_CPU(struct timer_of, tegra_to) = {
+        .flags = TIMER_OF_CLOCK | TIMER_OF_BASE,
+
+        .clkevt = {
+                .name = "tegra_timer",
+                .features = CLOCK_EVT_FEAT_ONESHOT | CLOCK_EVT_FEAT_PERIODIC,
+                .set_next_event = tegra_timer_set_next_event,
+                .set_state_shutdown = tegra_timer_shutdown,
+                .set_state_periodic = tegra_timer_set_periodic,
+                .set_state_oneshot = tegra_timer_shutdown,
+                .tick_resume = tegra_timer_shutdown,
+                .suspend = tegra_timer_suspend,
+                .resume = tegra_timer_resume,
+        },
+};
+
+static int tegra_timer_setup(unsigned int cpu)
+{
+        struct timer_of *to = per_cpu_ptr(&tegra_to, cpu);
+
+        writel_relaxed(0, timer_of_base(to) + TIMER_PTV);
+        writel_relaxed(TIMER_PCR_INTR_CLR, timer_of_base(to) + TIMER_PCR);
+
+        irq_force_affinity(to->clkevt.irq, cpumask_of(cpu));
+        enable_irq(to->clkevt.irq);
+
+        /*
+         * Tegra's timer uses n+1 scheme for the counter, i.e. timer will
+         * fire after one tick if 0 is loaded and thus minimum number of
+         * ticks is 1. In result both of the clocksource's tick limits are
+         * higher than a minimum and maximum that hardware register can
+         * take by 1, this is then taken into account by set_next_event
+         * callback.
+         */
+        clockevents_config_and_register(&to->clkevt, timer_of_rate(to),
+                                        1, /* min */
+                                        0x1fffffff + 1); /* max 29 bits + 1 */
+
+        return 0;
+}
+
+static int tegra_timer_stop(unsigned int cpu)
+{
+        struct timer_of *to = per_cpu_ptr(&tegra_to, cpu);
+
+        to->clkevt.set_state_shutdown(&to->clkevt);
+        disable_irq_nosync(to->clkevt.irq);
+
+        return 0;
+}
+
+static u64 notrace tegra_read_sched_clock(void)
+{
+        return readl_relaxed(timer_reg_base + TIMERUS_CNTR_1US);
+}
+
+#ifdef CONFIG_ARM
+static unsigned long tegra_delay_timer_read_counter_long(void)
+{
+        return readl_relaxed(timer_reg_base + TIMERUS_CNTR_1US);
+}
+
+static struct delay_timer tegra_delay_timer = {
+        .read_current_timer = tegra_delay_timer_read_counter_long,
+        .freq = TIMER_1MHz,
+};
+#endif
+
+static struct timer_of suspend_rtc_to = {
+        .flags = TIMER_OF_BASE | TIMER_OF_CLOCK,
+};
+
+/*
+ * tegra_rtc_read - Reads the Tegra RTC registers
+ * Care must be taken that this function is not called while the
+ * tegra_rtc driver could be executing to avoid race conditions
+ * on the RTC shadow register
+ */
+static u64 tegra_rtc_read_ms(struct clocksource *cs)
+{
+        void __iomem *reg_base = timer_of_base(&suspend_rtc_to);
+
+        u32 ms = readl_relaxed(reg_base + RTC_MILLISECONDS);
+        u32 s = readl_relaxed(reg_base + RTC_SHADOW_SECONDS);
+
+        return (u64)s * MSEC_PER_SEC + ms;
+}
+
+static struct clocksource suspend_rtc_clocksource = {
+        .name   = "tegra_suspend_timer",
+        .rating = 200,
+        .read   = tegra_rtc_read_ms,
+        .mask   = CLOCKSOURCE_MASK(32),
+        .flags  = CLOCK_SOURCE_IS_CONTINUOUS | CLOCK_SOURCE_SUSPEND_NONSTOP,
+};
+
+static inline unsigned int tegra_base_for_cpu(int cpu, bool tegra20)
+{
+        if (tegra20) {
+                switch (cpu) {
+                case 0:
+                        return TIMER1_BASE;
+                case 1:
+                        return TIMER2_BASE;
+                case 2:
+                        return TIMER3_BASE;
+                default:
+                        return TIMER4_BASE;
+                }
+        }
+
+        return TIMER10_BASE + cpu * 8;
+}
+
+static inline unsigned int tegra_irq_idx_for_cpu(int cpu, bool tegra20)
+{
+        if (tegra20)
+                return TIMER1_IRQ_IDX + cpu;
+
+        return TIMER10_IRQ_IDX + cpu;
+}
+
+static inline unsigned long tegra_rate_for_timer(struct timer_of *to,
+                                                 bool tegra20)
+{
+        /*
+         * TIMER1-9 are fixed to 1MHz, TIMER10-13 are running off the
+         * parent clock.
+         */
+        if (tegra20)
+                return TIMER_1MHz;
+
+        return timer_of_rate(to);
+}
+
+static int __init tegra_init_timer(struct device_node *np, bool tegra20,
+                                   int rating)
+{
+        struct timer_of *to;
+        int cpu, ret;
+
+        to = this_cpu_ptr(&tegra_to);
+        ret = timer_of_init(np, to);
+        if (ret)
+                goto out;
+
+        timer_reg_base = timer_of_base(to);
+
+        /*
+         * Configure microsecond timers to have 1MHz clock
+         * Config register is 0xqqww, where qq is "dividend", ww is "divisor"
+         * Uses n+1 scheme
+         */
+        switch (timer_of_rate(to)) {
+        case 12000000:
+                usec_config = 0x000b; /* (11+1)/(0+1) */
+                break;
+        case 12800000:
+                usec_config = 0x043f; /* (63+1)/(4+1) */
+                break;
+        case 13000000:
+                usec_config = 0x000c; /* (12+1)/(0+1) */
+                break;
+        case 16800000:
+                usec_config = 0x0453; /* (83+1)/(4+1) */
+                break;
+        case 19200000:
+                usec_config = 0x045f; /* (95+1)/(4+1) */
+                break;
+        case 26000000:
+                usec_config = 0x0019; /* (25+1)/(0+1) */
+                break;
+        case 38400000:
+                usec_config = 0x04bf; /* (191+1)/(4+1) */
+                break;
+        case 48000000:
+                usec_config = 0x002f; /* (47+1)/(0+1) */
+                break;
+        default:
+                ret = -EINVAL;
+                goto out;
+        }
+
+        writel_relaxed(usec_config, timer_reg_base + TIMERUS_USEC_CFG);
+
+        for_each_possible_cpu(cpu) {
+                struct timer_of *cpu_to = per_cpu_ptr(&tegra_to, cpu);
+                unsigned long flags = IRQF_TIMER | IRQF_NOBALANCING;
+                unsigned long rate = tegra_rate_for_timer(to, tegra20);
+                unsigned int base = tegra_base_for_cpu(cpu, tegra20);
+                unsigned int idx = tegra_irq_idx_for_cpu(cpu, tegra20);
+                unsigned int irq = irq_of_parse_and_map(np, idx);
+
+                if (!irq) {
+                        pr_err("failed to map irq for cpu%d\n", cpu);
+                        ret = -EINVAL;
+                        goto out_irq;
+                }
+
+                cpu_to->clkevt.irq = irq;
+                cpu_to->clkevt.rating = rating;
+                cpu_to->clkevt.cpumask = cpumask_of(cpu);
+                cpu_to->of_base.base = timer_reg_base + base;
+                cpu_to->of_clk.period = rate / HZ;
+                cpu_to->of_clk.rate = rate;
+
+                irq_set_status_flags(cpu_to->clkevt.irq, IRQ_NOAUTOEN);
+
+                ret = request_irq(cpu_to->clkevt.irq, tegra_timer_isr, flags,
+                                  cpu_to->clkevt.name, &cpu_to->clkevt);
+                if (ret) {
+                        pr_err("failed to set up irq for cpu%d: %d\n",
+                               cpu, ret);
+                        irq_dispose_mapping(cpu_to->clkevt.irq);
+                        cpu_to->clkevt.irq = 0;
+                        goto out_irq;
+                }
+        }
+
+        sched_clock_register(tegra_read_sched_clock, 32, TIMER_1MHz);
+
+        ret = clocksource_mmio_init(timer_reg_base + TIMERUS_CNTR_1US,
+                                    "timer_us", TIMER_1MHz, 300, 32,
+                                    clocksource_mmio_readl_up);
+        if (ret)
+                pr_err("failed to register clocksource: %d\n", ret);
+
+#ifdef CONFIG_ARM
+        register_current_timer_delay(&tegra_delay_timer);
+#endif
+
+        ret = cpuhp_setup_state(CPUHP_AP_TEGRA_TIMER_STARTING,
+                                "AP_TEGRA_TIMER_STARTING", tegra_timer_setup,
+                                tegra_timer_stop);
+        if (ret)
+                pr_err("failed to set up cpu hp state: %d\n", ret);
+
+        return ret;
+
+out_irq:
+        for_each_possible_cpu(cpu) {
+                struct timer_of *cpu_to;
+
+                cpu_to = per_cpu_ptr(&tegra_to, cpu);
+                if (cpu_to->clkevt.irq) {
+                        free_irq(cpu_to->clkevt.irq, &cpu_to->clkevt);
+                        irq_dispose_mapping(cpu_to->clkevt.irq);
+                }
+        }
+
+        to->of_base.base = timer_reg_base;
+out:
+        timer_of_cleanup(to);
+
+        return ret;
+}
+
+static int __init tegra210_init_timer(struct device_node *np)
+{
+        /*
+         * Arch-timer can't survive across power cycle of CPU core and
+         * after CPUPORESET signal due to a system design shortcoming,
+         * hence tegra-timer is more preferable on Tegra210.
+         */
+        return tegra_init_timer(np, false, 460);
+}
+TIMER_OF_DECLARE(tegra210_timer, "nvidia,tegra210-timer", tegra210_init_timer);
+
+static int __init tegra20_init_timer(struct device_node *np)
+{
+        int rating;
+
+        /*
+         * Tegra20 and Tegra30 have Cortex A9 CPU that has a TWD timer,
+         * that timer runs off the CPU clock and hence is subjected to
+         * a jitter caused by DVFS clock rate changes. Tegra-timer is
+         * more preferable for older Tegra's, while later SoC generations
+         * have arch-timer as a main per-CPU timer and it is not affected
+         * by DVFS changes.
+         */
+        if (of_machine_is_compatible("nvidia,tegra20") ||
+            of_machine_is_compatible("nvidia,tegra30"))
+                rating = 460;
+        else
+                rating = 330;
+
+        return tegra_init_timer(np, true, rating);
+}
+TIMER_OF_DECLARE(tegra20_timer, "nvidia,tegra20-timer", tegra20_init_timer);
+
+static int __init tegra20_init_rtc(struct device_node *np)
+{
+        int ret;
+
+        ret = timer_of_init(np, &suspend_rtc_to);
+        if (ret)
+                return ret;
+
+        return clocksource_register_hz(&suspend_rtc_clocksource, 1000);
+}
+TIMER_OF_DECLARE(tegra20_rtc, "nvidia,tegra20-rtc", tegra20_init_rtc);
diff --git a/drivers/clocksource/timer-tegra20.c b/drivers/clocksource/timer-tegra20.c
deleted file mode 100644
index 1e7ece279730..000000000000
--- a/drivers/clocksource/timer-tegra20.c
+++ /dev/null
@@ -1,379 +0,0 @@
-// SPDX-License-Identifier: GPL-2.0-only
-/*
- * Copyright (C) 2010 Google, Inc.
- *
- * Author:
- *      Colin Cross <ccross@google.com>
- */
-
-#include <linux/clk.h>
-#include <linux/clockchips.h>
-#include <linux/cpu.h>
-#include <linux/cpumask.h>
-#include <linux/delay.h>
-#include <linux/err.h>
-#include <linux/interrupt.h>
-#include <linux/of_address.h>
-#include <linux/of_irq.h>
-#include <linux/percpu.h>
-#include <linux/sched_clock.h>
-#include <linux/time.h>
-
-#include "timer-of.h"
-
-#ifdef CONFIG_ARM
-#include <asm/mach/time.h>
-#endif
-
-#define RTC_SECONDS            0x08
-#define RTC_SHADOW_SECONDS     0x0c
-#define RTC_MILLISECONDS       0x10
-
-#define TIMERUS_CNTR_1US 0x10
-#define TIMERUS_USEC_CFG 0x14
-#define TIMERUS_CNTR_FREEZE 0x4c
-
-#define TIMER_PTV               0x0
-#define TIMER_PTV_EN            BIT(31)
-#define TIMER_PTV_PER           BIT(30)
-#define TIMER_PCR               0x4
-#define TIMER_PCR_INTR_CLR      BIT(30)
-
-#ifdef CONFIG_ARM
-#define TIMER_CPU0              0x50 /* TIMER3 */
-#else
-#define TIMER_CPU0              0x90 /* TIMER10 */
-#define TIMER10_IRQ_IDX         10
-#define IRQ_IDX_FOR_CPU(cpu)    (TIMER10_IRQ_IDX + cpu)
-#endif
-#define TIMER_BASE_FOR_CPU(cpu) (TIMER_CPU0 + (cpu) * 8)
-
-static u32 usec_config;
-static void __iomem *timer_reg_base;
-#ifdef CONFIG_ARM
-static struct delay_timer tegra_delay_timer;
-#endif
-
-static int tegra_timer_set_next_event(unsigned long cycles,
-                                         struct clock_event_device *evt)
-{
-        void __iomem *reg_base = timer_of_base(to_timer_of(evt));
-
-        writel(TIMER_PTV_EN |
-               ((cycles > 1) ? (cycles - 1) : 0), /* n+1 scheme */
-               reg_base + TIMER_PTV);
-
-        return 0;
-}
-
-static int tegra_timer_shutdown(struct clock_event_device *evt)
-{
-        void __iomem *reg_base = timer_of_base(to_timer_of(evt));
-
-        writel(0, reg_base + TIMER_PTV);
-
-        return 0;
-}
-
-static int tegra_timer_set_periodic(struct clock_event_device *evt)
-{
-        void __iomem *reg_base = timer_of_base(to_timer_of(evt));
-
-        writel(TIMER_PTV_EN | TIMER_PTV_PER |
-               ((timer_of_rate(to_timer_of(evt)) / HZ) - 1),
-               reg_base + TIMER_PTV);
-
-        return 0;
-}
-
-static irqreturn_t tegra_timer_isr(int irq, void *dev_id)
-{
-        struct clock_event_device *evt = (struct clock_event_device *)dev_id;
-        void __iomem *reg_base = timer_of_base(to_timer_of(evt));
-
-        writel(TIMER_PCR_INTR_CLR, reg_base + TIMER_PCR);
-        evt->event_handler(evt);
-
-        return IRQ_HANDLED;
-}
-
-static void tegra_timer_suspend(struct clock_event_device *evt)
-{
-        void __iomem *reg_base = timer_of_base(to_timer_of(evt));
-
-        writel(TIMER_PCR_INTR_CLR, reg_base + TIMER_PCR);
-}
-
-static void tegra_timer_resume(struct clock_event_device *evt)
-{
-        writel(usec_config, timer_reg_base + TIMERUS_USEC_CFG);
-}
-
-#ifdef CONFIG_ARM64
-static DEFINE_PER_CPU(struct timer_of, tegra_to) = {
-        .flags = TIMER_OF_CLOCK | TIMER_OF_BASE,
-
-        .clkevt = {
-                .name = "tegra_timer",
-                .rating = 460,
-                .features = CLOCK_EVT_FEAT_ONESHOT | CLOCK_EVT_FEAT_PERIODIC,
-                .set_next_event = tegra_timer_set_next_event,
-                .set_state_shutdown = tegra_timer_shutdown,
-                .set_state_periodic = tegra_timer_set_periodic,
-                .set_state_oneshot = tegra_timer_shutdown,
-                .tick_resume = tegra_timer_shutdown,
-                .suspend = tegra_timer_suspend,
-                .resume = tegra_timer_resume,
-        },
-};
-
-static int tegra_timer_setup(unsigned int cpu)
-{
-        struct timer_of *to = per_cpu_ptr(&tegra_to, cpu);
-
-        irq_force_affinity(to->clkevt.irq, cpumask_of(cpu));
-        enable_irq(to->clkevt.irq);
-
-        clockevents_config_and_register(&to->clkevt, timer_of_rate(to),
-                                        1, /* min */
-                                        0x1fffffff); /* 29 bits */
-
-        return 0;
-}
-
-static int tegra_timer_stop(unsigned int cpu)
-{
-        struct timer_of *to = per_cpu_ptr(&tegra_to, cpu);
-
-        to->clkevt.set_state_shutdown(&to->clkevt);
-        disable_irq_nosync(to->clkevt.irq);
-
-        return 0;
-}
-#else /* CONFIG_ARM */
-static struct timer_of tegra_to = {
-        .flags = TIMER_OF_CLOCK | TIMER_OF_BASE | TIMER_OF_IRQ,
-
-        .clkevt = {
-                .name = "tegra_timer",
-                .rating = 300,
-                .features = CLOCK_EVT_FEAT_ONESHOT |
-                            CLOCK_EVT_FEAT_PERIODIC |
-                            CLOCK_EVT_FEAT_DYNIRQ,
-                .set_next_event = tegra_timer_set_next_event,
-                .set_state_shutdown = tegra_timer_shutdown,
-                .set_state_periodic = tegra_timer_set_periodic,
-                .set_state_oneshot = tegra_timer_shutdown,
-                .tick_resume = tegra_timer_shutdown,
-                .suspend = tegra_timer_suspend,
-                .resume = tegra_timer_resume,
-                .cpumask = cpu_possible_mask,
-        },
-
-        .of_irq = {
-                .index = 2,
-                .flags = IRQF_TIMER | IRQF_TRIGGER_HIGH,
-                .handler = tegra_timer_isr,
-        },
-};
-
-static u64 notrace tegra_read_sched_clock(void)
-{
-        return readl(timer_reg_base + TIMERUS_CNTR_1US);
-}
-
-static unsigned long tegra_delay_timer_read_counter_long(void)
-{
-        return readl(timer_reg_base + TIMERUS_CNTR_1US);
-}
-
-static struct timer_of suspend_rtc_to = {
-        .flags = TIMER_OF_BASE | TIMER_OF_CLOCK,
-};
-
-/*
- * tegra_rtc_read - Reads the Tegra RTC registers
- * Care must be taken that this funciton is not called while the
- * tegra_rtc driver could be executing to avoid race conditions
- * on the RTC shadow register
- */
-static u64 tegra_rtc_read_ms(struct clocksource *cs)
-{
-        u32 ms = readl(timer_of_base(&suspend_rtc_to) + RTC_MILLISECONDS);
-        u32 s = readl(timer_of_base(&suspend_rtc_to) + RTC_SHADOW_SECONDS);
-        return (u64)s * MSEC_PER_SEC + ms;
-}
-
-static struct clocksource suspend_rtc_clocksource = {
-        .name   = "tegra_suspend_timer",
-        .rating = 200,
-        .read   = tegra_rtc_read_ms,
-        .mask   = CLOCKSOURCE_MASK(32),
-        .flags  = CLOCK_SOURCE_IS_CONTINUOUS | CLOCK_SOURCE_SUSPEND_NONSTOP,
-};
-#endif
-
-static int tegra_timer_common_init(struct device_node *np, struct timer_of *to)
-{
-        int ret = 0;
-
-        ret = timer_of_init(np, to);
-        if (ret < 0)
-                goto out;
-
-        timer_reg_base = timer_of_base(to);
-
-        /*
-         * Configure microsecond timers to have 1MHz clock
-         * Config register is 0xqqww, where qq is "dividend", ww is "divisor"
-         * Uses n+1 scheme
-         */
-        switch (timer_of_rate(to)) {
-        case 12000000:
-                usec_config = 0x000b; /* (11+1)/(0+1) */
-                break;
-        case 12800000:
-                usec_config = 0x043f; /* (63+1)/(4+1) */
-                break;
-        case 13000000:
-                usec_config = 0x000c; /* (12+1)/(0+1) */
-                break;
-        case 16800000:
-                usec_config = 0x0453; /* (83+1)/(4+1) */
-                break;
-        case 19200000:
-                usec_config = 0x045f; /* (95+1)/(4+1) */
-                break;
-        case 26000000:
-                usec_config = 0x0019; /* (25+1)/(0+1) */
-                break;
-        case 38400000:
-                usec_config = 0x04bf; /* (191+1)/(4+1) */
-                break;
-        case 48000000:
-                usec_config = 0x002f; /* (47+1)/(0+1) */
-                break;
-        default:
-                ret = -EINVAL;
-                goto out;
-        }
-
-        writel(usec_config, timer_of_base(to) + TIMERUS_USEC_CFG);
-
-out:
-        return ret;
-}
-
-#ifdef CONFIG_ARM64
-static int __init tegra_init_timer(struct device_node *np)
-{
-        int cpu, ret = 0;
-        struct timer_of *to;
-
-        to = this_cpu_ptr(&tegra_to);
-        ret = tegra_timer_common_init(np, to);
-        if (ret < 0)
-                goto out;
-
-        for_each_possible_cpu(cpu) {
-                struct timer_of *cpu_to;
-
-                cpu_to = per_cpu_ptr(&tegra_to, cpu);
-                cpu_to->of_base.base = timer_reg_base + TIMER_BASE_FOR_CPU(cpu);
-                cpu_to->of_clk.rate = timer_of_rate(to);
-                cpu_to->clkevt.cpumask = cpumask_of(cpu);
-                cpu_to->clkevt.irq =
-                        irq_of_parse_and_map(np, IRQ_IDX_FOR_CPU(cpu));
-                if (!cpu_to->clkevt.irq) {
-                        pr_err("%s: can't map IRQ for CPU%d\n",
-                               __func__, cpu);
-                        ret = -EINVAL;
-                        goto out;
-                }
-
-                irq_set_status_flags(cpu_to->clkevt.irq, IRQ_NOAUTOEN);
-                ret = request_irq(cpu_to->clkevt.irq, tegra_timer_isr,
-                                  IRQF_TIMER | IRQF_NOBALANCING,
-                                  cpu_to->clkevt.name, &cpu_to->clkevt);
-                if (ret) {
-                        pr_err("%s: cannot setup irq %d for CPU%d\n",
-                                __func__, cpu_to->clkevt.irq, cpu);
-                        ret = -EINVAL;
-                        goto out_irq;
-                }
-        }
-
-        cpuhp_setup_state(CPUHP_AP_TEGRA_TIMER_STARTING,
-                          "AP_TEGRA_TIMER_STARTING", tegra_timer_setup,
-                          tegra_timer_stop);
-
-        return ret;
-out_irq:
-        for_each_possible_cpu(cpu) {
-                struct timer_of *cpu_to;
-
-                cpu_to = per_cpu_ptr(&tegra_to, cpu);
-                if (cpu_to->clkevt.irq) {
-                        free_irq(cpu_to->clkevt.irq, &cpu_to->clkevt);
-                        irq_dispose_mapping(cpu_to->clkevt.irq);
-                }
-        }
-out:
-        timer_of_cleanup(to);
-        return ret;
-}
-#else /* CONFIG_ARM */
-static int __init tegra_init_timer(struct device_node *np)
-{
-        int ret = 0;
-
-        ret = tegra_timer_common_init(np, &tegra_to);
-        if (ret < 0)
-                goto out;
-
-        tegra_to.of_base.base = timer_reg_base + TIMER_BASE_FOR_CPU(0);
-        tegra_to.of_clk.rate = 1000000; /* microsecond timer */
-
-        sched_clock_register(tegra_read_sched_clock, 32,
-                             timer_of_rate(&tegra_to));
-        ret = clocksource_mmio_init(timer_reg_base + TIMERUS_CNTR_1US,
-                                    "timer_us", timer_of_rate(&tegra_to),
-                                    300, 32, clocksource_mmio_readl_up);
-        if (ret) {
-                pr_err("Failed to register clocksource\n");
-                goto out;
-        }
-
-        tegra_delay_timer.read_current_timer =
-                        tegra_delay_timer_read_counter_long;
-        tegra_delay_timer.freq = timer_of_rate(&tegra_to);
-        register_current_timer_delay(&tegra_delay_timer);
-
-        clockevents_config_and_register(&tegra_to.clkevt,
-                                        timer_of_rate(&tegra_to),
-                                        0x1,
-                                        0x1fffffff);
-
-        return ret;
-out:
-        timer_of_cleanup(&tegra_to);
-
-        return ret;
-}
-
-static int __init tegra20_init_rtc(struct device_node *np)
-{
-        int ret;
-
-        ret = timer_of_init(np, &suspend_rtc_to);
-        if (ret)
-                return ret;
-
-        clocksource_register_hz(&suspend_rtc_clocksource, 1000);
-
-        return 0;
-}
-TIMER_OF_DECLARE(tegra20_rtc, "nvidia,tegra20-rtc", tegra20_init_rtc);
-#endif
-TIMER_OF_DECLARE(tegra210_timer, "nvidia,tegra210-timer", tegra_init_timer);
-TIMER_OF_DECLARE(tegra20_timer, "nvidia,tegra20-timer", tegra_init_timer);
diff --git a/drivers/crypto/nx/nx-842-pseries.c b/drivers/crypto/nx/nx-842-pseries.c
index 5c4aa606208c..2de5e3672e42 100644
--- a/drivers/crypto/nx/nx-842-pseries.c
+++ b/drivers/crypto/nx/nx-842-pseries.c
@@ -856,7 +856,7 @@ static ssize_t nx842_##_name##_show(struct device *dev,		\
         rcu_read_lock();                                                \
         local_devdata = rcu_dereference(devdata);                       \
         if (local_devdata)                                              \
-                p = snprintf(buf, PAGE_SIZE, "%ld\n",                   \
+                p = snprintf(buf, PAGE_SIZE, "%lld\n",                  \
                        atomic64_read(&local_devdata->counters->_name)); \
         rcu_read_unlock();                                              \
         return p;                                                       \
@@ -909,7 +909,7 @@ static ssize_t nx842_timehist_show(struct device *dev,
         }
 
         for (i = 0; i < (NX842_HIST_SLOTS - 2); i++) {
-                bytes = snprintf(p, bytes_remain, "%u-%uus:\t%ld\n",
+                bytes = snprintf(p, bytes_remain, "%u-%uus:\t%lld\n",
                                i ? (2<<(i-1)) : 0, (2<<i)-1,
                                atomic64_read(&times[i]));
                 bytes_remain -= bytes;
@@ -917,7 +917,7 @@ static ssize_t nx842_timehist_show(struct device *dev,
         }
         /* The last bucket holds everything over
          * 2<<(NX842_HIST_SLOTS - 2) us */
-        bytes = snprintf(p, bytes_remain, "%uus - :\t%ld\n",
+        bytes = snprintf(p, bytes_remain, "%uus - :\t%lld\n",
                         2<<(NX842_HIST_SLOTS - 2),
                         atomic64_read(&times[(NX842_HIST_SLOTS - 1)]));
         p += bytes;
diff --git a/drivers/dma/dma-jz4780.c b/drivers/dma/dma-jz4780.c
index 263bee76ef0d..6b8c4c458e8a 100644
--- a/drivers/dma/dma-jz4780.c
+++ b/drivers/dma/dma-jz4780.c
@@ -718,12 +718,13 @@ static irqreturn_t jz4780_dma_irq_handler(int irq, void *data)
 {
         struct jz4780_dma_dev *jzdma = data;
         unsigned int nb_channels = jzdma->soc_data->nb_channels;
-        uint32_t pending, dmac;
+        unsigned long pending;
+        uint32_t dmac;
         int i;
 
         pending = jz4780_dma_ctrl_readl(jzdma, JZ_DMA_REG_DIRQP);
 
-        for_each_set_bit(i, (unsigned long *)&pending, nb_channels) {
+        for_each_set_bit(i, &pending, nb_channels) {
                 if (jz4780_dma_chan_irq(jzdma, &jzdma->chan[i]))
                         pending &= ~BIT(i);
         }
diff --git a/drivers/dma/imx-sdma.c b/drivers/dma/imx-sdma.c
index 99d9f431ae2c..4ec84a633bd3 100644
--- a/drivers/dma/imx-sdma.c
+++ b/drivers/dma/imx-sdma.c
@@ -703,7 +703,7 @@ static int sdma_load_script(struct sdma_engine *sdma, void *buf, int size,
         spin_lock_irqsave(&sdma->channel_0_lock, flags);
 
         bd0->mode.command = C0_SETPM;
-        bd0->mode.status = BD_DONE | BD_INTR | BD_WRAP | BD_EXTD;
+        bd0->mode.status = BD_DONE | BD_WRAP | BD_EXTD;
         bd0->mode.count = size / 2;
         bd0->buffer_addr = buf_phys;
         bd0->ext_buffer_addr = address;
@@ -1025,7 +1025,7 @@ static int sdma_load_context(struct sdma_channel *sdmac)
         context->gReg[7] = sdmac->watermark_level;
 
         bd0->mode.command = C0_SETDM;
-        bd0->mode.status = BD_DONE | BD_INTR | BD_WRAP | BD_EXTD;
+        bd0->mode.status = BD_DONE | BD_WRAP | BD_EXTD;
         bd0->mode.count = sizeof(*context) / 4;
         bd0->buffer_addr = sdma->context_phys;
         bd0->ext_buffer_addr = 2048 + (sizeof(*context) / 4) * channel;
@@ -2096,27 +2096,6 @@ static int sdma_probe(struct platform_device *pdev)
         if (pdata && pdata->script_addrs)
                 sdma_add_scripts(sdma, pdata->script_addrs);
 
-        if (pdata) {
-                ret = sdma_get_firmware(sdma, pdata->fw_name);
-                if (ret)
-                        dev_warn(&pdev->dev, "failed to get firmware from platform data\n");
-        } else {
-                /*
-                 * Because that device tree does not encode ROM script address,
-                 * the RAM script in firmware is mandatory for device tree
-                 * probe, otherwise it fails.
-                 */
-                ret = of_property_read_string(np, "fsl,sdma-ram-script-name",
-                                              &fw_name);
-                if (ret)
-                        dev_warn(&pdev->dev, "failed to get firmware name\n");
-                else {
-                        ret = sdma_get_firmware(sdma, fw_name);
-                        if (ret)
-                                dev_warn(&pdev->dev, "failed to get firmware from device tree\n");
-                }
-        }
-
         sdma->dma_device.dev = &pdev->dev;
 
         sdma->dma_device.device_alloc_chan_resources = sdma_alloc_chan_resources;
@@ -2161,6 +2140,33 @@ static int sdma_probe(struct platform_device *pdev)
                 of_node_put(spba_bus);
         }
 
+        /*
+         * Kick off firmware loading as the very last step:
+         * attempt to load firmware only if we're not on the error path, because
+         * the firmware callback requires a fully functional and allocated sdma
+         * instance.
+         */
+        if (pdata) {
+                ret = sdma_get_firmware(sdma, pdata->fw_name);
+                if (ret)
+                        dev_warn(&pdev->dev, "failed to get firmware from platform data\n");
+        } else {
+                /*
+                 * Because that device tree does not encode ROM script address,
+                 * the RAM script in firmware is mandatory for device tree
+                 * probe, otherwise it fails.
+                 */
+                ret = of_property_read_string(np, "fsl,sdma-ram-script-name",
+                                              &fw_name);
+                if (ret) {
+                        dev_warn(&pdev->dev, "failed to get firmware name\n");
+                } else {
+                        ret = sdma_get_firmware(sdma, fw_name);
+                        if (ret)
+                                dev_warn(&pdev->dev, "failed to get firmware from device tree\n");
+                }
+        }
+
         return 0;
 
 err_register:
diff --git a/drivers/dma/qcom/bam_dma.c b/drivers/dma/qcom/bam_dma.c
index 4b43844f6af5..8e90a405939d 100644
--- a/drivers/dma/qcom/bam_dma.c
+++ b/drivers/dma/qcom/bam_dma.c
@@ -799,6 +799,9 @@ static u32 process_channel_irqs(struct bam_device *bdev)
                 /* Number of bytes available to read */
                 avail = CIRC_CNT(offset, bchan->head, MAX_DESCRIPTORS + 1);
 
+                if (offset < bchan->head)
+                        avail--;
+
                 list_for_each_entry_safe(async_desc, tmp,
                                          &bchan->desc_list, desc_node) {
                         /* Not enough data to read */
diff --git a/drivers/firmware/efi/efi-bgrt.c b/drivers/firmware/efi/efi-bgrt.c
index a2384184a7de..b07c17643210 100644
--- a/drivers/firmware/efi/efi-bgrt.c
+++ b/drivers/firmware/efi/efi-bgrt.c
@@ -47,11 +47,6 @@ void __init efi_bgrt_init(struct acpi_table_header *table)
                        bgrt->version);
                 goto out;
         }
-        if (bgrt->status & 0xfe) {
-                pr_notice("Ignoring BGRT: reserved status bits are non-zero %u\n",
-                       bgrt->status);
-                goto out;
-        }
         if (bgrt->image_type != 0) {
                 pr_notice("Ignoring BGRT: invalid image type %u (expected 0)\n",
                        bgrt->image_type);
diff --git a/drivers/firmware/efi/efi.c b/drivers/firmware/efi/efi.c
index 16b2137d117c..4b7cf7bc0ded 100644
--- a/drivers/firmware/efi/efi.c
+++ b/drivers/firmware/efi/efi.c
@@ -1009,14 +1009,16 @@ int __ref efi_mem_reserve_persistent(phys_addr_t addr, u64 size)
 
         /* first try to find a slot in an existing linked list entry */
         for (prsv = efi_memreserve_root->next; prsv; prsv = rsv->next) {
-                rsv = __va(prsv);
+                rsv = memremap(prsv, sizeof(*rsv), MEMREMAP_WB);
                 index = atomic_fetch_add_unless(&rsv->count, 1, rsv->size);
                 if (index < rsv->size) {
                         rsv->entry[index].base = addr;
                         rsv->entry[index].size = size;
 
+                        memunmap(rsv);
                         return 0;
                 }
+                memunmap(rsv);
         }
 
         /* no slot found - allocate a new linked list entry */
@@ -1024,7 +1026,13 @@ int __ref efi_mem_reserve_persistent(phys_addr_t addr, u64 size)
         if (!rsv)
                 return -ENOMEM;
 
-        rsv->size = EFI_MEMRESERVE_COUNT(PAGE_SIZE);
+        /*
+         * The memremap() call above assumes that a linux_efi_memreserve entry
+         * never crosses a page boundary, so let's ensure that this remains true
+         * even when kexec'ing a 4k pages kernel from a >4k pages kernel, by
+         * using SZ_4K explicitly in the size calculation below.
+         */
+        rsv->size = EFI_MEMRESERVE_COUNT(SZ_4K);
         atomic_set(&rsv->count, 1);
         rsv->entry[0].base = addr;
         rsv->entry[0].size = size;
diff --git a/drivers/firmware/efi/efibc.c b/drivers/firmware/efi/efibc.c
index 61e099826cbb..35dccc88ac0a 100644
--- a/drivers/firmware/efi/efibc.c
+++ b/drivers/firmware/efi/efibc.c
@@ -43,11 +43,13 @@ static int efibc_set_variable(const char *name, const char *value)
         efibc_str_to_str16(value, (efi_char16_t *)entry->var.Data);
         memcpy(&entry->var.VendorGuid, &guid, sizeof(guid));
 
-        ret = efivar_entry_set(entry,
-                               EFI_VARIABLE_NON_VOLATILE
-                               | EFI_VARIABLE_BOOTSERVICE_ACCESS
-                               | EFI_VARIABLE_RUNTIME_ACCESS,
-                               size, entry->var.Data, NULL);
+        ret = efivar_entry_set_safe(entry->var.VariableName,
+                                    entry->var.VendorGuid,
+                                    EFI_VARIABLE_NON_VOLATILE
+                                    | EFI_VARIABLE_BOOTSERVICE_ACCESS
+                                    | EFI_VARIABLE_RUNTIME_ACCESS,
+                                    false, size, entry->var.Data);
+
         if (ret)
                 pr_err("failed to set %s EFI variable: 0x%x\n",
                        name, ret);
diff --git a/drivers/gpio/gpio-mb86s7x.c b/drivers/gpio/gpio-mb86s7x.c
index 9bfff171f9fe..8f466993cd24 100644
--- a/drivers/gpio/gpio-mb86s7x.c
+++ b/drivers/gpio/gpio-mb86s7x.c
@@ -6,6 +6,7 @@
  *  Copyright (C) 2015 Linaro Ltd.
  */
 
+#include <linux/acpi.h>
 #include <linux/io.h>
 #include <linux/init.h>
 #include <linux/clk.h>
@@ -19,6 +20,8 @@
 #include <linux/spinlock.h>
 #include <linux/slab.h>
 
+#include "gpiolib.h"
+
 /*
  * Only first 8bits of a register correspond to each pin,
  * so there are 4 registers for 32 pins.
@@ -135,6 +138,20 @@ static void mb86s70_gpio_set(struct gpio_chip *gc, unsigned gpio, int value)
         spin_unlock_irqrestore(&gchip->lock, flags);
 }
 
+static int mb86s70_gpio_to_irq(struct gpio_chip *gc, unsigned int offset)
+{
+        int irq, index;
+
+        for (index = 0;; index++) {
+                irq = platform_get_irq(to_platform_device(gc->parent), index);
+                if (irq <= 0)
+                        break;
+                if (irq_get_irq_data(irq)->hwirq == offset)
+                        return irq;
+        }
+        return -EINVAL;
+}
+
 static int mb86s70_gpio_probe(struct platform_device *pdev)
 {
         struct mb86s70_gpio_chip *gchip;
@@ -150,13 +167,15 @@ static int mb86s70_gpio_probe(struct platform_device *pdev)
         if (IS_ERR(gchip->base))
                 return PTR_ERR(gchip->base);
 
-        gchip->clk = devm_clk_get(&pdev->dev, NULL);
-        if (IS_ERR(gchip->clk))
-                return PTR_ERR(gchip->clk);
+        if (!has_acpi_companion(&pdev->dev)) {
+                gchip->clk = devm_clk_get(&pdev->dev, NULL);
+                if (IS_ERR(gchip->clk))
+                        return PTR_ERR(gchip->clk);
 
-        ret = clk_prepare_enable(gchip->clk);
-        if (ret)
-                return ret;
+                ret = clk_prepare_enable(gchip->clk);
+                if (ret)
+                        return ret;
+        }
 
         spin_lock_init(&gchip->lock);
 
@@ -172,19 +191,28 @@ static int mb86s70_gpio_probe(struct platform_device *pdev)
         gchip->gc.parent = &pdev->dev;
         gchip->gc.base = -1;
 
+        if (has_acpi_companion(&pdev->dev))
+                gchip->gc.to_irq = mb86s70_gpio_to_irq;
+
         ret = gpiochip_add_data(&gchip->gc, gchip);
         if (ret) {
                 dev_err(&pdev->dev, "couldn't register gpio driver\n");
                 clk_disable_unprepare(gchip->clk);
+                return ret;
         }
 
-        return ret;
+        if (has_acpi_companion(&pdev->dev))
+                acpi_gpiochip_request_interrupts(&gchip->gc);
+
+        return 0;
 }
 
 static int mb86s70_gpio_remove(struct platform_device *pdev)
 {
         struct mb86s70_gpio_chip *gchip = platform_get_drvdata(pdev);
 
+        if (has_acpi_companion(&pdev->dev))
+                acpi_gpiochip_free_interrupts(&gchip->gc);
         gpiochip_remove(&gchip->gc);
         clk_disable_unprepare(gchip->clk);
 
@@ -197,10 +225,19 @@ static const struct of_device_id mb86s70_gpio_dt_ids[] = {
 };
 MODULE_DEVICE_TABLE(of, mb86s70_gpio_dt_ids);
 
+#ifdef CONFIG_ACPI
+static const struct acpi_device_id mb86s70_gpio_acpi_ids[] = {
+        { "SCX0007" },
+        { /* sentinel */ }
+};
+MODULE_DEVICE_TABLE(acpi, mb86s70_gpio_acpi_ids);
+#endif
+
 static struct platform_driver mb86s70_gpio_driver = {
         .driver = {
                 .name = "mb86s70-gpio",
                 .of_match_table = mb86s70_gpio_dt_ids,
+                .acpi_match_table = ACPI_PTR(mb86s70_gpio_acpi_ids),
         },
         .probe = mb86s70_gpio_probe,
         .remove = mb86s70_gpio_remove,
diff --git a/drivers/gpio/gpiolib-of.c b/drivers/gpio/gpiolib-of.c
index aec7bd86ae7e..9c9b965d7d6d 100644
--- a/drivers/gpio/gpiolib-of.c
+++ b/drivers/gpio/gpiolib-of.c
@@ -118,8 +118,15 @@ static void of_gpio_flags_quirks(struct device_node *np,
          * Legacy handling of SPI active high chip select. If we have a
          * property named "cs-gpios" we need to inspect the child node
          * to determine if the flags should have inverted semantics.
+         *
+         * This does not apply to an SPI device named "spi-gpio", because
+         * these have traditionally obtained their own GPIOs by parsing
+         * the device tree directly and did not respect any "spi-cs-high"
+         * property on the SPI bus children.
          */
-        if (IS_ENABLED(CONFIG_SPI_MASTER) && !strcmp(propname, "cs-gpios") &&
+        if (IS_ENABLED(CONFIG_SPI_MASTER) &&
+            !strcmp(propname, "cs-gpios") &&
+            !of_device_is_compatible(np, "spi-gpio") &&
             of_property_read_bool(np, "cs-gpios")) {
                 struct device_node *child;
                 u32 cs;
diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c b/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c
index b610e3b30d95..2f18c64d531f 100644
--- a/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c
@@ -1959,25 +1959,6 @@ static void gfx_v9_0_constants_init(struct amdgpu_device *adev)
         mutex_unlock(&adev->srbm_mutex);
 
         gfx_v9_0_init_compute_vmid(adev);
-
-        mutex_lock(&adev->grbm_idx_mutex);
-        /*
-         * making sure that the following register writes will be broadcasted
-         * to all the shaders
-         */
-        gfx_v9_0_select_se_sh(adev, 0xffffffff, 0xffffffff, 0xffffffff);
-
-        WREG32_SOC15(GC, 0, mmPA_SC_FIFO_SIZE,
-                   (adev->gfx.config.sc_prim_fifo_size_frontend <<
-                        PA_SC_FIFO_SIZE__SC_FRONTEND_PRIM_FIFO_SIZE__SHIFT) |
-                   (adev->gfx.config.sc_prim_fifo_size_backend <<
-                        PA_SC_FIFO_SIZE__SC_BACKEND_PRIM_FIFO_SIZE__SHIFT) |
-                   (adev->gfx.config.sc_hiz_tile_fifo_size <<
-                        PA_SC_FIFO_SIZE__SC_HIZ_TILE_FIFO_SIZE__SHIFT) |
-                   (adev->gfx.config.sc_earlyz_tile_fifo_size <<
-                        PA_SC_FIFO_SIZE__SC_EARLYZ_TILE_FIFO_SIZE__SHIFT));
-        mutex_unlock(&adev->grbm_idx_mutex);
-
 }
 
 static void gfx_v9_0_wait_for_rlc_serdes(struct amdgpu_device *adev)
diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c b/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c
index 083bd8114db1..dd6b4b0b5f30 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c
@@ -837,7 +837,7 @@ static int kfd_ioctl_get_clock_counters(struct file *filep,
 
         /* No access to rdtsc. Using raw monotonic time */
         args->cpu_clock_counter = ktime_get_raw_ns();
-        args->system_clock_counter = ktime_get_boot_ns();
+        args->system_clock_counter = ktime_get_boottime_ns();
 
         /* Since the counter is in nano-seconds we use 1GHz frequency */
         args->system_clock_freq = 1000000000;
diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/hwmgr.c b/drivers/gpu/drm/amd/powerplay/hwmgr/hwmgr.c
index f1d326caf69e..a7e8340baf90 100644
--- a/drivers/gpu/drm/amd/powerplay/hwmgr/hwmgr.c
+++ b/drivers/gpu/drm/amd/powerplay/hwmgr/hwmgr.c
@@ -326,7 +326,7 @@ int hwmgr_resume(struct pp_hwmgr *hwmgr)
         if (ret)
                 return ret;
 
-        ret = psm_adjust_power_state_dynamic(hwmgr, true, NULL);
+        ret = psm_adjust_power_state_dynamic(hwmgr, false, NULL);
 
         return ret;
 }
diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/process_pptables_v1_0.c b/drivers/gpu/drm/amd/powerplay/hwmgr/process_pptables_v1_0.c
index ae64ff7153d6..1cd5a8b5cdc1 100644
--- a/drivers/gpu/drm/amd/powerplay/hwmgr/process_pptables_v1_0.c
+++ b/drivers/gpu/drm/amd/powerplay/hwmgr/process_pptables_v1_0.c
@@ -916,8 +916,10 @@ static int init_thermal_controller(
                         PHM_PlatformCaps_ThermalController
                   );
 
-        if (0 == powerplay_table->usFanTableOffset)
+        if (0 == powerplay_table->usFanTableOffset) {
+                hwmgr->thermal_controller.use_hw_fan_control = 1;
                 return 0;
+        }
 
         fan_table = (const PPTable_Generic_SubTable_Header *)
                 (((unsigned long)powerplay_table) +
diff --git a/drivers/gpu/drm/amd/powerplay/inc/hwmgr.h b/drivers/gpu/drm/amd/powerplay/inc/hwmgr.h
index c92999aac07c..eccb26fddbd0 100644
--- a/drivers/gpu/drm/amd/powerplay/inc/hwmgr.h
+++ b/drivers/gpu/drm/amd/powerplay/inc/hwmgr.h
@@ -694,6 +694,7 @@ struct pp_thermal_controller_info {
         uint8_t ucType;
         uint8_t ucI2cLine;
         uint8_t ucI2cAddress;
+        uint8_t use_hw_fan_control;
         struct pp_fan_info fanInfo;
         struct pp_advance_fan_control_parameters advanceFanControlParameters;
 };
diff --git a/drivers/gpu/drm/amd/powerplay/smumgr/polaris10_smumgr.c b/drivers/gpu/drm/amd/powerplay/smumgr/polaris10_smumgr.c
index 2d4cfe14f72e..29e641c6a5db 100644
--- a/drivers/gpu/drm/amd/powerplay/smumgr/polaris10_smumgr.c
+++ b/drivers/gpu/drm/amd/powerplay/smumgr/polaris10_smumgr.c
@@ -2092,6 +2092,10 @@ static int polaris10_thermal_setup_fan_table(struct pp_hwmgr *hwmgr)
                 return 0;
         }
 
+        /* use hardware fan control */
+        if (hwmgr->thermal_controller.use_hw_fan_control)
+                return 0;
+
         tmp64 = hwmgr->thermal_controller.advanceFanControlParameters.
                         usPWMMin * duty100;
         do_div(tmp64, 10000);
diff --git a/drivers/gpu/drm/etnaviv/etnaviv_gpu.c b/drivers/gpu/drm/etnaviv/etnaviv_gpu.c
index 72d01e873160..5418a1a87b2c 100644
--- a/drivers/gpu/drm/etnaviv/etnaviv_gpu.c
+++ b/drivers/gpu/drm/etnaviv/etnaviv_gpu.c
@@ -760,7 +760,7 @@ int etnaviv_gpu_init(struct etnaviv_gpu *gpu)
         if (IS_ERR(gpu->cmdbuf_suballoc)) {
                 dev_err(gpu->dev, "Failed to create cmdbuf suballocator\n");
                 ret = PTR_ERR(gpu->cmdbuf_suballoc);
-                goto fail;
+                goto destroy_iommu;
         }
 
         /* Create buffer: */
@@ -768,7 +768,7 @@ int etnaviv_gpu_init(struct etnaviv_gpu *gpu)
                                   PAGE_SIZE);
         if (ret) {
                 dev_err(gpu->dev, "could not create command buffer\n");
-                goto destroy_iommu;
+                goto destroy_suballoc;
         }
 
         if (gpu->mmu->version == ETNAVIV_IOMMU_V1 &&
@@ -800,6 +800,9 @@ int etnaviv_gpu_init(struct etnaviv_gpu *gpu)
 free_buffer:
         etnaviv_cmdbuf_free(&gpu->buffer);
         gpu->buffer.suballoc = NULL;
+destroy_suballoc:
+        etnaviv_cmdbuf_suballoc_destroy(gpu->cmdbuf_suballoc);
+        gpu->cmdbuf_suballoc = NULL;
 destroy_iommu:
         etnaviv_iommu_destroy(gpu->mmu);
         gpu->mmu = NULL;
diff --git a/drivers/gpu/drm/i915/intel_ringbuffer.c b/drivers/gpu/drm/i915/intel_ringbuffer.c
index 029fd8ec1857..f0d45ccc1aac 100644
--- a/drivers/gpu/drm/i915/intel_ringbuffer.c
+++ b/drivers/gpu/drm/i915/intel_ringbuffer.c
@@ -1888,12 +1888,12 @@ static int ring_request_alloc(struct i915_request *request)
          */
         request->reserved_space += LEGACY_REQUEST_SIZE;
 
-        ret = switch_context(request);
+        /* Unconditionally invalidate GPU caches and TLBs. */
+        ret = request->engine->emit_flush(request, EMIT_INVALIDATE);
         if (ret)
                 return ret;
 
-        /* Unconditionally invalidate GPU caches and TLBs. */
-        ret = request->engine->emit_flush(request, EMIT_INVALIDATE);
+        ret = switch_context(request);
         if (ret)
                 return ret;
 
diff --git a/drivers/gpu/drm/imx/ipuv3-crtc.c b/drivers/gpu/drm/imx/ipuv3-crtc.c
index 9cc1d678674f..c436a28d50e4 100644
--- a/drivers/gpu/drm/imx/ipuv3-crtc.c
+++ b/drivers/gpu/drm/imx/ipuv3-crtc.c
@@ -91,14 +91,14 @@ static void ipu_crtc_atomic_disable(struct drm_crtc *crtc,
         ipu_dc_disable(ipu);
         ipu_prg_disable(ipu);
 
+        drm_crtc_vblank_off(crtc);
+
         spin_lock_irq(&crtc->dev->event_lock);
-        if (crtc->state->event) {
+        if (crtc->state->event && !crtc->state->active) {
                 drm_crtc_send_vblank_event(crtc, crtc->state->event);
                 crtc->state->event = NULL;
         }
         spin_unlock_irq(&crtc->dev->event_lock);
-
-        drm_crtc_vblank_off(crtc);
 }
 
 static void imx_drm_crtc_reset(struct drm_crtc *crtc)
diff --git a/drivers/gpu/drm/panfrost/panfrost_drv.c b/drivers/gpu/drm/panfrost/panfrost_drv.c
index d11e2281dde6..7e43b25785f7 100644
--- a/drivers/gpu/drm/panfrost/panfrost_drv.c
+++ b/drivers/gpu/drm/panfrost/panfrost_drv.c
@@ -63,7 +63,7 @@ static int panfrost_ioctl_create_bo(struct drm_device *dev, void *data,
         return 0;
 
 err_free:
-        drm_gem_object_put_unlocked(&shmem->base);
+        drm_gem_handle_delete(file, args->handle);
         return ret;
 }
 
diff --git a/drivers/gpu/drm/virtio/virtgpu_vq.c b/drivers/gpu/drm/virtio/virtgpu_vq.c
index e62fe24b1a2e..5bb0f0a084e9 100644
--- a/drivers/gpu/drm/virtio/virtgpu_vq.c
+++ b/drivers/gpu/drm/virtio/virtgpu_vq.c
@@ -619,11 +619,11 @@ static void virtio_gpu_cmd_get_edid_cb(struct virtio_gpu_device *vgdev,
         output = vgdev->outputs + scanout;
 
         new_edid = drm_do_get_edid(&output->conn, virtio_get_edid_block, resp);
+        drm_connector_update_edid_property(&output->conn, new_edid);
 
         spin_lock(&vgdev->display_info_lock);
         old_edid = output->edid;
         output->edid = new_edid;
-        drm_connector_update_edid_property(&output->conn, output->edid);
         spin_unlock(&vgdev->display_info_lock);
 
         kfree(old_edid);
diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
index eac0c54c5970..b032d3899fa3 100644
--- a/drivers/hid/hid-ids.h
+++ b/drivers/hid/hid-ids.h
@@ -80,6 +80,7 @@
 #define HID_DEVICE_ID_ALPS_U1_DUAL_3BTN_PTP     0x1220
 #define HID_DEVICE_ID_ALPS_U1           0x1215
 #define HID_DEVICE_ID_ALPS_T4_BTNLESS   0x120C
+#define HID_DEVICE_ID_ALPS_1222         0x1222
 
 
 #define USB_VENDOR_ID_AMI               0x046b
@@ -269,6 +270,7 @@
 #define USB_DEVICE_ID_CHICONY_MULTI_TOUCH       0xb19d
 #define USB_DEVICE_ID_CHICONY_WIRELESS  0x0618
 #define USB_DEVICE_ID_CHICONY_PIXART_USB_OPTICAL_MOUSE  0x1053
+#define USB_DEVICE_ID_CHICONY_PIXART_USB_OPTICAL_MOUSE2 0x0939
 #define USB_DEVICE_ID_CHICONY_WIRELESS2 0x1123
 #define USB_DEVICE_ID_ASUS_AK1D         0x1125
 #define USB_DEVICE_ID_CHICONY_TOSHIBA_WT10A     0x1408
@@ -569,6 +571,7 @@
 
 #define USB_VENDOR_ID_HUION             0x256c
 #define USB_DEVICE_ID_HUION_TABLET      0x006e
+#define USB_DEVICE_ID_HUION_HS64        0x006d
 
 #define USB_VENDOR_ID_IBM                                       0x04b3
 #define USB_DEVICE_ID_IBM_SCROLLPOINT_III                       0x3100
diff --git a/drivers/hid/hid-logitech-dj.c b/drivers/hid/hid-logitech-dj.c
index e564bff86515..bfcf2ee58d14 100644
--- a/drivers/hid/hid-logitech-dj.c
+++ b/drivers/hid/hid-logitech-dj.c
@@ -30,6 +30,7 @@
 
 #define REPORT_ID_HIDPP_SHORT                   0x10
 #define REPORT_ID_HIDPP_LONG                    0x11
+#define REPORT_ID_HIDPP_VERY_LONG               0x12
 
 #define HIDPP_REPORT_SHORT_LENGTH               7
 #define HIDPP_REPORT_LONG_LENGTH                20
@@ -1242,7 +1243,8 @@ static int logi_dj_ll_raw_request(struct hid_device *hid,
         int ret;
 
         if ((buf[0] == REPORT_ID_HIDPP_SHORT) ||
-            (buf[0] == REPORT_ID_HIDPP_LONG)) {
+            (buf[0] == REPORT_ID_HIDPP_LONG) ||
+            (buf[0] == REPORT_ID_HIDPP_VERY_LONG)) {
                 if (count < 2)
                         return -EINVAL;
 
diff --git a/drivers/hid/hid-multitouch.c b/drivers/hid/hid-multitouch.c
index 5df5dd56ecc8..b603c14d043b 100644
--- a/drivers/hid/hid-multitouch.c
+++ b/drivers/hid/hid-multitouch.c
@@ -1776,6 +1776,10 @@ static const struct hid_device_id mt_devices[] = {
                 HID_DEVICE(BUS_I2C, HID_GROUP_MULTITOUCH_WIN_8,
                         USB_VENDOR_ID_ALPS_JP,
                         HID_DEVICE_ID_ALPS_U1_DUAL_3BTN_PTP) },
+        { .driver_data = MT_CLS_WIN_8_DUAL,
+                HID_DEVICE(BUS_I2C, HID_GROUP_MULTITOUCH_WIN_8,
+                        USB_VENDOR_ID_ALPS_JP,
+                        HID_DEVICE_ID_ALPS_1222) },
 
         /* Lenovo X1 TAB Gen 2 */
         { .driver_data = MT_CLS_WIN_8_DUAL,
diff --git a/drivers/hid/hid-quirks.c b/drivers/hid/hid-quirks.c
index e5ca6fe2ca57..671a285724f9 100644
--- a/drivers/hid/hid-quirks.c
+++ b/drivers/hid/hid-quirks.c
@@ -42,6 +42,7 @@ static const struct hid_device_id hid_quirks[] = {
         { HID_USB_DEVICE(USB_VENDOR_ID_ATEN, USB_DEVICE_ID_ATEN_UC100KM), HID_QUIRK_NOGET },
         { HID_USB_DEVICE(USB_VENDOR_ID_CHICONY, USB_DEVICE_ID_CHICONY_MULTI_TOUCH), HID_QUIRK_MULTI_INPUT },
         { HID_USB_DEVICE(USB_VENDOR_ID_CHICONY, USB_DEVICE_ID_CHICONY_PIXART_USB_OPTICAL_MOUSE), HID_QUIRK_ALWAYS_POLL },
+        { HID_USB_DEVICE(USB_VENDOR_ID_CHICONY, USB_DEVICE_ID_CHICONY_PIXART_USB_OPTICAL_MOUSE2), HID_QUIRK_ALWAYS_POLL },
         { HID_USB_DEVICE(USB_VENDOR_ID_CHICONY, USB_DEVICE_ID_CHICONY_WIRELESS), HID_QUIRK_MULTI_INPUT },
         { HID_USB_DEVICE(USB_VENDOR_ID_CHIC, USB_DEVICE_ID_CHIC_GAMEPAD), HID_QUIRK_BADPAD },
         { HID_USB_DEVICE(USB_VENDOR_ID_CH, USB_DEVICE_ID_CH_3AXIS_5BUTTON_STICK), HID_QUIRK_NOGET },
diff --git a/drivers/hid/hid-uclogic-core.c b/drivers/hid/hid-uclogic-core.c
index 8fe02d81265d..914fb527ae7a 100644
--- a/drivers/hid/hid-uclogic-core.c
+++ b/drivers/hid/hid-uclogic-core.c
@@ -369,6 +369,8 @@ static const struct hid_device_id uclogic_devices[] = {
                                 USB_DEVICE_ID_UCLOGIC_TABLET_TWHA60) },
         { HID_USB_DEVICE(USB_VENDOR_ID_HUION,
                                 USB_DEVICE_ID_HUION_TABLET) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_HUION,
+                                USB_DEVICE_ID_HUION_HS64) },
         { HID_USB_DEVICE(USB_VENDOR_ID_UCLOGIC,
                                 USB_DEVICE_ID_HUION_TABLET) },
         { HID_USB_DEVICE(USB_VENDOR_ID_UCLOGIC,
diff --git a/drivers/hid/hid-uclogic-params.c b/drivers/hid/hid-uclogic-params.c
index 0187c9f8fc22..273d784fff66 100644
--- a/drivers/hid/hid-uclogic-params.c
+++ b/drivers/hid/hid-uclogic-params.c
@@ -977,6 +977,8 @@ int uclogic_params_init(struct uclogic_params *params,
                 /* FALL THROUGH */
         case VID_PID(USB_VENDOR_ID_HUION,
                      USB_DEVICE_ID_HUION_TABLET):
+        case VID_PID(USB_VENDOR_ID_HUION,
+                     USB_DEVICE_ID_HUION_HS64):
         case VID_PID(USB_VENDOR_ID_UCLOGIC,
                      USB_DEVICE_ID_HUION_TABLET):
         case VID_PID(USB_VENDOR_ID_UCLOGIC,
diff --git a/drivers/hid/intel-ish-hid/ishtp-fw-loader.c b/drivers/hid/intel-ish-hid/ishtp-fw-loader.c
index 22ba21457035..aa2dbed30fc3 100644
--- a/drivers/hid/intel-ish-hid/ishtp-fw-loader.c
+++ b/drivers/hid/intel-ish-hid/ishtp-fw-loader.c
@@ -816,9 +816,9 @@ static int load_fw_from_host(struct ishtp_cl_data *client_data)
                 goto end_err_fw_release;
 
         release_firmware(fw);
-        kfree(filename);
         dev_info(cl_data_to_dev(client_data), "ISH firmware %s loaded\n",
                  filename);
+        kfree(filename);
         return 0;
 
 end_err_fw_release:
diff --git a/drivers/hid/intel-ish-hid/ishtp-hid-client.c b/drivers/hid/intel-ish-hid/ishtp-hid-client.c
index c0487b34d2cf..6ba944b40fdb 100644
--- a/drivers/hid/intel-ish-hid/ishtp-hid-client.c
+++ b/drivers/hid/intel-ish-hid/ishtp-hid-client.c
@@ -891,7 +891,7 @@ static int hid_ishtp_cl_reset(struct ishtp_cl_device *cl_device)
  */
 static int hid_ishtp_cl_suspend(struct device *device)
 {
-        struct ishtp_cl_device *cl_device = dev_get_drvdata(device);
+        struct ishtp_cl_device *cl_device = ishtp_dev_to_cl_device(device);
         struct ishtp_cl *hid_ishtp_cl = ishtp_get_drvdata(cl_device);
         struct ishtp_cl_data *client_data = ishtp_get_client_data(hid_ishtp_cl);
 
@@ -912,7 +912,7 @@ static int hid_ishtp_cl_suspend(struct device *device)
  */
 static int hid_ishtp_cl_resume(struct device *device)
 {
-        struct ishtp_cl_device *cl_device = dev_get_drvdata(device);
+        struct ishtp_cl_device *cl_device = ishtp_dev_to_cl_device(device);
         struct ishtp_cl *hid_ishtp_cl = ishtp_get_drvdata(cl_device);
         struct ishtp_cl_data *client_data = ishtp_get_client_data(hid_ishtp_cl);
 
diff --git a/drivers/hid/intel-ish-hid/ishtp/bus.c b/drivers/hid/intel-ish-hid/ishtp/bus.c
index 794e700d65f7..c47c3328a0f4 100644
--- a/drivers/hid/intel-ish-hid/ishtp/bus.c
+++ b/drivers/hid/intel-ish-hid/ishtp/bus.c
@@ -471,7 +471,6 @@ static struct ishtp_cl_device *ishtp_bus_add_device(struct ishtp_device *dev,
         }
 
         ishtp_device_ready = true;
-        dev_set_drvdata(&device->dev, device);
 
         return device;
 }
@@ -640,6 +639,20 @@ void *ishtp_get_drvdata(struct ishtp_cl_device *cl_device)
 EXPORT_SYMBOL(ishtp_get_drvdata);
 
 /**
+ * ishtp_dev_to_cl_device() - get ishtp_cl_device instance from device instance
+ * @device: device instance
+ *
+ * Get ish_cl_device instance which embeds device instance in it.
+ *
+ * Return: pointer to ishtp_cl_device instance
+ */
+struct ishtp_cl_device *ishtp_dev_to_cl_device(struct device *device)
+{
+        return to_ishtp_cl_device(device);
+}
+EXPORT_SYMBOL(ishtp_dev_to_cl_device);
+
+/**
  * ishtp_bus_new_client() - Create a new client
  * @dev:        ISHTP device instance
  *
diff --git a/drivers/hv/Kconfig b/drivers/hv/Kconfig
index 1c1a2514d6f3..c423e57ae888 100644
--- a/drivers/hv/Kconfig
+++ b/drivers/hv/Kconfig
@@ -10,6 +10,9 @@ config HYPERV
           Select this option to run Linux as a Hyper-V client operating
           system.
 
+config HYPERV_TIMER
+        def_bool HYPERV
+
 config HYPERV_TSCPAGE
        def_bool HYPERV && X86_64
 
diff --git a/drivers/hv/hv.c b/drivers/hv/hv.c
index a1ea482183e8..6188fb7dda42 100644
--- a/drivers/hv/hv.c
+++ b/drivers/hv/hv.c
@@ -16,6 +16,7 @@
 #include <linux/version.h>
 #include <linux/random.h>
 #include <linux/clockchips.h>
+#include <clocksource/hyperv_timer.h>
 #include <asm/mshyperv.h>
 #include "hyperv_vmbus.h"
 
@@ -23,21 +24,6 @@
 struct hv_context hv_context;
 
 /*
- * If false, we're using the old mechanism for stimer0 interrupts
- * where it sends a VMbus message when it expires. The old
- * mechanism is used when running on older versions of Hyper-V
- * that don't support Direct Mode. While Hyper-V provides
- * four stimer's per CPU, Linux uses only stimer0.
- */
-static bool direct_mode_enabled;
-static int stimer0_irq;
-static int stimer0_vector;
-
-#define HV_TIMER_FREQUENCY (10 * 1000 * 1000) /* 100ns period */
-#define HV_MAX_MAX_DELTA_TICKS 0xffffffff
-#define HV_MIN_DELTA_TICKS 1
-
-/*
  * hv_init - Main initialization routine.
  *
  * This routine must be called before any other routines in here are called
@@ -47,9 +33,6 @@ int hv_init(void)
         hv_context.cpu_context = alloc_percpu(struct hv_per_cpu_context);
         if (!hv_context.cpu_context)
                 return -ENOMEM;
-
-        direct_mode_enabled = ms_hyperv.misc_features &
-                        HV_STIMER_DIRECT_MODE_AVAILABLE;
         return 0;
 }
 
@@ -88,89 +71,6 @@ int hv_post_message(union hv_connection_id connection_id,
         return status & 0xFFFF;
 }
 
-/*
- * ISR for when stimer0 is operating in Direct Mode.  Direct Mode
- * does not use VMbus or any VMbus messages, so process here and not
- * in the VMbus driver code.
- */
-
-static void hv_stimer0_isr(void)
-{
-        struct hv_per_cpu_context *hv_cpu;
-
-        hv_cpu = this_cpu_ptr(hv_context.cpu_context);
-        hv_cpu->clk_evt->event_handler(hv_cpu->clk_evt);
-        add_interrupt_randomness(stimer0_vector, 0);
-}
-
-static int hv_ce_set_next_event(unsigned long delta,
-                                struct clock_event_device *evt)
-{
-        u64 current_tick;
-
-        WARN_ON(!clockevent_state_oneshot(evt));
-
-        current_tick = hyperv_cs->read(NULL);
-        current_tick += delta;
-        hv_init_timer(0, current_tick);
-        return 0;
-}
-
-static int hv_ce_shutdown(struct clock_event_device *evt)
-{
-        hv_init_timer(0, 0);
-        hv_init_timer_config(0, 0);
-        if (direct_mode_enabled)
-                hv_disable_stimer0_percpu_irq(stimer0_irq);
-
-        return 0;
-}
-
-static int hv_ce_set_oneshot(struct clock_event_device *evt)
-{
-        union hv_stimer_config timer_cfg;
-
-        timer_cfg.as_uint64 = 0;
-        timer_cfg.enable = 1;
-        timer_cfg.auto_enable = 1;
-        if (direct_mode_enabled) {
-                /*
-                 * When it expires, the timer will directly interrupt
-                 * on the specified hardware vector/IRQ.
-                 */
-                timer_cfg.direct_mode = 1;
-                timer_cfg.apic_vector = stimer0_vector;
-                hv_enable_stimer0_percpu_irq(stimer0_irq);
-        } else {
-                /*
-                 * When it expires, the timer will generate a VMbus message,
-                 * to be handled by the normal VMbus interrupt handler.
-                 */
-                timer_cfg.direct_mode = 0;
-                timer_cfg.sintx = VMBUS_MESSAGE_SINT;
-        }
-        hv_init_timer_config(0, timer_cfg.as_uint64);
-        return 0;
-}
-
-static void hv_init_clockevent_device(struct clock_event_device *dev, int cpu)
-{
-        dev->name = "Hyper-V clockevent";
-        dev->features = CLOCK_EVT_FEAT_ONESHOT;
-        dev->cpumask = cpumask_of(cpu);
-        dev->rating = 1000;
-        /*
-         * Avoid settint dev->owner = THIS_MODULE deliberately as doing so will
-         * result in clockevents_config_and_register() taking additional
-         * references to the hv_vmbus module making it impossible to unload.
-         */
-
-        dev->set_state_shutdown = hv_ce_shutdown;
-        dev->set_state_oneshot = hv_ce_set_oneshot;
-        dev->set_next_event = hv_ce_set_next_event;
-}
-
-
 int hv_synic_alloc(void)
 {
         int cpu;
@@ -199,14 +99,6 @@ int hv_synic_alloc(void)
                 tasklet_init(&hv_cpu->msg_dpc,
                              vmbus_on_msg_dpc, (unsigned long) hv_cpu);
 
-                hv_cpu->clk_evt = kzalloc(sizeof(struct clock_event_device),
-                                          GFP_KERNEL);
-                if (hv_cpu->clk_evt == NULL) {
-                        pr_err("Unable to allocate clock event device\n");
-                        goto err;
-                }
-                hv_init_clockevent_device(hv_cpu->clk_evt, cpu);
-
                 hv_cpu->synic_message_page =
                         (void *)get_zeroed_page(GFP_ATOMIC);
                 if (hv_cpu->synic_message_page == NULL) {
@@ -229,11 +121,6 @@ int hv_synic_alloc(void)
                 INIT_LIST_HEAD(&hv_cpu->chan_list);
         }
 
-        if (direct_mode_enabled &&
-            hv_setup_stimer0_irq(&stimer0_irq, &stimer0_vector,
-                                hv_stimer0_isr))
-                goto err;
-
         return 0;
 err:
         /*
@@ -252,7 +139,6 @@ void hv_synic_free(void)
                 struct hv_per_cpu_context *hv_cpu
                         = per_cpu_ptr(hv_context.cpu_context, cpu);
 
-                kfree(hv_cpu->clk_evt);
                 free_page((unsigned long)hv_cpu->synic_event_page);
                 free_page((unsigned long)hv_cpu->synic_message_page);
                 free_page((unsigned long)hv_cpu->post_msg_page);
@@ -311,36 +197,9 @@ int hv_synic_init(unsigned int cpu)
 
         hv_set_synic_state(sctrl.as_uint64);
 
-        /*
-         * Register the per-cpu clockevent source.
-         */
-        if (ms_hyperv.features & HV_MSR_SYNTIMER_AVAILABLE)
-                clockevents_config_and_register(hv_cpu->clk_evt,
-                                                HV_TIMER_FREQUENCY,
-                                                HV_MIN_DELTA_TICKS,
-                                                HV_MAX_MAX_DELTA_TICKS);
-        return 0;
-}
-
-/*
- * hv_synic_clockevents_cleanup - Cleanup clockevent devices
- */
-void hv_synic_clockevents_cleanup(void)
-{
-        int cpu;
+        hv_stimer_init(cpu);
 
-        if (!(ms_hyperv.features & HV_MSR_SYNTIMER_AVAILABLE))
-                return;
-
-        if (direct_mode_enabled)
-                hv_remove_stimer0_irq(stimer0_irq);
-
-        for_each_present_cpu(cpu) {
-                struct hv_per_cpu_context *hv_cpu
-                        = per_cpu_ptr(hv_context.cpu_context, cpu);
-
-                clockevents_unbind_device(hv_cpu->clk_evt, cpu);
-        }
+        return 0;
 }
 
 /*
@@ -388,14 +247,7 @@ int hv_synic_cleanup(unsigned int cpu)
         if (channel_found && vmbus_connection.conn_state == CONNECTED)
                 return -EBUSY;
 
-        /* Turn off clockevent device */
-        if (ms_hyperv.features & HV_MSR_SYNTIMER_AVAILABLE) {
-                struct hv_per_cpu_context *hv_cpu
-                        = this_cpu_ptr(hv_context.cpu_context);
-
-                clockevents_unbind_device(hv_cpu->clk_evt, cpu);
-                hv_ce_shutdown(hv_cpu->clk_evt);
-        }
+        hv_stimer_cleanup(cpu);
 
         hv_get_synint_state(VMBUS_MESSAGE_SINT, shared_sint.as_uint64);
 
diff --git a/drivers/hv/hv_util.c b/drivers/hv/hv_util.c
index 7d3d31f099ea..e32681ee7b9f 100644
--- a/drivers/hv/hv_util.c
+++ b/drivers/hv/hv_util.c
@@ -17,6 +17,7 @@
 #include <linux/hyperv.h>
 #include <linux/clockchips.h>
 #include <linux/ptp_clock_kernel.h>
+#include <clocksource/hyperv_timer.h>
 #include <asm/mshyperv.h>
 
 #include "hyperv_vmbus.h"
diff --git a/drivers/hv/hyperv_vmbus.h b/drivers/hv/hyperv_vmbus.h
index b8e1ff05f110..362e70e9d145 100644
--- a/drivers/hv/hyperv_vmbus.h
+++ b/drivers/hv/hyperv_vmbus.h
@@ -138,7 +138,6 @@ struct hv_per_cpu_context {
          * per-cpu list of the channels based on their CPU affinity.
          */
         struct list_head chan_list;
-        struct clock_event_device *clk_evt;
 };
 
 struct hv_context {
@@ -176,8 +175,6 @@ extern int hv_synic_init(unsigned int cpu);
 
 extern int hv_synic_cleanup(unsigned int cpu);
 
-extern void hv_synic_clockevents_cleanup(void);
-
 /* Interface */
 
 void hv_ringbuffer_pre_init(struct vmbus_channel *channel);
diff --git a/drivers/hv/vmbus_drv.c b/drivers/hv/vmbus_drv.c
index 92b1874b3eb3..72d5a7cde7ea 100644
--- a/drivers/hv/vmbus_drv.c
+++ b/drivers/hv/vmbus_drv.c
@@ -30,6 +30,7 @@
 #include <linux/kdebug.h>
 #include <linux/efi.h>
 #include <linux/random.h>
+#include <clocksource/hyperv_timer.h>
 #include "hyperv_vmbus.h"
 
 struct vmbus_dynid {
@@ -955,17 +956,6 @@ static void vmbus_onmessage_work(struct work_struct *work)
         kfree(ctx);
 }
 
-static void hv_process_timer_expiration(struct hv_message *msg,
-                                        struct hv_per_cpu_context *hv_cpu)
-{
-        struct clock_event_device *dev = hv_cpu->clk_evt;
-
-        if (dev->event_handler)
-                dev->event_handler(dev);
-
-        vmbus_signal_eom(msg, HVMSG_TIMER_EXPIRED);
-}
-
 void vmbus_on_msg_dpc(unsigned long data)
 {
         struct hv_per_cpu_context *hv_cpu = (void *)data;
@@ -1159,9 +1149,10 @@ static void vmbus_isr(void)
 
         /* Check if there are actual msgs to be processed */
         if (msg->header.message_type != HVMSG_NONE) {
-                if (msg->header.message_type == HVMSG_TIMER_EXPIRED)
-                        hv_process_timer_expiration(msg, hv_cpu);
-                else
+                if (msg->header.message_type == HVMSG_TIMER_EXPIRED) {
+                        hv_stimer0_isr();
+                        vmbus_signal_eom(msg, HVMSG_TIMER_EXPIRED);
+                } else
                         tasklet_schedule(&hv_cpu->msg_dpc);
         }
 
@@ -1263,14 +1254,19 @@ static int vmbus_bus_init(void)
         ret = hv_synic_alloc();
         if (ret)
                 goto err_alloc;
+
+        ret = hv_stimer_alloc(VMBUS_MESSAGE_SINT);
+        if (ret < 0)
+                goto err_alloc;
+
         /*
-         * Initialize the per-cpu interrupt state and
-         * connect to the host.
+         * Initialize the per-cpu interrupt state and stimer state.
+         * Then connect to the host.
          */
         ret = cpuhp_setup_state(CPUHP_AP_ONLINE_DYN, "hyperv/vmbus:online",
                                 hv_synic_init, hv_synic_cleanup);
         if (ret < 0)
-                goto err_alloc;
+                goto err_cpuhp;
         hyperv_cpuhp_online = ret;
 
         ret = vmbus_connect();
@@ -1318,6 +1314,8 @@ static int vmbus_bus_init(void)
 
 err_connect:
         cpuhp_remove_state(hyperv_cpuhp_online);
+err_cpuhp:
+        hv_stimer_free();
 err_alloc:
         hv_synic_free();
         hv_remove_vmbus_irq();
@@ -2064,7 +2062,7 @@ static struct acpi_driver vmbus_acpi_driver = {
 
 static void hv_kexec_handler(void)
 {
-        hv_synic_clockevents_cleanup();
+        hv_stimer_global_cleanup();
         vmbus_initiate_unload(false);
         vmbus_connection.conn_state = DISCONNECTED;
         /* Make sure conn_state is set as hv_synic_cleanup checks for it */
@@ -2075,6 +2073,8 @@ static void hv_kexec_handler(void)
 
 static void hv_crash_handler(struct pt_regs *regs)
 {
+        int cpu;
+
         vmbus_initiate_unload(true);
         /*
          * In crash handler we can't schedule synic cleanup for all CPUs,
@@ -2082,7 +2082,9 @@ static void hv_crash_handler(struct pt_regs *regs)
          * for kdump.
          */
         vmbus_connection.conn_state = DISCONNECTED;
-        hv_synic_cleanup(smp_processor_id());
+        cpu = smp_processor_id();
+        hv_stimer_cleanup(cpu);
+        hv_synic_cleanup(cpu);
         hyperv_cleanup();
 };
 
@@ -2131,7 +2133,7 @@ static void __exit vmbus_exit(void)
         hv_remove_kexec_handler();
         hv_remove_crash_handler();
         vmbus_connection.conn_state = DISCONNECTED;
-        hv_synic_clockevents_cleanup();
+        hv_stimer_global_cleanup();
         vmbus_disconnect();
         hv_remove_vmbus_irq();
         for_each_online_cpu(cpu) {
diff --git a/drivers/iio/humidity/dht11.c b/drivers/iio/humidity/dht11.c
index c8159205c77d..4e22b3c3e488 100644
--- a/drivers/iio/humidity/dht11.c
+++ b/drivers/iio/humidity/dht11.c
@@ -149,7 +149,7 @@ static int dht11_decode(struct dht11 *dht11, int offset)
                 return -EIO;
         }
 
-        dht11->timestamp = ktime_get_boot_ns();
+        dht11->timestamp = ktime_get_boottime_ns();
         if (hum_int < 4) {  /* DHT22: 100000 = (3*256+232)*100 */
                 dht11->temperature = (((temp_int & 0x7f) << 8) + temp_dec) *
                                         ((temp_int & 0x80) ? -100 : 100);
@@ -177,7 +177,7 @@ static irqreturn_t dht11_handle_irq(int irq, void *data)
 
         /* TODO: Consider making the handler safe for IRQ sharing */
         if (dht11->num_edges < DHT11_EDGES_PER_READ && dht11->num_edges >= 0) {
-                dht11->edges[dht11->num_edges].ts = ktime_get_boot_ns();
+                dht11->edges[dht11->num_edges].ts = ktime_get_boottime_ns();
                 dht11->edges[dht11->num_edges++].value =
                                                 gpio_get_value(dht11->gpio);
 
@@ -196,7 +196,7 @@ static int dht11_read_raw(struct iio_dev *iio_dev,
         int ret, timeres, offset;
 
         mutex_lock(&dht11->lock);
-        if (dht11->timestamp + DHT11_DATA_VALID_TIME < ktime_get_boot_ns()) {
+        if (dht11->timestamp + DHT11_DATA_VALID_TIME < ktime_get_boottime_ns()) {
                 timeres = ktime_get_resolution_ns();
                 dev_dbg(dht11->dev, "current timeresolution: %dns\n", timeres);
                 if (timeres > DHT11_MIN_TIMERES) {
@@ -322,7 +322,7 @@ static int dht11_probe(struct platform_device *pdev)
                 return -EINVAL;
         }
 
-        dht11->timestamp = ktime_get_boot_ns() - DHT11_DATA_VALID_TIME - 1;
+        dht11->timestamp = ktime_get_boottime_ns() - DHT11_DATA_VALID_TIME - 1;
         dht11->num_edges = -1;
 
         platform_set_drvdata(pdev, iio);
diff --git a/drivers/iio/industrialio-core.c b/drivers/iio/industrialio-core.c
index 245b5844028d..401d7ff99853 100644
--- a/drivers/iio/industrialio-core.c
+++ b/drivers/iio/industrialio-core.c
@@ -228,9 +228,9 @@ s64 iio_get_time_ns(const struct iio_dev *indio_dev)
                 ktime_get_coarse_ts64(&tp);
                 return timespec64_to_ns(&tp);
         case CLOCK_BOOTTIME:
-                return ktime_get_boot_ns();
+                return ktime_get_boottime_ns();
         case CLOCK_TAI:
-                return ktime_get_tai_ns();
+                return ktime_get_clocktai_ns();
         default:
                 BUG();
         }
diff --git a/drivers/infiniband/core/device.c b/drivers/infiniband/core/device.c
index 29f7b15c81d9..d020bb4d03d5 100644
--- a/drivers/infiniband/core/device.c
+++ b/drivers/infiniband/core/device.c
@@ -457,7 +457,7 @@ static int alloc_name(struct ib_device *ibdev, const char *name)
         int rc;
         int i;
 
-        lockdep_assert_held_exclusive(&devices_rwsem);
+        lockdep_assert_held_write(&devices_rwsem);
         ida_init(&inuse);
         xa_for_each (&devices, index, device) {
                 char buf[IB_DEVICE_NAME_MAX];
diff --git a/drivers/infiniband/hw/mlx4/alias_GUID.c b/drivers/infiniband/hw/mlx4/alias_GUID.c
index 2a0b59a4b6eb..cca414ecfcd5 100644
--- a/drivers/infiniband/hw/mlx4/alias_GUID.c
+++ b/drivers/infiniband/hw/mlx4/alias_GUID.c
@@ -310,7 +310,7 @@ static void aliasguid_query_handler(int status,
         if (status) {
                 pr_debug("(port: %d) failed: status = %d\n",
                          cb_ctx->port, status);
-                rec->time_to_run = ktime_get_boot_ns() + 1 * NSEC_PER_SEC;
+                rec->time_to_run = ktime_get_boottime_ns() + 1 * NSEC_PER_SEC;
                 goto out;
         }
 
@@ -416,7 +416,7 @@ next_entry:
                          be64_to_cpu((__force __be64)rec->guid_indexes),
                          be64_to_cpu((__force __be64)applied_guid_indexes),
                          be64_to_cpu((__force __be64)declined_guid_indexes));
-                rec->time_to_run = ktime_get_boot_ns() +
+                rec->time_to_run = ktime_get_boottime_ns() +
                         resched_delay_sec * NSEC_PER_SEC;
         } else {
                 rec->status = MLX4_GUID_INFO_STATUS_SET;
@@ -709,7 +709,7 @@ static int get_low_record_time_index(struct mlx4_ib_dev *dev, u8 port,
                 }
         }
         if (resched_delay_sec) {
-                u64 curr_time = ktime_get_boot_ns();
+                u64 curr_time = ktime_get_boottime_ns();
 
                 *resched_delay_sec = (low_record_time < curr_time) ? 0 :
                         div_u64((low_record_time - curr_time), NSEC_PER_SEC);
diff --git a/drivers/irqchip/Kconfig b/drivers/irqchip/Kconfig
index 659c5e0fb835..80e10f4e213a 100644
--- a/drivers/irqchip/Kconfig
+++ b/drivers/irqchip/Kconfig
@@ -15,10 +15,10 @@ config ARM_GIC_PM
         bool
         depends on PM
         select ARM_GIC
-        select PM_CLK
 
 config ARM_GIC_MAX_NR
         int
+        depends on ARM_GIC
         default 2 if ARCH_REALVIEW
         default 1
 
@@ -87,6 +87,14 @@ config ALPINE_MSI
         select PCI_MSI
         select GENERIC_IRQ_CHIP
 
+config AL_FIC
+        bool "Amazon's Annapurna Labs Fabric Interrupt Controller"
+        depends on OF || COMPILE_TEST
+        select GENERIC_IRQ_CHIP
+        select IRQ_DOMAIN
+        help
+          Support Amazon's Annapurna Labs Fabric Interrupt Controller.
+
 config ATMEL_AIC_IRQ
         bool
         select GENERIC_IRQ_CHIP
@@ -217,13 +225,26 @@ config RDA_INTC
         select IRQ_DOMAIN
 
 config RENESAS_INTC_IRQPIN
-        bool
+        bool "Renesas INTC External IRQ Pin Support" if COMPILE_TEST
         select IRQ_DOMAIN
+        help
+          Enable support for the Renesas Interrupt Controller for external
+          interrupt pins, as found on SH/R-Mobile and R-Car Gen1 SoCs.
 
 config RENESAS_IRQC
-        bool
+        bool "Renesas R-Mobile APE6 and R-Car IRQC support" if COMPILE_TEST
         select GENERIC_IRQ_CHIP
         select IRQ_DOMAIN
+        help
+          Enable support for the Renesas Interrupt Controller for external
+          devices, as found on R-Mobile APE6, R-Car Gen2, and R-Car Gen3 SoCs.
+
+config RENESAS_RZA1_IRQC
+        bool "Renesas RZ/A1 IRQC support" if COMPILE_TEST
+        select IRQ_DOMAIN_HIERARCHY
+        help
+          Enable support for the Renesas RZ/A1 Interrupt Controller, to use up
+          to 8 external interrupts with configurable sense select.
 
 config ST_IRQCHIP
         bool
@@ -299,8 +320,11 @@ config RENESAS_H8300H_INTC
         select IRQ_DOMAIN
 
 config RENESAS_H8S_INTC
-        bool
+        bool "Renesas H8S Interrupt Controller Support" if COMPILE_TEST
         select IRQ_DOMAIN
+        help
+          Enable support for the Renesas H8/300 Interrupt Controller, as found
+          on Renesas H8S SoCs.
 
 config IMX_GPCV2
         bool
diff --git a/drivers/irqchip/Makefile b/drivers/irqchip/Makefile
index 606a003a0000..8d0fcec6ab23 100644
--- a/drivers/irqchip/Makefile
+++ b/drivers/irqchip/Makefile
@@ -1,6 +1,7 @@
 # SPDX-License-Identifier: GPL-2.0
 obj-$(CONFIG_IRQCHIP)                   += irqchip.o
 
+obj-$(CONFIG_AL_FIC)                    += irq-al-fic.o
 obj-$(CONFIG_ALPINE_MSI)                += irq-alpine-msi.o
 obj-$(CONFIG_ATH79)                     += irq-ath79-cpu.o
 obj-$(CONFIG_ATH79)                     += irq-ath79-misc.o
@@ -49,6 +50,7 @@ obj-$(CONFIG_JCORE_AIC)			+= irq-jcore-aic.o
 obj-$(CONFIG_RDA_INTC)                  += irq-rda-intc.o
 obj-$(CONFIG_RENESAS_INTC_IRQPIN)       += irq-renesas-intc-irqpin.o
 obj-$(CONFIG_RENESAS_IRQC)              += irq-renesas-irqc.o
+obj-$(CONFIG_RENESAS_RZA1_IRQC)         += irq-renesas-rza1.o
 obj-$(CONFIG_VERSATILE_FPGA_IRQ)        += irq-versatile-fpga.o
 obj-$(CONFIG_ARCH_NSPIRE)               += irq-zevio.o
 obj-$(CONFIG_ARCH_VT8500)               += irq-vt8500.o
diff --git a/drivers/irqchip/irq-al-fic.c b/drivers/irqchip/irq-al-fic.c
new file mode 100644
index 000000000000..1a57cee3efab
--- /dev/null
+++ b/drivers/irqchip/irq-al-fic.c
@@ -0,0 +1,278 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * Copyright 2019 Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ */
+
+#include <linux/bitfield.h>
+#include <linux/irq.h>
+#include <linux/irqchip.h>
+#include <linux/irqchip/chained_irq.h>
+#include <linux/irqdomain.h>
+#include <linux/module.h>
+#include <linux/of.h>
+#include <linux/of_address.h>
+#include <linux/of_irq.h>
+
+/* FIC Registers */
+#define AL_FIC_CAUSE            0x00
+#define AL_FIC_MASK             0x10
+#define AL_FIC_CONTROL          0x28
+
+#define CONTROL_TRIGGER_RISING  BIT(3)
+#define CONTROL_MASK_MSI_X      BIT(5)
+
+#define NR_FIC_IRQS 32
+
+MODULE_AUTHOR("Talel Shenhar");
+MODULE_DESCRIPTION("Amazon's Annapurna Labs Interrupt Controller Driver");
+MODULE_LICENSE("GPL v2");
+
+enum al_fic_state {
+        AL_FIC_UNCONFIGURED = 0,
+        AL_FIC_CONFIGURED_LEVEL,
+        AL_FIC_CONFIGURED_RISING_EDGE,
+};
+
+struct al_fic {
+        void __iomem *base;
+        struct irq_domain *domain;
+        const char *name;
+        unsigned int parent_irq;
+        enum al_fic_state state;
+};
+
+static void al_fic_set_trigger(struct al_fic *fic,
+                               struct irq_chip_generic *gc,
+                               enum al_fic_state new_state)
+{
+        irq_flow_handler_t handler;
+        u32 control = readl_relaxed(fic->base + AL_FIC_CONTROL);
+
+        if (new_state == AL_FIC_CONFIGURED_LEVEL) {
+                handler = handle_level_irq;
+                control &= ~CONTROL_TRIGGER_RISING;
+        } else {
+                handler = handle_edge_irq;
+                control |= CONTROL_TRIGGER_RISING;
+        }
+        gc->chip_types->handler = handler;
+        fic->state = new_state;
+        writel_relaxed(control, fic->base + AL_FIC_CONTROL);
+}
+
+static int al_fic_irq_set_type(struct irq_data *data, unsigned int flow_type)
+{
+        struct irq_chip_generic *gc = irq_data_get_irq_chip_data(data);
+        struct al_fic *fic = gc->private;
+        enum al_fic_state new_state;
+        int ret = 0;
+
+        irq_gc_lock(gc);
+
+        if (((flow_type & IRQ_TYPE_SENSE_MASK) != IRQ_TYPE_LEVEL_HIGH) &&
+            ((flow_type & IRQ_TYPE_SENSE_MASK) != IRQ_TYPE_EDGE_RISING)) {
+                pr_debug("fic doesn't support flow type %d\n", flow_type);
+                ret = -EINVAL;
+                goto err;
+        }
+
+        new_state = (flow_type & IRQ_TYPE_LEVEL_HIGH) ?
+                AL_FIC_CONFIGURED_LEVEL : AL_FIC_CONFIGURED_RISING_EDGE;
+
+        /*
+         * A given FIC instance can be either all level or all edge triggered.
+         * This is generally fixed depending on what pieces of HW it's wired up
+         * to.
+         *
+         * We configure it based on the sensitivity of the first source
+         * being setup, and reject any subsequent attempt at configuring it in a
+         * different way.
+         */
+        if (fic->state == AL_FIC_UNCONFIGURED) {
+                al_fic_set_trigger(fic, gc, new_state);
+        } else if (fic->state != new_state) {
+                pr_debug("fic %s state already configured to %d\n",
+                         fic->name, fic->state);
+                ret = -EINVAL;
+                goto err;
+        }
+
+err:
+        irq_gc_unlock(gc);
+
+        return ret;
+}
+
+static void al_fic_irq_handler(struct irq_desc *desc)
+{
+        struct al_fic *fic = irq_desc_get_handler_data(desc);
+        struct irq_domain *domain = fic->domain;
+        struct irq_chip *irqchip = irq_desc_get_chip(desc);
+        struct irq_chip_generic *gc = irq_get_domain_generic_chip(domain, 0);
+        unsigned long pending;
+        unsigned int irq;
+        u32 hwirq;
+
+        chained_irq_enter(irqchip, desc);
+
+        pending = readl_relaxed(fic->base + AL_FIC_CAUSE);
+        pending &= ~gc->mask_cache;
+
+        for_each_set_bit(hwirq, &pending, NR_FIC_IRQS) {
+                irq = irq_find_mapping(domain, hwirq);
+                generic_handle_irq(irq);
+        }
+
+        chained_irq_exit(irqchip, desc);
+}
+
+static int al_fic_register(struct device_node *node,
+                           struct al_fic *fic)
+{
+        struct irq_chip_generic *gc;
+        int ret;
+
+        fic->domain = irq_domain_add_linear(node,
+                                            NR_FIC_IRQS,
+                                            &irq_generic_chip_ops,
+                                            fic);
+        if (!fic->domain) {
+                pr_err("fail to add irq domain\n");
+                return -ENOMEM;
+        }
+
+        ret = irq_alloc_domain_generic_chips(fic->domain,
+                                             NR_FIC_IRQS,
+                                             1, fic->name,
+                                             handle_level_irq,
+                                             0, 0, IRQ_GC_INIT_MASK_CACHE);
+        if (ret) {
+                pr_err("fail to allocate generic chip (%d)\n", ret);
+                goto err_domain_remove;
+        }
+
+        gc = irq_get_domain_generic_chip(fic->domain, 0);
+        gc->reg_base = fic->base;
+        gc->chip_types->regs.mask = AL_FIC_MASK;
+        gc->chip_types->regs.ack = AL_FIC_CAUSE;
+        gc->chip_types->chip.irq_mask = irq_gc_mask_set_bit;
+        gc->chip_types->chip.irq_unmask = irq_gc_mask_clr_bit;
+        gc->chip_types->chip.irq_ack = irq_gc_ack_clr_bit;
+        gc->chip_types->chip.irq_set_type = al_fic_irq_set_type;
+        gc->chip_types->chip.flags = IRQCHIP_SKIP_SET_WAKE;
+        gc->private = fic;
+
+        irq_set_chained_handler_and_data(fic->parent_irq,
+                                         al_fic_irq_handler,
+                                         fic);
+        return 0;
+
+err_domain_remove:
+        irq_domain_remove(fic->domain);
+
+        return ret;
+}
+
+/*
+ * al_fic_wire_init() - initialize and configure fic in wire mode
+ * @of_node: optional pointer to interrupt controller's device tree node.
+ * @base: mmio to fic register
+ * @name: name of the fic
+ * @parent_irq: interrupt of parent
+ *
+ * This API will configure the fic hardware to to work in wire mode.
+ * In wire mode, fic hardware is generating a wire ("wired") interrupt.
+ * Interrupt can be generated based on positive edge or level - configuration is
+ * to be determined based on connected hardware to this fic.
+ */
+static struct al_fic *al_fic_wire_init(struct device_node *node,
+                                       void __iomem *base,
+                                       const char *name,
+                                       unsigned int parent_irq)
+{
+        struct al_fic *fic;
+        int ret;
+        u32 control = CONTROL_MASK_MSI_X;
+
+        fic = kzalloc(sizeof(*fic), GFP_KERNEL);
+        if (!fic)
+                return ERR_PTR(-ENOMEM);
+
+        fic->base = base;
+        fic->parent_irq = parent_irq;
+        fic->name = name;
+
+        /* mask out all interrupts */
+        writel_relaxed(0xFFFFFFFF, fic->base + AL_FIC_MASK);
+
+        /* clear any pending interrupt */
+        writel_relaxed(0, fic->base + AL_FIC_CAUSE);
+
+        writel_relaxed(control, fic->base + AL_FIC_CONTROL);
+
+        ret = al_fic_register(node, fic);
+        if (ret) {
+                pr_err("fail to register irqchip\n");
+                goto err_free;
+        }
+
+        pr_debug("%s initialized successfully in Legacy mode (parent-irq=%u)\n",
+                 fic->name, parent_irq);
+
+        return fic;
+
+err_free:
+        kfree(fic);
+        return ERR_PTR(ret);
+}
+
+static int __init al_fic_init_dt(struct device_node *node,
+                                 struct device_node *parent)
+{
+        int ret;
+        void __iomem *base;
+        unsigned int parent_irq;
+        struct al_fic *fic;
+
+        if (!parent) {
+                pr_err("%s: unsupported - device require a parent\n",
+                       node->name);
+                return -EINVAL;
+        }
+
+        base = of_iomap(node, 0);
+        if (!base) {
+                pr_err("%s: fail to map memory\n", node->name);
+                return -ENOMEM;
+        }
+
+        parent_irq = irq_of_parse_and_map(node, 0);
+        if (!parent_irq) {
+                pr_err("%s: fail to map irq\n", node->name);
+                ret = -EINVAL;
+                goto err_unmap;
+        }
+
+        fic = al_fic_wire_init(node,
+                               base,
+                               node->name,
+                               parent_irq);
+        if (IS_ERR(fic)) {
+                pr_err("%s: fail to initialize irqchip (%lu)\n",
+                       node->name,
+                       PTR_ERR(fic));
+                ret = PTR_ERR(fic);
+                goto err_irq_dispose;
+        }
+
+        return 0;
+
+err_irq_dispose:
+        irq_dispose_mapping(parent_irq);
+err_unmap:
+        iounmap(base);
+
+        return ret;
+}
+
+IRQCHIP_DECLARE(al_fic, "amazon,al-fic", al_fic_init_dt);
diff --git a/drivers/irqchip/irq-csky-mpintc.c b/drivers/irqchip/irq-csky-mpintc.c
index c67c961ab6cc..a1534edef7fa 100644
--- a/drivers/irqchip/irq-csky-mpintc.c
+++ b/drivers/irqchip/irq-csky-mpintc.c
@@ -32,8 +32,8 @@ static void __iomem *INTCL_base;
 #define INTCG_CIDSTR    0x1000
 
 #define INTCL_PICTLR    0x0
+#define INTCL_CFGR      0x14
 #define INTCL_SIGR      0x60
-#define INTCL_HPPIR     0x68
 #define INTCL_RDYIR     0x6c
 #define INTCL_SENR      0xa0
 #define INTCL_CENR      0xa4
@@ -41,21 +41,49 @@ static void __iomem *INTCL_base;
 
 static DEFINE_PER_CPU(void __iomem *, intcl_reg);
 
+static unsigned long *__trigger;
+
+#define IRQ_OFFSET(irq) ((irq < COMM_IRQ_BASE) ? irq : (irq - COMM_IRQ_BASE))
+
+#define TRIG_BYTE_OFFSET(i)     ((((i) * 2) / 32) * 4)
+#define TRIG_BIT_OFFSET(i)       (((i) * 2) % 32)
+
+#define TRIG_VAL(trigger, irq)  (trigger << TRIG_BIT_OFFSET(IRQ_OFFSET(irq)))
+#define TRIG_VAL_MSK(irq)           (~(3 << TRIG_BIT_OFFSET(IRQ_OFFSET(irq))))
+
+#define TRIG_BASE(irq) \
+        (TRIG_BYTE_OFFSET(IRQ_OFFSET(irq)) + ((irq < COMM_IRQ_BASE) ? \
+        (this_cpu_read(intcl_reg) + INTCL_CFGR) : (INTCG_base + INTCG_CICFGR)))
+
+static DEFINE_SPINLOCK(setup_lock);
+static void setup_trigger(unsigned long irq, unsigned long trigger)
+{
+        unsigned int tmp;
+
+        spin_lock(&setup_lock);
+
+        /* setup trigger */
+        tmp = readl_relaxed(TRIG_BASE(irq)) & TRIG_VAL_MSK(irq);
+
+        writel_relaxed(tmp | TRIG_VAL(trigger, irq), TRIG_BASE(irq));
+
+        spin_unlock(&setup_lock);
+}
+
 static void csky_mpintc_handler(struct pt_regs *regs)
 {
         void __iomem *reg_base = this_cpu_read(intcl_reg);
 
-        do {
-                handle_domain_irq(root_domain,
-                                  readl_relaxed(reg_base + INTCL_RDYIR),
-                                  regs);
-        } while (readl_relaxed(reg_base + INTCL_HPPIR) & BIT(31));
+        handle_domain_irq(root_domain,
+                readl_relaxed(reg_base + INTCL_RDYIR), regs);
 }
 
 static void csky_mpintc_enable(struct irq_data *d)
 {
         void __iomem *reg_base = this_cpu_read(intcl_reg);
 
+        setup_trigger(d->hwirq, __trigger[d->hwirq]);
+
         writel_relaxed(d->hwirq, reg_base + INTCL_SENR);
 }
 
@@ -73,6 +101,28 @@ static void csky_mpintc_eoi(struct irq_data *d)
         writel_relaxed(d->hwirq, reg_base + INTCL_CACR);
 }
 
+static int csky_mpintc_set_type(struct irq_data *d, unsigned int type)
+{
+        switch (type & IRQ_TYPE_SENSE_MASK) {
+        case IRQ_TYPE_LEVEL_HIGH:
+                __trigger[d->hwirq] = 0;
+                break;
+        case IRQ_TYPE_LEVEL_LOW:
+                __trigger[d->hwirq] = 1;
+                break;
+        case IRQ_TYPE_EDGE_RISING:
+                __trigger[d->hwirq] = 2;
+                break;
+        case IRQ_TYPE_EDGE_FALLING:
+                __trigger[d->hwirq] = 3;
+                break;
+        default:
+                return -EINVAL;
+        }
+
+        return 0;
+}
+
 #ifdef CONFIG_SMP
 static int csky_irq_set_affinity(struct irq_data *d,
                                  const struct cpumask *mask_val,
@@ -89,8 +139,19 @@ static int csky_irq_set_affinity(struct irq_data *d,
         if (cpu >= nr_cpu_ids)
                 return -EINVAL;
 
-        /* Enable interrupt destination */
-        cpu |= BIT(31);
+        /*
+         * The csky,mpintc could support auto irq deliver, but it only
+         * could deliver external irq to one cpu or all cpus. So it
+         * doesn't support deliver external irq to a group of cpus
+         * with cpu_mask.
+         * SO we only use auto deliver mode when affinity mask_val is
+         * equal to cpu_present_mask.
+         *
+         */
+        if (cpumask_equal(mask_val, cpu_present_mask))
+                cpu = 0;
+        else
+                cpu |= BIT(31);
 
         writel_relaxed(cpu, INTCG_base + INTCG_CIDSTR + offset);
 
@@ -105,6 +166,7 @@ static struct irq_chip csky_irq_chip = {
         .irq_eoi        = csky_mpintc_eoi,
         .irq_enable     = csky_mpintc_enable,
         .irq_disable    = csky_mpintc_disable,
+        .irq_set_type   = csky_mpintc_set_type,
 #ifdef CONFIG_SMP
         .irq_set_affinity = csky_irq_set_affinity,
 #endif
@@ -125,9 +187,26 @@ static int csky_irqdomain_map(struct irq_domain *d, unsigned int irq,
         return 0;
 }
 
+static int csky_irq_domain_xlate_cells(struct irq_domain *d,
+                struct device_node *ctrlr, const u32 *intspec,
+                unsigned int intsize, unsigned long *out_hwirq,
+                unsigned int *out_type)
+{
+        if (WARN_ON(intsize < 1))
+                return -EINVAL;
+
+        *out_hwirq = intspec[0];
+        if (intsize > 1)
+                *out_type = intspec[1] & IRQ_TYPE_SENSE_MASK;
+        else
+                *out_type = IRQ_TYPE_LEVEL_HIGH;
+
+        return 0;
+}
+
 static const struct irq_domain_ops csky_irqdomain_ops = {
         .map    = csky_irqdomain_map,
-        .xlate  = irq_domain_xlate_onecell,
+        .xlate  = csky_irq_domain_xlate_cells,
 };
 
 #ifdef CONFIG_SMP
@@ -161,6 +240,10 @@ csky_mpintc_init(struct device_node *node, struct device_node *parent)
         if (ret < 0)
                 nr_irq = INTC_IRQS;
 
+        __trigger  = kcalloc(nr_irq, sizeof(unsigned long), GFP_KERNEL);
+        if (__trigger == NULL)
+                return -ENXIO;
+
         if (INTCG_base == NULL) {
                 INTCG_base = ioremap(mfcr("cr<31, 14>"),
                                      INTCL_SIZE*nr_cpu_ids + INTCG_SIZE);
diff --git a/drivers/irqchip/irq-gic-v2m.c b/drivers/irqchip/irq-gic-v2m.c
index 875ac80f690b..7338f90b2f9e 100644
--- a/drivers/irqchip/irq-gic-v2m.c
+++ b/drivers/irqchip/irq-gic-v2m.c
@@ -53,6 +53,7 @@
 
 /* List of flags for specific v2m implementation */
 #define GICV2M_NEEDS_SPI_OFFSET         0x00000001
+#define GICV2M_GRAVITON_ADDRESS_ONLY    0x00000002
 
 static LIST_HEAD(v2m_nodes);
 static DEFINE_SPINLOCK(v2m_lock);
@@ -95,15 +96,26 @@ static struct msi_domain_info gicv2m_msi_domain_info = {
         .chip   = &gicv2m_msi_irq_chip,
 };
 
+static phys_addr_t gicv2m_get_msi_addr(struct v2m_data *v2m, int hwirq)
+{
+        if (v2m->flags & GICV2M_GRAVITON_ADDRESS_ONLY)
+                return v2m->res.start | ((hwirq - 32) << 3);
+        else
+                return v2m->res.start + V2M_MSI_SETSPI_NS;
+}
+
 static void gicv2m_compose_msi_msg(struct irq_data *data, struct msi_msg *msg)
 {
         struct v2m_data *v2m = irq_data_get_irq_chip_data(data);
-        phys_addr_t addr = v2m->res.start + V2M_MSI_SETSPI_NS;
+        phys_addr_t addr = gicv2m_get_msi_addr(v2m, data->hwirq);
 
         msg->address_hi = upper_32_bits(addr);
         msg->address_lo = lower_32_bits(addr);
-        msg->data = data->hwirq;
 
+        if (v2m->flags & GICV2M_GRAVITON_ADDRESS_ONLY)
+                msg->data = 0;
+        else
+                msg->data = data->hwirq;
         if (v2m->flags & GICV2M_NEEDS_SPI_OFFSET)
                 msg->data -= v2m->spi_offset;
 
@@ -185,7 +197,7 @@ static int gicv2m_irq_domain_alloc(struct irq_domain *domain, unsigned int virq,
         hwirq = v2m->spi_start + offset;
 
         err = iommu_dma_prepare_msi(info->desc,
-                                    v2m->res.start + V2M_MSI_SETSPI_NS);
+                                    gicv2m_get_msi_addr(v2m, hwirq));
         if (err)
                 return err;
 
@@ -304,7 +316,7 @@ static int gicv2m_allocate_domains(struct irq_domain *parent)
 
 static int __init gicv2m_init_one(struct fwnode_handle *fwnode,
                                   u32 spi_start, u32 nr_spis,
-                                  struct resource *res)
+                                  struct resource *res, u32 flags)
 {
         int ret;
         struct v2m_data *v2m;
@@ -317,6 +329,7 @@ static int __init gicv2m_init_one(struct fwnode_handle *fwnode,
 
         INIT_LIST_HEAD(&v2m->entry);
         v2m->fwnode = fwnode;
+        v2m->flags = flags;
 
         memcpy(&v2m->res, res, sizeof(struct resource));
 
@@ -331,7 +344,14 @@ static int __init gicv2m_init_one(struct fwnode_handle *fwnode,
                 v2m->spi_start = spi_start;
                 v2m->nr_spis = nr_spis;
         } else {
-                u32 typer = readl_relaxed(v2m->base + V2M_MSI_TYPER);
+                u32 typer;
+
+                /* Graviton should always have explicit spi_start/nr_spis */
+                if (v2m->flags & GICV2M_GRAVITON_ADDRESS_ONLY) {
+                        ret = -EINVAL;
+                        goto err_iounmap;
+                }
+                typer = readl_relaxed(v2m->base + V2M_MSI_TYPER);
 
                 v2m->spi_start = V2M_MSI_TYPER_BASE_SPI(typer);
                 v2m->nr_spis = V2M_MSI_TYPER_NUM_SPI(typer);
@@ -352,18 +372,21 @@ static int __init gicv2m_init_one(struct fwnode_handle *fwnode,
          *
          * Broadom NS2 GICv2m implementation has an erratum where the MSI data
          * is 'spi_number - 32'
+         *
+         * Reading that register fails on the Graviton implementation
          */
-        switch (readl_relaxed(v2m->base + V2M_MSI_IIDR)) {
-        case XGENE_GICV2M_MSI_IIDR:
-                v2m->flags |= GICV2M_NEEDS_SPI_OFFSET;
-                v2m->spi_offset = v2m->spi_start;
-                break;
-        case BCM_NS2_GICV2M_MSI_IIDR:
-                v2m->flags |= GICV2M_NEEDS_SPI_OFFSET;
-                v2m->spi_offset = 32;
-                break;
+        if (!(v2m->flags & GICV2M_GRAVITON_ADDRESS_ONLY)) {
+                switch (readl_relaxed(v2m->base + V2M_MSI_IIDR)) {
+                case XGENE_GICV2M_MSI_IIDR:
+                        v2m->flags |= GICV2M_NEEDS_SPI_OFFSET;
+                        v2m->spi_offset = v2m->spi_start;
+                        break;
+                case BCM_NS2_GICV2M_MSI_IIDR:
+                        v2m->flags |= GICV2M_NEEDS_SPI_OFFSET;
+                        v2m->spi_offset = 32;
+                        break;
+                }
         }
-
         v2m->bm = kcalloc(BITS_TO_LONGS(v2m->nr_spis), sizeof(long),
                           GFP_KERNEL);
         if (!v2m->bm) {
@@ -416,7 +439,8 @@ static int __init gicv2m_of_init(struct fwnode_handle *parent_handle,
                         pr_info("DT overriding V2M MSI_TYPER (base:%u, num:%u)\n",
                                 spi_start, nr_spis);
 
-                ret = gicv2m_init_one(&child->fwnode, spi_start, nr_spis, &res);
+                ret = gicv2m_init_one(&child->fwnode, spi_start, nr_spis,
+                                      &res, 0);
                 if (ret) {
                         of_node_put(child);
                         break;
@@ -448,6 +472,25 @@ static struct fwnode_handle *gicv2m_get_fwnode(struct device *dev)
         return data->fwnode;
 }
 
+static bool acpi_check_amazon_graviton_quirks(void)
+{
+        static struct acpi_table_madt *madt;
+        acpi_status status;
+        bool rc = false;
+
+#define ACPI_AMZN_OEM_ID                "AMAZON"
+
+        status = acpi_get_table(ACPI_SIG_MADT, 0,
+                                (struct acpi_table_header **)&madt);
+
+        if (ACPI_FAILURE(status) || !madt)
+                return rc;
+        rc = !memcmp(madt->header.oem_id, ACPI_AMZN_OEM_ID, ACPI_OEM_ID_SIZE);
+        acpi_put_table((struct acpi_table_header *)madt);
+
+        return rc;
+}
+
 static int __init
 acpi_parse_madt_msi(union acpi_subtable_headers *header,
                     const unsigned long end)
@@ -457,6 +500,7 @@ acpi_parse_madt_msi(union acpi_subtable_headers *header,
         u32 spi_start = 0, nr_spis = 0;
         struct acpi_madt_generic_msi_frame *m;
         struct fwnode_handle *fwnode;
+        u32 flags = 0;
 
         m = (struct acpi_madt_generic_msi_frame *)header;
         if (BAD_MADT_ENTRY(m, end))
@@ -466,6 +510,13 @@ acpi_parse_madt_msi(union acpi_subtable_headers *header,
         res.end = m->base_address + SZ_4K - 1;
         res.flags = IORESOURCE_MEM;
 
+        if (acpi_check_amazon_graviton_quirks()) {
+                pr_info("applying Amazon Graviton quirk\n");
+                res.end = res.start + SZ_8K - 1;
+                flags |= GICV2M_GRAVITON_ADDRESS_ONLY;
+                gicv2m_msi_domain_info.flags &= ~MSI_FLAG_MULTI_PCI_MSI;
+        }
+
         if (m->flags & ACPI_MADT_OVERRIDE_SPI_VALUES) {
                 spi_start = m->spi_base;
                 nr_spis = m->spi_count;
@@ -480,7 +531,7 @@ acpi_parse_madt_msi(union acpi_subtable_headers *header,
                 return -EINVAL;
         }
 
-        ret = gicv2m_init_one(fwnode, spi_start, nr_spis, &res);
+        ret = gicv2m_init_one(fwnode, spi_start, nr_spis, &res, flags);
         if (ret)
                 irq_domain_free_fwnode(fwnode);
 
diff --git a/drivers/irqchip/irq-gic-v3-its.c b/drivers/irqchip/irq-gic-v3-its.c
index d29b44b677e4..35500801dc2b 100644
--- a/drivers/irqchip/irq-gic-v3-its.c
+++ b/drivers/irqchip/irq-gic-v3-its.c
@@ -733,32 +733,43 @@ static void its_flush_cmd(struct its_node *its, struct its_cmd_block *cmd)
 }
 
 static int its_wait_for_range_completion(struct its_node *its,
-                                         struct its_cmd_block *from,
+                                         u64    prev_idx,
                                          struct its_cmd_block *to)
 {
-        u64 rd_idx, from_idx, to_idx;
+        u64 rd_idx, to_idx, linear_idx;
         u32 count = 1000000;    /* 1s! */
 
-        from_idx = its_cmd_ptr_to_offset(its, from);
+        /* Linearize to_idx if the command set has wrapped around */
         to_idx = its_cmd_ptr_to_offset(its, to);
+        if (to_idx < prev_idx)
+                to_idx += ITS_CMD_QUEUE_SZ;
+
+        linear_idx = prev_idx;
 
         while (1) {
+                s64 delta;
+
                 rd_idx = readl_relaxed(its->base + GITS_CREADR);
 
-                /* Direct case */
-                if (from_idx < to_idx && rd_idx >= to_idx)
-                        break;
+                /*
+                 * Compute the read pointer progress, taking the
+                 * potential wrap-around into account.
+                 */
+                delta = rd_idx - prev_idx;
+                if (rd_idx < prev_idx)
+                        delta += ITS_CMD_QUEUE_SZ;
 
-                /* Wrapped case */
-                if (from_idx >= to_idx && rd_idx >= to_idx && rd_idx < from_idx)
+                linear_idx += delta;
+                if (linear_idx >= to_idx)
                         break;
 
                 count--;
                 if (!count) {
-                        pr_err_ratelimited("ITS queue timeout (%llu %llu %llu)\n",
-                                           from_idx, to_idx, rd_idx);
+                        pr_err_ratelimited("ITS queue timeout (%llu %llu)\n",
+                                           to_idx, linear_idx);
                         return -1;
                 }
+                prev_idx = rd_idx;
                 cpu_relax();
                 udelay(1);
         }
@@ -775,6 +786,7 @@ void name(struct its_node *its,						\
         struct its_cmd_block *cmd, *sync_cmd, *next_cmd;                \
         synctype *sync_obj;                                             \
         unsigned long flags;                                            \
+        u64 rd_idx;                                                     \
                                                                         \
         raw_spin_lock_irqsave(&its->lock, flags);                       \
                                                                         \
@@ -796,10 +808,11 @@ void name(struct its_node *its,						\
         }                                                               \
                                                                         \
 post:                                                                   \
+        rd_idx = readl_relaxed(its->base + GITS_CREADR);                \
         next_cmd = its_post_commands(its);                              \
         raw_spin_unlock_irqrestore(&its->lock, flags);                  \
                                                                         \
-        if (its_wait_for_range_completion(its, cmd, next_cmd))          \
+        if (its_wait_for_range_completion(its, rd_idx, next_cmd))       \
                 pr_err_ratelimited("ITS cmd %ps failed\n", builder);    \
 }
 
diff --git a/drivers/irqchip/irq-gic-v3.c b/drivers/irqchip/irq-gic-v3.c
index 6377cb864f4c..9bca4896fa6f 100644
--- a/drivers/irqchip/irq-gic-v3.c
+++ b/drivers/irqchip/irq-gic-v3.c
@@ -461,8 +461,12 @@ static void gic_deactivate_unhandled(u32 irqnr)
 
 static inline void gic_handle_nmi(u32 irqnr, struct pt_regs *regs)
 {
+        bool irqs_enabled = interrupts_enabled(regs);
         int err;
 
+        if (irqs_enabled)
+                nmi_enter();
+
         if (static_branch_likely(&supports_deactivate_key))
                 gic_write_eoir(irqnr);
         /*
@@ -474,6 +478,9 @@ static inline void gic_handle_nmi(u32 irqnr, struct pt_regs *regs)
         err = handle_domain_nmi(gic_data.domain, irqnr, regs);
         if (err)
                 gic_deactivate_unhandled(irqnr);
+
+        if (irqs_enabled)
+                nmi_exit();
 }
 
 static asmlinkage void __exception_irq_entry gic_handle_irq(struct pt_regs *regs)
@@ -1332,6 +1339,9 @@ static int __init gic_init_bases(void __iomem *dist_base,
         if (gic_dist_supports_lpis()) {
                 its_init(handle, &gic_data.rdists, gic_data.domain);
                 its_cpu_init();
+        } else {
+                if (IS_ENABLED(CONFIG_ARM_GIC_V2M))
+                        gicv2m_init(handle, gic_data.domain);
         }
 
         if (gic_prio_masking_enabled()) {
diff --git a/drivers/irqchip/irq-mbigen.c b/drivers/irqchip/irq-mbigen.c
index a89c693d5b90..3dd28382d5f5 100644
--- a/drivers/irqchip/irq-mbigen.c
+++ b/drivers/irqchip/irq-mbigen.c
@@ -344,8 +344,7 @@ static int mbigen_device_probe(struct platform_device *pdev)
                 err = -EINVAL;
 
         if (err) {
-                dev_err(&pdev->dev, "Failed to create mbi-gen@%p irqdomain",
-                        mgn_chip->base);
+                dev_err(&pdev->dev, "Failed to create mbi-gen irqdomain\n");
                 return err;
         }
 
diff --git a/drivers/irqchip/irq-meson-gpio.c b/drivers/irqchip/irq-meson-gpio.c
index 8eb92eb98f54..dcdc23b9dce6 100644
--- a/drivers/irqchip/irq-meson-gpio.c
+++ b/drivers/irqchip/irq-meson-gpio.c
@@ -60,6 +60,7 @@ static const struct of_device_id meson_irq_gpio_matches[] = {
         { .compatible = "amlogic,meson-gxbb-gpio-intc", .data = &gxbb_params },
         { .compatible = "amlogic,meson-gxl-gpio-intc", .data = &gxl_params },
         { .compatible = "amlogic,meson-axg-gpio-intc", .data = &axg_params },
+        { .compatible = "amlogic,meson-g12a-gpio-intc", .data = &axg_params },
         { }
 };
 
diff --git a/drivers/irqchip/irq-mips-gic.c b/drivers/irqchip/irq-mips-gic.c
index d32268cc1174..f3985469c221 100644
--- a/drivers/irqchip/irq-mips-gic.c
+++ b/drivers/irqchip/irq-mips-gic.c
@@ -388,7 +388,7 @@ static void gic_all_vpes_irq_cpu_online(struct irq_data *d)
         intr = GIC_HWIRQ_TO_LOCAL(d->hwirq);
         cd = irq_data_get_irq_chip_data(d);
 
-        write_gic_vl_map(intr, cd->map);
+        write_gic_vl_map(mips_gic_vx_map_reg(intr), cd->map);
         if (cd->mask)
                 write_gic_vl_smask(BIT(intr));
 }
@@ -517,7 +517,7 @@ static int gic_irq_domain_map(struct irq_domain *d, unsigned int virq,
         spin_lock_irqsave(&gic_lock, flags);
         for_each_online_cpu(cpu) {
                 write_gic_vl_other(mips_cm_vp_id(cpu));
-                write_gic_vo_map(intr, map);
+                write_gic_vo_map(mips_gic_vx_map_reg(intr), map);
         }
         spin_unlock_irqrestore(&gic_lock, flags);
 
diff --git a/drivers/irqchip/irq-renesas-intc-irqpin.c b/drivers/irqchip/irq-renesas-intc-irqpin.c
index 04c05a18600c..f82bc60a6793 100644
--- a/drivers/irqchip/irq-renesas-intc-irqpin.c
+++ b/drivers/irqchip/irq-renesas-intc-irqpin.c
@@ -508,7 +508,8 @@ static int intc_irqpin_probe(struct platform_device *pdev)
         }
 
         irq_chip = &p->irq_chip;
-        irq_chip->name = name;
+        irq_chip->name = "intc-irqpin";
+        irq_chip->parent_device = dev;
         irq_chip->irq_mask = disable_fn;
         irq_chip->irq_unmask = enable_fn;
         irq_chip->irq_set_type = intc_irqpin_irq_set_type;
diff --git a/drivers/irqchip/irq-renesas-irqc.c b/drivers/irqchip/irq-renesas-irqc.c
index a449a7c839b3..11abc09ef76c 100644
--- a/drivers/irqchip/irq-renesas-irqc.c
+++ b/drivers/irqchip/irq-renesas-irqc.c
@@ -7,7 +7,6 @@
 
 #include <linux/init.h>
 #include <linux/platform_device.h>
-#include <linux/spinlock.h>
 #include <linux/interrupt.h>
 #include <linux/ioport.h>
 #include <linux/io.h>
@@ -48,7 +47,7 @@ struct irqc_priv {
         void __iomem *cpu_int_base;
         struct irqc_irq irq[IRQC_IRQ_MAX];
         unsigned int number_of_irqs;
-        struct platform_device *pdev;
+        struct device *dev;
         struct irq_chip_generic *gc;
         struct irq_domain *irq_domain;
         atomic_t wakeup_path;
@@ -61,8 +60,7 @@ static struct irqc_priv *irq_data_to_priv(struct irq_data *data)
 
 static void irqc_dbg(struct irqc_irq *i, char *str)
 {
-        dev_dbg(&i->p->pdev->dev, "%s (%d:%d)\n",
-                str, i->requested_irq, i->hw_irq);
+        dev_dbg(i->p->dev, "%s (%d:%d)\n", str, i->requested_irq, i->hw_irq);
 }
 
 static unsigned char irqc_sense[IRQ_TYPE_SENSE_MASK + 1] = {
@@ -125,33 +123,22 @@ static irqreturn_t irqc_irq_handler(int irq, void *dev_id)
 
 static int irqc_probe(struct platform_device *pdev)
 {
+        struct device *dev = &pdev->dev;
+        const char *name = dev_name(dev);
         struct irqc_priv *p;
-        struct resource *io;
         struct resource *irq;
-        const char *name = dev_name(&pdev->dev);
         int ret;
         int k;
 
-        p = kzalloc(sizeof(*p), GFP_KERNEL);
-        if (!p) {
-                dev_err(&pdev->dev, "failed to allocate driver data\n");
-                ret = -ENOMEM;
-                goto err0;
-        }
+        p = devm_kzalloc(dev, sizeof(*p), GFP_KERNEL);
+        if (!p)
+                return -ENOMEM;
 
-        p->pdev = pdev;
+        p->dev = dev;
         platform_set_drvdata(pdev, p);
 
-        pm_runtime_enable(&pdev->dev);
-        pm_runtime_get_sync(&pdev->dev);
-
-        /* get hold of manadatory IOMEM */
-        io = platform_get_resource(pdev, IORESOURCE_MEM, 0);
-        if (!io) {
-                dev_err(&pdev->dev, "not enough IOMEM resources\n");
-                ret = -EINVAL;
-                goto err1;
-        }
+        pm_runtime_enable(dev);
+        pm_runtime_get_sync(dev);
 
         /* allow any number of IRQs between 1 and IRQC_IRQ_MAX */
         for (k = 0; k < IRQC_IRQ_MAX; k++) {
@@ -166,42 +153,41 @@ static int irqc_probe(struct platform_device *pdev)
 
         p->number_of_irqs = k;
         if (p->number_of_irqs < 1) {
-                dev_err(&pdev->dev, "not enough IRQ resources\n");
+                dev_err(dev, "not enough IRQ resources\n");
                 ret = -EINVAL;
-                goto err1;
+                goto err_runtime_pm_disable;
         }
 
         /* ioremap IOMEM and setup read/write callbacks */
-        p->iomem = ioremap_nocache(io->start, resource_size(io));
-        if (!p->iomem) {
-                dev_err(&pdev->dev, "failed to remap IOMEM\n");
-                ret = -ENXIO;
-                goto err2;
+        p->iomem = devm_platform_ioremap_resource(pdev, 0);
+        if (IS_ERR(p->iomem)) {
+                ret = PTR_ERR(p->iomem);
+                goto err_runtime_pm_disable;
         }
 
         p->cpu_int_base = p->iomem + IRQC_INT_CPU_BASE(0); /* SYS-SPI */
 
-        p->irq_domain = irq_domain_add_linear(pdev->dev.of_node,
-                                              p->number_of_irqs,
+        p->irq_domain = irq_domain_add_linear(dev->of_node, p->number_of_irqs,
                                               &irq_generic_chip_ops, p);
         if (!p->irq_domain) {
                 ret = -ENXIO;
-                dev_err(&pdev->dev, "cannot initialize irq domain\n");
-                goto err2;
+                dev_err(dev, "cannot initialize irq domain\n");
+                goto err_runtime_pm_disable;
         }
 
         ret = irq_alloc_domain_generic_chips(p->irq_domain, p->number_of_irqs,
-                                             1, name, handle_level_irq,
+                                             1, "irqc", handle_level_irq,
                                              0, 0, IRQ_GC_INIT_NESTED_LOCK);
         if (ret) {
-                dev_err(&pdev->dev, "cannot allocate generic chip\n");
-                goto err3;
+                dev_err(dev, "cannot allocate generic chip\n");
+                goto err_remove_domain;
         }
 
         p->gc = irq_get_domain_generic_chip(p->irq_domain, 0);
         p->gc->reg_base = p->cpu_int_base;
         p->gc->chip_types[0].regs.enable = IRQC_EN_SET;
         p->gc->chip_types[0].regs.disable = IRQC_EN_STS;
+        p->gc->chip_types[0].chip.parent_device = dev;
         p->gc->chip_types[0].chip.irq_mask = irq_gc_mask_disable_reg;
         p->gc->chip_types[0].chip.irq_unmask = irq_gc_unmask_enable_reg;
         p->gc->chip_types[0].chip.irq_set_type  = irqc_irq_set_type;
@@ -210,46 +196,33 @@ static int irqc_probe(struct platform_device *pdev)
 
         /* request interrupts one by one */
         for (k = 0; k < p->number_of_irqs; k++) {
-                if (request_irq(p->irq[k].requested_irq, irqc_irq_handler,
-                                0, name, &p->irq[k])) {
-                        dev_err(&pdev->dev, "failed to request IRQ\n");
+                if (devm_request_irq(dev, p->irq[k].requested_irq,
+                                     irqc_irq_handler, 0, name, &p->irq[k])) {
+                        dev_err(dev, "failed to request IRQ\n");
                         ret = -ENOENT;
-                        goto err4;
+                        goto err_remove_domain;
                 }
         }
 
-        dev_info(&pdev->dev, "driving %d irqs\n", p->number_of_irqs);
+        dev_info(dev, "driving %d irqs\n", p->number_of_irqs);
 
         return 0;
-err4:
-        while (--k >= 0)
-                free_irq(p->irq[k].requested_irq, &p->irq[k]);
 
