22 files changed, 817 insertions, 197 deletions

diff --git a/lib/Kconfig.debug b/lib/Kconfig.debug
index 2307d7c89dac..cab7405f48d2 100644
--- a/lib/Kconfig.debug
+++ b/lib/Kconfig.debug
@@ -821,7 +821,7 @@ config DETECT_HUNG_TASK
         help
           Say Y here to enable the kernel to detect "hung tasks",
           which are bugs that cause the task to be stuck in
-          uninterruptible "D" state indefinitiley.
+          uninterruptible "D" state indefinitely.
 
           When a hung task is detected, the kernel will print the
           current stack trace (which you should report), but the
@@ -1686,24 +1686,6 @@ config LATENCYTOP
           Enable this option if you want to use the LatencyTOP tool
           to find out which userspace is blocking on what kernel operations.
 
-config ARCH_HAS_DEBUG_STRICT_USER_COPY_CHECKS
-        bool
-
-config DEBUG_STRICT_USER_COPY_CHECKS
-        bool "Strict user copy size checks"
-        depends on ARCH_HAS_DEBUG_STRICT_USER_COPY_CHECKS
-        depends on DEBUG_KERNEL && !TRACE_BRANCH_PROFILING
-        help
-          Enabling this option turns a certain set of sanity checks for user
-          copy operations into compile time failures.
-
-          The copy_from_user() etc checks are there to help test if there
-          are sufficient security checks on the length argument of
-          the copy operation, by having gcc prove that the argument is
-          within bounds.
-
-          If unsure, say N.
-
 source kernel/trace/Kconfig
 
 menu "Runtime Testing"
diff --git a/lib/Kconfig.ubsan b/lib/Kconfig.ubsan
index 39494af9a84a..bc6e651df68c 100644
--- a/lib/Kconfig.ubsan
+++ b/lib/Kconfig.ubsan
@@ -1,6 +1,9 @@
 config ARCH_HAS_UBSAN_SANITIZE_ALL
         bool
 
+config ARCH_WANTS_UBSAN_NO_NULL
+        def_bool n
+
 config UBSAN
         bool "Undefined behaviour sanity checker"
         help
@@ -34,3 +37,11 @@ config UBSAN_ALIGNMENT
           This option enables detection of unaligned memory accesses.
           Enabling this option on architectures that support unaligned
           accesses may produce a lot of false positives.
+
+config UBSAN_NULL
+        bool "Enable checking of null pointers"
+        depends on UBSAN
+        default y if !ARCH_WANTS_UBSAN_NO_NULL
+        help
+          This option enables detection of memory accesses via a
+          null pointer.
diff --git a/lib/Makefile b/lib/Makefile
index cfa68eb269e4..df747e5eeb7a 100644
--- a/lib/Makefile
+++ b/lib/Makefile
@@ -22,9 +22,8 @@ lib-y := ctype.o string.o vsprintf.o cmdline.o \
          sha1.o chacha20.o md5.o irq_regs.o argv_split.o \
          flex_proportions.o ratelimit.o show_mem.o \
          is_single_threaded.o plist.o decompress.o kobject_uevent.o \
-         earlycpio.o seq_buf.o nmi_backtrace.o nodemask.o
+         earlycpio.o seq_buf.o nmi_backtrace.o nodemask.o win_minmax.o
 
-obj-$(CONFIG_ARCH_HAS_DEBUG_STRICT_USER_COPY_CHECKS) += usercopy.o
 lib-$(CONFIG_MMU) += ioremap.o
 lib-$(CONFIG_SMP) += cpumask.o
 lib-$(CONFIG_HAS_DMA) += dma-noop.o
diff --git a/lib/cpu-notifier-error-inject.c b/lib/cpu-notifier-error-inject.c
index 707ca24f7b18..0e2c9a1e958a 100644
--- a/lib/cpu-notifier-error-inject.c
+++ b/lib/cpu-notifier-error-inject.c
@@ -8,16 +8,47 @@ static int priority;
 module_param(priority, int, 0);
 MODULE_PARM_DESC(priority, "specify cpu notifier priority");
 
+#define UP_PREPARE 0
+#define UP_PREPARE_FROZEN 0
+#define DOWN_PREPARE 0
+#define DOWN_PREPARE_FROZEN 0
+
 static struct notifier_err_inject cpu_notifier_err_inject = {
         .actions = {
-                { NOTIFIER_ERR_INJECT_ACTION(CPU_UP_PREPARE) },
-                { NOTIFIER_ERR_INJECT_ACTION(CPU_UP_PREPARE_FROZEN) },
-                { NOTIFIER_ERR_INJECT_ACTION(CPU_DOWN_PREPARE) },
-                { NOTIFIER_ERR_INJECT_ACTION(CPU_DOWN_PREPARE_FROZEN) },
+                { NOTIFIER_ERR_INJECT_ACTION(UP_PREPARE) },
+                { NOTIFIER_ERR_INJECT_ACTION(UP_PREPARE_FROZEN) },
+                { NOTIFIER_ERR_INJECT_ACTION(DOWN_PREPARE) },
+                { NOTIFIER_ERR_INJECT_ACTION(DOWN_PREPARE_FROZEN) },
                 {}
         }
 };
 
+static int notf_err_handle(struct notifier_err_inject_action *action)
+{
+        int ret;
+
+        ret = action->error;
+        if (ret)
+                pr_info("Injecting error (%d) to %s\n", ret, action->name);
+        return ret;
+}
+
+static int notf_err_inj_up_prepare(unsigned int cpu)
+{
+        if (!cpuhp_tasks_frozen)
+                return notf_err_handle(&cpu_notifier_err_inject.actions[0]);
+        else
+                return notf_err_handle(&cpu_notifier_err_inject.actions[1]);
+}
+
+static int notf_err_inj_dead(unsigned int cpu)
+{
+        if (!cpuhp_tasks_frozen)
+                return notf_err_handle(&cpu_notifier_err_inject.actions[2]);
+        else
+                return notf_err_handle(&cpu_notifier_err_inject.actions[3]);
+}
+
 static struct dentry *dir;
 
 static int err_inject_init(void)
@@ -29,7 +60,10 @@ static int err_inject_init(void)
         if (IS_ERR(dir))
                 return PTR_ERR(dir);
 
-        err = register_hotcpu_notifier(&cpu_notifier_err_inject.nb);
+        err = cpuhp_setup_state_nocalls(CPUHP_NOTF_ERR_INJ_PREPARE,
+                                        "cpu-err-notif:prepare",
+                                        notf_err_inj_up_prepare,
+                                        notf_err_inj_dead);
         if (err)
                 debugfs_remove_recursive(dir);
 
