211 files changed, 4422 insertions, 1618 deletions
diff --git a/Documentation/core-api/kernel-api.rst b/Documentation/core-api/kernel-api.rst
index ff335f8aeb39..92f30006adae 100644
--- a/Documentation/core-api/kernel-api.rst
+++ b/Documentation/core-api/kernel-api.rst
@@ -136,6 +136,19 @@ Sorting
 .. kernel-doc:: lib/list_sort.c
   :export:
+Text Searching
+--------------
+.. kernel-doc:: lib/textsearch.c
+   :doc: ts_intro
+.. kernel-doc:: lib/textsearch.c
+   :export:
+.. kernel-doc:: include/linux/textsearch.h
+   :functions: textsearch_find textsearch_next \
+               textsearch_get_pattern textsearch_get_pattern_len
 UUID/GUID
 ---------
diff --git a/Documentation/devicetree/bindings/thermal/exynos-thermal.txt b/Documentation/devicetree/bindings/thermal/exynos-thermal.txt
index 1b596fd38dc4..b957acff57aa 100644
--- a/Documentation/devicetree/bindings/thermal/exynos-thermal.txt
+++ b/Documentation/devicetree/bindings/thermal/exynos-thermal.txt
@@ -49,19 +49,6 @@ on the SoC (only first trip points defined in DT will be configured):
 - samsung,exynos5433-tmu: 8
 - samsung,exynos7-tmu: 8
-Following properties are mandatory (depending on SoC):
- samsung,tmu_gain: Gain value for internal TMU operation.
- samsung,tmu_reference_voltage: Value of TMU IP block's reference voltage
- samsung,tmu_noise_cancel_mode: Mode for noise cancellation
- samsung,tmu_efuse_value: Default level of temperature - it is needed when
-                           in factory fusing produced wrong value
- samsung,tmu_min_efuse_value: Minimum temperature fused value
- samsung,tmu_max_efuse_value: Maximum temperature fused value
- samsung,tmu_first_point_trim: First point trimming value
- samsung,tmu_second_point_trim: Second point trimming value
- samsung,tmu_default_temp_offset: Default temperature offset
- samsung,tmu_cal_type: Callibration type
 ** Optional properties:
 - vtmu-supply: This entry is optional and provides the regulator node supplying
@@ -78,7 +65,7 @@ Example 1):
                clocks = <&clock 383>;
                clock-names = "tmu_apbif";
                vtmu-supply = <&tmu_regulator_node>;
-                #include "exynos4412-tmu-sensor-conf.dtsi"
+                #thermal-sensor-cells = <0>;
        };
 Example 2):
@@ -89,7 +76,7 @@ Example 2):
                interrupts = <0 58 0>;
                clocks = <&clock 21>;
                clock-names = "tmu_apbif";
-                #include "exynos5440-tmu-sensor-conf.dtsi"
+                #thermal-sensor-cells = <0>;
        };
 Example 3): (In case of Exynos5420 "with misplaced TRIMINFO register")
@@ -99,7 +86,7 @@ Example 3): (In case of Exynos5420 "with misplaced TRIMINFO register")
                interrupts = <0 184 0>;
                clocks = <&clock 318>, <&clock 318>;
                clock-names = "tmu_apbif", "tmu_triminfo_apbif";
-                #include "exynos4412-tmu-sensor-conf.dtsi"
+                #thermal-sensor-cells = <0>;
        };
        tmu_cpu3: tmu@1006c000 {
@@ -108,7 +95,7 @@ Example 3): (In case of Exynos5420 "with misplaced TRIMINFO register")
                interrupts = <0 185 0>;
                clocks = <&clock 318>, <&clock 319>;
                clock-names = "tmu_apbif", "tmu_triminfo_apbif";
-                #include "exynos4412-tmu-sensor-conf.dtsi"
+                #thermal-sensor-cells = <0>;
        };
        tmu_gpu: tmu@100a0000 {
@@ -117,7 +104,7 @@ Example 3): (In case of Exynos5420 "with misplaced TRIMINFO register")
                interrupts = <0 215 0>;
                clocks = <&clock 319>, <&clock 318>;
                clock-names = "tmu_apbif", "tmu_triminfo_apbif";
-                #include "exynos4412-tmu-sensor-conf.dtsi"
+                #thermal-sensor-cells = <0>;
        };
 Note: For multi-instance tmu each instance should have an alias correctly
diff --git a/Documentation/devicetree/bindings/thermal/thermal.txt b/Documentation/devicetree/bindings/thermal/thermal.txt
index 1719d47a5e2f..cc553f0952c5 100644
--- a/Documentation/devicetree/bindings/thermal/thermal.txt
+++ b/Documentation/devicetree/bindings/thermal/thermal.txt
@@ -55,8 +55,7 @@ of heat dissipation). For example a fan's cooling states correspond to
 the different fan speeds possible. Cooling states are referred to by
 single unsigned integers, where larger numbers mean greater heat
 dissipation. The precise set of cooling states associated with a device
-(as referred to by the cooling-min-level and cooling-max-level
+should be defined in a particular device's binding.
-properties) should be defined in a particular device's binding.
 For more examples of cooling devices, refer to the example sections below.
 Required properties:
@@ -69,15 +68,6 @@ Required properties:
                        See Cooling device maps section below for more details
                        on how consumers refer to cooling devices.
-Optional properties:
- cooling-min-level:    An integer indicating the smallest
-  Type: unsigned        cooling state accepted. Typically 0.
-  Size: one cell
- cooling-max-level:    An integer indicating the largest
-  Type: unsigned        cooling state accepted.
-  Size: one cell
 * Trip points
 The trip node is a node to describe a point in the temperature domain
@@ -226,8 +216,6 @@ cpus {
                        396000  950000
                        198000  850000
                >;
-                cooling-min-level = <0>;
-                cooling-max-level = <3>;
                #cooling-cells = <2>; /* min followed by max */
        };
        ...
@@ -241,8 +229,6 @@ cpus {
         */
        fan0: fan@48 {
                ...
-                cooling-min-level = <0>;
-                cooling-max-level = <9>;
                #cooling-cells = <2>; /* min followed by max */
        };
 };
diff --git a/Documentation/devicetree/bindings/timer/nuvoton,npcm7xx-timer.txt b/Documentation/devicetree/bindings/timer/nuvoton,npcm7xx-timer.txt
new file mode 100644
index 000000000000..ea22dfe485be
--- /dev/null
+++ b/Documentation/devicetree/bindings/timer/nuvoton,npcm7xx-timer.txt
@@ -0,0 +1,21 @@
+Nuvoton NPCM7xx timer
+Nuvoton NPCM7xx have three timer modules, each timer module provides five 24-bit
+timer counters.
+Required properties:
+- compatible      : "nuvoton,npcm750-timer" for Poleg NPCM750.
+- reg             : Offset and length of the register set for the device.
+- interrupts      : Contain the timer interrupt with flags for
+                    falling edge.
+- clocks          : phandle of timer reference clock (usually a 25 MHz clock).
+Example:
+timer@f0008000 {
+    compatible = "nuvoton,npcm750-timer";
+    interrupts = <GIC_SPI 32 IRQ_TYPE_LEVEL_HIGH>;
+    reg = <0xf0008000 0x50>;
+    clocks = <&clk NPCM7XX_CLK_TIMER>;
+};
diff --git a/Documentation/devicetree/bindings/timer/nxp,tpm-timer.txt b/Documentation/devicetree/bindings/timer/nxp,tpm-timer.txt
index b4aa7ddb5b13..f82087b220f4 100644
--- a/Documentation/devicetree/bindings/timer/nxp,tpm-timer.txt
+++ b/Documentation/devicetree/bindings/timer/nxp,tpm-timer.txt
@@ -15,7 +15,7 @@ Required properties:
 - interrupts :  Should be the clock event device interrupt.
 - clocks :      The clocks provided by the SoC to drive the timer, must contain
                an entry for each entry in clock-names.
- clock-names : Must include the following entries: "igp" and "per".
+- clock-names : Must include the following entries: "ipg" and "per".
 Example:
 tpm5: tpm@40260000 {
diff --git a/Documentation/livepatch/shadow-vars.txt b/Documentation/livepatch/shadow-vars.txt
index 89c66634d600..ecc09a7be5dd 100644
--- a/Documentation/livepatch/shadow-vars.txt
+++ b/Documentation/livepatch/shadow-vars.txt
@@ -34,9 +34,13 @@ meta-data and shadow-data:
  - data[] - storage for shadow data
 It is important to note that the klp_shadow_alloc() and
-klp_shadow_get_or_alloc() calls, described below, store a *copy* of the
+klp_shadow_get_or_alloc() are zeroing the variable by default.
-data that the functions are provided.  Callers should provide whatever
+They also allow to call a custom constructor function when a non-zero
-mutual exclusion is required of the shadow data.
+value is needed. Callers should provide whatever mutual exclusion
+is required.
+Note that the constructor is called under klp_shadow_lock spinlock. It allows
+to do actions that can be done only once when a new variable is allocated.
 * klp_shadow_get() - retrieve a shadow variable data pointer
  - search hashtable for <obj, id> pair
@@ -47,7 +51,7 @@ mutual exclusion is required of the shadow data.
    - WARN and return NULL
  - if <obj, id> doesn't already exist
    - allocate a new shadow variable
-    - copy data into the new shadow variable
+    - initialize the variable using a custom constructor and data when provided
    - add <obj, id> to the global hashtable
 * klp_shadow_get_or_alloc() - get existing or alloc a new shadow variable
@@ -56,16 +60,20 @@ mutual exclusion is required of the shadow data.
    - return existing shadow variable
  - if <obj, id> doesn't already exist
    - allocate a new shadow variable
-    - copy data into the new shadow variable
+    - initialize the variable using a custom constructor and data when provided
    - add <obj, id> pair to the global hashtable
 * klp_shadow_free() - detach and free a <obj, id> shadow variable
  - find and remove a <obj, id> reference from global hashtable
-    - if found, free shadow variable
+    - if found
+      - call destructor function if defined
+      - free shadow variable
 * klp_shadow_free_all() - detach and free all <*, id> shadow variables
  - find and remove any <*, id> references from global hashtable
-    - if found, free shadow variable
+    - if found
+      - call destructor function if defined
+      - free shadow variable
 2. Use cases
@@ -107,7 +115,8 @@ struct sta_info *sta_info_alloc(struct ieee80211_sub_if_data *sdata,
        sta = kzalloc(sizeof(*sta) + hw->sta_data_size, gfp);
        /* Attach a corresponding shadow variable, then initialize it */
-        ps_lock = klp_shadow_alloc(sta, PS_LOCK, NULL, sizeof(*ps_lock), gfp);
+        ps_lock = klp_shadow_alloc(sta, PS_LOCK, sizeof(*ps_lock), gfp,
+                                   NULL, NULL);
        if (!ps_lock)
                goto shadow_fail;
        spin_lock_init(ps_lock);
@@ -131,7 +140,7 @@ variable:
 void sta_info_free(struct ieee80211_local *local, struct sta_info *sta)
 {
-        klp_shadow_free(sta, PS_LOCK);
+        klp_shadow_free(sta, PS_LOCK, NULL);
        kfree(sta);
        ...
@@ -148,16 +157,24 @@ shadow variables to parents already in-flight.
 For commit 1d147bfa6429, a good spot to allocate a shadow spinlock is
 inside ieee80211_sta_ps_deliver_wakeup():
+int ps_lock_shadow_ctor(void *obj, void *shadow_data, void *ctor_data)
+{
+        spinlock_t *lock = shadow_data;
+        spin_lock_init(lock);
+        return 0;
+}
 #define PS_LOCK 1
 void ieee80211_sta_ps_deliver_wakeup(struct sta_info *sta)
 {
-        DEFINE_SPINLOCK(ps_lock_fallback);
        spinlock_t *ps_lock;
        /* sync with ieee80211_tx_h_unicast_ps_buf */
        ps_lock = klp_shadow_get_or_alloc(sta, PS_LOCK,
-                        &ps_lock_fallback, sizeof(ps_lock_fallback),
+                        sizeof(*ps_lock), GFP_ATOMIC,
-                        GFP_ATOMIC);
+                        ps_lock_shadow_ctor, NULL);
        if (ps_lock)
                spin_lock(ps_lock);
        ...
diff --git a/Documentation/networking/filter.txt b/Documentation/networking/filter.txt
index a4508ec1816b..fd55c7de9991 100644
--- a/Documentation/networking/filter.txt
+++ b/Documentation/networking/filter.txt
@@ -169,7 +169,7 @@ access to BPF code as well.
 BPF engine and instruction set
 ------------------------------
-Under tools/net/ there's a small helper tool called bpf_asm which can
+Under tools/bpf/ there's a small helper tool called bpf_asm which can
 be used to write low-level filters for example scenarios mentioned in the
 previous section. Asm-like syntax mentioned here has been implemented in
 bpf_asm and will be used for further explanations (instead of dealing with
@@ -359,7 +359,7 @@ $ ./bpf_asm -c foo
 In particular, as usage with xt_bpf or cls_bpf can result in more complex BPF
 filters that might not be obvious at first, it's good to test filters before
 attaching to a live system. For that purpose, there's a small tool called
-bpf_dbg under tools/net/ in the kernel source directory. This debugger allows
+bpf_dbg under tools/bpf/ in the kernel source directory. This debugger allows
 for testing BPF filters against given pcap files, single stepping through the
 BPF code on the pcap's packets and to do BPF machine register dumps.
@@ -483,7 +483,7 @@ Example output from dmesg:
 [ 3389.935851] JIT code: 00000030: 00 e8 28 94 ff e0 83 f8 01 75 07 b8 ff ff 00 00
 [ 3389.935852] JIT code: 00000040: eb 02 31 c0 c9 c3
-In the kernel source tree under tools/net/, there's bpf_jit_disasm for
+In the kernel source tree under tools/bpf/, there's bpf_jit_disasm for
 generating disassembly out of the kernel log's hexdump:
 # ./bpf_jit_disasm
diff --git a/Documentation/networking/ip-sysctl.txt b/Documentation/networking/ip-sysctl.txt
index 5dc1a040a2f1..b583a73cf95f 100644
--- a/Documentation/networking/ip-sysctl.txt
+++ b/Documentation/networking/ip-sysctl.txt
@@ -1390,26 +1390,26 @@ mld_qrv - INTEGER
        Default: 2 (as specified by RFC3810 9.1)
        Minimum: 1 (as specified by RFC6636 4.5)
-max_dst_opts_cnt - INTEGER
+max_dst_opts_number - INTEGER
        Maximum number of non-padding TLVs allowed in a Destination
        options extension header. If this value is less than zero
        then unknown options are disallowed and the number of known
        TLVs allowed is the absolute value of this number.
        Default: 8
-max_hbh_opts_cnt - INTEGER
+max_hbh_opts_number - INTEGER
        Maximum number of non-padding TLVs allowed in a Hop-by-Hop
        options extension header. If this value is less than zero
        then unknown options are disallowed and the number of known
        TLVs allowed is the absolute value of this number.
        Default: 8
-max dst_opts_len - INTEGER
+max_dst_opts_length - INTEGER
        Maximum length allowed for a Destination options extension
        header.
        Default: INT_MAX (unlimited)
-max hbh_opts_len - INTEGER
+max_hbh_length - INTEGER
        Maximum length allowed for a Hop-by-Hop options extension
        header.
        Default: INT_MAX (unlimited)
diff --git a/MAINTAINERS b/MAINTAINERS
index 0a1410d5a621..92be777d060a 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -1373,7 +1373,8 @@ F:	arch/arm/mach-ebsa110/
 F:      drivers/net/ethernet/amd/am79c961a.*
 ARM/ENERGY MICRO (SILICON LABS) EFM32 SUPPORT
-M:      Uwe Kleine-König <kernel@pengutronix.de>
+M:      Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+R:      Pengutronix Kernel Team <kernel@pengutronix.de>
 L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
 S:      Maintained
 N:      efm32
@@ -1401,7 +1402,8 @@ F:	arch/arm/mach-footbridge/
 ARM/FREESCALE IMX / MXC ARM ARCHITECTURE
 M:      Shawn Guo <shawnguo@kernel.org>
-M:      Sascha Hauer <kernel@pengutronix.de>
+M:      Sascha Hauer <s.hauer@pengutronix.de>
+R:      Pengutronix Kernel Team <kernel@pengutronix.de>
 R:      Fabio Estevam <fabio.estevam@nxp.com>
 L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
 S:      Maintained
@@ -1416,7 +1418,8 @@ F:	include/soc/imx/
 ARM/FREESCALE VYBRID ARM ARCHITECTURE
 M:      Shawn Guo <shawnguo@kernel.org>
-M:      Sascha Hauer <kernel@pengutronix.de>
+M:      Sascha Hauer <s.hauer@pengutronix.de>
+R:      Pengutronix Kernel Team <kernel@pengutronix.de>
 R:      Stefan Agner <stefan@agner.ch>
 L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
 S:      Maintained
@@ -4245,6 +4248,9 @@ F:	include/trace/events/fs_dax.h
 DEVICE DIRECT ACCESS (DAX)
 M:      Dan Williams <dan.j.williams@intel.com>
+M:      Dave Jiang <dave.jiang@intel.com>
+M:      Ross Zwisler <ross.zwisler@linux.intel.com>
+M:      Vishal Verma <vishal.l.verma@intel.com>
 L:      linux-nvdimm@lists.01.org
 S:      Supported
 F:      drivers/dax/
@@ -5652,7 +5658,8 @@ F:	drivers/net/ethernet/freescale/fec.h
 F:      Documentation/devicetree/bindings/net/fsl-fec.txt
 FREESCALE IMX / MXC FRAMEBUFFER DRIVER
-M:      Sascha Hauer <kernel@pengutronix.de>
+M:      Sascha Hauer <s.hauer@pengutronix.de>
+R:      Pengutronix Kernel Team <kernel@pengutronix.de>
 L:      linux-fbdev@vger.kernel.org
 L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
 S:      Maintained
@@ -5784,6 +5791,14 @@ F:	fs/crypto/
 F:      include/linux/fscrypt*.h
 F:      Documentation/filesystems/fscrypt.rst
+FSNOTIFY: FILESYSTEM NOTIFICATION INFRASTRUCTURE
+M:      Jan Kara <jack@suse.cz>
+R:      Amir Goldstein <amir73il@gmail.com>
+L:      linux-fsdevel@vger.kernel.org
+S:      Maintained
+F:      fs/notify/
+F:      include/linux/fsnotify*.h
 FUJITSU LAPTOP EXTRAS
 M:      Jonathan Woithe <jwoithe@just42.net>
 L:      platform-driver-x86@vger.kernel.org
@@ -6256,7 +6271,7 @@ S:	Odd Fixes
 F:      drivers/media/usb/hdpvr/
 HEWLETT PACKARD ENTERPRISE ILO NMI WATCHDOG DRIVER
-M:      Jimmy Vance <jimmy.vance@hpe.com>
+M:      Jerry Hoemann <jerry.hoemann@hpe.com>
 S:      Supported
 F:      Documentation/watchdog/hpwdt.txt
 F:      drivers/watchdog/hpwdt.c
@@ -8048,6 +8063,9 @@ F:	tools/lib/lockdep/
 LIBNVDIMM BLK: MMIO-APERTURE DRIVER
 M:      Ross Zwisler <ross.zwisler@linux.intel.com>
+M:      Dan Williams <dan.j.williams@intel.com>
+M:      Vishal Verma <vishal.l.verma@intel.com>
+M:      Dave Jiang <dave.jiang@intel.com>
 L:      linux-nvdimm@lists.01.org
 Q:      https://patchwork.kernel.org/project/linux-nvdimm/list/
 S:      Supported
@@ -8056,6 +8074,9 @@ F:	drivers/nvdimm/region_devs.c
 LIBNVDIMM BTT: BLOCK TRANSLATION TABLE
 M:      Vishal Verma <vishal.l.verma@intel.com>
+M:      Dan Williams <dan.j.williams@intel.com>
+M:      Ross Zwisler <ross.zwisler@linux.intel.com>
+M:      Dave Jiang <dave.jiang@intel.com>
 L:      linux-nvdimm@lists.01.org
 Q:      https://patchwork.kernel.org/project/linux-nvdimm/list/
 S:      Supported
@@ -8063,6 +8084,9 @@ F:	drivers/nvdimm/btt*
 LIBNVDIMM PMEM: PERSISTENT MEMORY DRIVER
 M:      Ross Zwisler <ross.zwisler@linux.intel.com>
+M:      Dan Williams <dan.j.williams@intel.com>
+M:      Vishal Verma <vishal.l.verma@intel.com>
+M:      Dave Jiang <dave.jiang@intel.com>
 L:      linux-nvdimm@lists.01.org
 Q:      https://patchwork.kernel.org/project/linux-nvdimm/list/
 S:      Supported
@@ -8078,6 +8102,9 @@ F:	Documentation/devicetree/bindings/pmem/pmem-region.txt
 LIBNVDIMM: NON-VOLATILE MEMORY DEVICE SUBSYSTEM
 M:      Dan Williams <dan.j.williams@intel.com>
+M:      Ross Zwisler <ross.zwisler@linux.intel.com>
+M:      Vishal Verma <vishal.l.verma@intel.com>
+M:      Dave Jiang <dave.jiang@intel.com>
 L:      linux-nvdimm@lists.01.org
 Q:      https://patchwork.kernel.org/project/linux-nvdimm/list/
 T:      git git://git.kernel.org/pub/scm/linux/kernel/git/nvdimm/nvdimm.git
@@ -9765,6 +9792,7 @@ F:	include/uapi/linux/net_namespace.h
 F:      tools/testing/selftests/net/
 F:      lib/net_utils.c
 F:      lib/random32.c
+F:      Documentation/networking/
 NETWORKING [IPSEC]
 M:      Steffen Klassert <steffen.klassert@secunet.com>
@@ -12816,7 +12844,8 @@ F:	include/linux/siphash.h
 SIOX
 M:      Gavin Schenk <g.schenk@eckelmann.de>
-M:      Uwe Kleine-König <kernel@pengutronix.de>
+M:      Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+R:      Pengutronix Kernel Team <kernel@pengutronix.de>
 S:      Supported
 F:      drivers/siox/*
 F:      include/trace/events/siox.h
diff --git a/arch/arm64/kernel/traps.c b/arch/arm64/kernel/traps.c
index ba964da31a25..1cb2749a72bf 100644
--- a/arch/arm64/kernel/traps.c
+++ b/arch/arm64/kernel/traps.c
@@ -366,7 +366,7 @@ void force_signal_inject(int signal, int code, unsigned long address)
        }
        /* Force signals we don't understand to SIGKILL */
-        if (WARN_ON(signal != SIGKILL ||
+        if (WARN_ON(signal != SIGKILL &&
                    siginfo_layout(signal, code) != SIL_FAULT)) {
                signal = SIGKILL;
        }
diff --git a/arch/arm64/mm/kasan_init.c b/arch/arm64/mm/kasan_init.c
index dabfc1ecda3d..12145874c02b 100644
--- a/arch/arm64/mm/kasan_init.c
+++ b/arch/arm64/mm/kasan_init.c
@@ -204,7 +204,7 @@ void __init kasan_init(void)
        clear_pgds(KASAN_SHADOW_START, KASAN_SHADOW_END);
        kasan_map_populate(kimg_shadow_start, kimg_shadow_end,
-                           pfn_to_nid(virt_to_pfn(lm_alias(_text))));
+                           early_pfn_to_nid(virt_to_pfn(lm_alias(_text))));
        kasan_populate_zero_shadow((void *)KASAN_SHADOW_START,
                                   (void *)mod_shadow_start);
@@ -224,7 +224,7 @@ void __init kasan_init(void)
                kasan_map_populate((unsigned long)kasan_mem_to_shadow(start),
                                   (unsigned long)kasan_mem_to_shadow(end),
-                                   pfn_to_nid(virt_to_pfn(start)));
+                                   early_pfn_to_nid(virt_to_pfn(start)));
        }
        /*
diff --git a/arch/mips/boot/dts/img/boston.dts b/arch/mips/boot/dts/img/boston.dts
index 1bd105428f61..65af3f6ba81c 100644
--- a/arch/mips/boot/dts/img/boston.dts
+++ b/arch/mips/boot/dts/img/boston.dts
@@ -51,6 +51,8 @@
                ranges = <0x02000000 0 0x40000000
                          0x40000000 0 0x40000000>;
+                bus-range = <0x00 0xff>;
                interrupt-map-mask = <0 0 0 7>;
                interrupt-map = <0 0 0 1 &pci0_intc 1>,
                                <0 0 0 2 &pci0_intc 2>,
@@ -79,6 +81,8 @@
                ranges = <0x02000000 0 0x20000000
                          0x20000000 0 0x20000000>;
+                bus-range = <0x00 0xff>;
                interrupt-map-mask = <0 0 0 7>;
                interrupt-map = <0 0 0 1 &pci1_intc 1>,
                                <0 0 0 2 &pci1_intc 2>,
@@ -107,6 +111,8 @@
                ranges = <0x02000000 0 0x16000000
                          0x16000000 0 0x100000>;
+                bus-range = <0x00 0xff>;
                interrupt-map-mask = <0 0 0 7>;
                interrupt-map = <0 0 0 1 &pci2_intc 1>,
                                <0 0 0 2 &pci2_intc 2>,
diff --git a/arch/mips/include/asm/io.h b/arch/mips/include/asm/io.h
index 0cbf3af37eca..a7d0b836f2f7 100644
--- a/arch/mips/include/asm/io.h
+++ b/arch/mips/include/asm/io.h
@@ -307,7 +307,7 @@ static inline void iounmap(const volatile void __iomem *addr)
 #if defined(CONFIG_CPU_CAVIUM_OCTEON) || defined(CONFIG_LOONGSON3_ENHANCEMENT)
 #define war_io_reorder_wmb()            wmb()
 #else
-#define war_io_reorder_wmb()            do { } while (0)
+#define war_io_reorder_wmb()            barrier()
 #endif
 #define __BUILD_MEMORY_SINGLE(pfx, bwlq, type, irq)                     \
@@ -377,6 +377,8 @@ static inline type pfx##read##bwlq(const volatile void __iomem *mem)	\
                BUG();                                                  \
        }                                                               \
                                                                        \
+        /* prevent prefetching of coherent DMA data prematurely */      \
+        rmb();                                                          \
        return pfx##ioswab##bwlq(__mem, __val);                         \
 }
diff --git a/arch/mips/include/asm/uaccess.h b/arch/mips/include/asm/uaccess.h
index b71306947290..06629011a434 100644
--- a/arch/mips/include/asm/uaccess.h
+++ b/arch/mips/include/asm/uaccess.h
@@ -654,6 +654,13 @@ __clear_user(void __user *addr, __kernel_size_t size)
 {
        __kernel_size_t res;
+#ifdef CONFIG_CPU_MICROMIPS
+/* micromips memset / bzero also clobbers t7 & t8 */
+#define bzero_clobbers "$4", "$5", "$6", __UA_t0, __UA_t1, "$15", "$24", "$31"
+#else
+#define bzero_clobbers "$4", "$5", "$6", __UA_t0, __UA_t1, "$31"
+#endif /* CONFIG_CPU_MICROMIPS */
        if (eva_kernel_access()) {
                __asm__ __volatile__(
                        "move\t$4, %1\n\t"
@@ -663,7 +670,7 @@ __clear_user(void __user *addr, __kernel_size_t size)
                        "move\t%0, $6"
                        : "=r" (res)
                        : "r" (addr), "r" (size)
-                        : "$4", "$5", "$6", __UA_t0, __UA_t1, "$31");
+                        : bzero_clobbers);
        } else {
                might_fault();
                __asm__ __volatile__(
@@ -674,7 +681,7 @@ __clear_user(void __user *addr, __kernel_size_t size)
                        "move\t%0, $6"
                        : "=r" (res)
                        : "r" (addr), "r" (size)
-                        : "$4", "$5", "$6", __UA_t0, __UA_t1, "$31");
+                        : bzero_clobbers);
        }
        return res;
diff --git a/arch/mips/lib/memset.S b/arch/mips/lib/memset.S
index a1456664d6c2..f7327979a8f8 100644
--- a/arch/mips/lib/memset.S
+++ b/arch/mips/lib/memset.S
@@ -219,7 +219,7 @@
 1:      PTR_ADDIU       a0, 1                   /* fill bytewise */
        R10KCBARRIER(0(ra))
        bne             t1, a0, 1b
-        sb              a1, -1(a0)
+         EX(sb, a1, -1(a0), .Lsmall_fixup\@)
 2:      jr              ra                      /* done */
        move            a2, zero
@@ -252,13 +252,18 @@
        PTR_L           t0, TI_TASK($28)
        andi            a2, STORMASK
        LONG_L          t0, THREAD_BUADDR(t0)
-        LONG_ADDU       a2, t1
+        LONG_ADDU       a2, a0
        jr              ra
        LONG_SUBU       a2, t0
 .Llast_fixup\@:
        jr              ra
-        andi            v1, a2, STORMASK
+         nop
+.Lsmall_fixup\@:
+        PTR_SUBU        a2, t1, a0
+        jr              ra
+         PTR_ADDIU      a2, 1
        .endm
diff --git a/arch/parisc/kernel/Makefile b/arch/parisc/kernel/Makefile
index eafd06ab59ef..e5de34d00b1a 100644
--- a/arch/parisc/kernel/Makefile
+++ b/arch/parisc/kernel/Makefile
@@ -23,7 +23,7 @@ obj-$(CONFIG_SMP)	+= smp.o
 obj-$(CONFIG_PA11)      += pci-dma.o
 obj-$(CONFIG_PCI)       += pci.o
 obj-$(CONFIG_MODULES)   += module.o
-obj-$(CONFIG_64BIT)     += binfmt_elf32.o sys_parisc32.o signal32.o
+obj-$(CONFIG_64BIT)     += sys_parisc32.o signal32.o
 obj-$(CONFIG_STACKTRACE)+= stacktrace.o
 obj-$(CONFIG_AUDIT)     += audit.o
 obj64-$(CONFIG_AUDIT)   += compat_audit.o
diff --git a/arch/powerpc/kernel/eeh_pe.c b/arch/powerpc/kernel/eeh_pe.c
index 2d4956e97aa9..ee5a67d57aab 100644
--- a/arch/powerpc/kernel/eeh_pe.c
+++ b/arch/powerpc/kernel/eeh_pe.c
@@ -807,7 +807,8 @@ static void eeh_restore_bridge_bars(struct eeh_dev *edev)
        eeh_ops->write_config(pdn, 15*4, 4, edev->config_space[15]);
        /* PCI Command: 0x4 */
-        eeh_ops->write_config(pdn, PCI_COMMAND, 4, edev->config_space[1]);
+        eeh_ops->write_config(pdn, PCI_COMMAND, 4, edev->config_space[1] |
+                              PCI_COMMAND_MEMORY | PCI_COMMAND_MASTER);
        /* Check the PCIe link is ready */
        eeh_bridge_check_link(edev);
diff --git a/arch/powerpc/kernel/idle_book3s.S b/arch/powerpc/kernel/idle_book3s.S
index 79d005445c6c..e734f6e45abc 100644
--- a/arch/powerpc/kernel/idle_book3s.S
+++ b/arch/powerpc/kernel/idle_book3s.S
@@ -553,12 +553,12 @@ ALT_FTR_SECTION_END_IFSET(CPU_FTR_ARCH_300)
 #ifdef CONFIG_KVM_BOOK3S_HV_POSSIBLE
        lbz     r0,HSTATE_HWTHREAD_STATE(r13)
        cmpwi   r0,KVM_HWTHREAD_IN_KERNEL
-        beq     1f
+        beq     0f
        li      r0,KVM_HWTHREAD_IN_KERNEL
        stb     r0,HSTATE_HWTHREAD_STATE(r13)
        /* Order setting hwthread_state vs. testing hwthread_req */
        sync
-        lbz     r0,HSTATE_HWTHREAD_REQ(r13)
+0:      lbz     r0,HSTATE_HWTHREAD_REQ(r13)
        cmpwi   r0,0
        beq     1f
        b       kvm_start_guest
diff --git a/arch/powerpc/kernel/setup_64.c b/arch/powerpc/kernel/setup_64.c
index 44c30dd38067..b78f142a4148 100644
--- a/arch/powerpc/kernel/setup_64.c
+++ b/arch/powerpc/kernel/setup_64.c
@@ -890,6 +890,17 @@ static void __ref init_fallback_flush(void)
                return;
        l1d_size = ppc64_caches.l1d.size;
+        /*
+         * If there is no d-cache-size property in the device tree, l1d_size
+         * could be zero. That leads to the loop in the asm wrapping around to
+         * 2^64-1, and then walking off the end of the fallback area and
+         * eventually causing a page fault which is fatal. Just default to
+         * something vaguely sane.
+         */
+        if (!l1d_size)
+                l1d_size = (64 * 1024);
        limit = min(ppc64_bolted_size(), ppc64_rma_size);
        /*
diff --git a/arch/powerpc/lib/feature-fixups.c b/arch/powerpc/lib/feature-fixups.c
index 35f80ab7cbd8..288fe4f0db4e 100644
--- a/arch/powerpc/lib/feature-fixups.c
+++ b/arch/powerpc/lib/feature-fixups.c
@@ -55,7 +55,7 @@ static int patch_alt_instruction(unsigned int *src, unsigned int *dest,
                unsigned int *target = (unsigned int *)branch_target(src);
                /* Branch within the section doesn't need translating */
-                if (target < alt_start || target >= alt_end) {
+                if (target < alt_start || target > alt_end) {
                        instr = translate_branch(dest, src);
                        if (!instr)
                                return 1;
diff --git a/arch/powerpc/platforms/cell/spufs/sched.c b/arch/powerpc/platforms/cell/spufs/sched.c
index 9033c8194eda..ccc421503363 100644
--- a/arch/powerpc/platforms/cell/spufs/sched.c
+++ b/arch/powerpc/platforms/cell/spufs/sched.c
@@ -1093,7 +1093,7 @@ static int show_spu_loadavg(struct seq_file *s, void *private)
                LOAD_INT(c), LOAD_FRAC(c),
                count_active_contexts(),
                atomic_read(&nr_spu_contexts),
-                idr_get_cursor(&task_active_pid_ns(current)->idr));
+                idr_get_cursor(&task_active_pid_ns(current)->idr) - 1);
        return 0;
 }
diff --git a/arch/powerpc/sysdev/xive/native.c b/arch/powerpc/sysdev/xive/native.c
index d22aeb0b69e1..b48454be5b98 100644
--- a/arch/powerpc/sysdev/xive/native.c
+++ b/arch/powerpc/sysdev/xive/native.c
@@ -389,6 +389,10 @@ static void xive_native_setup_cpu(unsigned int cpu, struct xive_cpu *xc)
        if (xive_pool_vps == XIVE_INVALID_VP)
                return;
+        /* Check if pool VP already active, if it is, pull it */
+        if (in_be32(xive_tima + TM_QW2_HV_POOL + TM_WORD2) & TM_QW2W2_VP)
+                in_be64(xive_tima + TM_SPC_PULL_POOL_CTX);
        /* Enable the pool VP */
        vp = xive_pool_vps + cpu;
        pr_debug("CPU %d setting up pool VP 0x%x\n", cpu, vp);
diff --git a/arch/s390/Kbuild b/arch/s390/Kbuild
index 9fdff3fe1a42..e63940bb57cd 100644
--- a/arch/s390/Kbuild
+++ b/arch/s390/Kbuild
@@ -8,3 +8,4 @@ obj-$(CONFIG_APPLDATA_BASE)	+= appldata/
 obj-y                           += net/
 obj-$(CONFIG_PCI)               += pci/
 obj-$(CONFIG_NUMA)              += numa/
+obj-$(CONFIG_ARCH_HAS_KEXEC_PURGATORY) += purgatory/
diff --git a/arch/s390/Kconfig b/arch/s390/Kconfig
index 32a0d5b958bf..199ac3e4da1d 100644
--- a/arch/s390/Kconfig
+++ b/arch/s390/Kconfig
@@ -47,10 +47,6 @@ config PGSTE
 config ARCH_SUPPORTS_DEBUG_PAGEALLOC
        def_bool y
-config KEXEC
-        def_bool y
-        select KEXEC_CORE
 config AUDIT_ARCH
        def_bool y
@@ -290,12 +286,12 @@ config MARCH_Z13
          older machines.
 config MARCH_Z14
-        bool "IBM z14"
+        bool "IBM z14 ZR1 and z14"
        select HAVE_MARCH_Z14_FEATURES
        help
-          Select this to enable optimizations for IBM z14 (3906 series).
+          Select this to enable optimizations for IBM z14 ZR1 and z14 (3907
-          The kernel will be slightly faster but will not work on older
+          and 3906 series). The kernel will be slightly faster but will not
-          machines.
+          work on older machines.
 endchoice
@@ -525,6 +521,26 @@ source kernel/Kconfig.preempt
 source kernel/Kconfig.hz
+config KEXEC
+        def_bool y
+        select KEXEC_CORE
+config KEXEC_FILE
+        bool "kexec file based system call"
+        select KEXEC_CORE
+        select BUILD_BIN2C
+        depends on CRYPTO
+        depends on CRYPTO_SHA256
+        depends on CRYPTO_SHA256_S390
+        help
+          Enable the kexec file based system call. In contrast to the normal
+          kexec system call this system call takes file descriptors for the
+          kernel and initramfs as arguments.
+config ARCH_HAS_KEXEC_PURGATORY
+        def_bool y
+        depends on KEXEC_FILE
 config ARCH_RANDOM
        def_bool y
        prompt "s390 architectural random number generation API"
diff --git a/arch/s390/boot/Makefile b/arch/s390/boot/Makefile
index da9dad35c28e..d1fa37fcce83 100644
--- a/arch/s390/boot/Makefile
+++ b/arch/s390/boot/Makefile
@@ -3,12 +3,6 @@
 # Makefile for the linux s390-specific parts of the memory manager.
 #
-COMPILE_VERSION := __linux_compile_version_id__`hostname |  \
-                        tr -c '[0-9A-Za-z]' '_'`__`date | \
-                        tr -c '[0-9A-Za-z]' '_'`_t
-ccflags-y  := -DCOMPILE_VERSION=$(COMPILE_VERSION) -gstabs -I.
 targets := image
 targets += bzImage
 subdir- := compressed
diff --git a/arch/s390/boot/compressed/.gitignore b/arch/s390/boot/compressed/.gitignore
index ae06b9b4c02f..2088cc140629 100644
--- a/arch/s390/boot/compressed/.gitignore
+++ b/arch/s390/boot/compressed/.gitignore
@@ -1,3 +1,4 @@
 sizes.h
 vmlinux
 vmlinux.lds
+vmlinux.bin.full
diff --git a/arch/s390/configs/default_defconfig b/arch/s390/configs/debug_defconfig
index 5af8458951cf..6176fe9795ca 100644
--- a/arch/s390/configs/default_defconfig
+++ b/arch/s390/configs/debug_defconfig
@@ -24,13 +24,13 @@ CONFIG_CPUSETS=y
 CONFIG_CGROUP_DEVICE=y
 CONFIG_CGROUP_CPUACCT=y
 CONFIG_CGROUP_PERF=y
-CONFIG_CHECKPOINT_RESTORE=y
 CONFIG_NAMESPACES=y
 CONFIG_USER_NS=y
 CONFIG_SCHED_AUTOGROUP=y
 CONFIG_BLK_DEV_INITRD=y
 CONFIG_EXPERT=y
 # CONFIG_SYSFS_SYSCALL is not set
+CONFIG_CHECKPOINT_RESTORE=y
 CONFIG_BPF_SYSCALL=y
 CONFIG_USERFAULTFD=y
 # CONFIG_COMPAT_BRK is not set
@@ -59,10 +59,11 @@ CONFIG_CFQ_GROUP_IOSCHED=y
 CONFIG_DEFAULT_DEADLINE=y
 CONFIG_LIVEPATCH=y
 CONFIG_TUNE_ZEC12=y
-CONFIG_NR_CPUS=256
+CONFIG_NR_CPUS=512
 CONFIG_NUMA=y
 CONFIG_PREEMPT=y
 CONFIG_HZ_100=y
+CONFIG_KEXEC_FILE=y
 CONFIG_MEMORY_HOTPLUG=y
 CONFIG_MEMORY_HOTREMOVE=y
 CONFIG_KSM=y
@@ -305,7 +306,6 @@ CONFIG_IP6_NF_SECURITY=m
 CONFIG_IP6_NF_NAT=m
 CONFIG_IP6_NF_TARGET_MASQUERADE=m
 CONFIG_NF_TABLES_BRIDGE=m
-CONFIG_NET_SCTPPROBE=m
 CONFIG_RDS=m
 CONFIG_RDS_RDMA=m
 CONFIG_RDS_TCP=m
@@ -364,11 +364,11 @@ CONFIG_NET_ACT_SIMP=m
 CONFIG_NET_ACT_SKBEDIT=m
 CONFIG_NET_ACT_CSUM=m
 CONFIG_DNS_RESOLVER=y
+CONFIG_OPENVSWITCH=m
 CONFIG_NETLINK_DIAG=m
 CONFIG_CGROUP_NET_PRIO=y
 CONFIG_BPF_JIT=y
 CONFIG_NET_PKTGEN=m
-CONFIG_NET_TCPPROBE=m
 CONFIG_DEVTMPFS=y
 CONFIG_DMA_CMA=y
 CONFIG_CMA_SIZE_MBYTES=0
@@ -380,9 +380,9 @@ CONFIG_BLK_DEV_DRBD=m
 CONFIG_BLK_DEV_NBD=m
 CONFIG_BLK_DEV_RAM=y
 CONFIG_BLK_DEV_RAM_SIZE=32768
-CONFIG_BLK_DEV_RAM_DAX=y
 CONFIG_VIRTIO_BLK=y
 CONFIG_BLK_DEV_RBD=m
+CONFIG_BLK_DEV_NVME=m
 CONFIG_ENCLOSURE_SERVICES=m
 CONFIG_GENWQE=m
 CONFIG_RAID_ATTRS=m
@@ -461,6 +461,7 @@ CONFIG_PPTP=m
 CONFIG_PPPOL2TP=m
 CONFIG_PPP_ASYNC=m
 CONFIG_PPP_SYNC_TTY=m
+CONFIG_INPUT_EVDEV=y
 # CONFIG_INPUT_KEYBOARD is not set
 # CONFIG_INPUT_MOUSE is not set
 # CONFIG_SERIO is not set
@@ -474,6 +475,9 @@ CONFIG_WATCHDOG=y
 CONFIG_WATCHDOG_NOWAYOUT=y
 CONFIG_SOFT_WATCHDOG=m
 CONFIG_DIAG288_WATCHDOG=m
+CONFIG_DRM=y
+CONFIG_DRM_VIRTIO_GPU=y
+CONFIG_FRAMEBUFFER_CONSOLE=y
 # CONFIG_HID is not set
 # CONFIG_USB_SUPPORT is not set
 CONFIG_INFINIBAND=m
@@ -482,7 +486,9 @@ CONFIG_MLX4_INFINIBAND=m
 CONFIG_MLX5_INFINIBAND=m
 CONFIG_VFIO=m
 CONFIG_VFIO_PCI=m
+CONFIG_VIRTIO_PCI=m
 CONFIG_VIRTIO_BALLOON=m
+CONFIG_VIRTIO_INPUT=y
 CONFIG_EXT4_FS=y
 CONFIG_EXT4_FS_POSIX_ACL=y
 CONFIG_EXT4_FS_SECURITY=y
@@ -641,6 +647,8 @@ CONFIG_ATOMIC64_SELFTEST=y
 CONFIG_TEST_BPF=m
 CONFIG_BUG_ON_DATA_CORRUPTION=y
 CONFIG_S390_PTDUMP=y
+CONFIG_PERSISTENT_KEYRINGS=y
+CONFIG_BIG_KEYS=y
 CONFIG_ENCRYPTED_KEYS=m
 CONFIG_SECURITY=y
 CONFIG_SECURITY_NETWORK=y
@@ -649,17 +657,20 @@ CONFIG_SECURITY_SELINUX=y
 CONFIG_SECURITY_SELINUX_BOOTPARAM=y
 CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE=0
 CONFIG_SECURITY_SELINUX_DISABLE=y
+CONFIG_INTEGRITY_SIGNATURE=y
+CONFIG_INTEGRITY_ASYMMETRIC_KEYS=y
 CONFIG_IMA=y
+CONFIG_IMA_DEFAULT_HASH_SHA256=y
+CONFIG_IMA_WRITE_POLICY=y
 CONFIG_IMA_APPRAISE=y
-CONFIG_CRYPTO_RSA=m
 CONFIG_CRYPTO_DH=m
 CONFIG_CRYPTO_ECDH=m
 CONFIG_CRYPTO_USER=m
+# CONFIG_CRYPTO_MANAGER_DISABLE_TESTS is not set
 CONFIG_CRYPTO_PCRYPT=m
 CONFIG_CRYPTO_CRYPTD=m
 CONFIG_CRYPTO_MCRYPTD=m
 CONFIG_CRYPTO_TEST=m
-CONFIG_CRYPTO_GCM=m
 CONFIG_CRYPTO_CHACHA20POLY1305=m
 CONFIG_CRYPTO_LRW=m
 CONFIG_CRYPTO_PCBC=m
@@ -707,9 +718,8 @@ CONFIG_CRYPTO_DES_S390=m
 CONFIG_CRYPTO_AES_S390=m
 CONFIG_CRYPTO_GHASH_S390=m
 CONFIG_CRYPTO_CRC32_S390=y
-CONFIG_ASYMMETRIC_KEY_TYPE=y
+CONFIG_PKCS7_MESSAGE_PARSER=y
-CONFIG_ASYMMETRIC_PUBLIC_KEY_SUBTYPE=m
+CONFIG_SYSTEM_TRUSTED_KEYRING=y
-CONFIG_X509_CERTIFICATE_PARSER=m
 CONFIG_CRC7=m
 CONFIG_CRC8=m
 CONFIG_RANDOM32_SELFTEST=y
diff --git a/arch/s390/configs/gcov_defconfig b/arch/s390/configs/gcov_defconfig
deleted file mode 100644
index d52eafe57ae8..000000000000
--- a/arch/s390/configs/gcov_defconfig
+++ /dev/null
@@ -1,661 +0,0 @@
-CONFIG_SYSVIPC=y
-CONFIG_POSIX_MQUEUE=y
-CONFIG_AUDIT=y
-CONFIG_NO_HZ_IDLE=y
-CONFIG_HIGH_RES_TIMERS=y
-CONFIG_BSD_PROCESS_ACCT=y
-CONFIG_BSD_PROCESS_ACCT_V3=y
-CONFIG_TASKSTATS=y
-CONFIG_TASK_DELAY_ACCT=y
-CONFIG_TASK_XACCT=y
-CONFIG_TASK_IO_ACCOUNTING=y
-CONFIG_IKCONFIG=y
-CONFIG_IKCONFIG_PROC=y
-CONFIG_NUMA_BALANCING=y
-# CONFIG_NUMA_BALANCING_DEFAULT_ENABLED is not set
-CONFIG_MEMCG=y
-CONFIG_MEMCG_SWAP=y
-CONFIG_BLK_CGROUP=y
-CONFIG_CFS_BANDWIDTH=y
-CONFIG_RT_GROUP_SCHED=y
-CONFIG_CGROUP_PIDS=y
-CONFIG_CGROUP_FREEZER=y
-CONFIG_CGROUP_HUGETLB=y
-CONFIG_CPUSETS=y
-CONFIG_CGROUP_DEVICE=y
-CONFIG_CGROUP_CPUACCT=y
-CONFIG_CGROUP_PERF=y
-CONFIG_CHECKPOINT_RESTORE=y
-CONFIG_NAMESPACES=y
-CONFIG_USER_NS=y
-CONFIG_SCHED_AUTOGROUP=y
-CONFIG_BLK_DEV_INITRD=y
-CONFIG_EXPERT=y
-# CONFIG_SYSFS_SYSCALL is not set
-CONFIG_BPF_SYSCALL=y
-CONFIG_USERFAULTFD=y
-# CONFIG_COMPAT_BRK is not set
-CONFIG_PROFILING=y
-CONFIG_OPROFILE=m
-CONFIG_KPROBES=y
-CONFIG_JUMP_LABEL=y
-CONFIG_GCOV_KERNEL=y
-CONFIG_GCOV_PROFILE_ALL=y
-CONFIG_MODULES=y
-CONFIG_MODULE_FORCE_LOAD=y
-CONFIG_MODULE_UNLOAD=y
-CONFIG_MODULE_FORCE_UNLOAD=y
-CONFIG_MODVERSIONS=y
-CONFIG_MODULE_SRCVERSION_ALL=y
-CONFIG_BLK_DEV_INTEGRITY=y
-CONFIG_BLK_DEV_THROTTLING=y
-CONFIG_BLK_WBT=y
-CONFIG_BLK_WBT_SQ=y
-CONFIG_PARTITION_ADVANCED=y
-CONFIG_IBM_PARTITION=y
-CONFIG_BSD_DISKLABEL=y
-CONFIG_MINIX_SUBPARTITION=y
-CONFIG_SOLARIS_X86_PARTITION=y
-CONFIG_UNIXWARE_DISKLABEL=y
-CONFIG_CFQ_GROUP_IOSCHED=y
-CONFIG_DEFAULT_DEADLINE=y
-CONFIG_LIVEPATCH=y
-CONFIG_TUNE_ZEC12=y
-CONFIG_NR_CPUS=512
-CONFIG_NUMA=y
-CONFIG_HZ_100=y
-CONFIG_MEMORY_HOTPLUG=y
-CONFIG_MEMORY_HOTREMOVE=y
-CONFIG_KSM=y
-CONFIG_TRANSPARENT_HUGEPAGE=y
-CONFIG_CLEANCACHE=y
-CONFIG_FRONTSWAP=y
-CONFIG_MEM_SOFT_DIRTY=y
-CONFIG_ZSWAP=y
-CONFIG_ZBUD=m
-CONFIG_ZSMALLOC=m
-CONFIG_ZSMALLOC_STAT=y
-CONFIG_DEFERRED_STRUCT_PAGE_INIT=y
-CONFIG_IDLE_PAGE_TRACKING=y
-CONFIG_PCI=y
-CONFIG_HOTPLUG_PCI=y
-CONFIG_HOTPLUG_PCI_S390=y
-CONFIG_CHSC_SCH=y
-CONFIG_CRASH_DUMP=y
-CONFIG_BINFMT_MISC=m
-CONFIG_HIBERNATION=y
-CONFIG_NET=y
-CONFIG_PACKET=y
-CONFIG_PACKET_DIAG=m
-CONFIG_UNIX=y
-CONFIG_UNIX_DIAG=m
-CONFIG_XFRM_USER=m
-CONFIG_NET_KEY=m
-CONFIG_SMC=m
-CONFIG_SMC_DIAG=m
-CONFIG_INET=y
-CONFIG_IP_MULTICAST=y
-CONFIG_IP_ADVANCED_ROUTER=y
-CONFIG_IP_MULTIPLE_TABLES=y
-CONFIG_IP_ROUTE_MULTIPATH=y
-CONFIG_IP_ROUTE_VERBOSE=y
-CONFIG_NET_IPIP=m
-CONFIG_NET_IPGRE_DEMUX=m
-CONFIG_NET_IPGRE=m
-CONFIG_NET_IPGRE_BROADCAST=y
-CONFIG_IP_MROUTE=y
-CONFIG_IP_MROUTE_MULTIPLE_TABLES=y
-CONFIG_IP_PIMSM_V1=y
-CONFIG_IP_PIMSM_V2=y
-CONFIG_SYN_COOKIES=y
-CONFIG_NET_IPVTI=m
-CONFIG_INET_AH=m
-CONFIG_INET_ESP=m
-CONFIG_INET_IPCOMP=m
-CONFIG_INET_XFRM_MODE_TRANSPORT=m
-CONFIG_INET_XFRM_MODE_TUNNEL=m
-CONFIG_INET_XFRM_MODE_BEET=m
-CONFIG_INET_DIAG=m
-CONFIG_INET_UDP_DIAG=m
-CONFIG_TCP_CONG_ADVANCED=y
-CONFIG_TCP_CONG_HSTCP=m
-CONFIG_TCP_CONG_HYBLA=m
-CONFIG_TCP_CONG_SCALABLE=m
-CONFIG_TCP_CONG_LP=m
-CONFIG_TCP_CONG_VENO=m
-CONFIG_TCP_CONG_YEAH=m
-CONFIG_TCP_CONG_ILLINOIS=m
-CONFIG_IPV6_ROUTER_PREF=y
-CONFIG_INET6_AH=m
-CONFIG_INET6_ESP=m
-CONFIG_INET6_IPCOMP=m
-CONFIG_IPV6_MIP6=m
-CONFIG_INET6_XFRM_MODE_TRANSPORT=m
-CONFIG_INET6_XFRM_MODE_TUNNEL=m
-CONFIG_INET6_XFRM_MODE_BEET=m
-CONFIG_INET6_XFRM_MODE_ROUTEOPTIMIZATION=m
-CONFIG_IPV6_VTI=m
-CONFIG_IPV6_SIT=m
-CONFIG_IPV6_GRE=m
-CONFIG_IPV6_MULTIPLE_TABLES=y
-CONFIG_IPV6_SUBTREES=y
-CONFIG_NETFILTER=y
-CONFIG_NF_CONNTRACK=m
-CONFIG_NF_CONNTRACK_SECMARK=y
-CONFIG_NF_CONNTRACK_EVENTS=y
-CONFIG_NF_CONNTRACK_TIMEOUT=y
-CONFIG_NF_CONNTRACK_TIMESTAMP=y
-CONFIG_NF_CONNTRACK_AMANDA=m
-CONFIG_NF_CONNTRACK_FTP=m
-CONFIG_NF_CONNTRACK_H323=m
-CONFIG_NF_CONNTRACK_IRC=m
-CONFIG_NF_CONNTRACK_NETBIOS_NS=m
-CONFIG_NF_CONNTRACK_SNMP=m
-CONFIG_NF_CONNTRACK_PPTP=m
-CONFIG_NF_CONNTRACK_SANE=m
-CONFIG_NF_CONNTRACK_SIP=m
-CONFIG_NF_CONNTRACK_TFTP=m
-CONFIG_NF_CT_NETLINK=m
-CONFIG_NF_CT_NETLINK_TIMEOUT=m
-CONFIG_NF_TABLES=m
-CONFIG_NFT_EXTHDR=m
-CONFIG_NFT_META=m
-CONFIG_NFT_CT=m
-CONFIG_NFT_COUNTER=m
-CONFIG_NFT_LOG=m
-CONFIG_NFT_LIMIT=m
-CONFIG_NFT_NAT=m
-CONFIG_NFT_COMPAT=m
-CONFIG_NFT_HASH=m
-CONFIG_NETFILTER_XT_SET=m
-CONFIG_NETFILTER_XT_TARGET_AUDIT=m
-CONFIG_NETFILTER_XT_TARGET_CHECKSUM=m
-CONFIG_NETFILTER_XT_TARGET_CLASSIFY=m
-CONFIG_NETFILTER_XT_TARGET_CONNMARK=m
-CONFIG_NETFILTER_XT_TARGET_CONNSECMARK=m
-CONFIG_NETFILTER_XT_TARGET_CT=m
-CONFIG_NETFILTER_XT_TARGET_DSCP=m
-CONFIG_NETFILTER_XT_TARGET_HMARK=m
-CONFIG_NETFILTER_XT_TARGET_IDLETIMER=m
-CONFIG_NETFILTER_XT_TARGET_LOG=m
-CONFIG_NETFILTER_XT_TARGET_MARK=m
-CONFIG_NETFILTER_XT_TARGET_NFLOG=m
-CONFIG_NETFILTER_XT_TARGET_NFQUEUE=m
-CONFIG_NETFILTER_XT_TARGET_TEE=m
-CONFIG_NETFILTER_XT_TARGET_TPROXY=m
-CONFIG_NETFILTER_XT_TARGET_TRACE=m
-CONFIG_NETFILTER_XT_TARGET_SECMARK=m
-CONFIG_NETFILTER_XT_TARGET_TCPMSS=m
-CONFIG_NETFILTER_XT_TARGET_TCPOPTSTRIP=m
-CONFIG_NETFILTER_XT_MATCH_ADDRTYPE=m
-CONFIG_NETFILTER_XT_MATCH_BPF=m
-CONFIG_NETFILTER_XT_MATCH_CLUSTER=m
-CONFIG_NETFILTER_XT_MATCH_COMMENT=m
-CONFIG_NETFILTER_XT_MATCH_CONNBYTES=m
-CONFIG_NETFILTER_XT_MATCH_CONNLABEL=m
-CONFIG_NETFILTER_XT_MATCH_CONNLIMIT=m
-CONFIG_NETFILTER_XT_MATCH_CONNMARK=m
-CONFIG_NETFILTER_XT_MATCH_CONNTRACK=m
-CONFIG_NETFILTER_XT_MATCH_CPU=m
-CONFIG_NETFILTER_XT_MATCH_DCCP=m
-CONFIG_NETFILTER_XT_MATCH_DEVGROUP=m
-CONFIG_NETFILTER_XT_MATCH_DSCP=m
-CONFIG_NETFILTER_XT_MATCH_ESP=m
-CONFIG_NETFILTER_XT_MATCH_HASHLIMIT=m
-CONFIG_NETFILTER_XT_MATCH_HELPER=m
-CONFIG_NETFILTER_XT_MATCH_IPRANGE=m
-CONFIG_NETFILTER_XT_MATCH_IPVS=m
-CONFIG_NETFILTER_XT_MATCH_LENGTH=m
-CONFIG_NETFILTER_XT_MATCH_LIMIT=m
-CONFIG_NETFILTER_XT_MATCH_MAC=m
-CONFIG_NETFILTER_XT_MATCH_MARK=m
-CONFIG_NETFILTER_XT_MATCH_MULTIPORT=m
-CONFIG_NETFILTER_XT_MATCH_NFACCT=m
-CONFIG_NETFILTER_XT_MATCH_OSF=m
-CONFIG_NETFILTER_XT_MATCH_OWNER=m
-CONFIG_NETFILTER_XT_MATCH_POLICY=m
-CONFIG_NETFILTER_XT_MATCH_PHYSDEV=m
-CONFIG_NETFILTER_XT_MATCH_PKTTYPE=m
-CONFIG_NETFILTER_XT_MATCH_QUOTA=m
-CONFIG_NETFILTER_XT_MATCH_RATEEST=m
-CONFIG_NETFILTER_XT_MATCH_REALM=m
-CONFIG_NETFILTER_XT_MATCH_RECENT=m
-CONFIG_NETFILTER_XT_MATCH_STATE=m
-CONFIG_NETFILTER_XT_MATCH_STATISTIC=m
-CONFIG_NETFILTER_XT_MATCH_STRING=m
-CONFIG_NETFILTER_XT_MATCH_TCPMSS=m
-CONFIG_NETFILTER_XT_MATCH_TIME=m
-CONFIG_NETFILTER_XT_MATCH_U32=m
-CONFIG_IP_SET=m
-CONFIG_IP_SET_BITMAP_IP=m
-CONFIG_IP_SET_BITMAP_IPMAC=m
-CONFIG_IP_SET_BITMAP_PORT=m
-CONFIG_IP_SET_HASH_IP=m
-CONFIG_IP_SET_HASH_IPPORT=m
-CONFIG_IP_SET_HASH_IPPORTIP=m
-CONFIG_IP_SET_HASH_IPPORTNET=m
-CONFIG_IP_SET_HASH_NETPORTNET=m
-CONFIG_IP_SET_HASH_NET=m
-CONFIG_IP_SET_HASH_NETNET=m
-CONFIG_IP_SET_HASH_NETPORT=m
-CONFIG_IP_SET_HASH_NETIFACE=m
-CONFIG_IP_SET_LIST_SET=m
-CONFIG_IP_VS=m
-CONFIG_IP_VS_PROTO_TCP=y
-CONFIG_IP_VS_PROTO_UDP=y
-CONFIG_IP_VS_PROTO_ESP=y
-CONFIG_IP_VS_PROTO_AH=y
-CONFIG_IP_VS_RR=m
-CONFIG_IP_VS_WRR=m
-CONFIG_IP_VS_LC=m
-CONFIG_IP_VS_WLC=m
-CONFIG_IP_VS_LBLC=m
-CONFIG_IP_VS_LBLCR=m
-CONFIG_IP_VS_DH=m
-CONFIG_IP_VS_SH=m
-CONFIG_IP_VS_SED=m
-CONFIG_IP_VS_NQ=m
-CONFIG_IP_VS_FTP=m
-CONFIG_IP_VS_PE_SIP=m
-CONFIG_NF_CONNTRACK_IPV4=m
-CONFIG_NF_TABLES_IPV4=m
-CONFIG_NFT_CHAIN_ROUTE_IPV4=m
-CONFIG_NF_TABLES_ARP=m
-CONFIG_NFT_CHAIN_NAT_IPV4=m
-CONFIG_IP_NF_IPTABLES=m
-CONFIG_IP_NF_MATCH_AH=m
-CONFIG_IP_NF_MATCH_ECN=m
-CONFIG_IP_NF_MATCH_RPFILTER=m
-CONFIG_IP_NF_MATCH_TTL=m
-CONFIG_IP_NF_FILTER=m
-CONFIG_IP_NF_TARGET_REJECT=m
-CONFIG_IP_NF_NAT=m
-CONFIG_IP_NF_TARGET_MASQUERADE=m
-CONFIG_IP_NF_MANGLE=m
-CONFIG_IP_NF_TARGET_CLUSTERIP=m
-CONFIG_IP_NF_TARGET_ECN=m
-CONFIG_IP_NF_TARGET_TTL=m
-CONFIG_IP_NF_RAW=m
-CONFIG_IP_NF_SECURITY=m
-CONFIG_IP_NF_ARPTABLES=m
-CONFIG_IP_NF_ARPFILTER=m
-CONFIG_IP_NF_ARP_MANGLE=m
-CONFIG_NF_CONNTRACK_IPV6=m
-CONFIG_NF_TABLES_IPV6=m
-CONFIG_NFT_CHAIN_ROUTE_IPV6=m
-CONFIG_NFT_CHAIN_NAT_IPV6=m
-CONFIG_IP6_NF_IPTABLES=m
-CONFIG_IP6_NF_MATCH_AH=m
-CONFIG_IP6_NF_MATCH_EUI64=m
-CONFIG_IP6_NF_MATCH_FRAG=m
-CONFIG_IP6_NF_MATCH_OPTS=m
-CONFIG_IP6_NF_MATCH_HL=m
-CONFIG_IP6_NF_MATCH_IPV6HEADER=m
-CONFIG_IP6_NF_MATCH_MH=m
-CONFIG_IP6_NF_MATCH_RPFILTER=m
-CONFIG_IP6_NF_MATCH_RT=m
-CONFIG_IP6_NF_TARGET_HL=m
-CONFIG_IP6_NF_FILTER=m
-CONFIG_IP6_NF_TARGET_REJECT=m
-CONFIG_IP6_NF_MANGLE=m
-CONFIG_IP6_NF_RAW=m
-CONFIG_IP6_NF_SECURITY=m
-CONFIG_IP6_NF_NAT=m
-CONFIG_IP6_NF_TARGET_MASQUERADE=m
-CONFIG_NF_TABLES_BRIDGE=m
-CONFIG_NET_SCTPPROBE=m
-CONFIG_RDS=m
-CONFIG_RDS_RDMA=m
-CONFIG_RDS_TCP=m
-CONFIG_L2TP=m
-CONFIG_L2TP_DEBUGFS=m
-CONFIG_L2TP_V3=y
-CONFIG_L2TP_IP=m
-CONFIG_L2TP_ETH=m
-CONFIG_BRIDGE=m
-CONFIG_VLAN_8021Q=m
-CONFIG_VLAN_8021Q_GVRP=y
-CONFIG_NET_SCHED=y
-CONFIG_NET_SCH_CBQ=m