-err3:
+err_remove_domain:
         irq_domain_remove(p->irq_domain);
-err2:
-        iounmap(p->iomem);
-err1:
-        pm_runtime_put(&pdev->dev);
-        pm_runtime_disable(&pdev->dev);
-        kfree(p);
-err0:
+err_runtime_pm_disable:
+        pm_runtime_put(dev);
+        pm_runtime_disable(dev);
         return ret;
 }
 
 static int irqc_remove(struct platform_device *pdev)
 {
         struct irqc_priv *p = platform_get_drvdata(pdev);
-        int k;
-
-        for (k = 0; k < p->number_of_irqs; k++)
-                free_irq(p->irq[k].requested_irq, &p->irq[k]);
 
         irq_domain_remove(p->irq_domain);
-        iounmap(p->iomem);
         pm_runtime_put(&pdev->dev);
         pm_runtime_disable(&pdev->dev);
-        kfree(p);
         return 0;
 }
 
diff --git a/drivers/irqchip/irq-renesas-rza1.c b/drivers/irqchip/irq-renesas-rza1.c
new file mode 100644
index 000000000000..b1f19b210190
--- /dev/null
+++ b/drivers/irqchip/irq-renesas-rza1.c
@@ -0,0 +1,283 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * Renesas RZ/A1 IRQC Driver
+ *
+ * Copyright (C) 2019 Glider bvba
+ */
+
+#include <linux/err.h>
+#include <linux/init.h>
+#include <linux/interrupt.h>
+#include <linux/io.h>
+#include <linux/irqdomain.h>
+#include <linux/irq.h>
+#include <linux/module.h>
+#include <linux/of_irq.h>
+#include <linux/platform_device.h>
+#include <linux/slab.h>
+
+#include <dt-bindings/interrupt-controller/arm-gic.h>
+
+#define IRQC_NUM_IRQ            8
+
+#define ICR0                    0       /* Interrupt Control Register 0 */
+
+#define ICR0_NMIL               BIT(15) /* NMI Input Level (0=low, 1=high) */
+#define ICR0_NMIE               BIT(8)  /* Edge Select (0=falling, 1=rising) */
+#define ICR0_NMIF               BIT(1)  /* NMI Interrupt Request */
+
+#define ICR1                    2       /* Interrupt Control Register 1 */
+
+#define ICR1_IRQS(n, sense)     ((sense) << ((n) * 2))  /* IRQ Sense Select */
+#define ICR1_IRQS_LEVEL_LOW     0
+#define ICR1_IRQS_EDGE_FALLING  1
+#define ICR1_IRQS_EDGE_RISING   2
+#define ICR1_IRQS_EDGE_BOTH     3
+#define ICR1_IRQS_MASK(n)       ICR1_IRQS((n), 3)
+
+#define IRQRR                   4       /* IRQ Interrupt Request Register */
+
+
+struct rza1_irqc_priv {
+        struct device *dev;
+        void __iomem *base;
+        struct irq_chip chip;
+        struct irq_domain *irq_domain;
+        struct of_phandle_args map[IRQC_NUM_IRQ];
+};
+
+static struct rza1_irqc_priv *irq_data_to_priv(struct irq_data *data)
+{
+        return data->domain->host_data;
+}
+
+static void rza1_irqc_eoi(struct irq_data *d)
+{
+        struct rza1_irqc_priv *priv = irq_data_to_priv(d);
+        u16 bit = BIT(irqd_to_hwirq(d));
+        u16 tmp;
+
+        tmp = readw_relaxed(priv->base + IRQRR);
+        if (tmp & bit)
+                writew_relaxed(GENMASK(IRQC_NUM_IRQ - 1, 0) & ~bit,
+                               priv->base + IRQRR);
+
+        irq_chip_eoi_parent(d);
+}
+
+static int rza1_irqc_set_type(struct irq_data *d, unsigned int type)
+{
+        struct rza1_irqc_priv *priv = irq_data_to_priv(d);
+        unsigned int hw_irq = irqd_to_hwirq(d);
+        u16 sense, tmp;
+
+        switch (type & IRQ_TYPE_SENSE_MASK) {
+        case IRQ_TYPE_LEVEL_LOW:
+                sense = ICR1_IRQS_LEVEL_LOW;
+                break;
+
+        case IRQ_TYPE_EDGE_FALLING:
+                sense = ICR1_IRQS_EDGE_FALLING;
+                break;
+
+        case IRQ_TYPE_EDGE_RISING:
+                sense = ICR1_IRQS_EDGE_RISING;
+                break;
+
+        case IRQ_TYPE_EDGE_BOTH:
+                sense = ICR1_IRQS_EDGE_BOTH;
+                break;
+
+        default:
+                return -EINVAL;
+        }
+
+        tmp = readw_relaxed(priv->base + ICR1);
+        tmp &= ~ICR1_IRQS_MASK(hw_irq);
+        tmp |= ICR1_IRQS(hw_irq, sense);
+        writew_relaxed(tmp, priv->base + ICR1);
+        return 0;
+}
+
+static int rza1_irqc_alloc(struct irq_domain *domain, unsigned int virq,
+                           unsigned int nr_irqs, void *arg)
+{
+        struct rza1_irqc_priv *priv = domain->host_data;
+        struct irq_fwspec *fwspec = arg;
+        unsigned int hwirq = fwspec->param[0];
+        struct irq_fwspec spec;
+        unsigned int i;
+        int ret;
+
+        ret = irq_domain_set_hwirq_and_chip(domain, virq, hwirq, &priv->chip,
+                                            priv);
+        if (ret)
+                return ret;
+
+        spec.fwnode = &priv->dev->of_node->fwnode;
+        spec.param_count = priv->map[hwirq].args_count;
+        for (i = 0; i < spec.param_count; i++)
+                spec.param[i] = priv->map[hwirq].args[i];
+
+        return irq_domain_alloc_irqs_parent(domain, virq, nr_irqs, &spec);
+}
+
+static int rza1_irqc_translate(struct irq_domain *domain,
+                               struct irq_fwspec *fwspec, unsigned long *hwirq,
+                               unsigned int *type)
+{
+        if (fwspec->param_count != 2 || fwspec->param[0] >= IRQC_NUM_IRQ)
+                return -EINVAL;
+
+        *hwirq = fwspec->param[0];
+        *type = fwspec->param[1];
+        return 0;
+}
+
+static const struct irq_domain_ops rza1_irqc_domain_ops = {
+        .alloc = rza1_irqc_alloc,
+        .translate = rza1_irqc_translate,
+};
+
+static int rza1_irqc_parse_map(struct rza1_irqc_priv *priv,
+                               struct device_node *gic_node)
+{
+        unsigned int imaplen, i, j, ret;
+        struct device *dev = priv->dev;
+        struct device_node *ipar;
+        const __be32 *imap;
+        u32 intsize;
+
+        imap = of_get_property(dev->of_node, "interrupt-map", &imaplen);
+        if (!imap)
+                return -EINVAL;
+
+        for (i = 0; i < IRQC_NUM_IRQ; i++) {
+                if (imaplen < 3)
+                        return -EINVAL;
+
+                /* Check interrupt number, ignore sense */
+                if (be32_to_cpup(imap) != i)
+                        return -EINVAL;
+
+                ipar = of_find_node_by_phandle(be32_to_cpup(imap + 2));
+                if (ipar != gic_node) {
+                        of_node_put(ipar);
+                        return -EINVAL;
+                }
+
+                imap += 3;
+                imaplen -= 3;
+
+                ret = of_property_read_u32(ipar, "#interrupt-cells", &intsize);
+                of_node_put(ipar);
+                if (ret)
+                        return ret;
+
+                if (imaplen < intsize)
+                        return -EINVAL;
+
+                priv->map[i].args_count = intsize;
+                for (j = 0; j < intsize; j++)
+                        priv->map[i].args[j] = be32_to_cpup(imap++);
+
+                imaplen -= intsize;
+        }
+
+        return 0;
+}
+
+static int rza1_irqc_probe(struct platform_device *pdev)
+{
+        struct device *dev = &pdev->dev;
+        struct device_node *np = dev->of_node;
+        struct irq_domain *parent = NULL;
+        struct device_node *gic_node;
+        struct rza1_irqc_priv *priv;
+        int ret;
+
+        priv = devm_kzalloc(dev, sizeof(*priv), GFP_KERNEL);
+        if (!priv)
+                return -ENOMEM;
+
+        platform_set_drvdata(pdev, priv);
+        priv->dev = dev;
+
+        priv->base = devm_platform_ioremap_resource(pdev, 0);
+        if (IS_ERR(priv->base))
+                return PTR_ERR(priv->base);
+
+        gic_node = of_irq_find_parent(np);
+        if (gic_node) {
+                parent = irq_find_host(gic_node);
+                of_node_put(gic_node);
+        }
+
+        if (!parent) {
+                dev_err(dev, "cannot find parent domain\n");
+                return -ENODEV;
+        }
+
+        ret = rza1_irqc_parse_map(priv, gic_node);
+        if (ret) {
+                dev_err(dev, "cannot parse %s: %d\n", "interrupt-map", ret);
+                return ret;
+        }
+
+        priv->chip.name = "rza1-irqc",
+        priv->chip.irq_mask = irq_chip_mask_parent,
+        priv->chip.irq_unmask = irq_chip_unmask_parent,
+        priv->chip.irq_eoi = rza1_irqc_eoi,
+        priv->chip.irq_retrigger = irq_chip_retrigger_hierarchy,
+        priv->chip.irq_set_type = rza1_irqc_set_type,
+        priv->chip.flags = IRQCHIP_MASK_ON_SUSPEND | IRQCHIP_SKIP_SET_WAKE;
+
+        priv->irq_domain = irq_domain_add_hierarchy(parent, 0, IRQC_NUM_IRQ,
+                                                    np, &rza1_irqc_domain_ops,
+                                                    priv);
+        if (!priv->irq_domain) {
+                dev_err(dev, "cannot initialize irq domain\n");
+                return -ENOMEM;
+        }
+
+        return 0;
+}
+
+static int rza1_irqc_remove(struct platform_device *pdev)
+{
+        struct rza1_irqc_priv *priv = platform_get_drvdata(pdev);
+
+        irq_domain_remove(priv->irq_domain);
+        return 0;
+}
+
+static const struct of_device_id rza1_irqc_dt_ids[] = {
+        { .compatible = "renesas,rza1-irqc" },
+        {},
+};
+MODULE_DEVICE_TABLE(of, rza1_irqc_dt_ids);
+
+static struct platform_driver rza1_irqc_device_driver = {
+        .probe          = rza1_irqc_probe,
+        .remove         = rza1_irqc_remove,
+        .driver         = {
+                .name   = "renesas_rza1_irqc",
+                .of_match_table = rza1_irqc_dt_ids,
+        }
+};
+
+static int __init rza1_irqc_init(void)
+{
+        return platform_driver_register(&rza1_irqc_device_driver);
+}
+postcore_initcall(rza1_irqc_init);
+
+static void __exit rza1_irqc_exit(void)
+{
+        platform_driver_unregister(&rza1_irqc_device_driver);
+}
+module_exit(rza1_irqc_exit);
+
+MODULE_AUTHOR("Geert Uytterhoeven <geert+renesas@glider.be>");
+MODULE_DESCRIPTION("Renesas RZ/A1 IRQC Driver");
+MODULE_LICENSE("GPL v2");
diff --git a/drivers/irqchip/irq-sni-exiu.c b/drivers/irqchip/irq-sni-exiu.c
index 4e983bc6cf93..1d027623c776 100644
--- a/drivers/irqchip/irq-sni-exiu.c
+++ b/drivers/irqchip/irq-sni-exiu.c
@@ -2,7 +2,7 @@
 /*
  * Driver for Socionext External Interrupt Unit (EXIU)
  *
- * Copyright (c) 2017 Linaro, Ltd. <ard.biesheuvel@linaro.org>
+ * Copyright (c) 2017-2019 Linaro, Ltd. <ard.biesheuvel@linaro.org>
  *
  * Based on irq-tegra.c:
  *   Copyright (C) 2011 Google, Inc.
@@ -17,6 +17,7 @@
 #include <linux/of.h>
 #include <linux/of_address.h>
 #include <linux/of_irq.h>
+#include <linux/platform_device.h>
 
 #include <dt-bindings/interrupt-controller/arm-gic.h>
 
@@ -131,9 +132,13 @@ static int exiu_domain_translate(struct irq_domain *domain,
 
                 *hwirq = fwspec->param[1] - info->spi_base;
                 *type = fwspec->param[2] & IRQ_TYPE_SENSE_MASK;
-                return 0;
+        } else {
+                if (fwspec->param_count != 2)
+                        return -EINVAL;
+                *hwirq = fwspec->param[0];
+                *type = fwspec->param[2] & IRQ_TYPE_SENSE_MASK;
         }
-        return -EINVAL;
+        return 0;
 }
 
 static int exiu_domain_alloc(struct irq_domain *dom, unsigned int virq,
@@ -144,16 +149,21 @@ static int exiu_domain_alloc(struct irq_domain *dom, unsigned int virq,
         struct exiu_irq_data *info = dom->host_data;
         irq_hw_number_t hwirq;
 
-        if (fwspec->param_count != 3)
-                return -EINVAL; /* Not GIC compliant */
-        if (fwspec->param[0] != GIC_SPI)
-                return -EINVAL; /* No PPI should point to this domain */
+        parent_fwspec = *fwspec;
+        if (is_of_node(dom->parent->fwnode)) {
+                if (fwspec->param_count != 3)
+                        return -EINVAL; /* Not GIC compliant */
+                if (fwspec->param[0] != GIC_SPI)
+                        return -EINVAL; /* No PPI should point to this domain */
 
+                hwirq = fwspec->param[1] - info->spi_base;
+        } else {
+                hwirq = fwspec->param[0];
+                parent_fwspec.param[0] = hwirq + info->spi_base + 32;
+        }
         WARN_ON(nr_irqs != 1);
-        hwirq = fwspec->param[1] - info->spi_base;
         irq_domain_set_hwirq_and_chip(dom, virq, hwirq, &exiu_irq_chip, info);
 
-        parent_fwspec = *fwspec;
         parent_fwspec.fwnode = dom->parent->fwnode;
         return irq_domain_alloc_irqs_parent(dom, virq, nr_irqs, &parent_fwspec);
 }
@@ -164,35 +174,23 @@ static const struct irq_domain_ops exiu_domain_ops = {
         .free           = irq_domain_free_irqs_common,
 };
 
-static int __init exiu_init(struct device_node *node,
-                            struct device_node *parent)
+static struct exiu_irq_data *exiu_init(const struct fwnode_handle *fwnode,
+                                       struct resource *res)
 {
-        struct irq_domain *parent_domain, *domain;
         struct exiu_irq_data *data;
         int err;
 
-        if (!parent) {
-                pr_err("%pOF: no parent, giving up\n", node);
-                return -ENODEV;
-        }
-
-        parent_domain = irq_find_host(parent);
-        if (!parent_domain) {
-                pr_err("%pOF: unable to obtain parent domain\n", node);
-                return -ENXIO;
-        }
-
         data = kzalloc(sizeof(*data), GFP_KERNEL);
         if (!data)
-                return -ENOMEM;
+                return ERR_PTR(-ENOMEM);
 
-        if (of_property_read_u32(node, "socionext,spi-base", &data->spi_base)) {
-                pr_err("%pOF: failed to parse 'spi-base' property\n", node);
+        if (fwnode_property_read_u32_array(fwnode, "socionext,spi-base",
+                                           &data->spi_base, 1)) {
                 err = -ENODEV;
                 goto out_free;
         }
 
-        data->base = of_iomap(node, 0);
+        data->base = ioremap(res->start, resource_size(res));
         if (!data->base) {
                 err = -ENODEV;
                 goto out_free;
@@ -202,11 +200,44 @@ static int __init exiu_init(struct device_node *node,
         writel_relaxed(0xFFFFFFFF, data->base + EIREQCLR);
         writel_relaxed(0xFFFFFFFF, data->base + EIMASK);
 
+        return data;
+
+out_free:
+        kfree(data);
+        return ERR_PTR(err);
+}
+
+static int __init exiu_dt_init(struct device_node *node,
+                               struct device_node *parent)
+{
+        struct irq_domain *parent_domain, *domain;
+        struct exiu_irq_data *data;
+        struct resource res;
+
+        if (!parent) {
+                pr_err("%pOF: no parent, giving up\n", node);
+                return -ENODEV;
+        }
+
+        parent_domain = irq_find_host(parent);
+        if (!parent_domain) {
+                pr_err("%pOF: unable to obtain parent domain\n", node);
+                return -ENXIO;
+        }
+
+        if (of_address_to_resource(node, 0, &res)) {
+                pr_err("%pOF: failed to parse memory resource\n", node);
+                return -ENXIO;
+        }
+
+        data = exiu_init(of_node_to_fwnode(node), &res);
+        if (IS_ERR(data))
+                return PTR_ERR(data);
+
         domain = irq_domain_add_hierarchy(parent_domain, 0, NUM_IRQS, node,
                                           &exiu_domain_ops, data);
         if (!domain) {
                 pr_err("%pOF: failed to allocate domain\n", node);
-                err = -ENOMEM;
                 goto out_unmap;
         }
 
@@ -217,8 +248,57 @@ static int __init exiu_init(struct device_node *node,
 
 out_unmap:
         iounmap(data->base);
-out_free:
         kfree(data);
-        return err;
+        return -ENOMEM;
 }
-IRQCHIP_DECLARE(exiu, "socionext,synquacer-exiu", exiu_init);
+IRQCHIP_DECLARE(exiu, "socionext,synquacer-exiu", exiu_dt_init);
+
+#ifdef CONFIG_ACPI
+static int exiu_acpi_probe(struct platform_device *pdev)
+{
+        struct irq_domain *domain;
+        struct exiu_irq_data *data;
+        struct resource *res;
+
+        res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+        if (!res) {
+                dev_err(&pdev->dev, "failed to parse memory resource\n");
+                return -ENXIO;
+        }
+
+        data = exiu_init(dev_fwnode(&pdev->dev), res);
+        if (IS_ERR(data))
+                return PTR_ERR(data);
+
+        domain = acpi_irq_create_hierarchy(0, NUM_IRQS, dev_fwnode(&pdev->dev),
+                                           &exiu_domain_ops, data);
+        if (!domain) {
+                dev_err(&pdev->dev, "failed to create IRQ domain\n");
+                goto out_unmap;
+        }
+
+        dev_info(&pdev->dev, "%d interrupts forwarded\n", NUM_IRQS);
+
+        return 0;
+
+out_unmap:
+        iounmap(data->base);
+        kfree(data);
+        return -ENOMEM;
+}
+
+static const struct acpi_device_id exiu_acpi_ids[] = {
+        { "SCX0008" },
+        { /* sentinel */ }
+};
+MODULE_DEVICE_TABLE(acpi, exiu_acpi_ids);
+
+static struct platform_driver exiu_driver = {
+        .driver = {
+                .name = "exiu",
+                .acpi_match_table = exiu_acpi_ids,
+        },
+        .probe = exiu_acpi_probe,
+};
+builtin_platform_driver(exiu_driver);
+#endif
diff --git a/drivers/irqchip/irq-ti-sci-inta.c b/drivers/irqchip/irq-ti-sci-inta.c
index 011b60a49e3f..ef4d625d2d80 100644
--- a/drivers/irqchip/irq-ti-sci-inta.c
+++ b/drivers/irqchip/irq-ti-sci-inta.c
@@ -159,9 +159,9 @@ static struct ti_sci_inta_vint_desc *ti_sci_inta_alloc_parent_irq(struct irq_dom
         parent_fwspec.param[1] = vint_desc->vint_id;
 
         parent_virq = irq_create_fwspec_mapping(&parent_fwspec);
-        if (parent_virq <= 0) {
+        if (parent_virq == 0) {
                 kfree(vint_desc);
-                return ERR_PTR(parent_virq);
+                return ERR_PTR(-EINVAL);
         }
         vint_desc->parent_virq = parent_virq;
 
diff --git a/drivers/irqchip/qcom-irq-combiner.c b/drivers/irqchip/qcom-irq-combiner.c
index 067337ab3f20..d88e993aa66d 100644
--- a/drivers/irqchip/qcom-irq-combiner.c
+++ b/drivers/irqchip/qcom-irq-combiner.c
@@ -229,7 +229,6 @@ static int get_registers(struct platform_device *pdev, struct combiner *comb)
 static int __init combiner_probe(struct platform_device *pdev)
 {
         struct combiner *combiner;
-        size_t alloc_sz;
         int nregs;
         int err;
 
@@ -239,8 +238,8 @@ static int __init combiner_probe(struct platform_device *pdev)
                 return -EINVAL;
         }
 
-        alloc_sz = sizeof(*combiner) + sizeof(struct combiner_reg) * nregs;
-        combiner = devm_kzalloc(&pdev->dev, alloc_sz, GFP_KERNEL);
+        combiner = devm_kzalloc(&pdev->dev, struct_size(combiner, regs, nregs),
+                                GFP_KERNEL);
         if (!combiner)
                 return -ENOMEM;
 
diff --git a/drivers/leds/trigger/ledtrig-activity.c b/drivers/leds/trigger/ledtrig-activity.c
index 4c8b0c3cf284..6a72b7e13719 100644
--- a/drivers/leds/trigger/ledtrig-activity.c
+++ b/drivers/leds/trigger/ledtrig-activity.c
@@ -70,7 +70,7 @@ static void led_activity_function(struct timer_list *t)
          * down to 16us, ensuring we won't overflow 32-bit computations below
          * even up to 3k CPUs, while keeping divides cheap on smaller systems.
          */
-        curr_boot = ktime_get_boot_ns() * cpus;
+        curr_boot = ktime_get_boottime_ns() * cpus;
         diff_boot = (curr_boot - activity_data->last_boot) >> 16;
         diff_used = (curr_used - activity_data->last_used) >> 16;
         activity_data->last_boot = curr_boot;
diff --git a/drivers/md/dm-init.c b/drivers/md/dm-init.c
index 352e803f566e..728733a514c7 100644
--- a/drivers/md/dm-init.c
+++ b/drivers/md/dm-init.c
@@ -140,8 +140,8 @@ static char __init *dm_parse_table_entry(struct dm_device *dev, char *str)
                 return ERR_PTR(-EINVAL);
         }
         /* target_args */
-        dev->target_args_array[n] = kstrndup(field[3], GFP_KERNEL,
-                                             DM_MAX_STR_SIZE);
+        dev->target_args_array[n] = kstrndup(field[3], DM_MAX_STR_SIZE,
+                                             GFP_KERNEL);
         if (!dev->target_args_array[n])
                 return ERR_PTR(-ENOMEM);
 
@@ -272,10 +272,10 @@ static int __init dm_init_init(void)
                 return 0;
 
         if (strlen(create) >= DM_MAX_STR_SIZE) {
-                DMERR("Argument is too big. Limit is %d\n", DM_MAX_STR_SIZE);
+                DMERR("Argument is too big. Limit is %d", DM_MAX_STR_SIZE);
                 return -EINVAL;
         }
-        str = kstrndup(create, GFP_KERNEL, DM_MAX_STR_SIZE);
+        str = kstrndup(create, DM_MAX_STR_SIZE, GFP_KERNEL);
         if (!str)
                 return -ENOMEM;
 
@@ -283,7 +283,7 @@ static int __init dm_init_init(void)
         if (r)
                 goto out;
 
-        DMINFO("waiting for all devices to be available before creating mapped devices\n");
+        DMINFO("waiting for all devices to be available before creating mapped devices");
         wait_for_device_probe();
 
         list_for_each_entry(dev, &devices, list) {
diff --git a/drivers/md/dm-log-writes.c b/drivers/md/dm-log-writes.c
index 9ea2b0291f20..e549392e0ea5 100644
--- a/drivers/md/dm-log-writes.c
+++ b/drivers/md/dm-log-writes.c
@@ -60,6 +60,7 @@
 
 #define WRITE_LOG_VERSION 1ULL
 #define WRITE_LOG_MAGIC 0x6a736677736872ULL
+#define WRITE_LOG_SUPER_SECTOR 0
 
 /*
  * The disk format for this is braindead simple.
@@ -115,6 +116,7 @@ struct log_writes_c {
         struct list_head logging_blocks;
         wait_queue_head_t wait;
         struct task_struct *log_kthread;
+        struct completion super_done;
 };
 
 struct pending_block {
@@ -180,6 +182,14 @@ static void log_end_io(struct bio *bio)
         bio_put(bio);
 }
 
+static void log_end_super(struct bio *bio)
+{
+        struct log_writes_c *lc = bio->bi_private;
+
+        complete(&lc->super_done);
+        log_end_io(bio);
+}
+
 /*
  * Meant to be called if there is an error, it will free all the pages
  * associated with the block.
@@ -215,7 +225,8 @@ static int write_metadata(struct log_writes_c *lc, void *entry,
         bio->bi_iter.bi_size = 0;
         bio->bi_iter.bi_sector = sector;
         bio_set_dev(bio, lc->logdev->bdev);
-        bio->bi_end_io = log_end_io;
+        bio->bi_end_io = (sector == WRITE_LOG_SUPER_SECTOR) ?
+                          log_end_super : log_end_io;
         bio->bi_private = lc;
         bio_set_op_attrs(bio, REQ_OP_WRITE, 0);
 
@@ -418,11 +429,18 @@ static int log_super(struct log_writes_c *lc)
         super.nr_entries = cpu_to_le64(lc->logged_entries);
         super.sectorsize = cpu_to_le32(lc->sectorsize);
 
-        if (write_metadata(lc, &super, sizeof(super), NULL, 0, 0)) {
+        if (write_metadata(lc, &super, sizeof(super), NULL, 0,
+                           WRITE_LOG_SUPER_SECTOR)) {
                 DMERR("Couldn't write super");
                 return -1;
         }
 
+        /*
+         * Super sector should be writen in-order, otherwise the
+         * nr_entries could be rewritten incorrectly by an old bio.
+         */
+        wait_for_completion_io(&lc->super_done);
+
         return 0;
 }
 
@@ -531,6 +549,7 @@ static int log_writes_ctr(struct dm_target *ti, unsigned int argc, char **argv)
         INIT_LIST_HEAD(&lc->unflushed_blocks);
         INIT_LIST_HEAD(&lc->logging_blocks);
         init_waitqueue_head(&lc->wait);
+        init_completion(&lc->super_done);
         atomic_set(&lc->io_blocks, 0);
         atomic_set(&lc->pending_blocks, 0);
 
diff --git a/drivers/md/dm-table.c b/drivers/md/dm-table.c
index 350cf0451456..ec8b27e20de3 100644
--- a/drivers/md/dm-table.c
+++ b/drivers/md/dm-table.c
@@ -561,7 +561,7 @@ static char **realloc_argv(unsigned *size, char **old_argv)
                 gfp = GFP_NOIO;
         }
         argv = kmalloc_array(new_size, sizeof(*argv), gfp);
-        if (argv) {
+        if (argv && old_argv) {
                 memcpy(argv, old_argv, *size * sizeof(*argv));
                 *size = new_size;
         }
diff --git a/drivers/md/dm-verity-target.c b/drivers/md/dm-verity-target.c
index 720d06531aa3..ea24ff0612e3 100644
--- a/drivers/md/dm-verity-target.c
+++ b/drivers/md/dm-verity-target.c
@@ -235,8 +235,8 @@ static int verity_handle_err(struct dm_verity *v, enum verity_block_type type,
                 BUG();
         }
 
-        DMERR("%s: %s block %llu is corrupted", v->data_dev->name, type_str,
-                block);
+        DMERR_LIMIT("%s: %s block %llu is corrupted", v->data_dev->name,
+                    type_str, block);
 
         if (v->corrupted_errs == DM_VERITY_MAX_CORRUPTED_ERRS)
                 DMERR("%s: reached maximum errors", v->data_dev->name);
diff --git a/drivers/mfd/stmfx.c b/drivers/mfd/stmfx.c
index fe8efba2d45f..857991cb3cbb 100644
--- a/drivers/mfd/stmfx.c
+++ b/drivers/mfd/stmfx.c
@@ -204,12 +204,11 @@ static struct irq_chip stmfx_irq_chip = {
 static irqreturn_t stmfx_irq_handler(int irq, void *data)
 {
         struct stmfx *stmfx = data;
-        unsigned long n, pending;
-        u32 ack;
-        int ret;
+        unsigned long bits;
+        u32 pending, ack;
+        int n, ret;
 
-        ret = regmap_read(stmfx->map, STMFX_REG_IRQ_PENDING,
-                          (u32 *)&pending);
+        ret = regmap_read(stmfx->map, STMFX_REG_IRQ_PENDING, &pending);
         if (ret)
                 return IRQ_NONE;
 
@@ -224,7 +223,8 @@ static irqreturn_t stmfx_irq_handler(int irq, void *data)
                         return IRQ_NONE;
         }
 
-        for_each_set_bit(n, &pending, STMFX_REG_IRQ_SRC_MAX)
+        bits = pending;
+        for_each_set_bit(n, &bits, STMFX_REG_IRQ_SRC_MAX)
                 handle_nested_irq(irq_find_mapping(stmfx->irq_domain, n));
 
         return IRQ_HANDLED;
diff --git a/drivers/mtd/nand/raw/ingenic/Kconfig b/drivers/mtd/nand/raw/ingenic/Kconfig
index 19a96ce515c1..66b7cffdb0c2 100644
--- a/drivers/mtd/nand/raw/ingenic/Kconfig
+++ b/drivers/mtd/nand/raw/ingenic/Kconfig
@@ -16,7 +16,7 @@ config MTD_NAND_JZ4780
 if MTD_NAND_JZ4780
 
 config MTD_NAND_INGENIC_ECC
-        tristate
+        bool
 
 config MTD_NAND_JZ4740_ECC
         tristate "Hardware BCH support for JZ4740 SoC"
diff --git a/drivers/mtd/nand/raw/ingenic/Makefile b/drivers/mtd/nand/raw/ingenic/Makefile
index 1ac4f455baea..b63d36889263 100644
--- a/drivers/mtd/nand/raw/ingenic/Makefile
+++ b/drivers/mtd/nand/raw/ingenic/Makefile
@@ -2,7 +2,9 @@
 obj-$(CONFIG_MTD_NAND_JZ4740) += jz4740_nand.o
 obj-$(CONFIG_MTD_NAND_JZ4780) += ingenic_nand.o
 
-obj-$(CONFIG_MTD_NAND_INGENIC_ECC) += ingenic_ecc.o
+ingenic_nand-y += ingenic_nand_drv.o
+ingenic_nand-$(CONFIG_MTD_NAND_INGENIC_ECC) += ingenic_ecc.o
+
 obj-$(CONFIG_MTD_NAND_JZ4740_ECC) += jz4740_ecc.o
 obj-$(CONFIG_MTD_NAND_JZ4725B_BCH) += jz4725b_bch.o
 obj-$(CONFIG_MTD_NAND_JZ4780_BCH) += jz4780_bch.o
diff --git a/drivers/mtd/nand/raw/ingenic/ingenic_ecc.c b/drivers/mtd/nand/raw/ingenic/ingenic_ecc.c
index d3e085c5685a..c954189606f6 100644
--- a/drivers/mtd/nand/raw/ingenic/ingenic_ecc.c
+++ b/drivers/mtd/nand/raw/ingenic/ingenic_ecc.c
@@ -30,7 +30,6 @@ int ingenic_ecc_calculate(struct ingenic_ecc *ecc,
 {
         return ecc->ops->calculate(ecc, params, buf, ecc_code);
 }
-EXPORT_SYMBOL(ingenic_ecc_calculate);
 
 /**
  * ingenic_ecc_correct() - detect and correct bit errors
@@ -51,7 +50,6 @@ int ingenic_ecc_correct(struct ingenic_ecc *ecc,
 {
         return ecc->ops->correct(ecc, params, buf, ecc_code);
 }
-EXPORT_SYMBOL(ingenic_ecc_correct);
 
 /**
  * ingenic_ecc_get() - get the ECC controller device
@@ -111,7 +109,6 @@ struct ingenic_ecc *of_ingenic_ecc_get(struct device_node *of_node)
         }
         return ecc;
 }
-EXPORT_SYMBOL(of_ingenic_ecc_get);
 
 /**
  * ingenic_ecc_release() - release the ECC controller device
@@ -122,7 +119,6 @@ void ingenic_ecc_release(struct ingenic_ecc *ecc)
         clk_disable_unprepare(ecc->clk);
         put_device(ecc->dev);
 }
-EXPORT_SYMBOL(ingenic_ecc_release);
 
 int ingenic_ecc_probe(struct platform_device *pdev)
 {
@@ -159,8 +155,3 @@ int ingenic_ecc_probe(struct platform_device *pdev)
         return 0;
 }
 EXPORT_SYMBOL(ingenic_ecc_probe);
-
-MODULE_AUTHOR("Alex Smith <alex@alex-smith.me.uk>");
-MODULE_AUTHOR("Harvey Hunt <harveyhuntnexus@gmail.com>");
-MODULE_DESCRIPTION("Ingenic ECC common driver");
-MODULE_LICENSE("GPL v2");
diff --git a/drivers/mtd/nand/raw/ingenic/ingenic_nand.c b/drivers/mtd/nand/raw/ingenic/ingenic_nand_drv.c
index d7b7c0f13909..d7b7c0f13909 100644
--- a/drivers/mtd/nand/raw/ingenic/ingenic_nand.c
+++ b/drivers/mtd/nand/raw/ingenic/ingenic_nand_drv.c
diff --git a/drivers/mtd/nand/raw/nand_base.c b/drivers/mtd/nand/raw/nand_base.c
index b5b68aa16eb3..6eb131292eb2 100644
--- a/drivers/mtd/nand/raw/nand_base.c
+++ b/drivers/mtd/nand/raw/nand_base.c
@@ -4662,7 +4662,6 @@ static int nand_detect(struct nand_chip *chip, struct nand_flash_dev *type)
         memorg = nanddev_get_memorg(&chip->base);
         memorg->planes_per_lun = 1;
         memorg->luns_per_target = 1;
-        memorg->ntargets = 1;
 
         /*
          * Reset the chip, required by some chips (e.g. Micron MT29FxGxxxxx)
@@ -5027,6 +5026,8 @@ static int nand_scan_ident(struct nand_chip *chip, unsigned int maxchips,
         if (ret)
                 return ret;
 
+        memorg->ntargets = maxchips;
+
         /* Read the flash type */
         ret = nand_detect(chip, table);
         if (ret) {
diff --git a/drivers/mtd/nand/raw/sunxi_nand.c b/drivers/mtd/nand/raw/sunxi_nand.c
index b021a5720b42..89773293c64d 100644
--- a/drivers/mtd/nand/raw/sunxi_nand.c
+++ b/drivers/mtd/nand/raw/sunxi_nand.c
@@ -51,6 +51,7 @@
 #define NFC_REG_USER_DATA(x)    (0x0050 + ((x) * 4))
 #define NFC_REG_SPARE_AREA      0x00A0
 #define NFC_REG_PAT_ID          0x00A4
+#define NFC_REG_MDMA_CNT        0x00C4
 #define NFC_RAM0_BASE           0x0400
 #define NFC_RAM1_BASE           0x0800
 
@@ -69,6 +70,7 @@
 #define NFC_PAGE_SHIFT(x)       (((x) < 10 ? 0 : (x) - 10) << 8)
 #define NFC_SAM                 BIT(12)
 #define NFC_RAM_METHOD          BIT(14)
+#define NFC_DMA_TYPE_NORMAL     BIT(15)
 #define NFC_DEBUG_CTL           BIT(31)
 
 /* define bit use in NFC_ST */
@@ -205,14 +207,13 @@ static inline struct sunxi_nand_chip *to_sunxi_nand(struct nand_chip *nand)
  * NAND Controller capabilities structure: stores NAND controller capabilities
  * for distinction between compatible strings.
  *
- * @sram_through_ahb:   On A23, we choose to access the internal RAM through AHB
- *                      instead of MBUS (less configuration). A10, A10s, A13 and
- *                      A20 use the MBUS but no extra configuration is needed.
+ * @extra_mbus_conf:    Contrary to A10, A10s and A13, accessing internal RAM
+ *                      through MBUS on A23/A33 needs extra configuration.
  * @reg_io_data:        I/O data register
  * @dma_maxburst:       DMA maxburst
  */
 struct sunxi_nfc_caps {
-        bool sram_through_ahb;
+        bool extra_mbus_conf;
         unsigned int reg_io_data;
         unsigned int dma_maxburst;
 };
@@ -368,28 +369,12 @@ static int sunxi_nfc_dma_op_prepare(struct sunxi_nfc *nfc, const void *buf,
                 goto err_unmap_buf;
         }
 
-        /*
-         * On A23, we suppose the "internal RAM" (p.12 of the NFC user manual)
-         * refers to the NAND controller's internal SRAM. This memory is mapped
-         * and so is accessible from the AHB. It seems that it can also be
-         * accessed by the MBUS. MBUS accesses are mandatory when using the
-         * internal DMA instead of the external DMA engine.
-         *
-         * During DMA I/O operation, either we access this memory from the AHB
-         * by clearing the NFC_RAM_METHOD bit, or we set the bit and use the
-         * MBUS. In this case, we should also configure the MBUS DMA length
-         * NFC_REG_MDMA_CNT(0xC4) to be chunksize * nchunks. NAND I/O over MBUS
-         * are also limited to 32kiB pages.
-         */
-        if (nfc->caps->sram_through_ahb)
-                writel(readl(nfc->regs + NFC_REG_CTL) & ~NFC_RAM_METHOD,
-                       nfc->regs + NFC_REG_CTL);
-        else
-                writel(readl(nfc->regs + NFC_REG_CTL) | NFC_RAM_METHOD,
-                       nfc->regs + NFC_REG_CTL);
-
+        writel(readl(nfc->regs + NFC_REG_CTL) | NFC_RAM_METHOD,
+               nfc->regs + NFC_REG_CTL);
         writel(nchunks, nfc->regs + NFC_REG_SECTOR_NUM);
         writel(chunksize, nfc->regs + NFC_REG_CNT);
+        if (nfc->caps->extra_mbus_conf)
+                writel(chunksize * nchunks, nfc->regs + NFC_REG_MDMA_CNT);
 
         dmat = dmaengine_submit(dmad);
 
@@ -2151,6 +2136,11 @@ static int sunxi_nfc_probe(struct platform_device *pdev)
                 dmac_cfg.src_maxburst = nfc->caps->dma_maxburst;
                 dmac_cfg.dst_maxburst = nfc->caps->dma_maxburst;
                 dmaengine_slave_config(nfc->dmac, &dmac_cfg);
+
+                if (nfc->caps->extra_mbus_conf)
+                        writel(readl(nfc->regs + NFC_REG_CTL) |
+                               NFC_DMA_TYPE_NORMAL, nfc->regs + NFC_REG_CTL);
+
         } else {
                 dev_warn(dev, "failed to request rxtx DMA channel\n");
         }
@@ -2200,7 +2190,7 @@ static const struct sunxi_nfc_caps sunxi_nfc_a10_caps = {
 };
 
 static const struct sunxi_nfc_caps sunxi_nfc_a23_caps = {
-        .sram_through_ahb = true,
+        .extra_mbus_conf = true,
         .reg_io_data = NFC_REG_A23_IO_DATA,
         .dma_maxburst = 8,
 };
diff --git a/drivers/mtd/nand/spi/gigadevice.c b/drivers/mtd/nand/spi/gigadevice.c
index e5586390026a..e6c646007cda 100644
--- a/drivers/mtd/nand/spi/gigadevice.c
+++ b/drivers/mtd/nand/spi/gigadevice.c
@@ -180,7 +180,7 @@ static const struct spinand_info gigadevice_spinand_table[] = {
                      SPINAND_ECCINFO(&gd5fxgq4xa_ooblayout,
                                      gd5fxgq4xa_ecc_get_status)),
         SPINAND_INFO("GD5F4GQ4xA", 0xF4,
-                     NAND_MEMORG(1, 2048, 64, 64, 4096, 40, 1, 1, 1),
+                     NAND_MEMORG(1, 2048, 64, 64, 4096, 80, 1, 1, 1),
                      NAND_ECCREQ(8, 512),
                      SPINAND_INFO_OP_VARIANTS(&read_cache_variants,
                                               &write_cache_variants,
diff --git a/drivers/mtd/nand/spi/macronix.c b/drivers/mtd/nand/spi/macronix.c
index 6502727049a8..21def3f8fb36 100644
--- a/drivers/mtd/nand/spi/macronix.c
+++ b/drivers/mtd/nand/spi/macronix.c
@@ -100,7 +100,7 @@ static int mx35lf1ge4ab_ecc_get_status(struct spinand_device *spinand,
 
 static const struct spinand_info macronix_spinand_table[] = {
         SPINAND_INFO("MX35LF1GE4AB", 0x12,
-                     NAND_MEMORG(1, 2048, 64, 64, 1024, 40, 1, 1, 1),
+                     NAND_MEMORG(1, 2048, 64, 64, 1024, 20, 1, 1, 1),
                      NAND_ECCREQ(4, 512),
                      SPINAND_INFO_OP_VARIANTS(&read_cache_variants,
                                               &write_cache_variants,
@@ -109,7 +109,7 @@ static const struct spinand_info macronix_spinand_table[] = {
                      SPINAND_ECCINFO(&mx35lfxge4ab_ooblayout,
                                      mx35lf1ge4ab_ecc_get_status)),
         SPINAND_INFO("MX35LF2GE4AB", 0x22,
-                     NAND_MEMORG(1, 2048, 64, 64, 2048, 20, 2, 1, 1),
+                     NAND_MEMORG(1, 2048, 64, 64, 2048, 40, 2, 1, 1),
                      NAND_ECCREQ(4, 512),
                      SPINAND_INFO_OP_VARIANTS(&read_cache_variants,
                                               &write_cache_variants,
diff --git a/drivers/mtd/spi-nor/spi-nor.c b/drivers/mtd/spi-nor/spi-nor.c
index 73172d7f512b..0c2ec1c21434 100644
--- a/drivers/mtd/spi-nor/spi-nor.c
+++ b/drivers/mtd/spi-nor/spi-nor.c
@@ -1636,6 +1636,95 @@ static int sr2_bit7_quad_enable(struct spi_nor *nor)
         return 0;
 }
 
+/**
+ * spi_nor_clear_sr_bp() - clear the Status Register Block Protection bits.
+ * @nor:        pointer to a 'struct spi_nor'
+ *
+ * Read-modify-write function that clears the Block Protection bits from the
+ * Status Register without affecting other bits.
+ *
+ * Return: 0 on success, -errno otherwise.
+ */
+static int spi_nor_clear_sr_bp(struct spi_nor *nor)
+{
+        int ret;
+        u8 mask = SR_BP2 | SR_BP1 | SR_BP0;
+
+        ret = read_sr(nor);
+        if (ret < 0) {
+                dev_err(nor->dev, "error while reading status register\n");
+                return ret;
+        }
+
+        write_enable(nor);
+
+        ret = write_sr(nor, ret & ~mask);
+        if (ret) {
+                dev_err(nor->dev, "write to status register failed\n");
+                return ret;
+        }
+
+        ret = spi_nor_wait_till_ready(nor);
+        if (ret)
+                dev_err(nor->dev, "timeout while writing status register\n");
+        return ret;
+}
+
+/**
+ * spi_nor_spansion_clear_sr_bp() - clear the Status Register Block Protection
+ * bits on spansion flashes.
+ * @nor:        pointer to a 'struct spi_nor'
+ *
+ * Read-modify-write function that clears the Block Protection bits from the
+ * Status Register without affecting other bits. The function is tightly
+ * coupled with the spansion_quad_enable() function. Both assume that the Write
+ * Register with 16 bits, together with the Read Configuration Register (35h)
+ * instructions are supported.
+ *
+ * Return: 0 on success, -errno otherwise.
+ */
+static int spi_nor_spansion_clear_sr_bp(struct spi_nor *nor)
+{
+        int ret;
+        u8 mask = SR_BP2 | SR_BP1 | SR_BP0;
+        u8 sr_cr[2] = {0};
+
+        /* Check current Quad Enable bit value. */
+        ret = read_cr(nor);
+        if (ret < 0) {
+                dev_err(nor->dev,
+                        "error while reading configuration register\n");
+                return ret;
+        }
+
+        /*
+         * When the configuration register Quad Enable bit is one, only the
+         * Write Status (01h) command with two data bytes may be used.
+         */
+        if (ret & CR_QUAD_EN_SPAN) {
+                sr_cr[1] = ret;
+
+                ret = read_sr(nor);
+                if (ret < 0) {
+                        dev_err(nor->dev,
+                                "error while reading status register\n");
+                        return ret;
+                }
+                sr_cr[0] = ret & ~mask;
+
+                ret = write_sr_cr(nor, sr_cr);
+                if (ret)
+                        dev_err(nor->dev, "16-bit write register failed\n");
+                return ret;
+        }
+
+        /*
+         * If the Quad Enable bit is zero, use the Write Status (01h) command
+         * with one data byte.
+         */
+        return spi_nor_clear_sr_bp(nor);
+}
+
 /* Used when the "_ext_id" is two bytes at most */
 #define INFO(_jedec_id, _ext_id, _sector_size, _n_sectors, _flags)      \
                 .id = {                                                 \
@@ -3660,6 +3749,8 @@ static int spi_nor_init_params(struct spi_nor *nor,
                 default:
                         /* Kept only for backward compatibility purpose. */
                         params->quad_enable = spansion_quad_enable;
+                        if (nor->clear_sr_bp)
+                                nor->clear_sr_bp = spi_nor_spansion_clear_sr_bp;
                         break;
                 }
 
@@ -3912,17 +4003,13 @@ static int spi_nor_init(struct spi_nor *nor)
 {
         int err;
 
-        /*
-         * Atmel, SST, Intel/Numonyx, and others serial NOR tend to power up
-         * with the software protection bits set
-         */
-        if (JEDEC_MFR(nor->info) == SNOR_MFR_ATMEL ||
-            JEDEC_MFR(nor->info) == SNOR_MFR_INTEL ||
-            JEDEC_MFR(nor->info) == SNOR_MFR_SST ||
-            nor->info->flags & SPI_NOR_HAS_LOCK) {
-                write_enable(nor);
-                write_sr(nor, 0);
-                spi_nor_wait_till_ready(nor);
+        if (nor->clear_sr_bp) {
+                err = nor->clear_sr_bp(nor);
+                if (err) {
+                        dev_err(nor->dev,
+                                "fail to clear block protection bits\n");
+                        return err;
+                }
         }
 
         if (nor->quad_enable) {
@@ -4047,6 +4134,16 @@ int spi_nor_scan(struct spi_nor *nor, const char *name,
         if (info->flags & SPI_S3AN)
                 nor->flags |=  SNOR_F_READY_XSR_RDY;
 
+        /*
+         * Atmel, SST, Intel/Numonyx, and others serial NOR tend to power up
+         * with the software protection bits set.
+         */
+        if (JEDEC_MFR(nor->info) == SNOR_MFR_ATMEL ||
+            JEDEC_MFR(nor->info) == SNOR_MFR_INTEL ||
+            JEDEC_MFR(nor->info) == SNOR_MFR_SST ||
+            nor->info->flags & SPI_NOR_HAS_LOCK)
+                nor->clear_sr_bp = spi_nor_clear_sr_bp;
+
         /* Parse the Serial Flash Discoverable Parameters table. */
         ret = spi_nor_init_params(nor, &params);
         if (ret)
diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index 407f4095a37a..799fc38c5c34 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -4320,12 +4320,12 @@ void bond_setup(struct net_device *bond_dev)
         bond_dev->features |= NETIF_F_NETNS_LOCAL;
 
         bond_dev->hw_features = BOND_VLAN_FEATURES |
-                                NETIF_F_HW_VLAN_CTAG_TX |
                                 NETIF_F_HW_VLAN_CTAG_RX |
                                 NETIF_F_HW_VLAN_CTAG_FILTER;
 
         bond_dev->hw_features |= NETIF_F_GSO_ENCAP_ALL | NETIF_F_GSO_UDP_L4;
         bond_dev->features |= bond_dev->hw_features;
+        bond_dev->features |= NETIF_F_HW_VLAN_CTAG_TX | NETIF_F_HW_VLAN_STAG_TX;
 }
 
 /* Destroy a bonding device.
diff --git a/drivers/net/dsa/microchip/ksz_common.c b/drivers/net/dsa/microchip/ksz_common.c
index f46086fa9064..db91b213eae1 100644
--- a/drivers/net/dsa/microchip/ksz_common.c
+++ b/drivers/net/dsa/microchip/ksz_common.c
@@ -436,9 +436,9 @@ int ksz_switch_register(struct ksz_device *dev,
                 return PTR_ERR(dev->reset_gpio);
 
         if (dev->reset_gpio) {
-                gpiod_set_value(dev->reset_gpio, 1);
+                gpiod_set_value_cansleep(dev->reset_gpio, 1);
                 mdelay(10);
-                gpiod_set_value(dev->reset_gpio, 0);
+                gpiod_set_value_cansleep(dev->reset_gpio, 0);
         }
 
         mutex_init(&dev->dev_mutex);
@@ -487,7 +487,7 @@ void ksz_switch_remove(struct ksz_device *dev)
         dsa_unregister_switch(dev->ds);
 
         if (dev->reset_gpio)
-                gpiod_set_value(dev->reset_gpio, 1);
+                gpiod_set_value_cansleep(dev->reset_gpio, 1);
 
 }
 EXPORT_SYMBOL(ksz_switch_remove);
diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_filters.c b/drivers/net/ethernet/aquantia/atlantic/aq_filters.c
index 18bc035da850..1fff462a4175 100644
--- a/drivers/net/ethernet/aquantia/atlantic/aq_filters.c
+++ b/drivers/net/ethernet/aquantia/atlantic/aq_filters.c
@@ -843,9 +843,14 @@ int aq_filters_vlans_update(struct aq_nic_s *aq_nic)
                 return err;
 
         if (aq_nic->ndev->features & NETIF_F_HW_VLAN_CTAG_FILTER) {
-                if (hweight < AQ_VLAN_MAX_FILTERS)
-                        err = aq_hw_ops->hw_filter_vlan_ctrl(aq_hw, true);
+                if (hweight < AQ_VLAN_MAX_FILTERS && hweight > 0) {
+                        err = aq_hw_ops->hw_filter_vlan_ctrl(aq_hw,
+                                !(aq_nic->packet_filter & IFF_PROMISC));
+                        aq_nic->aq_nic_cfg.is_vlan_force_promisc = false;
+                } else {
                 /* otherwise left in promiscue mode */
+                        aq_nic->aq_nic_cfg.is_vlan_force_promisc = true;
+                }
         }
 
         return err;
@@ -866,6 +871,7 @@ int aq_filters_vlan_offload_off(struct aq_nic_s *aq_nic)
         if (unlikely(!aq_hw_ops->hw_filter_vlan_ctrl))
                 return -EOPNOTSUPP;
 
+        aq_nic->aq_nic_cfg.is_vlan_force_promisc = true;
         err = aq_hw_ops->hw_filter_vlan_ctrl(aq_hw, false);
         if (err)
                 return err;
diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_nic.c b/drivers/net/ethernet/aquantia/atlantic/aq_nic.c
index 0da5e161ec5d..41172fbebddd 100644
--- a/drivers/net/ethernet/aquantia/atlantic/aq_nic.c
+++ b/drivers/net/ethernet/aquantia/atlantic/aq_nic.c
@@ -126,6 +126,7 @@ void aq_nic_cfg_start(struct aq_nic_s *self)
 
         cfg->link_speed_msk &= cfg->aq_hw_caps->link_speed_msk;
         cfg->features = cfg->aq_hw_caps->hw_features;
+        cfg->is_vlan_force_promisc = true;
 }
 
 static int aq_nic_update_link_status(struct aq_nic_s *self)
diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_nic.h b/drivers/net/ethernet/aquantia/atlantic/aq_nic.h
index eb2e3c7c36f9..0f22f5d5691b 100644
--- a/drivers/net/ethernet/aquantia/atlantic/aq_nic.h
+++ b/drivers/net/ethernet/aquantia/atlantic/aq_nic.h
@@ -35,6 +35,7 @@ struct aq_nic_cfg_s {
         u32 flow_control;
         u32 link_speed_msk;
         u32 wol;
+        bool is_vlan_force_promisc;
         u16 is_mc_list_enabled;
         u16 mc_list_count;
         bool is_autoneg;
diff --git a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c
index 1c7593d54035..13ac2661a473 100644
--- a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c
+++ b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c
@@ -778,8 +778,15 @@ static int hw_atl_b0_hw_packet_filter_set(struct aq_hw_s *self,
                                           unsigned int packet_filter)
 {
         unsigned int i = 0U;
+        struct aq_nic_cfg_s *cfg = self->aq_nic_cfg;
+
+        hw_atl_rpfl2promiscuous_mode_en_set(self,
+                                            IS_FILTER_ENABLED(IFF_PROMISC));
+
+        hw_atl_rpf_vlan_prom_mode_en_set(self,
+                                     IS_FILTER_ENABLED(IFF_PROMISC) ||
+                                     cfg->is_vlan_force_promisc);
 
-        hw_atl_rpfl2promiscuous_mode_en_set(self, IS_FILTER_ENABLED(IFF_PROMISC));
         hw_atl_rpfl2multicast_flr_en_set(self,
                                          IS_FILTER_ENABLED(IFF_ALLMULTI), 0);
 
@@ -788,13 +795,13 @@ static int hw_atl_b0_hw_packet_filter_set(struct aq_hw_s *self,
 
         hw_atl_rpfl2broadcast_en_set(self, IS_FILTER_ENABLED(IFF_BROADCAST));
 
-        self->aq_nic_cfg->is_mc_list_enabled = IS_FILTER_ENABLED(IFF_MULTICAST);
+        cfg->is_mc_list_enabled = IS_FILTER_ENABLED(IFF_MULTICAST);
 
         for (i = HW_ATL_B0_MAC_MIN; i < HW_ATL_B0_MAC_MAX; ++i)
                 hw_atl_rpfl2_uc_flr_en_set(self,
-                                           (self->aq_nic_cfg->is_mc_list_enabled &&
-                                    (i <= self->aq_nic_cfg->mc_list_count)) ?
-                                    1U : 0U, i);
+                                           (cfg->is_mc_list_enabled &&
+                                            (i <= cfg->mc_list_count)) ?
+                                           1U : 0U, i);
 
         return aq_hw_err_from_flags(self);
 }
@@ -1086,7 +1093,7 @@ static int hw_atl_b0_hw_vlan_set(struct aq_hw_s *self,
 static int hw_atl_b0_hw_vlan_ctrl(struct aq_hw_s *self, bool enable)
 {
         /* set promisc in case of disabing the vland filter */
-        hw_atl_rpf_vlan_prom_mode_en_set(self, !!!enable);
+        hw_atl_rpf_vlan_prom_mode_en_set(self, !enable);
 
         return aq_hw_err_from_flags(self);
 }
diff --git a/drivers/net/ethernet/cadence/macb_main.c b/drivers/net/ethernet/cadence/macb_main.c
index 2375a13bb446..262a28ff81fc 100644
--- a/drivers/net/ethernet/cadence/macb_main.c
+++ b/drivers/net/ethernet/cadence/macb_main.c
@@ -4180,7 +4180,7 @@ static int macb_probe(struct platform_device *pdev)
         if (PTR_ERR(mac) == -EPROBE_DEFER) {
                 err = -EPROBE_DEFER;
                 goto err_out_free_netdev;
-        } else if (!IS_ERR(mac)) {
+        } else if (!IS_ERR_OR_NULL(mac)) {
                 ether_addr_copy(bp->dev->dev_addr, mac);
         } else {
                 macb_get_hwaddr(bp);
diff --git a/drivers/net/ethernet/emulex/benet/be_ethtool.c b/drivers/net/ethernet/emulex/benet/be_ethtool.c
index 8a6785173228..492f8769ac12 100644
--- a/drivers/net/ethernet/emulex/benet/be_ethtool.c
+++ b/drivers/net/ethernet/emulex/benet/be_ethtool.c
@@ -891,7 +891,7 @@ static void be_self_test(struct net_device *netdev, struct ethtool_test *test,
                          u64 *data)
 {
         struct be_adapter *adapter = netdev_priv(netdev);
-        int status;
+        int status, cnt;
         u8 link_status = 0;
 
         if (adapter->function_caps & BE_FUNCTION_CAPS_SUPER_NIC) {
@@ -902,6 +902,9 @@ static void be_self_test(struct net_device *netdev, struct ethtool_test *test,
 
         memset(data, 0, sizeof(u64) * ETHTOOL_TESTS_NUM);
 
+        /* check link status before offline tests */
+        link_status = netif_carrier_ok(netdev);
+
         if (test->flags & ETH_TEST_FL_OFFLINE) {
                 if (be_loopback_test(adapter, BE_MAC_LOOPBACK, &data[0]) != 0)
                         test->flags |= ETH_TEST_FL_FAILED;
@@ -922,13 +925,26 @@ static void be_self_test(struct net_device *netdev, struct ethtool_test *test,
                 test->flags |= ETH_TEST_FL_FAILED;
         }
 
-        status = be_cmd_link_status_query(adapter, NULL, &link_status, 0);
-        if (status) {
-                test->flags |= ETH_TEST_FL_FAILED;
-                data[4] = -1;
-        } else if (!link_status) {
+        /* link status was down prior to test */
+        if (!link_status) {
                 test->flags |= ETH_TEST_FL_FAILED;
                 data[4] = 1;
+                return;
+        }
+
+        for (cnt = 10; cnt; cnt--) {
+                status = be_cmd_link_status_query(adapter, NULL, &link_status,
+                                                  0);
+                if (status) {
+                        test->flags |= ETH_TEST_FL_FAILED;
+                        data[4] = -1;
+                        break;
+                }
+
+                if (link_status)
+                        break;
+
+                msleep_interruptible(500);
         }
 }
 
diff --git a/drivers/net/ethernet/sis/sis900.c b/drivers/net/ethernet/sis/sis900.c
index 67f9bb6e941b..9b036c857b1d 100644
--- a/drivers/net/ethernet/sis/sis900.c
+++ b/drivers/net/ethernet/sis/sis900.c
@@ -1057,7 +1057,7 @@ sis900_open(struct net_device *net_dev)
         sis900_set_mode(sis_priv, HW_SPEED_10_MBPS, FDX_CAPABLE_HALF_SELECTED);
 
         /* Enable all known interrupts by setting the interrupt mask. */
-        sw32(imr, RxSOVR | RxORN | RxERR | RxOK | TxURN | TxERR | TxIDLE);
+        sw32(imr, RxSOVR | RxORN | RxERR | RxOK | TxURN | TxERR | TxIDLE | TxDESC);
         sw32(cr, RxENA | sr32(cr));
         sw32(ier, IE);
 
@@ -1578,7 +1578,7 @@ static void sis900_tx_timeout(struct net_device *net_dev)
         sw32(txdp, sis_priv->tx_ring_dma);
 
         /* Enable all known interrupts by setting the interrupt mask. */
-        sw32(imr, RxSOVR | RxORN | RxERR | RxOK | TxURN | TxERR | TxIDLE);
+        sw32(imr, RxSOVR | RxORN | RxERR | RxOK | TxURN | TxERR | TxIDLE | TxDESC);
 }
 
 /**
@@ -1618,7 +1618,7 @@ sis900_start_xmit(struct sk_buff *skb, struct net_device *net_dev)
                         spin_unlock_irqrestore(&sis_priv->lock, flags);
                         return NETDEV_TX_OK;
         }
-        sis_priv->tx_ring[entry].cmdsts = (OWN | skb->len);
+        sis_priv->tx_ring[entry].cmdsts = (OWN | INTR | skb->len);
         sw32(cr, TxENA | sr32(cr));
 
         sis_priv->cur_tx ++;
@@ -1674,7 +1674,7 @@ static irqreturn_t sis900_interrupt(int irq, void *dev_instance)
         do {
                 status = sr32(isr);
 
-                if ((status & (HIBERR|TxURN|TxERR|TxIDLE|RxORN|RxERR|RxOK)) == 0)
+                if ((status & (HIBERR|TxURN|TxERR|TxIDLE|TxDESC|RxORN|RxERR|RxOK)) == 0)
                         /* nothing intresting happened */
                         break;
                 handled = 1;
@@ -1684,7 +1684,7 @@ static irqreturn_t sis900_interrupt(int irq, void *dev_instance)
                         /* Rx interrupt */
                         sis900_rx(net_dev);
 
-                if (status & (TxURN | TxERR | TxIDLE))
+                if (status & (TxURN | TxERR | TxIDLE | TxDESC))
                         /* Tx interrupt */
                         sis900_finish_xmit(net_dev);
 
@@ -1896,8 +1896,8 @@ static void sis900_finish_xmit (struct net_device *net_dev)
 
                 if (tx_status & OWN) {
                         /* The packet is not transmitted yet (owned by hardware) !
-                         * Note: the interrupt is generated only when Tx Machine
-                         * is idle, so this is an almost impossible case */
+                         * Note: this is an almost impossible condition
+                         * in case of TxDESC ('descriptor interrupt') */
                         break;
                 }
 
@@ -2473,7 +2473,7 @@ static int sis900_resume(struct pci_dev *pci_dev)
         sis900_set_mode(sis_priv, HW_SPEED_10_MBPS, FDX_CAPABLE_HALF_SELECTED);
 
         /* Enable all known interrupts by setting the interrupt mask. */
-        sw32(imr, RxSOVR | RxORN | RxERR | RxOK | TxURN | TxERR | TxIDLE);
+        sw32(imr, RxSOVR | RxORN | RxERR | RxOK | TxURN | TxERR | TxIDLE | TxDESC);
         sw32(cr, RxENA | sr32(cr));
         sw32(ier, IE);
 
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_hwtstamp.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_hwtstamp.c
index 2dcdf761d525..020159622559 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_hwtstamp.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_hwtstamp.c
@@ -112,7 +112,7 @@ static int adjust_systime(void __iomem *ioaddr, u32 sec, u32 nsec,
                  * programmed with (2^32 – <new_sec_value>)
                  */
                 if (gmac4)
-                        sec = (100000000ULL - sec);
+                        sec = -sec;
 
                 value = readl(ioaddr + PTP_TCR);
                 if (value & PTP_TCR_TSCTRLSSR)
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
index 06dd51f47cfd..06358fe5b245 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
@@ -2947,12 +2947,15 @@ static netdev_tx_t stmmac_tso_xmit(struct sk_buff *skb, struct net_device *dev)
 
         /* Manage tx mitigation */
         tx_q->tx_count_frames += nfrags + 1;
-        if (priv->tx_coal_frames <= tx_q->tx_count_frames) {
+        if (likely(priv->tx_coal_frames > tx_q->tx_count_frames) &&
+            !(priv->synopsys_id >= DWMAC_CORE_4_00 &&
+            (skb_shinfo(skb)->tx_flags & SKBTX_HW_TSTAMP) &&
+            priv->hwts_tx_en)) {
+                stmmac_tx_timer_arm(priv, queue);
+        } else {
+                tx_q->tx_count_frames = 0;
                 stmmac_set_tx_ic(priv, desc);
                 priv->xstats.tx_set_ic_bit++;
-                tx_q->tx_count_frames = 0;
-        } else {
-                stmmac_tx_timer_arm(priv, queue);
         }
 
         skb_tx_timestamp(skb);
@@ -3166,12 +3169,15 @@ static netdev_tx_t stmmac_xmit(struct sk_buff *skb, struct net_device *dev)
          * element in case of no SG.
          */
         tx_q->tx_count_frames += nfrags + 1;
-        if (priv->tx_coal_frames <= tx_q->tx_count_frames) {
+        if (likely(priv->tx_coal_frames > tx_q->tx_count_frames) &&
+            !(priv->synopsys_id >= DWMAC_CORE_4_00 &&
+            (skb_shinfo(skb)->tx_flags & SKBTX_HW_TSTAMP) &&
+            priv->hwts_tx_en)) {
+                stmmac_tx_timer_arm(priv, queue);
+        } else {
+                tx_q->tx_count_frames = 0;
                 stmmac_set_tx_ic(priv, desc);
                 priv->xstats.tx_set_ic_bit++;
-                tx_q->tx_count_frames = 0;
-        } else {
-                stmmac_tx_timer_arm(priv, queue);
         }
 
         skb_tx_timestamp(skb);
diff --git a/drivers/net/ppp/ppp_mppe.c b/drivers/net/ppp/ppp_mppe.c
index ff61dd8748de..66c8e65f6872 100644
--- a/drivers/net/ppp/ppp_mppe.c
+++ b/drivers/net/ppp/ppp_mppe.c
@@ -63,6 +63,7 @@ MODULE_AUTHOR("Frank Cusack <fcusack@fcusack.com>");
 MODULE_DESCRIPTION("Point-to-Point Protocol Microsoft Point-to-Point Encryption support");
 MODULE_LICENSE("Dual BSD/GPL");
 MODULE_ALIAS("ppp-compress-" __stringify(CI_MPPE));
+MODULE_SOFTDEP("pre: arc4");
 MODULE_VERSION("1.0.2");
 
 static unsigned int
diff --git a/drivers/net/team/team.c b/drivers/net/team/team.c
index b48006e7fa2f..36916bf51ee6 100644
--- a/drivers/net/team/team.c
+++ b/drivers/net/team/team.c
@@ -2128,12 +2128,12 @@ static void team_setup(struct net_device *dev)
         dev->features |= NETIF_F_NETNS_LOCAL;
 
         dev->hw_features = TEAM_VLAN_FEATURES |
-                           NETIF_F_HW_VLAN_CTAG_TX |
                            NETIF_F_HW_VLAN_CTAG_RX |
                            NETIF_F_HW_VLAN_CTAG_FILTER;
 
         dev->hw_features |= NETIF_F_GSO_ENCAP_ALL | NETIF_F_GSO_UDP_L4;
         dev->features |= dev->hw_features;
+        dev->features |= NETIF_F_HW_VLAN_CTAG_TX | NETIF_F_HW_VLAN_STAG_TX;
 }
 
 static int team_newlink(struct net *src_net, struct net_device *dev,
diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
index d080f8048e52..8b4ad10cf940 100644
--- a/drivers/net/usb/qmi_wwan.c
+++ b/drivers/net/usb/qmi_wwan.c
@@ -1482,7 +1482,7 @@ static int qmi_wwan_probe(struct usb_interface *intf,
          * different. Ignore the current interface if the number of endpoints
          * equals the number for the diag interface (two).
          */
-        info = (void *)&id->driver_info;
+        info = (void *)id->driver_info;
 
         if (info->data & QMI_WWAN_QUIRK_QUECTEL_DYNCFG) {
                 if (desc->bNumEndpoints == 2)
diff --git a/drivers/net/vrf.c b/drivers/net/vrf.c
index 11b9525dff27..311b0cc6eb98 100644
--- a/drivers/net/vrf.c
+++ b/drivers/net/vrf.c
@@ -350,8 +350,8 @@ static int vrf_finish_output6(struct net *net, struct sock *sk,
 {
         struct dst_entry *dst = skb_dst(skb);
         struct net_device *dev = dst->dev;
+        const struct in6_addr *nexthop;
         struct neighbour *neigh;
-        struct in6_addr *nexthop;
         int ret;
 
         nf_reset(skb);
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/ftm-initiator.c b/drivers/net/wireless/intel/iwlwifi/mvm/ftm-initiator.c
index fec38a47696e..9f4b117db9d7 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/ftm-initiator.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/ftm-initiator.c
@@ -93,7 +93,7 @@ void iwl_mvm_ftm_restart(struct iwl_mvm *mvm)
         struct cfg80211_pmsr_result result = {
                 .status = NL80211_PMSR_STATUS_FAILURE,
                 .final = 1,
-                .host_time = ktime_get_boot_ns(),
+                .host_time = ktime_get_boottime_ns(),
                 .type = NL80211_PMSR_TYPE_FTM,
         };
         int i;
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/rx.c b/drivers/net/wireless/intel/iwlwifi/mvm/rx.c
index fbd3014e8b82..160b0db27103 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/rx.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/rx.c
@@ -555,7 +555,7 @@ void iwl_mvm_rx_rx_mpdu(struct iwl_mvm *mvm, struct napi_struct *napi,
 
         if (unlikely(ieee80211_is_beacon(hdr->frame_control) ||
                      ieee80211_is_probe_resp(hdr->frame_control)))
-                rx_status->boottime_ns = ktime_get_boot_ns();
+                rx_status->boottime_ns = ktime_get_boottime_ns();
 
         /* Take a reference briefly to kick off a d0i3 entry delay so
          * we can handle bursts of RX packets without toggling the
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c b/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c
index 1824566d08fc..64f950501287 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c
@@ -1684,7 +1684,7 @@ void iwl_mvm_rx_mpdu_mq(struct iwl_mvm *mvm, struct napi_struct *napi,
 
                 if (unlikely(ieee80211_is_beacon(hdr->frame_control) ||
                              ieee80211_is_probe_resp(hdr->frame_control)))
-                        rx_status->boottime_ns = ktime_get_boot_ns();
+                        rx_status->boottime_ns = ktime_get_boottime_ns();
         }
 
         if (iwl_mvm_create_skb(mvm, skb, hdr, len, crypt_len, rxb)) {
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/utils.c b/drivers/net/wireless/intel/iwlwifi/mvm/utils.c
index cc56ab88fb43..72cd5b3f2d8d 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/utils.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/utils.c
@@ -1445,7 +1445,7 @@ void iwl_mvm_get_sync_time(struct iwl_mvm *mvm, u32 *gp2, u64 *boottime)
         }
 
         *gp2 = iwl_mvm_get_systime(mvm);
-        *boottime = ktime_get_boot_ns();
+        *boottime = ktime_get_boottime_ns();
 
         if (!ps_disabled) {
                 mvm->ps_disabled = ps_disabled;
diff --git a/drivers/net/wireless/mac80211_hwsim.c b/drivers/net/wireless/mac80211_hwsim.c
index 1c699a9fa866..a7bf6519d7aa 100644
--- a/drivers/net/wireless/mac80211_hwsim.c
+++ b/drivers/net/wireless/mac80211_hwsim.c
@@ -1271,7 +1271,7 @@ static bool mac80211_hwsim_tx_frame_no_nl(struct ieee80211_hw *hw,
          */
         if (ieee80211_is_beacon(hdr->frame_control) ||
             ieee80211_is_probe_resp(hdr->frame_control)) {
-                rx_status.boottime_ns = ktime_get_boot_ns();
+                rx_status.boottime_ns = ktime_get_boottime_ns();
                 now = data->abs_bcn_ts;
         } else {
                 now = mac80211_hwsim_get_tsf_raw();
diff --git a/drivers/net/wireless/ti/wlcore/main.c b/drivers/net/wireless/ti/wlcore/main.c
index c9a485ecee7b..b74dc8bc9755 100644
--- a/drivers/net/wireless/ti/wlcore/main.c
+++ b/drivers/net/wireless/ti/wlcore/main.c
@@ -483,7 +483,7 @@ static int wlcore_fw_status(struct wl1271 *wl, struct wl_fw_status *status)
         }
 
         /* update the host-chipset time offset */
-        wl->time_offset = (ktime_get_boot_ns() >> 10) -
+        wl->time_offset = (ktime_get_boottime_ns() >> 10) -
                 (s64)(status->fw_localtime);
 
         wl->fw_fast_lnk_map = status->link_fast_bitmap;
diff --git a/drivers/net/wireless/ti/wlcore/rx.c b/drivers/net/wireless/ti/wlcore/rx.c
index d96bb602fae6..307fab21050b 100644
--- a/drivers/net/wireless/ti/wlcore/rx.c
+++ b/drivers/net/wireless/ti/wlcore/rx.c
@@ -93,7 +93,7 @@ static void wl1271_rx_status(struct wl1271 *wl,
         }
 
         if (beacon || probe_rsp)
-                status->boottime_ns = ktime_get_boot_ns();
+                status->boottime_ns = ktime_get_boottime_ns();
 
         if (beacon)
                 wlcore_set_pending_regdomain_ch(wl, (u16)desc->channel,
diff --git a/drivers/net/wireless/ti/wlcore/tx.c b/drivers/net/wireless/ti/wlcore/tx.c
index 057c6be330e7..90e56d4c3df3 100644
--- a/drivers/net/wireless/ti/wlcore/tx.c
+++ b/drivers/net/wireless/ti/wlcore/tx.c
@@ -273,7 +273,7 @@ static void wl1271_tx_fill_hdr(struct wl1271 *wl, struct wl12xx_vif *wlvif,
         }
 
         /* configure packet life time */
-        hosttime = (ktime_get_boot_ns() >> 10);
+        hosttime = (ktime_get_boottime_ns() >> 10);
         desc->start_time = cpu_to_le32(hosttime - wl->time_offset);
 
         is_dummy = wl12xx_is_dummy_packet(wl, skb);
diff --git a/drivers/net/wireless/virt_wifi.c b/drivers/net/wireless/virt_wifi.c
index 606999f102eb..be92e1220284 100644
--- a/drivers/net/wireless/virt_wifi.c
+++ b/drivers/net/wireless/virt_wifi.c
@@ -172,7 +172,7 @@ static void virt_wifi_scan_result(struct work_struct *work)
         informed_bss = cfg80211_inform_bss(wiphy, &channel_5ghz,
                                            CFG80211_BSS_FTYPE_PRESP,
                                            fake_router_bssid,
-                                           ktime_get_boot_ns(),
+                                           ktime_get_boottime_ns(),
                                            WLAN_CAPABILITY_ESS, 0,
                                            (void *)&ssid, sizeof(ssid),
                                            DBM_TO_MBM(-50), GFP_KERNEL);
diff --git a/drivers/pci/pci-driver.c b/drivers/pci/pci-driver.c
index 98af9ecd4a90..ca3793002e2f 100644
--- a/drivers/pci/pci-driver.c
+++ b/drivers/pci/pci-driver.c
@@ -859,7 +859,7 @@ static int pci_pm_suspend_noirq(struct device *dev)
                         pci_dev->bus->self->skip_bus_pm = true;
         }
 
-        if (pci_dev->skip_bus_pm && !pm_suspend_via_firmware()) {
+        if (pci_dev->skip_bus_pm && pm_suspend_no_platform()) {
                 dev_dbg(dev, "PCI PM: Skipped\n");
                 goto Fixup;
         }
@@ -914,10 +914,10 @@ static int pci_pm_resume_noirq(struct device *dev)
         /*
          * In the suspend-to-idle case, devices left in D0 during suspend will
          * stay in D0, so it is not necessary to restore or update their
-         * configuration here and attempting to put them into D0 again may
-         * confuse some firmware, so avoid doing that.
+         * configuration here and attempting to put them into D0 again is
+         * pointless, so avoid doing that.
          */
-        if (!pci_dev->skip_bus_pm || pm_suspend_via_firmware())
+        if (!(pci_dev->skip_bus_pm && pm_suspend_no_platform()))
                 pci_pm_default_resume_early(pci_dev);
 
         pci_fixup_device(pci_fixup_resume_early, pci_dev);
diff --git a/drivers/perf/Kconfig b/drivers/perf/Kconfig
index e4221a107dca..09ae8a970880 100644
--- a/drivers/perf/Kconfig
+++ b/drivers/perf/Kconfig
@@ -71,6 +71,14 @@ config ARM_DSU_PMU
           system, control logic. The PMU allows counting various events related
           to DSU.
 
+config FSL_IMX8_DDR_PMU
+        tristate "Freescale i.MX8 DDR perf monitor"
+        depends on ARCH_MXC
+          help
+          Provides support for the DDR performance monitor in i.MX8, which
+          can give information about memory throughput and other related
+          events.
+
 config HISI_PMU
        bool "HiSilicon SoC PMU"
        depends on ARM64 && ACPI
diff --git a/drivers/perf/Makefile b/drivers/perf/Makefile
index 30489941f3d6..2ebb4de17815 100644
--- a/drivers/perf/Makefile
+++ b/drivers/perf/Makefile
@@ -5,6 +5,7 @@ obj-$(CONFIG_ARM_DSU_PMU) += arm_dsu_pmu.o
 obj-$(CONFIG_ARM_PMU) += arm_pmu.o arm_pmu_platform.o
 obj-$(CONFIG_ARM_PMU_ACPI) += arm_pmu_acpi.o
 obj-$(CONFIG_ARM_SMMU_V3_PMU) += arm_smmuv3_pmu.o
+obj-$(CONFIG_FSL_IMX8_DDR_PMU) += fsl_imx8_ddr_perf.o
 obj-$(CONFIG_HISI_PMU) += hisilicon/
 obj-$(CONFIG_QCOM_L2_PMU)       += qcom_l2_pmu.o
 obj-$(CONFIG_QCOM_L3_PMU) += qcom_l3_pmu.o
diff --git a/drivers/perf/arm_pmu_acpi.c b/drivers/perf/arm_pmu_acpi.c
index d2c2978409d2..acce8781c456 100644
--- a/drivers/perf/arm_pmu_acpi.c
+++ b/drivers/perf/arm_pmu_acpi.c
@@ -71,6 +71,76 @@ static void arm_pmu_acpi_unregister_irq(int cpu)
         acpi_unregister_gsi(gsi);
 }
 
+#if IS_ENABLED(CONFIG_ARM_SPE_PMU)
+static struct resource spe_resources[] = {
+        {
+                /* irq */
+                .flags          = IORESOURCE_IRQ,
+        }
+};
+
+static struct platform_device spe_dev = {
+        .name = ARMV8_SPE_PDEV_NAME,
+        .id = -1,
+        .resource = spe_resources,
+        .num_resources = ARRAY_SIZE(spe_resources)
+};
+
+/*
+ * For lack of a better place, hook the normal PMU MADT walk
+ * and create a SPE device if we detect a recent MADT with
+ * a homogeneous PPI mapping.
+ */
+static void arm_spe_acpi_register_device(void)
+{
+        int cpu, hetid, irq, ret;
+        bool first = true;
+        u16 gsi = 0;
+
+        /*
+         * Sanity check all the GICC tables for the same interrupt number.
+         * For now, we only support homogeneous ACPI/SPE machines.
+         */
+        for_each_possible_cpu(cpu) {
+                struct acpi_madt_generic_interrupt *gicc;
+
+                gicc = acpi_cpu_get_madt_gicc(cpu);
+                if (gicc->header.length < ACPI_MADT_GICC_SPE)
+                        return;
+
+                if (first) {
+                        gsi = gicc->spe_interrupt;
+                        if (!gsi)
+                                return;
+                        hetid = find_acpi_cpu_topology_hetero_id(cpu);
+                        first = false;
+                } else if ((gsi != gicc->spe_interrupt) ||
+                           (hetid != find_acpi_cpu_topology_hetero_id(cpu))) {
+                        pr_warn("ACPI: SPE must be homogeneous\n");
+                        return;
+                }
+        }
+
+        irq = acpi_register_gsi(NULL, gsi, ACPI_LEVEL_SENSITIVE,
+                                ACPI_ACTIVE_HIGH);
+        if (irq < 0) {
+                pr_warn("ACPI: SPE Unable to register interrupt: %d\n", gsi);
+                return;
+        }
+
+        spe_resources[0].start = irq;
+        ret = platform_device_register(&spe_dev);
+        if (ret < 0) {
+                pr_warn("ACPI: SPE: Unable to register device\n");
+                acpi_unregister_gsi(gsi);
+        }
+}
+#else
+static inline void arm_spe_acpi_register_device(void)
+{
+}
+#endif /* CONFIG_ARM_SPE_PMU */
+
 static int arm_pmu_acpi_parse_irqs(void)
 {
         int irq, cpu, irq_cpu, err;
@@ -276,6 +346,8 @@ static int arm_pmu_acpi_init(void)
         if (acpi_disabled)
                 return 0;
 
+        arm_spe_acpi_register_device();
+
         ret = arm_pmu_acpi_parse_irqs();
         if (ret)
                 return ret;
diff --git a/drivers/perf/arm_spe_pmu.c b/drivers/perf/arm_spe_pmu.c
index 49b490925255..4e4984a55cd1 100644
--- a/drivers/perf/arm_spe_pmu.c
+++ b/drivers/perf/arm_spe_pmu.c
@@ -27,6 +27,7 @@
 #include <linux/of_address.h>
 #include <linux/of_device.h>
 #include <linux/perf_event.h>
+#include <linux/perf/arm_pmu.h>
 #include <linux/platform_device.h>
 #include <linux/printk.h>
 #include <linux/slab.h>
@@ -1157,7 +1158,13 @@ static const struct of_device_id arm_spe_pmu_of_match[] = {
 };
 MODULE_DEVICE_TABLE(of, arm_spe_pmu_of_match);
 
-static int arm_spe_pmu_device_dt_probe(struct platform_device *pdev)
+static const struct platform_device_id arm_spe_match[] = {
+        { ARMV8_SPE_PDEV_NAME, 0},
+        { }
+};
+MODULE_DEVICE_TABLE(platform, arm_spe_match);
+
+static int arm_spe_pmu_device_probe(struct platform_device *pdev)
 {
         int ret;
         struct arm_spe_pmu *spe_pmu;
@@ -1217,11 +1224,12 @@ static int arm_spe_pmu_device_remove(struct platform_device *pdev)
 }
 
 static struct platform_driver arm_spe_pmu_driver = {
+        .id_table = arm_spe_match,
         .driver = {
                 .name           = DRVNAME,
                 .of_match_table = of_match_ptr(arm_spe_pmu_of_match),
         },
-        .probe  = arm_spe_pmu_device_dt_probe,
+        .probe  = arm_spe_pmu_device_probe,
         .remove = arm_spe_pmu_device_remove,
 };
 
diff --git a/drivers/perf/fsl_imx8_ddr_perf.c b/drivers/perf/fsl_imx8_ddr_perf.c
new file mode 100644
index 000000000000..63fe21600072
--- /dev/null
+++ b/drivers/perf/fsl_imx8_ddr_perf.c
@@ -0,0 +1,554 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * Copyright 2017 NXP
+ * Copyright 2016 Freescale Semiconductor, Inc.
+ */
+
+#include <linux/bitfield.h>
+#include <linux/init.h>
+#include <linux/interrupt.h>
+#include <linux/io.h>
+#include <linux/module.h>
+#include <linux/of.h>
+#include <linux/of_address.h>
+#include <linux/of_device.h>
+#include <linux/of_irq.h>
+#include <linux/perf_event.h>
+#include <linux/slab.h>
+
+#define COUNTER_CNTL            0x0
+#define COUNTER_READ            0x20
+
+#define COUNTER_DPCR1           0x30
+
+#define CNTL_OVER               0x1
+#define CNTL_CLEAR              0x2
+#define CNTL_EN                 0x4
+#define CNTL_EN_MASK            0xFFFFFFFB
+#define CNTL_CLEAR_MASK         0xFFFFFFFD
+#define CNTL_OVER_MASK          0xFFFFFFFE
+
+#define CNTL_CSV_SHIFT          24
+#define CNTL_CSV_MASK           (0xFF << CNTL_CSV_SHIFT)
+
+#define EVENT_CYCLES_ID         0
+#define EVENT_CYCLES_COUNTER    0
+#define NUM_COUNTERS            4
+
+#define to_ddr_pmu(p)           container_of(p, struct ddr_pmu, pmu)
+
+#define DDR_PERF_DEV_NAME       "imx8_ddr"
+#define DDR_CPUHP_CB_NAME       DDR_PERF_DEV_NAME "_perf_pmu"
+
+static DEFINE_IDA(ddr_ida);
+
+static const struct of_device_id imx_ddr_pmu_dt_ids[] = {
+        { .compatible = "fsl,imx8-ddr-pmu",},
+        { .compatible = "fsl,imx8m-ddr-pmu",},
+        { /* sentinel */ }
+};
+
+struct ddr_pmu {
+        struct pmu pmu;
+        void __iomem *base;
+        unsigned int cpu;
+        struct  hlist_node node;
+        struct  device *dev;
+        struct perf_event *events[NUM_COUNTERS];
+        int active_events;
+        enum cpuhp_state cpuhp_state;
+        int irq;
+        int id;
+};
+
+static ssize_t ddr_perf_cpumask_show(struct device *dev,
+                                struct device_attribute *attr, char *buf)
+{
+        struct ddr_pmu *pmu = dev_get_drvdata(dev);
+
+        return cpumap_print_to_pagebuf(true, buf, cpumask_of(pmu->cpu));
+}
+
+static struct device_attribute ddr_perf_cpumask_attr =
+        __ATTR(cpumask, 0444, ddr_perf_cpumask_show, NULL);
+
+static struct attribute *ddr_perf_cpumask_attrs[] = {
+        &ddr_perf_cpumask_attr.attr,
+        NULL,
+};
+
+static struct attribute_group ddr_perf_cpumask_attr_group = {
+        .attrs = ddr_perf_cpumask_attrs,
+};
+
+static ssize_t
+ddr_pmu_event_show(struct device *dev, struct device_attribute *attr,
+                   char *page)
+{
+        struct perf_pmu_events_attr *pmu_attr;
+
+        pmu_attr = container_of(attr, struct perf_pmu_events_attr, attr);
+        return sprintf(page, "event=0x%02llx\n", pmu_attr->id);
+}
+
+#define IMX8_DDR_PMU_EVENT_ATTR(_name, _id)                             \
+        (&((struct perf_pmu_events_attr[]) {                            \
+                { .attr = __ATTR(_name, 0444, ddr_pmu_event_show, NULL),\
+                  .id = _id, }                                          \
+        })[0].attr.attr)
+
+static struct attribute *ddr_perf_events_attrs[] = {
+        IMX8_DDR_PMU_EVENT_ATTR(cycles, EVENT_CYCLES_ID),
+        IMX8_DDR_PMU_EVENT_ATTR(selfresh, 0x01),
+        IMX8_DDR_PMU_EVENT_ATTR(read-accesses, 0x04),
+        IMX8_DDR_PMU_EVENT_ATTR(write-accesses, 0x05),
+        IMX8_DDR_PMU_EVENT_ATTR(read-queue-depth, 0x08),
+        IMX8_DDR_PMU_EVENT_ATTR(write-queue-depth, 0x09),
+        IMX8_DDR_PMU_EVENT_ATTR(lp-read-credit-cnt, 0x10),
+        IMX8_DDR_PMU_EVENT_ATTR(hp-read-credit-cnt, 0x11),
+        IMX8_DDR_PMU_EVENT_ATTR(write-credit-cnt, 0x12),
+        IMX8_DDR_PMU_EVENT_ATTR(read-command, 0x20),
+        IMX8_DDR_PMU_EVENT_ATTR(write-command, 0x21),
+        IMX8_DDR_PMU_EVENT_ATTR(read-modify-write-command, 0x22),
+        IMX8_DDR_PMU_EVENT_ATTR(hp-read, 0x23),
+        IMX8_DDR_PMU_EVENT_ATTR(hp-req-nocredit, 0x24),
+        IMX8_DDR_PMU_EVENT_ATTR(hp-xact-credit, 0x25),
+        IMX8_DDR_PMU_EVENT_ATTR(lp-req-nocredit, 0x26),
+        IMX8_DDR_PMU_EVENT_ATTR(lp-xact-credit, 0x27),
+        IMX8_DDR_PMU_EVENT_ATTR(wr-xact-credit, 0x29),
+        IMX8_DDR_PMU_EVENT_ATTR(read-cycles, 0x2a),
+        IMX8_DDR_PMU_EVENT_ATTR(write-cycles, 0x2b),
+        IMX8_DDR_PMU_EVENT_ATTR(read-write-transition, 0x30),
+        IMX8_DDR_PMU_EVENT_ATTR(precharge, 0x31),
+        IMX8_DDR_PMU_EVENT_ATTR(activate, 0x32),
+        IMX8_DDR_PMU_EVENT_ATTR(load-mode, 0x33),
+        IMX8_DDR_PMU_EVENT_ATTR(perf-mwr, 0x34),
+        IMX8_DDR_PMU_EVENT_ATTR(read, 0x35),
+        IMX8_DDR_PMU_EVENT_ATTR(read-activate, 0x36),
+        IMX8_DDR_PMU_EVENT_ATTR(refresh, 0x37),
+        IMX8_DDR_PMU_EVENT_ATTR(write, 0x38),
+        IMX8_DDR_PMU_EVENT_ATTR(raw-hazard, 0x39),
+        NULL,
+};
+
+static struct attribute_group ddr_perf_events_attr_group = {
+        .name = "events",
+        .attrs = ddr_perf_events_attrs,
+};
+
+PMU_FORMAT_ATTR(event, "config:0-7");
+
+static struct attribute *ddr_perf_format_attrs[] = {
+        &format_attr_event.attr,
+        NULL,
+};
+
+static struct attribute_group ddr_perf_format_attr_group = {
+        .name = "format",
+        .attrs = ddr_perf_format_attrs,
+};
+
+static const struct attribute_group *attr_groups[] = {
+        &ddr_perf_events_attr_group,
+        &ddr_perf_format_attr_group,
+        &ddr_perf_cpumask_attr_group,
+        NULL,
+};
+
+static u32 ddr_perf_alloc_counter(struct ddr_pmu *pmu, int event)
+{
+        int i;
+
+        /*
+         * Always map cycle event to counter 0
+         * Cycles counter is dedicated for cycle event
+         * can't used for the other events
+         */
+        if (event == EVENT_CYCLES_ID) {
+                if (pmu->events[EVENT_CYCLES_COUNTER] == NULL)
+                        return EVENT_CYCLES_COUNTER;
+                else
+                        return -ENOENT;
+        }
+
+        for (i = 1; i < NUM_COUNTERS; i++) {
+                if (pmu->events[i] == NULL)
+                        return i;
+        }
+
+        return -ENOENT;
+}
+
+static void ddr_perf_free_counter(struct ddr_pmu *pmu, int counter)
+{
+        pmu->events[counter] = NULL;
+}
+
+static u32 ddr_perf_read_counter(struct ddr_pmu *pmu, int counter)
+{
+        return readl_relaxed(pmu->base + COUNTER_READ + counter * 4);
+}
+
+static int ddr_perf_event_init(struct perf_event *event)
+{
+        struct ddr_pmu *pmu = to_ddr_pmu(event->pmu);
+        struct hw_perf_event *hwc = &event->hw;
+        struct perf_event *sibling;
+
+        if (event->attr.type != event->pmu->type)
+                return -ENOENT;
+
+        if (is_sampling_event(event) || event->attach_state & PERF_ATTACH_TASK)
+                return -EOPNOTSUPP;
+
+        if (event->cpu < 0) {
+                dev_warn(pmu->dev, "Can't provide per-task data!\n");
+                return -EOPNOTSUPP;
+        }
+
+        /*
+         * We must NOT create groups containing mixed PMUs, although software
+         * events are acceptable (for example to create a CCN group
+         * periodically read when a hrtimer aka cpu-clock leader triggers).
+         */
+        if (event->group_leader->pmu != event->pmu &&
+                        !is_software_event(event->group_leader))
+                return -EINVAL;
+
+        for_each_sibling_event(sibling, event->group_leader) {
+                if (sibling->pmu != event->pmu &&
+                                !is_software_event(sibling))
+                        return -EINVAL;
+        }
+
+        event->cpu = pmu->cpu;
+        hwc->idx = -1;
+
+        return 0;
+}
+
+
+static void ddr_perf_event_update(struct perf_event *event)
+{
+        struct ddr_pmu *pmu = to_ddr_pmu(event->pmu);
+        struct hw_perf_event *hwc = &event->hw;
+        u64 delta, prev_raw_count, new_raw_count;
+        int counter = hwc->idx;
+
+        do {
+                prev_raw_count = local64_read(&hwc->prev_count);
+                new_raw_count = ddr_perf_read_counter(pmu, counter);
+        } while (local64_cmpxchg(&hwc->prev_count, prev_raw_count,
+                        new_raw_count) != prev_raw_count);
+
+        delta = (new_raw_count - prev_raw_count) & 0xFFFFFFFF;
+
+        local64_add(delta, &event->count);
+}
+
+static void ddr_perf_counter_enable(struct ddr_pmu *pmu, int config,
+                                  int counter, bool enable)
+{
+        u8 reg = counter * 4 + COUNTER_CNTL;
+        int val;
+
+        if (enable) {
+                /*
+                 * must disable first, then enable again
+                 * otherwise, cycle counter will not work
+                 * if previous state is enabled.
+                 */
+                writel(0, pmu->base + reg);
+                val = CNTL_EN | CNTL_CLEAR;
+                val |= FIELD_PREP(CNTL_CSV_MASK, config);
+                writel(val, pmu->base + reg);
+        } else {
+                /* Disable counter */
+                writel(0, pmu->base + reg);
+        }
+}
+
+static void ddr_perf_event_start(struct perf_event *event, int flags)
+{
+        struct ddr_pmu *pmu = to_ddr_pmu(event->pmu);
+        struct hw_perf_event *hwc = &event->hw;
+        int counter = hwc->idx;
+
+        local64_set(&hwc->prev_count, 0);
+
+        ddr_perf_counter_enable(pmu, event->attr.config, counter, true);
+
+        hwc->state = 0;
+}
+
+static int ddr_perf_event_add(struct perf_event *event, int flags)
+{
+        struct ddr_pmu *pmu = to_ddr_pmu(event->pmu);
+        struct hw_perf_event *hwc = &event->hw;
+        int counter;
+        int cfg = event->attr.config;
+
+        counter = ddr_perf_alloc_counter(pmu, cfg);
+        if (counter < 0) {
+                dev_dbg(pmu->dev, "There are not enough counters\n");
+                return -EOPNOTSUPP;
+        }
+
+        pmu->events[counter] = event;
+        pmu->active_events++;
+        hwc->idx = counter;
+
+        hwc->state |= PERF_HES_STOPPED;
+
+        if (flags & PERF_EF_START)
+                ddr_perf_event_start(event, flags);
+
+        return 0;
+}
+
+static void ddr_perf_event_stop(struct perf_event *event, int flags)
+{
+        struct ddr_pmu *pmu = to_ddr_pmu(event->pmu);
+        struct hw_perf_event *hwc = &event->hw;
+        int counter = hwc->idx;
+
+        ddr_perf_counter_enable(pmu, event->attr.config, counter, false);
+        ddr_perf_event_update(event);
+
+        hwc->state |= PERF_HES_STOPPED;
+}
+
+static void ddr_perf_event_del(struct perf_event *event, int flags)
+{
+        struct ddr_pmu *pmu = to_ddr_pmu(event->pmu);
+        struct hw_perf_event *hwc = &event->hw;
+        int counter = hwc->idx;
+
+        ddr_perf_event_stop(event, PERF_EF_UPDATE);
+
+        ddr_perf_free_counter(pmu, counter);
+        pmu->active_events--;
+        hwc->idx = -1;
+}
+
+static void ddr_perf_pmu_enable(struct pmu *pmu)
+{
+        struct ddr_pmu *ddr_pmu = to_ddr_pmu(pmu);
+
+        /* enable cycle counter if cycle is not active event list */
+        if (ddr_pmu->events[EVENT_CYCLES_COUNTER] == NULL)
+                ddr_perf_counter_enable(ddr_pmu,
+                                      EVENT_CYCLES_ID,
+                                      EVENT_CYCLES_COUNTER,
+                                      true);
+}
+
+static void ddr_perf_pmu_disable(struct pmu *pmu)
+{
+        struct ddr_pmu *ddr_pmu = to_ddr_pmu(pmu);
+
+        if (ddr_pmu->events[EVENT_CYCLES_COUNTER] == NULL)
+                ddr_perf_counter_enable(ddr_pmu,
+                                      EVENT_CYCLES_ID,
+                                      EVENT_CYCLES_COUNTER,
+                                      false);
+}
+
+static int ddr_perf_init(struct ddr_pmu *pmu, void __iomem *base,
+                         struct device *dev)
+{
+        *pmu = (struct ddr_pmu) {
+                .pmu = (struct pmu) {
+                        .capabilities = PERF_PMU_CAP_NO_EXCLUDE,
+                        .task_ctx_nr = perf_invalid_context,
+                        .attr_groups = attr_groups,
+                        .event_init  = ddr_perf_event_init,
+                        .add         = ddr_perf_event_add,
+                        .del         = ddr_perf_event_del,
+                        .start       = ddr_perf_event_start,
+                        .stop        = ddr_perf_event_stop,
+                        .read        = ddr_perf_event_update,
+                        .pmu_enable  = ddr_perf_pmu_enable,
+                        .pmu_disable = ddr_perf_pmu_disable,
+                },
+                .base = base,
+                .dev = dev,
+        };
+
+        pmu->id = ida_simple_get(&ddr_ida, 0, 0, GFP_KERNEL);
+        return pmu->id;
+}
+
+static irqreturn_t ddr_perf_irq_handler(int irq, void *p)
+{
+        int i;
+        struct ddr_pmu *pmu = (struct ddr_pmu *) p;
+        struct perf_event *event, *cycle_event = NULL;
+
+        /* all counter will stop if cycle counter disabled */
+        ddr_perf_counter_enable(pmu,
+                              EVENT_CYCLES_ID,
+                              EVENT_CYCLES_COUNTER,
+                              false);
+        /*
+         * When the cycle counter overflows, all counters are stopped,
+         * and an IRQ is raised. If any other counter overflows, it
+         * continues counting, and no IRQ is raised.
+         *
+         * Cycles occur at least 4 times as often as other events, so we
+         * can update all events on a cycle counter overflow and not
+         * lose events.
+         *
+         */
+        for (i = 0; i < NUM_COUNTERS; i++) {
+
+                if (!pmu->events[i])
+                        continue;
+
+                event = pmu->events[i];
+
+                ddr_perf_event_update(event);
+
+                if (event->hw.idx == EVENT_CYCLES_COUNTER)
+                        cycle_event = event;
+        }
+
+        ddr_perf_counter_enable(pmu,
+                              EVENT_CYCLES_ID,
+                              EVENT_CYCLES_COUNTER,
+                              true);
+        if (cycle_event)
+                ddr_perf_event_update(cycle_event);
+
+        return IRQ_HANDLED;
+}
+
+static int ddr_perf_offline_cpu(unsigned int cpu, struct hlist_node *node)
+{
+        struct ddr_pmu *pmu = hlist_entry_safe(node, struct ddr_pmu, node);
+        int target;
+
+        if (cpu != pmu->cpu)
+                return 0;
+
+        target = cpumask_any_but(cpu_online_mask, cpu);
+        if (target >= nr_cpu_ids)
+                return 0;
+
+        perf_pmu_migrate_context(&pmu->pmu, cpu, target);
+        pmu->cpu = target;
+
+        WARN_ON(irq_set_affinity_hint(pmu->irq, cpumask_of(pmu->cpu)));
+
+        return 0;
+}
+
+static int ddr_perf_probe(struct platform_device *pdev)
+{
+        struct ddr_pmu *pmu;
+        struct device_node *np;
+        void __iomem *base;
+        char *name;
+        int num;
+        int ret;
+        int irq;
+
+        base = devm_platform_ioremap_resource(pdev, 0);
+        if (IS_ERR(base))
+                return PTR_ERR(base);
+
+        np = pdev->dev.of_node;
+
+        pmu = devm_kzalloc(&pdev->dev, sizeof(*pmu), GFP_KERNEL);
+        if (!pmu)
+                return -ENOMEM;
+
+        num = ddr_perf_init(pmu, base, &pdev->dev);
+
+        platform_set_drvdata(pdev, pmu);
+
+        name = devm_kasprintf(&pdev->dev, GFP_KERNEL, DDR_PERF_DEV_NAME "%d",
+                              num);
+        if (!name)
+                return -ENOMEM;
+
+        pmu->cpu = raw_smp_processor_id();
+        ret = cpuhp_setup_state_multi(CPUHP_AP_ONLINE_DYN,
+                                      DDR_CPUHP_CB_NAME,
+                                      NULL,
+                                      ddr_perf_offline_cpu);
+
+        if (ret < 0) {
+                dev_err(&pdev->dev, "cpuhp_setup_state_multi failed\n");
+                goto ddr_perf_err;
+        }
+
+        pmu->cpuhp_state = ret;
+
+        /* Register the pmu instance for cpu hotplug */
+        cpuhp_state_add_instance_nocalls(pmu->cpuhp_state, &pmu->node);
+
+        /* Request irq */
+        irq = of_irq_get(np, 0);
+        if (irq < 0) {
+                dev_err(&pdev->dev, "Failed to get irq: %d", irq);
+                ret = irq;
+                goto ddr_perf_err;
+        }
+
+        ret = devm_request_irq(&pdev->dev, irq,
+                                        ddr_perf_irq_handler,
+                                        IRQF_NOBALANCING | IRQF_NO_THREAD,
+                                        DDR_CPUHP_CB_NAME,
+                                        pmu);
+        if (ret < 0) {
+                dev_err(&pdev->dev, "Request irq failed: %d", ret);
+                goto ddr_perf_err;
+        }
+
+        pmu->irq = irq;
+        ret = irq_set_affinity_hint(pmu->irq, cpumask_of(pmu->cpu));
+        if (ret) {
+                dev_err(pmu->dev, "Failed to set interrupt affinity!\n");
+                goto ddr_perf_err;
+        }
+
+        ret = perf_pmu_register(&pmu->pmu, name, -1);
+        if (ret)
+                goto ddr_perf_err;
+
+        return 0;
+
+ddr_perf_err:
+        if (pmu->cpuhp_state)
+                cpuhp_state_remove_instance_nocalls(pmu->cpuhp_state, &pmu->node);
+
+        ida_simple_remove(&ddr_ida, pmu->id);
+        dev_warn(&pdev->dev, "i.MX8 DDR Perf PMU failed (%d), disabled\n", ret);
+        return ret;
+}
+
+static int ddr_perf_remove(struct platform_device *pdev)
+{
+        struct ddr_pmu *pmu = platform_get_drvdata(pdev);
+
+        cpuhp_state_remove_instance_nocalls(pmu->cpuhp_state, &pmu->node);
+        irq_set_affinity_hint(pmu->irq, NULL);
+
+        perf_pmu_unregister(&pmu->pmu);
+
+        ida_simple_remove(&ddr_ida, pmu->id);
+        return 0;
+}
+
+static struct platform_driver imx_ddr_pmu_driver = {
+        .driver         = {
+                .name   = "imx-ddr-pmu",
+                .of_match_table = imx_ddr_pmu_dt_ids,
+        },
+        .probe          = ddr_perf_probe,
+        .remove         = ddr_perf_remove,
+};
+
+module_platform_driver(imx_ddr_pmu_driver);
+MODULE_LICENSE("GPL v2");
diff --git a/drivers/pinctrl/mediatek/mtk-eint.c b/drivers/pinctrl/mediatek/mtk-eint.c
index f464f8cd274b..7e526bcf5e0b 100644
--- a/drivers/pinctrl/mediatek/mtk-eint.c
+++ b/drivers/pinctrl/mediatek/mtk-eint.c
@@ -113,6 +113,8 @@ static void mtk_eint_mask(struct irq_data *d)
         void __iomem *reg = mtk_eint_get_offset(eint, d->hwirq,
                                                 eint->regs->mask_set);
 
+        eint->cur_mask[d->hwirq >> 5] &= ~mask;
+
         writel(mask, reg);
 }
 
@@ -123,6 +125,8 @@ static void mtk_eint_unmask(struct irq_data *d)
         void __iomem *reg = mtk_eint_get_offset(eint, d->hwirq,
                                                 eint->regs->mask_clr);
 
+        eint->cur_mask[d->hwirq >> 5] |= mask;
+
         writel(mask, reg);
 
         if (eint->dual_edge[d->hwirq])
@@ -217,19 +221,6 @@ static void mtk_eint_chip_write_mask(const struct mtk_eint *eint,
         }
 }
 
-static void mtk_eint_chip_read_mask(const struct mtk_eint *eint,
-                                    void __iomem *base, u32 *buf)
-{
-        int port;
-        void __iomem *reg;
-
-        for (port = 0; port < eint->hw->ports; port++) {
-                reg = base + eint->regs->mask + (port << 2);
-                buf[port] = ~readl_relaxed(reg);
-                /* Mask is 0 when irq is enabled, and 1 when disabled. */
-        }
-}
-
 static int mtk_eint_irq_request_resources(struct irq_data *d)
 {
         struct mtk_eint *eint = irq_data_get_irq_chip_data(d);
@@ -318,7 +309,7 @@ static void mtk_eint_irq_handler(struct irq_desc *desc)
         struct irq_chip *chip = irq_desc_get_chip(desc);
         struct mtk_eint *eint = irq_desc_get_handler_data(desc);
         unsigned int status, eint_num;
-        int offset, index, virq;
+        int offset, mask_offset, index, virq;
         void __iomem *reg =  mtk_eint_get_offset(eint, 0, eint->regs->stat);
         int dual_edge, start_level, curr_level;
 
@@ -328,10 +319,24 @@ static void mtk_eint_irq_handler(struct irq_desc *desc)
                 status = readl(reg);
                 while (status) {
                         offset = __ffs(status);
+                        mask_offset = eint_num >> 5;
                         index = eint_num + offset;
                         virq = irq_find_mapping(eint->domain, index);
                         status &= ~BIT(offset);
 
+                        /*
+                         * If we get an interrupt on pin that was only required
+                         * for wake (but no real interrupt requested), mask the
+                         * interrupt (as would mtk_eint_resume do anyway later
+                         * in the resume sequence).
+                         */
+                        if (eint->wake_mask[mask_offset] & BIT(offset) &&
+                            !(eint->cur_mask[mask_offset] & BIT(offset))) {
+                                writel_relaxed(BIT(offset), reg -
+                                        eint->regs->stat +
+                                        eint->regs->mask_set);
+                        }
+
                         dual_edge = eint->dual_edge[index];
                         if (dual_edge) {
                                 /*
@@ -370,7 +375,6 @@ static void mtk_eint_irq_handler(struct irq_desc *desc)
 
 int mtk_eint_do_suspend(struct mtk_eint *eint)
 {
-        mtk_eint_chip_read_mask(eint, eint->base, eint->cur_mask);
         mtk_eint_chip_write_mask(eint, eint->base, eint->wake_mask);
 
         return 0;
diff --git a/drivers/pinctrl/pinctrl-mcp23s08.c b/drivers/pinctrl/pinctrl-mcp23s08.c
index 568ca96cdb6d..3a235487e38d 100644
--- a/drivers/pinctrl/pinctrl-mcp23s08.c
+++ b/drivers/pinctrl/pinctrl-mcp23s08.c
@@ -771,6 +771,10 @@ static int mcp23s08_probe_one(struct mcp23s08 *mcp, struct device *dev,
         if (ret < 0)
                 goto fail;
 
+        ret = devm_gpiochip_add_data(dev, &mcp->chip, mcp);
+        if (ret < 0)
+                goto fail;
+
         mcp->irq_controller =
                 device_property_read_bool(dev, "interrupt-controller");
         if (mcp->irq && mcp->irq_controller) {
@@ -812,10 +816,6 @@ static int mcp23s08_probe_one(struct mcp23s08 *mcp, struct device *dev,
                         goto fail;
         }
 
-        ret = devm_gpiochip_add_data(dev, &mcp->chip, mcp);
-        if (ret < 0)
-                goto fail;
-
         if (one_regmap_config) {
                 mcp->pinctrl_desc.name = devm_kasprintf(dev, GFP_KERNEL,
                                 "mcp23xxx-pinctrl.%d", raw_chip_address);
diff --git a/drivers/pinctrl/pinctrl-ocelot.c b/drivers/pinctrl/pinctrl-ocelot.c
index 3b4ca52d2456..fb76fb2e9ea5 100644
--- a/drivers/pinctrl/pinctrl-ocelot.c
+++ b/drivers/pinctrl/pinctrl-ocelot.c
@@ -396,7 +396,7 @@ static int ocelot_pin_function_idx(struct ocelot_pinctrl *info,
         return -1;
 }
 
-#define REG(r, info, p) ((r) * (info)->stride + (4 * ((p) / 32)))
+#define REG_ALT(msb, info, p) (OCELOT_GPIO_ALT0 * (info)->stride + 4 * ((msb) + ((info)->stride * ((p) / 32))))
 
 static int ocelot_pinmux_set_mux(struct pinctrl_dev *pctldev,
                                  unsigned int selector, unsigned int group)
@@ -412,19 +412,21 @@ static int ocelot_pinmux_set_mux(struct pinctrl_dev *pctldev,
 
         /*
          * f is encoded on two bits.
-         * bit 0 of f goes in BIT(pin) of ALT0, bit 1 of f goes in BIT(pin) of
-         * ALT1
+         * bit 0 of f goes in BIT(pin) of ALT[0], bit 1 of f goes in BIT(pin) of
+         * ALT[1]
          * This is racy because both registers can't be updated at the same time
          * but it doesn't matter much for now.
          */
-        regmap_update_bits(info->map, REG(OCELOT_GPIO_ALT0, info, pin->pin),
+        regmap_update_bits(info->map, REG_ALT(0, info, pin->pin),
                            BIT(p), f << p);
-        regmap_update_bits(info->map, REG(OCELOT_GPIO_ALT1, info, pin->pin),
+        regmap_update_bits(info->map, REG_ALT(1, info, pin->pin),
                            BIT(p), f << (p - 1));
 
         return 0;
 }
 
+#define REG(r, info, p) ((r) * (info)->stride + (4 * ((p) / 32)))
+
 static int ocelot_gpio_set_direction(struct pinctrl_dev *pctldev,
                                      struct pinctrl_gpio_range *range,
                                      unsigned int pin, bool input)
@@ -432,7 +434,7 @@ static int ocelot_gpio_set_direction(struct pinctrl_dev *pctldev,
         struct ocelot_pinctrl *info = pinctrl_dev_get_drvdata(pctldev);
         unsigned int p = pin % 32;
 
-        regmap_update_bits(info->map, REG(OCELOT_GPIO_OE, info, p), BIT(p),
+        regmap_update_bits(info->map, REG(OCELOT_GPIO_OE, info, pin), BIT(p),
                            input ? 0 : BIT(p));
 
         return 0;
@@ -445,9 +447,9 @@ static int ocelot_gpio_request_enable(struct pinctrl_dev *pctldev,
         struct ocelot_pinctrl *info = pinctrl_dev_get_drvdata(pctldev);
         unsigned int p = offset % 32;
 
-        regmap_update_bits(info->map, REG(OCELOT_GPIO_ALT0, info, offset),
+        regmap_update_bits(info->map, REG_ALT(0, info, offset),
                            BIT(p), 0);
-        regmap_update_bits(info->map, REG(OCELOT_GPIO_ALT1, info, offset),
+        regmap_update_bits(info->map, REG_ALT(1, info, offset),
                            BIT(p), 0);
 
         return 0;
diff --git a/drivers/ras/cec.c b/drivers/ras/cec.c
index 673f8a128397..5d545806d930 100644
--- a/drivers/ras/cec.c
+++ b/drivers/ras/cec.c
@@ -1,4 +1,7 @@
 // SPDX-License-Identifier: GPL-2.0
+/*
+ * Copyright (c) 2017-2019 Borislav Petkov, SUSE Labs.
+ */
 #include <linux/mm.h>
 #include <linux/gfp.h>
 #include <linux/kernel.h>
@@ -37,9 +40,9 @@
  * thus emulate an an LRU-like behavior when deleting elements to free up space
  * in the page.
  *
- * When an element reaches it's max count of count_threshold, we try to poison
- * it by assuming that errors triggered count_threshold times in a single page
- * are excessive and that page shouldn't be used anymore. count_threshold is
+ * When an element reaches it's max count of action_threshold, we try to poison
+ * it by assuming that errors triggered action_threshold times in a single page
+ * are excessive and that page shouldn't be used anymore. action_threshold is
  * initialized to COUNT_MASK which is the maximum.
  *
  * That error event entry causes cec_add_elem() to return !0 value and thus
@@ -122,7 +125,7 @@ static DEFINE_MUTEX(ce_mutex);
 static u64 dfs_pfn;
 
 /* Amount of errors after which we offline */
-static unsigned int count_threshold = COUNT_MASK;
+static u64 action_threshold = COUNT_MASK;
 
 /* Each element "decays" each decay_interval which is 24hrs by default. */
 #define CEC_DECAY_DEFAULT_INTERVAL      24 * 60 * 60    /* 24 hrs */
@@ -276,11 +279,39 @@ static u64 __maybe_unused del_lru_elem(void)
         return pfn;
 }
 
+static bool sanity_check(struct ce_array *ca)
+{
+        bool ret = false;
+        u64 prev = 0;
+        int i;
+
+        for (i = 0; i < ca->n; i++) {
+                u64 this = PFN(ca->array[i]);
+
+                if (WARN(prev > this, "prev: 0x%016llx <-> this: 0x%016llx\n", prev, this))
+                        ret = true;
+
+                prev = this;
+        }
+
+        if (!ret)
+                return ret;
+
+        pr_info("Sanity check dump:\n{ n: %d\n", ca->n);
+        for (i = 0; i < ca->n; i++) {
+                u64 this = PFN(ca->array[i]);
+
+                pr_info(" %03d: [%016llx|%03llx]\n", i, this, FULL_COUNT(ca->array[i]));
+        }
+        pr_info("}\n");
+
+        return ret;
+}
 
 int cec_add_elem(u64 pfn)
 {
         struct ce_array *ca = &ce_arr;
-        unsigned int to;
+        unsigned int to = 0;
         int count, ret = 0;
 
         /*
@@ -294,6 +325,7 @@ int cec_add_elem(u64 pfn)
 
         ca->ces_entered++;
 
+        /* Array full, free the LRU slot. */
         if (ca->n == MAX_ELEMS)
                 WARN_ON(!del_lru_elem_unlocked(ca));
 
@@ -306,24 +338,17 @@ int cec_add_elem(u64 pfn)
                         (void *)&ca->array[to],
                         (ca->n - to) * sizeof(u64));
 
-                ca->array[to] = (pfn << PAGE_SHIFT) |
-                                (DECAY_MASK << COUNT_BITS) | 1;
-
+                ca->array[to] = pfn << PAGE_SHIFT;
                 ca->n++;
-
-                ret = 0;
-
-                goto decay;
         }
 
-        count = COUNT(ca->array[to]);
-
-        if (count < count_threshold) {
-                ca->array[to] |= (DECAY_MASK << COUNT_BITS);
-                ca->array[to]++;
+        /* Add/refresh element generation and increment count */
+        ca->array[to] |= DECAY_MASK << COUNT_BITS;
+        ca->array[to]++;
 
-                ret = 0;
-        } else {
+        /* Check action threshold and soft-offline, if reached. */
+        count = COUNT(ca->array[to]);
+        if (count >= action_threshold) {
                 u64 pfn = ca->array[to] >> PAGE_SHIFT;
 
                 if (!pfn_valid(pfn)) {
@@ -338,20 +363,21 @@ int cec_add_elem(u64 pfn)
                 del_elem(ca, to);
 
                 /*
-                 * Return a >0 value to denote that we've reached the offlining
-                 * threshold.
+                 * Return a >0 value to callers, to denote that we've reached
+                 * the offlining threshold.
                  */
                 ret = 1;
 
                 goto unlock;
         }
 
-decay:
         ca->decay_count++;
 
         if (ca->decay_count >= CLEAN_ELEMS)
                 do_spring_cleaning(ca);
 
+        WARN_ON_ONCE(sanity_check(ca));
+
 unlock:
         mutex_unlock(&ce_mutex);
 
@@ -369,45 +395,48 @@ static int pfn_set(void *data, u64 val)
 {
         *(u64 *)data = val;
 
-        return cec_add_elem(val);
+        cec_add_elem(val);
+
+        return 0;
 }
 
 DEFINE_DEBUGFS_ATTRIBUTE(pfn_ops, u64_get, pfn_set, "0x%llx\n");
 
 static int decay_interval_set(void *data, u64 val)
 {
-        *(u64 *)data = val;
-
         if (val < CEC_DECAY_MIN_INTERVAL)
                 return -EINVAL;
 
         if (val > CEC_DECAY_MAX_INTERVAL)
                 return -EINVAL;
 
+        *(u64 *)data   = val;
         decay_interval = val;
 
         cec_mod_work(decay_interval);
+
         return 0;
 }
 DEFINE_DEBUGFS_ATTRIBUTE(decay_interval_ops, u64_get, decay_interval_set, "%lld\n");
 
-static int count_threshold_set(void *data, u64 val)
+static int action_threshold_set(void *data, u64 val)
 {
         *(u64 *)data = val;
 
         if (val > COUNT_MASK)
                 val = COUNT_MASK;
 
-        count_threshold = val;
+        action_threshold = val;
 
         return 0;
 }
-DEFINE_DEBUGFS_ATTRIBUTE(count_threshold_ops, u64_get, count_threshold_set, "%lld\n");
+DEFINE_DEBUGFS_ATTRIBUTE(action_threshold_ops, u64_get, action_threshold_set, "%lld\n");
+
+static const char * const bins[] = { "00", "01", "10", "11" };
 
 static int array_dump(struct seq_file *m, void *v)
 {
         struct ce_array *ca = &ce_arr;
-        u64 prev = 0;
         int i;
 
         mutex_lock(&ce_mutex);
@@ -416,11 +445,8 @@ static int array_dump(struct seq_file *m, void *v)
         for (i = 0; i < ca->n; i++) {
                 u64 this = PFN(ca->array[i]);
 
-                seq_printf(m, " %03d: [%016llx|%03llx]\n", i, this, FULL_COUNT(ca->array[i]));
-
-                WARN_ON(prev > this);
-
-                prev = this;
+                seq_printf(m, " %3d: [%016llx|%s|%03llx]\n",
+                           i, this, bins[DECAY(ca->array[i])], COUNT(ca->array[i]));
         }
 
         seq_printf(m, "}\n");
@@ -433,7 +459,7 @@ static int array_dump(struct seq_file *m, void *v)
         seq_printf(m, "Decay interval: %lld seconds\n", decay_interval);
         seq_printf(m, "Decays: %lld\n", ca->decays_done);
 
-        seq_printf(m, "Action threshold: %d\n", count_threshold);
+        seq_printf(m, "Action threshold: %lld\n", action_threshold);
 
         mutex_unlock(&ce_mutex);
 
@@ -463,18 +489,6 @@ static int __init create_debugfs_nodes(void)
                 return -1;
         }
 
-        pfn = debugfs_create_file("pfn", S_IRUSR | S_IWUSR, d, &dfs_pfn, &pfn_ops);
-        if (!pfn) {
-                pr_warn("Error creating pfn debugfs node!\n");
-                goto err;
-        }
-
-        array = debugfs_create_file("array", S_IRUSR, d, NULL, &array_ops);
-        if (!array) {
-                pr_warn("Error creating array debugfs node!\n");
-                goto err;
-        }
-
         decay = debugfs_create_file("decay_interval", S_IRUSR | S_IWUSR, d,
                                     &decay_interval, &decay_interval_ops);
         if (!decay) {
@@ -482,13 +496,27 @@ static int __init create_debugfs_nodes(void)
                 goto err;
         }
 
-        count = debugfs_create_file("count_threshold", S_IRUSR | S_IWUSR, d,
-                                    &count_threshold, &count_threshold_ops);
+        count = debugfs_create_file("action_threshold", S_IRUSR | S_IWUSR, d,
+                                    &action_threshold, &action_threshold_ops);
         if (!count) {
-                pr_warn("Error creating count_threshold debugfs node!\n");
+                pr_warn("Error creating action_threshold debugfs node!\n");
+                goto err;
+        }
+
+        if (!IS_ENABLED(CONFIG_RAS_CEC_DEBUG))
+                return 0;
+
+        pfn = debugfs_create_file("pfn", S_IRUSR | S_IWUSR, d, &dfs_pfn, &pfn_ops);
+        if (!pfn) {
+                pr_warn("Error creating pfn debugfs node!\n");
                 goto err;
         }
 
+        array = debugfs_create_file("array", S_IRUSR, d, NULL, &array_ops);
+        if (!array) {
+                pr_warn("Error creating array debugfs node!\n");
+                goto err;
+        }
 
         return 0;
 
@@ -509,8 +537,10 @@ void __init cec_init(void)
                 return;
         }
 
-        if (create_debugfs_nodes())
+        if (create_debugfs_nodes()) {
+                free_page((unsigned long)ce_arr.array);
                 return;
+        }
 
         INIT_DELAYED_WORK(&cec_work, cec_work_fn);
         schedule_delayed_work(&cec_work, CEC_DECAY_DEFAULT_INTERVAL);
diff --git a/drivers/s390/block/Kconfig b/drivers/s390/block/Kconfig
index 9ac7574e3cfb..a8682f69effc 100644
--- a/drivers/s390/block/Kconfig
+++ b/drivers/s390/block/Kconfig
@@ -38,7 +38,7 @@ config DASD_PROFILE
         depends on DASD
         help
           Enable this option if you want to see profiling information
-          in /proc/dasd/statistics.
+          in /proc/dasd/statistics.
 
 config DASD_ECKD
         def_tristate y
diff --git a/drivers/s390/block/dasd_devmap.c b/drivers/s390/block/dasd_devmap.c
index fab35c6170cc..245f33c2f71e 100644
--- a/drivers/s390/block/dasd_devmap.c
+++ b/drivers/s390/block/dasd_devmap.c
@@ -203,7 +203,7 @@ static int __init dasd_feature_list(char *str)
                 else if (len == 8 && !strncmp(str, "failfast", 8))
                         features |= DASD_FEATURE_FAILFAST;
                 else {
-                        pr_warn("%*s is not a supported device option\n",
+                        pr_warn("%.*s is not a supported device option\n",
                                 len, str);
                         rc = -EINVAL;
                 }
diff --git a/drivers/s390/char/Kconfig b/drivers/s390/char/Kconfig
index ab0b243a947d..6cc4b19acf85 100644
--- a/drivers/s390/char/Kconfig
+++ b/drivers/s390/char/Kconfig
@@ -79,27 +79,6 @@ config SCLP_VT220_CONSOLE
           Include support for using an IBM SCLP VT220-compatible terminal as a
           Linux system console.
 