@@ -38,7 +72,7 @@ static int err_inject_init(void)
 
 static void err_inject_exit(void)
 {
-        unregister_hotcpu_notifier(&cpu_notifier_err_inject.nb);
+        cpuhp_remove_state_nocalls(CPUHP_NOTF_ERR_INJ_PREPARE);
         debugfs_remove_recursive(dir);
 }
 
diff --git a/lib/dma-debug.c b/lib/dma-debug.c
index fcfa1939ac41..8971370bfb16 100644
--- a/lib/dma-debug.c
+++ b/lib/dma-debug.c
@@ -22,6 +22,7 @@
 #include <linux/stacktrace.h>
 #include <linux/dma-debug.h>
 #include <linux/spinlock.h>
+#include <linux/vmalloc.h>
 #include <linux/debugfs.h>
 #include <linux/uaccess.h>
 #include <linux/export.h>
@@ -43,6 +44,7 @@ enum {
         dma_debug_page,
         dma_debug_sg,
         dma_debug_coherent,
+        dma_debug_resource,
 };
 
 enum map_err_types {
@@ -150,8 +152,9 @@ static const char *const maperr2str[] = {
         [MAP_ERR_CHECKED] = "dma map error checked",
 };
 
-static const char *type2name[4] = { "single", "page",
-                                    "scather-gather", "coherent" };
+static const char *type2name[5] = { "single", "page",
+                                    "scather-gather", "coherent",
+                                    "resource" };
 
 static const char *dir2name[4] = { "DMA_BIDIRECTIONAL", "DMA_TO_DEVICE",
                                    "DMA_FROM_DEVICE", "DMA_NONE" };
@@ -399,6 +402,9 @@ static void hash_bucket_del(struct dma_debug_entry *entry)
 
 static unsigned long long phys_addr(struct dma_debug_entry *entry)
 {
+        if (entry->type == dma_debug_resource)
+                return __pfn_to_phys(entry->pfn) + entry->offset;
+
         return page_to_phys(pfn_to_page(entry->pfn)) + entry->offset;
 }
 
@@ -1164,11 +1170,32 @@ static void check_unmap(struct dma_debug_entry *ref)
         put_hash_bucket(bucket, &flags);
 }
 
-static void check_for_stack(struct device *dev, void *addr)
+static void check_for_stack(struct device *dev,
+                            struct page *page, size_t offset)
 {
-        if (object_is_on_stack(addr))
-                err_printk(dev, NULL, "DMA-API: device driver maps memory from "
-                                "stack [addr=%p]\n", addr);
+        void *addr;
+        struct vm_struct *stack_vm_area = task_stack_vm_area(current);
+
+        if (!stack_vm_area) {
+                /* Stack is direct-mapped. */
+                if (PageHighMem(page))
+                        return;
+                addr = page_address(page) + offset;
+                if (object_is_on_stack(addr))
+                        err_printk(dev, NULL, "DMA-API: device driver maps memory from stack [addr=%p]\n", addr);
+        } else {
+                /* Stack is vmalloced. */
+                int i;
+
+                for (i = 0; i < stack_vm_area->nr_pages; i++) {
+                        if (page != stack_vm_area->pages[i])
+                                continue;
+
+                        addr = (u8 *)current->stack + i * PAGE_SIZE + offset;
+                        err_printk(dev, NULL, "DMA-API: device driver maps memory from stack [probable addr=%p]\n", addr);
+                        break;
+                }
+        }
 }
 
 static inline bool overlap(void *addr, unsigned long len, void *start, void *end)
@@ -1291,10 +1318,11 @@ void debug_dma_map_page(struct device *dev, struct page *page, size_t offset,
         if (map_single)
                 entry->type = dma_debug_single;
 
+        check_for_stack(dev, page, offset);
+
         if (!PageHighMem(page)) {
                 void *addr = page_address(page) + offset;
 
-                check_for_stack(dev, addr);
                 check_for_illegal_area(dev, addr, size);
         }
 
@@ -1386,8 +1414,9 @@ void debug_dma_map_sg(struct device *dev, struct scatterlist *sg,
                 entry->sg_call_ents   = nents;
                 entry->sg_mapped_ents = mapped_ents;
 
+                check_for_stack(dev, sg_page(s), s->offset);
+
                 if (!PageHighMem(sg_page(s))) {
-                        check_for_stack(dev, sg_virt(s));
                         check_for_illegal_area(dev, sg_virt(s), sg_dma_len(s));
                 }
 
@@ -1495,6 +1524,49 @@ void debug_dma_free_coherent(struct device *dev, size_t size,
 }
 EXPORT_SYMBOL(debug_dma_free_coherent);
 
+void debug_dma_map_resource(struct device *dev, phys_addr_t addr, size_t size,
+                            int direction, dma_addr_t dma_addr)
+{
+        struct dma_debug_entry *entry;
+
+        if (unlikely(dma_debug_disabled()))
+                return;
+
+        entry = dma_entry_alloc();
+        if (!entry)
+                return;
+
+        entry->type             = dma_debug_resource;
+        entry->dev              = dev;
+        entry->pfn              = PHYS_PFN(addr);
+        entry->offset           = offset_in_page(addr);
+        entry->size             = size;
+        entry->dev_addr         = dma_addr;
+        entry->direction        = direction;
+        entry->map_err_type     = MAP_ERR_NOT_CHECKED;
+
+        add_dma_entry(entry);
+}
+EXPORT_SYMBOL(debug_dma_map_resource);
+
+void debug_dma_unmap_resource(struct device *dev, dma_addr_t dma_addr,
+                              size_t size, int direction)
+{
+        struct dma_debug_entry ref = {
+                .type           = dma_debug_resource,
+                .dev            = dev,
+                .dev_addr       = dma_addr,
+                .size           = size,
+                .direction      = direction,
+        };
+
+        if (unlikely(dma_debug_disabled()))
+                return;
+
+        check_unmap(&ref);
+}
+EXPORT_SYMBOL(debug_dma_unmap_resource);
+
 void debug_dma_sync_single_for_cpu(struct device *dev, dma_addr_t dma_handle,
                                    size_t size, int direction)
 {
diff --git a/lib/iov_iter.c b/lib/iov_iter.c
index 9e8c7386b3a0..7e3138cfc8c9 100644
--- a/lib/iov_iter.c
+++ b/lib/iov_iter.c
@@ -291,33 +291,13 @@ done:
 }
 