-CONFIG_NET_SCH_HTB=m
-CONFIG_NET_SCH_HFSC=m
-CONFIG_NET_SCH_PRIO=m
-CONFIG_NET_SCH_MULTIQ=m
-CONFIG_NET_SCH_RED=m
-CONFIG_NET_SCH_SFB=m
-CONFIG_NET_SCH_SFQ=m
-CONFIG_NET_SCH_TEQL=m
-CONFIG_NET_SCH_TBF=m
-CONFIG_NET_SCH_GRED=m
-CONFIG_NET_SCH_DSMARK=m
-CONFIG_NET_SCH_NETEM=m
-CONFIG_NET_SCH_DRR=m
-CONFIG_NET_SCH_MQPRIO=m
-CONFIG_NET_SCH_CHOKE=m
-CONFIG_NET_SCH_QFQ=m
-CONFIG_NET_SCH_CODEL=m
-CONFIG_NET_SCH_FQ_CODEL=m
-CONFIG_NET_SCH_INGRESS=m
-CONFIG_NET_SCH_PLUG=m
-CONFIG_NET_CLS_BASIC=m
-CONFIG_NET_CLS_TCINDEX=m
-CONFIG_NET_CLS_ROUTE4=m
-CONFIG_NET_CLS_FW=m
-CONFIG_NET_CLS_U32=m
-CONFIG_CLS_U32_PERF=y
-CONFIG_CLS_U32_MARK=y
-CONFIG_NET_CLS_RSVP=m
-CONFIG_NET_CLS_RSVP6=m
-CONFIG_NET_CLS_FLOW=m
-CONFIG_NET_CLS_CGROUP=y
-CONFIG_NET_CLS_BPF=m
-CONFIG_NET_CLS_ACT=y
-CONFIG_NET_ACT_POLICE=m
-CONFIG_NET_ACT_GACT=m
-CONFIG_GACT_PROB=y
-CONFIG_NET_ACT_MIRRED=m
-CONFIG_NET_ACT_IPT=m
-CONFIG_NET_ACT_NAT=m
-CONFIG_NET_ACT_PEDIT=m
-CONFIG_NET_ACT_SIMP=m
-CONFIG_NET_ACT_SKBEDIT=m
-CONFIG_NET_ACT_CSUM=m
-CONFIG_DNS_RESOLVER=y
-CONFIG_NETLINK_DIAG=m
-CONFIG_CGROUP_NET_PRIO=y
-CONFIG_BPF_JIT=y
-CONFIG_NET_PKTGEN=m
-CONFIG_NET_TCPPROBE=m
-CONFIG_DEVTMPFS=y
-CONFIG_DMA_CMA=y
-CONFIG_CMA_SIZE_MBYTES=0
-CONFIG_CONNECTOR=y
-CONFIG_ZRAM=m
-CONFIG_BLK_DEV_LOOP=m
-CONFIG_BLK_DEV_CRYPTOLOOP=m
-CONFIG_BLK_DEV_DRBD=m
-CONFIG_BLK_DEV_NBD=m
-CONFIG_BLK_DEV_RAM=y
-CONFIG_BLK_DEV_RAM_SIZE=32768
-CONFIG_BLK_DEV_RAM_DAX=y
-CONFIG_VIRTIO_BLK=y
-CONFIG_ENCLOSURE_SERVICES=m
-CONFIG_GENWQE=m
-CONFIG_RAID_ATTRS=m
-CONFIG_SCSI=y
-CONFIG_BLK_DEV_SD=y
-CONFIG_CHR_DEV_ST=m
-CONFIG_CHR_DEV_OSST=m
-CONFIG_BLK_DEV_SR=m
-CONFIG_CHR_DEV_SG=y
-CONFIG_CHR_DEV_SCH=m
-CONFIG_SCSI_ENCLOSURE=m
-CONFIG_SCSI_CONSTANTS=y
-CONFIG_SCSI_LOGGING=y
-CONFIG_SCSI_SPI_ATTRS=m
-CONFIG_SCSI_FC_ATTRS=y
-CONFIG_SCSI_SAS_LIBSAS=m
-CONFIG_SCSI_SRP_ATTRS=m
-CONFIG_ISCSI_TCP=m
-CONFIG_SCSI_DEBUG=m
-CONFIG_ZFCP=y
-CONFIG_SCSI_VIRTIO=m
-CONFIG_SCSI_DH=y
-CONFIG_SCSI_DH_RDAC=m
-CONFIG_SCSI_DH_HP_SW=m
-CONFIG_SCSI_DH_EMC=m
-CONFIG_SCSI_DH_ALUA=m
-CONFIG_SCSI_OSD_INITIATOR=m
-CONFIG_SCSI_OSD_ULD=m
-CONFIG_MD=y
-CONFIG_BLK_DEV_MD=y
-CONFIG_MD_LINEAR=m
-CONFIG_MD_MULTIPATH=m
-CONFIG_MD_FAULTY=m
-CONFIG_BLK_DEV_DM=m
-CONFIG_DM_CRYPT=m
-CONFIG_DM_SNAPSHOT=m
-CONFIG_DM_THIN_PROVISIONING=m
-CONFIG_DM_MIRROR=m
-CONFIG_DM_LOG_USERSPACE=m
-CONFIG_DM_RAID=m
-CONFIG_DM_ZERO=m
-CONFIG_DM_MULTIPATH=m
-CONFIG_DM_MULTIPATH_QL=m
-CONFIG_DM_MULTIPATH_ST=m
-CONFIG_DM_DELAY=m
-CONFIG_DM_UEVENT=y
-CONFIG_DM_FLAKEY=m
-CONFIG_DM_VERITY=m
-CONFIG_DM_SWITCH=m
-CONFIG_NETDEVICES=y
-CONFIG_BONDING=m
-CONFIG_DUMMY=m
-CONFIG_EQUALIZER=m
-CONFIG_IFB=m
-CONFIG_MACVLAN=m
-CONFIG_MACVTAP=m
-CONFIG_VXLAN=m
-CONFIG_TUN=m
-CONFIG_VETH=m
-CONFIG_VIRTIO_NET=m
-CONFIG_NLMON=m
-# CONFIG_NET_VENDOR_ARC is not set
-# CONFIG_NET_VENDOR_CHELSIO is not set
-# CONFIG_NET_VENDOR_INTEL is not set
-# CONFIG_NET_VENDOR_MARVELL is not set
-CONFIG_MLX4_EN=m
-CONFIG_MLX5_CORE=m
-CONFIG_MLX5_CORE_EN=y
-# CONFIG_NET_VENDOR_NATSEMI is not set
-CONFIG_PPP=m
-CONFIG_PPP_BSDCOMP=m
-CONFIG_PPP_DEFLATE=m
-CONFIG_PPP_MPPE=m
-CONFIG_PPPOE=m
-CONFIG_PPTP=m
-CONFIG_PPPOL2TP=m
-CONFIG_PPP_ASYNC=m
-CONFIG_PPP_SYNC_TTY=m
-# CONFIG_INPUT_KEYBOARD is not set
-# CONFIG_INPUT_MOUSE is not set
-# CONFIG_SERIO is not set
-CONFIG_LEGACY_PTY_COUNT=0
-CONFIG_HW_RANDOM_VIRTIO=m
-CONFIG_RAW_DRIVER=m
-CONFIG_HANGCHECK_TIMER=m
-CONFIG_TN3270_FS=y
-# CONFIG_HWMON is not set
-CONFIG_WATCHDOG=y
-CONFIG_WATCHDOG_NOWAYOUT=y
-CONFIG_SOFT_WATCHDOG=m
-CONFIG_DIAG288_WATCHDOG=m
-# CONFIG_HID is not set
-# CONFIG_USB_SUPPORT is not set
-CONFIG_INFINIBAND=m
-CONFIG_INFINIBAND_USER_ACCESS=m
-CONFIG_MLX4_INFINIBAND=m
-CONFIG_MLX5_INFINIBAND=m
-CONFIG_VFIO=m
-CONFIG_VFIO_PCI=m
-CONFIG_VIRTIO_BALLOON=m
-CONFIG_EXT4_FS=y
-CONFIG_EXT4_FS_POSIX_ACL=y
-CONFIG_EXT4_FS_SECURITY=y
-CONFIG_EXT4_ENCRYPTION=y
-CONFIG_JBD2_DEBUG=y
-CONFIG_JFS_FS=m
-CONFIG_JFS_POSIX_ACL=y
-CONFIG_JFS_SECURITY=y
-CONFIG_JFS_STATISTICS=y
-CONFIG_XFS_FS=y
-CONFIG_XFS_QUOTA=y
-CONFIG_XFS_POSIX_ACL=y
-CONFIG_XFS_RT=y
-CONFIG_GFS2_FS=m
-CONFIG_GFS2_FS_LOCKING_DLM=y
-CONFIG_OCFS2_FS=m
-CONFIG_BTRFS_FS=y
-CONFIG_BTRFS_FS_POSIX_ACL=y
-CONFIG_NILFS2_FS=m
-CONFIG_FS_DAX=y
-CONFIG_EXPORTFS_BLOCK_OPS=y
-CONFIG_FANOTIFY=y
-CONFIG_FANOTIFY_ACCESS_PERMISSIONS=y
-CONFIG_QUOTA_NETLINK_INTERFACE=y
-CONFIG_QFMT_V1=m
-CONFIG_QFMT_V2=m
-CONFIG_AUTOFS4_FS=m
-CONFIG_FUSE_FS=y
-CONFIG_CUSE=m
-CONFIG_OVERLAY_FS=m
-CONFIG_OVERLAY_FS_REDIRECT_DIR=y
-CONFIG_FSCACHE=m
-CONFIG_CACHEFILES=m
-CONFIG_ISO9660_FS=y
-CONFIG_JOLIET=y
-CONFIG_ZISOFS=y
-CONFIG_UDF_FS=m
-CONFIG_MSDOS_FS=m
-CONFIG_VFAT_FS=m
-CONFIG_NTFS_FS=m
-CONFIG_NTFS_RW=y
-CONFIG_PROC_KCORE=y
-CONFIG_TMPFS=y
-CONFIG_TMPFS_POSIX_ACL=y
-CONFIG_HUGETLBFS=y
-CONFIG_CONFIGFS_FS=m
-CONFIG_ECRYPT_FS=m
-CONFIG_CRAMFS=m
-CONFIG_SQUASHFS=m
-CONFIG_SQUASHFS_XATTR=y
-CONFIG_SQUASHFS_LZO=y
-CONFIG_SQUASHFS_XZ=y
-CONFIG_ROMFS_FS=m
-CONFIG_NFS_FS=m
-CONFIG_NFS_V3_ACL=y
-CONFIG_NFS_V4=m
-CONFIG_NFS_SWAP=y
-CONFIG_NFSD=m
-CONFIG_NFSD_V3_ACL=y
-CONFIG_NFSD_V4=y
-CONFIG_NFSD_V4_SECURITY_LABEL=y
-CONFIG_CIFS=m
-CONFIG_CIFS_STATS=y
-CONFIG_CIFS_STATS2=y
-CONFIG_CIFS_WEAK_PW_HASH=y
-CONFIG_CIFS_UPCALL=y
-CONFIG_CIFS_XATTR=y
-CONFIG_CIFS_POSIX=y
-# CONFIG_CIFS_DEBUG is not set
-CONFIG_CIFS_DFS_UPCALL=y
-CONFIG_NLS_DEFAULT="utf8"
-CONFIG_NLS_CODEPAGE_437=m
-CONFIG_NLS_CODEPAGE_850=m
-CONFIG_NLS_ASCII=m
-CONFIG_NLS_ISO8859_1=m
-CONFIG_NLS_ISO8859_15=m
-CONFIG_NLS_UTF8=m
-CONFIG_DLM=m
-CONFIG_PRINTK_TIME=y
-CONFIG_DEBUG_INFO=y
-CONFIG_DEBUG_INFO_DWARF4=y
-CONFIG_GDB_SCRIPTS=y
-# CONFIG_ENABLE_MUST_CHECK is not set
-CONFIG_FRAME_WARN=1024
-CONFIG_UNUSED_SYMBOLS=y
-CONFIG_MAGIC_SYSRQ=y
-CONFIG_DEBUG_MEMORY_INIT=y
-CONFIG_PANIC_ON_OOPS=y
-CONFIG_RCU_TORTURE_TEST=m
-CONFIG_RCU_CPU_STALL_TIMEOUT=60
-CONFIG_LATENCYTOP=y
-CONFIG_SCHED_TRACER=y
-CONFIG_FTRACE_SYSCALLS=y
-CONFIG_STACK_TRACER=y
-CONFIG_BLK_DEV_IO_TRACE=y
-CONFIG_FUNCTION_PROFILER=y
-CONFIG_HIST_TRIGGERS=y
-CONFIG_LKDTM=m
-CONFIG_PERCPU_TEST=m
-CONFIG_ATOMIC64_SELFTEST=y
-CONFIG_TEST_BPF=m
-CONFIG_BUG_ON_DATA_CORRUPTION=y
-CONFIG_S390_PTDUMP=y
-CONFIG_PERSISTENT_KEYRINGS=y
-CONFIG_BIG_KEYS=y
-CONFIG_ENCRYPTED_KEYS=m
-CONFIG_SECURITY=y
-CONFIG_SECURITY_NETWORK=y
-CONFIG_SECURITY_SELINUX=y
-CONFIG_SECURITY_SELINUX_BOOTPARAM=y
-CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE=0
-CONFIG_SECURITY_SELINUX_DISABLE=y
-CONFIG_INTEGRITY_SIGNATURE=y
-CONFIG_INTEGRITY_ASYMMETRIC_KEYS=y
-CONFIG_IMA=y
-CONFIG_IMA_WRITE_POLICY=y
-CONFIG_IMA_APPRAISE=y
-CONFIG_CRYPTO_DH=m
-CONFIG_CRYPTO_ECDH=m
-CONFIG_CRYPTO_USER=m
-# CONFIG_CRYPTO_MANAGER_DISABLE_TESTS is not set
-CONFIG_CRYPTO_PCRYPT=m
-CONFIG_CRYPTO_CRYPTD=m
-CONFIG_CRYPTO_MCRYPTD=m
-CONFIG_CRYPTO_TEST=m
-CONFIG_CRYPTO_CHACHA20POLY1305=m
-CONFIG_CRYPTO_LRW=m
-CONFIG_CRYPTO_PCBC=m
-CONFIG_CRYPTO_KEYWRAP=m
-CONFIG_CRYPTO_XCBC=m
-CONFIG_CRYPTO_VMAC=m
-CONFIG_CRYPTO_CRC32=m
-CONFIG_CRYPTO_MICHAEL_MIC=m
-CONFIG_CRYPTO_RMD128=m
-CONFIG_CRYPTO_RMD160=m
-CONFIG_CRYPTO_RMD256=m
-CONFIG_CRYPTO_RMD320=m
-CONFIG_CRYPTO_SHA512=m
-CONFIG_CRYPTO_SHA3=m
-CONFIG_CRYPTO_TGR192=m
-CONFIG_CRYPTO_WP512=m
-CONFIG_CRYPTO_AES_TI=m
-CONFIG_CRYPTO_ANUBIS=m
-CONFIG_CRYPTO_BLOWFISH=m
-CONFIG_CRYPTO_CAMELLIA=m
-CONFIG_CRYPTO_CAST5=m
-CONFIG_CRYPTO_CAST6=m
-CONFIG_CRYPTO_FCRYPT=m
-CONFIG_CRYPTO_KHAZAD=m
-CONFIG_CRYPTO_SALSA20=m
-CONFIG_CRYPTO_SEED=m
-CONFIG_CRYPTO_SERPENT=m
-CONFIG_CRYPTO_TEA=m
-CONFIG_CRYPTO_TWOFISH=m
-CONFIG_CRYPTO_842=m
-CONFIG_CRYPTO_LZ4=m
-CONFIG_CRYPTO_LZ4HC=m
-CONFIG_CRYPTO_ANSI_CPRNG=m
-CONFIG_CRYPTO_USER_API_HASH=m
-CONFIG_CRYPTO_USER_API_SKCIPHER=m
-CONFIG_CRYPTO_USER_API_RNG=m
-CONFIG_CRYPTO_USER_API_AEAD=m
-CONFIG_ZCRYPT=m
-CONFIG_PKEY=m
-CONFIG_CRYPTO_PAES_S390=m
-CONFIG_CRYPTO_SHA1_S390=m
-CONFIG_CRYPTO_SHA256_S390=m
-CONFIG_CRYPTO_SHA512_S390=m
-CONFIG_CRYPTO_DES_S390=m
-CONFIG_CRYPTO_AES_S390=m
-CONFIG_CRYPTO_GHASH_S390=m
-CONFIG_CRYPTO_CRC32_S390=y
-CONFIG_CRC7=m
-CONFIG_CRC8=m
-CONFIG_CORDIC=m
-CONFIG_CMM=m
-CONFIG_APPLDATA_BASE=y
-CONFIG_KVM=m
-CONFIG_KVM_S390_UCONTROL=y
-CONFIG_VHOST_NET=m
diff --git a/arch/s390/configs/performance_defconfig b/arch/s390/configs/performance_defconfig
index 20ed149e1137..c105bcc6d7a6 100644
--- a/arch/s390/configs/performance_defconfig
+++ b/arch/s390/configs/performance_defconfig
@@ -25,13 +25,13 @@ CONFIG_CPUSETS=y
 CONFIG_CGROUP_DEVICE=y
 CONFIG_CGROUP_CPUACCT=y
 CONFIG_CGROUP_PERF=y
-CONFIG_CHECKPOINT_RESTORE=y
 CONFIG_NAMESPACES=y
 CONFIG_USER_NS=y
 CONFIG_SCHED_AUTOGROUP=y
 CONFIG_BLK_DEV_INITRD=y
 CONFIG_EXPERT=y
 # CONFIG_SYSFS_SYSCALL is not set
+CONFIG_CHECKPOINT_RESTORE=y
 CONFIG_BPF_SYSCALL=y
 CONFIG_USERFAULTFD=y
 # CONFIG_COMPAT_BRK is not set
@@ -45,6 +45,8 @@ CONFIG_MODULE_UNLOAD=y
 CONFIG_MODULE_FORCE_UNLOAD=y
 CONFIG_MODVERSIONS=y
 CONFIG_MODULE_SRCVERSION_ALL=y
+CONFIG_MODULE_SIG=y
+CONFIG_MODULE_SIG_SHA256=y
 CONFIG_BLK_DEV_INTEGRITY=y
 CONFIG_BLK_DEV_THROTTLING=y
 CONFIG_BLK_WBT=y
@@ -62,6 +64,7 @@ CONFIG_TUNE_ZEC12=y
 CONFIG_NR_CPUS=512
 CONFIG_NUMA=y
 CONFIG_HZ_100=y
+CONFIG_KEXEC_FILE=y
 CONFIG_MEMORY_HOTPLUG=y
 CONFIG_MEMORY_HOTREMOVE=y
 CONFIG_KSM=y
@@ -301,7 +304,6 @@ CONFIG_IP6_NF_SECURITY=m
 CONFIG_IP6_NF_NAT=m
 CONFIG_IP6_NF_TARGET_MASQUERADE=m
 CONFIG_NF_TABLES_BRIDGE=m
-CONFIG_NET_SCTPPROBE=m
 CONFIG_RDS=m
 CONFIG_RDS_RDMA=m
 CONFIG_RDS_TCP=m
@@ -359,11 +361,11 @@ CONFIG_NET_ACT_SIMP=m
 CONFIG_NET_ACT_SKBEDIT=m
 CONFIG_NET_ACT_CSUM=m
 CONFIG_DNS_RESOLVER=y
+CONFIG_OPENVSWITCH=m
 CONFIG_NETLINK_DIAG=m
 CONFIG_CGROUP_NET_PRIO=y
 CONFIG_BPF_JIT=y
 CONFIG_NET_PKTGEN=m
-CONFIG_NET_TCPPROBE=m
 CONFIG_DEVTMPFS=y
 CONFIG_DMA_CMA=y
 CONFIG_CMA_SIZE_MBYTES=0
@@ -375,8 +377,9 @@ CONFIG_BLK_DEV_DRBD=m
 CONFIG_BLK_DEV_NBD=m
 CONFIG_BLK_DEV_RAM=y
 CONFIG_BLK_DEV_RAM_SIZE=32768
-CONFIG_BLK_DEV_RAM_DAX=y
 CONFIG_VIRTIO_BLK=y
+CONFIG_BLK_DEV_RBD=m
+CONFIG_BLK_DEV_NVME=m
 CONFIG_ENCLOSURE_SERVICES=m
 CONFIG_GENWQE=m
 CONFIG_RAID_ATTRS=m
@@ -455,6 +458,7 @@ CONFIG_PPTP=m
 CONFIG_PPPOL2TP=m
 CONFIG_PPP_ASYNC=m
 CONFIG_PPP_SYNC_TTY=m
+CONFIG_INPUT_EVDEV=y
 # CONFIG_INPUT_KEYBOARD is not set
 # CONFIG_INPUT_MOUSE is not set
 # CONFIG_SERIO is not set
@@ -468,6 +472,9 @@ CONFIG_WATCHDOG=y
 CONFIG_WATCHDOG_NOWAYOUT=y
 CONFIG_SOFT_WATCHDOG=m
 CONFIG_DIAG288_WATCHDOG=m
+CONFIG_DRM=y
+CONFIG_DRM_VIRTIO_GPU=y
+CONFIG_FRAMEBUFFER_CONSOLE=y
 # CONFIG_HID is not set
 # CONFIG_USB_SUPPORT is not set
 CONFIG_INFINIBAND=m
@@ -476,7 +483,9 @@ CONFIG_MLX4_INFINIBAND=m
 CONFIG_MLX5_INFINIBAND=m
 CONFIG_VFIO=m
 CONFIG_VFIO_PCI=m
+CONFIG_VIRTIO_PCI=m
 CONFIG_VIRTIO_BALLOON=m
+CONFIG_VIRTIO_INPUT=y
 CONFIG_EXT4_FS=y
 CONFIG_EXT4_FS_POSIX_ACL=y
 CONFIG_EXT4_FS_SECURITY=y
@@ -507,7 +516,6 @@ CONFIG_AUTOFS4_FS=m
 CONFIG_FUSE_FS=y
 CONFIG_CUSE=m
 CONFIG_OVERLAY_FS=m
-CONFIG_OVERLAY_FS_REDIRECT_DIR=y
 CONFIG_FSCACHE=m
 CONFIG_CACHEFILES=m
 CONFIG_ISO9660_FS=y
@@ -592,8 +600,10 @@ CONFIG_SECURITY_SELINUX_DISABLE=y
 CONFIG_INTEGRITY_SIGNATURE=y
 CONFIG_INTEGRITY_ASYMMETRIC_KEYS=y
 CONFIG_IMA=y
+CONFIG_IMA_DEFAULT_HASH_SHA256=y
 CONFIG_IMA_WRITE_POLICY=y
 CONFIG_IMA_APPRAISE=y
+CONFIG_CRYPTO_FIPS=y
 CONFIG_CRYPTO_DH=m
 CONFIG_CRYPTO_ECDH=m
 CONFIG_CRYPTO_USER=m
diff --git a/arch/s390/defconfig b/arch/s390/defconfig
index 46a3178d8bc6..f40600eb1762 100644
--- a/arch/s390/defconfig
+++ b/arch/s390/defconfig
@@ -8,6 +8,7 @@ CONFIG_TASKSTATS=y
 CONFIG_TASK_DELAY_ACCT=y
 CONFIG_TASK_XACCT=y
 CONFIG_TASK_IO_ACCOUNTING=y
+# CONFIG_CPU_ISOLATION is not set
 CONFIG_IKCONFIG=y
 CONFIG_IKCONFIG_PROC=y
 CONFIG_CGROUPS=y
@@ -23,12 +24,12 @@ CONFIG_CPUSETS=y
 CONFIG_CGROUP_DEVICE=y
 CONFIG_CGROUP_CPUACCT=y
 CONFIG_CGROUP_PERF=y
-CONFIG_CHECKPOINT_RESTORE=y
 CONFIG_NAMESPACES=y
 CONFIG_USER_NS=y
 CONFIG_BLK_DEV_INITRD=y
 CONFIG_EXPERT=y
 # CONFIG_SYSFS_SYSCALL is not set
+CONFIG_CHECKPOINT_RESTORE=y
 CONFIG_BPF_SYSCALL=y
 CONFIG_USERFAULTFD=y
 # CONFIG_COMPAT_BRK is not set
@@ -47,6 +48,7 @@ CONFIG_LIVEPATCH=y
 CONFIG_NR_CPUS=256
 CONFIG_NUMA=y
 CONFIG_HZ_100=y
+CONFIG_KEXEC_FILE=y
 CONFIG_MEMORY_HOTPLUG=y
 CONFIG_MEMORY_HOTREMOVE=y
 CONFIG_KSM=y
@@ -129,10 +131,13 @@ CONFIG_EQUALIZER=m
 CONFIG_TUN=m
 CONFIG_VIRTIO_NET=y
 # CONFIG_NET_VENDOR_ALACRITECH is not set
+# CONFIG_NET_VENDOR_CORTINA is not set
 # CONFIG_NET_VENDOR_SOLARFLARE is not set
+# CONFIG_NET_VENDOR_SOCIONEXT is not set
 # CONFIG_NET_VENDOR_SYNOPSYS is not set
 # CONFIG_INPUT is not set
 # CONFIG_SERIO is not set
+# CONFIG_VT is not set
 CONFIG_DEVKMEM=y
 CONFIG_RAW_DRIVER=m
 CONFIG_VIRTIO_BALLOON=y
@@ -177,13 +182,15 @@ CONFIG_TRACER_SNAPSHOT_PER_CPU_SWAP=y
 CONFIG_STACK_TRACER=y
 CONFIG_BLK_DEV_IO_TRACE=y
 CONFIG_FUNCTION_PROFILER=y
-CONFIG_KPROBES_SANITY_TEST=y
+# CONFIG_RUNTIME_TESTING_MENU is not set
 CONFIG_S390_PTDUMP=y
 CONFIG_CRYPTO_CRYPTD=m
+CONFIG_CRYPTO_AUTHENC=m
 CONFIG_CRYPTO_TEST=m
 CONFIG_CRYPTO_CCM=m
 CONFIG_CRYPTO_GCM=m
 CONFIG_CRYPTO_CBC=y
+CONFIG_CRYPTO_CFB=m
 CONFIG_CRYPTO_CTS=m
 CONFIG_CRYPTO_LRW=m
 CONFIG_CRYPTO_PCBC=m
@@ -213,6 +220,8 @@ CONFIG_CRYPTO_KHAZAD=m
 CONFIG_CRYPTO_SALSA20=m
 CONFIG_CRYPTO_SEED=m
 CONFIG_CRYPTO_SERPENT=m
+CONFIG_CRYPTO_SM4=m
+CONFIG_CRYPTO_SPECK=m
 CONFIG_CRYPTO_TEA=m
 CONFIG_CRYPTO_TWOFISH=m
 CONFIG_CRYPTO_DEFLATE=m
diff --git a/arch/s390/hypfs/inode.c b/arch/s390/hypfs/inode.c
index 43bbe63e2992..06b513d192b9 100644
--- a/arch/s390/hypfs/inode.c
+++ b/arch/s390/hypfs/inode.c
@@ -320,7 +320,7 @@ static void hypfs_kill_super(struct super_block *sb)
        if (sb->s_root)
                hypfs_delete_tree(sb->s_root);
-        if (sb_info->update_file)
+        if (sb_info && sb_info->update_file)
                hypfs_remove(sb_info->update_file);
        kfree(sb->s_fs_info);
        sb->s_fs_info = NULL;
diff --git a/arch/s390/include/asm/kexec.h b/arch/s390/include/asm/kexec.h
index 1d708a419326..825dd0f7f221 100644
--- a/arch/s390/include/asm/kexec.h
+++ b/arch/s390/include/asm/kexec.h
@@ -46,4 +46,27 @@
 static inline void crash_setup_regs(struct pt_regs *newregs,
                                        struct pt_regs *oldregs) { }
+struct kimage;
+struct s390_load_data {
+        /* Pointer to the kernel buffer. Used to register cmdline etc.. */
+        void *kernel_buf;
+        /* Total size of loaded segments in memory. Used as an offset. */
+        size_t memsz;
+        /* Load address of initrd. Used to register INITRD_START in kernel. */
+        unsigned long initrd_load_addr;
+};
+int kexec_file_add_purgatory(struct kimage *image,
+                             struct s390_load_data *data);
+int kexec_file_add_initrd(struct kimage *image,
+                          struct s390_load_data *data,
+                          char *initrd, unsigned long initrd_len);
+int *kexec_file_update_kernel(struct kimage *iamge,
+                              struct s390_load_data *data);
+extern const struct kexec_file_ops s390_kexec_image_ops;
+extern const struct kexec_file_ops s390_kexec_elf_ops;
 #endif /*_S390_KEXEC_H */
diff --git a/arch/s390/include/asm/purgatory.h b/arch/s390/include/asm/purgatory.h
new file mode 100644
index 000000000000..e297bcfc476f
--- /dev/null
+++ b/arch/s390/include/asm/purgatory.h
@@ -0,0 +1,17 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+/*
+ * Copyright IBM Corp. 2018
+ *
+ * Author(s): Philipp Rudo <prudo@linux.vnet.ibm.com>
+ */
+#ifndef _S390_PURGATORY_H_
+#define _S390_PURGATORY_H_
+#ifndef __ASSEMBLY__
+#include <linux/purgatory.h>
+int verify_sha256_digest(void);
+#endif  /* __ASSEMBLY__ */
+#endif /* _S390_PURGATORY_H_ */
diff --git a/arch/s390/include/asm/setup.h b/arch/s390/include/asm/setup.h
index 124154fdfc97..9c30ebe046f3 100644
--- a/arch/s390/include/asm/setup.h
+++ b/arch/s390/include/asm/setup.h
@@ -1,7 +1,7 @@
 /* SPDX-License-Identifier: GPL-2.0 */
 /*
 *  S390 version
- *    Copyright IBM Corp. 1999, 2010
+ *    Copyright IBM Corp. 1999, 2017
 */
 #ifndef _ASM_S390_SETUP_H
 #define _ASM_S390_SETUP_H
@@ -37,17 +37,31 @@
 #define LPP_MAGIC               _BITUL(31)
 #define LPP_PID_MASK            _AC(0xffffffff, UL)
+/* Offsets to entry points in kernel/head.S  */
+#define STARTUP_NORMAL_OFFSET   0x10000
+#define STARTUP_KDUMP_OFFSET    0x10010
+/* Offsets to parameters in kernel/head.S  */
+#define IPL_DEVICE_OFFSET       0x10400
+#define INITRD_START_OFFSET     0x10408
+#define INITRD_SIZE_OFFSET      0x10410
+#define OLDMEM_BASE_OFFSET      0x10418
+#define OLDMEM_SIZE_OFFSET      0x10420
+#define COMMAND_LINE_OFFSET     0x10480
 #ifndef __ASSEMBLY__
 #include <asm/lowcore.h>
 #include <asm/types.h>
-#define IPL_DEVICE        (*(unsigned long *)  (0x10400))
+#define IPL_DEVICE      (*(unsigned long *)  (IPL_DEVICE_OFFSET))
-#define INITRD_START      (*(unsigned long *)  (0x10408))
+#define INITRD_START    (*(unsigned long *)  (INITRD_START_OFFSET))
-#define INITRD_SIZE       (*(unsigned long *)  (0x10410))
+#define INITRD_SIZE     (*(unsigned long *)  (INITRD_SIZE_OFFSET))
-#define OLDMEM_BASE       (*(unsigned long *)  (0x10418))
+#define OLDMEM_BASE     (*(unsigned long *)  (OLDMEM_BASE_OFFSET))
-#define OLDMEM_SIZE       (*(unsigned long *)  (0x10420))
+#define OLDMEM_SIZE     (*(unsigned long *)  (OLDMEM_SIZE_OFFSET))
-#define COMMAND_LINE      ((char *)            (0x10480))
+#define COMMAND_LINE    ((char *)            (COMMAND_LINE_OFFSET))
 extern int memory_end_set;
 extern unsigned long memory_end;
@@ -121,12 +135,12 @@ extern void (*_machine_power_off)(void);
 #else /* __ASSEMBLY__ */
-#define IPL_DEVICE        0x10400
+#define IPL_DEVICE      (IPL_DEVICE_OFFSET)
-#define INITRD_START      0x10408
+#define INITRD_START    (INITRD_START_OFFSET)
-#define INITRD_SIZE       0x10410
+#define INITRD_SIZE     (INITRD_SIZE_OFFSET)
-#define OLDMEM_BASE       0x10418
+#define OLDMEM_BASE     (OLDMEM_BASE_OFFSET)
-#define OLDMEM_SIZE       0x10420
+#define OLDMEM_SIZE     (OLDMEM_SIZE_OFFSET)
-#define COMMAND_LINE      0x10480
+#define COMMAND_LINE    (COMMAND_LINE_OFFSET)
 #endif /* __ASSEMBLY__ */
 #endif /* _ASM_S390_SETUP_H */
diff --git a/arch/s390/include/uapi/asm/signal.h b/arch/s390/include/uapi/asm/signal.h
index c57f9d28d894..9a14a611ed82 100644
--- a/arch/s390/include/uapi/asm/signal.h
+++ b/arch/s390/include/uapi/asm/signal.h
@@ -97,22 +97,31 @@ typedef unsigned long sigset_t;
 #include <asm-generic/signal-defs.h>
 #ifndef __KERNEL__
-/* Here we must cater to libcs that poke about in kernel headers.  */
+/*
+ * There are two system calls in regard to sigaction, sys_rt_sigaction
+ * and sys_sigaction. Internally the kernel uses the struct old_sigaction
+ * for the older sys_sigaction system call, and the kernel version of the
+ * struct sigaction for the newer sys_rt_sigaction.
+ *
+ * The uapi definition for struct sigaction has made a strange distinction
+ * between 31-bit and 64-bit in the past. For 64-bit the uapi structure
+ * looks like the kernel struct sigaction, but for 31-bit it used to
+ * look like the kernel struct old_sigaction. That practically made the
+ * structure unusable for either system call. To get around this problem
+ * the glibc always had its own definitions for the sigaction structures.
+ *
+ * The current struct sigaction uapi definition below is suitable for the
+ * sys_rt_sigaction system call only.
+ */
 struct sigaction {
        union {
          __sighandler_t _sa_handler;
          void (*_sa_sigaction)(int, struct siginfo *, void *);
        } _u;
-#ifndef __s390x__ /* lovely */
-        sigset_t sa_mask;
-        unsigned long sa_flags;
-        void (*sa_restorer)(void);
-#else  /* __s390x__ */
        unsigned long sa_flags;
        void (*sa_restorer)(void);
        sigset_t sa_mask;
-#endif /* __s390x__ */
 };
 #define sa_handler      _u._sa_handler
diff --git a/arch/s390/kernel/Makefile b/arch/s390/kernel/Makefile
index b06a6f79c1ec..84ea6225efb4 100644
--- a/arch/s390/kernel/Makefile
+++ b/arch/s390/kernel/Makefile
@@ -82,6 +82,9 @@ obj-$(CONFIG_FUNCTION_TRACER)	+= mcount.o ftrace.o
 obj-$(CONFIG_CRASH_DUMP)        += crash_dump.o
 obj-$(CONFIG_UPROBES)           += uprobes.o
+obj-$(CONFIG_KEXEC_FILE)        += machine_kexec_file.o kexec_image.o
+obj-$(CONFIG_KEXEC_FILE)        += kexec_elf.o
 obj-$(CONFIG_PERF_EVENTS)       += perf_event.o perf_cpum_cf.o perf_cpum_sf.o
 obj-$(CONFIG_PERF_EVENTS)       += perf_cpum_cf_events.o perf_regs.o
diff --git a/arch/s390/kernel/asm-offsets.c b/arch/s390/kernel/asm-offsets.c
index cfe2c45c5180..eb2a5c0443cd 100644
--- a/arch/s390/kernel/asm-offsets.c
+++ b/arch/s390/kernel/asm-offsets.c
@@ -10,6 +10,7 @@
 #include <linux/kbuild.h>
 #include <linux/kvm_host.h>
 #include <linux/sched.h>
+#include <linux/purgatory.h>
 #include <asm/idle.h>
 #include <asm/vdso.h>
 #include <asm/pgtable.h>
@@ -204,5 +205,9 @@ int main(void)
        OFFSET(__GMAP_ASCE, gmap, asce);
        OFFSET(__SIE_PROG0C, kvm_s390_sie_block, prog0c);
        OFFSET(__SIE_PROG20, kvm_s390_sie_block, prog20);
+        /* kexec_sha_region */
+        OFFSET(__KEXEC_SHA_REGION_START, kexec_sha_region, start);
+        OFFSET(__KEXEC_SHA_REGION_LEN, kexec_sha_region, len);
+        DEFINE(__KEXEC_SHA_REGION_SIZE, sizeof(struct kexec_sha_region));
        return 0;
 }
diff --git a/arch/s390/kernel/compat_wrapper.c b/arch/s390/kernel/compat_wrapper.c
index 11e9d8b5c1b0..607c5e9fba3d 100644
--- a/arch/s390/kernel/compat_wrapper.c
+++ b/arch/s390/kernel/compat_wrapper.c
@@ -182,3 +182,4 @@ COMPAT_SYSCALL_WRAP6(copy_file_range, int, fd_in, loff_t __user *, off_in, int,
 COMPAT_SYSCALL_WRAP2(s390_guarded_storage, int, command, struct gs_cb *, gs_cb);
 COMPAT_SYSCALL_WRAP5(statx, int, dfd, const char __user *, path, unsigned, flags, unsigned, mask, struct statx __user *, buffer);
 COMPAT_SYSCALL_WRAP4(s390_sthyi, unsigned long, code, void __user *, info, u64 __user *, rc, unsigned long, flags);
+COMPAT_SYSCALL_WRAP5(kexec_file_load, int, kernel_fd, int, initrd_fd, unsigned long, cmdline_len, const char __user *, cmdline_ptr, unsigned long, flags)
diff --git a/arch/s390/kernel/kexec_elf.c b/arch/s390/kernel/kexec_elf.c
new file mode 100644
index 000000000000..5a286b012043
--- /dev/null
+++ b/arch/s390/kernel/kexec_elf.c
@@ -0,0 +1,147 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * ELF loader for kexec_file_load system call.
+ *
+ * Copyright IBM Corp. 2018
+ *
+ * Author(s): Philipp Rudo <prudo@linux.vnet.ibm.com>
+ */
+#include <linux/errno.h>
+#include <linux/kernel.h>
+#include <linux/kexec.h>
+#include <asm/setup.h>
+static int kexec_file_add_elf_kernel(struct kimage *image,
+                                     struct s390_load_data *data,
+                                     char *kernel, unsigned long kernel_len)
+{
+        struct kexec_buf buf;
+        const Elf_Ehdr *ehdr;
+        const Elf_Phdr *phdr;
+        int i, ret;
+        ehdr = (Elf_Ehdr *)kernel;
+        buf.image = image;
+        phdr = (void *)ehdr + ehdr->e_phoff;
+        for (i = 0; i < ehdr->e_phnum; i++, phdr++) {
+                if (phdr->p_type != PT_LOAD)
+                        continue;
+                buf.buffer = kernel + phdr->p_offset;
+                buf.bufsz = phdr->p_filesz;
+                buf.mem = ALIGN(phdr->p_paddr, phdr->p_align);
+                buf.memsz = phdr->p_memsz;
+                if (phdr->p_paddr == 0) {
+                        data->kernel_buf = buf.buffer;
+                        data->memsz += STARTUP_NORMAL_OFFSET;
+                        buf.buffer += STARTUP_NORMAL_OFFSET;
+                        buf.bufsz -= STARTUP_NORMAL_OFFSET;
+                        buf.mem += STARTUP_NORMAL_OFFSET;
+                        buf.memsz -= STARTUP_NORMAL_OFFSET;
+                }
+                if (image->type == KEXEC_TYPE_CRASH)
+                        buf.mem += crashk_res.start;
+                ret = kexec_add_buffer(&buf);
+                if (ret)
+                        return ret;
+                data->memsz += buf.memsz;
+        }
+        return 0;
+}
+static void *s390_elf_load(struct kimage *image,
+                           char *kernel, unsigned long kernel_len,
+                           char *initrd, unsigned long initrd_len,
+                           char *cmdline, unsigned long cmdline_len)
+{
+        struct s390_load_data data = {0};
+        const Elf_Ehdr *ehdr;
+        const Elf_Phdr *phdr;
+        size_t size;
+        int i, ret;
+        /* image->fobs->probe already checked for valid ELF magic number. */
+        ehdr = (Elf_Ehdr *)kernel;
+        if (ehdr->e_type != ET_EXEC ||
+            ehdr->e_ident[EI_CLASS] != ELFCLASS64 ||
+            !elf_check_arch(ehdr))
+                return ERR_PTR(-EINVAL);
+        if (!ehdr->e_phnum || ehdr->e_phentsize != sizeof(Elf_Phdr))
+                return ERR_PTR(-EINVAL);
+        size = ehdr->e_ehsize + ehdr->e_phoff;
+        size += ehdr->e_phentsize * ehdr->e_phnum;
+        if (size > kernel_len)
+                return ERR_PTR(-EINVAL);
+        phdr = (void *)ehdr + ehdr->e_phoff;
+        size = ALIGN(size, phdr->p_align);
+        for (i = 0; i < ehdr->e_phnum; i++, phdr++) {
+                if (phdr->p_type == PT_INTERP)
+                        return ERR_PTR(-EINVAL);
+                if (phdr->p_offset > kernel_len)
+                        return ERR_PTR(-EINVAL);
+                size += ALIGN(phdr->p_filesz, phdr->p_align);
+        }
+        if (size > kernel_len)
+                return ERR_PTR(-EINVAL);
+        ret = kexec_file_add_elf_kernel(image, &data, kernel, kernel_len);
+        if (ret)
+                return ERR_PTR(ret);
+        if (!data.memsz)
+                return ERR_PTR(-EINVAL);
+        if (initrd) {
+                ret = kexec_file_add_initrd(image, &data, initrd, initrd_len);
+                if (ret)
+                        return ERR_PTR(ret);
+        }
+        ret = kexec_file_add_purgatory(image, &data);
+        if (ret)
+                return ERR_PTR(ret);
+        return kexec_file_update_kernel(image, &data);
+}
+static int s390_elf_probe(const char *buf, unsigned long len)
+{
+        const Elf_Ehdr *ehdr;
+        if (len < sizeof(Elf_Ehdr))
+                return -ENOEXEC;
+        ehdr = (Elf_Ehdr *)buf;
+        /* Only check the ELF magic number here and do proper validity check
+         * in the loader. Any check here that fails would send the erroneous
+         * ELF file to the image loader that does not care what it gets.
+         * (Most likely) causing behavior not intended by the user.
+         */
+        if (memcmp(ehdr->e_ident, ELFMAG, SELFMAG) != 0)
+                return -ENOEXEC;
+        return 0;
+}
+const struct kexec_file_ops s390_kexec_elf_ops = {
+        .probe = s390_elf_probe,
+        .load = s390_elf_load,
+};
diff --git a/arch/s390/kernel/kexec_image.c b/arch/s390/kernel/kexec_image.c
new file mode 100644
index 000000000000..3800852595e8
--- /dev/null
+++ b/arch/s390/kernel/kexec_image.c
@@ -0,0 +1,76 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * Image loader for kexec_file_load system call.
+ *
+ * Copyright IBM Corp. 2018
+ *
+ * Author(s): Philipp Rudo <prudo@linux.vnet.ibm.com>
+ */
+#include <linux/errno.h>
+#include <linux/kernel.h>
+#include <linux/kexec.h>
+#include <asm/setup.h>
+static int kexec_file_add_image_kernel(struct kimage *image,
+                                       struct s390_load_data *data,
+                                       char *kernel, unsigned long kernel_len)
+{
+        struct kexec_buf buf;
+        int ret;
+        buf.image = image;
+        buf.buffer = kernel + STARTUP_NORMAL_OFFSET;
+        buf.bufsz = kernel_len - STARTUP_NORMAL_OFFSET;
+        buf.mem = STARTUP_NORMAL_OFFSET;
+        if (image->type == KEXEC_TYPE_CRASH)
+                buf.mem += crashk_res.start;
+        buf.memsz = buf.bufsz;
+        ret = kexec_add_buffer(&buf);
+        data->kernel_buf = kernel;
+        data->memsz += buf.memsz + STARTUP_NORMAL_OFFSET;
+        return ret;
+}
+static void *s390_image_load(struct kimage *image,
+                             char *kernel, unsigned long kernel_len,
+                             char *initrd, unsigned long initrd_len,
+                             char *cmdline, unsigned long cmdline_len)
+{
+        struct s390_load_data data = {0};
+        int ret;
+        ret = kexec_file_add_image_kernel(image, &data, kernel, kernel_len);
+        if (ret)
+                return ERR_PTR(ret);
+        if (initrd) {
+                ret = kexec_file_add_initrd(image, &data, initrd, initrd_len);
+                if (ret)
+                        return ERR_PTR(ret);
+        }
+        ret = kexec_file_add_purgatory(image, &data);
+        if (ret)
+                return ERR_PTR(ret);
+        return kexec_file_update_kernel(image, &data);
+}
+static int s390_image_probe(const char *buf, unsigned long len)
+{
+        /* Can't reliably tell if an image is valid.  Therefore give the
+         * user whatever he wants.
+         */
+        return 0;
+}
+const struct kexec_file_ops s390_kexec_image_ops = {
+        .probe = s390_image_probe,
+        .load = s390_image_load,
+};
diff --git a/arch/s390/kernel/machine_kexec_file.c b/arch/s390/kernel/machine_kexec_file.c
new file mode 100644
index 000000000000..f413f57f8d20
--- /dev/null
+++ b/arch/s390/kernel/machine_kexec_file.c
@@ -0,0 +1,245 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * s390 code for kexec_file_load system call
+ *
+ * Copyright IBM Corp. 2018
+ *
+ * Author(s): Philipp Rudo <prudo@linux.vnet.ibm.com>
+ */
+#include <linux/elf.h>
+#include <linux/kexec.h>
+#include <asm/setup.h>
+const struct kexec_file_ops * const kexec_file_loaders[] = {
+        &s390_kexec_elf_ops,
+        &s390_kexec_image_ops,
+        NULL,
+};
+int *kexec_file_update_kernel(struct kimage *image,
+                              struct s390_load_data *data)
+{
+        unsigned long *loc;
+        if (image->cmdline_buf_len >= ARCH_COMMAND_LINE_SIZE)
+                return ERR_PTR(-EINVAL);
+        if (image->cmdline_buf_len)
+                memcpy(data->kernel_buf + COMMAND_LINE_OFFSET,
+                       image->cmdline_buf, image->cmdline_buf_len);
+        if (image->type == KEXEC_TYPE_CRASH) {
+                loc = (unsigned long *)(data->kernel_buf + OLDMEM_BASE_OFFSET);
+                *loc = crashk_res.start;
+                loc = (unsigned long *)(data->kernel_buf + OLDMEM_SIZE_OFFSET);
+                *loc = crashk_res.end - crashk_res.start + 1;
+        }
+        if (image->initrd_buf) {
+                loc = (unsigned long *)(data->kernel_buf + INITRD_START_OFFSET);
+                *loc = data->initrd_load_addr;
+                loc = (unsigned long *)(data->kernel_buf + INITRD_SIZE_OFFSET);
+                *loc = image->initrd_buf_len;
+        }
+        return NULL;
+}
+static int kexec_file_update_purgatory(struct kimage *image)
+{
+        u64 entry, type;
+        int ret;
+        if (image->type == KEXEC_TYPE_CRASH) {
+                entry = STARTUP_KDUMP_OFFSET;
+                type = KEXEC_TYPE_CRASH;
+        } else {
+                entry = STARTUP_NORMAL_OFFSET;
+                type = KEXEC_TYPE_DEFAULT;
+        }
+        ret = kexec_purgatory_get_set_symbol(image, "kernel_entry", &entry,
+                                             sizeof(entry), false);
+        if (ret)
+                return ret;
+        ret = kexec_purgatory_get_set_symbol(image, "kernel_type", &type,
+                                             sizeof(type), false);
+        if (ret)
+                return ret;
+        if (image->type == KEXEC_TYPE_CRASH) {
+                u64 crash_size;
+                ret = kexec_purgatory_get_set_symbol(image, "crash_start",
+                                                     &crashk_res.start,
+                                                     sizeof(crashk_res.start),
+                                                     false);
+                if (ret)
+                        return ret;
+                crash_size = crashk_res.end - crashk_res.start + 1;
+                ret = kexec_purgatory_get_set_symbol(image, "crash_size",
+                                                     &crash_size,
+                                                     sizeof(crash_size),
+                                                     false);
+        }
+        return ret;
+}
+int kexec_file_add_purgatory(struct kimage *image, struct s390_load_data *data)
+{
+        struct kexec_buf buf;
+        int ret;
+        buf.image = image;
+        data->memsz = ALIGN(data->memsz, PAGE_SIZE);
+        buf.mem = data->memsz;
+        if (image->type == KEXEC_TYPE_CRASH)
+                buf.mem += crashk_res.start;
+        ret = kexec_load_purgatory(image, &buf);
+        if (ret)
+                return ret;
+        ret = kexec_file_update_purgatory(image);
+        return ret;
+}
+int kexec_file_add_initrd(struct kimage *image, struct s390_load_data *data,
+                          char *initrd, unsigned long initrd_len)
+{
+        struct kexec_buf buf;
+        int ret;
+        buf.image = image;
+        buf.buffer = initrd;
+        buf.bufsz = initrd_len;
+        data->memsz = ALIGN(data->memsz, PAGE_SIZE);
+        buf.mem = data->memsz;
+        if (image->type == KEXEC_TYPE_CRASH)
+                buf.mem += crashk_res.start;
+        buf.memsz = buf.bufsz;
+        data->initrd_load_addr = buf.mem;
+        data->memsz += buf.memsz;
+        ret = kexec_add_buffer(&buf);
+        return ret;
+}
+/*
+ * The kernel is loaded to a fixed location. Turn off kexec_locate_mem_hole
+ * and provide kbuf->mem by hand.
+ */
+int arch_kexec_walk_mem(struct kexec_buf *kbuf,
+                        int (*func)(struct resource *, void *))
+{
+        return 1;
+}
+int arch_kexec_apply_relocations_add(struct purgatory_info *pi,
+                                     Elf_Shdr *section,
+                                     const Elf_Shdr *relsec,
+                                     const Elf_Shdr *symtab)
+{
+        Elf_Rela *relas;
+        int i;
+        relas = (void *)pi->ehdr + relsec->sh_offset;
+        for (i = 0; i < relsec->sh_size / sizeof(*relas); i++) {
+                const Elf_Sym *sym;     /* symbol to relocate */
+                unsigned long addr;     /* final location after relocation */
+                unsigned long val;      /* relocated symbol value */
+                void *loc;              /* tmp location to modify */
+                sym = (void *)pi->ehdr + symtab->sh_offset;
+                sym += ELF64_R_SYM(relas[i].r_info);
+                if (sym->st_shndx == SHN_UNDEF)
+                        return -ENOEXEC;
+                if (sym->st_shndx == SHN_COMMON)
+                        return -ENOEXEC;
+                if (sym->st_shndx >= pi->ehdr->e_shnum &&
+                    sym->st_shndx != SHN_ABS)
+                        return -ENOEXEC;
+                loc = pi->purgatory_buf;
+                loc += section->sh_offset;
+                loc += relas[i].r_offset;
+                val = sym->st_value;
+                if (sym->st_shndx != SHN_ABS)
+                        val += pi->sechdrs[sym->st_shndx].sh_addr;
+                val += relas[i].r_addend;
+                addr = section->sh_addr + relas[i].r_offset;
+                switch (ELF64_R_TYPE(relas[i].r_info)) {
+                case R_390_8:           /* Direct 8 bit.   */
+                        *(u8 *)loc = val;
+                        break;
+                case R_390_12:          /* Direct 12 bit.  */
+                        *(u16 *)loc &= 0xf000;
+                        *(u16 *)loc |= val & 0xfff;
+                        break;
+                case R_390_16:          /* Direct 16 bit.  */
+                        *(u16 *)loc = val;
+                        break;
+                case R_390_20:          /* Direct 20 bit.  */
+                        *(u32 *)loc &= 0xf00000ff;
+                        *(u32 *)loc |= (val & 0xfff) << 16;     /* DL */
+                        *(u32 *)loc |= (val & 0xff000) >> 4;    /* DH */
+                        break;
+                case R_390_32:          /* Direct 32 bit.  */
+                        *(u32 *)loc = val;
+                        break;
+                case R_390_64:          /* Direct 64 bit.  */
+                        *(u64 *)loc = val;
+                        break;
+                case R_390_PC16:        /* PC relative 16 bit.  */
+                        *(u16 *)loc = (val - addr);
+                        break;
+                case R_390_PC16DBL:     /* PC relative 16 bit shifted by 1.  */
+                        *(u16 *)loc = (val - addr) >> 1;
+                        break;
+                case R_390_PC32DBL:     /* PC relative 32 bit shifted by 1.  */
+                        *(u32 *)loc = (val - addr) >> 1;
+                        break;
+                case R_390_PC32:        /* PC relative 32 bit.  */
+                        *(u32 *)loc = (val - addr);
+                        break;
+                case R_390_PC64:        /* PC relative 64 bit.  */
+                        *(u64 *)loc = (val - addr);
+                        break;
+                default:
+                        break;
+                }
+        }
+        return 0;
+}
+int arch_kexec_kernel_image_probe(struct kimage *image, void *buf,
+                                  unsigned long buf_len)
+{
+        /* A kernel must be at least large enough to contain head.S. During
+         * load memory in head.S will be accessed, e.g. to register the next
+         * command line. If the next kernel were smaller the current kernel
+         * will panic at load.
+         *
+         * 0x11000 = sizeof(head.S)
+         */
+        if (buf_len < 0x11000)
+                return -ENOEXEC;
+        return kexec_image_probe_default(image, buf, buf_len);
+}
diff --git a/arch/s390/kernel/nospec-branch.c b/arch/s390/kernel/nospec-branch.c
index f236ce8757e8..46d49a11663f 100644
--- a/arch/s390/kernel/nospec-branch.c
+++ b/arch/s390/kernel/nospec-branch.c
@@ -1,6 +1,7 @@
 // SPDX-License-Identifier: GPL-2.0
 #include <linux/module.h>
 #include <linux/device.h>
+#include <linux/cpu.h>
 #include <asm/nospec-branch.h>
 static int __init nobp_setup_early(char *str)
diff --git a/arch/s390/kernel/perf_cpum_cf_events.c b/arch/s390/kernel/perf_cpum_cf_events.c
index c5bc3f209652..5ee27dc9a10c 100644
--- a/arch/s390/kernel/perf_cpum_cf_events.c
+++ b/arch/s390/kernel/perf_cpum_cf_events.c
@@ -583,6 +583,7 @@ __init const struct attribute_group **cpumf_cf_event_group(void)
                model = cpumcf_z13_pmu_event_attr;
                break;
        case 0x3906:
+        case 0x3907:
                model = cpumcf_z14_pmu_event_attr;
                break;
        default:
diff --git a/arch/s390/kernel/setup.c b/arch/s390/kernel/setup.c
index fc3b4aa185cc..d82a9ec64ea9 100644
--- a/arch/s390/kernel/setup.c
+++ b/arch/s390/kernel/setup.c
@@ -821,6 +821,7 @@ static int __init setup_hwcaps(void)
                strcpy(elf_platform, "z13");
                break;
        case 0x3906:
+        case 0x3907:
                strcpy(elf_platform, "z14");
                break;
        }
diff --git a/arch/s390/kernel/syscalls/syscall.tbl b/arch/s390/kernel/syscalls/syscall.tbl
index b38d48464368..8b210ead7956 100644
--- a/arch/s390/kernel/syscalls/syscall.tbl
+++ b/arch/s390/kernel/syscalls/syscall.tbl
@@ -388,3 +388,4 @@
 378  common     s390_guarded_storage    sys_s390_guarded_storage        compat_sys_s390_guarded_storage
 379  common     statx                   sys_statx                       compat_sys_statx
 380  common     s390_sthyi              sys_s390_sthyi                  compat_sys_s390_sthyi
+381  common     kexec_file_load         sys_kexec_file_load             compat_sys_kexec_file_load
diff --git a/arch/s390/purgatory/.gitignore b/arch/s390/purgatory/.gitignore
new file mode 100644
index 000000000000..e9e66f178a6d
--- /dev/null
+++ b/arch/s390/purgatory/.gitignore
@@ -0,0 +1,2 @@
+kexec-purgatory.c
+purgatory.ro
diff --git a/arch/s390/purgatory/Makefile b/arch/s390/purgatory/Makefile
new file mode 100644
index 000000000000..e9525bc1b4a6
--- /dev/null
+++ b/arch/s390/purgatory/Makefile
@@ -0,0 +1,37 @@
+# SPDX-License-Identifier: GPL-2.0
+OBJECT_FILES_NON_STANDARD := y
+purgatory-y := head.o purgatory.o string.o sha256.o mem.o
+targets += $(purgatory-y) purgatory.ro kexec-purgatory.c
+PURGATORY_OBJS = $(addprefix $(obj)/,$(purgatory-y))
+$(obj)/sha256.o: $(srctree)/lib/sha256.c
+        $(call if_changed_rule,cc_o_c)
+$(obj)/mem.o: $(srctree)/arch/s390/lib/mem.S
+        $(call if_changed_rule,as_o_S)
+$(obj)/string.o: $(srctree)/arch/s390/lib/string.c
+        $(call if_changed_rule,cc_o_c)
+LDFLAGS_purgatory.ro := -e purgatory_start -r --no-undefined -nostdlib
+LDFLAGS_purgatory.ro += -z nodefaultlib
+KBUILD_CFLAGS := -fno-strict-aliasing -Wall -Wstrict-prototypes
+KBUILD_CFLAGS += -Wno-pointer-sign -Wno-sign-compare
+KBUILD_CFLAGS += -fno-zero-initialized-in-bss -fno-builtin -ffreestanding
+KBUILD_CFLAGS += -c -MD -Os -m64
+KBUILD_CFLAGS += $(call cc-option,-fno-PIE)
+$(obj)/purgatory.ro: $(PURGATORY_OBJS) FORCE
+                $(call if_changed,ld)
+CMD_BIN2C = $(objtree)/scripts/basic/bin2c
+quiet_cmd_bin2c = BIN2C   $@
+      cmd_bin2c = $(CMD_BIN2C) kexec_purgatory < $< > $@
+$(obj)/kexec-purgatory.c: $(obj)/purgatory.ro FORCE
+        $(call if_changed,bin2c)
+obj-$(CONFIG_ARCH_HAS_KEXEC_PURGATORY) += kexec-purgatory.o
diff --git a/arch/s390/purgatory/head.S b/arch/s390/purgatory/head.S
new file mode 100644
index 000000000000..660c96a05a9b
--- /dev/null
+++ b/arch/s390/purgatory/head.S
@@ -0,0 +1,279 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+/*
+ * Purgatory setup code
+ *
+ * Copyright IBM Corp. 2018
+ *
+ * Author(s): Philipp Rudo <prudo@linux.vnet.ibm.com>
+ */
+#include <linux/linkage.h>
+#include <asm/asm-offsets.h>
+#include <asm/page.h>
+#include <asm/sigp.h>
+/* The purgatory is the code running between two kernels. It's main purpose
+ * is to verify that the next kernel was not corrupted after load and to
+ * start it.
+ *
+ * If the next kernel is a crash kernel there are some peculiarities to
+ * consider:
+ *
+ * First the purgatory is called twice. Once only to verify the
+ * sha digest. So if the crash kernel got corrupted the old kernel can try
+ * to trigger a stand-alone dumper. And once to actually load the crash kernel.
+ *
+ * Second the purgatory also has to swap the crash memory region with its
+ * destination at address 0. As the purgatory is part of crash memory this
+ * requires some finesse. The tactic here is that the purgatory first copies
+ * itself to the end of the destination and then swaps the rest of the
+ * memory running from there.
+ */
+#define bufsz purgatory_end-stack
+.macro MEMCPY dst,src,len
+        lgr     %r0,\dst
+        lgr     %r1,\len
+        lgr     %r2,\src
+        lgr     %r3,\len
+20:     mvcle   %r0,%r2,0
+        jo      20b
+.endm
+.macro MEMSWAP dst,src,buf,len
+10:     cghi    \len,bufsz
+        jh      11f
+        lgr     %r4,\len
+        j       12f
+11:     lghi    %r4,bufsz
+12:     MEMCPY  \buf,\dst,%r4
+        MEMCPY  \dst,\src,%r4
+        MEMCPY  \src,\buf,%r4
+        agr     \dst,%r4
+        agr     \src,%r4
+        sgr     \len,%r4
+        cghi    \len,0
+        jh      10b
+.endm
+.macro START_NEXT_KERNEL base
+        lg      %r4,kernel_entry-\base(%r13)
+        lg      %r5,load_psw_mask-\base(%r13)
+        ogr     %r4,%r5
+        stg     %r4,0(%r0)
+        xgr     %r0,%r0
+        diag    %r0,%r0,0x308
+.endm
+.text
+.align PAGE_SIZE
+ENTRY(purgatory_start)
+        /* The purgatory might be called after a diag308 so better set
+         * architecture and addressing mode.
+         */
+        lhi     %r1,1
+        sigp    %r1,%r0,SIGP_SET_ARCHITECTURE
+        sam64
+        larl    %r5,gprregs
+        stmg    %r6,%r15,0(%r5)
+        basr    %r13,0
+.base_crash:
+        /* Setup stack */
+        larl    %r15,purgatory_end
+        aghi    %r15,-160
+        /* If the next kernel is KEXEC_TYPE_CRASH the purgatory is called
+         * directly with a flag passed in %r2 whether the purgatory shall do
+         * checksum verification only (%r2 = 0 -> verification only).
+         *
+         * Check now and preserve over C function call by storing in
+         * %r10 whith
+         *      1 -> checksum verification only
+         *      0 -> load new kernel
+         */
+        lghi    %r10,0
+        lg      %r11,kernel_type-.base_crash(%r13)
+        cghi    %r11,1          /* KEXEC_TYPE_CRASH */
+        jne     .do_checksum_verification
+        cghi    %r2,0           /* checksum verification only */
+        jne     .do_checksum_verification
+        lghi    %r10,1
+.do_checksum_verification:
+        brasl   %r14,verify_sha256_digest
+        cghi    %r10,1          /* checksum verification only */
+        je      .return_old_kernel
+        cghi    %r2,0           /* checksum match */
+        jne     .disabled_wait
+        /* If the next kernel is a crash kernel the purgatory has to swap
+         * the mem regions first.
+         */
+        cghi    %r11,1 /* KEXEC_TYPE_CRASH */
+        je      .start_crash_kernel
+        /* start normal kernel */
+        START_NEXT_KERNEL .base_crash
+.return_old_kernel:
+        lmg     %r6,%r15,gprregs-.base_crash(%r13)
+        br      %r14
+.disabled_wait:
+        lpswe   disabled_wait_psw-.base_crash(%r13)
+.start_crash_kernel:
+        /* Location of purgatory_start in crash memory */
+        lgr     %r8,%r13
+        aghi    %r8,-(.base_crash-purgatory_start)
+        /* Destination for this code i.e. end of memory to be swapped. */
+        lg      %r9,crash_size-.base_crash(%r13)
+        aghi    %r9,-(purgatory_end-purgatory_start)
+        /* Destination in crash memory, i.e. same as r9 but in crash memory. */
+        lg      %r10,crash_start-.base_crash(%r13)
+        agr     %r10,%r9
+        /* Buffer location (in crash memory) and size. As the purgatory is
+         * behind the point of no return it can re-use the stack as buffer.