-config SCLP_ASYNC
-        def_tristate m
-        prompt "Support for Call Home via Asynchronous SCLP Records"
-        depends on S390
-        help
-          This option enables the call home function, which is able to inform
-          the service element and connected organisations about a kernel panic.
-          You should only select this option if you know what you are doing,
-          want for inform other people about your kernel panics,
-          need this feature and intend to run your kernel in LPAR.
-
-config SCLP_ASYNC_ID
-       string "Component ID for Call Home"
-       depends on SCLP_ASYNC
-       default "000000000"
-       help
-         The Component ID for Call Home is used to identify the correct
-         problem reporting queue the call home records should be sent to.
-
-         If your are unsure, please use the default value "000000000".
-
 config HMC_DRV
         def_tristate m
         prompt "Support for file transfers from HMC drive CD/DVD-ROM"
@@ -205,4 +184,3 @@ config S390_VMUR
         depends on S390
         help
           Character device driver for z/VM reader, puncher and printer.
-
diff --git a/drivers/s390/char/Makefile b/drivers/s390/char/Makefile
index 3072b89785dd..b8a8816d94e7 100644
--- a/drivers/s390/char/Makefile
+++ b/drivers/s390/char/Makefile
@@ -31,7 +31,6 @@ obj-$(CONFIG_TN3215) += con3215.o
 obj-$(CONFIG_SCLP_TTY) += sclp_tty.o
 obj-$(CONFIG_SCLP_CONSOLE) += sclp_con.o
 obj-$(CONFIG_SCLP_VT220_TTY) += sclp_vt220.o
-obj-$(CONFIG_SCLP_ASYNC) += sclp_async.o
 
 obj-$(CONFIG_PCI) += sclp_pci.o
 
diff --git a/drivers/s390/char/sclp_async.c b/drivers/s390/char/sclp_async.c
deleted file mode 100644
index e69b12a40636..000000000000
--- a/drivers/s390/char/sclp_async.c
+++ /dev/null
@@ -1,189 +0,0 @@
-// SPDX-License-Identifier: GPL-2.0
-/*
- * Enable Asynchronous Notification via SCLP.
- *
- * Copyright IBM Corp. 2009
- * Author(s): Hans-Joachim Picht <hans@linux.vnet.ibm.com>
- *
- */
-
-#include <linux/init.h>
-#include <linux/module.h>
-#include <linux/device.h>
-#include <linux/stat.h>
-#include <linux/string.h>
-#include <linux/slab.h>
-#include <linux/ctype.h>
-#include <linux/kmod.h>
-#include <linux/err.h>
-#include <linux/errno.h>
-#include <linux/proc_fs.h>
-#include <linux/sysctl.h>
-#include <linux/utsname.h>
-#include "sclp.h"
-
-static int callhome_enabled;
-static struct sclp_req *request;
-static struct sclp_async_sccb *sccb;
-static int sclp_async_send_wait(char *message);
-static struct ctl_table_header *callhome_sysctl_header;
-static DEFINE_SPINLOCK(sclp_async_lock);
-#define SCLP_NORMAL_WRITE       0x00
-
-struct async_evbuf {
-        struct evbuf_header header;
-        u64 reserved;
-        u8 rflags;
-        u8 empty;
-        u8 rtype;
-        u8 otype;
-        char comp_id[12];
-        char data[3000]; /* there is still some space left */
-} __attribute__((packed));
-
-struct sclp_async_sccb {
-        struct sccb_header header;
-        struct async_evbuf evbuf;
-} __attribute__((packed));
-
-static struct sclp_register sclp_async_register = {
-        .send_mask = EVTYP_ASYNC_MASK,
-};
-
-static int call_home_on_panic(struct notifier_block *self,
-                              unsigned long event, void *data)
-{
-        strncat(data, init_utsname()->nodename,
-                sizeof(init_utsname()->nodename));
-        sclp_async_send_wait(data);
-        return NOTIFY_DONE;
-}
-
-static struct notifier_block call_home_panic_nb = {
-        .notifier_call = call_home_on_panic,
-        .priority = INT_MAX,
-};
-
-static int zero;
-static int one = 1;
-
-static struct ctl_table callhome_table[] = {
-        {
-                .procname       = "callhome",
-                .data           = &callhome_enabled,
-                .maxlen         = sizeof(int),
-                .mode           = 0644,
-                .proc_handler   = proc_dointvec_minmax,
-                .extra1         = &zero,
-                .extra2         = &one,
-        },
-        {}
-};
-
-static struct ctl_table kern_dir_table[] = {
-        {
-                .procname       = "kernel",
-                .maxlen         = 0,
-                .mode           = 0555,
-                .child          = callhome_table,
-        },
-        {}
-};
-
-/*
- * Function used to transfer asynchronous notification
- * records which waits for send completion
- */
-static int sclp_async_send_wait(char *message)
-{
-        struct async_evbuf *evb;
-        int rc;
-        unsigned long flags;
-
-        if (!callhome_enabled)
-                return 0;
-        sccb->evbuf.header.type = EVTYP_ASYNC;
-        sccb->evbuf.rtype = 0xA5;
-        sccb->evbuf.otype = 0x00;
-        evb = &sccb->evbuf;
-        request->command = SCLP_CMDW_WRITE_EVENT_DATA;
-        request->sccb = sccb;
-        request->status = SCLP_REQ_FILLED;
-        strncpy(sccb->evbuf.data, message, sizeof(sccb->evbuf.data));
-        /*
-         * Retain Queue
-         * e.g. 5639CC140 500 Red Hat RHEL5 Linux for zSeries (RHEL AS)
-         */
-        strncpy(sccb->evbuf.comp_id, CONFIG_SCLP_ASYNC_ID,
-                sizeof(sccb->evbuf.comp_id));
-        sccb->evbuf.header.length = sizeof(sccb->evbuf);
-        sccb->header.length = sizeof(sccb->evbuf) + sizeof(sccb->header);
-        sccb->header.function_code = SCLP_NORMAL_WRITE;
-        rc = sclp_add_request(request);
-        if (rc)
-                return rc;
-        spin_lock_irqsave(&sclp_async_lock, flags);
-        while (request->status != SCLP_REQ_DONE &&
-                request->status != SCLP_REQ_FAILED) {
-                 sclp_sync_wait();
-        }
-        spin_unlock_irqrestore(&sclp_async_lock, flags);
-        if (request->status != SCLP_REQ_DONE)
-                return -EIO;
-        rc = ((struct sclp_async_sccb *)
-               request->sccb)->header.response_code;
-        if (rc != 0x0020)
-                return -EIO;
-        if (evb->header.flags != 0x80)
-                return -EIO;
-        return rc;
-}
-
-static int __init sclp_async_init(void)
-{
-        int rc;
-
-        rc = sclp_register(&sclp_async_register);
-        if (rc)
-                return rc;
-        rc = -EOPNOTSUPP;
-        if (!(sclp_async_register.sclp_receive_mask & EVTYP_ASYNC_MASK))
-                goto out_sclp;
-        rc = -ENOMEM;
-        callhome_sysctl_header = register_sysctl_table(kern_dir_table);
-        if (!callhome_sysctl_header)
-                goto out_sclp;
-        request = kzalloc(sizeof(struct sclp_req), GFP_KERNEL);
-        sccb = (struct sclp_async_sccb *) get_zeroed_page(GFP_KERNEL | GFP_DMA);
-        if (!request || !sccb)
-                goto out_mem;
-        rc = atomic_notifier_chain_register(&panic_notifier_list,
-                                            &call_home_panic_nb);
-        if (!rc)
-                goto out;
-out_mem:
-        kfree(request);
-        free_page((unsigned long) sccb);
-        unregister_sysctl_table(callhome_sysctl_header);
-out_sclp:
-        sclp_unregister(&sclp_async_register);
-out:
-        return rc;
-}
-module_init(sclp_async_init);
-
-static void __exit sclp_async_exit(void)
-{
-        atomic_notifier_chain_unregister(&panic_notifier_list,
-                                         &call_home_panic_nb);
-        unregister_sysctl_table(callhome_sysctl_header);
-        sclp_unregister(&sclp_async_register);
-        free_page((unsigned long) sccb);
-        kfree(request);
-}
-module_exit(sclp_async_exit);
-
-MODULE_AUTHOR("Copyright IBM Corp. 2009");
-MODULE_AUTHOR("Hans-Joachim Picht <hans@linux.vnet.ibm.com>");
-MODULE_LICENSE("GPL");
-MODULE_DESCRIPTION("SCLP Asynchronous Notification Records");
diff --git a/drivers/s390/char/zcore.c b/drivers/s390/char/zcore.c
index 405a60538630..08f812475f5e 100644
--- a/drivers/s390/char/zcore.c
+++ b/drivers/s390/char/zcore.c
@@ -4,7 +4,7 @@
  * dumps on SCSI disks (zfcpdump). The "zcore/mem" debugfs file shows the same
  * dump format as s390 standalone dumps.
  *
- * For more information please refer to Documentation/s390/zfcpdump.txt
+ * For more information please refer to Documentation/s390/zfcpdump.rst
  *
  * Copyright IBM Corp. 2003, 2008
  * Author(s): Michael Holzheu
diff --git a/drivers/s390/cio/airq.c b/drivers/s390/cio/airq.c
index 4534afc63591..427b2e24a8ce 100644
--- a/drivers/s390/cio/airq.c
+++ b/drivers/s390/cio/airq.c
@@ -16,9 +16,11 @@
 #include <linux/mutex.h>
 #include <linux/rculist.h>
 #include <linux/slab.h>
+#include <linux/dmapool.h>
 
 #include <asm/airq.h>
 #include <asm/isc.h>
+#include <asm/cio.h>
 
 #include "cio.h"
 #include "cio_debug.h"
@@ -27,7 +29,7 @@
 static DEFINE_SPINLOCK(airq_lists_lock);
 static struct hlist_head airq_lists[MAX_ISC+1];
 
-static struct kmem_cache *airq_iv_cache;
+static struct dma_pool *airq_iv_cache;
 
 /**
  * register_adapter_interrupt() - register adapter interrupt handler
@@ -115,6 +117,11 @@ void __init init_airq_interrupts(void)
         setup_irq(THIN_INTERRUPT, &airq_interrupt);
 }
 
+static inline unsigned long iv_size(unsigned long bits)
+{
+        return BITS_TO_LONGS(bits) * sizeof(unsigned long);
+}
+
 /**
  * airq_iv_create - create an interrupt vector
  * @bits: number of bits in the interrupt vector
@@ -132,17 +139,19 @@ struct airq_iv *airq_iv_create(unsigned long bits, unsigned long flags)
                 goto out;
         iv->bits = bits;
         iv->flags = flags;
-        size = BITS_TO_LONGS(bits) * sizeof(unsigned long);
+        size = iv_size(bits);
 
         if (flags & AIRQ_IV_CACHELINE) {
-                if ((cache_line_size() * BITS_PER_BYTE) < bits)
+                if ((cache_line_size() * BITS_PER_BYTE) < bits
+                                || !airq_iv_cache)
                         goto out_free;
 
-                iv->vector = kmem_cache_zalloc(airq_iv_cache, GFP_KERNEL);
+                iv->vector = dma_pool_zalloc(airq_iv_cache, GFP_KERNEL,
+                                             &iv->vector_dma);
                 if (!iv->vector)
                         goto out_free;
         } else {
-                iv->vector = kzalloc(size, GFP_KERNEL);
+                iv->vector = cio_dma_zalloc(size);
                 if (!iv->vector)
                         goto out_free;
         }
@@ -178,10 +187,10 @@ out_free:
         kfree(iv->ptr);
         kfree(iv->bitlock);
         kfree(iv->avail);
-        if (iv->flags & AIRQ_IV_CACHELINE)
-                kmem_cache_free(airq_iv_cache, iv->vector);
+        if (iv->flags & AIRQ_IV_CACHELINE && iv->vector)
+                dma_pool_free(airq_iv_cache, iv->vector, iv->vector_dma);
         else
-                kfree(iv->vector);
+                cio_dma_free(iv->vector, size);
         kfree(iv);
 out:
         return NULL;
@@ -198,9 +207,9 @@ void airq_iv_release(struct airq_iv *iv)
         kfree(iv->ptr);
         kfree(iv->bitlock);
         if (iv->flags & AIRQ_IV_CACHELINE)
-                kmem_cache_free(airq_iv_cache, iv->vector);
+                dma_pool_free(airq_iv_cache, iv->vector, iv->vector_dma);
         else
-                kfree(iv->vector);
+                cio_dma_free(iv->vector, iv_size(iv->bits));
         kfree(iv->avail);
         kfree(iv);
 }
@@ -295,12 +304,12 @@ unsigned long airq_iv_scan(struct airq_iv *iv, unsigned long start,
 }
 EXPORT_SYMBOL(airq_iv_scan);
 
-static int __init airq_init(void)
+int __init airq_init(void)
 {
-        airq_iv_cache = kmem_cache_create("airq_iv_cache", cache_line_size(),
-                                          cache_line_size(), 0, NULL);
+        airq_iv_cache = dma_pool_create("airq_iv_cache", cio_get_dma_css_dev(),
+                                        cache_line_size(),
+                                        cache_line_size(), PAGE_SIZE);
         if (!airq_iv_cache)
                 return -ENOMEM;
         return 0;
 }
-subsys_initcall(airq_init);
diff --git a/drivers/s390/cio/ccwreq.c b/drivers/s390/cio/ccwreq.c
index 603268a33ea1..73582a0a2622 100644
--- a/drivers/s390/cio/ccwreq.c
+++ b/drivers/s390/cio/ccwreq.c
@@ -63,7 +63,7 @@ static void ccwreq_stop(struct ccw_device *cdev, int rc)
                 return;
         req->done = 1;
         ccw_device_set_timeout(cdev, 0);
-        memset(&cdev->private->irb, 0, sizeof(struct irb));
+        memset(&cdev->private->dma_area->irb, 0, sizeof(struct irb));
         if (rc && rc != -ENODEV && req->drc)
                 rc = req->drc;
         req->callback(cdev, req->data, rc);
@@ -86,7 +86,7 @@ static void ccwreq_do(struct ccw_device *cdev)
                         continue;
                 }
                 /* Perform start function. */
-                memset(&cdev->private->irb, 0, sizeof(struct irb));
+                memset(&cdev->private->dma_area->irb, 0, sizeof(struct irb));
                 rc = cio_start(sch, cp, (u8) req->mask);
                 if (rc == 0) {
                         /* I/O started successfully. */
@@ -169,7 +169,7 @@ int ccw_request_cancel(struct ccw_device *cdev)
  */
 static enum io_status ccwreq_status(struct ccw_device *cdev, struct irb *lcirb)
 {
-        struct irb *irb = &cdev->private->irb;
+        struct irb *irb = &cdev->private->dma_area->irb;
         struct cmd_scsw *scsw = &irb->scsw.cmd;
         enum uc_todo todo;
 
@@ -187,7 +187,8 @@ static enum io_status ccwreq_status(struct ccw_device *cdev, struct irb *lcirb)
                 CIO_TRACE_EVENT(2, "sensedata");
                 CIO_HEX_EVENT(2, &cdev->private->dev_id,
                               sizeof(struct ccw_dev_id));
-                CIO_HEX_EVENT(2, &cdev->private->irb.ecw, SENSE_MAX_COUNT);
+                CIO_HEX_EVENT(2, &cdev->private->dma_area->irb.ecw,
+                              SENSE_MAX_COUNT);
                 /* Check for command reject. */
                 if (irb->ecw[0] & SNS0_CMD_REJECT)
                         return IO_REJECTED;
diff --git a/drivers/s390/cio/chsc.c b/drivers/s390/cio/chsc.c
index a835b31aad99..6392a1b95b02 100644
--- a/drivers/s390/cio/chsc.c
+++ b/drivers/s390/cio/chsc.c
@@ -323,36 +323,6 @@ struct chsc_sei {
 } __packed __aligned(PAGE_SIZE);
 
 /*
- * Node Descriptor as defined in SA22-7204, "Common I/O-Device Commands"
- */
-
-#define ND_VALIDITY_VALID       0
-#define ND_VALIDITY_OUTDATED    1
-#define ND_VALIDITY_INVALID     2
-
-struct node_descriptor {
-        /* Flags. */
-        union {
-                struct {
-                        u32 validity:3;
-                        u32 reserved:5;
-                } __packed;
-                u8 byte0;
-        } __packed;
-
-        /* Node parameters. */
-        u32 params:24;
-
-        /* Node ID. */
-        char type[6];
-        char model[3];
-        char manufacturer[3];
-        char plant[2];
-        char seq[12];
-        u16 tag;
-} __packed;
-
-/*
  * Link Incident Record as defined in SA22-7202, "ESCON I/O Interface"
  */
 
diff --git a/drivers/s390/cio/cio.h b/drivers/s390/cio/cio.h
index 06a91743335a..ba7d2480613b 100644
--- a/drivers/s390/cio/cio.h
+++ b/drivers/s390/cio/cio.h
@@ -113,6 +113,7 @@ struct subchannel {
         enum sch_todo todo;
         struct work_struct todo_work;
         struct schib_config config;
+        char *driver_override; /* Driver name to force a match */
 } __attribute__ ((aligned(8)));
 
 DECLARE_PER_CPU_ALIGNED(struct irb, cio_irb);
@@ -135,6 +136,8 @@ extern int cio_commit_config(struct subchannel *sch);
 int cio_tm_start_key(struct subchannel *sch, struct tcw *tcw, u8 lpm, u8 key);
 int cio_tm_intrg(struct subchannel *sch);
 
+extern int __init airq_init(void);
+
 /* Use with care. */
 #ifdef CONFIG_CCW_CONSOLE
 extern struct subchannel *cio_probe_console(void);
diff --git a/drivers/s390/cio/css.c b/drivers/s390/cio/css.c
index aea502922646..e1f2d0eed544 100644
--- a/drivers/s390/cio/css.c
+++ b/drivers/s390/cio/css.c
@@ -20,6 +20,8 @@
 #include <linux/reboot.h>
 #include <linux/suspend.h>
 #include <linux/proc_fs.h>
+#include <linux/genalloc.h>
+#include <linux/dma-mapping.h>
 #include <asm/isc.h>
 #include <asm/crw.h>
 
@@ -165,6 +167,7 @@ static void css_subchannel_release(struct device *dev)
 
         sch->config.intparm = 0;
         cio_commit_config(sch);
+        kfree(sch->driver_override);
         kfree(sch->lock);
         kfree(sch);
 }
@@ -224,6 +227,12 @@ struct subchannel *css_alloc_subchannel(struct subchannel_id schid,
         INIT_WORK(&sch->todo_work, css_sch_todo);
         sch->dev.release = &css_subchannel_release;
         device_initialize(&sch->dev);
+        /*
+         * The physical addresses of some the dma structures that can
+         * belong to a subchannel need to fit 31 bit width (e.g. ccw).
+         */
+        sch->dev.coherent_dma_mask = DMA_BIT_MASK(31);
+        sch->dev.dma_mask = &sch->dev.coherent_dma_mask;
         return sch;
 
 err:
@@ -315,9 +324,57 @@ static ssize_t modalias_show(struct device *dev, struct device_attribute *attr,
 
 static DEVICE_ATTR_RO(modalias);
 
+static ssize_t driver_override_store(struct device *dev,
+                                     struct device_attribute *attr,
+                                     const char *buf, size_t count)
+{
+        struct subchannel *sch = to_subchannel(dev);
+        char *driver_override, *old, *cp;
+
+        /* We need to keep extra room for a newline */
+        if (count >= (PAGE_SIZE - 1))
+                return -EINVAL;
+
+        driver_override = kstrndup(buf, count, GFP_KERNEL);
+        if (!driver_override)
+                return -ENOMEM;
+
+        cp = strchr(driver_override, '\n');
+        if (cp)
+                *cp = '\0';
+
+        device_lock(dev);
+        old = sch->driver_override;
+        if (strlen(driver_override)) {
+                sch->driver_override = driver_override;
+        } else {
+                kfree(driver_override);
+                sch->driver_override = NULL;
+        }
+        device_unlock(dev);
+
+        kfree(old);
+
+        return count;
+}
+
+static ssize_t driver_override_show(struct device *dev,
+                                    struct device_attribute *attr, char *buf)
+{
+        struct subchannel *sch = to_subchannel(dev);
+        ssize_t len;
+
+        device_lock(dev);
+        len = snprintf(buf, PAGE_SIZE, "%s\n", sch->driver_override);
+        device_unlock(dev);
+        return len;
+}
+static DEVICE_ATTR_RW(driver_override);
+
 static struct attribute *subch_attrs[] = {
         &dev_attr_type.attr,
         &dev_attr_modalias.attr,
+        &dev_attr_driver_override.attr,
         NULL,
 };
 
@@ -899,6 +956,13 @@ static int __init setup_css(int nr)
         dev_set_name(&css->device, "css%x", nr);
         css->device.groups = cssdev_attr_groups;
         css->device.release = channel_subsystem_release;
+        /*
+         * We currently allocate notifier bits with this (using
+         * css->device as the device argument with the DMA API)
+         * and are fine with 64 bit addresses.
+         */
+        css->device.coherent_dma_mask = DMA_BIT_MASK(64);
+        css->device.dma_mask = &css->device.coherent_dma_mask;
 
         mutex_init(&css->mutex);
         css->cssid = chsc_get_cssid(nr);
@@ -1018,6 +1082,111 @@ static struct notifier_block css_power_notifier = {
         .notifier_call = css_power_event,
 };
 
+#define  CIO_DMA_GFP (GFP_KERNEL | __GFP_ZERO)
+static struct gen_pool *cio_dma_pool;
+
+/* Currently cio supports only a single css */
+struct device *cio_get_dma_css_dev(void)
+{
+        return &channel_subsystems[0]->device;
+}
+
+struct gen_pool *cio_gp_dma_create(struct device *dma_dev, int nr_pages)
+{
+        struct gen_pool *gp_dma;
+        void *cpu_addr;
+        dma_addr_t dma_addr;
+        int i;
+
+        gp_dma = gen_pool_create(3, -1);
+        if (!gp_dma)
+                return NULL;
+        for (i = 0; i < nr_pages; ++i) {
+                cpu_addr = dma_alloc_coherent(dma_dev, PAGE_SIZE, &dma_addr,
+                                              CIO_DMA_GFP);
+                if (!cpu_addr)
+                        return gp_dma;
+                gen_pool_add_virt(gp_dma, (unsigned long) cpu_addr,
+                                  dma_addr, PAGE_SIZE, -1);
+        }
+        return gp_dma;
+}
+
+static void __gp_dma_free_dma(struct gen_pool *pool,
+                              struct gen_pool_chunk *chunk, void *data)
+{
+        size_t chunk_size = chunk->end_addr - chunk->start_addr + 1;
+
+        dma_free_coherent((struct device *) data, chunk_size,
+                         (void *) chunk->start_addr,
+                         (dma_addr_t) chunk->phys_addr);
+}
+
+void cio_gp_dma_destroy(struct gen_pool *gp_dma, struct device *dma_dev)
+{
+        if (!gp_dma)
+                return;
+        /* this is quite ugly but no better idea */
+        gen_pool_for_each_chunk(gp_dma, __gp_dma_free_dma, dma_dev);
+        gen_pool_destroy(gp_dma);
+}
+
+static int cio_dma_pool_init(void)
+{
+        /* No need to free up the resources: compiled in */
+        cio_dma_pool = cio_gp_dma_create(cio_get_dma_css_dev(), 1);
+        if (!cio_dma_pool)
+                return -ENOMEM;
+        return 0;
+}
+
+void *cio_gp_dma_zalloc(struct gen_pool *gp_dma, struct device *dma_dev,
+                        size_t size)
+{
+        dma_addr_t dma_addr;
+        unsigned long addr;
+        size_t chunk_size;
+
+        if (!gp_dma)
+                return NULL;
+        addr = gen_pool_alloc(gp_dma, size);
+        while (!addr) {
+                chunk_size = round_up(size, PAGE_SIZE);
+                addr = (unsigned long) dma_alloc_coherent(dma_dev,
+                                         chunk_size, &dma_addr, CIO_DMA_GFP);
+                if (!addr)
+                        return NULL;
+                gen_pool_add_virt(gp_dma, addr, dma_addr, chunk_size, -1);
+                addr = gen_pool_alloc(gp_dma, size);
+        }
+        return (void *) addr;
+}
+
+void cio_gp_dma_free(struct gen_pool *gp_dma, void *cpu_addr, size_t size)
+{
+        if (!cpu_addr)
+                return;
+        memset(cpu_addr, 0, size);
+        gen_pool_free(gp_dma, (unsigned long) cpu_addr, size);
+}
+
+/*
+ * Allocate dma memory from the css global pool. Intended for memory not
+ * specific to any single device within the css. The allocated memory
+ * is not guaranteed to be 31-bit addressable.
+ *
+ * Caution: Not suitable for early stuff like console.
+ */
+void *cio_dma_zalloc(size_t size)
+{
+        return cio_gp_dma_zalloc(cio_dma_pool, cio_get_dma_css_dev(), size);
+}
+
+void cio_dma_free(void *cpu_addr, size_t size)
+{
+        cio_gp_dma_free(cio_dma_pool, cpu_addr, size);
+}
+
 /*
  * Now that the driver core is running, we can setup our channel subsystem.
  * The struct subchannel's are created during probing.
@@ -1059,16 +1228,22 @@ static int __init css_bus_init(void)
         if (ret)
                 goto out_unregister;
         ret = register_pm_notifier(&css_power_notifier);
-        if (ret) {
-                unregister_reboot_notifier(&css_reboot_notifier);
-                goto out_unregister;
-        }
+        if (ret)
+                goto out_unregister_rn;
+        ret = cio_dma_pool_init();
+        if (ret)
+                goto out_unregister_pmn;
+        airq_init();
         css_init_done = 1;
 
         /* Enable default isc for I/O subchannels. */
         isc_register(IO_SCH_ISC);
 
         return 0;
+out_unregister_pmn:
+        unregister_pm_notifier(&css_power_notifier);
+out_unregister_rn:
+        unregister_reboot_notifier(&css_reboot_notifier);
 out_unregister:
         while (i-- > 0) {
                 struct channel_subsystem *css = channel_subsystems[i];
@@ -1222,6 +1397,10 @@ static int css_bus_match(struct device *dev, struct device_driver *drv)
         struct css_driver *driver = to_cssdriver(drv);
         struct css_device_id *id;
 
+        /* When driver_override is set, only bind to the matching driver */
+        if (sch->driver_override && strcmp(sch->driver_override, drv->name))
+                return 0;
+
         for (id = driver->subchannel_type; id->match_flags; id++) {
                 if (sch->st == id->type)
                         return 1;
diff --git a/drivers/s390/cio/device.c b/drivers/s390/cio/device.c
index 1540229a37bb..9985b7484a6b 100644
--- a/drivers/s390/cio/device.c
+++ b/drivers/s390/cio/device.c
@@ -24,6 +24,7 @@
 #include <linux/timer.h>
 #include <linux/kernel_stat.h>
 #include <linux/sched/signal.h>
+#include <linux/dma-mapping.h>
 
 #include <asm/ccwdev.h>
 #include <asm/cio.h>
@@ -687,6 +688,9 @@ ccw_device_release(struct device *dev)
         struct ccw_device *cdev;
 
         cdev = to_ccwdev(dev);
+        cio_gp_dma_free(cdev->private->dma_pool, cdev->private->dma_area,
+                        sizeof(*cdev->private->dma_area));
+        cio_gp_dma_destroy(cdev->private->dma_pool, &cdev->dev);
         /* Release reference of parent subchannel. */
         put_device(cdev->dev.parent);
         kfree(cdev->private);
@@ -696,15 +700,33 @@ ccw_device_release(struct device *dev)
 static struct ccw_device * io_subchannel_allocate_dev(struct subchannel *sch)
 {
         struct ccw_device *cdev;
+        struct gen_pool *dma_pool;
 
         cdev  = kzalloc(sizeof(*cdev), GFP_KERNEL);
-        if (cdev) {
-                cdev->private = kzalloc(sizeof(struct ccw_device_private),
-                                        GFP_KERNEL | GFP_DMA);
-                if (cdev->private)
-                        return cdev;
-        }
+        if (!cdev)
+                goto err_cdev;
+        cdev->private = kzalloc(sizeof(struct ccw_device_private),
+                                GFP_KERNEL | GFP_DMA);
+        if (!cdev->private)
+                goto err_priv;
+        cdev->dev.coherent_dma_mask = sch->dev.coherent_dma_mask;
+        cdev->dev.dma_mask = &cdev->dev.coherent_dma_mask;
+        dma_pool = cio_gp_dma_create(&cdev->dev, 1);
+        if (!dma_pool)
+                goto err_dma_pool;
+        cdev->private->dma_pool = dma_pool;
+        cdev->private->dma_area = cio_gp_dma_zalloc(dma_pool, &cdev->dev,
+                                        sizeof(*cdev->private->dma_area));
+        if (!cdev->private->dma_area)
+                goto err_dma_area;
+        return cdev;
+err_dma_area:
+        cio_gp_dma_destroy(dma_pool, &cdev->dev);
+err_dma_pool:
+        kfree(cdev->private);
+err_priv:
         kfree(cdev);
+err_cdev:
         return ERR_PTR(-ENOMEM);
 }
 
@@ -884,7 +906,7 @@ io_subchannel_recog_done(struct ccw_device *cdev)
                         wake_up(&ccw_device_init_wq);
                 break;
         case DEV_STATE_OFFLINE:
-                /* 
+                /*
                  * We can't register the device in interrupt context so
                  * we schedule a work item.
                  */
@@ -1062,6 +1084,14 @@ static int io_subchannel_probe(struct subchannel *sch)
         if (!io_priv)
                 goto out_schedule;
 
+        io_priv->dma_area = dma_alloc_coherent(&sch->dev,
+                                sizeof(*io_priv->dma_area),
+                                &io_priv->dma_area_dma, GFP_KERNEL);
+        if (!io_priv->dma_area) {
+                kfree(io_priv);
+                goto out_schedule;
+        }
+
         set_io_private(sch, io_priv);
         css_schedule_eval(sch->schid);
         return 0;
@@ -1088,6 +1118,8 @@ static int io_subchannel_remove(struct subchannel *sch)
         set_io_private(sch, NULL);
         spin_unlock_irq(sch->lock);
 out_free:
+        dma_free_coherent(&sch->dev, sizeof(*io_priv->dma_area),
+                          io_priv->dma_area, io_priv->dma_area_dma);
         kfree(io_priv);
         sysfs_remove_group(&sch->dev.kobj, &io_subchannel_attr_group);
         return 0;
@@ -1593,13 +1625,19 @@ struct ccw_device * __init ccw_device_create_console(struct ccw_driver *drv)
                 return ERR_CAST(sch);
 
         io_priv = kzalloc(sizeof(*io_priv), GFP_KERNEL | GFP_DMA);
-        if (!io_priv) {
-                put_device(&sch->dev);
-                return ERR_PTR(-ENOMEM);
-        }
+        if (!io_priv)
+                goto err_priv;
+        io_priv->dma_area = dma_alloc_coherent(&sch->dev,
+                                sizeof(*io_priv->dma_area),
+                                &io_priv->dma_area_dma, GFP_KERNEL);
+        if (!io_priv->dma_area)
+                goto err_dma_area;
         set_io_private(sch, io_priv);
         cdev = io_subchannel_create_ccwdev(sch);
         if (IS_ERR(cdev)) {
+                dma_free_coherent(&sch->dev, sizeof(*io_priv->dma_area),
+                                  io_priv->dma_area, io_priv->dma_area_dma);
+                set_io_private(sch, NULL);
                 put_device(&sch->dev);
                 kfree(io_priv);
                 return cdev;
@@ -1607,6 +1645,12 @@ struct ccw_device * __init ccw_device_create_console(struct ccw_driver *drv)
         cdev->drv = drv;
         ccw_device_set_int_class(cdev);
         return cdev;
+
+err_dma_area:
+        kfree(io_priv);
+err_priv:
+        put_device(&sch->dev);
+        return ERR_PTR(-ENOMEM);
 }
 
 void __init ccw_device_destroy_console(struct ccw_device *cdev)
@@ -1617,6 +1661,8 @@ void __init ccw_device_destroy_console(struct ccw_device *cdev)
         set_io_private(sch, NULL);
         put_device(&sch->dev);
         put_device(&cdev->dev);
+        dma_free_coherent(&sch->dev, sizeof(*io_priv->dma_area),
+                          io_priv->dma_area, io_priv->dma_area_dma);
         kfree(io_priv);
 }
 
diff --git a/drivers/s390/cio/device_fsm.c b/drivers/s390/cio/device_fsm.c
index 9169af7dbb43..8fc267324ebb 100644
--- a/drivers/s390/cio/device_fsm.c
+++ b/drivers/s390/cio/device_fsm.c
@@ -67,8 +67,10 @@ static void ccw_timeout_log(struct ccw_device *cdev)
                                sizeof(struct tcw), 0);
         } else {
                 printk(KERN_WARNING "cio: orb indicates command mode\n");
-                if ((void *)(addr_t)orb->cmd.cpa == &private->sense_ccw ||
-                    (void *)(addr_t)orb->cmd.cpa == cdev->private->iccws)
+                if ((void *)(addr_t)orb->cmd.cpa ==
+                    &private->dma_area->sense_ccw ||
+                    (void *)(addr_t)orb->cmd.cpa ==
+                    cdev->private->dma_area->iccws)
                         printk(KERN_WARNING "cio: last channel program "
                                "(intern):\n");
                 else
@@ -143,18 +145,22 @@ ccw_device_cancel_halt_clear(struct ccw_device *cdev)
 void ccw_device_update_sense_data(struct ccw_device *cdev)
 {
         memset(&cdev->id, 0, sizeof(cdev->id));
-        cdev->id.cu_type   = cdev->private->senseid.cu_type;
-        cdev->id.cu_model  = cdev->private->senseid.cu_model;
-        cdev->id.dev_type  = cdev->private->senseid.dev_type;
-        cdev->id.dev_model = cdev->private->senseid.dev_model;
+        cdev->id.cu_type = cdev->private->dma_area->senseid.cu_type;
+        cdev->id.cu_model = cdev->private->dma_area->senseid.cu_model;
+        cdev->id.dev_type = cdev->private->dma_area->senseid.dev_type;
+        cdev->id.dev_model = cdev->private->dma_area->senseid.dev_model;
 }
 
 int ccw_device_test_sense_data(struct ccw_device *cdev)
 {
-        return cdev->id.cu_type == cdev->private->senseid.cu_type &&
-                cdev->id.cu_model == cdev->private->senseid.cu_model &&
-                cdev->id.dev_type == cdev->private->senseid.dev_type &&
-                cdev->id.dev_model == cdev->private->senseid.dev_model;
+        return cdev->id.cu_type ==
+                cdev->private->dma_area->senseid.cu_type &&
+                cdev->id.cu_model ==
+                cdev->private->dma_area->senseid.cu_model &&
+                cdev->id.dev_type ==
+                cdev->private->dma_area->senseid.dev_type &&
+                cdev->id.dev_model ==
+                cdev->private->dma_area->senseid.dev_model;
 }
 
 /*
@@ -342,7 +348,7 @@ ccw_device_done(struct ccw_device *cdev, int state)
                 cio_disable_subchannel(sch);
 
         /* Reset device status. */
-        memset(&cdev->private->irb, 0, sizeof(struct irb));
+        memset(&cdev->private->dma_area->irb, 0, sizeof(struct irb));
 
         cdev->private->state = state;
 
@@ -509,13 +515,14 @@ callback:
                 ccw_device_done(cdev, DEV_STATE_ONLINE);
                 /* Deliver fake irb to device driver, if needed. */
                 if (cdev->private->flags.fake_irb) {
-                        create_fake_irb(&cdev->private->irb,
+                        create_fake_irb(&cdev->private->dma_area->irb,
                                         cdev->private->flags.fake_irb);
                         cdev->private->flags.fake_irb = 0;
                         if (cdev->handler)
                                 cdev->handler(cdev, cdev->private->intparm,
-                                              &cdev->private->irb);
-                        memset(&cdev->private->irb, 0, sizeof(struct irb));
+                                              &cdev->private->dma_area->irb);
+                        memset(&cdev->private->dma_area->irb, 0,
+                               sizeof(struct irb));
                 }
                 ccw_device_report_path_events(cdev);
                 ccw_device_handle_broken_paths(cdev);
@@ -672,7 +679,8 @@ ccw_device_online_verify(struct ccw_device *cdev, enum dev_event dev_event)
 
         if (scsw_actl(&sch->schib.scsw) != 0 ||
             (scsw_stctl(&sch->schib.scsw) & SCSW_STCTL_STATUS_PEND) ||
-            (scsw_stctl(&cdev->private->irb.scsw) & SCSW_STCTL_STATUS_PEND)) {
+            (scsw_stctl(&cdev->private->dma_area->irb.scsw) &
+             SCSW_STCTL_STATUS_PEND)) {
                 /*
                  * No final status yet or final status not yet delivered
                  * to the device driver. Can't do path verification now,
@@ -719,7 +727,7 @@ static int ccw_device_call_handler(struct ccw_device *cdev)
          *  - fast notification was requested (primary status)
          *  - unsolicited interrupts
          */
-        stctl = scsw_stctl(&cdev->private->irb.scsw);
+        stctl = scsw_stctl(&cdev->private->dma_area->irb.scsw);
         ending_status = (stctl & SCSW_STCTL_SEC_STATUS) ||
                 (stctl == (SCSW_STCTL_ALERT_STATUS | SCSW_STCTL_STATUS_PEND)) ||
                 (stctl == SCSW_STCTL_STATUS_PEND);
@@ -735,9 +743,9 @@ static int ccw_device_call_handler(struct ccw_device *cdev)
 
         if (cdev->handler)
                 cdev->handler(cdev, cdev->private->intparm,
-                              &cdev->private->irb);
+                              &cdev->private->dma_area->irb);
 
-        memset(&cdev->private->irb, 0, sizeof(struct irb));
+        memset(&cdev->private->dma_area->irb, 0, sizeof(struct irb));
         return 1;
 }
 
@@ -759,7 +767,8 @@ ccw_device_irq(struct ccw_device *cdev, enum dev_event dev_event)
                         /* Unit check but no sense data. Need basic sense. */
                         if (ccw_device_do_sense(cdev, irb) != 0)
                                 goto call_handler_unsol;
-                        memcpy(&cdev->private->irb, irb, sizeof(struct irb));
+                        memcpy(&cdev->private->dma_area->irb, irb,
+                               sizeof(struct irb));
                         cdev->private->state = DEV_STATE_W4SENSE;
                         cdev->private->intparm = 0;
                         return;
@@ -842,7 +851,7 @@ ccw_device_w4sense(struct ccw_device *cdev, enum dev_event dev_event)
         if (scsw_fctl(&irb->scsw) &
             (SCSW_FCTL_CLEAR_FUNC | SCSW_FCTL_HALT_FUNC)) {
                 cdev->private->flags.dosense = 0;
-                memset(&cdev->private->irb, 0, sizeof(struct irb));
+                memset(&cdev->private->dma_area->irb, 0, sizeof(struct irb));
                 ccw_device_accumulate_irb(cdev, irb);
                 goto call_handler;
         }
diff --git a/drivers/s390/cio/device_id.c b/drivers/s390/cio/device_id.c
index f6df83a9dfbb..740996d0dc8c 100644
--- a/drivers/s390/cio/device_id.c
+++ b/drivers/s390/cio/device_id.c
@@ -99,7 +99,7 @@ static int diag210_to_senseid(struct senseid *senseid, struct diag210 *diag)
 static int diag210_get_dev_info(struct ccw_device *cdev)
 {
         struct ccw_dev_id *dev_id = &cdev->private->dev_id;
-        struct senseid *senseid = &cdev->private->senseid;
+        struct senseid *senseid = &cdev->private->dma_area->senseid;
         struct diag210 diag_data;
         int rc;
 
@@ -134,8 +134,10 @@ err_failed:
 static void snsid_init(struct ccw_device *cdev)
 {
         cdev->private->flags.esid = 0;
-        memset(&cdev->private->senseid, 0, sizeof(cdev->private->senseid));
-        cdev->private->senseid.cu_type = 0xffff;
+
+        memset(&cdev->private->dma_area->senseid, 0,
+               sizeof(cdev->private->dma_area->senseid));
+        cdev->private->dma_area->senseid.cu_type = 0xffff;
 }
 
 /*
@@ -143,16 +145,16 @@ static void snsid_init(struct ccw_device *cdev)
  */
 static int snsid_check(struct ccw_device *cdev, void *data)
 {
-        struct cmd_scsw *scsw = &cdev->private->irb.scsw.cmd;
+        struct cmd_scsw *scsw = &cdev->private->dma_area->irb.scsw.cmd;
         int len = sizeof(struct senseid) - scsw->count;
 
         /* Check for incomplete SENSE ID data. */
         if (len < SENSE_ID_MIN_LEN)
                 goto out_restart;
-        if (cdev->private->senseid.cu_type == 0xffff)
+        if (cdev->private->dma_area->senseid.cu_type == 0xffff)
                 goto out_restart;
         /* Check for incompatible SENSE ID data. */
-        if (cdev->private->senseid.reserved != 0xff)
+        if (cdev->private->dma_area->senseid.reserved != 0xff)
                 return -EOPNOTSUPP;
         /* Check for extended-identification information. */
         if (len > SENSE_ID_BASIC_LEN)
@@ -170,7 +172,7 @@ out_restart:
 static void snsid_callback(struct ccw_device *cdev, void *data, int rc)
 {
         struct ccw_dev_id *id = &cdev->private->dev_id;
-        struct senseid *senseid = &cdev->private->senseid;
+        struct senseid *senseid = &cdev->private->dma_area->senseid;
         int vm = 0;
 
         if (rc && MACHINE_IS_VM) {
@@ -200,7 +202,7 @@ void ccw_device_sense_id_start(struct ccw_device *cdev)
 {
         struct subchannel *sch = to_subchannel(cdev->dev.parent);
         struct ccw_request *req = &cdev->private->req;
-        struct ccw1 *cp = cdev->private->iccws;
+        struct ccw1 *cp = cdev->private->dma_area->iccws;
 
         CIO_TRACE_EVENT(4, "snsid");
         CIO_HEX_EVENT(4, &cdev->private->dev_id, sizeof(cdev->private->dev_id));
@@ -208,7 +210,7 @@ void ccw_device_sense_id_start(struct ccw_device *cdev)
         snsid_init(cdev);
         /* Channel program setup. */
         cp->cmd_code    = CCW_CMD_SENSE_ID;
-        cp->cda         = (u32) (addr_t) &cdev->private->senseid;
+        cp->cda         = (u32) (addr_t) &cdev->private->dma_area->senseid;
         cp->count       = sizeof(struct senseid);
         cp->flags       = CCW_FLAG_SLI;
         /* Request setup. */
diff --git a/drivers/s390/cio/device_ops.c b/drivers/s390/cio/device_ops.c
index 4435ae0b3027..d722458c5928 100644
--- a/drivers/s390/cio/device_ops.c
+++ b/drivers/s390/cio/device_ops.c
@@ -429,8 +429,8 @@ struct ciw *ccw_device_get_ciw(struct ccw_device *cdev, __u32 ct)
         if (cdev->private->flags.esid == 0)
                 return NULL;
         for (ciw_cnt = 0; ciw_cnt < MAX_CIWS; ciw_cnt++)
-                if (cdev->private->senseid.ciw[ciw_cnt].ct == ct)
-                        return cdev->private->senseid.ciw + ciw_cnt;
+                if (cdev->private->dma_area->senseid.ciw[ciw_cnt].ct == ct)
+                        return cdev->private->dma_area->senseid.ciw + ciw_cnt;
         return NULL;
 }
 
@@ -699,6 +699,23 @@ void ccw_device_get_schid(struct ccw_device *cdev, struct subchannel_id *schid)
 }
 EXPORT_SYMBOL_GPL(ccw_device_get_schid);
 
+/*
+ * Allocate zeroed dma coherent 31 bit addressable memory using
+ * the subchannels dma pool. Maximal size of allocation supported
+ * is PAGE_SIZE.
+ */
+void *ccw_device_dma_zalloc(struct ccw_device *cdev, size_t size)
+{
+        return cio_gp_dma_zalloc(cdev->private->dma_pool, &cdev->dev, size);
+}
+EXPORT_SYMBOL(ccw_device_dma_zalloc);
+
+void ccw_device_dma_free(struct ccw_device *cdev, void *cpu_addr, size_t size)
+{
+        cio_gp_dma_free(cdev->private->dma_pool, cpu_addr, size);
+}
+EXPORT_SYMBOL(ccw_device_dma_free);
+
 EXPORT_SYMBOL(ccw_device_set_options_mask);
 EXPORT_SYMBOL(ccw_device_set_options);
 EXPORT_SYMBOL(ccw_device_clear_options);
diff --git a/drivers/s390/cio/device_pgid.c b/drivers/s390/cio/device_pgid.c
index d30a3babf176..767a85635a0f 100644
--- a/drivers/s390/cio/device_pgid.c
+++ b/drivers/s390/cio/device_pgid.c
@@ -57,7 +57,7 @@ out:
 static void nop_build_cp(struct ccw_device *cdev)
 {
         struct ccw_request *req = &cdev->private->req;
-        struct ccw1 *cp = cdev->private->iccws;
+        struct ccw1 *cp = cdev->private->dma_area->iccws;
 
         cp->cmd_code    = CCW_CMD_NOOP;
         cp->cda         = 0;
@@ -134,9 +134,9 @@ err:
 static void spid_build_cp(struct ccw_device *cdev, u8 fn)
 {
         struct ccw_request *req = &cdev->private->req;
-        struct ccw1 *cp = cdev->private->iccws;
+        struct ccw1 *cp = cdev->private->dma_area->iccws;
         int i = pathmask_to_pos(req->lpm);
-        struct pgid *pgid = &cdev->private->pgid[i];
+        struct pgid *pgid = &cdev->private->dma_area->pgid[i];
 
         pgid->inf.fc    = fn;
         cp->cmd_code    = CCW_CMD_SET_PGID;
@@ -300,7 +300,7 @@ static int pgid_cmp(struct pgid *p1, struct pgid *p2)
 static void pgid_analyze(struct ccw_device *cdev, struct pgid **p,
                          int *mismatch, u8 *reserved, u8 *reset)
 {
-        struct pgid *pgid = &cdev->private->pgid[0];
+        struct pgid *pgid = &cdev->private->dma_area->pgid[0];
         struct pgid *first = NULL;
         int lpm;
         int i;
@@ -342,7 +342,7 @@ static u8 pgid_to_donepm(struct ccw_device *cdev)
                 lpm = 0x80 >> i;
                 if ((cdev->private->pgid_valid_mask & lpm) == 0)
                         continue;
-                pgid = &cdev->private->pgid[i];
+                pgid = &cdev->private->dma_area->pgid[i];
                 if (sch->opm & lpm) {
                         if (pgid->inf.ps.state1 != SNID_STATE1_GROUPED)
                                 continue;
@@ -368,7 +368,8 @@ static void pgid_fill(struct ccw_device *cdev, struct pgid *pgid)
         int i;
 
         for (i = 0; i < 8; i++)
-                memcpy(&cdev->private->pgid[i], pgid, sizeof(struct pgid));
+                memcpy(&cdev->private->dma_area->pgid[i], pgid,
+                       sizeof(struct pgid));
 }
 
 /*
@@ -435,12 +436,12 @@ out:
 static void snid_build_cp(struct ccw_device *cdev)
 {
         struct ccw_request *req = &cdev->private->req;
-        struct ccw1 *cp = cdev->private->iccws;
+        struct ccw1 *cp = cdev->private->dma_area->iccws;
         int i = pathmask_to_pos(req->lpm);
 
         /* Channel program setup. */
         cp->cmd_code    = CCW_CMD_SENSE_PGID;
-        cp->cda         = (u32) (addr_t) &cdev->private->pgid[i];
+        cp->cda         = (u32) (addr_t) &cdev->private->dma_area->pgid[i];
         cp->count       = sizeof(struct pgid);
         cp->flags       = CCW_FLAG_SLI;
         req->cp         = cp;
@@ -516,7 +517,8 @@ static void verify_start(struct ccw_device *cdev)
         sch->lpm = sch->schib.pmcw.pam;
 
         /* Initialize PGID data. */
-        memset(cdev->private->pgid, 0, sizeof(cdev->private->pgid));
+        memset(cdev->private->dma_area->pgid, 0,
+               sizeof(cdev->private->dma_area->pgid));
         cdev->private->pgid_valid_mask = 0;
         cdev->private->pgid_todo_mask = sch->schib.pmcw.pam;
         cdev->private->path_notoper_mask = 0;
@@ -626,7 +628,7 @@ struct stlck_data {
 static void stlck_build_cp(struct ccw_device *cdev, void *buf1, void *buf2)
 {
         struct ccw_request *req = &cdev->private->req;
-        struct ccw1 *cp = cdev->private->iccws;
+        struct ccw1 *cp = cdev->private->dma_area->iccws;
 
         cp[0].cmd_code = CCW_CMD_STLCK;
         cp[0].cda = (u32) (addr_t) buf1;
diff --git a/drivers/s390/cio/device_status.c b/drivers/s390/cio/device_status.c
index 7d5c7892b2c4..0bd8f2642732 100644
--- a/drivers/s390/cio/device_status.c
+++ b/drivers/s390/cio/device_status.c
@@ -79,15 +79,15 @@ ccw_device_accumulate_ecw(struct ccw_device *cdev, struct irb *irb)
          * are condition that have to be met for the extended control
          * bit to have meaning. Sick.
          */
-        cdev->private->irb.scsw.cmd.ectl = 0;
+        cdev->private->dma_area->irb.scsw.cmd.ectl = 0;
         if ((irb->scsw.cmd.stctl & SCSW_STCTL_ALERT_STATUS) &&
             !(irb->scsw.cmd.stctl & SCSW_STCTL_INTER_STATUS))
-                cdev->private->irb.scsw.cmd.ectl = irb->scsw.cmd.ectl;
+                cdev->private->dma_area->irb.scsw.cmd.ectl = irb->scsw.cmd.ectl;
         /* Check if extended control word is valid. */
-        if (!cdev->private->irb.scsw.cmd.ectl)
+        if (!cdev->private->dma_area->irb.scsw.cmd.ectl)
                 return;
         /* Copy concurrent sense / model dependent information. */
-        memcpy (&cdev->private->irb.ecw, irb->ecw, sizeof (irb->ecw));
+        memcpy(&cdev->private->dma_area->irb.ecw, irb->ecw, sizeof(irb->ecw));
 }
 
 /*
@@ -118,7 +118,7 @@ ccw_device_accumulate_esw(struct ccw_device *cdev, struct irb *irb)
         if (!ccw_device_accumulate_esw_valid(irb))
                 return;
 
-        cdev_irb = &cdev->private->irb;
+        cdev_irb = &cdev->private->dma_area->irb;
 
         /* Copy last path used mask. */
         cdev_irb->esw.esw1.lpum = irb->esw.esw1.lpum;
@@ -210,7 +210,7 @@ ccw_device_accumulate_irb(struct ccw_device *cdev, struct irb *irb)
                 ccw_device_path_notoper(cdev);
         /* No irb accumulation for transport mode irbs. */
         if (scsw_is_tm(&irb->scsw)) {
-                memcpy(&cdev->private->irb, irb, sizeof(struct irb));
+                memcpy(&cdev->private->dma_area->irb, irb, sizeof(struct irb));
                 return;
         }
         /*
@@ -219,7 +219,7 @@ ccw_device_accumulate_irb(struct ccw_device *cdev, struct irb *irb)
         if (!scsw_is_solicited(&irb->scsw))
                 return;
 
-        cdev_irb = &cdev->private->irb;
+        cdev_irb = &cdev->private->dma_area->irb;
 
         /*
          * If the clear function had been performed, all formerly pending
@@ -227,7 +227,7 @@ ccw_device_accumulate_irb(struct ccw_device *cdev, struct irb *irb)
          * intermediate accumulated status to the device driver.
          */
         if (irb->scsw.cmd.fctl & SCSW_FCTL_CLEAR_FUNC)
-                memset(&cdev->private->irb, 0, sizeof(struct irb));
+                memset(&cdev->private->dma_area->irb, 0, sizeof(struct irb));
 
         /* Copy bits which are valid only for the start function. */
         if (irb->scsw.cmd.fctl & SCSW_FCTL_START_FUNC) {
@@ -329,9 +329,9 @@ ccw_device_do_sense(struct ccw_device *cdev, struct irb *irb)
         /*
          * We have ending status but no sense information. Do a basic sense.
          */
-        sense_ccw = &to_io_private(sch)->sense_ccw;
+        sense_ccw = &to_io_private(sch)->dma_area->sense_ccw;
         sense_ccw->cmd_code = CCW_CMD_BASIC_SENSE;
-        sense_ccw->cda = (__u32) __pa(cdev->private->irb.ecw);
+        sense_ccw->cda = (__u32) __pa(cdev->private->dma_area->irb.ecw);
         sense_ccw->count = SENSE_MAX_COUNT;
         sense_ccw->flags = CCW_FLAG_SLI;
 
@@ -364,7 +364,7 @@ ccw_device_accumulate_basic_sense(struct ccw_device *cdev, struct irb *irb)
 
         if (!(irb->scsw.cmd.dstat & DEV_STAT_UNIT_CHECK) &&
             (irb->scsw.cmd.dstat & DEV_STAT_CHN_END)) {
-                cdev->private->irb.esw.esw0.erw.cons = 1;
+                cdev->private->dma_area->irb.esw.esw0.erw.cons = 1;
                 cdev->private->flags.dosense = 0;
         }
         /* Check if path verification is required. */
@@ -386,7 +386,7 @@ ccw_device_accumulate_and_sense(struct ccw_device *cdev, struct irb *irb)
         /* Check for basic sense. */
         if (cdev->private->flags.dosense &&
             !(irb->scsw.cmd.dstat & DEV_STAT_UNIT_CHECK)) {
-                cdev->private->irb.esw.esw0.erw.cons = 1;
+                cdev->private->dma_area->irb.esw.esw0.erw.cons = 1;
                 cdev->private->flags.dosense = 0;
                 return 0;
         }
diff --git a/drivers/s390/cio/io_sch.h b/drivers/s390/cio/io_sch.h
index 90e4e3a7841b..c03b4a19974e 100644
--- a/drivers/s390/cio/io_sch.h
+++ b/drivers/s390/cio/io_sch.h
@@ -9,15 +9,20 @@
 #include "css.h"
 #include "orb.h"
 
+struct io_subchannel_dma_area {
+        struct ccw1 sense_ccw;  /* static ccw for sense command */
+};
+
 struct io_subchannel_private {
         union orb orb;          /* operation request block */
-        struct ccw1 sense_ccw;  /* static ccw for sense command */
         struct ccw_device *cdev;/* pointer to the child ccw device */
         struct {
                 unsigned int suspend:1; /* allow suspend */
                 unsigned int prefetch:1;/* deny prefetch */
                 unsigned int inter:1;   /* suppress intermediate interrupts */
         } __packed options;
+        struct io_subchannel_dma_area *dma_area;
+        dma_addr_t dma_area_dma;
 } __aligned(8);
 
 #define to_io_private(n) ((struct io_subchannel_private *) \
@@ -115,6 +120,13 @@ enum cdev_todo {
 #define FAKE_CMD_IRB    1
 #define FAKE_TM_IRB     2
 
+struct ccw_device_dma_area {
+        struct senseid senseid; /* SenseID info */
+        struct ccw1 iccws[2];   /* ccws for SNID/SID/SPGID commands */
+        struct irb irb;         /* device status */
+        struct pgid pgid[8];    /* path group IDs per chpid*/
+};
+
 struct ccw_device_private {
         struct ccw_device *cdev;
         struct subchannel *sch;
@@ -156,11 +168,7 @@ struct ccw_device_private {
         } __attribute__((packed)) flags;
         unsigned long intparm;  /* user interruption parameter */
         struct qdio_irq *qdio_data;
-        struct irb irb;         /* device status */
         int async_kill_io_rc;
-        struct senseid senseid; /* SenseID info */
-        struct pgid pgid[8];    /* path group IDs per chpid*/
-        struct ccw1 iccws[2];   /* ccws for SNID/SID/SPGID commands */
         struct work_struct todo_work;
         enum cdev_todo todo;
         wait_queue_head_t wait_q;
@@ -169,6 +177,8 @@ struct ccw_device_private {
         struct list_head cmb_list;      /* list of measured devices */
         u64 cmb_start_time;             /* clock value of cmb reset */
         void *cmb_wait;                 /* deferred cmb enable/disable */
+        struct gen_pool *dma_pool;
+        struct ccw_device_dma_area *dma_area;
         enum interruption_class int_class;
 };
 
diff --git a/drivers/s390/cio/qdio_main.c b/drivers/s390/cio/qdio_main.c
index 7b7620de2acd..730c4e68094b 100644
--- a/drivers/s390/cio/qdio_main.c
+++ b/drivers/s390/cio/qdio_main.c
@@ -736,6 +736,7 @@ static int get_outbound_buffer_frontier(struct qdio_q *q, unsigned int start)
 
         switch (state) {
         case SLSB_P_OUTPUT_EMPTY:
+        case SLSB_P_OUTPUT_PENDING:
                 /* the adapter got it */
                 DBF_DEV_EVENT(DBF_INFO, q->irq_ptr,
                         "out empty:%1d %02x", q->nr, count);
diff --git a/drivers/s390/cio/qdio_setup.c b/drivers/s390/cio/qdio_setup.c
index 99d7d2566a3a..d4101cecdc8d 100644
--- a/drivers/s390/cio/qdio_setup.c
+++ b/drivers/s390/cio/qdio_setup.c
@@ -150,6 +150,7 @@ static int __qdio_allocate_qs(struct qdio_q **irq_ptr_qs, int nr_queues)
                         return -ENOMEM;
                 }
                 irq_ptr_qs[i] = q;
+                INIT_LIST_HEAD(&q->entry);
         }
         return 0;
 }
@@ -178,6 +179,7 @@ static void setup_queues_misc(struct qdio_q *q, struct qdio_irq *irq_ptr,
         q->mask = 1 << (31 - i);
         q->nr = i;
         q->handler = handler;
+        INIT_LIST_HEAD(&q->entry);
 }
 
 static void setup_storage_lists(struct qdio_q *q, struct qdio_irq *irq_ptr,
diff --git a/drivers/s390/cio/qdio_thinint.c b/drivers/s390/cio/qdio_thinint.c
index 28d59ac2204c..93ee067c10ca 100644
--- a/drivers/s390/cio/qdio_thinint.c
+++ b/drivers/s390/cio/qdio_thinint.c
@@ -79,7 +79,6 @@ void tiqdio_add_input_queues(struct qdio_irq *irq_ptr)
         mutex_lock(&tiq_list_lock);
         list_add_rcu(&irq_ptr->input_qs[0]->entry, &tiq_list);
         mutex_unlock(&tiq_list_lock);
-        xchg(irq_ptr->dsci, 1 << 7);
 }
 
 void tiqdio_remove_input_queues(struct qdio_irq *irq_ptr)
@@ -87,14 +86,14 @@ void tiqdio_remove_input_queues(struct qdio_irq *irq_ptr)
         struct qdio_q *q;
 
         q = irq_ptr->input_qs[0];
-        /* if establish triggered an error */
-        if (!q || !q->entry.prev || !q->entry.next)
+        if (!q)
                 return;
 
         mutex_lock(&tiq_list_lock);
         list_del_rcu(&q->entry);
         mutex_unlock(&tiq_list_lock);
         synchronize_rcu();
+        INIT_LIST_HEAD(&q->entry);
 }
 
 static inline int has_multiple_inq_on_dsci(struct qdio_irq *irq_ptr)
@@ -178,6 +177,7 @@ static inline void tiqdio_call_inq_handlers(struct qdio_irq *irq)
 /**
  * tiqdio_thinint_handler - thin interrupt handler for qdio
  * @airq: pointer to adapter interrupt descriptor
+ * @floating: flag to recognize floating vs. directed interrupts (unused)
  */
 static void tiqdio_thinint_handler(struct airq_struct *airq, bool floating)
 {
diff --git a/drivers/s390/cio/vfio_ccw_cp.c b/drivers/s390/cio/vfio_ccw_cp.c
index 0e79799e9a71..1d4c893ead23 100644
--- a/drivers/s390/cio/vfio_ccw_cp.c
+++ b/drivers/s390/cio/vfio_ccw_cp.c
@@ -16,12 +16,6 @@
 
 #include "vfio_ccw_cp.h"
 
-/*
- * Max length for ccw chain.
- * XXX: Limit to 256, need to check more?
- */
-#define CCWCHAIN_LEN_MAX        256
-
 struct pfn_array {
         /* Starting guest physical I/O address. */
         unsigned long           pa_iova;
@@ -33,11 +27,6 @@ struct pfn_array {
         int                     pa_nr;
 };
 
-struct pfn_array_table {
-        struct pfn_array        *pat_pa;
-        int                     pat_nr;
-};
-
 struct ccwchain {
         struct list_head        next;
         struct ccw1             *ch_ccw;
@@ -46,35 +35,29 @@ struct ccwchain {
         /* Count of the valid ccws in chain. */
         int                     ch_len;
         /* Pinned PAGEs for the original data. */
-        struct pfn_array_table  *ch_pat;
+        struct pfn_array        *ch_pa;
 };
 
 /*
- * pfn_array_alloc_pin() - alloc memory for PFNs, then pin user pages in memory
+ * pfn_array_alloc() - alloc memory for PFNs
  * @pa: pfn_array on which to perform the operation
- * @mdev: the mediated device to perform pin/unpin operations
  * @iova: target guest physical address
  * @len: number of bytes that should be pinned from @iova
  *
- * Attempt to allocate memory for PFNs, and pin user pages in memory.
+ * Attempt to allocate memory for PFNs.
  *
  * Usage of pfn_array:
  * We expect (pa_nr == 0) and (pa_iova_pfn == NULL), any field in
  * this structure will be filled in by this function.
  *
  * Returns:
- *   Number of pages pinned on success.
- *   If @pa->pa_nr is not 0, or @pa->pa_iova_pfn is not NULL initially,
- *   returns -EINVAL.
- *   If no pages were pinned, returns -errno.
+ *         0 if PFNs are allocated
+ *   -EINVAL if pa->pa_nr is not initially zero, or pa->pa_iova_pfn is not NULL
+ *   -ENOMEM if alloc failed
  */
-static int pfn_array_alloc_pin(struct pfn_array *pa, struct device *mdev,
-                               u64 iova, unsigned int len)
+static int pfn_array_alloc(struct pfn_array *pa, u64 iova, unsigned int len)
 {
-        int i, ret = 0;
-
-        if (!len)
-                return 0;
+        int i;
 
         if (pa->pa_nr || pa->pa_iova_pfn)
                 return -EINVAL;
@@ -94,8 +77,27 @@ static int pfn_array_alloc_pin(struct pfn_array *pa, struct device *mdev,
         pa->pa_pfn = pa->pa_iova_pfn + pa->pa_nr;
 
         pa->pa_iova_pfn[0] = pa->pa_iova >> PAGE_SHIFT;
-        for (i = 1; i < pa->pa_nr; i++)
+        pa->pa_pfn[0] = -1ULL;
+        for (i = 1; i < pa->pa_nr; i++) {
                 pa->pa_iova_pfn[i] = pa->pa_iova_pfn[i - 1] + 1;
+                pa->pa_pfn[i] = -1ULL;
+        }
+
+        return 0;
+}
+
+/*
+ * pfn_array_pin() - Pin user pages in memory
+ * @pa: pfn_array on which to perform the operation
+ * @mdev: the mediated device to perform pin operations
+ *
+ * Returns number of pages pinned upon success.
+ * If the pin request partially succeeds, or fails completely,
+ * all pages are left unpinned and a negative error value is returned.
+ */
+static int pfn_array_pin(struct pfn_array *pa, struct device *mdev)
+{
+        int ret = 0;
 
         ret = vfio_pin_pages(mdev, pa->pa_iova_pfn, pa->pa_nr,
                              IOMMU_READ | IOMMU_WRITE, pa->pa_pfn);
@@ -112,8 +114,6 @@ static int pfn_array_alloc_pin(struct pfn_array *pa, struct device *mdev,
 
 err_out:
         pa->pa_nr = 0;
-        kfree(pa->pa_iova_pfn);
-        pa->pa_iova_pfn = NULL;
 
         return ret;
 }
@@ -121,60 +121,30 @@ err_out:
 /* Unpin the pages before releasing the memory. */
 static void pfn_array_unpin_free(struct pfn_array *pa, struct device *mdev)
 {
-        vfio_unpin_pages(mdev, pa->pa_iova_pfn, pa->pa_nr);
+        /* Only unpin if any pages were pinned to begin with */
+        if (pa->pa_nr)
+                vfio_unpin_pages(mdev, pa->pa_iova_pfn, pa->pa_nr);
         pa->pa_nr = 0;
         kfree(pa->pa_iova_pfn);
 }
 
-static int pfn_array_table_init(struct pfn_array_table *pat, int nr)
-{
-        pat->pat_pa = kcalloc(nr, sizeof(*pat->pat_pa), GFP_KERNEL);
-        if (unlikely(ZERO_OR_NULL_PTR(pat->pat_pa))) {
-                pat->pat_nr = 0;
-                return -ENOMEM;
-        }
-
-        pat->pat_nr = nr;
-
-        return 0;
-}
-
-static void pfn_array_table_unpin_free(struct pfn_array_table *pat,
-                                       struct device *mdev)
+static bool pfn_array_iova_pinned(struct pfn_array *pa, unsigned long iova)
 {
-        int i;
-
-        for (i = 0; i < pat->pat_nr; i++)
-                pfn_array_unpin_free(pat->pat_pa + i, mdev);
-
-        if (pat->pat_nr) {
-                kfree(pat->pat_pa);
-                pat->pat_pa = NULL;
-                pat->pat_nr = 0;
-        }
-}
-
-static bool pfn_array_table_iova_pinned(struct pfn_array_table *pat,
-                                        unsigned long iova)
-{
-        struct pfn_array *pa = pat->pat_pa;
         unsigned long iova_pfn = iova >> PAGE_SHIFT;
-        int i, j;
+        int i;
 
-        for (i = 0; i < pat->pat_nr; i++, pa++)
-                for (j = 0; j < pa->pa_nr; j++)
-                        if (pa->pa_iova_pfn[j] == iova_pfn)
-                                return true;
+        for (i = 0; i < pa->pa_nr; i++)
+                if (pa->pa_iova_pfn[i] == iova_pfn)
+                        return true;
 
         return false;
 }
-/* Create the list idal words for a pfn_array_table. */
-static inline void pfn_array_table_idal_create_words(
-        struct pfn_array_table *pat,
+/* Create the list of IDAL words for a pfn_array. */
+static inline void pfn_array_idal_create_words(
+        struct pfn_array *pa,
         unsigned long *idaws)
 {
-        struct pfn_array *pa;
-        int i, j, k;
+        int i;
 
         /*
          * Idal words (execept the first one) rely on the memory being 4k
@@ -183,19 +153,36 @@ static inline void pfn_array_table_idal_create_words(
          * there will be no problem here to simply use the phys to create an
          * idaw.
          */
-        k = 0;
-        for (i = 0; i < pat->pat_nr; i++) {
-                pa = pat->pat_pa + i;
-                for (j = 0; j < pa->pa_nr; j++) {
-                        idaws[k] = pa->pa_pfn[j] << PAGE_SHIFT;
-                        if (k == 0)
-                                idaws[k] += pa->pa_iova & (PAGE_SIZE - 1);
-                        k++;
+
+        for (i = 0; i < pa->pa_nr; i++)
+                idaws[i] = pa->pa_pfn[i] << PAGE_SHIFT;
+
+        /* Adjust the first IDAW, since it may not start on a page boundary */
+        idaws[0] += pa->pa_iova & (PAGE_SIZE - 1);
+}
+
+static void convert_ccw0_to_ccw1(struct ccw1 *source, unsigned long len)
+{
+        struct ccw0 ccw0;
+        struct ccw1 *pccw1 = source;
+        int i;
+
+        for (i = 0; i < len; i++) {
+                ccw0 = *(struct ccw0 *)pccw1;
+                if ((pccw1->cmd_code & 0x0f) == CCW_CMD_TIC) {
+                        pccw1->cmd_code = CCW_CMD_TIC;
+                        pccw1->flags = 0;
+                        pccw1->count = 0;
+                } else {
+                        pccw1->cmd_code = ccw0.cmd_code;
+                        pccw1->flags = ccw0.flags;
+                        pccw1->count = ccw0.count;
                 }
+                pccw1->cda = ccw0.cda;
+                pccw1++;
         }
 }
 
-
 /*
  * Within the domain (@mdev), copy @n bytes from a guest physical
  * address (@iova) to a host physical address (@to).
@@ -209,9 +196,15 @@ static long copy_from_iova(struct device *mdev,
         int i, ret;
         unsigned long l, m;
 
-        ret = pfn_array_alloc_pin(&pa, mdev, iova, n);
-        if (ret <= 0)
+        ret = pfn_array_alloc(&pa, iova, n);
+        if (ret < 0)
+                return ret;
+
+        ret = pfn_array_pin(&pa, mdev);
+        if (ret < 0) {
+                pfn_array_unpin_free(&pa, mdev);
                 return ret;
+        }
 
         l = n;
         for (i = 0; i < pa.pa_nr; i++) {
@@ -235,55 +228,60 @@ static long copy_from_iova(struct device *mdev,
         return l;
 }
 
-static long copy_ccw_from_iova(struct channel_program *cp,
-                               struct ccw1 *to, u64 iova,
-                               unsigned long len)
-{
-        struct ccw0 ccw0;
-        struct ccw1 *pccw1;
-        int ret;
-        int i;
-
-        ret = copy_from_iova(cp->mdev, to, iova, len * sizeof(struct ccw1));
-        if (ret)
-                return ret;
-
-        if (!cp->orb.cmd.fmt) {
-                pccw1 = to;
-                for (i = 0; i < len; i++) {
-                        ccw0 = *(struct ccw0 *)pccw1;
-                        if ((pccw1->cmd_code & 0x0f) == CCW_CMD_TIC) {
-                                pccw1->cmd_code = CCW_CMD_TIC;
-                                pccw1->flags = 0;
-                                pccw1->count = 0;
-                        } else {
-                                pccw1->cmd_code = ccw0.cmd_code;
-                                pccw1->flags = ccw0.flags;
-                                pccw1->count = ccw0.count;
-                        }
-                        pccw1->cda = ccw0.cda;
-                        pccw1++;
-                }
-        }
-
-        return ret;
-}
-
 /*
  * Helpers to operate ccwchain.
  */
-#define ccw_is_test(_ccw) (((_ccw)->cmd_code & 0x0F) == 0)
+#define ccw_is_read(_ccw) (((_ccw)->cmd_code & 0x03) == 0x02)
+#define ccw_is_read_backward(_ccw) (((_ccw)->cmd_code & 0x0F) == 0x0C)
+#define ccw_is_sense(_ccw) (((_ccw)->cmd_code & 0x0F) == CCW_CMD_BASIC_SENSE)
 
 #define ccw_is_noop(_ccw) ((_ccw)->cmd_code == CCW_CMD_NOOP)
 
 #define ccw_is_tic(_ccw) ((_ccw)->cmd_code == CCW_CMD_TIC)
 
 #define ccw_is_idal(_ccw) ((_ccw)->flags & CCW_FLAG_IDA)
-
+#define ccw_is_skip(_ccw) ((_ccw)->flags & CCW_FLAG_SKIP)
 
 #define ccw_is_chain(_ccw) ((_ccw)->flags & (CCW_FLAG_CC | CCW_FLAG_DC))
 
 /*
+ * ccw_does_data_transfer()
+ *
+ * Determine whether a CCW will move any data, such that the guest pages
+ * would need to be pinned before performing the I/O.
+ *
+ * Returns 1 if yes, 0 if no.
+ */
+static inline int ccw_does_data_transfer(struct ccw1 *ccw)
+{
+        /* If the count field is zero, then no data will be transferred */
+        if (ccw->count == 0)
+                return 0;
+
+        /* If the command is a NOP, then no data will be transferred */
+        if (ccw_is_noop(ccw))
+                return 0;
+
+        /* If the skip flag is off, then data will be transferred */
+        if (!ccw_is_skip(ccw))
+                return 1;
+
+        /*
+         * If the skip flag is on, it is only meaningful if the command
+         * code is a read, read backward, sense, or sense ID.  In those
+         * cases, no data will be transferred.
+         */
+        if (ccw_is_read(ccw) || ccw_is_read_backward(ccw))
+                return 0;
+
+        if (ccw_is_sense(ccw))
+                return 0;
+
+        /* The skip flag is on, but it is ignored for this command code. */
+        return 1;
+}
+
+/*
  * is_cpa_within_range()
  *
  * @cpa: channel program address being questioned
@@ -319,7 +317,7 @@ static struct ccwchain *ccwchain_alloc(struct channel_program *cp, int len)
         /* Make ccw address aligned to 8. */
         size = ((sizeof(*chain) + 7L) & -8L) +
                 sizeof(*chain->ch_ccw) * len +
-                sizeof(*chain->ch_pat) * len;
+                sizeof(*chain->ch_pa) * len;
         chain = kzalloc(size, GFP_DMA | GFP_KERNEL);
         if (!chain)
                 return NULL;
@@ -328,7 +326,7 @@ static struct ccwchain *ccwchain_alloc(struct channel_program *cp, int len)
         chain->ch_ccw = (struct ccw1 *)data;
 
         data = (u8 *)(chain->ch_ccw) + sizeof(*chain->ch_ccw) * len;
-        chain->ch_pat = (struct pfn_array_table *)data;
+        chain->ch_pa = (struct pfn_array *)data;
 
         chain->ch_len = len;
 
@@ -348,31 +346,12 @@ static void ccwchain_cda_free(struct ccwchain *chain, int idx)
 {
         struct ccw1 *ccw = chain->ch_ccw + idx;
 
-        if (ccw_is_test(ccw) || ccw_is_noop(ccw) || ccw_is_tic(ccw))
-                return;
-        if (!ccw->count)
+        if (ccw_is_tic(ccw))
                 return;
 
         kfree((void *)(u64)ccw->cda);
 }
 
-/* Unpin the pages then free the memory resources. */
-static void cp_unpin_free(struct channel_program *cp)
-{
-        struct ccwchain *chain, *temp;
-        int i;
-
-        cp->initialized = false;
-        list_for_each_entry_safe(chain, temp, &cp->ccwchain_list, next) {
-                for (i = 0; i < chain->ch_len; i++) {
-                        pfn_array_table_unpin_free(chain->ch_pat + i,
-                                                   cp->mdev);
-                        ccwchain_cda_free(chain, i);
-                }
-                ccwchain_free(chain);
-        }
-}
-
 /**
  * ccwchain_calc_length - calculate the length of the ccw chain.
  * @iova: guest physical address of the target ccw chain
@@ -388,25 +367,9 @@ static void cp_unpin_free(struct channel_program *cp)
  */
 static int ccwchain_calc_length(u64 iova, struct channel_program *cp)
 {
-        struct ccw1 *ccw, *p;
-        int cnt;
-
-        /*
-         * Copy current chain from guest to host kernel.
-         * Currently the chain length is limited to CCWCHAIN_LEN_MAX (256).
-         * So copying 2K is enough (safe).
-         */
-        p = ccw = kcalloc(CCWCHAIN_LEN_MAX, sizeof(*ccw), GFP_KERNEL);
-        if (!ccw)
-                return -ENOMEM;
-
-        cnt = copy_ccw_from_iova(cp, ccw, iova, CCWCHAIN_LEN_MAX);
-        if (cnt) {
-                kfree(ccw);
-                return cnt;
-        }
+        struct ccw1 *ccw = cp->guest_cp;
+        int cnt = 0;
 
-        cnt = 0;
         do {
                 cnt++;
 
@@ -415,10 +378,8 @@ static int ccwchain_calc_length(u64 iova, struct channel_program *cp)
                  * orb specified one of the unsupported formats, we defer
                  * checking for IDAWs in unsupported formats to here.
                  */
-                if ((!cp->orb.cmd.c64 || cp->orb.cmd.i2k) && ccw_is_idal(ccw)) {
-                        kfree(p);
+                if ((!cp->orb.cmd.c64 || cp->orb.cmd.i2k) && ccw_is_idal(ccw))
                         return -EOPNOTSUPP;
-                }
 
                 /*
                  * We want to keep counting if the current CCW has the
@@ -437,7 +398,6 @@ static int ccwchain_calc_length(u64 iova, struct channel_program *cp)
         if (cnt == CCWCHAIN_LEN_MAX + 1)
                 cnt = -EINVAL;
 
-        kfree(p);
         return cnt;
 }
 
@@ -458,17 +418,23 @@ static int tic_target_chain_exists(struct ccw1 *tic, struct channel_program *cp)
 static int ccwchain_loop_tic(struct ccwchain *chain,
                              struct channel_program *cp);
 
-static int ccwchain_handle_tic(struct ccw1 *tic, struct channel_program *cp)
+static int ccwchain_handle_ccw(u32 cda, struct channel_program *cp)
 {
         struct ccwchain *chain;
-        int len, ret;
+        int len;
 
-        /* May transfer to an existing chain. */
-        if (tic_target_chain_exists(tic, cp))
-                return 0;
+        /* Copy 2K (the most we support today) of possible CCWs */
+        len = copy_from_iova(cp->mdev, cp->guest_cp, cda,
+                             CCWCHAIN_LEN_MAX * sizeof(struct ccw1));
+        if (len)
+                return len;
 
-        /* Get chain length. */
-        len = ccwchain_calc_length(tic->cda, cp);
+        /* Convert any Format-0 CCWs to Format-1 */
+        if (!cp->orb.cmd.fmt)
+                convert_ccw0_to_ccw1(cp->guest_cp, CCWCHAIN_LEN_MAX);
+
+        /* Count the CCWs in the current chain */
+        len = ccwchain_calc_length(cda, cp);
         if (len < 0)
                 return len;
 
@@ -476,14 +442,10 @@ static int ccwchain_handle_tic(struct ccw1 *tic, struct channel_program *cp)
         chain = ccwchain_alloc(cp, len);
         if (!chain)
                 return -ENOMEM;
-        chain->ch_iova = tic->cda;
+        chain->ch_iova = cda;
 
-        /* Copy the new chain from user. */
-        ret = copy_ccw_from_iova(cp, chain->ch_ccw, tic->cda, len);
-        if (ret) {
-                ccwchain_free(chain);
-                return ret;
-        }
+        /* Copy the actual CCWs into the new chain */
+        memcpy(chain->ch_ccw, cp->guest_cp, len * sizeof(struct ccw1));
 
         /* Loop for tics on this new chain. */
         return ccwchain_loop_tic(chain, cp);
@@ -501,7 +463,12 @@ static int ccwchain_loop_tic(struct ccwchain *chain, struct channel_program *cp)
                 if (!ccw_is_tic(tic))
                         continue;
 
-                ret = ccwchain_handle_tic(tic, cp);
+                /* May transfer to an existing chain. */
+                if (tic_target_chain_exists(tic, cp))
+                        continue;
+
+                /* Build a ccwchain for the next segment */
+                ret = ccwchain_handle_ccw(tic->cda, cp);
                 if (ret)
                         return ret;
         }
@@ -534,115 +501,90 @@ static int ccwchain_fetch_direct(struct ccwchain *chain,
                                  struct channel_program *cp)
 {
         struct ccw1 *ccw;
-        struct pfn_array_table *pat;
+        struct pfn_array *pa;
+        u64 iova;
         unsigned long *idaws;
         int ret;
+        int bytes = 1;
+        int idaw_nr, idal_len;
+        int i;
 
         ccw = chain->ch_ccw + idx;
 
-        if (!ccw->count) {
-                /*
-                 * We just want the translation result of any direct ccw
-                 * to be an IDA ccw, so let's add the IDA flag for it.
-                 * Although the flag will be ignored by firmware.
-                 */
-                ccw->flags |= CCW_FLAG_IDA;
-                return 0;
-        }
-
-        /*
-         * Pin data page(s) in memory.
-         * The number of pages actually is the count of the idaws which will be
-         * needed when translating a direct ccw to a idal ccw.
-         */
-        pat = chain->ch_pat + idx;
-        ret = pfn_array_table_init(pat, 1);
-        if (ret)
-                goto out_init;
-
-        ret = pfn_array_alloc_pin(pat->pat_pa, cp->mdev, ccw->cda, ccw->count);
-        if (ret < 0)
-                goto out_unpin;
+        if (ccw->count)
+                bytes = ccw->count;
 
-        /* Translate this direct ccw to a idal ccw. */
-        idaws = kcalloc(ret, sizeof(*idaws), GFP_DMA | GFP_KERNEL);
-        if (!idaws) {
-                ret = -ENOMEM;
-                goto out_unpin;
+        /* Calculate size of IDAL */
+        if (ccw_is_idal(ccw)) {
+                /* Read first IDAW to see if it's 4K-aligned or not. */
+                /* All subsequent IDAws will be 4K-aligned. */
+                ret = copy_from_iova(cp->mdev, &iova, ccw->cda, sizeof(iova));
+                if (ret)
+                        return ret;
+        } else {
+                iova = ccw->cda;
         }
-        ccw->cda = (__u32) virt_to_phys(idaws);
-        ccw->flags |= CCW_FLAG_IDA;
-
-        pfn_array_table_idal_create_words(pat, idaws);
-
-        return 0;
-
-out_unpin:
-        pfn_array_table_unpin_free(pat, cp->mdev);
-out_init:
-        ccw->cda = 0;
-        return ret;
-}
-
-static int ccwchain_fetch_idal(struct ccwchain *chain,
-                               int idx,
-                               struct channel_program *cp)
-{
-        struct ccw1 *ccw;
-        struct pfn_array_table *pat;
-        unsigned long *idaws;
-        u64 idaw_iova;
-        unsigned int idaw_nr, idaw_len;
-        int i, ret;
-
-        ccw = chain->ch_ccw + idx;
-
-        if (!ccw->count)
-                return 0;
-
-        /* Calculate size of idaws. */
-        ret = copy_from_iova(cp->mdev, &idaw_iova, ccw->cda, sizeof(idaw_iova));
-        if (ret)
-                return ret;
-        idaw_nr = idal_nr_words((void *)(idaw_iova), ccw->count);
-        idaw_len = idaw_nr * sizeof(*idaws);
-
-        /* Pin data page(s) in memory. */
-        pat = chain->ch_pat + idx;
-        ret = pfn_array_table_init(pat, idaw_nr);
-        if (ret)
-                goto out_init;
+        idaw_nr = idal_nr_words((void *)iova, bytes);
+        idal_len = idaw_nr * sizeof(*idaws);
 
-        /* Translate idal ccw to use new allocated idaws. */
-        idaws = kzalloc(idaw_len, GFP_DMA | GFP_KERNEL);
+        /* Allocate an IDAL from host storage */
+        idaws = kcalloc(idaw_nr, sizeof(*idaws), GFP_DMA | GFP_KERNEL);
         if (!idaws) {
                 ret = -ENOMEM;
-                goto out_unpin;
+                goto out_init;
         }
 
-        ret = copy_from_iova(cp->mdev, idaws, ccw->cda, idaw_len);
-        if (ret)
+        /*
+         * Allocate an array of pfn's for pages to pin/translate.
+         * The number of pages is actually the count of the idaws
+         * required for the data transfer, since we only only support
+         * 4K IDAWs today.
+         */
+        pa = chain->ch_pa + idx;
+        ret = pfn_array_alloc(pa, iova, bytes);
+        if (ret < 0)
                 goto out_free_idaws;
 
-        ccw->cda = virt_to_phys(idaws);
+        if (ccw_is_idal(ccw)) {
+                /* Copy guest IDAL into host IDAL */
+                ret = copy_from_iova(cp->mdev, idaws, ccw->cda, idal_len);
+                if (ret)
+                        goto out_unpin;
 
-        for (i = 0; i < idaw_nr; i++) {
-                idaw_iova = *(idaws + i);
+                /*
+                 * Copy guest IDAWs into pfn_array, in case the memory they
+                 * occupy is not contiguous.
+                 */
+                for (i = 0; i < idaw_nr; i++)
+                        pa->pa_iova_pfn[i] = idaws[i] >> PAGE_SHIFT;
+        } else {
+                /*
+                 * No action is required here; the iova addresses in pfn_array
+                 * were initialized sequentially in pfn_array_alloc() beginning
+                 * with the contents of ccw->cda.
+                 */
+        }
 
-                ret = pfn_array_alloc_pin(pat->pat_pa + i, cp->mdev,
-                                          idaw_iova, 1);
+        if (ccw_does_data_transfer(ccw)) {
+                ret = pfn_array_pin(pa, cp->mdev);
                 if (ret < 0)
-                        goto out_free_idaws;
+                        goto out_unpin;
+        } else {
+                pa->pa_nr = 0;
         }
 
-        pfn_array_table_idal_create_words(pat, idaws);
+        ccw->cda = (__u32) virt_to_phys(idaws);
+        ccw->flags |= CCW_FLAG_IDA;
+
+        /* Populate the IDAL with pinned/translated addresses from pfn */
+        pfn_array_idal_create_words(pa, idaws);
 
         return 0;
 
+out_unpin:
+        pfn_array_unpin_free(pa, cp->mdev);
 out_free_idaws:
         kfree(idaws);
-out_unpin:
-        pfn_array_table_unpin_free(pat, cp->mdev);
 out_init:
         ccw->cda = 0;
         return ret;
@@ -660,15 +602,9 @@ static int ccwchain_fetch_one(struct ccwchain *chain,
 {
         struct ccw1 *ccw = chain->ch_ccw + idx;
 
-        if (ccw_is_test(ccw) || ccw_is_noop(ccw))
-                return 0;
-
         if (ccw_is_tic(ccw))
                 return ccwchain_fetch_tic(chain, idx, cp);
 
-        if (ccw_is_idal(ccw))
-                return ccwchain_fetch_idal(chain, idx, cp);
-
         return ccwchain_fetch_direct(chain, idx, cp);
 }
 
@@ -691,9 +627,7 @@ static int ccwchain_fetch_one(struct ccwchain *chain,
  */
 int cp_init(struct channel_program *cp, struct device *mdev, union orb *orb)
 {
-        u64 iova = orb->cmd.cpa;
-        struct ccwchain *chain;
-        int len, ret;
+        int ret;
 
         /*
          * XXX:
@@ -706,28 +640,11 @@ int cp_init(struct channel_program *cp, struct device *mdev, union orb *orb)
         memcpy(&cp->orb, orb, sizeof(*orb));
         cp->mdev = mdev;
 
-        /* Get chain length. */
-        len = ccwchain_calc_length(iova, cp);
-        if (len < 0)
-                return len;
-
-        /* Alloc mem for the head chain. */
-        chain = ccwchain_alloc(cp, len);
-        if (!chain)
-                return -ENOMEM;
-        chain->ch_iova = iova;
-
-        /* Copy the head chain from guest. */
-        ret = copy_ccw_from_iova(cp, chain->ch_ccw, iova, len);
-        if (ret) {
-                ccwchain_free(chain);
-                return ret;
-        }
-
-        /* Now loop for its TICs. */
-        ret = ccwchain_loop_tic(chain, cp);
+        /* Build a ccwchain for the first CCW segment */
+        ret = ccwchain_handle_ccw(orb->cmd.cpa, cp);
         if (ret)
-                cp_unpin_free(cp);
+                cp_free(cp);
+
         /* It is safe to force: if not set but idals used
          * ccwchain_calc_length returns an error.
          */
@@ -750,8 +667,20 @@ int cp_init(struct channel_program *cp, struct device *mdev, union orb *orb)
  */
 void cp_free(struct channel_program *cp)
 {
-        if (cp->initialized)
-                cp_unpin_free(cp);
+        struct ccwchain *chain, *temp;
+        int i;
+
+        if (!cp->initialized)
+                return;
+
+        cp->initialized = false;
+        list_for_each_entry_safe(chain, temp, &cp->ccwchain_list, next) {
+                for (i = 0; i < chain->ch_len; i++) {
+                        pfn_array_unpin_free(chain->ch_pa + i, cp->mdev);
+                        ccwchain_cda_free(chain, i);
+                }
+                ccwchain_free(chain);
+        }
 }
 
 /**
@@ -886,7 +815,11 @@ void cp_update_scsw(struct channel_program *cp, union scsw *scsw)
          */
         list_for_each_entry(chain, &cp->ccwchain_list, next) {
                 ccw_head = (u32)(u64)chain->ch_ccw;
-                if (is_cpa_within_range(cpa, ccw_head, chain->ch_len)) {
+                /*
+                 * On successful execution, cpa points just beyond the end
+                 * of the chain.
+                 */
+                if (is_cpa_within_range(cpa, ccw_head, chain->ch_len + 1)) {
                         /*
                          * (cpa - ccw_head) is the offset value of the host
                          * physical ccw to its chain head.
@@ -919,8 +852,7 @@ bool cp_iova_pinned(struct channel_program *cp, u64 iova)
 
         list_for_each_entry(chain, &cp->ccwchain_list, next) {
                 for (i = 0; i < chain->ch_len; i++)
-                        if (pfn_array_table_iova_pinned(chain->ch_pat + i,
-                                                        iova))
+                        if (pfn_array_iova_pinned(chain->ch_pa + i, iova))
                                 return true;
         }
 
diff --git a/drivers/s390/cio/vfio_ccw_cp.h b/drivers/s390/cio/vfio_ccw_cp.h
index 3c20cd208da5..7cdc38049033 100644
--- a/drivers/s390/cio/vfio_ccw_cp.h
+++ b/drivers/s390/cio/vfio_ccw_cp.h
@@ -16,6 +16,12 @@
 
 #include "orb.h"
 
+/*
+ * Max length for ccw chain.
+ * XXX: Limit to 256, need to check more?
+ */
+#define CCWCHAIN_LEN_MAX        256
+
 /**
  * struct channel_program - manage information for channel program
  * @ccwchain_list: list head of ccwchains
@@ -32,6 +38,7 @@ struct channel_program {
         union orb orb;
         struct device *mdev;
         bool initialized;
+        struct ccw1 *guest_cp;
 };
 
 extern int cp_init(struct channel_program *cp, struct device *mdev,
diff --git a/drivers/s390/cio/vfio_ccw_drv.c b/drivers/s390/cio/vfio_ccw_drv.c
index 9125f7f4e64c..2b90a5ecaeb9 100644
--- a/drivers/s390/cio/vfio_ccw_drv.c
+++ b/drivers/s390/cio/vfio_ccw_drv.c
@@ -95,11 +95,11 @@ static void vfio_ccw_sch_io_todo(struct work_struct *work)
         memcpy(private->io_region->irb_area, irb, sizeof(*irb));
         mutex_unlock(&private->io_mutex);
 
-        if (private->io_trigger)
-                eventfd_signal(private->io_trigger, 1);
-
         if (private->mdev && is_final)
                 private->state = VFIO_CCW_STATE_IDLE;
+
+        if (private->io_trigger)
+                eventfd_signal(private->io_trigger, 1);
 }
 
 /*
@@ -129,6 +129,11 @@ static int vfio_ccw_sch_probe(struct subchannel *sch)
         if (!private)
                 return -ENOMEM;
 
+        private->cp.guest_cp = kcalloc(CCWCHAIN_LEN_MAX, sizeof(struct ccw1),
+                                       GFP_KERNEL);
+        if (!private->cp.guest_cp)
+                goto out_free;
+
         private->io_region = kmem_cache_zalloc(vfio_ccw_io_region,
                                                GFP_KERNEL | GFP_DMA);
         if (!private->io_region)
@@ -169,6 +174,7 @@ out_free:
                 kmem_cache_free(vfio_ccw_cmd_region, private->cmd_region);
         if (private->io_region)
                 kmem_cache_free(vfio_ccw_io_region, private->io_region);
+        kfree(private->cp.guest_cp);
         kfree(private);
         return ret;
 }
@@ -185,6 +191,7 @@ static int vfio_ccw_sch_remove(struct subchannel *sch)
 
         kmem_cache_free(vfio_ccw_cmd_region, private->cmd_region);
         kmem_cache_free(vfio_ccw_io_region, private->io_region);
+        kfree(private->cp.guest_cp);
         kfree(private);
 
         return 0;
diff --git a/drivers/s390/crypto/pkey_api.c b/drivers/s390/crypto/pkey_api.c
index 45eb0c14b880..7f418d2d8cdf 100644
--- a/drivers/s390/crypto/pkey_api.c
+++ b/drivers/s390/crypto/pkey_api.c
@@ -690,7 +690,7 @@ int pkey_clr2protkey(u32 keytype,
          */
         if (!cpacf_test_func(&pckmo_functions, fc)) {
                 DEBUG_ERR("%s pckmo functions not available\n", __func__);
-                return -EOPNOTSUPP;
+                return -ENODEV;
         }
 
         /* prepare param block */
@@ -1695,15 +1695,15 @@ static int __init pkey_init(void)
          * are able to work with protected keys.
          */
         if (!cpacf_query(CPACF_PCKMO, &pckmo_functions))
-                return -EOPNOTSUPP;
+                return -ENODEV;
 
         /* check for kmc instructions available */
         if (!cpacf_query(CPACF_KMC, &kmc_functions))
-                return -EOPNOTSUPP;
+                return -ENODEV;
         if (!cpacf_test_func(&kmc_functions, CPACF_KMC_PAES_128) ||
             !cpacf_test_func(&kmc_functions, CPACF_KMC_PAES_192) ||
             !cpacf_test_func(&kmc_functions, CPACF_KMC_PAES_256))
-                return -EOPNOTSUPP;
+                return -ENODEV;
 
         pkey_debug_init();
 
diff --git a/drivers/s390/crypto/vfio_ap_drv.c b/drivers/s390/crypto/vfio_ap_drv.c
index e9824c35c34f..003662aa8060 100644
--- a/drivers/s390/crypto/vfio_ap_drv.c
+++ b/drivers/s390/crypto/vfio_ap_drv.c
@@ -5,6 +5,7 @@
  * Copyright IBM Corp. 2018
  *
  * Author(s): Tony Krowiak <akrowiak@linux.ibm.com>
+ *            Pierre Morel <pmorel@linux.ibm.com>
  */
 
 #include <linux/module.h>
@@ -40,14 +41,45 @@ static struct ap_device_id ap_queue_ids[] = {
 
 MODULE_DEVICE_TABLE(vfio_ap, ap_queue_ids);
 
+/**
+ * vfio_ap_queue_dev_probe:
+ *
+ * Allocate a vfio_ap_queue structure and associate it
+ * with the device as driver_data.
+ */
 static int vfio_ap_queue_dev_probe(struct ap_device *apdev)
 {
+        struct vfio_ap_queue *q;
+
+        q = kzalloc(sizeof(*q), GFP_KERNEL);
+        if (!q)
+                return -ENOMEM;
+        dev_set_drvdata(&apdev->device, q);
+        q->apqn = to_ap_queue(&apdev->device)->qid;
+        q->saved_isc = VFIO_AP_ISC_INVALID;
         return 0;
 }
 
+/**
+ * vfio_ap_queue_dev_remove:
+ *
+ * Takes the matrix lock to avoid actions on this device while removing
+ * Free the associated vfio_ap_queue structure
+ */
 static void vfio_ap_queue_dev_remove(struct ap_device *apdev)
 {
-        /* Nothing to do yet */
+        struct vfio_ap_queue *q;
+        int apid, apqi;
+
+        mutex_lock(&matrix_dev->lock);
+        q = dev_get_drvdata(&apdev->device);
+        dev_set_drvdata(&apdev->device, NULL);
+        apid = AP_QID_CARD(q->apqn);
+        apqi = AP_QID_QUEUE(q->apqn);
+        vfio_ap_mdev_reset_queue(apid, apqi, 1);
+        vfio_ap_irq_disable(q);
+        kfree(q);
+        mutex_unlock(&matrix_dev->lock);
 }
 
 static void vfio_ap_matrix_dev_release(struct device *dev)
diff --git a/drivers/s390/crypto/vfio_ap_ops.c b/drivers/s390/crypto/vfio_ap_ops.c
index 900b9cf20ca5..2c9fb1423a39 100644
--- a/drivers/s390/crypto/vfio_ap_ops.c
+++ b/drivers/s390/crypto/vfio_ap_ops.c
@@ -24,6 +24,296 @@
 #define VFIO_AP_MDEV_TYPE_HWVIRT "passthrough"
 #define VFIO_AP_MDEV_NAME_HWVIRT "VFIO AP Passthrough Device"
 
+static int vfio_ap_mdev_reset_queues(struct mdev_device *mdev);
+
+static int match_apqn(struct device *dev, void *data)
+{
+        struct vfio_ap_queue *q = dev_get_drvdata(dev);
+
+        return (q->apqn == *(int *)(data)) ? 1 : 0;
+}
+
+/**
+ * vfio_ap_get_queue: Retrieve a queue with a specific APQN from a list
+ * @matrix_mdev: the associated mediated matrix
+ * @apqn: The queue APQN
+ *
+ * Retrieve a queue with a specific APQN from the list of the
+ * devices of the vfio_ap_drv.
+ * Verify that the APID and the APQI are set in the matrix.
+ *
+ * Returns the pointer to the associated vfio_ap_queue
+ */
+static struct vfio_ap_queue *vfio_ap_get_queue(
+                                        struct ap_matrix_mdev *matrix_mdev,
+                                        int apqn)
+{
+        struct vfio_ap_queue *q;
+        struct device *dev;
+
+        if (!test_bit_inv(AP_QID_CARD(apqn), matrix_mdev->matrix.apm))
+                return NULL;
+        if (!test_bit_inv(AP_QID_QUEUE(apqn), matrix_mdev->matrix.aqm))
+                return NULL;
+
+        dev = driver_find_device(&matrix_dev->vfio_ap_drv->driver, NULL,
+                                 &apqn, match_apqn);
+        if (!dev)
+                return NULL;
+        q = dev_get_drvdata(dev);
+        q->matrix_mdev = matrix_mdev;
+        put_device(dev);
+
+        return q;
+}
+
+/**
+ * vfio_ap_wait_for_irqclear
+ * @apqn: The AP Queue number
+ *
+ * Checks the IRQ bit for the status of this APQN using ap_tapq.
+ * Returns if the ap_tapq function succeeded and the bit is clear.
+ * Returns if ap_tapq function failed with invalid, deconfigured or
+ * checkstopped AP.
+ * Otherwise retries up to 5 times after waiting 20ms.
+ *
+ */
+static void vfio_ap_wait_for_irqclear(int apqn)
+{
+        struct ap_queue_status status;
+        int retry = 5;
+
+        do {
+                status = ap_tapq(apqn, NULL);
+                switch (status.response_code) {
+                case AP_RESPONSE_NORMAL:
+                case AP_RESPONSE_RESET_IN_PROGRESS:
+                        if (!status.irq_enabled)
+                                return;
+                        /* Fall through */
+                case AP_RESPONSE_BUSY:
+                        msleep(20);
+                        break;
+                case AP_RESPONSE_Q_NOT_AVAIL:
+                case AP_RESPONSE_DECONFIGURED:
+                case AP_RESPONSE_CHECKSTOPPED:
+                default:
+                        WARN_ONCE(1, "%s: tapq rc %02x: %04x\n", __func__,
+                                  status.response_code, apqn);
+                        return;
+                }
+        } while (--retry);
+
+        WARN_ONCE(1, "%s: tapq rc %02x: %04x could not clear IR bit\n",
+                  __func__, status.response_code, apqn);
+}
+
+/**
+ * vfio_ap_free_aqic_resources
+ * @q: The vfio_ap_queue
+ *
+ * Unregisters the ISC in the GIB when the saved ISC not invalid.
+ * Unpin the guest's page holding the NIB when it exist.
+ * Reset the saved_pfn and saved_isc to invalid values.
+ * Clear the pointer to the matrix mediated device.
+ *
+ */
+static void vfio_ap_free_aqic_resources(struct vfio_ap_queue *q)
+{
+        if (q->saved_isc != VFIO_AP_ISC_INVALID && q->matrix_mdev)
+                kvm_s390_gisc_unregister(q->matrix_mdev->kvm, q->saved_isc);
+        if (q->saved_pfn && q->matrix_mdev)
+                vfio_unpin_pages(mdev_dev(q->matrix_mdev->mdev),
+                                 &q->saved_pfn, 1);
+        q->saved_pfn = 0;
+        q->saved_isc = VFIO_AP_ISC_INVALID;
+        q->matrix_mdev = NULL;
+}
+
+/**
+ * vfio_ap_irq_disable
+ * @q: The vfio_ap_queue
+ *
+ * Uses ap_aqic to disable the interruption and in case of success, reset
+ * in progress or IRQ disable command already proceeded: calls
+ * vfio_ap_wait_for_irqclear() to check for the IRQ bit to be clear
+ * and calls vfio_ap_free_aqic_resources() to free the resources associated
+ * with the AP interrupt handling.
+ *
+ * In the case the AP is busy, or a reset is in progress,
+ * retries after 20ms, up to 5 times.
+ *
+ * Returns if ap_aqic function failed with invalid, deconfigured or
+ * checkstopped AP.
+ */
+struct ap_queue_status vfio_ap_irq_disable(struct vfio_ap_queue *q)
+{
+        struct ap_qirq_ctrl aqic_gisa = {};
+        struct ap_queue_status status;
+        int retries = 5;
+
+        do {
+                status = ap_aqic(q->apqn, aqic_gisa, NULL);
+                switch (status.response_code) {
+                case AP_RESPONSE_OTHERWISE_CHANGED:
+                case AP_RESPONSE_NORMAL:
+                        vfio_ap_wait_for_irqclear(q->apqn);
+                        goto end_free;
+                case AP_RESPONSE_RESET_IN_PROGRESS:
+                case AP_RESPONSE_BUSY:
+                        msleep(20);
+                        break;
+                case AP_RESPONSE_Q_NOT_AVAIL:
+                case AP_RESPONSE_DECONFIGURED:
+                case AP_RESPONSE_CHECKSTOPPED:
+                case AP_RESPONSE_INVALID_ADDRESS:
+                default:
+                        /* All cases in default means AP not operational */
+                        WARN_ONCE(1, "%s: ap_aqic status %d\n", __func__,
+                                  status.response_code);
+                        goto end_free;
+                }
+        } while (retries--);
+
+        WARN_ONCE(1, "%s: ap_aqic status %d\n", __func__,
+                  status.response_code);
+end_free:
+        vfio_ap_free_aqic_resources(q);
+        return status;
+}
+
+/**
+ * vfio_ap_setirq: Enable Interruption for a APQN
+ *
+ * @dev: the device associated with the ap_queue
+ * @q:   the vfio_ap_queue holding AQIC parameters
+ *
+ * Pin the NIB saved in *q
+ * Register the guest ISC to GIB interface and retrieve the
+ * host ISC to issue the host side PQAP/AQIC
+ *
+ * Response.status may be set to AP_RESPONSE_INVALID_ADDRESS in case the
+ * vfio_pin_pages failed.
+ *
+ * Otherwise return the ap_queue_status returned by the ap_aqic(),
+ * all retry handling will be done by the guest.
+ */
+static struct ap_queue_status vfio_ap_irq_enable(struct vfio_ap_queue *q,
+                                                 int isc,
+                                                 unsigned long nib)
+{
+        struct ap_qirq_ctrl aqic_gisa = {};
+        struct ap_queue_status status = {};
+        struct kvm_s390_gisa *gisa;
+        struct kvm *kvm;
+        unsigned long h_nib, g_pfn, h_pfn;
+        int ret;
+
+        g_pfn = nib >> PAGE_SHIFT;
+        ret = vfio_pin_pages(mdev_dev(q->matrix_mdev->mdev), &g_pfn, 1,
+                             IOMMU_READ | IOMMU_WRITE, &h_pfn);
+        switch (ret) {
+        case 1:
+                break;
+        default:
+                status.response_code = AP_RESPONSE_INVALID_ADDRESS;
+                return status;
+        }
+
+        kvm = q->matrix_mdev->kvm;
+        gisa = kvm->arch.gisa_int.origin;
+
+        h_nib = (h_pfn << PAGE_SHIFT) | (nib & ~PAGE_MASK);
+        aqic_gisa.gisc = isc;
+        aqic_gisa.isc = kvm_s390_gisc_register(kvm, isc);
+        aqic_gisa.ir = 1;
+        aqic_gisa.gisa = (uint64_t)gisa >> 4;
+
+        status = ap_aqic(q->apqn, aqic_gisa, (void *)h_nib);
+        switch (status.response_code) {
+        case AP_RESPONSE_NORMAL:
+                /* See if we did clear older IRQ configuration */
+                vfio_ap_free_aqic_resources(q);
+                q->saved_pfn = g_pfn;
+                q->saved_isc = isc;
+                break;
+        case AP_RESPONSE_OTHERWISE_CHANGED:
+                /* We could not modify IRQ setings: clear new configuration */
+                vfio_unpin_pages(mdev_dev(q->matrix_mdev->mdev), &g_pfn, 1);
+                kvm_s390_gisc_unregister(kvm, isc);
+                break;
+        default:
+                pr_warn("%s: apqn %04x: response: %02x\n", __func__, q->apqn,
+                        status.response_code);
+                vfio_ap_irq_disable(q);
+                break;
+        }
+
+        return status;
+}
+
+/**
+ * handle_pqap: PQAP instruction callback
+ *
+ * @vcpu: The vcpu on which we received the PQAP instruction
+ *
+ * Get the general register contents to initialize internal variables.
+ * REG[0]: APQN
+ * REG[1]: IR and ISC
+ * REG[2]: NIB
+ *
+ * Response.status may be set to following Response Code:
+ * - AP_RESPONSE_Q_NOT_AVAIL: if the queue is not available
+ * - AP_RESPONSE_DECONFIGURED: if the queue is not configured
+ * - AP_RESPONSE_NORMAL (0) : in case of successs
+ *   Check vfio_ap_setirq() and vfio_ap_clrirq() for other possible RC.
+ * We take the matrix_dev lock to ensure serialization on queues and
+ * mediated device access.
+ *
+ * Return 0 if we could handle the request inside KVM.
+ * otherwise, returns -EOPNOTSUPP to let QEMU handle the fault.
+ */
+static int handle_pqap(struct kvm_vcpu *vcpu)
+{
+        uint64_t status;
+        uint16_t apqn;
+        struct vfio_ap_queue *q;
+        struct ap_queue_status qstatus = {
+                               .response_code = AP_RESPONSE_Q_NOT_AVAIL, };
+        struct ap_matrix_mdev *matrix_mdev;
+
+        /* If we do not use the AIV facility just go to userland */
+        if (!(vcpu->arch.sie_block->eca & ECA_AIV))
+                return -EOPNOTSUPP;
+
+        apqn = vcpu->run->s.regs.gprs[0] & 0xffff;
+        mutex_lock(&matrix_dev->lock);
+
+        if (!vcpu->kvm->arch.crypto.pqap_hook)
+                goto out_unlock;
+        matrix_mdev = container_of(vcpu->kvm->arch.crypto.pqap_hook,
+                                   struct ap_matrix_mdev, pqap_hook);
+
+        q = vfio_ap_get_queue(matrix_mdev, apqn);
+        if (!q)
+                goto out_unlock;
+
+        status = vcpu->run->s.regs.gprs[1];
+
+        /* If IR bit(16) is set we enable the interrupt */
+        if ((status >> (63 - 16)) & 0x01)
+                qstatus = vfio_ap_irq_enable(q, status & 0x07,
+                                             vcpu->run->s.regs.gprs[2]);
+        else
+                qstatus = vfio_ap_irq_disable(q);
+
+out_unlock:
+        memcpy(&vcpu->run->s.regs.gprs[1], &qstatus, sizeof(qstatus));
+        vcpu->run->s.regs.gprs[1] >>= 32;
+        mutex_unlock(&matrix_dev->lock);
+        return 0;
+}
+
 static void vfio_ap_matrix_init(struct ap_config_info *info,
                                 struct ap_matrix *matrix)
 {
@@ -45,8 +335,11 @@ static int vfio_ap_mdev_create(struct kobject *kobj, struct mdev_device *mdev)
                 return -ENOMEM;
         }
 
+        matrix_mdev->mdev = mdev;
         vfio_ap_matrix_init(&matrix_dev->info, &matrix_mdev->matrix);
         mdev_set_drvdata(mdev, matrix_mdev);
+        matrix_mdev->pqap_hook.hook = handle_pqap;
+        matrix_mdev->pqap_hook.owner = THIS_MODULE;
         mutex_lock(&matrix_dev->lock);
         list_add(&matrix_mdev->node, &matrix_dev->mdev_list);
         mutex_unlock(&matrix_dev->lock);
@@ -62,6 +355,7 @@ static int vfio_ap_mdev_remove(struct mdev_device *mdev)
                 return -EBUSY;
 
         mutex_lock(&matrix_dev->lock);
+        vfio_ap_mdev_reset_queues(mdev);
         list_del(&matrix_mdev->node);
         mutex_unlock(&matrix_dev->lock);
 
@@ -754,11 +1048,42 @@ static int vfio_ap_mdev_set_kvm(struct ap_matrix_mdev *matrix_mdev,
         }
 
         matrix_mdev->kvm = kvm;
+        kvm_get_kvm(kvm);
+        kvm->arch.crypto.pqap_hook = &matrix_mdev->pqap_hook;
         mutex_unlock(&matrix_dev->lock);
 
         return 0;
 }
 
+/*
+ * vfio_ap_mdev_iommu_notifier: IOMMU notifier callback
+ *
+ * @nb: The notifier block
+ * @action: Action to be taken
+ * @data: data associated with the request
+ *
+ * For an UNMAP request, unpin the guest IOVA (the NIB guest address we
+ * pinned before). Other requests are ignored.
+ *
+ */
+static int vfio_ap_mdev_iommu_notifier(struct notifier_block *nb,
+                                       unsigned long action, void *data)
+{
+        struct ap_matrix_mdev *matrix_mdev;
+
+        matrix_mdev = container_of(nb, struct ap_matrix_mdev, iommu_notifier);
+
+        if (action == VFIO_IOMMU_NOTIFY_DMA_UNMAP) {
+                struct vfio_iommu_type1_dma_unmap *unmap = data;
+                unsigned long g_pfn = unmap->iova >> PAGE_SHIFT;
+
+                vfio_unpin_pages(mdev_dev(matrix_mdev->mdev), &g_pfn, 1);
+                return NOTIFY_OK;
+        }
+
+        return NOTIFY_DONE;
+}
+
 static int vfio_ap_mdev_group_notifier(struct notifier_block *nb,
                                        unsigned long action, void *data)
 {
@@ -790,15 +1115,36 @@ static int vfio_ap_mdev_group_notifier(struct notifier_block *nb,
         return NOTIFY_OK;
 }
 
-static int vfio_ap_mdev_reset_queue(unsigned int apid, unsigned int apqi,
-                                    unsigned int retry)
+static void vfio_ap_irq_disable_apqn(int apqn)
+{
+        struct device *dev;
+        struct vfio_ap_queue *q;
+
+        dev = driver_find_device(&matrix_dev->vfio_ap_drv->driver, NULL,
+                                 &apqn, match_apqn);
+        if (dev) {
+                q = dev_get_drvdata(dev);
+                vfio_ap_irq_disable(q);
+                put_device(dev);
+        }
+}
+
+int vfio_ap_mdev_reset_queue(unsigned int apid, unsigned int apqi,
+                             unsigned int retry)
 {
         struct ap_queue_status status;
+        int retry2 = 2;
+        int apqn = AP_MKQID(apid, apqi);
 
         do {
-                status = ap_zapq(AP_MKQID(apid, apqi));
+                status = ap_zapq(apqn);
                 switch (status.response_code) {
                 case AP_RESPONSE_NORMAL:
+                        while (!status.queue_empty && retry2--) {
+                                msleep(20);
+                                status = ap_tapq(apqn, NULL);
+                        }
+                        WARN_ON_ONCE(retry <= 0);
                         return 0;
                 case AP_RESPONSE_RESET_IN_PROGRESS:
                 case AP_RESPONSE_BUSY:
@@ -832,6 +1178,7 @@ static int vfio_ap_mdev_reset_queues(struct mdev_device *mdev)
                          */
                         if (ret)
                                 rc = ret;
+                        vfio_ap_irq_disable_apqn(AP_MKQID(apid, apqi));
                 }
         }
 
@@ -858,20 +1205,37 @@ static int vfio_ap_mdev_open(struct mdev_device *mdev)
                 return ret;
         }
 
-        return 0;
+        matrix_mdev->iommu_notifier.notifier_call = vfio_ap_mdev_iommu_notifier;
+        events = VFIO_IOMMU_NOTIFY_DMA_UNMAP;
+        ret = vfio_register_notifier(mdev_dev(mdev), VFIO_IOMMU_NOTIFY,
+                                     &events, &matrix_mdev->iommu_notifier);
+        if (!ret)
+                return ret;
+
+        vfio_unregister_notifier(mdev_dev(mdev), VFIO_GROUP_NOTIFY,
+                                 &matrix_mdev->group_notifier);
+        module_put(THIS_MODULE);
+        return ret;
 }
 
 static void vfio_ap_mdev_release(struct mdev_device *mdev)
 {
         struct ap_matrix_mdev *matrix_mdev = mdev_get_drvdata(mdev);
 
-        if (matrix_mdev->kvm)
+        mutex_lock(&matrix_dev->lock);
+        if (matrix_mdev->kvm) {
                 kvm_arch_crypto_clear_masks(matrix_mdev->kvm);
+                matrix_mdev->kvm->arch.crypto.pqap_hook = NULL;
+                vfio_ap_mdev_reset_queues(mdev);
+                kvm_put_kvm(matrix_mdev->kvm);
+                matrix_mdev->kvm = NULL;
+        }
+        mutex_unlock(&matrix_dev->lock);
 
-        vfio_ap_mdev_reset_queues(mdev);
+        vfio_unregister_notifier(mdev_dev(mdev), VFIO_IOMMU_NOTIFY,
+                                 &matrix_mdev->iommu_notifier);
         vfio_unregister_notifier(mdev_dev(mdev), VFIO_GROUP_NOTIFY,
                                  &matrix_mdev->group_notifier);
-        matrix_mdev->kvm = NULL;
         module_put(THIS_MODULE);
 }
 
@@ -900,6 +1264,7 @@ static ssize_t vfio_ap_mdev_ioctl(struct mdev_device *mdev,
 {
         int ret;
 
+        mutex_lock(&matrix_dev->lock);
         switch (cmd) {
         case VFIO_DEVICE_GET_INFO:
                 ret = vfio_ap_mdev_get_device_info(arg);
@@ -911,6 +1276,7 @@ static ssize_t vfio_ap_mdev_ioctl(struct mdev_device *mdev,
                 ret = -EOPNOTSUPP;
                 break;
         }
+        mutex_unlock(&matrix_dev->lock);
 
         return ret;
 }
diff --git a/drivers/s390/crypto/vfio_ap_private.h b/drivers/s390/crypto/vfio_ap_private.h
index 76b7f98e47e9..f46dde56b464 100644
--- a/drivers/s390/crypto/vfio_ap_private.h
+++ b/drivers/s390/crypto/vfio_ap_private.h
@@ -4,6 +4,7 @@
  *
  * Author(s): Tony Krowiak <akrowiak@linux.ibm.com>
  *            Halil Pasic <pasic@linux.ibm.com>
+ *            Pierre Morel <pmorel@linux.ibm.com>
  *
  * Copyright IBM Corp. 2018
  */
@@ -16,6 +17,7 @@
 #include <linux/mdev.h>
 #include <linux/delay.h>
 #include <linux/mutex.h>
+#include <linux/kvm_host.h>
 
 #include "ap_bus.h"
 
@@ -80,10 +82,23 @@ struct ap_matrix_mdev {
         struct list_head node;
         struct ap_matrix matrix;
         struct notifier_block group_notifier;
+        struct notifier_block iommu_notifier;
         struct kvm *kvm;
+        struct kvm_s390_module_hook pqap_hook;
+        struct mdev_device *mdev;
 };
 
 extern int vfio_ap_mdev_register(void);
 extern void vfio_ap_mdev_unregister(void);
+int vfio_ap_mdev_reset_queue(unsigned int apid, unsigned int apqi,
+                             unsigned int retry);
 
+struct vfio_ap_queue {
+        struct ap_matrix_mdev *matrix_mdev;
+        unsigned long saved_pfn;
+        int     apqn;
+#define VFIO_AP_ISC_INVALID 0xff
+        unsigned char saved_isc;
+};
+struct ap_queue_status vfio_ap_irq_disable(struct vfio_ap_queue *q);
 #endif /* _VFIO_AP_PRIVATE_H_ */
diff --git a/drivers/s390/crypto/zcrypt_msgtype6.c b/drivers/s390/crypto/zcrypt_msgtype6.c
index 0cbcc238ef98..12fe9deb265e 100644
--- a/drivers/s390/crypto/zcrypt_msgtype6.c
+++ b/drivers/s390/crypto/zcrypt_msgtype6.c
@@ -567,6 +567,10 @@ static int xcrb_msg_to_type6_ep11cprb_msgx(struct ap_message *ap_msg,
         payload_hdr = (struct pld_hdr *)((&(msg->pld_lenfmt))+lfmt);
         *fcode = payload_hdr->func_val & 0xFFFF;
 
+        /* enable special processing based on the cprbs flags special bit */
+        if (msg->cprbx.flags & 0x20)
+                ap_msg->special = 1;
+
         return 0;
 }
 
diff --git a/drivers/s390/net/Kconfig b/drivers/s390/net/Kconfig
index 7c5a25ddf832..ced896d1534a 100644
--- a/drivers/s390/net/Kconfig
+++ b/drivers/s390/net/Kconfig
@@ -7,10 +7,10 @@ config LCS
         prompt "Lan Channel Station Interface"
         depends on CCW && NETDEVICES && (ETHERNET || FDDI)
         help
-           Select this option if you want to use LCS networking on IBM System z.
-           This device driver supports FDDI (IEEE 802.7) and Ethernet.
-           To compile as a module, choose M. The module name is lcs.
-           If you do not know what it is, it's safe to choose Y.
+          Select this option if you want to use LCS networking on IBM System z.
+          This device driver supports FDDI (IEEE 802.7) and Ethernet.
+          To compile as a module, choose M. The module name is lcs.
+          If you do not know what it is, it's safe to choose Y.
 
 config CTCM
         def_tristate m
diff --git a/drivers/s390/virtio/virtio_ccw.c b/drivers/s390/virtio/virtio_ccw.c
index 6a3076881321..1a55e5942d36 100644
--- a/drivers/s390/virtio/virtio_ccw.c
+++ b/drivers/s390/virtio/virtio_ccw.c
@@ -46,9 +46,15 @@ struct vq_config_block {
 #define VIRTIO_CCW_CONFIG_SIZE 0x100
 /* same as PCI config space size, should be enough for all drivers */
 
+struct vcdev_dma_area {
+        unsigned long indicators;
+        unsigned long indicators2;
+        struct vq_config_block config_block;
+        __u8 status;
+};
+
 struct virtio_ccw_device {
         struct virtio_device vdev;
-        __u8 *status;
         __u8 config[VIRTIO_CCW_CONFIG_SIZE];
         struct ccw_device *cdev;
         __u32 curr_io;
@@ -58,17 +64,24 @@ struct virtio_ccw_device {
         spinlock_t lock;
         struct mutex io_lock; /* Serializes I/O requests */
         struct list_head virtqueues;
-        unsigned long indicators;
-        unsigned long indicators2;
-        struct vq_config_block *config_block;
         bool is_thinint;
         bool going_away;
         bool device_lost;
         unsigned int config_ready;
         void *airq_info;
-        u64 dma_mask;
+        struct vcdev_dma_area *dma_area;
 };
 
+static inline unsigned long *indicators(struct virtio_ccw_device *vcdev)
+{
+        return &vcdev->dma_area->indicators;
+}
+
+static inline unsigned long *indicators2(struct virtio_ccw_device *vcdev)
+{
+        return &vcdev->dma_area->indicators2;
+}
+
 struct vq_info_block_legacy {
         __u64 queue;
         __u32 align;
@@ -127,11 +140,17 @@ static int virtio_ccw_use_airq = 1;
 
 struct airq_info {
         rwlock_t lock;
-        u8 summary_indicator;
+        u8 summary_indicator_idx;
         struct airq_struct airq;
         struct airq_iv *aiv;
 };
 static struct airq_info *airq_areas[MAX_AIRQ_AREAS];
+static u8 *summary_indicators;
+
+static inline u8 *get_summary_indicator(struct airq_info *info)
+{
+        return summary_indicators + info->summary_indicator_idx;
+}
 
 #define CCW_CMD_SET_VQ 0x13
 #define CCW_CMD_VDEV_RESET 0x33
@@ -196,7 +215,7 @@ static void virtio_airq_handler(struct airq_struct *airq, bool floating)
                         break;
                 vring_interrupt(0, (void *)airq_iv_get_ptr(info->aiv, ai));
         }
-        info->summary_indicator = 0;
+        *(get_summary_indicator(info)) = 0;
         smp_wmb();
         /* Walk through indicators field, summary indicator not active. */
         for (ai = 0;;) {
@@ -208,7 +227,7 @@ static void virtio_airq_handler(struct airq_struct *airq, bool floating)
         read_unlock(&info->lock);
 }
 
-static struct airq_info *new_airq_info(void)
+static struct airq_info *new_airq_info(int index)
 {
         struct airq_info *info;
         int rc;
@@ -217,13 +236,15 @@ static struct airq_info *new_airq_info(void)
         if (!info)
                 return NULL;
         rwlock_init(&info->lock);
-        info->aiv = airq_iv_create(VIRTIO_IV_BITS, AIRQ_IV_ALLOC | AIRQ_IV_PTR);
+        info->aiv = airq_iv_create(VIRTIO_IV_BITS, AIRQ_IV_ALLOC | AIRQ_IV_PTR
+                                   | AIRQ_IV_CACHELINE);
         if (!info->aiv) {
                 kfree(info);
                 return NULL;
         }
         info->airq.handler = virtio_airq_handler;
-        info->airq.lsi_ptr = &info->summary_indicator;
+        info->summary_indicator_idx = index;
+        info->airq.lsi_ptr = get_summary_indicator(info);
         info->airq.lsi_mask = 0xff;
         info->airq.isc = VIRTIO_AIRQ_ISC;
         rc = register_adapter_interrupt(&info->airq);
@@ -245,7 +266,7 @@ static unsigned long get_airq_indicator(struct virtqueue *vqs[], int nvqs,
 
         for (i = 0; i < MAX_AIRQ_AREAS && !indicator_addr; i++) {
                 if (!airq_areas[i])
-                        airq_areas[i] = new_airq_info();
+                        airq_areas[i] = new_airq_info(i);
                 info = airq_areas[i];
                 if (!info)
                         return 0;
@@ -326,29 +347,29 @@ static void virtio_ccw_drop_indicator(struct virtio_ccw_device *vcdev,
         struct airq_info *airq_info = vcdev->airq_info;
 
         if (vcdev->is_thinint) {
-                thinint_area = kzalloc(sizeof(*thinint_area),
-                                       GFP_DMA | GFP_KERNEL);
+                thinint_area = ccw_device_dma_zalloc(vcdev->cdev,
+                                                     sizeof(*thinint_area));
                 if (!thinint_area)
                         return;
                 thinint_area->summary_indicator =
-                        (unsigned long) &airq_info->summary_indicator;
+                        (unsigned long) get_summary_indicator(airq_info);
                 thinint_area->isc = VIRTIO_AIRQ_ISC;
                 ccw->cmd_code = CCW_CMD_SET_IND_ADAPTER;
                 ccw->count = sizeof(*thinint_area);
                 ccw->cda = (__u32)(unsigned long) thinint_area;
         } else {
                 /* payload is the address of the indicators */
-                indicatorp = kmalloc(sizeof(&vcdev->indicators),
-                                     GFP_DMA | GFP_KERNEL);
+                indicatorp = ccw_device_dma_zalloc(vcdev->cdev,
+                                                   sizeof(indicators(vcdev)));
                 if (!indicatorp)
                         return;
                 *indicatorp = 0;
                 ccw->cmd_code = CCW_CMD_SET_IND;
-                ccw->count = sizeof(&vcdev->indicators);
+                ccw->count = sizeof(indicators(vcdev));
                 ccw->cda = (__u32)(unsigned long) indicatorp;
         }
         /* Deregister indicators from host. */
-        vcdev->indicators = 0;
+        *indicators(vcdev) = 0;
         ccw->flags = 0;
         ret = ccw_io_helper(vcdev, ccw,
                             vcdev->is_thinint ?
@@ -359,8 +380,8 @@ static void virtio_ccw_drop_indicator(struct virtio_ccw_device *vcdev,
                          "Failed to deregister indicators (%d)\n", ret);
         else if (vcdev->is_thinint)
                 virtio_ccw_drop_indicators(vcdev);
-        kfree(indicatorp);
-        kfree(thinint_area);
+        ccw_device_dma_free(vcdev->cdev, indicatorp, sizeof(indicators(vcdev)));
+        ccw_device_dma_free(vcdev->cdev, thinint_area, sizeof(*thinint_area));
 }
 
 static inline long __do_kvm_notify(struct subchannel_id schid,
@@ -407,15 +428,15 @@ static int virtio_ccw_read_vq_conf(struct virtio_ccw_device *vcdev,
 {
         int ret;
 
-        vcdev->config_block->index = index;
+        vcdev->dma_area->config_block.index = index;
         ccw->cmd_code = CCW_CMD_READ_VQ_CONF;
         ccw->flags = 0;
         ccw->count = sizeof(struct vq_config_block);
-        ccw->cda = (__u32)(unsigned long)(vcdev->config_block);
+        ccw->cda = (__u32)(unsigned long)(&vcdev->dma_area->config_block);
         ret = ccw_io_helper(vcdev, ccw, VIRTIO_CCW_DOING_READ_VQ_CONF);
         if (ret)
                 return ret;
-        return vcdev->config_block->num ?: -ENOENT;
+        return vcdev->dma_area->config_block.num ?: -ENOENT;
 }
 
 static void virtio_ccw_del_vq(struct virtqueue *vq, struct ccw1 *ccw)
@@ -460,7 +481,8 @@ static void virtio_ccw_del_vq(struct virtqueue *vq, struct ccw1 *ccw)
                          ret, index);
 
         vring_del_virtqueue(vq);
-        kfree(info->info_block);
+        ccw_device_dma_free(vcdev->cdev, info->info_block,
+                            sizeof(*info->info_block));
         kfree(info);
 }
 
@@ -470,7 +492,7 @@ static void virtio_ccw_del_vqs(struct virtio_device *vdev)
         struct ccw1 *ccw;
         struct virtio_ccw_device *vcdev = to_vc_device(vdev);
 
-        ccw = kzalloc(sizeof(*ccw), GFP_DMA | GFP_KERNEL);
+        ccw = ccw_device_dma_zalloc(vcdev->cdev, sizeof(*ccw));
         if (!ccw)
                 return;
 
@@ -479,7 +501,7 @@ static void virtio_ccw_del_vqs(struct virtio_device *vdev)
         list_for_each_entry_safe(vq, n, &vdev->vqs, list)
                 virtio_ccw_del_vq(vq, ccw);
 
-        kfree(ccw);
+        ccw_device_dma_free(vcdev->cdev, ccw, sizeof(*ccw));
 }
 
 static struct virtqueue *virtio_ccw_setup_vq(struct virtio_device *vdev,
@@ -502,8 +524,8 @@ static struct virtqueue *virtio_ccw_setup_vq(struct virtio_device *vdev,
                 err = -ENOMEM;
                 goto out_err;
         }
-        info->info_block = kzalloc(sizeof(*info->info_block),
-                                   GFP_DMA | GFP_KERNEL);
+        info->info_block = ccw_device_dma_zalloc(vcdev->cdev,
+                                                 sizeof(*info->info_block));
         if (!info->info_block) {
                 dev_warn(&vcdev->cdev->dev, "no info block\n");
                 err = -ENOMEM;
@@ -567,7 +589,8 @@ out_err:
         if (vq)
                 vring_del_virtqueue(vq);
         if (info) {
-                kfree(info->info_block);
+                ccw_device_dma_free(vcdev->cdev, info->info_block,
+                                    sizeof(*info->info_block));
         }
         kfree(info);
         return ERR_PTR(err);
@@ -581,7 +604,8 @@ static int virtio_ccw_register_adapter_ind(struct virtio_ccw_device *vcdev,
         struct virtio_thinint_area *thinint_area = NULL;
         struct airq_info *info;
 
-        thinint_area = kzalloc(sizeof(*thinint_area), GFP_DMA | GFP_KERNEL);
+        thinint_area = ccw_device_dma_zalloc(vcdev->cdev,
+                                             sizeof(*thinint_area));
         if (!thinint_area) {
                 ret = -ENOMEM;
                 goto out;
@@ -596,7 +620,7 @@ static int virtio_ccw_register_adapter_ind(struct virtio_ccw_device *vcdev,
         }
         info = vcdev->airq_info;
         thinint_area->summary_indicator =
-                (unsigned long) &info->summary_indicator;
+                (unsigned long) get_summary_indicator(info);
         thinint_area->isc = VIRTIO_AIRQ_ISC;
         ccw->cmd_code = CCW_CMD_SET_IND_ADAPTER;
         ccw->flags = CCW_FLAG_SLI;
@@ -617,7 +641,7 @@ static int virtio_ccw_register_adapter_ind(struct virtio_ccw_device *vcdev,
                 virtio_ccw_drop_indicators(vcdev);
         }
 out:
-        kfree(thinint_area);
+        ccw_device_dma_free(vcdev->cdev, thinint_area, sizeof(*thinint_area));
         return ret;
 }
 
@@ -633,7 +657,7 @@ static int virtio_ccw_find_vqs(struct virtio_device *vdev, unsigned nvqs,
         int ret, i, queue_idx = 0;
         struct ccw1 *ccw;
 
-        ccw = kzalloc(sizeof(*ccw), GFP_DMA | GFP_KERNEL);
+        ccw = ccw_device_dma_zalloc(vcdev->cdev, sizeof(*ccw));
         if (!ccw)
                 return -ENOMEM;
 
@@ -657,10 +681,11 @@ static int virtio_ccw_find_vqs(struct virtio_device *vdev, unsigned nvqs,
          * We need a data area under 2G to communicate. Our payload is
          * the address of the indicators.
         */
-        indicatorp = kmalloc(sizeof(&vcdev->indicators), GFP_DMA | GFP_KERNEL);
+        indicatorp = ccw_device_dma_zalloc(vcdev->cdev,
+                                           sizeof(indicators(vcdev)));
         if (!indicatorp)
                 goto out;
-        *indicatorp = (unsigned long) &vcdev->indicators;
+        *indicatorp = (unsigned long) indicators(vcdev);
         if (vcdev->is_thinint) {
                 ret = virtio_ccw_register_adapter_ind(vcdev, vqs, nvqs, ccw);
                 if (ret)
@@ -669,32 +694,36 @@ static int virtio_ccw_find_vqs(struct virtio_device *vdev, unsigned nvqs,
         }
         if (!vcdev->is_thinint) {
                 /* Register queue indicators with host. */
-                vcdev->indicators = 0;
+                *indicators(vcdev) = 0;
                 ccw->cmd_code = CCW_CMD_SET_IND;
                 ccw->flags = 0;
-                ccw->count = sizeof(&vcdev->indicators);
+                ccw->count = sizeof(indicators(vcdev));
                 ccw->cda = (__u32)(unsigned long) indicatorp;
                 ret = ccw_io_helper(vcdev, ccw, VIRTIO_CCW_DOING_SET_IND);
                 if (ret)
                         goto out;
         }
         /* Register indicators2 with host for config changes */
-        *indicatorp = (unsigned long) &vcdev->indicators2;
-        vcdev->indicators2 = 0;
+        *indicatorp = (unsigned long) indicators2(vcdev);
+        *indicators2(vcdev) = 0;
         ccw->cmd_code = CCW_CMD_SET_CONF_IND;
         ccw->flags = 0;
-        ccw->count = sizeof(&vcdev->indicators2);
+        ccw->count = sizeof(indicators2(vcdev));
         ccw->cda = (__u32)(unsigned long) indicatorp;
         ret = ccw_io_helper(vcdev, ccw, VIRTIO_CCW_DOING_SET_CONF_IND);
         if (ret)
                 goto out;
 
-        kfree(indicatorp);
-        kfree(ccw);
+        if (indicatorp)
+                ccw_device_dma_free(vcdev->cdev, indicatorp,
+                                    sizeof(indicators(vcdev)));
+        ccw_device_dma_free(vcdev->cdev, ccw, sizeof(*ccw));
         return 0;
 out:
-        kfree(indicatorp);
-        kfree(ccw);
+        if (indicatorp)
+                ccw_device_dma_free(vcdev->cdev, indicatorp,
+                                    sizeof(indicators(vcdev)));
+        ccw_device_dma_free(vcdev->cdev, ccw, sizeof(*ccw));
         virtio_ccw_del_vqs(vdev);
         return ret;
 }
@@ -704,12 +733,12 @@ static void virtio_ccw_reset(struct virtio_device *vdev)
         struct virtio_ccw_device *vcdev = to_vc_device(vdev);
         struct ccw1 *ccw;
 
-        ccw = kzalloc(sizeof(*ccw), GFP_DMA | GFP_KERNEL);
+        ccw = ccw_device_dma_zalloc(vcdev->cdev, sizeof(*ccw));
         if (!ccw)
                 return;
 
         /* Zero status bits. */
-        *vcdev->status = 0;
+        vcdev->dma_area->status = 0;
 
         /* Send a reset ccw on device. */
         ccw->cmd_code = CCW_CMD_VDEV_RESET;
@@ -717,7 +746,7 @@ static void virtio_ccw_reset(struct virtio_device *vdev)
         ccw->count = 0;
         ccw->cda = 0;
         ccw_io_helper(vcdev, ccw, VIRTIO_CCW_DOING_RESET);
-        kfree(ccw);
+        ccw_device_dma_free(vcdev->cdev, ccw, sizeof(*ccw));
 }
 
 static u64 virtio_ccw_get_features(struct virtio_device *vdev)
@@ -728,11 +757,11 @@ static u64 virtio_ccw_get_features(struct virtio_device *vdev)
         u64 rc;
         struct ccw1 *ccw;
 
-        ccw = kzalloc(sizeof(*ccw), GFP_DMA | GFP_KERNEL);
+        ccw = ccw_device_dma_zalloc(vcdev->cdev, sizeof(*ccw));
         if (!ccw)
                 return 0;
 
-        features = kzalloc(sizeof(*features), GFP_DMA | GFP_KERNEL);
+        features = ccw_device_dma_zalloc(vcdev->cdev, sizeof(*features));
         if (!features) {
                 rc = 0;
                 goto out_free;
@@ -765,8 +794,8 @@ static u64 virtio_ccw_get_features(struct virtio_device *vdev)
                 rc |= (u64)le32_to_cpu(features->features) << 32;
 
 out_free:
-        kfree(features);
-        kfree(ccw);
+        ccw_device_dma_free(vcdev->cdev, features, sizeof(*features));
+        ccw_device_dma_free(vcdev->cdev, ccw, sizeof(*ccw));
         return rc;
 }
 
@@ -791,11 +820,11 @@ static int virtio_ccw_finalize_features(struct virtio_device *vdev)
                 return -EINVAL;
         }
 
-        ccw = kzalloc(sizeof(*ccw), GFP_DMA | GFP_KERNEL);
+        ccw = ccw_device_dma_zalloc(vcdev->cdev, sizeof(*ccw));
         if (!ccw)
                 return -ENOMEM;
 
-        features = kzalloc(sizeof(*features), GFP_DMA | GFP_KERNEL);
+        features = ccw_device_dma_zalloc(vcdev->cdev, sizeof(*features));
         if (!features) {
                 ret = -ENOMEM;
                 goto out_free;
@@ -830,8 +859,8 @@ static int virtio_ccw_finalize_features(struct virtio_device *vdev)
         ret = ccw_io_helper(vcdev, ccw, VIRTIO_CCW_DOING_WRITE_FEAT);
 
 out_free:
-        kfree(features);
-        kfree(ccw);
+        ccw_device_dma_free(vcdev->cdev, features, sizeof(*features));
+        ccw_device_dma_free(vcdev->cdev, ccw, sizeof(*ccw));
 
         return ret;
 }
@@ -845,11 +874,12 @@ static void virtio_ccw_get_config(struct virtio_device *vdev,
         void *config_area;
         unsigned long flags;
 
-        ccw = kzalloc(sizeof(*ccw), GFP_DMA | GFP_KERNEL);
+        ccw = ccw_device_dma_zalloc(vcdev->cdev, sizeof(*ccw));
         if (!ccw)
                 return;
 
-        config_area = kzalloc(VIRTIO_CCW_CONFIG_SIZE, GFP_DMA | GFP_KERNEL);
+        config_area = ccw_device_dma_zalloc(vcdev->cdev,
+                                            VIRTIO_CCW_CONFIG_SIZE);
         if (!config_area)
                 goto out_free;
 
@@ -871,8 +901,8 @@ static void virtio_ccw_get_config(struct virtio_device *vdev,
                 memcpy(buf, config_area + offset, len);
 
 out_free:
-        kfree(config_area);
-        kfree(ccw);
+        ccw_device_dma_free(vcdev->cdev, config_area, VIRTIO_CCW_CONFIG_SIZE);
+        ccw_device_dma_free(vcdev->cdev, ccw, sizeof(*ccw));
 }
 
 static void virtio_ccw_set_config(struct virtio_device *vdev,
@@ -884,11 +914,12 @@ static void virtio_ccw_set_config(struct virtio_device *vdev,
         void *config_area;
         unsigned long flags;
 
-        ccw = kzalloc(sizeof(*ccw), GFP_DMA | GFP_KERNEL);
+        ccw = ccw_device_dma_zalloc(vcdev->cdev, sizeof(*ccw));
         if (!ccw)
                 return;
 
-        config_area = kzalloc(VIRTIO_CCW_CONFIG_SIZE, GFP_DMA | GFP_KERNEL);
+        config_area = ccw_device_dma_zalloc(vcdev->cdev,
+                                            VIRTIO_CCW_CONFIG_SIZE);
         if (!config_area)
                 goto out_free;
 
@@ -907,61 +938,61 @@ static void virtio_ccw_set_config(struct virtio_device *vdev,
         ccw_io_helper(vcdev, ccw, VIRTIO_CCW_DOING_WRITE_CONFIG);
 
 out_free:
-        kfree(config_area);
-        kfree(ccw);
+        ccw_device_dma_free(vcdev->cdev, config_area, VIRTIO_CCW_CONFIG_SIZE);
+        ccw_device_dma_free(vcdev->cdev, ccw, sizeof(*ccw));
 }
 
 static u8 virtio_ccw_get_status(struct virtio_device *vdev)
 {
         struct virtio_ccw_device *vcdev = to_vc_device(vdev);
-        u8 old_status = *vcdev->status;
+        u8 old_status = vcdev->dma_area->status;
         struct ccw1 *ccw;
 
         if (vcdev->revision < 1)
-                return *vcdev->status;
+                return vcdev->dma_area->status;
 
-        ccw = kzalloc(sizeof(*ccw), GFP_DMA | GFP_KERNEL);
+        ccw = ccw_device_dma_zalloc(vcdev->cdev, sizeof(*ccw));
         if (!ccw)
                 return old_status;
 
         ccw->cmd_code = CCW_CMD_READ_STATUS;
         ccw->flags = 0;
-        ccw->count = sizeof(*vcdev->status);
-        ccw->cda = (__u32)(unsigned long)vcdev->status;
+        ccw->count = sizeof(vcdev->dma_area->status);
+        ccw->cda = (__u32)(unsigned long)&vcdev->dma_area->status;
         ccw_io_helper(vcdev, ccw, VIRTIO_CCW_DOING_READ_STATUS);
 /*
  * If the channel program failed (should only happen if the device
  * was hotunplugged, and then we clean up via the machine check
- * handler anyway), vcdev->status was not overwritten and we just
+ * handler anyway), vcdev->dma_area->status was not overwritten and we just
  * return the old status, which is fine.
 */
-        kfree(ccw);
+        ccw_device_dma_free(vcdev->cdev, ccw, sizeof(*ccw));
 
-        return *vcdev->status;
+        return vcdev->dma_area->status;
 }
 
 static void virtio_ccw_set_status(struct virtio_device *vdev, u8 status)
 {
         struct virtio_ccw_device *vcdev = to_vc_device(vdev);
-        u8 old_status = *vcdev->status;
+        u8 old_status = vcdev->dma_area->status;
         struct ccw1 *ccw;
         int ret;
 
-        ccw = kzalloc(sizeof(*ccw), GFP_DMA | GFP_KERNEL);
+        ccw = ccw_device_dma_zalloc(vcdev->cdev, sizeof(*ccw));
         if (!ccw)
                 return;
 
         /* Write the status to the host. */
-        *vcdev->status = status;
+        vcdev->dma_area->status = status;
         ccw->cmd_code = CCW_CMD_WRITE_STATUS;
         ccw->flags = 0;
         ccw->count = sizeof(status);
-        ccw->cda = (__u32)(unsigned long)vcdev->status;
+        ccw->cda = (__u32)(unsigned long)&vcdev->dma_area->status;
         ret = ccw_io_helper(vcdev, ccw, VIRTIO_CCW_DOING_WRITE_STATUS);
         /* Write failed? We assume status is unchanged. */
         if (ret)
-                *vcdev->status = old_status;
-        kfree(ccw);
+                vcdev->dma_area->status = old_status;
+        ccw_device_dma_free(vcdev->cdev, ccw, sizeof(*ccw));
 }
 
 static const char *virtio_ccw_bus_name(struct virtio_device *vdev)
@@ -994,8 +1025,8 @@ static void virtio_ccw_release_dev(struct device *_d)
         struct virtio_device *dev = dev_to_virtio(_d);
         struct virtio_ccw_device *vcdev = to_vc_device(dev);
 
-        kfree(vcdev->status);
-        kfree(vcdev->config_block);
+        ccw_device_dma_free(vcdev->cdev, vcdev->dma_area,
+                            sizeof(*vcdev->dma_area));
         kfree(vcdev);
 }
 
@@ -1093,17 +1124,17 @@ static void virtio_ccw_int_handler(struct ccw_device *cdev,
                         vcdev->err = -EIO;
         }
         virtio_ccw_check_activity(vcdev, activity);
-        for_each_set_bit(i, &vcdev->indicators,
-                         sizeof(vcdev->indicators) * BITS_PER_BYTE) {
+        for_each_set_bit(i, indicators(vcdev),
+                         sizeof(*indicators(vcdev)) * BITS_PER_BYTE) {
                 /* The bit clear must happen before the vring kick. */
-                clear_bit(i, &vcdev->indicators);
+                clear_bit(i, indicators(vcdev));
                 barrier();
                 vq = virtio_ccw_vq_by_ind(vcdev, i);
                 vring_interrupt(0, vq);
         }
-        if (test_bit(0, &vcdev->indicators2)) {
+        if (test_bit(0, indicators2(vcdev))) {
                 virtio_config_changed(&vcdev->vdev);
-                clear_bit(0, &vcdev->indicators2);
+                clear_bit(0, indicators2(vcdev));
         }
 }
 
@@ -1203,12 +1234,12 @@ static int virtio_ccw_set_transport_rev(struct virtio_ccw_device *vcdev)
         struct ccw1 *ccw;
         int ret;
 
-        ccw = kzalloc(sizeof(*ccw), GFP_DMA | GFP_KERNEL);
+        ccw = ccw_device_dma_zalloc(vcdev->cdev, sizeof(*ccw));
         if (!ccw)
                 return -ENOMEM;
-        rev = kzalloc(sizeof(*rev), GFP_DMA | GFP_KERNEL);
+        rev = ccw_device_dma_zalloc(vcdev->cdev, sizeof(*rev));
         if (!rev) {
-                kfree(ccw);
+                ccw_device_dma_free(vcdev->cdev, ccw, sizeof(*ccw));
                 return -ENOMEM;
         }
 
@@ -1238,8 +1269,8 @@ static int virtio_ccw_set_transport_rev(struct virtio_ccw_device *vcdev)
                 }
         } while (ret == -EOPNOTSUPP);
 
-        kfree(ccw);
-        kfree(rev);
+        ccw_device_dma_free(vcdev->cdev, ccw, sizeof(*ccw));
+        ccw_device_dma_free(vcdev->cdev, rev, sizeof(*rev));
         return ret;
 }
 
@@ -1255,24 +1286,11 @@ static int virtio_ccw_online(struct ccw_device *cdev)
                 ret = -ENOMEM;
                 goto out_free;
         }
-
         vcdev->vdev.dev.parent = &cdev->dev;
-        cdev->dev.dma_mask = &vcdev->dma_mask;
-        /* we are fine with common virtio infrastructure using 64 bit DMA */
-        ret = dma_set_mask_and_coherent(&cdev->dev, DMA_BIT_MASK(64));
-        if (ret) {
-                dev_warn(&cdev->dev, "Failed to enable 64-bit DMA.\n");
-                goto out_free;
-        }
-
-        vcdev->config_block = kzalloc(sizeof(*vcdev->config_block),
-                                   GFP_DMA | GFP_KERNEL);
-        if (!vcdev->config_block) {
-                ret = -ENOMEM;
-                goto out_free;
-        }
-        vcdev->status = kzalloc(sizeof(*vcdev->status), GFP_DMA | GFP_KERNEL);
-        if (!vcdev->status) {
+        vcdev->cdev = cdev;
+        vcdev->dma_area = ccw_device_dma_zalloc(vcdev->cdev,
+                                                sizeof(*vcdev->dma_area));
+        if (!vcdev->dma_area) {
                 ret = -ENOMEM;
                 goto out_free;
         }
@@ -1281,7 +1299,6 @@ static int virtio_ccw_online(struct ccw_device *cdev)
 
         vcdev->vdev.dev.release = virtio_ccw_release_dev;
         vcdev->vdev.config = &virtio_ccw_config_ops;
-        vcdev->cdev = cdev;
         init_waitqueue_head(&vcdev->wait_q);
         INIT_LIST_HEAD(&vcdev->virtqueues);
         spin_lock_init(&vcdev->lock);
@@ -1312,8 +1329,8 @@ out_put:
         return ret;
 out_free:
         if (vcdev) {
-                kfree(vcdev->status);
-                kfree(vcdev->config_block);
+                ccw_device_dma_free(vcdev->cdev, vcdev->dma_area,
+                                    sizeof(*vcdev->dma_area));
         }
         kfree(vcdev);
         return ret;
@@ -1483,8 +1500,17 @@ static void __init no_auto_parse(void)
 
 static int __init virtio_ccw_init(void)
 {
+        int rc;
+
         /* parse no_auto string before we do anything further */
         no_auto_parse();
-        return ccw_driver_register(&virtio_ccw_driver);
+
+        summary_indicators = cio_dma_zalloc(MAX_AIRQ_AREAS);
+        if (!summary_indicators)
+                return -ENOMEM;
+        rc = ccw_driver_register(&virtio_ccw_driver);
+        if (rc)
+                cio_dma_free(summary_indicators, MAX_AIRQ_AREAS);
+        return rc;
 }
 device_initcall(virtio_ccw_init);
diff --git a/drivers/scsi/vmw_pvscsi.c b/drivers/scsi/vmw_pvscsi.c
index ecee4b3ff073..377b07b2feeb 100644
--- a/drivers/scsi/vmw_pvscsi.c
+++ b/drivers/scsi/vmw_pvscsi.c
@@ -763,6 +763,7 @@ static int pvscsi_queue_lck(struct scsi_cmnd *cmd, void (*done)(struct scsi_cmnd
         struct pvscsi_adapter *adapter = shost_priv(host);
         struct pvscsi_ctx *ctx;
         unsigned long flags;
+        unsigned char op;
 
         spin_lock_irqsave(&adapter->hw_lock, flags);
 
@@ -775,13 +776,14 @@ static int pvscsi_queue_lck(struct scsi_cmnd *cmd, void (*done)(struct scsi_cmnd
         }
 
         cmd->scsi_done = done;
+        op = cmd->cmnd[0];
 
         dev_dbg(&cmd->device->sdev_gendev,
-                "queued cmd %p, ctx %p, op=%x\n", cmd, ctx, cmd->cmnd[0]);
+                "queued cmd %p, ctx %p, op=%x\n", cmd, ctx, op);
 
         spin_unlock_irqrestore(&adapter->hw_lock, flags);
 
-        pvscsi_kick_io(adapter, cmd->cmnd[0]);
+        pvscsi_kick_io(adapter, op);
 
         return 0;
 }
diff --git a/drivers/soc/Makefile b/drivers/soc/Makefile
index 524ecdc2a9bb..2ec355003524 100644
--- a/drivers/soc/Makefile
+++ b/drivers/soc/Makefile
@@ -22,7 +22,7 @@ obj-$(CONFIG_ARCH_ROCKCHIP)	+= rockchip/
 obj-$(CONFIG_SOC_SAMSUNG)       += samsung/
 obj-y                           += sunxi/
 obj-$(CONFIG_ARCH_TEGRA)        += tegra/
-obj-$(CONFIG_SOC_TI)            += ti/
+obj-y                           += ti/
 obj-$(CONFIG_ARCH_U8500)        += ux500/
 obj-$(CONFIG_PLAT_VERSATILE)    += versatile/
 obj-y                           += xilinx/
diff --git a/drivers/soc/ti/Kconfig b/drivers/soc/ti/Kconfig
index ea0859f7b185..d7d50d48d05d 100644
--- a/drivers/soc/ti/Kconfig
+++ b/drivers/soc/ti/Kconfig
@@ -75,10 +75,10 @@ config TI_SCI_PM_DOMAINS
           called ti_sci_pm_domains. Note this is needed early in boot before
           rootfs may be available.
 