 /*
- * Fault in the first iovec of the given iov_iter, to a maximum length
- * of bytes. Returns 0 on success, or non-zero if the memory could not be
- * accessed (ie. because it is an invalid address).
- *
- * writev-intensive code may want this to prefault several iovecs -- that
- * would be possible (callers must not rely on the fact that _only_ the
- * first iovec will be faulted with the current implementation).
- */
-int iov_iter_fault_in_readable(struct iov_iter *i, size_t bytes)
-{
-        if (!(i->type & (ITER_BVEC|ITER_KVEC))) {
-                char __user *buf = i->iov->iov_base + i->iov_offset;
-                bytes = min(bytes, i->iov->iov_len - i->iov_offset);
-                return fault_in_pages_readable(buf, bytes);
-        }
-        return 0;
-}
-EXPORT_SYMBOL(iov_iter_fault_in_readable);
-
-/*
  * Fault in one or more iovecs of the given iov_iter, to a maximum length of
  * bytes.  For each iovec, fault in each page that constitutes the iovec.
  *
  * Return 0 on success, or non-zero if the memory could not be accessed (i.e.
  * because it is an invalid address).
  */
-int iov_iter_fault_in_multipages_readable(struct iov_iter *i, size_t bytes)
+int iov_iter_fault_in_readable(struct iov_iter *i, size_t bytes)
 {
         size_t skip = i->iov_offset;
         const struct iovec *iov;
@@ -334,7 +314,7 @@ int iov_iter_fault_in_multipages_readable(struct iov_iter *i, size_t bytes)
         }
         return 0;
 }
-EXPORT_SYMBOL(iov_iter_fault_in_multipages_readable);
+EXPORT_SYMBOL(iov_iter_fault_in_readable);
 
 void iov_iter_init(struct iov_iter *i, int direction,
                         const struct iovec *iov, unsigned long nr_segs,
diff --git a/lib/irq_poll.c b/lib/irq_poll.c
index 836f7db4e548..2be55692aa43 100644
--- a/lib/irq_poll.c
+++ b/lib/irq_poll.c
@@ -184,30 +184,21 @@ void irq_poll_init(struct irq_poll *iop, int weight, irq_poll_fn *poll_fn)
 }
 EXPORT_SYMBOL(irq_poll_init);
 
-static int irq_poll_cpu_notify(struct notifier_block *self,
-                                 unsigned long action, void *hcpu)
+static int irq_poll_cpu_dead(unsigned int cpu)
 {
         /*
          * If a CPU goes away, splice its entries to the current CPU
          * and trigger a run of the softirq
          */
-        if (action == CPU_DEAD || action == CPU_DEAD_FROZEN) {
-                int cpu = (unsigned long) hcpu;
-
-                local_irq_disable();
-                list_splice_init(&per_cpu(blk_cpu_iopoll, cpu),
-                                 this_cpu_ptr(&blk_cpu_iopoll));
-                __raise_softirq_irqoff(IRQ_POLL_SOFTIRQ);
-                local_irq_enable();
-        }
+        local_irq_disable();
+        list_splice_init(&per_cpu(blk_cpu_iopoll, cpu),
+                         this_cpu_ptr(&blk_cpu_iopoll));
+        __raise_softirq_irqoff(IRQ_POLL_SOFTIRQ);
+        local_irq_enable();
 
-        return NOTIFY_OK;
+        return 0;
 }
 
-static struct notifier_block irq_poll_cpu_notifier = {
-        .notifier_call  = irq_poll_cpu_notify,
-};
-
 static __init int irq_poll_setup(void)
 {
         int i;
@@ -216,7 +207,8 @@ static __init int irq_poll_setup(void)
                 INIT_LIST_HEAD(&per_cpu(blk_cpu_iopoll, i));
 
         open_softirq(IRQ_POLL_SOFTIRQ, irq_poll_softirq);
-        register_hotcpu_notifier(&irq_poll_cpu_notifier);
+        cpuhp_setup_state_nocalls(CPUHP_IRQ_POLL_DEAD, "irq_poll:dead", NULL,
+                                  irq_poll_cpu_dead);
         return 0;
 }
 subsys_initcall(irq_poll_setup);
diff --git a/lib/radix-tree.c b/lib/radix-tree.c
index 1b7bf7314141..8e6d552c40dd 100644
--- a/lib/radix-tree.c
+++ b/lib/radix-tree.c
@@ -105,10 +105,10 @@ static unsigned int radix_tree_descend(struct radix_tree_node *parent,
 
 #ifdef CONFIG_RADIX_TREE_MULTIORDER
         if (radix_tree_is_internal_node(entry)) {
-                unsigned long siboff = get_slot_offset(parent, entry);
-                if (siboff < RADIX_TREE_MAP_SIZE) {
-                        offset = siboff;
-                        entry = rcu_dereference_raw(parent->slots[offset]);
+                if (is_sibling_entry(parent, entry)) {
+                        void **sibentry = (void **) entry_to_node(entry);
+                        offset = get_slot_offset(parent, sibentry);
+                        entry = rcu_dereference_raw(*sibentry);
                 }
         }
 #endif
@@ -1583,15 +1583,10 @@ void *radix_tree_delete(struct radix_tree_root *root, unsigned long index)
 }
 EXPORT_SYMBOL(radix_tree_delete);
 
-struct radix_tree_node *radix_tree_replace_clear_tags(
-                        struct radix_tree_root *root,
-                        unsigned long index, void *entry)
+void radix_tree_clear_tags(struct radix_tree_root *root,
+                           struct radix_tree_node *node,
+                           void **slot)
 {
-        struct radix_tree_node *node;
-        void **slot;
-
-        __radix_tree_lookup(root, index, &node, &slot);
-
         if (node) {
                 unsigned int tag, offset = get_slot_offset(node, slot);
                 for (tag = 0; tag < RADIX_TREE_MAX_TAGS; tag++)
@@ -1600,9 +1595,6 @@ struct radix_tree_node *radix_tree_replace_clear_tags(
                 /* Clear root node tags */
                 root->gfp_mask &= __GFP_BITS_MASK;
         }
-
-        radix_tree_replace_slot(slot, entry);
-        return node;
 }
 
 /**
diff --git a/lib/raid6/.gitignore b/lib/raid6/.gitignore
index 0a7e494b2bcd..f01b1cb04f91 100644
--- a/lib/raid6/.gitignore
+++ b/lib/raid6/.gitignore
@@ -3,3 +3,4 @@ altivec*.c
 int*.c
 tables.c
 neon?.c
+s390vx?.c
diff --git a/lib/raid6/Makefile b/lib/raid6/Makefile
index 3b10a48fa040..29f503ebfd60 100644
--- a/lib/raid6/Makefile
+++ b/lib/raid6/Makefile
@@ -7,6 +7,7 @@ raid6_pq-$(CONFIG_X86) += recov_ssse3.o recov_avx2.o mmx.o sse1.o sse2.o avx2.o
 raid6_pq-$(CONFIG_ALTIVEC) += altivec1.o altivec2.o altivec4.o altivec8.o
 raid6_pq-$(CONFIG_KERNEL_MODE_NEON) += neon.o neon1.o neon2.o neon4.o neon8.o
 raid6_pq-$(CONFIG_TILEGX) += tilegx8.o
+raid6_pq-$(CONFIG_S390) += s390vx8.o recov_s390xc.o
 
 hostprogs-y     += mktables
 
@@ -116,6 +117,11 @@ $(obj)/tilegx8.c:   UNROLL := 8
 $(obj)/tilegx8.c:   $(src)/tilegx.uc $(src)/unroll.awk FORCE
         $(call if_changed,unroll)
 