+         */
+        lghi    %r11,bufsz
+        larl    %r12,stack
+        MEMCPY  %r12,%r9,%r11   /* dst  -> (crash) buf */
+        MEMCPY  %r9,%r8,%r11    /* self -> dst */
+        /* Jump to new location. */
+        lgr     %r7,%r9
+        aghi    %r7,.jump_to_dst-purgatory_start
+        br      %r7
+.jump_to_dst:
+        basr    %r13,0
+.base_dst:
+        /* clear buffer */
+        MEMCPY  %r12,%r10,%r11  /* (crash) buf -> (crash) dst */
+        /* Load new buffer location after jump */
+        larl    %r7,stack
+        aghi    %r10,stack-purgatory_start
+        MEMCPY  %r10,%r7,%r11   /* (new) buf -> (crash) buf */
+        /* Now the code is set up to run from its designated location. Start
+         * swapping the rest of crash memory now.
+         *
+         * The registers will be used as follow:
+         *
+         *      %r0-%r4 reserved for macros defined above
+         *      %r5-%r6 tmp registers
+         *      %r7     pointer to current struct sha region
+         *      %r8     index to iterate over all sha regions
+         *      %r9     pointer in crash memory
+         *      %r10    pointer in old kernel
+         *      %r11    total size (still) to be moved
+         *      %r12    pointer to buffer
+         */
+        lgr     %r12,%r7
+        lgr     %r11,%r9
+        lghi    %r10,0
+        lg      %r9,crash_start-.base_dst(%r13)
+        lghi    %r8,16  /* KEXEC_SEGMENTS_MAX */
+        larl    %r7,purgatory_sha_regions
+        j .loop_first
+        /* Loop over all purgatory_sha_regions. */
+.loop_next:
+        aghi    %r8,-1
+        cghi    %r8,0
+        je      .loop_out
+        aghi    %r7,__KEXEC_SHA_REGION_SIZE
+.loop_first:
+        lg      %r5,__KEXEC_SHA_REGION_START(%r7)
+        cghi    %r5,0
+        je      .loop_next
+        /* Copy [end last sha region, start current sha region) */
+        /* Note: kexec_sha_region->start points in crash memory */
+        sgr     %r5,%r9
+        MEMCPY  %r9,%r10,%r5
+        agr     %r9,%r5
+        agr     %r10,%r5
+        sgr     %r11,%r5
+        /* Swap sha region */
+        lg      %r6,__KEXEC_SHA_REGION_LEN(%r7)
+        MEMSWAP %r9,%r10,%r12,%r6
+        sg      %r11,__KEXEC_SHA_REGION_LEN(%r7)
+        j       .loop_next
+.loop_out:
+        /* Copy rest of crash memory */
+        MEMCPY  %r9,%r10,%r11
+        /* start crash kernel */
+        START_NEXT_KERNEL .base_dst
+load_psw_mask:
+        .long   0x00080000,0x80000000
+        .align  8
+disabled_wait_psw:
+        .quad   0x0002000180000000
+        .quad   0x0000000000000000 + .do_checksum_verification
+gprregs:
+        .rept   10
+        .quad   0
+        .endr
+purgatory_sha256_digest:
+        .global purgatory_sha256_digest
+        .rept   32      /* SHA256_DIGEST_SIZE */
+        .byte   0
+        .endr
+purgatory_sha_regions:
+        .global purgatory_sha_regions
+        .rept   16 * __KEXEC_SHA_REGION_SIZE    /* KEXEC_SEGMENTS_MAX */
+        .byte   0
+        .endr
+kernel_entry:
+        .global kernel_entry
+        .quad   0
+kernel_type:
+        .global kernel_type
+        .quad   0
+crash_start:
+        .global crash_start
+        .quad   0
+crash_size:
+        .global crash_size
+        .quad   0
+        .align  PAGE_SIZE
+stack:
+        /* The buffer to move this code must be as big as the code. */
+        .skip   stack-purgatory_start
+        .align  PAGE_SIZE
+purgatory_end:
diff --git a/arch/s390/purgatory/purgatory.c b/arch/s390/purgatory/purgatory.c
new file mode 100644
index 000000000000..4e2beb3c29b7
--- /dev/null
+++ b/arch/s390/purgatory/purgatory.c
@@ -0,0 +1,42 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * Purgatory code running between two kernels.
+ *
+ * Copyright IBM Corp. 2018
+ *
+ * Author(s): Philipp Rudo <prudo@linux.vnet.ibm.com>
+ */
+#include <linux/kexec.h>
+#include <linux/sha256.h>
+#include <linux/string.h>
+#include <asm/purgatory.h>
+struct kexec_sha_region purgatory_sha_regions[KEXEC_SEGMENT_MAX];
+u8 purgatory_sha256_digest[SHA256_DIGEST_SIZE];
+u64 kernel_entry;
+u64 kernel_type;
+u64 crash_start;
+u64 crash_size;
+int verify_sha256_digest(void)
+{
+        struct kexec_sha_region *ptr, *end;
+        u8 digest[SHA256_DIGEST_SIZE];
+        struct sha256_state sctx;
+        sha256_init(&sctx);
+        end = purgatory_sha_regions + ARRAY_SIZE(purgatory_sha_regions);
+        for (ptr = purgatory_sha_regions; ptr < end; ptr++)
+                sha256_update(&sctx, (uint8_t *)(ptr->start), ptr->len);
+        sha256_final(&sctx, digest);
+        if (memcmp(digest, purgatory_sha256_digest, sizeof(digest)))
+                return 1;
+        return 0;
+}
diff --git a/arch/x86/include/asm/kvm_host.h b/arch/x86/include/asm/kvm_host.h
index 949c977bc4c9..c25775fad4ed 100644
--- a/arch/x86/include/asm/kvm_host.h
+++ b/arch/x86/include/asm/kvm_host.h
@@ -1013,6 +1013,7 @@ struct kvm_x86_ops {
        bool (*has_wbinvd_exit)(void);
+        u64 (*read_l1_tsc_offset)(struct kvm_vcpu *vcpu);
        void (*write_tsc_offset)(struct kvm_vcpu *vcpu, u64 offset);
        void (*get_exit_info)(struct kvm_vcpu *vcpu, u64 *info1, u64 *info2);
diff --git a/arch/x86/kernel/kexec-bzimage64.c b/arch/x86/kernel/kexec-bzimage64.c
index 3182908b7e6c..7326078eaa7a 100644
--- a/arch/x86/kernel/kexec-bzimage64.c
+++ b/arch/x86/kernel/kexec-bzimage64.c
@@ -398,11 +398,10 @@ static void *bzImage64_load(struct kimage *image, char *kernel,
         * little bit simple
         */
        efi_map_sz = efi_get_runtime_map_size();
-        efi_map_sz = ALIGN(efi_map_sz, 16);
        params_cmdline_sz = sizeof(struct boot_params) + cmdline_len +
                                MAX_ELFCOREHDR_STR_LEN;
        params_cmdline_sz = ALIGN(params_cmdline_sz, 16);
-        kbuf.bufsz = params_cmdline_sz + efi_map_sz +
+        kbuf.bufsz = params_cmdline_sz + ALIGN(efi_map_sz, 16) +
                                sizeof(struct setup_data) +
                                sizeof(struct efi_setup_data);
@@ -410,7 +409,7 @@ static void *bzImage64_load(struct kimage *image, char *kernel,
        if (!params)
                return ERR_PTR(-ENOMEM);
        efi_map_offset = params_cmdline_sz;
-        efi_setup_data_offset = efi_map_offset + efi_map_sz;
+        efi_setup_data_offset = efi_map_offset + ALIGN(efi_map_sz, 16);
        /* Copy setup header onto bootparams. Documentation/x86/boot.txt */
        setup_header_size = 0x0202 + kernel[0x0201] - setup_hdr_offset;
diff --git a/arch/x86/kernel/ldt.c b/arch/x86/kernel/ldt.c
index d41d896481b8..c9b14020f4dd 100644
--- a/arch/x86/kernel/ldt.c
+++ b/arch/x86/kernel/ldt.c
@@ -166,7 +166,7 @@ map_ldt_struct(struct mm_struct *mm, struct ldt_struct *ldt, int slot)
                 */
                pte_prot = __pgprot(__PAGE_KERNEL_RO & ~_PAGE_GLOBAL);
                /* Filter out unsuppored __PAGE_KERNEL* bits: */
-                pgprot_val(pte_prot) |= __supported_pte_mask;
+                pgprot_val(pte_prot) &= __supported_pte_mask;
                pte = pfn_pte(pfn, pte_prot);
                set_pte_at(mm, va, ptep, pte);
                pte_unmap_unlock(ptep, ptl);
diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c
index b58787daf9f8..1fc05e428aba 100644
--- a/arch/x86/kvm/svm.c
+++ b/arch/x86/kvm/svm.c
@@ -1423,12 +1423,23 @@ static void init_sys_seg(struct vmcb_seg *seg, uint32_t type)
        seg->base = 0;
 }
+static u64 svm_read_l1_tsc_offset(struct kvm_vcpu *vcpu)
+{
+        struct vcpu_svm *svm = to_svm(vcpu);
+        if (is_guest_mode(vcpu))
+                return svm->nested.hsave->control.tsc_offset;
+        return vcpu->arch.tsc_offset;
+}
 static void svm_write_tsc_offset(struct kvm_vcpu *vcpu, u64 offset)
 {
        struct vcpu_svm *svm = to_svm(vcpu);
        u64 g_tsc_offset = 0;
        if (is_guest_mode(vcpu)) {
+                /* Write L1's TSC offset.  */
                g_tsc_offset = svm->vmcb->control.tsc_offset -
                               svm->nested.hsave->control.tsc_offset;
                svm->nested.hsave->control.tsc_offset = offset;
@@ -3322,6 +3333,7 @@ static int nested_svm_vmexit(struct vcpu_svm *svm)
        /* Restore the original control entries */
        copy_vmcb_control_area(vmcb, hsave);
+        svm->vcpu.arch.tsc_offset = svm->vmcb->control.tsc_offset;
        kvm_clear_exception_queue(&svm->vcpu);
        kvm_clear_interrupt_queue(&svm->vcpu);
@@ -3482,10 +3494,12 @@ static void enter_svm_guest_mode(struct vcpu_svm *svm, u64 vmcb_gpa,
        /* We don't want to see VMMCALLs from a nested guest */
        clr_intercept(svm, INTERCEPT_VMMCALL);
+        svm->vcpu.arch.tsc_offset += nested_vmcb->control.tsc_offset;
+        svm->vmcb->control.tsc_offset = svm->vcpu.arch.tsc_offset;
        svm->vmcb->control.virt_ext = nested_vmcb->control.virt_ext;
        svm->vmcb->control.int_vector = nested_vmcb->control.int_vector;
        svm->vmcb->control.int_state = nested_vmcb->control.int_state;
-        svm->vmcb->control.tsc_offset += nested_vmcb->control.tsc_offset;
        svm->vmcb->control.event_inj = nested_vmcb->control.event_inj;
        svm->vmcb->control.event_inj_err = nested_vmcb->control.event_inj_err;
@@ -4035,12 +4049,6 @@ static int svm_get_msr(struct kvm_vcpu *vcpu, struct msr_data *msr_info)
        struct vcpu_svm *svm = to_svm(vcpu);
        switch (msr_info->index) {
-        case MSR_IA32_TSC: {
-                msr_info->data = svm->vmcb->control.tsc_offset +
-                        kvm_scale_tsc(vcpu, rdtsc());
-                break;
-        }
        case MSR_STAR:
                msr_info->data = svm->vmcb->save.star;
                break;
@@ -4193,9 +4201,6 @@ static int svm_set_msr(struct kvm_vcpu *vcpu, struct msr_data *msr)
                svm->vmcb->save.g_pat = data;
                mark_dirty(svm->vmcb, VMCB_NPT);
                break;
-        case MSR_IA32_TSC:
-                kvm_write_tsc(vcpu, msr);
-                break;
        case MSR_IA32_SPEC_CTRL:
                if (!msr->host_initiated &&
                    !guest_cpuid_has(vcpu, X86_FEATURE_IBRS))
@@ -5265,9 +5270,8 @@ static int svm_update_pi_irte(struct kvm *kvm, unsigned int host_irq,
                }
                if (!ret && svm) {
-                        trace_kvm_pi_irte_update(svm->vcpu.vcpu_id,
+                        trace_kvm_pi_irte_update(host_irq, svm->vcpu.vcpu_id,
-                                                 host_irq, e->gsi,
+                                                 e->gsi, vcpu_info.vector,
-                                                 vcpu_info.vector,
                                                 vcpu_info.pi_desc_addr, set);
                }
@@ -7102,6 +7106,7 @@ static struct kvm_x86_ops svm_x86_ops __ro_after_init = {
        .has_wbinvd_exit = svm_has_wbinvd_exit,
+        .read_l1_tsc_offset = svm_read_l1_tsc_offset,
        .write_tsc_offset = svm_write_tsc_offset,
        .set_tdp_cr3 = set_tdp_cr3,
diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
index aafcc9881e88..aa66ccd6ed6c 100644
--- a/arch/x86/kvm/vmx.c
+++ b/arch/x86/kvm/vmx.c
@@ -2880,18 +2880,15 @@ static void setup_msrs(struct vcpu_vmx *vmx)
                vmx_update_msr_bitmap(&vmx->vcpu);
 }
-/*
+static u64 vmx_read_l1_tsc_offset(struct kvm_vcpu *vcpu)
- * reads and returns guest's timestamp counter "register"
- * guest_tsc = (host_tsc * tsc multiplier) >> 48 + tsc_offset
- * -- Intel TSC Scaling for Virtualization White Paper, sec 1.3
- */
-static u64 guest_read_tsc(struct kvm_vcpu *vcpu)
 {
-        u64 host_tsc, tsc_offset;
+        struct vmcs12 *vmcs12 = get_vmcs12(vcpu);
-        host_tsc = rdtsc();
+        if (is_guest_mode(vcpu) &&
-        tsc_offset = vmcs_read64(TSC_OFFSET);
+            (vmcs12->cpu_based_vm_exec_control & CPU_BASED_USE_TSC_OFFSETING))
-        return kvm_scale_tsc(vcpu, host_tsc) + tsc_offset;
+                return vcpu->arch.tsc_offset - vmcs12->tsc_offset;
+        return vcpu->arch.tsc_offset;
 }
 /*
@@ -3524,9 +3521,6 @@ static int vmx_get_msr(struct kvm_vcpu *vcpu, struct msr_data *msr_info)
 #endif
        case MSR_EFER:
                return kvm_get_msr_common(vcpu, msr_info);
-        case MSR_IA32_TSC:
-                msr_info->data = guest_read_tsc(vcpu);
-                break;
        case MSR_IA32_SPEC_CTRL:
                if (!msr_info->host_initiated &&
                    !guest_cpuid_has(vcpu, X86_FEATURE_IBRS) &&
@@ -3646,9 +3640,6 @@ static int vmx_set_msr(struct kvm_vcpu *vcpu, struct msr_data *msr_info)
                        return 1;
                vmcs_write64(GUEST_BNDCFGS, data);
                break;
-        case MSR_IA32_TSC:
-                kvm_write_tsc(vcpu, msr_info);
-                break;
        case MSR_IA32_SPEC_CTRL:
                if (!msr_info->host_initiated &&
                    !guest_cpuid_has(vcpu, X86_FEATURE_IBRS) &&
@@ -10608,6 +10599,16 @@ static inline bool nested_vmx_prepare_msr_bitmap(struct kvm_vcpu *vcpu,
        return true;
 }
+static int nested_vmx_check_apic_access_controls(struct kvm_vcpu *vcpu,
+                                          struct vmcs12 *vmcs12)
+{
+        if (nested_cpu_has2(vmcs12, SECONDARY_EXEC_VIRTUALIZE_APIC_ACCESSES) &&
+            !page_address_valid(vcpu, vmcs12->apic_access_addr))
+                return -EINVAL;
+        else
+                return 0;
+}
 static int nested_vmx_check_apicv_controls(struct kvm_vcpu *vcpu,
                                           struct vmcs12 *vmcs12)
 {
@@ -11176,11 +11177,8 @@ static int prepare_vmcs02(struct kvm_vcpu *vcpu, struct vmcs12 *vmcs12,
                vmcs_write64(GUEST_IA32_PAT, vmx->vcpu.arch.pat);
        }
-        if (vmcs12->cpu_based_vm_exec_control & CPU_BASED_USE_TSC_OFFSETING)
+        vmcs_write64(TSC_OFFSET, vcpu->arch.tsc_offset);
-                vmcs_write64(TSC_OFFSET,
-                        vcpu->arch.tsc_offset + vmcs12->tsc_offset);
-        else
-                vmcs_write64(TSC_OFFSET, vcpu->arch.tsc_offset);
        if (kvm_has_tsc_control)
                decache_tsc_multiplier(vmx);
@@ -11299,6 +11297,9 @@ static int check_vmentry_prereqs(struct kvm_vcpu *vcpu, struct vmcs12 *vmcs12)
        if (nested_vmx_check_msr_bitmap_controls(vcpu, vmcs12))
                return VMXERR_ENTRY_INVALID_CONTROL_FIELD;
+        if (nested_vmx_check_apic_access_controls(vcpu, vmcs12))
+                return VMXERR_ENTRY_INVALID_CONTROL_FIELD;
        if (nested_vmx_check_tpr_shadow_controls(vcpu, vmcs12))
                return VMXERR_ENTRY_INVALID_CONTROL_FIELD;
@@ -11420,6 +11421,7 @@ static int enter_vmx_non_root_mode(struct kvm_vcpu *vcpu, bool from_vmentry)
        struct vmcs12 *vmcs12 = get_vmcs12(vcpu);
        u32 msr_entry_idx;
        u32 exit_qual;
+        int r;
        enter_guest_mode(vcpu);
@@ -11429,26 +11431,21 @@ static int enter_vmx_non_root_mode(struct kvm_vcpu *vcpu, bool from_vmentry)
        vmx_switch_vmcs(vcpu, &vmx->nested.vmcs02);
        vmx_segment_cache_clear(vmx);
-        if (prepare_vmcs02(vcpu, vmcs12, from_vmentry, &exit_qual)) {
+        if (vmcs12->cpu_based_vm_exec_control & CPU_BASED_USE_TSC_OFFSETING)
-                leave_guest_mode(vcpu);
+                vcpu->arch.tsc_offset += vmcs12->tsc_offset;
-                vmx_switch_vmcs(vcpu, &vmx->vmcs01);
-                nested_vmx_entry_failure(vcpu, vmcs12,
+        r = EXIT_REASON_INVALID_STATE;
-                                         EXIT_REASON_INVALID_STATE, exit_qual);
+        if (prepare_vmcs02(vcpu, vmcs12, from_vmentry, &exit_qual))
-                return 1;
+                goto fail;
-        }
        nested_get_vmcs12_pages(vcpu, vmcs12);
+        r = EXIT_REASON_MSR_LOAD_FAIL;
        msr_entry_idx = nested_vmx_load_msr(vcpu,
                                            vmcs12->vm_entry_msr_load_addr,
                                            vmcs12->vm_entry_msr_load_count);
-        if (msr_entry_idx) {
+        if (msr_entry_idx)
-                leave_guest_mode(vcpu);
+                goto fail;
-                vmx_switch_vmcs(vcpu, &vmx->vmcs01);
-                nested_vmx_entry_failure(vcpu, vmcs12,
-                                EXIT_REASON_MSR_LOAD_FAIL, msr_entry_idx);
-                return 1;
-        }
        /*
         * Note no nested_vmx_succeed or nested_vmx_fail here. At this point
@@ -11457,6 +11454,14 @@ static int enter_vmx_non_root_mode(struct kvm_vcpu *vcpu, bool from_vmentry)
         * the success flag) when L2 exits (see nested_vmx_vmexit()).
         */
        return 0;
+fail:
+        if (vmcs12->cpu_based_vm_exec_control & CPU_BASED_USE_TSC_OFFSETING)
+                vcpu->arch.tsc_offset -= vmcs12->tsc_offset;
+        leave_guest_mode(vcpu);
+        vmx_switch_vmcs(vcpu, &vmx->vmcs01);
+        nested_vmx_entry_failure(vcpu, vmcs12, r, exit_qual);
+        return 1;
 }
 /*
@@ -12028,6 +12033,9 @@ static void nested_vmx_vmexit(struct kvm_vcpu *vcpu, u32 exit_reason,
        leave_guest_mode(vcpu);
+        if (vmcs12->cpu_based_vm_exec_control & CPU_BASED_USE_TSC_OFFSETING)
+                vcpu->arch.tsc_offset -= vmcs12->tsc_offset;
        if (likely(!vmx->fail)) {
                if (exit_reason == -1)
                        sync_vmcs12(vcpu, vmcs12);
@@ -12224,10 +12232,16 @@ static inline int u64_shl_div_u64(u64 a, unsigned int shift,
 static int vmx_set_hv_timer(struct kvm_vcpu *vcpu, u64 guest_deadline_tsc)
 {
-        struct vcpu_vmx *vmx = to_vmx(vcpu);
+        struct vcpu_vmx *vmx;
-        u64 tscl = rdtsc();
+        u64 tscl, guest_tscl, delta_tsc;
-        u64 guest_tscl = kvm_read_l1_tsc(vcpu, tscl);
-        u64 delta_tsc = max(guest_deadline_tsc, guest_tscl) - guest_tscl;
+        if (kvm_mwait_in_guest(vcpu->kvm))
+                return -EOPNOTSUPP;
+        vmx = to_vmx(vcpu);
+        tscl = rdtsc();
+        guest_tscl = kvm_read_l1_tsc(vcpu, tscl);
+        delta_tsc = max(guest_deadline_tsc, guest_tscl) - guest_tscl;
        /* Convert to host delta tsc if tsc scaling is enabled */
        if (vcpu->arch.tsc_scaling_ratio != kvm_default_tsc_scaling_ratio &&
@@ -12533,7 +12547,7 @@ static int vmx_update_pi_irte(struct kvm *kvm, unsigned int host_irq,
                vcpu_info.pi_desc_addr = __pa(vcpu_to_pi_desc(vcpu));
                vcpu_info.vector = irq.vector;
-                trace_kvm_pi_irte_update(vcpu->vcpu_id, host_irq, e->gsi,
+                trace_kvm_pi_irte_update(host_irq, vcpu->vcpu_id, e->gsi,
                                vcpu_info.vector, vcpu_info.pi_desc_addr, set);
                if (set)
@@ -12712,6 +12726,7 @@ static struct kvm_x86_ops vmx_x86_ops __ro_after_init = {
        .has_wbinvd_exit = cpu_has_vmx_wbinvd_exit,
+        .read_l1_tsc_offset = vmx_read_l1_tsc_offset,
        .write_tsc_offset = vmx_write_tsc_offset,
        .set_tdp_cr3 = vmx_set_cr3,
diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
index b2ff74b12ec4..51ecd381793b 100644
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -1490,7 +1490,7 @@ static void kvm_track_tsc_matching(struct kvm_vcpu *vcpu)
 static void update_ia32_tsc_adjust_msr(struct kvm_vcpu *vcpu, s64 offset)
 {
-        u64 curr_offset = vcpu->arch.tsc_offset;
+        u64 curr_offset = kvm_x86_ops->read_l1_tsc_offset(vcpu);
        vcpu->arch.ia32_tsc_adjust_msr += offset - curr_offset;
 }
@@ -1532,7 +1532,9 @@ static u64 kvm_compute_tsc_offset(struct kvm_vcpu *vcpu, u64 target_tsc)
 u64 kvm_read_l1_tsc(struct kvm_vcpu *vcpu, u64 host_tsc)
 {
-        return vcpu->arch.tsc_offset + kvm_scale_tsc(vcpu, host_tsc);
+        u64 tsc_offset = kvm_x86_ops->read_l1_tsc_offset(vcpu);
+        return tsc_offset + kvm_scale_tsc(vcpu, host_tsc);
 }
 EXPORT_SYMBOL_GPL(kvm_read_l1_tsc);
@@ -2362,6 +2364,9 @@ int kvm_set_msr_common(struct kvm_vcpu *vcpu, struct msr_data *msr_info)
                        return 1;
                vcpu->arch.smbase = data;
                break;
+        case MSR_IA32_TSC:
+                kvm_write_tsc(vcpu, msr_info);
+                break;
        case MSR_SMI_COUNT:
                if (!msr_info->host_initiated)
                        return 1;
@@ -2605,6 +2610,9 @@ int kvm_get_msr_common(struct kvm_vcpu *vcpu, struct msr_data *msr_info)
        case MSR_IA32_UCODE_REV:
                msr_info->data = vcpu->arch.microcode_version;
                break;
+        case MSR_IA32_TSC:
+                msr_info->data = kvm_scale_tsc(vcpu, rdtsc()) + vcpu->arch.tsc_offset;
+                break;
        case MSR_MTRRcap:
        case 0x200 ... 0x2ff:
                return kvm_mtrr_get_msr(vcpu, msr_info->index, &msr_info->data);
@@ -2819,7 +2827,8 @@ out:
 static inline bool kvm_can_mwait_in_guest(void)
 {
        return boot_cpu_has(X86_FEATURE_MWAIT) &&
-                !boot_cpu_has_bug(X86_BUG_MONITOR);
+                !boot_cpu_has_bug(X86_BUG_MONITOR) &&
+                boot_cpu_has(X86_FEATURE_ARAT);
 }
 int kvm_vm_ioctl_check_extension(struct kvm *kvm, long ext)
diff --git a/drivers/atm/iphase.c b/drivers/atm/iphase.c
index 44abb8a0a5e5..be076606d30e 100644
--- a/drivers/atm/iphase.c
+++ b/drivers/atm/iphase.c
@@ -671,7 +671,7 @@ static void ia_tx_poll (IADEV *iadev) {
          if ((vcc->pop) && (skb1->len != 0))
          {
             vcc->pop(vcc, skb1);
-             IF_EVENT(printk("Tansmit Done - skb 0x%lx return\n",
+             IF_EVENT(printk("Transmit Done - skb 0x%lx return\n",
                                                          (long)skb1);)
          }
          else 
@@ -1665,7 +1665,7 @@ static void tx_intr(struct atm_dev *dev)
        status = readl(iadev->seg_reg+SEG_INTR_STATUS_REG);  
        if (status & TRANSMIT_DONE){
-           IF_EVENT(printk("Tansmit Done Intr logic run\n");)
+           IF_EVENT(printk("Transmit Done Intr logic run\n");)
           spin_lock_irqsave(&iadev->tx_lock, flags);
           ia_tx_poll(iadev);
           spin_unlock_irqrestore(&iadev->tx_lock, flags);
diff --git a/drivers/block/rbd.c b/drivers/block/rbd.c
index 07dc5419bd63..8e8b04cc569a 100644
--- a/drivers/block/rbd.c
+++ b/drivers/block/rbd.c
@@ -732,6 +732,7 @@ static struct rbd_client *rbd_client_find(struct ceph_options *ceph_opts)
 */
 enum {
        Opt_queue_depth,
+        Opt_lock_timeout,
        Opt_last_int,
        /* int args above */
        Opt_last_string,
@@ -740,11 +741,13 @@ enum {
        Opt_read_write,
        Opt_lock_on_read,
        Opt_exclusive,
+        Opt_notrim,
        Opt_err
 };
 static match_table_t rbd_opts_tokens = {
        {Opt_queue_depth, "queue_depth=%d"},
+        {Opt_lock_timeout, "lock_timeout=%d"},
        /* int args above */
        /* string args above */
        {Opt_read_only, "read_only"},
@@ -753,20 +756,25 @@ static match_table_t rbd_opts_tokens = {
        {Opt_read_write, "rw"},         /* Alternate spelling */
        {Opt_lock_on_read, "lock_on_read"},
        {Opt_exclusive, "exclusive"},
+        {Opt_notrim, "notrim"},
        {Opt_err, NULL}
 };
 struct rbd_options {
        int     queue_depth;
+        unsigned long   lock_timeout;
        bool    read_only;
        bool    lock_on_read;
        bool    exclusive;
+        bool    trim;
 };
 #define RBD_QUEUE_DEPTH_DEFAULT BLKDEV_MAX_RQ
+#define RBD_LOCK_TIMEOUT_DEFAULT 0  /* no timeout */
 #define RBD_READ_ONLY_DEFAULT   false
 #define RBD_LOCK_ON_READ_DEFAULT false
 #define RBD_EXCLUSIVE_DEFAULT   false
+#define RBD_TRIM_DEFAULT        true
 static int parse_rbd_opts_token(char *c, void *private)
 {
@@ -796,6 +804,14 @@ static int parse_rbd_opts_token(char *c, void *private)
                }
                rbd_opts->queue_depth = intval;
                break;
+        case Opt_lock_timeout:
+                /* 0 is "wait forever" (i.e. infinite timeout) */
+                if (intval < 0 || intval > INT_MAX / 1000) {
+                        pr_err("lock_timeout out of range\n");
+                        return -EINVAL;
+                }
+                rbd_opts->lock_timeout = msecs_to_jiffies(intval * 1000);
+                break;
        case Opt_read_only:
                rbd_opts->read_only = true;
                break;
@@ -808,6 +824,9 @@ static int parse_rbd_opts_token(char *c, void *private)
        case Opt_exclusive:
                rbd_opts->exclusive = true;
                break;
+        case Opt_notrim:
+                rbd_opts->trim = false;
+                break;
        default:
                /* libceph prints "bad option" msg */
                return -EINVAL;
@@ -1392,7 +1411,7 @@ static bool rbd_img_is_write(struct rbd_img_request *img_req)
        case OBJ_OP_DISCARD:
                return true;
        default:
-                rbd_assert(0);
+                BUG();
        }
 }
@@ -2466,7 +2485,7 @@ again:
                }
                return false;
        default:
-                rbd_assert(0);
+                BUG();
        }
 }
@@ -2494,7 +2513,7 @@ static bool __rbd_obj_handle_request(struct rbd_obj_request *obj_req)
                }
                return false;
        default:
-                rbd_assert(0);
+                BUG();
        }
 }
@@ -3533,9 +3552,22 @@ static int rbd_obj_method_sync(struct rbd_device *rbd_dev,
 /*
 * lock_rwsem must be held for read
 */
-static void rbd_wait_state_locked(struct rbd_device *rbd_dev)
+static int rbd_wait_state_locked(struct rbd_device *rbd_dev, bool may_acquire)
 {
        DEFINE_WAIT(wait);
+        unsigned long timeout;
+        int ret = 0;
+        if (test_bit(RBD_DEV_FLAG_BLACKLISTED, &rbd_dev->flags))
+                return -EBLACKLISTED;
+        if (rbd_dev->lock_state == RBD_LOCK_STATE_LOCKED)
+                return 0;
+        if (!may_acquire) {
+                rbd_warn(rbd_dev, "exclusive lock required");
+                return -EROFS;
+        }
        do {
                /*
@@ -3547,12 +3579,22 @@ static void rbd_wait_state_locked(struct rbd_device *rbd_dev)
                prepare_to_wait_exclusive(&rbd_dev->lock_waitq, &wait,
                                          TASK_UNINTERRUPTIBLE);
                up_read(&rbd_dev->lock_rwsem);
-                schedule();
+                timeout = schedule_timeout(ceph_timeout_jiffies(
+                                                rbd_dev->opts->lock_timeout));
                down_read(&rbd_dev->lock_rwsem);
-        } while (rbd_dev->lock_state != RBD_LOCK_STATE_LOCKED &&
+                if (test_bit(RBD_DEV_FLAG_BLACKLISTED, &rbd_dev->flags)) {
-                 !test_bit(RBD_DEV_FLAG_BLACKLISTED, &rbd_dev->flags));
+                        ret = -EBLACKLISTED;
+                        break;
+                }
+                if (!timeout) {
+                        rbd_warn(rbd_dev, "timed out waiting for lock");
+                        ret = -ETIMEDOUT;
+                        break;
+                }
+        } while (rbd_dev->lock_state != RBD_LOCK_STATE_LOCKED);
        finish_wait(&rbd_dev->lock_waitq, &wait);
+        return ret;
 }
 static void rbd_queue_workfn(struct work_struct *work)
@@ -3638,19 +3680,10 @@ static void rbd_queue_workfn(struct work_struct *work)
            (op_type != OBJ_OP_READ || rbd_dev->opts->lock_on_read);
        if (must_be_locked) {
                down_read(&rbd_dev->lock_rwsem);
-                if (rbd_dev->lock_state != RBD_LOCK_STATE_LOCKED &&
+                result = rbd_wait_state_locked(rbd_dev,
-                    !test_bit(RBD_DEV_FLAG_BLACKLISTED, &rbd_dev->flags)) {
+                                               !rbd_dev->opts->exclusive);
-                        if (rbd_dev->opts->exclusive) {
+                if (result)
-                                rbd_warn(rbd_dev, "exclusive lock required");
-                                result = -EROFS;
-                                goto err_unlock;
-                        }
-                        rbd_wait_state_locked(rbd_dev);
-                }
-                if (test_bit(RBD_DEV_FLAG_BLACKLISTED, &rbd_dev->flags)) {
-                        result = -EBLACKLISTED;
                        goto err_unlock;
-                }
        }
        img_request = rbd_img_request_create(rbd_dev, op_type, snapc);
@@ -3902,7 +3935,8 @@ static int rbd_init_disk(struct rbd_device *rbd_dev)
 {
        struct gendisk *disk;
        struct request_queue *q;
-        u64 segment_size;
+        unsigned int objset_bytes =
+            rbd_dev->layout.object_size * rbd_dev->layout.stripe_count;
        int err;
        /* create gendisk info */
@@ -3942,20 +3976,19 @@ static int rbd_init_disk(struct rbd_device *rbd_dev)
        blk_queue_flag_set(QUEUE_FLAG_NONROT, q);
        /* QUEUE_FLAG_ADD_RANDOM is off by default for blk-mq */
-        /* set io sizes to object size */
+        blk_queue_max_hw_sectors(q, objset_bytes >> SECTOR_SHIFT);
-        segment_size = rbd_obj_bytes(&rbd_dev->header);
-        blk_queue_max_hw_sectors(q, segment_size / SECTOR_SIZE);
        q->limits.max_sectors = queue_max_hw_sectors(q);
        blk_queue_max_segments(q, USHRT_MAX);
        blk_queue_max_segment_size(q, UINT_MAX);
-        blk_queue_io_min(q, segment_size);
+        blk_queue_io_min(q, objset_bytes);
-        blk_queue_io_opt(q, segment_size);
+        blk_queue_io_opt(q, objset_bytes);
-        /* enable the discard support */
+        if (rbd_dev->opts->trim) {
-        blk_queue_flag_set(QUEUE_FLAG_DISCARD, q);
+                blk_queue_flag_set(QUEUE_FLAG_DISCARD, q);
-        q->limits.discard_granularity = segment_size;
+                q->limits.discard_granularity = objset_bytes;
-        blk_queue_max_discard_sectors(q, segment_size / SECTOR_SIZE);
+                blk_queue_max_discard_sectors(q, objset_bytes >> SECTOR_SHIFT);
-        blk_queue_max_write_zeroes_sectors(q, segment_size / SECTOR_SIZE);
+                blk_queue_max_write_zeroes_sectors(q, objset_bytes >> SECTOR_SHIFT);
+        }
        if (!ceph_test_opt(rbd_dev->rbd_client->client, NOCRC))
                q->backing_dev_info->capabilities |= BDI_CAP_STABLE_WRITES;
@@ -5179,8 +5212,10 @@ static int rbd_add_parse_args(const char *buf,
        rbd_opts->read_only = RBD_READ_ONLY_DEFAULT;
        rbd_opts->queue_depth = RBD_QUEUE_DEPTH_DEFAULT;
+        rbd_opts->lock_timeout = RBD_LOCK_TIMEOUT_DEFAULT;
        rbd_opts->lock_on_read = RBD_LOCK_ON_READ_DEFAULT;
        rbd_opts->exclusive = RBD_EXCLUSIVE_DEFAULT;
+        rbd_opts->trim = RBD_TRIM_DEFAULT;
        copts = ceph_parse_options(options, mon_addrs,
                                        mon_addrs + mon_addrs_size - 1,
@@ -5216,6 +5251,8 @@ static void rbd_dev_image_unlock(struct rbd_device *rbd_dev)
 static int rbd_add_acquire_lock(struct rbd_device *rbd_dev)
 {
+        int ret;
        if (!(rbd_dev->header.features & RBD_FEATURE_EXCLUSIVE_LOCK)) {
                rbd_warn(rbd_dev, "exclusive-lock feature is not enabled");
                return -EINVAL;
@@ -5223,9 +5260,9 @@ static int rbd_add_acquire_lock(struct rbd_device *rbd_dev)
        /* FIXME: "rbd map --exclusive" should be in interruptible */
        down_read(&rbd_dev->lock_rwsem);
-        rbd_wait_state_locked(rbd_dev);
+        ret = rbd_wait_state_locked(rbd_dev, true);
        up_read(&rbd_dev->lock_rwsem);
-        if (test_bit(RBD_DEV_FLAG_BLACKLISTED, &rbd_dev->flags)) {
+        if (ret) {
                rbd_warn(rbd_dev, "failed to acquire exclusive lock");
                return -EROFS;
        }
diff --git a/drivers/char/random.c b/drivers/char/random.c
index e027e7fa1472..3cd3aae24d6d 100644
--- a/drivers/char/random.c
+++ b/drivers/char/random.c
@@ -427,8 +427,9 @@ struct crng_state primary_crng = {
 * its value (from 0->1->2).
 */
 static int crng_init = 0;
-#define crng_ready() (likely(crng_init > 0))
+#define crng_ready() (likely(crng_init > 1))
 static int crng_init_cnt = 0;
+static unsigned long crng_global_init_time = 0;
 #define CRNG_INIT_CNT_THRESH (2*CHACHA20_KEY_SIZE)
 static void _extract_crng(struct crng_state *crng,
                          __u32 out[CHACHA20_BLOCK_WORDS]);
@@ -787,6 +788,36 @@ static void crng_initialize(struct crng_state *crng)
        crng->init_time = jiffies - CRNG_RESEED_INTERVAL - 1;
 }
+#ifdef CONFIG_NUMA
+static void numa_crng_init(void)
+{
+        int i;
+        struct crng_state *crng;
+        struct crng_state **pool;
+        pool = kcalloc(nr_node_ids, sizeof(*pool), GFP_KERNEL|__GFP_NOFAIL);
+        for_each_online_node(i) {
+                crng = kmalloc_node(sizeof(struct crng_state),
+                                    GFP_KERNEL | __GFP_NOFAIL, i);
+                spin_lock_init(&crng->lock);
+                crng_initialize(crng);
+                pool[i] = crng;
+        }
+        mb();
+        if (cmpxchg(&crng_node_pool, NULL, pool)) {
+                for_each_node(i)
+                        kfree(pool[i]);
+                kfree(pool);
+        }
+}
+#else
+static void numa_crng_init(void) {}
+#endif
+/*
+ * crng_fast_load() can be called by code in the interrupt service
+ * path.  So we can't afford to dilly-dally.
+ */
 static int crng_fast_load(const char *cp, size_t len)
 {
        unsigned long flags;
@@ -794,7 +825,7 @@ static int crng_fast_load(const char *cp, size_t len)
        if (!spin_trylock_irqsave(&primary_crng.lock, flags))
                return 0;
-        if (crng_ready()) {
+        if (crng_init != 0) {
                spin_unlock_irqrestore(&primary_crng.lock, flags);
                return 0;
        }
@@ -813,6 +844,51 @@ static int crng_fast_load(const char *cp, size_t len)
        return 1;
 }
+/*
+ * crng_slow_load() is called by add_device_randomness, which has two
+ * attributes.  (1) We can't trust the buffer passed to it is
+ * guaranteed to be unpredictable (so it might not have any entropy at
+ * all), and (2) it doesn't have the performance constraints of
+ * crng_fast_load().
+ *
+ * So we do something more comprehensive which is guaranteed to touch
+ * all of the primary_crng's state, and which uses a LFSR with a
+ * period of 255 as part of the mixing algorithm.  Finally, we do
+ * *not* advance crng_init_cnt since buffer we may get may be something
+ * like a fixed DMI table (for example), which might very well be
+ * unique to the machine, but is otherwise unvarying.
+ */
+static int crng_slow_load(const char *cp, size_t len)
+{
+        unsigned long           flags;
+        static unsigned char    lfsr = 1;
+        unsigned char           tmp;
+        unsigned                i, max = CHACHA20_KEY_SIZE;
+        const char *            src_buf = cp;
+        char *                  dest_buf = (char *) &primary_crng.state[4];
+        if (!spin_trylock_irqsave(&primary_crng.lock, flags))
+                return 0;
+        if (crng_init != 0) {
+                spin_unlock_irqrestore(&primary_crng.lock, flags);
+                return 0;
+        }
+        if (len > max)
+                max = len;
+        for (i = 0; i < max ; i++) {
+                tmp = lfsr;
+                lfsr >>= 1;
+                if (tmp & 1)
+                        lfsr ^= 0xE1;
+                tmp = dest_buf[i % CHACHA20_KEY_SIZE];
+                dest_buf[i % CHACHA20_KEY_SIZE] ^= src_buf[i % len] ^ lfsr;
+                lfsr += (tmp << 3) | (tmp >> 5);
+        }
+        spin_unlock_irqrestore(&primary_crng.lock, flags);
+        return 1;
+}
 static void crng_reseed(struct crng_state *crng, struct entropy_store *r)
 {
        unsigned long   flags;
@@ -831,7 +907,7 @@ static void crng_reseed(struct crng_state *crng, struct entropy_store *r)
                _crng_backtrack_protect(&primary_crng, buf.block,
                                        CHACHA20_KEY_SIZE);
        }
-        spin_lock_irqsave(&primary_crng.lock, flags);
+        spin_lock_irqsave(&crng->lock, flags);
        for (i = 0; i < 8; i++) {
                unsigned long   rv;
                if (!arch_get_random_seed_long(&rv) &&
@@ -841,9 +917,10 @@ static void crng_reseed(struct crng_state *crng, struct entropy_store *r)
        }
        memzero_explicit(&buf, sizeof(buf));
        crng->init_time = jiffies;
-        spin_unlock_irqrestore(&primary_crng.lock, flags);
+        spin_unlock_irqrestore(&crng->lock, flags);
        if (crng == &primary_crng && crng_init < 2) {
                invalidate_batched_entropy();
+                numa_crng_init();
                crng_init = 2;
                process_random_ready_list();
                wake_up_interruptible(&crng_init_wait);
@@ -856,8 +933,9 @@ static void _extract_crng(struct crng_state *crng,
 {
        unsigned long v, flags;
-        if (crng_init > 1 &&
+        if (crng_ready() &&
-            time_after(jiffies, crng->init_time + CRNG_RESEED_INTERVAL))
+            (time_after(crng_global_init_time, crng->init_time) ||
+             time_after(jiffies, crng->init_time + CRNG_RESEED_INTERVAL)))
                crng_reseed(crng, crng == &primary_crng ? &input_pool : NULL);
        spin_lock_irqsave(&crng->lock, flags);
        if (arch_get_random_long(&v))
@@ -981,10 +1059,8 @@ void add_device_randomness(const void *buf, unsigned int size)
        unsigned long time = random_get_entropy() ^ jiffies;
        unsigned long flags;
-        if (!crng_ready()) {
+        if (!crng_ready() && size)
-                crng_fast_load(buf, size);
+                crng_slow_load(buf, size);
-                return;
-        }
        trace_add_device_randomness(size, _RET_IP_);
        spin_lock_irqsave(&input_pool.lock, flags);
@@ -1139,7 +1215,7 @@ void add_interrupt_randomness(int irq, int irq_flags)
        fast_mix(fast_pool);
        add_interrupt_bench(cycles);
-        if (!crng_ready()) {
+        if (unlikely(crng_init == 0)) {
                if ((fast_pool->count >= 64) &&
                    crng_fast_load((char *) fast_pool->pool,
                                   sizeof(fast_pool->pool))) {
@@ -1680,28 +1756,10 @@ static void init_std_data(struct entropy_store *r)
 */
 static int rand_initialize(void)
 {
-#ifdef CONFIG_NUMA
-        int i;
-        struct crng_state *crng;
-        struct crng_state **pool;
-#endif
        init_std_data(&input_pool);
        init_std_data(&blocking_pool);
        crng_initialize(&primary_crng);
+        crng_global_init_time = jiffies;
-#ifdef CONFIG_NUMA
-        pool = kcalloc(nr_node_ids, sizeof(*pool), GFP_KERNEL|__GFP_NOFAIL);
-        for_each_online_node(i) {
-                crng = kmalloc_node(sizeof(struct crng_state),
-                                    GFP_KERNEL | __GFP_NOFAIL, i);
-                spin_lock_init(&crng->lock);
-                crng_initialize(crng);
-                pool[i] = crng;
-        }
-        mb();
-        crng_node_pool = pool;
-#endif
        return 0;
 }
 early_initcall(rand_initialize);
@@ -1875,6 +1933,14 @@ static long random_ioctl(struct file *f, unsigned int cmd, unsigned long arg)
                input_pool.entropy_count = 0;
                blocking_pool.entropy_count = 0;
                return 0;
+        case RNDRESEEDCRNG:
+                if (!capable(CAP_SYS_ADMIN))
+                        return -EPERM;
+                if (crng_init < 2)
+                        return -ENODATA;
+                crng_reseed(&primary_crng, NULL);
+                crng_global_init_time = jiffies - 1;
+                return 0;
        default:
                return -EINVAL;
        }
@@ -2212,7 +2278,7 @@ void add_hwgenerator_randomness(const char *buffer, size_t count,
 {
        struct entropy_store *poolp = &input_pool;
-        if (!crng_ready()) {
+        if (unlikely(crng_init == 0)) {
                crng_fast_load(buffer, count);
                return;
        }
diff --git a/drivers/clocksource/Kconfig b/drivers/clocksource/Kconfig
index 9ee2888275c1..8e8a09755d10 100644
--- a/drivers/clocksource/Kconfig
+++ b/drivers/clocksource/Kconfig
@@ -133,6 +133,14 @@ config VT8500_TIMER
        help
          Enables support for the VT8500 driver.
+config NPCM7XX_TIMER
+        bool "NPCM7xx timer driver" if COMPILE_TEST
+        depends on HAS_IOMEM
+        select CLKSRC_MMIO
+        help
+          Enable 24-bit TIMER0 and TIMER1 counters in the NPCM7xx architecture,
+          While TIMER0 serves as clockevent and TIMER1 serves as clocksource.
 config CADENCE_TTC_TIMER
        bool "Cadence TTC timer driver" if COMPILE_TEST
        depends on COMMON_CLK
diff --git a/drivers/clocksource/Makefile b/drivers/clocksource/Makefile
index e8e76dfef00b..00caf37e52f9 100644
--- a/drivers/clocksource/Makefile
+++ b/drivers/clocksource/Makefile
@@ -56,6 +56,7 @@ obj-$(CONFIG_CLKSRC_NPS)	+= timer-nps.o
 obj-$(CONFIG_OXNAS_RPS_TIMER)   += timer-oxnas-rps.o
 obj-$(CONFIG_OWL_TIMER)         += owl-timer.o
 obj-$(CONFIG_SPRD_TIMER)        += timer-sprd.o
+obj-$(CONFIG_NPCM7XX_TIMER)     += timer-npcm7xx.o
 obj-$(CONFIG_ARC_TIMERS)                += arc_timer.o
 obj-$(CONFIG_ARM_ARCH_TIMER)            += arm_arch_timer.o
diff --git a/drivers/clocksource/timer-imx-tpm.c b/drivers/clocksource/timer-imx-tpm.c
index 21bffdcb2f20..05d97a6871d8 100644
--- a/drivers/clocksource/timer-imx-tpm.c
+++ b/drivers/clocksource/timer-imx-tpm.c
@@ -17,9 +17,14 @@
 #include <linux/of_irq.h>
 #include <linux/sched_clock.h>
+#define TPM_PARAM                       0x4
+#define TPM_PARAM_WIDTH_SHIFT           16
+#define TPM_PARAM_WIDTH_MASK            (0xff << 16)
 #define TPM_SC                          0x10
 #define TPM_SC_CMOD_INC_PER_CNT         (0x1 << 3)
 #define TPM_SC_CMOD_DIV_DEFAULT         0x3
+#define TPM_SC_CMOD_DIV_MAX             0x7
+#define TPM_SC_TOF_MASK                 (0x1 << 7)
 #define TPM_CNT                         0x14
 #define TPM_MOD                         0x18
 #define TPM_STATUS                      0x1c
@@ -29,8 +34,11 @@
 #define TPM_C0SC_MODE_SHIFT             2
 #define TPM_C0SC_MODE_MASK              0x3c
 #define TPM_C0SC_MODE_SW_COMPARE        0x4
+#define TPM_C0SC_CHF_MASK               (0x1 << 7)
 #define TPM_C0V                         0x24
+static int counter_width;
+static int rating;
 static void __iomem *timer_base;
 static struct clock_event_device clockevent_tpm;
@@ -83,10 +91,11 @@ static int __init tpm_clocksource_init(unsigned long rate)
        tpm_delay_timer.freq = rate;
        register_current_timer_delay(&tpm_delay_timer);
-        sched_clock_register(tpm_read_sched_clock, 32, rate);
+        sched_clock_register(tpm_read_sched_clock, counter_width, rate);
        return clocksource_mmio_init(timer_base + TPM_CNT, "imx-tpm",
-                                     rate, 200, 32, clocksource_mmio_readl_up);
+                                     rate, rating, counter_width,
+                                     clocksource_mmio_readl_up);
 }
 static int tpm_set_next_event(unsigned long delta,
@@ -139,7 +148,6 @@ static struct clock_event_device clockevent_tpm = {
        .set_state_oneshot      = tpm_set_state_oneshot,
        .set_next_event         = tpm_set_next_event,
        .set_state_shutdown     = tpm_set_state_shutdown,
-        .rating                 = 200,
 };
 static int __init tpm_clockevent_init(unsigned long rate, int irq)
@@ -149,10 +157,11 @@ static int __init tpm_clockevent_init(unsigned long rate, int irq)
        ret = request_irq(irq, tpm_timer_interrupt, IRQF_TIMER | IRQF_IRQPOLL,
                          "i.MX7ULP TPM Timer", &clockevent_tpm);
+        clockevent_tpm.rating = rating;
        clockevent_tpm.cpumask = cpumask_of(0);
        clockevent_tpm.irq = irq;
-        clockevents_config_and_register(&clockevent_tpm,
+        clockevents_config_and_register(&clockevent_tpm, rate, 300,
-                                        rate, 300, 0xfffffffe);
+                                        GENMASK(counter_width - 1, 1));
        return ret;
 }
@@ -179,7 +188,7 @@ static int __init tpm_timer_init(struct device_node *np)
        ipg = of_clk_get_by_name(np, "ipg");
        per = of_clk_get_by_name(np, "per");
        if (IS_ERR(ipg) || IS_ERR(per)) {
-                pr_err("tpm: failed to get igp or per clk\n");
+                pr_err("tpm: failed to get ipg or per clk\n");
                ret = -ENODEV;
                goto err_clk_get;
        }
@@ -197,6 +206,11 @@ static int __init tpm_timer_init(struct device_node *np)
                goto err_per_clk_enable;
        }
+        counter_width = (readl(timer_base + TPM_PARAM) & TPM_PARAM_WIDTH_MASK)
+                >> TPM_PARAM_WIDTH_SHIFT;
+        /* use rating 200 for 32-bit counter and 150 for 16-bit counter */
+        rating = counter_width == 0x20 ? 200 : 150;
        /*
         * Initialize tpm module to a known state
         * 1) Counter disabled
@@ -205,16 +219,25 @@ static int __init tpm_timer_init(struct device_node *np)
         * 4) Channel0 disabled
         * 5) DMA transfers disabled
         */
+        /* make sure counter is disabled */
        writel(0, timer_base + TPM_SC);
+        /* TOF is W1C */
+        writel(TPM_SC_TOF_MASK, timer_base + TPM_SC);
        writel(0, timer_base + TPM_CNT);
-        writel(0, timer_base + TPM_C0SC);
+        /* CHF is W1C */
+        writel(TPM_C0SC_CHF_MASK, timer_base + TPM_C0SC);
-        /* increase per cnt, div 8 by default */
+        /*
-        writel(TPM_SC_CMOD_INC_PER_CNT | TPM_SC_CMOD_DIV_DEFAULT,
+         * increase per cnt,
+         * div 8 for 32-bit counter and div 128 for 16-bit counter
+         */
+        writel(TPM_SC_CMOD_INC_PER_CNT |
+                (counter_width == 0x20 ?
+                TPM_SC_CMOD_DIV_DEFAULT : TPM_SC_CMOD_DIV_MAX),
                     timer_base + TPM_SC);
        /* set MOD register to maximum for free running mode */
-        writel(0xffffffff, timer_base + TPM_MOD);
+        writel(GENMASK(counter_width - 1, 0), timer_base + TPM_MOD);
        rate = clk_get_rate(per) >> 3;
        ret = tpm_clocksource_init(rate);
diff --git a/drivers/clocksource/timer-npcm7xx.c b/drivers/clocksource/timer-npcm7xx.c
new file mode 100644
index 000000000000..7a9bb5532d99
--- /dev/null
+++ b/drivers/clocksource/timer-npcm7xx.c
@@ -0,0 +1,215 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * Copyright (C) 2014-2018 Nuvoton Technologies tomer.maimon@nuvoton.com
+ * All rights reserved.
+ *
+ * Copyright 2017 Google, Inc.
+ */
+#include <linux/kernel.h>
+#include <linux/sched.h>
+#include <linux/init.h>
+#include <linux/interrupt.h>
+#include <linux/err.h>
+#include <linux/clk.h>
+#include <linux/io.h>
+#include <linux/clockchips.h>
+#include <linux/of_irq.h>
+#include <linux/of_address.h>
+#include "timer-of.h"
+/* Timers registers */
+#define NPCM7XX_REG_TCSR0       0x0 /* Timer 0 Control and Status Register */
+#define NPCM7XX_REG_TICR0       0x8 /* Timer 0 Initial Count Register */
+#define NPCM7XX_REG_TCSR1       0x4 /* Timer 1 Control and Status Register */
+#define NPCM7XX_REG_TICR1       0xc /* Timer 1 Initial Count Register */
+#define NPCM7XX_REG_TDR1        0x14 /* Timer 1 Data Register */
+#define NPCM7XX_REG_TISR        0x18 /* Timer Interrupt Status Register */
+/* Timers control */
+#define NPCM7XX_Tx_RESETINT             0x1f
+#define NPCM7XX_Tx_PERIOD               BIT(27)
+#define NPCM7XX_Tx_INTEN                BIT(29)
+#define NPCM7XX_Tx_COUNTEN              BIT(30)
+#define NPCM7XX_Tx_ONESHOT              0x0
+#define NPCM7XX_Tx_OPER                 GENMASK(3, 27)
+#define NPCM7XX_Tx_MIN_PRESCALE         0x1
+#define NPCM7XX_Tx_TDR_MASK_BITS        24
+#define NPCM7XX_Tx_MAX_CNT              0xFFFFFF
+#define NPCM7XX_T0_CLR_INT              0x1
+#define NPCM7XX_Tx_CLR_CSR              0x0
+/* Timers operating mode */
+#define NPCM7XX_START_PERIODIC_Tx (NPCM7XX_Tx_PERIOD | NPCM7XX_Tx_COUNTEN | \
+                                        NPCM7XX_Tx_INTEN | \
+                                        NPCM7XX_Tx_MIN_PRESCALE)
+#define NPCM7XX_START_ONESHOT_Tx (NPCM7XX_Tx_ONESHOT | NPCM7XX_Tx_COUNTEN | \
+                                        NPCM7XX_Tx_INTEN | \
+                                        NPCM7XX_Tx_MIN_PRESCALE)
+#define NPCM7XX_START_Tx (NPCM7XX_Tx_COUNTEN | NPCM7XX_Tx_PERIOD | \
+                                NPCM7XX_Tx_MIN_PRESCALE)
+#define NPCM7XX_DEFAULT_CSR (NPCM7XX_Tx_CLR_CSR | NPCM7XX_Tx_MIN_PRESCALE)
+static int npcm7xx_timer_resume(struct clock_event_device *evt)
+{
+        struct timer_of *to = to_timer_of(evt);
+        u32 val;
+        val = readl(timer_of_base(to) + NPCM7XX_REG_TCSR0);
+        val |= NPCM7XX_Tx_COUNTEN;
+        writel(val, timer_of_base(to) + NPCM7XX_REG_TCSR0);
+        return 0;
+}
+static int npcm7xx_timer_shutdown(struct clock_event_device *evt)
+{
+        struct timer_of *to = to_timer_of(evt);
+        u32 val;
+        val = readl(timer_of_base(to) + NPCM7XX_REG_TCSR0);
+        val &= ~NPCM7XX_Tx_COUNTEN;
+        writel(val, timer_of_base(to) + NPCM7XX_REG_TCSR0);
+        return 0;
+}
+static int npcm7xx_timer_oneshot(struct clock_event_device *evt)
+{
+        struct timer_of *to = to_timer_of(evt);
+        u32 val;
+        val = readl(timer_of_base(to) + NPCM7XX_REG_TCSR0);
+        val &= ~NPCM7XX_Tx_OPER;
+        val = readl(timer_of_base(to) + NPCM7XX_REG_TCSR0);
+        val |= NPCM7XX_START_ONESHOT_Tx;
+        writel(val, timer_of_base(to) + NPCM7XX_REG_TCSR0);
+        return 0;
+}
+static int npcm7xx_timer_periodic(struct clock_event_device *evt)
+{
+        struct timer_of *to = to_timer_of(evt);
+        u32 val;
+        val = readl(timer_of_base(to) + NPCM7XX_REG_TCSR0);
+        val &= ~NPCM7XX_Tx_OPER;
+        writel(timer_of_period(to), timer_of_base(to) + NPCM7XX_REG_TICR0);
+        val |= NPCM7XX_START_PERIODIC_Tx;
+        writel(val, timer_of_base(to) + NPCM7XX_REG_TCSR0);
+        return 0;
+}
+static int npcm7xx_clockevent_set_next_event(unsigned long evt,
+                struct clock_event_device *clk)
+{
+        struct timer_of *to = to_timer_of(clk);
+        u32 val;
+        writel(evt, timer_of_base(to) + NPCM7XX_REG_TICR0);
+        val = readl(timer_of_base(to) + NPCM7XX_REG_TCSR0);
+        val |= NPCM7XX_START_Tx;
+        writel(val, timer_of_base(to) + NPCM7XX_REG_TCSR0);
+        return 0;
+}
+static irqreturn_t npcm7xx_timer0_interrupt(int irq, void *dev_id)
+{
+        struct clock_event_device *evt = (struct clock_event_device *)dev_id;
+        struct timer_of *to = to_timer_of(evt);
+        writel(NPCM7XX_T0_CLR_INT, timer_of_base(to) + NPCM7XX_REG_TISR);
+        evt->event_handler(evt);
+        return IRQ_HANDLED;
+}
+static struct timer_of npcm7xx_to = {
+        .flags = TIMER_OF_IRQ | TIMER_OF_BASE | TIMER_OF_CLOCK,
+        .clkevt = {
+                .name               = "npcm7xx-timer0",
+                .features           = CLOCK_EVT_FEAT_PERIODIC |
+                                      CLOCK_EVT_FEAT_ONESHOT,
+                .set_next_event     = npcm7xx_clockevent_set_next_event,
+                .set_state_shutdown = npcm7xx_timer_shutdown,
+                .set_state_periodic = npcm7xx_timer_periodic,
+                .set_state_oneshot  = npcm7xx_timer_oneshot,
+                .tick_resume        = npcm7xx_timer_resume,
+                .rating             = 300,
+        },
+        .of_irq = {
+                .handler = npcm7xx_timer0_interrupt,
+                .flags = IRQF_TIMER | IRQF_IRQPOLL,
+        },
+};
+static void __init npcm7xx_clockevents_init(void)
+{
+        writel(NPCM7XX_DEFAULT_CSR,
+                timer_of_base(&npcm7xx_to) + NPCM7XX_REG_TCSR0);
+        writel(NPCM7XX_Tx_RESETINT,
+                timer_of_base(&npcm7xx_to) + NPCM7XX_REG_TISR);
+        npcm7xx_to.clkevt.cpumask = cpumask_of(0);
+        clockevents_config_and_register(&npcm7xx_to.clkevt,
+                                        timer_of_rate(&npcm7xx_to),
+                                        0x1, NPCM7XX_Tx_MAX_CNT);
+}
+static void __init npcm7xx_clocksource_init(void)
+{
+        u32 val;
+        writel(NPCM7XX_DEFAULT_CSR,
+                timer_of_base(&npcm7xx_to) + NPCM7XX_REG_TCSR1);
+        writel(NPCM7XX_Tx_MAX_CNT,
+                timer_of_base(&npcm7xx_to) + NPCM7XX_REG_TICR1);
+        val = readl(timer_of_base(&npcm7xx_to) + NPCM7XX_REG_TCSR1);
+        val |= NPCM7XX_START_Tx;
+        writel(val, timer_of_base(&npcm7xx_to) + NPCM7XX_REG_TCSR1);
+        clocksource_mmio_init(timer_of_base(&npcm7xx_to) +
+                                NPCM7XX_REG_TDR1,
+                                "npcm7xx-timer1", timer_of_rate(&npcm7xx_to),
+                                200, (unsigned int)NPCM7XX_Tx_TDR_MASK_BITS,
+                                clocksource_mmio_readl_down);
+}
+static int __init npcm7xx_timer_init(struct device_node *np)
+{
+        int ret;
+        ret = timer_of_init(np, &npcm7xx_to);
+        if (ret)
+                return ret;
+        /* Clock input is divided by PRESCALE + 1 before it is fed */
+        /* to the counter */
+        npcm7xx_to.of_clk.rate = npcm7xx_to.of_clk.rate /
+                (NPCM7XX_Tx_MIN_PRESCALE + 1);
+        npcm7xx_clocksource_init();
+        npcm7xx_clockevents_init();
+        pr_info("Enabling NPCM7xx clocksource timer base: %px, IRQ: %d ",
+                timer_of_base(&npcm7xx_to), timer_of_irq(&npcm7xx_to));
+        return 0;
+}
+TIMER_OF_DECLARE(npcm7xx, "nuvoton,npcm750-timer", npcm7xx_timer_init);
diff --git a/drivers/dax/device.c b/drivers/dax/device.c
index be8606457f27..aff2c1594220 100644
--- a/drivers/dax/device.c
+++ b/drivers/dax/device.c
@@ -19,6 +19,7 @@
 #include <linux/dax.h>
 #include <linux/fs.h>
 #include <linux/mm.h>
+#include <linux/mman.h>
 #include "dax-private.h"
 #include "dax.h"
@@ -540,6 +541,7 @@ static const struct file_operations dax_fops = {
        .release = dax_release,
        .get_unmapped_area = dax_get_unmapped_area,
        .mmap = dax_mmap,
+        .mmap_supported_flags = MAP_SYNC,
 };
 static void dev_dax_release(struct device *dev)
diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
index 5a3a7ead3012..0b5cc910f62e 100644
--- a/drivers/hid/hid-ids.h
+++ b/drivers/hid/hid-ids.h
@@ -525,6 +525,9 @@
 #define I2C_VENDOR_ID_HANTICK           0x0911
 #define I2C_PRODUCT_ID_HANTICK_5288     0x5288
+#define I2C_VENDOR_ID_RAYD              0x2386
+#define I2C_PRODUCT_ID_RAYD_3118        0x3118
 #define USB_VENDOR_ID_HANWANG           0x0b57
 #define USB_DEVICE_ID_HANWANG_TABLET_FIRST      0x5000
 #define USB_DEVICE_ID_HANWANG_TABLET_LAST       0x8fff
diff --git a/drivers/hid/hid-input.c b/drivers/hid/hid-input.c
index 6836a856c243..930652c25120 100644
--- a/drivers/hid/hid-input.c
+++ b/drivers/hid/hid-input.c
@@ -387,7 +387,8 @@ static int hidinput_get_battery_property(struct power_supply *psy,
                break;
        case POWER_SUPPLY_PROP_CAPACITY:
-                if (dev->battery_report_type == HID_FEATURE_REPORT) {
+                if (dev->battery_status != HID_BATTERY_REPORTED &&
+                    !dev->battery_avoid_query) {
                        value = hidinput_query_battery_capacity(dev);
                        if (value < 0)
                                return value;
@@ -403,17 +404,17 @@ static int hidinput_get_battery_property(struct power_supply *psy,
                break;
        case POWER_SUPPLY_PROP_STATUS:
-                if (!dev->battery_reported &&
+                if (dev->battery_status != HID_BATTERY_REPORTED &&
-                    dev->battery_report_type == HID_FEATURE_REPORT) {
+                    !dev->battery_avoid_query) {
                        value = hidinput_query_battery_capacity(dev);
                        if (value < 0)
                                return value;
                        dev->battery_capacity = value;
-                        dev->battery_reported = true;
+                        dev->battery_status = HID_BATTERY_QUERIED;
                }
-                if (!dev->battery_reported)
+                if (dev->battery_status == HID_BATTERY_UNKNOWN)
                        val->intval = POWER_SUPPLY_STATUS_UNKNOWN;
                else if (dev->battery_capacity == 100)
                        val->intval = POWER_SUPPLY_STATUS_FULL;
@@ -486,6 +487,14 @@ static int hidinput_setup_battery(struct hid_device *dev, unsigned report_type,
        dev->battery_report_type = report_type;
        dev->battery_report_id = field->report->id;
+        /*
+         * Stylus is normally not connected to the device and thus we
+         * can't query the device and get meaningful battery strength.