+endif # SOC_TI
+
 config TI_SCI_INTA_MSI_DOMAIN
         bool
         select GENERIC_MSI_IRQ_DOMAIN
         help
           Driver to enable Interrupt Aggregator specific MSI Domain.
-
-endif # SOC_TI
diff --git a/drivers/target/iscsi/iscsi_target_auth.c b/drivers/target/iscsi/iscsi_target_auth.c
index b6e4862cc242..51ddca2033e0 100644
--- a/drivers/target/iscsi/iscsi_target_auth.c
+++ b/drivers/target/iscsi/iscsi_target_auth.c
@@ -81,6 +81,12 @@ out:
         return CHAP_DIGEST_UNKNOWN;
 }
 
+static void chap_close(struct iscsi_conn *conn)
+{
+        kfree(conn->auth_protocol);
+        conn->auth_protocol = NULL;
+}
+
 static struct iscsi_chap *chap_server_open(
         struct iscsi_conn *conn,
         struct iscsi_node_auth *auth,
@@ -118,7 +124,7 @@ static struct iscsi_chap *chap_server_open(
         case CHAP_DIGEST_UNKNOWN:
         default:
                 pr_err("Unsupported CHAP_A value\n");
-                kfree(conn->auth_protocol);
+                chap_close(conn);
                 return NULL;
         }
 
@@ -133,19 +139,13 @@ static struct iscsi_chap *chap_server_open(
          * Generate Challenge.
          */
         if (chap_gen_challenge(conn, 1, aic_str, aic_len) < 0) {
-                kfree(conn->auth_protocol);
+                chap_close(conn);
                 return NULL;
         }
 
         return chap;
 }
 
-static void chap_close(struct iscsi_conn *conn)
-{
-        kfree(conn->auth_protocol);
-        conn->auth_protocol = NULL;
-}
-
 static int chap_server_compute_md5(
         struct iscsi_conn *conn,
         struct iscsi_node_auth *auth,
diff --git a/drivers/target/target_core_iblock.c b/drivers/target/target_core_iblock.c
index f4a075303e9a..6949ea8bc387 100644
--- a/drivers/target/target_core_iblock.c
+++ b/drivers/target/target_core_iblock.c
@@ -502,7 +502,7 @@ iblock_execute_write_same(struct se_cmd *cmd)
 
                 /* Always in 512 byte units for Linux/Block */
                 block_lba += sg->length >> SECTOR_SHIFT;
-                sectors -= 1;
+                sectors -= sg->length >> SECTOR_SHIFT;
         }
 
         iblock_submit_bios(&list);
diff --git a/drivers/tty/tty_ldisc.c b/drivers/tty/tty_ldisc.c
index e38f104db174..fde8d4073e74 100644
--- a/drivers/tty/tty_ldisc.c
+++ b/drivers/tty/tty_ldisc.c
@@ -487,7 +487,7 @@ static int tty_ldisc_open(struct tty_struct *tty, struct tty_ldisc *ld)
 
 static void tty_ldisc_close(struct tty_struct *tty, struct tty_ldisc *ld)
 {
-        lockdep_assert_held_exclusive(&tty->ldisc_sem);
+        lockdep_assert_held_write(&tty->ldisc_sem);
         WARN_ON(!test_bit(TTY_LDISC_OPEN, &tty->flags));
         clear_bit(TTY_LDISC_OPEN, &tty->flags);
         if (ld->ops->close)
@@ -509,7 +509,7 @@ static int tty_ldisc_failto(struct tty_struct *tty, int ld)
         struct tty_ldisc *disc = tty_ldisc_get(tty, ld);
         int r;
 
-        lockdep_assert_held_exclusive(&tty->ldisc_sem);
+        lockdep_assert_held_write(&tty->ldisc_sem);
         if (IS_ERR(disc))
                 return PTR_ERR(disc);
         tty->ldisc = disc;
@@ -633,7 +633,7 @@ EXPORT_SYMBOL_GPL(tty_set_ldisc);
  */
 static void tty_ldisc_kill(struct tty_struct *tty)
 {
-        lockdep_assert_held_exclusive(&tty->ldisc_sem);
+        lockdep_assert_held_write(&tty->ldisc_sem);
         if (!tty->ldisc)
                 return;
         /*
@@ -681,7 +681,7 @@ int tty_ldisc_reinit(struct tty_struct *tty, int disc)
         struct tty_ldisc *ld;
         int retval;
 
-        lockdep_assert_held_exclusive(&tty->ldisc_sem);
+        lockdep_assert_held_write(&tty->ldisc_sem);
         ld = tty_ldisc_get(tty, disc);
         if (IS_ERR(ld)) {
                 BUG_ON(disc == N_TTY);
diff --git a/fs/Kconfig b/fs/Kconfig
index f1046cf6ad85..bfb1c6095c7a 100644
--- a/fs/Kconfig
+++ b/fs/Kconfig
@@ -11,7 +11,6 @@ config DCACHE_WORD_ACCESS
 
 config VALIDATE_FS_PARSER
         bool "Validate filesystem parameter description"
-        default y
         help
           Enable this to perform validation of the parameter description for a
           filesystem when it is registered.
diff --git a/fs/afs/callback.c b/fs/afs/callback.c
index d441bef72163..915010464572 100644
--- a/fs/afs/callback.c
+++ b/fs/afs/callback.c
@@ -275,9 +275,9 @@ static void afs_break_one_callback(struct afs_server *server,
                         struct afs_super_info *as = AFS_FS_S(cbi->sb);
                         struct afs_volume *volume = as->volume;
 
-                        write_lock(&volume->cb_break_lock);
+                        write_lock(&volume->cb_v_break_lock);
                         volume->cb_v_break++;
-                        write_unlock(&volume->cb_break_lock);
+                        write_unlock(&volume->cb_v_break_lock);
                 } else {
                         data.volume = NULL;
                         data.fid = *fid;
diff --git a/fs/afs/inode.c b/fs/afs/inode.c
index b42d9d09669c..18a50d4febcf 100644
--- a/fs/afs/inode.c
+++ b/fs/afs/inode.c
@@ -56,6 +56,16 @@ static noinline void dump_vnode(struct afs_vnode *vnode, struct afs_vnode *paren
 }
 
 /*
+ * Set the file size and block count.  Estimate the number of 512 bytes blocks
+ * used, rounded up to nearest 1K for consistency with other AFS clients.
+ */
+static void afs_set_i_size(struct afs_vnode *vnode, u64 size)
+{
+        i_size_write(&vnode->vfs_inode, size);
+        vnode->vfs_inode.i_blocks = ((size + 1023) >> 10) << 1;
+}
+
+/*
  * Initialise an inode from the vnode status.
  */
 static int afs_inode_init_from_status(struct afs_vnode *vnode, struct key *key,
@@ -124,12 +134,7 @@ static int afs_inode_init_from_status(struct afs_vnode *vnode, struct key *key,
                 return afs_protocol_error(NULL, -EBADMSG, afs_eproto_file_type);
         }
 
-        /*
-         * Estimate 512 bytes  blocks used, rounded up to nearest 1K
-         * for consistency with other AFS clients.
-         */
-        inode->i_blocks         = ((i_size_read(inode) + 1023) >> 10) << 1;
-        i_size_write(&vnode->vfs_inode, status->size);
+        afs_set_i_size(vnode, status->size);
 
         vnode->invalid_before   = status->data_version;
         inode_set_iversion_raw(&vnode->vfs_inode, status->data_version);
@@ -207,11 +212,13 @@ static void afs_apply_status(struct afs_fs_cursor *fc,
 
         if (expected_version &&
             *expected_version != status->data_version) {
-                kdebug("vnode modified %llx on {%llx:%llu} [exp %llx] %s",
-                       (unsigned long long) status->data_version,
-                       vnode->fid.vid, vnode->fid.vnode,
-                       (unsigned long long) *expected_version,
-                       fc->type ? fc->type->name : "???");
+                if (test_bit(AFS_VNODE_CB_PROMISED, &vnode->flags))
+                        pr_warn("kAFS: vnode modified {%llx:%llu} %llx->%llx %s\n",
+                                vnode->fid.vid, vnode->fid.vnode,
+                                (unsigned long long)*expected_version,
+                                (unsigned long long)status->data_version,
+                                fc->type ? fc->type->name : "???");
+
                 vnode->invalid_before = status->data_version;
                 if (vnode->status.type == AFS_FTYPE_DIR) {
                         if (test_and_clear_bit(AFS_VNODE_DIR_VALID, &vnode->flags))
@@ -230,7 +237,7 @@ static void afs_apply_status(struct afs_fs_cursor *fc,
 
         if (data_changed) {
                 inode_set_iversion_raw(&vnode->vfs_inode, status->data_version);
-                i_size_write(&vnode->vfs_inode, status->size);
+                afs_set_i_size(vnode, status->size);
         }
 }
 
diff --git a/fs/afs/internal.h b/fs/afs/internal.h
index 8a67bf741880..7ee63526c6a2 100644
--- a/fs/afs/internal.h
+++ b/fs/afs/internal.h
@@ -109,10 +109,8 @@ struct afs_call {
         struct rxrpc_call       *rxcall;        /* RxRPC call handle */
         struct key              *key;           /* security for this call */
         struct afs_net          *net;           /* The network namespace */
-        union {
-                struct afs_server       *server;
-                struct afs_vlserver     *vlserver;
-        };
+        struct afs_server       *server;        /* The fileserver record if fs op (pins ref) */
+        struct afs_vlserver     *vlserver;      /* The vlserver record if vl op */
         struct afs_cb_interest  *cbi;           /* Callback interest for server used */
         struct afs_vnode        *lvnode;        /* vnode being locked */
         void                    *request;       /* request data (first part) */
@@ -616,7 +614,7 @@ struct afs_volume {
         unsigned int            servers_seq;    /* Incremented each time ->servers changes */
 
         unsigned                cb_v_break;     /* Break-everything counter. */
-        rwlock_t                cb_break_lock;
+        rwlock_t                cb_v_break_lock;
 
         afs_voltype_t           type;           /* type of volume */
         short                   error;
diff --git a/fs/afs/volume.c b/fs/afs/volume.c
index 08fdb3951c49..1a414300b654 100644
--- a/fs/afs/volume.c
+++ b/fs/afs/volume.c
@@ -43,6 +43,7 @@ static struct afs_volume *afs_alloc_volume(struct afs_fs_context *params,
         atomic_set(&volume->usage, 1);
         INIT_LIST_HEAD(&volume->proc_link);
         rwlock_init(&volume->servers_lock);
+        rwlock_init(&volume->cb_v_break_lock);
         memcpy(volume->name, vldb->name, vldb->name_len + 1);
 
         slist = afs_alloc_server_list(params->cell, params->key, vldb, type_mask);
diff --git a/fs/aio.c b/fs/aio.c
index 3490d1fa0e16..c1e581dd32f5 100644
--- a/fs/aio.c
+++ b/fs/aio.c
@@ -2095,6 +2095,7 @@ SYSCALL_DEFINE6(io_pgetevents,
         struct __aio_sigset     ksig = { NULL, };
         sigset_t                ksigmask, sigsaved;
         struct timespec64       ts;
+        bool interrupted;
         int ret;
 
         if (timeout && unlikely(get_timespec64(&ts, timeout)))
@@ -2108,8 +2109,10 @@ SYSCALL_DEFINE6(io_pgetevents,
                 return ret;
 
         ret = do_io_getevents(ctx_id, min_nr, nr, events, timeout ? &ts : NULL);
-        restore_user_sigmask(ksig.sigmask, &sigsaved);
-        if (signal_pending(current) && !ret)
+
+        interrupted = signal_pending(current);
+        restore_user_sigmask(ksig.sigmask, &sigsaved, interrupted);
+        if (interrupted && !ret)
                 ret = -ERESTARTNOHAND;
 
         return ret;
@@ -2128,6 +2131,7 @@ SYSCALL_DEFINE6(io_pgetevents_time32,
         struct __aio_sigset     ksig = { NULL, };
         sigset_t                ksigmask, sigsaved;
         struct timespec64       ts;
+        bool interrupted;
         int ret;
 
         if (timeout && unlikely(get_old_timespec32(&ts, timeout)))
@@ -2142,8 +2146,10 @@ SYSCALL_DEFINE6(io_pgetevents_time32,
                 return ret;
 
         ret = do_io_getevents(ctx_id, min_nr, nr, events, timeout ? &ts : NULL);
-        restore_user_sigmask(ksig.sigmask, &sigsaved);
-        if (signal_pending(current) && !ret)
+
+        interrupted = signal_pending(current);
+        restore_user_sigmask(ksig.sigmask, &sigsaved, interrupted);
+        if (interrupted && !ret)
                 ret = -ERESTARTNOHAND;
 
         return ret;
@@ -2193,6 +2199,7 @@ COMPAT_SYSCALL_DEFINE6(io_pgetevents,
         struct __compat_aio_sigset ksig = { NULL, };
         sigset_t ksigmask, sigsaved;
         struct timespec64 t;
+        bool interrupted;
         int ret;
 
         if (timeout && get_old_timespec32(&t, timeout))
@@ -2206,8 +2213,10 @@ COMPAT_SYSCALL_DEFINE6(io_pgetevents,
                 return ret;
 
         ret = do_io_getevents(ctx_id, min_nr, nr, events, timeout ? &t : NULL);
-        restore_user_sigmask(ksig.sigmask, &sigsaved);
-        if (signal_pending(current) && !ret)
+
+        interrupted = signal_pending(current);
+        restore_user_sigmask(ksig.sigmask, &sigsaved, interrupted);
+        if (interrupted && !ret)
                 ret = -ERESTARTNOHAND;
 
         return ret;
@@ -2226,6 +2235,7 @@ COMPAT_SYSCALL_DEFINE6(io_pgetevents_time64,
         struct __compat_aio_sigset ksig = { NULL, };
         sigset_t ksigmask, sigsaved;
         struct timespec64 t;
+        bool interrupted;
         int ret;
 
         if (timeout && get_timespec64(&t, timeout))
@@ -2239,8 +2249,10 @@ COMPAT_SYSCALL_DEFINE6(io_pgetevents_time64,
                 return ret;
 
         ret = do_io_getevents(ctx_id, min_nr, nr, events, timeout ? &t : NULL);
-        restore_user_sigmask(ksig.sigmask, &sigsaved);
-        if (signal_pending(current) && !ret)
+
+        interrupted = signal_pending(current);
+        restore_user_sigmask(ksig.sigmask, &sigsaved, interrupted);
+        if (interrupted && !ret)
                 ret = -ERESTARTNOHAND;
 
         return ret;
diff --git a/fs/binfmt_flat.c b/fs/binfmt_flat.c
index 82a48e830018..e4b59e76afb0 100644
--- a/fs/binfmt_flat.c
+++ b/fs/binfmt_flat.c
@@ -856,9 +856,14 @@ err:
 
 static int load_flat_shared_library(int id, struct lib_info *libs)
 {
+        /*
+         * This is a fake bprm struct; only the members "buf", "file" and
+         * "filename" are actually used.
+         */
         struct linux_binprm bprm;
         int res;
         char buf[16];
+        loff_t pos = 0;
 
         memset(&bprm, 0, sizeof(bprm));
 
@@ -872,25 +877,11 @@ static int load_flat_shared_library(int id, struct lib_info *libs)
         if (IS_ERR(bprm.file))
                 return res;
 
-        bprm.cred = prepare_exec_creds();
-        res = -ENOMEM;
-        if (!bprm.cred)
-                goto out;
-
-        /* We don't really care about recalculating credentials at this point
-         * as we're past the point of no return and are dealing with shared
-         * libraries.
-         */
-        bprm.called_set_creds = 1;
+        res = kernel_read(bprm.file, bprm.buf, BINPRM_BUF_SIZE, &pos);
 
-        res = prepare_binprm(&bprm);
-
-        if (!res)
+        if (res >= 0)
                 res = load_flat_file(&bprm, libs, id, NULL);
 
-        abort_creds(bprm.cred);
-
-out:
         allow_write_access(bprm.file);
         fput(bprm.file);
 
diff --git a/fs/ceph/mds_client.c b/fs/ceph/mds_client.c
index 6af2d0d4a87a..c8a9b89b922d 100644
--- a/fs/ceph/mds_client.c
+++ b/fs/ceph/mds_client.c
@@ -2121,9 +2121,10 @@ retry:
                 if (inode && ceph_snap(inode) == CEPH_SNAPDIR) {
                         dout("build_path path+%d: %p SNAPDIR\n",
                              pos, temp);
-                } else if (stop_on_nosnap && inode &&
+                } else if (stop_on_nosnap && inode && dentry != temp &&
                            ceph_snap(inode) == CEPH_NOSNAP) {
                         spin_unlock(&temp->d_lock);
+                        pos++; /* get rid of any prepended '/' */
                         break;
                 } else {
                         pos -= temp->d_name.len;
diff --git a/fs/cifs/smb2ops.c b/fs/cifs/smb2ops.c
index 3fdc6a41b304..9fd56b0acd7e 100644
--- a/fs/cifs/smb2ops.c
+++ b/fs/cifs/smb2ops.c
@@ -2372,6 +2372,41 @@ smb2_get_dfs_refer(const unsigned int xid, struct cifs_ses *ses,
         kfree(dfs_rsp);
         return rc;
 }
+
+static int
+parse_reparse_symlink(struct reparse_symlink_data_buffer *symlink_buf,
+                      u32 plen, char **target_path,
+                      struct cifs_sb_info *cifs_sb)
+{
+        unsigned int sub_len;
+        unsigned int sub_offset;
+
+        /* We only handle Symbolic Link : MS-FSCC 2.1.2.4 */
+        if (le32_to_cpu(symlink_buf->ReparseTag) != IO_REPARSE_TAG_SYMLINK) {
+                cifs_dbg(VFS, "srv returned invalid symlink buffer\n");
+                return -EIO;
+        }
+
+        sub_offset = le16_to_cpu(symlink_buf->SubstituteNameOffset);
+        sub_len = le16_to_cpu(symlink_buf->SubstituteNameLength);
+        if (sub_offset + 20 > plen ||
+            sub_offset + sub_len + 20 > plen) {
+                cifs_dbg(VFS, "srv returned malformed symlink buffer\n");
+                return -EIO;
+        }
+
+        *target_path = cifs_strndup_from_utf16(
+                                symlink_buf->PathBuffer + sub_offset,
+                                sub_len, true, cifs_sb->local_nls);
+        if (!(*target_path))
+                return -ENOMEM;
+
+        convert_delimiter(*target_path, '/');
+        cifs_dbg(FYI, "%s: target path: %s\n", __func__, *target_path);
+
+        return 0;
+}
+
 #define SMB2_SYMLINK_STRUCT_SIZE \
         (sizeof(struct smb2_err_rsp) - 1 + sizeof(struct smb2_symlink_err_rsp))
 
@@ -2401,11 +2436,13 @@ smb2_query_symlink(const unsigned int xid, struct cifs_tcon *tcon,
         struct kvec close_iov[1];
         struct smb2_create_rsp *create_rsp;
         struct smb2_ioctl_rsp *ioctl_rsp;
-        char *ioctl_buf;
+        struct reparse_data_buffer *reparse_buf;
         u32 plen;
 
         cifs_dbg(FYI, "%s: path: %s\n", __func__, full_path);
 
+        *target_path = NULL;
+
         if (smb3_encryption_required(tcon))
                 flags |= CIFS_TRANSFORM_REQ;
 
@@ -2483,17 +2520,36 @@ smb2_query_symlink(const unsigned int xid, struct cifs_tcon *tcon,
         if ((rc == 0) && (is_reparse_point)) {
                 /* See MS-FSCC 2.3.23 */
 
-                ioctl_buf = (char *)ioctl_rsp + le32_to_cpu(ioctl_rsp->OutputOffset);
+                reparse_buf = (struct reparse_data_buffer *)
+                        ((char *)ioctl_rsp +
+                         le32_to_cpu(ioctl_rsp->OutputOffset));
                 plen = le32_to_cpu(ioctl_rsp->OutputCount);
 
                 if (plen + le32_to_cpu(ioctl_rsp->OutputOffset) >
                     rsp_iov[1].iov_len) {
-                        cifs_dbg(VFS, "srv returned invalid ioctl length: %d\n", plen);
+                        cifs_dbg(VFS, "srv returned invalid ioctl len: %d\n",
+                                 plen);
+                        rc = -EIO;
+                        goto querty_exit;
+                }
+
+                if (plen < 8) {
+                        cifs_dbg(VFS, "reparse buffer is too small. Must be "
+                                 "at least 8 bytes but was %d\n", plen);
+                        rc = -EIO;
+                        goto querty_exit;
+                }
+
+                if (plen < le16_to_cpu(reparse_buf->ReparseDataLength) + 8) {
+                        cifs_dbg(VFS, "srv returned invalid reparse buf "
+                                 "length: %d\n", plen);
                         rc = -EIO;
                         goto querty_exit;
                 }
 
-                /* Do stuff with ioctl_buf/plen */
+                rc = parse_reparse_symlink(
+                        (struct reparse_symlink_data_buffer *)reparse_buf,
+                        plen, target_path, cifs_sb);
                 goto querty_exit;
         }
 
diff --git a/fs/cifs/smb2pdu.h b/fs/cifs/smb2pdu.h
index c7d5813bebd8..858353d20c39 100644
--- a/fs/cifs/smb2pdu.h
+++ b/fs/cifs/smb2pdu.h
@@ -914,7 +914,19 @@ struct reparse_mount_point_data_buffer {
         __u8    PathBuffer[0]; /* Variable Length */
 } __packed;
 
-/* See MS-FSCC 2.1.2.4 and cifspdu.h for struct reparse_symlink_data */
+#define SYMLINK_FLAG_RELATIVE 0x00000001
+
+struct reparse_symlink_data_buffer {
+        __le32  ReparseTag;
+        __le16  ReparseDataLength;
+        __u16   Reserved;
+        __le16  SubstituteNameOffset;
+        __le16  SubstituteNameLength;
+        __le16  PrintNameOffset;
+        __le16  PrintNameLength;
+        __le32  Flags;
+        __u8    PathBuffer[0]; /* Variable Length */
+} __packed;
 
 /* See MS-FSCC 2.1.2.6 and cifspdu.h for struct reparse_posix_data */
 
diff --git a/fs/dax.c b/fs/dax.c
index 2e48c7ebb973..fe5e33810cd4 100644
--- a/fs/dax.c
+++ b/fs/dax.c
@@ -720,12 +720,11 @@ static void *dax_insert_entry(struct xa_state *xas,
 
         xas_reset(xas);
         xas_lock_irq(xas);
-        if (dax_entry_size(entry) != dax_entry_size(new_entry)) {
+        if (dax_is_zero_entry(entry) || dax_is_empty_entry(entry)) {
+                void *old;
+
                 dax_disassociate_entry(entry, mapping, false);
                 dax_associate_entry(new_entry, mapping, vmf->vma, vmf->address);
-        }
-
-        if (dax_is_zero_entry(entry) || dax_is_empty_entry(entry)) {
                 /*
                  * Only swap our new entry into the page cache if the current
                  * entry is a zero page or an empty entry.  If a normal PTE or
@@ -734,7 +733,7 @@ static void *dax_insert_entry(struct xa_state *xas,
                  * existing entry is a PMD, we will just leave the PMD in the
                  * tree and dirty it if necessary.
                  */
-                void *old = dax_lock_entry(xas, new_entry);
+                old = dax_lock_entry(xas, new_entry);
                 WARN_ON_ONCE(old != xa_mk_value(xa_to_value(entry) |
                                         DAX_LOCKED));
                 entry = new_entry;
@@ -1188,7 +1187,7 @@ dax_iomap_rw(struct kiocb *iocb, struct iov_iter *iter,
         unsigned flags = 0;
 
         if (iov_iter_rw(iter) == WRITE) {
-                lockdep_assert_held_exclusive(&inode->i_rwsem);
+                lockdep_assert_held_write(&inode->i_rwsem);
                 flags |= IOMAP_WRITE;
         } else {
                 lockdep_assert_held(&inode->i_rwsem);
diff --git a/fs/eventpoll.c b/fs/eventpoll.c
index c6f513100cc9..4c74c768ae43 100644
--- a/fs/eventpoll.c
+++ b/fs/eventpoll.c
@@ -2325,7 +2325,7 @@ SYSCALL_DEFINE6(epoll_pwait, int, epfd, struct epoll_event __user *, events,
 
         error = do_epoll_wait(epfd, events, maxevents, timeout);
 
-        restore_user_sigmask(sigmask, &sigsaved);
+        restore_user_sigmask(sigmask, &sigsaved, error == -EINTR);
 
         return error;
 }
@@ -2350,7 +2350,7 @@ COMPAT_SYSCALL_DEFINE6(epoll_pwait, int, epfd,
 
         err = do_epoll_wait(epfd, events, maxevents, timeout);
 
-        restore_user_sigmask(sigmask, &sigsaved);
+        restore_user_sigmask(sigmask, &sigsaved, err == -EINTR);
 
         return err;
 }
diff --git a/fs/inode.c b/fs/inode.c
index df6542ec3b88..2bf21e2c90fc 100644
--- a/fs/inode.c
+++ b/fs/inode.c
@@ -362,7 +362,7 @@ EXPORT_SYMBOL(inc_nlink);
 
 static void __address_space_init_once(struct address_space *mapping)
 {
-        xa_init_flags(&mapping->i_pages, XA_FLAGS_LOCK_IRQ);
+        xa_init_flags(&mapping->i_pages, XA_FLAGS_LOCK_IRQ | XA_FLAGS_ACCOUNT);
         init_rwsem(&mapping->i_mmap_rwsem);
         INIT_LIST_HEAD(&mapping->private_list);
         spin_lock_init(&mapping->private_lock);
diff --git a/fs/io_uring.c b/fs/io_uring.c
index 86a2bd721900..4ef62a45045d 100644
--- a/fs/io_uring.c
+++ b/fs/io_uring.c
@@ -579,6 +579,7 @@ static struct io_kiocb *io_get_req(struct io_ring_ctx *ctx,
                 state->cur_req++;
         }
 
+        req->file = NULL;
         req->ctx = ctx;
         req->flags = 0;
         /* one is dropped after submission, the other at completion */
@@ -1801,10 +1802,8 @@ static int io_req_set_file(struct io_ring_ctx *ctx, const struct sqe_submit *s,
                 req->sequence = ctx->cached_sq_head - 1;
         }
 
-        if (!io_op_needs_file(s->sqe)) {
-                req->file = NULL;
+        if (!io_op_needs_file(s->sqe))
                 return 0;
-        }
 
         if (flags & IOSQE_FIXED_FILE) {
                 if (unlikely(!ctx->user_files ||
@@ -2201,11 +2200,12 @@ static int io_cqring_wait(struct io_ring_ctx *ctx, int min_events,
         }
 
         ret = wait_event_interruptible(ctx->wait, io_cqring_events(ring) >= min_events);
-        if (ret == -ERESTARTSYS)
-                ret = -EINTR;
 
         if (sig)
-                restore_user_sigmask(sig, &sigsaved);
+                restore_user_sigmask(sig, &sigsaved, ret == -ERESTARTSYS);
+
+        if (ret == -ERESTARTSYS)
+                ret = -EINTR;
 
         return READ_ONCE(ring->r.head) == READ_ONCE(ring->r.tail) ? ret : 0;
 }
diff --git a/fs/namespace.c b/fs/namespace.c
index 7660c2749c96..6fbc9126367a 100644
--- a/fs/namespace.c
+++ b/fs/namespace.c
@@ -2596,11 +2596,12 @@ static int do_move_mount(struct path *old_path, struct path *new_path)
         if (!check_mnt(p))
                 goto out;
 
-        /* The thing moved should be either ours or completely unattached. */
-        if (attached && !check_mnt(old))
+        /* The thing moved must be mounted... */
+        if (!is_mounted(&old->mnt))
                 goto out;
 
-        if (!attached && !(ns && is_anon_ns(ns)))
+        /* ... and either ours or the root of anon namespace */
+        if (!(attached ? check_mnt(old) : is_anon_ns(ns)))
                 goto out;
 
         if (old->mnt.mnt_flags & MNT_LOCKED)
diff --git a/fs/nfs/flexfilelayout/flexfilelayoutdev.c b/fs/nfs/flexfilelayout/flexfilelayoutdev.c
index a809989807d6..19f856f45689 100644
--- a/fs/nfs/flexfilelayout/flexfilelayoutdev.c
+++ b/fs/nfs/flexfilelayout/flexfilelayoutdev.c
@@ -18,7 +18,7 @@
 
 #define NFSDBG_FACILITY         NFSDBG_PNFS_LD
 
-static unsigned int dataserver_timeo = NFS_DEF_TCP_RETRANS;
+static unsigned int dataserver_timeo = NFS_DEF_TCP_TIMEO;
 static unsigned int dataserver_retrans;
 
 static bool ff_layout_has_available_ds(struct pnfs_layout_segment *lseg);
diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c
index 618e66078ee5..1a0cdeb3b875 100644
--- a/fs/nfsd/nfs4state.c
+++ b/fs/nfsd/nfs4state.c
@@ -1563,7 +1563,7 @@ static u32 nfsd4_get_drc_mem(struct nfsd4_channel_attrs *ca)
          * Never use more than a third of the remaining memory,
          * unless it's the only way to give this client a slot:
          */
-        avail = clamp_t(int, avail, slotsize, total_avail/3);
+        avail = clamp_t(unsigned long, avail, slotsize, total_avail/3);
         num = min_t(int, num, avail / slotsize);
         nfsd_drc_mem_used += num * slotsize;
         spin_unlock(&nfsd_drc_lock);
diff --git a/fs/proc/array.c b/fs/proc/array.c
index 84908556ea58..46dcb6f0eccf 100644
--- a/fs/proc/array.c
+++ b/fs/proc/array.c
@@ -462,7 +462,7 @@ static int do_task_stat(struct seq_file *m, struct pid_namespace *ns,
                  * a program is not able to use ptrace(2) in that case. It is
                  * safe because the task has stopped executing permanently.
                  */
-                if (permitted && (task->flags & PF_DUMPCORE)) {
+                if (permitted && (task->flags & (PF_EXITING|PF_DUMPCORE))) {
                         if (try_get_task_stack(task)) {
                                 eip = KSTK_EIP(task);
                                 esp = KSTK_ESP(task);
diff --git a/fs/proc/base.c b/fs/proc/base.c
index 9c8ca6cd3ce4..255f6754c70d 100644
--- a/fs/proc/base.c
+++ b/fs/proc/base.c
@@ -3077,8 +3077,7 @@ static const struct file_operations proc_tgid_base_operations = {
 
 struct pid *tgid_pidfd_to_pid(const struct file *file)
 {
-        if (!d_is_dir(file->f_path.dentry) ||
-            (file->f_op != &proc_tgid_base_operations))
+        if (file->f_op != &proc_tgid_base_operations)
                 return ERR_PTR(-EBADF);
 
         return proc_pid(file_inode(file));
diff --git a/fs/select.c b/fs/select.c
index 6cbc9ff56ba0..a4d8f6e8b63c 100644
--- a/fs/select.c
+++ b/fs/select.c
@@ -758,10 +758,9 @@ static long do_pselect(int n, fd_set __user *inp, fd_set __user *outp,
                 return ret;
 
         ret = core_sys_select(n, inp, outp, exp, to);
+        restore_user_sigmask(sigmask, &sigsaved, ret == -ERESTARTNOHAND);
         ret = poll_select_copy_remaining(&end_time, tsp, type, ret);
 
-        restore_user_sigmask(sigmask, &sigsaved);
-
         return ret;
 }
 
@@ -1106,8 +1105,7 @@ SYSCALL_DEFINE5(ppoll, struct pollfd __user *, ufds, unsigned int, nfds,
 
         ret = do_sys_poll(ufds, nfds, to);
 
-        restore_user_sigmask(sigmask, &sigsaved);
-
+        restore_user_sigmask(sigmask, &sigsaved, ret == -EINTR);
         /* We can restart this syscall, usually */
         if (ret == -EINTR)
                 ret = -ERESTARTNOHAND;
@@ -1142,8 +1140,7 @@ SYSCALL_DEFINE5(ppoll_time32, struct pollfd __user *, ufds, unsigned int, nfds,
 
         ret = do_sys_poll(ufds, nfds, to);
 
-        restore_user_sigmask(sigmask, &sigsaved);
-
+        restore_user_sigmask(sigmask, &sigsaved, ret == -EINTR);
         /* We can restart this syscall, usually */
         if (ret == -EINTR)
                 ret = -ERESTARTNOHAND;
@@ -1350,10 +1347,9 @@ static long do_compat_pselect(int n, compat_ulong_t __user *inp,
                 return ret;
 
         ret = compat_core_sys_select(n, inp, outp, exp, to);
+        restore_user_sigmask(sigmask, &sigsaved, ret == -ERESTARTNOHAND);
         ret = poll_select_copy_remaining(&end_time, tsp, type, ret);
 
-        restore_user_sigmask(sigmask, &sigsaved);
-
         return ret;
 }
 
@@ -1425,8 +1421,7 @@ COMPAT_SYSCALL_DEFINE5(ppoll_time32, struct pollfd __user *, ufds,
 
         ret = do_sys_poll(ufds, nfds, to);
 
-        restore_user_sigmask(sigmask, &sigsaved);
-
+        restore_user_sigmask(sigmask, &sigsaved, ret == -EINTR);
         /* We can restart this syscall, usually */
         if (ret == -EINTR)
                 ret = -ERESTARTNOHAND;
@@ -1461,8 +1456,7 @@ COMPAT_SYSCALL_DEFINE5(ppoll_time64, struct pollfd __user *, ufds,
 
         ret = do_sys_poll(ufds, nfds, to);
 
-        restore_user_sigmask(sigmask, &sigsaved);
-
+        restore_user_sigmask(sigmask, &sigsaved, ret == -EINTR);
         /* We can restart this syscall, usually */
         if (ret == -EINTR)
                 ret = -ERESTARTNOHAND;
diff --git a/fs/userfaultfd.c b/fs/userfaultfd.c
index ae0b8b5f69e6..ccbdbd62f0d8 100644
--- a/fs/userfaultfd.c
+++ b/fs/userfaultfd.c
@@ -40,6 +40,16 @@ enum userfaultfd_state {
 /*
  * Start with fault_pending_wqh and fault_wqh so they're more likely
  * to be in the same cacheline.
+ *
+ * Locking order:
+ *      fd_wqh.lock
+ *              fault_pending_wqh.lock
+ *                      fault_wqh.lock
+ *              event_wqh.lock
+ *
+ * To avoid deadlocks, IRQs must be disabled when taking any of the above locks,
+ * since fd_wqh.lock is taken by aio_poll() while it's holding a lock that's
+ * also taken in IRQ context.
  */
 struct userfaultfd_ctx {
         /* waitqueue head for the pending (i.e. not read) userfaults */
@@ -458,7 +468,7 @@ vm_fault_t handle_userfault(struct vm_fault *vmf, unsigned long reason)
         blocking_state = return_to_userland ? TASK_INTERRUPTIBLE :
                          TASK_KILLABLE;
 
-        spin_lock(&ctx->fault_pending_wqh.lock);
+        spin_lock_irq(&ctx->fault_pending_wqh.lock);
         /*
          * After the __add_wait_queue the uwq is visible to userland
          * through poll/read().
@@ -470,7 +480,7 @@ vm_fault_t handle_userfault(struct vm_fault *vmf, unsigned long reason)
          * __add_wait_queue.
          */
         set_current_state(blocking_state);
-        spin_unlock(&ctx->fault_pending_wqh.lock);
+        spin_unlock_irq(&ctx->fault_pending_wqh.lock);
 
         if (!is_vm_hugetlb_page(vmf->vma))
                 must_wait = userfaultfd_must_wait(ctx, vmf->address, vmf->flags,
@@ -552,13 +562,13 @@ vm_fault_t handle_userfault(struct vm_fault *vmf, unsigned long reason)
          * kernel stack can be released after the list_del_init.
          */
         if (!list_empty_careful(&uwq.wq.entry)) {
-                spin_lock(&ctx->fault_pending_wqh.lock);
+                spin_lock_irq(&ctx->fault_pending_wqh.lock);
                 /*
                  * No need of list_del_init(), the uwq on the stack
                  * will be freed shortly anyway.
                  */
                 list_del(&uwq.wq.entry);
-                spin_unlock(&ctx->fault_pending_wqh.lock);
+                spin_unlock_irq(&ctx->fault_pending_wqh.lock);
         }
 
         /*
@@ -583,7 +593,7 @@ static void userfaultfd_event_wait_completion(struct userfaultfd_ctx *ctx,
         init_waitqueue_entry(&ewq->wq, current);
         release_new_ctx = NULL;
 
-        spin_lock(&ctx->event_wqh.lock);
+        spin_lock_irq(&ctx->event_wqh.lock);
         /*
          * After the __add_wait_queue the uwq is visible to userland
          * through poll/read().
@@ -613,15 +623,15 @@ static void userfaultfd_event_wait_completion(struct userfaultfd_ctx *ctx,
                         break;
                 }
 
-                spin_unlock(&ctx->event_wqh.lock);
+                spin_unlock_irq(&ctx->event_wqh.lock);
 
                 wake_up_poll(&ctx->fd_wqh, EPOLLIN);
                 schedule();
 
-                spin_lock(&ctx->event_wqh.lock);
+                spin_lock_irq(&ctx->event_wqh.lock);
         }
         __set_current_state(TASK_RUNNING);
-        spin_unlock(&ctx->event_wqh.lock);
+        spin_unlock_irq(&ctx->event_wqh.lock);
 
         if (release_new_ctx) {
                 struct vm_area_struct *vma;
@@ -918,10 +928,10 @@ wakeup:
          * the last page faults that may have been already waiting on
          * the fault_*wqh.
          */
-        spin_lock(&ctx->fault_pending_wqh.lock);
+        spin_lock_irq(&ctx->fault_pending_wqh.lock);
         __wake_up_locked_key(&ctx->fault_pending_wqh, TASK_NORMAL, &range);
         __wake_up(&ctx->fault_wqh, TASK_NORMAL, 1, &range);
-        spin_unlock(&ctx->fault_pending_wqh.lock);
+        spin_unlock_irq(&ctx->fault_pending_wqh.lock);
 
         /* Flush pending events that may still wait on event_wqh */
         wake_up_all(&ctx->event_wqh);
@@ -1134,7 +1144,7 @@ static ssize_t userfaultfd_ctx_read(struct userfaultfd_ctx *ctx, int no_wait,
 
         if (!ret && msg->event == UFFD_EVENT_FORK) {
                 ret = resolve_userfault_fork(ctx, fork_nctx, msg);
-                spin_lock(&ctx->event_wqh.lock);
+                spin_lock_irq(&ctx->event_wqh.lock);
                 if (!list_empty(&fork_event)) {
                         /*
                          * The fork thread didn't abort, so we can
@@ -1180,7 +1190,7 @@ static ssize_t userfaultfd_ctx_read(struct userfaultfd_ctx *ctx, int no_wait,
                         if (ret)
                                 userfaultfd_ctx_put(fork_nctx);
                 }
-                spin_unlock(&ctx->event_wqh.lock);
+                spin_unlock_irq(&ctx->event_wqh.lock);
         }
 
         return ret;
@@ -1219,14 +1229,14 @@ static ssize_t userfaultfd_read(struct file *file, char __user *buf,
 static void __wake_userfault(struct userfaultfd_ctx *ctx,
                              struct userfaultfd_wake_range *range)
 {
-        spin_lock(&ctx->fault_pending_wqh.lock);
+        spin_lock_irq(&ctx->fault_pending_wqh.lock);
         /* wake all in the range and autoremove */
         if (waitqueue_active(&ctx->fault_pending_wqh))
                 __wake_up_locked_key(&ctx->fault_pending_wqh, TASK_NORMAL,
                                      range);
         if (waitqueue_active(&ctx->fault_wqh))
                 __wake_up(&ctx->fault_wqh, TASK_NORMAL, 1, range);
-        spin_unlock(&ctx->fault_pending_wqh.lock);
+        spin_unlock_irq(&ctx->fault_pending_wqh.lock);
 }
 
 static __always_inline void wake_userfault(struct userfaultfd_ctx *ctx,
@@ -1881,7 +1891,7 @@ static void userfaultfd_show_fdinfo(struct seq_file *m, struct file *f)
         wait_queue_entry_t *wq;
         unsigned long pending = 0, total = 0;
 
-        spin_lock(&ctx->fault_pending_wqh.lock);
+        spin_lock_irq(&ctx->fault_pending_wqh.lock);
         list_for_each_entry(wq, &ctx->fault_pending_wqh.head, entry) {
                 pending++;
                 total++;
@@ -1889,7 +1899,7 @@ static void userfaultfd_show_fdinfo(struct seq_file *m, struct file *f)
         list_for_each_entry(wq, &ctx->fault_wqh.head, entry) {
                 total++;
         }
-        spin_unlock(&ctx->fault_pending_wqh.lock);
+        spin_unlock_irq(&ctx->fault_pending_wqh.lock);
 
         /*
          * If more protocols will be added, there will be all shown
diff --git a/include/asm-generic/atomic64.h b/include/asm-generic/atomic64.h
index d7a15096fb3b..370f01d4450f 100644
--- a/include/asm-generic/atomic64.h
+++ b/include/asm-generic/atomic64.h
@@ -10,24 +10,24 @@
 #include <linux/types.h>
 
 typedef struct {
-        long long counter;
+        s64 counter;
 } atomic64_t;
 
 #define ATOMIC64_INIT(i)        { (i) }
 
-extern long long atomic64_read(const atomic64_t *v);
-extern void      atomic64_set(atomic64_t *v, long long i);
+extern s64 atomic64_read(const atomic64_t *v);
+extern void atomic64_set(atomic64_t *v, s64 i);
 
 #define atomic64_set_release(v, i)      atomic64_set((v), (i))
 
 #define ATOMIC64_OP(op)                                                 \
-extern void      atomic64_##op(long long a, atomic64_t *v);
+extern void      atomic64_##op(s64 a, atomic64_t *v);
 
 #define ATOMIC64_OP_RETURN(op)                                          \
-extern long long atomic64_##op##_return(long long a, atomic64_t *v);
+extern s64 atomic64_##op##_return(s64 a, atomic64_t *v);
 
 #define ATOMIC64_FETCH_OP(op)                                           \
-extern long long atomic64_fetch_##op(long long a, atomic64_t *v);
+extern s64 atomic64_fetch_##op(s64 a, atomic64_t *v);
 
 #define ATOMIC64_OPS(op)        ATOMIC64_OP(op) ATOMIC64_OP_RETURN(op) ATOMIC64_FETCH_OP(op)
 
@@ -46,11 +46,11 @@ ATOMIC64_OPS(xor)
 #undef ATOMIC64_OP_RETURN
 #undef ATOMIC64_OP
 
-extern long long atomic64_dec_if_positive(atomic64_t *v);
+extern s64 atomic64_dec_if_positive(atomic64_t *v);
 #define atomic64_dec_if_positive atomic64_dec_if_positive
-extern long long atomic64_cmpxchg(atomic64_t *v, long long o, long long n);
-extern long long atomic64_xchg(atomic64_t *v, long long new);
-extern long long atomic64_fetch_add_unless(atomic64_t *v, long long a, long long u);
+extern s64 atomic64_cmpxchg(atomic64_t *v, s64 o, s64 n);
+extern s64 atomic64_xchg(atomic64_t *v, s64 new);
+extern s64 atomic64_fetch_add_unless(atomic64_t *v, s64 a, s64 u);
 #define atomic64_fetch_add_unless atomic64_fetch_add_unless
 
 #endif  /*  _ASM_GENERIC_ATOMIC64_H  */
diff --git a/include/asm-generic/vdso/vsyscall.h b/include/asm-generic/vdso/vsyscall.h
new file mode 100644
index 000000000000..e94b19782c92
--- /dev/null
+++ b/include/asm-generic/vdso/vsyscall.h
@@ -0,0 +1,50 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+#ifndef __ASM_GENERIC_VSYSCALL_H
+#define __ASM_GENERIC_VSYSCALL_H
+
+#ifndef __ASSEMBLY__
+
+#ifndef __arch_get_k_vdso_data
+static __always_inline struct vdso_data *__arch_get_k_vdso_data(void)
+{
+        return NULL;
+}
+#endif /* __arch_get_k_vdso_data */
+
+#ifndef __arch_update_vdso_data
+static __always_inline int __arch_update_vdso_data(void)
+{
+        return 0;
+}
+#endif /* __arch_update_vdso_data */
+
+#ifndef __arch_get_clock_mode
+static __always_inline int __arch_get_clock_mode(struct timekeeper *tk)
+{
+        return 0;
+}
+#endif /* __arch_get_clock_mode */
+
+#ifndef __arch_use_vsyscall
+static __always_inline int __arch_use_vsyscall(struct vdso_data *vdata)
+{
+        return 1;
+}
+#endif /* __arch_use_vsyscall */
+
+#ifndef __arch_update_vsyscall
+static __always_inline void __arch_update_vsyscall(struct vdso_data *vdata,
+                                                   struct timekeeper *tk)
+{
+}
+#endif /* __arch_update_vsyscall */
+
+#ifndef __arch_sync_vdso_data
+static __always_inline void __arch_sync_vdso_data(struct vdso_data *vdata)
+{
+}
+#endif /* __arch_sync_vdso_data */
+
+#endif /* !__ASSEMBLY__ */
+
+#endif /* __ASM_GENERIC_VSYSCALL_H */
diff --git a/include/clocksource/hyperv_timer.h b/include/clocksource/hyperv_timer.h
new file mode 100644
index 000000000000..a821deb8ecb2
--- /dev/null
+++ b/include/clocksource/hyperv_timer.h
@@ -0,0 +1,107 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+
+/*
+ * Definitions for the clocksource provided by the Hyper-V
+ * hypervisor to guest VMs, as described in the Hyper-V Top
+ * Level Functional Spec (TLFS).
+ *
+ * Copyright (C) 2019, Microsoft, Inc.
+ *
+ * Author:  Michael Kelley <mikelley@microsoft.com>
+ */
+
+#ifndef __CLKSOURCE_HYPERV_TIMER_H
+#define __CLKSOURCE_HYPERV_TIMER_H
+
+#include <linux/clocksource.h>
+#include <linux/math64.h>
+#include <asm/mshyperv.h>
+
+#define HV_MAX_MAX_DELTA_TICKS 0xffffffff
+#define HV_MIN_DELTA_TICKS 1
+
+/* Routines called by the VMbus driver */
+extern int hv_stimer_alloc(int sint);
+extern void hv_stimer_free(void);
+extern void hv_stimer_init(unsigned int cpu);
+extern void hv_stimer_cleanup(unsigned int cpu);
+extern void hv_stimer_global_cleanup(void);
+extern void hv_stimer0_isr(void);
+
+#if IS_ENABLED(CONFIG_HYPERV)
+extern struct clocksource *hyperv_cs;
+extern void hv_init_clocksource(void);
+#endif /* CONFIG_HYPERV */
+
+#ifdef CONFIG_HYPERV_TSCPAGE
+extern struct ms_hyperv_tsc_page *hv_get_tsc_page(void);
+
+static inline notrace u64
+hv_read_tsc_page_tsc(const struct ms_hyperv_tsc_page *tsc_pg, u64 *cur_tsc)
+{
+        u64 scale, offset;
+        u32 sequence;
+
+        /*
+         * The protocol for reading Hyper-V TSC page is specified in Hypervisor
+         * Top-Level Functional Specification ver. 3.0 and above. To get the
+         * reference time we must do the following:
+         * - READ ReferenceTscSequence
+         *   A special '0' value indicates the time source is unreliable and we
+         *   need to use something else. The currently published specification
+         *   versions (up to 4.0b) contain a mistake and wrongly claim '-1'
+         *   instead of '0' as the special value, see commit c35b82ef0294.
+         * - ReferenceTime =
+         *        ((RDTSC() * ReferenceTscScale) >> 64) + ReferenceTscOffset
+         * - READ ReferenceTscSequence again. In case its value has changed
+         *   since our first reading we need to discard ReferenceTime and repeat
+         *   the whole sequence as the hypervisor was updating the page in
+         *   between.
+         */
+        do {
+                sequence = READ_ONCE(tsc_pg->tsc_sequence);
+                if (!sequence)
+                        return U64_MAX;
+                /*
+                 * Make sure we read sequence before we read other values from
+                 * TSC page.
+                 */
+                smp_rmb();
+
+                scale = READ_ONCE(tsc_pg->tsc_scale);
+                offset = READ_ONCE(tsc_pg->tsc_offset);
+                *cur_tsc = hv_get_raw_timer();
+
+                /*
+                 * Make sure we read sequence after we read all other values
+                 * from TSC page.
+                 */
+                smp_rmb();
+
+        } while (READ_ONCE(tsc_pg->tsc_sequence) != sequence);
+
+        return mul_u64_u64_shr(*cur_tsc, scale, 64) + offset;
+}
+
+static inline notrace u64
+hv_read_tsc_page(const struct ms_hyperv_tsc_page *tsc_pg)
+{
+        u64 cur_tsc;
+
+        return hv_read_tsc_page_tsc(tsc_pg, &cur_tsc);
+}
+
+#else /* CONFIG_HYPERV_TSC_PAGE */
+static inline struct ms_hyperv_tsc_page *hv_get_tsc_page(void)
+{
+        return NULL;
+}
+
+static inline u64 hv_read_tsc_page_tsc(const struct ms_hyperv_tsc_page *tsc_pg,
+                                       u64 *cur_tsc)
+{
+        return U64_MAX;
+}
+#endif /* CONFIG_HYPERV_TSCPAGE */
+
+#endif
diff --git a/include/clocksource/timer-davinci.h b/include/clocksource/timer-davinci.h
new file mode 100644
index 000000000000..1dcc1333fbc8
--- /dev/null
+++ b/include/clocksource/timer-davinci.h
@@ -0,0 +1,44 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * TI DaVinci clocksource driver
+ *
+ * Copyright (C) 2019 Texas Instruments
+ * Author: Bartosz Golaszewski <bgolaszewski@baylibre.com>
+ */
+
+#ifndef __TIMER_DAVINCI_H__
+#define __TIMER_DAVINCI_H__
+
+#include <linux/clk.h>
+#include <linux/ioport.h>
+
+enum {
+        DAVINCI_TIMER_CLOCKEVENT_IRQ,
+        DAVINCI_TIMER_CLOCKSOURCE_IRQ,
+        DAVINCI_TIMER_NUM_IRQS,
+};
+
+/**
+ * struct davinci_timer_cfg - davinci clocksource driver configuration struct
+ * @reg:        register range resource
+ * @irq:        clockevent and clocksource interrupt resources
+ * @cmp_off:    if set - it specifies the compare register used for clockevent
+ *
+ * Note: if the compare register is specified, the driver will use the bottom
+ * clock half for both clocksource and clockevent and the compare register
+ * to generate event irqs. The user must supply the correct compare register
+ * interrupt number.
+ *
+ * This is only used by da830 the DSP of which uses the top half. The timer
+ * driver still configures the top half to run in free-run mode.
+ */
+struct davinci_timer_cfg {
+        struct resource reg;
+        struct resource irq[DAVINCI_TIMER_NUM_IRQS];
+        unsigned int cmp_off;
+};
+
+int __init davinci_timer_register(struct clk *clk,
+                                  const struct davinci_timer_cfg *data);
+
+#endif /* __TIMER_DAVINCI_H__ */
diff --git a/include/dt-bindings/clock/g12a-clkc.h b/include/dt-bindings/clock/g12a-clkc.h
index 82c9e0c020b2..e10470ed7c4f 100644
--- a/include/dt-bindings/clock/g12a-clkc.h
+++ b/include/dt-bindings/clock/g12a-clkc.h
@@ -130,7 +130,7 @@
 #define CLKID_MALI_1_SEL                        172
 #define CLKID_MALI_1                            174
 #define CLKID_MALI                              175
-#define CLKID_MPLL_5OM                          177
+#define CLKID_MPLL_50M                          177
 #define CLKID_CPU_CLK                           187
 #define CLKID_PCIE_PLL                          201
 #define CLKID_VDEC_1                            204
diff --git a/include/dt-bindings/clock/sifive-fu540-prci.h b/include/dt-bindings/clock/sifive-fu540-prci.h
index 6a0b70a37d78..3b21d0522c91 100644
--- a/include/dt-bindings/clock/sifive-fu540-prci.h
+++ b/include/dt-bindings/clock/sifive-fu540-prci.h
@@ -1,4 +1,4 @@
-/* SPDX-License-Identifier: GPL-2.0 */
+/* SPDX-License-Identifier: (GPL-2.0 OR MIT) */
 /*
  * Copyright (C) 2018-2019 SiFive, Inc.
  * Wesley Terpstra
diff --git a/include/linux/acpi.h b/include/linux/acpi.h
index d315d86844e4..469be6844703 100644
--- a/include/linux/acpi.h
+++ b/include/linux/acpi.h
@@ -10,6 +10,7 @@
 
 #include <linux/errno.h>
 #include <linux/ioport.h>       /* for struct resource */
+#include <linux/irqdomain.h>
 #include <linux/resource_ext.h>
 #include <linux/device.h>
 #include <linux/property.h>
@@ -314,6 +315,12 @@ int acpi_isa_irq_to_gsi (unsigned isa_irq, u32 *gsi);
 void acpi_set_irq_model(enum acpi_irq_model_id model,
                         struct fwnode_handle *fwnode);
 
+struct irq_domain *acpi_irq_create_hierarchy(unsigned int flags,
+                                             unsigned int size,
+                                             struct fwnode_handle *fwnode,
+                                             const struct irq_domain_ops *ops,
+                                             void *host_data);
+
 #ifdef CONFIG_X86_IO_APIC
 extern int acpi_get_override_irq(u32 gsi, int *trigger, int *polarity);
 #else
@@ -1303,6 +1310,7 @@ static inline int lpit_read_residency_count_address(u64 *address)
 #ifdef CONFIG_ACPI_PPTT
 int find_acpi_cpu_topology(unsigned int cpu, int level);
 int find_acpi_cpu_topology_package(unsigned int cpu);
+int find_acpi_cpu_topology_hetero_id(unsigned int cpu);
 int find_acpi_cpu_cache_topology(unsigned int cpu, int level);
 #else
 static inline int find_acpi_cpu_topology(unsigned int cpu, int level)
@@ -1313,6 +1321,10 @@ static inline int find_acpi_cpu_topology_package(unsigned int cpu)
 {
         return -EINVAL;
 }
+static inline int find_acpi_cpu_topology_hetero_id(unsigned int cpu)
+{
+        return -EINVAL;
+}
 static inline int find_acpi_cpu_cache_topology(unsigned int cpu, int level)
 {
         return -EINVAL;
diff --git a/include/linux/cacheinfo.h b/include/linux/cacheinfo.h
index 70e19bc6cc9f..46b92cd61d0c 100644
--- a/include/linux/cacheinfo.h
+++ b/include/linux/cacheinfo.h
@@ -17,6 +17,8 @@ enum cache_type {
         CACHE_TYPE_UNIFIED = BIT(2),
 };
 
+extern unsigned int coherency_max_size;
+
 /**
  * struct cacheinfo - represent a cache leaf node
  * @id: This cache's id. It is unique among caches with the same (type, level).
diff --git a/include/linux/cpuhotplug.h b/include/linux/cpuhotplug.h
index 5c6062206760..87c211adf49e 100644
--- a/include/linux/cpuhotplug.h
+++ b/include/linux/cpuhotplug.h
@@ -116,10 +116,10 @@ enum cpuhp_state {
         CPUHP_AP_PERF_ARM_ACPI_STARTING,
         CPUHP_AP_PERF_ARM_STARTING,
         CPUHP_AP_ARM_L2X0_STARTING,
+        CPUHP_AP_EXYNOS4_MCT_TIMER_STARTING,
         CPUHP_AP_ARM_ARCH_TIMER_STARTING,
         CPUHP_AP_ARM_GLOBAL_TIMER_STARTING,
         CPUHP_AP_JCORE_TIMER_STARTING,
-        CPUHP_AP_EXYNOS4_MCT_TIMER_STARTING,
         CPUHP_AP_ARM_TWD_STARTING,
         CPUHP_AP_QCOM_TIMER_STARTING,
         CPUHP_AP_TEGRA_TIMER_STARTING,
diff --git a/include/linux/device.h b/include/linux/device.h
index 848fc71c6ba6..4a295e324ac5 100644
--- a/include/linux/device.h
+++ b/include/linux/device.h
@@ -704,7 +704,8 @@ extern unsigned long devm_get_free_pages(struct device *dev,
                                          gfp_t gfp_mask, unsigned int order);
 extern void devm_free_pages(struct device *dev, unsigned long addr);
 
-void __iomem *devm_ioremap_resource(struct device *dev, struct resource *res);
+void __iomem *devm_ioremap_resource(struct device *dev,
+                                    const struct resource *res);
 
 void __iomem *devm_of_iomap(struct device *dev,
                             struct device_node *node, int index,
diff --git a/include/linux/hrtimer.h b/include/linux/hrtimer.h
index 2e8957eac4d4..4971100a8cab 100644
--- a/include/linux/hrtimer.h
+++ b/include/linux/hrtimer.h
@@ -12,8 +12,8 @@
 #ifndef _LINUX_HRTIMER_H
 #define _LINUX_HRTIMER_H
 
+#include <linux/hrtimer_defs.h>
 #include <linux/rbtree.h>
-#include <linux/ktime.h>
 #include <linux/init.h>
 #include <linux/list.h>
 #include <linux/percpu.h>
@@ -298,26 +298,12 @@ struct clock_event_device;
 
 extern void hrtimer_interrupt(struct clock_event_device *dev);
 
-/*
- * The resolution of the clocks. The resolution value is returned in
- * the clock_getres() system call to give application programmers an
- * idea of the (in)accuracy of timers. Timer values are rounded up to
- * this resolution values.
- */
-# define HIGH_RES_NSEC          1
-# define KTIME_HIGH_RES         (HIGH_RES_NSEC)
-# define MONOTONIC_RES_NSEC     HIGH_RES_NSEC
-# define KTIME_MONOTONIC_RES    KTIME_HIGH_RES
-
 extern void clock_was_set_delayed(void);
 
 extern unsigned int hrtimer_resolution;
 
 #else
 
-# define MONOTONIC_RES_NSEC     LOW_RES_NSEC
-# define KTIME_MONOTONIC_RES    KTIME_LOW_RES
-
 #define hrtimer_resolution      (unsigned int)LOW_RES_NSEC
 
 static inline void clock_was_set_delayed(void) { }
diff --git a/include/linux/hrtimer_defs.h b/include/linux/hrtimer_defs.h
new file mode 100644
index 000000000000..2d3e3c5fb946
--- /dev/null
+++ b/include/linux/hrtimer_defs.h
@@ -0,0 +1,27 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+#ifndef _LINUX_HRTIMER_DEFS_H
+#define _LINUX_HRTIMER_DEFS_H
+
+#include <linux/ktime.h>
+
+#ifdef CONFIG_HIGH_RES_TIMERS
+
+/*
+ * The resolution of the clocks. The resolution value is returned in
+ * the clock_getres() system call to give application programmers an
+ * idea of the (in)accuracy of timers. Timer values are rounded up to
+ * this resolution values.
+ */
+# define HIGH_RES_NSEC          1
+# define KTIME_HIGH_RES         (HIGH_RES_NSEC)
+# define MONOTONIC_RES_NSEC     HIGH_RES_NSEC
+# define KTIME_MONOTONIC_RES    KTIME_HIGH_RES
+
+#else
+
+# define MONOTONIC_RES_NSEC     LOW_RES_NSEC
+# define KTIME_MONOTONIC_RES    KTIME_LOW_RES
+
+#endif
+
+#endif
diff --git a/include/linux/intel-ish-client-if.h b/include/linux/intel-ish-client-if.h
index 16255c2ca2f4..0d6b4bc191c5 100644
--- a/include/linux/intel-ish-client-if.h
+++ b/include/linux/intel-ish-client-if.h
@@ -103,6 +103,7 @@ void ishtp_put_device(struct ishtp_cl_device *cl_dev);
 void ishtp_get_device(struct ishtp_cl_device *cl_dev);
 void ishtp_set_drvdata(struct ishtp_cl_device *cl_device, void *data);
 void *ishtp_get_drvdata(struct ishtp_cl_device *cl_device);
+struct ishtp_cl_device *ishtp_dev_to_cl_device(struct device *dev);
 int ishtp_register_event_cb(struct ishtp_cl_device *device,
                                 void (*read_cb)(struct ishtp_cl_device *));
 struct  ishtp_fw_client *ishtp_fw_cl_get_client(struct ishtp_device *dev,
diff --git a/include/linux/irqchip/arm-gic-common.h b/include/linux/irqchip/arm-gic-common.h
index 626283858563..b9850f5f1906 100644
--- a/include/linux/irqchip/arm-gic-common.h
+++ b/include/linux/irqchip/arm-gic-common.h
@@ -36,4 +36,9 @@ struct gic_kvm_info {
 
 const struct gic_kvm_info *gic_get_kvm_info(void);
 
+struct irq_domain;
+struct fwnode_handle;
+int gicv2m_init(struct fwnode_handle *parent_handle,
+                struct irq_domain *parent);
+
 #endif /* __LINUX_IRQCHIP_ARM_GIC_COMMON_H */
diff --git a/include/linux/irqchip/arm-gic.h b/include/linux/irqchip/arm-gic.h
index 316087da1d09..5686711b0f40 100644
--- a/include/linux/irqchip/arm-gic.h
+++ b/include/linux/irqchip/arm-gic.h
@@ -157,9 +157,6 @@ int gic_of_init_child(struct device *dev, struct gic_chip_data **gic, int irq);
  */
 void gic_init(void __iomem *dist , void __iomem *cpu);
 
-int gicv2m_init(struct fwnode_handle *parent_handle,
-                struct irq_domain *parent);
-
 void gic_send_sgi(unsigned int cpu_id, unsigned int irq);
 int gic_get_cpu_id(unsigned int cpu);
 void gic_migrate_target(unsigned int new_cpu_id);
diff --git a/include/linux/jump_label.h b/include/linux/jump_label.h
index 3e113a1fa0f1..3526c0aee954 100644
--- a/include/linux/jump_label.h
+++ b/include/linux/jump_label.h
@@ -215,6 +215,9 @@ extern void arch_jump_label_transform(struct jump_entry *entry,
                                       enum jump_label_type type);
 extern void arch_jump_label_transform_static(struct jump_entry *entry,
                                              enum jump_label_type type);
+extern bool arch_jump_label_transform_queue(struct jump_entry *entry,
+                                            enum jump_label_type type);
+extern void arch_jump_label_transform_apply(void);
 extern int jump_label_text_reserved(void *start, void *end);
 extern void static_key_slow_inc(struct static_key *key);
 extern void static_key_slow_dec(struct static_key *key);
diff --git a/include/linux/kernel.h b/include/linux/kernel.h
index 74b1ee9027f5..0c9bc231107f 100644
--- a/include/linux/kernel.h
+++ b/include/linux/kernel.h
@@ -93,7 +93,8 @@
 #define DIV_ROUND_DOWN_ULL(ll, d) \
         ({ unsigned long long _tmp = (ll); do_div(_tmp, d); _tmp; })
 
-#define DIV_ROUND_UP_ULL(ll, d)         DIV_ROUND_DOWN_ULL((ll) + (d) - 1, (d))
+#define DIV_ROUND_UP_ULL(ll, d) \
+        DIV_ROUND_DOWN_ULL((unsigned long long)(ll) + (d) - 1, (d))
 
 #if BITS_PER_LONG == 32
 # define DIV_ROUND_UP_SECTOR_T(ll,d) DIV_ROUND_UP_ULL(ll, d)
diff --git a/include/linux/lockdep.h b/include/linux/lockdep.h
index 6e2377e6c1d6..57baa27f238c 100644
--- a/include/linux/lockdep.h
+++ b/include/linux/lockdep.h
@@ -203,11 +203,17 @@ struct lock_list {
         struct lock_list                *parent;
 };
 
-/*
- * We record lock dependency chains, so that we can cache them:
+/**
+ * struct lock_chain - lock dependency chain record
+ *
+ * @irq_context: the same as irq_context in held_lock below
+ * @depth:       the number of held locks in this chain
+ * @base:        the index in chain_hlocks for this chain
+ * @entry:       the collided lock chains in lock_chain hash list
+ * @chain_key:   the hash key of this lock_chain
  */
 struct lock_chain {
-        /* see BUILD_BUG_ON()s in lookup_chain_cache() */
+        /* see BUILD_BUG_ON()s in add_chain_cache() */
         unsigned int                    irq_context :  2,
                                         depth       :  6,
                                         base        : 24;
@@ -217,12 +223,8 @@ struct lock_chain {
 };
 
 #define MAX_LOCKDEP_KEYS_BITS           13
-/*
- * Subtract one because we offset hlock->class_idx by 1 in order
- * to make 0 mean no class. This avoids overflowing the class_idx
- * bitfield and hitting the BUG in hlock_class().
- */
-#define MAX_LOCKDEP_KEYS                ((1UL << MAX_LOCKDEP_KEYS_BITS) - 1)
+#define MAX_LOCKDEP_KEYS                (1UL << MAX_LOCKDEP_KEYS_BITS)
+#define INITIAL_CHAIN_KEY               -1
 
 struct held_lock {
         /*
@@ -247,6 +249,11 @@ struct held_lock {
         u64                             waittime_stamp;
         u64                             holdtime_stamp;
 #endif
+        /*
+         * class_idx is zero-indexed; it points to the element in
+         * lock_classes this held lock instance belongs to. class_idx is in
+         * the range from 0 to (MAX_LOCKDEP_KEYS-1) inclusive.
+         */
         unsigned int                    class_idx:MAX_LOCKDEP_KEYS_BITS;
         /*
          * The lock-stack is unified in that the lock chains of interrupt
@@ -281,6 +288,8 @@ extern void lockdep_free_key_range(void *start, unsigned long size);
 extern asmlinkage void lockdep_sys_exit(void);
 extern void lockdep_set_selftest_task(struct task_struct *task);
 
+extern void lockdep_init_task(struct task_struct *task);
+
 extern void lockdep_off(void);
 extern void lockdep_on(void);
 
@@ -385,7 +394,7 @@ extern void lock_unpin_lock(struct lockdep_map *lock, struct pin_cookie);
                 WARN_ON(debug_locks && !lockdep_is_held(l));    \
         } while (0)
 
-#define lockdep_assert_held_exclusive(l)        do {                    \
+#define lockdep_assert_held_write(l)    do {                    \
                 WARN_ON(debug_locks && !lockdep_is_held_type(l, 0));    \
         } while (0)
 
@@ -405,6 +414,10 @@ extern void lock_unpin_lock(struct lockdep_map *lock, struct pin_cookie);
 
 #else /* !CONFIG_LOCKDEP */
 
+static inline void lockdep_init_task(struct task_struct *task)
+{
+}
+
 static inline void lockdep_off(void)
 {
 }
@@ -466,7 +479,7 @@ struct lockdep_map { };
 #define lockdep_is_held_type(l, r)              (1)
 
 #define lockdep_assert_held(l)                  do { (void)(l); } while (0)
-#define lockdep_assert_held_exclusive(l)        do { (void)(l); } while (0)
+#define lockdep_assert_held_write(l)    do { (void)(l); } while (0)
 #define lockdep_assert_held_read(l)             do { (void)(l); } while (0)
 #define lockdep_assert_held_once(l)             do { (void)(l); } while (0)
 
@@ -497,7 +510,6 @@ enum xhlock_context_t {
         { .name = (_name), .key = (void *)(_key), }
 
 static inline void lockdep_invariant_state(bool force) {}
-static inline void lockdep_init_task(struct task_struct *task) {}
 static inline void lockdep_free_task(struct task_struct *task) {}
 
 #ifdef CONFIG_LOCK_STAT
@@ -632,11 +644,18 @@ do {									\
                           "IRQs not disabled as expected\n");           \
         } while (0)
 
+#define lockdep_assert_in_irq() do {                                    \
+                WARN_ONCE(debug_locks && !current->lockdep_recursion && \
+                          !current->hardirq_context,                    \
+                          "Not in hardirq as expected\n");              \
+        } while (0)
+
 #else
 # define might_lock(lock) do { } while (0)
 # define might_lock_read(lock) do { } while (0)
 # define lockdep_assert_irqs_enabled() do { } while (0)
 # define lockdep_assert_irqs_disabled() do { } while (0)
+# define lockdep_assert_in_irq() do { } while (0)
 #endif
 
 #ifdef CONFIG_LOCKDEP
diff --git a/include/linux/module.h b/include/linux/module.h
index 188998d3dca9..1455812dd325 100644
--- a/include/linux/module.h
+++ b/include/linux/module.h
@@ -21,6 +21,7 @@
 #include <linux/rbtree_latch.h>
 #include <linux/error-injection.h>
 #include <linux/tracepoint-defs.h>
+#include <linux/srcu.h>
 
 #include <linux/percpu.h>
 #include <asm/module.h>
@@ -450,6 +451,10 @@ struct module {
         unsigned int num_tracepoints;
         tracepoint_ptr_t *tracepoints_ptrs;
 #endif
+#ifdef CONFIG_TREE_SRCU
+        unsigned int num_srcu_structs;
+        struct srcu_struct **srcu_struct_ptrs;
+#endif
 #ifdef CONFIG_BPF_EVENTS
         unsigned int num_bpf_raw_events;
         struct bpf_raw_event_map *bpf_raw_events;
diff --git a/include/linux/mtd/spi-nor.h b/include/linux/mtd/spi-nor.h
index b3d360b0ee3d..9f57cdfcc93d 100644
--- a/include/linux/mtd/spi-nor.h
+++ b/include/linux/mtd/spi-nor.h
@@ -373,6 +373,8 @@ struct flash_info;
  * @flash_unlock:       [FLASH-SPECIFIC] unlock a region of the SPI NOR
  * @flash_is_locked:    [FLASH-SPECIFIC] check if a region of the SPI NOR is
  * @quad_enable:        [FLASH-SPECIFIC] enables SPI NOR quad mode
+ * @clear_sr_bp:        [FLASH-SPECIFIC] clears the Block Protection Bits from
+ *                      the SPI NOR Status Register.
  *                      completely locked
  * @priv:               the private data
  */
@@ -410,6 +412,7 @@ struct spi_nor {
         int (*flash_unlock)(struct spi_nor *nor, loff_t ofs, uint64_t len);
         int (*flash_is_locked)(struct spi_nor *nor, loff_t ofs, uint64_t len);
         int (*quad_enable)(struct spi_nor *nor);
+        int (*clear_sr_bp)(struct spi_nor *nor);
 
         void *priv;
 };
diff --git a/include/linux/pagemap.h b/include/linux/pagemap.h
index 9ec3544baee2..fe0b29bf2df7 100644
--- a/include/linux/pagemap.h
+++ b/include/linux/pagemap.h
@@ -333,19 +333,6 @@ static inline struct page *grab_cache_page_nowait(struct address_space *mapping,
                         mapping_gfp_mask(mapping));
 }
 
-static inline struct page *find_subpage(struct page *page, pgoff_t offset)
-{
-        unsigned long mask;
-
-        if (PageHuge(page))
-                return page;
-
-        VM_BUG_ON_PAGE(PageTail(page), page);
-
-        mask = (1UL << compound_order(page)) - 1;
-        return page + (offset & mask);
-}
-
 struct page *find_get_entry(struct address_space *mapping, pgoff_t offset);
 struct page *find_lock_entry(struct address_space *mapping, pgoff_t offset);
 unsigned find_get_entries(struct address_space *mapping, pgoff_t start,
diff --git a/include/linux/percpu-rwsem.h b/include/linux/percpu-rwsem.h
index 03cb4b6f842e..3998cdf9cd14 100644
--- a/include/linux/percpu-rwsem.h
+++ b/include/linux/percpu-rwsem.h
@@ -17,14 +17,18 @@ struct percpu_rw_semaphore {
         int                     readers_block;
 };
 
-#define DEFINE_STATIC_PERCPU_RWSEM(name)                                \
+#define __DEFINE_PERCPU_RWSEM(name, is_static)                          \
 static DEFINE_PER_CPU(unsigned int, __percpu_rwsem_rc_##name);          \
-static struct percpu_rw_semaphore name = {                              \
-        .rss = __RCU_SYNC_INITIALIZER(name.rss, RCU_SCHED_SYNC),        \
+is_static struct percpu_rw_semaphore name = {                           \
+        .rss = __RCU_SYNC_INITIALIZER(name.rss),                        \
         .read_count = &__percpu_rwsem_rc_##name,                        \
         .rw_sem = __RWSEM_INITIALIZER(name.rw_sem),                     \
         .writer = __RCUWAIT_INITIALIZER(name.writer),                   \
 }
+#define DEFINE_PERCPU_RWSEM(name)               \
+        __DEFINE_PERCPU_RWSEM(name, /* not static */)
+#define DEFINE_STATIC_PERCPU_RWSEM(name)        \
+        __DEFINE_PERCPU_RWSEM(name, static)
 
 extern int __percpu_down_read(struct percpu_rw_semaphore *, int);
 extern void __percpu_up_read(struct percpu_rw_semaphore *);
@@ -117,7 +121,7 @@ static inline void percpu_rwsem_release(struct percpu_rw_semaphore *sem,
         lock_release(&sem->rw_sem.dep_map, 1, ip);
 #ifdef CONFIG_RWSEM_SPIN_ON_OWNER
         if (!read)
-                sem->rw_sem.owner = RWSEM_OWNER_UNKNOWN;
+                atomic_long_set(&sem->rw_sem.owner, RWSEM_OWNER_UNKNOWN);
 #endif
 }
 
@@ -127,7 +131,7 @@ static inline void percpu_rwsem_acquire(struct percpu_rw_semaphore *sem,
         lock_acquire(&sem->rw_sem.dep_map, 0, 1, read, 1, NULL, ip);
 #ifdef CONFIG_RWSEM_SPIN_ON_OWNER
         if (!read)
-                sem->rw_sem.owner = current;
+                atomic_long_set(&sem->rw_sem.owner, (long)current);
 #endif
 }
 
diff --git a/include/linux/perf/arm_pmu.h b/include/linux/perf/arm_pmu.h
index a9b0ee408fbd..71f525a35ac2 100644
--- a/include/linux/perf/arm_pmu.h
+++ b/include/linux/perf/arm_pmu.h
@@ -171,4 +171,6 @@ void armpmu_free_irq(int irq, int cpu);
 
 #endif /* CONFIG_ARM_PMU */
 
+#define ARMV8_SPE_PDEV_NAME "arm,spe-v1"
+
 #endif /* __ARM_PMU_H__ */
diff --git a/include/linux/perf_event.h b/include/linux/perf_event.h
index 0ab99c7b652d..2bca72f3028b 100644
--- a/include/linux/perf_event.h
+++ b/include/linux/perf_event.h
@@ -241,6 +241,7 @@ struct perf_event;
 #define PERF_PMU_CAP_NO_INTERRUPT               0x01
 #define PERF_PMU_CAP_NO_NMI                     0x02
 #define PERF_PMU_CAP_AUX_NO_SG                  0x04
+#define PERF_PMU_CAP_EXTENDED_REGS              0x08
 #define PERF_PMU_CAP_EXCLUSIVE                  0x10
 #define PERF_PMU_CAP_ITRACE                     0x20
 #define PERF_PMU_CAP_HETEROGENEOUS_CPUS         0x40
diff --git a/include/linux/perf_regs.h b/include/linux/perf_regs.h
index 476747456bca..2d12e97d5e7b 100644
--- a/include/linux/perf_regs.h
+++ b/include/linux/perf_regs.h
@@ -11,6 +11,11 @@ struct perf_regs {
 
 #ifdef CONFIG_HAVE_PERF_REGS
 #include <asm/perf_regs.h>
+
+#ifndef PERF_REG_EXTENDED_MASK
+#define PERF_REG_EXTENDED_MASK  0
+#endif
+
 u64 perf_reg_value(struct pt_regs *regs, int idx);
 int perf_reg_validate(u64 mask);
 u64 perf_reg_abi(struct task_struct *task);
@@ -18,6 +23,9 @@ void perf_get_regs_user(struct perf_regs *regs_user,
                         struct pt_regs *regs,
                         struct pt_regs *regs_user_copy);
 #else
+
+#define PERF_REG_EXTENDED_MASK  0
+
 static inline u64 perf_reg_value(struct pt_regs *regs, int idx)
 {
         return 0;
diff --git a/include/linux/pfn_t.h b/include/linux/pfn_t.h
index 7bb77850c65a..3c202a11a79e 100644
--- a/include/linux/pfn_t.h
+++ b/include/linux/pfn_t.h
@@ -68,7 +68,7 @@ static inline phys_addr_t pfn_t_to_phys(pfn_t pfn)
 
 static inline void *pfn_t_to_virt(pfn_t pfn)
 {
-        if (pfn_t_has_page(pfn))
+        if (pfn_t_has_page(pfn) && !is_device_private_page(pfn_t_to_page(pfn)))
                 return __va(pfn_t_to_phys(pfn));
         return NULL;
 }
diff --git a/include/linux/processor.h b/include/linux/processor.h
index dbc952eec869..dc78bdc7079a 100644
--- a/include/linux/processor.h
+++ b/include/linux/processor.h
@@ -32,15 +32,6 @@
 #define spin_cpu_relax() cpu_relax()
 #endif
 
-/*
- * spin_cpu_yield may be called to yield (undirected) to the hypervisor if
- * necessary. This should be used if the wait is expected to take longer
- * than context switch overhead, but we can't sleep or do a directed yield.
- */
-#ifndef spin_cpu_yield
-#define spin_cpu_yield() cpu_relax_yield()
-#endif
-
 #ifndef spin_end
 #define spin_end()
 #endif
diff --git a/include/linux/rcu_sync.h b/include/linux/rcu_sync.h
index 6fc53a1345b3..9b83865d24f9 100644
--- a/include/linux/rcu_sync.h
+++ b/include/linux/rcu_sync.h
@@ -13,62 +13,44 @@
 #include <linux/wait.h>
 #include <linux/rcupdate.h>
 
-enum rcu_sync_type { RCU_SYNC, RCU_SCHED_SYNC, RCU_BH_SYNC };
-
 /* Structure to mediate between updaters and fastpath-using readers.  */
 struct rcu_sync {
         int                     gp_state;
         int                     gp_count;
         wait_queue_head_t       gp_wait;
 
-        int                     cb_state;
         struct rcu_head         cb_head;
-
-        enum rcu_sync_type      gp_type;
 };
 
-extern void rcu_sync_lockdep_assert(struct rcu_sync *);
-
 /**
  * rcu_sync_is_idle() - Are readers permitted to use their fastpaths?
  * @rsp: Pointer to rcu_sync structure to use for synchronization
  *
- * Returns true if readers are permitted to use their fastpaths.
- * Must be invoked within an RCU read-side critical section whose
- * flavor matches that of the rcu_sync struture.
+ * Returns true if readers are permitted to use their fastpaths.  Must be
+ * invoked within some flavor of RCU read-side critical section.
  */
 static inline bool rcu_sync_is_idle(struct rcu_sync *rsp)
 {
-#ifdef CONFIG_PROVE_RCU
-        rcu_sync_lockdep_assert(rsp);
-#endif
-        return !rsp->gp_state; /* GP_IDLE */
+        RCU_LOCKDEP_WARN(!rcu_read_lock_held() &&
+                         !rcu_read_lock_bh_held() &&
+                         !rcu_read_lock_sched_held(),
+                         "suspicious rcu_sync_is_idle() usage");
+        return !READ_ONCE(rsp->gp_state); /* GP_IDLE */
 }
 
-extern void rcu_sync_init(struct rcu_sync *, enum rcu_sync_type);
+extern void rcu_sync_init(struct rcu_sync *);
 extern void rcu_sync_enter_start(struct rcu_sync *);
 extern void rcu_sync_enter(struct rcu_sync *);
 extern void rcu_sync_exit(struct rcu_sync *);
 extern void rcu_sync_dtor(struct rcu_sync *);
 
-#define __RCU_SYNC_INITIALIZER(name, type) {                            \
+#define __RCU_SYNC_INITIALIZER(name) {                                  \
                 .gp_state = 0,                                          \
                 .gp_count = 0,                                          \
                 .gp_wait = __WAIT_QUEUE_HEAD_INITIALIZER(name.gp_wait), \
-                .cb_state = 0,                                          \
-                .gp_type = type,                                        \
         }
 
-#define __DEFINE_RCU_SYNC(name, type)   \
-        struct rcu_sync_struct name = __RCU_SYNC_INITIALIZER(name, type)
-
-#define DEFINE_RCU_SYNC(name)           \
-        __DEFINE_RCU_SYNC(name, RCU_SYNC)
-
-#define DEFINE_RCU_SCHED_SYNC(name)     \
-        __DEFINE_RCU_SYNC(name, RCU_SCHED_SYNC)
-
-#define DEFINE_RCU_BH_SYNC(name)        \
-        __DEFINE_RCU_SYNC(name, RCU_BH_SYNC)
+#define DEFINE_RCU_SYNC(name)   \
+        struct rcu_sync name = __RCU_SYNC_INITIALIZER(name)
 
 #endif /* _LINUX_RCU_SYNC_H_ */
diff --git a/include/linux/rcupdate.h b/include/linux/rcupdate.h
index b25d20822e75..8f7167478c1d 100644
--- a/include/linux/rcupdate.h
+++ b/include/linux/rcupdate.h
@@ -365,16 +365,15 @@ static inline void rcu_preempt_sleep_check(void) { }
  * other macros that it invokes.
  */
 #define rcu_assign_pointer(p, v)                                              \
-({                                                                            \
+do {                                                                          \
         uintptr_t _r_a_p__v = (uintptr_t)(v);                                 \
-        rcu_check_sparse(p, __rcu);                                   \
+        rcu_check_sparse(p, __rcu);                                           \
                                                                               \
         if (__builtin_constant_p(v) && (_r_a_p__v) == (uintptr_t)NULL)        \
                 WRITE_ONCE((p), (typeof(p))(_r_a_p__v));                      \
         else                                                                  \
                 smp_store_release(&p, RCU_INITIALIZER((typeof(p))_r_a_p__v)); \
-        _r_a_p__v;                                                            \
-})
+} while (0)
 
 /**
  * rcu_swap_protected() - swap an RCU and a regular pointer
@@ -586,7 +585,7 @@ static inline void rcu_preempt_sleep_check(void) { }
  * read-side critical sections may be preempted and they may also block, but
  * only when acquiring spinlocks that are subject to priority inheritance.
  */
-static inline void rcu_read_lock(void)
+static __always_inline void rcu_read_lock(void)
 {
         __rcu_read_lock();
         __acquire(RCU);
@@ -803,7 +802,7 @@ static inline notrace void rcu_read_unlock_sched_notrace(void)
 /**
  * kfree_rcu() - kfree an object after a grace period.
  * @ptr:        pointer to kfree
- * @rcu_head:   the name of the struct rcu_head within the type of @ptr.
+ * @rhf:        the name of the struct rcu_head within the type of @ptr.
  *
  * Many rcu callbacks functions just call kfree() on the base structure.
  * These functions are trivial, but their size adds up, and furthermore
@@ -826,9 +825,13 @@ static inline notrace void rcu_read_unlock_sched_notrace(void)
  * The BUILD_BUG_ON check must not involve any function calls, hence the
  * checks are done in macros here.
  */
-#define kfree_rcu(ptr, rcu_head)                                        \
-        __kfree_rcu(&((ptr)->rcu_head), offsetof(typeof(*(ptr)), rcu_head))
-
+#define kfree_rcu(ptr, rhf)                                             \
+do {                                                                    \
+        typeof (ptr) ___p = (ptr);                                      \
+                                                                        \
+        if (___p)                                                       \
+                __kfree_rcu(&((___p)->rhf), offsetof(typeof(*(ptr)), rhf)); \
+} while (0)
 
 /*
  * Place this after a lock-acquisition primitive to guarantee that
diff --git a/include/linux/rwsem.h b/include/linux/rwsem.h
index 2ea18a3def04..e401358c4e7e 100644
--- a/include/linux/rwsem.h
+++ b/include/linux/rwsem.h
@@ -34,12 +34,13 @@
  */
 struct rw_semaphore {
         atomic_long_t count;
-#ifdef CONFIG_RWSEM_SPIN_ON_OWNER
         /*
-         * Write owner. Used as a speculative check to see
-         * if the owner is running on the cpu.
+         * Write owner or one of the read owners as well flags regarding
+         * the current state of the rwsem. Can be used as a speculative
+         * check to see if the write owner is running on the cpu.
          */
-        struct task_struct *owner;
+        atomic_long_t owner;
+#ifdef CONFIG_RWSEM_SPIN_ON_OWNER
         struct optimistic_spin_queue osq; /* spinner MCS lock */
 #endif
         raw_spinlock_t wait_lock;
@@ -50,10 +51,10 @@ struct rw_semaphore {
 };
 
 /*
- * Setting bit 1 of the owner field but not bit 0 will indicate
+ * Setting all bits of the owner field except bit 0 will indicate
  * that the rwsem is writer-owned with an unknown owner.
  */
-#define RWSEM_OWNER_UNKNOWN     ((struct task_struct *)-2L)
+#define RWSEM_OWNER_UNKNOWN     (-2L)
 
 /* In all implementations count != 0 means locked */
 static inline int rwsem_is_locked(struct rw_semaphore *sem)
@@ -73,13 +74,14 @@ static inline int rwsem_is_locked(struct rw_semaphore *sem)
 #endif
 
 #ifdef CONFIG_RWSEM_SPIN_ON_OWNER
-#define __RWSEM_OPT_INIT(lockname) , .osq = OSQ_LOCK_UNLOCKED, .owner = NULL
+#define __RWSEM_OPT_INIT(lockname) , .osq = OSQ_LOCK_UNLOCKED
 #else
 #define __RWSEM_OPT_INIT(lockname)
 #endif
 
 #define __RWSEM_INITIALIZER(name)                               \
         { __RWSEM_INIT_COUNT(name),                             \
+          .owner = ATOMIC_LONG_INIT(0),                         \
           .wait_list = LIST_HEAD_INIT((name).wait_list),        \
           .wait_lock = __RAW_SPIN_LOCK_UNLOCKED(name.wait_lock) \
           __RWSEM_OPT_INIT(name)                                \
diff --git a/include/linux/sched.h b/include/linux/sched.h
index 1113dd4706ae..459d95e4a574 100644
--- a/include/linux/sched.h
+++ b/include/linux/sched.h
@@ -618,7 +618,7 @@ union rcu_special {
                 u8                      blocked;
                 u8                      need_qs;
                 u8                      exp_hint; /* Hint for performance. */
-                u8                      pad; /* No garbage from compiler! */
+                u8                      deferred_qs;
         } b; /* Bits. */
         u32 s; /* Set of bits. */
 };
@@ -1579,10 +1579,6 @@ static inline int set_cpus_allowed_ptr(struct task_struct *p, const struct cpuma
 }
 #endif
 
-#ifndef cpu_relax_yield
-#define cpu_relax_yield() cpu_relax()
-#endif
-
 extern int yield_to(struct task_struct *p, bool preempt);
 extern void set_user_nice(struct task_struct *p, long nice);
 extern int task_prio(const struct task_struct *p);
diff --git a/include/linux/sched/wake_q.h b/include/linux/sched/wake_q.h
index ad826d2a4557..26a2013ac39c 100644
--- a/include/linux/sched/wake_q.h
+++ b/include/linux/sched/wake_q.h
@@ -51,6 +51,11 @@ static inline void wake_q_init(struct wake_q_head *head)
         head->lastp = &head->first;
 }
 
+static inline bool wake_q_empty(struct wake_q_head *head)
+{
+        return head->first == WAKE_Q_TAIL;
+}
+
 extern void wake_q_add(struct wake_q_head *head, struct task_struct *task);
 extern void wake_q_add_safe(struct wake_q_head *head, struct task_struct *task);
 extern void wake_up_q(struct wake_q_head *head);
diff --git a/include/linux/signal.h b/include/linux/signal.h
index 9702016734b1..78c2bb376954 100644
--- a/include/linux/signal.h
+++ b/include/linux/signal.h
@@ -276,7 +276,7 @@ extern int sigprocmask(int, sigset_t *, sigset_t *);
 extern int set_user_sigmask(const sigset_t __user *usigmask, sigset_t *set,
         sigset_t *oldset, size_t sigsetsize);
 extern void restore_user_sigmask(const void __user *usigmask,
-                                 sigset_t *sigsaved);
+                                 sigset_t *sigsaved, bool interrupted);
 extern void set_current_blocked(sigset_t *);
 extern void __set_current_blocked(const sigset_t *);
 extern int show_unhandled_signals;
diff --git a/include/linux/smp.h b/include/linux/smp.h
index a56f08ff3097..6fc856c9eda5 100644
--- a/include/linux/smp.h
+++ b/include/linux/smp.h
@@ -35,7 +35,7 @@ int smp_call_function_single(int cpuid, smp_call_func_t func, void *info,
 /*
  * Call a function on all processors
  */
-int on_each_cpu(smp_call_func_t func, void *info, int wait);
+void on_each_cpu(smp_call_func_t func, void *info, int wait);
 
 /*
  * Call a function on processors specified by mask, which might include
@@ -101,7 +101,7 @@ extern void smp_cpus_done(unsigned int max_cpus);
 /*
  * Call a function on all other processors
  */
-int smp_call_function(smp_call_func_t func, void *info, int wait);
+void smp_call_function(smp_call_func_t func, void *info, int wait);
 void smp_call_function_many(const struct cpumask *mask,
                             smp_call_func_t func, void *info, bool wait);
 
@@ -144,9 +144,8 @@ static inline void smp_send_stop(void) { }
  *      These macros fold the SMP functionality into a single CPU system
  */
 #define raw_smp_processor_id()                  0
-static inline int up_smp_call_function(smp_call_func_t func, void *info)
+static inline void up_smp_call_function(smp_call_func_t func, void *info)
 {
-        return 0;
 }
 #define smp_call_function(func, info, wait) \
                         (up_smp_call_function(func, info))
@@ -181,29 +180,46 @@ static inline int get_boot_cpu_id(void)
 
 #endif /* !SMP */
 
-/*
- * smp_processor_id(): get the current CPU ID.
+/**
+ * raw_processor_id() - get the current (unstable) CPU id
+ *
+ * For then you know what you are doing and need an unstable
+ * CPU id.
+ */
+
+/**
+ * smp_processor_id() - get the current (stable) CPU id
+ *
+ * This is the normal accessor to the CPU id and should be used
+ * whenever possible.
  *
- * if DEBUG_PREEMPT is enabled then we check whether it is
- * used in a preemption-safe way. (smp_processor_id() is safe
- * if it's used in a preemption-off critical section, or in
- * a thread that is bound to the current CPU.)
+ * The CPU id is stable when:
  *
- * NOTE: raw_smp_processor_id() is for internal use only
- * (smp_processor_id() is the preferred variant), but in rare
- * instances it might also be used to turn off false positives
- * (i.e. smp_processor_id() use that the debugging code reports but
- * which use for some reason is legal). Don't use this to hack around
- * the warning message, as your code might not work under PREEMPT.
+ *  - IRQs are disabled;
+ *  - preemption is disabled;
+ *  - the task is CPU affine.
+ *
+ * When CONFIG_DEBUG_PREEMPT; we verify these assumption and WARN
+ * when smp_processor_id() is used when the CPU id is not stable.
+ */
+
+/*
+ * Allow the architecture to differentiate between a stable and unstable read.
+ * For example, x86 uses an IRQ-safe asm-volatile read for the unstable but a
+ * regular asm read for the stable.
  */
+#ifndef __smp_processor_id
+#define __smp_processor_id(x) raw_smp_processor_id(x)
+#endif
+
 #ifdef CONFIG_DEBUG_PREEMPT
   extern unsigned int debug_smp_processor_id(void);
 # define smp_processor_id() debug_smp_processor_id()
 #else
-# define smp_processor_id() raw_smp_processor_id()
+# define smp_processor_id() __smp_processor_id()
 #endif
 
-#define get_cpu()               ({ preempt_disable(); smp_processor_id(); })
+#define get_cpu()               ({ preempt_disable(); __smp_processor_id(); })
 #define put_cpu()               preempt_enable()
 
 /*
diff --git a/include/linux/srcutree.h b/include/linux/srcutree.h
index 7f7c8c050f63..9cfcc8a756ae 100644
--- a/include/linux/srcutree.h
+++ b/include/linux/srcutree.h
@@ -120,9 +120,17 @@ struct srcu_struct {
  *
  * See include/linux/percpu-defs.h for the rules on per-CPU variables.
  */
-#define __DEFINE_SRCU(name, is_static)                                  \
-        static DEFINE_PER_CPU(struct srcu_data, name##_srcu_data);\
-        is_static struct srcu_struct name = __SRCU_STRUCT_INIT(name, name##_srcu_data)
+#ifdef MODULE
+# define __DEFINE_SRCU(name, is_static)                                 \
+        is_static struct srcu_struct name;                              \
+        struct srcu_struct * const __srcu_struct_##name                 \
+                __section("___srcu_struct_ptrs") = &name
+#else
+# define __DEFINE_SRCU(name, is_static)                                 \
+        static DEFINE_PER_CPU(struct srcu_data, name##_srcu_data);      \
+        is_static struct srcu_struct name =                             \
+                __SRCU_STRUCT_INIT(name, name##_srcu_data)
+#endif
 #define DEFINE_SRCU(name)               __DEFINE_SRCU(name, /* not static */)
 #define DEFINE_STATIC_SRCU(name)        __DEFINE_SRCU(name, static)
 
diff --git a/include/linux/stop_machine.h b/include/linux/stop_machine.h
index 6d3635c86dbe..f9a0c6189852 100644
--- a/include/linux/stop_machine.h
+++ b/include/linux/stop_machine.h
@@ -36,6 +36,7 @@ int stop_cpus(const struct cpumask *cpumask, cpu_stop_fn_t fn, void *arg);
 int try_stop_cpus(const struct cpumask *cpumask, cpu_stop_fn_t fn, void *arg);
 void stop_machine_park(int cpu);
 void stop_machine_unpark(int cpu);
+void stop_machine_yield(const struct cpumask *cpumask);
 
 #else   /* CONFIG_SMP */
 
diff --git a/include/linux/suspend.h b/include/linux/suspend.h
index 8594001e8be8..f0d262ad7b78 100644
--- a/include/linux/suspend.h
+++ b/include/linux/suspend.h
@@ -209,8 +209,9 @@ extern int suspend_valid_only_mem(suspend_state_t state);
 
 extern unsigned int pm_suspend_global_flags;
 
-#define PM_SUSPEND_FLAG_FW_SUSPEND      (1 << 0)
-#define PM_SUSPEND_FLAG_FW_RESUME       (1 << 1)
+#define PM_SUSPEND_FLAG_FW_SUSPEND      BIT(0)
+#define PM_SUSPEND_FLAG_FW_RESUME       BIT(1)
+#define PM_SUSPEND_FLAG_NO_PLATFORM     BIT(2)
 
 static inline void pm_suspend_clear_flags(void)
 {
@@ -227,6 +228,11 @@ static inline void pm_set_resume_via_firmware(void)
         pm_suspend_global_flags |= PM_SUSPEND_FLAG_FW_RESUME;
 }
 
+static inline void pm_set_suspend_no_platform(void)
+{
+        pm_suspend_global_flags |= PM_SUSPEND_FLAG_NO_PLATFORM;
+}
+
 /**
  * pm_suspend_via_firmware - Check if platform firmware will suspend the system.
  *
@@ -268,6 +274,22 @@ static inline bool pm_resume_via_firmware(void)
         return !!(pm_suspend_global_flags & PM_SUSPEND_FLAG_FW_RESUME);
 }
 
+/**
+ * pm_suspend_no_platform - Check if platform may change device power states.
+ *
+ * To be called during system-wide power management transitions to sleep states
+ * or during the subsequent system-wide transitions back to the working state.
+ *
+ * Return 'true' if the power states of devices remain under full control of the
+ * kernel throughout the system-wide suspend and resume cycle in progress (that
+ * is, if a device is put into a certain power state during suspend, it can be
+ * expected to remain in that state during resume).
+ */
+static inline bool pm_suspend_no_platform(void)
+{
+        return !!(pm_suspend_global_flags & PM_SUSPEND_FLAG_NO_PLATFORM);
+}
+
 /* Suspend-to-idle state machnine. */
 enum s2idle_states {
         S2IDLE_STATE_NONE,      /* Not suspended/suspending. */
diff --git a/include/linux/timekeeping.h b/include/linux/timekeeping.h
index a8ab0f143ac4..b27e2ffa96c1 100644
--- a/include/linux/timekeeping.h
+++ b/include/linux/timekeeping.h
@@ -113,6 +113,34 @@ static inline ktime_t ktime_get_coarse_clocktai(void)
         return ktime_get_coarse_with_offset(TK_OFFS_TAI);
 }
 
+static inline ktime_t ktime_get_coarse(void)
+{
+        struct timespec64 ts;
+
+        ktime_get_coarse_ts64(&ts);
+        return timespec64_to_ktime(ts);
+}
+
+static inline u64 ktime_get_coarse_ns(void)
+{
+        return ktime_to_ns(ktime_get_coarse());
+}
+
+static inline u64 ktime_get_coarse_real_ns(void)
+{
+        return ktime_to_ns(ktime_get_coarse_real());
+}
+
+static inline u64 ktime_get_coarse_boottime_ns(void)
+{
+        return ktime_to_ns(ktime_get_coarse_boottime());
+}
+
+static inline u64 ktime_get_coarse_clocktai_ns(void)
+{
+        return ktime_to_ns(ktime_get_coarse_clocktai());
+}
+
 /**
  * ktime_mono_to_real - Convert monotonic time to clock realtime
  */
@@ -131,12 +159,12 @@ static inline u64 ktime_get_real_ns(void)
         return ktime_to_ns(ktime_get_real());
 }
 
-static inline u64 ktime_get_boot_ns(void)
+static inline u64 ktime_get_boottime_ns(void)
 {
         return ktime_to_ns(ktime_get_boottime());
 }
 
-static inline u64 ktime_get_tai_ns(void)
+static inline u64 ktime_get_clocktai_ns(void)
 {
         return ktime_to_ns(ktime_get_clocktai());
 }
diff --git a/include/linux/timer.h b/include/linux/timer.h
index 7b066fd38248..282e4f2a532a 100644
--- a/include/linux/timer.h
+++ b/include/linux/timer.h
@@ -36,19 +36,30 @@ struct timer_list {
 #define __TIMER_LOCKDEP_MAP_INITIALIZER(_kn)
 #endif
 
-/*
- * A deferrable timer will work normally when the system is busy, but
- * will not cause a CPU to come out of idle just to service it; instead,
- * the timer will be serviced when the CPU eventually wakes up with a
- * subsequent non-deferrable timer.
+/**
+ * @TIMER_DEFERRABLE: A deferrable timer will work normally when the
+ * system is busy, but will not cause a CPU to come out of idle just
+ * to service it; instead, the timer will be serviced when the CPU
+ * eventually wakes up with a subsequent non-deferrable timer.
  *
- * An irqsafe timer is executed with IRQ disabled and it's safe to wait for
- * the completion of the running instance from IRQ handlers, for example,
- * by calling del_timer_sync().
+ * @TIMER_IRQSAFE: An irqsafe timer is executed with IRQ disabled and
+ * it's safe to wait for the completion of the running instance from
+ * IRQ handlers, for example, by calling del_timer_sync().
  *
  * Note: The irq disabled callback execution is a special case for
  * workqueue locking issues. It's not meant for executing random crap
  * with interrupts disabled. Abuse is monitored!
+ *
+ * @TIMER_PINNED: A pinned timer will not be affected by any timer
+ * placement heuristics (like, NOHZ) and will always expire on the CPU
+ * on which the timer was enqueued.
+ *
+ * Note: Because enqueuing of timers can migrate the timer from one
+ * CPU to another, pinned timers are not guaranteed to stay on the
+ * initialy selected CPU.  They move to the CPU on which the enqueue
+ * function is invoked via mod_timer() or add_timer().  If the timer
+ * should be placed on a particular CPU, then add_timer_on() has to be
+ * used.
  */
 #define TIMER_CPUMASK           0x0003FFFF
 #define TIMER_MIGRATING         0x00040000
diff --git a/include/linux/torture.h b/include/linux/torture.h
index 23d80db426d7..a620118385bb 100644
--- a/include/linux/torture.h
+++ b/include/linux/torture.h
@@ -66,7 +66,7 @@ int torture_shutdown_init(int ssecs, void (*cleanup)(void));
 
 /* Task stuttering, which forces load/no-load transitions. */
 bool stutter_wait(const char *title);
-int torture_stutter_init(int s);
+int torture_stutter_init(int s, int sgap);
 
 /* Initialization and cleanup. */
 bool torture_init_begin(char *ttype, int v);
diff --git a/include/linux/types.h b/include/linux/types.h
index 231114ae38f4..05030f608be3 100644
--- a/include/linux/types.h
+++ b/include/linux/types.h
@@ -174,7 +174,7 @@ typedef struct {
 
 #ifdef CONFIG_64BIT
 typedef struct {
-        long counter;
+        s64 counter;
 } atomic64_t;
 #endif
 
diff --git a/include/linux/xarray.h b/include/linux/xarray.h
index 0e01e6129145..5921599b6dc4 100644
--- a/include/linux/xarray.h
+++ b/include/linux/xarray.h
@@ -265,6 +265,7 @@ enum xa_lock_type {
 #define XA_FLAGS_TRACK_FREE     ((__force gfp_t)4U)
 #define XA_FLAGS_ZERO_BUSY      ((__force gfp_t)8U)
 #define XA_FLAGS_ALLOC_WRAPPED  ((__force gfp_t)16U)
+#define XA_FLAGS_ACCOUNT        ((__force gfp_t)32U)
 #define XA_FLAGS_MARK(mark)     ((__force gfp_t)((1U << __GFP_BITS_SHIFT) << \
                                                 (__force unsigned)(mark)))
 
diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h
index 8fb5be3ca0ca..1fce25b1d87f 100644
--- a/include/net/cfg80211.h
+++ b/include/net/cfg80211.h
@@ -2007,7 +2007,7 @@ enum cfg80211_signal_type {
  *      received by the device (not just by the host, in case it was
  *      buffered on the device) and be accurate to about 10ms.
  *      If the frame isn't buffered, just passing the return value of
- *      ktime_get_boot_ns() is likely appropriate.
+ *      ktime_get_boottime_ns() is likely appropriate.
  * @parent_tsf: the time at the start of reception of the first octet of the
  *      timestamp field of the frame. The time is the TSF of the BSS specified
  *      by %parent_bssid.
diff --git a/include/net/ip6_route.h b/include/net/ip6_route.h
index 4790beaa86e0..ee7405e759ba 100644
--- a/include/net/ip6_route.h
+++ b/include/net/ip6_route.h
@@ -262,8 +262,8 @@ static inline bool ip6_sk_ignore_df(const struct sock *sk)
                inet6_sk(sk)->pmtudisc == IPV6_PMTUDISC_OMIT;
 }
 
-static inline struct in6_addr *rt6_nexthop(struct rt6_info *rt,
-                                           struct in6_addr *daddr)
+static inline const struct in6_addr *rt6_nexthop(const struct rt6_info *rt,
+                                                 const struct in6_addr *daddr)
 {
         if (rt->rt6i_flags & RTF_GATEWAY)
                 return &rt->rt6i_gateway;
diff --git a/include/net/route.h b/include/net/route.h
index 065b47754f05..55ff71ffb796 100644
--- a/include/net/route.h
+++ b/include/net/route.h
@@ -221,6 +221,7 @@ void ip_rt_get_source(u8 *src, struct sk_buff *skb, struct rtable *rt);
 struct rtable *rt_dst_alloc(struct net_device *dev,
                              unsigned int flags, u16 type,
                              bool nopolicy, bool noxfrm, bool will_cache);
+struct rtable *rt_dst_clone(struct net_device *dev, struct rtable *rt);
 
 struct in_ifaddr;
 void fib_add_ifaddr(struct in_ifaddr *);
diff --git a/include/net/tls.h b/include/net/tls.h
index 4a55ce6a303f..53d96bca220d 100644
--- a/include/net/tls.h
+++ b/include/net/tls.h
@@ -373,21 +373,6 @@ static inline bool tls_is_partially_sent_record(struct tls_context *ctx)
         return !!ctx->partially_sent_record;
 }
 
-static inline int tls_complete_pending_work(struct sock *sk,
-                                            struct tls_context *ctx,
-                                            int flags, long *timeo)
-{
-        int rc = 0;
-
-        if (unlikely(sk->sk_write_pending))
-                rc = wait_on_pending_writer(sk, timeo);
-
-        if (!rc && tls_is_partially_sent_record(ctx))
-                rc = tls_push_partial_record(sk, ctx, flags);
-
-        return rc;
-}
-
 static inline bool tls_is_pending_open_record(struct tls_context *tls_ctx)
 {
         return tls_ctx->pending_open_record_frags;
diff --git a/include/vdso/datapage.h b/include/vdso/datapage.h
new file mode 100644
index 000000000000..2e302c0f41f7
--- /dev/null
+++ b/include/vdso/datapage.h
@@ -0,0 +1,89 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+#ifndef __VDSO_DATAPAGE_H
+#define __VDSO_DATAPAGE_H
+
+#ifndef __ASSEMBLY__
+
+#include <linux/bits.h>
+#include <linux/time.h>
+#include <linux/types.h>
+
+#define VDSO_BASES      (CLOCK_TAI + 1)
+#define VDSO_HRES       (BIT(CLOCK_REALTIME)            | \
+                         BIT(CLOCK_MONOTONIC)           | \
+                         BIT(CLOCK_BOOTTIME)            | \
+                         BIT(CLOCK_TAI))
+#define VDSO_COARSE     (BIT(CLOCK_REALTIME_COARSE)     | \
+                         BIT(CLOCK_MONOTONIC_COARSE))
+#define VDSO_RAW        (BIT(CLOCK_MONOTONIC_RAW))
+
+#define CS_HRES_COARSE  0
+#define CS_RAW          1
+#define CS_BASES        (CS_RAW + 1)
+
+/**
+ * struct vdso_timestamp - basetime per clock_id
+ * @sec:        seconds
+ * @nsec:       nanoseconds
+ *
+ * There is one vdso_timestamp object in vvar for each vDSO-accelerated
+ * clock_id. For high-resolution clocks, this encodes the time
+ * corresponding to vdso_data.cycle_last. For coarse clocks this encodes
+ * the actual time.
+ *
+ * To be noticed that for highres clocks nsec is left-shifted by
+ * vdso_data.cs[x].shift.
+ */
+struct vdso_timestamp {
+        u64     sec;
+        u64     nsec;
+};
+
+/**
+ * struct vdso_data - vdso datapage representation
+ * @seq:                timebase sequence counter
+ * @clock_mode:         clock mode
+ * @cycle_last:         timebase at clocksource init
+ * @mask:               clocksource mask
+ * @mult:               clocksource multiplier
+ * @shift:              clocksource shift
+ * @basetime[clock_id]: basetime per clock_id
+ * @tz_minuteswest:     minutes west of Greenwich
+ * @tz_dsttime:         type of DST correction
+ * @hrtimer_res:        hrtimer resolution
+ * @__unused:           unused
+ *
+ * vdso_data will be accessed by 64 bit and compat code at the same time
+ * so we should be careful before modifying this structure.
+ */
+struct vdso_data {
+        u32                     seq;
+
+        s32                     clock_mode;
+        u64                     cycle_last;
+        u64                     mask;
+        u32                     mult;
+        u32                     shift;
+
+        struct vdso_timestamp   basetime[VDSO_BASES];
+
+        s32                     tz_minuteswest;
+        s32                     tz_dsttime;
+        u32                     hrtimer_res;
+        u32                     __unused;
+};
+
+/*
+ * We use the hidden visibility to prevent the compiler from generating a GOT
+ * relocation. Not only is going through a GOT useless (the entry couldn't and
+ * must not be overridden by another library), it does not even work: the linker
+ * cannot generate an absolute address to the data page.
+ *
+ * With the hidden visibility, the compiler simply generates a PC-relative
+ * relocation, and this is what we need.
+ */
+extern struct vdso_data _vdso_data[CS_BASES] __attribute__((visibility("hidden")));
+
+#endif /* !__ASSEMBLY__ */
+
+#endif /* __VDSO_DATAPAGE_H */
diff --git a/include/vdso/helpers.h b/include/vdso/helpers.h
new file mode 100644
index 000000000000..01641dbb68ef
--- /dev/null
+++ b/include/vdso/helpers.h
@@ -0,0 +1,56 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+#ifndef __VDSO_HELPERS_H
+#define __VDSO_HELPERS_H
+
+#ifndef __ASSEMBLY__
+
+#include <vdso/datapage.h>
+
+static __always_inline u32 vdso_read_begin(const struct vdso_data *vd)
+{
+        u32 seq;
+
+        while ((seq = READ_ONCE(vd->seq)) & 1)
+                cpu_relax();
+
+        smp_rmb();
+        return seq;
+}
+
+static __always_inline u32 vdso_read_retry(const struct vdso_data *vd,
+                                           u32 start)
+{
+        u32 seq;
+
+        smp_rmb();
+        seq = READ_ONCE(vd->seq);
+        return seq != start;
+}
+
+static __always_inline void vdso_write_begin(struct vdso_data *vd)
+{
+        /*
+         * WRITE_ONCE it is required otherwise the compiler can validly tear
+         * updates to vd[x].seq and it is possible that the value seen by the
+         * reader it is inconsistent.
+         */
+        WRITE_ONCE(vd[CS_HRES_COARSE].seq, vd[CS_HRES_COARSE].seq + 1);
+        WRITE_ONCE(vd[CS_RAW].seq, vd[CS_RAW].seq + 1);
+        smp_wmb();
+}
+
+static __always_inline void vdso_write_end(struct vdso_data *vd)
+{
+        smp_wmb();
+        /*
+         * WRITE_ONCE it is required otherwise the compiler can validly tear
+         * updates to vd[x].seq and it is possible that the value seen by the
+         * reader it is inconsistent.
+         */
+        WRITE_ONCE(vd[CS_HRES_COARSE].seq, vd[CS_HRES_COARSE].seq + 1);
+        WRITE_ONCE(vd[CS_RAW].seq, vd[CS_RAW].seq + 1);
+}
+
+#endif /* !__ASSEMBLY__ */
+
+#endif /* __VDSO_HELPERS_H */
diff --git a/include/vdso/vsyscall.h b/include/vdso/vsyscall.h
new file mode 100644
index 000000000000..2c6134e0c23d
--- /dev/null
+++ b/include/vdso/vsyscall.h
@@ -0,0 +1,11 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+#ifndef __VDSO_VSYSCALL_H
+#define __VDSO_VSYSCALL_H
+
+#ifndef __ASSEMBLY__
+
+#include <asm/vdso/vsyscall.h>
+
+#endif /* !__ASSEMBLY__ */
+
+#endif /* __VDSO_VSYSCALL_H */
diff --git a/init/init_task.c b/init/init_task.c
index 3c27c0efa316..7ab773b9b3cd 100644
--- a/init/init_task.c
+++ b/init/init_task.c
@@ -167,6 +167,8 @@ struct task_struct init_task
         .softirqs_enabled = 1,
 #endif
 #ifdef CONFIG_LOCKDEP
+        .lockdep_depth = 0, /* no locks held yet */
+        .curr_chain_key = INITIAL_CHAIN_KEY,
         .lockdep_recursion = 0,
 #endif
 #ifdef CONFIG_FUNCTION_GRAPH_TRACER
diff --git a/init/initramfs.c b/init/initramfs.c
index 178130fd61c2..c47dad0884f7 100644
--- a/init/initramfs.c
+++ b/init/initramfs.c
@@ -617,7 +617,7 @@ static inline void clean_rootfs(void)
 #endif /* CONFIG_BLK_DEV_RAM */
 
 #ifdef CONFIG_BLK_DEV_RAM
-static void populate_initrd_image(char *err)
+static void __init populate_initrd_image(char *err)
 {
         ssize_t written;
         int fd;
@@ -637,7 +637,7 @@ static void populate_initrd_image(char *err)
         ksys_close(fd);
 }
 #else
-static void populate_initrd_image(char *err)
+static void __init populate_initrd_image(char *err)
 {
         printk(KERN_EMERG "Initramfs unpacking failed: %s\n", err);
 }
diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c
index 42d17f730780..5b30f8baaf02 100644
--- a/kernel/bpf/syscall.c
+++ b/kernel/bpf/syscall.c
@@ -1668,7 +1668,7 @@ static int bpf_prog_load(union bpf_attr *attr, union bpf_attr __user *uattr)
         if (err < 0)
                 goto free_prog;
 
-        prog->aux->load_time = ktime_get_boot_ns();
+        prog->aux->load_time = ktime_get_boottime_ns();
         err = bpf_obj_name_cpy(prog->aux->name, attr->prog_name);
         if (err)
                 goto free_prog;
diff --git a/kernel/cgroup/cgroup.c b/kernel/cgroup/cgroup.c
index bf9dbffd46b1..cdbeff87fa99 100644
--- a/kernel/cgroup/cgroup.c
+++ b/kernel/cgroup/cgroup.c
@@ -101,7 +101,7 @@ static DEFINE_SPINLOCK(cgroup_idr_lock);
  */
 static DEFINE_SPINLOCK(cgroup_file_kn_lock);
 
-struct percpu_rw_semaphore cgroup_threadgroup_rwsem;
+DEFINE_PERCPU_RWSEM(cgroup_threadgroup_rwsem);
 
 #define cgroup_assert_mutex_or_rcu_locked()                             \
         RCU_LOCKDEP_WARN(!rcu_read_lock_held() &&                       \
@@ -5666,7 +5666,6 @@ int __init cgroup_init(void)
         int ssid;
 
         BUILD_BUG_ON(CGROUP_SUBSYS_COUNT > 16);
-        BUG_ON(percpu_init_rwsem(&cgroup_threadgroup_rwsem));
         BUG_ON(cgroup_init_cftypes(NULL, cgroup_base_files));
         BUG_ON(cgroup_init_cftypes(NULL, cgroup1_base_files));
 
diff --git a/kernel/cpu.c b/kernel/cpu.c
index 077fde6fb953..e84c0873559e 100644
--- a/kernel/cpu.c
+++ b/kernel/cpu.c
@@ -522,7 +522,7 @@ static int bringup_wait_for_ap(unsigned int cpu)
         /*
          * SMT soft disabling on X86 requires to bring the CPU out of the
          * BIOS 'wait for SIPI' state in order to set the CR4.MCE bit.  The
-         * CPU marked itself as booted_once in cpu_notify_starting() so the
+         * CPU marked itself as booted_once in notify_cpu_starting() so the
          * cpu_smt_allowed() check will now return false if this is not the
          * primary sibling.
          */
@@ -1221,6 +1221,13 @@ int freeze_secondary_cpus(int primary)
         for_each_online_cpu(cpu) {
                 if (cpu == primary)
                         continue;
+
+                if (pm_wakeup_pending()) {
+                        pr_info("Wakeup pending. Abort CPU freeze\n");
+                        error = -EBUSY;
+                        break;
+                }
+
                 trace_suspend_resume(TPS("CPU_OFF"), cpu, true);
                 error = _cpu_down(cpu, 1, CPUHP_OFFLINE);
                 trace_suspend_resume(TPS("CPU_OFF"), cpu, false);
@@ -1964,6 +1971,9 @@ static ssize_t write_cpuhp_fail(struct device *dev,
         if (ret)
                 return ret;
 
+        if (fail < CPUHP_OFFLINE || fail > CPUHP_ONLINE)
+                return -EINVAL;
+
         /*
          * Cannot fail STARTING/DYING callbacks.
          */
@@ -2339,6 +2349,9 @@ static int __init mitigations_parse_cmdline(char *arg)
                 cpu_mitigations = CPU_MITIGATIONS_AUTO;
         else if (!strcmp(arg, "auto,nosmt"))
                 cpu_mitigations = CPU_MITIGATIONS_AUTO_NOSMT;
+        else
+                pr_crit("Unsupported mitigations=%s, system may still be vulnerable\n",
+                        arg);
 
         return 0;
 }
diff --git a/kernel/events/core.c b/kernel/events/core.c
index abbd4b3b96c2..29e5f7880a4b 100644
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -5005,6 +5005,9 @@ static int perf_event_period(struct perf_event *event, u64 __user *arg)
         if (perf_event_check_period(event, value))
                 return -EINVAL;
 
+        if (!event->attr.freq && (value & (1ULL << 63)))
+                return -EINVAL;
+
         event_function_call(event, __perf_event_period, &value);
 
         return 0;
@@ -5923,7 +5926,7 @@ static void perf_sample_regs_user(struct perf_regs *regs_user,
         if (user_mode(regs)) {
                 regs_user->abi = perf_reg_abi(current);
                 regs_user->regs = regs;
-        } else if (current->mm) {
+        } else if (!(current->flags & PF_KTHREAD)) {
                 perf_get_regs_user(regs_user, regs, regs_user_copy);
         } else {
                 regs_user->abi = PERF_SAMPLE_REGS_ABI_NONE;
@@ -10033,6 +10036,12 @@ void perf_pmu_unregister(struct pmu *pmu)
 }
 EXPORT_SYMBOL_GPL(perf_pmu_unregister);
 
+static inline bool has_extended_regs(struct perf_event *event)
+{
+        return (event->attr.sample_regs_user & PERF_REG_EXTENDED_MASK) ||
+               (event->attr.sample_regs_intr & PERF_REG_EXTENDED_MASK);
+}
+
 static int perf_try_init_event(struct pmu *pmu, struct perf_event *event)
 {
         struct perf_event_context *ctx = NULL;
@@ -10064,12 +10073,16 @@ static int perf_try_init_event(struct pmu *pmu, struct perf_event *event)
                 perf_event_ctx_unlock(event->group_leader, ctx);
 
         if (!ret) {
+                if (!(pmu->capabilities & PERF_PMU_CAP_EXTENDED_REGS) &&
+                    has_extended_regs(event))
+                        ret = -EOPNOTSUPP;
+
                 if (pmu->capabilities & PERF_PMU_CAP_NO_EXCLUDE &&
-                                event_has_any_exclude_flag(event)) {
-                        if (event->destroy)
-                                event->destroy(event);
+                    event_has_any_exclude_flag(event))
                         ret = -EINVAL;
-                }
+
+                if (ret && event->destroy)
+                        event->destroy(event);
         }
 
         if (ret)
@@ -10680,11 +10693,11 @@ static int perf_event_set_clock(struct perf_event *event, clockid_t clk_id)
                 break;
 
         case CLOCK_BOOTTIME:
-                event->clock = &ktime_get_boot_ns;
+                event->clock = &ktime_get_boottime_ns;
                 break;
 
         case CLOCK_TAI:
-                event->clock = &ktime_get_tai_ns;
+                event->clock = &ktime_get_clocktai_ns;
                 break;
 
         default:
diff --git a/kernel/events/uprobes.c b/kernel/events/uprobes.c
index 78f61bfc6b79..97c367f0a9aa 100644
--- a/kernel/events/uprobes.c
+++ b/kernel/events/uprobes.c
@@ -46,7 +46,7 @@ static DEFINE_SPINLOCK(uprobes_treelock);	/* serialize rbtree access */
 static struct mutex uprobes_mmap_mutex[UPROBES_HASH_SZ];
 #define uprobes_mmap_hash(v)    (&uprobes_mmap_mutex[((unsigned long)(v)) % UPROBES_HASH_SZ])
 
-static struct percpu_rw_semaphore dup_mmap_sem;
+DEFINE_STATIC_PERCPU_RWSEM(dup_mmap_sem);
 
 /* Have a copy of original instruction */
 #define UPROBE_COPY_INSN        0
@@ -2302,7 +2302,5 @@ void __init uprobes_init(void)
         for (i = 0; i < UPROBES_HASH_SZ; i++)
                 mutex_init(&uprobes_mmap_mutex[i]);
 
-        BUG_ON(percpu_init_rwsem(&dup_mmap_sem));
-
         BUG_ON(register_die_notifier(&uprobe_exception_nb));
 }
diff --git a/kernel/fork.c b/kernel/fork.c
index 6be686283e55..847dd147b068 100644
--- a/kernel/fork.c
+++ b/kernel/fork.c
@@ -248,7 +248,11 @@ static unsigned long *alloc_thread_stack_node(struct task_struct *tsk, int node)
         struct page *page = alloc_pages_node(node, THREADINFO_GFP,
                                              THREAD_SIZE_ORDER);
 
-        return page ? page_address(page) : NULL;
+        if (likely(page)) {
+                tsk->stack = page_address(page);
+                return tsk->stack;
+        }
+        return NULL;
 #endif
 }
 
@@ -1714,31 +1718,6 @@ const struct file_operations pidfd_fops = {
 #endif
 };
 
-/**
- * pidfd_create() - Create a new pid file descriptor.
- *
- * @pid:  struct pid that the pidfd will reference
- *
- * This creates a new pid file descriptor with the O_CLOEXEC flag set.
- *
- * Note, that this function can only be called after the fd table has
- * been unshared to avoid leaking the pidfd to the new process.
- *
- * Return: On success, a cloexec pidfd is returned.
- *         On error, a negative errno number will be returned.
- */
-static int pidfd_create(struct pid *pid)
-{
-        int fd;
-
-        fd = anon_inode_getfd("[pidfd]", &pidfd_fops, get_pid(pid),
-                              O_RDWR | O_CLOEXEC);
-        if (fd < 0)
-                put_pid(pid);
-
-        return fd;
-}
-
 static void __delayed_free_task(struct rcu_head *rhp)
 {
         struct task_struct *tsk = container_of(rhp, struct task_struct, rcu);
@@ -1776,6 +1755,7 @@ static __latent_entropy struct task_struct *copy_process(
         int pidfd = -1, retval;
         struct task_struct *p;
         struct multiprocess_signals delayed;
+        struct file *pidfile = NULL;
 
         /*
          * Don't allow sharing the root directory with processes in a different
@@ -1824,8 +1804,6 @@ static __latent_entropy struct task_struct *copy_process(
         }
 
         if (clone_flags & CLONE_PIDFD) {
-                int reserved;
-
                 /*
                  * - CLONE_PARENT_SETTID is useless for pidfds and also
                  *   parent_tidptr is used to return pidfds.
@@ -1836,16 +1814,6 @@ static __latent_entropy struct task_struct *copy_process(
                 if (clone_flags &
                     (CLONE_DETACHED | CLONE_PARENT_SETTID | CLONE_THREAD))
                         return ERR_PTR(-EINVAL);
-
-                /*
-                 * Verify that parent_tidptr is sane so we can potentially
-                 * reuse it later.
-                 */
-                if (get_user(reserved, parent_tidptr))
-                        return ERR_PTR(-EFAULT);
-
-                if (reserved != 0)
-                        return ERR_PTR(-EINVAL);
         }
 
         /*
@@ -1986,9 +1954,6 @@ static __latent_entropy struct task_struct *copy_process(
         p->pagefault_disabled = 0;
 
 #ifdef CONFIG_LOCKDEP
-        p->lockdep_depth = 0; /* no locks held yet */
-        p->curr_chain_key = 0;
-        p->lockdep_recursion = 0;
         lockdep_init_task(p);
 #endif
 
@@ -2060,11 +2025,21 @@ static __latent_entropy struct task_struct *copy_process(
          * if the fd table isn't shared).
          */
         if (clone_flags & CLONE_PIDFD) {
-                retval = pidfd_create(pid);
+                retval = get_unused_fd_flags(O_RDWR | O_CLOEXEC);
                 if (retval < 0)
                         goto bad_fork_free_pid;
 
                 pidfd = retval;
+
+                pidfile = anon_inode_getfile("[pidfd]", &pidfd_fops, pid,
+                                              O_RDWR | O_CLOEXEC);
+                if (IS_ERR(pidfile)) {
+                        put_unused_fd(pidfd);
+                        retval = PTR_ERR(pidfile);
+                        goto bad_fork_free_pid;
+                }
+                get_pid(pid);   /* held by pidfile now */
+
                 retval = put_user(pidfd, parent_tidptr);
                 if (retval)
                         goto bad_fork_put_pidfd;
@@ -2141,7 +2116,7 @@ static __latent_entropy struct task_struct *copy_process(
          */
 
         p->start_time = ktime_get_ns();
-        p->real_start_time = ktime_get_boot_ns();
+        p->real_start_time = ktime_get_boottime_ns();
 
         /*
          * Make it visible to the rest of the system, but dont wake it up yet.
@@ -2182,6 +2157,9 @@ static __latent_entropy struct task_struct *copy_process(
                 goto bad_fork_cancel_cgroup;
         }
 
+        /* past the last point of failure */
+        if (pidfile)
+                fd_install(pidfd, pidfile);
 
         init_task_pid_links(p);
         if (likely(p->pid)) {
@@ -2248,8 +2226,10 @@ bad_fork_cancel_cgroup:
 bad_fork_cgroup_threadgroup_change_end:
         cgroup_threadgroup_change_end(current);
 bad_fork_put_pidfd:
-        if (clone_flags & CLONE_PIDFD)
-                ksys_close(pidfd);
+        if (clone_flags & CLONE_PIDFD) {
+                fput(pidfile);
+                put_unused_fd(pidfd);
+        }
 bad_fork_free_pid:
         if (pid != &init_struct_pid)
                 free_pid(pid);
diff --git a/kernel/futex.c b/kernel/futex.c
index 4b5b468c58b6..6d50728ef2e7 100644
--- a/kernel/futex.c
+++ b/kernel/futex.c
@@ -471,6 +471,37 @@ enum futex_access {
 };
 
 /**
+ * futex_setup_timer - set up the sleeping hrtimer.
+ * @time:       ptr to the given timeout value
+ * @timeout:    the hrtimer_sleeper structure to be set up
+ * @flags:      futex flags
+ * @range_ns:   optional range in ns
+ *
+ * Return: Initialized hrtimer_sleeper structure or NULL if no timeout
+ *         value given
+ */
+static inline struct hrtimer_sleeper *
+futex_setup_timer(ktime_t *time, struct hrtimer_sleeper *timeout,
+                  int flags, u64 range_ns)
+{
+        if (!time)
+                return NULL;
+
+        hrtimer_init_on_stack(&timeout->timer, (flags & FLAGS_CLOCKRT) ?
+                              CLOCK_REALTIME : CLOCK_MONOTONIC,
+                              HRTIMER_MODE_ABS);
+        hrtimer_init_sleeper(timeout, current);
+
+        /*
+         * If range_ns is 0, calling hrtimer_set_expires_range_ns() is
+         * effectively the same as calling hrtimer_set_expires().
+         */
+        hrtimer_set_expires_range_ns(&timeout->timer, *time, range_ns);
+
+        return timeout;
+}
+
+/**
  * get_futex_key() - Get parameters which are the keys for a futex
  * @uaddr:      virtual address of the futex
  * @fshared:    0 for a PROCESS_PRIVATE futex, 1 for PROCESS_SHARED
@@ -2679,7 +2710,7 @@ out:
 static int futex_wait(u32 __user *uaddr, unsigned int flags, u32 val,
                       ktime_t *abs_time, u32 bitset)
 {
-        struct hrtimer_sleeper timeout, *to = NULL;
+        struct hrtimer_sleeper timeout, *to;
         struct restart_block *restart;
         struct futex_hash_bucket *hb;
         struct futex_q q = futex_q_init;
@@ -2689,17 +2720,8 @@ static int futex_wait(u32 __user *uaddr, unsigned int flags, u32 val,
                 return -EINVAL;
         q.bitset = bitset;
 
-        if (abs_time) {
-                to = &timeout;
-
-                hrtimer_init_on_stack(&to->timer, (flags & FLAGS_CLOCKRT) ?
-                                      CLOCK_REALTIME : CLOCK_MONOTONIC,
-                                      HRTIMER_MODE_ABS);
-                hrtimer_init_sleeper(to, current);
-                hrtimer_set_expires_range_ns(&to->timer, *abs_time,
-                                             current->timer_slack_ns);
-        }
-
+        to = futex_setup_timer(abs_time, &timeout, flags,
+                               current->timer_slack_ns);
 retry:
         /*
          * Prepare to wait on uaddr. On success, holds hb lock and increments
@@ -2779,7 +2801,7 @@ static long futex_wait_restart(struct restart_block *restart)
 static int futex_lock_pi(u32 __user *uaddr, unsigned int flags,
                          ktime_t *time, int trylock)
 {
-        struct hrtimer_sleeper timeout, *to = NULL;
+        struct hrtimer_sleeper timeout, *to;
         struct futex_pi_state *pi_state = NULL;
         struct rt_mutex_waiter rt_waiter;
         struct futex_hash_bucket *hb;
@@ -2792,13 +2814,7 @@ static int futex_lock_pi(u32 __user *uaddr, unsigned int flags,
         if (refill_pi_state_cache())
                 return -ENOMEM;
 