+targets += s390vx8.c
+$(obj)/s390vx8.c:   UNROLL := 8
+$(obj)/s390vx8.c:   $(src)/s390vx.uc $(src)/unroll.awk FORCE
+        $(call if_changed,unroll)
+
 quiet_cmd_mktable = TABLE   $@
       cmd_mktable = $(obj)/mktables > $@ || ( rm -f $@ && exit 1 )
 
diff --git a/lib/raid6/algos.c b/lib/raid6/algos.c
index 975c6e0434bd..592ff49df47d 100644
--- a/lib/raid6/algos.c
+++ b/lib/raid6/algos.c
@@ -69,6 +69,9 @@ const struct raid6_calls * const raid6_algos[] = {
 #if defined(CONFIG_TILEGX)
         &raid6_tilegx8,
 #endif
+#if defined(CONFIG_S390)
+        &raid6_s390vx8,
+#endif
         &raid6_intx1,
         &raid6_intx2,
         &raid6_intx4,
@@ -95,6 +98,9 @@ const struct raid6_recov_calls *const raid6_recov_algos[] = {
 #ifdef CONFIG_AS_SSSE3
         &raid6_recov_ssse3,
 #endif
+#ifdef CONFIG_S390
+        &raid6_recov_s390xc,
+#endif
         &raid6_recov_intx1,
         NULL
 };
diff --git a/lib/raid6/recov_s390xc.c b/lib/raid6/recov_s390xc.c
new file mode 100644
index 000000000000..b042dac826cc
--- /dev/null
+++ b/lib/raid6/recov_s390xc.c
@@ -0,0 +1,116 @@
+/*
+ * RAID-6 data recovery in dual failure mode based on the XC instruction.
+ *
+ * Copyright IBM Corp. 2016
+ * Author(s): Martin Schwidefsky <schwidefsky@de.ibm.com>
+ */
+
+#include <linux/export.h>
+#include <linux/raid/pq.h>
+
+static inline void xor_block(u8 *p1, u8 *p2)
+{
+        typedef struct { u8 _[256]; } addrtype;
+
+        asm volatile(
+                "       xc      0(256,%[p1]),0(%[p2])\n"
+                : "+m" (*(addrtype *) p1) : "m" (*(addrtype *) p2),
+                  [p1] "a" (p1), [p2] "a" (p2) : "cc");
+}
+
+/* Recover two failed data blocks. */
+static void raid6_2data_recov_s390xc(int disks, size_t bytes, int faila,
+                int failb, void **ptrs)
+{
+        u8 *p, *q, *dp, *dq;
+        const u8 *pbmul;        /* P multiplier table for B data */
+        const u8 *qmul;         /* Q multiplier table (for both) */
+        int i;
+
+        p = (u8 *)ptrs[disks-2];
+        q = (u8 *)ptrs[disks-1];
+
+        /* Compute syndrome with zero for the missing data pages
+           Use the dead data pages as temporary storage for
+           delta p and delta q */
+        dp = (u8 *)ptrs[faila];
+        ptrs[faila] = (void *)raid6_empty_zero_page;
+        ptrs[disks-2] = dp;
+        dq = (u8 *)ptrs[failb];
+        ptrs[failb] = (void *)raid6_empty_zero_page;
+        ptrs[disks-1] = dq;
+
+        raid6_call.gen_syndrome(disks, bytes, ptrs);
+
+        /* Restore pointer table */
+        ptrs[faila]   = dp;
+        ptrs[failb]   = dq;
+        ptrs[disks-2] = p;
+        ptrs[disks-1] = q;
+
+        /* Now, pick the proper data tables */
+        pbmul = raid6_gfmul[raid6_gfexi[failb-faila]];
+        qmul  = raid6_gfmul[raid6_gfinv[raid6_gfexp[faila]^raid6_gfexp[failb]]];
+
+        /* Now do it... */
+        while (bytes) {
+                xor_block(dp, p);
+                xor_block(dq, q);
+                for (i = 0; i < 256; i++)
+                        dq[i] = pbmul[dp[i]] ^ qmul[dq[i]];
+                xor_block(dp, dq);
+                p += 256;
+                q += 256;
+                dp += 256;
+                dq += 256;
+                bytes -= 256;
+        }
+}
+
+/* Recover failure of one data block plus the P block */
+static void raid6_datap_recov_s390xc(int disks, size_t bytes, int faila,
+                void **ptrs)
+{
+        u8 *p, *q, *dq;
+        const u8 *qmul;         /* Q multiplier table */
+        int i;
+
+        p = (u8 *)ptrs[disks-2];
+        q = (u8 *)ptrs[disks-1];
+
+        /* Compute syndrome with zero for the missing data page
+           Use the dead data page as temporary storage for delta q */
+        dq = (u8 *)ptrs[faila];
+        ptrs[faila] = (void *)raid6_empty_zero_page;
+        ptrs[disks-1] = dq;
+
+        raid6_call.gen_syndrome(disks, bytes, ptrs);
+
+        /* Restore pointer table */
+        ptrs[faila]   = dq;
+        ptrs[disks-1] = q;
+
+        /* Now, pick the proper data tables */
+        qmul  = raid6_gfmul[raid6_gfinv[raid6_gfexp[faila]]];
+
+        /* Now do it... */
+        while (bytes) {
+                xor_block(dq, q);
+                for (i = 0; i < 256; i++)
+                        dq[i] = qmul[dq[i]];
+                xor_block(p, dq);
+                p += 256;
+                q += 256;
+                dq += 256;
+                bytes -= 256;
+        }
+}
+
+
+const struct raid6_recov_calls raid6_recov_s390xc = {
+        .data2 = raid6_2data_recov_s390xc,
+        .datap = raid6_datap_recov_s390xc,
+        .valid = NULL,
+        .name = "s390xc",
+        .priority = 1,
+};
diff --git a/lib/raid6/s390vx.uc b/lib/raid6/s390vx.uc
new file mode 100644
index 000000000000..7b45191a655f
--- /dev/null
+++ b/lib/raid6/s390vx.uc
@@ -0,0 +1,168 @@
+/*
+ * raid6_vx$#.c
+ *
+ * $#-way unrolled RAID6 gen/xor functions for s390
+ * based on the vector facility
+ *
+ * Copyright IBM Corp. 2016
+ * Author(s): Martin Schwidefsky <schwidefsky@de.ibm.com>
+ *
+ * This file is postprocessed using unroll.awk.
+ */
+
+#include <linux/raid/pq.h>
+#include <asm/fpu/api.h>
+
+asm(".include \"asm/vx-insn.h\"\n");
+
+#define NSIZE 16
+
+static inline void LOAD_CONST(void)
+{
+        asm volatile("VREPIB %v24,7");
+        asm volatile("VREPIB %v25,0x1d");
+}
+
+/*