+         * We have to wait for the device to report it on its own.
+         */
+        dev->battery_avoid_query = report_type == HID_INPUT_REPORT &&
+                                   field->physical == HID_DG_STYLUS;
        dev->battery = power_supply_register(&dev->dev, psy_desc, &psy_cfg);
        if (IS_ERR(dev->battery)) {
                error = PTR_ERR(dev->battery);
@@ -530,9 +539,10 @@ static void hidinput_update_battery(struct hid_device *dev, int value)
        capacity = hidinput_scale_battery_capacity(dev, value);
-        if (!dev->battery_reported || capacity != dev->battery_capacity) {
+        if (dev->battery_status != HID_BATTERY_REPORTED ||
+            capacity != dev->battery_capacity) {
                dev->battery_capacity = capacity;
-                dev->battery_reported = true;
+                dev->battery_status = HID_BATTERY_REPORTED;
                power_supply_changed(dev->battery);
        }
 }
diff --git a/drivers/hid/hidraw.c b/drivers/hid/hidraw.c
index fbfcc8009432..b39844adea47 100644
--- a/drivers/hid/hidraw.c
+++ b/drivers/hid/hidraw.c
@@ -192,6 +192,11 @@ static ssize_t hidraw_get_report(struct file *file, char __user *buffer, size_t
        int ret = 0, len;
        unsigned char report_number;
+        if (!hidraw_table[minor] || !hidraw_table[minor]->exist) {
+                ret = -ENODEV;
+                goto out;
+        }
        dev = hidraw_table[minor]->hid;
        if (!dev->ll_driver->raw_request) {
diff --git a/drivers/hid/i2c-hid/i2c-hid.c b/drivers/hid/i2c-hid/i2c-hid.c
index 97689e98e53f..963328674e93 100644
--- a/drivers/hid/i2c-hid/i2c-hid.c
+++ b/drivers/hid/i2c-hid/i2c-hid.c
@@ -47,6 +47,7 @@
 /* quirks to control the device */
 #define I2C_HID_QUIRK_SET_PWR_WAKEUP_DEV        BIT(0)
 #define I2C_HID_QUIRK_NO_IRQ_AFTER_RESET        BIT(1)
+#define I2C_HID_QUIRK_RESEND_REPORT_DESCR       BIT(2)
 /* flags */
 #define I2C_HID_STARTED         0
@@ -171,6 +172,8 @@ static const struct i2c_hid_quirks {
                I2C_HID_QUIRK_SET_PWR_WAKEUP_DEV },
        { I2C_VENDOR_ID_HANTICK, I2C_PRODUCT_ID_HANTICK_5288,
                I2C_HID_QUIRK_NO_IRQ_AFTER_RESET },
+        { I2C_VENDOR_ID_RAYD, I2C_PRODUCT_ID_RAYD_3118,
+                I2C_HID_QUIRK_RESEND_REPORT_DESCR },
        { 0, 0 }
 };
@@ -1220,6 +1223,16 @@ static int i2c_hid_resume(struct device *dev)
        if (ret)
                return ret;
+        /* RAYDIUM device (2386:3118) need to re-send report descr cmd
+         * after resume, after this it will be back normal.
+         * otherwise it issues too many incomplete reports.
+         */
+        if (ihid->quirks & I2C_HID_QUIRK_RESEND_REPORT_DESCR) {
+                ret = i2c_hid_command(client, &hid_report_descr_cmd, NULL, 0);
+                if (ret)
+                        return ret;
+        }
        if (hid->driver && hid->driver->reset_resume) {
                ret = hid->driver->reset_resume(hid);
                return ret;
diff --git a/drivers/hid/wacom_wac.c b/drivers/hid/wacom_wac.c
index 6da16a879c9f..5f947ec20dcb 100644
--- a/drivers/hid/wacom_wac.c
+++ b/drivers/hid/wacom_wac.c
@@ -689,6 +689,45 @@ static int wacom_intuos_get_tool_type(int tool_id)
        return tool_type;
 }
+static void wacom_exit_report(struct wacom_wac *wacom)
+{
+        struct input_dev *input = wacom->pen_input;
+        struct wacom_features *features = &wacom->features;
+        unsigned char *data = wacom->data;
+        int idx = (features->type == INTUOS) ? (data[1] & 0x01) : 0;
+        /*
+         * Reset all states otherwise we lose the initial states
+         * when in-prox next time
+         */
+        input_report_abs(input, ABS_X, 0);
+        input_report_abs(input, ABS_Y, 0);
+        input_report_abs(input, ABS_DISTANCE, 0);
+        input_report_abs(input, ABS_TILT_X, 0);
+        input_report_abs(input, ABS_TILT_Y, 0);
+        if (wacom->tool[idx] >= BTN_TOOL_MOUSE) {
+                input_report_key(input, BTN_LEFT, 0);
+                input_report_key(input, BTN_MIDDLE, 0);
+                input_report_key(input, BTN_RIGHT, 0);
+                input_report_key(input, BTN_SIDE, 0);
+                input_report_key(input, BTN_EXTRA, 0);
+                input_report_abs(input, ABS_THROTTLE, 0);
+                input_report_abs(input, ABS_RZ, 0);
+        } else {
+                input_report_abs(input, ABS_PRESSURE, 0);
+                input_report_key(input, BTN_STYLUS, 0);
+                input_report_key(input, BTN_STYLUS2, 0);
+                input_report_key(input, BTN_TOUCH, 0);
+                input_report_abs(input, ABS_WHEEL, 0);
+                if (features->type >= INTUOS3S)
+                        input_report_abs(input, ABS_Z, 0);
+        }
+        input_report_key(input, wacom->tool[idx], 0);
+        input_report_abs(input, ABS_MISC, 0); /* reset tool id */
+        input_event(input, EV_MSC, MSC_SERIAL, wacom->serial[idx]);
+        wacom->id[idx] = 0;
+}
 static int wacom_intuos_inout(struct wacom_wac *wacom)
 {
        struct wacom_features *features = &wacom->features;
@@ -741,36 +780,7 @@ static int wacom_intuos_inout(struct wacom_wac *wacom)
                if (!wacom->id[idx])
                        return 1;
-                /*
+                wacom_exit_report(wacom);
-                 * Reset all states otherwise we lose the initial states
-                 * when in-prox next time
-                 */
-                input_report_abs(input, ABS_X, 0);
-                input_report_abs(input, ABS_Y, 0);
-                input_report_abs(input, ABS_DISTANCE, 0);
-                input_report_abs(input, ABS_TILT_X, 0);
-                input_report_abs(input, ABS_TILT_Y, 0);
-                if (wacom->tool[idx] >= BTN_TOOL_MOUSE) {
-                        input_report_key(input, BTN_LEFT, 0);
-                        input_report_key(input, BTN_MIDDLE, 0);
-                        input_report_key(input, BTN_RIGHT, 0);
-                        input_report_key(input, BTN_SIDE, 0);
-                        input_report_key(input, BTN_EXTRA, 0);
-                        input_report_abs(input, ABS_THROTTLE, 0);
-                        input_report_abs(input, ABS_RZ, 0);
-                } else {
-                        input_report_abs(input, ABS_PRESSURE, 0);
-                        input_report_key(input, BTN_STYLUS, 0);
-                        input_report_key(input, BTN_STYLUS2, 0);
-                        input_report_key(input, BTN_TOUCH, 0);
-                        input_report_abs(input, ABS_WHEEL, 0);
-                        if (features->type >= INTUOS3S)
-                                input_report_abs(input, ABS_Z, 0);
-                }
-                input_report_key(input, wacom->tool[idx], 0);
-                input_report_abs(input, ABS_MISC, 0); /* reset tool id */
-                input_event(input, EV_MSC, MSC_SERIAL, wacom->serial[idx]);
-                wacom->id[idx] = 0;
                return 2;
        }
@@ -1235,6 +1245,12 @@ static void wacom_intuos_pro2_bt_pen(struct wacom_wac *wacom)
                if (!valid)
                        continue;
+                if (!prox) {
+                        wacom->shared->stylus_in_proximity = false;
+                        wacom_exit_report(wacom);
+                        input_sync(pen_input);
+                        return;
+                }
                if (range) {
                        input_report_abs(pen_input, ABS_X, get_unaligned_le16(&frame[1]));
                        input_report_abs(pen_input, ABS_Y, get_unaligned_le16(&frame[3]));
diff --git a/drivers/isdn/mISDN/dsp_hwec.c b/drivers/isdn/mISDN/dsp_hwec.c
index a6e87076acc2..5336bbdbfdc5 100644
--- a/drivers/isdn/mISDN/dsp_hwec.c
+++ b/drivers/isdn/mISDN/dsp_hwec.c
@@ -68,12 +68,12 @@ void dsp_hwec_enable(struct dsp *dsp, const char *arg)
                goto _do;
        {
-                char _dup[len + 1];
                char *dup, *tok, *name, *val;
                int tmp;
-                strcpy(_dup, arg);
+                dup = kstrdup(arg, GFP_ATOMIC);
-                dup = _dup;
+                if (!dup)
+                        return;
                while ((tok = strsep(&dup, ","))) {
                        if (!strlen(tok))
@@ -89,6 +89,8 @@ void dsp_hwec_enable(struct dsp *dsp, const char *arg)
                                        deftaps = tmp;
                        }
                }
+                kfree(dup);
        }
 _do:
diff --git a/drivers/isdn/mISDN/l1oip_core.c b/drivers/isdn/mISDN/l1oip_core.c
index 21d50e4cc5e1..b05022f94f18 100644
--- a/drivers/isdn/mISDN/l1oip_core.c
+++ b/drivers/isdn/mISDN/l1oip_core.c
@@ -279,7 +279,7 @@ l1oip_socket_send(struct l1oip *hc, u8 localcodec, u8 channel, u32 chanmask,
                  u16 timebase, u8 *buf, int len)
 {
        u8 *p;
-        u8 frame[len + 32];
+        u8 frame[MAX_DFRAME_LEN_L1 + 32];
        struct socket *socket = NULL;
        if (debug & DEBUG_L1OIP_MSG)
@@ -902,7 +902,11 @@ handle_dmsg(struct mISDNchannel *ch, struct sk_buff *skb)
                p = skb->data;
                l = skb->len;
                while (l) {
-                        ll = (l < L1OIP_MAX_PERFRAME) ? l : L1OIP_MAX_PERFRAME;
+                        /*
+                         * This is technically bounded by L1OIP_MAX_PERFRAME but
+                         * MAX_DFRAME_LEN_L1 < L1OIP_MAX_PERFRAME
+                         */
+                        ll = (l < MAX_DFRAME_LEN_L1) ? l : MAX_DFRAME_LEN_L1;
                        l1oip_socket_send(hc, 0, dch->slot, 0,
                                          hc->chan[dch->slot].tx_counter++, p, ll);
                        p += ll;
@@ -1140,7 +1144,11 @@ handle_bmsg(struct mISDNchannel *ch, struct sk_buff *skb)
                p = skb->data;
                l = skb->len;
                while (l) {
-                        ll = (l < L1OIP_MAX_PERFRAME) ? l : L1OIP_MAX_PERFRAME;
+                        /*
+                         * This is technically bounded by L1OIP_MAX_PERFRAME but
+                         * MAX_DFRAME_LEN_L1 < L1OIP_MAX_PERFRAME
+                         */
+                        ll = (l < MAX_DFRAME_LEN_L1) ? l : MAX_DFRAME_LEN_L1;
                        l1oip_socket_send(hc, hc->codec, bch->slot, 0,
                                          hc->chan[bch->slot].tx_counter, p, ll);
                        hc->chan[bch->slot].tx_counter += ll;
diff --git a/drivers/md/md.c b/drivers/md/md.c
index 3bea45e8ccff..c208c01f63a5 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -9256,8 +9256,10 @@ void md_reload_sb(struct mddev *mddev, int nr)
        check_sb_changes(mddev, rdev);
        /* Read all rdev's to update recovery_offset */
-        rdev_for_each_rcu(rdev, mddev)
+        rdev_for_each_rcu(rdev, mddev) {
-                read_rdev(mddev, rdev);
+                if (!test_bit(Faulty, &rdev->flags))
+                        read_rdev(mddev, rdev);
+        }
 }
 EXPORT_SYMBOL(md_reload_sb);
diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c
index e2943fb74056..e9e3308cb0a7 100644
--- a/drivers/md/raid1.c
+++ b/drivers/md/raid1.c
@@ -854,7 +854,7 @@ static void flush_pending_writes(struct r1conf *conf)
 *    there is no normal IO happeing.  It must arrange to call
 *    lower_barrier when the particular background IO completes.
 */
-static void raise_barrier(struct r1conf *conf, sector_t sector_nr)
+static sector_t raise_barrier(struct r1conf *conf, sector_t sector_nr)
 {
        int idx = sector_to_idx(sector_nr);
@@ -885,13 +885,23 @@ static void raise_barrier(struct r1conf *conf, sector_t sector_nr)
         *    max resync count which allowed on current I/O barrier bucket.
         */
        wait_event_lock_irq(conf->wait_barrier,
-                            !conf->array_frozen &&
+                            (!conf->array_frozen &&
                             !atomic_read(&conf->nr_pending[idx]) &&
-                             atomic_read(&conf->barrier[idx]) < RESYNC_DEPTH,
+                             atomic_read(&conf->barrier[idx]) < RESYNC_DEPTH) ||
+                                test_bit(MD_RECOVERY_INTR, &conf->mddev->recovery),
                            conf->resync_lock);
+        if (test_bit(MD_RECOVERY_INTR, &conf->mddev->recovery)) {
+                atomic_dec(&conf->barrier[idx]);
+                spin_unlock_irq(&conf->resync_lock);
+                wake_up(&conf->wait_barrier);
+                return -EINTR;
+        }
        atomic_inc(&conf->nr_sync_pending);
        spin_unlock_irq(&conf->resync_lock);
+        return 0;
 }
 static void lower_barrier(struct r1conf *conf, sector_t sector_nr)
@@ -1092,6 +1102,8 @@ static void alloc_behind_master_bio(struct r1bio *r1_bio,
                goto skip_copy;
        }
+        behind_bio->bi_write_hint = bio->bi_write_hint;
        while (i < vcnt && size) {
                struct page *page;
                int len = min_t(int, PAGE_SIZE, size);
@@ -2662,9 +2674,12 @@ static sector_t raid1_sync_request(struct mddev *mddev, sector_t sector_nr,
        bitmap_cond_end_sync(mddev->bitmap, sector_nr,
                mddev_is_clustered(mddev) && (sector_nr + 2 * RESYNC_SECTORS > conf->cluster_sync_high));
-        r1_bio = raid1_alloc_init_r1buf(conf);
-        raise_barrier(conf, sector_nr);
+        if (raise_barrier(conf, sector_nr))
+                return 0;
+        r1_bio = raid1_alloc_init_r1buf(conf);
        rcu_read_lock();
        /*
diff --git a/drivers/mmc/host/renesas_sdhi_internal_dmac.c b/drivers/mmc/host/renesas_sdhi_internal_dmac.c
index 8e0acd197c43..6af946d16d24 100644
--- a/drivers/mmc/host/renesas_sdhi_internal_dmac.c
+++ b/drivers/mmc/host/renesas_sdhi_internal_dmac.c
@@ -9,6 +9,7 @@
 * published by the Free Software Foundation.
 */
+#include <linux/bitops.h>
 #include <linux/device.h>
 #include <linux/dma-mapping.h>
 #include <linux/io-64-nonatomic-hi-lo.h>
@@ -62,6 +63,17 @@
 *   need a custom accessor.
 */
+static unsigned long global_flags;
+/*
+ * Workaround for avoiding to use RX DMAC by multiple channels.
+ * On R-Car H3 ES1.* and M3-W ES1.0, when multiple SDHI channels use
+ * RX DMAC simultaneously, sometimes hundreds of bytes data are not
+ * stored into the system memory even if the DMAC interrupt happened.
+ * So, this driver then uses one RX DMAC channel only.
+ */
+#define SDHI_INTERNAL_DMAC_ONE_RX_ONLY  0
+#define SDHI_INTERNAL_DMAC_RX_IN_USE    1
 /* Definitions for sampling clocks */
 static struct renesas_sdhi_scc rcar_gen3_scc_taps[] = {
        {
@@ -126,6 +138,9 @@ renesas_sdhi_internal_dmac_abort_dma(struct tmio_mmc_host *host) {
        renesas_sdhi_internal_dmac_dm_write(host, DM_CM_RST,
                                            RST_RESERVED_BITS | val);
+        if (host->data && host->data->flags & MMC_DATA_READ)
+                clear_bit(SDHI_INTERNAL_DMAC_RX_IN_USE, &global_flags);
        renesas_sdhi_internal_dmac_enable_dma(host, true);
 }
@@ -155,6 +170,9 @@ renesas_sdhi_internal_dmac_start_dma(struct tmio_mmc_host *host,
        if (data->flags & MMC_DATA_READ) {
                dtran_mode |= DTRAN_MODE_CH_NUM_CH1;
                dir = DMA_FROM_DEVICE;
+                if (test_bit(SDHI_INTERNAL_DMAC_ONE_RX_ONLY, &global_flags) &&
+                    test_and_set_bit(SDHI_INTERNAL_DMAC_RX_IN_USE, &global_flags))
+                        goto force_pio;
        } else {
                dtran_mode |= DTRAN_MODE_CH_NUM_CH0;
                dir = DMA_TO_DEVICE;
@@ -208,6 +226,9 @@ static void renesas_sdhi_internal_dmac_complete_tasklet_fn(unsigned long arg)
        renesas_sdhi_internal_dmac_enable_dma(host, false);
        dma_unmap_sg(&host->pdev->dev, host->sg_ptr, host->sg_len, dir);
+        if (dir == DMA_FROM_DEVICE)
+                clear_bit(SDHI_INTERNAL_DMAC_RX_IN_USE, &global_flags);
        tmio_mmc_do_data_irq(host);
 out:
        spin_unlock_irq(&host->lock);
@@ -251,18 +272,24 @@ static const struct tmio_mmc_dma_ops renesas_sdhi_internal_dmac_dma_ops = {
 * implementation as others may use a different implementation.
 */
 static const struct soc_device_attribute gen3_soc_whitelist[] = {
-        { .soc_id = "r8a7795", .revision = "ES1.*" },
+        { .soc_id = "r8a7795", .revision = "ES1.*",
-        { .soc_id = "r8a7795", .revision = "ES2.0" },
+          .data = (void *)BIT(SDHI_INTERNAL_DMAC_ONE_RX_ONLY) },
-        { .soc_id = "r8a7796", .revision = "ES1.0" },
+        { .soc_id = "r8a7795", .revision = "ES2.0" },
-        { .soc_id = "r8a77995", .revision = "ES1.0" },
+        { .soc_id = "r8a7796", .revision = "ES1.0",
-        { /* sentinel */ }
+          .data = (void *)BIT(SDHI_INTERNAL_DMAC_ONE_RX_ONLY) },
+        { .soc_id = "r8a77995", .revision = "ES1.0" },
+        { /* sentinel */ }
 };
 static int renesas_sdhi_internal_dmac_probe(struct platform_device *pdev)
 {
-        if (!soc_device_match(gen3_soc_whitelist))
+        const struct soc_device_attribute *soc = soc_device_match(gen3_soc_whitelist);
+        if (!soc)
                return -ENODEV;
+        global_flags |= (unsigned long)soc->data;
        return renesas_sdhi_probe(pdev, &renesas_sdhi_internal_dmac_dma_ops);
 }
diff --git a/drivers/mmc/host/sdhci-pci-core.c b/drivers/mmc/host/sdhci-pci-core.c
index 787434e5589d..78c25ad35fd2 100644
--- a/drivers/mmc/host/sdhci-pci-core.c
+++ b/drivers/mmc/host/sdhci-pci-core.c
@@ -1312,7 +1312,7 @@ static void amd_enable_manual_tuning(struct pci_dev *pdev)
        pci_write_config_dword(pdev, AMD_SD_MISC_CONTROL, val);
 }
-static int amd_execute_tuning(struct sdhci_host *host, u32 opcode)
+static int amd_execute_tuning_hs200(struct sdhci_host *host, u32 opcode)
 {
        struct sdhci_pci_slot *slot = sdhci_priv(host);
        struct pci_dev *pdev = slot->chip->pdev;
@@ -1351,6 +1351,27 @@ static int amd_execute_tuning(struct sdhci_host *host, u32 opcode)
        return 0;
 }
+static int amd_execute_tuning(struct mmc_host *mmc, u32 opcode)
+{
+        struct sdhci_host *host = mmc_priv(mmc);
+        /* AMD requires custom HS200 tuning */
+        if (host->timing == MMC_TIMING_MMC_HS200)
+                return amd_execute_tuning_hs200(host, opcode);
+        /* Otherwise perform standard SDHCI tuning */
+        return sdhci_execute_tuning(mmc, opcode);
+}
+static int amd_probe_slot(struct sdhci_pci_slot *slot)
+{
+        struct mmc_host_ops *ops = &slot->host->mmc_host_ops;
+        ops->execute_tuning = amd_execute_tuning;
+        return 0;
+}
 static int amd_probe(struct sdhci_pci_chip *chip)
 {
        struct pci_dev  *smbus_dev;
@@ -1385,12 +1406,12 @@ static const struct sdhci_ops amd_sdhci_pci_ops = {
        .set_bus_width                  = sdhci_set_bus_width,
        .reset                          = sdhci_reset,
        .set_uhs_signaling              = sdhci_set_uhs_signaling,
-        .platform_execute_tuning        = amd_execute_tuning,
 };
 static const struct sdhci_pci_fixes sdhci_amd = {
        .probe          = amd_probe,
        .ops            = &amd_sdhci_pci_ops,
+        .probe_slot     = amd_probe_slot,
 };
 static const struct pci_device_id pci_ids[] = {
diff --git a/drivers/net/dsa/mv88e6xxx/hwtstamp.c b/drivers/net/dsa/mv88e6xxx/hwtstamp.c
index ac7694c71266..a036c490b7ce 100644
--- a/drivers/net/dsa/mv88e6xxx/hwtstamp.c
+++ b/drivers/net/dsa/mv88e6xxx/hwtstamp.c
@@ -285,10 +285,18 @@ static void mv88e6xxx_get_rxts(struct mv88e6xxx_chip *chip,
                               struct sk_buff_head *rxq)
 {
        u16 buf[4] = { 0 }, status, seq_id;
-        u64 ns, timelo, timehi;
        struct skb_shared_hwtstamps *shwt;
+        struct sk_buff_head received;
+        u64 ns, timelo, timehi;
+        unsigned long flags;
        int err;
+        /* The latched timestamp belongs to one of the received frames. */
+        __skb_queue_head_init(&received);
+        spin_lock_irqsave(&rxq->lock, flags);
+        skb_queue_splice_tail_init(rxq, &received);
+        spin_unlock_irqrestore(&rxq->lock, flags);
        mutex_lock(&chip->reg_lock);
        err = mv88e6xxx_port_ptp_read(chip, ps->port_id,
                                      reg, buf, ARRAY_SIZE(buf));
@@ -311,7 +319,7 @@ static void mv88e6xxx_get_rxts(struct mv88e6xxx_chip *chip,
        /* Since the device can only handle one time stamp at a time,
         * we purge any extra frames from the queue.
         */
-        for ( ; skb; skb = skb_dequeue(rxq)) {
+        for ( ; skb; skb = __skb_dequeue(&received)) {
                if (mv88e6xxx_ts_valid(status) && seq_match(skb, seq_id)) {
                        ns = timehi << 16 | timelo;
diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c
index 1f622ca2a64f..8ba14ae00e8f 100644
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c
@@ -1927,22 +1927,39 @@ static char *bnxt_parse_pkglog(int desired_field, u8 *data, size_t datalen)
        return retval;
 }
-static char *bnxt_get_pkgver(struct net_device *dev, char *buf, size_t buflen)
+static void bnxt_get_pkgver(struct net_device *dev)
 {
+        struct bnxt *bp = netdev_priv(dev);
        u16 index = 0;
-        u32 datalen;
+        char *pkgver;
+        u32 pkglen;
+        u8 *pkgbuf;
+        int len;
        if (bnxt_find_nvram_item(dev, BNX_DIR_TYPE_PKG_LOG,
                                 BNX_DIR_ORDINAL_FIRST, BNX_DIR_EXT_NONE,
-                                 &index, NULL, &datalen) != 0)
+                                 &index, NULL, &pkglen) != 0)
-                return NULL;
+                return;
-        memset(buf, 0, buflen);
+        pkgbuf = kzalloc(pkglen, GFP_KERNEL);
-        if (bnxt_get_nvram_item(dev, index, 0, datalen, buf) != 0)
+        if (!pkgbuf) {
-                return NULL;
+                dev_err(&bp->pdev->dev, "Unable to allocate memory for pkg version, length = %u\n",
+                        pkglen);
+                return;
+        }
+        if (bnxt_get_nvram_item(dev, index, 0, pkglen, pkgbuf))
+                goto err;
-        return bnxt_parse_pkglog(BNX_PKG_LOG_FIELD_IDX_PKG_VERSION, buf,
+        pkgver = bnxt_parse_pkglog(BNX_PKG_LOG_FIELD_IDX_PKG_VERSION, pkgbuf,
-                datalen);
+                                   pkglen);
+        if (pkgver && *pkgver != 0 && isdigit(*pkgver)) {
+                len = strlen(bp->fw_ver_str);
+                snprintf(bp->fw_ver_str + len, FW_VER_STR_LEN - len - 1,
+                         "/pkg %s", pkgver);
+        }
+err:
+        kfree(pkgbuf);
 }
 static int bnxt_get_eeprom(struct net_device *dev,
@@ -2615,22 +2632,10 @@ void bnxt_ethtool_init(struct bnxt *bp)
        struct hwrm_selftest_qlist_input req = {0};
        struct bnxt_test_info *test_info;
        struct net_device *dev = bp->dev;
-        char *pkglog;
        int i, rc;
-        pkglog = kzalloc(BNX_PKG_LOG_MAX_LENGTH, GFP_KERNEL);
+        bnxt_get_pkgver(dev);
-        if (pkglog) {
-                char *pkgver;
-                int len;
-                pkgver = bnxt_get_pkgver(dev, pkglog, BNX_PKG_LOG_MAX_LENGTH);
-                if (pkgver && *pkgver != 0 && isdigit(*pkgver)) {
-                        len = strlen(bp->fw_ver_str);
-                        snprintf(bp->fw_ver_str + len, FW_VER_STR_LEN - len - 1,
-                                 "/pkg %s", pkgver);
-                }
-                kfree(pkglog);
-        }
        if (bp->hwrm_spec_code < 0x10704 || !BNXT_SINGLE_PF(bp))
                return;
diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_nvm_defs.h b/drivers/net/ethernet/broadcom/bnxt/bnxt_nvm_defs.h
index 73f2249555b5..83444811d3c6 100644
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_nvm_defs.h
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_nvm_defs.h
@@ -59,8 +59,6 @@ enum bnxt_nvm_directory_type {
 #define BNX_DIR_ATTR_NO_CHKSUM                  (1 << 0)
 #define BNX_DIR_ATTR_PROP_STREAM                (1 << 1)
-#define BNX_PKG_LOG_MAX_LENGTH                  4096
 enum bnxnvm_pkglog_field_index {
        BNX_PKG_LOG_FIELD_IDX_INSTALLED_TIMESTAMP       = 0,
        BNX_PKG_LOG_FIELD_IDX_PKG_DESCRIPTION           = 1,
diff --git a/drivers/net/ethernet/hisilicon/hns/hnae.h b/drivers/net/ethernet/hisilicon/hns/hnae.h
index 3e62692af011..fa5b30f547f6 100644
--- a/drivers/net/ethernet/hisilicon/hns/hnae.h
+++ b/drivers/net/ethernet/hisilicon/hns/hnae.h
@@ -87,7 +87,7 @@ do { \
 #define HNAE_AE_REGISTER 0x1
-#define RCB_RING_NAME_LEN 16
+#define RCB_RING_NAME_LEN (IFNAMSIZ + 4)
 #define HNAE_LOWEST_LATENCY_COAL_PARAM  30
 #define HNAE_LOW_LATENCY_COAL_PARAM     80
diff --git a/drivers/net/ethernet/ibm/ibmvnic.c b/drivers/net/ethernet/ibm/ibmvnic.c
index aad5658d79d5..2df01ad98df7 100644
--- a/drivers/net/ethernet/ibm/ibmvnic.c
+++ b/drivers/net/ethernet/ibm/ibmvnic.c
@@ -794,46 +794,61 @@ static int ibmvnic_login(struct net_device *netdev)
 {
        struct ibmvnic_adapter *adapter = netdev_priv(netdev);
        unsigned long timeout = msecs_to_jiffies(30000);
-        struct device *dev = &adapter->vdev->dev;
+        int retry_count = 0;
        int rc;
        do {
-                if (adapter->renegotiate) {
+                if (retry_count > IBMVNIC_MAX_QUEUES) {
-                        adapter->renegotiate = false;
+                        netdev_warn(netdev, "Login attempts exceeded\n");
+                        return -1;
+                }
+                adapter->init_done_rc = 0;
+                reinit_completion(&adapter->init_done);
+                rc = send_login(adapter);
+                if (rc) {
+                        netdev_warn(netdev, "Unable to login\n");
+                        return rc;
+                }
+                if (!wait_for_completion_timeout(&adapter->init_done,
+                                                 timeout)) {
+                        netdev_warn(netdev, "Login timed out\n");
+                        return -1;
+                }
+                if (adapter->init_done_rc == PARTIALSUCCESS) {
+                        retry_count++;
                        release_sub_crqs(adapter, 1);
+                        adapter->init_done_rc = 0;
                        reinit_completion(&adapter->init_done);
                        send_cap_queries(adapter);
                        if (!wait_for_completion_timeout(&adapter->init_done,
                                                         timeout)) {
-                                dev_err(dev, "Capabilities query timeout\n");
+                                netdev_warn(netdev,
+                                            "Capabilities query timed out\n");
                                return -1;
                        }
                        rc = init_sub_crqs(adapter);
                        if (rc) {
-                                dev_err(dev,
+                                netdev_warn(netdev,
-                                        "Initialization of SCRQ's failed\n");
+                                            "SCRQ initialization failed\n");
                                return -1;
                        }
                        rc = init_sub_crq_irqs(adapter);
                        if (rc) {
-                                dev_err(dev,
+                                netdev_warn(netdev,
-                                        "Initialization of SCRQ's irqs failed\n");
+                                            "SCRQ irq initialization failed\n");
                                return -1;
                        }
-                }
+                } else if (adapter->init_done_rc) {
+                        netdev_warn(netdev, "Adapter login failed\n");
-                reinit_completion(&adapter->init_done);
-                rc = send_login(adapter);
-                if (rc) {
-                        dev_err(dev, "Unable to attempt device login\n");
-                        return rc;
-                } else if (!wait_for_completion_timeout(&adapter->init_done,
-                                                 timeout)) {
-                        dev_err(dev, "Login timeout\n");
                        return -1;
                }
-        } while (adapter->renegotiate);
+        } while (adapter->init_done_rc == PARTIALSUCCESS);
        /* handle pending MAC address changes after successful login */
        if (adapter->mac_change_pending) {
@@ -1034,16 +1049,14 @@ static int __ibmvnic_open(struct net_device *netdev)
                netdev_dbg(netdev, "Enabling rx_scrq[%d] irq\n", i);
                if (prev_state == VNIC_CLOSED)
                        enable_irq(adapter->rx_scrq[i]->irq);
-                else
+                enable_scrq_irq(adapter, adapter->rx_scrq[i]);
-                        enable_scrq_irq(adapter, adapter->rx_scrq[i]);
        }
        for (i = 0; i < adapter->req_tx_queues; i++) {
                netdev_dbg(netdev, "Enabling tx_scrq[%d] irq\n", i);
                if (prev_state == VNIC_CLOSED)
                        enable_irq(adapter->tx_scrq[i]->irq);
-                else
+                enable_scrq_irq(adapter, adapter->tx_scrq[i]);
-                        enable_scrq_irq(adapter, adapter->tx_scrq[i]);
        }
        rc = set_link_state(adapter, IBMVNIC_LOGICAL_LNK_UP);
@@ -1184,6 +1197,7 @@ static void ibmvnic_disable_irqs(struct ibmvnic_adapter *adapter)
                        if (adapter->tx_scrq[i]->irq) {
                                netdev_dbg(netdev,
                                           "Disabling tx_scrq[%d] irq\n", i);
+                                disable_scrq_irq(adapter, adapter->tx_scrq[i]);
                                disable_irq(adapter->tx_scrq[i]->irq);
                        }
        }
@@ -1193,6 +1207,7 @@ static void ibmvnic_disable_irqs(struct ibmvnic_adapter *adapter)
                        if (adapter->rx_scrq[i]->irq) {
                                netdev_dbg(netdev,
                                           "Disabling rx_scrq[%d] irq\n", i);
+                                disable_scrq_irq(adapter, adapter->rx_scrq[i]);
                                disable_irq(adapter->rx_scrq[i]->irq);
                        }
                }
@@ -1828,7 +1843,8 @@ static int do_reset(struct ibmvnic_adapter *adapter,
        for (i = 0; i < adapter->req_rx_queues; i++)
                napi_schedule(&adapter->napi[i]);
-        if (adapter->reset_reason != VNIC_RESET_FAILOVER)
+        if (adapter->reset_reason != VNIC_RESET_FAILOVER &&
+            adapter->reset_reason != VNIC_RESET_CHANGE_PARAM)
                netdev_notify_peers(netdev);
        netif_carrier_on(netdev);
@@ -2601,12 +2617,19 @@ static int enable_scrq_irq(struct ibmvnic_adapter *adapter,
 {
        struct device *dev = &adapter->vdev->dev;
        unsigned long rc;
+        u64 val;
        if (scrq->hw_irq > 0x100000000ULL) {
                dev_err(dev, "bad hw_irq = %lx\n", scrq->hw_irq);
                return 1;
        }
+        val = (0xff000000) | scrq->hw_irq;
+        rc = plpar_hcall_norets(H_EOI, val);
+        if (rc)
+                dev_err(dev, "H_EOI FAILED irq 0x%llx. rc=%ld\n",
+                        val, rc);
        rc = plpar_hcall_norets(H_VIOCTL, adapter->vdev->unit_address,
                                H_ENABLE_VIO_INTERRUPT, scrq->hw_irq, 0, 0);
        if (rc)
@@ -3170,7 +3193,7 @@ static int send_version_xchg(struct ibmvnic_adapter *adapter)
 struct vnic_login_client_data {
        u8      type;
        __be16  len;
-        char    name;
+        char    name[];
 } __packed;
 static int vnic_client_data_len(struct ibmvnic_adapter *adapter)
@@ -3199,21 +3222,21 @@ static void vnic_add_client_data(struct ibmvnic_adapter *adapter,
        vlcd->type = 1;
        len = strlen(os_name) + 1;
        vlcd->len = cpu_to_be16(len);
-        strncpy(&vlcd->name, os_name, len);
+        strncpy(vlcd->name, os_name, len);
-        vlcd = (struct vnic_login_client_data *)((char *)&vlcd->name + len);
+        vlcd = (struct vnic_login_client_data *)(vlcd->name + len);
        /* Type 2 - LPAR name */
        vlcd->type = 2;
        len = strlen(utsname()->nodename) + 1;
        vlcd->len = cpu_to_be16(len);
-        strncpy(&vlcd->name, utsname()->nodename, len);
+        strncpy(vlcd->name, utsname()->nodename, len);
-        vlcd = (struct vnic_login_client_data *)((char *)&vlcd->name + len);
+        vlcd = (struct vnic_login_client_data *)(vlcd->name + len);
        /* Type 3 - device name */
        vlcd->type = 3;
        len = strlen(adapter->netdev->name) + 1;
        vlcd->len = cpu_to_be16(len);
-        strncpy(&vlcd->name, adapter->netdev->name, len);
+        strncpy(vlcd->name, adapter->netdev->name, len);
 }
 static int send_login(struct ibmvnic_adapter *adapter)
@@ -3942,7 +3965,7 @@ static int handle_login_rsp(union ibmvnic_crq *login_rsp_crq,
         * to resend the login buffer with fewer queues requested.
         */
        if (login_rsp_crq->generic.rc.code) {
-                adapter->renegotiate = true;
+                adapter->init_done_rc = login_rsp_crq->generic.rc.code;
                complete(&adapter->init_done);
                return 0;
        }
diff --git a/drivers/net/ethernet/ibm/ibmvnic.h b/drivers/net/ethernet/ibm/ibmvnic.h
index 99c0b58c2c39..22391e8805f6 100644
--- a/drivers/net/ethernet/ibm/ibmvnic.h
+++ b/drivers/net/ethernet/ibm/ibmvnic.h
@@ -1035,7 +1035,6 @@ struct ibmvnic_adapter {
        struct ibmvnic_sub_crq_queue **tx_scrq;
        struct ibmvnic_sub_crq_queue **rx_scrq;
-        bool renegotiate;
        /* rx structs */
        struct napi_struct *napi;
diff --git a/drivers/net/ethernet/marvell/mvpp2.c b/drivers/net/ethernet/marvell/mvpp2.c
index 54a038943c06..4202f9b5b966 100644
--- a/drivers/net/ethernet/marvell/mvpp2.c
+++ b/drivers/net/ethernet/marvell/mvpp2.c
@@ -663,7 +663,7 @@ enum mvpp2_tag_type {
 #define MVPP2_PE_VID_FILT_RANGE_END     (MVPP2_PRS_TCAM_SRAM_SIZE - 31)
 #define MVPP2_PE_VID_FILT_RANGE_START   (MVPP2_PE_VID_FILT_RANGE_END - \
                                         MVPP2_PRS_VLAN_FILT_RANGE_SIZE + 1)
-#define MVPP2_PE_LAST_FREE_TID          (MVPP2_PE_VID_FILT_RANGE_START - 1)
+#define MVPP2_PE_LAST_FREE_TID          (MVPP2_PE_MAC_RANGE_START - 1)
 #define MVPP2_PE_IP6_EXT_PROTO_UN       (MVPP2_PRS_TCAM_SRAM_SIZE - 30)
 #define MVPP2_PE_IP6_ADDR_UN            (MVPP2_PRS_TCAM_SRAM_SIZE - 29)
 #define MVPP2_PE_IP4_ADDR_UN            (MVPP2_PRS_TCAM_SRAM_SIZE - 28)
@@ -916,6 +916,8 @@ static struct {
 #define MVPP2_MIB_COUNTERS_STATS_DELAY          (1 * HZ)
+#define MVPP2_DESC_DMA_MASK     DMA_BIT_MASK(40)
 /* Definitions */
 /* Shared Packet Processor resources */
@@ -1429,7 +1431,7 @@ static dma_addr_t mvpp2_txdesc_dma_addr_get(struct mvpp2_port *port,
        if (port->priv->hw_version == MVPP21)
                return tx_desc->pp21.buf_dma_addr;
        else
-                return tx_desc->pp22.buf_dma_addr_ptp & GENMASK_ULL(40, 0);
+                return tx_desc->pp22.buf_dma_addr_ptp & MVPP2_DESC_DMA_MASK;
 }
 static void mvpp2_txdesc_dma_addr_set(struct mvpp2_port *port,
@@ -1447,7 +1449,7 @@ static void mvpp2_txdesc_dma_addr_set(struct mvpp2_port *port,
        } else {
                u64 val = (u64)addr;
-                tx_desc->pp22.buf_dma_addr_ptp &= ~GENMASK_ULL(40, 0);
+                tx_desc->pp22.buf_dma_addr_ptp &= ~MVPP2_DESC_DMA_MASK;
                tx_desc->pp22.buf_dma_addr_ptp |= val;
                tx_desc->pp22.packet_offset = offset;
        }
@@ -1507,7 +1509,7 @@ static dma_addr_t mvpp2_rxdesc_dma_addr_get(struct mvpp2_port *port,
        if (port->priv->hw_version == MVPP21)
                return rx_desc->pp21.buf_dma_addr;
        else
-                return rx_desc->pp22.buf_dma_addr_key_hash & GENMASK_ULL(40, 0);
+                return rx_desc->pp22.buf_dma_addr_key_hash & MVPP2_DESC_DMA_MASK;
 }
 static unsigned long mvpp2_rxdesc_cookie_get(struct mvpp2_port *port,
@@ -1516,7 +1518,7 @@ static unsigned long mvpp2_rxdesc_cookie_get(struct mvpp2_port *port,
        if (port->priv->hw_version == MVPP21)
                return rx_desc->pp21.buf_cookie;
        else
-                return rx_desc->pp22.buf_cookie_misc & GENMASK_ULL(40, 0);
+                return rx_desc->pp22.buf_cookie_misc & MVPP2_DESC_DMA_MASK;
 }
 static size_t mvpp2_rxdesc_size_get(struct mvpp2_port *port,
@@ -8789,7 +8791,7 @@ static int mvpp2_probe(struct platform_device *pdev)
        }
        if (priv->hw_version == MVPP22) {
-                err = dma_set_mask(&pdev->dev, DMA_BIT_MASK(40));
+                err = dma_set_mask(&pdev->dev, MVPP2_DESC_DMA_MASK);
                if (err)
                        goto err_mg_clk;
                /* Sadly, the BM pools all share the same register to
diff --git a/drivers/net/ethernet/netronome/nfp/flower/cmsg.c b/drivers/net/ethernet/netronome/nfp/flower/cmsg.c
index 3735c09d2112..577659f332e4 100644
--- a/drivers/net/ethernet/netronome/nfp/flower/cmsg.c
+++ b/drivers/net/ethernet/netronome/nfp/flower/cmsg.c
@@ -258,9 +258,6 @@ nfp_flower_cmsg_process_one_rx(struct nfp_app *app, struct sk_buff *skb)
        case NFP_FLOWER_CMSG_TYPE_ACTIVE_TUNS:
                nfp_tunnel_keep_alive(app, skb);
                break;
-        case NFP_FLOWER_CMSG_TYPE_TUN_NEIGH:
-                /* Acks from the NFP that the route is added - ignore. */
-                break;
        default:
                nfp_flower_cmsg_warn(app, "Cannot handle invalid repr control type %u\n",
                                     type);
@@ -275,18 +272,49 @@ out:
 void nfp_flower_cmsg_process_rx(struct work_struct *work)
 {
+        struct sk_buff_head cmsg_joined;
        struct nfp_flower_priv *priv;
        struct sk_buff *skb;
        priv = container_of(work, struct nfp_flower_priv, cmsg_work);
+        skb_queue_head_init(&cmsg_joined);
+        spin_lock_bh(&priv->cmsg_skbs_high.lock);
+        skb_queue_splice_tail_init(&priv->cmsg_skbs_high, &cmsg_joined);
+        spin_unlock_bh(&priv->cmsg_skbs_high.lock);
-        while ((skb = skb_dequeue(&priv->cmsg_skbs)))
+        spin_lock_bh(&priv->cmsg_skbs_low.lock);
+        skb_queue_splice_tail_init(&priv->cmsg_skbs_low, &cmsg_joined);
+        spin_unlock_bh(&priv->cmsg_skbs_low.lock);
+        while ((skb = __skb_dequeue(&cmsg_joined)))
                nfp_flower_cmsg_process_one_rx(priv->app, skb);
 }
-void nfp_flower_cmsg_rx(struct nfp_app *app, struct sk_buff *skb)
+static void
+nfp_flower_queue_ctl_msg(struct nfp_app *app, struct sk_buff *skb, int type)
 {
        struct nfp_flower_priv *priv = app->priv;
+        struct sk_buff_head *skb_head;
+        if (type == NFP_FLOWER_CMSG_TYPE_PORT_REIFY ||
+            type == NFP_FLOWER_CMSG_TYPE_PORT_MOD)
+                skb_head = &priv->cmsg_skbs_high;
+        else
+                skb_head = &priv->cmsg_skbs_low;
+        if (skb_queue_len(skb_head) >= NFP_FLOWER_WORKQ_MAX_SKBS) {
+                nfp_flower_cmsg_warn(app, "Dropping queued control messages\n");
+                dev_kfree_skb_any(skb);
+                return;
+        }
+        skb_queue_tail(skb_head, skb);
+        schedule_work(&priv->cmsg_work);
+}
+void nfp_flower_cmsg_rx(struct nfp_app *app, struct sk_buff *skb)
+{
        struct nfp_flower_cmsg_hdr *cmsg_hdr;
        cmsg_hdr = nfp_flower_cmsg_get_hdr(skb);
@@ -306,8 +334,10 @@ void nfp_flower_cmsg_rx(struct nfp_app *app, struct sk_buff *skb)
                   nfp_flower_process_mtu_ack(app, skb)) {
                /* Handle MTU acks outside wq to prevent RTNL conflict. */
                dev_consume_skb_any(skb);
+        } else if (cmsg_hdr->type == NFP_FLOWER_CMSG_TYPE_TUN_NEIGH) {
+                /* Acks from the NFP that the route is added - ignore. */
+                dev_consume_skb_any(skb);
        } else {
-                skb_queue_tail(&priv->cmsg_skbs, skb);
+                nfp_flower_queue_ctl_msg(app, skb, cmsg_hdr->type);
-                schedule_work(&priv->cmsg_work);
        }
 }
diff --git a/drivers/net/ethernet/netronome/nfp/flower/cmsg.h b/drivers/net/ethernet/netronome/nfp/flower/cmsg.h
index 96bc0e33980c..b6c0fd053a50 100644
--- a/drivers/net/ethernet/netronome/nfp/flower/cmsg.h
+++ b/drivers/net/ethernet/netronome/nfp/flower/cmsg.h
@@ -108,6 +108,8 @@
 #define NFP_FL_IPV4_TUNNEL_TYPE         GENMASK(7, 4)
 #define NFP_FL_IPV4_PRE_TUN_INDEX       GENMASK(2, 0)
+#define NFP_FLOWER_WORKQ_MAX_SKBS       30000
 #define nfp_flower_cmsg_warn(app, fmt, args...)                         \
        do {                                                            \
                if (net_ratelimit())                                    \
diff --git a/drivers/net/ethernet/netronome/nfp/flower/main.c b/drivers/net/ethernet/netronome/nfp/flower/main.c
index 6357e0720f43..ad02592a82b7 100644
--- a/drivers/net/ethernet/netronome/nfp/flower/main.c
+++ b/drivers/net/ethernet/netronome/nfp/flower/main.c
@@ -519,7 +519,8 @@ static int nfp_flower_init(struct nfp_app *app)
        app->priv = app_priv;
        app_priv->app = app;
-        skb_queue_head_init(&app_priv->cmsg_skbs);
+        skb_queue_head_init(&app_priv->cmsg_skbs_high);
+        skb_queue_head_init(&app_priv->cmsg_skbs_low);
        INIT_WORK(&app_priv->cmsg_work, nfp_flower_cmsg_process_rx);
        init_waitqueue_head(&app_priv->reify_wait_queue);
@@ -549,7 +550,8 @@ static void nfp_flower_clean(struct nfp_app *app)
 {
        struct nfp_flower_priv *app_priv = app->priv;
-        skb_queue_purge(&app_priv->cmsg_skbs);
+        skb_queue_purge(&app_priv->cmsg_skbs_high);
+        skb_queue_purge(&app_priv->cmsg_skbs_low);
        flush_work(&app_priv->cmsg_work);
        nfp_flower_metadata_cleanup(app);
diff --git a/drivers/net/ethernet/netronome/nfp/flower/main.h b/drivers/net/ethernet/netronome/nfp/flower/main.h
index e030b3ce4510..c67e1b54c614 100644
--- a/drivers/net/ethernet/netronome/nfp/flower/main.h
+++ b/drivers/net/ethernet/netronome/nfp/flower/main.h
@@ -107,7 +107,10 @@ struct nfp_mtu_conf {
 * @mask_table:         Hash table used to store masks
 * @flow_table:         Hash table used to store flower rules
 * @cmsg_work:          Workqueue for control messages processing
- * @cmsg_skbs:          List of skbs for control message processing
+ * @cmsg_skbs_high:     List of higher priority skbs for control message
+ *                      processing
+ * @cmsg_skbs_low:      List of lower priority skbs for control message
+ *                      processing
 * @nfp_mac_off_list:   List of MAC addresses to offload
 * @nfp_mac_index_list: List of unique 8-bit indexes for non NFP netdevs
 * @nfp_ipv4_off_list:  List of IPv4 addresses to offload
@@ -136,7 +139,8 @@ struct nfp_flower_priv {
        DECLARE_HASHTABLE(mask_table, NFP_FLOWER_MASK_HASH_BITS);
        DECLARE_HASHTABLE(flow_table, NFP_FLOWER_HASH_BITS);
        struct work_struct cmsg_work;
-        struct sk_buff_head cmsg_skbs;
+        struct sk_buff_head cmsg_skbs_high;
+        struct sk_buff_head cmsg_skbs_low;
        struct list_head nfp_mac_off_list;
        struct list_head nfp_mac_index_list;
        struct list_head nfp_ipv4_off_list;
diff --git a/drivers/net/ethernet/netronome/nfp/nfpcore/nfp_mutex.c b/drivers/net/ethernet/netronome/nfp/nfpcore/nfp_mutex.c
index f7b958181126..cb28ac03e4ca 100644
--- a/drivers/net/ethernet/netronome/nfp/nfpcore/nfp_mutex.c
+++ b/drivers/net/ethernet/netronome/nfp/nfpcore/nfp_mutex.c
@@ -211,8 +211,11 @@ int nfp_cpp_mutex_lock(struct nfp_cpp_mutex *mutex)
                        break;
                err = msleep_interruptible(timeout_ms);
-                if (err != 0)
+                if (err != 0) {
+                        nfp_info(mutex->cpp,
+                                 "interrupted waiting for NFP mutex\n");
                        return -ERESTARTSYS;
+                }
                if (time_is_before_eq_jiffies(warn_at)) {
                        warn_at = jiffies + NFP_MUTEX_WAIT_NEXT_WARN * HZ;
diff --git a/drivers/net/ethernet/netronome/nfp/nfpcore/nfp_nsp.c b/drivers/net/ethernet/netronome/nfp/nfpcore/nfp_nsp.c
index 99bb679a9801..2abee0fe3a7c 100644
--- a/drivers/net/ethernet/netronome/nfp/nfpcore/nfp_nsp.c
+++ b/drivers/net/ethernet/netronome/nfp/nfpcore/nfp_nsp.c
@@ -281,8 +281,7 @@ nfp_nsp_wait_reg(struct nfp_cpp *cpp, u64 *reg, u32 nsp_cpp, u64 addr,
                if ((*reg & mask) == val)
                        return 0;
-                if (msleep_interruptible(25))
+                msleep(25);
-                        return -ERESTARTSYS;
                if (time_after(start_time, wait_until))
                        return -ETIMEDOUT;
diff --git a/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c b/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c
index d33988570217..5f4e447c5dce 100644
--- a/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c
+++ b/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c
@@ -350,15 +350,16 @@ static int rmnet_fill_info(struct sk_buff *skb, const struct net_device *dev)
        real_dev = priv->real_dev;
-        if (!rmnet_is_real_dev_registered(real_dev))
-                return -ENODEV;
        if (nla_put_u16(skb, IFLA_RMNET_MUX_ID, priv->mux_id))
                goto nla_put_failure;
-        port = rmnet_get_port_rtnl(real_dev);
+        if (rmnet_is_real_dev_registered(real_dev)) {
+                port = rmnet_get_port_rtnl(real_dev);
+                f.flags = port->data_format;
+        } else {
+                f.flags = 0;
+        }
-        f.flags = port->data_format;
        f.mask  = ~0;
        if (nla_put(skb, IFLA_RMNET_FLAGS, sizeof(f), &f))
diff --git a/drivers/net/ethernet/sfc/ef10.c b/drivers/net/ethernet/sfc/ef10.c
index 50daad0a1482..83ce229f4eb7 100644
--- a/drivers/net/ethernet/sfc/ef10.c
+++ b/drivers/net/ethernet/sfc/ef10.c
@@ -4776,8 +4776,7 @@ static bool efx_ef10_filter_rfs_expire_one(struct efx_nic *efx, u32 flow_id,
                goto out_unlock;
        }
-        if (!rps_may_expire_flow(efx->net_dev, spec->dmaq_id,
+        if (!rps_may_expire_flow(efx->net_dev, spec->dmaq_id, flow_id, 0)) {
-                                 flow_id, filter_idx)) {
                ret = false;
                goto out_unlock;
        }
@@ -5265,7 +5264,7 @@ static int efx_ef10_filter_insert_addr_list(struct efx_nic *efx,
                ids = vlan->uc;
        }
-        filter_flags = efx_rss_enabled(efx) ? EFX_FILTER_FLAG_RX_RSS : 0;
+        filter_flags = efx_rss_active(&efx->rss_context) ? EFX_FILTER_FLAG_RX_RSS : 0;
        /* Insert/renew filters */
        for (i = 0; i < addr_count; i++) {
@@ -5334,7 +5333,7 @@ static int efx_ef10_filter_insert_def(struct efx_nic *efx,
        int rc;
        u16 *id;
-        filter_flags = efx_rss_enabled(efx) ? EFX_FILTER_FLAG_RX_RSS : 0;
+        filter_flags = efx_rss_active(&efx->rss_context) ? EFX_FILTER_FLAG_RX_RSS : 0;
        efx_filter_init_rx(&spec, EFX_FILTER_PRI_AUTO, filter_flags, 0);
diff --git a/drivers/net/ethernet/sfc/farch.c b/drivers/net/ethernet/sfc/farch.c
index 4a19c7efdf8d..7174ef5e5c5e 100644
--- a/drivers/net/ethernet/sfc/farch.c
+++ b/drivers/net/ethernet/sfc/farch.c
@@ -2912,7 +2912,7 @@ bool efx_farch_filter_rfs_expire_one(struct efx_nic *efx, u32 flow_id,
        if (test_bit(index, table->used_bitmap) &&
            table->spec[index].priority == EFX_FILTER_PRI_HINT &&
            rps_may_expire_flow(efx->net_dev, table->spec[index].dmaq_id,
-                                flow_id, index)) {
+                                flow_id, 0)) {
                efx_farch_filter_table_clear_entry(efx, table, index);
                ret = true;
        }
diff --git a/drivers/net/ethernet/sfc/net_driver.h b/drivers/net/ethernet/sfc/net_driver.h
index 5e379a83c729..eea3808b3f25 100644
--- a/drivers/net/ethernet/sfc/net_driver.h
+++ b/drivers/net/ethernet/sfc/net_driver.h
@@ -733,6 +733,27 @@ struct efx_rss_context {
        u32 rx_indir_table[128];
 };
+#ifdef CONFIG_RFS_ACCEL
+/**
+ * struct efx_async_filter_insertion - Request to asynchronously insert a filter
+ * @net_dev: Reference to the netdevice
+ * @spec: The filter to insert
+ * @work: Workitem for this request
+ * @rxq_index: Identifies the channel for which this request was made
+ * @flow_id: Identifies the kernel-side flow for which this request was made
+ */
+struct efx_async_filter_insertion {
+        struct net_device *net_dev;
+        struct efx_filter_spec spec;
+        struct work_struct work;
+        u16 rxq_index;
+        u32 flow_id;
+};
+/* Maximum number of ARFS workitems that may be in flight on an efx_nic */
+#define EFX_RPS_MAX_IN_FLIGHT   8
+#endif /* CONFIG_RFS_ACCEL */
 /**
 * struct efx_nic - an Efx NIC
 * @name: Device name (net device name or bus id before net device registered)
@@ -850,6 +871,8 @@ struct efx_rss_context {
 * @rps_expire_channel: Next channel to check for expiry
 * @rps_expire_index: Next index to check for expiry in
 *      @rps_expire_channel's @rps_flow_id
+ * @rps_slot_map: bitmap of in-flight entries in @rps_slot
+ * @rps_slot: array of ARFS insertion requests for efx_filter_rfs_work()
 * @active_queues: Count of RX and TX queues that haven't been flushed and drained.
 * @rxq_flush_pending: Count of number of receive queues that need to be flushed.
 *      Decremented when the efx_flush_rx_queue() is called.
@@ -1004,6 +1027,8 @@ struct efx_nic {
        struct mutex rps_mutex;
        unsigned int rps_expire_channel;
        unsigned int rps_expire_index;
+        unsigned long rps_slot_map;
+        struct efx_async_filter_insertion rps_slot[EFX_RPS_MAX_IN_FLIGHT];
 #endif
        atomic_t active_queues;
diff --git a/drivers/net/ethernet/sfc/rx.c b/drivers/net/ethernet/sfc/rx.c
index 95682831484e..9c593c661cbf 100644
--- a/drivers/net/ethernet/sfc/rx.c
+++ b/drivers/net/ethernet/sfc/rx.c
@@ -827,31 +827,16 @@ MODULE_PARM_DESC(rx_refill_threshold,
 #ifdef CONFIG_RFS_ACCEL
-/**
- * struct efx_async_filter_insertion - Request to asynchronously insert a filter
- * @net_dev: Reference to the netdevice
- * @spec: The filter to insert
- * @work: Workitem for this request
- * @rxq_index: Identifies the channel for which this request was made
- * @flow_id: Identifies the kernel-side flow for which this request was made
- */
-struct efx_async_filter_insertion {
-        struct net_device *net_dev;
-        struct efx_filter_spec spec;
-        struct work_struct work;
-        u16 rxq_index;
-        u32 flow_id;
-};
 static void efx_filter_rfs_work(struct work_struct *data)
 {
        struct efx_async_filter_insertion *req = container_of(data, struct efx_async_filter_insertion,
                                                              work);
        struct efx_nic *efx = netdev_priv(req->net_dev);
        struct efx_channel *channel = efx_get_channel(efx, req->rxq_index);
+        int slot_idx = req - efx->rps_slot;
        int rc;
-        rc = efx->type->filter_insert(efx, &req->spec, false);
+        rc = efx->type->filter_insert(efx, &req->spec, true);
        if (rc >= 0) {
                /* Remember this so we can check whether to expire the filter
                 * later.
@@ -878,8 +863,8 @@ static void efx_filter_rfs_work(struct work_struct *data)
        }
        /* Release references */
+        clear_bit(slot_idx, &efx->rps_slot_map);
        dev_put(req->net_dev);
-        kfree(req);
 }
 int efx_filter_rfs(struct net_device *net_dev, const struct sk_buff *skb,
@@ -888,22 +873,36 @@ int efx_filter_rfs(struct net_device *net_dev, const struct sk_buff *skb,
        struct efx_nic *efx = netdev_priv(net_dev);
        struct efx_async_filter_insertion *req;
        struct flow_keys fk;
+        int slot_idx;
+        int rc;
-        if (flow_id == RPS_FLOW_ID_INVALID)
+        /* find a free slot */
-                return -EINVAL;
+        for (slot_idx = 0; slot_idx < EFX_RPS_MAX_IN_FLIGHT; slot_idx++)
+                if (!test_and_set_bit(slot_idx, &efx->rps_slot_map))
+                        break;
+        if (slot_idx >= EFX_RPS_MAX_IN_FLIGHT)
+                return -EBUSY;
-        if (!skb_flow_dissect_flow_keys(skb, &fk, 0))
+        if (flow_id == RPS_FLOW_ID_INVALID) {
-                return -EPROTONOSUPPORT;
+                rc = -EINVAL;
+                goto out_clear;
+        }
-        if (fk.basic.n_proto != htons(ETH_P_IP) && fk.basic.n_proto != htons(ETH_P_IPV6))
+        if (!skb_flow_dissect_flow_keys(skb, &fk, 0)) {
-                return -EPROTONOSUPPORT;
+                rc = -EPROTONOSUPPORT;
-        if (fk.control.flags & FLOW_DIS_IS_FRAGMENT)
+                goto out_clear;
-                return -EPROTONOSUPPORT;
+        }
-        req = kmalloc(sizeof(*req), GFP_ATOMIC);
+        if (fk.basic.n_proto != htons(ETH_P_IP) && fk.basic.n_proto != htons(ETH_P_IPV6)) {
-        if (!req)
+                rc = -EPROTONOSUPPORT;
-                return -ENOMEM;
+                goto out_clear;
+        }
+        if (fk.control.flags & FLOW_DIS_IS_FRAGMENT) {
+                rc = -EPROTONOSUPPORT;
+                goto out_clear;
+        }
+        req = efx->rps_slot + slot_idx;
        efx_filter_init_rx(&req->spec, EFX_FILTER_PRI_HINT,
                           efx->rx_scatter ? EFX_FILTER_FLAG_RX_SCATTER : 0,
                           rxq_index);
@@ -933,6 +932,9 @@ int efx_filter_rfs(struct net_device *net_dev, const struct sk_buff *skb,
        req->flow_id = flow_id;
        schedule_work(&req->work);
        return 0;
+out_clear:
+        clear_bit(slot_idx, &efx->rps_slot_map);
+        return rc;
 }
 bool __efx_filter_rfs_expire(struct efx_nic *efx, unsigned int quota)
diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac4.h b/drivers/net/ethernet/stmicro/stmmac/dwmac4.h
index c7bff596c665..dedd40613090 100644
--- a/drivers/net/ethernet/stmicro/stmmac/dwmac4.h
+++ b/drivers/net/ethernet/stmicro/stmmac/dwmac4.h
@@ -347,7 +347,7 @@ enum power_event {
 #define MTL_RX_OVERFLOW_INT             BIT(16)
 /* Default operating mode of the MAC */
-#define GMAC_CORE_INIT (GMAC_CONFIG_JD | GMAC_CONFIG_PS | GMAC_CONFIG_ACS | \
+#define GMAC_CORE_INIT (GMAC_CONFIG_JD | GMAC_CONFIG_PS | \
                        GMAC_CONFIG_BE | GMAC_CONFIG_DCRS)
 /* To dump the core regs excluding  the Address Registers */
diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c b/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c
index a3af92ebbca8..517b1f6736a8 100644
--- a/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c
+++ b/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c
@@ -31,13 +31,6 @@ static void dwmac4_core_init(struct mac_device_info *hw,
        value |= GMAC_CORE_INIT;
-        /* Clear ACS bit because Ethernet switch tagging formats such as
-         * Broadcom tags can look like invalid LLC/SNAP packets and cause the
-         * hardware to truncate packets on reception.