-        if (time) {
-                to = &timeout;
-                hrtimer_init_on_stack(&to->timer, CLOCK_REALTIME,
-                                      HRTIMER_MODE_ABS);
-                hrtimer_init_sleeper(to, current);
-                hrtimer_set_expires(&to->timer, *time);
-        }
+        to = futex_setup_timer(time, &timeout, FLAGS_CLOCKRT, 0);
 
 retry:
         ret = get_futex_key(uaddr, flags & FLAGS_SHARED, &q.key, FUTEX_WRITE);
@@ -3195,7 +3211,7 @@ static int futex_wait_requeue_pi(u32 __user *uaddr, unsigned int flags,
                                  u32 val, ktime_t *abs_time, u32 bitset,
                                  u32 __user *uaddr2)
 {
-        struct hrtimer_sleeper timeout, *to = NULL;
+        struct hrtimer_sleeper timeout, *to;
         struct futex_pi_state *pi_state = NULL;
         struct rt_mutex_waiter rt_waiter;
         struct futex_hash_bucket *hb;
@@ -3212,15 +3228,8 @@ static int futex_wait_requeue_pi(u32 __user *uaddr, unsigned int flags,
         if (!bitset)
                 return -EINVAL;
 
-        if (abs_time) {
-                to = &timeout;
-                hrtimer_init_on_stack(&to->timer, (flags & FLAGS_CLOCKRT) ?
-                                      CLOCK_REALTIME : CLOCK_MONOTONIC,
-                                      HRTIMER_MODE_ABS);
-                hrtimer_init_sleeper(to, current);
-                hrtimer_set_expires_range_ns(&to->timer, *abs_time,
-                                             current->timer_slack_ns);
-        }
+        to = futex_setup_timer(abs_time, &timeout, flags,
+                               current->timer_slack_ns);
 
         /*
          * The waiter is allocated on our stack, manipulated by the requeue
diff --git a/kernel/irq/Makefile b/kernel/irq/Makefile
index ff6e352e3a6c..b4f53717d143 100644
--- a/kernel/irq/Makefile
+++ b/kernel/irq/Makefile
@@ -2,6 +2,9 @@
 
 obj-y := irqdesc.o handle.o manage.o spurious.o resend.o chip.o dummychip.o devres.o
 obj-$(CONFIG_IRQ_TIMINGS) += timings.o
+ifeq ($(CONFIG_TEST_IRQ_TIMINGS),y)
+        CFLAGS_timings.o += -DDEBUG
+endif
 obj-$(CONFIG_GENERIC_IRQ_CHIP) += generic-chip.o
 obj-$(CONFIG_GENERIC_IRQ_PROBE) += autoprobe.o
 obj-$(CONFIG_IRQ_DOMAIN) += irqdomain.o
diff --git a/kernel/irq/affinity.c b/kernel/irq/affinity.c
index f18cd5aa33e8..4352b08ae48d 100644
--- a/kernel/irq/affinity.c
+++ b/kernel/irq/affinity.c
@@ -94,8 +94,7 @@ static int get_nodes_in_cpumask(cpumask_var_t *node_to_cpumask,
         return nodes;
 }
 
-static int __irq_build_affinity_masks(const struct irq_affinity *affd,
-                                      unsigned int startvec,
+static int __irq_build_affinity_masks(unsigned int startvec,
                                       unsigned int numvecs,
                                       unsigned int firstvec,
                                       cpumask_var_t *node_to_cpumask,
@@ -171,8 +170,7 @@ static int __irq_build_affinity_masks(const struct irq_affinity *affd,
  *      1) spread present CPU on these vectors
  *      2) spread other possible CPUs on these vectors
  */
-static int irq_build_affinity_masks(const struct irq_affinity *affd,
-                                    unsigned int startvec, unsigned int numvecs,
+static int irq_build_affinity_masks(unsigned int startvec, unsigned int numvecs,
                                     unsigned int firstvec,
                                     struct irq_affinity_desc *masks)
 {
@@ -197,7 +195,7 @@ static int irq_build_affinity_masks(const struct irq_affinity *affd,
         build_node_to_cpumask(node_to_cpumask);
 
         /* Spread on present CPUs starting from affd->pre_vectors */
-        nr_present = __irq_build_affinity_masks(affd, curvec, numvecs,
+        nr_present = __irq_build_affinity_masks(curvec, numvecs,
                                                 firstvec, node_to_cpumask,
                                                 cpu_present_mask, nmsk, masks);
 
@@ -212,7 +210,7 @@ static int irq_build_affinity_masks(const struct irq_affinity *affd,
         else
                 curvec = firstvec + nr_present;
         cpumask_andnot(npresmsk, cpu_possible_mask, cpu_present_mask);
-        nr_others = __irq_build_affinity_masks(affd, curvec, numvecs,
+        nr_others = __irq_build_affinity_masks(curvec, numvecs,
                                                firstvec, node_to_cpumask,
                                                npresmsk, nmsk, masks);
         put_online_cpus();
@@ -295,7 +293,7 @@ irq_create_affinity_masks(unsigned int nvecs, struct irq_affinity *affd)
                 unsigned int this_vecs = affd->set_size[i];
                 int ret;
 
-                ret = irq_build_affinity_masks(affd, curvec, this_vecs,
+                ret = irq_build_affinity_masks(curvec, this_vecs,
                                                curvec, masks);
                 if (ret) {
                         kfree(masks);
diff --git a/kernel/irq/autoprobe.c b/kernel/irq/autoprobe.c
index 16cbf6beb276..ae60cae24e9a 100644
--- a/kernel/irq/autoprobe.c
+++ b/kernel/irq/autoprobe.c
@@ -90,7 +90,7 @@ unsigned long probe_irq_on(void)
                         /* It triggered already - consider it spurious. */
                         if (!(desc->istate & IRQS_WAITING)) {
                                 desc->istate &= ~IRQS_AUTODETECT;
-                                irq_shutdown(desc);
+                                irq_shutdown_and_deactivate(desc);
                         } else
                                 if (i < 32)
                                         mask |= 1 << i;
@@ -127,7 +127,7 @@ unsigned int probe_irq_mask(unsigned long val)
                                 mask |= 1 << i;
 
                         desc->istate &= ~IRQS_AUTODETECT;
-                        irq_shutdown(desc);
+                        irq_shutdown_and_deactivate(desc);
                 }
                 raw_spin_unlock_irq(&desc->lock);
         }
@@ -169,7 +169,7 @@ int probe_irq_off(unsigned long val)
                                 nr_of_irqs++;
                         }
                         desc->istate &= ~IRQS_AUTODETECT;
-                        irq_shutdown(desc);
+                        irq_shutdown_and_deactivate(desc);
                 }
                 raw_spin_unlock_irq(&desc->lock);
         }
diff --git a/kernel/irq/chip.c b/kernel/irq/chip.c
index 29d6c7d070b4..b76703b2c0af 100644
--- a/kernel/irq/chip.c
+++ b/kernel/irq/chip.c
@@ -314,6 +314,12 @@ void irq_shutdown(struct irq_desc *desc)
                 }
                 irq_state_clr_started(desc);
         }
+}
+
+
+void irq_shutdown_and_deactivate(struct irq_desc *desc)
+{
+        irq_shutdown(desc);
         /*
          * This must be called even if the interrupt was never started up,
          * because the activation can happen before the interrupt is
@@ -748,6 +754,8 @@ void handle_fasteoi_nmi(struct irq_desc *desc)
         unsigned int irq = irq_desc_get_irq(desc);
         irqreturn_t res;
 
+        __kstat_incr_irqs_this_cpu(desc);
+
         trace_irq_handler_entry(irq, action);
         /*
          * NMIs cannot be shared, there is only one action.
@@ -962,6 +970,8 @@ void handle_percpu_devid_fasteoi_nmi(struct irq_desc *desc)
         unsigned int irq = irq_desc_get_irq(desc);
         irqreturn_t res;
 
+        __kstat_incr_irqs_this_cpu(desc);
+
         trace_irq_handler_entry(irq, action);
         res = action->handler(irq, raw_cpu_ptr(action->percpu_dev_id));
         trace_irq_handler_exit(irq, action, res);
diff --git a/kernel/irq/cpuhotplug.c b/kernel/irq/cpuhotplug.c
index 5b1072e394b2..6c7ca2e983a5 100644
--- a/kernel/irq/cpuhotplug.c
+++ b/kernel/irq/cpuhotplug.c
@@ -116,7 +116,7 @@ static bool migrate_one_irq(struct irq_desc *desc)
                  */
                 if (irqd_affinity_is_managed(d)) {
                         irqd_set_managed_shutdown(d);
-                        irq_shutdown(desc);
+                        irq_shutdown_and_deactivate(desc);
                         return false;
                 }
                 affinity = cpu_online_mask;
diff --git a/kernel/irq/internals.h b/kernel/irq/internals.h
index 70c3053bc1f6..3924fbe829d4 100644
--- a/kernel/irq/internals.h
+++ b/kernel/irq/internals.h
@@ -82,6 +82,7 @@ extern int irq_activate_and_startup(struct irq_desc *desc, bool resend);
 extern int irq_startup(struct irq_desc *desc, bool resend, bool force);
 
 extern void irq_shutdown(struct irq_desc *desc);
+extern void irq_shutdown_and_deactivate(struct irq_desc *desc);
 extern void irq_enable(struct irq_desc *desc);
 extern void irq_disable(struct irq_desc *desc);
 extern void irq_percpu_enable(struct irq_desc *desc, unsigned int cpu);
@@ -96,6 +97,10 @@ static inline void irq_mark_irq(unsigned int irq) { }
 extern void irq_mark_irq(unsigned int irq);
 #endif
 
+extern int __irq_get_irqchip_state(struct irq_data *data,
+                                   enum irqchip_irq_state which,
+                                   bool *state);
+
 extern void init_kstat_irqs(struct irq_desc *desc, int node, int nr);
 
 irqreturn_t __handle_irq_event_percpu(struct irq_desc *desc, unsigned int *flags);
@@ -354,6 +359,16 @@ static inline int irq_timing_decode(u64 value, u64 *timestamp)
         return value & U16_MAX;
 }
 
+static __always_inline void irq_timings_push(u64 ts, int irq)
+{
+        struct irq_timings *timings = this_cpu_ptr(&irq_timings);
+
+        timings->values[timings->count & IRQ_TIMINGS_MASK] =
+                irq_timing_encode(ts, irq);
+
+        timings->count++;
+}
+
 /*
  * The function record_irq_time is only called in one place in the
  * interrupts handler. We want this function always inline so the code
@@ -367,15 +382,8 @@ static __always_inline void record_irq_time(struct irq_desc *desc)
         if (!static_branch_likely(&irq_timing_enabled))
                 return;
 
-        if (desc->istate & IRQS_TIMINGS) {
-                struct irq_timings *timings = this_cpu_ptr(&irq_timings);
-
-                timings->values[timings->count & IRQ_TIMINGS_MASK] =
-                        irq_timing_encode(local_clock(),
-                                          irq_desc_get_irq(desc));
-
-                timings->count++;
-        }
+        if (desc->istate & IRQS_TIMINGS)
+                irq_timings_push(local_clock(), irq_desc_get_irq(desc));
 }
 #else
 static inline void irq_remove_timings(struct irq_desc *desc) {}
diff --git a/kernel/irq/irqdesc.c b/kernel/irq/irqdesc.c
index c52b737ab8e3..9484e88dabc2 100644
--- a/kernel/irq/irqdesc.c
+++ b/kernel/irq/irqdesc.c
@@ -680,6 +680,8 @@ int __handle_domain_irq(struct irq_domain *domain, unsigned int hwirq,
  * @hwirq:      The HW irq number to convert to a logical one
  * @regs:       Register file coming from the low-level handling code
  *
+ *              This function must be called from an NMI context.
+ *
  * Returns:     0 on success, or -EINVAL if conversion has failed
  */
 int handle_domain_nmi(struct irq_domain *domain, unsigned int hwirq,
@@ -689,7 +691,10 @@ int handle_domain_nmi(struct irq_domain *domain, unsigned int hwirq,
         unsigned int irq;
         int ret = 0;
 
-        nmi_enter();
+        /*
+         * NMI context needs to be setup earlier in order to deal with tracing.
+         */
+        WARN_ON(!in_nmi());
 
         irq = irq_find_mapping(domain, hwirq);
 
@@ -702,7 +707,6 @@ int handle_domain_nmi(struct irq_domain *domain, unsigned int hwirq,
         else
                 ret = -EINVAL;
 
-        nmi_exit();
         set_irq_regs(old_regs);
         return ret;
 }
@@ -946,6 +950,11 @@ unsigned int kstat_irqs_cpu(unsigned int irq, int cpu)
                         *per_cpu_ptr(desc->kstat_irqs, cpu) : 0;
 }
 
+static bool irq_is_nmi(struct irq_desc *desc)
+{
+        return desc->istate & IRQS_NMI;
+}
+
 /**
  * kstat_irqs - Get the statistics for an interrupt
  * @irq:        The interrupt number
@@ -963,7 +972,8 @@ unsigned int kstat_irqs(unsigned int irq)
         if (!desc || !desc->kstat_irqs)
                 return 0;
         if (!irq_settings_is_per_cpu_devid(desc) &&
-            !irq_settings_is_per_cpu(desc))
+            !irq_settings_is_per_cpu(desc) &&
+            !irq_is_nmi(desc))
             return desc->tot_count;
 
         for_each_possible_cpu(cpu)
diff --git a/kernel/irq/irqdomain.c b/kernel/irq/irqdomain.c
index a453e229f99c..3078d0e48bba 100644
--- a/kernel/irq/irqdomain.c
+++ b/kernel/irq/irqdomain.c
@@ -123,7 +123,7 @@ EXPORT_SYMBOL_GPL(irq_domain_free_fwnode);
  * @ops: domain callbacks
  * @host_data: Controller private data pointer
  *
- * Allocates and initialize and irq_domain structure.
+ * Allocates and initializes an irq_domain structure.
  * Returns pointer to IRQ domain, or NULL on failure.
  */
 struct irq_domain *__irq_domain_add(struct fwnode_handle *fwnode, int size,
@@ -139,7 +139,7 @@ struct irq_domain *__irq_domain_add(struct fwnode_handle *fwnode, int size,
 
         domain = kzalloc_node(sizeof(*domain) + (sizeof(unsigned int) * size),
                               GFP_KERNEL, of_node_to_nid(of_node));
-        if (WARN_ON(!domain))
+        if (!domain)
                 return NULL;
 
         if (fwnode && is_fwnode_irqchip(fwnode)) {
diff --git a/kernel/irq/manage.c b/kernel/irq/manage.c
index 78f3ddeb7fe4..e8f7f179bf77 100644
--- a/kernel/irq/manage.c
+++ b/kernel/irq/manage.c
@@ -13,6 +13,7 @@
 #include <linux/module.h>
 #include <linux/random.h>
 #include <linux/interrupt.h>
+#include <linux/irqdomain.h>
 #include <linux/slab.h>
 #include <linux/sched.h>
 #include <linux/sched/rt.h>
@@ -34,8 +35,9 @@ static int __init setup_forced_irqthreads(char *arg)
 early_param("threadirqs", setup_forced_irqthreads);
 #endif
 
-static void __synchronize_hardirq(struct irq_desc *desc)
+static void __synchronize_hardirq(struct irq_desc *desc, bool sync_chip)
 {
+        struct irq_data *irqd = irq_desc_get_irq_data(desc);
         bool inprogress;
 
         do {
@@ -51,6 +53,20 @@ static void __synchronize_hardirq(struct irq_desc *desc)
                 /* Ok, that indicated we're done: double-check carefully. */
                 raw_spin_lock_irqsave(&desc->lock, flags);
                 inprogress = irqd_irq_inprogress(&desc->irq_data);
+
+                /*
+                 * If requested and supported, check at the chip whether it
+                 * is in flight at the hardware level, i.e. already pending
+                 * in a CPU and waiting for service and acknowledge.
+                 */
+                if (!inprogress && sync_chip) {
+                        /*
+                         * Ignore the return code. inprogress is only updated
+                         * when the chip supports it.
+                         */
+                        __irq_get_irqchip_state(irqd, IRQCHIP_STATE_ACTIVE,
+                                                &inprogress);
+                }
                 raw_spin_unlock_irqrestore(&desc->lock, flags);
 
                 /* Oops, that failed? */
@@ -73,13 +89,18 @@ static void __synchronize_hardirq(struct irq_desc *desc)
  *      Returns: false if a threaded handler is active.
  *
  *      This function may be called - with care - from IRQ context.
+ *
+ *      It does not check whether there is an interrupt in flight at the
+ *      hardware level, but not serviced yet, as this might deadlock when
+ *      called with interrupts disabled and the target CPU of the interrupt
+ *      is the current CPU.
  */
 bool synchronize_hardirq(unsigned int irq)
 {
         struct irq_desc *desc = irq_to_desc(irq);
 
         if (desc) {
-                __synchronize_hardirq(desc);
+                __synchronize_hardirq(desc, false);
                 return !atomic_read(&desc->threads_active);
         }
 
@@ -95,14 +116,19 @@ EXPORT_SYMBOL(synchronize_hardirq);
  *      to complete before returning. If you use this function while
  *      holding a resource the IRQ handler may need you will deadlock.
  *
- *      This function may be called - with care - from IRQ context.
+ *      Can only be called from preemptible code as it might sleep when
+ *      an interrupt thread is associated to @irq.
+ *
+ *      It optionally makes sure (when the irq chip supports that method)
+ *      that the interrupt is not pending in any CPU and waiting for
+ *      service.
  */
 void synchronize_irq(unsigned int irq)
 {
         struct irq_desc *desc = irq_to_desc(irq);
 
         if (desc) {
-                __synchronize_hardirq(desc);
+                __synchronize_hardirq(desc, true);
                 /*
                  * We made sure that no hardirq handler is
                  * running. Now verify that no threaded handlers are
@@ -1699,6 +1725,7 @@ static struct irqaction *__free_irq(struct irq_desc *desc, void *dev_id)
         /* If this was the last handler, shut down the IRQ line: */
         if (!desc->action) {
                 irq_settings_clr_disable_unlazy(desc);
+                /* Only shutdown. Deactivate after synchronize_hardirq() */
                 irq_shutdown(desc);
         }
 
@@ -1727,8 +1754,12 @@ static struct irqaction *__free_irq(struct irq_desc *desc, void *dev_id)
 
         unregister_handler_proc(irq, action);
 
-        /* Make sure it's not being used on another CPU: */
-        synchronize_hardirq(irq);
+        /*
+         * Make sure it's not being used on another CPU and if the chip
+         * supports it also make sure that there is no (not yet serviced)
+         * interrupt in flight at the hardware level.
+         */
+        __synchronize_hardirq(desc, true);
 
 #ifdef CONFIG_DEBUG_SHIRQ
         /*
@@ -1768,6 +1799,14 @@ static struct irqaction *__free_irq(struct irq_desc *desc, void *dev_id)
                  * require it to deallocate resources over the slow bus.
                  */
                 chip_bus_lock(desc);
+                /*
+                 * There is no interrupt on the fly anymore. Deactivate it
+                 * completely.
+                 */
+                raw_spin_lock_irqsave(&desc->lock, flags);
+                irq_domain_deactivate_irq(&desc->irq_data);
+                raw_spin_unlock_irqrestore(&desc->lock, flags);
+
                 irq_release_resources(desc);
                 chip_bus_sync_unlock(desc);
                 irq_remove_timings(desc);
@@ -1855,7 +1894,7 @@ static const void *__cleanup_nmi(unsigned int irq, struct irq_desc *desc)
         }
 
         irq_settings_clr_disable_unlazy(desc);
-        irq_shutdown(desc);
+        irq_shutdown_and_deactivate(desc);
 
         irq_release_resources(desc);
 
@@ -2578,6 +2617,28 @@ out:
         irq_put_desc_unlock(desc, flags);
 }
 
+int __irq_get_irqchip_state(struct irq_data *data, enum irqchip_irq_state which,
+                            bool *state)
+{
+        struct irq_chip *chip;
+        int err = -EINVAL;
+
+        do {
+                chip = irq_data_get_irq_chip(data);
+                if (chip->irq_get_irqchip_state)
+                        break;
+#ifdef CONFIG_IRQ_DOMAIN_HIERARCHY
+                data = data->parent_data;
+#else
+                data = NULL;
+#endif
+        } while (data);
+
+        if (data)
+                err = chip->irq_get_irqchip_state(data, which, state);
+        return err;
+}
+
 /**
  *      irq_get_irqchip_state - returns the irqchip state of a interrupt.
  *      @irq: Interrupt line that is forwarded to a VM
@@ -2596,7 +2657,6 @@ int irq_get_irqchip_state(unsigned int irq, enum irqchip_irq_state which,
 {
         struct irq_desc *desc;
         struct irq_data *data;
-        struct irq_chip *chip;
         unsigned long flags;
         int err = -EINVAL;
 
@@ -2606,19 +2666,7 @@ int irq_get_irqchip_state(unsigned int irq, enum irqchip_irq_state which,
 
         data = irq_desc_get_irq_data(desc);
 
-        do {
-                chip = irq_data_get_irq_chip(data);
-                if (chip->irq_get_irqchip_state)
-                        break;
-#ifdef CONFIG_IRQ_DOMAIN_HIERARCHY
-                data = data->parent_data;
-#else
-                data = NULL;
-#endif
-        } while (data);
-
-        if (data)
-                err = chip->irq_get_irqchip_state(data, which, state);
+        err = __irq_get_irqchip_state(data, which, state);
 
         irq_put_desc_busunlock(desc, flags);
         return err;
diff --git a/kernel/irq/timings.c b/kernel/irq/timings.c
index 90c735da15d0..e960d7ce7bcc 100644
--- a/kernel/irq/timings.c
+++ b/kernel/irq/timings.c
@@ -1,10 +1,12 @@
 // SPDX-License-Identifier: GPL-2.0
 // Copyright (C) 2016, Linaro Ltd - Daniel Lezcano <daniel.lezcano@linaro.org>
+#define pr_fmt(fmt) "irq_timings: " fmt
 
 #include <linux/kernel.h>
 #include <linux/percpu.h>
 #include <linux/slab.h>
 #include <linux/static_key.h>
+#include <linux/init.h>
 #include <linux/interrupt.h>
 #include <linux/idr.h>
 #include <linux/irq.h>
@@ -261,12 +263,29 @@ void irq_timings_disable(void)
 #define EMA_ALPHA_VAL           64
 #define EMA_ALPHA_SHIFT         7
 
-#define PREDICTION_PERIOD_MIN   2
+#define PREDICTION_PERIOD_MIN   3
 #define PREDICTION_PERIOD_MAX   5
 #define PREDICTION_FACTOR       4
 #define PREDICTION_MAX          10 /* 2 ^ PREDICTION_MAX useconds */
 #define PREDICTION_BUFFER_SIZE  16 /* slots for EMAs, hardly more than 16 */
 
+/*
+ * Number of elements in the circular buffer: If it happens it was
+ * flushed before, then the number of elements could be smaller than
+ * IRQ_TIMINGS_SIZE, so the count is used, otherwise the array size is
+ * used as we wrapped. The index begins from zero when we did not
+ * wrap. That could be done in a nicer way with the proper circular
+ * array structure type but with the cost of extra computation in the
+ * interrupt handler hot path. We choose efficiency.
+ */
+#define for_each_irqts(i, irqts)                                        \
+        for (i = irqts->count < IRQ_TIMINGS_SIZE ?                      \
+                     0 : irqts->count & IRQ_TIMINGS_MASK,               \
+                     irqts->count = min(IRQ_TIMINGS_SIZE,               \
+                                        irqts->count);                  \
+             irqts->count > 0; irqts->count--,                          \
+                     i = (i + 1) & IRQ_TIMINGS_MASK)
+
 struct irqt_stat {
         u64     last_ts;
         u64     ema_time[PREDICTION_BUFFER_SIZE];
@@ -297,7 +316,16 @@ static u64 irq_timings_ema_new(u64 value, u64 ema_old)
 
 static int irq_timings_next_event_index(int *buffer, size_t len, int period_max)
 {
-        int i;
+        int period;
+
+        /*
+         * Move the beginning pointer to the end minus the max period x 3.
+         * We are at the point we can begin searching the pattern
+         */
+        buffer = &buffer[len - (period_max * 3)];
+
+        /* Adjust the length to the maximum allowed period x 3 */
+        len = period_max * 3;
 
         /*
          * The buffer contains the suite of intervals, in a ilog2
@@ -306,21 +334,45 @@ static int irq_timings_next_event_index(int *buffer, size_t len, int period_max)
          * period beginning at the end of the buffer. We do that for
          * each suffix.
          */
-        for (i = period_max; i >= PREDICTION_PERIOD_MIN ; i--) {
+        for (period = period_max; period >= PREDICTION_PERIOD_MIN; period--) {
 
-                int *begin = &buffer[len - (i * 3)];
-                int *ptr = begin;
+                /*
+                 * The first comparison always succeed because the
+                 * suffix is deduced from the first n-period bytes of
+                 * the buffer and we compare the initial suffix with
+                 * itself, so we can skip the first iteration.
+                 */
+                int idx = period;
+                size_t size = period;
 
                 /*
                  * We look if the suite with period 'i' repeat
                  * itself. If it is truncated at the end, as it
                  * repeats we can use the period to find out the next
-                 * element.
+                 * element with the modulo.
                  */
-                while (!memcmp(ptr, begin, i * sizeof(*ptr))) {
-                        ptr += i;
-                        if (ptr >= &buffer[len])
-                                return begin[((i * 3) % i)];
+                while (!memcmp(buffer, &buffer[idx], size * sizeof(int))) {
+
+                        /*
+                         * Move the index in a period basis
+                         */
+                        idx += size;
+
+                        /*
+                         * If this condition is reached, all previous
+                         * memcmp were successful, so the period is
+                         * found.
+                         */
+                        if (idx == len)
+                                return buffer[len % period];
+
+                        /*
+                         * If the remaining elements to compare are
+                         * smaller than the period, readjust the size
+                         * of the comparison for the last iteration.
+                         */
+                        if (len - idx < period)
+                                size = len - idx;
                 }
         }
 
@@ -380,11 +432,43 @@ static u64 __irq_timings_next_event(struct irqt_stat *irqs, int irq, u64 now)
         return irqs->last_ts + irqs->ema_time[index];
 }
 
+static __always_inline int irq_timings_interval_index(u64 interval)
+{
+        /*
+         * The PREDICTION_FACTOR increase the interval size for the
+         * array of exponential average.
+         */
+        u64 interval_us = (interval >> 10) / PREDICTION_FACTOR;
+
+        return likely(interval_us) ? ilog2(interval_us) : 0;
+}
+
+static __always_inline void __irq_timings_store(int irq, struct irqt_stat *irqs,
+                                                u64 interval)
+{
+        int index;
+
+        /*
+         * Get the index in the ema table for this interrupt.
+         */
+        index = irq_timings_interval_index(interval);
+
+        /*
+         * Store the index as an element of the pattern in another
+         * circular array.
+         */
+        irqs->circ_timings[irqs->count & IRQ_TIMINGS_MASK] = index;
+
+        irqs->ema_time[index] = irq_timings_ema_new(interval,
+                                                    irqs->ema_time[index]);
+
+        irqs->count++;
+}
+
 static inline void irq_timings_store(int irq, struct irqt_stat *irqs, u64 ts)
 {
         u64 old_ts = irqs->last_ts;
         u64 interval;
-        int index;
 
         /*
          * The timestamps are absolute time values, we need to compute
@@ -415,24 +499,7 @@ static inline void irq_timings_store(int irq, struct irqt_stat *irqs, u64 ts)
                 return;
         }
 
-        /*
-         * Get the index in the ema table for this interrupt. The
-         * PREDICTION_FACTOR increase the interval size for the array
-         * of exponential average.
-         */
-        index = likely(interval) ?
-                ilog2((interval >> 10) / PREDICTION_FACTOR) : 0;
-
-        /*
-         * Store the index as an element of the pattern in another
-         * circular array.
-         */
-        irqs->circ_timings[irqs->count & IRQ_TIMINGS_MASK] = index;
-
-        irqs->ema_time[index] = irq_timings_ema_new(interval,
-                                                    irqs->ema_time[index]);
-
-        irqs->count++;
+        __irq_timings_store(irq, irqs, interval);
 }
 
 /**
@@ -493,11 +560,7 @@ u64 irq_timings_next_event(u64 now)
          * model while decrementing the counter because we consume the
          * data from our circular buffer.
          */
-
-        i = (irqts->count & IRQ_TIMINGS_MASK) - 1;
-        irqts->count = min(IRQ_TIMINGS_SIZE, irqts->count);
-
-        for (; irqts->count > 0; irqts->count--, i = (i + 1) & IRQ_TIMINGS_MASK) {
+        for_each_irqts(i, irqts) {
                 irq = irq_timing_decode(irqts->values[i], &ts);
                 s = idr_find(&irqt_stats, irq);
                 if (s)
@@ -564,3 +627,325 @@ int irq_timings_alloc(int irq)
 
         return 0;
 }
+
+#ifdef CONFIG_TEST_IRQ_TIMINGS
+struct timings_intervals {
+        u64 *intervals;
+        size_t count;
+};
+
+/*
+ * Intervals are given in nanosecond base
+ */
+static u64 intervals0[] __initdata = {
+        10000, 50000, 200000, 500000,
+        10000, 50000, 200000, 500000,
+        10000, 50000, 200000, 500000,
+        10000, 50000, 200000, 500000,
+        10000, 50000, 200000, 500000,
+        10000, 50000, 200000, 500000,
+        10000, 50000, 200000, 500000,
+        10000, 50000, 200000, 500000,
+        10000, 50000, 200000,
+};
+
+static u64 intervals1[] __initdata = {
+        223947000, 1240000, 1384000, 1386000, 1386000,
+        217416000, 1236000, 1384000, 1386000, 1387000,
+        214719000, 1241000, 1386000, 1387000, 1384000,
+        213696000, 1234000, 1384000, 1386000, 1388000,
+        219904000, 1240000, 1385000, 1389000, 1385000,
+        212240000, 1240000, 1386000, 1386000, 1386000,
+        214415000, 1236000, 1384000, 1386000, 1387000,
+        214276000, 1234000,
+};
+
+static u64 intervals2[] __initdata = {
+        4000, 3000, 5000, 100000,
+        3000, 3000, 5000, 117000,
+        4000, 4000, 5000, 112000,
+        4000, 3000, 4000, 110000,
+        3000, 5000, 3000, 117000,
+        4000, 4000, 5000, 112000,
+        4000, 3000, 4000, 110000,
+        3000, 4000, 5000, 112000,
+        4000,
+};
+
+static u64 intervals3[] __initdata = {
+        1385000, 212240000, 1240000,
+        1386000, 214415000, 1236000,
+        1384000, 214276000, 1234000,
+        1386000, 214415000, 1236000,
+        1385000, 212240000, 1240000,
+        1386000, 214415000, 1236000,
+        1384000, 214276000, 1234000,
+        1386000, 214415000, 1236000,
+        1385000, 212240000, 1240000,
+};
+
+static u64 intervals4[] __initdata = {
+        10000, 50000, 10000, 50000,
+        10000, 50000, 10000, 50000,
+        10000, 50000, 10000, 50000,
+        10000, 50000, 10000, 50000,
+        10000, 50000, 10000, 50000,
+        10000, 50000, 10000, 50000,
+        10000, 50000, 10000, 50000,
+        10000, 50000, 10000, 50000,
+        10000,
+};
+
+static struct timings_intervals tis[] __initdata = {
+        { intervals0, ARRAY_SIZE(intervals0) },
+        { intervals1, ARRAY_SIZE(intervals1) },
+        { intervals2, ARRAY_SIZE(intervals2) },
+        { intervals3, ARRAY_SIZE(intervals3) },
+        { intervals4, ARRAY_SIZE(intervals4) },
+};
+
+static int __init irq_timings_test_next_index(struct timings_intervals *ti)
+{
+        int _buffer[IRQ_TIMINGS_SIZE];
+        int buffer[IRQ_TIMINGS_SIZE];
+        int index, start, i, count, period_max;
+
+        count = ti->count - 1;
+
+        period_max = count > (3 * PREDICTION_PERIOD_MAX) ?
+                PREDICTION_PERIOD_MAX : count / 3;
+
+        /*
+         * Inject all values except the last one which will be used
+         * to compare with the next index result.
+         */
+        pr_debug("index suite: ");
+
+        for (i = 0; i < count; i++) {
+                index = irq_timings_interval_index(ti->intervals[i]);
+                _buffer[i & IRQ_TIMINGS_MASK] = index;
+                pr_cont("%d ", index);
+        }
+
+        start = count < IRQ_TIMINGS_SIZE ? 0 :
+                count & IRQ_TIMINGS_MASK;
+
+        count = min_t(int, count, IRQ_TIMINGS_SIZE);
+
+        for (i = 0; i < count; i++) {
+                int index = (start + i) & IRQ_TIMINGS_MASK;
+                buffer[i] = _buffer[index];
+        }
+
+        index = irq_timings_next_event_index(buffer, count, period_max);
+        i = irq_timings_interval_index(ti->intervals[ti->count - 1]);
+
+        if (index != i) {
+                pr_err("Expected (%d) and computed (%d) next indexes differ\n",
+                       i, index);
+                return -EINVAL;
+        }
+
+        return 0;
+}
+
+static int __init irq_timings_next_index_selftest(void)
+{
+        int i, ret;
+
+        for (i = 0; i < ARRAY_SIZE(tis); i++) {
+
+                pr_info("---> Injecting intervals number #%d (count=%zd)\n",
+                        i, tis[i].count);
+
+                ret = irq_timings_test_next_index(&tis[i]);
+                if (ret)
+                        break;
+        }
+
+        return ret;
+}
+
+static int __init irq_timings_test_irqs(struct timings_intervals *ti)
+{
+        struct irqt_stat __percpu *s;
+        struct irqt_stat *irqs;
+        int i, index, ret, irq = 0xACE5;
+
+        ret = irq_timings_alloc(irq);
+        if (ret) {
+                pr_err("Failed to allocate irq timings\n");
+                return ret;
+        }
+
+        s = idr_find(&irqt_stats, irq);
+        if (!s) {
+                ret = -EIDRM;
+                goto out;
+        }
+
+        irqs = this_cpu_ptr(s);
+
+        for (i = 0; i < ti->count; i++) {
+
+                index = irq_timings_interval_index(ti->intervals[i]);
+                pr_debug("%d: interval=%llu ema_index=%d\n",
+                         i, ti->intervals[i], index);
+
+                __irq_timings_store(irq, irqs, ti->intervals[i]);
+                if (irqs->circ_timings[i & IRQ_TIMINGS_MASK] != index) {
+                        pr_err("Failed to store in the circular buffer\n");
+                        goto out;
+                }
+        }
+
+        if (irqs->count != ti->count) {
+                pr_err("Count differs\n");
+                goto out;
+        }
+
+        ret = 0;
+out:
+        irq_timings_free(irq);
+
+        return ret;
+}
+
+static int __init irq_timings_irqs_selftest(void)
+{
+        int i, ret;
+
+        for (i = 0; i < ARRAY_SIZE(tis); i++) {
+                pr_info("---> Injecting intervals number #%d (count=%zd)\n",
+                        i, tis[i].count);
+                ret = irq_timings_test_irqs(&tis[i]);
+                if (ret)
+                        break;
+        }
+
+        return ret;
+}
+
+static int __init irq_timings_test_irqts(struct irq_timings *irqts,
+                                         unsigned count)
+{
+        int start = count >= IRQ_TIMINGS_SIZE ? count - IRQ_TIMINGS_SIZE : 0;
+        int i, irq, oirq = 0xBEEF;
+        u64 ots = 0xDEAD, ts;
+
+        /*
+         * Fill the circular buffer by using the dedicated function.
+         */
+        for (i = 0; i < count; i++) {
+                pr_debug("%d: index=%d, ts=%llX irq=%X\n",
+                         i, i & IRQ_TIMINGS_MASK, ots + i, oirq + i);
+
+                irq_timings_push(ots + i, oirq + i);
+        }
+
+        /*
+         * Compute the first elements values after the index wrapped
+         * up or not.
+         */
+        ots += start;
+        oirq += start;
+
+        /*
+         * Test the circular buffer count is correct.
+         */
+        pr_debug("---> Checking timings array count (%d) is right\n", count);
+        if (WARN_ON(irqts->count != count))
+                return -EINVAL;
+
+        /*
+         * Test the macro allowing to browse all the irqts.
+         */
+        pr_debug("---> Checking the for_each_irqts() macro\n");
+        for_each_irqts(i, irqts) {
+
+                irq = irq_timing_decode(irqts->values[i], &ts);
+
+                pr_debug("index=%d, ts=%llX / %llX, irq=%X / %X\n",
+                         i, ts, ots, irq, oirq);
+
+                if (WARN_ON(ts != ots || irq != oirq))
+                        return -EINVAL;
+
+                ots++; oirq++;
+        }
+
+        /*
+         * The circular buffer should have be flushed when browsed
+         * with for_each_irqts
+         */
+        pr_debug("---> Checking timings array is empty after browsing it\n");
+        if (WARN_ON(irqts->count))
+                return -EINVAL;
+
+        return 0;
+}
+
+static int __init irq_timings_irqts_selftest(void)
+{
+        struct irq_timings *irqts = this_cpu_ptr(&irq_timings);
+        int i, ret;
+
+        /*
+         * Test the circular buffer with different number of
+         * elements. The purpose is to test at the limits (empty, half
+         * full, full, wrapped with the cursor at the boundaries,
+         * wrapped several times, etc ...
+         */
+        int count[] = { 0,
+                        IRQ_TIMINGS_SIZE >> 1,
+                        IRQ_TIMINGS_SIZE,
+                        IRQ_TIMINGS_SIZE + (IRQ_TIMINGS_SIZE >> 1),
+                        2 * IRQ_TIMINGS_SIZE,
+                        (2 * IRQ_TIMINGS_SIZE) + 3,
+        };
+
+        for (i = 0; i < ARRAY_SIZE(count); i++) {
+
+                pr_info("---> Checking the timings with %d/%d values\n",
+                        count[i], IRQ_TIMINGS_SIZE);
+
+                ret = irq_timings_test_irqts(irqts, count[i]);
+                if (ret)
+                        break;
+        }
+
+        return ret;
+}
+
+static int __init irq_timings_selftest(void)
+{
+        int ret;
+
+        pr_info("------------------- selftest start -----------------\n");
+
+        /*
+         * At this point, we don't except any subsystem to use the irq
+         * timings but us, so it should not be enabled.
+         */
+        if (static_branch_unlikely(&irq_timing_enabled)) {
+                pr_warn("irq timings already initialized, skipping selftest\n");
+                return 0;
+        }
+
+        ret = irq_timings_irqts_selftest();
+        if (ret)
+                goto out;
+
+        ret = irq_timings_irqs_selftest();
+        if (ret)
+                goto out;
+
+        ret = irq_timings_next_index_selftest();
+out:
+        pr_info("---------- selftest end with %s -----------\n",
+                ret ? "failure" : "success");
+
+        return ret;
+}
+early_initcall(irq_timings_selftest);
+#endif
diff --git a/kernel/jump_label.c b/kernel/jump_label.c
index 0bfa10f4410c..df3008419a1d 100644
--- a/kernel/jump_label.c
+++ b/kernel/jump_label.c
@@ -37,12 +37,26 @@ static int jump_label_cmp(const void *a, const void *b)
         const struct jump_entry *jea = a;
         const struct jump_entry *jeb = b;
 
+        /*
+         * Entrires are sorted by key.
+         */
         if (jump_entry_key(jea) < jump_entry_key(jeb))
                 return -1;
 
         if (jump_entry_key(jea) > jump_entry_key(jeb))
                 return 1;
 
+        /*
+         * In the batching mode, entries should also be sorted by the code
+         * inside the already sorted list of entries, enabling a bsearch in
+         * the vector.
+         */
+        if (jump_entry_code(jea) < jump_entry_code(jeb))
+                return -1;
+
+        if (jump_entry_code(jea) > jump_entry_code(jeb))
+                return 1;
+
         return 0;
 }
 
@@ -384,25 +398,55 @@ static enum jump_label_type jump_label_type(struct jump_entry *entry)
         return enabled ^ branch;
 }
 
+static bool jump_label_can_update(struct jump_entry *entry, bool init)
+{
+        /*
+         * Cannot update code that was in an init text area.
+         */
+        if (!init && jump_entry_is_init(entry))
+                return false;
+
+        if (!kernel_text_address(jump_entry_code(entry))) {
+                WARN_ONCE(1, "can't patch jump_label at %pS", (void *)jump_entry_code(entry));
+                return false;
+        }
+
+        return true;
+}
+
+#ifndef HAVE_JUMP_LABEL_BATCH
 static void __jump_label_update(struct static_key *key,
                                 struct jump_entry *entry,
                                 struct jump_entry *stop,
                                 bool init)
 {
         for (; (entry < stop) && (jump_entry_key(entry) == key); entry++) {
-                /*
-                 * An entry->code of 0 indicates an entry which has been
-                 * disabled because it was in an init text area.
-                 */
-                if (init || !jump_entry_is_init(entry)) {
-                        if (kernel_text_address(jump_entry_code(entry)))
-                                arch_jump_label_transform(entry, jump_label_type(entry));
-                        else
-                                WARN_ONCE(1, "can't patch jump_label at %pS",
-                                          (void *)jump_entry_code(entry));
+                if (jump_label_can_update(entry, init))
+                        arch_jump_label_transform(entry, jump_label_type(entry));
+        }
+}
+#else
+static void __jump_label_update(struct static_key *key,
+                                struct jump_entry *entry,
+                                struct jump_entry *stop,
+                                bool init)
+{
+        for (; (entry < stop) && (jump_entry_key(entry) == key); entry++) {
+
+                if (!jump_label_can_update(entry, init))
+                        continue;
+
+                if (!arch_jump_label_transform_queue(entry, jump_label_type(entry))) {
+                        /*
+                         * Queue is full: Apply the current queue and try again.
+                         */
+                        arch_jump_label_transform_apply();
+                        BUG_ON(!arch_jump_label_transform_queue(entry, jump_label_type(entry)));
                 }
         }
+        arch_jump_label_transform_apply();
 }
+#endif
 
 void __init jump_label_init(void)
 {
diff --git a/kernel/locking/Makefile b/kernel/locking/Makefile
index 6fe2f333aecb..45452facff3b 100644
--- a/kernel/locking/Makefile
+++ b/kernel/locking/Makefile
@@ -3,7 +3,7 @@
 # and is generally not a function of system call inputs.
 KCOV_INSTRUMENT         := n
 
-obj-y += mutex.o semaphore.o rwsem.o percpu-rwsem.o rwsem-xadd.o
+obj-y += mutex.o semaphore.o rwsem.o percpu-rwsem.o
 
 ifdef CONFIG_FUNCTION_TRACER
 CFLAGS_REMOVE_lockdep.o = $(CC_FLAGS_FTRACE)
diff --git a/kernel/locking/lock_events.h b/kernel/locking/lock_events.h
index 46b71af8eef2..8c7e7d25f09c 100644
--- a/kernel/locking/lock_events.h
+++ b/kernel/locking/lock_events.h
@@ -31,50 +31,13 @@ enum lock_events {
 DECLARE_PER_CPU(unsigned long, lockevents[lockevent_num]);
 
 /*
- * The purpose of the lock event counting subsystem is to provide a low
- * overhead way to record the number of specific locking events by using
- * percpu counters. It is the percpu sum that matters, not specifically
- * how many of them happens in each cpu.
- *
- * It is possible that the same percpu counter may be modified in both
- * the process and interrupt contexts. For architectures that perform
- * percpu operation with multiple instructions, it is possible to lose
- * count if a process context percpu update is interrupted in the middle
- * and the same counter is updated in the interrupt context. Therefore,
- * the generated percpu sum may not be precise. The error, if any, should
- * be small and insignificant.
- *
- * For those architectures that do multi-instruction percpu operation,
- * preemption in the middle and moving the task to another cpu may cause
- * a larger error in the count. Again, this will be few and far between.
- * Given the imprecise nature of the count and the possibility of resetting
- * the count and doing the measurement again, this is not really a big
- * problem.
- *
- * To get a better picture of what is happening under the hood, it is
- * suggested that a few measurements should be taken with the counts
- * reset in between to stamp out outliner because of these possible
- * error conditions.
- *
- * To minimize overhead, we use __this_cpu_*() in all cases except when
- * CONFIG_DEBUG_PREEMPT is defined. In this particular case, this_cpu_*()
- * will be used to avoid the appearance of unwanted BUG messages.
- */
-#ifdef CONFIG_DEBUG_PREEMPT
-#define lockevent_percpu_inc(x)         this_cpu_inc(x)
-#define lockevent_percpu_add(x, v)      this_cpu_add(x, v)
-#else
-#define lockevent_percpu_inc(x)         __this_cpu_inc(x)
-#define lockevent_percpu_add(x, v)      __this_cpu_add(x, v)
-#endif
-
-/*
- * Increment the PV qspinlock statistical counters
+ * Increment the statistical counters. use raw_cpu_inc() because of lower
+ * overhead and we don't care if we loose the occasional update.
  */
 static inline void __lockevent_inc(enum lock_events event, bool cond)
 {
         if (cond)
-                lockevent_percpu_inc(lockevents[event]);
+                raw_cpu_inc(lockevents[event]);
 }
 
 #define lockevent_inc(ev)         __lockevent_inc(LOCKEVENT_ ##ev, true)
@@ -82,7 +45,7 @@ static inline void __lockevent_inc(enum lock_events event, bool cond)
 
 static inline void __lockevent_add(enum lock_events event, int inc)
 {
-        lockevent_percpu_add(lockevents[event], inc);
+        raw_cpu_add(lockevents[event], inc);
 }
 
 #define lockevent_add(ev, c)    __lockevent_add(LOCKEVENT_ ##ev, c)
diff --git a/kernel/locking/lock_events_list.h b/kernel/locking/lock_events_list.h
index ad7668cfc9da..239039d0ce21 100644
--- a/kernel/locking/lock_events_list.h
+++ b/kernel/locking/lock_events_list.h
@@ -56,12 +56,16 @@ LOCK_EVENT(rwsem_sleep_reader)	/* # of reader sleeps			*/
 LOCK_EVENT(rwsem_sleep_writer)  /* # of writer sleeps                   */
 LOCK_EVENT(rwsem_wake_reader)   /* # of reader wakeups                  */
 LOCK_EVENT(rwsem_wake_writer)   /* # of writer wakeups                  */
-LOCK_EVENT(rwsem_opt_wlock)     /* # of write locks opt-spin acquired   */
-LOCK_EVENT(rwsem_opt_fail)      /* # of failed opt-spinnings            */
+LOCK_EVENT(rwsem_opt_rlock)     /* # of opt-acquired read locks         */
+LOCK_EVENT(rwsem_opt_wlock)     /* # of opt-acquired write locks        */
+LOCK_EVENT(rwsem_opt_fail)      /* # of failed optspins                 */
+LOCK_EVENT(rwsem_opt_nospin)    /* # of disabled optspins               */
+LOCK_EVENT(rwsem_opt_norspin)   /* # of disabled reader-only optspins   */
+LOCK_EVENT(rwsem_opt_rlock2)    /* # of opt-acquired 2ndary read locks  */
 LOCK_EVENT(rwsem_rlock)         /* # of read locks acquired             */
 LOCK_EVENT(rwsem_rlock_fast)    /* # of fast read locks acquired        */
 LOCK_EVENT(rwsem_rlock_fail)    /* # of failed read lock acquisitions   */
-LOCK_EVENT(rwsem_rtrylock)      /* # of read trylock calls              */
+LOCK_EVENT(rwsem_rlock_handoff) /* # of read lock handoffs              */
 LOCK_EVENT(rwsem_wlock)         /* # of write locks acquired            */
 LOCK_EVENT(rwsem_wlock_fail)    /* # of failed write lock acquisitions  */
-LOCK_EVENT(rwsem_wtrylock)      /* # of write trylock calls             */
+LOCK_EVENT(rwsem_wlock_handoff) /* # of write lock handoffs             */
diff --git a/kernel/locking/lockdep.c b/kernel/locking/lockdep.c
index c47788fa85f9..341f52117f88 100644
--- a/kernel/locking/lockdep.c
+++ b/kernel/locking/lockdep.c
@@ -151,17 +151,28 @@ unsigned long nr_lock_classes;
 static
 #endif
 struct lock_class lock_classes[MAX_LOCKDEP_KEYS];
+static DECLARE_BITMAP(lock_classes_in_use, MAX_LOCKDEP_KEYS);
 
 static inline struct lock_class *hlock_class(struct held_lock *hlock)
 {
-        if (!hlock->class_idx) {
+        unsigned int class_idx = hlock->class_idx;
+
+        /* Don't re-read hlock->class_idx, can't use READ_ONCE() on bitfield */
+        barrier();
+
+        if (!test_bit(class_idx, lock_classes_in_use)) {
                 /*
                  * Someone passed in garbage, we give up.
                  */
                 DEBUG_LOCKS_WARN_ON(1);
                 return NULL;
         }
-        return lock_classes + hlock->class_idx - 1;
+
+        /*
+         * At this point, if the passed hlock->class_idx is still garbage,
+         * we just have to live with it
+         */
+        return lock_classes + class_idx;
 }
 
 #ifdef CONFIG_LOCK_STAT
@@ -359,6 +370,13 @@ static inline u64 iterate_chain_key(u64 key, u32 idx)
         return k0 | (u64)k1 << 32;
 }
 
+void lockdep_init_task(struct task_struct *task)
+{
+        task->lockdep_depth = 0; /* no locks held yet */
+        task->curr_chain_key = INITIAL_CHAIN_KEY;
+        task->lockdep_recursion = 0;
+}
+
 void lockdep_off(void)
 {
         current->lockdep_recursion++;
@@ -419,13 +437,6 @@ static int verbose(struct lock_class *class)
         return 0;
 }
 
-/*
- * Stack-trace: tightly packed array of stack backtrace
- * addresses. Protected by the graph_lock.
- */
-unsigned long nr_stack_trace_entries;
-static unsigned long stack_trace[MAX_STACK_TRACE_ENTRIES];
-
 static void print_lockdep_off(const char *bug_msg)
 {
         printk(KERN_DEBUG "%s\n", bug_msg);
@@ -435,6 +446,15 @@ static void print_lockdep_off(const char *bug_msg)
 #endif
 }
 
+unsigned long nr_stack_trace_entries;
+
+#if defined(CONFIG_TRACE_IRQFLAGS) && defined(CONFIG_PROVE_LOCKING)
+/*
+ * Stack-trace: tightly packed array of stack backtrace
+ * addresses. Protected by the graph_lock.
+ */
+static unsigned long stack_trace[MAX_STACK_TRACE_ENTRIES];
+
 static int save_trace(struct lock_trace *trace)
 {
         unsigned long *entries = stack_trace + nr_stack_trace_entries;
@@ -457,6 +477,7 @@ static int save_trace(struct lock_trace *trace)
 
         return 1;
 }
+#endif
 
 unsigned int nr_hardirq_chains;
 unsigned int nr_softirq_chains;
@@ -470,6 +491,7 @@ unsigned int max_lockdep_depth;
 DEFINE_PER_CPU(struct lockdep_stats, lockdep_stats);
 #endif
 
+#if defined(CONFIG_TRACE_IRQFLAGS) && defined(CONFIG_PROVE_LOCKING)
 /*
  * Locking printouts:
  */
@@ -487,6 +509,7 @@ static const char *usage_str[] =
 #undef LOCKDEP_STATE
         [LOCK_USED] = "INITIAL USE",
 };
+#endif
 
 const char * __get_key_name(struct lockdep_subclass_key *key, char *str)
 {
@@ -500,15 +523,26 @@ static inline unsigned long lock_flag(enum lock_usage_bit bit)
 
 static char get_usage_char(struct lock_class *class, enum lock_usage_bit bit)
 {
+        /*
+         * The usage character defaults to '.' (i.e., irqs disabled and not in
+         * irq context), which is the safest usage category.
+         */
         char c = '.';
 
-        if (class->usage_mask & lock_flag(bit + LOCK_USAGE_DIR_MASK))
+        /*
+         * The order of the following usage checks matters, which will
+         * result in the outcome character as follows:
+         *
+         * - '+': irq is enabled and not in irq context
+         * - '-': in irq context and irq is disabled
+         * - '?': in irq context and irq is enabled
+         */
+        if (class->usage_mask & lock_flag(bit + LOCK_USAGE_DIR_MASK)) {
                 c = '+';
-        if (class->usage_mask & lock_flag(bit)) {
-                c = '-';
-                if (class->usage_mask & lock_flag(bit + LOCK_USAGE_DIR_MASK))
+                if (class->usage_mask & lock_flag(bit))
                         c = '?';
-        }
+        } else if (class->usage_mask & lock_flag(bit))
+                c = '-';
 
         return c;
 }
@@ -572,19 +606,22 @@ static void print_lock(struct held_lock *hlock)
         /*
          * We can be called locklessly through debug_show_all_locks() so be
          * extra careful, the hlock might have been released and cleared.
+         *
+         * If this indeed happens, lets pretend it does not hurt to continue
+         * to print the lock unless the hlock class_idx does not point to a
+         * registered class. The rationale here is: since we don't attempt
+         * to distinguish whether we are in this situation, if it just
+         * happened we can't count on class_idx to tell either.
          */
-        unsigned int class_idx = hlock->class_idx;
-
-        /* Don't re-read hlock->class_idx, can't use READ_ONCE() on bitfields: */
-        barrier();
+        struct lock_class *lock = hlock_class(hlock);
 
-        if (!class_idx || (class_idx - 1) >= MAX_LOCKDEP_KEYS) {
+        if (!lock) {
                 printk(KERN_CONT "<RELEASED>\n");
                 return;
         }
 
         printk(KERN_CONT "%p", hlock->instance);
-        print_lock_name(lock_classes + class_idx - 1);
+        print_lock_name(lock);
         printk(KERN_CONT ", at: %pS\n", (void *)hlock->acquire_ip);
 }
 
@@ -732,7 +769,8 @@ look_up_lock_class(const struct lockdep_map *lock, unsigned int subclass)
                          * Huh! same key, different name? Did someone trample
                          * on some memory? We're most confused.
                          */
-                        WARN_ON_ONCE(class->name != lock->name);
+                        WARN_ON_ONCE(class->name != lock->name &&
+                                     lock->key != &__lockdep_no_validate__);
                         return class;
                 }
         }
@@ -838,11 +876,11 @@ static u16 chain_hlocks[MAX_LOCKDEP_CHAIN_HLOCKS];
 static bool check_lock_chain_key(struct lock_chain *chain)
 {
 #ifdef CONFIG_PROVE_LOCKING
-        u64 chain_key = 0;
+        u64 chain_key = INITIAL_CHAIN_KEY;
         int i;
 
         for (i = chain->base; i < chain->base + chain->depth; i++)
-                chain_key = iterate_chain_key(chain_key, chain_hlocks[i] + 1);
+                chain_key = iterate_chain_key(chain_key, chain_hlocks[i]);
         /*
          * The 'unsigned long long' casts avoid that a compiler warning
          * is reported when building tools/lib/lockdep.
@@ -1117,6 +1155,7 @@ register_lock_class(struct lockdep_map *lock, unsigned int subclass, int force)
                 return NULL;
         }
         nr_lock_classes++;
+        __set_bit(class - lock_classes, lock_classes_in_use);
         debug_atomic_inc(nr_unused_locks);
         class->key = key;
         class->name = lock->name;
@@ -1228,13 +1267,17 @@ static int add_lock_to_list(struct lock_class *this,
 #define CQ_MASK                         (MAX_CIRCULAR_QUEUE_SIZE-1)
 
 /*
- * The circular_queue and helpers is used to implement the
- * breadth-first search(BFS)algorithem, by which we can build
- * the shortest path from the next lock to be acquired to the
- * previous held lock if there is a circular between them.
+ * The circular_queue and helpers are used to implement graph
+ * breadth-first search (BFS) algorithm, by which we can determine
+ * whether there is a path from a lock to another. In deadlock checks,
+ * a path from the next lock to be acquired to a previous held lock
+ * indicates that adding the <prev> -> <next> lock dependency will
+ * produce a circle in the graph. Breadth-first search instead of
+ * depth-first search is used in order to find the shortest (circular)
+ * path.
  */
 struct circular_queue {
-        unsigned long element[MAX_CIRCULAR_QUEUE_SIZE];
+        struct lock_list *element[MAX_CIRCULAR_QUEUE_SIZE];
         unsigned int  front, rear;
 };
 
@@ -1260,7 +1303,7 @@ static inline int __cq_full(struct circular_queue *cq)
         return ((cq->rear + 1) & CQ_MASK) == cq->front;
 }
 
-static inline int __cq_enqueue(struct circular_queue *cq, unsigned long elem)
+static inline int __cq_enqueue(struct circular_queue *cq, struct lock_list *elem)
 {
         if (__cq_full(cq))
                 return -1;
@@ -1270,14 +1313,21 @@ static inline int __cq_enqueue(struct circular_queue *cq, unsigned long elem)
         return 0;
 }
 
-static inline int __cq_dequeue(struct circular_queue *cq, unsigned long *elem)
+/*
+ * Dequeue an element from the circular_queue, return a lock_list if
+ * the queue is not empty, or NULL if otherwise.
+ */
+static inline struct lock_list * __cq_dequeue(struct circular_queue *cq)
 {
+        struct lock_list * lock;
+
         if (__cq_empty(cq))
-                return -1;
+                return NULL;
 
-        *elem = cq->element[cq->front];
+        lock = cq->element[cq->front];
         cq->front = (cq->front + 1) & CQ_MASK;
-        return 0;
+
+        return lock;
 }
 
 static inline unsigned int  __cq_get_elem_count(struct circular_queue *cq)
@@ -1322,13 +1372,32 @@ static inline int get_lock_depth(struct lock_list *child)
         return depth;
 }
 
+/*
+ * Return the forward or backward dependency list.
+ *
+ * @lock:   the lock_list to get its class's dependency list
+ * @offset: the offset to struct lock_class to determine whether it is
+ *          locks_after or locks_before
+ */
+static inline struct list_head *get_dep_list(struct lock_list *lock, int offset)
+{
+        void *lock_class = lock->class;
+
+        return lock_class + offset;
+}
+
+/*
+ * Forward- or backward-dependency search, used for both circular dependency
+ * checking and hardirq-unsafe/softirq-unsafe checking.
+ */
 static int __bfs(struct lock_list *source_entry,
                  void *data,
                  int (*match)(struct lock_list *entry, void *data),
                  struct lock_list **target_entry,
-                 int forward)
+                 int offset)
 {
         struct lock_list *entry;
+        struct lock_list *lock;
         struct list_head *head;
         struct circular_queue *cq = &lock_cq;
         int ret = 1;
@@ -1339,31 +1408,21 @@ static int __bfs(struct lock_list *source_entry,
                 goto exit;
         }
 
-        if (forward)
-                head = &source_entry->class->locks_after;
-        else
-                head = &source_entry->class->locks_before;
-
+        head = get_dep_list(source_entry, offset);
         if (list_empty(head))
                 goto exit;
 
         __cq_init(cq);
-        __cq_enqueue(cq, (unsigned long)source_entry);
+        __cq_enqueue(cq, source_entry);
 
-        while (!__cq_empty(cq)) {
-                struct lock_list *lock;
-
-                __cq_dequeue(cq, (unsigned long *)&lock);
+        while ((lock = __cq_dequeue(cq))) {
 
                 if (!lock->class) {
                         ret = -2;
                         goto exit;
                 }
 
-                if (forward)
-                        head = &lock->class->locks_after;
-                else
-                        head = &lock->class->locks_before;
+                head = get_dep_list(lock, offset);
 
                 DEBUG_LOCKS_WARN_ON(!irqs_disabled());
 
@@ -1377,7 +1436,7 @@ static int __bfs(struct lock_list *source_entry,
                                         goto exit;
                                 }
 
-                                if (__cq_enqueue(cq, (unsigned long)entry)) {
+                                if (__cq_enqueue(cq, entry)) {
                                         ret = -1;
                                         goto exit;
                                 }
@@ -1396,7 +1455,8 @@ static inline int __bfs_forwards(struct lock_list *src_entry,
                         int (*match)(struct lock_list *entry, void *data),
                         struct lock_list **target_entry)
 {
-        return __bfs(src_entry, data, match, target_entry, 1);
+        return __bfs(src_entry, data, match, target_entry,
+                     offsetof(struct lock_class, locks_after));
 
 }
 
@@ -1405,16 +1465,11 @@ static inline int __bfs_backwards(struct lock_list *src_entry,
                         int (*match)(struct lock_list *entry, void *data),
                         struct lock_list **target_entry)
 {
-        return __bfs(src_entry, data, match, target_entry, 0);
+        return __bfs(src_entry, data, match, target_entry,
+                     offsetof(struct lock_class, locks_before));
 
 }
 
-/*
- * Recursive, forwards-direction lock-dependency checking, used for
- * both noncyclic checking and for hardirq-unsafe/softirq-unsafe
- * checking.
- */
-
 static void print_lock_trace(struct lock_trace *trace, unsigned int spaces)
 {
         unsigned long *entries = stack_trace + trace->offset;
@@ -1426,16 +1481,15 @@ static void print_lock_trace(struct lock_trace *trace, unsigned int spaces)
  * Print a dependency chain entry (this is only done when a deadlock
  * has been detected):
  */
-static noinline int
+static noinline void
 print_circular_bug_entry(struct lock_list *target, int depth)
 {
         if (debug_locks_silent)
-                return 0;
+                return;
         printk("\n-> #%u", depth);
         print_lock_name(target->class);
         printk(KERN_CONT ":\n");
         print_lock_trace(&target->trace, 6);
-        return 0;
 }
 
 static void
@@ -1492,7 +1546,7 @@ print_circular_lock_scenario(struct held_lock *src,
  * When a circular dependency is detected, print the
  * header first:
  */
-static noinline int
+static noinline void
 print_circular_bug_header(struct lock_list *entry, unsigned int depth,
                         struct held_lock *check_src,
                         struct held_lock *check_tgt)
@@ -1500,7 +1554,7 @@ print_circular_bug_header(struct lock_list *entry, unsigned int depth,
         struct task_struct *curr = current;
 
         if (debug_locks_silent)
-                return 0;
+                return;
 
         pr_warn("\n");
         pr_warn("======================================================\n");
@@ -1518,8 +1572,6 @@ print_circular_bug_header(struct lock_list *entry, unsigned int depth,
         pr_warn("\nthe existing dependency chain (in reverse order) is:\n");
 
         print_circular_bug_entry(entry, depth);
-
-        return 0;
 }
 
 static inline int class_equal(struct lock_list *entry, void *data)
@@ -1527,10 +1579,10 @@ static inline int class_equal(struct lock_list *entry, void *data)
         return entry->class == data;
 }
 
-static noinline int print_circular_bug(struct lock_list *this,
-                                       struct lock_list *target,
-                                       struct held_lock *check_src,
-                                       struct held_lock *check_tgt)
+static noinline void print_circular_bug(struct lock_list *this,
+                                        struct lock_list *target,
+                                        struct held_lock *check_src,
+                                        struct held_lock *check_tgt)
 {
         struct task_struct *curr = current;
         struct lock_list *parent;
@@ -1538,10 +1590,10 @@ static noinline int print_circular_bug(struct lock_list *this,
         int depth;
 
         if (!debug_locks_off_graph_unlock() || debug_locks_silent)
-                return 0;
+                return;
 
         if (!save_trace(&this->trace))
-                return 0;
+                return;
 
         depth = get_lock_depth(target);
 
@@ -1563,21 +1615,17 @@ static noinline int print_circular_bug(struct lock_list *this,
 
         printk("\nstack backtrace:\n");
         dump_stack();
-
-        return 0;
 }
 
-static noinline int print_bfs_bug(int ret)
+static noinline void print_bfs_bug(int ret)
 {
         if (!debug_locks_off_graph_unlock())
-                return 0;
+                return;
 
         /*
          * Breadth-first-search failed, graph got corrupted?
          */
         WARN(1, "lockdep bfs error:%d\n", ret);
-
-        return 0;
 }
 
 static int noop_count(struct lock_list *entry, void *data)
@@ -1640,36 +1688,95 @@ unsigned long lockdep_count_backward_deps(struct lock_class *class)
 }
 
 /*
- * Prove that the dependency graph starting at <entry> can not
- * lead to <target>. Print an error and return 0 if it does.
+ * Check that the dependency graph starting at <src> can lead to
+ * <target> or not. Print an error and return 0 if it does.
  */
 static noinline int
-check_noncircular(struct lock_list *root, struct lock_class *target,
-                struct lock_list **target_entry)
+check_path(struct lock_class *target, struct lock_list *src_entry,
+           struct lock_list **target_entry)
 {
-        int result;
+        int ret;
+
+        ret = __bfs_forwards(src_entry, (void *)target, class_equal,
+                             target_entry);
+
+        if (unlikely(ret < 0))
+                print_bfs_bug(ret);
+
+        return ret;
+}
+
+/*
+ * Prove that the dependency graph starting at <src> can not
+ * lead to <target>. If it can, there is a circle when adding
+ * <target> -> <src> dependency.
+ *
+ * Print an error and return 0 if it does.
+ */
+static noinline int
+check_noncircular(struct held_lock *src, struct held_lock *target,
+                  struct lock_trace *trace)
+{
+        int ret;
+        struct lock_list *uninitialized_var(target_entry);
+        struct lock_list src_entry = {
+                .class = hlock_class(src),
+                .parent = NULL,
+        };
 
         debug_atomic_inc(nr_cyclic_checks);
 
-        result = __bfs_forwards(root, target, class_equal, target_entry);
+        ret = check_path(hlock_class(target), &src_entry, &target_entry);
 
-        return result;
+        if (unlikely(!ret)) {
+                if (!trace->nr_entries) {
+                        /*
+                         * If save_trace fails here, the printing might
+                         * trigger a WARN but because of the !nr_entries it
+                         * should not do bad things.
+                         */
+                        save_trace(trace);
+                }
+
+                print_circular_bug(&src_entry, target_entry, src, target);
+        }
+
+        return ret;
 }
 
+#ifdef CONFIG_LOCKDEP_SMALL
+/*
+ * Check that the dependency graph starting at <src> can lead to
+ * <target> or not. If it can, <src> -> <target> dependency is already
+ * in the graph.
+ *
+ * Print an error and return 2 if it does or 1 if it does not.
+ */
 static noinline int
-check_redundant(struct lock_list *root, struct lock_class *target,
-                struct lock_list **target_entry)
+check_redundant(struct held_lock *src, struct held_lock *target)
 {
-        int result;
+        int ret;
+        struct lock_list *uninitialized_var(target_entry);
+        struct lock_list src_entry = {
+                .class = hlock_class(src),
+                .parent = NULL,
+        };
 
         debug_atomic_inc(nr_redundant_checks);
 
-        result = __bfs_forwards(root, target, class_equal, target_entry);
+        ret = check_path(hlock_class(target), &src_entry, &target_entry);
 
-        return result;
+        if (!ret) {
+                debug_atomic_inc(nr_redundant);
+                ret = 2;
+        } else if (ret < 0)
+                ret = 0;
+
+        return ret;
 }
+#endif
 
-#if defined(CONFIG_TRACE_IRQFLAGS) && defined(CONFIG_PROVE_LOCKING)
+#ifdef CONFIG_TRACE_IRQFLAGS
 
 static inline int usage_accumulate(struct lock_list *entry, void *mask)
 {
@@ -1766,7 +1873,7 @@ static void print_lock_class_header(struct lock_class *class, int depth)
  */
 static void __used
 print_shortest_lock_dependencies(struct lock_list *leaf,
-                                struct lock_list *root)
+                                 struct lock_list *root)
 {
         struct lock_list *entry = leaf;
         int depth;
@@ -1788,8 +1895,6 @@ print_shortest_lock_dependencies(struct lock_list *leaf,
                 entry = get_lock_parent(entry);
                 depth--;
         } while (entry && (depth >= 0));
-
-        return;
 }
 
 static void
@@ -1848,7 +1953,7 @@ print_irq_lock_scenario(struct lock_list *safe_entry,
         printk("\n *** DEADLOCK ***\n\n");
 }
 
-static int
+static void
 print_bad_irq_dependency(struct task_struct *curr,
                          struct lock_list *prev_root,
                          struct lock_list *next_root,
@@ -1861,7 +1966,7 @@ print_bad_irq_dependency(struct task_struct *curr,
                          const char *irqclass)
 {
         if (!debug_locks_off_graph_unlock() || debug_locks_silent)
-                return 0;
+                return;
 
         pr_warn("\n");
         pr_warn("=====================================================\n");
@@ -1907,19 +2012,17 @@ print_bad_irq_dependency(struct task_struct *curr,
 
         pr_warn("\nthe dependencies between %s-irq-safe lock and the holding lock:\n", irqclass);
         if (!save_trace(&prev_root->trace))
-                return 0;
+                return;
         print_shortest_lock_dependencies(backwards_entry, prev_root);
 
         pr_warn("\nthe dependencies between the lock to be acquired");
         pr_warn(" and %s-irq-unsafe lock:\n", irqclass);
         if (!save_trace(&next_root->trace))
-                return 0;
+                return;
         print_shortest_lock_dependencies(forwards_entry, next_root);
 
         pr_warn("\nstack backtrace:\n");
         dump_stack();
-
-        return 0;
 }
 
 static const char *state_names[] = {
@@ -2066,8 +2169,10 @@ static int check_irq_usage(struct task_struct *curr, struct held_lock *prev,
         this.class = hlock_class(prev);
 
         ret = __bfs_backwards(&this, &usage_mask, usage_accumulate, NULL);
-        if (ret < 0)
-                return print_bfs_bug(ret);
+        if (ret < 0) {
+                print_bfs_bug(ret);
+                return 0;
+        }
 
         usage_mask &= LOCKF_USED_IN_IRQ_ALL;
         if (!usage_mask)
@@ -2083,8 +2188,10 @@ static int check_irq_usage(struct task_struct *curr, struct held_lock *prev,
         that.class = hlock_class(next);
 
         ret = find_usage_forwards(&that, forward_mask, &target_entry1);
-        if (ret < 0)
-                return print_bfs_bug(ret);
+        if (ret < 0) {
+                print_bfs_bug(ret);
+                return 0;
+        }
         if (ret == 1)
                 return ret;
 
@@ -2096,8 +2203,10 @@ static int check_irq_usage(struct task_struct *curr, struct held_lock *prev,
         backward_mask = original_mask(target_entry1->class->usage_mask);
 
         ret = find_usage_backwards(&this, backward_mask, &target_entry);
-        if (ret < 0)
-                return print_bfs_bug(ret);
+        if (ret < 0) {
+                print_bfs_bug(ret);
+                return 0;
+        }
         if (DEBUG_LOCKS_WARN_ON(ret == 1))
                 return 1;
 
@@ -2111,11 +2220,13 @@ static int check_irq_usage(struct task_struct *curr, struct held_lock *prev,
         if (DEBUG_LOCKS_WARN_ON(ret == -1))
                 return 1;
 
-        return print_bad_irq_dependency(curr, &this, &that,
-                        target_entry, target_entry1,
-                        prev, next,
-                        backward_bit, forward_bit,
-                        state_name(backward_bit));
+        print_bad_irq_dependency(curr, &this, &that,
+                                 target_entry, target_entry1,
+                                 prev, next,
+                                 backward_bit, forward_bit,
+                                 state_name(backward_bit));
+
+        return 0;
 }
 
 static void inc_chains(void)
@@ -2143,11 +2254,10 @@ static inline void inc_chains(void)
         nr_process_chains++;
 }
 
-#endif
+#endif /* CONFIG_TRACE_IRQFLAGS */
 
 static void
-print_deadlock_scenario(struct held_lock *nxt,
-                             struct held_lock *prv)
+print_deadlock_scenario(struct held_lock *nxt, struct held_lock *prv)
 {
         struct lock_class *next = hlock_class(nxt);
         struct lock_class *prev = hlock_class(prv);
@@ -2165,12 +2275,12 @@ print_deadlock_scenario(struct held_lock *nxt,
         printk(" May be due to missing lock nesting notation\n\n");
 }
 
-static int
+static void
 print_deadlock_bug(struct task_struct *curr, struct held_lock *prev,
                    struct held_lock *next)
 {
         if (!debug_locks_off_graph_unlock() || debug_locks_silent)
-                return 0;
+                return;
 
         pr_warn("\n");
         pr_warn("============================================\n");
@@ -2189,8 +2299,6 @@ print_deadlock_bug(struct task_struct *curr, struct held_lock *prev,
 
         pr_warn("\nstack backtrace:\n");
         dump_stack();
-
-        return 0;
 }
 
 /*
@@ -2202,8 +2310,7 @@ print_deadlock_bug(struct task_struct *curr, struct held_lock *prev,
  * Returns: 0 on deadlock detected, 1 on OK, 2 on recursive read
  */
 static int
-check_deadlock(struct task_struct *curr, struct held_lock *next,
-               struct lockdep_map *next_instance, int read)
+check_deadlock(struct task_struct *curr, struct held_lock *next)
 {
         struct held_lock *prev;
         struct held_lock *nest = NULL;
@@ -2222,7 +2329,7 @@ check_deadlock(struct task_struct *curr, struct held_lock *next,
                  * Allow read-after-read recursion of the same
                  * lock class (i.e. read_lock(lock)+read_lock(lock)):
                  */
-                if ((read == 2) && prev->read)
+                if ((next->read == 2) && prev->read)
                         return 2;
 
                 /*
@@ -2232,14 +2339,15 @@ check_deadlock(struct task_struct *curr, struct held_lock *next,
                 if (nest)
                         return 2;
 
-                return print_deadlock_bug(curr, prev, next);
+                print_deadlock_bug(curr, prev, next);
+                return 0;
         }
         return 1;
 }
 
 /*
  * There was a chain-cache miss, and we are about to add a new dependency
- * to a previous lock. We recursively validate the following rules:
+ * to a previous lock. We validate the following rules:
  *
  *  - would the adding of the <prev> -> <next> dependency create a
  *    circular dependency in the graph? [== circular deadlock]
@@ -2263,9 +2371,7 @@ static int
 check_prev_add(struct task_struct *curr, struct held_lock *prev,
                struct held_lock *next, int distance, struct lock_trace *trace)
 {
-        struct lock_list *uninitialized_var(target_entry);
         struct lock_list *entry;
-        struct lock_list this;
         int ret;
 
         if (!hlock_class(prev)->key || !hlock_class(next)->key) {
@@ -2289,28 +2395,16 @@ check_prev_add(struct task_struct *curr, struct held_lock *prev,
         /*
          * Prove that the new <prev> -> <next> dependency would not
          * create a circular dependency in the graph. (We do this by
-         * forward-recursing into the graph starting at <next>, and
-         * checking whether we can reach <prev>.)
+         * a breadth-first search into the graph starting at <next>,
+         * and check whether we can reach <prev>.)
          *
-         * We are using global variables to control the recursion, to
-         * keep the stackframe size of the recursive functions low:
+         * The search is limited by the size of the circular queue (i.e.,
+         * MAX_CIRCULAR_QUEUE_SIZE) which keeps track of a breadth of nodes
+         * in the graph whose neighbours are to be checked.
          */
-        this.class = hlock_class(next);
-        this.parent = NULL;
-        ret = check_noncircular(&this, hlock_class(prev), &target_entry);
-        if (unlikely(!ret)) {
-                if (!trace->nr_entries) {
-                        /*
-                         * If save_trace fails here, the printing might
-                         * trigger a WARN but because of the !nr_entries it
-                         * should not do bad things.
-                         */
-                        save_trace(trace);
-                }
-                return print_circular_bug(&this, target_entry, next, prev);
-        }
-        else if (unlikely(ret < 0))
-                return print_bfs_bug(ret);
+        ret = check_noncircular(next, prev, trace);
+        if (unlikely(ret <= 0))
+                return 0;
 
         if (!check_irq_usage(curr, prev, next))
                 return 0;
@@ -2341,19 +2435,14 @@ check_prev_add(struct task_struct *curr, struct held_lock *prev,
                 }
         }
 
+#ifdef CONFIG_LOCKDEP_SMALL
         /*
          * Is the <prev> -> <next> link redundant?
          */
-        this.class = hlock_class(prev);
-        this.parent = NULL;
-        ret = check_redundant(&this, hlock_class(next), &target_entry);
-        if (!ret) {
-                debug_atomic_inc(nr_redundant);
-                return 2;
-        }
-        if (ret < 0)
-                return print_bfs_bug(ret);
-
+        ret = check_redundant(prev, next);
+        if (ret != 1)
+                return ret;
+#endif
 
         if (!trace->nr_entries && !save_trace(trace))
                 return 0;
@@ -2505,12 +2594,13 @@ static void
 print_chain_keys_held_locks(struct task_struct *curr, struct held_lock *hlock_next)
 {
         struct held_lock *hlock;
-        u64 chain_key = 0;
+        u64 chain_key = INITIAL_CHAIN_KEY;
         int depth = curr->lockdep_depth;
-        int i;
+        int i = get_first_held_lock(curr, hlock_next);
 
-        printk("depth: %u\n", depth + 1);
-        for (i = get_first_held_lock(curr, hlock_next); i < depth; i++) {
+        printk("depth: %u (irq_context %u)\n", depth - i + 1,
+                hlock_next->irq_context);
+        for (; i < depth; i++) {
                 hlock = curr->held_locks + i;
                 chain_key = print_chain_key_iteration(hlock->class_idx, chain_key);
 
@@ -2524,13 +2614,13 @@ print_chain_keys_held_locks(struct task_struct *curr, struct held_lock *hlock_ne
 static void print_chain_keys_chain(struct lock_chain *chain)
 {
         int i;
-        u64 chain_key = 0;
+        u64 chain_key = INITIAL_CHAIN_KEY;
         int class_id;
 
         printk("depth: %u\n", chain->depth);
         for (i = 0; i < chain->depth; i++) {
                 class_id = chain_hlocks[chain->base + i];
-                chain_key = print_chain_key_iteration(class_id + 1, chain_key);
+                chain_key = print_chain_key_iteration(class_id, chain_key);
 
                 print_lock_name(lock_classes + class_id);
                 printk("\n");
@@ -2581,7 +2671,7 @@ static int check_no_collision(struct task_struct *curr,
         }
 
         for (j = 0; j < chain->depth - 1; j++, i++) {
-                id = curr->held_locks[i].class_idx - 1;
+                id = curr->held_locks[i].class_idx;
 
                 if (DEBUG_LOCKS_WARN_ON(chain_hlocks[chain->base + j] != id)) {
                         print_collision(curr, hlock, chain);
@@ -2664,7 +2754,7 @@ static inline int add_chain_cache(struct task_struct *curr,
         if (likely(nr_chain_hlocks + chain->depth <= MAX_LOCKDEP_CHAIN_HLOCKS)) {
                 chain->base = nr_chain_hlocks;
                 for (j = 0; j < chain->depth - 1; j++, i++) {
-                        int lock_id = curr->held_locks[i].class_idx - 1;
+                        int lock_id = curr->held_locks[i].class_idx;
                         chain_hlocks[chain->base + j] = lock_id;
                 }
                 chain_hlocks[chain->base + j] = class - lock_classes;
@@ -2754,8 +2844,9 @@ cache_hit:
         return 1;
 }
 
-static int validate_chain(struct task_struct *curr, struct lockdep_map *lock,
-                struct held_lock *hlock, int chain_head, u64 chain_key)
+static int validate_chain(struct task_struct *curr,
+                          struct held_lock *hlock,
+                          int chain_head, u64 chain_key)
 {
         /*
          * Trylock needs to maintain the stack of held locks, but it
@@ -2776,12 +2867,18 @@ static int validate_chain(struct task_struct *curr, struct lockdep_map *lock,
                  * - is softirq-safe, if this lock is hardirq-unsafe
                  *
                  * And check whether the new lock's dependency graph
-                 * could lead back to the previous lock.
+                 * could lead back to the previous lock:
                  *
-                 * any of these scenarios could lead to a deadlock. If
-                 * All validations
+                 * - within the current held-lock stack
+                 * - across our accumulated lock dependency records
+                 *
+                 * any of these scenarios could lead to a deadlock.
                  */
-                int ret = check_deadlock(curr, hlock, lock, hlock->read);
+                /*
+                 * The simple case: does the current hold the same lock
+                 * already?
+                 */
+                int ret = check_deadlock(curr, hlock);
 
                 if (!ret)
                         return 0;
@@ -2812,16 +2909,12 @@ static int validate_chain(struct task_struct *curr, struct lockdep_map *lock,
 }
 #else
 static inline int validate_chain(struct task_struct *curr,
-                struct lockdep_map *lock, struct held_lock *hlock,
-                int chain_head, u64 chain_key)
+                                 struct held_lock *hlock,
+                                 int chain_head, u64 chain_key)
 {
         return 1;
 }
-
-static void print_lock_trace(struct lock_trace *trace, unsigned int spaces)
-{
-}
-#endif
+#endif /* CONFIG_PROVE_LOCKING */
 
 /*
  * We are building curr_chain_key incrementally, so double-check
@@ -2832,7 +2925,7 @@ static void check_chain_key(struct task_struct *curr)
 #ifdef CONFIG_DEBUG_LOCKDEP
         struct held_lock *hlock, *prev_hlock = NULL;
         unsigned int i;
-        u64 chain_key = 0;
+        u64 chain_key = INITIAL_CHAIN_KEY;
 
         for (i = 0; i < curr->lockdep_depth; i++) {
                 hlock = curr->held_locks + i;
@@ -2848,15 +2941,17 @@ static void check_chain_key(struct task_struct *curr)
                                 (unsigned long long)hlock->prev_chain_key);
                         return;
                 }
+
                 /*
-                 * Whoops ran out of static storage again?
+                 * hlock->class_idx can't go beyond MAX_LOCKDEP_KEYS, but is
+                 * it registered lock class index?
                  */
-                if (DEBUG_LOCKS_WARN_ON(hlock->class_idx > MAX_LOCKDEP_KEYS))
+                if (DEBUG_LOCKS_WARN_ON(!test_bit(hlock->class_idx, lock_classes_in_use)))
                         return;
 
                 if (prev_hlock && (prev_hlock->irq_context !=
                                                         hlock->irq_context))
-                        chain_key = 0;
+                        chain_key = INITIAL_CHAIN_KEY;
                 chain_key = iterate_chain_key(chain_key, hlock->class_idx);
                 prev_hlock = hlock;
         }
@@ -2874,14 +2969,11 @@ static void check_chain_key(struct task_struct *curr)
 #endif
 }
 
+#if defined(CONFIG_TRACE_IRQFLAGS) && defined(CONFIG_PROVE_LOCKING)
 static int mark_lock(struct task_struct *curr, struct held_lock *this,
                      enum lock_usage_bit new_bit);
 
-#if defined(CONFIG_TRACE_IRQFLAGS) && defined(CONFIG_PROVE_LOCKING)
-
-
-static void
-print_usage_bug_scenario(struct held_lock *lock)
+static void print_usage_bug_scenario(struct held_lock *lock)
 {
         struct lock_class *class = hlock_class(lock);
 
@@ -2898,12 +2990,12 @@ print_usage_bug_scenario(struct held_lock *lock)
         printk("\n *** DEADLOCK ***\n\n");
 }
 
-static int
+static void
 print_usage_bug(struct task_struct *curr, struct held_lock *this,
                 enum lock_usage_bit prev_bit, enum lock_usage_bit new_bit)
 {
         if (!debug_locks_off_graph_unlock() || debug_locks_silent)
-                return 0;
+                return;
 
         pr_warn("\n");
         pr_warn("================================\n");
@@ -2933,8 +3025,6 @@ print_usage_bug(struct task_struct *curr, struct held_lock *this,
 
         pr_warn("\nstack backtrace:\n");
         dump_stack();
-
-        return 0;
 }
 
 /*
@@ -2944,8 +3034,10 @@ static inline int
 valid_state(struct task_struct *curr, struct held_lock *this,
             enum lock_usage_bit new_bit, enum lock_usage_bit bad_bit)
 {
-        if (unlikely(hlock_class(this)->usage_mask & (1 << bad_bit)))
-                return print_usage_bug(curr, this, bad_bit, new_bit);
+        if (unlikely(hlock_class(this)->usage_mask & (1 << bad_bit))) {
+                print_usage_bug(curr, this, bad_bit, new_bit);
+                return 0;
+        }
         return 1;
 }
 
@@ -2953,7 +3045,7 @@ valid_state(struct task_struct *curr, struct held_lock *this,
 /*
  * print irq inversion bug:
  */
-static int
+static void
 print_irq_inversion_bug(struct task_struct *curr,
                         struct lock_list *root, struct lock_list *other,
                         struct held_lock *this, int forwards,
@@ -2964,7 +3056,7 @@ print_irq_inversion_bug(struct task_struct *curr,
         int depth;
 
         if (!debug_locks_off_graph_unlock() || debug_locks_silent)
-                return 0;
+                return;
 
         pr_warn("\n");
         pr_warn("========================================================\n");
@@ -3005,13 +3097,11 @@ print_irq_inversion_bug(struct task_struct *curr,
 
         pr_warn("\nthe shortest dependencies between 2nd lock and 1st lock:\n");
         if (!save_trace(&root->trace))
-                return 0;
+                return;
         print_shortest_lock_dependencies(other, root);
 
         pr_warn("\nstack backtrace:\n");
         dump_stack();
-
-        return 0;
 }
 
 /*
@@ -3029,13 +3119,16 @@ check_usage_forwards(struct task_struct *curr, struct held_lock *this,
         root.parent = NULL;
         root.class = hlock_class(this);
         ret = find_usage_forwards(&root, lock_flag(bit), &target_entry);
-        if (ret < 0)
-                return print_bfs_bug(ret);
+        if (ret < 0) {
+                print_bfs_bug(ret);
+                return 0;
+        }
         if (ret == 1)
                 return ret;
 
-        return print_irq_inversion_bug(curr, &root, target_entry,
-                                        this, 1, irqclass);
+        print_irq_inversion_bug(curr, &root, target_entry,
+                                this, 1, irqclass);
+        return 0;
 }
 
 /*
@@ -3053,13 +3146,16 @@ check_usage_backwards(struct task_struct *curr, struct held_lock *this,
         root.parent = NULL;
         root.class = hlock_class(this);
         ret = find_usage_backwards(&root, lock_flag(bit), &target_entry);
-        if (ret < 0)
-                return print_bfs_bug(ret);
+        if (ret < 0) {
+                print_bfs_bug(ret);
+                return 0;
+        }
         if (ret == 1)
                 return ret;
 
-        return print_irq_inversion_bug(curr, &root, target_entry,
-                                        this, 0, irqclass);
+        print_irq_inversion_bug(curr, &root, target_entry,
+                                this, 0, irqclass);
+        return 0;
 }
 
 void print_irqtrace_events(struct task_struct *curr)
@@ -3142,7 +3238,7 @@ mark_lock_irq(struct task_struct *curr, struct held_lock *this,
          * Validate that the lock dependencies don't have conflicting usage
          * states.
          */
-        if ((!read || !dir || STRICT_READ_CHECKS) &&
+        if ((!read || STRICT_READ_CHECKS) &&
                         !usage(curr, this, excl_bit, state_name(new_bit & ~LOCK_USAGE_READ_MASK)))
                 return 0;
 
@@ -3367,8 +3463,12 @@ void trace_softirqs_off(unsigned long ip)
                 debug_atomic_inc(redundant_softirqs_off);
 }
 
-static int mark_irqflags(struct task_struct *curr, struct held_lock *hlock)
+static int
+mark_usage(struct task_struct *curr, struct held_lock *hlock, int check)
 {
+        if (!check)
+                goto lock_used;
+
         /*
          * If non-trylock use in a hardirq or softirq context, then
          * mark the lock as used in these contexts:
@@ -3412,6 +3512,11 @@ static int mark_irqflags(struct task_struct *curr, struct held_lock *hlock)
                 }
         }
 
+lock_used:
+        /* mark it as used: */
+        if (!mark_lock(curr, hlock, LOCK_USED))
+                return 0;
+
         return 1;
 }
 
@@ -3443,35 +3548,6 @@ static int separate_irq_context(struct task_struct *curr,
         return 0;
 }
 
-#else /* defined(CONFIG_TRACE_IRQFLAGS) && defined(CONFIG_PROVE_LOCKING) */
-
-static inline
-int mark_lock_irq(struct task_struct *curr, struct held_lock *this,
-                enum lock_usage_bit new_bit)
-{
-        WARN_ON(1); /* Impossible innit? when we don't have TRACE_IRQFLAG */
-        return 1;
-}
-
-static inline int mark_irqflags(struct task_struct *curr,
-                struct held_lock *hlock)
-{
-        return 1;
-}
-
-static inline unsigned int task_irq_context(struct task_struct *task)
-{
-        return 0;
-}
-
-static inline int separate_irq_context(struct task_struct *curr,
-                struct held_lock *hlock)
-{
-        return 0;
-}
-
-#endif /* defined(CONFIG_TRACE_IRQFLAGS) && defined(CONFIG_PROVE_LOCKING) */
-
 /*
  * Mark a lock with a usage bit, and validate the state transition:
  */
@@ -3480,6 +3556,11 @@ static int mark_lock(struct task_struct *curr, struct held_lock *this,
 {
         unsigned int new_mask = 1 << new_bit, ret = 1;
 
+        if (new_bit >= LOCK_USAGE_STATES) {
+                DEBUG_LOCKS_WARN_ON(1);
+                return 0;
+        }
+
         /*
          * If already set then do not dirty the cacheline,
          * nor do any checks:
@@ -3503,25 +3584,13 @@ static int mark_lock(struct task_struct *curr, struct held_lock *this,
                 return 0;
 
         switch (new_bit) {
-#define LOCKDEP_STATE(__STATE)                  \
-        case LOCK_USED_IN_##__STATE:            \
-        case LOCK_USED_IN_##__STATE##_READ:     \
-        case LOCK_ENABLED_##__STATE:            \
-        case LOCK_ENABLED_##__STATE##_READ:
-#include "lockdep_states.h"
-#undef LOCKDEP_STATE
-                ret = mark_lock_irq(curr, this, new_bit);
-                if (!ret)
-                        return 0;
-                break;
         case LOCK_USED:
                 debug_atomic_dec(nr_unused_locks);
                 break;
         default:
-                if (!debug_locks_off_graph_unlock())
+                ret = mark_lock_irq(curr, this, new_bit);
+                if (!ret)
                         return 0;
-                WARN_ON(1);
-                return 0;
         }
 
         graph_unlock();
@@ -3539,6 +3608,27 @@ static int mark_lock(struct task_struct *curr, struct held_lock *this,
         return ret;
 }
 
+#else /* defined(CONFIG_TRACE_IRQFLAGS) && defined(CONFIG_PROVE_LOCKING) */
+
+static inline int
+mark_usage(struct task_struct *curr, struct held_lock *hlock, int check)
+{
+        return 1;
+}
+
+static inline unsigned int task_irq_context(struct task_struct *task)
+{
+        return 0;
+}
+
+static inline int separate_irq_context(struct task_struct *curr,
+                struct held_lock *hlock)
+{
+        return 0;
+}
+
+#endif /* defined(CONFIG_TRACE_IRQFLAGS) && defined(CONFIG_PROVE_LOCKING) */
+
 /*
  * Initialize a lock instance's lock-class mapping info:
  */
@@ -3602,15 +3692,15 @@ EXPORT_SYMBOL_GPL(lockdep_init_map);
 struct lock_class_key __lockdep_no_validate__;
 EXPORT_SYMBOL_GPL(__lockdep_no_validate__);
 
-static int
+static void
 print_lock_nested_lock_not_held(struct task_struct *curr,
                                 struct held_lock *hlock,
                                 unsigned long ip)
 {
         if (!debug_locks_off())
-                return 0;
+                return;
         if (debug_locks_silent)
-                return 0;
+                return;
 
         pr_warn("\n");
         pr_warn("==================================\n");
@@ -3632,8 +3722,6 @@ print_lock_nested_lock_not_held(struct task_struct *curr,
 
         pr_warn("\nstack backtrace:\n");
         dump_stack();
-
-        return 0;
 }
 
 static int __lock_is_held(const struct lockdep_map *lock, int read);
@@ -3698,24 +3786,24 @@ static int __lock_acquire(struct lockdep_map *lock, unsigned int subclass,
         if (DEBUG_LOCKS_WARN_ON(depth >= MAX_LOCK_DEPTH))
                 return 0;
 
-        class_idx = class - lock_classes + 1;
+        class_idx = class - lock_classes;
 
         if (depth) {
                 hlock = curr->held_locks + depth - 1;
                 if (hlock->class_idx == class_idx && nest_lock) {
-                        if (hlock->references) {
-                                /*
-                                 * Check: unsigned int references:12, overflow.
-                                 */
-                                if (DEBUG_LOCKS_WARN_ON(hlock->references == (1 << 12)-1))
-                                        return 0;
+                        if (!references)
+                                references++;
 
+                        if (!hlock->references)
                                 hlock->references++;
-                        } else {
-                                hlock->references = 2;
-                        }
 
-                        return 1;
+                        hlock->references += references;
+
+                        /* Overflow */
+                        if (DEBUG_LOCKS_WARN_ON(hlock->references < references))
+                                return 0;
+
+                        return 2;
                 }
         }
 
@@ -3742,11 +3830,8 @@ static int __lock_acquire(struct lockdep_map *lock, unsigned int subclass,
 #endif
         hlock->pin_count = pin_count;
 
-        if (check && !mark_irqflags(curr, hlock))
-                return 0;
-
-        /* mark it as used: */
-        if (!mark_lock(curr, hlock, LOCK_USED))
+        /* Initialize the lock usage bit */
+        if (!mark_usage(curr, hlock, check))
                 return 0;
 
         /*
@@ -3760,9 +3845,9 @@ static int __lock_acquire(struct lockdep_map *lock, unsigned int subclass,
          * the hash, not class->key.
          */
         /*
-         * Whoops, we did it again.. ran straight out of our static allocation.
+         * Whoops, we did it again.. class_idx is invalid.
          */
-        if (DEBUG_LOCKS_WARN_ON(class_idx > MAX_LOCKDEP_KEYS))
+        if (DEBUG_LOCKS_WARN_ON(!test_bit(class_idx, lock_classes_in_use)))
                 return 0;
 
         chain_key = curr->curr_chain_key;
@@ -3770,27 +3855,29 @@ static int __lock_acquire(struct lockdep_map *lock, unsigned int subclass,
                 /*
                  * How can we have a chain hash when we ain't got no keys?!
                  */
-                if (DEBUG_LOCKS_WARN_ON(chain_key != 0))
+                if (DEBUG_LOCKS_WARN_ON(chain_key != INITIAL_CHAIN_KEY))
                         return 0;
                 chain_head = 1;
         }
 
         hlock->prev_chain_key = chain_key;
         if (separate_irq_context(curr, hlock)) {
-                chain_key = 0;
+                chain_key = INITIAL_CHAIN_KEY;
                 chain_head = 1;
         }
         chain_key = iterate_chain_key(chain_key, class_idx);
 
-        if (nest_lock && !__lock_is_held(nest_lock, -1))
-                return print_lock_nested_lock_not_held(curr, hlock, ip);
+        if (nest_lock && !__lock_is_held(nest_lock, -1)) {
+                print_lock_nested_lock_not_held(curr, hlock, ip);
+                return 0;
+        }
 
         if (!debug_locks_silent) {
                 WARN_ON_ONCE(depth && !hlock_class(hlock - 1)->key);
                 WARN_ON_ONCE(!hlock_class(hlock)->key);
         }
 
-        if (!validate_chain(curr, lock, hlock, chain_head, chain_key))
+        if (!validate_chain(curr, hlock, chain_head, chain_key))
                 return 0;
 
         curr->curr_chain_key = chain_key;
@@ -3819,14 +3906,14 @@ static int __lock_acquire(struct lockdep_map *lock, unsigned int subclass,
         return 1;
 }
 
-static int
-print_unlock_imbalance_bug(struct task_struct *curr, struct lockdep_map *lock,
-                           unsigned long ip)
+static void print_unlock_imbalance_bug(struct task_struct *curr,
+                                       struct lockdep_map *lock,
+                                       unsigned long ip)
 {
         if (!debug_locks_off())
-                return 0;
+                return;
         if (debug_locks_silent)
-                return 0;
+                return;
 
         pr_warn("\n");
         pr_warn("=====================================\n");
@@ -3844,8 +3931,6 @@ print_unlock_imbalance_bug(struct task_struct *curr, struct lockdep_map *lock,
 
         pr_warn("\nstack backtrace:\n");
         dump_stack();
-
-        return 0;
 }
 
 static int match_held_lock(const struct held_lock *hlock,
@@ -3877,7 +3962,7 @@ static int match_held_lock(const struct held_lock *hlock,
                 if (DEBUG_LOCKS_WARN_ON(!hlock->nest_lock))
                         return 0;
 
-                if (hlock->class_idx == class - lock_classes + 1)
+                if (hlock->class_idx == class - lock_classes)
                         return 1;
         }
 
@@ -3921,22 +4006,33 @@ out:
 }
 
 static int reacquire_held_locks(struct task_struct *curr, unsigned int depth,
-                              int idx)
+                                int idx, unsigned int *merged)
 {
         struct held_lock *hlock;
+        int first_idx = idx;
 
         if (DEBUG_LOCKS_WARN_ON(!irqs_disabled()))
                 return 0;
 
         for (hlock = curr->held_locks + idx; idx < depth; idx++, hlock++) {
-                if (!__lock_acquire(hlock->instance,
+                switch (__lock_acquire(hlock->instance,
                                     hlock_class(hlock)->subclass,
                                     hlock->trylock,
                                     hlock->read, hlock->check,
                                     hlock->hardirqs_off,
                                     hlock->nest_lock, hlock->acquire_ip,
-                                    hlock->references, hlock->pin_count))
+                                    hlock->references, hlock->pin_count)) {
+                case 0:
                         return 1;
+                case 1:
+                        break;
+                case 2:
+                        *merged += (idx == first_idx);
+                        break;
+                default:
+                        WARN_ON(1);
+                        return 0;
+                }
         }
         return 0;
 }
@@ -3947,9 +4043,9 @@ __lock_set_class(struct lockdep_map *lock, const char *name,
                  unsigned long ip)
 {
         struct task_struct *curr = current;
+        unsigned int depth, merged = 0;
         struct held_lock *hlock;
         struct lock_class *class;
-        unsigned int depth;
         int i;
 
         if (unlikely(!debug_locks))
@@ -3964,24 +4060,26 @@ __lock_set_class(struct lockdep_map *lock, const char *name,
                 return 0;
 
         hlock = find_held_lock(curr, lock, depth, &i);
-        if (!hlock)
-                return print_unlock_imbalance_bug(curr, lock, ip);
+        if (!hlock) {
+                print_unlock_imbalance_bug(curr, lock, ip);
+                return 0;
+        }
 
         lockdep_init_map(lock, name, key, 0);
         class = register_lock_class(lock, subclass, 0);
-        hlock->class_idx = class - lock_classes + 1;
+        hlock->class_idx = class - lock_classes;
 
         curr->lockdep_depth = i;
         curr->curr_chain_key = hlock->prev_chain_key;
 
-        if (reacquire_held_locks(curr, depth, i))
+        if (reacquire_held_locks(curr, depth, i, &merged))
                 return 0;
 
         /*
          * I took it apart and put it back together again, except now I have
          * these 'spare' parts.. where shall I put them.
          */
-        if (DEBUG_LOCKS_WARN_ON(curr->lockdep_depth != depth))
+        if (DEBUG_LOCKS_WARN_ON(curr->lockdep_depth != depth - merged))
                 return 0;
         return 1;
 }
@@ -3989,8 +4087,8 @@ __lock_set_class(struct lockdep_map *lock, const char *name,
 static int __lock_downgrade(struct lockdep_map *lock, unsigned long ip)
 {
         struct task_struct *curr = current;
+        unsigned int depth, merged = 0;
         struct held_lock *hlock;
-        unsigned int depth;
         int i;
 
         if (unlikely(!debug_locks))
@@ -4005,8 +4103,10 @@ static int __lock_downgrade(struct lockdep_map *lock, unsigned long ip)
                 return 0;
 
         hlock = find_held_lock(curr, lock, depth, &i);
-        if (!hlock)
-                return print_unlock_imbalance_bug(curr, lock, ip);
+        if (!hlock) {
+                print_unlock_imbalance_bug(curr, lock, ip);
+                return 0;
+        }
 
         curr->lockdep_depth = i;
         curr->curr_chain_key = hlock->prev_chain_key;
@@ -4015,7 +4115,11 @@ static int __lock_downgrade(struct lockdep_map *lock, unsigned long ip)
         hlock->read = 1;
         hlock->acquire_ip = ip;
 
-        if (reacquire_held_locks(curr, depth, i))
+        if (reacquire_held_locks(curr, depth, i, &merged))
+                return 0;
+
+        /* Merging can't happen with unchanged classes.. */
+        if (DEBUG_LOCKS_WARN_ON(merged))
                 return 0;
 
         /*
@@ -4024,6 +4128,7 @@ static int __lock_downgrade(struct lockdep_map *lock, unsigned long ip)
          */
         if (DEBUG_LOCKS_WARN_ON(curr->lockdep_depth != depth))
                 return 0;
+
         return 1;
 }
 
@@ -4035,11 +4140,11 @@ static int __lock_downgrade(struct lockdep_map *lock, unsigned long ip)
  * @nested is an hysterical artifact, needs a tree wide cleanup.
  */
 static int
-__lock_release(struct lockdep_map *lock, int nested, unsigned long ip)
+__lock_release(struct lockdep_map *lock, unsigned long ip)
 {
         struct task_struct *curr = current;
+        unsigned int depth, merged = 1;
         struct held_lock *hlock;
-        unsigned int depth;
         int i;
 
         if (unlikely(!debug_locks))
@@ -4050,16 +4155,20 @@ __lock_release(struct lockdep_map *lock, int nested, unsigned long ip)
          * So we're all set to release this lock.. wait what lock? We don't
          * own any locks, you've been drinking again?
          */
-        if (DEBUG_LOCKS_WARN_ON(depth <= 0))
-                 return print_unlock_imbalance_bug(curr, lock, ip);
+        if (depth <= 0) {
+                print_unlock_imbalance_bug(curr, lock, ip);
+                return 0;
+        }
 
         /*
          * Check whether the lock exists in the current stack
          * of held locks:
          */
         hlock = find_held_lock(curr, lock, depth, &i);
-        if (!hlock)
-                return print_unlock_imbalance_bug(curr, lock, ip);
+        if (!hlock) {
+                print_unlock_imbalance_bug(curr, lock, ip);
+                return 0;
+        }
 
         if (hlock->instance == lock)
                 lock_release_holdtime(hlock);
@@ -4094,14 +4203,15 @@ __lock_release(struct lockdep_map *lock, int nested, unsigned long ip)
         if (i == depth-1)
                 return 1;
 
-        if (reacquire_held_locks(curr, depth, i + 1))
+        if (reacquire_held_locks(curr, depth, i + 1, &merged))
                 return 0;
 
         /*
          * We had N bottles of beer on the wall, we drank one, but now
          * there's not N-1 bottles of beer left on the wall...
+         * Pouring two of the bottles together is acceptable.
          */
-        DEBUG_LOCKS_WARN_ON(curr->lockdep_depth != depth-1);
+        DEBUG_LOCKS_WARN_ON(curr->lockdep_depth != depth - merged);
 
         /*
          * Since reacquire_held_locks() would have called check_chain_key()
@@ -4319,7 +4429,7 @@ void lock_release(struct lockdep_map *lock, int nested,
         check_flags(flags);
         current->lockdep_recursion = 1;
         trace_lock_release(lock, ip);
-        if (__lock_release(lock, nested, ip))
+        if (__lock_release(lock, ip))
                 check_chain_key(current);
         current->lockdep_recursion = 0;
         raw_local_irq_restore(flags);
@@ -4402,14 +4512,14 @@ void lock_unpin_lock(struct lockdep_map *lock, struct pin_cookie cookie)
 EXPORT_SYMBOL_GPL(lock_unpin_lock);
 
 #ifdef CONFIG_LOCK_STAT
-static int
-print_lock_contention_bug(struct task_struct *curr, struct lockdep_map *lock,
-                           unsigned long ip)
+static void print_lock_contention_bug(struct task_struct *curr,
+                                      struct lockdep_map *lock,
+                                      unsigned long ip)
 {
         if (!debug_locks_off())
-                return 0;
+                return;
         if (debug_locks_silent)
-                return 0;
+                return;
 
         pr_warn("\n");
         pr_warn("=================================\n");
@@ -4427,8 +4537,6 @@ print_lock_contention_bug(struct task_struct *curr, struct lockdep_map *lock,
 
         pr_warn("\nstack backtrace:\n");
         dump_stack();
-
-        return 0;
 }
 
 static void
@@ -4573,9 +4681,7 @@ void lockdep_reset(void)
         int i;
 
         raw_local_irq_save(flags);
-        current->curr_chain_key = 0;
-        current->lockdep_depth = 0;
-        current->lockdep_recursion = 0;
+        lockdep_init_task(current);
         memset(current->held_locks, 0, MAX_LOCK_DEPTH*sizeof(struct held_lock));
         nr_hardirq_chains = 0;
         nr_softirq_chains = 0;
@@ -4615,9 +4721,9 @@ static void remove_class_from_lock_chain(struct pending_free *pf,
         return;
 
 recalc:
-        chain_key = 0;
+        chain_key = INITIAL_CHAIN_KEY;
         for (i = chain->base; i < chain->base + chain->depth; i++)
-                chain_key = iterate_chain_key(chain_key, chain_hlocks[i] + 1);
+                chain_key = iterate_chain_key(chain_key, chain_hlocks[i]);
         if (chain->depth && chain->chain_key == chain_key)
                 return;
         /* Overwrite the chain key for concurrent RCU readers. */
@@ -4691,6 +4797,7 @@ static void zap_class(struct pending_free *pf, struct lock_class *class)
                 WRITE_ONCE(class->key, NULL);
                 WRITE_ONCE(class->name, NULL);
                 nr_lock_classes--;
+                __clear_bit(class - lock_classes, lock_classes_in_use);
         } else {
                 WARN_ONCE(true, "%s() failed for class %s\n", __func__,
                           class->name);
@@ -5036,6 +5143,7 @@ void __init lockdep_init(void)
 
         printk(" memory used by lock dependency info: %zu kB\n",
                (sizeof(lock_classes) +
+                sizeof(lock_classes_in_use) +
                 sizeof(classhash_table) +
                 sizeof(list_entries) +
                 sizeof(list_entries_in_use) +
diff --git a/kernel/locking/lockdep_internals.h b/kernel/locking/lockdep_internals.h
index 150ec3f0c5b5..cc83568d5012 100644
--- a/kernel/locking/lockdep_internals.h
+++ b/kernel/locking/lockdep_internals.h
@@ -131,7 +131,6 @@ extern unsigned int nr_hardirq_chains;
 extern unsigned int nr_softirq_chains;
 extern unsigned int nr_process_chains;
 extern unsigned int max_lockdep_depth;
-extern unsigned int max_recursion_depth;
 
 extern unsigned int max_bfs_queue_depth;
 
@@ -160,25 +159,22 @@ lockdep_count_backward_deps(struct lock_class *class)
  * and we want to avoid too much cache bouncing.
  */
 struct lockdep_stats {
-        int     chain_lookup_hits;
-        int     chain_lookup_misses;
-        int     hardirqs_on_events;
-        int     hardirqs_off_events;
-        int     redundant_hardirqs_on;
-        int     redundant_hardirqs_off;
-        int     softirqs_on_events;
-        int     softirqs_off_events;
-        int     redundant_softirqs_on;
-        int     redundant_softirqs_off;
-        int     nr_unused_locks;
-        int     nr_redundant_checks;
-        int     nr_redundant;
-        int     nr_cyclic_checks;
-        int     nr_cyclic_check_recursions;
-        int     nr_find_usage_forwards_checks;
-        int     nr_find_usage_forwards_recursions;
-        int     nr_find_usage_backwards_checks;
-        int     nr_find_usage_backwards_recursions;
+        unsigned long  chain_lookup_hits;
+        unsigned int   chain_lookup_misses;
+        unsigned long  hardirqs_on_events;
+        unsigned long  hardirqs_off_events;
+        unsigned long  redundant_hardirqs_on;
+        unsigned long  redundant_hardirqs_off;
+        unsigned long  softirqs_on_events;
+        unsigned long  softirqs_off_events;
+        unsigned long  redundant_softirqs_on;
+        unsigned long  redundant_softirqs_off;
+        int            nr_unused_locks;
+        unsigned int   nr_redundant_checks;
+        unsigned int   nr_redundant;
+        unsigned int   nr_cyclic_checks;
+        unsigned int   nr_find_usage_forwards_checks;
+        unsigned int   nr_find_usage_backwards_checks;
 
         /*
          * Per lock class locking operation stat counts
diff --git a/kernel/locking/locktorture.c b/kernel/locking/locktorture.c
index 80a463d31a8d..c513031cd7e3 100644
--- a/kernel/locking/locktorture.c
+++ b/kernel/locking/locktorture.c
@@ -975,7 +975,7 @@ static int __init lock_torture_init(void)
                         goto unwind;
         }
         if (stutter > 0) {
-                firsterr = torture_stutter_init(stutter);
+                firsterr = torture_stutter_init(stutter, stutter);
                 if (firsterr)
                         goto unwind;
         }
diff --git a/kernel/locking/percpu-rwsem.c b/kernel/locking/percpu-rwsem.c
index b6a9cc62099a..364d38a0c444 100644
--- a/kernel/locking/percpu-rwsem.c
+++ b/kernel/locking/percpu-rwsem.c
@@ -18,7 +18,7 @@ int __percpu_init_rwsem(struct percpu_rw_semaphore *sem,
                 return -ENOMEM;
 
         /* ->rw_sem represents the whole percpu_rw_semaphore for lockdep */
-        rcu_sync_init(&sem->rss, RCU_SCHED_SYNC);
+        rcu_sync_init(&sem->rss);
         __init_rwsem(&sem->rw_sem, name, rwsem_key);
         rcuwait_init(&sem->writer);
         sem->readers_block = 0;
diff --git a/kernel/locking/rwsem-xadd.c b/kernel/locking/rwsem-xadd.c
deleted file mode 100644
index 0b1f77957240..000000000000
--- a/kernel/locking/rwsem-xadd.c
+++ /dev/null
@@ -1,745 +0,0 @@
-// SPDX-License-Identifier: GPL-2.0
-/* rwsem.c: R/W semaphores: contention handling functions
- *
- * Written by David Howells (dhowells@redhat.com).
- * Derived from arch/i386/kernel/semaphore.c
- *
- * Writer lock-stealing by Alex Shi <alex.shi@intel.com>
- * and Michel Lespinasse <walken@google.com>
- *
- * Optimistic spinning by Tim Chen <tim.c.chen@intel.com>
- * and Davidlohr Bueso <davidlohr@hp.com>. Based on mutexes.
- */
-#include <linux/rwsem.h>
-#include <linux/init.h>
-#include <linux/export.h>
-#include <linux/sched/signal.h>
-#include <linux/sched/rt.h>
-#include <linux/sched/wake_q.h>
-#include <linux/sched/debug.h>
-#include <linux/osq_lock.h>
-
-#include "rwsem.h"
-
-/*
- * Guide to the rw_semaphore's count field for common values.
- * (32-bit case illustrated, similar for 64-bit)
- *
- * 0x0000000X   (1) X readers active or attempting lock, no writer waiting
- *                  X = #active_readers + #readers attempting to lock
- *                  (X*ACTIVE_BIAS)
- *
- * 0x00000000   rwsem is unlocked, and no one is waiting for the lock or
- *              attempting to read lock or write lock.
- *
- * 0xffff000X   (1) X readers active or attempting lock, with waiters for lock
- *                  X = #active readers + # readers attempting lock
- *                  (X*ACTIVE_BIAS + WAITING_BIAS)
- *              (2) 1 writer attempting lock, no waiters for lock
- *                  X-1 = #active readers + #readers attempting lock
- *                  ((X-1)*ACTIVE_BIAS + ACTIVE_WRITE_BIAS)
- *              (3) 1 writer active, no waiters for lock
- *                  X-1 = #active readers + #readers attempting lock
- *                  ((X-1)*ACTIVE_BIAS + ACTIVE_WRITE_BIAS)
- *
- * 0xffff0001   (1) 1 reader active or attempting lock, waiters for lock
- *                  (WAITING_BIAS + ACTIVE_BIAS)
- *              (2) 1 writer active or attempting lock, no waiters for lock
- *                  (ACTIVE_WRITE_BIAS)
- *
- * 0xffff0000   (1) There are writers or readers queued but none active
- *                  or in the process of attempting lock.
- *                  (WAITING_BIAS)
- *              Note: writer can attempt to steal lock for this count by adding
- *              ACTIVE_WRITE_BIAS in cmpxchg and checking the old count
- *
- * 0xfffe0001   (1) 1 writer active, or attempting lock. Waiters on queue.
- *                  (ACTIVE_WRITE_BIAS + WAITING_BIAS)
- *
- * Note: Readers attempt to lock by adding ACTIVE_BIAS in down_read and checking
- *       the count becomes more than 0 for successful lock acquisition,
- *       i.e. the case where there are only readers or nobody has lock.
- *       (1st and 2nd case above).
- *
- *       Writers attempt to lock by adding ACTIVE_WRITE_BIAS in down_write and
- *       checking the count becomes ACTIVE_WRITE_BIAS for successful lock
- *       acquisition (i.e. nobody else has lock or attempts lock).  If
- *       unsuccessful, in rwsem_down_write_failed, we'll check to see if there
- *       are only waiters but none active (5th case above), and attempt to
- *       steal the lock.
- *
- */
-
-/*
- * Initialize an rwsem:
- */
-void __init_rwsem(struct rw_semaphore *sem, const char *name,
-                  struct lock_class_key *key)
-{
-#ifdef CONFIG_DEBUG_LOCK_ALLOC
-        /*
-         * Make sure we are not reinitializing a held semaphore:
-         */
-        debug_check_no_locks_freed((void *)sem, sizeof(*sem));
-        lockdep_init_map(&sem->dep_map, name, key, 0);
-#endif
-        atomic_long_set(&sem->count, RWSEM_UNLOCKED_VALUE);
-        raw_spin_lock_init(&sem->wait_lock);
-        INIT_LIST_HEAD(&sem->wait_list);
-#ifdef CONFIG_RWSEM_SPIN_ON_OWNER
-        sem->owner = NULL;
-        osq_lock_init(&sem->osq);
-#endif
-}
-
-EXPORT_SYMBOL(__init_rwsem);
-
-enum rwsem_waiter_type {
-        RWSEM_WAITING_FOR_WRITE,
-        RWSEM_WAITING_FOR_READ
-};
-
-struct rwsem_waiter {
-        struct list_head list;
-        struct task_struct *task;
-        enum rwsem_waiter_type type;
-};
-
-enum rwsem_wake_type {
-        RWSEM_WAKE_ANY,         /* Wake whatever's at head of wait list */
-        RWSEM_WAKE_READERS,     /* Wake readers only */
-        RWSEM_WAKE_READ_OWNED   /* Waker thread holds the read lock */
-};
-
-/*
- * handle the lock release when processes blocked on it that can now run
- * - if we come here from up_xxxx(), then:
- *   - the 'active part' of count (&0x0000ffff) reached 0 (but may have changed)
- *   - the 'waiting part' of count (&0xffff0000) is -ve (and will still be so)
- * - there must be someone on the queue
- * - the wait_lock must be held by the caller
- * - tasks are marked for wakeup, the caller must later invoke wake_up_q()
- *   to actually wakeup the blocked task(s) and drop the reference count,
- *   preferably when the wait_lock is released
- * - woken process blocks are discarded from the list after having task zeroed
- * - writers are only marked woken if downgrading is false
- */
-static void __rwsem_mark_wake(struct rw_semaphore *sem,
-                              enum rwsem_wake_type wake_type,
-                              struct wake_q_head *wake_q)
-{
-        struct rwsem_waiter *waiter, *tmp;
-        long oldcount, woken = 0, adjustment = 0;
-        struct list_head wlist;
-
-        /*
-         * Take a peek at the queue head waiter such that we can determine
-         * the wakeup(s) to perform.
-         */
-        waiter = list_first_entry(&sem->wait_list, struct rwsem_waiter, list);
-
-        if (waiter->type == RWSEM_WAITING_FOR_WRITE) {
-                if (wake_type == RWSEM_WAKE_ANY) {
-                        /*
-                         * Mark writer at the front of the queue for wakeup.
-                         * Until the task is actually later awoken later by
-                         * the caller, other writers are able to steal it.
-                         * Readers, on the other hand, will block as they
-                         * will notice the queued writer.
-                         */
-                        wake_q_add(wake_q, waiter->task);
-                        lockevent_inc(rwsem_wake_writer);
-                }
-
-                return;
-        }
-
-        /*
-         * Writers might steal the lock before we grant it to the next reader.
-         * We prefer to do the first reader grant before counting readers
-         * so we can bail out early if a writer stole the lock.
-         */
-        if (wake_type != RWSEM_WAKE_READ_OWNED) {
-                adjustment = RWSEM_ACTIVE_READ_BIAS;
- try_reader_grant:
-                oldcount = atomic_long_fetch_add(adjustment, &sem->count);
-                if (unlikely(oldcount < RWSEM_WAITING_BIAS)) {
-                        /*
-                         * If the count is still less than RWSEM_WAITING_BIAS
-                         * after removing the adjustment, it is assumed that
-                         * a writer has stolen the lock. We have to undo our
-                         * reader grant.
-                         */
-                        if (atomic_long_add_return(-adjustment, &sem->count) <
-                            RWSEM_WAITING_BIAS)
-                                return;
-
-                        /* Last active locker left. Retry waking readers. */
-                        goto try_reader_grant;
-                }
-                /*
-                 * Set it to reader-owned to give spinners an early
-                 * indication that readers now have the lock.
-                 */
-                __rwsem_set_reader_owned(sem, waiter->task);
-        }
-
-        /*
-         * Grant an infinite number of read locks to the readers at the front
-         * of the queue. We know that woken will be at least 1 as we accounted
-         * for above. Note we increment the 'active part' of the count by the
-         * number of readers before waking any processes up.
-         *
-         * We have to do wakeup in 2 passes to prevent the possibility that
-         * the reader count may be decremented before it is incremented. It
-         * is because the to-be-woken waiter may not have slept yet. So it
-         * may see waiter->task got cleared, finish its critical section and
-         * do an unlock before the reader count increment.
-         *
-         * 1) Collect the read-waiters in a separate list, count them and
-         *    fully increment the reader count in rwsem.
-         * 2) For each waiters in the new list, clear waiter->task and
-         *    put them into wake_q to be woken up later.
-         */
-        list_for_each_entry(waiter, &sem->wait_list, list) {
-                if (waiter->type == RWSEM_WAITING_FOR_WRITE)
-                        break;
-
-                woken++;
-        }
-        list_cut_before(&wlist, &sem->wait_list, &waiter->list);
-
-        adjustment = woken * RWSEM_ACTIVE_READ_BIAS - adjustment;
-        lockevent_cond_inc(rwsem_wake_reader, woken);
-        if (list_empty(&sem->wait_list)) {
-                /* hit end of list above */
-                adjustment -= RWSEM_WAITING_BIAS;
-        }
-
-        if (adjustment)
-                atomic_long_add(adjustment, &sem->count);
-
-        /* 2nd pass */
-        list_for_each_entry_safe(waiter, tmp, &wlist, list) {
-                struct task_struct *tsk;
-
-                tsk = waiter->task;
-                get_task_struct(tsk);
-
-                /*
-                 * Ensure calling get_task_struct() before setting the reader
-                 * waiter to nil such that rwsem_down_read_failed() cannot
-                 * race with do_exit() by always holding a reference count
-                 * to the task to wakeup.
-                 */
-                smp_store_release(&waiter->task, NULL);
-                /*
-                 * Ensure issuing the wakeup (either by us or someone else)
-                 * after setting the reader waiter to nil.
-                 */
-                wake_q_add_safe(wake_q, tsk);
-        }
-}
-
-/*
- * This function must be called with the sem->wait_lock held to prevent
- * race conditions between checking the rwsem wait list and setting the
- * sem->count accordingly.
- */
-static inline bool rwsem_try_write_lock(long count, struct rw_semaphore *sem)
-{
-        /*
-         * Avoid trying to acquire write lock if count isn't RWSEM_WAITING_BIAS.
-         */
-        if (count != RWSEM_WAITING_BIAS)
-                return false;
-
-        /*
-         * Acquire the lock by trying to set it to ACTIVE_WRITE_BIAS. If there
-         * are other tasks on the wait list, we need to add on WAITING_BIAS.
-         */
-        count = list_is_singular(&sem->wait_list) ?
-                        RWSEM_ACTIVE_WRITE_BIAS :
-                        RWSEM_ACTIVE_WRITE_BIAS + RWSEM_WAITING_BIAS;
-
-        if (atomic_long_cmpxchg_acquire(&sem->count, RWSEM_WAITING_BIAS, count)
-                                                        == RWSEM_WAITING_BIAS) {
-                rwsem_set_owner(sem);
-                return true;
-        }
-
-        return false;
-}
-
-#ifdef CONFIG_RWSEM_SPIN_ON_OWNER
-/*
- * Try to acquire write lock before the writer has been put on wait queue.
- */
-static inline bool rwsem_try_write_lock_unqueued(struct rw_semaphore *sem)
-{
-        long count = atomic_long_read(&sem->count);
-
-        while (!count || count == RWSEM_WAITING_BIAS) {
-                if (atomic_long_try_cmpxchg_acquire(&sem->count, &count,
-                                        count + RWSEM_ACTIVE_WRITE_BIAS)) {
-                        rwsem_set_owner(sem);
-                        lockevent_inc(rwsem_opt_wlock);
-                        return true;
-                }
-        }
-        return false;
-}
-
-static inline bool owner_on_cpu(struct task_struct *owner)
-{
-        /*
-         * As lock holder preemption issue, we both skip spinning if
-         * task is not on cpu or its cpu is preempted
-         */
-        return owner->on_cpu && !vcpu_is_preempted(task_cpu(owner));
-}
-
-static inline bool rwsem_can_spin_on_owner(struct rw_semaphore *sem)
-{
-        struct task_struct *owner;
-        bool ret = true;
-
-        BUILD_BUG_ON(!rwsem_has_anonymous_owner(RWSEM_OWNER_UNKNOWN));
-
-        if (need_resched())
-                return false;
-
-        rcu_read_lock();
-        owner = READ_ONCE(sem->owner);
-        if (owner) {
-                ret = is_rwsem_owner_spinnable(owner) &&
-                      owner_on_cpu(owner);
-        }
-        rcu_read_unlock();
-        return ret;
-}
-
-/*
- * Return true only if we can still spin on the owner field of the rwsem.
- */
-static noinline bool rwsem_spin_on_owner(struct rw_semaphore *sem)
-{
-        struct task_struct *owner = READ_ONCE(sem->owner);
-
-        if (!is_rwsem_owner_spinnable(owner))
-                return false;
-
-        rcu_read_lock();
-        while (owner && (READ_ONCE(sem->owner) == owner)) {
-                /*
-                 * Ensure we emit the owner->on_cpu, dereference _after_
-                 * checking sem->owner still matches owner, if that fails,
-                 * owner might point to free()d memory, if it still matches,
-                 * the rcu_read_lock() ensures the memory stays valid.
-                 */
-                barrier();
-
-                /*
-                 * abort spinning when need_resched or owner is not running or
-                 * owner's cpu is preempted.
-                 */
-                if (need_resched() || !owner_on_cpu(owner)) {
-                        rcu_read_unlock();
-                        return false;
-                }
-
-                cpu_relax();
-        }
-        rcu_read_unlock();
-
-        /*
-         * If there is a new owner or the owner is not set, we continue
-         * spinning.
-         */
-        return is_rwsem_owner_spinnable(READ_ONCE(sem->owner));
-}
-
-static bool rwsem_optimistic_spin(struct rw_semaphore *sem)
-{
-        bool taken = false;
-
-        preempt_disable();
-
-        /* sem->wait_lock should not be held when doing optimistic spinning */
-        if (!rwsem_can_spin_on_owner(sem))
-                goto done;
-
-        if (!osq_lock(&sem->osq))
-                goto done;
-
-        /*
-         * Optimistically spin on the owner field and attempt to acquire the
-         * lock whenever the owner changes. Spinning will be stopped when:
-         *  1) the owning writer isn't running; or
-         *  2) readers own the lock as we can't determine if they are
-         *     actively running or not.
-         */
-        while (rwsem_spin_on_owner(sem)) {
-                /*
-                 * Try to acquire the lock
-                 */
-                if (rwsem_try_write_lock_unqueued(sem)) {
-                        taken = true;
-                        break;
-                }
-
-                /*
-                 * When there's no owner, we might have preempted between the
-                 * owner acquiring the lock and setting the owner field. If
-                 * we're an RT task that will live-lock because we won't let
-                 * the owner complete.
-                 */
-                if (!sem->owner && (need_resched() || rt_task(current)))
-                        break;
-
-                /*
-                 * The cpu_relax() call is a compiler barrier which forces
-                 * everything in this loop to be re-loaded. We don't need
-                 * memory barriers as we'll eventually observe the right
-                 * values at the cost of a few extra spins.
-                 */
-                cpu_relax();
-        }
-        osq_unlock(&sem->osq);
-done:
-        preempt_enable();
-        lockevent_cond_inc(rwsem_opt_fail, !taken);
-        return taken;
-}
-
-/*
- * Return true if the rwsem has active spinner
- */
-static inline bool rwsem_has_spinner(struct rw_semaphore *sem)
-{
-        return osq_is_locked(&sem->osq);
-}
-
-#else
-static bool rwsem_optimistic_spin(struct rw_semaphore *sem)
-{
-        return false;
-}
-
-static inline bool rwsem_has_spinner(struct rw_semaphore *sem)
-{
-        return false;
-}
-#endif
-
-/*
- * Wait for the read lock to be granted
- */
-static inline struct rw_semaphore __sched *
-__rwsem_down_read_failed_common(struct rw_semaphore *sem, int state)
-{
-        long count, adjustment = -RWSEM_ACTIVE_READ_BIAS;
-        struct rwsem_waiter waiter;
-        DEFINE_WAKE_Q(wake_q);
-
-        waiter.task = current;
-        waiter.type = RWSEM_WAITING_FOR_READ;
-
-        raw_spin_lock_irq(&sem->wait_lock);
-        if (list_empty(&sem->wait_list)) {
-                /*
-                 * In case the wait queue is empty and the lock isn't owned
-                 * by a writer, this reader can exit the slowpath and return
-                 * immediately as its RWSEM_ACTIVE_READ_BIAS has already
-                 * been set in the count.
-                 */
-                if (atomic_long_read(&sem->count) >= 0) {
-                        raw_spin_unlock_irq(&sem->wait_lock);
-                        rwsem_set_reader_owned(sem);
-                        lockevent_inc(rwsem_rlock_fast);
-                        return sem;
-                }
-                adjustment += RWSEM_WAITING_BIAS;
-        }
-        list_add_tail(&waiter.list, &sem->wait_list);
-
-        /* we're now waiting on the lock, but no longer actively locking */
-        count = atomic_long_add_return(adjustment, &sem->count);
-
-        /*
-         * If there are no active locks, wake the front queued process(es).
-         *
-         * If there are no writers and we are first in the queue,
-         * wake our own waiter to join the existing active readers !
-         */
-        if (count == RWSEM_WAITING_BIAS ||
-            (count > RWSEM_WAITING_BIAS &&
-             adjustment != -RWSEM_ACTIVE_READ_BIAS))
-                __rwsem_mark_wake(sem, RWSEM_WAKE_ANY, &wake_q);
-
-        raw_spin_unlock_irq(&sem->wait_lock);
-        wake_up_q(&wake_q);
-
-        /* wait to be given the lock */
-        while (true) {
-                set_current_state(state);
-                if (!waiter.task)
-                        break;
-                if (signal_pending_state(state, current)) {
-                        raw_spin_lock_irq(&sem->wait_lock);
-                        if (waiter.task)
-                                goto out_nolock;
-                        raw_spin_unlock_irq(&sem->wait_lock);
-                        break;
-                }
-                schedule();
-                lockevent_inc(rwsem_sleep_reader);
-        }
-
-        __set_current_state(TASK_RUNNING);
-        lockevent_inc(rwsem_rlock);
-        return sem;
-out_nolock:
-        list_del(&waiter.list);
-        if (list_empty(&sem->wait_list))
-                atomic_long_add(-RWSEM_WAITING_BIAS, &sem->count);
-        raw_spin_unlock_irq(&sem->wait_lock);
-        __set_current_state(TASK_RUNNING);
-        lockevent_inc(rwsem_rlock_fail);
-        return ERR_PTR(-EINTR);
-}
-
-__visible struct rw_semaphore * __sched
-rwsem_down_read_failed(struct rw_semaphore *sem)
-{
-        return __rwsem_down_read_failed_common(sem, TASK_UNINTERRUPTIBLE);
-}
-EXPORT_SYMBOL(rwsem_down_read_failed);
-
-__visible struct rw_semaphore * __sched
-rwsem_down_read_failed_killable(struct rw_semaphore *sem)
-{
-        return __rwsem_down_read_failed_common(sem, TASK_KILLABLE);
-}
-EXPORT_SYMBOL(rwsem_down_read_failed_killable);
-
-/*
- * Wait until we successfully acquire the write lock
- */
-static inline struct rw_semaphore *
-__rwsem_down_write_failed_common(struct rw_semaphore *sem, int state)
-{
-        long count;
-        bool waiting = true; /* any queued threads before us */
-        struct rwsem_waiter waiter;
-        struct rw_semaphore *ret = sem;
-        DEFINE_WAKE_Q(wake_q);
-
-        /* undo write bias from down_write operation, stop active locking */
-        count = atomic_long_sub_return(RWSEM_ACTIVE_WRITE_BIAS, &sem->count);
-
-        /* do optimistic spinning and steal lock if possible */
-        if (rwsem_optimistic_spin(sem))
-                return sem;
-
-        /*
-         * Optimistic spinning failed, proceed to the slowpath
-         * and block until we can acquire the sem.
-         */
-        waiter.task = current;
-        waiter.type = RWSEM_WAITING_FOR_WRITE;
-
-        raw_spin_lock_irq(&sem->wait_lock);
-
-        /* account for this before adding a new element to the list */
-        if (list_empty(&sem->wait_list))
-                waiting = false;
-
-        list_add_tail(&waiter.list, &sem->wait_list);
-
-        /* we're now waiting on the lock, but no longer actively locking */
-        if (waiting) {
-                count = atomic_long_read(&sem->count);
-
-                /*
-                 * If there were already threads queued before us and there are
-                 * no active writers, the lock must be read owned; so we try to
-                 * wake any read locks that were queued ahead of us.
-                 */
-                if (count > RWSEM_WAITING_BIAS) {
-                        __rwsem_mark_wake(sem, RWSEM_WAKE_READERS, &wake_q);
-                        /*
-                         * The wakeup is normally called _after_ the wait_lock
-                         * is released, but given that we are proactively waking
-                         * readers we can deal with the wake_q overhead as it is
-                         * similar to releasing and taking the wait_lock again
-                         * for attempting rwsem_try_write_lock().
-                         */
-                        wake_up_q(&wake_q);
-
-                        /*
-                         * Reinitialize wake_q after use.
-                         */
-                        wake_q_init(&wake_q);
-                }
-
-        } else
-                count = atomic_long_add_return(RWSEM_WAITING_BIAS, &sem->count);
-
-        /* wait until we successfully acquire the lock */
-        set_current_state(state);
-        while (true) {
-                if (rwsem_try_write_lock(count, sem))
-                        break;
-                raw_spin_unlock_irq(&sem->wait_lock);
-
-                /* Block until there are no active lockers. */
-                do {
-                        if (signal_pending_state(state, current))
-                                goto out_nolock;
-
-                        schedule();
-                        lockevent_inc(rwsem_sleep_writer);
-                        set_current_state(state);
-                } while ((count = atomic_long_read(&sem->count)) & RWSEM_ACTIVE_MASK);
-
-                raw_spin_lock_irq(&sem->wait_lock);
-        }
-        __set_current_state(TASK_RUNNING);
-        list_del(&waiter.list);
-        raw_spin_unlock_irq(&sem->wait_lock);
-        lockevent_inc(rwsem_wlock);
-
-        return ret;
-
-out_nolock:
-        __set_current_state(TASK_RUNNING);
-        raw_spin_lock_irq(&sem->wait_lock);
-        list_del(&waiter.list);
-        if (list_empty(&sem->wait_list))
-                atomic_long_add(-RWSEM_WAITING_BIAS, &sem->count);
-        else
-                __rwsem_mark_wake(sem, RWSEM_WAKE_ANY, &wake_q);
-        raw_spin_unlock_irq(&sem->wait_lock);
-        wake_up_q(&wake_q);
-        lockevent_inc(rwsem_wlock_fail);
-
-        return ERR_PTR(-EINTR);
-}
-
-__visible struct rw_semaphore * __sched
-rwsem_down_write_failed(struct rw_semaphore *sem)
-{
-        return __rwsem_down_write_failed_common(sem, TASK_UNINTERRUPTIBLE);
-}
-EXPORT_SYMBOL(rwsem_down_write_failed);
-
-__visible struct rw_semaphore * __sched
-rwsem_down_write_failed_killable(struct rw_semaphore *sem)
-{
-        return __rwsem_down_write_failed_common(sem, TASK_KILLABLE);
-}
-EXPORT_SYMBOL(rwsem_down_write_failed_killable);
-
-/*
- * handle waking up a waiter on the semaphore
- * - up_read/up_write has decremented the active part of count if we come here
- */
-__visible
-struct rw_semaphore *rwsem_wake(struct rw_semaphore *sem)
-{
-        unsigned long flags;
-        DEFINE_WAKE_Q(wake_q);
-
-        /*
-        * __rwsem_down_write_failed_common(sem)
-        *   rwsem_optimistic_spin(sem)
-        *     osq_unlock(sem->osq)
-        *   ...
-        *   atomic_long_add_return(&sem->count)
-        *
-        *      - VS -
-        *
-        *              __up_write()
-        *                if (atomic_long_sub_return_release(&sem->count) < 0)
-        *                  rwsem_wake(sem)
-        *                    osq_is_locked(&sem->osq)
-        *
-        * And __up_write() must observe !osq_is_locked() when it observes the
-        * atomic_long_add_return() in order to not miss a wakeup.
-        *
-        * This boils down to:
-        *
-        * [S.rel] X = 1                [RmW] r0 = (Y += 0)
-        *         MB                         RMB
-        * [RmW]   Y += 1               [L]   r1 = X
-        *
-        * exists (r0=1 /\ r1=0)
-        */
-        smp_rmb();
-
-        /*
-         * If a spinner is present, it is not necessary to do the wakeup.
-         * Try to do wakeup only if the trylock succeeds to minimize
-         * spinlock contention which may introduce too much delay in the
-         * unlock operation.
-         *
-         *    spinning writer           up_write/up_read caller
-         *    ---------------           -----------------------
-         * [S]   osq_unlock()           [L]   osq
-         *       MB                           RMB
-         * [RmW] rwsem_try_write_lock() [RmW] spin_trylock(wait_lock)
-         *
-         * Here, it is important to make sure that there won't be a missed
-         * wakeup while the rwsem is free and the only spinning writer goes
-         * to sleep without taking the rwsem. Even when the spinning writer
-         * is just going to break out of the waiting loop, it will still do
-         * a trylock in rwsem_down_write_failed() before sleeping. IOW, if
-         * rwsem_has_spinner() is true, it will guarantee at least one
-         * trylock attempt on the rwsem later on.
-         */
-        if (rwsem_has_spinner(sem)) {
-                /*
-                 * The smp_rmb() here is to make sure that the spinner
-                 * state is consulted before reading the wait_lock.
-                 */
-                smp_rmb();
-                if (!raw_spin_trylock_irqsave(&sem->wait_lock, flags))
-                        return sem;
-                goto locked;
-        }
-        raw_spin_lock_irqsave(&sem->wait_lock, flags);
-locked:
-
-        if (!list_empty(&sem->wait_list))
-                __rwsem_mark_wake(sem, RWSEM_WAKE_ANY, &wake_q);
-
-        raw_spin_unlock_irqrestore(&sem->wait_lock, flags);
-        wake_up_q(&wake_q);
-
-        return sem;
-}
-EXPORT_SYMBOL(rwsem_wake);
-
-/*
- * downgrade a write lock into a read lock
- * - caller incremented waiting part of count and discovered it still negative
- * - just wake up any readers at the front of the queue
- */
-__visible
-struct rw_semaphore *rwsem_downgrade_wake(struct rw_semaphore *sem)
-{
-        unsigned long flags;
-        DEFINE_WAKE_Q(wake_q);
-
-        raw_spin_lock_irqsave(&sem->wait_lock, flags);
-
-        if (!list_empty(&sem->wait_list))
-                __rwsem_mark_wake(sem, RWSEM_WAKE_READ_OWNED, &wake_q);
-
-        raw_spin_unlock_irqrestore(&sem->wait_lock, flags);
-        wake_up_q(&wake_q);
-
-        return sem;
-}
-EXPORT_SYMBOL(rwsem_downgrade_wake);
diff --git a/kernel/locking/rwsem.c b/kernel/locking/rwsem.c
index ccbf18f560ff..37524a47f002 100644
--- a/kernel/locking/rwsem.c
+++ b/kernel/locking/rwsem.c
@@ -3,17 +3,1438 @@
  *
  * Written by David Howells (dhowells@redhat.com).
  * Derived from asm-i386/semaphore.h
+ *
+ * Writer lock-stealing by Alex Shi <alex.shi@intel.com>
+ * and Michel Lespinasse <walken@google.com>
+ *
+ * Optimistic spinning by Tim Chen <tim.c.chen@intel.com>
+ * and Davidlohr Bueso <davidlohr@hp.com>. Based on mutexes.
+ *
+ * Rwsem count bit fields re-definition and rwsem rearchitecture by
+ * Waiman Long <longman@redhat.com> and
+ * Peter Zijlstra <peterz@infradead.org>.
  */
 