+ * The SHLBYTE() operation shifts each of the 16 bytes in
+ * vector register y left by 1 bit and stores the result in
+ * vector register x.
+ */
+static inline void SHLBYTE(int x, int y)
+{
+        asm volatile ("VAB %0,%1,%1" : : "i" (x), "i" (y));
+}
+
+/*
+ * For each of the 16 bytes in the vector register y the MASK()
+ * operation returns 0xFF if the high bit of the byte is 1,
+ * or 0x00 if the high bit is 0. The result is stored in vector
+ * register x.
+ */
+static inline void MASK(int x, int y)
+{
+        asm volatile ("VESRAVB  %0,%1,24" : : "i" (x), "i" (y));
+}
+
+static inline void AND(int x, int y, int z)
+{
+        asm volatile ("VN %0,%1,%2" : : "i" (x), "i" (y), "i" (z));
+}
+
+static inline void XOR(int x, int y, int z)
+{
+        asm volatile ("VX %0,%1,%2" : : "i" (x), "i" (y), "i" (z));
+}
+
+static inline void LOAD_DATA(int x, int n, u8 *ptr)
+{
+        typedef struct { u8 _[16*n]; } addrtype;
+        register addrtype *__ptr asm("1") = (addrtype *) ptr;
+
+        asm volatile ("VLM %2,%3,0,%r1"
+                      : : "m" (*__ptr), "a" (__ptr), "i" (x), "i" (x + n - 1));
+}
+
+static inline void STORE_DATA(int x, int n, u8 *ptr)
+{
+        typedef struct { u8 _[16*n]; } addrtype;
+        register addrtype *__ptr asm("1") = (addrtype *) ptr;
+
+        asm volatile ("VSTM %2,%3,0,1"
+                      : "=m" (*__ptr) : "a" (__ptr), "i" (x), "i" (x + n - 1));
+}
+
+static inline void COPY_VEC(int x, int y)
+{
+        asm volatile ("VLR %0,%1" : : "i" (x), "i" (y));
+}
+
+static void raid6_s390vx$#_gen_syndrome(int disks, size_t bytes, void **ptrs)
+{
+        struct kernel_fpu vxstate;
+        u8 **dptr, *p, *q;
+        int d, z, z0;
+
+        kernel_fpu_begin(&vxstate, KERNEL_VXR);
+        LOAD_CONST();
+
+        dptr = (u8 **) ptrs;
+        z0 = disks - 3;         /* Highest data disk */
+        p = dptr[z0 + 1];       /* XOR parity */
+        q = dptr[z0 + 2];       /* RS syndrome */
+
+        for (d = 0; d < bytes; d += $#*NSIZE) {
+                LOAD_DATA(0,$#,&dptr[z0][d]);
+                COPY_VEC(8+$$,0+$$);
+                for (z = z0 - 1; z >= 0; z--) {
+                        MASK(16+$$,8+$$);
+                        AND(16+$$,16+$$,25);
+                        SHLBYTE(8+$$,8+$$);
+                        XOR(8+$$,8+$$,16+$$);
+                        LOAD_DATA(16,$#,&dptr[z][d]);
+                        XOR(0+$$,0+$$,16+$$);
+                        XOR(8+$$,8+$$,16+$$);
+                }
+                STORE_DATA(0,$#,&p[d]);
+                STORE_DATA(8,$#,&q[d]);
+        }
+        kernel_fpu_end(&vxstate, KERNEL_VXR);
+}
+
+static void raid6_s390vx$#_xor_syndrome(int disks, int start, int stop,
+                                        size_t bytes, void **ptrs)
+{
+        struct kernel_fpu vxstate;
+        u8 **dptr, *p, *q;
+        int d, z, z0;
+
+        dptr = (u8 **) ptrs;
+        z0 = stop;              /* P/Q right side optimization */
+        p = dptr[disks - 2];    /* XOR parity */
+        q = dptr[disks - 1];    /* RS syndrome */
+
+        kernel_fpu_begin(&vxstate, KERNEL_VXR);
+        LOAD_CONST();
+
+        for (d = 0; d < bytes; d += $#*NSIZE) {
+                /* P/Q data pages */
+                LOAD_DATA(0,$#,&dptr[z0][d]);
+                COPY_VEC(8+$$,0+$$);
+                for (z = z0 - 1; z >= start; z--) {
+                        MASK(16+$$,8+$$);
+                        AND(16+$$,16+$$,25);
+                        SHLBYTE(8+$$,8+$$);
+                        XOR(8+$$,8+$$,16+$$);
+                        LOAD_DATA(16,$#,&dptr[z][d]);
+                        XOR(0+$$,0+$$,16+$$);
+                        XOR(8+$$,8+$$,16+$$);
+                }
+                /* P/Q left side optimization */
+                for (z = start - 1; z >= 0; z--) {
+                        MASK(16+$$,8+$$);
+                        AND(16+$$,16+$$,25);
+                        SHLBYTE(8+$$,8+$$);
+                        XOR(8+$$,8+$$,16+$$);
+                }
+                LOAD_DATA(16,$#,&p[d]);
+                XOR(16+$$,16+$$,0+$$);
+                STORE_DATA(16,$#,&p[d]);
+                LOAD_DATA(16,$#,&q[d]);
+                XOR(16+$$,16+$$,8+$$);
+                STORE_DATA(16,$#,&q[d]);
+        }
+        kernel_fpu_end(&vxstate, KERNEL_VXR);
+}
+
+static int raid6_s390vx$#_valid(void)
+{
+        return MACHINE_HAS_VX;
+}
+
+const struct raid6_calls raid6_s390vx$# = {
+        raid6_s390vx$#_gen_syndrome,
+        raid6_s390vx$#_xor_syndrome,
+        raid6_s390vx$#_valid,
+        "vx128x$#",
+        1
+};
diff --git a/lib/random32.c b/lib/random32.c
index 69ed593aab07..915982b304bb 100644
--- a/lib/random32.c
+++ b/lib/random32.c
@@ -81,7 +81,7 @@ u32 prandom_u32(void)
         u32 res;
 
         res = prandom_u32_state(state);
-        put_cpu_var(state);
+        put_cpu_var(net_rand_state);
 
         return res;
 }
@@ -128,7 +128,7 @@ void prandom_bytes(void *buf, size_t bytes)
         struct rnd_state *state = &get_cpu_var(net_rand_state);
 
         prandom_bytes_state(state, buf, bytes);
-        put_cpu_var(state);
+        put_cpu_var(net_rand_state);
 }
 EXPORT_SYMBOL(prandom_bytes);
 
diff --git a/lib/rhashtable.c b/lib/rhashtable.c
index 5d845ffd7982..32d0ad058380 100644
--- a/lib/rhashtable.c
+++ b/lib/rhashtable.c
@@ -30,7 +30,7 @@
 