-         */
-        if (netdev_uses_dsa(dev))
-                value &= ~GMAC_CONFIG_ACS;
        if (mtu > 1500)
                value |= GMAC_CONFIG_2K;
        if (mtu > 2000)
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
index 9a16931ce39d..b65e2d144698 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
@@ -3495,8 +3495,13 @@ static int stmmac_rx(struct stmmac_priv *priv, int limit, u32 queue)
                        /* ACS is set; GMAC core strips PAD/FCS for IEEE 802.3
                         * Type frames (LLC/LLC-SNAP)
+                         *
+                         * llc_snap is never checked in GMAC >= 4, so this ACS
+                         * feature is always disabled and packets need to be
+                         * stripped manually.
                         */
-                        if (unlikely(status != llc_snap))
+                        if (unlikely(priv->synopsys_id >= DWMAC_CORE_4_00) ||
+                            unlikely(status != llc_snap))
                                frame_len -= ETH_FCS_LEN;
                        if (netif_msg_rx_status(priv)) {
diff --git a/drivers/net/macsec.c b/drivers/net/macsec.c
index 9cbb0c8a896a..7de88b33d5b9 100644
--- a/drivers/net/macsec.c
+++ b/drivers/net/macsec.c
@@ -3277,7 +3277,7 @@ static int macsec_newlink(struct net *net, struct net_device *dev,
        err = netdev_upper_dev_link(real_dev, dev, extack);
        if (err < 0)
-                goto put_dev;
+                goto unregister;
        /* need to be already registered so that ->init has run and
         * the MAC addr is set
@@ -3316,8 +3316,7 @@ del_dev:
        macsec_del_dev(macsec);
 unlink:
        netdev_upper_dev_unlink(real_dev, dev);
-put_dev:
+unregister:
-        dev_put(real_dev);
        unregister_netdevice(dev);
        return err;
 }
diff --git a/drivers/net/phy/microchip.c b/drivers/net/phy/microchip.c
index 0f293ef28935..a97ac8c12c4c 100644
--- a/drivers/net/phy/microchip.c
+++ b/drivers/net/phy/microchip.c
@@ -20,6 +20,7 @@
 #include <linux/ethtool.h>
 #include <linux/phy.h>
 #include <linux/microchipphy.h>
+#include <linux/delay.h>
 #define DRIVER_AUTHOR   "WOOJUNG HUH <woojung.huh@microchip.com>"
 #define DRIVER_DESC     "Microchip LAN88XX PHY driver"
@@ -30,6 +31,16 @@ struct lan88xx_priv {
        __u32   wolopts;
 };
+static int lan88xx_read_page(struct phy_device *phydev)
+{
+        return __phy_read(phydev, LAN88XX_EXT_PAGE_ACCESS);
+}
+static int lan88xx_write_page(struct phy_device *phydev, int page)
+{
+        return __phy_write(phydev, LAN88XX_EXT_PAGE_ACCESS, page);
+}
 static int lan88xx_phy_config_intr(struct phy_device *phydev)
 {
        int rc;
@@ -66,6 +77,150 @@ static int lan88xx_suspend(struct phy_device *phydev)
        return 0;
 }
+static int lan88xx_TR_reg_set(struct phy_device *phydev, u16 regaddr,
+                              u32 data)
+{
+        int val, save_page, ret = 0;
+        u16 buf;
+        /* Save current page */
+        save_page = phy_save_page(phydev);
+        if (save_page < 0) {
+                pr_warn("Failed to get current page\n");
+                goto err;
+        }
+        /* Switch to TR page */
+        lan88xx_write_page(phydev, LAN88XX_EXT_PAGE_ACCESS_TR);
+        ret = __phy_write(phydev, LAN88XX_EXT_PAGE_TR_LOW_DATA,
+                          (data & 0xFFFF));
+        if (ret < 0) {
+                pr_warn("Failed to write TR low data\n");
+                goto err;
+        }
+        ret = __phy_write(phydev, LAN88XX_EXT_PAGE_TR_HIGH_DATA,
+                          (data & 0x00FF0000) >> 16);
+        if (ret < 0) {
+                pr_warn("Failed to write TR high data\n");
+                goto err;
+        }
+        /* Config control bits [15:13] of register */
+        buf = (regaddr & ~(0x3 << 13));/* Clr [14:13] to write data in reg */
+        buf |= 0x8000; /* Set [15] to Packet transmit */
+        ret = __phy_write(phydev, LAN88XX_EXT_PAGE_TR_CR, buf);
+        if (ret < 0) {
+                pr_warn("Failed to write data in reg\n");
+                goto err;
+        }
+        usleep_range(1000, 2000);/* Wait for Data to be written */
+        val = __phy_read(phydev, LAN88XX_EXT_PAGE_TR_CR);
+        if (!(val & 0x8000))
+                pr_warn("TR Register[0x%X] configuration failed\n", regaddr);
+err:
+        return phy_restore_page(phydev, save_page, ret);
+}
+static void lan88xx_config_TR_regs(struct phy_device *phydev)
+{
+        int err;
+        /* Get access to Channel 0x1, Node 0xF , Register 0x01.
+         * Write 24-bit value 0x12B00A to register. Setting MrvlTrFix1000Kf,
+         * MrvlTrFix1000Kp, MasterEnableTR bits.
+         */
+        err = lan88xx_TR_reg_set(phydev, 0x0F82, 0x12B00A);
+        if (err < 0)
+                pr_warn("Failed to Set Register[0x0F82]\n");
+        /* Get access to Channel b'10, Node b'1101, Register 0x06.
+         * Write 24-bit value 0xD2C46F to register. Setting SSTrKf1000Slv,
+         * SSTrKp1000Mas bits.
+         */
+        err = lan88xx_TR_reg_set(phydev, 0x168C, 0xD2C46F);
+        if (err < 0)
+                pr_warn("Failed to Set Register[0x168C]\n");
+        /* Get access to Channel b'10, Node b'1111, Register 0x11.
+         * Write 24-bit value 0x620 to register. Setting rem_upd_done_thresh
+         * bits
+         */
+        err = lan88xx_TR_reg_set(phydev, 0x17A2, 0x620);
+        if (err < 0)
+                pr_warn("Failed to Set Register[0x17A2]\n");
+        /* Get access to Channel b'10, Node b'1101, Register 0x10.
+         * Write 24-bit value 0xEEFFDD to register. Setting
+         * eee_TrKp1Long_1000, eee_TrKp2Long_1000, eee_TrKp3Long_1000,
+         * eee_TrKp1Short_1000,eee_TrKp2Short_1000, eee_TrKp3Short_1000 bits.
+         */
+        err = lan88xx_TR_reg_set(phydev, 0x16A0, 0xEEFFDD);
+        if (err < 0)
+                pr_warn("Failed to Set Register[0x16A0]\n");
+        /* Get access to Channel b'10, Node b'1101, Register 0x13.
+         * Write 24-bit value 0x071448 to register. Setting
+         * slv_lpi_tr_tmr_val1, slv_lpi_tr_tmr_val2 bits.
+         */
+        err = lan88xx_TR_reg_set(phydev, 0x16A6, 0x071448);
+        if (err < 0)
+                pr_warn("Failed to Set Register[0x16A6]\n");
+        /* Get access to Channel b'10, Node b'1101, Register 0x12.
+         * Write 24-bit value 0x13132F to register. Setting
+         * slv_sigdet_timer_val1, slv_sigdet_timer_val2 bits.
+         */
+        err = lan88xx_TR_reg_set(phydev, 0x16A4, 0x13132F);
+        if (err < 0)
+                pr_warn("Failed to Set Register[0x16A4]\n");
+        /* Get access to Channel b'10, Node b'1101, Register 0x14.
+         * Write 24-bit value 0x0 to register. Setting eee_3level_delay,
+         * eee_TrKf_freeze_delay bits.
+         */
+        err = lan88xx_TR_reg_set(phydev, 0x16A8, 0x0);
+        if (err < 0)
+                pr_warn("Failed to Set Register[0x16A8]\n");
+        /* Get access to Channel b'01, Node b'1111, Register 0x34.
+         * Write 24-bit value 0x91B06C to register. Setting
+         * FastMseSearchThreshLong1000, FastMseSearchThreshShort1000,
+         * FastMseSearchUpdGain1000 bits.
+         */
+        err = lan88xx_TR_reg_set(phydev, 0x0FE8, 0x91B06C);
+        if (err < 0)
+                pr_warn("Failed to Set Register[0x0FE8]\n");
+        /* Get access to Channel b'01, Node b'1111, Register 0x3E.
+         * Write 24-bit value 0xC0A028 to register. Setting
+         * FastMseKp2ThreshLong1000, FastMseKp2ThreshShort1000,
+         * FastMseKp2UpdGain1000, FastMseKp2ExitEn1000 bits.
+         */
+        err = lan88xx_TR_reg_set(phydev, 0x0FFC, 0xC0A028);
+        if (err < 0)
+                pr_warn("Failed to Set Register[0x0FFC]\n");
+        /* Get access to Channel b'01, Node b'1111, Register 0x35.
+         * Write 24-bit value 0x041600 to register. Setting
+         * FastMseSearchPhShNum1000, FastMseSearchClksPerPh1000,
+         * FastMsePhChangeDelay1000 bits.
+         */
+        err = lan88xx_TR_reg_set(phydev, 0x0FEA, 0x041600);
+        if (err < 0)
+                pr_warn("Failed to Set Register[0x0FEA]\n");
+        /* Get access to Channel b'10, Node b'1101, Register 0x03.
+         * Write 24-bit value 0x000004 to register. Setting TrFreeze bits.
+         */
+        err = lan88xx_TR_reg_set(phydev, 0x1686, 0x000004);
+        if (err < 0)
+                pr_warn("Failed to Set Register[0x1686]\n");
+}
 static int lan88xx_probe(struct phy_device *phydev)
 {
        struct device *dev = &phydev->mdio.dev;
@@ -132,6 +287,25 @@ static void lan88xx_set_mdix(struct phy_device *phydev)
        phy_write(phydev, LAN88XX_EXT_PAGE_ACCESS, LAN88XX_EXT_PAGE_SPACE_0);
 }
+static int lan88xx_config_init(struct phy_device *phydev)
+{
+        int val;
+        genphy_config_init(phydev);
+        /*Zerodetect delay enable */
+        val = phy_read_mmd(phydev, MDIO_MMD_PCS,
+                           PHY_ARDENNES_MMD_DEV_3_PHY_CFG);
+        val |= PHY_ARDENNES_MMD_DEV_3_PHY_CFG_ZD_DLY_EN_;
+        phy_write_mmd(phydev, MDIO_MMD_PCS, PHY_ARDENNES_MMD_DEV_3_PHY_CFG,
+                      val);
+        /* Config DSP registers */
+        lan88xx_config_TR_regs(phydev);
+        return 0;
+}
 static int lan88xx_config_aneg(struct phy_device *phydev)
 {
        lan88xx_set_mdix(phydev);
@@ -151,7 +325,7 @@ static struct phy_driver microchip_phy_driver[] = {
        .probe          = lan88xx_probe,
        .remove         = lan88xx_remove,
-        .config_init    = genphy_config_init,
+        .config_init    = lan88xx_config_init,
        .config_aneg    = lan88xx_config_aneg,
        .ack_interrupt  = lan88xx_phy_ack_interrupt,
@@ -160,6 +334,8 @@ static struct phy_driver microchip_phy_driver[] = {
        .suspend        = lan88xx_suspend,
        .resume         = genphy_resume,
        .set_wol        = lan88xx_set_wol,
+        .read_page      = lan88xx_read_page,
+        .write_page     = lan88xx_write_page,
 } };
 module_phy_driver(microchip_phy_driver);
diff --git a/drivers/net/team/team.c b/drivers/net/team/team.c
index a6c6ce19eeee..acbe84967834 100644
--- a/drivers/net/team/team.c
+++ b/drivers/net/team/team.c
@@ -261,6 +261,17 @@ static void __team_option_inst_mark_removed_port(struct team *team,
        }
 }
+static bool __team_option_inst_tmp_find(const struct list_head *opts,
+                                        const struct team_option_inst *needle)
+{
+        struct team_option_inst *opt_inst;
+        list_for_each_entry(opt_inst, opts, tmp_list)
+                if (opt_inst == needle)
+                        return true;
+        return false;
+}
 static int __team_options_register(struct team *team,
                                   const struct team_option *option,
                                   size_t option_count)
@@ -2568,6 +2579,14 @@ static int team_nl_cmd_options_set(struct sk_buff *skb, struct genl_info *info)
                        if (err)
                                goto team_put;
                        opt_inst->changed = true;
+                        /* dumb/evil user-space can send us duplicate opt,
+                         * keep only the last one
+                         */
+                        if (__team_option_inst_tmp_find(&opt_inst_list,
+                                                        opt_inst))
+                                continue;
                        list_add(&opt_inst->tmp_list, &opt_inst_list);
                }
                if (!opt_found) {
diff --git a/drivers/net/tun.c b/drivers/net/tun.c
index 28583aa0c17d..ef33950a45d9 100644
--- a/drivers/net/tun.c
+++ b/drivers/net/tun.c
@@ -1102,12 +1102,7 @@ static netdev_tx_t tun_net_xmit(struct sk_buff *skb, struct net_device *dev)
                goto drop;
        len = run_ebpf_filter(tun, skb, len);
+        if (len == 0 || pskb_trim(skb, len))
-        /* Trim extra bytes since we may insert vlan proto & TCI
-         * in tun_put_user().
-         */
-        len -= skb_vlan_tag_present(skb) ? sizeof(struct veth) : 0;
-        if (len <= 0 || pskb_trim(skb, len))
                goto drop;
        if (unlikely(skb_orphan_frags_rx(skb, GFP_ATOMIC)))
diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
index ca066b785e9f..c853e7410f5a 100644
--- a/drivers/net/usb/qmi_wwan.c
+++ b/drivers/net/usb/qmi_wwan.c
@@ -1107,6 +1107,7 @@ static const struct usb_device_id products[] = {
        {QMI_FIXED_INTF(0x1435, 0xd181, 3)},    /* Wistron NeWeb D18Q1 */
        {QMI_FIXED_INTF(0x1435, 0xd181, 4)},    /* Wistron NeWeb D18Q1 */
        {QMI_FIXED_INTF(0x1435, 0xd181, 5)},    /* Wistron NeWeb D18Q1 */
+        {QMI_FIXED_INTF(0x1435, 0xd191, 4)},    /* Wistron NeWeb D19Q1 */
        {QMI_FIXED_INTF(0x16d8, 0x6003, 0)},    /* CMOTech 6003 */
        {QMI_FIXED_INTF(0x16d8, 0x6007, 0)},    /* CMOTech CHE-628S */
        {QMI_FIXED_INTF(0x16d8, 0x6008, 0)},    /* CMOTech CMU-301 */
diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
index 7b187ec7411e..770422e953f7 100644
--- a/drivers/net/virtio_net.c
+++ b/drivers/net/virtio_net.c
@@ -147,6 +147,17 @@ struct receive_queue {
        struct xdp_rxq_info xdp_rxq;
 };
+/* Control VQ buffers: protected by the rtnl lock */
+struct control_buf {
+        struct virtio_net_ctrl_hdr hdr;
+        virtio_net_ctrl_ack status;
+        struct virtio_net_ctrl_mq mq;
+        u8 promisc;
+        u8 allmulti;
+        __virtio16 vid;
+        __virtio64 offloads;
+};
 struct virtnet_info {
        struct virtio_device *vdev;
        struct virtqueue *cvq;
@@ -192,14 +203,7 @@ struct virtnet_info {
        struct hlist_node node;
        struct hlist_node node_dead;
-        /* Control VQ buffers: protected by the rtnl lock */
+        struct control_buf *ctrl;
-        struct virtio_net_ctrl_hdr ctrl_hdr;
-        virtio_net_ctrl_ack ctrl_status;
-        struct virtio_net_ctrl_mq ctrl_mq;
-        u8 ctrl_promisc;
-        u8 ctrl_allmulti;
-        u16 ctrl_vid;
-        u64 ctrl_offloads;
        /* Ethtool settings */
        u8 duplex;
@@ -1269,7 +1273,9 @@ static int virtnet_poll(struct napi_struct *napi, int budget)
 {
        struct receive_queue *rq =
                container_of(napi, struct receive_queue, napi);
-        unsigned int received;
+        struct virtnet_info *vi = rq->vq->vdev->priv;
+        struct send_queue *sq;
+        unsigned int received, qp;
        bool xdp_xmit = false;
        virtnet_poll_cleantx(rq);
@@ -1280,8 +1286,13 @@ static int virtnet_poll(struct napi_struct *napi, int budget)
        if (received < budget)
                virtqueue_napi_complete(napi, rq->vq, received);
-        if (xdp_xmit)
+        if (xdp_xmit) {
+                qp = vi->curr_queue_pairs - vi->xdp_queue_pairs +
+                     smp_processor_id();
+                sq = &vi->sq[qp];
+                virtqueue_kick(sq->vq);
                xdp_do_flush_map();
+        }
        return received;
 }
@@ -1454,25 +1465,25 @@ static bool virtnet_send_command(struct virtnet_info *vi, u8 class, u8 cmd,
        /* Caller should know better */
        BUG_ON(!virtio_has_feature(vi->vdev, VIRTIO_NET_F_CTRL_VQ));
-        vi->ctrl_status = ~0;
+        vi->ctrl->status = ~0;
-        vi->ctrl_hdr.class = class;
+        vi->ctrl->hdr.class = class;
-        vi->ctrl_hdr.cmd = cmd;
+        vi->ctrl->hdr.cmd = cmd;
        /* Add header */
-        sg_init_one(&hdr, &vi->ctrl_hdr, sizeof(vi->ctrl_hdr));
+        sg_init_one(&hdr, &vi->ctrl->hdr, sizeof(vi->ctrl->hdr));
        sgs[out_num++] = &hdr;
        if (out)
                sgs[out_num++] = out;
        /* Add return status. */
-        sg_init_one(&stat, &vi->ctrl_status, sizeof(vi->ctrl_status));
+        sg_init_one(&stat, &vi->ctrl->status, sizeof(vi->ctrl->status));
        sgs[out_num] = &stat;
        BUG_ON(out_num + 1 > ARRAY_SIZE(sgs));
        virtqueue_add_sgs(vi->cvq, sgs, out_num, 1, vi, GFP_ATOMIC);
        if (unlikely(!virtqueue_kick(vi->cvq)))
-                return vi->ctrl_status == VIRTIO_NET_OK;
+                return vi->ctrl->status == VIRTIO_NET_OK;
        /* Spin for a response, the kick causes an ioport write, trapping
         * into the hypervisor, so the request should be handled immediately.
@@ -1481,7 +1492,7 @@ static bool virtnet_send_command(struct virtnet_info *vi, u8 class, u8 cmd,
               !virtqueue_is_broken(vi->cvq))
                cpu_relax();
-        return vi->ctrl_status == VIRTIO_NET_OK;
+        return vi->ctrl->status == VIRTIO_NET_OK;
 }
 static int virtnet_set_mac_address(struct net_device *dev, void *p)
@@ -1593,8 +1604,8 @@ static int _virtnet_set_queues(struct virtnet_info *vi, u16 queue_pairs)
        if (!vi->has_cvq || !virtio_has_feature(vi->vdev, VIRTIO_NET_F_MQ))
                return 0;
-        vi->ctrl_mq.virtqueue_pairs = cpu_to_virtio16(vi->vdev, queue_pairs);
+        vi->ctrl->mq.virtqueue_pairs = cpu_to_virtio16(vi->vdev, queue_pairs);
-        sg_init_one(&sg, &vi->ctrl_mq, sizeof(vi->ctrl_mq));
+        sg_init_one(&sg, &vi->ctrl->mq, sizeof(vi->ctrl->mq));
        if (!virtnet_send_command(vi, VIRTIO_NET_CTRL_MQ,
                                  VIRTIO_NET_CTRL_MQ_VQ_PAIRS_SET, &sg)) {
@@ -1653,22 +1664,22 @@ static void virtnet_set_rx_mode(struct net_device *dev)
        if (!virtio_has_feature(vi->vdev, VIRTIO_NET_F_CTRL_RX))
                return;
-        vi->ctrl_promisc = ((dev->flags & IFF_PROMISC) != 0);
+        vi->ctrl->promisc = ((dev->flags & IFF_PROMISC) != 0);
-        vi->ctrl_allmulti = ((dev->flags & IFF_ALLMULTI) != 0);
+        vi->ctrl->allmulti = ((dev->flags & IFF_ALLMULTI) != 0);
-        sg_init_one(sg, &vi->ctrl_promisc, sizeof(vi->ctrl_promisc));
+        sg_init_one(sg, &vi->ctrl->promisc, sizeof(vi->ctrl->promisc));
        if (!virtnet_send_command(vi, VIRTIO_NET_CTRL_RX,
                                  VIRTIO_NET_CTRL_RX_PROMISC, sg))
                dev_warn(&dev->dev, "Failed to %sable promisc mode.\n",
-                         vi->ctrl_promisc ? "en" : "dis");
+                         vi->ctrl->promisc ? "en" : "dis");
-        sg_init_one(sg, &vi->ctrl_allmulti, sizeof(vi->ctrl_allmulti));
+        sg_init_one(sg, &vi->ctrl->allmulti, sizeof(vi->ctrl->allmulti));
        if (!virtnet_send_command(vi, VIRTIO_NET_CTRL_RX,
                                  VIRTIO_NET_CTRL_RX_ALLMULTI, sg))
                dev_warn(&dev->dev, "Failed to %sable allmulti mode.\n",
-                         vi->ctrl_allmulti ? "en" : "dis");
+                         vi->ctrl->allmulti ? "en" : "dis");
        uc_count = netdev_uc_count(dev);
        mc_count = netdev_mc_count(dev);
@@ -1714,8 +1725,8 @@ static int virtnet_vlan_rx_add_vid(struct net_device *dev,
        struct virtnet_info *vi = netdev_priv(dev);
        struct scatterlist sg;
-        vi->ctrl_vid = vid;
+        vi->ctrl->vid = cpu_to_virtio16(vi->vdev, vid);
-        sg_init_one(&sg, &vi->ctrl_vid, sizeof(vi->ctrl_vid));
+        sg_init_one(&sg, &vi->ctrl->vid, sizeof(vi->ctrl->vid));
        if (!virtnet_send_command(vi, VIRTIO_NET_CTRL_VLAN,
                                  VIRTIO_NET_CTRL_VLAN_ADD, &sg))
@@ -1729,8 +1740,8 @@ static int virtnet_vlan_rx_kill_vid(struct net_device *dev,
        struct virtnet_info *vi = netdev_priv(dev);
        struct scatterlist sg;
-        vi->ctrl_vid = vid;
+        vi->ctrl->vid = cpu_to_virtio16(vi->vdev, vid);
-        sg_init_one(&sg, &vi->ctrl_vid, sizeof(vi->ctrl_vid));
+        sg_init_one(&sg, &vi->ctrl->vid, sizeof(vi->ctrl->vid));
        if (!virtnet_send_command(vi, VIRTIO_NET_CTRL_VLAN,
                                  VIRTIO_NET_CTRL_VLAN_DEL, &sg))
@@ -2126,9 +2137,9 @@ static int virtnet_restore_up(struct virtio_device *vdev)
 static int virtnet_set_guest_offloads(struct virtnet_info *vi, u64 offloads)
 {
        struct scatterlist sg;
-        vi->ctrl_offloads = cpu_to_virtio64(vi->vdev, offloads);
+        vi->ctrl->offloads = cpu_to_virtio64(vi->vdev, offloads);
-        sg_init_one(&sg, &vi->ctrl_offloads, sizeof(vi->ctrl_offloads));
+        sg_init_one(&sg, &vi->ctrl->offloads, sizeof(vi->ctrl->offloads));
        if (!virtnet_send_command(vi, VIRTIO_NET_CTRL_GUEST_OFFLOADS,
                                  VIRTIO_NET_CTRL_GUEST_OFFLOADS_SET, &sg)) {
@@ -2351,6 +2362,7 @@ static void virtnet_free_queues(struct virtnet_info *vi)
        kfree(vi->rq);
        kfree(vi->sq);
+        kfree(vi->ctrl);
 }
 static void _free_receive_bufs(struct virtnet_info *vi)
@@ -2543,6 +2555,9 @@ static int virtnet_alloc_queues(struct virtnet_info *vi)
 {
        int i;
+        vi->ctrl = kzalloc(sizeof(*vi->ctrl), GFP_KERNEL);
+        if (!vi->ctrl)
+                goto err_ctrl;
        vi->sq = kzalloc(sizeof(*vi->sq) * vi->max_queue_pairs, GFP_KERNEL);
        if (!vi->sq)
                goto err_sq;
@@ -2571,6 +2586,8 @@ static int virtnet_alloc_queues(struct virtnet_info *vi)
 err_rq:
        kfree(vi->sq);
 err_sq:
+        kfree(vi->ctrl);
+err_ctrl:
        return -ENOMEM;
 }
diff --git a/drivers/net/vmxnet3/vmxnet3_drv.c b/drivers/net/vmxnet3/vmxnet3_drv.c
index e04937f44f33..9ebe2a689966 100644
--- a/drivers/net/vmxnet3/vmxnet3_drv.c
+++ b/drivers/net/vmxnet3/vmxnet3_drv.c
@@ -1218,6 +1218,7 @@ vmxnet3_get_hdr_len(struct vmxnet3_adapter *adapter, struct sk_buff *skb,
        union {
                void *ptr;
                struct ethhdr *eth;
+                struct vlan_ethhdr *veth;
                struct iphdr *ipv4;
                struct ipv6hdr *ipv6;
                struct tcphdr *tcp;
@@ -1228,16 +1229,24 @@ vmxnet3_get_hdr_len(struct vmxnet3_adapter *adapter, struct sk_buff *skb,
        if (unlikely(sizeof(struct iphdr) + sizeof(struct tcphdr) > maplen))
                return 0;
+        if (skb->protocol == cpu_to_be16(ETH_P_8021Q) ||
+            skb->protocol == cpu_to_be16(ETH_P_8021AD))
+                hlen = sizeof(struct vlan_ethhdr);
+        else
+                hlen = sizeof(struct ethhdr);
        hdr.eth = eth_hdr(skb);
        if (gdesc->rcd.v4) {
-                BUG_ON(hdr.eth->h_proto != htons(ETH_P_IP));
+                BUG_ON(hdr.eth->h_proto != htons(ETH_P_IP) &&
-                hdr.ptr += sizeof(struct ethhdr);
+                       hdr.veth->h_vlan_encapsulated_proto != htons(ETH_P_IP));
+                hdr.ptr += hlen;
                BUG_ON(hdr.ipv4->protocol != IPPROTO_TCP);
                hlen = hdr.ipv4->ihl << 2;
                hdr.ptr += hdr.ipv4->ihl << 2;
        } else if (gdesc->rcd.v6) {
-                BUG_ON(hdr.eth->h_proto != htons(ETH_P_IPV6));
+                BUG_ON(hdr.eth->h_proto != htons(ETH_P_IPV6) &&
-                hdr.ptr += sizeof(struct ethhdr);
+                       hdr.veth->h_vlan_encapsulated_proto != htons(ETH_P_IPV6));
+                hdr.ptr += hlen;
                /* Use an estimated value, since we also need to handle
                 * TSO case.
                 */
diff --git a/drivers/net/vmxnet3/vmxnet3_int.h b/drivers/net/vmxnet3/vmxnet3_int.h
index 59ec34052a65..a3326463b71f 100644
--- a/drivers/net/vmxnet3/vmxnet3_int.h
+++ b/drivers/net/vmxnet3/vmxnet3_int.h
@@ -69,10 +69,10 @@
 /*
 * Version numbers
 */
-#define VMXNET3_DRIVER_VERSION_STRING   "1.4.13.0-k"
+#define VMXNET3_DRIVER_VERSION_STRING   "1.4.14.0-k"
 /* a 32-bit int, each byte encode a verion number in VMXNET3_DRIVER_VERSION */
-#define VMXNET3_DRIVER_VERSION_NUM      0x01040d00
+#define VMXNET3_DRIVER_VERSION_NUM      0x01040e00
 #if defined(CONFIG_PCI_MSI)
        /* RSS only makes sense if MSI-X is supported. */
diff --git a/drivers/nvdimm/Kconfig b/drivers/nvdimm/Kconfig
index 85997184e047..9d36473dc2a2 100644
--- a/drivers/nvdimm/Kconfig
+++ b/drivers/nvdimm/Kconfig
@@ -103,8 +103,7 @@ config NVDIMM_DAX
          Select Y if unsure
 config OF_PMEM
-        # FIXME: make tristate once OF_NUMA dependency removed
+        tristate "Device-tree support for persistent memory regions"
-        bool "Device-tree support for persistent memory regions"
        depends on OF
        default LIBNVDIMM
        help
diff --git a/drivers/nvdimm/dimm_devs.c b/drivers/nvdimm/dimm_devs.c
index e00d45522b80..8d348b22ba45 100644
--- a/drivers/nvdimm/dimm_devs.c
+++ b/drivers/nvdimm/dimm_devs.c
@@ -88,9 +88,9 @@ int nvdimm_init_nsarea(struct nvdimm_drvdata *ndd)
 int nvdimm_init_config_data(struct nvdimm_drvdata *ndd)
 {
        struct nvdimm_bus *nvdimm_bus = walk_to_nvdimm_bus(ndd->dev);
+        int rc = validate_dimm(ndd), cmd_rc = 0;
        struct nd_cmd_get_config_data_hdr *cmd;
        struct nvdimm_bus_descriptor *nd_desc;
-        int rc = validate_dimm(ndd);
        u32 max_cmd_size, config_size;
        size_t offset;
@@ -124,9 +124,11 @@ int nvdimm_init_config_data(struct nvdimm_drvdata *ndd)
                cmd->in_offset = offset;
                rc = nd_desc->ndctl(nd_desc, to_nvdimm(ndd->dev),
                                ND_CMD_GET_CONFIG_DATA, cmd,
-                                cmd->in_length + sizeof(*cmd), NULL);
+                                cmd->in_length + sizeof(*cmd), &cmd_rc);
-                if (rc || cmd->status) {
+                if (rc < 0)
-                        rc = -ENXIO;
+                        break;
+                if (cmd_rc < 0) {
+                        rc = cmd_rc;
                        break;
                }
                memcpy(ndd->data + offset, cmd->out_buf, cmd->in_length);
@@ -140,9 +142,9 @@ int nvdimm_init_config_data(struct nvdimm_drvdata *ndd)
 int nvdimm_set_config_data(struct nvdimm_drvdata *ndd, size_t offset,
                void *buf, size_t len)
 {
-        int rc = validate_dimm(ndd);
        size_t max_cmd_size, buf_offset;
        struct nd_cmd_set_config_hdr *cmd;
+        int rc = validate_dimm(ndd), cmd_rc = 0;
        struct nvdimm_bus *nvdimm_bus = walk_to_nvdimm_bus(ndd->dev);
        struct nvdimm_bus_descriptor *nd_desc = nvdimm_bus->nd_desc;
@@ -164,7 +166,6 @@ int nvdimm_set_config_data(struct nvdimm_drvdata *ndd, size_t offset,
        for (buf_offset = 0; len; len -= cmd->in_length,
                        buf_offset += cmd->in_length) {
                size_t cmd_size;
-                u32 *status;
                cmd->in_offset = offset + buf_offset;
                cmd->in_length = min(max_cmd_size, len);
@@ -172,12 +173,13 @@ int nvdimm_set_config_data(struct nvdimm_drvdata *ndd, size_t offset,
                /* status is output in the last 4-bytes of the command buffer */
                cmd_size = sizeof(*cmd) + cmd->in_length + sizeof(u32);
-                status = ((void *) cmd) + cmd_size - sizeof(u32);
                rc = nd_desc->ndctl(nd_desc, to_nvdimm(ndd->dev),
-                                ND_CMD_SET_CONFIG_DATA, cmd, cmd_size, NULL);
+                                ND_CMD_SET_CONFIG_DATA, cmd, cmd_size, &cmd_rc);
-                if (rc || *status) {
+                if (rc < 0)
-                        rc = rc ? rc : -ENXIO;
+                        break;
+                if (cmd_rc < 0) {
+                        rc = cmd_rc;
                        break;
                }
        }
diff --git a/drivers/nvdimm/of_pmem.c b/drivers/nvdimm/of_pmem.c
index 85013bad35de..0a701837dfc0 100644
--- a/drivers/nvdimm/of_pmem.c
+++ b/drivers/nvdimm/of_pmem.c
@@ -67,7 +67,7 @@ static int of_pmem_region_probe(struct platform_device *pdev)
                 */
                memset(&ndr_desc, 0, sizeof(ndr_desc));
                ndr_desc.attr_groups = region_attr_groups;
-                ndr_desc.numa_node = of_node_to_nid(np);
+                ndr_desc.numa_node = dev_to_node(&pdev->dev);
                ndr_desc.res = &pdev->resource[i];
                ndr_desc.of_node = np;
                set_bit(ND_REGION_PAGEMAP, &ndr_desc.flags);
diff --git a/drivers/rapidio/devices/rio_mport_cdev.c b/drivers/rapidio/devices/rio_mport_cdev.c
index 9d27016c899e..0434ab7b6497 100644
--- a/drivers/rapidio/devices/rio_mport_cdev.c
+++ b/drivers/rapidio/devices/rio_mport_cdev.c
@@ -740,10 +740,7 @@ static int do_dma_request(struct mport_dma_req *req,
        tx->callback = dma_xfer_callback;
        tx->callback_param = req;
-        req->dmach = chan;
-        req->sync = sync;
        req->status = DMA_IN_PROGRESS;
-        init_completion(&req->req_comp);
        kref_get(&req->refcount);
        cookie = dmaengine_submit(tx);
@@ -831,13 +828,20 @@ rio_dma_transfer(struct file *filp, u32 transfer_mode,
        if (!req)
                return -ENOMEM;
-        kref_init(&req->refcount);
        ret = get_dma_channel(priv);
        if (ret) {
                kfree(req);
                return ret;
        }
+        chan = priv->dmach;
+        kref_init(&req->refcount);
+        init_completion(&req->req_comp);
+        req->dir = dir;
+        req->filp = filp;
+        req->priv = priv;
+        req->dmach = chan;
+        req->sync = sync;
        /*
         * If parameter loc_addr != NULL, we are transferring data from/to
@@ -925,11 +929,6 @@ rio_dma_transfer(struct file *filp, u32 transfer_mode,
                                xfer->offset, xfer->length);
        }
-        req->dir = dir;
-        req->filp = filp;
-        req->priv = priv;
-        chan = priv->dmach;
        nents = dma_map_sg(chan->device->dev,
                           req->sgt.sgl, req->sgt.nents, dir);
        if (nents == 0) {
diff --git a/drivers/s390/block/dasd_diag.c b/drivers/s390/block/dasd_diag.c
index f035c2f25d35..131f1989f6f3 100644
--- a/drivers/s390/block/dasd_diag.c
+++ b/drivers/s390/block/dasd_diag.c
@@ -27,7 +27,6 @@
 #include <asm/io.h>
 #include <asm/irq.h>
 #include <asm/vtoc.h>
-#include <asm/diag.h>
 #include "dasd_int.h"
 #include "dasd_diag.h"
diff --git a/drivers/s390/char/sclp_early_core.c b/drivers/s390/char/sclp_early_core.c
index 5f8d9ea69ebd..eceba3858cef 100644
--- a/drivers/s390/char/sclp_early_core.c
+++ b/drivers/s390/char/sclp_early_core.c
@@ -18,7 +18,7 @@ int sclp_init_state __section(.data) = sclp_init_state_uninitialized;
 * Used to keep track of the size of the event masks. Qemu until version 2.11
 * only supports 4 and needs a workaround.
 */
-bool sclp_mask_compat_mode;
+bool sclp_mask_compat_mode __section(.data);
 void sclp_early_wait_irq(void)
 {
diff --git a/drivers/s390/net/qeth_l2_main.c b/drivers/s390/net/qeth_l2_main.c
index 50a313806dde..2ad6f12f3d49 100644
--- a/drivers/s390/net/qeth_l2_main.c
+++ b/drivers/s390/net/qeth_l2_main.c
@@ -21,7 +21,6 @@
 #include <linux/list.h>
 #include <linux/hash.h>
 #include <linux/hashtable.h>
-#include <linux/string.h>
 #include <asm/setup.h>
 #include "qeth_core.h"
 #include "qeth_l2.h"
diff --git a/drivers/s390/net/smsgiucv.c b/drivers/s390/net/smsgiucv.c
index 3b0c8b8a7634..066b5c3aaae6 100644
--- a/drivers/s390/net/smsgiucv.c
+++ b/drivers/s390/net/smsgiucv.c
@@ -176,7 +176,7 @@ static struct device_driver smsg_driver = {
 static void __exit smsg_exit(void)
 {
-        cpcmd("SET SMSG IUCV", NULL, 0, NULL);
+        cpcmd("SET SMSG OFF", NULL, 0, NULL);
        device_unregister(smsg_dev);
        iucv_unregister(&smsg_handler, 1);
        driver_unregister(&smsg_driver);
diff --git a/drivers/watchdog/aspeed_wdt.c b/drivers/watchdog/aspeed_wdt.c
index a5b8eb21201f..1abe4d021fd2 100644
--- a/drivers/watchdog/aspeed_wdt.c
+++ b/drivers/watchdog/aspeed_wdt.c
@@ -55,6 +55,8 @@ MODULE_DEVICE_TABLE(of, aspeed_wdt_of_table);
 #define   WDT_CTRL_WDT_INTR             BIT(2)
 #define   WDT_CTRL_RESET_SYSTEM         BIT(1)
 #define   WDT_CTRL_ENABLE               BIT(0)
+#define WDT_TIMEOUT_STATUS      0x10
+#define   WDT_TIMEOUT_STATUS_BOOT_SECONDARY     BIT(1)
 /*
 * WDT_RESET_WIDTH controls the characteristics of the external pulse (if
@@ -192,6 +194,7 @@ static int aspeed_wdt_probe(struct platform_device *pdev)
        struct device_node *np;
        const char *reset_type;
        u32 duration;
+        u32 status;
        int ret;
        wdt = devm_kzalloc(&pdev->dev, sizeof(*wdt), GFP_KERNEL);
@@ -307,6 +310,10 @@ static int aspeed_wdt_probe(struct platform_device *pdev)
                writel(duration - 1, wdt->base + WDT_RESET_WIDTH);
        }
+        status = readl(wdt->base + WDT_TIMEOUT_STATUS);
+        if (status & WDT_TIMEOUT_STATUS_BOOT_SECONDARY)
+                wdt->wdd.bootstatus = WDIOF_CARDRESET;
        ret = devm_watchdog_register_device(&pdev->dev, &wdt->wdd);
        if (ret) {
                dev_err(&pdev->dev, "failed to register\n");
diff --git a/drivers/watchdog/renesas_wdt.c b/drivers/watchdog/renesas_wdt.c
index 6b8c6ddfe30b..514db5cc1595 100644
--- a/drivers/watchdog/renesas_wdt.c
+++ b/drivers/watchdog/renesas_wdt.c
@@ -121,7 +121,8 @@ static int rwdt_restart(struct watchdog_device *wdev, unsigned long action,
 }
 static const struct watchdog_info rwdt_ident = {
-        .options = WDIOF_MAGICCLOSE | WDIOF_KEEPALIVEPING | WDIOF_SETTIMEOUT,
+        .options = WDIOF_MAGICCLOSE | WDIOF_KEEPALIVEPING | WDIOF_SETTIMEOUT |
+                WDIOF_CARDRESET,
        .identity = "Renesas WDT Watchdog",
 };
@@ -197,9 +198,10 @@ static int rwdt_probe(struct platform_device *pdev)
                return PTR_ERR(clk);
        pm_runtime_enable(&pdev->dev);
        pm_runtime_get_sync(&pdev->dev);
        priv->clk_rate = clk_get_rate(clk);
+        priv->wdev.bootstatus = (readb_relaxed(priv->base + RWTCSRA) &
+                                RWTCSRA_WOVF) ? WDIOF_CARDRESET : 0;
        pm_runtime_put(&pdev->dev);
        if (!priv->clk_rate) {
diff --git a/drivers/watchdog/sch311x_wdt.c b/drivers/watchdog/sch311x_wdt.c
index 43d0cbb7ba0b..814cdf539b0f 100644
--- a/drivers/watchdog/sch311x_wdt.c
+++ b/drivers/watchdog/sch311x_wdt.c
@@ -299,7 +299,7 @@ static long sch311x_wdt_ioctl(struct file *file, unsigned int cmd,
                if (sch311x_wdt_set_heartbeat(new_timeout))
                        return -EINVAL;
                sch311x_wdt_keepalive();
-                /* Fall */
+                /* Fall through */
        case WDIOC_GETTIMEOUT:
                return put_user(timeout, p);
        default:
diff --git a/drivers/watchdog/w83977f_wdt.c b/drivers/watchdog/w83977f_wdt.c
index 20e2bba10400..672b61a7f9a3 100644
--- a/drivers/watchdog/w83977f_wdt.c
+++ b/drivers/watchdog/w83977f_wdt.c
@@ -427,7 +427,7 @@ static long wdt_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
                        return -EINVAL;
                wdt_keepalive();
-                /* Fall */
+                /* Fall through */
        case WDIOC_GETTIMEOUT:
                return put_user(timeout, uarg.i);
diff --git a/drivers/watchdog/wafer5823wdt.c b/drivers/watchdog/wafer5823wdt.c
index db0da7ea4fd8..93c5b610e264 100644
--- a/drivers/watchdog/wafer5823wdt.c
+++ b/drivers/watchdog/wafer5823wdt.c
@@ -178,7 +178,7 @@ static long wafwdt_ioctl(struct file *file, unsigned int cmd,
                timeout = new_timeout;
                wafwdt_stop();
                wafwdt_start();
-                /* Fall */
+                /* Fall through */
        case WDIOC_GETTIMEOUT:
                return put_user(timeout, p);
diff --git a/drivers/xen/xen-pciback/conf_space_quirks.c b/drivers/xen/xen-pciback/conf_space_quirks.c
index 89d9744ece61..ed593d1042a6 100644
--- a/drivers/xen/xen-pciback/conf_space_quirks.c
+++ b/drivers/xen/xen-pciback/conf_space_quirks.c
@@ -95,7 +95,7 @@ int xen_pcibk_config_quirks_init(struct pci_dev *dev)
        struct xen_pcibk_config_quirk *quirk;
        int ret = 0;
-        quirk = kzalloc(sizeof(*quirk), GFP_ATOMIC);
+        quirk = kzalloc(sizeof(*quirk), GFP_KERNEL);
        if (!quirk) {
                ret = -ENOMEM;
                goto out;
diff --git a/drivers/xen/xen-pciback/pci_stub.c b/drivers/xen/xen-pciback/pci_stub.c
index 9e480fdebe1f..59661db144e5 100644
--- a/drivers/xen/xen-pciback/pci_stub.c
+++ b/drivers/xen/xen-pciback/pci_stub.c
@@ -71,7 +71,7 @@ static struct pcistub_device *pcistub_device_alloc(struct pci_dev *dev)
        dev_dbg(&dev->dev, "pcistub_device_alloc\n");
-        psdev = kzalloc(sizeof(*psdev), GFP_ATOMIC);
+        psdev = kzalloc(sizeof(*psdev), GFP_KERNEL);
        if (!psdev)
                return NULL;
@@ -364,7 +364,7 @@ static int pcistub_init_device(struct pci_dev *dev)
         * here and then to call kfree(pci_get_drvdata(psdev->dev)).
         */
        dev_data = kzalloc(sizeof(*dev_data) +  strlen(DRV_NAME "[]")
-                                + strlen(pci_name(dev)) + 1, GFP_ATOMIC);
+                                + strlen(pci_name(dev)) + 1, GFP_KERNEL);
        if (!dev_data) {
                err = -ENOMEM;
                goto out;
@@ -577,7 +577,7 @@ static int pcistub_probe(struct pci_dev *dev, const struct pci_device_id *id)
                }
                if (!match) {
-                        pci_dev_id = kmalloc(sizeof(*pci_dev_id), GFP_ATOMIC);
+                        pci_dev_id = kmalloc(sizeof(*pci_dev_id), GFP_KERNEL);
                        if (!pci_dev_id) {
                                err = -ENOMEM;
                                goto out;
@@ -1149,7 +1149,7 @@ static int pcistub_reg_add(int domain, int bus, int slot, int func,
        }
        dev = psdev->dev;
-        field = kzalloc(sizeof(*field), GFP_ATOMIC);
+        field = kzalloc(sizeof(*field), GFP_KERNEL);
        if (!field) {
                err = -ENOMEM;
                goto out;
diff --git a/drivers/xen/xenbus/xenbus_dev_frontend.c b/drivers/xen/xenbus/xenbus_dev_frontend.c
index 0d6d9264d6a9..c3e201025ef0 100644
--- a/drivers/xen/xenbus/xenbus_dev_frontend.c
+++ b/drivers/xen/xenbus/xenbus_dev_frontend.c
@@ -403,7 +403,7 @@ static int xenbus_command_reply(struct xenbus_file_priv *u,
 {
        struct {
                struct xsd_sockmsg hdr;
-                const char body[16];
+                char body[16];
        } msg;
        int rc;
@@ -412,6 +412,7 @@ static int xenbus_command_reply(struct xenbus_file_priv *u,
        msg.hdr.len = strlen(reply) + 1;
        if (msg.hdr.len > sizeof(msg.body))
                return -E2BIG;
+        memcpy(&msg.body, reply, msg.hdr.len);
        mutex_lock(&u->reply_mutex);
        rc = queue_reply(&u->read_buffers, &msg, sizeof(msg.hdr) + msg.hdr.len);
diff --git a/fs/afs/server.c b/fs/afs/server.c
index e23be63998a8..629c74986cff 100644
--- a/fs/afs/server.c
+++ b/fs/afs/server.c
@@ -428,8 +428,15 @@ static void afs_gc_servers(struct afs_net *net, struct afs_server *gc_list)
                }
                write_sequnlock(&net->fs_lock);
-                if (deleted)
+                if (deleted) {
+                        write_seqlock(&net->fs_addr_lock);
+                        if (!hlist_unhashed(&server->addr4_link))
+                                hlist_del_rcu(&server->addr4_link);
+                        if (!hlist_unhashed(&server->addr6_link))
+                                hlist_del_rcu(&server->addr6_link);
+                        write_sequnlock(&net->fs_addr_lock);
                        afs_destroy_server(net, server);
+                }
        }
 }
diff --git a/fs/autofs4/root.c b/fs/autofs4/root.c
index 82e8f6edfb48..b12e37f27530 100644
--- a/fs/autofs4/root.c
+++ b/fs/autofs4/root.c
@@ -749,7 +749,7 @@ static int autofs4_dir_mkdir(struct inode *dir,
        autofs4_del_active(dentry);
-        inode = autofs4_get_inode(dir->i_sb, S_IFDIR | 0555);
+        inode = autofs4_get_inode(dir->i_sb, S_IFDIR | mode);
        if (!inode)
                return -ENOMEM;
        d_add(dentry, inode);
diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c
index 41e04183e4ce..4ad6f669fe34 100644
--- a/fs/binfmt_elf.c
+++ b/fs/binfmt_elf.c
@@ -377,10 +377,10 @@ static unsigned long elf_map(struct file *filep, unsigned long addr,
        } else
                map_addr = vm_mmap(filep, addr, size, prot, type, off);
-        if ((type & MAP_FIXED_NOREPLACE) && BAD_ADDR(map_addr))
+        if ((type & MAP_FIXED_NOREPLACE) &&
-                pr_info("%d (%s): Uhuuh, elf segment at %p requested but the memory is mapped already\n",
+            PTR_ERR((void *)map_addr) == -EEXIST)
-                                task_pid_nr(current), current->comm,
+                pr_info("%d (%s): Uhuuh, elf segment at %px requested but the memory is mapped already\n",
-                                (void *)addr);
+                        task_pid_nr(current), current->comm, (void *)addr);
        return(map_addr);
 }
diff --git a/fs/ceph/inode.c b/fs/ceph/inode.c
index 8bf60250309e..ae056927080d 100644
--- a/fs/ceph/inode.c
+++ b/fs/ceph/inode.c
@@ -669,13 +669,15 @@ void ceph_fill_file_time(struct inode *inode, int issued,
                      CEPH_CAP_FILE_BUFFER|
                      CEPH_CAP_AUTH_EXCL|
                      CEPH_CAP_XATTR_EXCL)) {
-                if (timespec_compare(ctime, &inode->i_ctime) > 0) {
+                if (ci->i_version == 0 ||
+                    timespec_compare(ctime, &inode->i_ctime) > 0) {
                        dout("ctime %ld.%09ld -> %ld.%09ld inc w/ cap\n",
                             inode->i_ctime.tv_sec, inode->i_ctime.tv_nsec,
                             ctime->tv_sec, ctime->tv_nsec);
                        inode->i_ctime = *ctime;
                }
-                if (ceph_seq_cmp(time_warp_seq, ci->i_time_warp_seq) > 0) {
+                if (ci->i_version == 0 ||
+                    ceph_seq_cmp(time_warp_seq, ci->i_time_warp_seq) > 0) {
                        /* the MDS did a utimes() */
                        dout("mtime %ld.%09ld -> %ld.%09ld "
                             "tw %d -> %d\n",
@@ -795,7 +797,6 @@ static int fill_inode(struct inode *inode, struct page *locked_page,
        new_issued = ~issued & le32_to_cpu(info->cap.caps);
        /* update inode */
-        ci->i_version = le64_to_cpu(info->version);
        inode->i_rdev = le32_to_cpu(info->rdev);
        inode->i_blkbits = fls(le32_to_cpu(info->layout.fl_stripe_unit)) - 1;
@@ -868,6 +869,9 @@ static int fill_inode(struct inode *inode, struct page *locked_page,
                xattr_blob = NULL;
        }
+        /* finally update i_version */
+        ci->i_version = le64_to_cpu(info->version);
        inode->i_mapping->a_ops = &ceph_aops;
        switch (inode->i_mode & S_IFMT) {
diff --git a/fs/ecryptfs/crypto.c b/fs/ecryptfs/crypto.c
index 846ca150d52e..4dd842f72846 100644
--- a/fs/ecryptfs/crypto.c
+++ b/fs/ecryptfs/crypto.c
@@ -1997,6 +1997,16 @@ out:
        return rc;
 }
+static bool is_dot_dotdot(const char *name, size_t name_size)
+{
+        if (name_size == 1 && name[0] == '.')
+                return true;
+        else if (name_size == 2 && name[0] == '.' && name[1] == '.')
+                return true;
+        return false;
+}
 /**
 * ecryptfs_decode_and_decrypt_filename - converts the encoded cipher text name to decoded plaintext
 * @plaintext_name: The plaintext name
@@ -2021,13 +2031,21 @@ int ecryptfs_decode_and_decrypt_filename(char **plaintext_name,
        size_t packet_size;
        int rc = 0;
-        if ((mount_crypt_stat->flags & ECRYPTFS_GLOBAL_ENCRYPT_FILENAMES)
+        if ((mount_crypt_stat->flags & ECRYPTFS_GLOBAL_ENCRYPT_FILENAMES) &&
-            && !(mount_crypt_stat->flags & ECRYPTFS_ENCRYPTED_VIEW_ENABLED)
+            !(mount_crypt_stat->flags & ECRYPTFS_ENCRYPTED_VIEW_ENABLED)) {
-            && (name_size > ECRYPTFS_FNEK_ENCRYPTED_FILENAME_PREFIX_SIZE)
+                if (is_dot_dotdot(name, name_size)) {
-            && (strncmp(name, ECRYPTFS_FNEK_ENCRYPTED_FILENAME_PREFIX,
+                        rc = ecryptfs_copy_filename(plaintext_name,
-                        ECRYPTFS_FNEK_ENCRYPTED_FILENAME_PREFIX_SIZE) == 0)) {
+                                                    plaintext_name_size,
-                const char *orig_name = name;
+                                                    name, name_size);
-                size_t orig_name_size = name_size;
+                        goto out;
+                }
+                if (name_size <= ECRYPTFS_FNEK_ENCRYPTED_FILENAME_PREFIX_SIZE ||
+                    strncmp(name, ECRYPTFS_FNEK_ENCRYPTED_FILENAME_PREFIX,
+                            ECRYPTFS_FNEK_ENCRYPTED_FILENAME_PREFIX_SIZE)) {
+                        rc = -EINVAL;
+                        goto out;
+                }
                name += ECRYPTFS_FNEK_ENCRYPTED_FILENAME_PREFIX_SIZE;
                name_size -= ECRYPTFS_FNEK_ENCRYPTED_FILENAME_PREFIX_SIZE;
@@ -2047,12 +2065,9 @@ int ecryptfs_decode_and_decrypt_filename(char **plaintext_name,
                                                  decoded_name,
                                                  decoded_name_size);
                if (rc) {
-                        printk(KERN_INFO "%s: Could not parse tag 70 packet "
+                        ecryptfs_printk(KERN_DEBUG,
-                               "from filename; copying through filename "
+                                        "%s: Could not parse tag 70 packet from filename\n",
-                               "as-is\n", __func__);
+                                        __func__);
-                        rc = ecryptfs_copy_filename(plaintext_name,
-                                                    plaintext_name_size,
-                                                    orig_name, orig_name_size);
                        goto out_free;
                }
        } else {
diff --git a/fs/ecryptfs/file.c b/fs/ecryptfs/file.c
index c74ed3ca3372..b76a9853325e 100644
--- a/fs/ecryptfs/file.c
+++ b/fs/ecryptfs/file.c
@@ -82,17 +82,28 @@ ecryptfs_filldir(struct dir_context *ctx, const char *lower_name,
                                                  buf->sb, lower_name,
                                                  lower_namelen);
        if (rc) {
-                printk(KERN_ERR "%s: Error attempting to decode and decrypt "
+                if (rc != -EINVAL) {
-                       "filename [%s]; rc = [%d]\n", __func__, lower_name,
+                        ecryptfs_printk(KERN_DEBUG,
-                       rc);
+                                        "%s: Error attempting to decode and decrypt filename [%s]; rc = [%d]\n",
-                goto out;
+                                        __func__, lower_name, rc);
+                        return rc;
+                }
+                /* Mask -EINVAL errors as these are most likely due a plaintext
+                 * filename present in the lower filesystem despite filename
+                 * encryption being enabled. One unavoidable example would be
+                 * the "lost+found" dentry in the root directory of an Ext4
+                 * filesystem.
+                 */
+                return 0;
        }
        buf->caller->pos = buf->ctx.pos;
        rc = !dir_emit(buf->caller, name, name_size, ino, d_type);
        kfree(name);
        if (!rc)
                buf->entries_written++;
-out:
        return rc;
 }
diff --git a/fs/ecryptfs/inode.c b/fs/ecryptfs/inode.c
index 847904aa63a9..97d17eaeba07 100644
--- a/fs/ecryptfs/inode.c
+++ b/fs/ecryptfs/inode.c
@@ -395,8 +395,7 @@ static struct dentry *ecryptfs_lookup(struct inode *ecryptfs_dir_inode,
        mount_crypt_stat = &ecryptfs_superblock_to_private(
                                ecryptfs_dentry->d_sb)->mount_crypt_stat;
-        if (mount_crypt_stat
+        if (mount_crypt_stat->flags & ECRYPTFS_GLOBAL_ENCRYPT_FILENAMES) {
-            && (mount_crypt_stat->flags & ECRYPTFS_GLOBAL_ENCRYPT_FILENAMES)) {
                rc = ecryptfs_encrypt_and_encode_filename(
                        &encrypted_and_encoded_name, &len,
                        mount_crypt_stat, name, len);
diff --git a/fs/ecryptfs/keystore.c b/fs/ecryptfs/keystore.c
index c89a58cfc991..e74fe84d0886 100644
--- a/fs/ecryptfs/keystore.c
+++ b/fs/ecryptfs/keystore.c
@@ -1880,7 +1880,7 @@ find_next_matching_auth_tok:
                candidate_auth_tok = &auth_tok_list_item->auth_tok;
                if (unlikely(ecryptfs_verbosity > 0)) {
                        ecryptfs_printk(KERN_DEBUG,
-                                        "Considering cadidate auth tok:\n");
+                                        "Considering candidate auth tok:\n");
                        ecryptfs_dump_auth_tok(candidate_auth_tok);
                }
                rc = ecryptfs_get_auth_tok_sig(&candidate_auth_tok_sig,
diff --git a/fs/ext2/file.c b/fs/ext2/file.c
index 09640220fda8..047c327a6b23 100644
--- a/fs/ext2/file.c
+++ b/fs/ext2/file.c
@@ -88,11 +88,11 @@ out_unlock:
 * The default page_lock and i_size verification done by non-DAX fault paths
 * is sufficient because ext2 doesn't support hole punching.
 */
-static int ext2_dax_fault(struct vm_fault *vmf)
+static vm_fault_t ext2_dax_fault(struct vm_fault *vmf)
 {
        struct inode *inode = file_inode(vmf->vma->vm_file);
        struct ext2_inode_info *ei = EXT2_I(inode);
-        int ret;
+        vm_fault_t ret;
        if (vmf->flags & FAULT_FLAG_WRITE) {
                sb_start_pagefault(inode->i_sb);
diff --git a/fs/fs-writeback.c b/fs/fs-writeback.c
index 4b12ba70a895..47d7c151fcba 100644
--- a/fs/fs-writeback.c
+++ b/fs/fs-writeback.c
@@ -745,11 +745,12 @@ int inode_congested(struct inode *inode, int cong_bits)
         */
        if (inode && inode_to_wb_is_valid(inode)) {
                struct bdi_writeback *wb;
-                bool locked, congested;
+                struct wb_lock_cookie lock_cookie = {};
+                bool congested;
-                wb = unlocked_inode_to_wb_begin(inode, &locked);
+                wb = unlocked_inode_to_wb_begin(inode, &lock_cookie);
                congested = wb_congested(wb, cong_bits);
-                unlocked_inode_to_wb_end(inode, locked);
+                unlocked_inode_to_wb_end(inode, &lock_cookie);
                return congested;
        }
diff --git a/fs/isofs/compress.c b/fs/isofs/compress.c
index 9bb2fe35799d..10205ececc27 100644
--- a/fs/isofs/compress.c
+++ b/fs/isofs/compress.c
@@ -20,6 +20,7 @@
 #include <linux/init.h>
 #include <linux/bio.h>
+#include <linux/slab.h>
 #include <linux/vmalloc.h>
 #include <linux/zlib.h>
@@ -59,7 +60,7 @@ static loff_t zisofs_uncompress_block(struct inode *inode, loff_t block_start,
                                >> bufshift;
        int haveblocks;
        blkcnt_t blocknum;
-        struct buffer_head *bhs[needblocks + 1];
+        struct buffer_head **bhs;
        int curbh, curpage;
        if (block_size > deflateBound(1UL << zisofs_block_shift)) {
@@ -80,7 +81,11 @@ static loff_t zisofs_uncompress_block(struct inode *inode, loff_t block_start,
        /* Because zlib is not thread-safe, do all the I/O at the top. */
        blocknum = block_start >> bufshift;
-        memset(bhs, 0, (needblocks + 1) * sizeof(struct buffer_head *));
+        bhs = kcalloc(needblocks + 1, sizeof(*bhs), GFP_KERNEL);
+        if (!bhs) {
+                *errp = -ENOMEM;
+                return 0;
+        }
        haveblocks = isofs_get_blocks(inode, blocknum, bhs, needblocks);
        ll_rw_block(REQ_OP_READ, 0, haveblocks, bhs);
@@ -190,6 +195,7 @@ z_eio:
 b_eio:
        for (i = 0; i < haveblocks; i++)
                brelse(bhs[i]);
+        kfree(bhs);
        return stream.total_out;
 }
@@ -305,7 +311,7 @@ static int zisofs_readpage(struct file *file, struct page *page)
        unsigned int zisofs_pages_per_cblock =
                PAGE_SHIFT <= zisofs_block_shift ?
                (1 << (zisofs_block_shift - PAGE_SHIFT)) : 0;
-        struct page *pages[max_t(unsigned, zisofs_pages_per_cblock, 1)];
+        struct page **pages;
        pgoff_t index = page->index, end_index;
        end_index = (inode->i_size + PAGE_SIZE - 1) >> PAGE_SHIFT;
@@ -330,6 +336,12 @@ static int zisofs_readpage(struct file *file, struct page *page)
                full_page = 0;
                pcount = 1;
        }
+        pages = kcalloc(max_t(unsigned int, zisofs_pages_per_cblock, 1),
+                                        sizeof(*pages), GFP_KERNEL);
+        if (!pages) {
+                unlock_page(page);
+                return -ENOMEM;
+        }
        pages[full_page] = page;
        for (i = 0; i < pcount; i++, index++) {
@@ -357,6 +369,7 @@ static int zisofs_readpage(struct file *file, struct page *page)
        }                       
        /* At this point, err contains 0 or -EIO depending on the "critical" page */
+        kfree(pages);
        return err;
 }
diff --git a/fs/isofs/inode.c b/fs/isofs/inode.c
index bc258a4402f6..ec3fba7d492f 100644
--- a/fs/isofs/inode.c
+++ b/fs/isofs/inode.c
@@ -394,7 +394,10 @@ static int parse_options(char *options, struct iso9660_options *popt)
                        break;
 #ifdef CONFIG_JOLIET
                case Opt_iocharset:
+                        kfree(popt->iocharset);
                        popt->iocharset = match_strdup(&args[0]);
+                        if (!popt->iocharset)
+                                return 0;
                        break;
 #endif
                case Opt_map_a:
diff --git a/fs/jffs2/super.c b/fs/jffs2/super.c
index f60dee7faf03..87bdf0f4cba1 100644
--- a/fs/jffs2/super.c
+++ b/fs/jffs2/super.c
@@ -342,7 +342,7 @@ static void jffs2_put_super (struct super_block *sb)
 static void jffs2_kill_sb(struct super_block *sb)
 {
        struct jffs2_sb_info *c = JFFS2_SB_INFO(sb);
-        if (!sb_rdonly(sb))
+        if (c && !sb_rdonly(sb))
                jffs2_stop_garbage_collect_thread(c);
        kill_mtd_super(sb);
        kfree(c);
diff --git a/fs/namespace.c b/fs/namespace.c
index e398f32d7541..5f75969adff1 100644
--- a/fs/namespace.c
+++ b/fs/namespace.c
@@ -1089,7 +1089,8 @@ static struct mount *clone_mnt(struct mount *old, struct dentry *root,
                        goto out_free;
        }
-        mnt->mnt.mnt_flags = old->mnt.mnt_flags & ~(MNT_WRITE_HOLD|MNT_MARKED);
+        mnt->mnt.mnt_flags = old->mnt.mnt_flags;
+        mnt->mnt.mnt_flags &= ~(MNT_WRITE_HOLD|MNT_MARKED|MNT_INTERNAL);
        /* Don't allow unprivileged users to change mount flags */
        if (flag & CL_UNPRIVILEGED) {
                mnt->mnt.mnt_flags |= MNT_LOCK_ATIME;
@@ -2814,7 +2815,7 @@ long do_mount(const char *dev_name, const char __user *dir_name,
                mnt_flags |= MNT_NODIRATIME;
        if (flags & MS_STRICTATIME)
                mnt_flags &= ~(MNT_RELATIME | MNT_NOATIME);
-        if (flags & SB_RDONLY)
+        if (flags & MS_RDONLY)
                mnt_flags |= MNT_READONLY;
        /* The default atime for remount is preservation */
diff --git a/fs/notify/fanotify/fanotify.c b/fs/notify/fanotify/fanotify.c
index d51e1bb781cf..d94e8031fe5f 100644
--- a/fs/notify/fanotify/fanotify.c
+++ b/fs/notify/fanotify/fanotify.c
@@ -92,7 +92,7 @@ static bool fanotify_should_send_event(struct fsnotify_mark *inode_mark,
                                       u32 event_mask,
                                       const void *data, int data_type)
 {
-        __u32 marks_mask, marks_ignored_mask;
+        __u32 marks_mask = 0, marks_ignored_mask = 0;
        const struct path *path = data;
        pr_debug("%s: inode_mark=%p vfsmnt_mark=%p mask=%x data=%p"
@@ -108,24 +108,20 @@ static bool fanotify_should_send_event(struct fsnotify_mark *inode_mark,
            !d_can_lookup(path->dentry))
                return false;
-        if (inode_mark && vfsmnt_mark) {
+        /*
-                marks_mask = (vfsmnt_mark->mask | inode_mark->mask);
+         * if the event is for a child and this inode doesn't care about
-                marks_ignored_mask = (vfsmnt_mark->ignored_mask | inode_mark->ignored_mask);
+         * events on the child, don't send it!