 #include <linux/types.h>
 #include <linux/kernel.h>
 #include <linux/sched.h>
+#include <linux/sched/rt.h>
+#include <linux/sched/task.h>
 #include <linux/sched/debug.h>
+#include <linux/sched/wake_q.h>
+#include <linux/sched/signal.h>
+#include <linux/sched/clock.h>
 #include <linux/export.h>
 #include <linux/rwsem.h>
 #include <linux/atomic.h>
 
 #include "rwsem.h"
+#include "lock_events.h"
+
+/*
+ * The least significant 3 bits of the owner value has the following
+ * meanings when set.
+ *  - Bit 0: RWSEM_READER_OWNED - The rwsem is owned by readers
+ *  - Bit 1: RWSEM_RD_NONSPINNABLE - Readers cannot spin on this lock.
+ *  - Bit 2: RWSEM_WR_NONSPINNABLE - Writers cannot spin on this lock.
+ *
+ * When the rwsem is either owned by an anonymous writer, or it is
+ * reader-owned, but a spinning writer has timed out, both nonspinnable
+ * bits will be set to disable optimistic spinning by readers and writers.
+ * In the later case, the last unlocking reader should then check the
+ * writer nonspinnable bit and clear it only to give writers preference
+ * to acquire the lock via optimistic spinning, but not readers. Similar
+ * action is also done in the reader slowpath.
+
+ * When a writer acquires a rwsem, it puts its task_struct pointer
+ * into the owner field. It is cleared after an unlock.
+ *
+ * When a reader acquires a rwsem, it will also puts its task_struct
+ * pointer into the owner field with the RWSEM_READER_OWNED bit set.
+ * On unlock, the owner field will largely be left untouched. So
+ * for a free or reader-owned rwsem, the owner value may contain
+ * information about the last reader that acquires the rwsem.
+ *
+ * That information may be helpful in debugging cases where the system
+ * seems to hang on a reader owned rwsem especially if only one reader
+ * is involved. Ideally we would like to track all the readers that own
+ * a rwsem, but the overhead is simply too big.
+ *
+ * Reader optimistic spinning is helpful when the reader critical section
+ * is short and there aren't that many readers around. It makes readers
+ * relatively more preferred than writers. When a writer times out spinning
+ * on a reader-owned lock and set the nospinnable bits, there are two main
+ * reasons for that.
+ *
+ *  1) The reader critical section is long, perhaps the task sleeps after
+ *     acquiring the read lock.
+ *  2) There are just too many readers contending the lock causing it to
+ *     take a while to service all of them.
+ *
+ * In the former case, long reader critical section will impede the progress
+ * of writers which is usually more important for system performance. In
+ * the later case, reader optimistic spinning tends to make the reader
+ * groups that contain readers that acquire the lock together smaller
+ * leading to more of them. That may hurt performance in some cases. In
+ * other words, the setting of nonspinnable bits indicates that reader
+ * optimistic spinning may not be helpful for those workloads that cause
+ * it.
+ *
+ * Therefore, any writers that had observed the setting of the writer
+ * nonspinnable bit for a given rwsem after they fail to acquire the lock
+ * via optimistic spinning will set the reader nonspinnable bit once they
+ * acquire the write lock. Similarly, readers that observe the setting
+ * of reader nonspinnable bit at slowpath entry will set the reader
+ * nonspinnable bits when they acquire the read lock via the wakeup path.
+ *
+ * Once the reader nonspinnable bit is on, it will only be reset when
+ * a writer is able to acquire the rwsem in the fast path or somehow a
+ * reader or writer in the slowpath doesn't observe the nonspinable bit.
+ *
+ * This is to discourage reader optmistic spinning on that particular
+ * rwsem and make writers more preferred. This adaptive disabling of reader
+ * optimistic spinning will alleviate the negative side effect of this
+ * feature.
+ */
+#define RWSEM_READER_OWNED      (1UL << 0)
+#define RWSEM_RD_NONSPINNABLE   (1UL << 1)
+#define RWSEM_WR_NONSPINNABLE   (1UL << 2)
+#define RWSEM_NONSPINNABLE      (RWSEM_RD_NONSPINNABLE | RWSEM_WR_NONSPINNABLE)
+#define RWSEM_OWNER_FLAGS_MASK  (RWSEM_READER_OWNED | RWSEM_NONSPINNABLE)
+
+#ifdef CONFIG_DEBUG_RWSEMS
+# define DEBUG_RWSEMS_WARN_ON(c, sem)   do {                    \
+        if (!debug_locks_silent &&                              \
+            WARN_ONCE(c, "DEBUG_RWSEMS_WARN_ON(%s): count = 0x%lx, owner = 0x%lx, curr 0x%lx, list %sempty\n",\
+                #c, atomic_long_read(&(sem)->count),            \
+                atomic_long_read(&(sem)->owner), (long)current, \
+                list_empty(&(sem)->wait_list) ? "" : "not "))   \
+                        debug_locks_off();                      \
+        } while (0)
+#else
+# define DEBUG_RWSEMS_WARN_ON(c, sem)
+#endif
+
+/*
+ * On 64-bit architectures, the bit definitions of the count are:
+ *
+ * Bit  0    - writer locked bit
+ * Bit  1    - waiters present bit
+ * Bit  2    - lock handoff bit
+ * Bits 3-7  - reserved
+ * Bits 8-62 - 55-bit reader count
+ * Bit  63   - read fail bit
+ *
+ * On 32-bit architectures, the bit definitions of the count are:
+ *
+ * Bit  0    - writer locked bit
+ * Bit  1    - waiters present bit
+ * Bit  2    - lock handoff bit
+ * Bits 3-7  - reserved
+ * Bits 8-30 - 23-bit reader count
+ * Bit  31   - read fail bit
+ *
+ * It is not likely that the most significant bit (read fail bit) will ever
+ * be set. This guard bit is still checked anyway in the down_read() fastpath
+ * just in case we need to use up more of the reader bits for other purpose
+ * in the future.
+ *
+ * atomic_long_fetch_add() is used to obtain reader lock, whereas
+ * atomic_long_cmpxchg() will be used to obtain writer lock.
+ *
+ * There are three places where the lock handoff bit may be set or cleared.
+ * 1) rwsem_mark_wake() for readers.
+ * 2) rwsem_try_write_lock() for writers.
+ * 3) Error path of rwsem_down_write_slowpath().
+ *
+ * For all the above cases, wait_lock will be held. A writer must also
+ * be the first one in the wait_list to be eligible for setting the handoff
+ * bit. So concurrent setting/clearing of handoff bit is not possible.
+ */
+#define RWSEM_WRITER_LOCKED     (1UL << 0)
+#define RWSEM_FLAG_WAITERS      (1UL << 1)
+#define RWSEM_FLAG_HANDOFF      (1UL << 2)
+#define RWSEM_FLAG_READFAIL     (1UL << (BITS_PER_LONG - 1))
+
+#define RWSEM_READER_SHIFT      8
+#define RWSEM_READER_BIAS       (1UL << RWSEM_READER_SHIFT)
+#define RWSEM_READER_MASK       (~(RWSEM_READER_BIAS - 1))
+#define RWSEM_WRITER_MASK       RWSEM_WRITER_LOCKED
+#define RWSEM_LOCK_MASK         (RWSEM_WRITER_MASK|RWSEM_READER_MASK)
+#define RWSEM_READ_FAILED_MASK  (RWSEM_WRITER_MASK|RWSEM_FLAG_WAITERS|\
+                                 RWSEM_FLAG_HANDOFF|RWSEM_FLAG_READFAIL)
+
+/*
+ * All writes to owner are protected by WRITE_ONCE() to make sure that
+ * store tearing can't happen as optimistic spinners may read and use
+ * the owner value concurrently without lock. Read from owner, however,
+ * may not need READ_ONCE() as long as the pointer value is only used
+ * for comparison and isn't being dereferenced.
+ */
+static inline void rwsem_set_owner(struct rw_semaphore *sem)
+{
+        atomic_long_set(&sem->owner, (long)current);
+}
+
+static inline void rwsem_clear_owner(struct rw_semaphore *sem)
+{
+        atomic_long_set(&sem->owner, 0);
+}
+
+/*
+ * Test the flags in the owner field.
+ */
+static inline bool rwsem_test_oflags(struct rw_semaphore *sem, long flags)
+{
+        return atomic_long_read(&sem->owner) & flags;
+}
+
+/*
+ * The task_struct pointer of the last owning reader will be left in
+ * the owner field.
+ *
+ * Note that the owner value just indicates the task has owned the rwsem
+ * previously, it may not be the real owner or one of the real owners
+ * anymore when that field is examined, so take it with a grain of salt.
+ *
+ * The reader non-spinnable bit is preserved.
+ */
+static inline void __rwsem_set_reader_owned(struct rw_semaphore *sem,
+                                            struct task_struct *owner)
+{
+        unsigned long val = (unsigned long)owner | RWSEM_READER_OWNED |
+                (atomic_long_read(&sem->owner) & RWSEM_RD_NONSPINNABLE);
+
+        atomic_long_set(&sem->owner, val);
+}
+
+static inline void rwsem_set_reader_owned(struct rw_semaphore *sem)
+{
+        __rwsem_set_reader_owned(sem, current);
+}
+
+/*
+ * Return true if the rwsem is owned by a reader.
+ */
+static inline bool is_rwsem_reader_owned(struct rw_semaphore *sem)
+{
+#ifdef CONFIG_DEBUG_RWSEMS
+        /*
+         * Check the count to see if it is write-locked.
+         */
+        long count = atomic_long_read(&sem->count);
+
+        if (count & RWSEM_WRITER_MASK)
+                return false;
+#endif
+        return rwsem_test_oflags(sem, RWSEM_READER_OWNED);
+}
+
+#ifdef CONFIG_DEBUG_RWSEMS
+/*
+ * With CONFIG_DEBUG_RWSEMS configured, it will make sure that if there
+ * is a task pointer in owner of a reader-owned rwsem, it will be the
+ * real owner or one of the real owners. The only exception is when the
+ * unlock is done by up_read_non_owner().
+ */
+static inline void rwsem_clear_reader_owned(struct rw_semaphore *sem)
+{
+        unsigned long val = atomic_long_read(&sem->owner);
+
+        while ((val & ~RWSEM_OWNER_FLAGS_MASK) == (unsigned long)current) {
+                if (atomic_long_try_cmpxchg(&sem->owner, &val,
+                                            val & RWSEM_OWNER_FLAGS_MASK))
+                        return;
+        }
+}
+#else
+static inline void rwsem_clear_reader_owned(struct rw_semaphore *sem)
+{
+}
+#endif
+
+/*
+ * Set the RWSEM_NONSPINNABLE bits if the RWSEM_READER_OWNED flag
+ * remains set. Otherwise, the operation will be aborted.
+ */
+static inline void rwsem_set_nonspinnable(struct rw_semaphore *sem)
+{
+        unsigned long owner = atomic_long_read(&sem->owner);
+
+        do {
+                if (!(owner & RWSEM_READER_OWNED))
+                        break;
+                if (owner & RWSEM_NONSPINNABLE)
+                        break;
+        } while (!atomic_long_try_cmpxchg(&sem->owner, &owner,
+                                          owner | RWSEM_NONSPINNABLE));
+}
+
+static inline bool rwsem_read_trylock(struct rw_semaphore *sem)
+{
+        long cnt = atomic_long_add_return_acquire(RWSEM_READER_BIAS, &sem->count);
+        if (WARN_ON_ONCE(cnt < 0))
+                rwsem_set_nonspinnable(sem);
+        return !(cnt & RWSEM_READ_FAILED_MASK);
+}
+
+/*
+ * Return just the real task structure pointer of the owner
+ */
+static inline struct task_struct *rwsem_owner(struct rw_semaphore *sem)
+{
+        return (struct task_struct *)
+                (atomic_long_read(&sem->owner) & ~RWSEM_OWNER_FLAGS_MASK);
+}
+
+/*
+ * Return the real task structure pointer of the owner and the embedded
+ * flags in the owner. pflags must be non-NULL.
+ */
+static inline struct task_struct *
+rwsem_owner_flags(struct rw_semaphore *sem, unsigned long *pflags)
+{
+        unsigned long owner = atomic_long_read(&sem->owner);
+
+        *pflags = owner & RWSEM_OWNER_FLAGS_MASK;
+        return (struct task_struct *)(owner & ~RWSEM_OWNER_FLAGS_MASK);
+}
+
+/*
+ * Guide to the rw_semaphore's count field.
+ *
+ * When the RWSEM_WRITER_LOCKED bit in count is set, the lock is owned
+ * by a writer.
+ *
+ * The lock is owned by readers when
+ * (1) the RWSEM_WRITER_LOCKED isn't set in count,
+ * (2) some of the reader bits are set in count, and
+ * (3) the owner field has RWSEM_READ_OWNED bit set.
+ *
+ * Having some reader bits set is not enough to guarantee a readers owned
+ * lock as the readers may be in the process of backing out from the count
+ * and a writer has just released the lock. So another writer may steal
+ * the lock immediately after that.
+ */
+
+/*
+ * Initialize an rwsem:
+ */
+void __init_rwsem(struct rw_semaphore *sem, const char *name,
+                  struct lock_class_key *key)
+{
+#ifdef CONFIG_DEBUG_LOCK_ALLOC
+        /*
+         * Make sure we are not reinitializing a held semaphore:
+         */
+        debug_check_no_locks_freed((void *)sem, sizeof(*sem));
+        lockdep_init_map(&sem->dep_map, name, key, 0);
+#endif
+        atomic_long_set(&sem->count, RWSEM_UNLOCKED_VALUE);
+        raw_spin_lock_init(&sem->wait_lock);
+        INIT_LIST_HEAD(&sem->wait_list);
+        atomic_long_set(&sem->owner, 0L);
+#ifdef CONFIG_RWSEM_SPIN_ON_OWNER
+        osq_lock_init(&sem->osq);
+#endif
+}
+EXPORT_SYMBOL(__init_rwsem);
+
+enum rwsem_waiter_type {
+        RWSEM_WAITING_FOR_WRITE,
+        RWSEM_WAITING_FOR_READ
+};
+
+struct rwsem_waiter {
+        struct list_head list;
+        struct task_struct *task;
+        enum rwsem_waiter_type type;
+        unsigned long timeout;
+        unsigned long last_rowner;
+};
+#define rwsem_first_waiter(sem) \
+        list_first_entry(&sem->wait_list, struct rwsem_waiter, list)
+
+enum rwsem_wake_type {
+        RWSEM_WAKE_ANY,         /* Wake whatever's at head of wait list */
+        RWSEM_WAKE_READERS,     /* Wake readers only */
+        RWSEM_WAKE_READ_OWNED   /* Waker thread holds the read lock */
+};
+
+enum writer_wait_state {
+        WRITER_NOT_FIRST,       /* Writer is not first in wait list */
+        WRITER_FIRST,           /* Writer is first in wait list     */
+        WRITER_HANDOFF          /* Writer is first & handoff needed */
+};
+
+/*
+ * The typical HZ value is either 250 or 1000. So set the minimum waiting
+ * time to at least 4ms or 1 jiffy (if it is higher than 4ms) in the wait
+ * queue before initiating the handoff protocol.
+ */
+#define RWSEM_WAIT_TIMEOUT      DIV_ROUND_UP(HZ, 250)
+
+/*
+ * Magic number to batch-wakeup waiting readers, even when writers are
+ * also present in the queue. This both limits the amount of work the
+ * waking thread must do and also prevents any potential counter overflow,
+ * however unlikely.
+ */
+#define MAX_READERS_WAKEUP      0x100
+
+/*
+ * handle the lock release when processes blocked on it that can now run
+ * - if we come here from up_xxxx(), then the RWSEM_FLAG_WAITERS bit must
+ *   have been set.
+ * - there must be someone on the queue
+ * - the wait_lock must be held by the caller
+ * - tasks are marked for wakeup, the caller must later invoke wake_up_q()
+ *   to actually wakeup the blocked task(s) and drop the reference count,
+ *   preferably when the wait_lock is released
+ * - woken process blocks are discarded from the list after having task zeroed
+ * - writers are only marked woken if downgrading is false
+ */
+static void rwsem_mark_wake(struct rw_semaphore *sem,
+                            enum rwsem_wake_type wake_type,
+                            struct wake_q_head *wake_q)
+{
+        struct rwsem_waiter *waiter, *tmp;
+        long oldcount, woken = 0, adjustment = 0;
+        struct list_head wlist;
+
+        lockdep_assert_held(&sem->wait_lock);
+
+        /*
+         * Take a peek at the queue head waiter such that we can determine
+         * the wakeup(s) to perform.
+         */
+        waiter = rwsem_first_waiter(sem);
+
+        if (waiter->type == RWSEM_WAITING_FOR_WRITE) {
+                if (wake_type == RWSEM_WAKE_ANY) {
+                        /*
+                         * Mark writer at the front of the queue for wakeup.
+                         * Until the task is actually later awoken later by
+                         * the caller, other writers are able to steal it.
+                         * Readers, on the other hand, will block as they
+                         * will notice the queued writer.
+                         */
+                        wake_q_add(wake_q, waiter->task);
+                        lockevent_inc(rwsem_wake_writer);
+                }
+
+                return;
+        }
+
+        /*
+         * No reader wakeup if there are too many of them already.
+         */
+        if (unlikely(atomic_long_read(&sem->count) < 0))
+                return;
+
+        /*
+         * Writers might steal the lock before we grant it to the next reader.
+         * We prefer to do the first reader grant before counting readers
+         * so we can bail out early if a writer stole the lock.
+         */
+        if (wake_type != RWSEM_WAKE_READ_OWNED) {
+                struct task_struct *owner;
+
+                adjustment = RWSEM_READER_BIAS;
+                oldcount = atomic_long_fetch_add(adjustment, &sem->count);
+                if (unlikely(oldcount & RWSEM_WRITER_MASK)) {
+                        /*
+                         * When we've been waiting "too" long (for writers
+                         * to give up the lock), request a HANDOFF to
+                         * force the issue.
+                         */
+                        if (!(oldcount & RWSEM_FLAG_HANDOFF) &&
+                            time_after(jiffies, waiter->timeout)) {
+                                adjustment -= RWSEM_FLAG_HANDOFF;
+                                lockevent_inc(rwsem_rlock_handoff);
+                        }
+
+                        atomic_long_add(-adjustment, &sem->count);
+                        return;
+                }
+                /*
+                 * Set it to reader-owned to give spinners an early
+                 * indication that readers now have the lock.
+                 * The reader nonspinnable bit seen at slowpath entry of
+                 * the reader is copied over.
+                 */
+                owner = waiter->task;
+                if (waiter->last_rowner & RWSEM_RD_NONSPINNABLE) {
+                        owner = (void *)((unsigned long)owner | RWSEM_RD_NONSPINNABLE);
+                        lockevent_inc(rwsem_opt_norspin);
+                }
+                __rwsem_set_reader_owned(sem, owner);
+        }
+
+        /*
+         * Grant up to MAX_READERS_WAKEUP read locks to all the readers in the
+         * queue. We know that the woken will be at least 1 as we accounted
+         * for above. Note we increment the 'active part' of the count by the
+         * number of readers before waking any processes up.
+         *
+         * This is an adaptation of the phase-fair R/W locks where at the
+         * reader phase (first waiter is a reader), all readers are eligible
+         * to acquire the lock at the same time irrespective of their order
+         * in the queue. The writers acquire the lock according to their
+         * order in the queue.
+         *
+         * We have to do wakeup in 2 passes to prevent the possibility that
+         * the reader count may be decremented before it is incremented. It
+         * is because the to-be-woken waiter may not have slept yet. So it
+         * may see waiter->task got cleared, finish its critical section and
+         * do an unlock before the reader count increment.
+         *
+         * 1) Collect the read-waiters in a separate list, count them and
+         *    fully increment the reader count in rwsem.
+         * 2) For each waiters in the new list, clear waiter->task and
+         *    put them into wake_q to be woken up later.
+         */
+        INIT_LIST_HEAD(&wlist);
+        list_for_each_entry_safe(waiter, tmp, &sem->wait_list, list) {
+                if (waiter->type == RWSEM_WAITING_FOR_WRITE)
+                        continue;
+
+                woken++;
+                list_move_tail(&waiter->list, &wlist);
+
+                /*
+                 * Limit # of readers that can be woken up per wakeup call.
+                 */
+                if (woken >= MAX_READERS_WAKEUP)
+                        break;
+        }
+
+        adjustment = woken * RWSEM_READER_BIAS - adjustment;
+        lockevent_cond_inc(rwsem_wake_reader, woken);
+        if (list_empty(&sem->wait_list)) {
+                /* hit end of list above */
+                adjustment -= RWSEM_FLAG_WAITERS;
+        }
+
+        /*
+         * When we've woken a reader, we no longer need to force writers
+         * to give up the lock and we can clear HANDOFF.
+         */
+        if (woken && (atomic_long_read(&sem->count) & RWSEM_FLAG_HANDOFF))
+                adjustment -= RWSEM_FLAG_HANDOFF;
+
+        if (adjustment)
+                atomic_long_add(adjustment, &sem->count);
+
+        /* 2nd pass */
+        list_for_each_entry_safe(waiter, tmp, &wlist, list) {
+                struct task_struct *tsk;
+
+                tsk = waiter->task;
+                get_task_struct(tsk);
+
+                /*
+                 * Ensure calling get_task_struct() before setting the reader
+                 * waiter to nil such that rwsem_down_read_slowpath() cannot
+                 * race with do_exit() by always holding a reference count
+                 * to the task to wakeup.
+                 */
+                smp_store_release(&waiter->task, NULL);
+                /*
+                 * Ensure issuing the wakeup (either by us or someone else)
+                 * after setting the reader waiter to nil.
+                 */
+                wake_q_add_safe(wake_q, tsk);
+        }
+}
+
+/*
+ * This function must be called with the sem->wait_lock held to prevent
+ * race conditions between checking the rwsem wait list and setting the
+ * sem->count accordingly.
+ *
+ * If wstate is WRITER_HANDOFF, it will make sure that either the handoff
+ * bit is set or the lock is acquired with handoff bit cleared.
+ */
+static inline bool rwsem_try_write_lock(struct rw_semaphore *sem,
+                                        enum writer_wait_state wstate)
+{
+        long count, new;
+
+        lockdep_assert_held(&sem->wait_lock);
+
+        count = atomic_long_read(&sem->count);
+        do {
+                bool has_handoff = !!(count & RWSEM_FLAG_HANDOFF);
+
+                if (has_handoff && wstate == WRITER_NOT_FIRST)
+                        return false;
+
+                new = count;
+
+                if (count & RWSEM_LOCK_MASK) {
+                        if (has_handoff || (wstate != WRITER_HANDOFF))
+                                return false;
+
+                        new |= RWSEM_FLAG_HANDOFF;
+                } else {
+                        new |= RWSEM_WRITER_LOCKED;
+                        new &= ~RWSEM_FLAG_HANDOFF;
+
+                        if (list_is_singular(&sem->wait_list))
+                                new &= ~RWSEM_FLAG_WAITERS;
+                }
+        } while (!atomic_long_try_cmpxchg_acquire(&sem->count, &count, new));
+
+        /*
+         * We have either acquired the lock with handoff bit cleared or
+         * set the handoff bit.
+         */
+        if (new & RWSEM_FLAG_HANDOFF)
+                return false;
+
+        rwsem_set_owner(sem);
+        return true;
+}
+
+#ifdef CONFIG_RWSEM_SPIN_ON_OWNER
+/*
+ * Try to acquire read lock before the reader is put on wait queue.
+ * Lock acquisition isn't allowed if the rwsem is locked or a writer handoff
+ * is ongoing.
+ */
+static inline bool rwsem_try_read_lock_unqueued(struct rw_semaphore *sem)
+{
+        long count = atomic_long_read(&sem->count);
+
+        if (count & (RWSEM_WRITER_MASK | RWSEM_FLAG_HANDOFF))
+                return false;
+
+        count = atomic_long_fetch_add_acquire(RWSEM_READER_BIAS, &sem->count);
+        if (!(count & (RWSEM_WRITER_MASK | RWSEM_FLAG_HANDOFF))) {
+                rwsem_set_reader_owned(sem);
+                lockevent_inc(rwsem_opt_rlock);
+                return true;
+        }
+
+        /* Back out the change */
+        atomic_long_add(-RWSEM_READER_BIAS, &sem->count);
+        return false;
+}
+
+/*
+ * Try to acquire write lock before the writer has been put on wait queue.
+ */
+static inline bool rwsem_try_write_lock_unqueued(struct rw_semaphore *sem)
+{
+        long count = atomic_long_read(&sem->count);
+
+        while (!(count & (RWSEM_LOCK_MASK|RWSEM_FLAG_HANDOFF))) {
+                if (atomic_long_try_cmpxchg_acquire(&sem->count, &count,
+                                        count | RWSEM_WRITER_LOCKED)) {
+                        rwsem_set_owner(sem);
+                        lockevent_inc(rwsem_opt_wlock);
+                        return true;
+                }
+        }
+        return false;
+}
+
+static inline bool owner_on_cpu(struct task_struct *owner)
+{
+        /*
+         * As lock holder preemption issue, we both skip spinning if
+         * task is not on cpu or its cpu is preempted
+         */
+        return owner->on_cpu && !vcpu_is_preempted(task_cpu(owner));
+}
+
+static inline bool rwsem_can_spin_on_owner(struct rw_semaphore *sem,
+                                           unsigned long nonspinnable)
+{
+        struct task_struct *owner;
+        unsigned long flags;
+        bool ret = true;
+
+        BUILD_BUG_ON(!(RWSEM_OWNER_UNKNOWN & RWSEM_NONSPINNABLE));
+
+        if (need_resched()) {
+                lockevent_inc(rwsem_opt_fail);
+                return false;
+        }
+
+        preempt_disable();
+        rcu_read_lock();
+        owner = rwsem_owner_flags(sem, &flags);
+        if ((flags & nonspinnable) || (owner && !owner_on_cpu(owner)))
+                ret = false;
+        rcu_read_unlock();
+        preempt_enable();
+
+        lockevent_cond_inc(rwsem_opt_fail, !ret);
+        return ret;
+}
+
+/*
+ * The rwsem_spin_on_owner() function returns the folowing 4 values
+ * depending on the lock owner state.
+ *   OWNER_NULL  : owner is currently NULL
+ *   OWNER_WRITER: when owner changes and is a writer
+ *   OWNER_READER: when owner changes and the new owner may be a reader.
+ *   OWNER_NONSPINNABLE:
+ *                 when optimistic spinning has to stop because either the
+ *                 owner stops running, is unknown, or its timeslice has
+ *                 been used up.
+ */
+enum owner_state {
+        OWNER_NULL              = 1 << 0,
+        OWNER_WRITER            = 1 << 1,
+        OWNER_READER            = 1 << 2,
+        OWNER_NONSPINNABLE      = 1 << 3,
+};
+#define OWNER_SPINNABLE         (OWNER_NULL | OWNER_WRITER | OWNER_READER)
+
+static inline enum owner_state
+rwsem_owner_state(struct task_struct *owner, unsigned long flags, unsigned long nonspinnable)
+{
+        if (flags & nonspinnable)
+                return OWNER_NONSPINNABLE;
+
+        if (flags & RWSEM_READER_OWNED)
+                return OWNER_READER;
+
+        return owner ? OWNER_WRITER : OWNER_NULL;
+}
+
+static noinline enum owner_state
+rwsem_spin_on_owner(struct rw_semaphore *sem, unsigned long nonspinnable)
+{
+        struct task_struct *new, *owner;
+        unsigned long flags, new_flags;
+        enum owner_state state;
+
+        owner = rwsem_owner_flags(sem, &flags);
+        state = rwsem_owner_state(owner, flags, nonspinnable);
+        if (state != OWNER_WRITER)
+                return state;
+
+        rcu_read_lock();
+        for (;;) {
+                if (atomic_long_read(&sem->count) & RWSEM_FLAG_HANDOFF) {
+                        state = OWNER_NONSPINNABLE;
+                        break;
+                }
+
+                new = rwsem_owner_flags(sem, &new_flags);
+                if ((new != owner) || (new_flags != flags)) {
+                        state = rwsem_owner_state(new, new_flags, nonspinnable);
+                        break;
+                }
+
+                /*
+                 * Ensure we emit the owner->on_cpu, dereference _after_
+                 * checking sem->owner still matches owner, if that fails,
+                 * owner might point to free()d memory, if it still matches,
+                 * the rcu_read_lock() ensures the memory stays valid.
+                 */
+                barrier();
+
+                if (need_resched() || !owner_on_cpu(owner)) {
+                        state = OWNER_NONSPINNABLE;
+                        break;
+                }
+
+                cpu_relax();
+        }
+        rcu_read_unlock();
+
+        return state;
+}
+
+/*
+ * Calculate reader-owned rwsem spinning threshold for writer
+ *
+ * The more readers own the rwsem, the longer it will take for them to
+ * wind down and free the rwsem. So the empirical formula used to
+ * determine the actual spinning time limit here is:
+ *
+ *   Spinning threshold = (10 + nr_readers/2)us
+ *
+ * The limit is capped to a maximum of 25us (30 readers). This is just
+ * a heuristic and is subjected to change in the future.
+ */
+static inline u64 rwsem_rspin_threshold(struct rw_semaphore *sem)
+{
+        long count = atomic_long_read(&sem->count);
+        int readers = count >> RWSEM_READER_SHIFT;
+        u64 delta;
+
+        if (readers > 30)
+                readers = 30;
+        delta = (20 + readers) * NSEC_PER_USEC / 2;
+
+        return sched_clock() + delta;
+}
+
+static bool rwsem_optimistic_spin(struct rw_semaphore *sem, bool wlock)
+{
+        bool taken = false;
+        int prev_owner_state = OWNER_NULL;
+        int loop = 0;
+        u64 rspin_threshold = 0;
+        unsigned long nonspinnable = wlock ? RWSEM_WR_NONSPINNABLE
+                                           : RWSEM_RD_NONSPINNABLE;
+
+        preempt_disable();
+
+        /* sem->wait_lock should not be held when doing optimistic spinning */
+        if (!osq_lock(&sem->osq))
+                goto done;
+
+        /*
+         * Optimistically spin on the owner field and attempt to acquire the
+         * lock whenever the owner changes. Spinning will be stopped when:
+         *  1) the owning writer isn't running; or
+         *  2) readers own the lock and spinning time has exceeded limit.
+         */
+        for (;;) {
+                enum owner_state owner_state;
+
+                owner_state = rwsem_spin_on_owner(sem, nonspinnable);
+                if (!(owner_state & OWNER_SPINNABLE))
+                        break;
+
+                /*
+                 * Try to acquire the lock
+                 */
+                taken = wlock ? rwsem_try_write_lock_unqueued(sem)
+                              : rwsem_try_read_lock_unqueued(sem);
+
+                if (taken)
+                        break;
+
+                /*
+                 * Time-based reader-owned rwsem optimistic spinning
+                 */
+                if (wlock && (owner_state == OWNER_READER)) {
+                        /*
+                         * Re-initialize rspin_threshold every time when
+                         * the owner state changes from non-reader to reader.
+                         * This allows a writer to steal the lock in between
+                         * 2 reader phases and have the threshold reset at
+                         * the beginning of the 2nd reader phase.
+                         */
+                        if (prev_owner_state != OWNER_READER) {
+                                if (rwsem_test_oflags(sem, nonspinnable))
+                                        break;
+                                rspin_threshold = rwsem_rspin_threshold(sem);
+                                loop = 0;
+                        }
+
+                        /*
+                         * Check time threshold once every 16 iterations to
+                         * avoid calling sched_clock() too frequently so
+                         * as to reduce the average latency between the times
+                         * when the lock becomes free and when the spinner
+                         * is ready to do a trylock.
+                         */
+                        else if (!(++loop & 0xf) && (sched_clock() > rspin_threshold)) {
+                                rwsem_set_nonspinnable(sem);
+                                lockevent_inc(rwsem_opt_nospin);
+                                break;
+                        }
+                }
+
+                /*
+                 * An RT task cannot do optimistic spinning if it cannot
+                 * be sure the lock holder is running or live-lock may
+                 * happen if the current task and the lock holder happen
+                 * to run in the same CPU. However, aborting optimistic
+                 * spinning while a NULL owner is detected may miss some
+                 * opportunity where spinning can continue without causing
+                 * problem.
+                 *
+                 * There are 2 possible cases where an RT task may be able
+                 * to continue spinning.
+                 *
+                 * 1) The lock owner is in the process of releasing the
+                 *    lock, sem->owner is cleared but the lock has not
+                 *    been released yet.
+                 * 2) The lock was free and owner cleared, but another
+                 *    task just comes in and acquire the lock before
+                 *    we try to get it. The new owner may be a spinnable
+                 *    writer.
+                 *
+                 * To take advantage of two scenarios listed agove, the RT
+                 * task is made to retry one more time to see if it can
+                 * acquire the lock or continue spinning on the new owning
+                 * writer. Of course, if the time lag is long enough or the
+                 * new owner is not a writer or spinnable, the RT task will
+                 * quit spinning.
+                 *
+                 * If the owner is a writer, the need_resched() check is
+                 * done inside rwsem_spin_on_owner(). If the owner is not
+                 * a writer, need_resched() check needs to be done here.
+                 */
+                if (owner_state != OWNER_WRITER) {
+                        if (need_resched())
+                                break;
+                        if (rt_task(current) &&
+                           (prev_owner_state != OWNER_WRITER))
+                                break;
+                }
+                prev_owner_state = owner_state;
+
+                /*
+                 * The cpu_relax() call is a compiler barrier which forces
+                 * everything in this loop to be re-loaded. We don't need
+                 * memory barriers as we'll eventually observe the right
+                 * values at the cost of a few extra spins.
+                 */
+                cpu_relax();
+        }
+        osq_unlock(&sem->osq);
+done:
+        preempt_enable();
+        lockevent_cond_inc(rwsem_opt_fail, !taken);
+        return taken;
+}
+
+/*
+ * Clear the owner's RWSEM_WR_NONSPINNABLE bit if it is set. This should
+ * only be called when the reader count reaches 0.
+ *
+ * This give writers better chance to acquire the rwsem first before
+ * readers when the rwsem was being held by readers for a relatively long
+ * period of time. Race can happen that an optimistic spinner may have
+ * just stolen the rwsem and set the owner, but just clearing the
+ * RWSEM_WR_NONSPINNABLE bit will do no harm anyway.
+ */
+static inline void clear_wr_nonspinnable(struct rw_semaphore *sem)
+{
+        if (rwsem_test_oflags(sem, RWSEM_WR_NONSPINNABLE))
+                atomic_long_andnot(RWSEM_WR_NONSPINNABLE, &sem->owner);
+}
+
+/*
+ * This function is called when the reader fails to acquire the lock via
+ * optimistic spinning. In this case we will still attempt to do a trylock
+ * when comparing the rwsem state right now with the state when entering
+ * the slowpath indicates that the reader is still in a valid reader phase.
+ * This happens when the following conditions are true:
+ *
+ * 1) The lock is currently reader owned, and
+ * 2) The lock is previously not reader-owned or the last read owner changes.
+ *
+ * In the former case, we have transitioned from a writer phase to a
+ * reader-phase while spinning. In the latter case, it means the reader
+ * phase hasn't ended when we entered the optimistic spinning loop. In
+ * both cases, the reader is eligible to acquire the lock. This is the
+ * secondary path where a read lock is acquired optimistically.
+ *
+ * The reader non-spinnable bit wasn't set at time of entry or it will
+ * not be here at all.
+ */
+static inline bool rwsem_reader_phase_trylock(struct rw_semaphore *sem,
+                                              unsigned long last_rowner)
+{
+        unsigned long owner = atomic_long_read(&sem->owner);
+
+        if (!(owner & RWSEM_READER_OWNED))
+                return false;
+
+        if (((owner ^ last_rowner) & ~RWSEM_OWNER_FLAGS_MASK) &&
+            rwsem_try_read_lock_unqueued(sem)) {
+                lockevent_inc(rwsem_opt_rlock2);
+                lockevent_add(rwsem_opt_fail, -1);
+                return true;
+        }
+        return false;
+}
+#else
+static inline bool rwsem_can_spin_on_owner(struct rw_semaphore *sem,
+                                           unsigned long nonspinnable)
+{
+        return false;
+}
+
+static inline bool rwsem_optimistic_spin(struct rw_semaphore *sem, bool wlock)
+{
+        return false;
+}
+
+static inline void clear_wr_nonspinnable(struct rw_semaphore *sem) { }
+
+static inline bool rwsem_reader_phase_trylock(struct rw_semaphore *sem,
+                                              unsigned long last_rowner)
+{
+        return false;
+}
+#endif
+
+/*
+ * Wait for the read lock to be granted
+ */
+static struct rw_semaphore __sched *
+rwsem_down_read_slowpath(struct rw_semaphore *sem, int state)
+{
+        long count, adjustment = -RWSEM_READER_BIAS;
+        struct rwsem_waiter waiter;
+        DEFINE_WAKE_Q(wake_q);
+        bool wake = false;
+
+        /*
+         * Save the current read-owner of rwsem, if available, and the
+         * reader nonspinnable bit.
+         */
+        waiter.last_rowner = atomic_long_read(&sem->owner);
+        if (!(waiter.last_rowner & RWSEM_READER_OWNED))
+                waiter.last_rowner &= RWSEM_RD_NONSPINNABLE;
+
+        if (!rwsem_can_spin_on_owner(sem, RWSEM_RD_NONSPINNABLE))
+                goto queue;
+
+        /*
+         * Undo read bias from down_read() and do optimistic spinning.
+         */
+        atomic_long_add(-RWSEM_READER_BIAS, &sem->count);
+        adjustment = 0;
+        if (rwsem_optimistic_spin(sem, false)) {
+                /*
+                 * Wake up other readers in the wait list if the front
+                 * waiter is a reader.
+                 */
+                if ((atomic_long_read(&sem->count) & RWSEM_FLAG_WAITERS)) {
+                        raw_spin_lock_irq(&sem->wait_lock);
+                        if (!list_empty(&sem->wait_list))
+                                rwsem_mark_wake(sem, RWSEM_WAKE_READ_OWNED,
+                                                &wake_q);
+                        raw_spin_unlock_irq(&sem->wait_lock);
+                        wake_up_q(&wake_q);
+                }
+                return sem;
+        } else if (rwsem_reader_phase_trylock(sem, waiter.last_rowner)) {
+                return sem;
+        }
+
+queue:
+        waiter.task = current;
+        waiter.type = RWSEM_WAITING_FOR_READ;
+        waiter.timeout = jiffies + RWSEM_WAIT_TIMEOUT;
+
+        raw_spin_lock_irq(&sem->wait_lock);
+        if (list_empty(&sem->wait_list)) {
+                /*
+                 * In case the wait queue is empty and the lock isn't owned
+                 * by a writer or has the handoff bit set, this reader can
+                 * exit the slowpath and return immediately as its
+                 * RWSEM_READER_BIAS has already been set in the count.
+                 */
+                if (adjustment && !(atomic_long_read(&sem->count) &
+                     (RWSEM_WRITER_MASK | RWSEM_FLAG_HANDOFF))) {
+                        raw_spin_unlock_irq(&sem->wait_lock);
+                        rwsem_set_reader_owned(sem);
+                        lockevent_inc(rwsem_rlock_fast);
+                        return sem;
+                }
+                adjustment += RWSEM_FLAG_WAITERS;
+        }
+        list_add_tail(&waiter.list, &sem->wait_list);
+
+        /* we're now waiting on the lock, but no longer actively locking */
+        if (adjustment)
+                count = atomic_long_add_return(adjustment, &sem->count);
+        else
+                count = atomic_long_read(&sem->count);
+
+        /*
+         * If there are no active locks, wake the front queued process(es).
+         *
+         * If there are no writers and we are first in the queue,
+         * wake our own waiter to join the existing active readers !
+         */
+        if (!(count & RWSEM_LOCK_MASK)) {
+                clear_wr_nonspinnable(sem);
+                wake = true;
+        }
+        if (wake || (!(count & RWSEM_WRITER_MASK) &&
+                    (adjustment & RWSEM_FLAG_WAITERS)))
+                rwsem_mark_wake(sem, RWSEM_WAKE_ANY, &wake_q);
+
+        raw_spin_unlock_irq(&sem->wait_lock);
+        wake_up_q(&wake_q);
+
+        /* wait to be given the lock */
+        while (true) {
+                set_current_state(state);
+                if (!waiter.task)
+                        break;
+                if (signal_pending_state(state, current)) {
+                        raw_spin_lock_irq(&sem->wait_lock);
+                        if (waiter.task)
+                                goto out_nolock;
+                        raw_spin_unlock_irq(&sem->wait_lock);
+                        break;
+                }
+                schedule();
+                lockevent_inc(rwsem_sleep_reader);
+        }
+
+        __set_current_state(TASK_RUNNING);
+        lockevent_inc(rwsem_rlock);
+        return sem;
+out_nolock:
+        list_del(&waiter.list);
+        if (list_empty(&sem->wait_list)) {
+                atomic_long_andnot(RWSEM_FLAG_WAITERS|RWSEM_FLAG_HANDOFF,
+                                   &sem->count);
+        }
+        raw_spin_unlock_irq(&sem->wait_lock);
+        __set_current_state(TASK_RUNNING);
+        lockevent_inc(rwsem_rlock_fail);
+        return ERR_PTR(-EINTR);
+}
+
+/*
+ * This function is called by the a write lock owner. So the owner value
+ * won't get changed by others.
+ */
+static inline void rwsem_disable_reader_optspin(struct rw_semaphore *sem,
+                                                bool disable)
+{
+        if (unlikely(disable)) {
+                atomic_long_or(RWSEM_RD_NONSPINNABLE, &sem->owner);
+                lockevent_inc(rwsem_opt_norspin);
+        }
+}
+
+/*
+ * Wait until we successfully acquire the write lock
+ */
+static struct rw_semaphore *
+rwsem_down_write_slowpath(struct rw_semaphore *sem, int state)
+{
+        long count;
+        bool disable_rspin;
+        enum writer_wait_state wstate;
+        struct rwsem_waiter waiter;
+        struct rw_semaphore *ret = sem;
+        DEFINE_WAKE_Q(wake_q);
+
+        /* do optimistic spinning and steal lock if possible */
+        if (rwsem_can_spin_on_owner(sem, RWSEM_WR_NONSPINNABLE) &&
+            rwsem_optimistic_spin(sem, true))
+                return sem;
+
+        /*
+         * Disable reader optimistic spinning for this rwsem after
+         * acquiring the write lock when the setting of the nonspinnable
+         * bits are observed.
+         */
+        disable_rspin = atomic_long_read(&sem->owner) & RWSEM_NONSPINNABLE;
+
+        /*
+         * Optimistic spinning failed, proceed to the slowpath
+         * and block until we can acquire the sem.
+         */
+        waiter.task = current;
+        waiter.type = RWSEM_WAITING_FOR_WRITE;
+        waiter.timeout = jiffies + RWSEM_WAIT_TIMEOUT;
+
+        raw_spin_lock_irq(&sem->wait_lock);
+
+        /* account for this before adding a new element to the list */
+        wstate = list_empty(&sem->wait_list) ? WRITER_FIRST : WRITER_NOT_FIRST;
+
+        list_add_tail(&waiter.list, &sem->wait_list);
+
+        /* we're now waiting on the lock */
+        if (wstate == WRITER_NOT_FIRST) {
+                count = atomic_long_read(&sem->count);
+
+                /*
+                 * If there were already threads queued before us and:
+                 *  1) there are no no active locks, wake the front
+                 *     queued process(es) as the handoff bit might be set.
+                 *  2) there are no active writers and some readers, the lock
+                 *     must be read owned; so we try to wake any read lock
+                 *     waiters that were queued ahead of us.
+                 */
+                if (count & RWSEM_WRITER_MASK)
+                        goto wait;
+
+                rwsem_mark_wake(sem, (count & RWSEM_READER_MASK)
+                                        ? RWSEM_WAKE_READERS
+                                        : RWSEM_WAKE_ANY, &wake_q);
+
+                if (!wake_q_empty(&wake_q)) {
+                        /*
+                         * We want to minimize wait_lock hold time especially
+                         * when a large number of readers are to be woken up.
+                         */
+                        raw_spin_unlock_irq(&sem->wait_lock);
+                        wake_up_q(&wake_q);
+                        wake_q_init(&wake_q);   /* Used again, reinit */
+                        raw_spin_lock_irq(&sem->wait_lock);
+                }
+        } else {
+                atomic_long_or(RWSEM_FLAG_WAITERS, &sem->count);
+        }
+
+wait:
+        /* wait until we successfully acquire the lock */
+        set_current_state(state);
+        while (true) {
+                if (rwsem_try_write_lock(sem, wstate))
+                        break;
+
+                raw_spin_unlock_irq(&sem->wait_lock);
+
+                /* Block until there are no active lockers. */
+                for (;;) {
+                        if (signal_pending_state(state, current))
+                                goto out_nolock;
+
+                        schedule();
+                        lockevent_inc(rwsem_sleep_writer);
+                        set_current_state(state);
+                        /*
+                         * If HANDOFF bit is set, unconditionally do
+                         * a trylock.
+                         */
+                        if (wstate == WRITER_HANDOFF)
+                                break;
+
+                        if ((wstate == WRITER_NOT_FIRST) &&
+                            (rwsem_first_waiter(sem) == &waiter))
+                                wstate = WRITER_FIRST;
+
+                        count = atomic_long_read(&sem->count);
+                        if (!(count & RWSEM_LOCK_MASK))
+                                break;
+
+                        /*
+                         * The setting of the handoff bit is deferred
+                         * until rwsem_try_write_lock() is called.
+                         */
+                        if ((wstate == WRITER_FIRST) && (rt_task(current) ||
+                            time_after(jiffies, waiter.timeout))) {
+                                wstate = WRITER_HANDOFF;
+                                lockevent_inc(rwsem_wlock_handoff);
+                                break;
+                        }
+                }
+
+                raw_spin_lock_irq(&sem->wait_lock);
+        }
+        __set_current_state(TASK_RUNNING);
+        list_del(&waiter.list);
+        rwsem_disable_reader_optspin(sem, disable_rspin);
+        raw_spin_unlock_irq(&sem->wait_lock);
+        lockevent_inc(rwsem_wlock);
+
+        return ret;
+
+out_nolock:
+        __set_current_state(TASK_RUNNING);
+        raw_spin_lock_irq(&sem->wait_lock);
+        list_del(&waiter.list);
+
+        if (unlikely(wstate == WRITER_HANDOFF))
+                atomic_long_add(-RWSEM_FLAG_HANDOFF,  &sem->count);
+
+        if (list_empty(&sem->wait_list))
+                atomic_long_andnot(RWSEM_FLAG_WAITERS, &sem->count);
+        else
+                rwsem_mark_wake(sem, RWSEM_WAKE_ANY, &wake_q);
+        raw_spin_unlock_irq(&sem->wait_lock);
+        wake_up_q(&wake_q);
+        lockevent_inc(rwsem_wlock_fail);
+
+        return ERR_PTR(-EINTR);
+}
+
+/*
+ * handle waking up a waiter on the semaphore
+ * - up_read/up_write has decremented the active part of count if we come here
+ */
+static struct rw_semaphore *rwsem_wake(struct rw_semaphore *sem, long count)
+{
+        unsigned long flags;
+        DEFINE_WAKE_Q(wake_q);
+
+        raw_spin_lock_irqsave(&sem->wait_lock, flags);
+
+        if (!list_empty(&sem->wait_list))
+                rwsem_mark_wake(sem, RWSEM_WAKE_ANY, &wake_q);
+
+        raw_spin_unlock_irqrestore(&sem->wait_lock, flags);
+        wake_up_q(&wake_q);
+
+        return sem;
+}
+
+/*
+ * downgrade a write lock into a read lock
+ * - caller incremented waiting part of count and discovered it still negative
+ * - just wake up any readers at the front of the queue
+ */
+static struct rw_semaphore *rwsem_downgrade_wake(struct rw_semaphore *sem)
+{
+        unsigned long flags;
+        DEFINE_WAKE_Q(wake_q);
+
+        raw_spin_lock_irqsave(&sem->wait_lock, flags);
+
+        if (!list_empty(&sem->wait_list))
+                rwsem_mark_wake(sem, RWSEM_WAKE_READ_OWNED, &wake_q);
+
+        raw_spin_unlock_irqrestore(&sem->wait_lock, flags);
+        wake_up_q(&wake_q);
+
+        return sem;
+}
+
+/*
+ * lock for reading
+ */
+inline void __down_read(struct rw_semaphore *sem)
+{
+        if (!rwsem_read_trylock(sem)) {
+                rwsem_down_read_slowpath(sem, TASK_UNINTERRUPTIBLE);
+                DEBUG_RWSEMS_WARN_ON(!is_rwsem_reader_owned(sem), sem);
+        } else {
+                rwsem_set_reader_owned(sem);
+        }
+}
+
+static inline int __down_read_killable(struct rw_semaphore *sem)
+{
+        if (!rwsem_read_trylock(sem)) {
+                if (IS_ERR(rwsem_down_read_slowpath(sem, TASK_KILLABLE)))
+                        return -EINTR;
+                DEBUG_RWSEMS_WARN_ON(!is_rwsem_reader_owned(sem), sem);
+        } else {
+                rwsem_set_reader_owned(sem);
+        }
+        return 0;
+}
+
+static inline int __down_read_trylock(struct rw_semaphore *sem)
+{
+        /*
+         * Optimize for the case when the rwsem is not locked at all.
+         */
+        long tmp = RWSEM_UNLOCKED_VALUE;
+
+        do {
+                if (atomic_long_try_cmpxchg_acquire(&sem->count, &tmp,
+                                        tmp + RWSEM_READER_BIAS)) {
+                        rwsem_set_reader_owned(sem);
+                        return 1;
+                }
+        } while (!(tmp & RWSEM_READ_FAILED_MASK));
+        return 0;
+}
+
+/*
+ * lock for writing
+ */
+static inline void __down_write(struct rw_semaphore *sem)
+{
+        long tmp = RWSEM_UNLOCKED_VALUE;
+
+        if (unlikely(!atomic_long_try_cmpxchg_acquire(&sem->count, &tmp,
+                                                      RWSEM_WRITER_LOCKED)))
+                rwsem_down_write_slowpath(sem, TASK_UNINTERRUPTIBLE);
+        else
+                rwsem_set_owner(sem);
+}
+
+static inline int __down_write_killable(struct rw_semaphore *sem)
+{
+        long tmp = RWSEM_UNLOCKED_VALUE;
+
+        if (unlikely(!atomic_long_try_cmpxchg_acquire(&sem->count, &tmp,
+                                                      RWSEM_WRITER_LOCKED))) {
+                if (IS_ERR(rwsem_down_write_slowpath(sem, TASK_KILLABLE)))
+                        return -EINTR;
+        } else {
+                rwsem_set_owner(sem);
+        }
+        return 0;
+}
+
+static inline int __down_write_trylock(struct rw_semaphore *sem)
+{
+        long tmp = RWSEM_UNLOCKED_VALUE;
+
+        if (atomic_long_try_cmpxchg_acquire(&sem->count, &tmp,
+                                            RWSEM_WRITER_LOCKED)) {
+                rwsem_set_owner(sem);
+                return true;
+        }
+        return false;
+}
+
+/*
+ * unlock after reading
+ */
+inline void __up_read(struct rw_semaphore *sem)
+{
+        long tmp;
+
+        DEBUG_RWSEMS_WARN_ON(!is_rwsem_reader_owned(sem), sem);
+        rwsem_clear_reader_owned(sem);
+        tmp = atomic_long_add_return_release(-RWSEM_READER_BIAS, &sem->count);
+        DEBUG_RWSEMS_WARN_ON(tmp < 0, sem);
+        if (unlikely((tmp & (RWSEM_LOCK_MASK|RWSEM_FLAG_WAITERS)) ==
+                      RWSEM_FLAG_WAITERS)) {
+                clear_wr_nonspinnable(sem);
+                rwsem_wake(sem, tmp);
+        }
+}
+
+/*
+ * unlock after writing
+ */
+static inline void __up_write(struct rw_semaphore *sem)
+{
+        long tmp;
+
+        /*
+         * sem->owner may differ from current if the ownership is transferred
+         * to an anonymous writer by setting the RWSEM_NONSPINNABLE bits.
+         */
+        DEBUG_RWSEMS_WARN_ON((rwsem_owner(sem) != current) &&
+                            !rwsem_test_oflags(sem, RWSEM_NONSPINNABLE), sem);
+        rwsem_clear_owner(sem);
+        tmp = atomic_long_fetch_add_release(-RWSEM_WRITER_LOCKED, &sem->count);
+        if (unlikely(tmp & RWSEM_FLAG_WAITERS))
+                rwsem_wake(sem, tmp);
+}
+
+/*
+ * downgrade write lock to read lock
+ */
+static inline void __downgrade_write(struct rw_semaphore *sem)
+{
+        long tmp;
+
+        /*
+         * When downgrading from exclusive to shared ownership,
+         * anything inside the write-locked region cannot leak
+         * into the read side. In contrast, anything in the
+         * read-locked region is ok to be re-ordered into the
+         * write side. As such, rely on RELEASE semantics.
+         */
+        DEBUG_RWSEMS_WARN_ON(rwsem_owner(sem) != current, sem);
+        tmp = atomic_long_fetch_add_release(
+                -RWSEM_WRITER_LOCKED+RWSEM_READER_BIAS, &sem->count);
+        rwsem_set_reader_owned(sem);
+        if (tmp & RWSEM_FLAG_WAITERS)
+                rwsem_downgrade_wake(sem);
+}
 
 /*
  * lock for reading
@@ -25,7 +1446,6 @@ void __sched down_read(struct rw_semaphore *sem)
 
         LOCK_CONTENDED(sem, __down_read_trylock, __down_read);
 }
-
 EXPORT_SYMBOL(down_read);
 
 int __sched down_read_killable(struct rw_semaphore *sem)
@@ -40,7 +1460,6 @@ int __sched down_read_killable(struct rw_semaphore *sem)
 
         return 0;
 }
-
 EXPORT_SYMBOL(down_read_killable);
 
 /*
@@ -54,7 +1473,6 @@ int down_read_trylock(struct rw_semaphore *sem)
                 rwsem_acquire_read(&sem->dep_map, 0, 1, _RET_IP_);
         return ret;
 }
-
 EXPORT_SYMBOL(down_read_trylock);
 
 /*
@@ -64,10 +1482,8 @@ void __sched down_write(struct rw_semaphore *sem)
 {
         might_sleep();
         rwsem_acquire(&sem->dep_map, 0, 0, _RET_IP_);
-
         LOCK_CONTENDED(sem, __down_write_trylock, __down_write);
 }
-
 EXPORT_SYMBOL(down_write);
 
 /*
@@ -78,14 +1494,14 @@ int __sched down_write_killable(struct rw_semaphore *sem)
         might_sleep();
         rwsem_acquire(&sem->dep_map, 0, 0, _RET_IP_);
 
-        if (LOCK_CONTENDED_RETURN(sem, __down_write_trylock, __down_write_killable)) {
+        if (LOCK_CONTENDED_RETURN(sem, __down_write_trylock,
+                                  __down_write_killable)) {
                 rwsem_release(&sem->dep_map, 1, _RET_IP_);
                 return -EINTR;
         }
 
         return 0;
 }
-
 EXPORT_SYMBOL(down_write_killable);
 
 /*
@@ -100,7 +1516,6 @@ int down_write_trylock(struct rw_semaphore *sem)
 
         return ret;
 }
-
 EXPORT_SYMBOL(down_write_trylock);
 
 /*
@@ -109,10 +1524,8 @@ EXPORT_SYMBOL(down_write_trylock);
 void up_read(struct rw_semaphore *sem)
 {
         rwsem_release(&sem->dep_map, 1, _RET_IP_);
-
         __up_read(sem);
 }
-
 EXPORT_SYMBOL(up_read);
 
 /*
@@ -121,10 +1534,8 @@ EXPORT_SYMBOL(up_read);
 void up_write(struct rw_semaphore *sem)
 {
         rwsem_release(&sem->dep_map, 1, _RET_IP_);
-
         __up_write(sem);
 }
-
 EXPORT_SYMBOL(up_write);
 
 /*
@@ -133,10 +1544,8 @@ EXPORT_SYMBOL(up_write);
 void downgrade_write(struct rw_semaphore *sem)
 {
         lock_downgrade(&sem->dep_map, _RET_IP_);
-
         __downgrade_write(sem);
 }
-
 EXPORT_SYMBOL(downgrade_write);
 
 #ifdef CONFIG_DEBUG_LOCK_ALLOC
@@ -145,40 +1554,32 @@ void down_read_nested(struct rw_semaphore *sem, int subclass)
 {
         might_sleep();
         rwsem_acquire_read(&sem->dep_map, subclass, 0, _RET_IP_);
-
         LOCK_CONTENDED(sem, __down_read_trylock, __down_read);
 }
-
 EXPORT_SYMBOL(down_read_nested);
 
 void _down_write_nest_lock(struct rw_semaphore *sem, struct lockdep_map *nest)
 {
         might_sleep();
         rwsem_acquire_nest(&sem->dep_map, 0, 0, nest, _RET_IP_);
-
         LOCK_CONTENDED(sem, __down_write_trylock, __down_write);
 }
-
 EXPORT_SYMBOL(_down_write_nest_lock);
 
 void down_read_non_owner(struct rw_semaphore *sem)
 {
         might_sleep();
-
         __down_read(sem);
         __rwsem_set_reader_owned(sem, NULL);
 }
-
 EXPORT_SYMBOL(down_read_non_owner);
 
 void down_write_nested(struct rw_semaphore *sem, int subclass)
 {
         might_sleep();
         rwsem_acquire(&sem->dep_map, subclass, 0, _RET_IP_);
-
         LOCK_CONTENDED(sem, __down_write_trylock, __down_write);
 }
-
 EXPORT_SYMBOL(down_write_nested);
 
 int __sched down_write_killable_nested(struct rw_semaphore *sem, int subclass)
@@ -186,23 +1587,21 @@ int __sched down_write_killable_nested(struct rw_semaphore *sem, int subclass)
         might_sleep();
         rwsem_acquire(&sem->dep_map, subclass, 0, _RET_IP_);
 
-        if (LOCK_CONTENDED_RETURN(sem, __down_write_trylock, __down_write_killable)) {
+        if (LOCK_CONTENDED_RETURN(sem, __down_write_trylock,
+                                  __down_write_killable)) {
                 rwsem_release(&sem->dep_map, 1, _RET_IP_);
                 return -EINTR;
         }
 
         return 0;
 }
-
 EXPORT_SYMBOL(down_write_killable_nested);
 
 void up_read_non_owner(struct rw_semaphore *sem)
 {
-        DEBUG_RWSEMS_WARN_ON(!((unsigned long)sem->owner & RWSEM_READER_OWNED),
-                                sem);
+        DEBUG_RWSEMS_WARN_ON(!is_rwsem_reader_owned(sem), sem);
         __up_read(sem);
 }
-
 EXPORT_SYMBOL(up_read_non_owner);
 
 #endif
diff --git a/kernel/locking/rwsem.h b/kernel/locking/rwsem.h
index 64877f5294e3..2534ce49f648 100644
--- a/kernel/locking/rwsem.h
+++ b/kernel/locking/rwsem.h
@@ -1,304 +1,10 @@
 /* SPDX-License-Identifier: GPL-2.0 */
-/*
- * The least significant 2 bits of the owner value has the following
- * meanings when set.
- *  - RWSEM_READER_OWNED (bit 0): The rwsem is owned by readers
- *  - RWSEM_ANONYMOUSLY_OWNED (bit 1): The rwsem is anonymously owned,
- *    i.e. the owner(s) cannot be readily determined. It can be reader
- *    owned or the owning writer is indeterminate.
- *
- * When a writer acquires a rwsem, it puts its task_struct pointer
- * into the owner field. It is cleared after an unlock.
- *
- * When a reader acquires a rwsem, it will also puts its task_struct
- * pointer into the owner field with both the RWSEM_READER_OWNED and
- * RWSEM_ANONYMOUSLY_OWNED bits set. On unlock, the owner field will
- * largely be left untouched. So for a free or reader-owned rwsem,
- * the owner value may contain information about the last reader that
- * acquires the rwsem. The anonymous bit is set because that particular
- * reader may or may not still own the lock.
- *
- * That information may be helpful in debugging cases where the system
- * seems to hang on a reader owned rwsem especially if only one reader
- * is involved. Ideally we would like to track all the readers that own
- * a rwsem, but the overhead is simply too big.
- */
-#include "lock_events.h"
 
-#define RWSEM_READER_OWNED      (1UL << 0)
-#define RWSEM_ANONYMOUSLY_OWNED (1UL << 1)
+#ifndef __INTERNAL_RWSEM_H
+#define __INTERNAL_RWSEM_H
+#include <linux/rwsem.h>
 
-#ifdef CONFIG_DEBUG_RWSEMS
-# define DEBUG_RWSEMS_WARN_ON(c, sem)   do {                    \
-        if (!debug_locks_silent &&                              \
-            WARN_ONCE(c, "DEBUG_RWSEMS_WARN_ON(%s): count = 0x%lx, owner = 0x%lx, curr 0x%lx, list %sempty\n",\
-                #c, atomic_long_read(&(sem)->count),            \
-                (long)((sem)->owner), (long)current,            \
-                list_empty(&(sem)->wait_list) ? "" : "not "))   \
-                        debug_locks_off();                      \
-        } while (0)
-#else
-# define DEBUG_RWSEMS_WARN_ON(c, sem)
-#endif
+extern void __down_read(struct rw_semaphore *sem);
+extern void __up_read(struct rw_semaphore *sem);
 
-/*
- * R/W semaphores originally for PPC using the stuff in lib/rwsem.c.
- * Adapted largely from include/asm-i386/rwsem.h
- * by Paul Mackerras <paulus@samba.org>.
- */
-
-/*
- * the semaphore definition
- */
-#ifdef CONFIG_64BIT
-# define RWSEM_ACTIVE_MASK              0xffffffffL
-#else
-# define RWSEM_ACTIVE_MASK              0x0000ffffL
-#endif
-
-#define RWSEM_ACTIVE_BIAS               0x00000001L
-#define RWSEM_WAITING_BIAS              (-RWSEM_ACTIVE_MASK-1)
-#define RWSEM_ACTIVE_READ_BIAS          RWSEM_ACTIVE_BIAS
-#define RWSEM_ACTIVE_WRITE_BIAS         (RWSEM_WAITING_BIAS + RWSEM_ACTIVE_BIAS)
-
-#ifdef CONFIG_RWSEM_SPIN_ON_OWNER
-/*
- * All writes to owner are protected by WRITE_ONCE() to make sure that
- * store tearing can't happen as optimistic spinners may read and use
- * the owner value concurrently without lock. Read from owner, however,
- * may not need READ_ONCE() as long as the pointer value is only used
- * for comparison and isn't being dereferenced.
- */
-static inline void rwsem_set_owner(struct rw_semaphore *sem)
-{
-        WRITE_ONCE(sem->owner, current);
-}
-
-static inline void rwsem_clear_owner(struct rw_semaphore *sem)
-{
-        WRITE_ONCE(sem->owner, NULL);
-}
-
-/*
- * The task_struct pointer of the last owning reader will be left in
- * the owner field.
- *
- * Note that the owner value just indicates the task has owned the rwsem
- * previously, it may not be the real owner or one of the real owners
- * anymore when that field is examined, so take it with a grain of salt.
- */
-static inline void __rwsem_set_reader_owned(struct rw_semaphore *sem,
-                                            struct task_struct *owner)
-{
-        unsigned long val = (unsigned long)owner | RWSEM_READER_OWNED
-                                                 | RWSEM_ANONYMOUSLY_OWNED;
-
-        WRITE_ONCE(sem->owner, (struct task_struct *)val);
-}
-
-static inline void rwsem_set_reader_owned(struct rw_semaphore *sem)
-{
-        __rwsem_set_reader_owned(sem, current);
-}
-
-/*
- * Return true if the a rwsem waiter can spin on the rwsem's owner
- * and steal the lock, i.e. the lock is not anonymously owned.
- * N.B. !owner is considered spinnable.
- */
-static inline bool is_rwsem_owner_spinnable(struct task_struct *owner)
-{
-        return !((unsigned long)owner & RWSEM_ANONYMOUSLY_OWNED);
-}
-
-/*
- * Return true if rwsem is owned by an anonymous writer or readers.
- */
-static inline bool rwsem_has_anonymous_owner(struct task_struct *owner)
-{
-        return (unsigned long)owner & RWSEM_ANONYMOUSLY_OWNED;
-}
-
-#ifdef CONFIG_DEBUG_RWSEMS
-/*
- * With CONFIG_DEBUG_RWSEMS configured, it will make sure that if there
- * is a task pointer in owner of a reader-owned rwsem, it will be the
- * real owner or one of the real owners. The only exception is when the
- * unlock is done by up_read_non_owner().
- */
-#define rwsem_clear_reader_owned rwsem_clear_reader_owned
-static inline void rwsem_clear_reader_owned(struct rw_semaphore *sem)
-{
-        unsigned long val = (unsigned long)current | RWSEM_READER_OWNED
-                                                   | RWSEM_ANONYMOUSLY_OWNED;
-        if (READ_ONCE(sem->owner) == (struct task_struct *)val)
-                cmpxchg_relaxed((unsigned long *)&sem->owner, val,
-                                RWSEM_READER_OWNED | RWSEM_ANONYMOUSLY_OWNED);
-}
-#endif
-
-#else
-static inline void rwsem_set_owner(struct rw_semaphore *sem)
-{
-}
-
-static inline void rwsem_clear_owner(struct rw_semaphore *sem)
-{
-}
-
-static inline void __rwsem_set_reader_owned(struct rw_semaphore *sem,
-                                           struct task_struct *owner)
-{
-}
-
-static inline void rwsem_set_reader_owned(struct rw_semaphore *sem)
-{
-}
-#endif
-
-#ifndef rwsem_clear_reader_owned
-static inline void rwsem_clear_reader_owned(struct rw_semaphore *sem)
-{
-}
-#endif
-
-extern struct rw_semaphore *rwsem_down_read_failed(struct rw_semaphore *sem);
-extern struct rw_semaphore *rwsem_down_read_failed_killable(struct rw_semaphore *sem);
-extern struct rw_semaphore *rwsem_down_write_failed(struct rw_semaphore *sem);
-extern struct rw_semaphore *rwsem_down_write_failed_killable(struct rw_semaphore *sem);
-extern struct rw_semaphore *rwsem_wake(struct rw_semaphore *sem);
-extern struct rw_semaphore *rwsem_downgrade_wake(struct rw_semaphore *sem);
-
-/*
- * lock for reading
- */
-static inline void __down_read(struct rw_semaphore *sem)
-{
-        if (unlikely(atomic_long_inc_return_acquire(&sem->count) <= 0)) {
-                rwsem_down_read_failed(sem);
-                DEBUG_RWSEMS_WARN_ON(!((unsigned long)sem->owner &
-                                        RWSEM_READER_OWNED), sem);
-        } else {
-                rwsem_set_reader_owned(sem);
-        }
-}
-
-static inline int __down_read_killable(struct rw_semaphore *sem)
-{
-        if (unlikely(atomic_long_inc_return_acquire(&sem->count) <= 0)) {
-                if (IS_ERR(rwsem_down_read_failed_killable(sem)))
-                        return -EINTR;
-                DEBUG_RWSEMS_WARN_ON(!((unsigned long)sem->owner &
-                                        RWSEM_READER_OWNED), sem);
-        } else {
-                rwsem_set_reader_owned(sem);
-        }
-        return 0;
-}
-
-static inline int __down_read_trylock(struct rw_semaphore *sem)
-{
-        /*
-         * Optimize for the case when the rwsem is not locked at all.
-         */
-        long tmp = RWSEM_UNLOCKED_VALUE;
-
-        lockevent_inc(rwsem_rtrylock);
-        do {
-                if (atomic_long_try_cmpxchg_acquire(&sem->count, &tmp,
-                                        tmp + RWSEM_ACTIVE_READ_BIAS)) {
-                        rwsem_set_reader_owned(sem);
-                        return 1;
-                }
-        } while (tmp >= 0);
-        return 0;
-}
-
-/*
- * lock for writing
- */
-static inline void __down_write(struct rw_semaphore *sem)
-{
-        long tmp;
-
-        tmp = atomic_long_add_return_acquire(RWSEM_ACTIVE_WRITE_BIAS,
-                                             &sem->count);
-        if (unlikely(tmp != RWSEM_ACTIVE_WRITE_BIAS))
-                rwsem_down_write_failed(sem);
-        rwsem_set_owner(sem);
-}
-
-static inline int __down_write_killable(struct rw_semaphore *sem)
-{
-        long tmp;
-
-        tmp = atomic_long_add_return_acquire(RWSEM_ACTIVE_WRITE_BIAS,
-                                             &sem->count);
-        if (unlikely(tmp != RWSEM_ACTIVE_WRITE_BIAS))
-                if (IS_ERR(rwsem_down_write_failed_killable(sem)))
-                        return -EINTR;
-        rwsem_set_owner(sem);
-        return 0;
-}
-
-static inline int __down_write_trylock(struct rw_semaphore *sem)
-{
-        long tmp;
-
-        lockevent_inc(rwsem_wtrylock);
-        tmp = atomic_long_cmpxchg_acquire(&sem->count, RWSEM_UNLOCKED_VALUE,
-                      RWSEM_ACTIVE_WRITE_BIAS);
-        if (tmp == RWSEM_UNLOCKED_VALUE) {
-                rwsem_set_owner(sem);
-                return true;
-        }
-        return false;
-}
-
-/*
- * unlock after reading
- */
-static inline void __up_read(struct rw_semaphore *sem)
-{
-        long tmp;
-
-        DEBUG_RWSEMS_WARN_ON(!((unsigned long)sem->owner & RWSEM_READER_OWNED),
-                                sem);
-        rwsem_clear_reader_owned(sem);
-        tmp = atomic_long_dec_return_release(&sem->count);
-        if (unlikely(tmp < -1 && (tmp & RWSEM_ACTIVE_MASK) == 0))
-                rwsem_wake(sem);
-}
-
-/*
- * unlock after writing
- */
-static inline void __up_write(struct rw_semaphore *sem)
-{
-        DEBUG_RWSEMS_WARN_ON(sem->owner != current, sem);
-        rwsem_clear_owner(sem);
-        if (unlikely(atomic_long_sub_return_release(RWSEM_ACTIVE_WRITE_BIAS,
-                                                    &sem->count) < 0))
-                rwsem_wake(sem);
-}
-
-/*
- * downgrade write lock to read lock
- */
-static inline void __downgrade_write(struct rw_semaphore *sem)
-{
-        long tmp;
-
-        /*
-         * When downgrading from exclusive to shared ownership,
-         * anything inside the write-locked region cannot leak
-         * into the read side. In contrast, anything in the
-         * read-locked region is ok to be re-ordered into the
-         * write side. As such, rely on RELEASE semantics.
-         */
-        DEBUG_RWSEMS_WARN_ON(sem->owner != current, sem);
-        tmp = atomic_long_add_return_release(-RWSEM_WAITING_BIAS, &sem->count);
-        rwsem_set_reader_owned(sem);
-        if (tmp < 0)
-                rwsem_downgrade_wake(sem);
-}
+#endif /* __INTERNAL_RWSEM_H */
diff --git a/kernel/module.c b/kernel/module.c
index 80c7c09584cf..a2cee14a83f3 100644
--- a/kernel/module.c
+++ b/kernel/module.c
@@ -3083,6 +3083,11 @@ static int find_module_sections(struct module *mod, struct load_info *info)
                                              sizeof(*mod->tracepoints_ptrs),
                                              &mod->num_tracepoints);
 #endif
+#ifdef CONFIG_TREE_SRCU
+        mod->srcu_struct_ptrs = section_objs(info, "___srcu_struct_ptrs",
+                                             sizeof(*mod->srcu_struct_ptrs),
+                                             &mod->num_srcu_structs);
+#endif
 #ifdef CONFIG_BPF_EVENTS
         mod->bpf_raw_events = section_objs(info, "__bpf_raw_tp_map",
                                            sizeof(*mod->bpf_raw_events),
diff --git a/kernel/power/suspend.c b/kernel/power/suspend.c
index 9505101ed2bc..096211299c07 100644
--- a/kernel/power/suspend.c
+++ b/kernel/power/suspend.c
@@ -493,6 +493,9 @@ int suspend_devices_and_enter(suspend_state_t state)
 
         pm_suspend_target_state = state;
 
+        if (state == PM_SUSPEND_TO_IDLE)
+                pm_set_suspend_no_platform();
+
         error = platform_suspend_begin(state);
         if (error)
                 goto Close;
diff --git a/kernel/ptrace.c b/kernel/ptrace.c
index 8456b6e2205f..83a531cea2f3 100644
--- a/kernel/ptrace.c
+++ b/kernel/ptrace.c
@@ -79,9 +79,7 @@ void __ptrace_link(struct task_struct *child, struct task_struct *new_parent,
  */
 static void ptrace_link(struct task_struct *child, struct task_struct *new_parent)
 {
-        rcu_read_lock();
-        __ptrace_link(child, new_parent, __task_cred(new_parent));
-        rcu_read_unlock();
+        __ptrace_link(child, new_parent, current_cred());
 }
 
 /**
@@ -118,6 +116,9 @@ void __ptrace_unlink(struct task_struct *child)
         BUG_ON(!child->ptrace);
 
         clear_tsk_thread_flag(child, TIF_SYSCALL_TRACE);
+#ifdef TIF_SYSCALL_EMU
+        clear_tsk_thread_flag(child, TIF_SYSCALL_EMU);
+#endif
 
         child->parent = child->real_parent;
         list_del_init(&child->ptrace_entry);
diff --git a/kernel/rcu/rcu.h b/kernel/rcu/rcu.h
index 390aab20115e..5290b01de534 100644
--- a/kernel/rcu/rcu.h
+++ b/kernel/rcu/rcu.h
@@ -446,6 +446,7 @@ void rcu_request_urgent_qs_task(struct task_struct *t);
 enum rcutorture_type {
         RCU_FLAVOR,
         RCU_TASKS_FLAVOR,
+        RCU_TRIVIAL_FLAVOR,
         SRCU_FLAVOR,
         INVALID_RCU_FLAVOR
 };
@@ -479,6 +480,10 @@ void do_trace_rcu_torture_read(const char *rcutorturename,
 #endif
 #endif
 
+#if IS_ENABLED(CONFIG_RCU_TORTURE_TEST) || IS_MODULE(CONFIG_RCU_TORTURE_TEST)
+long rcutorture_sched_setaffinity(pid_t pid, const struct cpumask *in_mask);
+#endif
+
 #ifdef CONFIG_TINY_SRCU
 
 static inline void srcutorture_get_gp_data(enum rcutorture_type test_type,
diff --git a/kernel/rcu/rcutorture.c b/kernel/rcu/rcutorture.c
index efaa5b3f4d3f..fce4e7e6f502 100644
--- a/kernel/rcu/rcutorture.c
+++ b/kernel/rcu/rcutorture.c
@@ -299,6 +299,7 @@ struct rcu_torture_ops {
         int irq_capable;
         int can_boost;
         int extendables;
+        int slow_gps;
         const char *name;
 };
 
@@ -667,9 +668,51 @@ static struct rcu_torture_ops tasks_ops = {
         .fqs            = NULL,
         .stats          = NULL,
         .irq_capable    = 1,
+        .slow_gps       = 1,
         .name           = "tasks"
 };
 
+/*
+ * Definitions for trivial CONFIG_PREEMPT=n-only torture testing.
+ * This implementation does not necessarily work well with CPU hotplug.
+ */
+
+static void synchronize_rcu_trivial(void)
+{
+        int cpu;
+
+        for_each_online_cpu(cpu) {
+                rcutorture_sched_setaffinity(current->pid, cpumask_of(cpu));
+                WARN_ON_ONCE(raw_smp_processor_id() != cpu);
+        }
+}
+
+static int rcu_torture_read_lock_trivial(void) __acquires(RCU)
+{
+        preempt_disable();
+        return 0;
+}
+
+static void rcu_torture_read_unlock_trivial(int idx) __releases(RCU)
+{
+        preempt_enable();
+}
+
+static struct rcu_torture_ops trivial_ops = {
+        .ttype          = RCU_TRIVIAL_FLAVOR,
+        .init           = rcu_sync_torture_init,
+        .readlock       = rcu_torture_read_lock_trivial,
+        .read_delay     = rcu_read_delay,  /* just reuse rcu's version. */
+        .readunlock     = rcu_torture_read_unlock_trivial,
+        .get_gp_seq     = rcu_no_completed,
+        .sync           = synchronize_rcu_trivial,
+        .exp_sync       = synchronize_rcu_trivial,
+        .fqs            = NULL,
+        .stats          = NULL,
+        .irq_capable    = 1,
+        .name           = "trivial"
+};
+
 static unsigned long rcutorture_seq_diff(unsigned long new, unsigned long old)
 {
         if (!cur_ops->gp_diff)
@@ -1010,10 +1053,17 @@ rcu_torture_writer(void *arg)
                                        !rcu_gp_is_normal();
                 }
                 rcu_torture_writer_state = RTWS_STUTTER;
-                if (stutter_wait("rcu_torture_writer"))
+                if (stutter_wait("rcu_torture_writer") &&
+                    !READ_ONCE(rcu_fwd_cb_nodelay) &&
+                    !cur_ops->slow_gps &&
+                    !torture_must_stop())
                         for (i = 0; i < ARRAY_SIZE(rcu_tortures); i++)
-                                if (list_empty(&rcu_tortures[i].rtort_free))
-                                        WARN_ON_ONCE(1);
+                                if (list_empty(&rcu_tortures[i].rtort_free) &&
+                                    rcu_access_pointer(rcu_torture_current) !=
+                                    &rcu_tortures[i]) {
+                                        rcu_ftrace_dump(DUMP_ALL);
+                                        WARN(1, "%s: rtort_pipe_count: %d\n", __func__, rcu_tortures[i].rtort_pipe_count);
+                                }
         } while (!torture_must_stop());
         /* Reset expediting back to unexpedited. */
         if (expediting > 0)
@@ -1358,8 +1408,9 @@ rcu_torture_stats_print(void)
         }
 
         pr_alert("%s%s ", torture_type, TORTURE_FLAG);
-        pr_cont("rtc: %p ver: %lu tfle: %d rta: %d rtaf: %d rtf: %d ",
+        pr_cont("rtc: %p %s: %lu tfle: %d rta: %d rtaf: %d rtf: %d ",
                 rcu_torture_current,
+                rcu_torture_current ? "ver" : "VER",
                 rcu_torture_current_version,
                 list_empty(&rcu_torture_freelist),
                 atomic_read(&n_rcu_torture_alloc),
@@ -1661,6 +1712,17 @@ static void rcu_torture_fwd_cb_cr(struct rcu_head *rhp)
         spin_unlock_irqrestore(&rcu_fwd_lock, flags);
 }
 
+// Give the scheduler a chance, even on nohz_full CPUs.
+static void rcu_torture_fwd_prog_cond_resched(void)
+{
+        if (IS_ENABLED(CONFIG_PREEMPT) && IS_ENABLED(CONFIG_NO_HZ_FULL)) {
+                if (need_resched())
+                        schedule();
+        } else {
+                cond_resched();
+        }
+}
+
 /*
  * Free all callbacks on the rcu_fwd_cb_head list, either because the
  * test is over or because we hit an OOM event.
@@ -1674,16 +1736,18 @@ static unsigned long rcu_torture_fwd_prog_cbfree(void)
         for (;;) {
                 spin_lock_irqsave(&rcu_fwd_lock, flags);
                 rfcp = rcu_fwd_cb_head;
-                if (!rfcp)
+                if (!rfcp) {
+                        spin_unlock_irqrestore(&rcu_fwd_lock, flags);
                         break;
+                }
                 rcu_fwd_cb_head = rfcp->rfc_next;
                 if (!rcu_fwd_cb_head)
                         rcu_fwd_cb_tail = &rcu_fwd_cb_head;
                 spin_unlock_irqrestore(&rcu_fwd_lock, flags);
                 kfree(rfcp);
                 freed++;
+                rcu_torture_fwd_prog_cond_resched();
         }
-        spin_unlock_irqrestore(&rcu_fwd_lock, flags);
         return freed;
 }
 
@@ -1707,6 +1771,8 @@ static void rcu_torture_fwd_prog_nr(int *tested, int *tested_tries)
         }
 
         /* Tight loop containing cond_resched(). */
+        WRITE_ONCE(rcu_fwd_cb_nodelay, true);
+        cur_ops->sync(); /* Later readers see above write. */
         if  (selfpropcb) {
                 WRITE_ONCE(fcs.stop, 0);
                 cur_ops->call(&fcs.rh, rcu_torture_fwd_prog_cb);
@@ -1724,7 +1790,7 @@ static void rcu_torture_fwd_prog_nr(int *tested, int *tested_tries)
                 udelay(10);
                 cur_ops->readunlock(idx);
                 if (!fwd_progress_need_resched || need_resched())
-                        cond_resched();
+                        rcu_torture_fwd_prog_cond_resched();
         }
         (*tested_tries)++;
         if (!time_before(jiffies, stopat) &&
@@ -1745,6 +1811,8 @@ static void rcu_torture_fwd_prog_nr(int *tested, int *tested_tries)
                 WARN_ON(READ_ONCE(fcs.stop) != 2);
                 destroy_rcu_head_on_stack(&fcs.rh);
         }
+        schedule_timeout_uninterruptible(HZ / 10); /* Let kthreads recover. */
+        WRITE_ONCE(rcu_fwd_cb_nodelay, false);
 }
 
 /* Carry out call_rcu() forward-progress testing. */
@@ -1765,6 +1833,8 @@ static void rcu_torture_fwd_prog_cr(void)
 
         if (READ_ONCE(rcu_fwd_emergency_stop))
                 return; /* Get out of the way quickly, no GP wait! */
+        if (!cur_ops->call)
+                return; /* Can't do call_rcu() fwd prog without ->call. */
 
         /* Loop continuously posting RCU callbacks. */
         WRITE_ONCE(rcu_fwd_cb_nodelay, true);
@@ -1805,7 +1875,7 @@ static void rcu_torture_fwd_prog_cr(void)
                         rfcp->rfc_gps = 0;
                 }
                 cur_ops->call(&rfcp->rh, rcu_torture_fwd_cb_cr);
-                cond_resched();
+                rcu_torture_fwd_prog_cond_resched();
         }
         stoppedat = jiffies;
         n_launders_cb_snap = READ_ONCE(n_launders_cb);
@@ -1814,7 +1884,6 @@ static void rcu_torture_fwd_prog_cr(void)
         cur_ops->cb_barrier(); /* Wait for callbacks to be invoked. */
         (void)rcu_torture_fwd_prog_cbfree();
 
-        WRITE_ONCE(rcu_fwd_cb_nodelay, false);
         if (!torture_must_stop() && !READ_ONCE(rcu_fwd_emergency_stop)) {
                 WARN_ON(n_max_gps < MIN_FWD_CBS_LAUNDERED);
                 pr_alert("%s Duration %lu barrier: %lu pending %ld n_launders: %ld n_launders_sa: %ld n_max_gps: %ld n_max_cbs: %ld cver %ld gps %ld\n",
@@ -1825,6 +1894,8 @@ static void rcu_torture_fwd_prog_cr(void)
                          n_max_gps, n_max_cbs, cver, gps);
                 rcu_torture_fwd_cb_hist();
         }
+        schedule_timeout_uninterruptible(HZ); /* Let CBs drain. */
+        WRITE_ONCE(rcu_fwd_cb_nodelay, false);
 }
 
 
@@ -2240,7 +2311,7 @@ rcu_torture_init(void)
         int firsterr = 0;
         static struct rcu_torture_ops *torture_ops[] = {
                 &rcu_ops, &rcu_busted_ops, &srcu_ops, &srcud_ops,
-                &busted_srcud_ops, &tasks_ops,
+                &busted_srcud_ops, &tasks_ops, &trivial_ops,
         };
 
         if (!torture_init_begin(torture_type, verbose))
@@ -2363,7 +2434,10 @@ rcu_torture_init(void)
         if (stutter < 0)
                 stutter = 0;
         if (stutter) {
-                firsterr = torture_stutter_init(stutter * HZ);
+                int t;
+
+                t = cur_ops->stall_dur ? cur_ops->stall_dur() : stutter * HZ;
+                firsterr = torture_stutter_init(stutter * HZ, t);
                 if (firsterr)
                         goto unwind;
         }
diff --git a/kernel/rcu/srcutree.c b/kernel/rcu/srcutree.c
index 9b761e546de8..cf0e886314f2 100644
--- a/kernel/rcu/srcutree.c
+++ b/kernel/rcu/srcutree.c
@@ -831,8 +831,8 @@ static void srcu_leak_callback(struct rcu_head *rhp)
  * srcu_read_lock(), and srcu_read_unlock() that are all passed the same
  * srcu_struct structure.
  */
-void __call_srcu(struct srcu_struct *ssp, struct rcu_head *rhp,
-                 rcu_callback_t func, bool do_norm)
+static void __call_srcu(struct srcu_struct *ssp, struct rcu_head *rhp,
+                        rcu_callback_t func, bool do_norm)
 {
         unsigned long flags;
         int idx;
@@ -1310,3 +1310,68 @@ void __init srcu_init(void)
                 queue_work(rcu_gp_wq, &ssp->work.work);
         }
 }
+
+#ifdef CONFIG_MODULES
+
+/* Initialize any global-scope srcu_struct structures used by this module. */
+static int srcu_module_coming(struct module *mod)
+{
+        int i;
+        struct srcu_struct **sspp = mod->srcu_struct_ptrs;
+        int ret;
+
+        for (i = 0; i < mod->num_srcu_structs; i++) {
+                ret = init_srcu_struct(*(sspp++));
+                if (WARN_ON_ONCE(ret))
+                        return ret;
+        }
+        return 0;
+}
+
+/* Clean up any global-scope srcu_struct structures used by this module. */
+static void srcu_module_going(struct module *mod)
+{
+        int i;
+        struct srcu_struct **sspp = mod->srcu_struct_ptrs;
+
+        for (i = 0; i < mod->num_srcu_structs; i++)
+                cleanup_srcu_struct(*(sspp++));
+}
+
+/* Handle one module, either coming or going. */
+static int srcu_module_notify(struct notifier_block *self,
+                              unsigned long val, void *data)
+{
+        struct module *mod = data;
+        int ret = 0;
+
+        switch (val) {
+        case MODULE_STATE_COMING:
+                ret = srcu_module_coming(mod);
+                break;
+        case MODULE_STATE_GOING:
+                srcu_module_going(mod);
+                break;
+        default:
+                break;
+        }
+        return ret;
+}
+
+static struct notifier_block srcu_module_nb = {
+        .notifier_call = srcu_module_notify,
+        .priority = 0,
+};
+
+static __init int init_srcu_module_notifier(void)
+{
+        int ret;
+
+        ret = register_module_notifier(&srcu_module_nb);
+        if (ret)
+                pr_warn("Failed to register srcu module notifier\n");
+        return ret;
+}
+late_initcall(init_srcu_module_notifier);
+
+#endif /* #ifdef CONFIG_MODULES */
diff --git a/kernel/rcu/sync.c b/kernel/rcu/sync.c
index a8304d90573f..d4558ab7a07d 100644
--- a/kernel/rcu/sync.c
+++ b/kernel/rcu/sync.c
@@ -10,65 +10,18 @@
 #include <linux/rcu_sync.h>
 #include <linux/sched.h>
 
-#ifdef CONFIG_PROVE_RCU
-#define __INIT_HELD(func)       .held = func,
-#else
-#define __INIT_HELD(func)
-#endif
-
-static const struct {
-        void (*sync)(void);
-        void (*call)(struct rcu_head *, void (*)(struct rcu_head *));
-        void (*wait)(void);
-#ifdef CONFIG_PROVE_RCU
-        int  (*held)(void);
-#endif
-} gp_ops[] = {
-        [RCU_SYNC] = {
-                .sync = synchronize_rcu,
-                .call = call_rcu,
-                .wait = rcu_barrier,
-                __INIT_HELD(rcu_read_lock_held)
-        },
-        [RCU_SCHED_SYNC] = {
-                .sync = synchronize_rcu,
-                .call = call_rcu,
-                .wait = rcu_barrier,
-                __INIT_HELD(rcu_read_lock_sched_held)
-        },
-        [RCU_BH_SYNC] = {
-                .sync = synchronize_rcu,
-                .call = call_rcu,
-                .wait = rcu_barrier,
-                __INIT_HELD(rcu_read_lock_bh_held)
-        },
-};
-
-enum { GP_IDLE = 0, GP_PENDING, GP_PASSED };
-enum { CB_IDLE = 0, CB_PENDING, CB_REPLAY };
+enum { GP_IDLE = 0, GP_ENTER, GP_PASSED, GP_EXIT, GP_REPLAY };
 
 #define rss_lock        gp_wait.lock
 
-#ifdef CONFIG_PROVE_RCU
-void rcu_sync_lockdep_assert(struct rcu_sync *rsp)
-{
-        RCU_LOCKDEP_WARN(!gp_ops[rsp->gp_type].held(),
-                         "suspicious rcu_sync_is_idle() usage");
-}
-
-EXPORT_SYMBOL_GPL(rcu_sync_lockdep_assert);
-#endif
-
 /**
  * rcu_sync_init() - Initialize an rcu_sync structure
  * @rsp: Pointer to rcu_sync structure to be initialized
- * @type: Flavor of RCU with which to synchronize rcu_sync structure
  */
-void rcu_sync_init(struct rcu_sync *rsp, enum rcu_sync_type type)
+void rcu_sync_init(struct rcu_sync *rsp)
 {
         memset(rsp, 0, sizeof(*rsp));
         init_waitqueue_head(&rsp->gp_wait);
-        rsp->gp_type = type;
 }
 
 /**
@@ -86,56 +39,26 @@ void rcu_sync_enter_start(struct rcu_sync *rsp)
         rsp->gp_state = GP_PASSED;
 }
 
-/**
- * rcu_sync_enter() - Force readers onto slowpath
- * @rsp: Pointer to rcu_sync structure to use for synchronization
- *
- * This function is used by updaters who need readers to make use of
- * a slowpath during the update.  After this function returns, all
- * subsequent calls to rcu_sync_is_idle() will return false, which
- * tells readers to stay off their fastpaths.  A later call to
- * rcu_sync_exit() re-enables reader slowpaths.
- *
- * When called in isolation, rcu_sync_enter() must wait for a grace
- * period, however, closely spaced calls to rcu_sync_enter() can
- * optimize away the grace-period wait via a state machine implemented
- * by rcu_sync_enter(), rcu_sync_exit(), and rcu_sync_func().
- */
-void rcu_sync_enter(struct rcu_sync *rsp)
-{
-        bool need_wait, need_sync;
 
-        spin_lock_irq(&rsp->rss_lock);
-        need_wait = rsp->gp_count++;
-        need_sync = rsp->gp_state == GP_IDLE;
-        if (need_sync)
-                rsp->gp_state = GP_PENDING;
-        spin_unlock_irq(&rsp->rss_lock);
+static void rcu_sync_func(struct rcu_head *rhp);
 
-        WARN_ON_ONCE(need_wait && need_sync);
-        if (need_sync) {
-                gp_ops[rsp->gp_type].sync();
-                rsp->gp_state = GP_PASSED;
-                wake_up_all(&rsp->gp_wait);
-        } else if (need_wait) {
-                wait_event(rsp->gp_wait, rsp->gp_state == GP_PASSED);
-        } else {
-                /*
-                 * Possible when there's a pending CB from a rcu_sync_exit().
-                 * Nobody has yet been allowed the 'fast' path and thus we can
-                 * avoid doing any sync(). The callback will get 'dropped'.
-                 */
-                WARN_ON_ONCE(rsp->gp_state != GP_PASSED);
-        }
+static void rcu_sync_call(struct rcu_sync *rsp)
+{
+        call_rcu(&rsp->cb_head, rcu_sync_func);
 }
 
 /**
  * rcu_sync_func() - Callback function managing reader access to fastpath
  * @rhp: Pointer to rcu_head in rcu_sync structure to use for synchronization
  *
- * This function is passed to one of the call_rcu() functions by
+ * This function is passed to call_rcu() function by rcu_sync_enter() and
  * rcu_sync_exit(), so that it is invoked after a grace period following the
- * that invocation of rcu_sync_exit().  It takes action based on events that
+ * that invocation of enter/exit.
+ *
+ * If it is called by rcu_sync_enter() it signals that all the readers were
+ * switched onto slow path.
+ *
+ * If it is called by rcu_sync_exit() it takes action based on events that
  * have taken place in the meantime, so that closely spaced rcu_sync_enter()
  * and rcu_sync_exit() pairs need not wait for a grace period.
  *
@@ -152,35 +75,88 @@ static void rcu_sync_func(struct rcu_head *rhp)
         struct rcu_sync *rsp = container_of(rhp, struct rcu_sync, cb_head);
         unsigned long flags;
 
-        WARN_ON_ONCE(rsp->gp_state != GP_PASSED);
-        WARN_ON_ONCE(rsp->cb_state == CB_IDLE);
+        WARN_ON_ONCE(READ_ONCE(rsp->gp_state) == GP_IDLE);
+        WARN_ON_ONCE(READ_ONCE(rsp->gp_state) == GP_PASSED);
 
         spin_lock_irqsave(&rsp->rss_lock, flags);
         if (rsp->gp_count) {
                 /*
-                 * A new rcu_sync_begin() has happened; drop the callback.
+                 * We're at least a GP after the GP_IDLE->GP_ENTER transition.
                  */
-                rsp->cb_state = CB_IDLE;
-        } else if (rsp->cb_state == CB_REPLAY) {
+                WRITE_ONCE(rsp->gp_state, GP_PASSED);
+                wake_up_locked(&rsp->gp_wait);
+        } else if (rsp->gp_state == GP_REPLAY) {
                 /*
-                 * A new rcu_sync_exit() has happened; requeue the callback
-                 * to catch a later GP.
+                 * A new rcu_sync_exit() has happened; requeue the callback to
+                 * catch a later GP.
                  */
-                rsp->cb_state = CB_PENDING;
-                gp_ops[rsp->gp_type].call(&rsp->cb_head, rcu_sync_func);
+                WRITE_ONCE(rsp->gp_state, GP_EXIT);
+                rcu_sync_call(rsp);
         } else {
                 /*
-                 * We're at least a GP after rcu_sync_exit(); eveybody will now
-                 * have observed the write side critical section. Let 'em rip!.
+                 * We're at least a GP after the last rcu_sync_exit(); eveybody
+                 * will now have observed the write side critical section.
+                 * Let 'em rip!.
                  */
-                rsp->cb_state = CB_IDLE;
-                rsp->gp_state = GP_IDLE;
+                WRITE_ONCE(rsp->gp_state, GP_IDLE);
         }
         spin_unlock_irqrestore(&rsp->rss_lock, flags);
 }
 
 /**
- * rcu_sync_exit() - Allow readers back onto fast patch after grace period
+ * rcu_sync_enter() - Force readers onto slowpath
+ * @rsp: Pointer to rcu_sync structure to use for synchronization
+ *
+ * This function is used by updaters who need readers to make use of
+ * a slowpath during the update.  After this function returns, all
+ * subsequent calls to rcu_sync_is_idle() will return false, which
+ * tells readers to stay off their fastpaths.  A later call to
+ * rcu_sync_exit() re-enables reader slowpaths.
+ *
+ * When called in isolation, rcu_sync_enter() must wait for a grace
+ * period, however, closely spaced calls to rcu_sync_enter() can
+ * optimize away the grace-period wait via a state machine implemented
+ * by rcu_sync_enter(), rcu_sync_exit(), and rcu_sync_func().
+ */
+void rcu_sync_enter(struct rcu_sync *rsp)
+{
+        int gp_state;
+
+        spin_lock_irq(&rsp->rss_lock);
+        gp_state = rsp->gp_state;
+        if (gp_state == GP_IDLE) {
+                WRITE_ONCE(rsp->gp_state, GP_ENTER);
+                WARN_ON_ONCE(rsp->gp_count);
+                /*
+                 * Note that we could simply do rcu_sync_call(rsp) here and
+                 * avoid the "if (gp_state == GP_IDLE)" block below.
+                 *
+                 * However, synchronize_rcu() can be faster if rcu_expedited
+                 * or rcu_blocking_is_gp() is true.
+                 *
+                 * Another reason is that we can't wait for rcu callback if
+                 * we are called at early boot time but this shouldn't happen.
+                 */
+        }
+        rsp->gp_count++;
+        spin_unlock_irq(&rsp->rss_lock);
+
+        if (gp_state == GP_IDLE) {
+                /*
+                 * See the comment above, this simply does the "synchronous"
+                 * call_rcu(rcu_sync_func) which does GP_ENTER -> GP_PASSED.
+                 */
+                synchronize_rcu();
+                rcu_sync_func(&rsp->cb_head);
+                /* Not really needed, wait_event() would see GP_PASSED. */
+                return;
+        }
+
+        wait_event(rsp->gp_wait, READ_ONCE(rsp->gp_state) >= GP_PASSED);
+}
+
+/**
+ * rcu_sync_exit() - Allow readers back onto fast path after grace period
  * @rsp: Pointer to rcu_sync structure to use for synchronization
  *
  * This function is used by updaters who have completed, and can therefore
@@ -191,13 +167,16 @@ static void rcu_sync_func(struct rcu_head *rhp)
  */
 void rcu_sync_exit(struct rcu_sync *rsp)
 {
+        WARN_ON_ONCE(READ_ONCE(rsp->gp_state) == GP_IDLE);
+        WARN_ON_ONCE(READ_ONCE(rsp->gp_count) == 0);
+
         spin_lock_irq(&rsp->rss_lock);
         if (!--rsp->gp_count) {
-                if (rsp->cb_state == CB_IDLE) {
-                        rsp->cb_state = CB_PENDING;
-                        gp_ops[rsp->gp_type].call(&rsp->cb_head, rcu_sync_func);
-                } else if (rsp->cb_state == CB_PENDING) {
-                        rsp->cb_state = CB_REPLAY;
+                if (rsp->gp_state == GP_PASSED) {
+                        WRITE_ONCE(rsp->gp_state, GP_EXIT);
+                        rcu_sync_call(rsp);
+                } else if (rsp->gp_state == GP_EXIT) {
+                        WRITE_ONCE(rsp->gp_state, GP_REPLAY);
                 }
         }
         spin_unlock_irq(&rsp->rss_lock);
@@ -209,18 +188,19 @@ void rcu_sync_exit(struct rcu_sync *rsp)
  */
 void rcu_sync_dtor(struct rcu_sync *rsp)
 {
-        int cb_state;
+        int gp_state;
 
-        WARN_ON_ONCE(rsp->gp_count);
+        WARN_ON_ONCE(READ_ONCE(rsp->gp_count));
+        WARN_ON_ONCE(READ_ONCE(rsp->gp_state) == GP_PASSED);
 
         spin_lock_irq(&rsp->rss_lock);
-        if (rsp->cb_state == CB_REPLAY)
-                rsp->cb_state = CB_PENDING;
-        cb_state = rsp->cb_state;
+        if (rsp->gp_state == GP_REPLAY)
+                WRITE_ONCE(rsp->gp_state, GP_EXIT);
+        gp_state = rsp->gp_state;
         spin_unlock_irq(&rsp->rss_lock);
 
-        if (cb_state != CB_IDLE) {
-                gp_ops[rsp->gp_type].wait();
-                WARN_ON_ONCE(rsp->cb_state != CB_IDLE);
+        if (gp_state != GP_IDLE) {
+                rcu_barrier();
+                WARN_ON_ONCE(rsp->gp_state != GP_IDLE);
         }
 }
diff --git a/kernel/rcu/tree.c b/kernel/rcu/tree.c
index 980ca3ca643f..a14e5fbbea46 100644
--- a/kernel/rcu/tree.c
+++ b/kernel/rcu/tree.c
@@ -51,6 +51,12 @@
 #include <linux/tick.h>
 #include <linux/sysrq.h>
 #include <linux/kprobes.h>
+#include <linux/gfp.h>
+#include <linux/oom.h>
+#include <linux/smpboot.h>
+#include <linux/jiffies.h>
+#include <linux/sched/isolation.h>
+#include "../time/tick-internal.h"
 
 #include "tree.h"
 #include "rcu.h"
@@ -92,6 +98,9 @@ struct rcu_state rcu_state = {
 /* Dump rcu_node combining tree at boot to verify correct setup. */
 static bool dump_tree;
 module_param(dump_tree, bool, 0444);
+/* By default, use RCU_SOFTIRQ instead of rcuc kthreads. */
+static bool use_softirq = 1;
+module_param(use_softirq, bool, 0444);
 /* Control rcu_node-tree auto-balancing at boot time. */
 static bool rcu_fanout_exact;
 module_param(rcu_fanout_exact, bool, 0444);
@@ -138,7 +147,6 @@ static void rcu_init_new_rnp(struct rcu_node *rnp_leaf);
 static void rcu_cleanup_dead_rnp(struct rcu_node *rnp_leaf);
 static void rcu_boost_kthread_setaffinity(struct rcu_node *rnp, int outgoingcpu);
 static void invoke_rcu_core(void);
-static void invoke_rcu_callbacks(struct rcu_data *rdp);
 static void rcu_report_exp_rdp(struct rcu_data *rdp);
 static void sync_sched_exp_online_cleanup(int cpu);
 
@@ -368,19 +376,33 @@ static void __maybe_unused rcu_momentary_dyntick_idle(void)
 }
 
 /**
- * rcu_is_cpu_rrupt_from_idle - see if idle or immediately interrupted from idle
+ * rcu_is_cpu_rrupt_from_idle - see if interrupted from idle
  *
- * If the current CPU is idle or running at a first-level (not nested)
+ * If the current CPU is idle and running at a first-level (not nested)
  * interrupt from idle, return true.  The caller must have at least
  * disabled preemption.
  */
 static int rcu_is_cpu_rrupt_from_idle(void)
 {
-        return __this_cpu_read(rcu_data.dynticks_nesting) <= 0 &&
-               __this_cpu_read(rcu_data.dynticks_nmi_nesting) <= 1;
+        /* Called only from within the scheduling-clock interrupt */
+        lockdep_assert_in_irq();
+
+        /* Check for counter underflows */
+        RCU_LOCKDEP_WARN(__this_cpu_read(rcu_data.dynticks_nesting) < 0,
+                         "RCU dynticks_nesting counter underflow!");
+        RCU_LOCKDEP_WARN(__this_cpu_read(rcu_data.dynticks_nmi_nesting) <= 0,
+                         "RCU dynticks_nmi_nesting counter underflow/zero!");
+
+        /* Are we at first interrupt nesting level? */
+        if (__this_cpu_read(rcu_data.dynticks_nmi_nesting) != 1)
+                return false;
+
+        /* Does CPU appear to be idle from an RCU standpoint? */
+        return __this_cpu_read(rcu_data.dynticks_nesting) == 0;
 }
 
-#define DEFAULT_RCU_BLIMIT 10     /* Maximum callbacks per rcu_do_batch. */
+#define DEFAULT_RCU_BLIMIT 10     /* Maximum callbacks per rcu_do_batch ... */
+#define DEFAULT_MAX_RCU_BLIMIT 10000 /* ... even during callback flood. */
 static long blimit = DEFAULT_RCU_BLIMIT;
 #define DEFAULT_RCU_QHIMARK 10000 /* If this many pending, ignore blimit. */
 static long qhimark = DEFAULT_RCU_QHIMARK;
@@ -2113,7 +2135,7 @@ static void rcu_do_batch(struct rcu_data *rdp)
 
         /* Reinstate batch limit if we have worked down the excess. */
         count = rcu_segcblist_n_cbs(&rdp->cblist);
-        if (rdp->blimit == LONG_MAX && count <= qlowmark)
+        if (rdp->blimit >= DEFAULT_MAX_RCU_BLIMIT && count <= qlowmark)
                 rdp->blimit = blimit;
 
         /* Reset ->qlen_last_fqs_check trigger if enough CBs have drained. */
@@ -2253,7 +2275,7 @@ void rcu_force_quiescent_state(void)
 EXPORT_SYMBOL_GPL(rcu_force_quiescent_state);
 
 /* Perform RCU core processing work for the current CPU.  */
-static __latent_entropy void rcu_core(struct softirq_action *unused)
+static __latent_entropy void rcu_core(void)
 {
         unsigned long flags;
         struct rcu_data *rdp = raw_cpu_ptr(&rcu_data);
@@ -2287,37 +2309,126 @@ static __latent_entropy void rcu_core(struct softirq_action *unused)
         rcu_check_gp_start_stall(rnp, rdp, rcu_jiffies_till_stall_check());
 
         /* If there are callbacks ready, invoke them. */
-        if (rcu_segcblist_ready_cbs(&rdp->cblist))
-                invoke_rcu_callbacks(rdp);
+        if (rcu_segcblist_ready_cbs(&rdp->cblist) &&
+            likely(READ_ONCE(rcu_scheduler_fully_active)))
+                rcu_do_batch(rdp);
 
         /* Do any needed deferred wakeups of rcuo kthreads. */
         do_nocb_deferred_wakeup(rdp);
         trace_rcu_utilization(TPS("End RCU core"));
 }
 
+static void rcu_core_si(struct softirq_action *h)
+{
+        rcu_core();
+}
+
+static void rcu_wake_cond(struct task_struct *t, int status)
+{
+        /*
+         * If the thread is yielding, only wake it when this
+         * is invoked from idle
+         */
+        if (t && (status != RCU_KTHREAD_YIELDING || is_idle_task(current)))
+                wake_up_process(t);
+}
+
+static void invoke_rcu_core_kthread(void)
+{
+        struct task_struct *t;
+        unsigned long flags;
+
+        local_irq_save(flags);
+        __this_cpu_write(rcu_data.rcu_cpu_has_work, 1);
+        t = __this_cpu_read(rcu_data.rcu_cpu_kthread_task);
+        if (t != NULL && t != current)
+                rcu_wake_cond(t, __this_cpu_read(rcu_data.rcu_cpu_kthread_status));
+        local_irq_restore(flags);
+}
+
 /*
- * Schedule RCU callback invocation.  If the running implementation of RCU
- * does not support RCU priority boosting, just do a direct call, otherwise
- * wake up the per-CPU kernel kthread.  Note that because we are running
- * on the current CPU with softirqs disabled, the rcu_cpu_kthread_task
- * cannot disappear out from under us.
+ * Wake up this CPU's rcuc kthread to do RCU core processing.
  */
-static void invoke_rcu_callbacks(struct rcu_data *rdp)
+static void invoke_rcu_core(void)
 {
-        if (unlikely(!READ_ONCE(rcu_scheduler_fully_active)))
-                return;
-        if (likely(!rcu_state.boost)) {
-                rcu_do_batch(rdp);
+        if (!cpu_online(smp_processor_id()))
                 return;
+        if (use_softirq)
+                raise_softirq(RCU_SOFTIRQ);
+        else
+                invoke_rcu_core_kthread();
+}
+
+static void rcu_cpu_kthread_park(unsigned int cpu)
+{
+        per_cpu(rcu_data.rcu_cpu_kthread_status, cpu) = RCU_KTHREAD_OFFCPU;
+}
+
+static int rcu_cpu_kthread_should_run(unsigned int cpu)
+{
+        return __this_cpu_read(rcu_data.rcu_cpu_has_work);
+}
+
+/*
+ * Per-CPU kernel thread that invokes RCU callbacks.  This replaces
+ * the RCU softirq used in configurations of RCU that do not support RCU
+ * priority boosting.
+ */
+static void rcu_cpu_kthread(unsigned int cpu)
+{
+        unsigned int *statusp = this_cpu_ptr(&rcu_data.rcu_cpu_kthread_status);
+        char work, *workp = this_cpu_ptr(&rcu_data.rcu_cpu_has_work);
+        int spincnt;
+
+        for (spincnt = 0; spincnt < 10; spincnt++) {
+                trace_rcu_utilization(TPS("Start CPU kthread@rcu_wait"));
+                local_bh_disable();
+                *statusp = RCU_KTHREAD_RUNNING;
+                local_irq_disable();
+                work = *workp;
+                *workp = 0;
+                local_irq_enable();
+                if (work)
+                        rcu_core();
+                local_bh_enable();
+                if (*workp == 0) {
+                        trace_rcu_utilization(TPS("End CPU kthread@rcu_wait"));
+                        *statusp = RCU_KTHREAD_WAITING;
+                        return;
+                }
         }
-        invoke_rcu_callbacks_kthread();
+        *statusp = RCU_KTHREAD_YIELDING;
+        trace_rcu_utilization(TPS("Start CPU kthread@rcu_yield"));
+        schedule_timeout_interruptible(2);
+        trace_rcu_utilization(TPS("End CPU kthread@rcu_yield"));
+        *statusp = RCU_KTHREAD_WAITING;
 }
 
-static void invoke_rcu_core(void)
+static struct smp_hotplug_thread rcu_cpu_thread_spec = {
+        .store                  = &rcu_data.rcu_cpu_kthread_task,
+        .thread_should_run      = rcu_cpu_kthread_should_run,
+        .thread_fn              = rcu_cpu_kthread,
+        .thread_comm            = "rcuc/%u",
+        .setup                  = rcu_cpu_kthread_setup,
+        .park                   = rcu_cpu_kthread_park,
+};
+
+/*
+ * Spawn per-CPU RCU core processing kthreads.
+ */
+static int __init rcu_spawn_core_kthreads(void)
 {
-        if (cpu_online(smp_processor_id()))
-                raise_softirq(RCU_SOFTIRQ);
+        int cpu;
+
+        for_each_possible_cpu(cpu)
+                per_cpu(rcu_data.rcu_cpu_has_work, cpu) = 0;
+        if (!IS_ENABLED(CONFIG_RCU_BOOST) && use_softirq)
+                return 0;
+        WARN_ONCE(smpboot_register_percpu_thread(&rcu_cpu_thread_spec),
+                  "%s: Could not start rcuc kthread, OOM is now expected behavior\n", __func__);
+        return 0;
 }
+early_initcall(rcu_spawn_core_kthreads);
 
 /*
  * Handle any core-RCU processing required by a call_rcu() invocation.
@@ -2354,7 +2465,7 @@ static void __call_rcu_core(struct rcu_data *rdp, struct rcu_head *head,
                         rcu_accelerate_cbs_unlocked(rdp->mynode, rdp);
                 } else {
                         /* Give the grace period a kick. */
-                        rdp->blimit = LONG_MAX;
+                        rdp->blimit = DEFAULT_MAX_RCU_BLIMIT;
                         if (rcu_state.n_force_qs == rdp->n_force_qs_snap &&
                             rcu_segcblist_first_pend_cb(&rdp->cblist) != head)
                                 rcu_force_quiescent_state();
@@ -3355,7 +3466,8 @@ void __init rcu_init(void)
         rcu_init_one();
         if (dump_tree)
                 rcu_dump_rcu_node_tree();
-        open_softirq(RCU_SOFTIRQ, rcu_core);
+        if (use_softirq)
+                open_softirq(RCU_SOFTIRQ, rcu_core_si);
 
         /*
          * We don't need protection against CPU-hotplug here because
diff --git a/kernel/rcu/tree.h b/kernel/rcu/tree.h
index e253d11af3c4..7acaf3a62d39 100644
--- a/kernel/rcu/tree.h
+++ b/kernel/rcu/tree.h
@@ -154,13 +154,15 @@ struct rcu_data {
         bool            core_needs_qs;  /* Core waits for quiesc state. */
         bool            beenonline;     /* CPU online at least once. */
         bool            gpwrap;         /* Possible ->gp_seq wrap. */
-        bool            deferred_qs;    /* This CPU awaiting a deferred QS? */
+        bool            exp_deferred_qs; /* This CPU awaiting a deferred QS? */
         struct rcu_node *mynode;        /* This CPU's leaf of hierarchy */
         unsigned long grpmask;          /* Mask to apply to leaf qsmask. */
         unsigned long   ticks_this_gp;  /* The number of scheduling-clock */
                                         /*  ticks this CPU has handled */
                                         /*  during and after the last grace */
                                         /* period it is aware of. */
+        struct irq_work defer_qs_iw;    /* Obtain later scheduler attention. */
+        bool defer_qs_iw_pending;       /* Scheduler attention pending? */
 
         /* 2) batch handling */
         struct rcu_segcblist cblist;    /* Segmented callback list, with */
@@ -407,8 +409,8 @@ void call_rcu(struct rcu_head *head, rcu_callback_t func);
 static void dump_blkd_tasks(struct rcu_node *rnp, int ncheck);
 static void rcu_initiate_boost(struct rcu_node *rnp, unsigned long flags);
 static void rcu_preempt_boost_start_gp(struct rcu_node *rnp);
-static void invoke_rcu_callbacks_kthread(void);
 static bool rcu_is_callbacks_kthread(void);
+static void rcu_cpu_kthread_setup(unsigned int cpu);
 static void __init rcu_spawn_boost_kthreads(void);
 static void rcu_prepare_kthreads(int cpu);
 static void rcu_cleanup_after_idle(void);
diff --git a/kernel/rcu/tree_exp.h b/kernel/rcu/tree_exp.h
index 9c990df880d1..af7e7b9c86af 100644
--- a/kernel/rcu/tree_exp.h
+++ b/kernel/rcu/tree_exp.h
@@ -250,7 +250,7 @@ static void rcu_report_exp_cpu_mult(struct rcu_node *rnp,
  */
 static void rcu_report_exp_rdp(struct rcu_data *rdp)
 {
-        WRITE_ONCE(rdp->deferred_qs, false);
+        WRITE_ONCE(rdp->exp_deferred_qs, false);
         rcu_report_exp_cpu_mult(rdp->mynode, rdp->grpmask, true);
 }
 
@@ -259,8 +259,7 @@ static bool sync_exp_work_done(unsigned long s)
 {
         if (rcu_exp_gp_seq_done(s)) {
                 trace_rcu_exp_grace_period(rcu_state.name, s, TPS("done"));
-                /* Ensure test happens before caller kfree(). */
-                smp_mb__before_atomic(); /* ^^^ */
+                smp_mb(); /* Ensure test happens before caller kfree(). */
                 return true;
         }
         return false;
@@ -384,7 +383,12 @@ retry_ipi:
                         mask_ofl_test |= mask;
                         continue;
                 }
+                if (get_cpu() == cpu) {
+                        put_cpu();
+                        continue;
+                }
                 ret = smp_call_function_single(cpu, rcu_exp_handler, NULL, 0);
+                put_cpu();
                 if (!ret) {
                         mask_ofl_ipi &= ~mask;
                         continue;
@@ -611,7 +615,7 @@ static void rcu_exp_handler(void *unused)
                     rcu_dynticks_curr_cpu_in_eqs()) {
                         rcu_report_exp_rdp(rdp);
                 } else {
-                        rdp->deferred_qs = true;
+                        rdp->exp_deferred_qs = true;
                         set_tsk_need_resched(t);
                         set_preempt_need_resched();
                 }
@@ -633,7 +637,7 @@ static void rcu_exp_handler(void *unused)
         if (t->rcu_read_lock_nesting > 0) {
                 raw_spin_lock_irqsave_rcu_node(rnp, flags);
                 if (rnp->expmask & rdp->grpmask) {
-                        rdp->deferred_qs = true;
+                        rdp->exp_deferred_qs = true;
                         t->rcu_read_unlock_special.b.exp_hint = true;
                 }
                 raw_spin_unlock_irqrestore_rcu_node(rnp, flags);
@@ -656,7 +660,7 @@ static void rcu_exp_handler(void *unused)
          *
          * Otherwise, force a context switch after the CPU enables everything.
          */
-        rdp->deferred_qs = true;
+        rdp->exp_deferred_qs = true;
         if (!(preempt_count() & (PREEMPT_MASK | SOFTIRQ_MASK)) ||
             WARN_ON_ONCE(rcu_dynticks_curr_cpu_in_eqs())) {
                 rcu_preempt_deferred_qs(t);
@@ -694,6 +698,16 @@ static int rcu_print_task_exp_stall(struct rcu_node *rnp)
 
 #else /* #ifdef CONFIG_PREEMPT_RCU */
 
+/* Request an expedited quiescent state. */
+static void rcu_exp_need_qs(void)
+{
+        __this_cpu_write(rcu_data.cpu_no_qs.b.exp, true);
+        /* Store .exp before .rcu_urgent_qs. */
+        smp_store_release(this_cpu_ptr(&rcu_data.rcu_urgent_qs), true);
+        set_tsk_need_resched(current);
+        set_preempt_need_resched();
+}
+
 /* Invoked on each online non-idle CPU for expedited quiescent state. */
 static void rcu_exp_handler(void *unused)
 {
@@ -709,25 +723,38 @@ static void rcu_exp_handler(void *unused)
                 rcu_report_exp_rdp(this_cpu_ptr(&rcu_data));
                 return;
         }
-        __this_cpu_write(rcu_data.cpu_no_qs.b.exp, true);
-        /* Store .exp before .rcu_urgent_qs. */
-        smp_store_release(this_cpu_ptr(&rcu_data.rcu_urgent_qs), true);
-        set_tsk_need_resched(current);
-        set_preempt_need_resched();
+        rcu_exp_need_qs();
 }
 
 /* Send IPI for expedited cleanup if needed at end of CPU-hotplug operation. */
 static void sync_sched_exp_online_cleanup(int cpu)
 {
+        unsigned long flags;
+        int my_cpu;
         struct rcu_data *rdp;
         int ret;
         struct rcu_node *rnp;
 
         rdp = per_cpu_ptr(&rcu_data, cpu);
         rnp = rdp->mynode;
-        if (!(READ_ONCE(rnp->expmask) & rdp->grpmask))
+        my_cpu = get_cpu();
+        /* Quiescent state either not needed or already requested, leave. */
+        if (!(READ_ONCE(rnp->expmask) & rdp->grpmask) ||
+            __this_cpu_read(rcu_data.cpu_no_qs.b.exp)) {
+                put_cpu();
+                return;
+        }
+        /* Quiescent state needed on current CPU, so set it up locally. */
+        if (my_cpu == cpu) {
+                local_irq_save(flags);
+                rcu_exp_need_qs();
+                local_irq_restore(flags);
+                put_cpu();
                 return;
+        }
+        /* Quiescent state needed on some other CPU, send IPI. */
         ret = smp_call_function_single(cpu, rcu_exp_handler, NULL, 0);
+        put_cpu();
         WARN_ON_ONCE(ret);
 }
 
@@ -765,7 +792,6 @@ static int rcu_print_task_exp_stall(struct rcu_node *rnp)
  */
 void synchronize_rcu_expedited(void)
 {
-        struct rcu_data *rdp;
         struct rcu_exp_work rew;
         struct rcu_node *rnp;
         unsigned long s;
@@ -802,7 +828,6 @@ void synchronize_rcu_expedited(void)
         }
 
         /* Wait for expedited grace period to complete. */
-        rdp = per_cpu_ptr(&rcu_data, raw_smp_processor_id());
         rnp = rcu_get_root();
         wait_event(rnp->exp_wq[rcu_seq_ctr(s) & 0x3],
                    sync_exp_work_done(s));
diff --git a/kernel/rcu/tree_plugin.h b/kernel/rcu/tree_plugin.h
index 1102765f91fd..acb225023ed1 100644
--- a/kernel/rcu/tree_plugin.h
+++ b/kernel/rcu/tree_plugin.h
@@ -11,29 +11,7 @@
  *         Paul E. McKenney <paulmck@linux.ibm.com>
  */
 
-#include <linux/delay.h>
-#include <linux/gfp.h>
-#include <linux/oom.h>
-#include <linux/sched/debug.h>
-#include <linux/smpboot.h>
-#include <linux/sched/isolation.h>
-#include <uapi/linux/sched/types.h>
-#include "../time/tick-internal.h"
-
-#ifdef CONFIG_RCU_BOOST
 #include "../locking/rtmutex_common.h"
-#else /* #ifdef CONFIG_RCU_BOOST */
-
-/*
- * Some architectures do not define rt_mutexes, but if !CONFIG_RCU_BOOST,
- * all uses are in dead code.  Provide a definition to keep the compiler
- * happy, but add WARN_ON_ONCE() to complain if used in the wrong place.
- * This probably needs to be excluded from -rt builds.
- */
-#define rt_mutex_owner(a) ({ WARN_ON_ONCE(1); NULL; })
-#define rt_mutex_futex_unlock(x) WARN_ON_ONCE(1)
-
-#endif /* #else #ifdef CONFIG_RCU_BOOST */
 
 #ifdef CONFIG_RCU_NOCB_CPU
 static cpumask_var_t rcu_nocb_mask; /* CPUs to have callbacks offloaded. */
@@ -94,6 +72,8 @@ static void __init rcu_bootup_announce_oddness(void)
                 pr_info("\tRCU debug GP init slowdown %d jiffies.\n", gp_init_delay);
         if (gp_cleanup_delay)
                 pr_info("\tRCU debug GP init slowdown %d jiffies.\n", gp_cleanup_delay);
+        if (!use_softirq)
+                pr_info("\tRCU_SOFTIRQ processing moved to rcuc kthreads.\n");
         if (IS_ENABLED(CONFIG_RCU_EQS_DEBUG))
                 pr_info("\tRCU debug extended QS entry/exit.\n");
         rcupdate_announce_bootup_oddness();
@@ -257,10 +237,10 @@ static void rcu_preempt_ctxt_queue(struct rcu_node *rnp, struct rcu_data *rdp)
          * no need to check for a subsequent expedited GP.  (Though we are
          * still in a quiescent state in any case.)
          */
-        if (blkd_state & RCU_EXP_BLKD && rdp->deferred_qs)
+        if (blkd_state & RCU_EXP_BLKD && rdp->exp_deferred_qs)
                 rcu_report_exp_rdp(rdp);
         else
-                WARN_ON_ONCE(rdp->deferred_qs);
+                WARN_ON_ONCE(rdp->exp_deferred_qs);
 }
 
 /*
@@ -357,7 +337,7 @@ void rcu_note_context_switch(bool preempt)
          * means that we continue to block the current grace period.
          */
         rcu_qs();
-        if (rdp->deferred_qs)
+        if (rdp->exp_deferred_qs)
                 rcu_report_exp_rdp(rdp);
         trace_rcu_utilization(TPS("End context switch"));
         barrier(); /* Avoid RCU read-side critical sections leaking up. */
@@ -471,14 +451,15 @@ rcu_preempt_deferred_qs_irqrestore(struct task_struct *t, unsigned long flags)
          */
         special = t->rcu_read_unlock_special;
         rdp = this_cpu_ptr(&rcu_data);
-        if (!special.s && !rdp->deferred_qs) {
+        if (!special.s && !rdp->exp_deferred_qs) {
                 local_irq_restore(flags);
                 return;
         }
+        t->rcu_read_unlock_special.b.deferred_qs = false;
         if (special.b.need_qs) {
                 rcu_qs();
                 t->rcu_read_unlock_special.b.need_qs = false;
-                if (!t->rcu_read_unlock_special.s && !rdp->deferred_qs) {
+                if (!t->rcu_read_unlock_special.s && !rdp->exp_deferred_qs) {
                         local_irq_restore(flags);
                         return;
                 }
@@ -490,7 +471,7 @@ rcu_preempt_deferred_qs_irqrestore(struct task_struct *t, unsigned long flags)
          * tasks are handled when removing the task from the
          * blocked-tasks list below.
          */
-        if (rdp->deferred_qs) {
+        if (rdp->exp_deferred_qs) {
                 rcu_report_exp_rdp(rdp);
                 if (!t->rcu_read_unlock_special.s) {
                         local_irq_restore(flags);
@@ -579,7 +560,7 @@ rcu_preempt_deferred_qs_irqrestore(struct task_struct *t, unsigned long flags)
  */
 static bool rcu_preempt_need_deferred_qs(struct task_struct *t)
 {
-        return (__this_cpu_read(rcu_data.deferred_qs) ||
+        return (__this_cpu_read(rcu_data.exp_deferred_qs) ||
                 READ_ONCE(t->rcu_read_unlock_special.s)) &&
                t->rcu_read_lock_nesting <= 0;
 }
@@ -607,6 +588,17 @@ static void rcu_preempt_deferred_qs(struct task_struct *t)
 }
 