 #define HASH_DEFAULT_SIZE       64UL
 #define HASH_MIN_SIZE           4U
-#define BUCKET_LOCKS_PER_CPU   128UL
+#define BUCKET_LOCKS_PER_CPU    32UL
 
 static u32 head_hashfn(struct rhashtable *ht,
                        const struct bucket_table *tbl,
@@ -70,21 +70,25 @@ static int alloc_bucket_locks(struct rhashtable *ht, struct bucket_table *tbl,
         unsigned int nr_pcpus = num_possible_cpus();
 #endif
 
-        nr_pcpus = min_t(unsigned int, nr_pcpus, 32UL);
+        nr_pcpus = min_t(unsigned int, nr_pcpus, 64UL);
         size = roundup_pow_of_two(nr_pcpus * ht->p.locks_mul);
 
         /* Never allocate more than 0.5 locks per bucket */
         size = min_t(unsigned int, size, tbl->size >> 1);
 
         if (sizeof(spinlock_t) != 0) {
+                tbl->locks = NULL;
 #ifdef CONFIG_NUMA
                 if (size * sizeof(spinlock_t) > PAGE_SIZE &&
                     gfp == GFP_KERNEL)
                         tbl->locks = vmalloc(size * sizeof(spinlock_t));
-                else
 #endif
-                tbl->locks = kmalloc_array(size, sizeof(spinlock_t),
-                                           gfp);
+                if (gfp != GFP_KERNEL)
+                        gfp |= __GFP_NOWARN | __GFP_NORETRY;
+
+                if (!tbl->locks)
+                        tbl->locks = kmalloc_array(size, sizeof(spinlock_t),
+                                                   gfp);
                 if (!tbl->locks)
                         return -ENOMEM;
                 for (i = 0; i < size; i++)
@@ -321,12 +325,14 @@ static int rhashtable_expand(struct rhashtable *ht)
 static int rhashtable_shrink(struct rhashtable *ht)
 {
         struct bucket_table *new_tbl, *old_tbl = rht_dereference(ht->tbl, ht);
-        unsigned int size;
+        unsigned int nelems = atomic_read(&ht->nelems);
+        unsigned int size = 0;
         int err;
 
         ASSERT_RHT_MUTEX(ht);
 
-        size = roundup_pow_of_two(atomic_read(&ht->nelems) * 3 / 2);
+        if (nelems)
+                size = roundup_pow_of_two(nelems * 3 / 2);
         if (size < ht->p.min_size)
                 size = ht->p.min_size;
 
@@ -372,22 +378,8 @@ static void rht_deferred_worker(struct work_struct *work)
                 schedule_work(&ht->run_work);
 }
 
-static bool rhashtable_check_elasticity(struct rhashtable *ht,
-                                        struct bucket_table *tbl,
-                                        unsigned int hash)
-{
-        unsigned int elasticity = ht->elasticity;
-        struct rhash_head *head;
-
-        rht_for_each(head, tbl, hash)
-                if (!--elasticity)
-                        return true;
-
-        return false;
-}
-
-int rhashtable_insert_rehash(struct rhashtable *ht,
-                             struct bucket_table *tbl)
+static int rhashtable_insert_rehash(struct rhashtable *ht,
+                                    struct bucket_table *tbl)
 {
         struct bucket_table *old_tbl;
         struct bucket_table *new_tbl;
@@ -433,61 +425,172 @@ fail:
 
         return err;
 }
-EXPORT_SYMBOL_GPL(rhashtable_insert_rehash);
 
-struct bucket_table *rhashtable_insert_slow(struct rhashtable *ht,
-                                            const void *key,
-                                            struct rhash_head *obj,
-                                            struct bucket_table *tbl)
+static void *rhashtable_lookup_one(struct rhashtable *ht,
+                                   struct bucket_table *tbl, unsigned int hash,
+                                   const void *key, struct rhash_head *obj)
 {
+        struct rhashtable_compare_arg arg = {
+                .ht = ht,
+                .key = key,
+        };
+        struct rhash_head __rcu **pprev;
         struct rhash_head *head;
-        unsigned int hash;
-        int err;
+        int elasticity;
 
-        tbl = rhashtable_last_table(ht, tbl);
-        hash = head_hashfn(ht, tbl, obj);
-        spin_lock_nested(rht_bucket_lock(tbl, hash), SINGLE_DEPTH_NESTING);
+        elasticity = ht->elasticity;
+        pprev = &tbl->buckets[hash];
+        rht_for_each(head, tbl, hash) {
+                struct rhlist_head *list;
+                struct rhlist_head *plist;
 
-        err = -EEXIST;
-        if (key && rhashtable_lookup_fast(ht, key, ht->p))
-                goto exit;
+                elasticity--;
+                if (!key ||
+                    (ht->p.obj_cmpfn ?
+                     ht->p.obj_cmpfn(&arg, rht_obj(ht, head)) :
+                     rhashtable_compare(&arg, rht_obj(ht, head))))
+                        continue;
 
-        err = -E2BIG;
-        if (unlikely(rht_grow_above_max(ht, tbl)))
-                goto exit;
+                if (!ht->rhlist)
+                        return rht_obj(ht, head);
+
+                list = container_of(obj, struct rhlist_head, rhead);
+                plist = container_of(head, struct rhlist_head, rhead);
+
+                RCU_INIT_POINTER(list->next, plist);
+                head = rht_dereference_bucket(head->next, tbl, hash);
+                RCU_INIT_POINTER(list->rhead.next, head);
+                rcu_assign_pointer(*pprev, obj);
 
-        err = -EAGAIN;
-        if (rhashtable_check_elasticity(ht, tbl, hash) ||
-            rht_grow_above_100(ht, tbl))
-                goto exit;
+                return NULL;
+        }
 