-        } else if (inode_mark) {
+         */
-                /*
+        if (inode_mark &&
-                 * if the event is for a child and this inode doesn't care about
+            (!(event_mask & FS_EVENT_ON_CHILD) ||
-                 * events on the child, don't send it!
+             (inode_mark->mask & FS_EVENT_ON_CHILD))) {
-                 */
+                marks_mask |= inode_mark->mask;
-                if ((event_mask & FS_EVENT_ON_CHILD) &&
+                marks_ignored_mask |= inode_mark->ignored_mask;
-                    !(inode_mark->mask & FS_EVENT_ON_CHILD))
+        }
-                        return false;
-                marks_mask = inode_mark->mask;
+        if (vfsmnt_mark) {
-                marks_ignored_mask = inode_mark->ignored_mask;
+                marks_mask |= vfsmnt_mark->mask;
-        } else if (vfsmnt_mark) {
+                marks_ignored_mask |= vfsmnt_mark->ignored_mask;
-                marks_mask = vfsmnt_mark->mask;
-                marks_ignored_mask = vfsmnt_mark->ignored_mask;
-        } else {
-                BUG();
        }
        if (d_is_dir(path->dentry) &&
diff --git a/fs/notify/fsnotify.c b/fs/notify/fsnotify.c
index 219b269c737e..613ec7e5a465 100644
--- a/fs/notify/fsnotify.c
+++ b/fs/notify/fsnotify.c
@@ -192,8 +192,9 @@ static int send_to_group(struct inode *to_tell,
                         struct fsnotify_iter_info *iter_info)
 {
        struct fsnotify_group *group = NULL;
-        __u32 inode_test_mask = 0;
+        __u32 test_mask = (mask & ~FS_EVENT_ON_CHILD);
-        __u32 vfsmount_test_mask = 0;
+        __u32 marks_mask = 0;
+        __u32 marks_ignored_mask = 0;
        if (unlikely(!inode_mark && !vfsmount_mark)) {
                BUG();
@@ -213,29 +214,25 @@ static int send_to_group(struct inode *to_tell,
        /* does the inode mark tell us to do something? */
        if (inode_mark) {
                group = inode_mark->group;
-                inode_test_mask = (mask & ~FS_EVENT_ON_CHILD);
+                marks_mask |= inode_mark->mask;
-                inode_test_mask &= inode_mark->mask;
+                marks_ignored_mask |= inode_mark->ignored_mask;
-                inode_test_mask &= ~inode_mark->ignored_mask;
        }
        /* does the vfsmount_mark tell us to do something? */
        if (vfsmount_mark) {
-                vfsmount_test_mask = (mask & ~FS_EVENT_ON_CHILD);
                group = vfsmount_mark->group;
-                vfsmount_test_mask &= vfsmount_mark->mask;
+                marks_mask |= vfsmount_mark->mask;
-                vfsmount_test_mask &= ~vfsmount_mark->ignored_mask;
+                marks_ignored_mask |= vfsmount_mark->ignored_mask;
-                if (inode_mark)
-                        vfsmount_test_mask &= ~inode_mark->ignored_mask;
        }
        pr_debug("%s: group=%p to_tell=%p mask=%x inode_mark=%p"
-                 " inode_test_mask=%x vfsmount_mark=%p vfsmount_test_mask=%x"
+                 " vfsmount_mark=%p marks_mask=%x marks_ignored_mask=%x"
                 " data=%p data_is=%d cookie=%d\n",
-                 __func__, group, to_tell, mask, inode_mark,
+                 __func__, group, to_tell, mask, inode_mark, vfsmount_mark,
-                 inode_test_mask, vfsmount_mark, vfsmount_test_mask, data,
+                 marks_mask, marks_ignored_mask, data,
                 data_is, cookie);
-        if (!inode_test_mask && !vfsmount_test_mask)
+        if (!(test_mask & marks_mask & ~marks_ignored_mask))
                return 0;
        return group->ops->handle_event(group, to_tell, inode_mark,
diff --git a/fs/orangefs/super.c b/fs/orangefs/super.c
index 3ae5fdba0225..10796d3fe27d 100644
--- a/fs/orangefs/super.c
+++ b/fs/orangefs/super.c
@@ -579,6 +579,11 @@ void orangefs_kill_sb(struct super_block *sb)
        /* provided sb cleanup */
        kill_anon_super(sb);
+        if (!ORANGEFS_SB(sb)) {
+                mutex_lock(&orangefs_request_mutex);
+                mutex_unlock(&orangefs_request_mutex);
+                return;
+        }
        /*
         * issue the unmount to userspace to tell it to remove the
         * dynamic mount info it has for this superblock
diff --git a/fs/proc/base.c b/fs/proc/base.c
index eafa39a3a88c..1b2ede6abcdf 100644
--- a/fs/proc/base.c
+++ b/fs/proc/base.c
@@ -1693,6 +1693,12 @@ void task_dump_owner(struct task_struct *task, umode_t mode,
        kuid_t uid;
        kgid_t gid;
+        if (unlikely(task->flags & PF_KTHREAD)) {
+                *ruid = GLOBAL_ROOT_UID;
+                *rgid = GLOBAL_ROOT_GID;
+                return;
+        }
        /* Default to the tasks effective ownership */
        rcu_read_lock();
        cred = __task_cred(task);
diff --git a/fs/proc/loadavg.c b/fs/proc/loadavg.c
index a000d7547479..b572cc865b92 100644
--- a/fs/proc/loadavg.c
+++ b/fs/proc/loadavg.c
@@ -24,7 +24,7 @@ static int loadavg_proc_show(struct seq_file *m, void *v)
                LOAD_INT(avnrun[1]), LOAD_FRAC(avnrun[1]),
                LOAD_INT(avnrun[2]), LOAD_FRAC(avnrun[2]),
                nr_running(), nr_threads,
-                idr_get_cursor(&task_active_pid_ns(current)->idr));
+                idr_get_cursor(&task_active_pid_ns(current)->idr) - 1);
        return 0;
 }
diff --git a/fs/proc/task_mmu.c b/fs/proc/task_mmu.c
index 65ae54659833..c486ad4b43f0 100644
--- a/fs/proc/task_mmu.c
+++ b/fs/proc/task_mmu.c
@@ -1310,9 +1310,11 @@ static int pagemap_pmd_range(pmd_t *pmdp, unsigned long addr, unsigned long end,
 #ifdef CONFIG_ARCH_ENABLE_THP_MIGRATION
                else if (is_swap_pmd(pmd)) {
                        swp_entry_t entry = pmd_to_swp_entry(pmd);
+                        unsigned long offset = swp_offset(entry);
+                        offset += (addr & ~PMD_MASK) >> PAGE_SHIFT;
                        frame = swp_type(entry) |
-                                (swp_offset(entry) << MAX_SWAPFILES_SHIFT);
+                                (offset << MAX_SWAPFILES_SHIFT);
                        flags |= PM_SWAP;
                        if (pmd_swp_soft_dirty(pmd))
                                flags |= PM_SOFT_DIRTY;
@@ -1332,6 +1334,8 @@ static int pagemap_pmd_range(pmd_t *pmdp, unsigned long addr, unsigned long end,
                                break;
                        if (pm->show_pfn && (flags & PM_PRESENT))
                                frame++;
+                        else if (flags & PM_SWAP)
+                                frame += (1 << MAX_SWAPFILES_SHIFT);
                }
                spin_unlock(ptl);
                return err;
diff --git a/fs/quota/dquot.c b/fs/quota/dquot.c
index 020c597ef9b6..d88231e3b2be 100644
--- a/fs/quota/dquot.c
+++ b/fs/quota/dquot.c
@@ -2966,7 +2966,7 @@ static int __init dquot_init(void)
                        NULL);
        order = 0;
-        dquot_hash = (struct hlist_head *)__get_free_pages(GFP_ATOMIC, order);
+        dquot_hash = (struct hlist_head *)__get_free_pages(GFP_KERNEL, order);
        if (!dquot_hash)
                panic("Cannot create dquot hash table");
diff --git a/fs/super.c b/fs/super.c
index 5fa9a8d8d865..122c402049a2 100644
--- a/fs/super.c
+++ b/fs/super.c
@@ -167,6 +167,7 @@ static void destroy_unused_super(struct super_block *s)
        security_sb_free(s);
        put_user_ns(s->s_user_ns);
        kfree(s->s_subtype);
+        free_prealloced_shrinker(&s->s_shrink);
        /* no delays needed */
        destroy_super_work(&s->destroy_work);
 }
@@ -252,6 +253,8 @@ static struct super_block *alloc_super(struct file_system_type *type, int flags,
        s->s_shrink.count_objects = super_cache_count;
        s->s_shrink.batch = 1024;
        s->s_shrink.flags = SHRINKER_NUMA_AWARE | SHRINKER_MEMCG_AWARE;
+        if (prealloc_shrinker(&s->s_shrink))
+                goto fail;
        return s;
 fail:
@@ -518,11 +521,7 @@ retry:
        hlist_add_head(&s->s_instances, &type->fs_supers);
        spin_unlock(&sb_lock);
        get_filesystem(type);
-        err = register_shrinker(&s->s_shrink);
+        register_shrinker_prepared(&s->s_shrink);
-        if (err) {
-                deactivate_locked_super(s);
-                s = ERR_PTR(err);
-        }
        return s;
 }
diff --git a/fs/udf/unicode.c b/fs/udf/unicode.c
index f897e55f2cd0..16a8ad21b77e 100644
--- a/fs/udf/unicode.c
+++ b/fs/udf/unicode.c
@@ -28,6 +28,9 @@
 #include "udf_sb.h"
+#define SURROGATE_MASK 0xfffff800
+#define SURROGATE_PAIR 0x0000d800
 static int udf_uni2char_utf8(wchar_t uni,
                             unsigned char *out,
                             int boundlen)
@@ -37,6 +40,9 @@ static int udf_uni2char_utf8(wchar_t uni,
        if (boundlen <= 0)
                return -ENAMETOOLONG;
+        if ((uni & SURROGATE_MASK) == SURROGATE_PAIR)
+                return -EINVAL;
        if (uni < 0x80) {
                out[u_len++] = (unsigned char)uni;
        } else if (uni < 0x800) {
diff --git a/include/linux/backing-dev-defs.h b/include/linux/backing-dev-defs.h
index bfe86b54f6c1..0bd432a4d7bd 100644
--- a/include/linux/backing-dev-defs.h
+++ b/include/linux/backing-dev-defs.h
@@ -223,6 +223,11 @@ static inline void set_bdi_congested(struct backing_dev_info *bdi, int sync)
        set_wb_congested(bdi->wb.congested, sync);
 }
+struct wb_lock_cookie {
+        bool locked;
+        unsigned long flags;
+};
 #ifdef CONFIG_CGROUP_WRITEBACK
 /**
diff --git a/include/linux/backing-dev.h b/include/linux/backing-dev.h
index f6be4b0b6c18..72ca0f3d39f3 100644
--- a/include/linux/backing-dev.h
+++ b/include/linux/backing-dev.h
@@ -347,7 +347,7 @@ static inline struct bdi_writeback *inode_to_wb(const struct inode *inode)
 /**
 * unlocked_inode_to_wb_begin - begin unlocked inode wb access transaction
 * @inode: target inode
- * @lockedp: temp bool output param, to be passed to the end function
+ * @cookie: output param, to be passed to the end function
 *
 * The caller wants to access the wb associated with @inode but isn't
 * holding inode->i_lock, the i_pages lock or wb->list_lock.  This
@@ -355,12 +355,12 @@ static inline struct bdi_writeback *inode_to_wb(const struct inode *inode)
 * association doesn't change until the transaction is finished with
 * unlocked_inode_to_wb_end().
 *
- * The caller must call unlocked_inode_to_wb_end() with *@lockdep
+ * The caller must call unlocked_inode_to_wb_end() with *@cookie afterwards and
- * afterwards and can't sleep during transaction.  IRQ may or may not be
+ * can't sleep during the transaction.  IRQs may or may not be disabled on
- * disabled on return.
+ * return.
 */
 static inline struct bdi_writeback *
-unlocked_inode_to_wb_begin(struct inode *inode, bool *lockedp)
+unlocked_inode_to_wb_begin(struct inode *inode, struct wb_lock_cookie *cookie)
 {
        rcu_read_lock();
@@ -368,10 +368,10 @@ unlocked_inode_to_wb_begin(struct inode *inode, bool *lockedp)
         * Paired with store_release in inode_switch_wb_work_fn() and
         * ensures that we see the new wb if we see cleared I_WB_SWITCH.
         */
-        *lockedp = smp_load_acquire(&inode->i_state) & I_WB_SWITCH;
+        cookie->locked = smp_load_acquire(&inode->i_state) & I_WB_SWITCH;
-        if (unlikely(*lockedp))
+        if (unlikely(cookie->locked))
-                xa_lock_irq(&inode->i_mapping->i_pages);
+                xa_lock_irqsave(&inode->i_mapping->i_pages, cookie->flags);
        /*
         * Protected by either !I_WB_SWITCH + rcu_read_lock() or the i_pages
@@ -383,12 +383,13 @@ unlocked_inode_to_wb_begin(struct inode *inode, bool *lockedp)
 /**
 * unlocked_inode_to_wb_end - end inode wb access transaction
 * @inode: target inode
- * @locked: *@lockedp from unlocked_inode_to_wb_begin()
+ * @cookie: @cookie from unlocked_inode_to_wb_begin()
 */
-static inline void unlocked_inode_to_wb_end(struct inode *inode, bool locked)
+static inline void unlocked_inode_to_wb_end(struct inode *inode,
+                                            struct wb_lock_cookie *cookie)
 {
-        if (unlikely(locked))
+        if (unlikely(cookie->locked))
-                xa_unlock_irq(&inode->i_mapping->i_pages);
+                xa_unlock_irqrestore(&inode->i_mapping->i_pages, cookie->flags);
        rcu_read_unlock();
 }
@@ -435,12 +436,13 @@ static inline struct bdi_writeback *inode_to_wb(struct inode *inode)
 }
 static inline struct bdi_writeback *
-unlocked_inode_to_wb_begin(struct inode *inode, bool *lockedp)
+unlocked_inode_to_wb_begin(struct inode *inode, struct wb_lock_cookie *cookie)
 {
        return inode_to_wb(inode);
 }
-static inline void unlocked_inode_to_wb_end(struct inode *inode, bool locked)
+static inline void unlocked_inode_to_wb_end(struct inode *inode,
+                                            struct wb_lock_cookie *cookie)
 {
 }
diff --git a/include/linux/compiler-clang.h b/include/linux/compiler-clang.h
index ceb96ecab96e..7d98e263e048 100644
--- a/include/linux/compiler-clang.h
+++ b/include/linux/compiler-clang.h
@@ -25,6 +25,9 @@
 #define __SANITIZE_ADDRESS__
 #endif
+#undef __no_sanitize_address
+#define __no_sanitize_address __attribute__((no_sanitize("address")))
 /* Clang doesn't have a way to turn it off per-function, yet. */
 #ifdef __noretpoline
 #undef __noretpoline
diff --git a/include/linux/fsnotify_backend.h b/include/linux/fsnotify_backend.h
index 9f1edb92c97e..e0c95c9f1e29 100644
--- a/include/linux/fsnotify_backend.h
+++ b/include/linux/fsnotify_backend.h
@@ -248,7 +248,7 @@ struct fsnotify_mark {
        /* Group this mark is for. Set on mark creation, stable until last ref
         * is dropped */
        struct fsnotify_group *group;
-        /* List of marks by group->i_fsnotify_marks. Also reused for queueing
+        /* List of marks by group->marks_list. Also reused for queueing
         * mark into destroy_list when it's waiting for the end of SRCU period
         * before it can be freed. [group->mark_mutex] */
        struct list_head g_list;
diff --git a/include/linux/hid.h b/include/linux/hid.h
index 8da3e1f48195..26240a22978a 100644
--- a/include/linux/hid.h
+++ b/include/linux/hid.h
@@ -516,6 +516,12 @@ enum hid_type {
        HID_TYPE_USBNONE
 };
+enum hid_battery_status {
+        HID_BATTERY_UNKNOWN = 0,
+        HID_BATTERY_QUERIED,            /* Kernel explicitly queried battery strength */
+        HID_BATTERY_REPORTED,           /* Device sent unsolicited battery strength report */
+};
 struct hid_driver;
 struct hid_ll_driver;
@@ -558,7 +564,8 @@ struct hid_device {							/* device report descriptor */
        __s32 battery_max;
        __s32 battery_report_type;
        __s32 battery_report_id;
-        bool battery_reported;
+        enum hid_battery_status battery_status;
+        bool battery_avoid_query;
 #endif
        unsigned int status;                                            /* see STAT flags above */
diff --git a/include/linux/if_vlan.h b/include/linux/if_vlan.h
index d11f41d5269f..78a5a90b4267 100644
--- a/include/linux/if_vlan.h
+++ b/include/linux/if_vlan.h
@@ -663,7 +663,7 @@ static inline bool skb_vlan_tagged(const struct sk_buff *skb)
 * Returns true if the skb is tagged with multiple vlan headers, regardless
 * of whether it is hardware accelerated or not.
 */
-static inline bool skb_vlan_tagged_multi(const struct sk_buff *skb)
+static inline bool skb_vlan_tagged_multi(struct sk_buff *skb)
 {
        __be16 protocol = skb->protocol;
@@ -673,6 +673,9 @@ static inline bool skb_vlan_tagged_multi(const struct sk_buff *skb)
                if (likely(!eth_type_vlan(protocol)))
                        return false;
+                if (unlikely(!pskb_may_pull(skb, VLAN_ETH_HLEN)))
+                        return false;
                veh = (struct vlan_ethhdr *)skb->data;
                protocol = veh->h_vlan_encapsulated_proto;
        }
@@ -690,7 +693,7 @@ static inline bool skb_vlan_tagged_multi(const struct sk_buff *skb)
 *
 * Returns features without unsafe ones if the skb has multiple tags.
 */
-static inline netdev_features_t vlan_features_check(const struct sk_buff *skb,
+static inline netdev_features_t vlan_features_check(struct sk_buff *skb,
                                                    netdev_features_t features)
 {
        if (skb_vlan_tagged_multi(skb)) {
diff --git a/include/linux/livepatch.h b/include/linux/livepatch.h
index 4754f01c1abb..aec44b1d9582 100644
--- a/include/linux/livepatch.h
+++ b/include/linux/livepatch.h
@@ -186,13 +186,20 @@ static inline bool klp_have_reliable_stack(void)
               IS_ENABLED(CONFIG_HAVE_RELIABLE_STACKTRACE);
 }
+typedef int (*klp_shadow_ctor_t)(void *obj,
+                                 void *shadow_data,
+                                 void *ctor_data);
+typedef void (*klp_shadow_dtor_t)(void *obj, void *shadow_data);
 void *klp_shadow_get(void *obj, unsigned long id);
-void *klp_shadow_alloc(void *obj, unsigned long id, void *data,
+void *klp_shadow_alloc(void *obj, unsigned long id,
-                       size_t size, gfp_t gfp_flags);
+                       size_t size, gfp_t gfp_flags,
-void *klp_shadow_get_or_alloc(void *obj, unsigned long id, void *data,
+                       klp_shadow_ctor_t ctor, void *ctor_data);
-                              size_t size, gfp_t gfp_flags);
+void *klp_shadow_get_or_alloc(void *obj, unsigned long id,
-void klp_shadow_free(void *obj, unsigned long id);
+                              size_t size, gfp_t gfp_flags,
-void klp_shadow_free_all(unsigned long id);
+                              klp_shadow_ctor_t ctor, void *ctor_data);
+void klp_shadow_free(void *obj, unsigned long id, klp_shadow_dtor_t dtor);
+void klp_shadow_free_all(unsigned long id, klp_shadow_dtor_t dtor);
 #else /* !CONFIG_LIVEPATCH */
diff --git a/include/linux/microchipphy.h b/include/linux/microchipphy.h
index eb492d47f717..8f9c90379732 100644
--- a/include/linux/microchipphy.h
+++ b/include/linux/microchipphy.h
@@ -70,4 +70,12 @@
 #define LAN88XX_MMD3_CHIP_ID                    (32877)
 #define LAN88XX_MMD3_CHIP_REV                   (32878)
+/* DSP registers */
+#define PHY_ARDENNES_MMD_DEV_3_PHY_CFG          (0x806A)
+#define PHY_ARDENNES_MMD_DEV_3_PHY_CFG_ZD_DLY_EN_       (0x2000)
+#define LAN88XX_EXT_PAGE_ACCESS_TR              (0x52B5)
+#define LAN88XX_EXT_PAGE_TR_CR                  16
+#define LAN88XX_EXT_PAGE_TR_LOW_DATA            17
+#define LAN88XX_EXT_PAGE_TR_HIGH_DATA           18
 #endif /* _MICROCHIPPHY_H */
diff --git a/include/linux/shrinker.h b/include/linux/shrinker.h
index 388ff2936a87..6794490f25b2 100644
--- a/include/linux/shrinker.h
+++ b/include/linux/shrinker.h
@@ -75,6 +75,9 @@ struct shrinker {
 #define SHRINKER_NUMA_AWARE     (1 << 0)
 #define SHRINKER_MEMCG_AWARE    (1 << 1)
-extern int register_shrinker(struct shrinker *);
+extern int prealloc_shrinker(struct shrinker *shrinker);
-extern void unregister_shrinker(struct shrinker *);
+extern void register_shrinker_prepared(struct shrinker *shrinker);
+extern int register_shrinker(struct shrinker *shrinker);
+extern void unregister_shrinker(struct shrinker *shrinker);
+extern void free_prealloced_shrinker(struct shrinker *shrinker);
 #endif
diff --git a/include/linux/textsearch.h b/include/linux/textsearch.h
index 0494db3fd9e8..13770cfe33ad 100644
--- a/include/linux/textsearch.h
+++ b/include/linux/textsearch.h
@@ -62,7 +62,7 @@ struct ts_config
        int                     flags;
        /**
-         * get_next_block - fetch next block of data
+         * @get_next_block: fetch next block of data
         * @consumed: number of bytes consumed by the caller
         * @dst: destination buffer
         * @conf: search configuration
@@ -79,7 +79,7 @@ struct ts_config
                                                  struct ts_state *state);
        /**
-         * finish - finalize/clean a series of get_next_block() calls
+         * @finish: finalize/clean a series of get_next_block() calls
         * @conf: search configuration
         * @state: search state
         *
diff --git a/include/linux/thread_info.h b/include/linux/thread_info.h
index 34f053a150a9..cf2862bd134a 100644
--- a/include/linux/thread_info.h
+++ b/include/linux/thread_info.h
@@ -43,11 +43,7 @@ enum {
 #define THREAD_ALIGN    THREAD_SIZE
 #endif
-#if IS_ENABLED(CONFIG_DEBUG_STACK_USAGE) || IS_ENABLED(CONFIG_DEBUG_KMEMLEAK)
+#define THREADINFO_GFP          (GFP_KERNEL_ACCOUNT | __GFP_ZERO)
-# define THREADINFO_GFP         (GFP_KERNEL_ACCOUNT | __GFP_ZERO)
-#else
-# define THREADINFO_GFP         (GFP_KERNEL_ACCOUNT)
-#endif
 /*
 * flag set/clear/test wrappers
diff --git a/include/uapi/linux/random.h b/include/uapi/linux/random.h
index c34f4490d025..26ee91300e3e 100644
--- a/include/uapi/linux/random.h
+++ b/include/uapi/linux/random.h
@@ -35,6 +35,9 @@
 /* Clear the entropy pool and associated counters.  (Superuser only.) */
 #define RNDCLEARPOOL    _IO( 'R', 0x06 )
+/* Reseed CRNG.  (Superuser only.) */
+#define RNDRESEEDCRNG   _IO( 'R', 0x07 )
 struct rand_pool_info {
        int     entropy_count;
        int     buf_size;
diff --git a/include/xen/interface/io/sndif.h b/include/xen/interface/io/sndif.h
index 5c918276835e..78bb5d9f8d83 100644
--- a/include/xen/interface/io/sndif.h
+++ b/include/xen/interface/io/sndif.h
@@ -38,6 +38,13 @@
 /*
 ******************************************************************************
+ *                           Protocol version
+ ******************************************************************************
+ */
+#define XENSND_PROTOCOL_VERSION 2
+/*
+ ******************************************************************************
 *                  Feature and Parameter Negotiation
 ******************************************************************************
 *
@@ -106,6 +113,8 @@
 *
 * /local/domain/1/device/vsnd/0/0/0/ring-ref = "386"
 * /local/domain/1/device/vsnd/0/0/0/event-channel = "15"
+ * /local/domain/1/device/vsnd/0/0/0/evt-ring-ref = "1386"
+ * /local/domain/1/device/vsnd/0/0/0/evt-event-channel = "215"
 *
 *------------------------------ Stream 1, capture ----------------------------
 *
@@ -115,6 +124,8 @@
 *
 * /local/domain/1/device/vsnd/0/0/1/ring-ref = "384"
 * /local/domain/1/device/vsnd/0/0/1/event-channel = "13"
+ * /local/domain/1/device/vsnd/0/0/1/evt-ring-ref = "1384"
+ * /local/domain/1/device/vsnd/0/0/1/evt-event-channel = "213"
 *
 *------------------------------- PCM device 1 --------------------------------
 *
@@ -128,6 +139,8 @@
 *
 * /local/domain/1/device/vsnd/0/1/0/ring-ref = "387"
 * /local/domain/1/device/vsnd/0/1/0/event-channel = "151"
+ * /local/domain/1/device/vsnd/0/1/0/evt-ring-ref = "1387"
+ * /local/domain/1/device/vsnd/0/1/0/evt-event-channel = "351"
 *
 *------------------------------- PCM device 2 --------------------------------
 *
@@ -140,6 +153,8 @@
 *
 * /local/domain/1/device/vsnd/0/2/0/ring-ref = "389"
 * /local/domain/1/device/vsnd/0/2/0/event-channel = "152"
+ * /local/domain/1/device/vsnd/0/2/0/evt-ring-ref = "1389"
+ * /local/domain/1/device/vsnd/0/2/0/evt-event-channel = "452"
 *
 ******************************************************************************
 *                            Backend XenBus Nodes
@@ -285,6 +300,23 @@
 *      The Xen grant reference granting permission for the backend to map
 *      a sole page in a single page sized ring buffer.
 *
+ *--------------------- Stream Event Transport Parameters ---------------------
+ *
+ * This communication path is used to deliver asynchronous events from backend
+ * to frontend, set up per stream.
+ *
+ * evt-event-channel
+ *      Values:         <uint32_t>
+ *
+ *      The identifier of the Xen event channel used to signal activity
+ *      in the ring buffer.
+ *
+ * evt-ring-ref
+ *      Values:         <uint32_t>
+ *
+ *      The Xen grant reference granting permission for the backend to map
+ *      a sole page in a single page sized ring buffer.
+ *
 ******************************************************************************
 *                               STATE DIAGRAMS
 ******************************************************************************
@@ -432,6 +464,20 @@
 #define XENSND_OP_GET_VOLUME            5
 #define XENSND_OP_MUTE                  6
 #define XENSND_OP_UNMUTE                7
+#define XENSND_OP_TRIGGER               8
+#define XENSND_OP_HW_PARAM_QUERY        9
+#define XENSND_OP_TRIGGER_START         0
+#define XENSND_OP_TRIGGER_PAUSE         1
+#define XENSND_OP_TRIGGER_STOP          2
+#define XENSND_OP_TRIGGER_RESUME        3
+/*
+ ******************************************************************************
+ *                                 EVENT CODES
+ ******************************************************************************
+ */
+#define XENSND_EVT_CUR_POS              0
 /*
 ******************************************************************************
@@ -448,6 +494,8 @@
 #define XENSND_FIELD_VCARD_LONG_NAME    "long-name"
 #define XENSND_FIELD_RING_REF           "ring-ref"
 #define XENSND_FIELD_EVT_CHNL           "event-channel"
+#define XENSND_FIELD_EVT_RING_REF       "evt-ring-ref"
+#define XENSND_FIELD_EVT_EVT_CHNL       "evt-event-channel"
 #define XENSND_FIELD_DEVICE_NAME        "name"
 #define XENSND_FIELD_TYPE               "type"
 #define XENSND_FIELD_STREAM_UNIQUE_ID   "unique-id"
@@ -526,7 +574,7 @@
 *
 *---------------------------------- Requests ---------------------------------
 *
- * All request packets have the same length (32 octets)
+ * All request packets have the same length (64 octets)
 * All request packets have common header:
 *         0                1                 2               3        octet
 * +----------------+----------------+----------------+----------------+
@@ -559,11 +607,13 @@
 * +----------------+----------------+----------------+----------------+
 * |                           gref_directory                          | 24
 * +----------------+----------------+----------------+----------------+
- * |                             reserved                              | 28
+ * |                             period_sz                             | 28
+ * +----------------+----------------+----------------+----------------+
+ * |                             reserved                              | 32
 * +----------------+----------------+----------------+----------------+
 * |/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/|
 * +----------------+----------------+----------------+----------------+
- * |                             reserved                              | 32
+ * |                             reserved                              | 64
 * +----------------+----------------+----------------+----------------+
 *
 * pcm_rate - uint32_t, stream data rate, Hz
@@ -571,6 +621,14 @@
 * pcm_channels - uint8_t, number of channels of this stream,
 *   [channels-min; channels-max]
 * buffer_sz - uint32_t, buffer size to be allocated, octets
+ * period_sz - uint32_t, event period size, octets
+ *   This is the requested value of the period at which frontend would
+ *   like to receive XENSND_EVT_CUR_POS notifications from the backend when
+ *   stream position advances during playback/capture.
+ *   It shows how many octets are expected to be played/captured before
+ *   sending such an event.
+ *   If set to 0 no XENSND_EVT_CUR_POS events are sent by the backend.
+ *
 * gref_directory - grant_ref_t, a reference to the first shared page
 *   describing shared buffer references. At least one page exists. If shared
 *   buffer size  (buffer_sz) exceeds what can be addressed by this single page,
@@ -585,6 +643,7 @@ struct xensnd_open_req {
        uint16_t reserved;
        uint32_t buffer_sz;
        grant_ref_t gref_directory;
+        uint32_t period_sz;
 };
 /*
@@ -632,7 +691,7 @@ struct xensnd_page_directory {
 * +----------------+----------------+----------------+----------------+
 * |/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/|
 * +----------------+----------------+----------------+----------------+
- * |                             reserved                              | 32
+ * |                             reserved                              | 64
 * +----------------+----------------+----------------+----------------+
 *
 * Request read/write - used for read (for capture) or write (for playback):
@@ -650,7 +709,7 @@ struct xensnd_page_directory {
 * +----------------+----------------+----------------+----------------+
 * |/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/|
 * +----------------+----------------+----------------+----------------+
- * |                             reserved                              | 32
+ * |                             reserved                              | 64
 * +----------------+----------------+----------------+----------------+
 *
 * operation - XENSND_OP_READ for read or XENSND_OP_WRITE for write
@@ -673,9 +732,11 @@ struct xensnd_rw_req {
 * +----------------+----------------+----------------+----------------+
 * |                              length                               | 16
 * +----------------+----------------+----------------+----------------+
+ * |                             reserved                              | 20
+ * +----------------+----------------+----------------+----------------+
 * |/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/|
 * +----------------+----------------+----------------+----------------+
- * |                             reserved                              | 32
+ * |                             reserved                              | 64
 * +----------------+----------------+----------------+----------------+
 *
 * operation - XENSND_OP_SET_VOLUME for volume set
@@ -713,9 +774,11 @@ struct xensnd_rw_req {
 * +----------------+----------------+----------------+----------------+
 * |                              length                               | 16
 * +----------------+----------------+----------------+----------------+
+ * |                             reserved                              | 20
+ * +----------------+----------------+----------------+----------------+
 * |/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/|
 * +----------------+----------------+----------------+----------------+
- * |                             reserved                              | 32
+ * |                             reserved                              | 64
 * +----------------+----------------+----------------+----------------+
 *
 * operation - XENSND_OP_MUTE for mute or XENSND_OP_UNMUTE for unmute
@@ -743,32 +806,213 @@ struct xensnd_rw_req {
 *
 * The 'struct xensnd_rw_req' is also used for XENSND_OP_SET_VOLUME,
 * XENSND_OP_GET_VOLUME, XENSND_OP_MUTE, XENSND_OP_UNMUTE.
+ *
+ * Request stream running state change - trigger PCM stream running state
+ * to start, stop, pause or resume:
+ *
+ *         0                1                 2               3        octet
+ * +----------------+----------------+----------------+----------------+
+ * |               id                |   _OP_TRIGGER  |    reserved    | 4
+ * +----------------+----------------+----------------+----------------+
+ * |                             reserved                              | 8
+ * +----------------+----------------+----------------+----------------+
+ * |      type      |                     reserved                     | 12
+ * +----------------+----------------+----------------+----------------+
+ * |                             reserved                              | 16
+ * +----------------+----------------+----------------+----------------+
+ * |/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/|
+ * +----------------+----------------+----------------+----------------+
+ * |                             reserved                              | 64
+ * +----------------+----------------+----------------+----------------+
+ *
+ * type - uint8_t, XENSND_OP_TRIGGER_XXX value
 */
+struct xensnd_trigger_req {
+        uint8_t type;
+};
 /*
- *---------------------------------- Responses --------------------------------
+ * Request stream parameter ranges: request intervals and
+ *   masks of supported ranges for stream configuration values.
 *
- * All response packets have the same length (32 octets)
+ *   Sound device configuration for a particular stream is a limited subset
+ *   of the multidimensional configuration available on XenStore, e.g.
+ *   once the frame rate has been selected there is a limited supported range
+ *   for sample rates becomes available (which might be the same set configured
+ *   on XenStore or less). For example, selecting 96kHz sample rate may limit
+ *   number of channels available for such configuration from 4 to 2, etc.
+ *   Thus, each call to XENSND_OP_HW_PARAM_QUERY may reduce configuration
+ *   space making it possible to iteratively get the final stream configuration,
+ *   used in XENSND_OP_OPEN request.
+ *
+ *   See response format for this request.
 *
- * Response for all requests:
 *         0                1                 2               3        octet
 * +----------------+----------------+----------------+----------------+
- * |               id                |    operation   |    reserved    | 4
+ * |               id                | _HW_PARAM_QUERY|    reserved    | 4
 * +----------------+----------------+----------------+----------------+
- * |                              status                               | 8
+ * |                             reserved                              | 8
+ * +----------------+----------------+----------------+----------------+
+ * |                     formats mask low 32-bit                       | 12
+ * +----------------+----------------+----------------+----------------+
+ * |                     formats mask high 32-bit                      | 16
 * +----------------+----------------+----------------+----------------+
- * |                             reserved                              | 12
+ * |                              min rate                             | 20
+ * +----------------+----------------+----------------+----------------+
+ * |                              max rate                             | 24
+ * +----------------+----------------+----------------+----------------+
+ * |                            min channels                           | 28
+ * +----------------+----------------+----------------+----------------+
+ * |                            max channels                           | 32
+ * +----------------+----------------+----------------+----------------+
+ * |                         min buffer frames                         | 36
+ * +----------------+----------------+----------------+----------------+
+ * |                         max buffer frames                         | 40
+ * +----------------+----------------+----------------+----------------+
+ * |                         min period frames                         | 44
+ * +----------------+----------------+----------------+----------------+
+ * |                         max period frames                         | 48
+ * +----------------+----------------+----------------+----------------+
+ * |                             reserved                              | 52
 * +----------------+----------------+----------------+----------------+
 * |/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/|
 * +----------------+----------------+----------------+----------------+
- * |                             reserved                              | 32
+ * |                             reserved                              | 64
+ * +----------------+----------------+----------------+----------------+
+ *
+ * formats - uint64_t, bit mask representing values of the parameter
+ *     made as bitwise OR of (1 << XENSND_PCM_FORMAT_XXX) values
+ *
+ * For interval parameters:
+ *   min - uint32_t, minimum value of the parameter
+ *   max - uint32_t, maximum value of the parameter
+ *
+ * Frame is defined as a product of the number of channels by the
+ * number of octets per one sample.
+ */
+struct xensnd_query_hw_param {
+        uint64_t formats;
+        struct {
+                uint32_t min;
+                uint32_t max;
+        } rates;
+        struct {
+                uint32_t min;
+                uint32_t max;
+        } channels;
+        struct {
+                uint32_t min;
+                uint32_t max;
+        } buffer;
+        struct {
+                uint32_t min;
+                uint32_t max;
+        } period;
+};
+/*
+ *---------------------------------- Responses --------------------------------
+ *
+ * All response packets have the same length (64 octets)
+ *
+ * All response packets have common header:
+ *         0                1                 2               3        octet
+ * +----------------+----------------+----------------+----------------+
+ * |               id                |    operation   |    reserved    | 4
+ * +----------------+----------------+----------------+----------------+
+ * |                              status                               | 8
 * +----------------+----------------+----------------+----------------+
 *
 * id - uint16_t, copied from the request
 * operation - uint8_t, XENSND_OP_* - copied from request
 * status - int32_t, response status, zero on success and -XEN_EXX on failure
+ *
+ *
+ * HW parameter query response - response for XENSND_OP_HW_PARAM_QUERY:
+ *         0                1                 2               3        octet
+ * +----------------+----------------+----------------+----------------+
+ * |               id                |    operation   |    reserved    | 4
+ * +----------------+----------------+----------------+----------------+
+ * |                              status                               | 8
+ * +----------------+----------------+----------------+----------------+
+ * |                     formats mask low 32-bit                       | 12
+ * +----------------+----------------+----------------+----------------+
+ * |                     formats mask high 32-bit                      | 16
+ * +----------------+----------------+----------------+----------------+
+ * |                              min rate                             | 20
+ * +----------------+----------------+----------------+----------------+
+ * |                              max rate                             | 24
+ * +----------------+----------------+----------------+----------------+
+ * |                            min channels                           | 28
+ * +----------------+----------------+----------------+----------------+
+ * |                            max channels                           | 32
+ * +----------------+----------------+----------------+----------------+
+ * |                         min buffer frames                         | 36
+ * +----------------+----------------+----------------+----------------+
+ * |                         max buffer frames                         | 40
+ * +----------------+----------------+----------------+----------------+
+ * |                         min period frames                         | 44
+ * +----------------+----------------+----------------+----------------+
+ * |                         max period frames                         | 48
+ * +----------------+----------------+----------------+----------------+
+ * |                             reserved                              | 52
+ * +----------------+----------------+----------------+----------------+
+ * |/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/|
+ * +----------------+----------------+----------------+----------------+
+ * |                             reserved                              | 64
+ * +----------------+----------------+----------------+----------------+
+ *
+ * Meaning of the values in this response is the same as for
+ * XENSND_OP_HW_PARAM_QUERY request.
+ */
+/*
+ *----------------------------------- Events ----------------------------------
+ *
+ * Events are sent via shared page allocated by the front and propagated by
+ *   evt-event-channel/evt-ring-ref XenStore entries
+ * All event packets have the same length (64 octets)
+ * All event packets have common header:
+ *         0                1                 2               3        octet
+ * +----------------+----------------+----------------+----------------+
+ * |               id                |      type      |   reserved     | 4
+ * +----------------+----------------+----------------+----------------+
+ * |                             reserved                              | 8
+ * +----------------+----------------+----------------+----------------+
+ *
+ * id - uint16_t, event id, may be used by front
+ * type - uint8_t, type of the event
+ *
+ *
+ * Current stream position - event from back to front when stream's
+ *   playback/capture position has advanced:
+ *         0                1                 2               3        octet
+ * +----------------+----------------+----------------+----------------+
+ * |               id                |   _EVT_CUR_POS |   reserved     | 4
+ * +----------------+----------------+----------------+----------------+
+ * |                             reserved                              | 8
+ * +----------------+----------------+----------------+----------------+
+ * |                         position low 32-bit                       | 12
+ * +----------------+----------------+----------------+----------------+
+ * |                         position high 32-bit                      | 16
+ * +----------------+----------------+----------------+----------------+
+ * |                             reserved                              | 20
+ * +----------------+----------------+----------------+----------------+
+ * |/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/|
+ * +----------------+----------------+----------------+----------------+
+ * |                             reserved                              | 64
+ * +----------------+----------------+----------------+----------------+
+ *
+ * position - current value of stream's playback/capture position, octets
+ *
 */
+struct xensnd_cur_pos_evt {
+        uint64_t position;
+};
 struct xensnd_req {
        uint16_t id;
        uint8_t operation;
@@ -776,7 +1020,9 @@ struct xensnd_req {
        union {
                struct xensnd_open_req open;
                struct xensnd_rw_req rw;
-                uint8_t reserved[24];
+                struct xensnd_trigger_req trigger;
+                struct xensnd_query_hw_param hw_param;
+                uint8_t reserved[56];
        } op;
 };
@@ -785,9 +1031,53 @@ struct xensnd_resp {
        uint8_t operation;
        uint8_t reserved;
        int32_t status;
-        uint8_t reserved1[24];
+        union {
+                struct xensnd_query_hw_param hw_param;
+                uint8_t reserved1[56];
+        } resp;
+};
+struct xensnd_evt {
+        uint16_t id;
+        uint8_t type;
+        uint8_t reserved[5];
+        union {
+                struct xensnd_cur_pos_evt cur_pos;
+                uint8_t reserved[56];
+        } op;
 };
 DEFINE_RING_TYPES(xen_sndif, struct xensnd_req, struct xensnd_resp);
+/*
+ ******************************************************************************
+ *                        Back to front events delivery
+ ******************************************************************************
+ * In order to deliver asynchronous events from back to front a shared page is
+ * allocated by front and its granted reference propagated to back via
+ * XenStore entries (evt-ring-ref/evt-event-channel).
+ * This page has a common header used by both front and back to synchronize
+ * access and control event's ring buffer, while back being a producer of the
+ * events and front being a consumer. The rest of the page after the header
+ * is used for event packets.
+ *
+ * Upon reception of an event(s) front may confirm its reception
+ * for either each event, group of events or none.
+ */
+struct xensnd_event_page {
+        uint32_t in_cons;
+        uint32_t in_prod;
+        uint8_t reserved[56];
+};
+#define XENSND_EVENT_PAGE_SIZE XEN_PAGE_SIZE
+#define XENSND_IN_RING_OFFS (sizeof(struct xensnd_event_page))
+#define XENSND_IN_RING_SIZE (XENSND_EVENT_PAGE_SIZE - XENSND_IN_RING_OFFS)
+#define XENSND_IN_RING_LEN (XENSND_IN_RING_SIZE / sizeof(struct xensnd_evt))
+#define XENSND_IN_RING(page) \
+        ((struct xensnd_evt *)((char *)(page) + XENSND_IN_RING_OFFS))
+#define XENSND_IN_RING_REF(page, idx) \
+        (XENSND_IN_RING((page))[(idx) % XENSND_IN_RING_LEN])
 #endif /* __XEN_PUBLIC_IO_SNDIF_H__ */
diff --git a/kernel/fork.c b/kernel/fork.c
index 242c8c93d285..a5d21c42acfc 100644
--- a/kernel/fork.c
+++ b/kernel/fork.c
@@ -216,10 +216,9 @@ static unsigned long *alloc_thread_stack_node(struct task_struct *tsk, int node)
                if (!s)
                        continue;
-#ifdef CONFIG_DEBUG_KMEMLEAK
                /* Clear stale pointers from reused stack. */
                memset(s->addr, 0, THREAD_SIZE);
-#endif
                tsk->stack_vm_area = s;
                return s->addr;
        }
diff --git a/kernel/livepatch/shadow.c b/kernel/livepatch/shadow.c
index fdac27588d60..83958c814439 100644
--- a/kernel/livepatch/shadow.c
+++ b/kernel/livepatch/shadow.c
@@ -113,8 +113,10 @@ void *klp_shadow_get(void *obj, unsigned long id)
 }
 EXPORT_SYMBOL_GPL(klp_shadow_get);
-static void *__klp_shadow_get_or_alloc(void *obj, unsigned long id, void *data,
+static void *__klp_shadow_get_or_alloc(void *obj, unsigned long id,
-                       size_t size, gfp_t gfp_flags, bool warn_on_exist)
+                                       size_t size, gfp_t gfp_flags,
+                                       klp_shadow_ctor_t ctor, void *ctor_data,
+                                       bool warn_on_exist)
 {
        struct klp_shadow *new_shadow;
        void *shadow_data;
@@ -125,18 +127,15 @@ static void *__klp_shadow_get_or_alloc(void *obj, unsigned long id, void *data,
        if (shadow_data)
                goto exists;
-        /* Allocate a new shadow variable for use inside the lock below */
+        /*
+         * Allocate a new shadow variable.  Fill it with zeroes by default.
+         * More complex setting can be done by @ctor function.  But it is
+         * called only when the buffer is really used (under klp_shadow_lock).
+         */
        new_shadow = kzalloc(size + sizeof(*new_shadow), gfp_flags);
        if (!new_shadow)
                return NULL;
-        new_shadow->obj = obj;
-        new_shadow->id = id;
-        /* Initialize the shadow variable if data provided */
-        if (data)
-                memcpy(new_shadow->data, data, size);
        /* Look for <obj, id> again under the lock */
        spin_lock_irqsave(&klp_shadow_lock, flags);
        shadow_data = klp_shadow_get(obj, id);
@@ -150,6 +149,22 @@ static void *__klp_shadow_get_or_alloc(void *obj, unsigned long id, void *data,
                goto exists;
        }
+        new_shadow->obj = obj;
+        new_shadow->id = id;
+        if (ctor) {
+                int err;
+                err = ctor(obj, new_shadow->data, ctor_data);
+                if (err) {
+                        spin_unlock_irqrestore(&klp_shadow_lock, flags);
+                        kfree(new_shadow);
+                        pr_err("Failed to construct shadow variable <%p, %lx> (%d)\n",
+                               obj, id, err);
+                        return NULL;
+                }
+        }
        /* No <obj, id> found, so attach the newly allocated one */
        hash_add_rcu(klp_shadow_hash, &new_shadow->node,
                     (unsigned long)new_shadow->obj);
@@ -170,26 +185,32 @@ exists:
 * klp_shadow_alloc() - allocate and add a new shadow variable
 * @obj:        pointer to parent object
 * @id:         data identifier
- * @data:       pointer to data to attach to parent
 * @size:       size of attached data
 * @gfp_flags:  GFP mask for allocation
+ * @ctor:       custom constructor to initialize the shadow data (optional)
+ * @ctor_data:  pointer to any data needed by @ctor (optional)
+ *
+ * Allocates @size bytes for new shadow variable data using @gfp_flags.
+ * The data are zeroed by default.  They are further initialized by @ctor
+ * function if it is not NULL.  The new shadow variable is then added
+ * to the global hashtable.
 *
- * Allocates @size bytes for new shadow variable data using @gfp_flags
+ * If an existing <obj, id> shadow variable can be found, this routine will
- * and copies @size bytes from @data into the new shadow variable's own
+ * issue a WARN, exit early and return NULL.
- * data space.  If @data is NULL, @size bytes are still allocated, but
- * no copy is performed.  The new shadow variable is then added to the
- * global hashtable.
 *
- * If an existing <obj, id> shadow variable can be found, this routine
+ * This function guarantees that the constructor function is called only when
- * will issue a WARN, exit early and return NULL.
+ * the variable did not exist before.  The cost is that @ctor is called
+ * in atomic context under a spin lock.
 *
 * Return: the shadow variable data element, NULL on duplicate or
 * failure.
 */
-void *klp_shadow_alloc(void *obj, unsigned long id, void *data,
+void *klp_shadow_alloc(void *obj, unsigned long id,
-                       size_t size, gfp_t gfp_flags)
+                       size_t size, gfp_t gfp_flags,
+                       klp_shadow_ctor_t ctor, void *ctor_data)
 {
-        return __klp_shadow_get_or_alloc(obj, id, data, size, gfp_flags, true);
+        return __klp_shadow_get_or_alloc(obj, id, size, gfp_flags,
+                                         ctor, ctor_data, true);
 }
 EXPORT_SYMBOL_GPL(klp_shadow_alloc);
@@ -197,37 +218,51 @@ EXPORT_SYMBOL_GPL(klp_shadow_alloc);
 * klp_shadow_get_or_alloc() - get existing or allocate a new shadow variable
 * @obj:        pointer to parent object
 * @id:         data identifier
- * @data:       pointer to data to attach to parent
 * @size:       size of attached data
 * @gfp_flags:  GFP mask for allocation
+ * @ctor:       custom constructor to initialize the shadow data (optional)
+ * @ctor_data:  pointer to any data needed by @ctor (optional)
 *
 * Returns a pointer to existing shadow data if an <obj, id> shadow
 * variable is already present.  Otherwise, it creates a new shadow
 * variable like klp_shadow_alloc().
 *
- * This function guarantees that only one shadow variable exists with
+ * This function guarantees that only one shadow variable exists with the given
- * the given @id for the given @obj.  It also guarantees that the shadow
+ * @id for the given @obj.  It also guarantees that the constructor function
- * variable will be initialized by the given @data only when it did not
+ * will be called only when the variable did not exist before.  The cost is
- * exist before.
+ * that @ctor is called in atomic context under a spin lock.
 *
 * Return: the shadow variable data element, NULL on failure.
 */
-void *klp_shadow_get_or_alloc(void *obj, unsigned long id, void *data,
+void *klp_shadow_get_or_alloc(void *obj, unsigned long id,
-                               size_t size, gfp_t gfp_flags)
+                              size_t size, gfp_t gfp_flags,
+                              klp_shadow_ctor_t ctor, void *ctor_data)
 {
-        return __klp_shadow_get_or_alloc(obj, id, data, size, gfp_flags, false);
+        return __klp_shadow_get_or_alloc(obj, id, size, gfp_flags,
+                                         ctor, ctor_data, false);
 }
 EXPORT_SYMBOL_GPL(klp_shadow_get_or_alloc);
+static void klp_shadow_free_struct(struct klp_shadow *shadow,
+                                   klp_shadow_dtor_t dtor)
+{
+        hash_del_rcu(&shadow->node);
+        if (dtor)
+                dtor(shadow->obj, shadow->data);
+        kfree_rcu(shadow, rcu_head);
+}
 /**
 * klp_shadow_free() - detach and free a <obj, id> shadow variable
 * @obj:        pointer to parent object
 * @id:         data identifier
+ * @dtor:       custom callback that can be used to unregister the variable
+ *              and/or free data that the shadow variable points to (optional)
 *
 * This function releases the memory for this <obj, id> shadow variable
 * instance, callers should stop referencing it accordingly.
 */
-void klp_shadow_free(void *obj, unsigned long id)
+void klp_shadow_free(void *obj, unsigned long id, klp_shadow_dtor_t dtor)
 {
        struct klp_shadow *shadow;
        unsigned long flags;
@@ -239,8 +274,7 @@ void klp_shadow_free(void *obj, unsigned long id)
                               (unsigned long)obj) {
                if (klp_shadow_match(shadow, obj, id)) {
-                        hash_del_rcu(&shadow->node);
+                        klp_shadow_free_struct(shadow, dtor);
-                        kfree_rcu(shadow, rcu_head);
                        break;
                }
        }
@@ -252,11 +286,13 @@ EXPORT_SYMBOL_GPL(klp_shadow_free);
 /**
 * klp_shadow_free_all() - detach and free all <*, id> shadow variables
 * @id:         data identifier
+ * @dtor:       custom callback that can be used to unregister the variable
+ *              and/or free data that the shadow variable points to (optional)
 *
 * This function releases the memory for all <*, id> shadow variable
 * instances, callers should stop referencing them accordingly.
 */
-void klp_shadow_free_all(unsigned long id)
+void klp_shadow_free_all(unsigned long id, klp_shadow_dtor_t dtor)
 {
        struct klp_shadow *shadow;
        unsigned long flags;
@@ -266,10 +302,8 @@ void klp_shadow_free_all(unsigned long id)
        /* Delete all <*, id> from hash */
        hash_for_each(klp_shadow_hash, i, shadow, node) {
-                if (klp_shadow_match(shadow, shadow->obj, id)) {
+                if (klp_shadow_match(shadow, shadow->obj, id))
-                        hash_del_rcu(&shadow->node);
+                        klp_shadow_free_struct(shadow, dtor);
-                        kfree_rcu(shadow, rcu_head);
-                }
        }
        spin_unlock_irqrestore(&klp_shadow_lock, flags);
diff --git a/lib/textsearch.c b/lib/textsearch.c
index 0b79908dfe89..5939549c0e7b 100644
--- a/lib/textsearch.c
+++ b/lib/textsearch.c
@@ -10,7 +10,10 @@
 *              Pablo Neira Ayuso <pablo@netfilter.org>
 *
 * ==========================================================================
- *
+ */
+/**
+ * DOC: ts_intro
 * INTRODUCTION
 *
 *   The textsearch infrastructure provides text searching facilities for
@@ -19,7 +22,9 @@
 *
 * ARCHITECTURE
 *
- *      User
+ * .. code-block:: none
+ *
+ *     User
 *     +----------------+
 *     |        finish()|<--------------(6)-----------------+
 *     |get_next_block()|<--------------(5)---------------+ |
@@ -33,21 +38,21 @@
 *     |             (3)|----->| find()/next() |-----------+          |
 *     |             (7)|----->| destroy()     |----------------------+
 *     +----------------+      +---------------+
- *  
+ *
- *   (1) User configures a search by calling _prepare() specifying the
+ *   (1) User configures a search by calling textsearch_prepare() specifying
- *       search parameters such as the pattern and algorithm name.
+ *       the search parameters such as the pattern and algorithm name.
 *   (2) Core requests the algorithm to allocate and initialize a search
 *       configuration according to the specified parameters.
- *   (3) User starts the search(es) by calling _find() or _next() to
+ *   (3) User starts the search(es) by calling textsearch_find() or
- *       fetch subsequent occurrences. A state variable is provided
+ *       textsearch_next() to fetch subsequent occurrences. A state variable
- *       to the algorithm to store persistent variables.
+ *       is provided to the algorithm to store persistent variables.
 *   (4) Core eventually resets the search offset and forwards the find()
 *       request to the algorithm.
 *   (5) Algorithm calls get_next_block() provided by the user continuously
 *       to fetch the data to be searched in block by block.
 *   (6) Algorithm invokes finish() after the last call to get_next_block
 *       to clean up any leftovers from get_next_block. (Optional)
- *   (7) User destroys the configuration by calling _destroy().
+ *   (7) User destroys the configuration by calling textsearch_destroy().
 *   (8) Core notifies the algorithm to destroy algorithm specific
 *       allocations. (Optional)
 *
@@ -62,9 +67,10 @@
 *   amount of times and even in parallel as long as a separate struct
 *   ts_state variable is provided to every instance.
 *
- *   The actual search is performed by either calling textsearch_find_-
+ *   The actual search is performed by either calling
- *   continuous() for linear data or by providing an own get_next_block()
+ *   textsearch_find_continuous() for linear data or by providing
- *   implementation and calling textsearch_find(). Both functions return
+ *   an own get_next_block() implementation and
+ *   calling textsearch_find(). Both functions return
 *   the position of the first occurrence of the pattern or UINT_MAX if
 *   no match was found. Subsequent occurrences can be found by calling
 *   textsearch_next() regardless of the linearity of the data.
@@ -72,7 +78,7 @@
 *   Once you're done using a configuration it must be given back via
 *   textsearch_destroy.
 *
- * EXAMPLE
+ * EXAMPLE::
 *
 *   int pos;
 *   struct ts_config *conf;
@@ -87,13 +93,13 @@
 *       goto errout;
 *   }
 *
- *   pos = textsearch_find_continuous(conf, &state, example, strlen(example));
+ *   pos = textsearch_find_continuous(conf, \&state, example, strlen(example));
 *   if (pos != UINT_MAX)
- *       panic("Oh my god, dancing chickens at %d\n", pos);
+ *       panic("Oh my god, dancing chickens at \%d\n", pos);
 *
 *   textsearch_destroy(conf);
- * ==========================================================================
 */
+/* ========================================================================== */
 #include <linux/module.h>
 #include <linux/types.h>
@@ -225,7 +231,7 @@ static unsigned int get_linear_data(unsigned int consumed, const u8 **dst,
 *
 * Returns the position of first occurrence of the pattern or
 * %UINT_MAX if no occurrence was found.
- */ 
+ */
 unsigned int textsearch_find_continuous(struct ts_config *conf,
                                        struct ts_state *state,
                                        const void *data, unsigned int len)
diff --git a/mm/filemap.c b/mm/filemap.c
index 9276bdb2343c..0604cb02e6f3 100644
--- a/mm/filemap.c
+++ b/mm/filemap.c
@@ -786,7 +786,7 @@ int replace_page_cache_page(struct page *old, struct page *new, gfp_t gfp_mask)
        VM_BUG_ON_PAGE(!PageLocked(new), new);
        VM_BUG_ON_PAGE(new->mapping, new);
-        error = radix_tree_preload(gfp_mask & ~__GFP_HIGHMEM);
+        error = radix_tree_preload(gfp_mask & GFP_RECLAIM_MASK);
        if (!error) {
                struct address_space *mapping = old->mapping;
                void (*freepage)(struct page *);
@@ -842,7 +842,7 @@ static int __add_to_page_cache_locked(struct page *page,
                        return error;
        }
-        error = radix_tree_maybe_preload(gfp_mask & ~__GFP_HIGHMEM);
+        error = radix_tree_maybe_preload(gfp_mask & GFP_RECLAIM_MASK);
        if (error) {
                if (!huge)
                        mem_cgroup_cancel_charge(page, memcg, false);
@@ -1585,8 +1585,7 @@ no_page:
                if (fgp_flags & FGP_ACCESSED)
                        __SetPageReferenced(page);
-                err = add_to_page_cache_lru(page, mapping, offset,
+                err = add_to_page_cache_lru(page, mapping, offset, gfp_mask);
-                                gfp_mask & GFP_RECLAIM_MASK);
                if (unlikely(err)) {
                        put_page(page);
                        page = NULL;
@@ -2387,7 +2386,7 @@ static int page_cache_read(struct file *file, pgoff_t offset, gfp_t gfp_mask)
                if (!page)
                        return -ENOMEM;
-                ret = add_to_page_cache_lru(page, mapping, offset, gfp_mask & GFP_KERNEL);
+                ret = add_to_page_cache_lru(page, mapping, offset, gfp_mask);
                if (ret == 0)
                        ret = mapping->a_ops->readpage(file, page);
                else if (ret == -EEXIST)
diff --git a/mm/huge_memory.c b/mm/huge_memory.c
index 14ed6ee5e02f..a3a1815f8e11 100644
--- a/mm/huge_memory.c
+++ b/mm/huge_memory.c
@@ -2925,7 +2925,10 @@ void remove_migration_pmd(struct page_vma_mapped_walk *pvmw, struct page *new)
                pmde = maybe_pmd_mkwrite(pmde, vma);
        flush_cache_range(vma, mmun_start, mmun_start + HPAGE_PMD_SIZE);
-        page_add_anon_rmap(new, vma, mmun_start, true);
+        if (PageAnon(new))
+                page_add_anon_rmap(new, vma, mmun_start, true);
+        else
+                page_add_file_rmap(new, true);
        set_pmd_at(mm, mmun_start, pvmw->pmd, pmde);
        if (vma->vm_flags & VM_LOCKED)
                mlock_vma_page(new);
diff --git a/mm/memcontrol.c b/mm/memcontrol.c
index e074f7c637aa..2bd3df3d101a 100644
--- a/mm/memcontrol.c
+++ b/mm/memcontrol.c
@@ -2192,7 +2192,7 @@ static void __memcg_schedule_kmem_cache_create(struct mem_cgroup *memcg,
 {
        struct memcg_kmem_cache_create_work *cw;
-        cw = kmalloc(sizeof(*cw), GFP_NOWAIT);
+        cw = kmalloc(sizeof(*cw), GFP_NOWAIT | __GFP_NOWARN);
        if (!cw)
                return;
diff --git a/mm/migrate.c b/mm/migrate.c
index f65dd69e1fd1..568433023831 100644
--- a/mm/migrate.c
+++ b/mm/migrate.c
@@ -472,7 +472,7 @@ int migrate_page_move_mapping(struct address_space *mapping,
        pslot = radix_tree_lookup_slot(&mapping->i_pages,
                                        page_index(page));
-        expected_count += 1 + page_has_private(page);
+        expected_count += hpage_nr_pages(page) + page_has_private(page);
        if (page_count(page) != expected_count ||
                radix_tree_deref_slot_protected(pslot,
                                        &mapping->i_pages.xa_lock) != page) {
@@ -505,7 +505,7 @@ int migrate_page_move_mapping(struct address_space *mapping,
         */
        newpage->index = page->index;
        newpage->mapping = page->mapping;
-        get_page(newpage);      /* add cache reference */
+        page_ref_add(newpage, hpage_nr_pages(page)); /* add cache reference */
        if (PageSwapBacked(page)) {
                __SetPageSwapBacked(newpage);
                if (PageSwapCache(page)) {
@@ -524,13 +524,26 @@ int migrate_page_move_mapping(struct address_space *mapping,
        }
        radix_tree_replace_slot(&mapping->i_pages, pslot, newpage);
+        if (PageTransHuge(page)) {
+                int i;
+                int index = page_index(page);
+                for (i = 0; i < HPAGE_PMD_NR; i++) {
+                        pslot = radix_tree_lookup_slot(&mapping->i_pages,
+                                                       index + i);
+                        radix_tree_replace_slot(&mapping->i_pages, pslot,
+                                                newpage + i);
+                }
+        } else {
+                radix_tree_replace_slot(&mapping->i_pages, pslot, newpage);
+        }
        /*
         * Drop cache reference from old page by unfreezing
         * to one less reference.