 /*
+ * Minimal handler to give the scheduler a chance to re-evaluate.
+ */
+static void rcu_preempt_deferred_qs_handler(struct irq_work *iwp)
+{
+        struct rcu_data *rdp;
+
+        rdp = container_of(iwp, struct rcu_data, defer_qs_iw);
+        rdp->defer_qs_iw_pending = false;
+}
+
+/*
  * Handle special cases during rcu_read_unlock(), such as needing to
  * notify RCU core processing or task having blocked during the RCU
  * read-side critical section.
@@ -625,16 +617,41 @@ static void rcu_read_unlock_special(struct task_struct *t)
         local_irq_save(flags);
         irqs_were_disabled = irqs_disabled_flags(flags);
         if (preempt_bh_were_disabled || irqs_were_disabled) {
-                WRITE_ONCE(t->rcu_read_unlock_special.b.exp_hint, false);
-                /* Need to defer quiescent state until everything is enabled. */
-                if (irqs_were_disabled) {
-                        /* Enabling irqs does not reschedule, so... */
+                bool exp;
+                struct rcu_data *rdp = this_cpu_ptr(&rcu_data);
+                struct rcu_node *rnp = rdp->mynode;
+
+                t->rcu_read_unlock_special.b.exp_hint = false;
+                exp = (t->rcu_blocked_node && t->rcu_blocked_node->exp_tasks) ||
+                      (rdp->grpmask & rnp->expmask) ||
+                      tick_nohz_full_cpu(rdp->cpu);
+                // Need to defer quiescent state until everything is enabled.
+                if ((exp || in_irq()) && irqs_were_disabled && use_softirq &&
+                    (in_irq() || !t->rcu_read_unlock_special.b.deferred_qs)) {
+                        // Using softirq, safe to awaken, and we get
+                        // no help from enabling irqs, unlike bh/preempt.
                         raise_softirq_irqoff(RCU_SOFTIRQ);
+                } else if (exp && irqs_were_disabled && !use_softirq &&
+                           !t->rcu_read_unlock_special.b.deferred_qs) {
+                        // Safe to awaken and we get no help from enabling
+                        // irqs, unlike bh/preempt.
+                        invoke_rcu_core();
                 } else {
-                        /* Enabling BH or preempt does reschedule, so... */
+                        // Enabling BH or preempt does reschedule, so...
+                        // Also if no expediting or NO_HZ_FULL, slow is OK.
                         set_tsk_need_resched(current);
                         set_preempt_need_resched();
+                        if (IS_ENABLED(CONFIG_IRQ_WORK) &&
+                            !rdp->defer_qs_iw_pending && exp) {
+                                // Get scheduler to re-evaluate and call hooks.
+                                // If !IRQ_WORK, FQS scan will eventually IPI.
+                                init_irq_work(&rdp->defer_qs_iw,
+                                              rcu_preempt_deferred_qs_handler);
+                                rdp->defer_qs_iw_pending = true;
+                                irq_work_queue_on(&rdp->defer_qs_iw, rdp->cpu);
+                        }
                 }
+                t->rcu_read_unlock_special.b.deferred_qs = true;
                 local_irq_restore(flags);
                 return;
         }
@@ -760,7 +777,7 @@ dump_blkd_tasks(struct rcu_node *rnp, int ncheck)
         i = 0;
         list_for_each(lhp, &rnp->blkd_tasks) {
                 pr_cont(" %p", lhp);
-                if (++i >= 10)
+                if (++i >= ncheck)
                         break;
         }
         pr_cont("\n");
@@ -944,18 +961,21 @@ dump_blkd_tasks(struct rcu_node *rnp, int ncheck)
 
 #endif /* #else #ifdef CONFIG_PREEMPT_RCU */
 
+/*
+ * If boosting, set rcuc kthreads to realtime priority.
+ */
+static void rcu_cpu_kthread_setup(unsigned int cpu)
+{
 #ifdef CONFIG_RCU_BOOST
+        struct sched_param sp;
 
-static void rcu_wake_cond(struct task_struct *t, int status)
-{
-        /*
-         * If the thread is yielding, only wake it when this
-         * is invoked from idle
-         */
-        if (status != RCU_KTHREAD_YIELDING || is_idle_task(current))
-                wake_up_process(t);
+        sp.sched_priority = kthread_prio;
+        sched_setscheduler_nocheck(current, SCHED_FIFO, &sp);
+#endif /* #ifdef CONFIG_RCU_BOOST */
 }
 
+#ifdef CONFIG_RCU_BOOST
+
 /*
  * Carry out RCU priority boosting on the task indicated by ->exp_tasks
  * or ->boost_tasks, advancing the pointer to the next task in the
@@ -1091,23 +1111,6 @@ static void rcu_initiate_boost(struct rcu_node *rnp, unsigned long flags)
 }
 
 /*
- * Wake up the per-CPU kthread to invoke RCU callbacks.
- */
-static void invoke_rcu_callbacks_kthread(void)
-{
-        unsigned long flags;
-
-        local_irq_save(flags);
-        __this_cpu_write(rcu_data.rcu_cpu_has_work, 1);
-        if (__this_cpu_read(rcu_data.rcu_cpu_kthread_task) != NULL &&
-            current != __this_cpu_read(rcu_data.rcu_cpu_kthread_task)) {
-                rcu_wake_cond(__this_cpu_read(rcu_data.rcu_cpu_kthread_task),
-                              __this_cpu_read(rcu_data.rcu_cpu_kthread_status));
-        }
-        local_irq_restore(flags);
-}
-
-/*
  * Is the current CPU running the RCU-callbacks kthread?
  * Caller must have preemption disabled.
  */
@@ -1160,59 +1163,6 @@ static int rcu_spawn_one_boost_kthread(struct rcu_node *rnp)
         return 0;
 }
 
-static void rcu_cpu_kthread_setup(unsigned int cpu)
-{
-        struct sched_param sp;
-
-        sp.sched_priority = kthread_prio;
-        sched_setscheduler_nocheck(current, SCHED_FIFO, &sp);
-}
-
-static void rcu_cpu_kthread_park(unsigned int cpu)
-{
-        per_cpu(rcu_data.rcu_cpu_kthread_status, cpu) = RCU_KTHREAD_OFFCPU;
-}
-
-static int rcu_cpu_kthread_should_run(unsigned int cpu)
-{
-        return __this_cpu_read(rcu_data.rcu_cpu_has_work);
-}
-
-/*
- * Per-CPU kernel thread that invokes RCU callbacks.  This replaces
- * the RCU softirq used in configurations of RCU that do not support RCU
- * priority boosting.
- */
-static void rcu_cpu_kthread(unsigned int cpu)
-{
-        unsigned int *statusp = this_cpu_ptr(&rcu_data.rcu_cpu_kthread_status);
-        char work, *workp = this_cpu_ptr(&rcu_data.rcu_cpu_has_work);
-        int spincnt;
-
-        for (spincnt = 0; spincnt < 10; spincnt++) {
-                trace_rcu_utilization(TPS("Start CPU kthread@rcu_wait"));
-                local_bh_disable();
-                *statusp = RCU_KTHREAD_RUNNING;
-                local_irq_disable();
-                work = *workp;
-                *workp = 0;
-                local_irq_enable();
-                if (work)
-                        rcu_do_batch(this_cpu_ptr(&rcu_data));
-                local_bh_enable();
-                if (*workp == 0) {
-                        trace_rcu_utilization(TPS("End CPU kthread@rcu_wait"));
-                        *statusp = RCU_KTHREAD_WAITING;
-                        return;
-                }
-        }
-        *statusp = RCU_KTHREAD_YIELDING;
-        trace_rcu_utilization(TPS("Start CPU kthread@rcu_yield"));
-        schedule_timeout_interruptible(2);
-        trace_rcu_utilization(TPS("End CPU kthread@rcu_yield"));
-        *statusp = RCU_KTHREAD_WAITING;
-}
-
 /*
  * Set the per-rcu_node kthread's affinity to cover all CPUs that are
  * served by the rcu_node in question.  The CPU hotplug lock is still
@@ -1243,27 +1193,13 @@ static void rcu_boost_kthread_setaffinity(struct rcu_node *rnp, int outgoingcpu)
         free_cpumask_var(cm);
 }
 
-static struct smp_hotplug_thread rcu_cpu_thread_spec = {
-        .store                  = &rcu_data.rcu_cpu_kthread_task,
-        .thread_should_run      = rcu_cpu_kthread_should_run,
-        .thread_fn              = rcu_cpu_kthread,
-        .thread_comm            = "rcuc/%u",
-        .setup                  = rcu_cpu_kthread_setup,
-        .park                   = rcu_cpu_kthread_park,
-};
-
 /*
  * Spawn boost kthreads -- called as soon as the scheduler is running.
  */
 static void __init rcu_spawn_boost_kthreads(void)
 {
         struct rcu_node *rnp;
-        int cpu;
 
-        for_each_possible_cpu(cpu)
-                per_cpu(rcu_data.rcu_cpu_has_work, cpu) = 0;
-        if (WARN_ONCE(smpboot_register_percpu_thread(&rcu_cpu_thread_spec), "%s: Could not start rcub kthread, OOM is now expected behavior\n", __func__))
-                return;
         rcu_for_each_leaf_node(rnp)
                 (void)rcu_spawn_one_boost_kthread(rnp);
 }
@@ -1286,11 +1222,6 @@ static void rcu_initiate_boost(struct rcu_node *rnp, unsigned long flags)
         raw_spin_unlock_irqrestore_rcu_node(rnp, flags);
 }
 
-static void invoke_rcu_callbacks_kthread(void)
-{
-        WARN_ON_ONCE(1);
-}
-
 static bool rcu_is_callbacks_kthread(void)
 {
         return false;
diff --git a/kernel/rcu/tree_stall.h b/kernel/rcu/tree_stall.h
index f65a73a97323..065183391f75 100644
--- a/kernel/rcu/tree_stall.h
+++ b/kernel/rcu/tree_stall.h
@@ -630,7 +630,9 @@ static void rcu_check_gp_start_stall(struct rcu_node *rnp, struct rcu_data *rdp,
             time_before(j, rcu_state.gp_req_activity + gpssdelay) ||
             time_before(j, rcu_state.gp_activity + gpssdelay) ||
             atomic_xchg(&warned, 1)) {
-                raw_spin_unlock_rcu_node(rnp_root); /* irqs remain disabled. */
+                if (rnp_root != rnp)
+                        /* irqs remain disabled. */
+                        raw_spin_unlock_rcu_node(rnp_root);
                 raw_spin_unlock_irqrestore_rcu_node(rnp, flags);
                 return;
         }
diff --git a/kernel/rcu/update.c b/kernel/rcu/update.c
index c3bf44ba42e5..61df2bf08563 100644
--- a/kernel/rcu/update.c
+++ b/kernel/rcu/update.c
@@ -423,6 +423,19 @@ EXPORT_SYMBOL_GPL(do_trace_rcu_torture_read);
         do { } while (0)
 #endif
 
+#if IS_ENABLED(CONFIG_RCU_TORTURE_TEST) || IS_MODULE(CONFIG_RCU_TORTURE_TEST)
+/* Get rcutorture access to sched_setaffinity(). */
+long rcutorture_sched_setaffinity(pid_t pid, const struct cpumask *in_mask)
+{
+        int ret;
+
+        ret = sched_setaffinity(pid, in_mask);
+        WARN_ONCE(ret, "%s: sched_setaffinity() returned %d\n", __func__, ret);
+        return ret;
+}
+EXPORT_SYMBOL_GPL(rcutorture_sched_setaffinity);
+#endif
+
 #ifdef CONFIG_RCU_STALL_COMMON
 int rcu_cpu_stall_suppress __read_mostly; /* 1 = suppress stall warnings. */
 EXPORT_SYMBOL_GPL(rcu_cpu_stall_suppress);
diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
index b798fe7ff7cd..036be95a87e9 100644
--- a/kernel/sched/fair.c
+++ b/kernel/sched/fair.c
@@ -5922,6 +5922,7 @@ static int select_idle_cpu(struct task_struct *p, struct sched_domain *sd, int t
         u64 time, cost;
         s64 delta;
         int cpu, nr = INT_MAX;
+        int this = smp_processor_id();
 
         this_sd = rcu_dereference(*this_cpu_ptr(&sd_llc));
         if (!this_sd)
@@ -5945,7 +5946,7 @@ static int select_idle_cpu(struct task_struct *p, struct sched_domain *sd, int t
                         nr = 4;
         }
 
-        time = local_clock();
+        time = cpu_clock(this);
 
         for_each_cpu_wrap(cpu, sched_domain_span(sd), target) {
                 if (!--nr)
@@ -5956,7 +5957,7 @@ static int select_idle_cpu(struct task_struct *p, struct sched_domain *sd, int t
                         break;
         }
 
-        time = local_clock() - time;
+        time = cpu_clock(this) - time;
         cost = this_sd->avg_scan_cost;
         delta = (s64)(time - cost) / 8;
         this_sd->avg_scan_cost += delta;
diff --git a/kernel/signal.c b/kernel/signal.c
index d622eac9d169..edf8915ddd54 100644
--- a/kernel/signal.c
+++ b/kernel/signal.c
@@ -2912,7 +2912,8 @@ EXPORT_SYMBOL(set_compat_user_sigmask);
  * This is useful for syscalls such as ppoll, pselect, io_pgetevents and
  * epoll_pwait where a new sigmask is passed in from userland for the syscalls.
  */
-void restore_user_sigmask(const void __user *usigmask, sigset_t *sigsaved)
+void restore_user_sigmask(const void __user *usigmask, sigset_t *sigsaved,
+                                bool interrupted)
 {
 
         if (!usigmask)
@@ -2922,7 +2923,7 @@ void restore_user_sigmask(const void __user *usigmask, sigset_t *sigsaved)
          * Restoring sigmask here can lead to delivering signals that the above
          * syscalls are intended to block because of the sigmask passed in.
          */
-        if (signal_pending(current)) {
+        if (interrupted) {
                 current->saved_sigmask = *sigsaved;
                 set_restore_sigmask();
                 return;
diff --git a/kernel/smp.c b/kernel/smp.c
index d155374632eb..616d4d114847 100644
--- a/kernel/smp.c
+++ b/kernel/smp.c
@@ -34,7 +34,7 @@ struct call_function_data {
         cpumask_var_t           cpumask_ipi;
 };
 
-static DEFINE_PER_CPU_SHARED_ALIGNED(struct call_function_data, cfd_data);
+static DEFINE_PER_CPU_ALIGNED(struct call_function_data, cfd_data);
 
 static DEFINE_PER_CPU_SHARED_ALIGNED(struct llist_head, call_single_queue);
 
@@ -487,13 +487,11 @@ EXPORT_SYMBOL(smp_call_function_many);
  * You must not call this function with disabled interrupts or from a
  * hardware interrupt handler or from a bottom half handler.
  */
-int smp_call_function(smp_call_func_t func, void *info, int wait)
+void smp_call_function(smp_call_func_t func, void *info, int wait)
 {
         preempt_disable();
         smp_call_function_many(cpu_online_mask, func, info, wait);
         preempt_enable();
-
-        return 0;
 }
 EXPORT_SYMBOL(smp_call_function);
 
@@ -594,18 +592,16 @@ void __init smp_init(void)
  * early_boot_irqs_disabled is set.  Use local_irq_save/restore() instead
  * of local_irq_disable/enable().
  */
-int on_each_cpu(void (*func) (void *info), void *info, int wait)
+void on_each_cpu(void (*func) (void *info), void *info, int wait)
 {
         unsigned long flags;
-        int ret = 0;
 
         preempt_disable();
-        ret = smp_call_function(func, info, wait);
+        smp_call_function(func, info, wait);
         local_irq_save(flags);
         func(info);
         local_irq_restore(flags);
         preempt_enable();
-        return ret;
 }
 EXPORT_SYMBOL(on_each_cpu);
 
diff --git a/kernel/softirq.c b/kernel/softirq.c
index a6b81c6b6bff..0427a86743a4 100644
--- a/kernel/softirq.c
+++ b/kernel/softirq.c
@@ -649,7 +649,7 @@ static int takeover_tasklets(unsigned int cpu)
         /* Find end, append list for that CPU. */
         if (&per_cpu(tasklet_vec, cpu).head != per_cpu(tasklet_vec, cpu).tail) {
                 *__this_cpu_read(tasklet_vec.tail) = per_cpu(tasklet_vec, cpu).head;
-                this_cpu_write(tasklet_vec.tail, per_cpu(tasklet_vec, cpu).tail);
+                __this_cpu_write(tasklet_vec.tail, per_cpu(tasklet_vec, cpu).tail);
                 per_cpu(tasklet_vec, cpu).head = NULL;
                 per_cpu(tasklet_vec, cpu).tail = &per_cpu(tasklet_vec, cpu).head;
         }
diff --git a/kernel/stop_machine.c b/kernel/stop_machine.c
index 2b5a6754646f..b4f83f7bdf86 100644
--- a/kernel/stop_machine.c
+++ b/kernel/stop_machine.c
@@ -177,12 +177,18 @@ static void ack_state(struct multi_stop_data *msdata)
                 set_state(msdata, msdata->state + 1);
 }
 
+void __weak stop_machine_yield(const struct cpumask *cpumask)
+{
+        cpu_relax();
+}
+
 /* This is the cpu_stop function which stops the CPU. */
 static int multi_cpu_stop(void *data)
 {
         struct multi_stop_data *msdata = data;
         enum multi_stop_state curstate = MULTI_STOP_NONE;
         int cpu = smp_processor_id(), err = 0;
+        const struct cpumask *cpumask;
         unsigned long flags;
         bool is_active;
 
@@ -192,15 +198,18 @@ static int multi_cpu_stop(void *data)
          */
         local_save_flags(flags);
 
-        if (!msdata->active_cpus)
-                is_active = cpu == cpumask_first(cpu_online_mask);
-        else
-                is_active = cpumask_test_cpu(cpu, msdata->active_cpus);
+        if (!msdata->active_cpus) {
+                cpumask = cpu_online_mask;
+                is_active = cpu == cpumask_first(cpumask);
+        } else {
+                cpumask = msdata->active_cpus;
+                is_active = cpumask_test_cpu(cpu, cpumask);
+        }
 
         /* Simple state machine */
         do {
                 /* Chill out and ensure we re-read multi_stop_state. */
-                cpu_relax_yield();
+                stop_machine_yield(cpumask);
                 if (msdata->state != curstate) {
                         curstate = msdata->state;
                         switch (curstate) {
diff --git a/kernel/time/Makefile b/kernel/time/Makefile
index f1e46f338a9c..1867044800bb 100644
--- a/kernel/time/Makefile
+++ b/kernel/time/Makefile
@@ -16,5 +16,6 @@ ifeq ($(CONFIG_GENERIC_CLOCKEVENTS_BROADCAST),y)
 endif
 obj-$(CONFIG_GENERIC_SCHED_CLOCK)               += sched_clock.o
 obj-$(CONFIG_TICK_ONESHOT)                      += tick-oneshot.o tick-sched.o
+obj-$(CONFIG_HAVE_GENERIC_VDSO)                 += vsyscall.o
 obj-$(CONFIG_DEBUG_FS)                          += timekeeping_debug.o
 obj-$(CONFIG_TEST_UDELAY)                       += test_udelay.o
diff --git a/kernel/time/alarmtimer.c b/kernel/time/alarmtimer.c
index 0519a8805aab..57518efc3810 100644
--- a/kernel/time/alarmtimer.c
+++ b/kernel/time/alarmtimer.c
@@ -233,7 +233,6 @@ EXPORT_SYMBOL_GPL(alarm_expires_remaining);
 /**
  * alarmtimer_suspend - Suspend time callback
  * @dev: unused
- * @state: unused
  *
  * When we are going into suspend, we look through the bases
  * to see which is the soonest timer to expire. We then
diff --git a/kernel/time/clocksource.c b/kernel/time/clocksource.c
index 3bcc19ceb073..fff5f64981c6 100644
--- a/kernel/time/clocksource.c
+++ b/kernel/time/clocksource.c
@@ -105,12 +105,12 @@ static DEFINE_SPINLOCK(watchdog_lock);
 static int watchdog_running;
 static atomic_t watchdog_reset_pending;
 
-static void inline clocksource_watchdog_lock(unsigned long *flags)
+static inline void clocksource_watchdog_lock(unsigned long *flags)
 {
         spin_lock_irqsave(&watchdog_lock, *flags);
 }
 
-static void inline clocksource_watchdog_unlock(unsigned long *flags)
+static inline void clocksource_watchdog_unlock(unsigned long *flags)
 {
         spin_unlock_irqrestore(&watchdog_lock, *flags);
 }
diff --git a/kernel/time/hrtimer.c b/kernel/time/hrtimer.c
index 41dfff23c1f9..5ee77f1a8a92 100644
--- a/kernel/time/hrtimer.c
+++ b/kernel/time/hrtimer.c
@@ -30,7 +30,6 @@
 #include <linux/syscalls.h>
 #include <linux/interrupt.h>
 #include <linux/tick.h>
-#include <linux/seq_file.h>
 #include <linux/err.h>
 #include <linux/debugobjects.h>
 #include <linux/sched/signal.h>
@@ -1115,9 +1114,10 @@ EXPORT_SYMBOL_GPL(hrtimer_start_range_ns);
  * @timer:      hrtimer to stop
  *
  * Returns:
- *  0 when the timer was not active
- *  1 when the timer was active
- * -1 when the timer is currently executing the callback function and
+ *
+ *  *  0 when the timer was not active
+ *  *  1 when the timer was active
+ *  * -1 when the timer is currently executing the callback function and
  *    cannot be stopped
  */
 int hrtimer_try_to_cancel(struct hrtimer *timer)
diff --git a/kernel/time/ntp.c b/kernel/time/ntp.c
index 8de4f789dc1b..65eb796610dc 100644
--- a/kernel/time/ntp.c
+++ b/kernel/time/ntp.c
@@ -43,6 +43,7 @@ static u64			tick_length_base;
 #define MAX_TICKADJ             500LL           /* usecs */
 #define MAX_TICKADJ_SCALED \
         (((MAX_TICKADJ * NSEC_PER_USEC) << NTP_SCALE_SHIFT) / NTP_INTERVAL_FREQ)
+#define MAX_TAI_OFFSET          100000
 
 /*
  * phase-lock loop variables
@@ -691,7 +692,8 @@ static inline void process_adjtimex_modes(const struct __kernel_timex *txc,
                 time_constant = max(time_constant, 0l);
         }
 
-        if (txc->modes & ADJ_TAI && txc->constant >= 0)
+        if (txc->modes & ADJ_TAI &&
+                        txc->constant >= 0 && txc->constant <= MAX_TAI_OFFSET)
                 *time_tai = txc->constant;
 
         if (txc->modes & ADJ_OFFSET)
diff --git a/kernel/time/posix-timers.c b/kernel/time/posix-timers.c
index 29176635991f..d7f2d91acdac 100644
--- a/kernel/time/posix-timers.c
+++ b/kernel/time/posix-timers.c
@@ -980,23 +980,16 @@ retry_delete:
  */
 static void itimer_delete(struct k_itimer *timer)
 {
-        unsigned long flags;
-
 retry_delete:
-        spin_lock_irqsave(&timer->it_lock, flags);
+        spin_lock_irq(&timer->it_lock);
 
         if (timer_delete_hook(timer) == TIMER_RETRY) {
-                unlock_timer(timer, flags);
+                spin_unlock_irq(&timer->it_lock);
                 goto retry_delete;
         }
         list_del(&timer->list);
-        /*
-         * This keeps any tasks waiting on the spin lock from thinking
-         * they got something (see the lock code above).
-         */
-        timer->it_signal = NULL;
 
-        unlock_timer(timer, flags);
+        spin_unlock_irq(&timer->it_lock);
         release_posix_timer(timer, IT_ID_SET);
 }
 
diff --git a/kernel/time/time.c b/kernel/time/time.c
index 7f7d6914ddd5..5c54ca632d08 100644
--- a/kernel/time/time.c
+++ b/kernel/time/time.c
@@ -251,6 +251,10 @@ COMPAT_SYSCALL_DEFINE2(settimeofday, struct old_timeval32 __user *, tv,
         if (tv) {
                 if (compat_get_timeval(&user_tv, tv))
                         return -EFAULT;
+
+                if (!timeval_valid(&user_tv))
+                        return -EINVAL;
+
                 new_ts.tv_sec = user_tv.tv_sec;
                 new_ts.tv_nsec = user_tv.tv_usec * NSEC_PER_USEC;
         }
diff --git a/kernel/time/timekeeping.c b/kernel/time/timekeeping.c
index 44b726bab4bd..d911c8470149 100644
--- a/kernel/time/timekeeping.c
+++ b/kernel/time/timekeeping.c
@@ -819,7 +819,7 @@ ktime_t ktime_get_coarse_with_offset(enum tk_offsets offs)
 
         } while (read_seqcount_retry(&tk_core.seq, seq));
 
-        return base + nsecs;
+        return ktime_add_ns(base, nsecs);
 }
 EXPORT_SYMBOL_GPL(ktime_get_coarse_with_offset);
 
diff --git a/kernel/time/timer_list.c b/kernel/time/timer_list.c
index 98ba50dcb1b2..acb326f5f50a 100644
--- a/kernel/time/timer_list.c
+++ b/kernel/time/timer_list.c
@@ -282,23 +282,6 @@ static inline void timer_list_header(struct seq_file *m, u64 now)
         SEQ_printf(m, "\n");
 }
 
-static int timer_list_show(struct seq_file *m, void *v)
-{
-        struct timer_list_iter *iter = v;
-
-        if (iter->cpu == -1 && !iter->second_pass)
-                timer_list_header(m, iter->now);
-        else if (!iter->second_pass)
-                print_cpu(m, iter->cpu, iter->now);
-#ifdef CONFIG_GENERIC_CLOCKEVENTS
-        else if (iter->cpu == -1 && iter->second_pass)
-                timer_list_show_tickdevices_header(m);
-        else
-                print_tickdevice(m, tick_get_device(iter->cpu), iter->cpu);
-#endif
-        return 0;
-}
-
 void sysrq_timer_list_show(void)
 {
         u64 now = ktime_to_ns(ktime_get());
@@ -317,6 +300,24 @@ void sysrq_timer_list_show(void)
         return;
 }
 
+#ifdef CONFIG_PROC_FS
+static int timer_list_show(struct seq_file *m, void *v)
+{
+        struct timer_list_iter *iter = v;
+
+        if (iter->cpu == -1 && !iter->second_pass)
+                timer_list_header(m, iter->now);
+        else if (!iter->second_pass)
+                print_cpu(m, iter->cpu, iter->now);
+#ifdef CONFIG_GENERIC_CLOCKEVENTS
+        else if (iter->cpu == -1 && iter->second_pass)
+                timer_list_show_tickdevices_header(m);
+        else
+                print_tickdevice(m, tick_get_device(iter->cpu), iter->cpu);
+#endif
+        return 0;
+}
+
 static void *move_iter(struct timer_list_iter *iter, loff_t offset)
 {
         for (; offset; offset--) {
@@ -376,3 +377,4 @@ static int __init init_timer_list_procfs(void)
         return 0;
 }
 __initcall(init_timer_list_procfs);
+#endif
diff --git a/kernel/time/vsyscall.c b/kernel/time/vsyscall.c
new file mode 100644
index 000000000000..a80893180826
--- /dev/null
+++ b/kernel/time/vsyscall.c
@@ -0,0 +1,133 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * Copyright 2019 ARM Ltd.
+ *
+ * Generic implementation of update_vsyscall and update_vsyscall_tz.
+ *
+ * Based on the x86 specific implementation.
+ */
+
+#include <linux/hrtimer.h>
+#include <linux/timekeeper_internal.h>
+#include <vdso/datapage.h>
+#include <vdso/helpers.h>
+#include <vdso/vsyscall.h>
+
+static inline void update_vdso_data(struct vdso_data *vdata,
+                                    struct timekeeper *tk)
+{
+        struct vdso_timestamp *vdso_ts;
+        u64 nsec;
+
+        vdata[CS_HRES_COARSE].cycle_last        = tk->tkr_mono.cycle_last;
+        vdata[CS_HRES_COARSE].mask              = tk->tkr_mono.mask;
+        vdata[CS_HRES_COARSE].mult              = tk->tkr_mono.mult;
+        vdata[CS_HRES_COARSE].shift             = tk->tkr_mono.shift;
+        vdata[CS_RAW].cycle_last                = tk->tkr_raw.cycle_last;
+        vdata[CS_RAW].mask                      = tk->tkr_raw.mask;
+        vdata[CS_RAW].mult                      = tk->tkr_raw.mult;
+        vdata[CS_RAW].shift                     = tk->tkr_raw.shift;
+
+        /* CLOCK_REALTIME */
+        vdso_ts         = &vdata[CS_HRES_COARSE].basetime[CLOCK_REALTIME];
+        vdso_ts->sec    = tk->xtime_sec;
+        vdso_ts->nsec   = tk->tkr_mono.xtime_nsec;
+
+        /* CLOCK_MONOTONIC */
+        vdso_ts         = &vdata[CS_HRES_COARSE].basetime[CLOCK_MONOTONIC];
+        vdso_ts->sec    = tk->xtime_sec + tk->wall_to_monotonic.tv_sec;
+
+        nsec = tk->tkr_mono.xtime_nsec;
+        nsec += ((u64)tk->wall_to_monotonic.tv_nsec << tk->tkr_mono.shift);
+        while (nsec >= (((u64)NSEC_PER_SEC) << tk->tkr_mono.shift)) {
+                nsec -= (((u64)NSEC_PER_SEC) << tk->tkr_mono.shift);
+                vdso_ts->sec++;
+        }
+        vdso_ts->nsec   = nsec;
+
+        /* CLOCK_MONOTONIC_RAW */
+        vdso_ts         = &vdata[CS_RAW].basetime[CLOCK_MONOTONIC_RAW];
+        vdso_ts->sec    = tk->raw_sec;
+        vdso_ts->nsec   = tk->tkr_raw.xtime_nsec;
+
+        /* CLOCK_BOOTTIME */
+        vdso_ts         = &vdata[CS_HRES_COARSE].basetime[CLOCK_BOOTTIME];
+        vdso_ts->sec    = tk->xtime_sec + tk->wall_to_monotonic.tv_sec;
+        nsec = tk->tkr_mono.xtime_nsec;
+        nsec += ((u64)(tk->wall_to_monotonic.tv_nsec +
+                       ktime_to_ns(tk->offs_boot)) << tk->tkr_mono.shift);
+        while (nsec >= (((u64)NSEC_PER_SEC) << tk->tkr_mono.shift)) {
+                nsec -= (((u64)NSEC_PER_SEC) << tk->tkr_mono.shift);
+                vdso_ts->sec++;
+        }
+        vdso_ts->nsec   = nsec;
+
+        /* CLOCK_TAI */
+        vdso_ts         = &vdata[CS_HRES_COARSE].basetime[CLOCK_TAI];
+        vdso_ts->sec    = tk->xtime_sec + (s64)tk->tai_offset;
+        vdso_ts->nsec   = tk->tkr_mono.xtime_nsec;
+
+        /*
+         * Read without the seqlock held by clock_getres().
+         * Note: No need to have a second copy.
+         */
+        WRITE_ONCE(vdata[CS_HRES_COARSE].hrtimer_res, hrtimer_resolution);
+}
+
+void update_vsyscall(struct timekeeper *tk)
+{
+        struct vdso_data *vdata = __arch_get_k_vdso_data();
+        struct vdso_timestamp *vdso_ts;
+        u64 nsec;
+
+        if (__arch_update_vdso_data()) {
+                /*
+                 * Some architectures might want to skip the update of the
+                 * data page.
+                 */
+                return;
+        }
+
+        /* copy vsyscall data */
+        vdso_write_begin(vdata);
+
+        vdata[CS_HRES_COARSE].clock_mode        = __arch_get_clock_mode(tk);
+        vdata[CS_RAW].clock_mode                = __arch_get_clock_mode(tk);
+
+        /* CLOCK_REALTIME_COARSE */
+        vdso_ts         = &vdata[CS_HRES_COARSE].basetime[CLOCK_REALTIME_COARSE];
+        vdso_ts->sec    = tk->xtime_sec;
+        vdso_ts->nsec   = tk->tkr_mono.xtime_nsec >> tk->tkr_mono.shift;
+
+        /* CLOCK_MONOTONIC_COARSE */
+        vdso_ts         = &vdata[CS_HRES_COARSE].basetime[CLOCK_MONOTONIC_COARSE];
+        vdso_ts->sec    = tk->xtime_sec + tk->wall_to_monotonic.tv_sec;
+        nsec            = tk->tkr_mono.xtime_nsec >> tk->tkr_mono.shift;
+        nsec            = nsec + tk->wall_to_monotonic.tv_nsec;
+        while (nsec >= NSEC_PER_SEC) {
+                nsec = nsec - NSEC_PER_SEC;
+                vdso_ts->sec++;
+        }
+        vdso_ts->nsec   = nsec;
+
+        if (__arch_use_vsyscall(vdata))
+                update_vdso_data(vdata, tk);
+
+        __arch_update_vsyscall(vdata, tk);
+
+        vdso_write_end(vdata);
+
+        __arch_sync_vdso_data(vdata);
+}
+
+void update_vsyscall_tz(void)
+{
+        struct vdso_data *vdata = __arch_get_k_vdso_data();
+
+        if (__arch_use_vsyscall(vdata)) {
+                vdata[CS_HRES_COARSE].tz_minuteswest = sys_tz.tz_minuteswest;
+                vdata[CS_HRES_COARSE].tz_dsttime = sys_tz.tz_dsttime;
+        }
+
+        __arch_sync_vdso_data(vdata);
+}
diff --git a/kernel/torture.c b/kernel/torture.c
index 17b2be9bde12..a8d9bdfba7c3 100644
--- a/kernel/torture.c
+++ b/kernel/torture.c
@@ -570,6 +570,7 @@ static void torture_shutdown_cleanup(void)
 static struct task_struct *stutter_task;
 static int stutter_pause_test;
 static int stutter;
+static int stutter_gap;
 
 /*
  * Block until the stutter interval ends.  This must be called periodically
@@ -578,10 +579,12 @@ static int stutter;
 bool stutter_wait(const char *title)
 {
         int spt;
+        bool ret = false;
 
         cond_resched_tasks_rcu_qs();
         spt = READ_ONCE(stutter_pause_test);
         for (; spt; spt = READ_ONCE(stutter_pause_test)) {
+                ret = true;
                 if (spt == 1) {
                         schedule_timeout_interruptible(1);
                 } else if (spt == 2) {
@@ -592,7 +595,7 @@ bool stutter_wait(const char *title)
                 }
                 torture_shutdown_absorb(title);
         }
-        return !!spt;
+        return ret;
 }
 EXPORT_SYMBOL_GPL(stutter_wait);
 
@@ -602,17 +605,24 @@ EXPORT_SYMBOL_GPL(stutter_wait);
  */
 static int torture_stutter(void *arg)
 {
+        int wtime;
+
         VERBOSE_TOROUT_STRING("torture_stutter task started");
         do {
                 if (!torture_must_stop() && stutter > 1) {
-                        WRITE_ONCE(stutter_pause_test, 1);
-                        schedule_timeout_interruptible(stutter - 1);
+                        wtime = stutter;
+                        if (stutter > HZ + 1) {
+                                WRITE_ONCE(stutter_pause_test, 1);
+                                wtime = stutter - HZ - 1;
+                                schedule_timeout_interruptible(wtime);
+                                wtime = HZ + 1;
+                        }
                         WRITE_ONCE(stutter_pause_test, 2);
-                        schedule_timeout_interruptible(1);
+                        schedule_timeout_interruptible(wtime);
                 }
                 WRITE_ONCE(stutter_pause_test, 0);
                 if (!torture_must_stop())
-                        schedule_timeout_interruptible(stutter);
+                        schedule_timeout_interruptible(stutter_gap);
                 torture_shutdown_absorb("torture_stutter");
         } while (!torture_must_stop());
         torture_kthread_stopping("torture_stutter");
@@ -622,9 +632,10 @@ static int torture_stutter(void *arg)
 /*
  * Initialize and kick off the torture_stutter kthread.
  */
-int torture_stutter_init(const int s)
+int torture_stutter_init(const int s, const int sgap)
 {
         stutter = s;
+        stutter_gap = sgap;
         return torture_create_kthread(torture_stutter, NULL, stutter_task);
 }
 EXPORT_SYMBOL_GPL(torture_stutter_init);
diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
index 38277af44f5c..576c41644e77 100644
--- a/kernel/trace/ftrace.c
+++ b/kernel/trace/ftrace.c
@@ -34,7 +34,6 @@
 #include <linux/hash.h>
 #include <linux/rcupdate.h>
 #include <linux/kprobes.h>
-#include <linux/memory.h>
 
 #include <trace/events/sched.h>
 
@@ -2611,12 +2610,10 @@ static void ftrace_run_update_code(int command)
 {
         int ret;
 
-        mutex_lock(&text_mutex);
-
         ret = ftrace_arch_code_modify_prepare();
         FTRACE_WARN_ON(ret);
         if (ret)
-                goto out_unlock;
+                return;
 
         /*
          * By default we use stop_machine() to modify the code.
@@ -2628,9 +2625,6 @@ static void ftrace_run_update_code(int command)
 
         ret = ftrace_arch_code_modify_post_process();
         FTRACE_WARN_ON(ret);
-
-out_unlock:
-        mutex_unlock(&text_mutex);
 }
 
 static void ftrace_run_modify_code(struct ftrace_ops *ops, int command,
@@ -5784,7 +5778,6 @@ void ftrace_module_enable(struct module *mod)
         struct ftrace_page *pg;
 
         mutex_lock(&ftrace_lock);
-        mutex_lock(&text_mutex);
 
         if (ftrace_disabled)
                 goto out_unlock;
@@ -5846,7 +5839,6 @@ void ftrace_module_enable(struct module *mod)
                 ftrace_arch_code_modify_post_process();
 
  out_unlock:
-        mutex_unlock(&text_mutex);
         mutex_unlock(&ftrace_lock);
 
         process_cached_mods(mod->name);
diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
index 83e08b78dbee..c3aabb576fe5 100644
--- a/kernel/trace/trace.c
+++ b/kernel/trace/trace.c
@@ -6719,11 +6719,13 @@ tracing_snapshot_write(struct file *filp, const char __user *ubuf, size_t cnt,
                         break;
                 }
 #endif
-                if (!tr->allocated_snapshot) {
+                if (tr->allocated_snapshot)
+                        ret = resize_buffer_duplicate_size(&tr->max_buffer,
+                                        &tr->trace_buffer, iter->cpu_file);
+                else
                         ret = tracing_alloc_snapshot_instance(tr);
-                        if (ret < 0)
-                                break;
-                }
+                if (ret < 0)
+                        break;
                 local_irq_disable();
                 /* Now, we're going to swap */
                 if (iter->cpu_file == RING_BUFFER_ALL_CPUS)
@@ -7126,12 +7128,24 @@ static ssize_t tracing_err_log_write(struct file *file,
         return count;
 }
 
+static int tracing_err_log_release(struct inode *inode, struct file *file)
+{
+        struct trace_array *tr = inode->i_private;
+
+        trace_array_put(tr);
+
+        if (file->f_mode & FMODE_READ)
+                seq_release(inode, file);
+
+        return 0;
+}
+
 static const struct file_operations tracing_err_log_fops = {
         .open           = tracing_err_log_open,
         .write          = tracing_err_log_write,
         .read           = seq_read,
         .llseek         = seq_lseek,
-        .release        = tracing_release_generic_tr,
+        .release        = tracing_err_log_release,
 };
 
 static int tracing_buffers_open(struct inode *inode, struct file *filp)
diff --git a/kernel/up.c b/kernel/up.c
index 483c9962c999..862b460ab97a 100644
--- a/kernel/up.c
+++ b/kernel/up.c
@@ -35,14 +35,13 @@ int smp_call_function_single_async(int cpu, call_single_data_t *csd)
 }
 EXPORT_SYMBOL(smp_call_function_single_async);
 
-int on_each_cpu(smp_call_func_t func, void *info, int wait)
+void on_each_cpu(smp_call_func_t func, void *info, int wait)
 {
         unsigned long flags;
 
         local_irq_save(flags);
         func(info);
         local_irq_restore(flags);
-        return 0;
 }
 EXPORT_SYMBOL(on_each_cpu);
 
diff --git a/lib/Kconfig b/lib/Kconfig
index 90623a0e1942..8c8eefc5e54c 100644
--- a/lib/Kconfig
+++ b/lib/Kconfig
@@ -576,6 +576,11 @@ config OID_REGISTRY
 config UCS2_STRING
         tristate
 
+#
+# generic vdso
+#
+source "lib/vdso/Kconfig"
+
 source "lib/fonts/Kconfig"
 
 config SG_SPLIT
diff --git a/lib/Kconfig.debug b/lib/Kconfig.debug
index cbdfae379896..06d9c9d70385 100644
--- a/lib/Kconfig.debug
+++ b/lib/Kconfig.debug
@@ -1095,7 +1095,7 @@ config PROVE_LOCKING
         select DEBUG_SPINLOCK
         select DEBUG_MUTEXES
         select DEBUG_RT_MUTEXES if RT_MUTEXES
-        select DEBUG_RWSEMS if RWSEM_SPIN_ON_OWNER
+        select DEBUG_RWSEMS
         select DEBUG_WW_MUTEX_SLOWPATH
         select DEBUG_LOCK_ALLOC
         select TRACE_IRQFLAGS
@@ -1199,10 +1199,10 @@ config DEBUG_WW_MUTEX_SLOWPATH
 
 config DEBUG_RWSEMS
         bool "RW Semaphore debugging: basic checks"
-        depends on DEBUG_KERNEL && RWSEM_SPIN_ON_OWNER
+        depends on DEBUG_KERNEL
         help
-          This debugging feature allows mismatched rw semaphore locks and unlocks
-          to be detected and reported.
+          This debugging feature allows mismatched rw semaphore locks
+          and unlocks to be detected and reported.
 
 config DEBUG_LOCK_ALLOC
         bool "Lock debugging: detect incorrect freeing of live locks"
@@ -1754,6 +1754,18 @@ config RBTREE_TEST
           A benchmark measuring the performance of the rbtree library.
           Also includes rbtree invariant checks.
 
+config REED_SOLOMON_TEST
+        tristate "Reed-Solomon library test"
+        depends on DEBUG_KERNEL || m
+        select REED_SOLOMON
+        select REED_SOLOMON_ENC16
+        select REED_SOLOMON_DEC16
+        help
+          This option enables the self-test function of rslib at boot,
+          or at module load time.
+
+          If unsure, say N.
+
 config INTERVAL_TREE_TEST
         tristate "Interval tree test"
         depends on DEBUG_KERNEL
@@ -1858,6 +1870,14 @@ config TEST_PARMAN
 
           If unsure, say N.
 
+config TEST_IRQ_TIMINGS
+        bool "IRQ timings selftest"
+        depends on IRQ_TIMINGS
+        help
+          Enable this option to test the irq timings code on boot.
+
+          If unsure, say N.
+
 config TEST_LKM
         tristate "Test module loading with 'hello world' module"
         depends on m
diff --git a/lib/atomic64.c b/lib/atomic64.c
index 7e6905751522..e98c85a99787 100644
--- a/lib/atomic64.c
+++ b/lib/atomic64.c
@@ -42,11 +42,11 @@ static inline raw_spinlock_t *lock_addr(const atomic64_t *v)
         return &atomic64_lock[addr & (NR_LOCKS - 1)].lock;
 }
 
-long long atomic64_read(const atomic64_t *v)
+s64 atomic64_read(const atomic64_t *v)
 {
         unsigned long flags;
         raw_spinlock_t *lock = lock_addr(v);
-        long long val;
+        s64 val;
 
         raw_spin_lock_irqsave(lock, flags);
         val = v->counter;
@@ -55,7 +55,7 @@ long long atomic64_read(const atomic64_t *v)
 }
 EXPORT_SYMBOL(atomic64_read);
 
-void atomic64_set(atomic64_t *v, long long i)
+void atomic64_set(atomic64_t *v, s64 i)
 {
         unsigned long flags;
         raw_spinlock_t *lock = lock_addr(v);
@@ -67,7 +67,7 @@ void atomic64_set(atomic64_t *v, long long i)
 EXPORT_SYMBOL(atomic64_set);
 
 #define ATOMIC64_OP(op, c_op)                                           \
-void atomic64_##op(long long a, atomic64_t *v)                          \
+void atomic64_##op(s64 a, atomic64_t *v)                                \
 {                                                                       \
         unsigned long flags;                                            \
         raw_spinlock_t *lock = lock_addr(v);                            \
@@ -79,11 +79,11 @@ void atomic64_##op(long long a, atomic64_t *v)				\
 EXPORT_SYMBOL(atomic64_##op);
 
 #define ATOMIC64_OP_RETURN(op, c_op)                                    \
-long long atomic64_##op##_return(long long a, atomic64_t *v)            \
+s64 atomic64_##op##_return(s64 a, atomic64_t *v)                        \
 {                                                                       \
         unsigned long flags;                                            \
         raw_spinlock_t *lock = lock_addr(v);                            \
-        long long val;                                                  \
+        s64 val;                                                        \
                                                                         \
         raw_spin_lock_irqsave(lock, flags);                             \
         val = (v->counter c_op a);                                      \
@@ -93,11 +93,11 @@ long long atomic64_##op##_return(long long a, atomic64_t *v)		\
 EXPORT_SYMBOL(atomic64_##op##_return);
 
 #define ATOMIC64_FETCH_OP(op, c_op)                                     \
-long long atomic64_fetch_##op(long long a, atomic64_t *v)               \
+s64 atomic64_fetch_##op(s64 a, atomic64_t *v)                           \
 {                                                                       \
         unsigned long flags;                                            \
         raw_spinlock_t *lock = lock_addr(v);                            \
-        long long val;                                                  \
+        s64 val;                                                        \
                                                                         \
         raw_spin_lock_irqsave(lock, flags);                             \
         val = v->counter;                                               \
@@ -130,11 +130,11 @@ ATOMIC64_OPS(xor, ^=)
 #undef ATOMIC64_OP_RETURN
 #undef ATOMIC64_OP
 
-long long atomic64_dec_if_positive(atomic64_t *v)
+s64 atomic64_dec_if_positive(atomic64_t *v)
 {
         unsigned long flags;
         raw_spinlock_t *lock = lock_addr(v);
-        long long val;
+        s64 val;
 
         raw_spin_lock_irqsave(lock, flags);
         val = v->counter - 1;
@@ -145,11 +145,11 @@ long long atomic64_dec_if_positive(atomic64_t *v)
 }
 EXPORT_SYMBOL(atomic64_dec_if_positive);
 
-long long atomic64_cmpxchg(atomic64_t *v, long long o, long long n)
+s64 atomic64_cmpxchg(atomic64_t *v, s64 o, s64 n)
 {
         unsigned long flags;
         raw_spinlock_t *lock = lock_addr(v);
-        long long val;
+        s64 val;
 
         raw_spin_lock_irqsave(lock, flags);
         val = v->counter;
@@ -160,11 +160,11 @@ long long atomic64_cmpxchg(atomic64_t *v, long long o, long long n)
 }
 EXPORT_SYMBOL(atomic64_cmpxchg);
 
-long long atomic64_xchg(atomic64_t *v, long long new)
+s64 atomic64_xchg(atomic64_t *v, s64 new)
 {
         unsigned long flags;
         raw_spinlock_t *lock = lock_addr(v);
-        long long val;
+        s64 val;
 
         raw_spin_lock_irqsave(lock, flags);
         val = v->counter;
@@ -174,11 +174,11 @@ long long atomic64_xchg(atomic64_t *v, long long new)
 }
 EXPORT_SYMBOL(atomic64_xchg);
 
-long long atomic64_fetch_add_unless(atomic64_t *v, long long a, long long u)
+s64 atomic64_fetch_add_unless(atomic64_t *v, s64 a, s64 u)
 {
         unsigned long flags;
         raw_spinlock_t *lock = lock_addr(v);
-        long long val;
+        s64 val;
 
         raw_spin_lock_irqsave(lock, flags);
         val = v->counter;
diff --git a/lib/debugobjects.c b/lib/debugobjects.c
index 55437fd5128b..61261195f5b6 100644
--- a/lib/debugobjects.c
+++ b/lib/debugobjects.c
@@ -25,16 +25,37 @@
 
 #define ODEBUG_POOL_SIZE        1024
 #define ODEBUG_POOL_MIN_LEVEL   256
+#define ODEBUG_POOL_PERCPU_SIZE 64
+#define ODEBUG_BATCH_SIZE       16
 
 #define ODEBUG_CHUNK_SHIFT      PAGE_SHIFT
 #define ODEBUG_CHUNK_SIZE       (1 << ODEBUG_CHUNK_SHIFT)
 #define ODEBUG_CHUNK_MASK       (~(ODEBUG_CHUNK_SIZE - 1))
 
+/*
+ * We limit the freeing of debug objects via workqueue at a maximum
+ * frequency of 10Hz and about 1024 objects for each freeing operation.
+ * So it is freeing at most 10k debug objects per second.
+ */
+#define ODEBUG_FREE_WORK_MAX    1024
+#define ODEBUG_FREE_WORK_DELAY  DIV_ROUND_UP(HZ, 10)
+
 struct debug_bucket {
         struct hlist_head       list;
         raw_spinlock_t          lock;
 };
 
+/*
+ * Debug object percpu free list
+ * Access is protected by disabling irq
+ */
+struct debug_percpu_free {
+        struct hlist_head       free_objs;
+        int                     obj_free;
+};
+
+static DEFINE_PER_CPU(struct debug_percpu_free, percpu_obj_pool);
+
 static struct debug_bucket      obj_hash[ODEBUG_HASH_SIZE];
 
 static struct debug_obj         obj_static_pool[ODEBUG_POOL_SIZE] __initdata;
@@ -44,13 +65,20 @@ static DEFINE_RAW_SPINLOCK(pool_lock);
 static HLIST_HEAD(obj_pool);
 static HLIST_HEAD(obj_to_free);
 
+/*
+ * Because of the presence of percpu free pools, obj_pool_free will
+ * under-count those in the percpu free pools. Similarly, obj_pool_used
+ * will over-count those in the percpu free pools. Adjustments will be
+ * made at debug_stats_show(). Both obj_pool_min_free and obj_pool_max_used
+ * can be off.
+ */
 static int                      obj_pool_min_free = ODEBUG_POOL_SIZE;
 static int                      obj_pool_free = ODEBUG_POOL_SIZE;
 static int                      obj_pool_used;
 static int                      obj_pool_max_used;
+static bool                     obj_freeing;
 /* The number of objs on the global free list */
 static int                      obj_nr_tofree;
-static struct kmem_cache        *obj_cache;
 
 static int                      debug_objects_maxchain __read_mostly;
 static int __maybe_unused       debug_objects_maxchecked __read_mostly;
@@ -63,6 +91,7 @@ static int			debug_objects_pool_size __read_mostly
 static int                      debug_objects_pool_min_level __read_mostly
                                 = ODEBUG_POOL_MIN_LEVEL;
 static struct debug_obj_descr   *descr_test  __read_mostly;
+static struct kmem_cache        *obj_cache __read_mostly;
 
 /*
  * Track numbers of kmem_cache_alloc()/free() calls done.
@@ -71,7 +100,7 @@ static int			debug_objects_allocated;
 static int                      debug_objects_freed;
 
 static void free_obj_work(struct work_struct *work);
-static DECLARE_WORK(debug_obj_work, free_obj_work);
+static DECLARE_DELAYED_WORK(debug_obj_work, free_obj_work);
 
 static int __init enable_object_debug(char *str)
 {
@@ -100,7 +129,7 @@ static const char *obj_states[ODEBUG_STATE_MAX] = {
 static void fill_pool(void)
 {
         gfp_t gfp = GFP_ATOMIC | __GFP_NORETRY | __GFP_NOWARN;
-        struct debug_obj *new, *obj;
+        struct debug_obj *obj;
         unsigned long flags;
 
         if (likely(obj_pool_free >= debug_objects_pool_min_level))
@@ -116,7 +145,7 @@ static void fill_pool(void)
                  * Recheck with the lock held as the worker thread might have
                  * won the race and freed the global free list already.
                  */
-                if (obj_nr_tofree) {
+                while (obj_nr_tofree && (obj_pool_free < obj_pool_min_free)) {
                         obj = hlist_entry(obj_to_free.first, typeof(*obj), node);
                         hlist_del(&obj->node);
                         obj_nr_tofree--;
@@ -130,15 +159,23 @@ static void fill_pool(void)
                 return;
 
         while (obj_pool_free < debug_objects_pool_min_level) {
+                struct debug_obj *new[ODEBUG_BATCH_SIZE];
+                int cnt;
 
-                new = kmem_cache_zalloc(obj_cache, gfp);
-                if (!new)
+                for (cnt = 0; cnt < ODEBUG_BATCH_SIZE; cnt++) {
+                        new[cnt] = kmem_cache_zalloc(obj_cache, gfp);
+                        if (!new[cnt])
+                                break;
+                }
+                if (!cnt)
                         return;
 
                 raw_spin_lock_irqsave(&pool_lock, flags);
-                hlist_add_head(&new->node, &obj_pool);
-                debug_objects_allocated++;
-                obj_pool_free++;
+                while (cnt) {
+                        hlist_add_head(&new[--cnt]->node, &obj_pool);
+                        debug_objects_allocated++;
+                        obj_pool_free++;
+                }
                 raw_spin_unlock_irqrestore(&pool_lock, flags);
         }
 }
@@ -163,36 +200,81 @@ static struct debug_obj *lookup_object(void *addr, struct debug_bucket *b)
 }
 
 /*
+ * Allocate a new object from the hlist
+ */
+static struct debug_obj *__alloc_object(struct hlist_head *list)
+{
+        struct debug_obj *obj = NULL;
+
+        if (list->first) {
+                obj = hlist_entry(list->first, typeof(*obj), node);
+                hlist_del(&obj->node);
+        }
+
+        return obj;
+}
+
+/*
  * Allocate a new object. If the pool is empty, switch off the debugger.
  * Must be called with interrupts disabled.
  */
 static struct debug_obj *
 alloc_object(void *addr, struct debug_bucket *b, struct debug_obj_descr *descr)
 {
-        struct debug_obj *obj = NULL;
+        struct debug_percpu_free *percpu_pool = this_cpu_ptr(&percpu_obj_pool);
+        struct debug_obj *obj;
 
-        raw_spin_lock(&pool_lock);
-        if (obj_pool.first) {
-                obj         = hlist_entry(obj_pool.first, typeof(*obj), node);
+        if (likely(obj_cache)) {
+                obj = __alloc_object(&percpu_pool->free_objs);
+                if (obj) {
+                        percpu_pool->obj_free--;
+                        goto init_obj;
+                }
+        }
 
-                obj->object = addr;
-                obj->descr  = descr;
-                obj->state  = ODEBUG_STATE_NONE;
-                obj->astate = 0;
-                hlist_del(&obj->node);
+        raw_spin_lock(&pool_lock);
+        obj = __alloc_object(&obj_pool);
+        if (obj) {
+                obj_pool_used++;
+                obj_pool_free--;
 
-                hlist_add_head(&obj->node, &b->list);
+                /*
+                 * Looking ahead, allocate one batch of debug objects and
+                 * put them into the percpu free pool.
+                 */
+                if (likely(obj_cache)) {
+                        int i;
+
+                        for (i = 0; i < ODEBUG_BATCH_SIZE; i++) {
+                                struct debug_obj *obj2;
+
+                                obj2 = __alloc_object(&obj_pool);
+                                if (!obj2)
+                                        break;
+                                hlist_add_head(&obj2->node,
+                                               &percpu_pool->free_objs);
+                                percpu_pool->obj_free++;
+                                obj_pool_used++;
+                                obj_pool_free--;
+                        }
+                }
 
-                obj_pool_used++;
                 if (obj_pool_used > obj_pool_max_used)
                         obj_pool_max_used = obj_pool_used;
 
-                obj_pool_free--;
                 if (obj_pool_free < obj_pool_min_free)
                         obj_pool_min_free = obj_pool_free;
         }
         raw_spin_unlock(&pool_lock);
 
+init_obj:
+        if (obj) {
+                obj->object = addr;
+                obj->descr  = descr;
+                obj->state  = ODEBUG_STATE_NONE;
+                obj->astate = 0;
+                hlist_add_head(&obj->node, &b->list);
+        }
         return obj;
 }
 
@@ -209,13 +291,19 @@ static void free_obj_work(struct work_struct *work)
         unsigned long flags;
         HLIST_HEAD(tofree);
 
+        WRITE_ONCE(obj_freeing, false);
         if (!raw_spin_trylock_irqsave(&pool_lock, flags))
                 return;
 
+        if (obj_pool_free >= debug_objects_pool_size)
+                goto free_objs;
+
         /*
          * The objs on the pool list might be allocated before the work is
          * run, so recheck if pool list it full or not, if not fill pool
-         * list from the global free list
+         * list from the global free list. As it is likely that a workload
+         * may be gearing up to use more and more objects, don't free any
+         * of them until the next round.
          */
         while (obj_nr_tofree && obj_pool_free < debug_objects_pool_size) {
                 obj = hlist_entry(obj_to_free.first, typeof(*obj), node);
@@ -224,7 +312,10 @@ static void free_obj_work(struct work_struct *work)
                 obj_pool_free++;
                 obj_nr_tofree--;
         }
+        raw_spin_unlock_irqrestore(&pool_lock, flags);
+        return;
 
+free_objs:
         /*
          * Pool list is already full and there are still objs on the free
          * list. Move remaining free objs to a temporary list to free the
@@ -243,24 +334,86 @@ static void free_obj_work(struct work_struct *work)
         }
 }
 
-static bool __free_object(struct debug_obj *obj)
+static void __free_object(struct debug_obj *obj)
 {
+        struct debug_obj *objs[ODEBUG_BATCH_SIZE];
+        struct debug_percpu_free *percpu_pool;
+        int lookahead_count = 0;
         unsigned long flags;
         bool work;
 
-        raw_spin_lock_irqsave(&pool_lock, flags);
-        work = (obj_pool_free > debug_objects_pool_size) && obj_cache;
+        local_irq_save(flags);
+        if (!obj_cache)
+                goto free_to_obj_pool;
+
+        /*
+         * Try to free it into the percpu pool first.
+         */
+        percpu_pool = this_cpu_ptr(&percpu_obj_pool);
+        if (percpu_pool->obj_free < ODEBUG_POOL_PERCPU_SIZE) {
+                hlist_add_head(&obj->node, &percpu_pool->free_objs);
+                percpu_pool->obj_free++;
+                local_irq_restore(flags);
+                return;
+        }
+
+        /*
+         * As the percpu pool is full, look ahead and pull out a batch
+         * of objects from the percpu pool and free them as well.
+         */
+        for (; lookahead_count < ODEBUG_BATCH_SIZE; lookahead_count++) {
+                objs[lookahead_count] = __alloc_object(&percpu_pool->free_objs);
+                if (!objs[lookahead_count])
+                        break;
+                percpu_pool->obj_free--;
+        }
+
+free_to_obj_pool:
+        raw_spin_lock(&pool_lock);
+        work = (obj_pool_free > debug_objects_pool_size) && obj_cache &&
+               (obj_nr_tofree < ODEBUG_FREE_WORK_MAX);
         obj_pool_used--;
 
         if (work) {
                 obj_nr_tofree++;
                 hlist_add_head(&obj->node, &obj_to_free);
+                if (lookahead_count) {
+                        obj_nr_tofree += lookahead_count;
+                        obj_pool_used -= lookahead_count;
+                        while (lookahead_count) {
+                                hlist_add_head(&objs[--lookahead_count]->node,
+                                               &obj_to_free);
+                        }
+                }
+
+                if ((obj_pool_free > debug_objects_pool_size) &&
+                    (obj_nr_tofree < ODEBUG_FREE_WORK_MAX)) {
+                        int i;
+
+                        /*
+                         * Free one more batch of objects from obj_pool.
+                         */
+                        for (i = 0; i < ODEBUG_BATCH_SIZE; i++) {
+                                obj = __alloc_object(&obj_pool);
+                                hlist_add_head(&obj->node, &obj_to_free);
+                                obj_pool_free--;
+                                obj_nr_tofree++;
+                        }
+                }
         } else {
                 obj_pool_free++;
                 hlist_add_head(&obj->node, &obj_pool);
+                if (lookahead_count) {
+                        obj_pool_free += lookahead_count;
+                        obj_pool_used -= lookahead_count;
+                        while (lookahead_count) {
+                                hlist_add_head(&objs[--lookahead_count]->node,
+                                               &obj_pool);
+                        }
+                }
         }
-        raw_spin_unlock_irqrestore(&pool_lock, flags);
-        return work;
+        raw_spin_unlock(&pool_lock);
+        local_irq_restore(flags);
 }
 
 /*
@@ -269,8 +422,11 @@ static bool __free_object(struct debug_obj *obj)
  */
 static void free_object(struct debug_obj *obj)
 {
-        if (__free_object(obj))
-                schedule_work(&debug_obj_work);
+        __free_object(obj);
+        if (!obj_freeing && obj_nr_tofree) {
+                WRITE_ONCE(obj_freeing, true);
+                schedule_delayed_work(&debug_obj_work, ODEBUG_FREE_WORK_DELAY);
+        }
 }
 
 /*
@@ -372,6 +528,7 @@ static void
 __debug_object_init(void *addr, struct debug_obj_descr *descr, int onstack)
 {
         enum debug_obj_state state;
+        bool check_stack = false;
         struct debug_bucket *db;
         struct debug_obj *obj;
         unsigned long flags;
@@ -391,7 +548,7 @@ __debug_object_init(void *addr, struct debug_obj_descr *descr, int onstack)
                         debug_objects_oom();
                         return;
                 }
-                debug_object_is_on_stack(addr, onstack);
+                check_stack = true;
         }
 
         switch (obj->state) {
@@ -402,20 +559,23 @@ __debug_object_init(void *addr, struct debug_obj_descr *descr, int onstack)
                 break;
 
         case ODEBUG_STATE_ACTIVE:
-                debug_print_object(obj, "init");
                 state = obj->state;
                 raw_spin_unlock_irqrestore(&db->lock, flags);
+                debug_print_object(obj, "init");
                 debug_object_fixup(descr->fixup_init, addr, state);
                 return;
 
         case ODEBUG_STATE_DESTROYED:
+                raw_spin_unlock_irqrestore(&db->lock, flags);
                 debug_print_object(obj, "init");
-                break;
+                return;
         default:
                 break;
         }
 
         raw_spin_unlock_irqrestore(&db->lock, flags);
+        if (check_stack)
+                debug_object_is_on_stack(addr, onstack);
 }
 
 /**
@@ -473,6 +633,8 @@ int debug_object_activate(void *addr, struct debug_obj_descr *descr)
 
         obj = lookup_object(addr, db);
         if (obj) {
+                bool print_object = false;
+
                 switch (obj->state) {
                 case ODEBUG_STATE_INIT:
                 case ODEBUG_STATE_INACTIVE:
@@ -481,14 +643,14 @@ int debug_object_activate(void *addr, struct debug_obj_descr *descr)
                         break;
 
                 case ODEBUG_STATE_ACTIVE:
-                        debug_print_object(obj, "activate");
                         state = obj->state;
                         raw_spin_unlock_irqrestore(&db->lock, flags);
+                        debug_print_object(obj, "activate");
                         ret = debug_object_fixup(descr->fixup_activate, addr, state);
                         return ret ? 0 : -EINVAL;
 
                 case ODEBUG_STATE_DESTROYED:
-                        debug_print_object(obj, "activate");
+                        print_object = true;
                         ret = -EINVAL;
                         break;
                 default:
@@ -496,10 +658,13 @@ int debug_object_activate(void *addr, struct debug_obj_descr *descr)
                         break;
                 }
                 raw_spin_unlock_irqrestore(&db->lock, flags);
+                if (print_object)
+                        debug_print_object(obj, "activate");
                 return ret;
         }
 
         raw_spin_unlock_irqrestore(&db->lock, flags);
+
         /*
          * We are here when a static object is activated. We
          * let the type specific code confirm whether this is
@@ -531,6 +696,7 @@ void debug_object_deactivate(void *addr, struct debug_obj_descr *descr)
         struct debug_bucket *db;
         struct debug_obj *obj;
         unsigned long flags;
+        bool print_object = false;
 
         if (!debug_objects_enabled)
                 return;
@@ -548,24 +714,27 @@ void debug_object_deactivate(void *addr, struct debug_obj_descr *descr)
                         if (!obj->astate)
                                 obj->state = ODEBUG_STATE_INACTIVE;
                         else
-                                debug_print_object(obj, "deactivate");
+                                print_object = true;
                         break;
 
                 case ODEBUG_STATE_DESTROYED:
-                        debug_print_object(obj, "deactivate");
+                        print_object = true;
                         break;
                 default:
                         break;
                 }
-        } else {
+        }
+
+        raw_spin_unlock_irqrestore(&db->lock, flags);
+        if (!obj) {
                 struct debug_obj o = { .object = addr,
                                        .state = ODEBUG_STATE_NOTAVAILABLE,
                                        .descr = descr };
 
                 debug_print_object(&o, "deactivate");
+        } else if (print_object) {
+                debug_print_object(obj, "deactivate");
         }
-
-        raw_spin_unlock_irqrestore(&db->lock, flags);
 }
 EXPORT_SYMBOL_GPL(debug_object_deactivate);
 
@@ -580,6 +749,7 @@ void debug_object_destroy(void *addr, struct debug_obj_descr *descr)
         struct debug_bucket *db;
         struct debug_obj *obj;
         unsigned long flags;
+        bool print_object = false;
 
         if (!debug_objects_enabled)
                 return;
@@ -599,20 +769,22 @@ void debug_object_destroy(void *addr, struct debug_obj_descr *descr)
                 obj->state = ODEBUG_STATE_DESTROYED;
                 break;
         case ODEBUG_STATE_ACTIVE:
-                debug_print_object(obj, "destroy");
                 state = obj->state;
                 raw_spin_unlock_irqrestore(&db->lock, flags);
+                debug_print_object(obj, "destroy");
                 debug_object_fixup(descr->fixup_destroy, addr, state);
                 return;
 
         case ODEBUG_STATE_DESTROYED:
-                debug_print_object(obj, "destroy");
+                print_object = true;
                 break;
         default:
                 break;
         }
 out_unlock:
         raw_spin_unlock_irqrestore(&db->lock, flags);
+        if (print_object)
+                debug_print_object(obj, "destroy");
 }
 EXPORT_SYMBOL_GPL(debug_object_destroy);
 
@@ -641,9 +813,9 @@ void debug_object_free(void *addr, struct debug_obj_descr *descr)
 
         switch (obj->state) {
         case ODEBUG_STATE_ACTIVE:
-                debug_print_object(obj, "free");
                 state = obj->state;
                 raw_spin_unlock_irqrestore(&db->lock, flags);
+                debug_print_object(obj, "free");
                 debug_object_fixup(descr->fixup_free, addr, state);
                 return;
         default:
@@ -716,6 +888,7 @@ debug_object_active_state(void *addr, struct debug_obj_descr *descr,
         struct debug_bucket *db;
         struct debug_obj *obj;
         unsigned long flags;
+        bool print_object = false;
 
         if (!debug_objects_enabled)
                 return;
@@ -731,22 +904,25 @@ debug_object_active_state(void *addr, struct debug_obj_descr *descr,
                         if (obj->astate == expect)
                                 obj->astate = next;
                         else
-                                debug_print_object(obj, "active_state");
+                                print_object = true;
                         break;
 
                 default:
-                        debug_print_object(obj, "active_state");
+                        print_object = true;
                         break;
                 }
-        } else {
+        }
+
+        raw_spin_unlock_irqrestore(&db->lock, flags);
+        if (!obj) {
                 struct debug_obj o = { .object = addr,
                                        .state = ODEBUG_STATE_NOTAVAILABLE,
                                        .descr = descr };
 
                 debug_print_object(&o, "active_state");
+        } else if (print_object) {
+                debug_print_object(obj, "active_state");
         }
-
-        raw_spin_unlock_irqrestore(&db->lock, flags);
 }
 EXPORT_SYMBOL_GPL(debug_object_active_state);
 
@@ -760,7 +936,6 @@ static void __debug_check_no_obj_freed(const void *address, unsigned long size)
         struct hlist_node *tmp;
         struct debug_obj *obj;
         int cnt, objs_checked = 0;
-        bool work = false;
 
         saddr = (unsigned long) address;
         eaddr = saddr + size;
@@ -782,16 +957,16 @@ repeat:
 
                         switch (obj->state) {
                         case ODEBUG_STATE_ACTIVE:
-                                debug_print_object(obj, "free");
                                 descr = obj->descr;
                                 state = obj->state;
                                 raw_spin_unlock_irqrestore(&db->lock, flags);
+                                debug_print_object(obj, "free");
                                 debug_object_fixup(descr->fixup_free,
                                                    (void *) oaddr, state);
                                 goto repeat;
                         default:
                                 hlist_del(&obj->node);
-                                work |= __free_object(obj);
+                                __free_object(obj);
                                 break;
                         }
                 }
@@ -807,8 +982,10 @@ repeat:
                 debug_objects_maxchecked = objs_checked;
 
         /* Schedule work to actually kmem_cache_free() objects */
-        if (work)
-                schedule_work(&debug_obj_work);
+        if (!obj_freeing && obj_nr_tofree) {
+                WRITE_ONCE(obj_freeing, true);
+                schedule_delayed_work(&debug_obj_work, ODEBUG_FREE_WORK_DELAY);
+        }
 }
 
 void debug_check_no_obj_freed(const void *address, unsigned long size)
@@ -822,13 +999,19 @@ void debug_check_no_obj_freed(const void *address, unsigned long size)
 
 static int debug_stats_show(struct seq_file *m, void *v)
 {
+        int cpu, obj_percpu_free = 0;
+
+        for_each_possible_cpu(cpu)
+                obj_percpu_free += per_cpu(percpu_obj_pool.obj_free, cpu);
+
         seq_printf(m, "max_chain     :%d\n", debug_objects_maxchain);
         seq_printf(m, "max_checked   :%d\n", debug_objects_maxchecked);
         seq_printf(m, "warnings      :%d\n", debug_objects_warnings);
         seq_printf(m, "fixups        :%d\n", debug_objects_fixups);
-        seq_printf(m, "pool_free     :%d\n", obj_pool_free);
+        seq_printf(m, "pool_free     :%d\n", obj_pool_free + obj_percpu_free);
+        seq_printf(m, "pool_pcp_free :%d\n", obj_percpu_free);
         seq_printf(m, "pool_min_free :%d\n", obj_pool_min_free);
-        seq_printf(m, "pool_used     :%d\n", obj_pool_used);
+        seq_printf(m, "pool_used     :%d\n", obj_pool_used - obj_percpu_free);
         seq_printf(m, "pool_max_used :%d\n", obj_pool_max_used);
         seq_printf(m, "on_free_list  :%d\n", obj_nr_tofree);
         seq_printf(m, "objs_allocated:%d\n", debug_objects_allocated);
@@ -850,26 +1033,16 @@ static const struct file_operations debug_stats_fops = {
 
 static int __init debug_objects_init_debugfs(void)
 {
-        struct dentry *dbgdir, *dbgstats;
+        struct dentry *dbgdir;
 
         if (!debug_objects_enabled)
                 return 0;
 
         dbgdir = debugfs_create_dir("debug_objects", NULL);
-        if (!dbgdir)
-                return -ENOMEM;
 
-        dbgstats = debugfs_create_file("stats", 0444, dbgdir, NULL,
-                                       &debug_stats_fops);
-        if (!dbgstats)
-                goto err;
+        debugfs_create_file("stats", 0444, dbgdir, NULL, &debug_stats_fops);
 
         return 0;
-
-err:
-        debugfs_remove(dbgdir);
-
-        return -ENOMEM;
 }
 __initcall(debug_objects_init_debugfs);
 
@@ -1175,9 +1348,20 @@ free:
  */
 void __init debug_objects_mem_init(void)
 {
+        int cpu, extras;
+
         if (!debug_objects_enabled)
                 return;
 
+        /*
+         * Initialize the percpu object pools
+         *
+         * Initialization is not strictly necessary, but was done for
+         * completeness.
+         */
+        for_each_possible_cpu(cpu)
+                INIT_HLIST_HEAD(&per_cpu(percpu_obj_pool.free_objs, cpu));
+
         obj_cache = kmem_cache_create("debug_objects_cache",
                                       sizeof (struct debug_obj), 0,
                                       SLAB_DEBUG_OBJECTS | SLAB_NOLEAKTRACE,
@@ -1194,6 +1378,7 @@ void __init debug_objects_mem_init(void)
          * Increase the thresholds for allocating and freeing objects
          * according to the number of possible CPUs available in the system.
          */
-        debug_objects_pool_size += num_possible_cpus() * 32;
-        debug_objects_pool_min_level += num_possible_cpus() * 4;
+        extras = num_possible_cpus() * ODEBUG_BATCH_SIZE;
+        debug_objects_pool_size += extras;
+        debug_objects_pool_min_level += extras;
 }
diff --git a/lib/devres.c b/lib/devres.c
index 69bed2f38306..6a0e9bd6524a 100644
--- a/lib/devres.c
+++ b/lib/devres.c
@@ -131,7 +131,8 @@ EXPORT_SYMBOL(devm_iounmap);
  *      if (IS_ERR(base))
  *              return PTR_ERR(base);
  */
-void __iomem *devm_ioremap_resource(struct device *dev, struct resource *res)
+void __iomem *devm_ioremap_resource(struct device *dev,
+                                    const struct resource *res)
 {
         resource_size_t size;
         void __iomem *dest_ptr;
diff --git a/lib/idr.c b/lib/idr.c
index c34e256d2f01..66a374892482 100644
--- a/lib/idr.c
+++ b/lib/idr.c
@@ -228,11 +228,21 @@ void *idr_get_next(struct idr *idr, int *nextid)
 {
         struct radix_tree_iter iter;
         void __rcu **slot;
+        void *entry = NULL;
         unsigned long base = idr->idr_base;
         unsigned long id = *nextid;
 
         id = (id < base) ? 0 : id - base;
-        slot = radix_tree_iter_find(&idr->idr_rt, &iter, id);
+        radix_tree_for_each_slot(slot, &idr->idr_rt, &iter, id) {
+                entry = rcu_dereference_raw(*slot);
+                if (!entry)
+                        continue;
+                if (!xa_is_internal(entry))
+                        break;
+                if (slot != &idr->idr_rt.xa_head && !xa_is_retry(entry))
+                        break;
+                slot = radix_tree_iter_retry(&iter);
+        }
         if (!slot)
                 return NULL;
         id = iter.index + base;
@@ -241,7 +251,7 @@ void *idr_get_next(struct idr *idr, int *nextid)
                 return NULL;
 
         *nextid = id;
-        return rcu_dereference_raw(*slot);
+        return entry;
 }
 EXPORT_SYMBOL(idr_get_next);
 
diff --git a/lib/mpi/mpi-pow.c b/lib/mpi/mpi-pow.c
index 82b19e4f1189..2fd7a46d55ec 100644
--- a/lib/mpi/mpi-pow.c
+++ b/lib/mpi/mpi-pow.c
@@ -24,6 +24,7 @@
 int mpi_powm(MPI res, MPI base, MPI exp, MPI mod)
 {
         mpi_ptr_t mp_marker = NULL, bp_marker = NULL, ep_marker = NULL;
+        struct karatsuba_ctx karactx = {};
         mpi_ptr_t xp_marker = NULL;
         mpi_ptr_t tspace = NULL;
         mpi_ptr_t rp, ep, mp, bp;
@@ -150,13 +151,11 @@ int mpi_powm(MPI res, MPI base, MPI exp, MPI mod)
                 int c;
                 mpi_limb_t e;
                 mpi_limb_t carry_limb;
-                struct karatsuba_ctx karactx;
 
                 xp = xp_marker = mpi_alloc_limb_space(2 * (msize + 1));
                 if (!xp)
                         goto enomem;
 
-                memset(&karactx, 0, sizeof karactx);
                 negative_result = (ep[0] & 1) && base->sign;
 
                 i = esize - 1;
@@ -281,8 +280,6 @@ int mpi_powm(MPI res, MPI base, MPI exp, MPI mod)
                 if (mod_shift_cnt)
                         mpihelp_rshift(rp, rp, rsize, mod_shift_cnt);
                 MPN_NORMALIZE(rp, rsize);
-
-                mpihelp_release_karatsuba_ctx(&karactx);
         }
 
         if (negative_result && rsize) {
@@ -299,6 +296,7 @@ int mpi_powm(MPI res, MPI base, MPI exp, MPI mod)
 leave:
         rc = 0;
 enomem:
+        mpihelp_release_karatsuba_ctx(&karactx);
         if (assign_rp)
                 mpi_assign_limb_space(res, rp, size);
         if (mp_marker)
diff --git a/lib/raid6/s390vx.uc b/lib/raid6/s390vx.uc
index 914ebe98fc21..9e597e1f91a4 100644
--- a/lib/raid6/s390vx.uc
+++ b/lib/raid6/s390vx.uc
@@ -60,7 +60,7 @@ static inline void LOAD_DATA(int x, u8 *ptr)
         typedef struct { u8 _[16 * $#]; } addrtype;
         register addrtype *__ptr asm("1") = (addrtype *) ptr;
 
-        asm volatile ("VLM %2,%3,0,%r1"
+        asm volatile ("VLM %2,%3,0,%1"
                       : : "m" (*__ptr), "a" (__ptr), "i" (x),
                           "i" (x + $# - 1));
 }
diff --git a/lib/reed_solomon/Makefile b/lib/reed_solomon/Makefile
index ba9d7a3329eb..5d4fa68f26cb 100644
--- a/lib/reed_solomon/Makefile
+++ b/lib/reed_solomon/Makefile
@@ -4,4 +4,4 @@
 #
 
 obj-$(CONFIG_REED_SOLOMON) += reed_solomon.o
-
+obj-$(CONFIG_REED_SOLOMON_TEST) += test_rslib.o
diff --git a/lib/reed_solomon/decode_rs.c b/lib/reed_solomon/decode_rs.c
index 1db74eb098d0..805de84ae83d 100644
--- a/lib/reed_solomon/decode_rs.c
+++ b/lib/reed_solomon/decode_rs.c
@@ -22,6 +22,7 @@
         uint16_t *index_of = rs->index_of;
         uint16_t u, q, tmp, num1, num2, den, discr_r, syn_error;
         int count = 0;
+        int num_corrected;
         uint16_t msk = (uint16_t) rs->nn;
 
         /*
@@ -39,11 +40,21 @@
 
         /* Check length parameter for validity */
         pad = nn - nroots - len;
-        BUG_ON(pad < 0 || pad >= nn);
+        BUG_ON(pad < 0 || pad >= nn - nroots);
 
         /* Does the caller provide the syndrome ? */
-        if (s != NULL)
-                goto decode;
+        if (s != NULL) {
+                for (i = 0; i < nroots; i++) {
+                        /* The syndrome is in index form,
+                         * so nn represents zero
+                         */
+                        if (s[i] != nn)
+                                goto decode;
+                }
+
+                /* syndrome is zero, no errors to correct  */
+                return 0;
+        }
 
         /* form the syndromes; i.e., evaluate data(x) at roots of
          * g(x) */
@@ -88,8 +99,7 @@
                 /* if syndrome is zero, data[] is a codeword and there are no
                  * errors to correct. So return data[] unmodified
                  */
-                count = 0;
-                goto finish;
+                return 0;
         }
 
  decode:
@@ -99,9 +109,9 @@
         if (no_eras > 0) {
                 /* Init lambda to be the erasure locator polynomial */
                 lambda[1] = alpha_to[rs_modnn(rs,
-                                              prim * (nn - 1 - eras_pos[0]))];
+                                        prim * (nn - 1 - (eras_pos[0] + pad)))];
                 for (i = 1; i < no_eras; i++) {
-                        u = rs_modnn(rs, prim * (nn - 1 - eras_pos[i]));
+                        u = rs_modnn(rs, prim * (nn - 1 - (eras_pos[i] + pad)));
                         for (j = i + 1; j > 0; j--) {
                                 tmp = index_of[lambda[j - 1]];
                                 if (tmp != nn) {
@@ -175,6 +185,15 @@
                 if (lambda[i] != nn)
                         deg_lambda = i;
         }
+
+        if (deg_lambda == 0) {
+                /*
+                 * deg(lambda) is zero even though the syndrome is non-zero
+                 * => uncorrectable error detected
+                 */
+                return -EBADMSG;
+        }
+
         /* Find roots of error+erasure locator polynomial by Chien search */
         memcpy(&reg[1], &lambda[1], nroots * sizeof(reg[0]));
         count = 0;              /* Number of roots of lambda(x) */
@@ -188,6 +207,12 @@
                 }
                 if (q != 0)
                         continue;       /* Not a root */
+
+                if (k < pad) {
+                        /* Impossible error location. Uncorrectable error. */
+                        return -EBADMSG;
+                }
+
                 /* store root (index-form) and error location number */
                 root[count] = i;
                 loc[count] = k;
@@ -202,8 +227,7 @@
                  * deg(lambda) unequal to number of roots => uncorrectable
                  * error detected
                  */
-                count = -EBADMSG;
-                goto finish;
+                return -EBADMSG;
         }
         /*
          * Compute err+eras evaluator poly omega(x) = s(x)*lambda(x) (modulo
@@ -223,7 +247,9 @@
         /*
          * Compute error values in poly-form. num1 = omega(inv(X(l))), num2 =
          * inv(X(l))**(fcr-1) and den = lambda_pr(inv(X(l))) all in poly-form
+         * Note: we reuse the buffer for b to store the correction pattern
          */
+        num_corrected = 0;
         for (j = count - 1; j >= 0; j--) {
                 num1 = 0;
                 for (i = deg_omega; i >= 0; i--) {
@@ -231,6 +257,13 @@
                                 num1 ^= alpha_to[rs_modnn(rs, omega[i] +
                                                         i * root[j])];
                 }
+
+                if (num1 == 0) {
+                        /* Nothing to correct at this position */
+                        b[j] = 0;
+                        continue;
+                }
+
                 num2 = alpha_to[rs_modnn(rs, root[j] * (fcr - 1) + nn)];
                 den = 0;
 
@@ -242,30 +275,52 @@
                                                        i * root[j])];
                         }
                 }
-                /* Apply error to data */
-                if (num1 != 0 && loc[j] >= pad) {
-                        uint16_t cor = alpha_to[rs_modnn(rs,index_of[num1] +
-                                                       index_of[num2] +
-                                                       nn - index_of[den])];
-                        /* Store the error correction pattern, if a
-                         * correction buffer is available */
-                        if (corr) {
-                                corr[j] = cor;
-                        } else {
-                                /* If a data buffer is given and the
-                                 * error is inside the message,
-                                 * correct it */
-                                if (data && (loc[j] < (nn - nroots)))
-                                        data[loc[j] - pad] ^= cor;
-                        }
+
+                b[j] = alpha_to[rs_modnn(rs, index_of[num1] +
+                                               index_of[num2] +
+                                               nn - index_of[den])];
+                num_corrected++;
+        }
+
+        /*
+         * We compute the syndrome of the 'error' and check that it matches
+         * the syndrome of the received word
+         */
+        for (i = 0; i < nroots; i++) {
+                tmp = 0;
+                for (j = 0; j < count; j++) {
+                        if (b[j] == 0)
+                                continue;
+
+                        k = (fcr + i) * prim * (nn-loc[j]-1);
+                        tmp ^= alpha_to[rs_modnn(rs, index_of[b[j]] + k)];
                 }
+
+                if (tmp != alpha_to[s[i]])
+                        return -EBADMSG;
         }
 
-finish:
-        if (eras_pos != NULL) {
-                for (i = 0; i < count; i++)
-                        eras_pos[i] = loc[i] - pad;
+        /*
+         * Store the error correction pattern, if a
+         * correction buffer is available
+         */
+        if (corr && eras_pos) {
+                j = 0;
+                for (i = 0; i < count; i++) {
+                        if (b[i]) {
+                                corr[j] = b[i];
+                                eras_pos[j++] = loc[i] - pad;
+                        }
+                }
+        } else if (data && par) {
+                /* Apply error to data and parity */
+                for (i = 0; i < count; i++) {
+                        if (loc[i] < (nn - nroots))
+                                data[loc[i] - pad] ^= b[i];
+                        else
+                                par[loc[i] - pad - len] ^= b[i];
+                }
         }
-        return count;
 
+        return  num_corrected;
 }
diff --git a/lib/reed_solomon/reed_solomon.c b/lib/reed_solomon/reed_solomon.c
index e5fdc8b9e856..bbc01bad3053 100644
--- a/lib/reed_solomon/reed_solomon.c
+++ b/lib/reed_solomon/reed_solomon.c
@@ -340,7 +340,8 @@ EXPORT_SYMBOL_GPL(encode_rs8);
  *  @data:      data field of a given type
  *  @par:       received parity data field
  *  @len:       data length
- *  @s:         syndrome data field (if NULL, syndrome is calculated)
+ *  @s:         syndrome data field, must be in index form
+ *              (if NULL, syndrome is calculated)
  *  @no_eras:   number of erasures
  *  @eras_pos:  position of erasures, can be NULL
  *  @invmsk:    invert data mask (will be xored on data, not on parity!)
@@ -354,7 +355,8 @@ EXPORT_SYMBOL_GPL(encode_rs8);
  *  decoding, so the caller has to ensure that decoder invocations are
  *  serialized.
  *
- *  Returns the number of corrected bits or -EBADMSG for uncorrectable errors.
+ *  Returns the number of corrected symbols or -EBADMSG for uncorrectable
+ *  errors. The count includes errors in the parity.
  */
 int decode_rs8(struct rs_control *rsc, uint8_t *data, uint16_t *par, int len,
                uint16_t *s, int no_eras, int *eras_pos, uint16_t invmsk,
@@ -391,7 +393,8 @@ EXPORT_SYMBOL_GPL(encode_rs16);
  *  @data:      data field of a given type
  *  @par:       received parity data field
  *  @len:       data length
- *  @s:         syndrome data field (if NULL, syndrome is calculated)
+ *  @s:         syndrome data field, must be in index form
+ *              (if NULL, syndrome is calculated)
  *  @no_eras:   number of erasures
  *  @eras_pos:  position of erasures, can be NULL
  *  @invmsk:    invert data mask (will be xored on data, not on parity!)
@@ -403,7 +406,8 @@ EXPORT_SYMBOL_GPL(encode_rs16);
  *  decoding, so the caller has to ensure that decoder invocations are
  *  serialized.
  *
- *  Returns the number of corrected bits or -EBADMSG for uncorrectable errors.
+ *  Returns the number of corrected symbols or -EBADMSG for uncorrectable
+ *  errors. The count includes errors in the parity.
  */
 int decode_rs16(struct rs_control *rsc, uint16_t *data, uint16_t *par, int len,
                 uint16_t *s, int no_eras, int *eras_pos, uint16_t invmsk,
diff --git a/lib/reed_solomon/test_rslib.c b/lib/reed_solomon/test_rslib.c
new file mode 100644
index 000000000000..4eb29f365ece
--- /dev/null
+++ b/lib/reed_solomon/test_rslib.c
@@ -0,0 +1,518 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * Tests for Generic Reed Solomon encoder / decoder library
+ *
+ * Written by Ferdinand Blomqvist
+ * Based on previous work by Phil Karn, KA9Q
+ */
+#include <linux/rslib.h>
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/moduleparam.h>
+#include <linux/random.h>
+#include <linux/slab.h>
+
+enum verbosity {
+        V_SILENT,
+        V_PROGRESS,
+        V_CSUMMARY
+};
+
+enum method {
+        CORR_BUFFER,
+        CALLER_SYNDROME,
+        IN_PLACE
+};
+
+#define __param(type, name, init, msg)          \
+        static type name = init;                \
+        module_param(name, type, 0444);         \
+        MODULE_PARM_DESC(name, msg)
+
+__param(int, v, V_PROGRESS, "Verbosity level");
+__param(int, ewsc, 1, "Erasures without symbol corruption");
+__param(int, bc, 1, "Test for correct behaviour beyond error correction capacity");
+
+struct etab {
+        int     symsize;
+        int     genpoly;
+        int     fcs;
+        int     prim;
+        int     nroots;
+        int     ntrials;
+};
+
+/* List of codes to test */
+static struct etab Tab[] = {
+        {2,     0x7,    1,      1,      1,      100000  },
+        {3,     0xb,    1,      1,      2,      100000  },
+        {3,     0xb,    1,      1,      3,      100000  },
+        {3,     0xb,    2,      1,      4,      100000  },
+        {4,     0x13,   1,      1,      4,      10000   },
+        {5,     0x25,   1,      1,      6,      1000    },
+        {6,     0x43,   3,      1,      8,      1000    },
+        {7,     0x89,   1,      1,      14,     500     },
+        {8,     0x11d,  1,      1,      30,     100     },
+        {8,     0x187,  112,    11,     32,     100     },
+        {9,     0x211,  1,      1,      33,     80      },
+        {0, 0, 0, 0, 0, 0},
+};
+
+
+struct estat {
+        int     dwrong;
+        int     irv;
+        int     wepos;
+        int     nwords;
+};
+
+struct bcstat {
+        int     rfail;
+        int     rsuccess;
+        int     noncw;
+        int     nwords;
+};
+
+struct wspace {
+        uint16_t        *c;             /* sent codeword */
+        uint16_t        *r;             /* received word */
+        uint16_t        *s;             /* syndrome */
+        uint16_t        *corr;          /* correction buffer */
+        int             *errlocs;
+        int             *derrlocs;
+};
+
+struct pad {
+        int     mult;
+        int     shift;
+};
+
+static struct pad pad_coef[] = {
+        { 0, 0 },
+        { 1, 2 },
+        { 1, 1 },
+        { 3, 2 },
+        { 1, 0 },
+};
+
+static void free_ws(struct wspace *ws)
+{
+        if (!ws)
+                return;
+
+        kfree(ws->errlocs);
+        kfree(ws->c);
+        kfree(ws);
+}
+
+static struct wspace *alloc_ws(struct rs_codec *rs)
+{
+        int nroots = rs->nroots;
+        struct wspace *ws;
+        int nn = rs->nn;
+
+        ws = kzalloc(sizeof(*ws), GFP_KERNEL);
+        if (!ws)
+                return NULL;
+
+        ws->c = kmalloc_array(2 * (nn + nroots),
+                                sizeof(uint16_t), GFP_KERNEL);
+        if (!ws->c)
+                goto err;
+
+        ws->r = ws->c + nn;
+        ws->s = ws->r + nn;
+        ws->corr = ws->s + nroots;
+
+        ws->errlocs = kmalloc_array(nn + nroots, sizeof(int), GFP_KERNEL);
+        if (!ws->errlocs)
+                goto err;
+
+        ws->derrlocs = ws->errlocs + nn;
+        return ws;
+
+err:
+        free_ws(ws);
+        return NULL;
+}
+
+
+/*
+ * Generates a random codeword and stores it in c. Generates random errors and
+ * erasures, and stores the random word with errors in r. Erasure positions are
+ * stored in derrlocs, while errlocs has one of three values in every position:
+ *
+ * 0 if there is no error in this position;
+ * 1 if there is a symbol error in this position;
+ * 2 if there is an erasure without symbol corruption.
+ *
+ * Returns the number of corrupted symbols.
+ */
+static int get_rcw_we(struct rs_control *rs, struct wspace *ws,
+                        int len, int errs, int eras)
+{
+        int nroots = rs->codec->nroots;
+        int *derrlocs = ws->derrlocs;
+        int *errlocs = ws->errlocs;
+        int dlen = len - nroots;
+        int nn = rs->codec->nn;
+        uint16_t *c = ws->c;
+        uint16_t *r = ws->r;
+        int errval;
+        int errloc;
+        int i;
+
+        /* Load c with random data and encode */
+        for (i = 0; i < dlen; i++)
+                c[i] = prandom_u32() & nn;
+
+        memset(c + dlen, 0, nroots * sizeof(*c));
+        encode_rs16(rs, c, dlen, c + dlen, 0);
+
+        /* Make copyand add errors and erasures */
+        memcpy(r, c, len * sizeof(*r));
+        memset(errlocs, 0, len * sizeof(*errlocs));
+        memset(derrlocs, 0, nroots * sizeof(*derrlocs));
+
+        /* Generating random errors */
+        for (i = 0; i < errs; i++) {
+                do {
+                        /* Error value must be nonzero */
+                        errval = prandom_u32() & nn;
+                } while (errval == 0);
+
+                do {
+                        /* Must not choose the same location twice */
+                        errloc = prandom_u32() % len;
+                } while (errlocs[errloc] != 0);
+
+                errlocs[errloc] = 1;
+                r[errloc] ^= errval;
+        }
+
+        /* Generating random erasures */
+        for (i = 0; i < eras; i++) {
+                do {
+                        /* Must not choose the same location twice */
+                        errloc = prandom_u32() % len;
+                } while (errlocs[errloc] != 0);
+
+                derrlocs[i] = errloc;
+
+                if (ewsc && (prandom_u32() & 1)) {
+                        /* Erasure with the symbol intact */
+                        errlocs[errloc] = 2;
+                } else {
+                        /* Erasure with corrupted symbol */
+                        do {
+                                /* Error value must be nonzero */
+                                errval = prandom_u32() & nn;
+                        } while (errval == 0);
+
+                        errlocs[errloc] = 1;
+                        r[errloc] ^= errval;
+                        errs++;
+                }
+        }
+
+        return errs;
+}
+
+static void fix_err(uint16_t *data, int nerrs, uint16_t *corr, int *errlocs)
+{
+        int i;
+
+        for (i = 0; i < nerrs; i++)
+                data[errlocs[i]] ^= corr[i];
+}
+
+static void compute_syndrome(struct rs_control *rsc, uint16_t *data,
+                                int len, uint16_t *syn)
+{
+        struct rs_codec *rs = rsc->codec;
+        uint16_t *alpha_to = rs->alpha_to;
+        uint16_t *index_of = rs->index_of;
+        int nroots = rs->nroots;
+        int prim = rs->prim;
+        int fcr = rs->fcr;
+        int i, j;
+
+        /* Calculating syndrome */
+        for (i = 0; i < nroots; i++) {
+                syn[i] = data[0];
+                for (j = 1; j < len; j++) {
+                        if (syn[i] == 0) {
+                                syn[i] = data[j];
+                        } else {
+                                syn[i] = data[j] ^
+                                        alpha_to[rs_modnn(rs, index_of[syn[i]]
+                                                + (fcr + i) * prim)];
+                        }
+                }
+        }
+
+        /* Convert to index form */
+        for (i = 0; i < nroots; i++)
+                syn[i] = rs->index_of[syn[i]];
+}
+
+/* Test up to error correction capacity */
+static void test_uc(struct rs_control *rs, int len, int errs,
+                int eras, int trials, struct estat *stat,
+                struct wspace *ws, int method)
+{
+        int dlen = len - rs->codec->nroots;
+        int *derrlocs = ws->derrlocs;
+        int *errlocs = ws->errlocs;
+        uint16_t *corr = ws->corr;
+        uint16_t *c = ws->c;
+        uint16_t *r = ws->r;
+        uint16_t *s = ws->s;
+        int derrs, nerrs;
+        int i, j;
+
+        for (j = 0; j < trials; j++) {
+                nerrs = get_rcw_we(rs, ws, len, errs, eras);
+
+                switch (method) {
+                case CORR_BUFFER:
+                        derrs = decode_rs16(rs, r, r + dlen, dlen,
+                                        NULL, eras, derrlocs, 0, corr);
+                        fix_err(r, derrs, corr, derrlocs);
+                        break;
+                case CALLER_SYNDROME:
+                        compute_syndrome(rs, r, len, s);
+                        derrs = decode_rs16(rs, NULL, NULL, dlen,
+                                        s, eras, derrlocs, 0, corr);
+                        fix_err(r, derrs, corr, derrlocs);
+                        break;
+                case IN_PLACE:
+                        derrs = decode_rs16(rs, r, r + dlen, dlen,
+                                        NULL, eras, derrlocs, 0, NULL);
+                        break;
+                default:
+                        continue;
+                }
+
+                if (derrs != nerrs)
+                        stat->irv++;
+
+                if (method != IN_PLACE) {
+                        for (i = 0; i < derrs; i++) {
+                                if (errlocs[derrlocs[i]] != 1)
+                                        stat->wepos++;
+                        }
+                }
+
+                if (memcmp(r, c, len * sizeof(*r)))
+                        stat->dwrong++;
+        }
+        stat->nwords += trials;
+}
+
+static int ex_rs_helper(struct rs_control *rs, struct wspace *ws,
+                        int len, int trials, int method)
+{
+        static const char * const desc[] = {
+                "Testing correction buffer interface...",
+                "Testing with caller provided syndrome...",
+                "Testing in-place interface..."
+        };
+
+        struct estat stat = {0, 0, 0, 0};
+        int nroots = rs->codec->nroots;
+        int errs, eras, retval;
+
+        if (v >= V_PROGRESS)
+                pr_info("  %s\n", desc[method]);
+
+        for (errs = 0; errs <= nroots / 2; errs++)
+                for (eras = 0; eras <= nroots - 2 * errs; eras++)
+                        test_uc(rs, len, errs, eras, trials, &stat, ws, method);
+
+        if (v >= V_CSUMMARY) {
+                pr_info("    Decodes wrong:        %d / %d\n",
+                                stat.dwrong, stat.nwords);
+                pr_info("    Wrong return value:   %d / %d\n",
+                                stat.irv, stat.nwords);
+                if (method != IN_PLACE)
+                        pr_info("    Wrong error position: %d\n", stat.wepos);
+        }
+
+        retval = stat.dwrong + stat.wepos + stat.irv;
+        if (retval && v >= V_PROGRESS)
+                pr_warn("    FAIL: %d decoding failures!\n", retval);
+
+        return retval;
+}
+
+static int exercise_rs(struct rs_control *rs, struct wspace *ws,
+                       int len, int trials)
+{
+
+        int retval = 0;
+        int i;
+
+        if (v >= V_PROGRESS)
+                pr_info("Testing up to error correction capacity...\n");
+
+        for (i = 0; i <= IN_PLACE; i++)
+                retval |= ex_rs_helper(rs, ws, len, trials, i);
+
+        return retval;
+}
+
+/* Tests for correct behaviour beyond error correction capacity */
+static void test_bc(struct rs_control *rs, int len, int errs,
+                int eras, int trials, struct bcstat *stat,
+                struct wspace *ws)
+{
+        int nroots = rs->codec->nroots;
+        int dlen = len - nroots;
+        int *derrlocs = ws->derrlocs;
+        uint16_t *corr = ws->corr;
+        uint16_t *r = ws->r;
+        int derrs, j;
+
+        for (j = 0; j < trials; j++) {
+                get_rcw_we(rs, ws, len, errs, eras);
+                derrs = decode_rs16(rs, r, r + dlen, dlen,
+                                NULL, eras, derrlocs, 0, corr);
+                fix_err(r, derrs, corr, derrlocs);
+
+                if (derrs >= 0) {
+                        stat->rsuccess++;
+
+                        /*
+                         * We check that the returned word is actually a
+                         * codeword. The obious way to do this would be to
+                         * compute the syndrome, but we don't want to replicate
+                         * that code here. However, all the codes are in
+                         * systematic form, and therefore we can encode the
+                         * returned word, and see whether the parity changes or
+                         * not.
+                         */
+                        memset(corr, 0, nroots * sizeof(*corr));
+                        encode_rs16(rs, r, dlen, corr, 0);
+
+                        if (memcmp(r + dlen, corr, nroots * sizeof(*corr)))
+                                stat->noncw++;
+                } else {
+                        stat->rfail++;
+                }
+        }
+        stat->nwords += trials;
+}
+
+static int exercise_rs_bc(struct rs_control *rs, struct wspace *ws,
+                          int len, int trials)
+{
+        struct bcstat stat = {0, 0, 0, 0};
+        int nroots = rs->codec->nroots;
+        int errs, eras, cutoff;
+
+        if (v >= V_PROGRESS)
+                pr_info("Testing beyond error correction capacity...\n");
+
+        for (errs = 1; errs <= nroots; errs++) {
+                eras = nroots - 2 * errs + 1;
+                if (eras < 0)
+                        eras = 0;
+
+                cutoff = nroots <= len - errs ? nroots : len - errs;
+                for (; eras <= cutoff; eras++)
+                        test_bc(rs, len, errs, eras, trials, &stat, ws);
+        }
+
+        if (v >= V_CSUMMARY) {
+                pr_info("  decoder gives up:        %d / %d\n",
+                                stat.rfail, stat.nwords);
+                pr_info("  decoder returns success: %d / %d\n",
+                                stat.rsuccess, stat.nwords);
+                pr_info("    not a codeword:        %d / %d\n",
+                                stat.noncw, stat.rsuccess);
+        }
+
+        if (stat.noncw && v >= V_PROGRESS)
+                pr_warn("    FAIL: %d silent failures!\n", stat.noncw);
+
+        return stat.noncw;
+}
+
+static int run_exercise(struct etab *e)
+{
+        int nn = (1 << e->symsize) - 1;
+        int kk = nn - e->nroots;
+        struct rs_control *rsc;
+        int retval = -ENOMEM;
+        int max_pad = kk - 1;
+        int prev_pad = -1;
+        struct wspace *ws;
+        int i;
+
+        rsc = init_rs(e->symsize, e->genpoly, e->fcs, e->prim, e->nroots);
+        if (!rsc)
+                return retval;
+
+        ws = alloc_ws(rsc->codec);
+        if (!ws)
+                goto err;
+
+        retval = 0;
+        for (i = 0; i < ARRAY_SIZE(pad_coef); i++) {
+                int pad = (pad_coef[i].mult * max_pad) >> pad_coef[i].shift;
+                int len = nn - pad;
+
+                if (pad == prev_pad)
+                        continue;
+
+                prev_pad = pad;
+                if (v >= V_PROGRESS) {
+                        pr_info("Testing (%d,%d)_%d code...\n",
+                                        len, kk - pad, nn + 1);
+                }
+
+                retval |= exercise_rs(rsc, ws, len, e->ntrials);
+                if (bc)
+                        retval |= exercise_rs_bc(rsc, ws, len, e->ntrials);
+        }
+
+        free_ws(ws);
+
+err:
+        free_rs(rsc);
+        return retval;
+}
+
+static int __init test_rslib_init(void)
+{
+        int i, fail = 0;
+
+        for (i = 0; Tab[i].symsize != 0 ; i++) {
+                int retval;
+
+                retval = run_exercise(Tab + i);
+                if (retval < 0)
+                        return -ENOMEM;
+
+                fail |= retval;
+        }
+
+        if (fail)
+                pr_warn("rslib: test failed\n");
+        else
+                pr_info("rslib: test ok\n");
+
+        return -EAGAIN; /* Fail will directly unload the module */
+}
+
+static void __exit test_rslib_exit(void)
+{
+}
+
+module_init(test_rslib_init)
+module_exit(test_rslib_exit)
+
+MODULE_LICENSE("GPL");
+MODULE_AUTHOR("Ferdinand Blomqvist");
+MODULE_DESCRIPTION("Reed-Solomon library test");
diff --git a/lib/test_xarray.c b/lib/test_xarray.c
index 5d4bad8bd96a..9d631a7b6a70 100644
--- a/lib/test_xarray.c
+++ b/lib/test_xarray.c
@@ -38,6 +38,12 @@ static void *xa_store_index(struct xarray *xa, unsigned long index, gfp_t gfp)
         return xa_store(xa, index, xa_mk_index(index), gfp);
 }
 
+static void xa_insert_index(struct xarray *xa, unsigned long index)
+{
+        XA_BUG_ON(xa, xa_insert(xa, index, xa_mk_index(index),
+                                GFP_KERNEL) != 0);
+}
+
 static void xa_alloc_index(struct xarray *xa, unsigned long index, gfp_t gfp)
 {
         u32 id;
@@ -338,6 +344,37 @@ static noinline void check_xa_shrink(struct xarray *xa)
         }
 }
 
+static noinline void check_insert(struct xarray *xa)
+{
+        unsigned long i;
+
+        for (i = 0; i < 1024; i++) {
+                xa_insert_index(xa, i);
+                XA_BUG_ON(xa, xa_load(xa, i - 1) != NULL);
+                XA_BUG_ON(xa, xa_load(xa, i + 1) != NULL);
+                xa_erase_index(xa, i);
+        }
+
+        for (i = 10; i < BITS_PER_LONG; i++) {
+                xa_insert_index(xa, 1UL << i);
+                XA_BUG_ON(xa, xa_load(xa, (1UL << i) - 1) != NULL);
+                XA_BUG_ON(xa, xa_load(xa, (1UL << i) + 1) != NULL);
+                xa_erase_index(xa, 1UL << i);
+
+                xa_insert_index(xa, (1UL << i) - 1);
+                XA_BUG_ON(xa, xa_load(xa, (1UL << i) - 2) != NULL);
+                XA_BUG_ON(xa, xa_load(xa, 1UL << i) != NULL);
+                xa_erase_index(xa, (1UL << i) - 1);
+        }
+
+        xa_insert_index(xa, ~0UL);
+        XA_BUG_ON(xa, xa_load(xa, 0UL) != NULL);
+        XA_BUG_ON(xa, xa_load(xa, ~1UL) != NULL);
+        xa_erase_index(xa, ~0UL);
+
+        XA_BUG_ON(xa, !xa_empty(xa));
+}
+
 static noinline void check_cmpxchg(struct xarray *xa)
 {
         void *FIVE = xa_mk_value(5);
@@ -1527,6 +1564,7 @@ static int xarray_checks(void)
         check_xa_mark(&array);
         check_xa_shrink(&array);
         check_xas_erase(&array);
+        check_insert(&array);
         check_cmpxchg(&array);
         check_reserve(&array);
         check_reserve(&xa0);
diff --git a/lib/vdso/Kconfig b/lib/vdso/Kconfig
new file mode 100644
index 000000000000..cc00364bd2c2
--- /dev/null
+++ b/lib/vdso/Kconfig
@@ -0,0 +1,36 @@
+# SPDX-License-Identifier: GPL-2.0
+
+config HAVE_GENERIC_VDSO
+        bool
+
+if HAVE_GENERIC_VDSO
+
+config GENERIC_GETTIMEOFDAY
+        bool
+        help
+          This is a generic implementation of gettimeofday vdso.
+          Each architecture that enables this feature has to
+          provide the fallback implementation.
+
+config GENERIC_VDSO_32
+        bool
+        depends on GENERIC_GETTIMEOFDAY && !64BIT
+        help
+          This config option helps to avoid possible performance issues
+          in 32 bit only architectures.
+
+config GENERIC_COMPAT_VDSO
+        bool
+        help
+          This config option enables the compat VDSO layer.
+
+config CROSS_COMPILE_COMPAT_VDSO
+        string "32 bit Toolchain prefix for compat vDSO"
+        default ""
+        depends on GENERIC_COMPAT_VDSO
+        help
+          Defines the cross-compiler prefix for compiling compat vDSO.
+          If a 64 bit compiler (i.e. x86_64) can compile the VDSO for
+          32 bit, it does not need to define this parameter.
+
+endif
diff --git a/lib/vdso/Makefile b/lib/vdso/Makefile
new file mode 100644
index 000000000000..c415a685d61b
--- /dev/null
+++ b/lib/vdso/Makefile
@@ -0,0 +1,22 @@
+# SPDX-License-Identifier: GPL-2.0
+
+GENERIC_VDSO_MK_PATH := $(abspath $(lastword $(MAKEFILE_LIST)))
+GENERIC_VDSO_DIR := $(dir $(GENERIC_VDSO_MK_PATH))
+
+c-gettimeofday-$(CONFIG_GENERIC_GETTIMEOFDAY) := $(addprefix $(GENERIC_VDSO_DIR), gettimeofday.c)
+
+# This cmd checks that the vdso library does not contain absolute relocation
+# It has to be called after the linking of the vdso library and requires it
+# as a parameter.
+#
+# $(ARCH_REL_TYPE_ABS) is defined in the arch specific makefile and corresponds
+# to the absolute relocation types printed by "objdump -R" and accepted by the
+# dynamic linker.
+ifndef ARCH_REL_TYPE_ABS
+$(error ARCH_REL_TYPE_ABS is not set)
+endif
+
+quiet_cmd_vdso_check = VDSOCHK $@
+      cmd_vdso_check = if $(OBJDUMP) -R $@ | egrep -h "$(ARCH_REL_TYPE_ABS)"; \
+                       then (echo >&2 "$@: dynamic relocations are not supported"; \
+                             rm -f $@; /bin/false); fi
diff --git a/lib/vdso/gettimeofday.c b/lib/vdso/gettimeofday.c
new file mode 100644
index 000000000000..2d1c1f241fd9
--- /dev/null
+++ b/lib/vdso/gettimeofday.c
@@ -0,0 +1,239 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * Generic userspace implementations of gettimeofday() and similar.
+ */
+#include <linux/compiler.h>
+#include <linux/math64.h>
+#include <linux/time.h>
+#include <linux/kernel.h>
+#include <linux/hrtimer_defs.h>
+#include <vdso/datapage.h>
+#include <vdso/helpers.h>
+
+/*
+ * The generic vDSO implementation requires that gettimeofday.h
+ * provides:
+ * - __arch_get_vdso_data(): to get the vdso datapage.
+ * - __arch_get_hw_counter(): to get the hw counter based on the
+ *   clock_mode.
+ * - gettimeofday_fallback(): fallback for gettimeofday.
+ * - clock_gettime_fallback(): fallback for clock_gettime.
+ * - clock_getres_fallback(): fallback for clock_getres.
+ */
+#ifdef ENABLE_COMPAT_VDSO
+#include <asm/vdso/compat_gettimeofday.h>
+#else
+#include <asm/vdso/gettimeofday.h>
+#endif /* ENABLE_COMPAT_VDSO */
+
+#ifndef vdso_calc_delta
+/*
+ * Default implementation which works for all sane clocksources. That
+ * obviously excludes x86/TSC.
+ */
+static __always_inline
+u64 vdso_calc_delta(u64 cycles, u64 last, u64 mask, u32 mult)
+{
+        return ((cycles - last) & mask) * mult;
+}
+#endif
+
+static int do_hres(const struct vdso_data *vd, clockid_t clk,
+                   struct __kernel_timespec *ts)
+{
+        const struct vdso_timestamp *vdso_ts = &vd->basetime[clk];
+        u64 cycles, last, sec, ns;
+        u32 seq;
+
+        do {
+                seq = vdso_read_begin(vd);
+                cycles = __arch_get_hw_counter(vd->clock_mode);
+                ns = vdso_ts->nsec;
+                last = vd->cycle_last;
+                if (unlikely((s64)cycles < 0))
+                        return clock_gettime_fallback(clk, ts);
+
+                ns += vdso_calc_delta(cycles, last, vd->mask, vd->mult);
+                ns >>= vd->shift;
+                sec = vdso_ts->sec;
+        } while (unlikely(vdso_read_retry(vd, seq)));
+
+        /*
+         * Do this outside the loop: a race inside the loop could result
+         * in __iter_div_u64_rem() being extremely slow.
+         */
+        ts->tv_sec = sec + __iter_div_u64_rem(ns, NSEC_PER_SEC, &ns);
+        ts->tv_nsec = ns;
+
+        return 0;
+}
+
+static void do_coarse(const struct vdso_data *vd, clockid_t clk,
+                      struct __kernel_timespec *ts)
+{
+        const struct vdso_timestamp *vdso_ts = &vd->basetime[clk];
+        u32 seq;
+
+        do {
+                seq = vdso_read_begin(vd);
+                ts->tv_sec = vdso_ts->sec;
+                ts->tv_nsec = vdso_ts->nsec;
+        } while (unlikely(vdso_read_retry(vd, seq)));
+}
+
+static __maybe_unused int
+__cvdso_clock_gettime(clockid_t clock, struct __kernel_timespec *ts)
+{
+        const struct vdso_data *vd = __arch_get_vdso_data();
+        u32 msk;
+
+        /* Check for negative values or invalid clocks */
+        if (unlikely((u32) clock >= MAX_CLOCKS))
+                goto fallback;
+
+        /*
+         * Convert the clockid to a bitmask and use it to check which
+         * clocks are handled in the VDSO directly.
+         */
+        msk = 1U << clock;
+        if (likely(msk & VDSO_HRES)) {
+                return do_hres(&vd[CS_HRES_COARSE], clock, ts);
+        } else if (msk & VDSO_COARSE) {
+                do_coarse(&vd[CS_HRES_COARSE], clock, ts);
+                return 0;
+        } else if (msk & VDSO_RAW) {
+                return do_hres(&vd[CS_RAW], clock, ts);
+        }
+
+fallback:
+        return clock_gettime_fallback(clock, ts);
+}
+
+static __maybe_unused int
+__cvdso_clock_gettime32(clockid_t clock, struct old_timespec32 *res)
+{
+        struct __kernel_timespec ts;
+        int ret;
+
+        if (res == NULL)
+                goto fallback;
+
+        ret = __cvdso_clock_gettime(clock, &ts);
+
+        if (ret == 0) {
+                res->tv_sec = ts.tv_sec;
+                res->tv_nsec = ts.tv_nsec;
+        }
+
+        return ret;
+
+fallback:
+        return clock_gettime_fallback(clock, (struct __kernel_timespec *)res);
+}
+
+static __maybe_unused int
+__cvdso_gettimeofday(struct __kernel_old_timeval *tv, struct timezone *tz)
+{
+        const struct vdso_data *vd = __arch_get_vdso_data();
+
+        if (likely(tv != NULL)) {
+                struct __kernel_timespec ts;
+
+                if (do_hres(&vd[CS_HRES_COARSE], CLOCK_REALTIME, &ts))
+                        return gettimeofday_fallback(tv, tz);
+
+                tv->tv_sec = ts.tv_sec;
+                tv->tv_usec = (u32)ts.tv_nsec / NSEC_PER_USEC;
+        }
+
+        if (unlikely(tz != NULL)) {
+                tz->tz_minuteswest = vd[CS_HRES_COARSE].tz_minuteswest;
+                tz->tz_dsttime = vd[CS_HRES_COARSE].tz_dsttime;
+        }
+
+        return 0;
+}
+
+#ifdef VDSO_HAS_TIME
+static __maybe_unused time_t __cvdso_time(time_t *time)
+{
+        const struct vdso_data *vd = __arch_get_vdso_data();
+        time_t t = READ_ONCE(vd[CS_HRES_COARSE].basetime[CLOCK_REALTIME].sec);
+
+        if (time)
+                *time = t;
+
+        return t;
+}
+#endif /* VDSO_HAS_TIME */
+
+#ifdef VDSO_HAS_CLOCK_GETRES
+static __maybe_unused
+int __cvdso_clock_getres(clockid_t clock, struct __kernel_timespec *res)
+{
+        const struct vdso_data *vd = __arch_get_vdso_data();
+        u64 ns;
+        u32 msk;
+        u64 hrtimer_res = READ_ONCE(vd[CS_HRES_COARSE].hrtimer_res);
+
+        /* Check for negative values or invalid clocks */
+        if (unlikely((u32) clock >= MAX_CLOCKS))
+                goto fallback;
+
+        /*
+         * Convert the clockid to a bitmask and use it to check which
+         * clocks are handled in the VDSO directly.
+         */
+        msk = 1U << clock;
+        if (msk & VDSO_HRES) {
+                /*
+                 * Preserves the behaviour of posix_get_hrtimer_res().
+                 */
+                ns = hrtimer_res;
+        } else if (msk & VDSO_COARSE) {
+                /*
+                 * Preserves the behaviour of posix_get_coarse_res().
+                 */
+                ns = LOW_RES_NSEC;
+        } else if (msk & VDSO_RAW) {
+                /*
+                 * Preserves the behaviour of posix_get_hrtimer_res().
+                 */
+                ns = hrtimer_res;
+        } else {
+                goto fallback;
+        }
+
+        if (res) {
+                res->tv_sec = 0;
+                res->tv_nsec = ns;
+        }
+
+        return 0;
+
+fallback:
+        return clock_getres_fallback(clock, res);
+}
+
+static __maybe_unused int
+__cvdso_clock_getres_time32(clockid_t clock, struct old_timespec32 *res)
+{
+        struct __kernel_timespec ts;
+        int ret;
+
+        if (res == NULL)
+                goto fallback;
+
+        ret = __cvdso_clock_getres(clock, &ts);
+
+        if (ret == 0) {
+                res->tv_sec = ts.tv_sec;
+                res->tv_nsec = ts.tv_nsec;
+        }
+
+        return ret;
+
+fallback:
+        return clock_getres_fallback(clock, (struct __kernel_timespec *)res);
+}
+#endif /* VDSO_HAS_CLOCK_GETRES */
diff --git a/lib/xarray.c b/lib/xarray.c
index 6be3acbb861f..446b956c9188 100644
--- a/lib/xarray.c
+++ b/lib/xarray.c
@@ -298,6 +298,8 @@ bool xas_nomem(struct xa_state *xas, gfp_t gfp)
                 xas_destroy(xas);
                 return false;
         }
+        if (xas->xa->xa_flags & XA_FLAGS_ACCOUNT)
+                gfp |= __GFP_ACCOUNT;
         xas->xa_alloc = kmem_cache_alloc(radix_tree_node_cachep, gfp);
         if (!xas->xa_alloc)
                 return false;
@@ -325,6 +327,8 @@ static bool __xas_nomem(struct xa_state *xas, gfp_t gfp)
                 xas_destroy(xas);
                 return false;
         }
+        if (xas->xa->xa_flags & XA_FLAGS_ACCOUNT)
+                gfp |= __GFP_ACCOUNT;
         if (gfpflags_allow_blocking(gfp)) {
                 xas_unlock_type(xas, lock_type);
                 xas->xa_alloc = kmem_cache_alloc(radix_tree_node_cachep, gfp);
@@ -358,8 +362,12 @@ static void *xas_alloc(struct xa_state *xas, unsigned int shift)
         if (node) {
                 xas->xa_alloc = NULL;
         } else {
-                node = kmem_cache_alloc(radix_tree_node_cachep,
-                                        GFP_NOWAIT | __GFP_NOWARN);
+                gfp_t gfp = GFP_NOWAIT | __GFP_NOWARN;
+
+                if (xas->xa->xa_flags & XA_FLAGS_ACCOUNT)
+                        gfp |= __GFP_ACCOUNT;
+
+                node = kmem_cache_alloc(radix_tree_node_cachep, gfp);
                 if (!node) {
                         xas_set_err(xas, -ENOMEM);
                         return NULL;
diff --git a/mm/filemap.c b/mm/filemap.c
index df2006ba0cfa..6dd9a2274c80 100644
--- a/mm/filemap.c
+++ b/mm/filemap.c
@@ -281,11 +281,11 @@ EXPORT_SYMBOL(delete_from_page_cache);
  * @pvec: pagevec with pages to delete
  *
  * The function walks over mapping->i_pages and removes pages passed in @pvec
- * from the mapping. The function expects @pvec to be sorted by page index
- * and is optimised for it to be dense.
+ * from the mapping. The function expects @pvec to be sorted by page index.
  * It tolerates holes in @pvec (mapping entries at those indices are not
  * modified). The function expects only THP head pages to be present in the
- * @pvec.
+ * @pvec and takes care to delete all corresponding tail pages from the
+ * mapping as well.
  *
  * The function expects the i_pages lock to be held.
  */
@@ -294,44 +294,40 @@ static void page_cache_delete_batch(struct address_space *mapping,
 {
         XA_STATE(xas, &mapping->i_pages, pvec->pages[0]->index);
         int total_pages = 0;
-        int i = 0;
+        int i = 0, tail_pages = 0;
         struct page *page;
 
         mapping_set_update(&xas, mapping);
         xas_for_each(&xas, page, ULONG_MAX) {
-                if (i >= pagevec_count(pvec))
+                if (i >= pagevec_count(pvec) && !tail_pages)
                         break;
-
-                /* A swap/dax/shadow entry got inserted? Skip it. */
                 if (xa_is_value(page))
                         continue;
-                /*
-                 * A page got inserted in our range? Skip it. We have our
-                 * pages locked so they are protected from being removed.
-                 * If we see a page whose index is higher than ours, it
-                 * means our page has been removed, which shouldn't be
-                 * possible because we're holding the PageLock.
-                 */
-                if (page != pvec->pages[i]) {
-                        VM_BUG_ON_PAGE(page->index > pvec->pages[i]->index,
-                                        page);
-                        continue;
-                }
-
-                WARN_ON_ONCE(!PageLocked(page));
-
-                if (page->index == xas.xa_index)
+                if (!tail_pages) {
+                        /*
+                         * Some page got inserted in our range? Skip it. We
+                         * have our pages locked so they are protected from
+                         * being removed.
+                         */
+                        if (page != pvec->pages[i]) {
+                                VM_BUG_ON_PAGE(page->index >
+                                                pvec->pages[i]->index, page);
+                                continue;
+                        }
+                        WARN_ON_ONCE(!PageLocked(page));
+                        if (PageTransHuge(page) && !PageHuge(page))
+                                tail_pages = HPAGE_PMD_NR - 1;
                         page->mapping = NULL;
-                /* Leave page->index set: truncation lookup relies on it */
-
-                /*
-                 * Move to the next page in the vector if this is a regular
-                 * page or the index is of the last sub-page of this compound
-                 * page.
-                 */
-                if (page->index + (1UL << compound_order(page)) - 1 ==
-                                xas.xa_index)
+                        /*
+                         * Leave page->index set: truncation lookup relies
+                         * upon it
+                         */
                         i++;
+                } else {
+                        VM_BUG_ON_PAGE(page->index + HPAGE_PMD_NR - tail_pages
+                                        != pvec->pages[i]->index, page);
+                        tail_pages--;
+                }
                 xas_store(&xas, NULL);
                 total_pages++;
         }
@@ -1498,7 +1494,7 @@ EXPORT_SYMBOL(page_cache_prev_miss);
 struct page *find_get_entry(struct address_space *mapping, pgoff_t offset)
 {
         XA_STATE(xas, &mapping->i_pages, offset);
-        struct page *page;
+        struct page *head, *page;
 
         rcu_read_lock();
 repeat:
@@ -1513,19 +1509,25 @@ repeat:
         if (!page || xa_is_value(page))
                 goto out;
 
-        if (!page_cache_get_speculative(page))
+        head = compound_head(page);
+        if (!page_cache_get_speculative(head))
+                goto repeat;
+
+        /* The page was split under us? */
+        if (compound_head(page) != head) {
+                put_page(head);
                 goto repeat;
+        }
 
         /*
-         * Has the page moved or been split?
+         * Has the page moved?
          * This is part of the lockless pagecache protocol. See
          * include/linux/pagemap.h for details.
          */
         if (unlikely(page != xas_reload(&xas))) {
-                put_page(page);
+                put_page(head);
                 goto repeat;
         }
-        page = find_subpage(page, offset);
 out:
         rcu_read_unlock();
 
@@ -1707,6 +1709,7 @@ unsigned find_get_entries(struct address_space *mapping,
 
         rcu_read_lock();
         xas_for_each(&xas, page, ULONG_MAX) {
+                struct page *head;
                 if (xas_retry(&xas, page))
                         continue;
                 /*
@@ -1717,13 +1720,17 @@ unsigned find_get_entries(struct address_space *mapping,
                 if (xa_is_value(page))
                         goto export;
 
-                if (!page_cache_get_speculative(page))
+                head = compound_head(page);
+                if (!page_cache_get_speculative(head))
                         goto retry;
 
-                /* Has the page moved or been split? */
+                /* The page was split under us? */
+                if (compound_head(page) != head)
+                        goto put_page;
+
+                /* Has the page moved? */
                 if (unlikely(page != xas_reload(&xas)))
                         goto put_page;
-                page = find_subpage(page, xas.xa_index);
 
 export:
                 indices[ret] = xas.xa_index;
@@ -1732,7 +1739,7 @@ export:
                         break;
                 continue;
 put_page:
-                put_page(page);
+                put_page(head);
 retry:
                 xas_reset(&xas);
         }
@@ -1774,27 +1781,33 @@ unsigned find_get_pages_range(struct address_space *mapping, pgoff_t *start,
 
         rcu_read_lock();
         xas_for_each(&xas, page, end) {
+                struct page *head;
                 if (xas_retry(&xas, page))
                         continue;
                 /* Skip over shadow, swap and DAX entries */
                 if (xa_is_value(page))
                         continue;
 
-                if (!page_cache_get_speculative(page))
+                head = compound_head(page);
+                if (!page_cache_get_speculative(head))
                         goto retry;
 
-                /* Has the page moved or been split? */
+                /* The page was split under us? */
+                if (compound_head(page) != head)
+                        goto put_page;
+
+                /* Has the page moved? */
                 if (unlikely(page != xas_reload(&xas)))
                         goto put_page;
 
-                pages[ret] = find_subpage(page, xas.xa_index);
+                pages[ret] = page;
                 if (++ret == nr_pages) {
                         *start = xas.xa_index + 1;
                         goto out;
                 }
                 continue;
 put_page:
-                put_page(page);
+                put_page(head);
 retry:
                 xas_reset(&xas);
         }
@@ -1839,6 +1852,7 @@ unsigned find_get_pages_contig(struct address_space *mapping, pgoff_t index,
 
         rcu_read_lock();
         for (page = xas_load(&xas); page; page = xas_next(&xas)) {
+                struct page *head;
                 if (xas_retry(&xas, page))
                         continue;
                 /*
@@ -1848,19 +1862,24 @@ unsigned find_get_pages_contig(struct address_space *mapping, pgoff_t index,
                 if (xa_is_value(page))
                         break;
 
-                if (!page_cache_get_speculative(page))
+                head = compound_head(page);
+                if (!page_cache_get_speculative(head))
                         goto retry;
 
-                /* Has the page moved or been split? */
+                /* The page was split under us? */
+                if (compound_head(page) != head)
+                        goto put_page;
+
+                /* Has the page moved? */
                 if (unlikely(page != xas_reload(&xas)))
                         goto put_page;
 
-                pages[ret] = find_subpage(page, xas.xa_index);
+                pages[ret] = page;
                 if (++ret == nr_pages)
                         break;
                 continue;
 put_page:
-                put_page(page);
+                put_page(head);
 retry:
                 xas_reset(&xas);
         }
@@ -1896,6 +1915,7 @@ unsigned find_get_pages_range_tag(struct address_space *mapping, pgoff_t *index,
 
         rcu_read_lock();
         xas_for_each_marked(&xas, page, end, tag) {
+                struct page *head;
                 if (xas_retry(&xas, page))
                         continue;
                 /*
@@ -1906,21 +1926,26 @@ unsigned find_get_pages_range_tag(struct address_space *mapping, pgoff_t *index,
                 if (xa_is_value(page))
                         continue;
 
-                if (!page_cache_get_speculative(page))
+                head = compound_head(page);
+                if (!page_cache_get_speculative(head))
                         goto retry;
 
-                /* Has the page moved or been split? */
+                /* The page was split under us? */
+                if (compound_head(page) != head)
+                        goto put_page;
+
+                /* Has the page moved? */
                 if (unlikely(page != xas_reload(&xas)))
                         goto put_page;
 
-                pages[ret] = find_subpage(page, xas.xa_index);
+                pages[ret] = page;
                 if (++ret == nr_pages) {
                         *index = xas.xa_index + 1;
                         goto out;
                 }
                 continue;
 put_page:
-                put_page(page);
+                put_page(head);
 retry:
                 xas_reset(&xas);
         }
@@ -2603,7 +2628,7 @@ void filemap_map_pages(struct vm_fault *vmf,
         pgoff_t last_pgoff = start_pgoff;
         unsigned long max_idx;
         XA_STATE(xas, &mapping->i_pages, start_pgoff);
-        struct page *page;
+        struct page *head, *page;
 
         rcu_read_lock();
         xas_for_each(&xas, page, end_pgoff) {
@@ -2612,19 +2637,24 @@ void filemap_map_pages(struct vm_fault *vmf,
                 if (xa_is_value(page))
                         goto next;
 
+                head = compound_head(page);
+
                 /*
                  * Check for a locked page first, as a speculative
                  * reference may adversely influence page migration.
                  */
-                if (PageLocked(page))
+                if (PageLocked(head))
                         goto next;
-                if (!page_cache_get_speculative(page))
+                if (!page_cache_get_speculative(head))
                         goto next;
 
-                /* Has the page moved or been split? */
+                /* The page was split under us? */
+                if (compound_head(page) != head)
+                        goto skip;
+
+                /* Has the page moved? */
                 if (unlikely(page != xas_reload(&xas)))
                         goto skip;
-                page = find_subpage(page, xas.xa_index);
 
                 if (!PageUptodate(page) ||
                                 PageReadahead(page) ||
diff --git a/mm/huge_memory.c b/mm/huge_memory.c
index bb8b617e34ed..885642c82aaa 100644
--- a/mm/huge_memory.c
+++ b/mm/huge_memory.c
@@ -2496,9 +2496,6 @@ static void __split_huge_page(struct page *page, struct list_head *list,
                         if (IS_ENABLED(CONFIG_SHMEM) && PageSwapBacked(head))
                                 shmem_uncharge(head->mapping->host, 1);
                         put_page(head + i);
-                } else if (!PageAnon(page)) {
-                        __xa_store(&head->mapping->i_pages, head[i].index,
-                                        head + i, 0);
                 }
         }
 
diff --git a/mm/hugetlb.c b/mm/hugetlb.c
index ac843d32b019..ede7e7f5d1ab 100644
--- a/mm/hugetlb.c
+++ b/mm/hugetlb.c
@@ -1510,16 +1510,29 @@ static int free_pool_huge_page(struct hstate *h, nodemask_t *nodes_allowed,
 
 /*
  * Dissolve a given free hugepage into free buddy pages. This function does
- * nothing for in-use (including surplus) hugepages. Returns -EBUSY if the
- * dissolution fails because a give page is not a free hugepage, or because
- * free hugepages are fully reserved.
+ * nothing for in-use hugepages and non-hugepages.
+ * This function returns values like below:
+ *
+ *  -EBUSY: failed to dissolved free hugepages or the hugepage is in-use
+ *          (allocated or reserved.)
+ *       0: successfully dissolved free hugepages or the page is not a
+ *          hugepage (considered as already dissolved)
  */
 int dissolve_free_huge_page(struct page *page)
 {
         int rc = -EBUSY;
 
+        /* Not to disrupt normal path by vainly holding hugetlb_lock */
+        if (!PageHuge(page))
+                return 0;
+
         spin_lock(&hugetlb_lock);
-        if (PageHuge(page) && !page_count(page)) {
+        if (!PageHuge(page)) {
+                rc = 0;
+                goto out;
+        }
+
+        if (!page_count(page)) {
                 struct page *head = compound_head(page);
                 struct hstate *h = page_hstate(head);
                 int nid = page_to_nid(head);
@@ -1564,11 +1577,9 @@ int dissolve_free_huge_pages(unsigned long start_pfn, unsigned long end_pfn)
 
         for (pfn = start_pfn; pfn < end_pfn; pfn += 1 << minimum_order) {
                 page = pfn_to_page(pfn);
-                if (PageHuge(page) && !page_count(page)) {
-                        rc = dissolve_free_huge_page(page);
-                        if (rc)
-                                break;
-                }
+                rc = dissolve_free_huge_page(page);
+                if (rc)
+                        break;
         }
 
         return rc;
diff --git a/mm/khugepaged.c b/mm/khugepaged.c
index 0f7419938008..eaaa21b23215 100644
--- a/mm/khugepaged.c
+++ b/mm/khugepaged.c
@@ -1378,7 +1378,7 @@ static void collapse_shmem(struct mm_struct *mm,
                                 result = SCAN_FAIL;
                                 goto xa_locked;
                         }
-                        xas_store(&xas, new_page);
+                        xas_store(&xas, new_page + (index % HPAGE_PMD_NR));
                         nr_none++;
                         continue;
                 }
@@ -1454,7 +1454,7 @@ static void collapse_shmem(struct mm_struct *mm,
                 list_add_tail(&page->lru, &pagelist);
 
                 /* Finally, replace with the new page. */
-                xas_store(&xas, new_page);
+                xas_store(&xas, new_page + (index % HPAGE_PMD_NR));
                 continue;
 out_unlock:
                 unlock_page(page);
diff --git a/mm/memfd.c b/mm/memfd.c
index 2647c898990c..650e65a46b9c 100644
--- a/mm/memfd.c
+++ b/mm/memfd.c
@@ -39,7 +39,6 @@ static void memfd_tag_pins(struct xa_state *xas)
         xas_for_each(xas, page, ULONG_MAX) {
                 if (xa_is_value(page))
                         continue;
-                page = find_subpage(page, xas->xa_index);
                 if (page_count(page) - page_mapcount(page) > 1)
                         xas_set_mark(xas, MEMFD_TAG_PINNED);
 
@@ -89,7 +88,6 @@ static int memfd_wait_for_pins(struct address_space *mapping)
                         bool clear = true;
                         if (xa_is_value(page))
                                 continue;
-                        page = find_subpage(page, xas.xa_index);
                         if (page_count(page) - page_mapcount(page) != 1) {
                                 /*
                                  * On the last scan, we clean up all those tags
diff --git a/mm/memory-failure.c b/mm/memory-failure.c
index 8da0334b9ca0..d9cc6606f409 100644
--- a/mm/memory-failure.c
+++ b/mm/memory-failure.c
@@ -1730,6 +1730,8 @@ static int soft_offline_huge_page(struct page *page, int flags)
                 if (!ret) {
                         if (set_hwpoison_free_buddy_page(page))
                                 num_poisoned_pages_inc();
+                        else
+                                ret = -EBUSY;
                 }
         }
         return ret;
@@ -1854,11 +1856,8 @@ static int soft_offline_in_use_page(struct page *page, int flags)
 
 static int soft_offline_free_page(struct page *page)
 {
-        int rc = 0;
-        struct page *head = compound_head(page);
+        int rc = dissolve_free_huge_page(page);
 