-        err = 0;
+        if (elasticity <= 0)
+                return ERR_PTR(-EAGAIN);
+
+        return ERR_PTR(-ENOENT);
+}
+
+static struct bucket_table *rhashtable_insert_one(struct rhashtable *ht,
+                                                  struct bucket_table *tbl,
+                                                  unsigned int hash,
+                                                  struct rhash_head *obj,
+                                                  void *data)
+{
+        struct bucket_table *new_tbl;
+        struct rhash_head *head;
+
+        if (!IS_ERR_OR_NULL(data))
+                return ERR_PTR(-EEXIST);
+
+        if (PTR_ERR(data) != -EAGAIN && PTR_ERR(data) != -ENOENT)
+                return ERR_CAST(data);
+
+        new_tbl = rcu_dereference(tbl->future_tbl);
+        if (new_tbl)
+                return new_tbl;
+
+        if (PTR_ERR(data) != -ENOENT)
+                return ERR_CAST(data);
+
+        if (unlikely(rht_grow_above_max(ht, tbl)))
+                return ERR_PTR(-E2BIG);
+
+        if (unlikely(rht_grow_above_100(ht, tbl)))
+                return ERR_PTR(-EAGAIN);
 
         head = rht_dereference_bucket(tbl->buckets[hash], tbl, hash);
 
         RCU_INIT_POINTER(obj->next, head);
+        if (ht->rhlist) {
+                struct rhlist_head *list;
+
+                list = container_of(obj, struct rhlist_head, rhead);
+                RCU_INIT_POINTER(list->next, NULL);
+        }
 
         rcu_assign_pointer(tbl->buckets[hash], obj);
 
         atomic_inc(&ht->nelems);
+        if (rht_grow_above_75(ht, tbl))
+                schedule_work(&ht->run_work);
 
-exit:
-        spin_unlock(rht_bucket_lock(tbl, hash));
+        return NULL;
+}
 
-        if (err == 0)
-                return NULL;
-        else if (err == -EAGAIN)
-                return tbl;
-        else
-                return ERR_PTR(err);
+static void *rhashtable_try_insert(struct rhashtable *ht, const void *key,
+                                   struct rhash_head *obj)
+{
+        struct bucket_table *new_tbl;
+        struct bucket_table *tbl;
+        unsigned int hash;
+        spinlock_t *lock;
+        void *data;
+
+        tbl = rcu_dereference(ht->tbl);
+
+        /* All insertions must grab the oldest table containing
+         * the hashed bucket that is yet to be rehashed.
+         */
+        for (;;) {
+                hash = rht_head_hashfn(ht, tbl, obj, ht->p);
+                lock = rht_bucket_lock(tbl, hash);
+                spin_lock_bh(lock);
+
+                if (tbl->rehash <= hash)
+                        break;
+
+                spin_unlock_bh(lock);
+                tbl = rcu_dereference(tbl->future_tbl);
+        }
+
+        data = rhashtable_lookup_one(ht, tbl, hash, key, obj);
+        new_tbl = rhashtable_insert_one(ht, tbl, hash, obj, data);
+        if (PTR_ERR(new_tbl) != -EEXIST)
+                data = ERR_CAST(new_tbl);
+
+        while (!IS_ERR_OR_NULL(new_tbl)) {
+                tbl = new_tbl;
+                hash = rht_head_hashfn(ht, tbl, obj, ht->p);
+                spin_lock_nested(rht_bucket_lock(tbl, hash),
+                                 SINGLE_DEPTH_NESTING);
+
+                data = rhashtable_lookup_one(ht, tbl, hash, key, obj);
+                new_tbl = rhashtable_insert_one(ht, tbl, hash, obj, data);
+                if (PTR_ERR(new_tbl) != -EEXIST)
+                        data = ERR_CAST(new_tbl);
+
+                spin_unlock(rht_bucket_lock(tbl, hash));
+        }
+
+        spin_unlock_bh(lock);
+
+        if (PTR_ERR(data) == -EAGAIN)
+                data = ERR_PTR(rhashtable_insert_rehash(ht, tbl) ?:
+                               -EAGAIN);
+
+        return data;
+}
+
+void *rhashtable_insert_slow(struct rhashtable *ht, const void *key,
+                             struct rhash_head *obj)
+{
+        void *data;
+
+        do {
+                rcu_read_lock();
+                data = rhashtable_try_insert(ht, key, obj);
+                rcu_read_unlock();
+        } while (PTR_ERR(data) == -EAGAIN);
+
+        return data;
 }
 EXPORT_SYMBOL_GPL(rhashtable_insert_slow);
 
 /**
- * rhashtable_walk_init - Initialise an iterator
+ * rhashtable_walk_enter - Initialise an iterator
  * @ht:         Table to walk over
  * @iter:       Hash table Iterator
- * @gfp:        GFP flags for allocations
  *
  * This function prepares a hash table walk.
  *
@@ -502,30 +605,22 @@ EXPORT_SYMBOL_GPL(rhashtable_insert_slow);
  * This function may sleep so you must not call it from interrupt
  * context or with spin locks held.
  *
- * You must call rhashtable_walk_exit if this function returns
- * successfully.
+ * You must call rhashtable_walk_exit after this function returns.
  */
-int rhashtable_walk_init(struct rhashtable *ht, struct rhashtable_iter *iter,
-                         gfp_t gfp)
+void rhashtable_walk_enter(struct rhashtable *ht, struct rhashtable_iter *iter)
 {
         iter->ht = ht;
         iter->p = NULL;
         iter->slot = 0;
         iter->skip = 0;
 
-        iter->walker = kmalloc(sizeof(*iter->walker), gfp);
-        if (!iter->walker)
-                return -ENOMEM;
-
         spin_lock(&ht->lock);
-        iter->walker->tbl =
+        iter->walker.tbl =
                 rcu_dereference_protected(ht->tbl, lockdep_is_held(&ht->lock));
-        list_add(&iter->walker->list, &iter->walker->tbl->walkers);
+        list_add(&iter->walker.list, &iter->walker.tbl->walkers);
         spin_unlock(&ht->lock);
-
-        return 0;
 }
-EXPORT_SYMBOL_GPL(rhashtable_walk_init);
+EXPORT_SYMBOL_GPL(rhashtable_walk_enter);
 
 /**
  * rhashtable_walk_exit - Free an iterator
@@ -536,10 +631,9 @@ EXPORT_SYMBOL_GPL(rhashtable_walk_init);
 void rhashtable_walk_exit(struct rhashtable_iter *iter)
 {
         spin_lock(&iter->ht->lock);
-        if (iter->walker->tbl)
-                list_del(&iter->walker->list);
+        if (iter->walker.tbl)
+                list_del(&iter->walker.list);
         spin_unlock(&iter->ht->lock);
-        kfree(iter->walker);
 }
 EXPORT_SYMBOL_GPL(rhashtable_walk_exit);
 
@@ -565,12 +659,12 @@ int rhashtable_walk_start(struct rhashtable_iter *iter)
         rcu_read_lock();
 
         spin_lock(&ht->lock);
-        if (iter->walker->tbl)
-                list_del(&iter->walker->list);
+        if (iter->walker.tbl)
+                list_del(&iter->walker.list);
         spin_unlock(&ht->lock);
 