         * We know this isn't the last reference.
         */
-        page_ref_unfreeze(page, expected_count - 1);
+        page_ref_unfreeze(page, expected_count - hpage_nr_pages(page));
        xa_unlock(&mapping->i_pages);
        /* Leave irq disabled to prevent preemption while updating stats */
@@ -1622,6 +1635,9 @@ static int do_pages_move(struct mm_struct *mm, nodemask_t task_nodes,
                current_node = NUMA_NO_NODE;
        }
 out_flush:
+        if (list_empty(&pagelist))
+                return err;
        /* Make sure we do not overwrite the existing error */
        err1 = do_move_pages_to_node(mm, &pagelist, current_node);
        if (!err1)
diff --git a/mm/page-writeback.c b/mm/page-writeback.c
index 5c1a3279e63f..337c6afb3345 100644
--- a/mm/page-writeback.c
+++ b/mm/page-writeback.c
@@ -2502,13 +2502,13 @@ void account_page_redirty(struct page *page)
        if (mapping && mapping_cap_account_dirty(mapping)) {
                struct inode *inode = mapping->host;
                struct bdi_writeback *wb;
-                bool locked;
+                struct wb_lock_cookie cookie = {};
-                wb = unlocked_inode_to_wb_begin(inode, &locked);
+                wb = unlocked_inode_to_wb_begin(inode, &cookie);
                current->nr_dirtied--;
                dec_node_page_state(page, NR_DIRTIED);
                dec_wb_stat(wb, WB_DIRTIED);
-                unlocked_inode_to_wb_end(inode, locked);
+                unlocked_inode_to_wb_end(inode, &cookie);
        }
 }
 EXPORT_SYMBOL(account_page_redirty);
@@ -2614,15 +2614,15 @@ void __cancel_dirty_page(struct page *page)
        if (mapping_cap_account_dirty(mapping)) {
                struct inode *inode = mapping->host;
                struct bdi_writeback *wb;
-                bool locked;
+                struct wb_lock_cookie cookie = {};
                lock_page_memcg(page);
-                wb = unlocked_inode_to_wb_begin(inode, &locked);
+                wb = unlocked_inode_to_wb_begin(inode, &cookie);
                if (TestClearPageDirty(page))
                        account_page_cleaned(page, mapping, wb);
-                unlocked_inode_to_wb_end(inode, locked);
+                unlocked_inode_to_wb_end(inode, &cookie);
                unlock_page_memcg(page);
        } else {
                ClearPageDirty(page);
@@ -2654,7 +2654,7 @@ int clear_page_dirty_for_io(struct page *page)
        if (mapping && mapping_cap_account_dirty(mapping)) {
                struct inode *inode = mapping->host;
                struct bdi_writeback *wb;
-                bool locked;
+                struct wb_lock_cookie cookie = {};
                /*
                 * Yes, Virginia, this is indeed insane.
@@ -2691,14 +2691,14 @@ int clear_page_dirty_for_io(struct page *page)
                 * always locked coming in here, so we get the desired
                 * exclusion.
                 */
-                wb = unlocked_inode_to_wb_begin(inode, &locked);
+                wb = unlocked_inode_to_wb_begin(inode, &cookie);
                if (TestClearPageDirty(page)) {
                        dec_lruvec_page_state(page, NR_FILE_DIRTY);
                        dec_zone_page_state(page, NR_ZONE_WRITE_PENDING);
                        dec_wb_stat(wb, WB_RECLAIMABLE);
                        ret = 1;
                }
-                unlocked_inode_to_wb_end(inode, locked);
+                unlocked_inode_to_wb_end(inode, &cookie);
                return ret;
        }
        return TestClearPageDirty(page);
diff --git a/mm/rmap.c b/mm/rmap.c
index f0dd4e4565bc..8d5337fed37b 100644
--- a/mm/rmap.c
+++ b/mm/rmap.c
@@ -1374,9 +1374,6 @@ static bool try_to_unmap_one(struct page *page, struct vm_area_struct *vma,
                if (!pvmw.pte && (flags & TTU_MIGRATION)) {
                        VM_BUG_ON_PAGE(PageHuge(page) || !PageTransCompound(page), page);
-                        if (!PageAnon(page))
-                                continue;
                        set_pmd_migration_entry(&pvmw, page);
                        continue;
                }
diff --git a/mm/vmscan.c b/mm/vmscan.c
index 8b920ce3ae02..9b697323a88c 100644
--- a/mm/vmscan.c
+++ b/mm/vmscan.c
@@ -303,7 +303,7 @@ unsigned long lruvec_lru_size(struct lruvec *lruvec, enum lru_list lru, int zone
 /*
 * Add a shrinker callback to be called from the vm.
 */
-int register_shrinker(struct shrinker *shrinker)
+int prealloc_shrinker(struct shrinker *shrinker)
 {
        size_t size = sizeof(*shrinker->nr_deferred);
@@ -313,10 +313,29 @@ int register_shrinker(struct shrinker *shrinker)
        shrinker->nr_deferred = kzalloc(size, GFP_KERNEL);
        if (!shrinker->nr_deferred)
                return -ENOMEM;
+        return 0;
+}
+void free_prealloced_shrinker(struct shrinker *shrinker)
+{
+        kfree(shrinker->nr_deferred);
+        shrinker->nr_deferred = NULL;
+}
+void register_shrinker_prepared(struct shrinker *shrinker)
+{
        down_write(&shrinker_rwsem);
        list_add_tail(&shrinker->list, &shrinker_list);
        up_write(&shrinker_rwsem);
+}
+int register_shrinker(struct shrinker *shrinker)
+{
+        int err = prealloc_shrinker(shrinker);
+        if (err)
+                return err;
+        register_shrinker_prepared(shrinker);
        return 0;
 }
 EXPORT_SYMBOL(register_shrinker);
diff --git a/net/caif/chnl_net.c b/net/caif/chnl_net.c
index 53ecda10b790..13e2ae6be620 100644
--- a/net/caif/chnl_net.c
+++ b/net/caif/chnl_net.c
@@ -174,7 +174,7 @@ static void chnl_flowctrl_cb(struct cflayer *layr, enum caif_ctrlcmd flow,
                flow == CAIF_CTRLCMD_DEINIT_RSP ? "CLOSE/DEINIT" :
                flow == CAIF_CTRLCMD_INIT_FAIL_RSP ? "OPEN_FAIL" :
                flow == CAIF_CTRLCMD_REMOTE_SHUTDOWN_IND ?
-                 "REMOTE_SHUTDOWN" : "UKNOWN CTRL COMMAND");
+                 "REMOTE_SHUTDOWN" : "UNKNOWN CTRL COMMAND");
diff --git a/net/core/dev.c b/net/core/dev.c
index 969462ebb296..af0558b00c6c 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -2969,7 +2969,7 @@ netdev_features_t passthru_features_check(struct sk_buff *skb,
 }
 EXPORT_SYMBOL(passthru_features_check);
-static netdev_features_t dflt_features_check(const struct sk_buff *skb,
+static netdev_features_t dflt_features_check(struct sk_buff *skb,
                                             struct net_device *dev,
                                             netdev_features_t features)
 {
diff --git a/net/core/dev_addr_lists.c b/net/core/dev_addr_lists.c
index e3e6a3e2ca22..d884d8f5f0e5 100644
--- a/net/core/dev_addr_lists.c
+++ b/net/core/dev_addr_lists.c
@@ -839,7 +839,7 @@ void dev_mc_flush(struct net_device *dev)
 EXPORT_SYMBOL(dev_mc_flush);
 /**
- *      dev_mc_flush - Init multicast address list
+ *      dev_mc_init - Init multicast address list
 *      @dev: device
 *
 *      Init multicast address list.
diff --git a/net/core/neighbour.c b/net/core/neighbour.c
index 7b7a14abba28..ce519861be59 100644
--- a/net/core/neighbour.c
+++ b/net/core/neighbour.c
@@ -55,7 +55,8 @@ static void neigh_timer_handler(struct timer_list *t);
 static void __neigh_notify(struct neighbour *n, int type, int flags,
                           u32 pid);
 static void neigh_update_notify(struct neighbour *neigh, u32 nlmsg_pid);
-static int pneigh_ifdown(struct neigh_table *tbl, struct net_device *dev);
+static int pneigh_ifdown_and_unlock(struct neigh_table *tbl,
+                                    struct net_device *dev);
 #ifdef CONFIG_PROC_FS
 static const struct file_operations neigh_stat_seq_fops;
@@ -291,8 +292,7 @@ int neigh_ifdown(struct neigh_table *tbl, struct net_device *dev)
 {
        write_lock_bh(&tbl->lock);
        neigh_flush_dev(tbl, dev);
-        pneigh_ifdown(tbl, dev);
+        pneigh_ifdown_and_unlock(tbl, dev);
-        write_unlock_bh(&tbl->lock);
        del_timer_sync(&tbl->proxy_timer);
        pneigh_queue_purge(&tbl->proxy_queue);
@@ -681,9 +681,10 @@ int pneigh_delete(struct neigh_table *tbl, struct net *net, const void *pkey,
        return -ENOENT;
 }
-static int pneigh_ifdown(struct neigh_table *tbl, struct net_device *dev)
+static int pneigh_ifdown_and_unlock(struct neigh_table *tbl,
+                                    struct net_device *dev)
 {
-        struct pneigh_entry *n, **np;
+        struct pneigh_entry *n, **np, *freelist = NULL;
        u32 h;
        for (h = 0; h <= PNEIGH_HASHMASK; h++) {
@@ -691,16 +692,23 @@ static int pneigh_ifdown(struct neigh_table *tbl, struct net_device *dev)
                while ((n = *np) != NULL) {
                        if (!dev || n->dev == dev) {
                                *np = n->next;
-                                if (tbl->pdestructor)
+                                n->next = freelist;
-                                        tbl->pdestructor(n);
+                                freelist = n;
-                                if (n->dev)
-                                        dev_put(n->dev);
-                                kfree(n);
                                continue;
                        }
                        np = &n->next;
                }
        }
+        write_unlock_bh(&tbl->lock);
+        while ((n = freelist)) {
+                freelist = n->next;
+                n->next = NULL;
+                if (tbl->pdestructor)
+                        tbl->pdestructor(n);
+                if (n->dev)
+                        dev_put(n->dev);
+                kfree(n);
+        }
        return -ENOENT;
 }
@@ -2323,12 +2331,16 @@ static int neigh_dump_table(struct neigh_table *tbl, struct sk_buff *skb,
        err = nlmsg_parse(nlh, sizeof(struct ndmsg), tb, NDA_MAX, NULL, NULL);
        if (!err) {
-                if (tb[NDA_IFINDEX])
+                if (tb[NDA_IFINDEX]) {
+                        if (nla_len(tb[NDA_IFINDEX]) != sizeof(u32))
+                                return -EINVAL;
                        filter_idx = nla_get_u32(tb[NDA_IFINDEX]);
+                }
-                if (tb[NDA_MASTER])
+                if (tb[NDA_MASTER]) {
+                        if (nla_len(tb[NDA_MASTER]) != sizeof(u32))
+                                return -EINVAL;
                        filter_master_idx = nla_get_u32(tb[NDA_MASTER]);
+                }
                if (filter_idx || filter_master_idx)
                        flags |= NLM_F_DUMP_FILTERED;
        }
diff --git a/net/dns_resolver/dns_key.c b/net/dns_resolver/dns_key.c
index 8396705deffc..40c851693f77 100644
--- a/net/dns_resolver/dns_key.c
+++ b/net/dns_resolver/dns_key.c
@@ -91,9 +91,9 @@ dns_resolver_preparse(struct key_preparsed_payload *prep)
                        next_opt = memchr(opt, '#', end - opt) ?: end;
                        opt_len = next_opt - opt;
-                        if (!opt_len) {
+                        if (opt_len <= 0 || opt_len > 128) {
-                                printk(KERN_WARNING
+                                pr_warn_ratelimited("Invalid option length (%d) for dns_resolver key\n",
-                                       "Empty option to dns_resolver key\n");
+                                                    opt_len);
                                return -EINVAL;
                        }
@@ -127,10 +127,8 @@ dns_resolver_preparse(struct key_preparsed_payload *prep)
                        }
                bad_option_value:
-                        printk(KERN_WARNING
+                        pr_warn_ratelimited("Option '%*.*s' to dns_resolver key: bad/missing value\n",
-                               "Option '%*.*s' to dns_resolver key:"
+                                            opt_nlen, opt_nlen, opt);
-                               " bad/missing value\n",
-                               opt_nlen, opt_nlen, opt);
                        return -EINVAL;
                } while (opt = next_opt + 1, opt < end);
        }
diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
index 4c11b810a447..83c73bab2c3d 100644
--- a/net/ipv4/ip_output.c
+++ b/net/ipv4/ip_output.c
@@ -1109,6 +1109,10 @@ static int ip_setup_cork(struct sock *sk, struct inet_cork *cork,
        struct ip_options_rcu *opt;
        struct rtable *rt;
+        rt = *rtp;
+        if (unlikely(!rt))
+                return -EFAULT;
        /*
         * setup for corking.
         */
@@ -1124,9 +1128,7 @@ static int ip_setup_cork(struct sock *sk, struct inet_cork *cork,
                cork->flags |= IPCORK_OPT;
                cork->addr = ipc->addr;
        }
-        rt = *rtp;
-        if (unlikely(!rt))
-                return -EFAULT;
        /*
         * We steal reference to this route, caller should not release it
         */
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index bccc4c270087..9ce1c726185e 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -2368,6 +2368,7 @@ void tcp_write_queue_purge(struct sock *sk)
        INIT_LIST_HEAD(&tcp_sk(sk)->tsorted_sent_queue);
        sk_mem_reclaim(sk);
        tcp_clear_all_retrans_hints(tcp_sk(sk));
+        tcp_sk(sk)->packets_out = 0;
 }
 int tcp_disconnect(struct sock *sk, int flags)
@@ -2417,7 +2418,6 @@ int tcp_disconnect(struct sock *sk, int flags)
        icsk->icsk_backoff = 0;
        tp->snd_cwnd = 2;
        icsk->icsk_probes_out = 0;
-        tp->packets_out = 0;
        tp->snd_ssthresh = TCP_INFINITE_SSTHRESH;
        tp->snd_cwnd_cnt = 0;
        tp->window_clamp = 0;
@@ -2813,8 +2813,10 @@ static int do_tcp_setsockopt(struct sock *sk, int level,
 #ifdef CONFIG_TCP_MD5SIG
        case TCP_MD5SIG:
        case TCP_MD5SIG_EXT:
-                /* Read the IP->Key mappings from userspace */
+                if ((1 << sk->sk_state) & (TCPF_CLOSE | TCPF_LISTEN))
-                err = tp->af_specific->md5_parse(sk, optname, optval, optlen);
+                        err = tp->af_specific->md5_parse(sk, optname, optval, optlen);
+                else
+                        err = -EINVAL;
                break;
 #endif
        case TCP_USER_TIMEOUT:
diff --git a/net/l2tp/l2tp_core.c b/net/l2tp/l2tp_core.c
index 0fbd3ee26165..40261cb68e83 100644
--- a/net/l2tp/l2tp_core.c
+++ b/net/l2tp/l2tp_core.c
@@ -183,6 +183,26 @@ struct l2tp_tunnel *l2tp_tunnel_get(const struct net *net, u32 tunnel_id)
 }
 EXPORT_SYMBOL_GPL(l2tp_tunnel_get);
+struct l2tp_tunnel *l2tp_tunnel_get_nth(const struct net *net, int nth)
+{
+        const struct l2tp_net *pn = l2tp_pernet(net);
+        struct l2tp_tunnel *tunnel;
+        int count = 0;
+        rcu_read_lock_bh();
+        list_for_each_entry_rcu(tunnel, &pn->l2tp_tunnel_list, list) {
+                if (++count > nth) {
+                        l2tp_tunnel_inc_refcount(tunnel);
+                        rcu_read_unlock_bh();
+                        return tunnel;
+                }
+        }
+        rcu_read_unlock_bh();
+        return NULL;
+}
+EXPORT_SYMBOL_GPL(l2tp_tunnel_get_nth);
 /* Lookup a session. A new reference is held on the returned session. */
 struct l2tp_session *l2tp_session_get(const struct net *net,
                                      struct l2tp_tunnel *tunnel,
@@ -335,26 +355,6 @@ err_tlock:
 }
 EXPORT_SYMBOL_GPL(l2tp_session_register);
-struct l2tp_tunnel *l2tp_tunnel_find_nth(const struct net *net, int nth)
-{
-        struct l2tp_net *pn = l2tp_pernet(net);
-        struct l2tp_tunnel *tunnel;
-        int count = 0;
-        rcu_read_lock_bh();
-        list_for_each_entry_rcu(tunnel, &pn->l2tp_tunnel_list, list) {
-                if (++count > nth) {
-                        rcu_read_unlock_bh();
-                        return tunnel;
-                }
-        }
-        rcu_read_unlock_bh();
-        return NULL;
-}
-EXPORT_SYMBOL_GPL(l2tp_tunnel_find_nth);
 /*****************************************************************************
 * Receive data handling
 *****************************************************************************/
diff --git a/net/l2tp/l2tp_core.h b/net/l2tp/l2tp_core.h
index ba33cbec71eb..c199020f8a8a 100644
--- a/net/l2tp/l2tp_core.h
+++ b/net/l2tp/l2tp_core.h
@@ -212,6 +212,8 @@ static inline void *l2tp_session_priv(struct l2tp_session *session)
 }
 struct l2tp_tunnel *l2tp_tunnel_get(const struct net *net, u32 tunnel_id);
+struct l2tp_tunnel *l2tp_tunnel_get_nth(const struct net *net, int nth);
 void l2tp_tunnel_free(struct l2tp_tunnel *tunnel);
 struct l2tp_session *l2tp_session_get(const struct net *net,
@@ -220,7 +222,6 @@ struct l2tp_session *l2tp_session_get(const struct net *net,
 struct l2tp_session *l2tp_session_get_nth(struct l2tp_tunnel *tunnel, int nth);
 struct l2tp_session *l2tp_session_get_by_ifname(const struct net *net,
                                                const char *ifname);
-struct l2tp_tunnel *l2tp_tunnel_find_nth(const struct net *net, int nth);
 int l2tp_tunnel_create(struct net *net, int fd, int version, u32 tunnel_id,
                       u32 peer_tunnel_id, struct l2tp_tunnel_cfg *cfg,
diff --git a/net/l2tp/l2tp_debugfs.c b/net/l2tp/l2tp_debugfs.c
index 72e713da4733..b8f9d45bfeb1 100644
--- a/net/l2tp/l2tp_debugfs.c
+++ b/net/l2tp/l2tp_debugfs.c
@@ -47,7 +47,11 @@ struct l2tp_dfs_seq_data {
 static void l2tp_dfs_next_tunnel(struct l2tp_dfs_seq_data *pd)
 {
-        pd->tunnel = l2tp_tunnel_find_nth(pd->net, pd->tunnel_idx);
+        /* Drop reference taken during previous invocation */
+        if (pd->tunnel)
+                l2tp_tunnel_dec_refcount(pd->tunnel);
+        pd->tunnel = l2tp_tunnel_get_nth(pd->net, pd->tunnel_idx);
        pd->tunnel_idx++;
 }
@@ -96,7 +100,14 @@ static void *l2tp_dfs_seq_next(struct seq_file *m, void *v, loff_t *pos)
 static void l2tp_dfs_seq_stop(struct seq_file *p, void *v)
 {
-        /* nothing to do */
+        struct l2tp_dfs_seq_data *pd = v;
+        if (!pd || pd == SEQ_START_TOKEN)
+                return;
+        /* Drop reference taken by last invocation of l2tp_dfs_next_tunnel() */
+        if (pd->tunnel)
+                l2tp_tunnel_dec_refcount(pd->tunnel);
 }
 static void l2tp_dfs_seq_tunnel_show(struct seq_file *m, void *v)
diff --git a/net/l2tp/l2tp_netlink.c b/net/l2tp/l2tp_netlink.c
index b05dbd9ffcb2..6616c9fd292f 100644
--- a/net/l2tp/l2tp_netlink.c
+++ b/net/l2tp/l2tp_netlink.c
@@ -487,14 +487,17 @@ static int l2tp_nl_cmd_tunnel_dump(struct sk_buff *skb, struct netlink_callback
        struct net *net = sock_net(skb->sk);
        for (;;) {
-                tunnel = l2tp_tunnel_find_nth(net, ti);
+                tunnel = l2tp_tunnel_get_nth(net, ti);
                if (tunnel == NULL)
                        goto out;
                if (l2tp_nl_tunnel_send(skb, NETLINK_CB(cb->skb).portid,
                                        cb->nlh->nlmsg_seq, NLM_F_MULTI,
-                                        tunnel, L2TP_CMD_TUNNEL_GET) < 0)
+                                        tunnel, L2TP_CMD_TUNNEL_GET) < 0) {
+                        l2tp_tunnel_dec_refcount(tunnel);
                        goto out;
+                }
+                l2tp_tunnel_dec_refcount(tunnel);
                ti++;
        }
@@ -848,7 +851,7 @@ static int l2tp_nl_cmd_session_dump(struct sk_buff *skb, struct netlink_callback
        for (;;) {
                if (tunnel == NULL) {
-                        tunnel = l2tp_tunnel_find_nth(net, ti);
+                        tunnel = l2tp_tunnel_get_nth(net, ti);
                        if (tunnel == NULL)
                                goto out;
                }
@@ -856,6 +859,7 @@ static int l2tp_nl_cmd_session_dump(struct sk_buff *skb, struct netlink_callback
                session = l2tp_session_get_nth(tunnel, si);
                if (session == NULL) {
                        ti++;
+                        l2tp_tunnel_dec_refcount(tunnel);
                        tunnel = NULL;
                        si = 0;
                        continue;
@@ -865,6 +869,7 @@ static int l2tp_nl_cmd_session_dump(struct sk_buff *skb, struct netlink_callback
                                         cb->nlh->nlmsg_seq, NLM_F_MULTI,
                                         session, L2TP_CMD_SESSION_GET) < 0) {
                        l2tp_session_dec_refcount(session);
+                        l2tp_tunnel_dec_refcount(tunnel);
                        break;
                }
                l2tp_session_dec_refcount(session);
diff --git a/net/l2tp/l2tp_ppp.c b/net/l2tp/l2tp_ppp.c
index 896bbca9bdaa..7d0c963680e6 100644
--- a/net/l2tp/l2tp_ppp.c
+++ b/net/l2tp/l2tp_ppp.c
@@ -1551,16 +1551,19 @@ struct pppol2tp_seq_data {
 static void pppol2tp_next_tunnel(struct net *net, struct pppol2tp_seq_data *pd)
 {
+        /* Drop reference taken during previous invocation */
+        if (pd->tunnel)
+                l2tp_tunnel_dec_refcount(pd->tunnel);
        for (;;) {
-                pd->tunnel = l2tp_tunnel_find_nth(net, pd->tunnel_idx);
+                pd->tunnel = l2tp_tunnel_get_nth(net, pd->tunnel_idx);
                pd->tunnel_idx++;
-                if (pd->tunnel == NULL)
+                /* Only accept L2TPv2 tunnels */
-                        break;
+                if (!pd->tunnel || pd->tunnel->version == 2)
+                        return;
-                /* Ignore L2TPv3 tunnels */
+                l2tp_tunnel_dec_refcount(pd->tunnel);
-                if (pd->tunnel->version < 3)
-                        break;
        }
 }
@@ -1609,7 +1612,14 @@ static void *pppol2tp_seq_next(struct seq_file *m, void *v, loff_t *pos)
 static void pppol2tp_seq_stop(struct seq_file *p, void *v)
 {
-        /* nothing to do */
+        struct pppol2tp_seq_data *pd = v;
+        if (!pd || pd == SEQ_START_TOKEN)
+                return;
+        /* Drop reference taken by last invocation of pppol2tp_next_tunnel() */
+        if (pd->tunnel)
+                l2tp_tunnel_dec_refcount(pd->tunnel);
 }
 static void pppol2tp_seq_tunnel_show(struct seq_file *m, void *v)
diff --git a/net/llc/af_llc.c b/net/llc/af_llc.c
index 01dcc0823d1f..6d29b2b94e84 100644
--- a/net/llc/af_llc.c
+++ b/net/llc/af_llc.c
@@ -189,6 +189,7 @@ static int llc_ui_release(struct socket *sock)
 {
        struct sock *sk = sock->sk;
        struct llc_sock *llc;
+        struct llc_sap *sap;
        if (unlikely(sk == NULL))
                goto out;
@@ -199,9 +200,15 @@ static int llc_ui_release(struct socket *sock)
                llc->laddr.lsap, llc->daddr.lsap);
        if (!llc_send_disc(sk))
                llc_ui_wait_for_disc(sk, sk->sk_rcvtimeo);
+        sap = llc->sap;
+        /* Hold this for release_sock(), so that llc_backlog_rcv() could still
+         * use it.
+         */
+        llc_sap_hold(sap);
        if (!sock_flag(sk, SOCK_ZAPPED))
                llc_sap_remove_socket(llc->sap, sk);
        release_sock(sk);
+        llc_sap_put(sap);
        if (llc->dev)
                dev_put(llc->dev);
        sock_put(sk);
diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
index 616cb9c18f88..c31b0687396a 100644
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -3008,6 +3008,7 @@ static int packet_release(struct socket *sock)
        packet_flush_mclist(sk);
+        lock_sock(sk);
        if (po->rx_ring.pg_vec) {
                memset(&req_u, 0, sizeof(req_u));
                packet_set_ring(sk, &req_u, 1, 0);
@@ -3017,6 +3018,7 @@ static int packet_release(struct socket *sock)
                memset(&req_u, 0, sizeof(req_u));
                packet_set_ring(sk, &req_u, 1, 1);
        }
+        release_sock(sk);
        f = fanout_release(sk);
@@ -3643,6 +3645,7 @@ packet_setsockopt(struct socket *sock, int level, int optname, char __user *optv
                union tpacket_req_u req_u;
                int len;
+                lock_sock(sk);
                switch (po->tp_version) {
                case TPACKET_V1:
                case TPACKET_V2:
@@ -3653,12 +3656,17 @@ packet_setsockopt(struct socket *sock, int level, int optname, char __user *optv
                        len = sizeof(req_u.req3);
                        break;
                }
-                if (optlen < len)
+                if (optlen < len) {
-                        return -EINVAL;
+                        ret = -EINVAL;
-                if (copy_from_user(&req_u.req, optval, len))
+                } else {
-                        return -EFAULT;
+                        if (copy_from_user(&req_u.req, optval, len))
-                return packet_set_ring(sk, &req_u, 0,
+                                ret = -EFAULT;
-                        optname == PACKET_TX_RING);
+                        else
+                                ret = packet_set_ring(sk, &req_u, 0,
+                                                    optname == PACKET_TX_RING);
+                }
+                release_sock(sk);
+                return ret;
        }
        case PACKET_COPY_THRESH:
        {
@@ -4208,8 +4216,6 @@ static int packet_set_ring(struct sock *sk, union tpacket_req_u *req_u,
        /* Added to avoid minimal code churn */
        struct tpacket_req *req = &req_u->req;
-        lock_sock(sk);
        rb = tx_ring ? &po->tx_ring : &po->rx_ring;
        rb_queue = tx_ring ? &sk->sk_write_queue : &sk->sk_receive_queue;
@@ -4347,7 +4353,6 @@ static int packet_set_ring(struct sock *sk, union tpacket_req_u *req_u,
        if (pg_vec)
                free_pg_vec(pg_vec, order, req->tp_block_nr);
 out:
-        release_sock(sk);
        return err;
 }
diff --git a/net/qrtr/qrtr.c b/net/qrtr/qrtr.c
index b33e5aeb4c06..2aa07b547b16 100644
--- a/net/qrtr/qrtr.c
+++ b/net/qrtr/qrtr.c
@@ -1135,3 +1135,4 @@ module_exit(qrtr_proto_fini);
 MODULE_DESCRIPTION("Qualcomm IPC-router driver");
 MODULE_LICENSE("GPL v2");
+MODULE_ALIAS_NETPROTO(PF_QIPCRTR);
diff --git a/net/sctp/ipv6.c b/net/sctp/ipv6.c
index 31083b5035ec..2e3f7b75a8ec 100644
--- a/net/sctp/ipv6.c
+++ b/net/sctp/ipv6.c
@@ -556,46 +556,49 @@ static void sctp_v6_to_addr(union sctp_addr *addr, struct in6_addr *saddr,
        addr->v6.sin6_scope_id = 0;
 }
-/* Compare addresses exactly.
+static int __sctp_v6_cmp_addr(const union sctp_addr *addr1,
- * v4-mapped-v6 is also in consideration.
+                              const union sctp_addr *addr2)
- */
-static int sctp_v6_cmp_addr(const union sctp_addr *addr1,
-                            const union sctp_addr *addr2)
 {
        if (addr1->sa.sa_family != addr2->sa.sa_family) {
                if (addr1->sa.sa_family == AF_INET &&
                    addr2->sa.sa_family == AF_INET6 &&
-                    ipv6_addr_v4mapped(&addr2->v6.sin6_addr)) {
+                    ipv6_addr_v4mapped(&addr2->v6.sin6_addr) &&
-                        if (addr2->v6.sin6_port == addr1->v4.sin_port &&
+                    addr2->v6.sin6_addr.s6_addr32[3] ==
-                            addr2->v6.sin6_addr.s6_addr32[3] ==
+                    addr1->v4.sin_addr.s_addr)
-                            addr1->v4.sin_addr.s_addr)
+                        return 1;
-                                return 1;
-                }
                if (addr2->sa.sa_family == AF_INET &&
                    addr1->sa.sa_family == AF_INET6 &&
-                    ipv6_addr_v4mapped(&addr1->v6.sin6_addr)) {
+                    ipv6_addr_v4mapped(&addr1->v6.sin6_addr) &&
-                        if (addr1->v6.sin6_port == addr2->v4.sin_port &&
+                    addr1->v6.sin6_addr.s6_addr32[3] ==
-                            addr1->v6.sin6_addr.s6_addr32[3] ==
+                    addr2->v4.sin_addr.s_addr)
-                            addr2->v4.sin_addr.s_addr)
+                        return 1;
-                                return 1;
-                }
                return 0;
        }
-        if (addr1->v6.sin6_port != addr2->v6.sin6_port)
-                return 0;
        if (!ipv6_addr_equal(&addr1->v6.sin6_addr, &addr2->v6.sin6_addr))
                return 0;
        /* If this is a linklocal address, compare the scope_id. */
-        if (ipv6_addr_type(&addr1->v6.sin6_addr) & IPV6_ADDR_LINKLOCAL) {
+        if ((ipv6_addr_type(&addr1->v6.sin6_addr) & IPV6_ADDR_LINKLOCAL) &&
-                if (addr1->v6.sin6_scope_id && addr2->v6.sin6_scope_id &&
+            addr1->v6.sin6_scope_id && addr2->v6.sin6_scope_id &&
-                    (addr1->v6.sin6_scope_id != addr2->v6.sin6_scope_id)) {
+            addr1->v6.sin6_scope_id != addr2->v6.sin6_scope_id)
-                        return 0;
+                return 0;
-                }
-        }
        return 1;
 }
+/* Compare addresses exactly.
+ * v4-mapped-v6 is also in consideration.
+ */
+static int sctp_v6_cmp_addr(const union sctp_addr *addr1,
+                            const union sctp_addr *addr2)
+{
+        return __sctp_v6_cmp_addr(addr1, addr2) &&
+               addr1->v6.sin6_port == addr2->v6.sin6_port;
+}
 /* Initialize addr struct to INADDR_ANY. */
 static void sctp_v6_inaddr_any(union sctp_addr *addr, __be16 port)
 {
@@ -875,8 +878,8 @@ static int sctp_inet6_cmp_addr(const union sctp_addr *addr1,
                               const union sctp_addr *addr2,
                               struct sctp_sock *opt)
 {
-        struct sctp_af *af1, *af2;
        struct sock *sk = sctp_opt2sk(opt);
+        struct sctp_af *af1, *af2;
        af1 = sctp_get_af_specific(addr1->sa.sa_family);
        af2 = sctp_get_af_specific(addr2->sa.sa_family);
@@ -892,10 +895,7 @@ static int sctp_inet6_cmp_addr(const union sctp_addr *addr1,
        if (sctp_is_any(sk, addr1) || sctp_is_any(sk, addr2))
                return 1;
-        if (addr1->sa.sa_family != addr2->sa.sa_family)
+        return __sctp_v6_cmp_addr(addr1, addr2);
-                return 0;
-        return af1->cmp_addr(addr1, addr2);
 }
 /* Verify that the provided sockaddr looks bindable.   Common verification,
diff --git a/net/smc/af_smc.c b/net/smc/af_smc.c
index 5f8046c62d90..f5d4b69dbabc 100644
--- a/net/smc/af_smc.c
+++ b/net/smc/af_smc.c
@@ -1259,14 +1259,12 @@ static int smc_shutdown(struct socket *sock, int how)
                rc = smc_close_shutdown_write(smc);
                break;
        case SHUT_RD:
-                if (sk->sk_state == SMC_LISTEN)
+                rc = 0;
-                        rc = smc_close_active(smc);
+                /* nothing more to do because peer is not involved */
-                else
-                        rc = 0;
-                        /* nothing more to do because peer is not involved */
                break;
        }
-        rc1 = kernel_sock_shutdown(smc->clcsock, how);
+        if (smc->clcsock)
+                rc1 = kernel_sock_shutdown(smc->clcsock, how);
        /* map sock_shutdown_cmd constants to sk_shutdown value range */
        sk->sk_shutdown |= how + 1;
diff --git a/net/strparser/strparser.c b/net/strparser/strparser.c
index b9283ce5cd85..805b139756db 100644
--- a/net/strparser/strparser.c
+++ b/net/strparser/strparser.c
@@ -296,9 +296,9 @@ static int __strp_recv(read_descriptor_t *desc, struct sk_buff *orig_skb,
                                        strp_start_timer(strp, timeo);
                                }
+                                stm->accum_len += cand_len;
                                strp->need_bytes = stm->strp.full_len -
                                                       stm->accum_len;
-                                stm->accum_len += cand_len;
                                stm->early_eaten = cand_len;
                                STRP_STATS_ADD(strp->stats.bytes, cand_len);
                                desc->count = 0; /* Stop reading socket */
@@ -321,6 +321,7 @@ static int __strp_recv(read_descriptor_t *desc, struct sk_buff *orig_skb,
                /* Hurray, we have a new message! */
                cancel_delayed_work(&strp->msg_timer_work);
                strp->skb_head = NULL;
+                strp->need_bytes = 0;
                STRP_STATS_INCR(strp->stats.msgs);
                /* Give skb to upper layer */
@@ -410,9 +411,7 @@ void strp_data_ready(struct strparser *strp)
                return;
        if (strp->need_bytes) {
-                if (strp_peek_len(strp) >= strp->need_bytes)
+                if (strp_peek_len(strp) < strp->need_bytes)
-                        strp->need_bytes = 0;
-                else
                        return;
        }
diff --git a/net/sunrpc/rpc_pipe.c b/net/sunrpc/rpc_pipe.c
index 0f08934b2cea..c81ef5e6c981 100644
--- a/net/sunrpc/rpc_pipe.c
+++ b/net/sunrpc/rpc_pipe.c
@@ -1375,6 +1375,7 @@ rpc_gssd_dummy_depopulate(struct dentry *pipe_dentry)
        struct dentry *clnt_dir = pipe_dentry->d_parent;
        struct dentry *gssd_dir = clnt_dir->d_parent;
+        dget(pipe_dentry);
        __rpc_rmpipe(d_inode(clnt_dir), pipe_dentry);
        __rpc_depopulate(clnt_dir, gssd_dummy_info_file, 0, 1);
        __rpc_depopulate(gssd_dir, gssd_dummy_clnt_dir, 0, 1);
diff --git a/net/tipc/monitor.c b/net/tipc/monitor.c
index 32dc33a94bc7..5453e564da82 100644
--- a/net/tipc/monitor.c
+++ b/net/tipc/monitor.c
@@ -777,7 +777,7 @@ int __tipc_nl_add_monitor(struct net *net, struct tipc_nl_msg *msg,
        ret = tipc_bearer_get_name(net, bearer_name, bearer_id);
        if (ret || !mon)
-                return -EINVAL;
+                return 0;
        hdr = genlmsg_put(msg->skb, msg->portid, msg->seq, &tipc_genl_family,
                          NLM_F_MULTI, TIPC_NL_MON_GET);
diff --git a/net/tipc/name_table.c b/net/tipc/name_table.c
index b1fe20972aa9..dd1c4fa2eb78 100644
--- a/net/tipc/name_table.c
+++ b/net/tipc/name_table.c
@@ -241,7 +241,8 @@ err:
 static struct publication *tipc_service_remove_publ(struct net *net,
                                                    struct tipc_service *sc,
                                                    u32 lower, u32 upper,
-                                                    u32 node, u32 key)
+                                                    u32 node, u32 key,
+                                                    struct service_range **rng)
 {
        struct tipc_subscription *sub, *tmp;
        struct service_range *sr;
@@ -275,19 +276,15 @@ static struct publication *tipc_service_remove_publ(struct net *net,
        list_del(&p->all_publ);
        list_del(&p->local_publ);
+        if (list_empty(&sr->all_publ))
-        /* Remove service range item if this was its last publication */
-        if (list_empty(&sr->all_publ)) {
                last = true;
-                rb_erase(&sr->tree_node, &sc->ranges);
-                kfree(sr);
-        }
        /* Notify any waiting subscriptions */
        list_for_each_entry_safe(sub, tmp, &sc->subscriptions, service_list) {
                tipc_sub_report_overlap(sub, p->lower, p->upper, TIPC_WITHDRAWN,
                                        p->port, p->node, p->scope, last);
        }
+        *rng = sr;
        return p;
 }
@@ -379,13 +376,20 @@ struct publication *tipc_nametbl_remove_publ(struct net *net, u32 type,
                                             u32 node, u32 key)
 {
        struct tipc_service *sc = tipc_service_find(net, type);
+        struct service_range *sr = NULL;
        struct publication *p = NULL;
        if (!sc)
                return NULL;
        spin_lock_bh(&sc->lock);
-        p = tipc_service_remove_publ(net, sc, lower, upper, node, key);
+        p = tipc_service_remove_publ(net, sc, lower, upper, node, key, &sr);
+        /* Remove service range item if this was its last publication */
+        if (sr && list_empty(&sr->all_publ)) {
+                rb_erase(&sr->tree_node, &sc->ranges);
+                kfree(sr);
+        }
        /* Delete service item if this no more publications and subscriptions */
        if (RB_EMPTY_ROOT(&sc->ranges) && list_empty(&sc->subscriptions)) {
@@ -665,13 +669,14 @@ int tipc_nametbl_withdraw(struct net *net, u32 type, u32 lower,
 /**
 * tipc_nametbl_subscribe - add a subscription object to the name table
 */
-void tipc_nametbl_subscribe(struct tipc_subscription *sub)
+bool tipc_nametbl_subscribe(struct tipc_subscription *sub)
 {
        struct name_table *nt = tipc_name_table(sub->net);
        struct tipc_net *tn = tipc_net(sub->net);
        struct tipc_subscr *s = &sub->evt.s;
        u32 type = tipc_sub_read(s, seq.type);
        struct tipc_service *sc;
+        bool res = true;
        spin_lock_bh(&tn->nametbl_lock);
        sc = tipc_service_find(sub->net, type);
@@ -685,8 +690,10 @@ void tipc_nametbl_subscribe(struct tipc_subscription *sub)
                pr_warn("Failed to subscribe for {%u,%u,%u}\n", type,
                        tipc_sub_read(s, seq.lower),
                        tipc_sub_read(s, seq.upper));
+                res = false;
        }
        spin_unlock_bh(&tn->nametbl_lock);
+        return res;
 }
 /**
@@ -744,16 +751,17 @@ int tipc_nametbl_init(struct net *net)
 static void tipc_service_delete(struct net *net, struct tipc_service *sc)
 {
        struct service_range *sr, *tmpr;
-        struct publication *p, *tmpb;
+        struct publication *p, *tmp;
        spin_lock_bh(&sc->lock);
        rbtree_postorder_for_each_entry_safe(sr, tmpr, &sc->ranges, tree_node) {
-                list_for_each_entry_safe(p, tmpb,
+                list_for_each_entry_safe(p, tmp, &sr->all_publ, all_publ) {
-                                         &sr->all_publ, all_publ) {
                        tipc_service_remove_publ(net, sc, p->lower, p->upper,
-                                                 p->node, p->key);
+                                                 p->node, p->key, &sr);
                        kfree_rcu(p, rcu);
                }
+                rb_erase(&sr->tree_node, &sc->ranges);
+                kfree(sr);
        }
        hlist_del_init_rcu(&sc->service_list);
        spin_unlock_bh(&sc->lock);
diff --git a/net/tipc/name_table.h b/net/tipc/name_table.h
index 4b14fc28d9e2..0febba41da86 100644
--- a/net/tipc/name_table.h
+++ b/net/tipc/name_table.h
@@ -126,7 +126,7 @@ struct publication *tipc_nametbl_insert_publ(struct net *net, u32 type,
 struct publication *tipc_nametbl_remove_publ(struct net *net, u32 type,
                                             u32 lower, u32 upper,
                                             u32 node, u32 key);
-void tipc_nametbl_subscribe(struct tipc_subscription *s);
+bool tipc_nametbl_subscribe(struct tipc_subscription *s);
 void tipc_nametbl_unsubscribe(struct tipc_subscription *s);
 int tipc_nametbl_init(struct net *net);
 void tipc_nametbl_stop(struct net *net);
diff --git a/net/tipc/net.c b/net/tipc/net.c
index 856f9e97ea29..4fbaa0464405 100644
--- a/net/tipc/net.c
+++ b/net/tipc/net.c
@@ -252,6 +252,8 @@ int __tipc_nl_net_set(struct sk_buff *skb, struct genl_info *info)
                u64 *w0 = (u64 *)&node_id[0];
                u64 *w1 = (u64 *)&node_id[8];
+                if (!attrs[TIPC_NLA_NET_NODEID_W1])
+                        return -EINVAL;
                *w0 = nla_get_u64(attrs[TIPC_NLA_NET_NODEID]);
                *w1 = nla_get_u64(attrs[TIPC_NLA_NET_NODEID_W1]);
                tipc_net_init(net, node_id, 0);
diff --git a/net/tipc/netlink.c b/net/tipc/netlink.c
index b76f13f6fea1..6ff2254088f6 100644
--- a/net/tipc/netlink.c
+++ b/net/tipc/netlink.c
@@ -79,7 +79,10 @@ const struct nla_policy tipc_nl_sock_policy[TIPC_NLA_SOCK_MAX + 1] = {
 const struct nla_policy tipc_nl_net_policy[TIPC_NLA_NET_MAX + 1] = {
        [TIPC_NLA_NET_UNSPEC]           = { .type = NLA_UNSPEC },
-        [TIPC_NLA_NET_ID]               = { .type = NLA_U32 }
+        [TIPC_NLA_NET_ID]               = { .type = NLA_U32 },
+        [TIPC_NLA_NET_ADDR]             = { .type = NLA_U32 },
+        [TIPC_NLA_NET_NODEID]           = { .type = NLA_U64 },
+        [TIPC_NLA_NET_NODEID_W1]        = { .type = NLA_U64 },
 };
 const struct nla_policy tipc_nl_link_policy[TIPC_NLA_LINK_MAX + 1] = {
diff --git a/net/tipc/node.c b/net/tipc/node.c
index c77dd2f3c589..6f98b56dd48e 100644
--- a/net/tipc/node.c
+++ b/net/tipc/node.c
@@ -2232,8 +2232,8 @@ int tipc_nl_node_dump_monitor(struct sk_buff *skb, struct netlink_callback *cb)
        struct net *net = sock_net(skb->sk);
        u32 prev_bearer = cb->args[0];
        struct tipc_nl_msg msg;
+        int bearer_id;
        int err;
-        int i;
        if (prev_bearer == MAX_BEARERS)
                return 0;
@@ -2243,16 +2243,13 @@ int tipc_nl_node_dump_monitor(struct sk_buff *skb, struct netlink_callback *cb)
        msg.seq = cb->nlh->nlmsg_seq;
        rtnl_lock();
-        for (i = prev_bearer; i < MAX_BEARERS; i++) {
+        for (bearer_id = prev_bearer; bearer_id < MAX_BEARERS; bearer_id++) {
-                prev_bearer = i;
                err = __tipc_nl_add_monitor(net, &msg, prev_bearer);
                if (err)
-                        goto out;
+                        break;
        }
-out:
        rtnl_unlock();
-        cb->args[0] = prev_bearer;
+        cb->args[0] = bearer_id;
        return skb->len;
 }
diff --git a/net/tipc/socket.c b/net/tipc/socket.c
index 1fd1c8b5ce03..252a52ae0893 100644
--- a/net/tipc/socket.c
+++ b/net/tipc/socket.c
@@ -1278,7 +1278,7 @@ static int __tipc_sendmsg(struct socket *sock, struct msghdr *m, size_t dlen)
        struct tipc_msg *hdr = &tsk->phdr;
        struct tipc_name_seq *seq;
        struct sk_buff_head pkts;
-        u32 dnode, dport;
+        u32 dport, dnode = 0;
        u32 type, inst;
        int mtu, rc;
@@ -1348,6 +1348,8 @@ static int __tipc_sendmsg(struct socket *sock, struct msghdr *m, size_t dlen)
                msg_set_destnode(hdr, dnode);
                msg_set_destport(hdr, dest->addr.id.ref);
                msg_set_hdr_sz(hdr, BASIC_H_SIZE);
+        } else {
+                return -EINVAL;
        }
        /* Block or return if destination link is congested */
diff --git a/net/tipc/subscr.c b/net/tipc/subscr.c
index b7d80bc5f4ab..f340e53da625 100644
--- a/net/tipc/subscr.c
+++ b/net/tipc/subscr.c
@@ -153,7 +153,10 @@ struct tipc_subscription *tipc_sub_subscribe(struct net *net,
        memcpy(&sub->evt.s, s, sizeof(*s));
        spin_lock_init(&sub->lock);
        kref_init(&sub->kref);
-        tipc_nametbl_subscribe(sub);
+        if (!tipc_nametbl_subscribe(sub)) {
+                kfree(sub);
+                return NULL;
+        }
        timer_setup(&sub->timer, tipc_sub_timeout, 0);
        timeout = tipc_sub_read(&sub->evt.s, timeout);
        if (timeout != TIPC_WAIT_FOREVER)
diff --git a/net/tls/tls_sw.c b/net/tls/tls_sw.c
index 4dc766b03f00..71e79597f940 100644
--- a/net/tls/tls_sw.c
+++ b/net/tls/tls_sw.c
@@ -41,6 +41,8 @@
 #include <net/strparser.h>
 #include <net/tls.h>
+#define MAX_IV_SIZE     TLS_CIPHER_AES_GCM_128_IV_SIZE
 static int tls_do_decryption(struct sock *sk,
                             struct scatterlist *sgin,
                             struct scatterlist *sgout,
@@ -673,7 +675,7 @@ static int decrypt_skb(struct sock *sk, struct sk_buff *skb,
 {
        struct tls_context *tls_ctx = tls_get_ctx(sk);
        struct tls_sw_context *ctx = tls_sw_ctx(tls_ctx);
-        char iv[TLS_CIPHER_AES_GCM_128_SALT_SIZE + tls_ctx->rx.iv_size];
+        char iv[TLS_CIPHER_AES_GCM_128_SALT_SIZE + MAX_IV_SIZE];
        struct scatterlist sgin_arr[MAX_SKB_FRAGS + 2];
        struct scatterlist *sgin = &sgin_arr[0];
        struct strp_msg *rxm = strp_msg(skb);
@@ -1094,6 +1096,12 @@ int tls_set_sw_offload(struct sock *sk, struct tls_context *ctx, int tx)
                goto free_priv;
        }
+        /* Sanity-check the IV size for stack allocations. */
+        if (iv_size > MAX_IV_SIZE) {
+                rc = -EINVAL;
+                goto free_priv;
+        }
        cctx->prepend_size = TLS_HEADER_SIZE + nonce_size;
        cctx->tag_size = tag_size;
        cctx->overhead_size = cctx->prepend_size + cctx->tag_size;
diff --git a/net/vmw_vsock/af_vsock.c b/net/vmw_vsock/af_vsock.c
index aac9b8f6552e..c1076c19b858 100644
--- a/net/vmw_vsock/af_vsock.c
+++ b/net/vmw_vsock/af_vsock.c
@@ -2018,7 +2018,13 @@ const struct vsock_transport *vsock_core_get_transport(void)
 }
 EXPORT_SYMBOL_GPL(vsock_core_get_transport);
+static void __exit vsock_exit(void)
+{
+        /* Do nothing.  This function makes this module removable. */
+}
 module_init(vsock_init_tables);
+module_exit(vsock_exit);
 MODULE_AUTHOR("VMware, Inc.");
 MODULE_DESCRIPTION("VMware Virtual Socket Family");
diff --git a/samples/livepatch/livepatch-shadow-fix1.c b/samples/livepatch/livepatch-shadow-fix1.c
index 830c55514f9f..49b13553eaae 100644
--- a/samples/livepatch/livepatch-shadow-fix1.c
+++ b/samples/livepatch/livepatch-shadow-fix1.c
@@ -56,6 +56,21 @@ struct dummy {
        unsigned long jiffies_expire;
 };
+/*
+ * The constructor makes more sense together with klp_shadow_get_or_alloc().
+ * In this example, it would be safe to assign the pointer also to the shadow
+ * variable returned by klp_shadow_alloc().  But we wanted to show the more
+ * complicated use of the API.
+ */
+static int shadow_leak_ctor(void *obj, void *shadow_data, void *ctor_data)
+{
+        void **shadow_leak = shadow_data;
+        void *leak = ctor_data;
+        *shadow_leak = leak;
+        return 0;
+}
 struct dummy *livepatch_fix1_dummy_alloc(void)
 {
        struct dummy *d;
@@ -74,7 +89,8 @@ struct dummy *livepatch_fix1_dummy_alloc(void)
         * pointer to handle resource release.
         */
        leak = kzalloc(sizeof(int), GFP_KERNEL);
-        klp_shadow_alloc(d, SV_LEAK, &leak, sizeof(leak), GFP_KERNEL);
+        klp_shadow_alloc(d, SV_LEAK, sizeof(leak), GFP_KERNEL,
+                         shadow_leak_ctor, leak);
        pr_info("%s: dummy @ %p, expires @ %lx\n",
                __func__, d, d->jiffies_expire);
@@ -82,9 +98,19 @@ struct dummy *livepatch_fix1_dummy_alloc(void)
        return d;
 }
+static void livepatch_fix1_dummy_leak_dtor(void *obj, void *shadow_data)
+{
+        void *d = obj;
+        void **shadow_leak = shadow_data;
+        kfree(*shadow_leak);
+        pr_info("%s: dummy @ %p, prevented leak @ %p\n",
+                         __func__, d, *shadow_leak);
+}
 void livepatch_fix1_dummy_free(struct dummy *d)
 {
-        void **shadow_leak, *leak;
+        void **shadow_leak;
        /*
         * Patch: fetch the saved SV_LEAK shadow variable, detach and
@@ -93,15 +119,10 @@ void livepatch_fix1_dummy_free(struct dummy *d)
         * was loaded.)
         */
        shadow_leak = klp_shadow_get(d, SV_LEAK);
-        if (shadow_leak) {
+        if (shadow_leak)
-                leak = *shadow_leak;
+                klp_shadow_free(d, SV_LEAK, livepatch_fix1_dummy_leak_dtor);
-                klp_shadow_free(d, SV_LEAK);
+        else
-                kfree(leak);
-                pr_info("%s: dummy @ %p, prevented leak @ %p\n",
-                         __func__, d, leak);
-        } else {
                pr_info("%s: dummy @ %p leaked!\n", __func__, d);
-        }
        kfree(d);
 }
@@ -147,7 +168,7 @@ static int livepatch_shadow_fix1_init(void)
 static void livepatch_shadow_fix1_exit(void)
 {
        /* Cleanup any existing SV_LEAK shadow variables */
-        klp_shadow_free_all(SV_LEAK);
+        klp_shadow_free_all(SV_LEAK, livepatch_fix1_dummy_leak_dtor);
        WARN_ON(klp_unregister_patch(&patch));
 }
diff --git a/samples/livepatch/livepatch-shadow-fix2.c b/samples/livepatch/livepatch-shadow-fix2.c
index ff9948f0ec00..b34c7bf83356 100644
--- a/samples/livepatch/livepatch-shadow-fix2.c
+++ b/samples/livepatch/livepatch-shadow-fix2.c
@@ -53,39 +53,42 @@ struct dummy {
 bool livepatch_fix2_dummy_check(struct dummy *d, unsigned long jiffies)
 {
        int *shadow_count;
-        int count;
        /*
         * Patch: handle in-flight dummy structures, if they do not
         * already have a SV_COUNTER shadow variable, then attach a
         * new one.
         */
-        count = 0;
        shadow_count = klp_shadow_get_or_alloc(d, SV_COUNTER,
-                                               &count, sizeof(count),
+                                sizeof(*shadow_count), GFP_NOWAIT,
-                                               GFP_NOWAIT);
+                                NULL, NULL);
        if (shadow_count)
                *shadow_count += 1;
        return time_after(jiffies, d->jiffies_expire);
 }
+static void livepatch_fix2_dummy_leak_dtor(void *obj, void *shadow_data)
+{
+        void *d = obj;
+        void **shadow_leak = shadow_data;
+        kfree(*shadow_leak);
+        pr_info("%s: dummy @ %p, prevented leak @ %p\n",
+                         __func__, d, *shadow_leak);
+}
 void livepatch_fix2_dummy_free(struct dummy *d)
 {
-        void **shadow_leak, *leak;
+        void **shadow_leak;
        int *shadow_count;
        /* Patch: copy the memory leak patch from the fix1 module. */
        shadow_leak = klp_shadow_get(d, SV_LEAK);
-        if (shadow_leak) {
+        if (shadow_leak)
-                leak = *shadow_leak;
+                klp_shadow_free(d, SV_LEAK, livepatch_fix2_dummy_leak_dtor);
-                klp_shadow_free(d, SV_LEAK);
+        else
-                kfree(leak);
-                pr_info("%s: dummy @ %p, prevented leak @ %p\n",
-                         __func__, d, leak);
-        } else {
                pr_info("%s: dummy @ %p leaked!\n", __func__, d);
-        }
        /*
         * Patch: fetch the SV_COUNTER shadow variable and display
@@ -95,7 +98,7 @@ void livepatch_fix2_dummy_free(struct dummy *d)
        if (shadow_count) {
                pr_info("%s: dummy @ %p, check counter = %d\n",
                        __func__, d, *shadow_count);
-                klp_shadow_free(d, SV_COUNTER);
+                klp_shadow_free(d, SV_COUNTER, NULL);
        }
        kfree(d);
@@ -142,7 +145,7 @@ static int livepatch_shadow_fix2_init(void)
 static void livepatch_shadow_fix2_exit(void)
 {
        /* Cleanup any existing SV_COUNTER shadow variables */
-        klp_shadow_free_all(SV_COUNTER);
+        klp_shadow_free_all(SV_COUNTER, NULL);
        WARN_ON(klp_unregister_patch(&patch));
 }
diff --git a/sound/core/rawmidi_compat.c b/sound/core/rawmidi_compat.c
index f69764d7cdd7..e30e30ba6e39 100644
--- a/sound/core/rawmidi_compat.c
+++ b/sound/core/rawmidi_compat.c
@@ -36,8 +36,6 @@ static int snd_rawmidi_ioctl_params_compat(struct snd_rawmidi_file *rfile,
        struct snd_rawmidi_params params;
        unsigned int val;
-        if (rfile->output == NULL)
-                return -EINVAL;
        if (get_user(params.stream, &src->stream) ||
            get_user(params.buffer_size, &src->buffer_size) ||
            get_user(params.avail_min, &src->avail_min) ||
@@ -46,8 +44,12 @@ static int snd_rawmidi_ioctl_params_compat(struct snd_rawmidi_file *rfile,
        params.no_active_sensing = val;
        switch (params.stream) {
        case SNDRV_RAWMIDI_STREAM_OUTPUT:
+                if (!rfile->output)
+                        return -EINVAL;
                return snd_rawmidi_output_params(rfile->output, &params);
        case SNDRV_RAWMIDI_STREAM_INPUT:
+                if (!rfile->input)
+                        return -EINVAL;
                return snd_rawmidi_input_params(rfile->input, &params);
        }
        return -EINVAL;
@@ -67,16 +69,18 @@ static int snd_rawmidi_ioctl_status_compat(struct snd_rawmidi_file *rfile,
        int err;
        struct snd_rawmidi_status status;
-        if (rfile->output == NULL)
-                return -EINVAL;
        if (get_user(status.stream, &src->stream))
                return -EFAULT;
        switch (status.stream) {
        case SNDRV_RAWMIDI_STREAM_OUTPUT:
+                if (!rfile->output)
+                        return -EINVAL;
                err = snd_rawmidi_output_status(rfile->output, &status);
                break;
        case SNDRV_RAWMIDI_STREAM_INPUT:
+                if (!rfile->input)
+                        return -EINVAL;
                err = snd_rawmidi_input_status(rfile->input, &status);
                break;
        default:
@@ -112,16 +116,18 @@ static int snd_rawmidi_ioctl_status_x32(struct snd_rawmidi_file *rfile,
        int err;
        struct snd_rawmidi_status status;
-        if (rfile->output == NULL)
-                return -EINVAL;
        if (get_user(status.stream, &src->stream))
                return -EFAULT;
        switch (status.stream) {
        case SNDRV_RAWMIDI_STREAM_OUTPUT:
+                if (!rfile->output)
+                        return -EINVAL;
                err = snd_rawmidi_output_status(rfile->output, &status);
                break;
        case SNDRV_RAWMIDI_STREAM_INPUT:
+                if (!rfile->input)
+                        return -EINVAL;
                err = snd_rawmidi_input_status(rfile->input, &status);
                break;
        default:
diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
index 7a111a1b5836..b0c8c79848a9 100644
--- a/sound/pci/hda/hda_intel.c
+++ b/sound/pci/hda/hda_intel.c
@@ -1647,7 +1647,8 @@ static void azx_check_snoop_available(struct azx *chip)
                 */
                u8 val;
                pci_read_config_byte(chip->pci, 0x42, &val);
-                if (!(val & 0x80) && chip->pci->revision == 0x30)
+                if (!(val & 0x80) && (chip->pci->revision == 0x30 ||
+                                      chip->pci->revision == 0x20))
                        snoop = false;
        }
diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index aef1f52db7d9..fc77bf7a1544 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -6370,6 +6370,8 @@ static const struct hda_fixup alc269_fixups[] = {
                        { 0x19, 0x01a1913c }, /* use as headset mic, without its own jack detect */
                        { }
                },
+                .chained = true,
+                .chain_id = ALC269_FIXUP_HEADSET_MIC
        },
 };
@@ -6573,6 +6575,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
        SND_PCI_QUIRK(0x17aa, 0x30bb, "ThinkCentre AIO", ALC233_FIXUP_LENOVO_LINE2_MIC_HOTKEY),
        SND_PCI_QUIRK(0x17aa, 0x30e2, "ThinkCentre AIO", ALC233_FIXUP_LENOVO_LINE2_MIC_HOTKEY),
        SND_PCI_QUIRK(0x17aa, 0x310c, "ThinkCentre Station", ALC294_FIXUP_LENOVO_MIC_LOCATION),
+        SND_PCI_QUIRK(0x17aa, 0x3138, "ThinkCentre Station", ALC294_FIXUP_LENOVO_MIC_LOCATION),
        SND_PCI_QUIRK(0x17aa, 0x313c, "ThinkCentre Station", ALC294_FIXUP_LENOVO_MIC_LOCATION),
        SND_PCI_QUIRK(0x17aa, 0x3112, "ThinkCentre AIO", ALC233_FIXUP_LENOVO_LINE2_MIC_HOTKEY),
        SND_PCI_QUIRK(0x17aa, 0x3902, "Lenovo E50-80", ALC269_FIXUP_DMIC_THINKPAD_ACPI),
diff --git a/sound/usb/line6/midi.c b/sound/usb/line6/midi.c
index 6d7cde56a355..e2cf55c53ea8 100644
--- a/sound/usb/line6/midi.c
+++ b/sound/usb/line6/midi.c
@@ -125,7 +125,7 @@ static int send_midi_async(struct usb_line6 *line6, unsigned char *data,
        }
        usb_fill_int_urb(urb, line6->usbdev,
-                         usb_sndbulkpipe(line6->usbdev,
+                         usb_sndintpipe(line6->usbdev,
                                         line6->properties->ep_ctrl_w),
                         transfer_buffer, length, midi_sent, line6,
                         line6->interval);
diff --git a/tools/objtool/Makefile b/tools/objtool/Makefile
index 8ae824dbfca3..f76d9914686a 100644
--- a/tools/objtool/Makefile
+++ b/tools/objtool/Makefile
@@ -31,8 +31,8 @@ INCLUDES := -I$(srctree)/tools/include \
            -I$(srctree)/tools/arch/$(HOSTARCH)/include/uapi \
            -I$(srctree)/tools/objtool/arch/$(ARCH)/include
 WARNINGS := $(EXTRA_WARNINGS) -Wno-switch-default -Wno-switch-enum -Wno-packed
-CFLAGS   += -Wall -Werror $(WARNINGS) -fomit-frame-pointer -O2 -g $(INCLUDES)
+CFLAGS   += -Werror $(WARNINGS) $(HOSTCFLAGS) -g $(INCLUDES)
-LDFLAGS  += -lelf $(LIBSUBCMD)
+LDFLAGS  += -lelf $(LIBSUBCMD) $(HOSTLDFLAGS)
 # Allow old libelf to be used:
 elfshdr := $(shell echo '$(pound)include <libelf.h>' | $(CC) $(CFLAGS) -x c -E - | grep elf_getshdr)
diff --git a/tools/testing/nvdimm/test/nfit.c b/tools/testing/nvdimm/test/nfit.c
index cb166be4918d..4ea385be528f 100644
--- a/tools/testing/nvdimm/test/nfit.c
+++ b/tools/testing/nvdimm/test/nfit.c
@@ -138,6 +138,7 @@ static u32 handle[] = {
 };
 static unsigned long dimm_fail_cmd_flags[NUM_DCR];
+static int dimm_fail_cmd_code[NUM_DCR];
 struct nfit_test_fw {
        enum intel_fw_update_state state;
@@ -892,8 +893,11 @@ static int get_dimm(struct nfit_mem *nfit_mem, unsigned int func)
        if (i >= ARRAY_SIZE(handle))
                return -ENXIO;
-        if ((1 << func) & dimm_fail_cmd_flags[i])
+        if ((1 << func) & dimm_fail_cmd_flags[i]) {
+                if (dimm_fail_cmd_code[i])
+                        return dimm_fail_cmd_code[i];
                return -EIO;
+        }
        return i;
 }
@@ -1162,12 +1166,12 @@ static int ars_state_init(struct device *dev, struct ars_state *ars_state)
 static void put_dimms(void *data)
 {
-        struct device **dimm_dev = data;
+        struct nfit_test *t = data;
        int i;
-        for (i = 0; i < NUM_DCR; i++)
+        for (i = 0; i < t->num_dcr; i++)
-                if (dimm_dev[i])
+                if (t->dimm_dev[i])
-                        device_unregister(dimm_dev[i]);
+                        device_unregister(t->dimm_dev[i]);
 }
 static struct class *nfit_test_dimm;
@@ -1176,13 +1180,11 @@ static int dimm_name_to_id(struct device *dev)
 {
        int dimm;
-        if (sscanf(dev_name(dev), "test_dimm%d", &dimm) != 1
+        if (sscanf(dev_name(dev), "test_dimm%d", &dimm) != 1)
-                        || dimm >= NUM_DCR || dimm < 0)
                return -ENXIO;
        return dimm;
 }
 static ssize_t handle_show(struct device *dev, struct device_attribute *attr,
                char *buf)
 {
@@ -1191,7 +1193,7 @@ static ssize_t handle_show(struct device *dev, struct device_attribute *attr,
        if (dimm < 0)
                return dimm;
-        return sprintf(buf, "%#x", handle[dimm]);
+        return sprintf(buf, "%#x\n", handle[dimm]);
 }
 DEVICE_ATTR_RO(handle);
@@ -1225,8 +1227,39 @@ static ssize_t fail_cmd_store(struct device *dev, struct device_attribute *attr,
 }
 static DEVICE_ATTR_RW(fail_cmd);
+static ssize_t fail_cmd_code_show(struct device *dev, struct device_attribute *attr,
+                char *buf)
+{
+        int dimm = dimm_name_to_id(dev);
+        if (dimm < 0)
+                return dimm;
+        return sprintf(buf, "%d\n", dimm_fail_cmd_code[dimm]);
+}
+static ssize_t fail_cmd_code_store(struct device *dev, struct device_attribute *attr,
+                const char *buf, size_t size)
+{
+        int dimm = dimm_name_to_id(dev);
+        unsigned long val;
+        ssize_t rc;
+        if (dimm < 0)
+                return dimm;
+        rc = kstrtol(buf, 0, &val);
+        if (rc)
+                return rc;
+        dimm_fail_cmd_code[dimm] = val;
+        return size;
+}
+static DEVICE_ATTR_RW(fail_cmd_code);
 static struct attribute *nfit_test_dimm_attributes[] = {
        &dev_attr_fail_cmd.attr,
+        &dev_attr_fail_cmd_code.attr,
        &dev_attr_handle.attr,
        NULL,
 };
@@ -1240,6 +1273,23 @@ static const struct attribute_group *nfit_test_dimm_attribute_groups[] = {
        NULL,
 };
+static int nfit_test_dimm_init(struct nfit_test *t)
+{
+        int i;
+        if (devm_add_action_or_reset(&t->pdev.dev, put_dimms, t))
+                return -ENOMEM;
+        for (i = 0; i < t->num_dcr; i++) {
+                t->dimm_dev[i] = device_create_with_groups(nfit_test_dimm,
+                                &t->pdev.dev, 0, NULL,
+                                nfit_test_dimm_attribute_groups,
+                                "test_dimm%d", i + t->dcr_idx);
+                if (!t->dimm_dev[i])
+                        return -ENOMEM;
+        }
+        return 0;
+}
 static void smart_init(struct nfit_test *t)
 {
        int i;
@@ -1335,17 +1385,8 @@ static int nfit_test0_alloc(struct nfit_test *t)
        if (!t->_fit)
                return -ENOMEM;
-        if (devm_add_action_or_reset(&t->pdev.dev, put_dimms, t->dimm_dev))
+        if (nfit_test_dimm_init(t))
                return -ENOMEM;
-        for (i = 0; i < NUM_DCR; i++) {
-                t->dimm_dev[i] = device_create_with_groups(nfit_test_dimm,
-                                &t->pdev.dev, 0, NULL,
-                                nfit_test_dimm_attribute_groups,
-                                "test_dimm%d", i);
-                if (!t->dimm_dev[i])
-                        return -ENOMEM;
-        }
        smart_init(t);
        return ars_state_init(&t->pdev.dev, &t->ars_state);
 }
@@ -1377,6 +1418,8 @@ static int nfit_test1_alloc(struct nfit_test *t)
        if (!t->spa_set[1])
                return -ENOMEM;
+        if (nfit_test_dimm_init(t))
+                return -ENOMEM;
        smart_init(t);
        return ars_state_init(&t->pdev.dev, &t->ars_state);
 }
@@ -2222,6 +2265,9 @@ static void nfit_test1_setup(struct nfit_test *t)
        set_bit(ND_CMD_ARS_STATUS, &acpi_desc->bus_cmd_force_en);
        set_bit(ND_CMD_CLEAR_ERROR, &acpi_desc->bus_cmd_force_en);
        set_bit(ND_INTEL_ENABLE_LSS_STATUS, &acpi_desc->dimm_cmd_force_en);
+        set_bit(ND_CMD_GET_CONFIG_SIZE, &acpi_desc->dimm_cmd_force_en);
+        set_bit(ND_CMD_GET_CONFIG_DATA, &acpi_desc->dimm_cmd_force_en);
+        set_bit(ND_CMD_SET_CONFIG_DATA, &acpi_desc->dimm_cmd_force_en);
 }
 static int nfit_test_blk_do_io(struct nd_blk_region *ndbr, resource_size_t dpa,
diff --git a/tools/testing/selftests/filesystems/Makefile b/tools/testing/selftests/filesystems/Makefile
index 4e6d09fb166f..5c7d7001ad37 100644
--- a/tools/testing/selftests/filesystems/Makefile
+++ b/tools/testing/selftests/filesystems/Makefile
@@ -1,8 +1,6 @@
 # SPDX-License-Identifier: GPL-2.0
-TEST_PROGS := dnotify_test devpts_pts
-all: $(TEST_PROGS)
-include ../lib.mk
+TEST_GEN_PROGS := devpts_pts
+TEST_GEN_PROGS_EXTENDED := dnotify_test
-clean:
+include ../lib.mk
-        rm -fr $(TEST_PROGS)
diff --git a/tools/testing/selftests/kvm/Makefile b/tools/testing/selftests/kvm/Makefile
index dc44de904797..2ddcc96ae456 100644
--- a/tools/testing/selftests/kvm/Makefile
+++ b/tools/testing/selftests/kvm/Makefile
@@ -4,17 +4,18 @@ top_srcdir = ../../../../
 UNAME_M := $(shell uname -m)
 LIBKVM = lib/assert.c lib/elf.c lib/io.c lib/kvm_util.c lib/sparsebit.c
-LIBKVM_x86_64 = lib/x86.c
+LIBKVM_x86_64 = lib/x86.c lib/vmx.c
 TEST_GEN_PROGS_x86_64 = set_sregs_test
 TEST_GEN_PROGS_x86_64 += sync_regs_test
+TEST_GEN_PROGS_x86_64 += vmx_tsc_adjust_test
 TEST_GEN_PROGS += $(TEST_GEN_PROGS_$(UNAME_M))
 LIBKVM += $(LIBKVM_$(UNAME_M))
 INSTALL_HDR_PATH = $(top_srcdir)/usr
 LINUX_HDR_PATH = $(INSTALL_HDR_PATH)/include/
-CFLAGS += -O2 -g -I$(LINUX_HDR_PATH) -Iinclude -I$(<D)
+CFLAGS += -O2 -g -std=gnu99 -I$(LINUX_HDR_PATH) -Iinclude -I$(<D)
 # After inclusion, $(OUTPUT) is defined and
 # $(TEST_GEN_PROGS) starts with $(OUTPUT)/
diff --git a/tools/testing/selftests/kvm/include/kvm_util.h b/tools/testing/selftests/kvm/include/kvm_util.h
index 57974ad46373..637b7017b6ee 100644
--- a/tools/testing/selftests/kvm/include/kvm_util.h
+++ b/tools/testing/selftests/kvm/include/kvm_util.h
@@ -112,24 +112,27 @@ void virt_pg_map(struct kvm_vm *vm, uint64_t vaddr, uint64_t paddr,
 vm_paddr_t vm_phy_page_alloc(struct kvm_vm *vm,
        vm_paddr_t paddr_min, uint32_t memslot);
-void kvm_get_supported_cpuid(struct kvm_cpuid2 *cpuid);
+struct kvm_cpuid2 *kvm_get_supported_cpuid(void);
 void vcpu_set_cpuid(
        struct kvm_vm *vm, uint32_t vcpuid, struct kvm_cpuid2 *cpuid);
-struct kvm_cpuid2 *allocate_kvm_cpuid2(void);
 struct kvm_cpuid_entry2 *
-find_cpuid_index_entry(struct kvm_cpuid2 *cpuid, uint32_t function,
+kvm_get_supported_cpuid_index(uint32_t function, uint32_t index);
-                       uint32_t index);
 static inline struct kvm_cpuid_entry2 *
-find_cpuid_entry(struct kvm_cpuid2 *cpuid, uint32_t function)
+kvm_get_supported_cpuid_entry(uint32_t function)
 {
-        return find_cpuid_index_entry(cpuid, function, 0);
+        return kvm_get_supported_cpuid_index(function, 0);
 }
 struct kvm_vm *vm_create_default(uint32_t vcpuid, void *guest_code);
 void vm_vcpu_add_default(struct kvm_vm *vm, uint32_t vcpuid, void *guest_code);
+typedef void (*vmx_guest_code_t)(vm_vaddr_t vmxon_vaddr,
+                                 vm_paddr_t vmxon_paddr,
+                                 vm_vaddr_t vmcs_vaddr,
+                                 vm_paddr_t vmcs_paddr);
 struct kvm_userspace_memory_region *
 kvm_userspace_memory_region_find(struct kvm_vm *vm, uint64_t start,
                                 uint64_t end);
diff --git a/tools/testing/selftests/kvm/include/vmx.h b/tools/testing/selftests/kvm/include/vmx.h
new file mode 100644
index 000000000000..6ed8499807fd
--- /dev/null
+++ b/tools/testing/selftests/kvm/include/vmx.h
@@ -0,0 +1,494 @@
+/*
+ * tools/testing/selftests/kvm/include/vmx.h
+ *
+ * Copyright (C) 2018, Google LLC.