-        if (PageHuge(head))
-                rc = dissolve_free_huge_page(page);
         if (!rc) {
                 if (set_hwpoison_free_buddy_page(page))
                         num_poisoned_pages_inc();
diff --git a/mm/mempolicy.c b/mm/mempolicy.c
index 01600d80ae01..fdcb73536319 100644
--- a/mm/mempolicy.c
+++ b/mm/mempolicy.c
@@ -306,7 +306,7 @@ static void mpol_rebind_nodemask(struct mempolicy *pol, const nodemask_t *nodes)
         else {
                 nodes_remap(tmp, pol->v.nodes,pol->w.cpuset_mems_allowed,
                                                                 *nodes);
-                pol->w.cpuset_mems_allowed = tmp;
+                pol->w.cpuset_mems_allowed = *nodes;
         }
 
         if (nodes_empty(tmp))
diff --git a/mm/migrate.c b/mm/migrate.c
index f2ecc2855a12..e9594bc0d406 100644
--- a/mm/migrate.c
+++ b/mm/migrate.c
@@ -463,7 +463,7 @@ int migrate_page_move_mapping(struct address_space *mapping,
 
                 for (i = 1; i < HPAGE_PMD_NR; i++) {
                         xas_next(&xas);
-                        xas_store(&xas, newpage);
+                        xas_store(&xas, newpage + i);
                 }
         }
 
diff --git a/mm/oom_kill.c b/mm/oom_kill.c
index 5a58778c91d4..f719b64741d6 100644
--- a/mm/oom_kill.c
+++ b/mm/oom_kill.c
@@ -987,8 +987,7 @@ static void oom_kill_process(struct oom_control *oc, const char *message)
 /*
  * Determines whether the kernel must panic because of the panic_on_oom sysctl.
  */
-static void check_panic_on_oom(struct oom_control *oc,
-                               enum oom_constraint constraint)
+static void check_panic_on_oom(struct oom_control *oc)
 {
         if (likely(!sysctl_panic_on_oom))
                 return;
@@ -998,7 +997,7 @@ static void check_panic_on_oom(struct oom_control *oc,
                  * does not panic for cpuset, mempolicy, or memcg allocation
                  * failures.
                  */
-                if (constraint != CONSTRAINT_NONE)
+                if (oc->constraint != CONSTRAINT_NONE)
                         return;
         }
         /* Do not panic for oom kills triggered by sysrq */
@@ -1035,7 +1034,6 @@ EXPORT_SYMBOL_GPL(unregister_oom_notifier);
 bool out_of_memory(struct oom_control *oc)
 {
         unsigned long freed = 0;
-        enum oom_constraint constraint = CONSTRAINT_NONE;
 
         if (oom_killer_disabled)
                 return false;
@@ -1071,10 +1069,10 @@ bool out_of_memory(struct oom_control *oc)
          * Check if there were limitations on the allocation (only relevant for
          * NUMA and memcg) that may require different handling.
          */
-        constraint = constrained_alloc(oc);
-        if (constraint != CONSTRAINT_MEMORY_POLICY)
+        oc->constraint = constrained_alloc(oc);
+        if (oc->constraint != CONSTRAINT_MEMORY_POLICY)
                 oc->nodemask = NULL;
-        check_panic_on_oom(oc, constraint);
+        check_panic_on_oom(oc);
 
         if (!is_memcg_oom(oc) && sysctl_oom_kill_allocating_task &&
             current->mm && !oom_unkillable_task(current, NULL, oc->nodemask) &&
diff --git a/mm/page_alloc.c b/mm/page_alloc.c
index d66bc8abe0af..8e3bc949ebcc 100644
--- a/mm/page_alloc.c
+++ b/mm/page_alloc.c
@@ -1826,7 +1826,8 @@ deferred_grow_zone(struct zone *zone, unsigned int order)
                                                  first_deferred_pfn)) {
                 pgdat->first_deferred_pfn = ULONG_MAX;
                 pgdat_resize_unlock(pgdat, &flags);
-                return true;
+                /* Retry only once. */
+                return first_deferred_pfn != ULONG_MAX;
         }
 
         /*
diff --git a/mm/page_idle.c b/mm/page_idle.c
index 0b39ec0c945c..295512465065 100644
--- a/mm/page_idle.c
+++ b/mm/page_idle.c
@@ -136,7 +136,7 @@ static ssize_t page_idle_bitmap_read(struct file *file, struct kobject *kobj,
 
         end_pfn = pfn + count * BITS_PER_BYTE;
         if (end_pfn > max_pfn)
-                end_pfn = ALIGN(max_pfn, BITMAP_CHUNK_BITS);
+                end_pfn = max_pfn;
 
         for (; pfn < end_pfn; pfn++) {
                 bit = pfn % BITMAP_CHUNK_BITS;
@@ -181,7 +181,7 @@ static ssize_t page_idle_bitmap_write(struct file *file, struct kobject *kobj,
 
         end_pfn = pfn + count * BITS_PER_BYTE;
         if (end_pfn > max_pfn)
-                end_pfn = ALIGN(max_pfn, BITMAP_CHUNK_BITS);
+                end_pfn = max_pfn;
 
         for (; pfn < end_pfn; pfn++) {
                 bit = pfn % BITMAP_CHUNK_BITS;
diff --git a/mm/page_io.c b/mm/page_io.c
index 2e8019d0e048..a39aac2f8c8d 100644
--- a/mm/page_io.c
+++ b/mm/page_io.c
@@ -29,10 +29,9 @@
 static struct bio *get_swap_bio(gfp_t gfp_flags,
                                 struct page *page, bio_end_io_t end_io)
 {
-        int i, nr = hpage_nr_pages(page);
         struct bio *bio;
 
-        bio = bio_alloc(gfp_flags, nr);
+        bio = bio_alloc(gfp_flags, 1);
         if (bio) {
                 struct block_device *bdev;
 
@@ -41,9 +40,7 @@ static struct bio *get_swap_bio(gfp_t gfp_flags,
                 bio->bi_iter.bi_sector <<= PAGE_SHIFT - 9;
                 bio->bi_end_io = end_io;
 
-                for (i = 0; i < nr; i++)
-                        bio_add_page(bio, page + i, PAGE_SIZE, 0);
-                VM_BUG_ON(bio->bi_iter.bi_size != PAGE_SIZE * nr);
+                bio_add_page(bio, page, PAGE_SIZE * hpage_nr_pages(page), 0);
         }
         return bio;
 }
@@ -140,8 +137,10 @@ out:
         unlock_page(page);
         WRITE_ONCE(bio->bi_private, NULL);
         bio_put(bio);
-        blk_wake_io_task(waiter);
-        put_task_struct(waiter);
+        if (waiter) {
+                blk_wake_io_task(waiter);
+                put_task_struct(waiter);
+        }
 }
 
 int generic_swapfile_activate(struct swap_info_struct *sis,
@@ -398,11 +397,12 @@ int swap_readpage(struct page *page, bool synchronous)
          * Keep this task valid during swap readpage because the oom killer may
          * attempt to access it in the page fault retry time check.
          */
-        get_task_struct(current);
-        bio->bi_private = current;
         bio_set_op_attrs(bio, REQ_OP_READ, 0);
-        if (synchronous)
+        if (synchronous) {
                 bio->bi_opf |= REQ_HIPRI;
+                get_task_struct(current);
+                bio->bi_private = current;
+        }
         count_vm_event(PSWPIN);
         bio_get(bio);
         qc = submit_bio(bio);
diff --git a/mm/shmem.c b/mm/shmem.c
index 1bb3b8dc8bb2..f4dce9c8670d 100644
--- a/mm/shmem.c
+++ b/mm/shmem.c
@@ -614,7 +614,7 @@ static int shmem_add_to_page_cache(struct page *page,
                 if (xas_error(&xas))
                         goto unlock;
 next:
-                xas_store(&xas, page);
+                xas_store(&xas, page + i);
                 if (++i < nr) {
                         xas_next(&xas);
                         goto next;
diff --git a/mm/swap_state.c b/mm/swap_state.c
index eb714165afd2..85245fdec8d9 100644
--- a/mm/swap_state.c
+++ b/mm/swap_state.c
@@ -132,7 +132,7 @@ int add_to_swap_cache(struct page *page, swp_entry_t entry, gfp_t gfp)
                 for (i = 0; i < nr; i++) {
                         VM_BUG_ON_PAGE(xas.xa_index != idx + i, page);
                         set_page_private(page + i, entry.val + i);
-                        xas_store(&xas, page);
+                        xas_store(&xas, page + i);
                         xas_next(&xas);
                 }
                 address_space->nrpages += nr;
@@ -167,7 +167,7 @@ void __delete_from_swap_cache(struct page *page, swp_entry_t entry)
 
         for (i = 0; i < nr; i++) {
                 void *entry = xas_store(&xas, NULL);
-                VM_BUG_ON_PAGE(entry != page, entry);
+                VM_BUG_ON_PAGE(entry != page + i, entry);
                 set_page_private(page + i, 0);
                 xas_next(&xas);
         }
diff --git a/mm/vmalloc.c b/mm/vmalloc.c
index 4c9e150e5ad3..030a544e6602 100644
--- a/mm/vmalloc.c
+++ b/mm/vmalloc.c
@@ -913,7 +913,7 @@ adjust_va_to_fit_type(struct vmap_area *va,
         unsigned long nva_start_addr, unsigned long size,
         enum fit_type type)
 {
-        struct vmap_area *lva;
+        struct vmap_area *lva = NULL;
 
         if (type == FL_FIT_TYPE) {
                 /*
@@ -972,7 +972,7 @@ adjust_va_to_fit_type(struct vmap_area *va,
         if (type != FL_FIT_TYPE) {
                 augment_tree_propagate_from(va);
 
-                if (type == NE_FIT_TYPE)
+                if (lva)        /* type == NE_FIT_TYPE */
                         insert_vmap_area_augment(lva, &va->rb_node,
                                 &free_vmap_area_root, &free_vmap_area_list);
         }
@@ -2128,17 +2128,6 @@ static void vm_remove_mappings(struct vm_struct *area, int deallocate_pages)
         int flush_dmap = 0;
         int i;
 
-        /*
-         * The below block can be removed when all architectures that have
-         * direct map permissions also have set_direct_map_() implementations.
-         * This is concerned with resetting the direct map any an vm alias with
-         * execute permissions, without leaving a RW+X window.
-         */
-        if (flush_reset && !IS_ENABLED(CONFIG_ARCH_HAS_SET_DIRECT_MAP)) {
-                set_memory_nx((unsigned long)area->addr, area->nr_pages);
-                set_memory_rw((unsigned long)area->addr, area->nr_pages);
-        }
-
         remove_vm_area(area->addr);
 
         /* If this is not VM_FLUSH_RESET_PERMS memory, no need for the below. */
diff --git a/mm/vmscan.c b/mm/vmscan.c
index 7889f583ced9..910e02c793ff 100644
--- a/mm/vmscan.c
+++ b/mm/vmscan.c
@@ -3644,19 +3644,18 @@ out:
 }
 
 /*
- * pgdat->kswapd_classzone_idx is the highest zone index that a recent
- * allocation request woke kswapd for. When kswapd has not woken recently,
- * the value is MAX_NR_ZONES which is not a valid index. This compares a
- * given classzone and returns it or the highest classzone index kswapd
- * was recently woke for.
+ * The pgdat->kswapd_classzone_idx is used to pass the highest zone index to be
+ * reclaimed by kswapd from the waker. If the value is MAX_NR_ZONES which is not
+ * a valid index then either kswapd runs for first time or kswapd couldn't sleep
+ * after previous reclaim attempt (node is still unbalanced). In that case
+ * return the zone index of the previous kswapd reclaim cycle.
  */
 static enum zone_type kswapd_classzone_idx(pg_data_t *pgdat,
-                                           enum zone_type classzone_idx)
+                                           enum zone_type prev_classzone_idx)
 {
         if (pgdat->kswapd_classzone_idx == MAX_NR_ZONES)
-                return classzone_idx;
-
-        return max(pgdat->kswapd_classzone_idx, classzone_idx);
+                return prev_classzone_idx;
+        return pgdat->kswapd_classzone_idx;
 }
 
 static void kswapd_try_to_sleep(pg_data_t *pgdat, int alloc_order, int reclaim_order,
@@ -3797,7 +3796,7 @@ kswapd_try_sleep:
 
                 /* Read the new order and classzone_idx */
                 alloc_order = reclaim_order = pgdat->kswapd_order;
-                classzone_idx = kswapd_classzone_idx(pgdat, 0);
+                classzone_idx = kswapd_classzone_idx(pgdat, classzone_idx);
                 pgdat->kswapd_order = 0;
                 pgdat->kswapd_classzone_idx = MAX_NR_ZONES;
 
@@ -3851,8 +3850,12 @@ void wakeup_kswapd(struct zone *zone, gfp_t gfp_flags, int order,
         if (!cpuset_zone_allowed(zone, gfp_flags))
                 return;
         pgdat = zone->zone_pgdat;
-        pgdat->kswapd_classzone_idx = kswapd_classzone_idx(pgdat,
-                                                           classzone_idx);
+
+        if (pgdat->kswapd_classzone_idx == MAX_NR_ZONES)
+                pgdat->kswapd_classzone_idx = classzone_idx;
+        else
+                pgdat->kswapd_classzone_idx = max(pgdat->kswapd_classzone_idx,
+                                                  classzone_idx);
         pgdat->kswapd_order = max(pgdat->kswapd_order, order);
         if (!waitqueue_active(&pgdat->kswapd_wait))
                 return;
diff --git a/net/bluetooth/6lowpan.c b/net/bluetooth/6lowpan.c
index 19d27bee285e..1555b0c6f7ec 100644
--- a/net/bluetooth/6lowpan.c
+++ b/net/bluetooth/6lowpan.c
@@ -160,10 +160,10 @@ static inline struct lowpan_peer *peer_lookup_dst(struct lowpan_btle_dev *dev,
                                                   struct in6_addr *daddr,
                                                   struct sk_buff *skb)
 {
-        struct lowpan_peer *peer;
-        struct in6_addr *nexthop;
         struct rt6_info *rt = (struct rt6_info *)skb_dst(skb);
         int count = atomic_read(&dev->peer_count);
+        const struct in6_addr *nexthop;
+        struct lowpan_peer *peer;
 
         BT_DBG("peers %d addr %pI6c rt %p", count, daddr, rt);
 
diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
index 9f77432dbe38..5406d7cd46ad 100644
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -1353,7 +1353,7 @@ static bool l2cap_check_enc_key_size(struct hci_conn *hcon)
          * actually encrypted before enforcing a key size.
          */
         return (!test_bit(HCI_CONN_ENCRYPT, &hcon->flags) ||
-                hcon->enc_key_size > HCI_MIN_ENC_KEY_SIZE);
+                hcon->enc_key_size >= HCI_MIN_ENC_KEY_SIZE);
 }
 
 static void l2cap_do_start(struct l2cap_chan *chan)
diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
index 16f9159234a2..8c2ec35b6512 100644
--- a/net/ipv4/ip_output.c
+++ b/net/ipv4/ip_output.c
@@ -318,6 +318,7 @@ static int ip_finish_output(struct net *net, struct sock *sk, struct sk_buff *sk
 static int ip_mc_finish_output(struct net *net, struct sock *sk,
                                struct sk_buff *skb)
 {
+        struct rtable *new_rt;
         int ret;
 
         ret = BPF_CGROUP_RUN_PROG_INET_EGRESS(sk, skb);
@@ -326,6 +327,17 @@ static int ip_mc_finish_output(struct net *net, struct sock *sk,
                 return ret;
         }
 
+        /* Reset rt_iif so that inet_iif() will return skb->skb_iif. Setting
+         * this to non-zero causes ipi_ifindex in in_pktinfo to be overwritten,
+         * see ipv4_pktinfo_prepare().
+         */
+        new_rt = rt_dst_clone(net->loopback_dev, skb_rtable(skb));
+        if (new_rt) {
+                new_rt->rt_iif = 0;
+                skb_dst_drop(skb);
+                skb_dst_set(skb, &new_rt->dst);
+        }
+
         return dev_loopback_xmit(net, sk, skb);
 }
 
diff --git a/net/ipv4/raw.c b/net/ipv4/raw.c
index 0b8e06ca75d6..40a6abbc9cf6 100644
--- a/net/ipv4/raw.c
+++ b/net/ipv4/raw.c
@@ -197,7 +197,7 @@ static int raw_v4_input(struct sk_buff *skb, const struct iphdr *iph, int hash)
                 }
                 sk = __raw_v4_lookup(net, sk_next(sk), iph->protocol,
                                      iph->saddr, iph->daddr,
-                                     skb->dev->ifindex, sdif);
+                                     dif, sdif);
         }
 out:
         read_unlock(&raw_v4_hashinfo.lock);
diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index 6cb7cff22db9..8ea0735a6754 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -1647,6 +1647,39 @@ struct rtable *rt_dst_alloc(struct net_device *dev,
 }
 EXPORT_SYMBOL(rt_dst_alloc);
 
+struct rtable *rt_dst_clone(struct net_device *dev, struct rtable *rt)
+{
+        struct rtable *new_rt;
+
+        new_rt = dst_alloc(&ipv4_dst_ops, dev, 1, DST_OBSOLETE_FORCE_CHK,
+                           rt->dst.flags);
+
+        if (new_rt) {
+                new_rt->rt_genid = rt_genid_ipv4(dev_net(dev));
+                new_rt->rt_flags = rt->rt_flags;
+                new_rt->rt_type = rt->rt_type;
+                new_rt->rt_is_input = rt->rt_is_input;
+                new_rt->rt_iif = rt->rt_iif;
+                new_rt->rt_pmtu = rt->rt_pmtu;
+                new_rt->rt_mtu_locked = rt->rt_mtu_locked;
+                new_rt->rt_gw_family = rt->rt_gw_family;
+                if (rt->rt_gw_family == AF_INET)
+                        new_rt->rt_gw4 = rt->rt_gw4;
+                else if (rt->rt_gw_family == AF_INET6)
+                        new_rt->rt_gw6 = rt->rt_gw6;
+                INIT_LIST_HEAD(&new_rt->rt_uncached);
+
+                new_rt->dst.flags |= DST_HOST;
+                new_rt->dst.input = rt->dst.input;
+                new_rt->dst.output = rt->dst.output;
+                new_rt->dst.error = rt->dst.error;
+                new_rt->dst.lastuse = jiffies;
+                new_rt->dst.lwtstate = lwtstate_get(rt->dst.lwtstate);
+        }
+        return new_rt;
+}
+EXPORT_SYMBOL(rt_dst_clone);
+
 /* called in rcu_read_lock() section */
 int ip_mc_validate_source(struct sk_buff *skb, __be32 daddr, __be32 saddr,
                           u8 tos, struct net_device *dev,
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index 834475717110..21efcd02f337 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -59,8 +59,8 @@ static int ip6_finish_output2(struct net *net, struct sock *sk, struct sk_buff *
 {
         struct dst_entry *dst = skb_dst(skb);
         struct net_device *dev = dst->dev;
+        const struct in6_addr *nexthop;
         struct neighbour *neigh;
-        struct in6_addr *nexthop;
         int ret;
 
         if (ipv6_addr_is_multicast(&ipv6_hdr(skb)->daddr)) {
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index 11ad62effd56..97a843cf164c 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -218,7 +218,8 @@ static struct neighbour *ip6_dst_neigh_lookup(const struct dst_entry *dst,
 {
         const struct rt6_info *rt = container_of(dst, struct rt6_info, dst);
 
-        return ip6_neigh_lookup(&rt->rt6i_gateway, dst->dev, skb, daddr);
+        return ip6_neigh_lookup(rt6_nexthop(rt, &in6addr_any),
+                                dst->dev, skb, daddr);
 }
 
 static void ip6_confirm_neigh(const struct dst_entry *dst, const void *daddr)
@@ -5281,7 +5282,7 @@ static struct ctl_table ipv6_route_table_template[] = {
                 .data           =       &init_net.ipv6.sysctl.skip_notify_on_dev_down,
                 .maxlen         =       sizeof(int),
                 .mode           =       0644,
-                .proc_handler   =       proc_dointvec,
+                .proc_handler   =       proc_dointvec_minmax,
                 .extra1         =       &zero,
                 .extra2         =       &one,
         },
diff --git a/net/netfilter/nf_flow_table_ip.c b/net/netfilter/nf_flow_table_ip.c
index 241317473114..cdfc33517e85 100644
--- a/net/netfilter/nf_flow_table_ip.c
+++ b/net/netfilter/nf_flow_table_ip.c
@@ -439,9 +439,9 @@ nf_flow_offload_ipv6_hook(void *priv, struct sk_buff *skb,
         struct nf_flowtable *flow_table = priv;
         struct flow_offload_tuple tuple = {};
         enum flow_offload_tuple_dir dir;
+        const struct in6_addr *nexthop;
         struct flow_offload *flow;
         struct net_device *outdev;
-        struct in6_addr *nexthop;
         struct ipv6hdr *ip6h;
         struct rt6_info *rt;
 
diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
index a29d66da7394..5f78df080573 100644
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -2401,6 +2401,9 @@ static void tpacket_destruct_skb(struct sk_buff *skb)
 
                 ts = __packet_set_timestamp(po, ph, skb);
                 __packet_set_status(po, ph, TP_STATUS_AVAILABLE | ts);
+
+                if (!packet_read_pending(&po->tx_ring))
+                        complete(&po->skb_completion);
         }
 
         sock_wfree(skb);
@@ -2585,7 +2588,7 @@ static int tpacket_parse_header(struct packet_sock *po, void *frame,
 
 static int tpacket_snd(struct packet_sock *po, struct msghdr *msg)
 {
-        struct sk_buff *skb;
+        struct sk_buff *skb = NULL;
         struct net_device *dev;
         struct virtio_net_hdr *vnet_hdr = NULL;
         struct sockcm_cookie sockc;
@@ -2600,6 +2603,7 @@ static int tpacket_snd(struct packet_sock *po, struct msghdr *msg)
         int len_sum = 0;
         int status = TP_STATUS_AVAILABLE;
         int hlen, tlen, copylen = 0;
+        long timeo = 0;
 
         mutex_lock(&po->pg_vec_lock);
 
@@ -2646,12 +2650,21 @@ static int tpacket_snd(struct packet_sock *po, struct msghdr *msg)
         if ((size_max > dev->mtu + reserve + VLAN_HLEN) && !po->has_vnet_hdr)
                 size_max = dev->mtu + reserve + VLAN_HLEN;
 
+        reinit_completion(&po->skb_completion);
+
         do {
                 ph = packet_current_frame(po, &po->tx_ring,
                                           TP_STATUS_SEND_REQUEST);
                 if (unlikely(ph == NULL)) {
-                        if (need_wait && need_resched())
-                                schedule();
+                        if (need_wait && skb) {
+                                timeo = sock_sndtimeo(&po->sk, msg->msg_flags & MSG_DONTWAIT);
+                                timeo = wait_for_completion_interruptible_timeout(&po->skb_completion, timeo);
+                                if (timeo <= 0) {
+                                        err = !timeo ? -ETIMEDOUT : -ERESTARTSYS;
+                                        goto out_put;
+                                }
+                        }
+                        /* check for additional frames */
                         continue;
                 }
 
@@ -3207,6 +3220,7 @@ static int packet_create(struct net *net, struct socket *sock, int protocol,
         sock_init_data(sock, sk);
 
         po = pkt_sk(sk);
+        init_completion(&po->skb_completion);
         sk->sk_family = PF_PACKET;
         po->num = proto;
         po->xmit = dev_queue_xmit;
@@ -4314,7 +4328,7 @@ static int packet_set_ring(struct sock *sk, union tpacket_req_u *req_u,
                                     req3->tp_sizeof_priv ||
                                     req3->tp_feature_req_word) {
                                         err = -EINVAL;
-                                        goto out;
+                                        goto out_free_pg_vec;
                                 }
                         }
                         break;
@@ -4378,6 +4392,7 @@ static int packet_set_ring(struct sock *sk, union tpacket_req_u *req_u,
                         prb_shutdown_retire_blk_timer(po, rb_queue);
         }
 
+out_free_pg_vec:
         if (pg_vec)
                 free_pg_vec(pg_vec, order, req->tp_block_nr);
 out:
diff --git a/net/packet/internal.h b/net/packet/internal.h
index 3bb7c5fb3bff..c70a2794456f 100644
--- a/net/packet/internal.h
+++ b/net/packet/internal.h
@@ -128,6 +128,7 @@ struct packet_sock {
         unsigned int            tp_hdrlen;
         unsigned int            tp_reserve;
         unsigned int            tp_tstamp;
+        struct completion       skb_completion;
         struct net_device __rcu *cached_dev;
         int                     (*xmit)(struct sk_buff *skb);
         struct packet_type      prot_hook ____cacheline_aligned_in_smp;
diff --git a/net/sched/sch_cbs.c b/net/sched/sch_cbs.c
index e16a3d37d2bc..732e109c3055 100644
--- a/net/sched/sch_cbs.c
+++ b/net/sched/sch_cbs.c
@@ -549,12 +549,17 @@ static struct notifier_block cbs_device_notifier = {
 
 static int __init cbs_module_init(void)
 {
-        int err = register_netdevice_notifier(&cbs_device_notifier);
+        int err;
 
+        err = register_netdevice_notifier(&cbs_device_notifier);
         if (err)
                 return err;
 
-        return register_qdisc(&cbs_qdisc_ops);
+        err = register_qdisc(&cbs_qdisc_ops);
+        if (err)
+                unregister_netdevice_notifier(&cbs_device_notifier);
+
+        return err;
 }
 
 static void __exit cbs_module_exit(void)
diff --git a/net/sctp/endpointola.c b/net/sctp/endpointola.c
index e358437ba29b..69cebb2c998b 100644
--- a/net/sctp/endpointola.c
+++ b/net/sctp/endpointola.c
@@ -118,10 +118,6 @@ static struct sctp_endpoint *sctp_endpoint_init(struct sctp_endpoint *ep,
         /* Initialize the bind addr area */
         sctp_bind_addr_init(&ep->base.bind_addr, 0);
 
-        /* Remember who we are attached to.  */
-        ep->base.sk = sk;
-        sock_hold(ep->base.sk);
-
         /* Create the lists of associations.  */
         INIT_LIST_HEAD(&ep->asocs);
 
@@ -154,6 +150,10 @@ static struct sctp_endpoint *sctp_endpoint_init(struct sctp_endpoint *ep,
         ep->prsctp_enable = net->sctp.prsctp_enable;
         ep->reconf_enable = net->sctp.reconf_enable;
 
+        /* Remember who we are attached to.  */
+        ep->base.sk = sk;
+        sock_hold(ep->base.sk);
+
         return ep;
 
 nomem_shkey:
diff --git a/net/smc/af_smc.c b/net/smc/af_smc.c
index 0c874e996f85..7621ec2f539c 100644
--- a/net/smc/af_smc.c
+++ b/net/smc/af_smc.c
@@ -2029,7 +2029,7 @@ static int __init smc_init(void)
 
         rc = smc_pnet_init();
         if (rc)
-                return rc;
+                goto out_pernet_subsys;
 
         rc = smc_llc_init();
         if (rc) {
@@ -2080,6 +2080,9 @@ out_proto:
         proto_unregister(&smc_proto);
 out_pnet:
         smc_pnet_exit();
+out_pernet_subsys:
+        unregister_pernet_subsys(&smc_net_ops);
+
         return rc;
 }
 
diff --git a/net/smc/smc_core.c b/net/smc/smc_core.c
index 2d2850adc2a3..4ca50ddf8d16 100644
--- a/net/smc/smc_core.c
+++ b/net/smc/smc_core.c
@@ -652,7 +652,10 @@ create:
                 rc = smc_lgr_create(smc, ini);
                 if (rc)
                         goto out;
+                lgr = conn->lgr;
+                write_lock_bh(&lgr->conns_lock);
                 smc_lgr_register_conn(conn); /* add smc conn to lgr */
+                write_unlock_bh(&lgr->conns_lock);
         }
         conn->local_tx_ctrl.common.type = SMC_CDC_MSG_TYPE;
         conn->local_tx_ctrl.len = SMC_WR_TX_SIZE;
diff --git a/net/sunrpc/xprtrdma/svc_rdma_transport.c b/net/sunrpc/xprtrdma/svc_rdma_transport.c
index 027a3b07d329..0004535c0188 100644
--- a/net/sunrpc/xprtrdma/svc_rdma_transport.c
+++ b/net/sunrpc/xprtrdma/svc_rdma_transport.c
@@ -211,9 +211,14 @@ static void handle_connect_req(struct rdma_cm_id *new_cma_id,
         /* Save client advertised inbound read limit for use later in accept. */
         newxprt->sc_ord = param->initiator_depth;
 
-        /* Set the local and remote addresses in the transport */
         sa = (struct sockaddr *)&newxprt->sc_cm_id->route.addr.dst_addr;
         svc_xprt_set_remote(&newxprt->sc_xprt, sa, svc_addr_len(sa));
+        /* The remote port is arbitrary and not under the control of the
+         * client ULP. Set it to a fixed value so that the DRC continues
+         * to be effective after a reconnect.
+         */
+        rpc_set_port((struct sockaddr *)&newxprt->sc_xprt.xpt_remote, 0);
+
         sa = (struct sockaddr *)&newxprt->sc_cm_id->route.addr.src_addr;
         svc_xprt_set_local(&newxprt->sc_xprt, sa, svc_addr_len(sa));
 
diff --git a/net/sunrpc/xprtsock.c b/net/sunrpc/xprtsock.c
index c69951ed2ebc..36652352a38c 100644
--- a/net/sunrpc/xprtsock.c
+++ b/net/sunrpc/xprtsock.c
@@ -950,6 +950,8 @@ static int xs_local_send_request(struct rpc_rqst *req)
         struct sock_xprt *transport =
                                 container_of(xprt, struct sock_xprt, xprt);
         struct xdr_buf *xdr = &req->rq_snd_buf;
+        rpc_fraghdr rm = xs_stream_record_marker(xdr);
+        unsigned int msglen = rm ? req->rq_slen + sizeof(rm) : req->rq_slen;
         int status;
         int sent = 0;
 
@@ -964,9 +966,7 @@ static int xs_local_send_request(struct rpc_rqst *req)
 
         req->rq_xtime = ktime_get();
         status = xs_sendpages(transport->sock, NULL, 0, xdr,
-                              transport->xmit.offset,
-                              xs_stream_record_marker(xdr),
-                              &sent);
+                              transport->xmit.offset, rm, &sent);
         dprintk("RPC:       %s(%u) = %d\n",
                         __func__, xdr->len - transport->xmit.offset, status);
 
@@ -976,7 +976,7 @@ static int xs_local_send_request(struct rpc_rqst *req)
         if (likely(sent > 0) || status == 0) {
                 transport->xmit.offset += sent;
                 req->rq_bytes_sent = transport->xmit.offset;
-                if (likely(req->rq_bytes_sent >= req->rq_slen)) {
+                if (likely(req->rq_bytes_sent >= msglen)) {
                         req->rq_xmit_bytes_sent += transport->xmit.offset;
                         transport->xmit.offset = 0;
                         return 0;
@@ -1097,6 +1097,8 @@ static int xs_tcp_send_request(struct rpc_rqst *req)
         struct rpc_xprt *xprt = req->rq_xprt;
         struct sock_xprt *transport = container_of(xprt, struct sock_xprt, xprt);
         struct xdr_buf *xdr = &req->rq_snd_buf;
+        rpc_fraghdr rm = xs_stream_record_marker(xdr);
+        unsigned int msglen = rm ? req->rq_slen + sizeof(rm) : req->rq_slen;
         bool vm_wait = false;
         int status;
         int sent;
@@ -1122,9 +1124,7 @@ static int xs_tcp_send_request(struct rpc_rqst *req)
         while (1) {
                 sent = 0;
                 status = xs_sendpages(transport->sock, NULL, 0, xdr,
-                                      transport->xmit.offset,
-                                      xs_stream_record_marker(xdr),
-                                      &sent);
+                                      transport->xmit.offset, rm, &sent);
 
                 dprintk("RPC:       xs_tcp_send_request(%u) = %d\n",
                                 xdr->len - transport->xmit.offset, status);
@@ -1133,7 +1133,7 @@ static int xs_tcp_send_request(struct rpc_rqst *req)
                  * reset the count of bytes sent. */
                 transport->xmit.offset += sent;
                 req->rq_bytes_sent = transport->xmit.offset;
-                if (likely(req->rq_bytes_sent >= req->rq_slen)) {
+                if (likely(req->rq_bytes_sent >= msglen)) {
                         req->rq_xmit_bytes_sent += transport->xmit.offset;
                         transport->xmit.offset = 0;
                         return 0;
diff --git a/net/tipc/core.c b/net/tipc/core.c
index ed536c05252a..c8370722f0bb 100644
--- a/net/tipc/core.c
+++ b/net/tipc/core.c
@@ -134,7 +134,7 @@ static int __init tipc_init(void)
         if (err)
                 goto out_sysctl;
 
-        err = register_pernet_subsys(&tipc_net_ops);
+        err = register_pernet_device(&tipc_net_ops);
         if (err)
                 goto out_pernet;
 
@@ -142,7 +142,7 @@ static int __init tipc_init(void)
         if (err)
                 goto out_socket;
 
-        err = register_pernet_subsys(&tipc_topsrv_net_ops);
+        err = register_pernet_device(&tipc_topsrv_net_ops);
         if (err)
                 goto out_pernet_topsrv;
 
@@ -153,11 +153,11 @@ static int __init tipc_init(void)
         pr_info("Started in single node mode\n");
         return 0;
 out_bearer:
-        unregister_pernet_subsys(&tipc_topsrv_net_ops);
+        unregister_pernet_device(&tipc_topsrv_net_ops);
 out_pernet_topsrv:
         tipc_socket_stop();
 out_socket:
-        unregister_pernet_subsys(&tipc_net_ops);
+        unregister_pernet_device(&tipc_net_ops);
 out_pernet:
         tipc_unregister_sysctl();
 out_sysctl:
@@ -172,9 +172,9 @@ out_netlink:
 static void __exit tipc_exit(void)
 {
         tipc_bearer_cleanup();
-        unregister_pernet_subsys(&tipc_topsrv_net_ops);
+        unregister_pernet_device(&tipc_topsrv_net_ops);
         tipc_socket_stop();
-        unregister_pernet_subsys(&tipc_net_ops);
+        unregister_pernet_device(&tipc_net_ops);
         tipc_netlink_stop();
         tipc_netlink_compat_stop();
         tipc_unregister_sysctl();
diff --git a/net/tipc/netlink_compat.c b/net/tipc/netlink_compat.c
index c6a04c09d075..cf155061c472 100644
--- a/net/tipc/netlink_compat.c
+++ b/net/tipc/netlink_compat.c
@@ -445,7 +445,11 @@ static int tipc_nl_compat_bearer_disable(struct tipc_nl_compat_cmd_doit *cmd,
         if (!bearer)
                 return -EMSGSIZE;
 
-        len = min_t(int, TLV_GET_DATA_LEN(msg->req), TIPC_MAX_BEARER_NAME);
+        len = TLV_GET_DATA_LEN(msg->req);
+        if (len <= 0)
+                return -EINVAL;
+
+        len = min_t(int, len, TIPC_MAX_BEARER_NAME);
         if (!string_is_valid(name, len))
                 return -EINVAL;
 
@@ -539,7 +543,11 @@ static int tipc_nl_compat_link_stat_dump(struct tipc_nl_compat_msg *msg,
 
         name = (char *)TLV_DATA(msg->req);
 
-        len = min_t(int, TLV_GET_DATA_LEN(msg->req), TIPC_MAX_LINK_NAME);
+        len = TLV_GET_DATA_LEN(msg->req);
+        if (len <= 0)
+                return -EINVAL;
+
+        len = min_t(int, len, TIPC_MAX_BEARER_NAME);
         if (!string_is_valid(name, len))
                 return -EINVAL;
 
@@ -817,7 +825,11 @@ static int tipc_nl_compat_link_reset_stats(struct tipc_nl_compat_cmd_doit *cmd,
         if (!link)
                 return -EMSGSIZE;
 
-        len = min_t(int, TLV_GET_DATA_LEN(msg->req), TIPC_MAX_LINK_NAME);
+        len = TLV_GET_DATA_LEN(msg->req);
+        if (len <= 0)
+                return -EINVAL;
+
+        len = min_t(int, len, TIPC_MAX_BEARER_NAME);
         if (!string_is_valid(name, len))
                 return -EINVAL;
 
diff --git a/net/tls/tls_main.c b/net/tls/tls_main.c
index fc81ae18cc44..e2b69e805d46 100644
--- a/net/tls/tls_main.c
+++ b/net/tls/tls_main.c
@@ -279,7 +279,8 @@ static void tls_sk_proto_close(struct sock *sk, long timeout)
                 goto skip_tx_cleanup;
         }
 
-        if (!tls_complete_pending_work(sk, ctx, 0, &timeo))
+        if (unlikely(sk->sk_write_pending) &&
+            !wait_on_pending_writer(sk, &timeo))
                 tls_handle_open_record(sk, 0);
 
         /* We need these for tls_sw_fallback handling of other packets */
diff --git a/samples/pidfd/pidfd-metadata.c b/samples/pidfd/pidfd-metadata.c
index 14b454448429..c459155daf9a 100644
--- a/samples/pidfd/pidfd-metadata.c
+++ b/samples/pidfd/pidfd-metadata.c
@@ -83,7 +83,7 @@ static int pidfd_metadata_fd(pid_t pid, int pidfd)
 
 int main(int argc, char *argv[])
 {
-        int pidfd = 0, ret = EXIT_FAILURE;
+        int pidfd = -1, ret = EXIT_FAILURE;
         char buf[4096] = { 0 };
         pid_t pid;
         int procfd, statusfd;
@@ -91,7 +91,11 @@ int main(int argc, char *argv[])
 
         pid = pidfd_clone(CLONE_PIDFD, &pidfd);
         if (pid < 0)
-                exit(ret);
+                err(ret, "CLONE_PIDFD");
+        if (pidfd == -1) {
+                warnx("CLONE_PIDFD is not supported by the kernel");
+                goto out;
+        }
 
         procfd = pidfd_metadata_fd(pid, pidfd);
         close(pidfd);
diff --git a/scripts/atomic/check-atomics.sh b/scripts/atomic/check-atomics.sh
index cfa0c2f71c84..8378c63a1e09 100755
--- a/scripts/atomic/check-atomics.sh
+++ b/scripts/atomic/check-atomics.sh
@@ -22,7 +22,7 @@ while read header; do
         OLDSUM="$(tail -n 1 ${LINUXDIR}/include/${header})"
         OLDSUM="${OLDSUM#// }"
 
-        NEWSUM="$(head -n -1 ${LINUXDIR}/include/${header} | sha1sum)"
+        NEWSUM="$(sed '$d' ${LINUXDIR}/include/${header} | sha1sum)"
         NEWSUM="${NEWSUM%% *}"
 
         if [ "${OLDSUM}" != "${NEWSUM}" ]; then
diff --git a/security/apparmor/label.c b/security/apparmor/label.c
index 068e93c5d29c..59f1cc2557a7 100644
--- a/security/apparmor/label.c
+++ b/security/apparmor/label.c
@@ -76,7 +76,7 @@ void __aa_proxy_redirect(struct aa_label *orig, struct aa_label *new)
 
         AA_BUG(!orig);
         AA_BUG(!new);
-        lockdep_assert_held_exclusive(&labels_set(orig)->lock);
+        lockdep_assert_held_write(&labels_set(orig)->lock);
 
         tmp = rcu_dereference_protected(orig->proxy->label,
                                         &labels_ns(orig)->lock);
@@ -566,7 +566,7 @@ static bool __label_remove(struct aa_label *label, struct aa_label *new)
 
         AA_BUG(!ls);
         AA_BUG(!label);
-        lockdep_assert_held_exclusive(&ls->lock);
+        lockdep_assert_held_write(&ls->lock);
 
         if (new)
                 __aa_proxy_redirect(label, new);
@@ -603,7 +603,7 @@ static bool __label_replace(struct aa_label *old, struct aa_label *new)
         AA_BUG(!ls);
         AA_BUG(!old);
         AA_BUG(!new);
-        lockdep_assert_held_exclusive(&ls->lock);
+        lockdep_assert_held_write(&ls->lock);
         AA_BUG(new->flags & FLAG_IN_TREE);
 
         if (!label_is_stale(old))
@@ -640,7 +640,7 @@ static struct aa_label *__label_insert(struct aa_labelset *ls,
         AA_BUG(!ls);
         AA_BUG(!label);
         AA_BUG(labels_set(label) != ls);
-        lockdep_assert_held_exclusive(&ls->lock);
+        lockdep_assert_held_write(&ls->lock);
         AA_BUG(label->flags & FLAG_IN_TREE);
 
         /* Figure out where to put new node */
diff --git a/sound/core/seq/oss/seq_oss_ioctl.c b/sound/core/seq/oss/seq_oss_ioctl.c
index 96ad01fb668c..ccf682689ec9 100644
--- a/sound/core/seq/oss/seq_oss_ioctl.c
+++ b/sound/core/seq/oss/seq_oss_ioctl.c
@@ -49,7 +49,7 @@ static int snd_seq_oss_oob_user(struct seq_oss_devinfo *dp, void __user *arg)
         if (copy_from_user(ev, arg, 8))
                 return -EFAULT;
         memset(&tmpev, 0, sizeof(tmpev));
-        snd_seq_oss_fill_addr(dp, &tmpev, dp->addr.port, dp->addr.client);
+        snd_seq_oss_fill_addr(dp, &tmpev, dp->addr.client, dp->addr.port);
         tmpev.time.tick = 0;
         if (! snd_seq_oss_process_event(dp, (union evrec *)ev, &tmpev)) {
                 snd_seq_oss_dispatch(dp, &tmpev, 0, 0);
diff --git a/sound/core/seq/oss/seq_oss_rw.c b/sound/core/seq/oss/seq_oss_rw.c
index 79ef430e56e1..537d5f423e20 100644
--- a/sound/core/seq/oss/seq_oss_rw.c
+++ b/sound/core/seq/oss/seq_oss_rw.c
@@ -161,7 +161,7 @@ insert_queue(struct seq_oss_devinfo *dp, union evrec *rec, struct file *opt)
         memset(&event, 0, sizeof(event));
         /* set dummy -- to be sure */
         event.type = SNDRV_SEQ_EVENT_NOTEOFF;
-        snd_seq_oss_fill_addr(dp, &event, dp->addr.port, dp->addr.client);
+        snd_seq_oss_fill_addr(dp, &event, dp->addr.client, dp->addr.port);
 
         if (snd_seq_oss_process_event(dp, rec, &event))
                 return 0; /* invalid event - no need to insert queue */
diff --git a/sound/firewire/amdtp-am824.c b/sound/firewire/amdtp-am824.c
index cc6eb30f03a2..71168728940a 100644
--- a/sound/firewire/amdtp-am824.c
+++ b/sound/firewire/amdtp-am824.c
@@ -320,7 +320,7 @@ static void read_midi_messages(struct amdtp_stream *s,
         u8 *b;
 
         for (f = 0; f < frames; f++) {
-                port = (s->data_block_counter + f) % 8;
+                port = (8 - s->tx_first_dbc + s->data_block_counter + f) % 8;
                 b = (u8 *)&buffer[p->midi_position];
 
                 len = b[0] - 0x80;
diff --git a/sound/hda/hdac_device.c b/sound/hda/hdac_device.c
index 6907dbefd08c..3842f9d34b7c 100644
--- a/sound/hda/hdac_device.c
+++ b/sound/hda/hdac_device.c
@@ -400,27 +400,33 @@ static void setup_fg_nodes(struct hdac_device *codec)
 int snd_hdac_refresh_widgets(struct hdac_device *codec, bool sysfs)
 {
         hda_nid_t start_nid;
-        int nums, err;
+        int nums, err = 0;
 
+        /*
+         * Serialize against multiple threads trying to update the sysfs
+         * widgets array.
+         */
+        mutex_lock(&codec->widget_lock);
         nums = snd_hdac_get_sub_nodes(codec, codec->afg, &start_nid);
         if (!start_nid || nums <= 0 || nums >= 0xff) {
                 dev_err(&codec->dev, "cannot read sub nodes for FG 0x%02x\n",
                         codec->afg);
-                return -EINVAL;
+                err = -EINVAL;
+                goto unlock;
         }
 
         if (sysfs) {
-                mutex_lock(&codec->widget_lock);
                 err = hda_widget_sysfs_reinit(codec, start_nid, nums);
-                mutex_unlock(&codec->widget_lock);
                 if (err < 0)
-                        return err;
+                        goto unlock;
         }
 
         codec->num_nodes = nums;
         codec->start_nid = start_nid;
         codec->end_nid = start_nid + nums;
-        return 0;
+unlock:
+        mutex_unlock(&codec->widget_lock);
+        return err;
 }
 EXPORT_SYMBOL_GPL(snd_hdac_refresh_widgets);
 
diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index 5b3c26991f26..6f3a35949cdd 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -2448,9 +2448,10 @@ static const struct snd_pci_quirk alc882_fixup_tbl[] = {
         SND_PCI_QUIRK(0x1558, 0x9501, "Clevo P950HR", ALC1220_FIXUP_CLEVO_P950),
         SND_PCI_QUIRK(0x1558, 0x95e1, "Clevo P95xER", ALC1220_FIXUP_CLEVO_P950),
         SND_PCI_QUIRK(0x1558, 0x95e2, "Clevo P950ER", ALC1220_FIXUP_CLEVO_P950),
-        SND_PCI_QUIRK(0x1558, 0x96e1, "System76 Oryx Pro (oryp5)", ALC1220_FIXUP_CLEVO_PB51ED_PINS),
-        SND_PCI_QUIRK(0x1558, 0x97e1, "System76 Oryx Pro (oryp5)", ALC1220_FIXUP_CLEVO_PB51ED_PINS),
-        SND_PCI_QUIRK(0x1558, 0x65d1, "Tuxedo Book XC1509", ALC1220_FIXUP_CLEVO_PB51ED_PINS),
+        SND_PCI_QUIRK(0x1558, 0x96e1, "Clevo P960[ER][CDFN]-K", ALC1220_FIXUP_CLEVO_P950),
+        SND_PCI_QUIRK(0x1558, 0x97e1, "Clevo P970[ER][CDFN]", ALC1220_FIXUP_CLEVO_P950),
+        SND_PCI_QUIRK(0x1558, 0x65d1, "Clevo PB51[ER][CDF]", ALC1220_FIXUP_CLEVO_PB51ED_PINS),
+        SND_PCI_QUIRK(0x1558, 0x67d1, "Clevo PB71[ER][CDF]", ALC1220_FIXUP_CLEVO_PB51ED_PINS),
         SND_PCI_QUIRK_VENDOR(0x1558, "Clevo laptop", ALC882_FIXUP_EAPD),
         SND_PCI_QUIRK(0x161f, 0x2054, "Medion laptop", ALC883_FIXUP_EAPD),
         SND_PCI_QUIRK(0x17aa, 0x3a0d, "Lenovo Y530", ALC882_FIXUP_LENOVO_Y530),
@@ -7074,6 +7075,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
         SND_PCI_QUIRK(0x17aa, 0x30bb, "ThinkCentre AIO", ALC233_FIXUP_LENOVO_LINE2_MIC_HOTKEY),
         SND_PCI_QUIRK(0x17aa, 0x30e2, "ThinkCentre AIO", ALC233_FIXUP_LENOVO_LINE2_MIC_HOTKEY),
         SND_PCI_QUIRK(0x17aa, 0x310c, "ThinkCentre Station", ALC294_FIXUP_LENOVO_MIC_LOCATION),
+        SND_PCI_QUIRK(0x17aa, 0x3111, "ThinkCentre Station", ALC294_FIXUP_LENOVO_MIC_LOCATION),
         SND_PCI_QUIRK(0x17aa, 0x312a, "ThinkCentre Station", ALC294_FIXUP_LENOVO_MIC_LOCATION),
         SND_PCI_QUIRK(0x17aa, 0x312f, "ThinkCentre Station", ALC294_FIXUP_LENOVO_MIC_LOCATION),
         SND_PCI_QUIRK(0x17aa, 0x313c, "ThinkCentre Station", ALC294_FIXUP_LENOVO_MIC_LOCATION),
diff --git a/sound/usb/line6/pcm.c b/sound/usb/line6/pcm.c
index 21127e4958b2..2c03e0f6bf72 100644
--- a/sound/usb/line6/pcm.c
+++ b/sound/usb/line6/pcm.c
@@ -556,6 +556,11 @@ int line6_init_pcm(struct usb_line6 *line6,
         line6pcm->max_packet_size_out =
                 usb_maxpacket(line6->usbdev,
                         usb_sndisocpipe(line6->usbdev, ep_write), 1);
+        if (!line6pcm->max_packet_size_in || !line6pcm->max_packet_size_out) {
+                dev_err(line6pcm->line6->ifcdev,
+                        "cannot get proper max packet size\n");
+                return -EINVAL;
+        }
 
         spin_lock_init(&line6pcm->out.lock);
         spin_lock_init(&line6pcm->in.lock);
diff --git a/sound/usb/mixer_quirks.c b/sound/usb/mixer_quirks.c
index 1f6011f36bb0..199fa157a411 100644
--- a/sound/usb/mixer_quirks.c
+++ b/sound/usb/mixer_quirks.c
@@ -741,7 +741,7 @@ static int snd_ni_control_init_val(struct usb_mixer_interface *mixer,
                 return err;
         }
 
-        kctl->private_value |= (value << 24);
+        kctl->private_value |= ((unsigned int)value << 24);
         return 0;
 }
 
@@ -902,7 +902,7 @@ static int snd_ftu_eff_switch_init(struct usb_mixer_interface *mixer,
         if (err < 0)
                 return err;
 
-        kctl->private_value |= value[0] << 24;
+        kctl->private_value |= (unsigned int)value[0] << 24;
         return 0;
 }
 
diff --git a/tools/arch/x86/include/uapi/asm/perf_regs.h b/tools/arch/x86/include/uapi/asm/perf_regs.h
index ac67bbea10ca..7c9d2bb3833b 100644
--- a/tools/arch/x86/include/uapi/asm/perf_regs.h
+++ b/tools/arch/x86/include/uapi/asm/perf_regs.h
@@ -52,4 +52,7 @@ enum perf_event_x86_regs {
         /* These include both GPRs and XMMX registers */
         PERF_REG_X86_XMM_MAX = PERF_REG_X86_XMM15 + 2,
 };
+
+#define PERF_REG_EXTENDED_MASK  (~((1ULL << PERF_REG_X86_XMM0) - 1))
+
 #endif /* _ASM_X86_PERF_REGS_H */
diff --git a/tools/include/linux/rcu.h b/tools/include/linux/rcu.h
index 7d02527e5bce..9554d3fa54f3 100644
--- a/tools/include/linux/rcu.h
+++ b/tools/include/linux/rcu.h
@@ -19,7 +19,7 @@ static inline bool rcu_is_watching(void)
         return false;
 }
 
-#define rcu_assign_pointer(p, v) ((p) = (v))
-#define RCU_INIT_POINTER(p, v) p=(v)
+#define rcu_assign_pointer(p, v)        do { (p) = (v); } while (0)
+#define RCU_INIT_POINTER(p, v)  do { (p) = (v); } while (0)
 
 #endif
diff --git a/tools/memory-model/linux-kernel.bell b/tools/memory-model/linux-kernel.bell
index def9131d3d8e..5be86b1025e8 100644
--- a/tools/memory-model/linux-kernel.bell
+++ b/tools/memory-model/linux-kernel.bell
@@ -24,6 +24,7 @@ instructions RMW[{'once,'acquire,'release}]
 enum Barriers = 'wmb (*smp_wmb*) ||
                 'rmb (*smp_rmb*) ||
                 'mb (*smp_mb*) ||
+                'barrier (*barrier*) ||
                 'rcu-lock (*rcu_read_lock*)  ||
                 'rcu-unlock (*rcu_read_unlock*) ||
                 'sync-rcu (*synchronize_rcu*) ||
@@ -76,3 +77,8 @@ flag ~empty rcu-rscs & (po ; [Sync-srcu] ; po) as invalid-sleep
 
 (* Validate SRCU dynamic match *)
 flag ~empty different-values(srcu-rscs) as srcu-bad-nesting
+
+(* Compute marked and plain memory accesses *)
+let Marked = (~M) | IW | Once | Release | Acquire | domain(rmw) | range(rmw) |
+                LKR | LKW | UL | LF | RL | RU
+let Plain = M \ Marked
diff --git a/tools/memory-model/linux-kernel.cat b/tools/memory-model/linux-kernel.cat
index 8dcb37835b61..ea2ff4b94074 100644
--- a/tools/memory-model/linux-kernel.cat
+++ b/tools/memory-model/linux-kernel.cat
@@ -24,8 +24,14 @@ include "lock.cat"
 (* Basic relations *)
 (*******************)
 
+(* Release Acquire *)
+let acq-po = [Acquire] ; po ; [M]
+let po-rel = [M] ; po ; [Release]
+let po-unlock-rf-lock-po = po ; [UL] ; rf ; [LKR] ; po
+
 (* Fences *)
-let rmb = [R \ Noreturn] ; fencerel(Rmb) ; [R \ Noreturn]
+let R4rmb = R \ Noreturn        (* Reads for which rmb works *)
+let rmb = [R4rmb] ; fencerel(Rmb) ; [R4rmb]
 let wmb = [W] ; fencerel(Wmb) ; [W]
 let mb = ([M] ; fencerel(Mb) ; [M]) |
         ([M] ; fencerel(Before-atomic) ; [RMW] ; po? ; [M]) |
@@ -34,13 +40,14 @@ let mb = ([M] ; fencerel(Mb) ; [M]) |
         ([M] ; po ; [UL] ; (co | po) ; [LKW] ;
                 fencerel(After-unlock-lock) ; [M])
 let gp = po ; [Sync-rcu | Sync-srcu] ; po?
-
 let strong-fence = mb | gp
 
-(* Release Acquire *)
-let acq-po = [Acquire] ; po ; [M]
-let po-rel = [M] ; po ; [Release]
-let po-unlock-rf-lock-po = po ; [UL] ; rf ; [LKR] ; po
+let nonrw-fence = strong-fence | po-rel | acq-po
+let fence = nonrw-fence | wmb | rmb
+let barrier = fencerel(Barrier | Rmb | Wmb | Mb | Sync-rcu | Sync-srcu |
+                Before-atomic | After-atomic | Acquire | Release |
+                Rcu-lock | Rcu-unlock | Srcu-lock | Srcu-unlock) |
+        (po ; [Release]) | ([Acquire] ; po)
 
 (**********************************)
 (* Fundamental coherence ordering *)
@@ -61,21 +68,22 @@ empty rmw & (fre ; coe) as atomic
 let dep = addr | data
 let rwdep = (dep | ctrl) ; [W]
 let overwrite = co | fr
-let to-w = rwdep | (overwrite & int)
-let to-r = addr | (dep ; rfi)
-let fence = strong-fence | wmb | po-rel | rmb | acq-po
+let to-w = rwdep | (overwrite & int) | (addr ; [Plain] ; wmb)
+let to-r = addr | (dep ; [Marked] ; rfi)
 let ppo = to-r | to-w | fence | (po-unlock-rf-lock-po & int)
 
 (* Propagation: Ordering from release operations and strong fences. *)
-let A-cumul(r) = rfe? ; r
-let cumul-fence = A-cumul(strong-fence | po-rel) | wmb | po-unlock-rf-lock-po
-let prop = (overwrite & ext)? ; cumul-fence* ; rfe?
+let A-cumul(r) = (rfe ; [Marked])? ; r
+let cumul-fence = [Marked] ; (A-cumul(strong-fence | po-rel) | wmb |
+        po-unlock-rf-lock-po) ; [Marked]
+let prop = [Marked] ; (overwrite & ext)? ; cumul-fence* ;
+        [Marked] ; rfe? ; [Marked]
 
 (*
  * Happens Before: Ordering from the passage of time.
  * No fences needed here for prop because relation confined to one process.
  *)
-let hb = ppo | rfe | ((prop \ id) & int)
+let hb = [Marked] ; (ppo | rfe | ((prop \ id) & int)) ; [Marked]
 acyclic hb as happens-before
 
 (****************************************)
@@ -83,7 +91,7 @@ acyclic hb as happens-before
 (****************************************)
 
 (* Propagation: Each non-rf link needs a strong fence. *)
-let pb = prop ; strong-fence ; hb*
+let pb = prop ; strong-fence ; hb* ; [Marked]
 acyclic pb as propagation
 
 (*******)
@@ -114,24 +122,28 @@ let rcu-link = po? ; hb* ; pb* ; prop ; po
 
 (*
  * Any sequence containing at least as many grace periods as RCU read-side
- * critical sections (joined by rcu-link) acts as a generalized strong fence.
+ * critical sections (joined by rcu-link) induces order like a generalized
+ * inter-CPU strong fence.
  * Likewise for SRCU grace periods and read-side critical sections, provided
  * the synchronize_srcu() and srcu_read_[un]lock() calls refer to the same
  * struct srcu_struct location.
  *)
-let rec rcu-fence = rcu-gp | srcu-gp |
+let rec rcu-order = rcu-gp | srcu-gp |
         (rcu-gp ; rcu-link ; rcu-rscsi) |
         ((srcu-gp ; rcu-link ; srcu-rscsi) & loc) |
         (rcu-rscsi ; rcu-link ; rcu-gp) |
         ((srcu-rscsi ; rcu-link ; srcu-gp) & loc) |
-        (rcu-gp ; rcu-link ; rcu-fence ; rcu-link ; rcu-rscsi) |
-        ((srcu-gp ; rcu-link ; rcu-fence ; rcu-link ; srcu-rscsi) & loc) |
-        (rcu-rscsi ; rcu-link ; rcu-fence ; rcu-link ; rcu-gp) |
-        ((srcu-rscsi ; rcu-link ; rcu-fence ; rcu-link ; srcu-gp) & loc) |
-        (rcu-fence ; rcu-link ; rcu-fence)
+        (rcu-gp ; rcu-link ; rcu-order ; rcu-link ; rcu-rscsi) |
+        ((srcu-gp ; rcu-link ; rcu-order ; rcu-link ; srcu-rscsi) & loc) |
+        (rcu-rscsi ; rcu-link ; rcu-order ; rcu-link ; rcu-gp) |
+        ((srcu-rscsi ; rcu-link ; rcu-order ; rcu-link ; srcu-gp) & loc) |
+        (rcu-order ; rcu-link ; rcu-order)
+let rcu-fence = po ; rcu-order ; po?
+let fence = fence | rcu-fence
+let strong-fence = strong-fence | rcu-fence
 
 (* rb orders instructions just as pb does *)
-let rb = prop ; po ; rcu-fence ; po? ; hb* ; pb*
+let rb = prop ; rcu-fence ; hb* ; pb* ; [Marked]
 
 irreflexive rb as rcu
 
@@ -143,3 +155,49 @@ irreflexive rb as rcu
  * let xb = hb | pb | rb
  * acyclic xb as executes-before
  *)
+
+(*********************************)
+(* Plain accesses and data races *)
+(*********************************)
+
+(* Warn about plain writes and marked accesses in the same region *)
+let mixed-accesses = ([Plain & W] ; (po-loc \ barrier) ; [Marked]) |
+        ([Marked] ; (po-loc \ barrier) ; [Plain & W])
+flag ~empty mixed-accesses as mixed-accesses
+
+(* Executes-before and visibility *)
+let xbstar = (hb | pb | rb)*
+let vis = cumul-fence* ; rfe? ; [Marked] ;
+        ((strong-fence ; [Marked] ; xbstar) | (xbstar & int))
+
+(* Boundaries for lifetimes of plain accesses *)
+let w-pre-bounded = [Marked] ; (addr | fence)?
+let r-pre-bounded = [Marked] ; (addr | nonrw-fence |
+        ([R4rmb] ; fencerel(Rmb) ; [~Noreturn]))?
+let w-post-bounded = fence? ; [Marked]
+let r-post-bounded = (nonrw-fence | ([~Noreturn] ; fencerel(Rmb) ; [R4rmb]))? ;
+        [Marked]
+
+(* Visibility and executes-before for plain accesses *)
+let ww-vis = fence | (strong-fence ; xbstar ; w-pre-bounded) |
+        (w-post-bounded ; vis ; w-pre-bounded)
+let wr-vis = fence | (strong-fence ; xbstar ; r-pre-bounded) |
+        (w-post-bounded ; vis ; r-pre-bounded)
+let rw-xbstar = fence | (r-post-bounded ; xbstar ; w-pre-bounded)
+
+(* Potential races *)
+let pre-race = ext & ((Plain * M) | ((M \ IW) * Plain))
+
+(* Coherence requirements for plain accesses *)
+let wr-incoh = pre-race & rf & rw-xbstar^-1
+let rw-incoh = pre-race & fr & wr-vis^-1
+let ww-incoh = pre-race & co & ww-vis^-1
+empty (wr-incoh | rw-incoh | ww-incoh) as plain-coherence
+
+(* Actual races *)
+let ww-nonrace = ww-vis & ((Marked * W) | rw-xbstar) & ((W * Marked) | wr-vis)
+let ww-race = (pre-race & co) \ ww-nonrace
+let wr-race = (pre-race & (co? ; rf)) \ wr-vis
+let rw-race = (pre-race & fr) \ rw-xbstar
+
+flag ~empty (ww-race | wr-race | rw-race) as data-race
diff --git a/tools/memory-model/linux-kernel.def b/tools/memory-model/linux-kernel.def
index 551eeaa389d4..ef0f3c1850de 100644
--- a/tools/memory-model/linux-kernel.def
+++ b/tools/memory-model/linux-kernel.def
@@ -24,6 +24,7 @@ smp_mb__before_atomic() { __fence{before-atomic}; }
 smp_mb__after_atomic() { __fence{after-atomic}; }
 smp_mb__after_spinlock() { __fence{after-spinlock}; }
 smp_mb__after_unlock_lock() { __fence{after-unlock-lock}; }
+barrier() { __fence{barrier}; }
 
 // Exchange
 xchg(X,V)  __xchg{mb}(X,V)
diff --git a/tools/memory-model/litmus-tests/MP+poonceonces.litmus b/tools/memory-model/litmus-tests/MP+poonceonces.litmus
index b2b60b84fb9d..172f0145301c 100644
--- a/tools/memory-model/litmus-tests/MP+poonceonces.litmus
+++ b/tools/memory-model/litmus-tests/MP+poonceonces.litmus
@@ -1,7 +1,7 @@
 C MP+poonceonces
 
 (*
- * Result: Maybe
+ * Result: Sometimes
  *
  * Can the counter-intuitive message-passing outcome be prevented with
  * no ordering at all?
diff --git a/tools/memory-model/litmus-tests/README b/tools/memory-model/litmus-tests/README
index 5ee08f129094..681f9067fa9e 100644
--- a/tools/memory-model/litmus-tests/README
+++ b/tools/memory-model/litmus-tests/README
@@ -244,7 +244,7 @@ produce the name:
 Adding the ".litmus" suffix: SB+rfionceonce-poonceonces.litmus
 
 The descriptors that describe connections between consecutive accesses
-within the cycle through a given litmus test can be provided by the herd
+within the cycle through a given litmus test can be provided by the herd7
 tool (Rfi, Po, Fre, and so on) or by the linux-kernel.bell file (Once,
 Release, Acquire, and so on).
 
diff --git a/tools/memory-model/lock.cat b/tools/memory-model/lock.cat
index a059d1a6d8a2..6b52f365d73a 100644
--- a/tools/memory-model/lock.cat
+++ b/tools/memory-model/lock.cat
@@ -11,7 +11,7 @@
 include "cross.cat"
 
 (*
- * The lock-related events generated by herd are as follows:
+ * The lock-related events generated by herd7 are as follows:
  *
  * LKR          Lock-Read: the read part of a spin_lock() or successful
  *                      spin_trylock() read-modify-write event pair
diff --git a/tools/memory-model/scripts/README b/tools/memory-model/scripts/README
index 29375a1fbbfa..095c7eb36f9f 100644
--- a/tools/memory-model/scripts/README
+++ b/tools/memory-model/scripts/README
@@ -22,7 +22,7 @@ checklitmushist.sh
 
         Run all litmus tests having .litmus.out files from previous
         initlitmushist.sh or newlitmushist.sh runs, comparing the
-        herd output to that of the original runs.
+        herd7 output to that of the original runs.
 
 checklitmus.sh
 
@@ -43,7 +43,7 @@ initlitmushist.sh
 
 judgelitmus.sh
 
-        Given a .litmus file and its .litmus.out herd output, check the
+        Given a .litmus file and its .litmus.out herd7 output, check the
         .litmus.out file against the .litmus file's "Result:" comment to
         judge whether the test ran correctly.  Not normally run manually,
         provided instead for use by other scripts.
diff --git a/tools/memory-model/scripts/checkalllitmus.sh b/tools/memory-model/scripts/checkalllitmus.sh
index b35fcd61ecf6..3c0c7fbbd223 100755
--- a/tools/memory-model/scripts/checkalllitmus.sh
+++ b/tools/memory-model/scripts/checkalllitmus.sh
@@ -1,7 +1,7 @@
 #!/bin/sh
 # SPDX-License-Identifier: GPL-2.0+
 #
-# Run herd tests on all .litmus files in the litmus-tests directory
+# Run herd7 tests on all .litmus files in the litmus-tests directory
 # and check each file's result against a "Result:" comment within that
 # litmus test.  If the verification result does not match that specified
 # in the litmus test, this script prints an error message prefixed with
diff --git a/tools/memory-model/scripts/checklitmus.sh b/tools/memory-model/scripts/checklitmus.sh
index dd08801a30b0..11461ed40b5e 100755
--- a/tools/memory-model/scripts/checklitmus.sh
+++ b/tools/memory-model/scripts/checklitmus.sh
@@ -1,7 +1,7 @@
 #!/bin/sh
 # SPDX-License-Identifier: GPL-2.0+
 #
-# Run a herd test and invokes judgelitmus.sh to check the result against
+# Run a herd7 test and invokes judgelitmus.sh to check the result against
 # a "Result:" comment within the litmus test.  It also outputs verification
 # results to a file whose name is that of the specified litmus test, but
 # with ".out" appended.
diff --git a/tools/memory-model/scripts/parseargs.sh b/tools/memory-model/scripts/parseargs.sh
index 859e1d581e05..40f52080fdbd 100644
--- a/tools/memory-model/scripts/parseargs.sh
+++ b/tools/memory-model/scripts/parseargs.sh
@@ -91,7 +91,7 @@ do
                 shift
                 ;;
         --herdopts|--herdopt)
-                checkarg --destdir "(herd options)" "$#" "$2" '.*' '^--'
+                checkarg --destdir "(herd7 options)" "$#" "$2" '.*' '^--'
                 LKMM_HERD_OPTIONS="$2"
                 shift
                 ;;
diff --git a/tools/memory-model/scripts/runlitmushist.sh b/tools/memory-model/scripts/runlitmushist.sh
index e507f5f933d5..6ed376f495bb 100644
--- a/tools/memory-model/scripts/runlitmushist.sh
+++ b/tools/memory-model/scripts/runlitmushist.sh
@@ -79,7 +79,7 @@ then
         echo ' ---' Summary: 1>&2
         grep '!!!' $T/*.sh.out 1>&2
         nfail="`grep '!!!' $T/*.sh.out | wc -l`"
-        echo 'Number of failed herd runs (e.g., timeout): ' $nfail 1>&2
+        echo 'Number of failed herd7 runs (e.g., timeout): ' $nfail 1>&2
         exit 1
 else
         echo All runs completed successfully. 1>&2
diff --git a/tools/perf/arch/x86/include/perf_regs.h b/tools/perf/arch/x86/include/perf_regs.h
index b7cd91a9014f..b7321337d100 100644
--- a/tools/perf/arch/x86/include/perf_regs.h
+++ b/tools/perf/arch/x86/include/perf_regs.h
@@ -9,7 +9,6 @@
 void perf_regs_load(u64 *regs);
 
 #define PERF_REGS_MAX PERF_REG_X86_XMM_MAX
-#define PERF_XMM_REGS_MASK      (~((1ULL << PERF_REG_X86_XMM0) - 1))
 #ifndef HAVE_ARCH_X86_64_SUPPORT
 #define PERF_REGS_MASK ((1ULL << PERF_REG_X86_32_MAX) - 1)
 #define PERF_SAMPLE_REGS_ABI PERF_SAMPLE_REGS_ABI_32
diff --git a/tools/perf/arch/x86/util/perf_regs.c b/tools/perf/arch/x86/util/perf_regs.c
index 7886ca5263e3..3666c0076df9 100644
--- a/tools/perf/arch/x86/util/perf_regs.c
+++ b/tools/perf/arch/x86/util/perf_regs.c
@@ -277,7 +277,7 @@ uint64_t arch__intr_reg_mask(void)
                 .type                   = PERF_TYPE_HARDWARE,
                 .config                 = PERF_COUNT_HW_CPU_CYCLES,
                 .sample_type            = PERF_SAMPLE_REGS_INTR,
-                .sample_regs_intr       = PERF_XMM_REGS_MASK,
+                .sample_regs_intr       = PERF_REG_EXTENDED_MASK,
                 .precise_ip             = 1,
                 .disabled               = 1,
                 .exclude_kernel         = 1,
@@ -293,7 +293,7 @@ uint64_t arch__intr_reg_mask(void)
         fd = sys_perf_event_open(&attr, 0, -1, -1, 0);
         if (fd != -1) {
                 close(fd);
-                return (PERF_XMM_REGS_MASK | PERF_REGS_MASK);
+                return (PERF_REG_EXTENDED_MASK | PERF_REGS_MASK);
         }
 
         return PERF_REGS_MASK;
diff --git a/tools/testing/radix-tree/idr-test.c b/tools/testing/radix-tree/idr-test.c
index 698c08f851b8..8995092d541e 100644
--- a/tools/testing/radix-tree/idr-test.c
+++ b/tools/testing/radix-tree/idr-test.c
@@ -279,6 +279,51 @@ static void idr_align_test(struct idr *idr)
         }
 }
 
+DEFINE_IDR(find_idr);
+
+static void *idr_throbber(void *arg)
+{
+        time_t start = time(NULL);
+        int id = *(int *)arg;
+
+        rcu_register_thread();
+        do {
+                idr_alloc(&find_idr, xa_mk_value(id), id, id + 1, GFP_KERNEL);
+                idr_remove(&find_idr, id);
+        } while (time(NULL) < start + 10);
+        rcu_unregister_thread();
+
+        return NULL;
+}
+
+void idr_find_test_1(int anchor_id, int throbber_id)
+{
+        pthread_t throbber;
+        time_t start = time(NULL);
+
+        pthread_create(&throbber, NULL, idr_throbber, &throbber_id);
+
+        BUG_ON(idr_alloc(&find_idr, xa_mk_value(anchor_id), anchor_id,
+                                anchor_id + 1, GFP_KERNEL) != anchor_id);
+
+        do {
+                int id = 0;
+                void *entry = idr_get_next(&find_idr, &id);
+                BUG_ON(entry != xa_mk_value(id));
+        } while (time(NULL) < start + 11);
+
+        pthread_join(throbber, NULL);
+
+        idr_remove(&find_idr, anchor_id);
+        BUG_ON(!idr_is_empty(&find_idr));
+}
+
+void idr_find_test(void)
+{
+        idr_find_test_1(100000, 0);
+        idr_find_test_1(0, 100000);
+}
+
 void idr_checks(void)
 {
         unsigned long i;
@@ -360,6 +405,7 @@ void idr_checks(void)
         idr_u32_test(1);
         idr_u32_test(0);
         idr_align_test(&idr);
+        idr_find_test();
 }
 
 #define module_init(x)
diff --git a/tools/testing/radix-tree/linux/rcupdate.h b/tools/testing/radix-tree/linux/rcupdate.h
index fd280b070fdb..fed468fb0c78 100644
--- a/tools/testing/radix-tree/linux/rcupdate.h
+++ b/tools/testing/radix-tree/linux/rcupdate.h
@@ -7,6 +7,6 @@
 #define rcu_dereference_raw(p) rcu_dereference(p)
 #define rcu_dereference_protected(p, cond) rcu_dereference(p)
 #define rcu_dereference_check(p, cond) rcu_dereference(p)
-#define RCU_INIT_POINTER(p, v)  (p) = (v)
+#define RCU_INIT_POINTER(p, v)  do { (p) = (v); } while (0)
 
 #endif
diff --git a/tools/testing/selftests/kvm/x86_64/evmcs_test.c b/tools/testing/selftests/kvm/x86_64/evmcs_test.c
index b38260e29775..241919ef1eac 100644
--- a/tools/testing/selftests/kvm/x86_64/evmcs_test.c
+++ b/tools/testing/selftests/kvm/x86_64/evmcs_test.c
@@ -146,6 +146,7 @@ int main(int argc, char *argv[])
                 kvm_vm_restart(vm, O_RDWR);
                 vm_vcpu_add(vm, VCPU_ID, 0, 0);
                 vcpu_set_cpuid(vm, VCPU_ID, kvm_get_supported_cpuid());
+                vcpu_ioctl(vm, VCPU_ID, KVM_ENABLE_CAP, &enable_evmcs_cap);
                 vcpu_load_state(vm, VCPU_ID, state);
                 run = vcpu_state(vm, VCPU_ID);
                 free(state);
diff --git a/tools/testing/selftests/powerpc/mm/.gitignore b/tools/testing/selftests/powerpc/mm/.gitignore
index ba919308fe30..d503b8764a8e 100644
--- a/tools/testing/selftests/powerpc/mm/.gitignore
+++ b/tools/testing/selftests/powerpc/mm/.gitignore
@@ -3,4 +3,5 @@ subpage_prot
 tempfile
 prot_sao
 segv_errors
-wild_bctr
\ No newline at end of file
+wild_bctr
+large_vm_fork_separation
\ No newline at end of file
diff --git a/tools/testing/selftests/powerpc/mm/Makefile b/tools/testing/selftests/powerpc/mm/Makefile
index 43d68420e363..f1fbc15800c4 100644
--- a/tools/testing/selftests/powerpc/mm/Makefile
+++ b/tools/testing/selftests/powerpc/mm/Makefile
@@ -2,7 +2,8 @@
 noarg:
         $(MAKE) -C ../
 
-TEST_GEN_PROGS := hugetlb_vs_thp_test subpage_prot prot_sao segv_errors wild_bctr
+TEST_GEN_PROGS := hugetlb_vs_thp_test subpage_prot prot_sao segv_errors wild_bctr \
+                  large_vm_fork_separation
 TEST_GEN_FILES := tempfile
 
 top_srcdir = ../../../../..
@@ -13,6 +14,7 @@ $(TEST_GEN_PROGS): ../harness.c
 $(OUTPUT)/prot_sao: ../utils.c
 
 $(OUTPUT)/wild_bctr: CFLAGS += -m64
+$(OUTPUT)/large_vm_fork_separation: CFLAGS += -m64
 
 $(OUTPUT)/tempfile:
         dd if=/dev/zero of=$@ bs=64k count=1
diff --git a/tools/testing/selftests/powerpc/mm/large_vm_fork_separation.c b/tools/testing/selftests/powerpc/mm/large_vm_fork_separation.c
new file mode 100644
index 000000000000..2363a7f3ab0d
--- /dev/null
+++ b/tools/testing/selftests/powerpc/mm/large_vm_fork_separation.c
@@ -0,0 +1,87 @@
+// SPDX-License-Identifier: GPL-2.0+
+//
+// Copyright 2019, Michael Ellerman, IBM Corp.
+//
+// Test that allocating memory beyond the memory limit and then forking is
+// handled correctly, ie. the child is able to access the mappings beyond the
+// memory limit and the child's writes are not visible to the parent.
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <sys/mman.h>
+#include <sys/types.h>
+#include <sys/wait.h>
+#include <unistd.h>
+
+#include "utils.h"
+
+
+#ifndef MAP_FIXED_NOREPLACE
+#define MAP_FIXED_NOREPLACE     MAP_FIXED       // "Should be safe" above 512TB
+#endif
+
+
+static int test(void)
+{
+        int p2c[2], c2p[2], rc, status, c, *p;
+        unsigned long page_size;
+        pid_t pid;
+
+        page_size = sysconf(_SC_PAGESIZE);
+        SKIP_IF(page_size != 65536);
+
+        // Create a mapping at 512TB to allocate an extended_id
+        p = mmap((void *)(512ul << 40), page_size, PROT_READ | PROT_WRITE,
+                MAP_PRIVATE | MAP_ANONYMOUS | MAP_FIXED_NOREPLACE, -1, 0);
+        if (p == MAP_FAILED) {
+                perror("mmap");
+                printf("Error: couldn't mmap(), confirm kernel has 4TB support?\n");
+                return 1;
+        }
+
+        printf("parent writing %p = 1\n", p);
+        *p = 1;
+
+        FAIL_IF(pipe(p2c) == -1 || pipe(c2p) == -1);
+
+        pid = fork();
+        if (pid == 0) {
+                FAIL_IF(read(p2c[0], &c, 1) != 1);
+
+                pid = getpid();
+                printf("child writing  %p = %d\n", p, pid);
+                *p = pid;
+
+                FAIL_IF(write(c2p[1], &c, 1) != 1);
+                FAIL_IF(read(p2c[0], &c, 1) != 1);
+                exit(0);
+        }
+
+        c = 0;
+        FAIL_IF(write(p2c[1], &c, 1) != 1);
+        FAIL_IF(read(c2p[0], &c, 1) != 1);
+
+        // Prevent compiler optimisation
+        barrier();
+
+        rc = 0;
+        printf("parent reading %p = %d\n", p, *p);
+        if (*p != 1) {
+                printf("Error: BUG! parent saw child's write! *p = %d\n", *p);
+                rc = 1;
+        }
+
+        FAIL_IF(write(p2c[1], &c, 1) != 1);
+        FAIL_IF(waitpid(pid, &status, 0) == -1);
+        FAIL_IF(!WIFEXITED(status) || WEXITSTATUS(status));
+
+        if (rc == 0)
+                printf("success: test completed OK\n");
+
+        return rc;
+}
+
+int main(void)
+{
+        return test_harness(test, "large_vm_fork_separation");
+}
diff --git a/tools/testing/selftests/rcutorture/Makefile b/tools/testing/selftests/rcutorture/Makefile
new file mode 100644
index 000000000000..5202dc666206
--- /dev/null
+++ b/tools/testing/selftests/rcutorture/Makefile
@@ -0,0 +1,3 @@
+# SPDX-License-Identifier: GPL-2.0+
+all:
+        ( cd ../../../..; tools/testing/selftests/rcutorture/bin/kvm.sh --duration 10 --configs TREE01 )
diff --git a/tools/testing/selftests/rcutorture/bin/configinit.sh b/tools/testing/selftests/rcutorture/bin/configinit.sh
index 40359486b3a8..93e80a42249a 100755
--- a/tools/testing/selftests/rcutorture/bin/configinit.sh
+++ b/tools/testing/selftests/rcutorture/bin/configinit.sh
@@ -1,7 +1,7 @@
 #!/bin/bash
 # SPDX-License-Identifier: GPL-2.0+
 #
-# Usage: configinit.sh config-spec-file build-output-dir results-dir
+# Usage: configinit.sh config-spec-file results-dir
 #
 # Create a .config file from the spec file.  Run from the kernel source tree.
 # Exits with 0 if all went well, with 1 if all went well but the config
@@ -11,10 +11,6 @@
 # desired settings, for example, "CONFIG_NO_HZ=y".  For best results,
 # this should be a full pathname.
 #
-# The second argument is a optional path to a build output directory,
-# for example, "O=/tmp/foo".  If this argument is omitted, the .config
-# file will be generated directly in the current directory.
-#
 # Copyright (C) IBM Corporation, 2013
 #
 # Authors: Paul E. McKenney <paulmck@linux.ibm.com>
@@ -26,34 +22,23 @@ mkdir $T
 # Capture config spec file.
 
 c=$1
-buildloc=$2
-resdir=$3
-builddir=
-if echo $buildloc | grep -q '^O='
-then
-        builddir=`echo $buildloc | sed -e 's/^O=//'`
-        if test ! -d $builddir
-        then
-                mkdir $builddir
-        fi
-else
-        echo Bad build directory: \"$buildloc\"
-        exit 2
-fi
+resdir=$2
 
 sed -e 's/^\(CONFIG[0-9A-Z_]*\)=.*$/grep -v "^# \1" |/' < $c > $T/u.sh
 sed -e 's/^\(CONFIG[0-9A-Z_]*=\).*$/grep -v \1 |/' < $c >> $T/u.sh
 grep '^grep' < $T/u.sh > $T/upd.sh
 echo "cat - $c" >> $T/upd.sh
-make mrproper
-make $buildloc distclean > $resdir/Make.distclean 2>&1
-make $buildloc $TORTURE_DEFCONFIG > $resdir/Make.defconfig.out 2>&1
-mv $builddir/.config $builddir/.config.sav
-sh $T/upd.sh < $builddir/.config.sav > $builddir/.config
-cp $builddir/.config $builddir/.config.new
-yes '' | make $buildloc oldconfig > $resdir/Make.oldconfig.out 2> $resdir/Make.oldconfig.err
+if test -z "$TORTURE_TRUST_MAKE"
+then
+        make clean > $resdir/Make.clean 2>&1
+fi
+make $TORTURE_DEFCONFIG > $resdir/Make.defconfig.out 2>&1
+mv .config .config.sav
+sh $T/upd.sh < .config.sav > .config
+cp .config .config.new
+yes '' | make oldconfig > $resdir/Make.oldconfig.out 2> $resdir/Make.oldconfig.err
 
 # verify new config matches specification.
-configcheck.sh $builddir/.config $c
+configcheck.sh .config $c
 
 exit 0
diff --git a/tools/testing/selftests/rcutorture/bin/cpus2use.sh b/tools/testing/selftests/rcutorture/bin/cpus2use.sh
index ff7102212703..4e9485590c10 100755
--- a/tools/testing/selftests/rcutorture/bin/cpus2use.sh
+++ b/tools/testing/selftests/rcutorture/bin/cpus2use.sh
@@ -9,6 +9,11 @@
 #
 # Authors: Paul E. McKenney <paulmck@linux.ibm.com>
 
+if test -n "$TORTURE_ALLOTED_CPUS"
+then
+        echo $TORTURE_ALLOTED_CPUS
+        exit 0
+fi
 ncpus=`grep '^processor' /proc/cpuinfo | wc -l`
 idlecpus=`mpstat | tail -1 | \
         awk -v ncpus=$ncpus '{ print ncpus * ($7 + $NF) / 100 }'`
diff --git a/tools/testing/selftests/rcutorture/bin/functions.sh b/tools/testing/selftests/rcutorture/bin/functions.sh
index 6bcb8b5b2ff2..c3a49fb4d6f6 100644
--- a/tools/testing/selftests/rcutorture/bin/functions.sh
+++ b/tools/testing/selftests/rcutorture/bin/functions.sh
@@ -172,7 +172,7 @@ identify_qemu_append () {
         local console=ttyS0
         case "$1" in
         qemu-system-x86_64|qemu-system-i386)
-                echo noapic selinux=0 initcall_debug debug
+                echo selinux=0 initcall_debug debug
                 ;;
         qemu-system-aarch64)
                 console=ttyAMA0
@@ -191,8 +191,19 @@ identify_qemu_append () {
 # Output arguments for qemu arguments based on the TORTURE_QEMU_MAC
 # and TORTURE_QEMU_INTERACTIVE environment variables.
 identify_qemu_args () {
+        local KVM_CPU=""
+        case "$1" in
+        qemu-system-x86_64)
+                KVM_CPU=kvm64
+                ;;
+        qemu-system-i386)
+                KVM_CPU=kvm32
+                ;;
+        esac
         case "$1" in
         qemu-system-x86_64|qemu-system-i386)
+                echo -machine q35,accel=kvm
+                echo -cpu ${KVM_CPU}
                 ;;
         qemu-system-aarch64)
                 echo -machine virt,gic-version=host -cpu host
diff --git a/tools/testing/selftests/rcutorture/bin/jitter.sh b/tools/testing/selftests/rcutorture/bin/jitter.sh
index 435b60933985..dc49a3ba6111 100755
--- a/tools/testing/selftests/rcutorture/bin/jitter.sh
+++ b/tools/testing/selftests/rcutorture/bin/jitter.sh
@@ -34,10 +34,15 @@ do
                 exit 0;
         fi
 
-        # Set affinity to randomly selected CPU
-        cpus=`ls /sys/devices/system/cpu/*/online |
-                sed -e 's,/[^/]*$,,' -e 's/^[^0-9]*//' |
-                grep -v '^0*$'`
+        # Set affinity to randomly selected online CPU
+        cpus=`grep 1 /sys/devices/system/cpu/*/online |
+                sed -e 's,/[^/]*$,,' -e 's/^[^0-9]*//'`
+
+        # Do not leave out poor old cpu0 which may not be hot-pluggable
+        if [ ! -f "/sys/devices/system/cpu/cpu0/online" ]; then
+                cpus="0 $cpus"
+        fi
+
         cpumask=`awk -v cpus="$cpus" -v me=$me -v n=$n 'BEGIN {
                 srand(n + me + systime());
                 ncpus = split(cpus, ca);
diff --git a/tools/testing/selftests/rcutorture/bin/kvm-build.sh b/tools/testing/selftests/rcutorture/bin/kvm-build.sh
index c27a0bbb9c02..18d6518504ee 100755
--- a/tools/testing/selftests/rcutorture/bin/kvm-build.sh
+++ b/tools/testing/selftests/rcutorture/bin/kvm-build.sh
@@ -3,7 +3,7 @@
 #
 # Build a kvm-ready Linux kernel from the tree in the current directory.
 #
-# Usage: kvm-build.sh config-template build-dir resdir
+# Usage: kvm-build.sh config-template resdir
 #
 # Copyright (C) IBM Corporation, 2011
 #
@@ -15,8 +15,7 @@ then
         echo "kvm-build.sh :$config_template: Not a readable file"
         exit 1
 fi
-builddir=${2}
-resdir=${3}
+resdir=${2}
 
 T=${TMPDIR-/tmp}/test-linux.sh.$$
 trap 'rm -rf $T' 0
@@ -29,14 +28,14 @@ CONFIG_VIRTIO_PCI=y
 CONFIG_VIRTIO_CONSOLE=y
 ___EOF___
 
-configinit.sh $T/config O=$builddir $resdir
+configinit.sh $T/config $resdir
 retval=$?
 if test $retval -gt 1
 then
         exit 2
 fi
 ncpus=`cpus2use.sh`
-make O=$builddir -j$ncpus $TORTURE_KMAKE_ARG > $resdir/Make.out 2>&1
+make -j$ncpus $TORTURE_KMAKE_ARG > $resdir/Make.out 2>&1
 retval=$?
 if test $retval -ne 0 || grep "rcu[^/]*": < $resdir/Make.out | egrep -q "Stop|Error|error:|warning:" || egrep -q "Stop|Error|error:" < $resdir/Make.out
 then
diff --git a/tools/testing/selftests/rcutorture/bin/kvm-find-errors.sh b/tools/testing/selftests/rcutorture/bin/kvm-find-errors.sh
index 8426fe1f15ee..1871d00bccd7 100755
--- a/tools/testing/selftests/rcutorture/bin/kvm-find-errors.sh
+++ b/tools/testing/selftests/rcutorture/bin/kvm-find-errors.sh
@@ -11,6 +11,7 @@
 #
 # The "directory" above should end with the date/time directory, for example,
 # "tools/testing/selftests/rcutorture/res/2018.02.25-14:27:27".
+# Returns error status reflecting the success (or not) of the specified run.
 #
 # Copyright (C) IBM Corporation, 2018
 #
@@ -56,6 +57,8 @@ done
 if test -n "$files"
 then
         $editor $files
+        exit 1
 else
         echo No errors in console logs.
+        exit 0
 fi
diff --git a/tools/testing/selftests/rcutorture/bin/kvm-recheck.sh b/tools/testing/selftests/rcutorture/bin/kvm-recheck.sh
index 2adde6aaafdb..e5edd5198725 100755
--- a/tools/testing/selftests/rcutorture/bin/kvm-recheck.sh
+++ b/tools/testing/selftests/rcutorture/bin/kvm-recheck.sh
@@ -7,6 +7,8 @@
 #
 # Usage: kvm-recheck.sh resdir ...
 #
+# Returns status reflecting the success or not of the last run specified.
+#
 # Copyright (C) IBM Corporation, 2011
 #
 # Authors: Paul E. McKenney <paulmck@linux.ibm.com>
@@ -28,8 +30,16 @@ do
                 TORTURE_SUITE="`cat $i/../TORTURE_SUITE`"
                 rm -f $i/console.log.*.diags
                 kvm-recheck-${TORTURE_SUITE}.sh $i
-                if test -f "$i/console.log"
+                if test -f "$i/qemu-retval" && test "`cat $i/qemu-retval`" -ne 0 && test "`cat $i/qemu-retval`" -ne 137
+                then
+                        echo QEMU error, output:
+                        cat $i/qemu-output
+                elif test -f "$i/console.log"
                 then
+                        if test -f "$i/qemu-retval" && test "`cat $i/qemu-retval`" -eq 137
+                        then
+                                echo QEMU killed
+                        fi
                         configcheck.sh $i/.config $i/ConfigFragment
                         if test -r $i/Make.oldconfig.err
                         then
@@ -58,3 +68,4 @@ do
                 fi
         done
 done
+EDITOR=echo kvm-find-errors.sh "${@: -1}" > /dev/null 2>&1
diff --git a/tools/testing/selftests/rcutorture/bin/kvm-test-1-run.sh b/tools/testing/selftests/rcutorture/bin/kvm-test-1-run.sh
index 0eb1ec16d78a..27b7b5693ede 100755
--- a/tools/testing/selftests/rcutorture/bin/kvm-test-1-run.sh
+++ b/tools/testing/selftests/rcutorture/bin/kvm-test-1-run.sh
@@ -36,11 +36,6 @@ config_template=${1}
 config_dir=`echo $config_template | sed -e 's,/[^/]*$,,'`
 title=`echo $config_template | sed -e 's/^.*\///'`
 builddir=${2}
-if test -z "$builddir" -o ! -d "$builddir" -o ! -w "$builddir"
-then
-        echo "kvm-test-1-run.sh :$builddir: Not a writable directory, cannot build into it"
-        exit 1
-fi
 resdir=${3}
 if test -z "$resdir" -o ! -d "$resdir" -o ! -w "$resdir"
 then
@@ -85,18 +80,18 @@ then
         ln -s $base_resdir/.config $resdir  # for kvm-recheck.sh
         # Arch-independent indicator
         touch $resdir/builtkernel
-elif kvm-build.sh $T/Kc2 $builddir $resdir
+elif kvm-build.sh $T/Kc2 $resdir
 then
         # Had to build a kernel for this test.
-        QEMU="`identify_qemu $builddir/vmlinux`"
+        QEMU="`identify_qemu vmlinux`"
         BOOT_IMAGE="`identify_boot_image $QEMU`"
-        cp $builddir/vmlinux $resdir
-        cp $builddir/.config $resdir
-        cp $builddir/Module.symvers $resdir > /dev/null || :
-        cp $builddir/System.map $resdir > /dev/null || :
+        cp vmlinux $resdir
+        cp .config $resdir
+        cp Module.symvers $resdir > /dev/null || :
+        cp System.map $resdir > /dev/null || :
         if test -n "$BOOT_IMAGE"
         then
-                cp $builddir/$BOOT_IMAGE $resdir
+                cp $BOOT_IMAGE $resdir
                 KERNEL=$resdir/${BOOT_IMAGE##*/}
                 # Arch-independent indicator
                 touch $resdir/builtkernel
@@ -107,7 +102,7 @@ then
         parse-build.sh $resdir/Make.out $title
 else
         # Build failed.
-        cp $builddir/.config $resdir || :
+        cp .config $resdir || :
         echo Build failed, not running KVM, see $resdir.
         if test -f $builddir.wait
         then
@@ -165,7 +160,7 @@ then
 fi
 echo "NOTE: $QEMU either did not run or was interactive" > $resdir/console.log
 echo $QEMU $qemu_args -m $TORTURE_QEMU_MEM -kernel $KERNEL -append \"$qemu_append $boot_args\" > $resdir/qemu-cmd
-( $QEMU $qemu_args -m $TORTURE_QEMU_MEM -kernel $KERNEL -append "$qemu_append $boot_args"& echo $! > $resdir/qemu_pid; wait `cat  $resdir/qemu_pid`; echo $? > $resdir/qemu-retval ) &
+( $QEMU $qemu_args -m $TORTURE_QEMU_MEM -kernel $KERNEL -append "$qemu_append $boot_args" > $resdir/qemu-output 2>&1 & echo $! > $resdir/qemu_pid; wait `cat  $resdir/qemu_pid`; echo $? > $resdir/qemu-retval ) &
 commandcompleted=0
 sleep 10 # Give qemu's pid a chance to reach the file
 if test -s "$resdir/qemu_pid"
diff --git a/tools/testing/selftests/rcutorture/bin/kvm.sh b/tools/testing/selftests/rcutorture/bin/kvm.sh
index 8f1e337b9b54..72518580df23 100755
--- a/tools/testing/selftests/rcutorture/bin/kvm.sh
+++ b/tools/testing/selftests/rcutorture/bin/kvm.sh
@@ -24,6 +24,7 @@ dur=$((30*60))
 dryrun=""
 KVM="`pwd`/tools/testing/selftests/rcutorture"; export KVM
 PATH=${KVM}/bin:$PATH; export PATH
+TORTURE_ALLOTED_CPUS=""
 TORTURE_DEFCONFIG=defconfig
 TORTURE_BOOT_IMAGE=""
 TORTURE_INITRD="$KVM/initrd"; export TORTURE_INITRD
@@ -32,6 +33,7 @@ TORTURE_KMAKE_ARG=""
 TORTURE_QEMU_MEM=512
 TORTURE_SHUTDOWN_GRACE=180
 TORTURE_SUITE=rcu
+TORTURE_TRUST_MAKE=""
 resdir=""
 configs=""
 cpus=0
@@ -62,6 +64,7 @@ usage () {
         echo "       --qemu-cmd qemu-system-..."
         echo "       --results absolute-pathname"
         echo "       --torture rcu"
+        echo "       --trust-make"
         exit 1
 }
 
@@ -89,6 +92,7 @@ do
         --cpus)
                 checkarg --cpus "(number)" "$#" "$2" '^[0-9]*$' '^--'
                 cpus=$2
+                TORTURE_ALLOTED_CPUS="$2"
                 shift
                 ;;
         --datestamp)
@@ -173,6 +177,9 @@ do
                         jitter=0
                 fi
                 ;;
+        --trust-make)
+                TORTURE_TRUST_MAKE="y"
+                ;;
         *)
                 echo Unknown argument $1
                 usage
@@ -285,6 +292,7 @@ cat << ___EOF___ > $T/script
 CONFIGFRAG="$CONFIGFRAG"; export CONFIGFRAG
 KVM="$KVM"; export KVM
 PATH="$PATH"; export PATH
+TORTURE_ALLOTED_CPUS="$TORTURE_ALLOTED_CPUS"; export TORTURE_ALLOTED_CPUS
 TORTURE_BOOT_IMAGE="$TORTURE_BOOT_IMAGE"; export TORTURE_BOOT_IMAGE
 TORTURE_BUILDONLY="$TORTURE_BUILDONLY"; export TORTURE_BUILDONLY
 TORTURE_DEFCONFIG="$TORTURE_DEFCONFIG"; export TORTURE_DEFCONFIG
@@ -297,6 +305,7 @@ TORTURE_QEMU_MAC="$TORTURE_QEMU_MAC"; export TORTURE_QEMU_MAC
 TORTURE_QEMU_MEM="$TORTURE_QEMU_MEM"; export TORTURE_QEMU_MEM
 TORTURE_SHUTDOWN_GRACE="$TORTURE_SHUTDOWN_GRACE"; export TORTURE_SHUTDOWN_GRACE
 TORTURE_SUITE="$TORTURE_SUITE"; export TORTURE_SUITE
+TORTURE_TRUST_MAKE="$TORTURE_TRUST_MAKE"; export TORTURE_TRUST_MAKE
 if ! test -e $resdir
 then
         mkdir -p "$resdir" || :
@@ -342,7 +351,7 @@ function dump(first, pastlast, batchnum)
         print "needqemurun="
         jn=1
         for (j = first; j < pastlast; j++) {
-                builddir=KVM "/b1"
+                builddir=KVM "/b" j - first + 1
                 cpusr[jn] = cpus[j];
                 if (cfrep[cf[j]] == "") {
                         cfr[jn] = cf[j];
@@ -358,7 +367,6 @@ function dump(first, pastlast, batchnum)
                 print "echo ", cfr[jn], cpusr[jn] ovf ": Starting build. `date` | tee -a " rd "log";
                 print "rm -f " builddir ".*";
                 print "touch " builddir ".wait";
-                print "mkdir " builddir " > /dev/null 2>&1 || :";
                 print "mkdir " rd cfr[jn] " || :";
                 print "kvm-test-1-run.sh " CONFIGDIR cf[j], builddir, rd cfr[jn], dur " \"" TORTURE_QEMU_ARG "\" \"" TORTURE_BOOTARGS "\" > " rd cfr[jn]  "/kvm-test-1-run.sh.out 2>&1 &"
                 print "echo ", cfr[jn], cpusr[jn] ovf ": Waiting for build to complete. `date` | tee -a " rd "log";
@@ -464,3 +472,5 @@ else
 fi
 
 # Tracing: trace_event=rcu:rcu_grace_period,rcu:rcu_future_grace_period,rcu:rcu_grace_period_init,rcu:rcu_nocb_wake,rcu:rcu_preempt_task,rcu:rcu_unlock_preempted_task,rcu:rcu_quiescent_state_report,rcu:rcu_fqs,rcu:rcu_callback,rcu:rcu_kfree_callback,rcu:rcu_batch_start,rcu:rcu_invoke_callback,rcu:rcu_invoke_kfree_callback,rcu:rcu_batch_end,rcu:rcu_torture_read,rcu:rcu_barrier
+# Function-graph tracing: ftrace=function_graph ftrace_graph_filter=sched_setaffinity,migration_cpu_stop
+# Also --kconfig "CONFIG_FUNCTION_TRACER=y CONFIG_FUNCTION_GRAPH_TRACER=y"
diff --git a/tools/testing/selftests/rcutorture/bin/parse-build.sh b/tools/testing/selftests/rcutorture/bin/parse-build.sh
index 0701b3bf6ade..09155c15ea65 100755
--- a/tools/testing/selftests/rcutorture/bin/parse-build.sh
+++ b/tools/testing/selftests/rcutorture/bin/parse-build.sh
@@ -21,7 +21,7 @@ mkdir $T
 
 . functions.sh
 
-if grep -q CC < $F
+if grep -q CC < $F || test -n "$TORTURE_TRUST_MAKE"
 then
         :
 else
diff --git a/tools/testing/selftests/rcutorture/bin/parse-console.sh b/tools/testing/selftests/rcutorture/bin/parse-console.sh
index 4508373a922f..4bf62d7b1cbc 100755
--- a/tools/testing/selftests/rcutorture/bin/parse-console.sh
+++ b/tools/testing/selftests/rcutorture/bin/parse-console.sh
@@ -106,6 +106,7 @@ fi | tee -a $file.diags
 
 egrep 'Badness|WARNING:|Warn|BUG|===========|Call Trace:|Oops:|detected stalls on CPUs/tasks:|self-detected stall on CPU|Stall ended before state dump start|\?\?\? Writer stall state|rcu_.*kthread starved for' < $file |
 grep -v 'ODEBUG: ' |
+grep -v 'This means that this is a DEBUG kernel and it is' |
 grep -v 'Warning: unable to open an initial console' > $T.diags
 if test -s $T.diags
 then
diff --git a/tools/testing/selftests/rcutorture/configs/rcu/CFcommon b/tools/testing/selftests/rcutorture/configs/rcu/CFcommon
index d2d2a86139db..e19a444a0684 100644
--- a/tools/testing/selftests/rcutorture/configs/rcu/CFcommon
+++ b/tools/testing/selftests/rcutorture/configs/rcu/CFcommon
@@ -1,2 +1,5 @@
 CONFIG_RCU_TORTURE_TEST=y
 CONFIG_PRINTK_TIME=y
+CONFIG_HYPERVISOR_GUEST=y
+CONFIG_PARAVIRT=y
+CONFIG_KVM_GUEST=y
diff --git a/tools/testing/selftests/rcutorture/configs/rcu/TREE01.boot b/tools/testing/selftests/rcutorture/configs/rcu/TREE01.boot
index ea47da95374b..d6da9a61d44a 100644
--- a/tools/testing/selftests/rcutorture/configs/rcu/TREE01.boot
+++ b/tools/testing/selftests/rcutorture/configs/rcu/TREE01.boot
@@ -3,3 +3,4 @@ rcutree.gp_preinit_delay=3
 rcutree.gp_init_delay=3
 rcutree.gp_cleanup_delay=3
 rcu_nocbs=0
+rcutorture.fwd_progress=0
diff --git a/tools/testing/selftests/rcutorture/configs/rcu/TRIVIAL b/tools/testing/selftests/rcutorture/configs/rcu/TRIVIAL
new file mode 100644
index 000000000000..4d8eb5bfb6f6
--- /dev/null
+++ b/tools/testing/selftests/rcutorture/configs/rcu/TRIVIAL
@@ -0,0 +1,14 @@
+CONFIG_SMP=y
+CONFIG_NR_CPUS=8
+CONFIG_PREEMPT_NONE=y
+CONFIG_PREEMPT_VOLUNTARY=n
+CONFIG_PREEMPT=n
+CONFIG_HZ_PERIODIC=n
+CONFIG_NO_HZ_IDLE=y
+CONFIG_NO_HZ_FULL=n
+CONFIG_HOTPLUG_CPU=n
+CONFIG_SUSPEND=n
+CONFIG_HIBERNATION=n
+CONFIG_DEBUG_LOCK_ALLOC=n
+CONFIG_DEBUG_OBJECTS_RCU_HEAD=n
+CONFIG_RCU_EXPERT=y
diff --git a/tools/testing/selftests/rcutorture/configs/rcu/TRIVIAL.boot b/tools/testing/selftests/rcutorture/configs/rcu/TRIVIAL.boot
new file mode 100644
index 000000000000..7017f5f5a55f
--- /dev/null
+++ b/tools/testing/selftests/rcutorture/configs/rcu/TRIVIAL.boot
@@ -0,0 +1,3 @@
+rcutorture.torture_type=trivial
+rcutorture.onoff_interval=0
+rcutorture.shuffle_interval=0
diff --git a/tools/testing/selftests/timers/freq-step.c b/tools/testing/selftests/timers/freq-step.c
index 8cd10662ffba..4b76450d78d1 100644
--- a/tools/testing/selftests/timers/freq-step.c
+++ b/tools/testing/selftests/timers/freq-step.c
@@ -21,9 +21,9 @@
 #define SAMPLE_READINGS 10
 #define MEAN_SAMPLE_INTERVAL 0.1
 #define STEP_INTERVAL 1.0
-#define MAX_PRECISION 100e-9
-#define MAX_FREQ_ERROR 10e-6
-#define MAX_STDDEV 1000e-9
+#define MAX_PRECISION 500e-9
+#define MAX_FREQ_ERROR 0.02e-6
+#define MAX_STDDEV 50e-9
 
 #ifndef ADJ_SETOFFSET
   #define ADJ_SETOFFSET 0x0100
diff --git a/tools/testing/selftests/x86/Makefile b/tools/testing/selftests/x86/Makefile
index 186520198de7..fa07d526fe39 100644
--- a/tools/testing/selftests/x86/Makefile
+++ b/tools/testing/selftests/x86/Makefile
@@ -12,8 +12,9 @@ CAN_BUILD_WITH_NOPIE := $(shell ./check_cc.sh $(CC) trivial_program.c -no-pie)
 
 TARGETS_C_BOTHBITS := single_step_syscall sysret_ss_attrs syscall_nt test_mremap_vdso \
                         check_initial_reg_state sigreturn iopl mpx-mini-test ioperm \
-                        protection_keys test_vdso test_vsyscall mov_ss_trap
-TARGETS_C_32BIT_ONLY := entry_from_vm86 syscall_arg_fault test_syscall_vdso unwind_vdso \
+                        protection_keys test_vdso test_vsyscall mov_ss_trap \
+                        syscall_arg_fault
+TARGETS_C_32BIT_ONLY := entry_from_vm86 test_syscall_vdso unwind_vdso \
                         test_FCMOV test_FCOMI test_FISTTP \
                         vdso_restorer
 TARGETS_C_64BIT_ONLY := fsgsbase sysret_rip
diff --git a/tools/testing/selftests/x86/fsgsbase.c b/tools/testing/selftests/x86/fsgsbase.c
index af85bd4752a5..5ab4c60c100e 100644
--- a/tools/testing/selftests/x86/fsgsbase.c
+++ b/tools/testing/selftests/x86/fsgsbase.c
@@ -23,6 +23,10 @@
 #include <pthread.h>
 #include <asm/ldt.h>
 #include <sys/mman.h>
+#include <stddef.h>
+#include <sys/ptrace.h>
+#include <sys/wait.h>
+#include <setjmp.h>
 
 #ifndef __x86_64__
 # error This test is 64-bit only
@@ -31,6 +35,8 @@
 static volatile sig_atomic_t want_segv;
 static volatile unsigned long segv_addr;
 
+static unsigned short *shared_scratch;
+
 static int nerrs;
 
 static void sethandler(int sig, void (*handler)(int, siginfo_t *, void *),
@@ -71,6 +77,43 @@ static void sigsegv(int sig, siginfo_t *si, void *ctx_void)
 
 }
 
+static jmp_buf jmpbuf;
+
+static void sigill(int sig, siginfo_t *si, void *ctx_void)
+{
+        siglongjmp(jmpbuf, 1);
+}
+
+static bool have_fsgsbase;
+
+static inline unsigned long rdgsbase(void)
+{
+        unsigned long gsbase;
+
+        asm volatile("rdgsbase %0" : "=r" (gsbase) :: "memory");
+
+        return gsbase;
+}
+
+static inline unsigned long rdfsbase(void)
+{
+        unsigned long fsbase;
+
+        asm volatile("rdfsbase %0" : "=r" (fsbase) :: "memory");
+
+        return fsbase;
+}
+
+static inline void wrgsbase(unsigned long gsbase)
+{
+        asm volatile("wrgsbase %0" :: "r" (gsbase) : "memory");
+}
+
+static inline void wrfsbase(unsigned long fsbase)
+{
+        asm volatile("wrfsbase %0" :: "r" (fsbase) : "memory");
+}
+
 enum which_base { FS, GS };
 
 static unsigned long read_base(enum which_base which)
@@ -199,16 +242,13 @@ static void do_remote_base()
                to_set, hard_zero ? " and clear gs" : "", sel);
 }
 
-void do_unexpected_base(void)
+static __thread int set_thread_area_entry_number = -1;
+
+static unsigned short load_gs(void)
 {
         /*
-         * The goal here is to try to arrange for GS == 0, GSBASE !=
-         * 0, and for the the kernel the think that GSBASE == 0.
-         *
-         * To make the test as reliable as possible, this uses
-         * explicit descriptorss.  (This is not the only way.  This
-         * could use ARCH_SET_GS with a low, nonzero base, but the
-         * relevant side effect of ARCH_SET_GS could change.)
+         * Sets GS != 0 and GSBASE != 0 but arranges for the kernel to think
+         * that GSBASE == 0 (i.e. thread.gsbase == 0).
          */
 
         /* Step 1: tell the kernel that we have GSBASE == 0. */
@@ -228,8 +268,9 @@ void do_unexpected_base(void)
                 .useable         = 0
         };
         if (syscall(SYS_modify_ldt, 1, &desc, sizeof(desc)) == 0) {
-                printf("\tother thread: using LDT slot 0\n");
+                printf("\tusing LDT slot 0\n");
                 asm volatile ("mov %0, %%gs" : : "rm" ((unsigned short)0x7));
+                return 0x7;
         } else {
                 /* No modify_ldt for us (configured out, perhaps) */
 
@@ -239,7 +280,7 @@ void do_unexpected_base(void)
                         MAP_PRIVATE | MAP_ANONYMOUS | MAP_32BIT, -1, 0);
                 memcpy(low_desc, &desc, sizeof(desc));
 
-                low_desc->entry_number = -1;
+                low_desc->entry_number = set_thread_area_entry_number;
 
                 /* 32-bit set_thread_area */
                 long ret;
@@ -251,18 +292,43 @@ void do_unexpected_base(void)
 
                 if (ret != 0) {
                         printf("[NOTE]\tcould not create a segment -- test won't do anything\n");
-                        return;
+                        return 0;
                 }
-                printf("\tother thread: using GDT slot %d\n", desc.entry_number);
-                asm volatile ("mov %0, %%gs" : : "rm" ((unsigned short)((desc.entry_number << 3) | 0x3)));
+                printf("\tusing GDT slot %d\n", desc.entry_number);
+                set_thread_area_entry_number = desc.entry_number;
+
+                unsigned short gs = (unsigned short)((desc.entry_number << 3) | 0x3);
+                asm volatile ("mov %0, %%gs" : : "rm" (gs));
+                return gs;
         }
+}
 
-        /*
-         * Step 3: set the selector back to zero.  On AMD chips, this will
-         * preserve GSBASE.
-         */
+void test_wrbase(unsigned short index, unsigned long base)
+{
+        unsigned short newindex;
+        unsigned long newbase;
 
-        asm volatile ("mov %0, %%gs" : : "rm" ((unsigned short)0));
+        printf("[RUN]\tGS = 0x%hx, GSBASE = 0x%lx\n", index, base);
+
+        asm volatile ("mov %0, %%gs" : : "rm" (index));
+        wrgsbase(base);
+
+        remote_base = 0;
+        ftx = 1;
+        syscall(SYS_futex, &ftx, FUTEX_WAKE, 0, NULL, NULL, 0);
+        while (ftx != 0)
+                syscall(SYS_futex, &ftx, FUTEX_WAIT, 1, NULL, NULL, 0);
+
+        asm volatile ("mov %%gs, %0" : "=rm" (newindex));
+        newbase = rdgsbase();
+
+        if (newindex == index && newbase == base) {
+                printf("[OK]\tIndex and base were preserved\n");
+        } else {
+                printf("[FAIL]\tAfter switch, GS = 0x%hx and GSBASE = 0x%lx\n",
+                       newindex, newbase);
+                nerrs++;
+        }
 }
 
 static void *threadproc(void *ctx)
@@ -273,12 +339,19 @@ static void *threadproc(void *ctx)
                 if (ftx == 3)
                         return NULL;
 
-                if (ftx == 1)
+                if (ftx == 1) {
                         do_remote_base();
-                else if (ftx == 2)
-                        do_unexpected_base();
-                else
+                } else if (ftx == 2) {
+                        /*
+                         * On AMD chips, this causes GSBASE != 0, GS == 0, and
+                         * thread.gsbase == 0.
+                         */
+
+                        load_gs();
+                        asm volatile ("mov %0, %%gs" : : "rm" ((unsigned short)0));
+                } else {
                         errx(1, "helper thread got bad command");
+                }
 
                 ftx = 0;
                 syscall(SYS_futex, &ftx, FUTEX_WAKE, 0, NULL, NULL, 0);
@@ -367,10 +440,99 @@ static void test_unexpected_base(void)
         }
 }
 
+#define USER_REGS_OFFSET(r) offsetof(struct user_regs_struct, r)
+
+static void test_ptrace_write_gsbase(void)
+{
+        int status;
+        pid_t child = fork();
+
+        if (child < 0)
+                err(1, "fork");
+
+        if (child == 0) {
+                printf("[RUN]\tPTRACE_POKE(), write GSBASE from ptracer\n");
+
+                *shared_scratch = load_gs();
+
+                if (ptrace(PTRACE_TRACEME, 0, NULL, NULL) != 0)
+                        err(1, "PTRACE_TRACEME");
+
+                raise(SIGTRAP);
+                _exit(0);
+        }
+
+        wait(&status);
+
+        if (WSTOPSIG(status) == SIGTRAP) {
+                unsigned long gs, base;
+                unsigned long gs_offset = USER_REGS_OFFSET(gs);
+                unsigned long base_offset = USER_REGS_OFFSET(gs_base);
+
+                gs = ptrace(PTRACE_PEEKUSER, child, gs_offset, NULL);
+
+                if (gs != *shared_scratch) {
+                        nerrs++;
+                        printf("[FAIL]\tGS is not prepared with nonzero\n");
+                        goto END;
+                }
+
+                if (ptrace(PTRACE_POKEUSER, child, base_offset, 0xFF) != 0)
+                        err(1, "PTRACE_POKEUSER");
+
+                gs = ptrace(PTRACE_PEEKUSER, child, gs_offset, NULL);
+                base = ptrace(PTRACE_PEEKUSER, child, base_offset, NULL);
+
+                /*
+                 * In a non-FSGSBASE system, the nonzero selector will load
+                 * GSBASE (again). But what is tested here is whether the
+                 * selector value is changed or not by the GSBASE write in
+                 * a ptracer.
+                 */
+                if (gs != *shared_scratch) {
+                        nerrs++;
+                        printf("[FAIL]\tGS changed to %lx\n", gs);
+
+                        /*
+                         * On older kernels, poking a nonzero value into the
+                         * base would zero the selector.  On newer kernels,
+                         * this behavior has changed -- poking the base
+                         * changes only the base and, if FSGSBASE is not
+                         * available, this may have no effect.
+                         */
+                        if (gs == 0)
+                                printf("\tNote: this is expected behavior on older kernels.\n");
+                } else if (have_fsgsbase && (base != 0xFF)) {
+                        nerrs++;
+                        printf("[FAIL]\tGSBASE changed to %lx\n", base);
+                } else {
+                        printf("[OK]\tGS remained 0x%hx%s", *shared_scratch, have_fsgsbase ? " and GSBASE changed to 0xFF" : "");
+                        printf("\n");
+                }
+        }
+
+END:
+        ptrace(PTRACE_CONT, child, NULL, NULL);
+}
+
 int main()
 {
         pthread_t thread;
 
+        shared_scratch = mmap(NULL, 4096, PROT_READ | PROT_WRITE,
+                              MAP_ANONYMOUS | MAP_SHARED, -1, 0);
+
+        /* Probe FSGSBASE */
+        sethandler(SIGILL, sigill, 0);
+        if (sigsetjmp(jmpbuf, 1) == 0) {
+                rdfsbase();
+                have_fsgsbase = true;
+                printf("\tFSGSBASE instructions are enabled\n");
+        } else {
+                printf("\tFSGSBASE instructions are disabled\n");
+        }
+        clearhandler(SIGILL);
+
         sethandler(SIGSEGV, sigsegv, 0);
 
         check_gs_value(0);
@@ -417,11 +579,28 @@ int main()
 
         test_unexpected_base();
 
+        if (have_fsgsbase) {
+                unsigned short ss;
+
+                asm volatile ("mov %%ss, %0" : "=rm" (ss));
+
+                test_wrbase(0, 0);
+                test_wrbase(0, 1);
+                test_wrbase(0, 0x200000000);
+                test_wrbase(0, 0xffffffffffffffff);
+                test_wrbase(ss, 0);
+                test_wrbase(ss, 1);
+                test_wrbase(ss, 0x200000000);
+                test_wrbase(ss, 0xffffffffffffffff);
+        }
+
         ftx = 3;  /* Kill the thread. */
         syscall(SYS_futex, &ftx, FUTEX_WAKE, 0, NULL, NULL, 0);
 
         if (pthread_join(thread, NULL) != 0)
                 err(1, "pthread_join");
 
+        test_ptrace_write_gsbase();
+
         return nerrs == 0 ? 0 : 1;
 }
diff --git a/tools/testing/selftests/x86/syscall_arg_fault.c b/tools/testing/selftests/x86/syscall_arg_fault.c
index 4e25d38c8bbd..bc0ecc2e862e 100644
--- a/tools/testing/selftests/x86/syscall_arg_fault.c
+++ b/tools/testing/selftests/x86/syscall_arg_fault.c
@@ -15,9 +15,30 @@
 #include <setjmp.h>
 #include <errno.h>
 
+#ifdef __x86_64__
+# define WIDTH "q"
+#else
+# define WIDTH "l"
+#endif
+
 /* Our sigaltstack scratch space. */
 static unsigned char altstack_data[SIGSTKSZ];
 
+static unsigned long get_eflags(void)
+{
+        unsigned long eflags;
+        asm volatile ("pushf" WIDTH "\n\tpop" WIDTH " %0" : "=rm" (eflags));
+        return eflags;
+}
+
+static void set_eflags(unsigned long eflags)
+{
+        asm volatile ("push" WIDTH " %0\n\tpopf" WIDTH
+                      : : "rm" (eflags) : "flags");
+}
+
+#define X86_EFLAGS_TF (1UL << 8)
+
 static void sethandler(int sig, void (*handler)(int, siginfo_t *, void *),
                        int flags)
 {
@@ -35,13 +56,22 @@ static sigjmp_buf jmpbuf;
 
 static volatile sig_atomic_t n_errs;
 
+#ifdef __x86_64__
+#define REG_AX REG_RAX
+#define REG_IP REG_RIP
+#else
+#define REG_AX REG_EAX
+#define REG_IP REG_EIP
+#endif
+
 static void sigsegv_or_sigbus(int sig, siginfo_t *info, void *ctx_void)
 {
         ucontext_t *ctx = (ucontext_t*)ctx_void;
+        long ax = (long)ctx->uc_mcontext.gregs[REG_AX];
 
-        if (ctx->uc_mcontext.gregs[REG_EAX] != -EFAULT) {
-                printf("[FAIL]\tAX had the wrong value: 0x%x\n",
-                       ctx->uc_mcontext.gregs[REG_EAX]);
+        if (ax != -EFAULT && ax != -ENOSYS) {
+                printf("[FAIL]\tAX had the wrong value: 0x%lx\n",
+                       (unsigned long)ax);
                 n_errs++;
         } else {
                 printf("[OK]\tSeems okay\n");
@@ -50,9 +80,42 @@ static void sigsegv_or_sigbus(int sig, siginfo_t *info, void *ctx_void)
         siglongjmp(jmpbuf, 1);
 }
 
+static volatile sig_atomic_t sigtrap_consecutive_syscalls;
+
+static void sigtrap(int sig, siginfo_t *info, void *ctx_void)
+{
+        /*
+         * KVM has some bugs that can cause us to stop making progress.
+         * detect them and complain, but don't infinite loop or fail the
+         * test.
+         */
+
+        ucontext_t *ctx = (ucontext_t*)ctx_void;
+        unsigned short *ip = (unsigned short *)ctx->uc_mcontext.gregs[REG_IP];
+
+        if (*ip == 0x340f || *ip == 0x050f) {
+                /* The trap was on SYSCALL or SYSENTER */
+                sigtrap_consecutive_syscalls++;
+                if (sigtrap_consecutive_syscalls > 3) {
+                        printf("[WARN]\tGot stuck single-stepping -- you probably have a KVM bug\n");
+                        siglongjmp(jmpbuf, 1);
+                }
+        } else {
+                sigtrap_consecutive_syscalls = 0;
+        }
+}
+
 static void sigill(int sig, siginfo_t *info, void *ctx_void)
 {
-        printf("[SKIP]\tIllegal instruction\n");
+        ucontext_t *ctx = (ucontext_t*)ctx_void;
+        unsigned short *ip = (unsigned short *)ctx->uc_mcontext.gregs[REG_IP];
+
+        if (*ip == 0x0b0f) {
+                /* one of the ud2 instructions faulted */
+                printf("[OK]\tSYSCALL returned normally\n");
+        } else {
+                printf("[SKIP]\tIllegal instruction\n");
+        }
         siglongjmp(jmpbuf, 1);
 }
 
@@ -120,9 +183,48 @@ int main()
                         "movl $-1, %%ebp\n\t"
                         "movl $-1, %%esp\n\t"
                         "syscall\n\t"
-                        "pushl $0"      /* make sure we segfault cleanly */
+                        "ud2"           /* make sure we recover cleanly */
+                        : : : "memory", "flags");
+        }
+
+        printf("[RUN]\tSYSENTER with TF and invalid state\n");
+        sethandler(SIGTRAP, sigtrap, SA_ONSTACK);
+
+        if (sigsetjmp(jmpbuf, 1) == 0) {
+                sigtrap_consecutive_syscalls = 0;
+                set_eflags(get_eflags() | X86_EFLAGS_TF);
+                asm volatile (
+                        "movl $-1, %%eax\n\t"
+                        "movl $-1, %%ebx\n\t"
+                        "movl $-1, %%ecx\n\t"
+                        "movl $-1, %%edx\n\t"
+                        "movl $-1, %%esi\n\t"
+                        "movl $-1, %%edi\n\t"
+                        "movl $-1, %%ebp\n\t"
+                        "movl $-1, %%esp\n\t"
+                        "sysenter"
+                        : : : "memory", "flags");
+        }
+        set_eflags(get_eflags() & ~X86_EFLAGS_TF);
+
+        printf("[RUN]\tSYSCALL with TF and invalid state\n");
+        if (sigsetjmp(jmpbuf, 1) == 0) {
+                sigtrap_consecutive_syscalls = 0;
+                set_eflags(get_eflags() | X86_EFLAGS_TF);
+                asm volatile (
+                        "movl $-1, %%eax\n\t"
+                        "movl $-1, %%ebx\n\t"
+                        "movl $-1, %%ecx\n\t"
+                        "movl $-1, %%edx\n\t"
+                        "movl $-1, %%esi\n\t"
+                        "movl $-1, %%edi\n\t"
+                        "movl $-1, %%ebp\n\t"
+                        "movl $-1, %%esp\n\t"
+                        "syscall\n\t"
+                        "ud2"           /* make sure we recover cleanly */
                         : : : "memory", "flags");
         }
+        set_eflags(get_eflags() & ~X86_EFLAGS_TF);
 
         return 0;
 }
diff --git a/tools/testing/selftests/x86/test_vsyscall.c b/tools/testing/selftests/x86/test_vsyscall.c
index 0b4f1cc2291c..4602326b8f5b 100644
--- a/tools/testing/selftests/x86/test_vsyscall.c
+++ b/tools/testing/selftests/x86/test_vsyscall.c
@@ -18,6 +18,7 @@
 #include <sched.h>
 #include <stdbool.h>
 #include <setjmp.h>
+#include <sys/uio.h>
 
 #ifdef __x86_64__
 # define VSYS(x) (x)
@@ -49,21 +50,21 @@ static void sethandler(int sig, void (*handler)(int, siginfo_t *, void *),
 }
 
 /* vsyscalls and vDSO */
-bool should_read_vsyscall = false;
+bool vsyscall_map_r = false, vsyscall_map_x = false;
 
 typedef long (*gtod_t)(struct timeval *tv, struct timezone *tz);
-gtod_t vgtod = (gtod_t)VSYS(0xffffffffff600000);
+const gtod_t vgtod = (gtod_t)VSYS(0xffffffffff600000);
 gtod_t vdso_gtod;
 
 typedef int (*vgettime_t)(clockid_t, struct timespec *);
 vgettime_t vdso_gettime;
 
 typedef long (*time_func_t)(time_t *t);
-time_func_t vtime = (time_func_t)VSYS(0xffffffffff600400);
+const time_func_t vtime = (time_func_t)VSYS(0xffffffffff600400);
 time_func_t vdso_time;
 
 typedef long (*getcpu_t)(unsigned *, unsigned *, void *);
-getcpu_t vgetcpu = (getcpu_t)VSYS(0xffffffffff600800);
+const getcpu_t vgetcpu = (getcpu_t)VSYS(0xffffffffff600800);
 getcpu_t vdso_getcpu;
 
 static void init_vdso(void)
@@ -107,7 +108,7 @@ static int init_vsys(void)
         maps = fopen("/proc/self/maps", "r");
         if (!maps) {
                 printf("[WARN]\tCould not open /proc/self/maps -- assuming vsyscall is r-x\n");
-                should_read_vsyscall = true;
+                vsyscall_map_r = true;
                 return 0;
         }
 
@@ -133,12 +134,8 @@ static int init_vsys(void)
                 }
 
                 printf("\tvsyscall permissions are %c-%c\n", r, x);
-                should_read_vsyscall = (r == 'r');
-                if (x != 'x') {
-                        vgtod = NULL;
-                        vtime = NULL;
-                        vgetcpu = NULL;
-                }
+                vsyscall_map_r = (r == 'r');
+                vsyscall_map_x = (x == 'x');
 
                 found = true;
                 break;
@@ -148,10 +145,8 @@ static int init_vsys(void)
 
         if (!found) {
                 printf("\tno vsyscall map in /proc/self/maps\n");
-                should_read_vsyscall = false;
-                vgtod = NULL;
-                vtime = NULL;
-                vgetcpu = NULL;
+                vsyscall_map_r = false;
+                vsyscall_map_x = false;
         }
 
         return nerrs;
@@ -183,9 +178,13 @@ static inline long sys_getcpu(unsigned * cpu, unsigned * node,
 }
 
 static jmp_buf jmpbuf;
+static volatile unsigned long segv_err;
 
 static void sigsegv(int sig, siginfo_t *info, void *ctx_void)
 {
+        ucontext_t *ctx = (ucontext_t *)ctx_void;
+
+        segv_err =  ctx->uc_mcontext.gregs[REG_ERR];
         siglongjmp(jmpbuf, 1);
 }
 
@@ -238,7 +237,7 @@ static int test_gtod(void)
                 err(1, "syscall gettimeofday");
         if (vdso_gtod)
                 ret_vdso = vdso_gtod(&tv_vdso, &tz_vdso);
-        if (vgtod)
+        if (vsyscall_map_x)
                 ret_vsys = vgtod(&tv_vsys, &tz_vsys);
         if (sys_gtod(&tv_sys2, &tz_sys) != 0)
                 err(1, "syscall gettimeofday");
@@ -252,7 +251,7 @@ static int test_gtod(void)
                 }
         }
 
-        if (vgtod) {
+        if (vsyscall_map_x) {
                 if (ret_vsys == 0) {
                         nerrs += check_gtod(&tv_sys1, &tv_sys2, &tz_sys, "vsyscall", &tv_vsys, &tz_vsys);
                 } else {
@@ -273,7 +272,7 @@ static int test_time(void) {
         t_sys1 = sys_time(&t2_sys1);
         if (vdso_time)
                 t_vdso = vdso_time(&t2_vdso);
-        if (vtime)
+        if (vsyscall_map_x)
                 t_vsys = vtime(&t2_vsys);
         t_sys2 = sys_time(&t2_sys2);
         if (t_sys1 < 0 || t_sys1 != t2_sys1 || t_sys2 < 0 || t_sys2 != t2_sys2) {
@@ -294,7 +293,7 @@ static int test_time(void) {
                 }
         }
 
-        if (vtime) {
+        if (vsyscall_map_x) {
                 if (t_vsys < 0 || t_vsys != t2_vsys) {
                         printf("[FAIL]\tvsyscall failed (ret:%ld output:%ld)\n", t_vsys, t2_vsys);
                         nerrs++;
@@ -330,7 +329,7 @@ static int test_getcpu(int cpu)
         ret_sys = sys_getcpu(&cpu_sys, &node_sys, 0);
         if (vdso_getcpu)
                 ret_vdso = vdso_getcpu(&cpu_vdso, &node_vdso, 0);
-        if (vgetcpu)
+        if (vsyscall_map_x)
                 ret_vsys = vgetcpu(&cpu_vsys, &node_vsys, 0);
 
         if (ret_sys == 0) {
@@ -369,7 +368,7 @@ static int test_getcpu(int cpu)
                 }
         }
 
-        if (vgetcpu) {
+        if (vsyscall_map_x) {
                 if (ret_vsys) {
                         printf("[FAIL]\tvsyscall getcpu() failed\n");
                         nerrs++;
@@ -410,20 +409,88 @@ static int test_vsys_r(void)
                 can_read = false;
         }
 
-        if (can_read && !should_read_vsyscall) {
+        if (can_read && !vsyscall_map_r) {
                 printf("[FAIL]\tWe have read access, but we shouldn't\n");
                 return 1;
-        } else if (!can_read && should_read_vsyscall) {
+        } else if (!can_read && vsyscall_map_r) {
                 printf("[FAIL]\tWe don't have read access, but we should\n");
                 return 1;
+        } else if (can_read) {
+                printf("[OK]\tWe have read access\n");
         } else {
-                printf("[OK]\tgot expected result\n");
+                printf("[OK]\tWe do not have read access: #PF(0x%lx)\n",
+                       segv_err);
         }
 #endif
 
         return 0;
 }
 
+static int test_vsys_x(void)
+{
+#ifdef __x86_64__
+        if (vsyscall_map_x) {
+                /* We already tested this adequately. */
+                return 0;
+        }
+
+        printf("[RUN]\tMake sure that vsyscalls really page fault\n");
+
+        bool can_exec;
+        if (sigsetjmp(jmpbuf, 1) == 0) {
+                vgtod(NULL, NULL);
+                can_exec = true;
+        } else {
+                can_exec = false;
+        }
+
+        if (can_exec) {
+                printf("[FAIL]\tExecuting the vsyscall did not page fault\n");
+                return 1;
+        } else if (segv_err & (1 << 4)) { /* INSTR */
+                printf("[OK]\tExecuting the vsyscall page failed: #PF(0x%lx)\n",
+                       segv_err);
+        } else {
+                printf("[FAILT]\tExecution failed with the wrong error: #PF(0x%lx)\n",
+                       segv_err);
+                return 1;
+        }
+#endif
+
+        return 0;
+}
+
+static int test_process_vm_readv(void)
+{
+#ifdef __x86_64__
+        char buf[4096];
+        struct iovec local, remote;
+        int ret;
+
+        printf("[RUN]\tprocess_vm_readv() from vsyscall page\n");
+
+        local.iov_base = buf;
+        local.iov_len = 4096;
+        remote.iov_base = (void *)0xffffffffff600000;
+        remote.iov_len = 4096;
+        ret = process_vm_readv(getpid(), &local, 1, &remote, 1, 0);
+        if (ret != 4096) {
+                printf("[OK]\tprocess_vm_readv() failed (ret = %d, errno = %d)\n", ret, errno);
+                return 0;
+        }
+
+        if (vsyscall_map_r) {
+                if (!memcmp(buf, (const void *)0xffffffffff600000, 4096)) {
+                        printf("[OK]\tIt worked and read correct data\n");
+                } else {
+                        printf("[FAIL]\tIt worked but returned incorrect data\n");
+                        return 1;
+                }
+        }
+#endif
+
+        return 0;
+}
 
 #ifdef __x86_64__
 #define X86_EFLAGS_TF (1UL << 8)
@@ -455,7 +522,7 @@ static int test_emulation(void)
         time_t tmp;
         bool is_native;
 
-        if (!vtime)
+        if (!vsyscall_map_x)
                 return 0;
 
         printf("[RUN]\tchecking that vsyscalls are emulated\n");
@@ -497,6 +564,9 @@ int main(int argc, char **argv)
 
         sethandler(SIGSEGV, sigsegv, 0);
         nerrs += test_vsys_r();
+        nerrs += test_vsys_x();
+
+        nerrs += test_process_vm_readv();
 
 #ifdef __x86_64__
         nerrs += test_emulation();