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2.
+ *
+ */
+#ifndef SELFTEST_KVM_VMX_H
+#define SELFTEST_KVM_VMX_H
+#include <stdint.h>
+#include "x86.h"
+#define CPUID_VMX_BIT                           5
+#define CPUID_VMX                               (1 << 5)
+/*
+ * Definitions of Primary Processor-Based VM-Execution Controls.
+ */
+#define CPU_BASED_VIRTUAL_INTR_PENDING          0x00000004
+#define CPU_BASED_USE_TSC_OFFSETING             0x00000008
+#define CPU_BASED_HLT_EXITING                   0x00000080
+#define CPU_BASED_INVLPG_EXITING                0x00000200
+#define CPU_BASED_MWAIT_EXITING                 0x00000400
+#define CPU_BASED_RDPMC_EXITING                 0x00000800
+#define CPU_BASED_RDTSC_EXITING                 0x00001000
+#define CPU_BASED_CR3_LOAD_EXITING              0x00008000
+#define CPU_BASED_CR3_STORE_EXITING             0x00010000
+#define CPU_BASED_CR8_LOAD_EXITING              0x00080000
+#define CPU_BASED_CR8_STORE_EXITING             0x00100000
+#define CPU_BASED_TPR_SHADOW                    0x00200000
+#define CPU_BASED_VIRTUAL_NMI_PENDING           0x00400000
+#define CPU_BASED_MOV_DR_EXITING                0x00800000
+#define CPU_BASED_UNCOND_IO_EXITING             0x01000000
+#define CPU_BASED_USE_IO_BITMAPS                0x02000000
+#define CPU_BASED_MONITOR_TRAP                  0x08000000
+#define CPU_BASED_USE_MSR_BITMAPS               0x10000000
+#define CPU_BASED_MONITOR_EXITING               0x20000000
+#define CPU_BASED_PAUSE_EXITING                 0x40000000
+#define CPU_BASED_ACTIVATE_SECONDARY_CONTROLS   0x80000000
+#define CPU_BASED_ALWAYSON_WITHOUT_TRUE_MSR     0x0401e172
+/*
+ * Definitions of Secondary Processor-Based VM-Execution Controls.
+ */
+#define SECONDARY_EXEC_VIRTUALIZE_APIC_ACCESSES 0x00000001
+#define SECONDARY_EXEC_ENABLE_EPT               0x00000002
+#define SECONDARY_EXEC_DESC                     0x00000004
+#define SECONDARY_EXEC_RDTSCP                   0x00000008
+#define SECONDARY_EXEC_VIRTUALIZE_X2APIC_MODE   0x00000010
+#define SECONDARY_EXEC_ENABLE_VPID              0x00000020
+#define SECONDARY_EXEC_WBINVD_EXITING           0x00000040
+#define SECONDARY_EXEC_UNRESTRICTED_GUEST       0x00000080
+#define SECONDARY_EXEC_APIC_REGISTER_VIRT       0x00000100
+#define SECONDARY_EXEC_VIRTUAL_INTR_DELIVERY    0x00000200
+#define SECONDARY_EXEC_PAUSE_LOOP_EXITING       0x00000400
+#define SECONDARY_EXEC_RDRAND_EXITING           0x00000800
+#define SECONDARY_EXEC_ENABLE_INVPCID           0x00001000
+#define SECONDARY_EXEC_ENABLE_VMFUNC            0x00002000
+#define SECONDARY_EXEC_SHADOW_VMCS              0x00004000
+#define SECONDARY_EXEC_RDSEED_EXITING           0x00010000
+#define SECONDARY_EXEC_ENABLE_PML               0x00020000
+#define SECONDARY_EPT_VE                        0x00040000
+#define SECONDARY_ENABLE_XSAV_RESTORE           0x00100000
+#define SECONDARY_EXEC_TSC_SCALING              0x02000000
+#define PIN_BASED_EXT_INTR_MASK                 0x00000001
+#define PIN_BASED_NMI_EXITING                   0x00000008
+#define PIN_BASED_VIRTUAL_NMIS                  0x00000020
+#define PIN_BASED_VMX_PREEMPTION_TIMER          0x00000040
+#define PIN_BASED_POSTED_INTR                   0x00000080
+#define PIN_BASED_ALWAYSON_WITHOUT_TRUE_MSR     0x00000016
+#define VM_EXIT_SAVE_DEBUG_CONTROLS             0x00000004
+#define VM_EXIT_HOST_ADDR_SPACE_SIZE            0x00000200
+#define VM_EXIT_LOAD_IA32_PERF_GLOBAL_CTRL      0x00001000
+#define VM_EXIT_ACK_INTR_ON_EXIT                0x00008000
+#define VM_EXIT_SAVE_IA32_PAT                   0x00040000
+#define VM_EXIT_LOAD_IA32_PAT                   0x00080000
+#define VM_EXIT_SAVE_IA32_EFER                  0x00100000
+#define VM_EXIT_LOAD_IA32_EFER                  0x00200000
+#define VM_EXIT_SAVE_VMX_PREEMPTION_TIMER       0x00400000
+#define VM_EXIT_ALWAYSON_WITHOUT_TRUE_MSR       0x00036dff
+#define VM_ENTRY_LOAD_DEBUG_CONTROLS            0x00000004
+#define VM_ENTRY_IA32E_MODE                     0x00000200
+#define VM_ENTRY_SMM                            0x00000400
+#define VM_ENTRY_DEACT_DUAL_MONITOR             0x00000800
+#define VM_ENTRY_LOAD_IA32_PERF_GLOBAL_CTRL     0x00002000
+#define VM_ENTRY_LOAD_IA32_PAT                  0x00004000
+#define VM_ENTRY_LOAD_IA32_EFER                 0x00008000
+#define VM_ENTRY_ALWAYSON_WITHOUT_TRUE_MSR      0x000011ff
+#define VMX_MISC_PREEMPTION_TIMER_RATE_MASK     0x0000001f
+#define VMX_MISC_SAVE_EFER_LMA                  0x00000020
+#define EXIT_REASON_FAILED_VMENTRY      0x80000000
+#define EXIT_REASON_EXCEPTION_NMI       0
+#define EXIT_REASON_EXTERNAL_INTERRUPT  1
+#define EXIT_REASON_TRIPLE_FAULT        2
+#define EXIT_REASON_PENDING_INTERRUPT   7
+#define EXIT_REASON_NMI_WINDOW          8
+#define EXIT_REASON_TASK_SWITCH         9
+#define EXIT_REASON_CPUID               10
+#define EXIT_REASON_HLT                 12
+#define EXIT_REASON_INVD                13
+#define EXIT_REASON_INVLPG              14
+#define EXIT_REASON_RDPMC               15
+#define EXIT_REASON_RDTSC               16
+#define EXIT_REASON_VMCALL              18
+#define EXIT_REASON_VMCLEAR             19
+#define EXIT_REASON_VMLAUNCH            20
+#define EXIT_REASON_VMPTRLD             21
+#define EXIT_REASON_VMPTRST             22
+#define EXIT_REASON_VMREAD              23
+#define EXIT_REASON_VMRESUME            24
+#define EXIT_REASON_VMWRITE             25
+#define EXIT_REASON_VMOFF               26
+#define EXIT_REASON_VMON                27
+#define EXIT_REASON_CR_ACCESS           28
+#define EXIT_REASON_DR_ACCESS           29
+#define EXIT_REASON_IO_INSTRUCTION      30
+#define EXIT_REASON_MSR_READ            31
+#define EXIT_REASON_MSR_WRITE           32
+#define EXIT_REASON_INVALID_STATE       33
+#define EXIT_REASON_MWAIT_INSTRUCTION   36
+#define EXIT_REASON_MONITOR_INSTRUCTION 39
+#define EXIT_REASON_PAUSE_INSTRUCTION   40
+#define EXIT_REASON_MCE_DURING_VMENTRY  41
+#define EXIT_REASON_TPR_BELOW_THRESHOLD 43
+#define EXIT_REASON_APIC_ACCESS         44
+#define EXIT_REASON_EOI_INDUCED         45
+#define EXIT_REASON_EPT_VIOLATION       48
+#define EXIT_REASON_EPT_MISCONFIG       49
+#define EXIT_REASON_INVEPT              50
+#define EXIT_REASON_RDTSCP              51
+#define EXIT_REASON_PREEMPTION_TIMER    52
+#define EXIT_REASON_INVVPID             53
+#define EXIT_REASON_WBINVD              54
+#define EXIT_REASON_XSETBV              55
+#define EXIT_REASON_APIC_WRITE          56
+#define EXIT_REASON_INVPCID             58
+#define EXIT_REASON_PML_FULL            62
+#define EXIT_REASON_XSAVES              63
+#define EXIT_REASON_XRSTORS             64
+#define LAST_EXIT_REASON                64
+enum vmcs_field {
+        VIRTUAL_PROCESSOR_ID            = 0x00000000,
+        POSTED_INTR_NV                  = 0x00000002,
+        GUEST_ES_SELECTOR               = 0x00000800,
+        GUEST_CS_SELECTOR               = 0x00000802,
+        GUEST_SS_SELECTOR               = 0x00000804,
+        GUEST_DS_SELECTOR               = 0x00000806,
+        GUEST_FS_SELECTOR               = 0x00000808,
+        GUEST_GS_SELECTOR               = 0x0000080a,
+        GUEST_LDTR_SELECTOR             = 0x0000080c,
+        GUEST_TR_SELECTOR               = 0x0000080e,
+        GUEST_INTR_STATUS               = 0x00000810,
+        GUEST_PML_INDEX                 = 0x00000812,
+        HOST_ES_SELECTOR                = 0x00000c00,
+        HOST_CS_SELECTOR                = 0x00000c02,
+        HOST_SS_SELECTOR                = 0x00000c04,
+        HOST_DS_SELECTOR                = 0x00000c06,
+        HOST_FS_SELECTOR                = 0x00000c08,
+        HOST_GS_SELECTOR                = 0x00000c0a,
+        HOST_TR_SELECTOR                = 0x00000c0c,
+        IO_BITMAP_A                     = 0x00002000,
+        IO_BITMAP_A_HIGH                = 0x00002001,
+        IO_BITMAP_B                     = 0x00002002,
+        IO_BITMAP_B_HIGH                = 0x00002003,
+        MSR_BITMAP                      = 0x00002004,
+        MSR_BITMAP_HIGH                 = 0x00002005,
+        VM_EXIT_MSR_STORE_ADDR          = 0x00002006,
+        VM_EXIT_MSR_STORE_ADDR_HIGH     = 0x00002007,
+        VM_EXIT_MSR_LOAD_ADDR           = 0x00002008,
+        VM_EXIT_MSR_LOAD_ADDR_HIGH      = 0x00002009,
+        VM_ENTRY_MSR_LOAD_ADDR          = 0x0000200a,
+        VM_ENTRY_MSR_LOAD_ADDR_HIGH     = 0x0000200b,
+        PML_ADDRESS                     = 0x0000200e,
+        PML_ADDRESS_HIGH                = 0x0000200f,
+        TSC_OFFSET                      = 0x00002010,
+        TSC_OFFSET_HIGH                 = 0x00002011,
+        VIRTUAL_APIC_PAGE_ADDR          = 0x00002012,
+        VIRTUAL_APIC_PAGE_ADDR_HIGH     = 0x00002013,
+        APIC_ACCESS_ADDR                = 0x00002014,
+        APIC_ACCESS_ADDR_HIGH           = 0x00002015,
+        POSTED_INTR_DESC_ADDR           = 0x00002016,
+        POSTED_INTR_DESC_ADDR_HIGH      = 0x00002017,
+        EPT_POINTER                     = 0x0000201a,
+        EPT_POINTER_HIGH                = 0x0000201b,
+        EOI_EXIT_BITMAP0                = 0x0000201c,
+        EOI_EXIT_BITMAP0_HIGH           = 0x0000201d,
+        EOI_EXIT_BITMAP1                = 0x0000201e,
+        EOI_EXIT_BITMAP1_HIGH           = 0x0000201f,
+        EOI_EXIT_BITMAP2                = 0x00002020,
+        EOI_EXIT_BITMAP2_HIGH           = 0x00002021,
+        EOI_EXIT_BITMAP3                = 0x00002022,
+        EOI_EXIT_BITMAP3_HIGH           = 0x00002023,
+        VMREAD_BITMAP                   = 0x00002026,
+        VMREAD_BITMAP_HIGH              = 0x00002027,
+        VMWRITE_BITMAP                  = 0x00002028,
+        VMWRITE_BITMAP_HIGH             = 0x00002029,
+        XSS_EXIT_BITMAP                 = 0x0000202C,
+        XSS_EXIT_BITMAP_HIGH            = 0x0000202D,
+        TSC_MULTIPLIER                  = 0x00002032,
+        TSC_MULTIPLIER_HIGH             = 0x00002033,
+        GUEST_PHYSICAL_ADDRESS          = 0x00002400,
+        GUEST_PHYSICAL_ADDRESS_HIGH     = 0x00002401,
+        VMCS_LINK_POINTER               = 0x00002800,
+        VMCS_LINK_POINTER_HIGH          = 0x00002801,
+        GUEST_IA32_DEBUGCTL             = 0x00002802,
+        GUEST_IA32_DEBUGCTL_HIGH        = 0x00002803,
+        GUEST_IA32_PAT                  = 0x00002804,
+        GUEST_IA32_PAT_HIGH             = 0x00002805,
+        GUEST_IA32_EFER                 = 0x00002806,
+        GUEST_IA32_EFER_HIGH            = 0x00002807,
+        GUEST_IA32_PERF_GLOBAL_CTRL     = 0x00002808,
+        GUEST_IA32_PERF_GLOBAL_CTRL_HIGH= 0x00002809,
+        GUEST_PDPTR0                    = 0x0000280a,
+        GUEST_PDPTR0_HIGH               = 0x0000280b,
+        GUEST_PDPTR1                    = 0x0000280c,
+        GUEST_PDPTR1_HIGH               = 0x0000280d,
+        GUEST_PDPTR2                    = 0x0000280e,
+        GUEST_PDPTR2_HIGH               = 0x0000280f,
+        GUEST_PDPTR3                    = 0x00002810,
+        GUEST_PDPTR3_HIGH               = 0x00002811,
+        GUEST_BNDCFGS                   = 0x00002812,
+        GUEST_BNDCFGS_HIGH              = 0x00002813,
+        HOST_IA32_PAT                   = 0x00002c00,
+        HOST_IA32_PAT_HIGH              = 0x00002c01,
+        HOST_IA32_EFER                  = 0x00002c02,
+        HOST_IA32_EFER_HIGH             = 0x00002c03,
+        HOST_IA32_PERF_GLOBAL_CTRL      = 0x00002c04,
+        HOST_IA32_PERF_GLOBAL_CTRL_HIGH = 0x00002c05,
+        PIN_BASED_VM_EXEC_CONTROL       = 0x00004000,
+        CPU_BASED_VM_EXEC_CONTROL       = 0x00004002,
+        EXCEPTION_BITMAP                = 0x00004004,
+        PAGE_FAULT_ERROR_CODE_MASK      = 0x00004006,
+        PAGE_FAULT_ERROR_CODE_MATCH     = 0x00004008,
+        CR3_TARGET_COUNT                = 0x0000400a,
+        VM_EXIT_CONTROLS                = 0x0000400c,
+        VM_EXIT_MSR_STORE_COUNT         = 0x0000400e,
+        VM_EXIT_MSR_LOAD_COUNT          = 0x00004010,
+        VM_ENTRY_CONTROLS               = 0x00004012,
+        VM_ENTRY_MSR_LOAD_COUNT         = 0x00004014,
+        VM_ENTRY_INTR_INFO_FIELD        = 0x00004016,
+        VM_ENTRY_EXCEPTION_ERROR_CODE   = 0x00004018,
+        VM_ENTRY_INSTRUCTION_LEN        = 0x0000401a,
+        TPR_THRESHOLD                   = 0x0000401c,
+        SECONDARY_VM_EXEC_CONTROL       = 0x0000401e,
+        PLE_GAP                         = 0x00004020,
+        PLE_WINDOW                      = 0x00004022,
+        VM_INSTRUCTION_ERROR            = 0x00004400,
+        VM_EXIT_REASON                  = 0x00004402,
+        VM_EXIT_INTR_INFO               = 0x00004404,
+        VM_EXIT_INTR_ERROR_CODE         = 0x00004406,
+        IDT_VECTORING_INFO_FIELD        = 0x00004408,
+        IDT_VECTORING_ERROR_CODE        = 0x0000440a,
+        VM_EXIT_INSTRUCTION_LEN         = 0x0000440c,
+        VMX_INSTRUCTION_INFO            = 0x0000440e,
+        GUEST_ES_LIMIT                  = 0x00004800,
+        GUEST_CS_LIMIT                  = 0x00004802,
+        GUEST_SS_LIMIT                  = 0x00004804,
+        GUEST_DS_LIMIT                  = 0x00004806,
+        GUEST_FS_LIMIT                  = 0x00004808,
+        GUEST_GS_LIMIT                  = 0x0000480a,
+        GUEST_LDTR_LIMIT                = 0x0000480c,
+        GUEST_TR_LIMIT                  = 0x0000480e,
+        GUEST_GDTR_LIMIT                = 0x00004810,
+        GUEST_IDTR_LIMIT                = 0x00004812,
+        GUEST_ES_AR_BYTES               = 0x00004814,
+        GUEST_CS_AR_BYTES               = 0x00004816,
+        GUEST_SS_AR_BYTES               = 0x00004818,
+        GUEST_DS_AR_BYTES               = 0x0000481a,
+        GUEST_FS_AR_BYTES               = 0x0000481c,
+        GUEST_GS_AR_BYTES               = 0x0000481e,
+        GUEST_LDTR_AR_BYTES             = 0x00004820,
+        GUEST_TR_AR_BYTES               = 0x00004822,
+        GUEST_INTERRUPTIBILITY_INFO     = 0x00004824,
+        GUEST_ACTIVITY_STATE            = 0X00004826,
+        GUEST_SYSENTER_CS               = 0x0000482A,
+        VMX_PREEMPTION_TIMER_VALUE      = 0x0000482E,
+        HOST_IA32_SYSENTER_CS           = 0x00004c00,
+        CR0_GUEST_HOST_MASK             = 0x00006000,
+        CR4_GUEST_HOST_MASK             = 0x00006002,
+        CR0_READ_SHADOW                 = 0x00006004,
+        CR4_READ_SHADOW                 = 0x00006006,
+        CR3_TARGET_VALUE0               = 0x00006008,
+        CR3_TARGET_VALUE1               = 0x0000600a,
+        CR3_TARGET_VALUE2               = 0x0000600c,
+        CR3_TARGET_VALUE3               = 0x0000600e,
+        EXIT_QUALIFICATION              = 0x00006400,
+        GUEST_LINEAR_ADDRESS            = 0x0000640a,
+        GUEST_CR0                       = 0x00006800,
+        GUEST_CR3                       = 0x00006802,
+        GUEST_CR4                       = 0x00006804,
+        GUEST_ES_BASE                   = 0x00006806,
+        GUEST_CS_BASE                   = 0x00006808,
+        GUEST_SS_BASE                   = 0x0000680a,
+        GUEST_DS_BASE                   = 0x0000680c,
+        GUEST_FS_BASE                   = 0x0000680e,
+        GUEST_GS_BASE                   = 0x00006810,
+        GUEST_LDTR_BASE                 = 0x00006812,
+        GUEST_TR_BASE                   = 0x00006814,
+        GUEST_GDTR_BASE                 = 0x00006816,
+        GUEST_IDTR_BASE                 = 0x00006818,
+        GUEST_DR7                       = 0x0000681a,
+        GUEST_RSP                       = 0x0000681c,
+        GUEST_RIP                       = 0x0000681e,
+        GUEST_RFLAGS                    = 0x00006820,
+        GUEST_PENDING_DBG_EXCEPTIONS    = 0x00006822,
+        GUEST_SYSENTER_ESP              = 0x00006824,
+        GUEST_SYSENTER_EIP              = 0x00006826,
+        HOST_CR0                        = 0x00006c00,
+        HOST_CR3                        = 0x00006c02,
+        HOST_CR4                        = 0x00006c04,
+        HOST_FS_BASE                    = 0x00006c06,
+        HOST_GS_BASE                    = 0x00006c08,
+        HOST_TR_BASE                    = 0x00006c0a,
+        HOST_GDTR_BASE                  = 0x00006c0c,
+        HOST_IDTR_BASE                  = 0x00006c0e,
+        HOST_IA32_SYSENTER_ESP          = 0x00006c10,
+        HOST_IA32_SYSENTER_EIP          = 0x00006c12,
+        HOST_RSP                        = 0x00006c14,
+        HOST_RIP                        = 0x00006c16,
+};
+struct vmx_msr_entry {
+        uint32_t index;
+        uint32_t reserved;
+        uint64_t value;
+} __attribute__ ((aligned(16)));
+static inline int vmxon(uint64_t phys)
+{
+        uint8_t ret;
+        __asm__ __volatile__ ("vmxon %[pa]; setna %[ret]"
+                : [ret]"=rm"(ret)
+                : [pa]"m"(phys)
+                : "cc", "memory");
+        return ret;
+}
+static inline void vmxoff(void)
+{
+        __asm__ __volatile__("vmxoff");
+}
+static inline int vmclear(uint64_t vmcs_pa)
+{
+        uint8_t ret;
+        __asm__ __volatile__ ("vmclear %[pa]; setna %[ret]"
+                : [ret]"=rm"(ret)
+                : [pa]"m"(vmcs_pa)
+                : "cc", "memory");
+        return ret;
+}
+static inline int vmptrld(uint64_t vmcs_pa)
+{
+        uint8_t ret;
+        __asm__ __volatile__ ("vmptrld %[pa]; setna %[ret]"
+                : [ret]"=rm"(ret)
+                : [pa]"m"(vmcs_pa)
+                : "cc", "memory");
+        return ret;
+}
+/*
+ * No guest state (e.g. GPRs) is established by this vmlaunch.
+ */
+static inline int vmlaunch(void)
+{
+        int ret;
+        __asm__ __volatile__("push %%rbp;"
+                             "push %%rcx;"
+                             "push %%rdx;"
+                             "push %%rsi;"
+                             "push %%rdi;"
+                             "push $0;"
+                             "vmwrite %%rsp, %[host_rsp];"
+                             "lea 1f(%%rip), %%rax;"
+                             "vmwrite %%rax, %[host_rip];"
+                             "vmlaunch;"
+                             "incq (%%rsp);"
+                             "1: pop %%rax;"
+                             "pop %%rdi;"
+                             "pop %%rsi;"
+                             "pop %%rdx;"
+                             "pop %%rcx;"
+                             "pop %%rbp;"
+                             : [ret]"=&a"(ret)
+                             : [host_rsp]"r"((uint64_t)HOST_RSP),
+                               [host_rip]"r"((uint64_t)HOST_RIP)
+                             : "memory", "cc", "rbx", "r8", "r9", "r10",
+                               "r11", "r12", "r13", "r14", "r15");
+        return ret;
+}
+/*
+ * No guest state (e.g. GPRs) is established by this vmresume.
+ */
+static inline int vmresume(void)
+{
+        int ret;
+        __asm__ __volatile__("push %%rbp;"
+                             "push %%rcx;"
+                             "push %%rdx;"
+                             "push %%rsi;"
+                             "push %%rdi;"
+                             "push $0;"
+                             "vmwrite %%rsp, %[host_rsp];"
+                             "lea 1f(%%rip), %%rax;"
+                             "vmwrite %%rax, %[host_rip];"
+                             "vmresume;"
+                             "incq (%%rsp);"
+                             "1: pop %%rax;"
+                             "pop %%rdi;"
+                             "pop %%rsi;"
+                             "pop %%rdx;"
+                             "pop %%rcx;"
+                             "pop %%rbp;"
+                             : [ret]"=&a"(ret)
+                             : [host_rsp]"r"((uint64_t)HOST_RSP),
+                               [host_rip]"r"((uint64_t)HOST_RIP)
+                             : "memory", "cc", "rbx", "r8", "r9", "r10",
+                               "r11", "r12", "r13", "r14", "r15");
+        return ret;
+}
+static inline int vmread(uint64_t encoding, uint64_t *value)
+{
+        uint64_t tmp;
+        uint8_t ret;
+        __asm__ __volatile__("vmread %[encoding], %[value]; setna %[ret]"
+                : [value]"=rm"(tmp), [ret]"=rm"(ret)
+                : [encoding]"r"(encoding)
+                : "cc", "memory");
+        *value = tmp;
+        return ret;
+}
+/*
+ * A wrapper around vmread that ignores errors and returns zero if the
+ * vmread instruction fails.
+ */
+static inline uint64_t vmreadz(uint64_t encoding)
+{
+        uint64_t value = 0;
+        vmread(encoding, &value);
+        return value;
+}
+static inline int vmwrite(uint64_t encoding, uint64_t value)
+{
+        uint8_t ret;
+        __asm__ __volatile__ ("vmwrite %[value], %[encoding]; setna %[ret]"
+                : [ret]"=rm"(ret)
+                : [value]"rm"(value), [encoding]"r"(encoding)
+                : "cc", "memory");
+        return ret;
+}
+static inline uint32_t vmcs_revision(void)
+{
+        return rdmsr(MSR_IA32_VMX_BASIC);
+}
+void prepare_for_vmx_operation(void);
+void prepare_vmcs(void *guest_rip, void *guest_rsp);
+struct kvm_vm *vm_create_default_vmx(uint32_t vcpuid,
+                                     vmx_guest_code_t guest_code);
+#endif /* !SELFTEST_KVM_VMX_H */
diff --git a/tools/testing/selftests/kvm/lib/kvm_util.c b/tools/testing/selftests/kvm/lib/kvm_util.c
index 7ca1bb40c498..2cedfda181d4 100644
--- a/tools/testing/selftests/kvm/lib/kvm_util.c
+++ b/tools/testing/selftests/kvm/lib/kvm_util.c
@@ -378,7 +378,7 @@ int kvm_memcmp_hva_gva(void *hva,
 * complicated. This function uses a reasonable default length for
 * the array and performs the appropriate allocation.
 */
-struct kvm_cpuid2 *allocate_kvm_cpuid2(void)
+static struct kvm_cpuid2 *allocate_kvm_cpuid2(void)
 {
        struct kvm_cpuid2 *cpuid;
        int nent = 100;
@@ -402,17 +402,21 @@ struct kvm_cpuid2 *allocate_kvm_cpuid2(void)
 * Input Args: None
 *
 * Output Args:
- *   cpuid - The supported KVM CPUID
 *
- * Return: void
+ * Return: The supported KVM CPUID
 *
 * Get the guest CPUID supported by KVM.
 */
-void kvm_get_supported_cpuid(struct kvm_cpuid2 *cpuid)
+struct kvm_cpuid2 *kvm_get_supported_cpuid(void)
 {
+        static struct kvm_cpuid2 *cpuid;
        int ret;
        int kvm_fd;
+        if (cpuid)
+                return cpuid;
+        cpuid = allocate_kvm_cpuid2();
        kvm_fd = open(KVM_DEV_PATH, O_RDONLY);
        TEST_ASSERT(kvm_fd >= 0, "open %s failed, rc: %i errno: %i",
                KVM_DEV_PATH, kvm_fd, errno);
@@ -422,6 +426,7 @@ void kvm_get_supported_cpuid(struct kvm_cpuid2 *cpuid)
                    ret, errno);
        close(kvm_fd);
+        return cpuid;
 }
 /* Locate a cpuid entry.
@@ -435,12 +440,13 @@ void kvm_get_supported_cpuid(struct kvm_cpuid2 *cpuid)
 * Return: A pointer to the cpuid entry. Never returns NULL.
 */
 struct kvm_cpuid_entry2 *
-find_cpuid_index_entry(struct kvm_cpuid2 *cpuid, uint32_t function,
+kvm_get_supported_cpuid_index(uint32_t function, uint32_t index)
-                       uint32_t index)
 {
+        struct kvm_cpuid2 *cpuid;
        struct kvm_cpuid_entry2 *entry = NULL;
        int i;
+        cpuid = kvm_get_supported_cpuid();
        for (i = 0; i < cpuid->nent; i++) {
                if (cpuid->entries[i].function == function &&
                    cpuid->entries[i].index == index) {
@@ -1435,7 +1441,7 @@ vm_paddr_t vm_phy_page_alloc(struct kvm_vm *vm,
        sparsebit_idx_t pg;
        TEST_ASSERT((paddr_min % vm->page_size) == 0, "Min physical address "
-                "not divisable by page size.\n"
+                "not divisible by page size.\n"
                "  paddr_min: 0x%lx page_size: 0x%x",
                paddr_min, vm->page_size);
diff --git a/tools/testing/selftests/kvm/lib/sparsebit.c b/tools/testing/selftests/kvm/lib/sparsebit.c
index 0c5cf3e0cb6f..b132bc95d183 100644
--- a/tools/testing/selftests/kvm/lib/sparsebit.c
+++ b/tools/testing/selftests/kvm/lib/sparsebit.c
@@ -121,7 +121,7 @@
 *     avoided by moving the setting of the nodes mask bits into
 *     the previous nodes num_after setting.
 *
- *   + Node starting index is evenly divisable by the number of bits
+ *   + Node starting index is evenly divisible by the number of bits
 *     within a nodes mask member.
 *
 *   + Nodes never represent a range of bits that wrap around the
@@ -1741,7 +1741,7 @@ void sparsebit_validate_internal(struct sparsebit *s)
                /* Validate node index is divisible by the mask size */
                if (nodep->idx % MASK_BITS) {
-                        fprintf(stderr, "Node index not divisable by "
+                        fprintf(stderr, "Node index not divisible by "
                                "mask size,\n"
                                "  nodep: %p nodep->idx: 0x%lx "
                                "MASK_BITS: %lu\n",
diff --git a/tools/testing/selftests/kvm/lib/vmx.c b/tools/testing/selftests/kvm/lib/vmx.c
new file mode 100644
index 000000000000..0231bc0aae7b
--- /dev/null
+++ b/tools/testing/selftests/kvm/lib/vmx.c
@@ -0,0 +1,243 @@
+/*
+ * tools/testing/selftests/kvm/lib/x86.c
+ *
+ * Copyright (C) 2018, Google LLC.
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2.
+ */
+#define _GNU_SOURCE /* for program_invocation_name */
+#include "test_util.h"
+#include "kvm_util.h"
+#include "x86.h"
+#include "vmx.h"
+/* Create a default VM for VMX tests.
+ *
+ * Input Args:
+ *   vcpuid - The id of the single VCPU to add to the VM.
+ *   guest_code - The vCPU's entry point
+ *
+ * Output Args: None
+ *
+ * Return:
+ *   Pointer to opaque structure that describes the created VM.
+ */
+struct kvm_vm *
+vm_create_default_vmx(uint32_t vcpuid, vmx_guest_code_t guest_code)
+{
+        struct kvm_cpuid2 *cpuid;
+        struct kvm_vm *vm;
+        vm_vaddr_t vmxon_vaddr;
+        vm_paddr_t vmxon_paddr;
+        vm_vaddr_t vmcs_vaddr;
+        vm_paddr_t vmcs_paddr;
+        vm = vm_create_default(vcpuid, (void *) guest_code);
+        /* Enable nesting in CPUID */
+        vcpu_set_cpuid(vm, vcpuid, kvm_get_supported_cpuid());
+        /* Setup of a region of guest memory for the vmxon region. */
+        vmxon_vaddr = vm_vaddr_alloc(vm, getpagesize(), 0, 0, 0);
+        vmxon_paddr = addr_gva2gpa(vm, vmxon_vaddr);
+        /* Setup of a region of guest memory for a vmcs. */
+        vmcs_vaddr = vm_vaddr_alloc(vm, getpagesize(), 0, 0, 0);
+        vmcs_paddr = addr_gva2gpa(vm, vmcs_vaddr);
+        vcpu_args_set(vm, vcpuid, 4, vmxon_vaddr, vmxon_paddr, vmcs_vaddr,
+                      vmcs_paddr);
+        return vm;
+}
+void prepare_for_vmx_operation(void)
+{
+        uint64_t feature_control;
+        uint64_t required;
+        unsigned long cr0;
+        unsigned long cr4;
+        /*
+         * Ensure bits in CR0 and CR4 are valid in VMX operation:
+         * - Bit X is 1 in _FIXED0: bit X is fixed to 1 in CRx.
+         * - Bit X is 0 in _FIXED1: bit X is fixed to 0 in CRx.
+         */
+        __asm__ __volatile__("mov %%cr0, %0" : "=r"(cr0) : : "memory");
+        cr0 &= rdmsr(MSR_IA32_VMX_CR0_FIXED1);
+        cr0 |= rdmsr(MSR_IA32_VMX_CR0_FIXED0);
+        __asm__ __volatile__("mov %0, %%cr0" : : "r"(cr0) : "memory");
+        __asm__ __volatile__("mov %%cr4, %0" : "=r"(cr4) : : "memory");
+        cr4 &= rdmsr(MSR_IA32_VMX_CR4_FIXED1);
+        cr4 |= rdmsr(MSR_IA32_VMX_CR4_FIXED0);
+        /* Enable VMX operation */
+        cr4 |= X86_CR4_VMXE;
+        __asm__ __volatile__("mov %0, %%cr4" : : "r"(cr4) : "memory");
+        /*
+         * Configure IA32_FEATURE_CONTROL MSR to allow VMXON:
+         *  Bit 0: Lock bit. If clear, VMXON causes a #GP.
+         *  Bit 2: Enables VMXON outside of SMX operation. If clear, VMXON
+         *    outside of SMX causes a #GP.
+         */
+        required = FEATURE_CONTROL_VMXON_ENABLED_OUTSIDE_SMX;
+        required |= FEATURE_CONTROL_LOCKED;
+        feature_control = rdmsr(MSR_IA32_FEATURE_CONTROL);
+        if ((feature_control & required) != required)
+                wrmsr(MSR_IA32_FEATURE_CONTROL, feature_control | required);
+}
+/*
+ * Initialize the control fields to the most basic settings possible.
+ */
+static inline void init_vmcs_control_fields(void)
+{
+        vmwrite(VIRTUAL_PROCESSOR_ID, 0);
+        vmwrite(POSTED_INTR_NV, 0);
+        vmwrite(PIN_BASED_VM_EXEC_CONTROL, rdmsr(MSR_IA32_VMX_PINBASED_CTLS));
+        vmwrite(CPU_BASED_VM_EXEC_CONTROL, rdmsr(MSR_IA32_VMX_PROCBASED_CTLS));
+        vmwrite(EXCEPTION_BITMAP, 0);
+        vmwrite(PAGE_FAULT_ERROR_CODE_MASK, 0);
+        vmwrite(PAGE_FAULT_ERROR_CODE_MATCH, -1); /* Never match */
+        vmwrite(CR3_TARGET_COUNT, 0);
+        vmwrite(VM_EXIT_CONTROLS, rdmsr(MSR_IA32_VMX_EXIT_CTLS) |
+                VM_EXIT_HOST_ADDR_SPACE_SIZE);    /* 64-bit host */
+        vmwrite(VM_EXIT_MSR_STORE_COUNT, 0);
+        vmwrite(VM_EXIT_MSR_LOAD_COUNT, 0);
+        vmwrite(VM_ENTRY_CONTROLS, rdmsr(MSR_IA32_VMX_ENTRY_CTLS) |
+                VM_ENTRY_IA32E_MODE);             /* 64-bit guest */
+        vmwrite(VM_ENTRY_MSR_LOAD_COUNT, 0);
+        vmwrite(VM_ENTRY_INTR_INFO_FIELD, 0);
+        vmwrite(TPR_THRESHOLD, 0);
+        vmwrite(SECONDARY_VM_EXEC_CONTROL, 0);
+        vmwrite(CR0_GUEST_HOST_MASK, 0);
+        vmwrite(CR4_GUEST_HOST_MASK, 0);
+        vmwrite(CR0_READ_SHADOW, get_cr0());
+        vmwrite(CR4_READ_SHADOW, get_cr4());
+}
+/*
+ * Initialize the host state fields based on the current host state, with
+ * the exception of HOST_RSP and HOST_RIP, which should be set by vmlaunch
+ * or vmresume.
+ */
+static inline void init_vmcs_host_state(void)
+{
+        uint32_t exit_controls = vmreadz(VM_EXIT_CONTROLS);
+        vmwrite(HOST_ES_SELECTOR, get_es());
+        vmwrite(HOST_CS_SELECTOR, get_cs());
+        vmwrite(HOST_SS_SELECTOR, get_ss());
+        vmwrite(HOST_DS_SELECTOR, get_ds());
+        vmwrite(HOST_FS_SELECTOR, get_fs());
+        vmwrite(HOST_GS_SELECTOR, get_gs());
+        vmwrite(HOST_TR_SELECTOR, get_tr());
+        if (exit_controls & VM_EXIT_LOAD_IA32_PAT)
+                vmwrite(HOST_IA32_PAT, rdmsr(MSR_IA32_CR_PAT));
+        if (exit_controls & VM_EXIT_LOAD_IA32_EFER)
+                vmwrite(HOST_IA32_EFER, rdmsr(MSR_EFER));
+        if (exit_controls & VM_EXIT_LOAD_IA32_PERF_GLOBAL_CTRL)
+                vmwrite(HOST_IA32_PERF_GLOBAL_CTRL,
+                        rdmsr(MSR_CORE_PERF_GLOBAL_CTRL));
+        vmwrite(HOST_IA32_SYSENTER_CS, rdmsr(MSR_IA32_SYSENTER_CS));
+        vmwrite(HOST_CR0, get_cr0());
+        vmwrite(HOST_CR3, get_cr3());
+        vmwrite(HOST_CR4, get_cr4());
+        vmwrite(HOST_FS_BASE, rdmsr(MSR_FS_BASE));
+        vmwrite(HOST_GS_BASE, rdmsr(MSR_GS_BASE));
+        vmwrite(HOST_TR_BASE,
+                get_desc64_base((struct desc64 *)(get_gdt_base() + get_tr())));
+        vmwrite(HOST_GDTR_BASE, get_gdt_base());
+        vmwrite(HOST_IDTR_BASE, get_idt_base());
+        vmwrite(HOST_IA32_SYSENTER_ESP, rdmsr(MSR_IA32_SYSENTER_ESP));
+        vmwrite(HOST_IA32_SYSENTER_EIP, rdmsr(MSR_IA32_SYSENTER_EIP));
+}
+/*
+ * Initialize the guest state fields essentially as a clone of
+ * the host state fields. Some host state fields have fixed
+ * values, and we set the corresponding guest state fields accordingly.
+ */
+static inline void init_vmcs_guest_state(void *rip, void *rsp)
+{
+        vmwrite(GUEST_ES_SELECTOR, vmreadz(HOST_ES_SELECTOR));
+        vmwrite(GUEST_CS_SELECTOR, vmreadz(HOST_CS_SELECTOR));
+        vmwrite(GUEST_SS_SELECTOR, vmreadz(HOST_SS_SELECTOR));
+        vmwrite(GUEST_DS_SELECTOR, vmreadz(HOST_DS_SELECTOR));
+        vmwrite(GUEST_FS_SELECTOR, vmreadz(HOST_FS_SELECTOR));
+        vmwrite(GUEST_GS_SELECTOR, vmreadz(HOST_GS_SELECTOR));
+        vmwrite(GUEST_LDTR_SELECTOR, 0);
+        vmwrite(GUEST_TR_SELECTOR, vmreadz(HOST_TR_SELECTOR));
+        vmwrite(GUEST_INTR_STATUS, 0);
+        vmwrite(GUEST_PML_INDEX, 0);
+        vmwrite(VMCS_LINK_POINTER, -1ll);
+        vmwrite(GUEST_IA32_DEBUGCTL, 0);
+        vmwrite(GUEST_IA32_PAT, vmreadz(HOST_IA32_PAT));
+        vmwrite(GUEST_IA32_EFER, vmreadz(HOST_IA32_EFER));
+        vmwrite(GUEST_IA32_PERF_GLOBAL_CTRL,
+                vmreadz(HOST_IA32_PERF_GLOBAL_CTRL));
+        vmwrite(GUEST_ES_LIMIT, -1);
+        vmwrite(GUEST_CS_LIMIT, -1);
+        vmwrite(GUEST_SS_LIMIT, -1);
+        vmwrite(GUEST_DS_LIMIT, -1);
+        vmwrite(GUEST_FS_LIMIT, -1);
+        vmwrite(GUEST_GS_LIMIT, -1);
+        vmwrite(GUEST_LDTR_LIMIT, -1);
+        vmwrite(GUEST_TR_LIMIT, 0x67);
+        vmwrite(GUEST_GDTR_LIMIT, 0xffff);
+        vmwrite(GUEST_IDTR_LIMIT, 0xffff);
+        vmwrite(GUEST_ES_AR_BYTES,
+                vmreadz(GUEST_ES_SELECTOR) == 0 ? 0x10000 : 0xc093);
+        vmwrite(GUEST_CS_AR_BYTES, 0xa09b);
+        vmwrite(GUEST_SS_AR_BYTES, 0xc093);
+        vmwrite(GUEST_DS_AR_BYTES,
+                vmreadz(GUEST_DS_SELECTOR) == 0 ? 0x10000 : 0xc093);
+        vmwrite(GUEST_FS_AR_BYTES,
+                vmreadz(GUEST_FS_SELECTOR) == 0 ? 0x10000 : 0xc093);
+        vmwrite(GUEST_GS_AR_BYTES,
+                vmreadz(GUEST_GS_SELECTOR) == 0 ? 0x10000 : 0xc093);
+        vmwrite(GUEST_LDTR_AR_BYTES, 0x10000);
+        vmwrite(GUEST_TR_AR_BYTES, 0x8b);
+        vmwrite(GUEST_INTERRUPTIBILITY_INFO, 0);
+        vmwrite(GUEST_ACTIVITY_STATE, 0);
+        vmwrite(GUEST_SYSENTER_CS, vmreadz(HOST_IA32_SYSENTER_CS));
+        vmwrite(VMX_PREEMPTION_TIMER_VALUE, 0);
+        vmwrite(GUEST_CR0, vmreadz(HOST_CR0));
+        vmwrite(GUEST_CR3, vmreadz(HOST_CR3));
+        vmwrite(GUEST_CR4, vmreadz(HOST_CR4));
+        vmwrite(GUEST_ES_BASE, 0);
+        vmwrite(GUEST_CS_BASE, 0);
+        vmwrite(GUEST_SS_BASE, 0);
+        vmwrite(GUEST_DS_BASE, 0);
+        vmwrite(GUEST_FS_BASE, vmreadz(HOST_FS_BASE));
+        vmwrite(GUEST_GS_BASE, vmreadz(HOST_GS_BASE));
+        vmwrite(GUEST_LDTR_BASE, 0);
+        vmwrite(GUEST_TR_BASE, vmreadz(HOST_TR_BASE));
+        vmwrite(GUEST_GDTR_BASE, vmreadz(HOST_GDTR_BASE));
+        vmwrite(GUEST_IDTR_BASE, vmreadz(HOST_IDTR_BASE));
+        vmwrite(GUEST_DR7, 0x400);
+        vmwrite(GUEST_RSP, (uint64_t)rsp);
+        vmwrite(GUEST_RIP, (uint64_t)rip);
+        vmwrite(GUEST_RFLAGS, 2);
+        vmwrite(GUEST_PENDING_DBG_EXCEPTIONS, 0);
+        vmwrite(GUEST_SYSENTER_ESP, vmreadz(HOST_IA32_SYSENTER_ESP));
+        vmwrite(GUEST_SYSENTER_EIP, vmreadz(HOST_IA32_SYSENTER_EIP));
+}
+void prepare_vmcs(void *guest_rip, void *guest_rsp)
+{
+        init_vmcs_control_fields();
+        init_vmcs_host_state();
+        init_vmcs_guest_state(guest_rip, guest_rsp);
+}
diff --git a/tools/testing/selftests/kvm/vmx_tsc_adjust_test.c b/tools/testing/selftests/kvm/vmx_tsc_adjust_test.c
new file mode 100644
index 000000000000..8f7f62093add
--- /dev/null
+++ b/tools/testing/selftests/kvm/vmx_tsc_adjust_test.c
@@ -0,0 +1,231 @@
+/*
+ * gtests/tests/vmx_tsc_adjust_test.c
+ *
+ * Copyright (C) 2018, Google LLC.
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2.
+ *
+ *
+ * IA32_TSC_ADJUST test
+ *
+ * According to the SDM, "if an execution of WRMSR to the
+ * IA32_TIME_STAMP_COUNTER MSR adds (or subtracts) value X from the TSC,
+ * the logical processor also adds (or subtracts) value X from the
+ * IA32_TSC_ADJUST MSR.
+ *
+ * Note that when L1 doesn't intercept writes to IA32_TSC, a
+ * WRMSR(IA32_TSC) from L2 sets L1's TSC value, not L2's perceived TSC
+ * value.
+ *
+ * This test verifies that this unusual case is handled correctly.
+ */
+#include "test_util.h"
+#include "kvm_util.h"
+#include "x86.h"
+#include "vmx.h"
+#include <string.h>
+#include <sys/ioctl.h>
+#ifndef MSR_IA32_TSC_ADJUST
+#define MSR_IA32_TSC_ADJUST 0x3b
+#endif
+#define PAGE_SIZE       4096
+#define VCPU_ID         5
+#define TSC_ADJUST_VALUE (1ll << 32)
+#define TSC_OFFSET_VALUE -(1ll << 48)
+enum {
+        PORT_ABORT = 0x1000,
+        PORT_REPORT,
+        PORT_DONE,
+};
+struct vmx_page {
+        vm_vaddr_t virt;
+        vm_paddr_t phys;
+};
+enum {
+        VMXON_PAGE = 0,
+        VMCS_PAGE,
+        MSR_BITMAP_PAGE,
+        NUM_VMX_PAGES,
+};
+struct kvm_single_msr {
+        struct kvm_msrs header;
+        struct kvm_msr_entry entry;
+} __attribute__((packed));
+/* The virtual machine object. */
+static struct kvm_vm *vm;
+/* Array of vmx_page descriptors that is shared with the guest. */
+struct vmx_page *vmx_pages;
+#define exit_to_l0(_port, _arg) do_exit_to_l0(_port, (unsigned long) (_arg))
+static void do_exit_to_l0(uint16_t port, unsigned long arg)
+{
+        __asm__ __volatile__("in %[port], %%al"
+                :
+                : [port]"d"(port), "D"(arg)
+                : "rax");
+}
+#define GUEST_ASSERT(_condition) do {                                        \
+        if (!(_condition))                                                   \
+                exit_to_l0(PORT_ABORT, "Failed guest assert: " #_condition); \
+} while (0)
+static void check_ia32_tsc_adjust(int64_t max)
+{
+        int64_t adjust;
+        adjust = rdmsr(MSR_IA32_TSC_ADJUST);
+        exit_to_l0(PORT_REPORT, adjust);
+        GUEST_ASSERT(adjust <= max);
+}
+static void l2_guest_code(void)
+{
+        uint64_t l1_tsc = rdtsc() - TSC_OFFSET_VALUE;
+        wrmsr(MSR_IA32_TSC, l1_tsc - TSC_ADJUST_VALUE);
+        check_ia32_tsc_adjust(-2 * TSC_ADJUST_VALUE);
+        /* Exit to L1 */
+        __asm__ __volatile__("vmcall");
+}
+static void l1_guest_code(struct vmx_page *vmx_pages)
+{
+#define L2_GUEST_STACK_SIZE 64
+        unsigned long l2_guest_stack[L2_GUEST_STACK_SIZE];
+        uint32_t control;
+        uintptr_t save_cr3;
+        GUEST_ASSERT(rdtsc() < TSC_ADJUST_VALUE);
+        wrmsr(MSR_IA32_TSC, rdtsc() - TSC_ADJUST_VALUE);
+        check_ia32_tsc_adjust(-1 * TSC_ADJUST_VALUE);
+        prepare_for_vmx_operation();
+        /* Enter VMX root operation. */
+        *(uint32_t *)vmx_pages[VMXON_PAGE].virt = vmcs_revision();
+        GUEST_ASSERT(!vmxon(vmx_pages[VMXON_PAGE].phys));
+        /* Load a VMCS. */
+        *(uint32_t *)vmx_pages[VMCS_PAGE].virt = vmcs_revision();
+        GUEST_ASSERT(!vmclear(vmx_pages[VMCS_PAGE].phys));
+        GUEST_ASSERT(!vmptrld(vmx_pages[VMCS_PAGE].phys));
+        /* Prepare the VMCS for L2 execution. */
+        prepare_vmcs(l2_guest_code, &l2_guest_stack[L2_GUEST_STACK_SIZE]);
+        control = vmreadz(CPU_BASED_VM_EXEC_CONTROL);
+        control |= CPU_BASED_USE_MSR_BITMAPS | CPU_BASED_USE_TSC_OFFSETING;
+        vmwrite(CPU_BASED_VM_EXEC_CONTROL, control);
+        vmwrite(MSR_BITMAP, vmx_pages[MSR_BITMAP_PAGE].phys);
+        vmwrite(TSC_OFFSET, TSC_OFFSET_VALUE);
+        /* Jump into L2.  First, test failure to load guest CR3.  */
+        save_cr3 = vmreadz(GUEST_CR3);
+        vmwrite(GUEST_CR3, -1ull);
+        GUEST_ASSERT(!vmlaunch());
+        GUEST_ASSERT(vmreadz(VM_EXIT_REASON) ==
+                     (EXIT_REASON_FAILED_VMENTRY | EXIT_REASON_INVALID_STATE));
+        check_ia32_tsc_adjust(-1 * TSC_ADJUST_VALUE);
+        vmwrite(GUEST_CR3, save_cr3);
+        GUEST_ASSERT(!vmlaunch());
+        GUEST_ASSERT(vmreadz(VM_EXIT_REASON) == EXIT_REASON_VMCALL);
+        check_ia32_tsc_adjust(-2 * TSC_ADJUST_VALUE);
+        exit_to_l0(PORT_DONE, 0);
+}
+static void allocate_vmx_page(struct vmx_page *page)
+{
+        vm_vaddr_t virt;
+        virt = vm_vaddr_alloc(vm, PAGE_SIZE, 0, 0, 0);
+        memset(addr_gva2hva(vm, virt), 0, PAGE_SIZE);
+        page->virt = virt;
+        page->phys = addr_gva2gpa(vm, virt);
+}
+static vm_vaddr_t allocate_vmx_pages(void)
+{
+        vm_vaddr_t vmx_pages_vaddr;
+        int i;
+        vmx_pages_vaddr = vm_vaddr_alloc(
+                vm, sizeof(struct vmx_page) * NUM_VMX_PAGES, 0, 0, 0);
+        vmx_pages = (void *) addr_gva2hva(vm, vmx_pages_vaddr);
+        for (i = 0; i < NUM_VMX_PAGES; i++)
+                allocate_vmx_page(&vmx_pages[i]);
+        return vmx_pages_vaddr;
+}
+void report(int64_t val)
+{
+        printf("IA32_TSC_ADJUST is %ld (%lld * TSC_ADJUST_VALUE + %lld).\n",
+               val, val / TSC_ADJUST_VALUE, val % TSC_ADJUST_VALUE);
+}
+int main(int argc, char *argv[])
+{
+        vm_vaddr_t vmx_pages_vaddr;
+        struct kvm_cpuid_entry2 *entry = kvm_get_supported_cpuid_entry(1);
+        if (!(entry->ecx & CPUID_VMX)) {
+                printf("nested VMX not enabled, skipping test");
+                return 0;
+        }
+        vm = vm_create_default_vmx(VCPU_ID, (void *) l1_guest_code);
+        /* Allocate VMX pages and shared descriptors (vmx_pages). */
+        vmx_pages_vaddr = allocate_vmx_pages();
+        vcpu_args_set(vm, VCPU_ID, 1, vmx_pages_vaddr);
+        for (;;) {
+                volatile struct kvm_run *run = vcpu_state(vm, VCPU_ID);
+                struct kvm_regs regs;
+                vcpu_run(vm, VCPU_ID);
+                TEST_ASSERT(run->exit_reason == KVM_EXIT_IO,
+                            "Got exit_reason other than KVM_EXIT_IO: %u (%s),\n",
+                            run->exit_reason,
+                            exit_reason_str(run->exit_reason));
+                vcpu_regs_get(vm, VCPU_ID, &regs);
+                switch (run->io.port) {
+                case PORT_ABORT:
+                        TEST_ASSERT(false, "%s", (const char *) regs.rdi);
+                        /* NOT REACHED */
+                case PORT_REPORT:
+                        report(regs.rdi);
+                        break;
+                case PORT_DONE:
+                        goto done;
+                default:
+                        TEST_ASSERT(false, "Unknown port 0x%x.", run->io.port);
+                }
+        }
+        kvm_vm_free(vm);
+done:
+        return 0;
+}
diff --git a/tools/testing/selftests/net/Makefile b/tools/testing/selftests/net/Makefile
index 785fc18a16b4..8f1e13d2e547 100644
--- a/tools/testing/selftests/net/Makefile
+++ b/tools/testing/selftests/net/Makefile
@@ -5,7 +5,7 @@ CFLAGS =  -Wall -Wl,--no-as-needed -O2 -g
 CFLAGS += -I../../../../usr/include/
 TEST_PROGS := run_netsocktests run_afpackettests test_bpf.sh netdevice.sh rtnetlink.sh
-TEST_PROGS += fib_tests.sh fib-onlink-tests.sh pmtu.sh
+TEST_PROGS += fib_tests.sh fib-onlink-tests.sh in_netns.sh pmtu.sh
 TEST_GEN_FILES =  socket
 TEST_GEN_FILES += psock_fanout psock_tpacket msg_zerocopy
 TEST_GEN_PROGS = reuseport_bpf reuseport_bpf_cpu reuseport_bpf_numa