-        if (!iter->walker->tbl) {
-                iter->walker->tbl = rht_dereference_rcu(ht->tbl, ht);
+        if (!iter->walker.tbl) {
+                iter->walker.tbl = rht_dereference_rcu(ht->tbl, ht);
                 return -EAGAIN;
         }
 
@@ -592,12 +686,17 @@ EXPORT_SYMBOL_GPL(rhashtable_walk_start);
  */
 void *rhashtable_walk_next(struct rhashtable_iter *iter)
 {
-        struct bucket_table *tbl = iter->walker->tbl;
+        struct bucket_table *tbl = iter->walker.tbl;
+        struct rhlist_head *list = iter->list;
         struct rhashtable *ht = iter->ht;
         struct rhash_head *p = iter->p;
+        bool rhlist = ht->rhlist;
 
         if (p) {
-                p = rht_dereference_bucket_rcu(p->next, tbl, iter->slot);
+                if (!rhlist || !(list = rcu_dereference(list->next))) {
+                        p = rcu_dereference(p->next);
+                        list = container_of(p, struct rhlist_head, rhead);
+                }
                 goto next;
         }
 
@@ -605,6 +704,18 @@ void *rhashtable_walk_next(struct rhashtable_iter *iter)
                 int skip = iter->skip;
 
                 rht_for_each_rcu(p, tbl, iter->slot) {
+                        if (rhlist) {
+                                list = container_of(p, struct rhlist_head,
+                                                    rhead);
+                                do {
+                                        if (!skip)
+                                                goto next;
+                                        skip--;
+                                        list = rcu_dereference(list->next);
+                                } while (list);
+
+                                continue;
+                        }
                         if (!skip)
                                 break;
                         skip--;
@@ -614,7 +725,8 @@ next:
                 if (!rht_is_a_nulls(p)) {
                         iter->skip++;
                         iter->p = p;
-                        return rht_obj(ht, p);
+                        iter->list = list;
+                        return rht_obj(ht, rhlist ? &list->rhead : p);
                 }
 
                 iter->skip = 0;
@@ -625,8 +737,8 @@ next:
         /* Ensure we see any new tables. */
         smp_rmb();
 
-        iter->walker->tbl = rht_dereference_rcu(tbl->future_tbl, ht);
-        if (iter->walker->tbl) {
+        iter->walker.tbl = rht_dereference_rcu(tbl->future_tbl, ht);
+        if (iter->walker.tbl) {
                 iter->slot = 0;
                 iter->skip = 0;
                 return ERR_PTR(-EAGAIN);
@@ -646,7 +758,7 @@ void rhashtable_walk_stop(struct rhashtable_iter *iter)
         __releases(RCU)
 {
         struct rhashtable *ht;
-        struct bucket_table *tbl = iter->walker->tbl;
+        struct bucket_table *tbl = iter->walker.tbl;
 
         if (!tbl)
                 goto out;
@@ -655,9 +767,9 @@ void rhashtable_walk_stop(struct rhashtable_iter *iter)
 
         spin_lock(&ht->lock);
         if (tbl->rehash < tbl->size)
-                list_add(&iter->walker->list, &tbl->walkers);
+                list_add(&iter->walker.list, &tbl->walkers);
         else
-                iter->walker->tbl = NULL;
+                iter->walker.tbl = NULL;
         spin_unlock(&ht->lock);
 
         iter->p = NULL;
@@ -803,6 +915,48 @@ int rhashtable_init(struct rhashtable *ht,
 EXPORT_SYMBOL_GPL(rhashtable_init);
 
 /**
+ * rhltable_init - initialize a new hash list table
+ * @hlt:        hash list table to be initialized
+ * @params:     configuration parameters
+ *
+ * Initializes a new hash list table.
+ *
+ * See documentation for rhashtable_init.
+ */
+int rhltable_init(struct rhltable *hlt, const struct rhashtable_params *params)
+{
+        int err;
+
+        /* No rhlist NULLs marking for now. */
+        if (params->nulls_base)
+                return -EINVAL;
+
+        err = rhashtable_init(&hlt->ht, params);
+        hlt->ht.rhlist = true;
+        return err;
+}
+EXPORT_SYMBOL_GPL(rhltable_init);
+
+static void rhashtable_free_one(struct rhashtable *ht, struct rhash_head *obj,
+                                void (*free_fn)(void *ptr, void *arg),
+                                void *arg)
+{
+        struct rhlist_head *list;
+
+        if (!ht->rhlist) {
+                free_fn(rht_obj(ht, obj), arg);
+                return;
+        }
+
+        list = container_of(obj, struct rhlist_head, rhead);
+        do {
+                obj = &list->rhead;
+                list = rht_dereference(list->next, ht);
+                free_fn(rht_obj(ht, obj), arg);
+        } while (list);
+}
+
+/**
  * rhashtable_free_and_destroy - free elements and destroy hash table
  * @ht:         the hash table to destroy
  * @free_fn:    callback to release resources of element
@@ -839,7 +993,7 @@ void rhashtable_free_and_destroy(struct rhashtable *ht,
                              pos = next,
                              next = !rht_is_a_nulls(pos) ?
                                         rht_dereference(pos->next, ht) : NULL)
-                                free_fn(rht_obj(ht, pos), arg);
+                                rhashtable_free_one(ht, pos, free_fn, arg);
                 }
         }
 
diff --git a/lib/syscall.c b/lib/syscall.c
index e30e03932480..63239e097b13 100644
--- a/lib/syscall.c
+++ b/lib/syscall.c
@@ -7,9 +7,19 @@ static int collect_syscall(struct task_struct *target, long *callno,
                            unsigned long args[6], unsigned int maxargs,
                            unsigned long *sp, unsigned long *pc)
 {
-        struct pt_regs *regs = task_pt_regs(target);
-        if (unlikely(!regs))
+        struct pt_regs *regs;
+
+        if (!try_get_task_stack(target)) {
+                /* Task has no stack, so the task isn't in a syscall. */
+                *callno = -1;
+                return 0;
+        }
+
+        regs = task_pt_regs(target);
+        if (unlikely(!regs)) {
+                put_task_stack(target);
                 return -EAGAIN;
+        }
 
         *sp = user_stack_pointer(regs);
         *pc = instruction_pointer(regs);
@@ -18,6 +28,7 @@ static int collect_syscall(struct task_struct *target, long *callno,
         if (*callno != -1L && maxargs > 0)
                 syscall_get_arguments(target, regs, 0, maxargs, args);
 
+        put_task_stack(target);
         return 0;
 }
 
diff --git a/lib/test_bpf.c b/lib/test_bpf.c
index 93f45011a59d..94346b4d8984 100644
--- a/lib/test_bpf.c
+++ b/lib/test_bpf.c
@@ -5485,6 +5485,7 @@ static struct sk_buff *populate_skb(char *buf, int size)
         skb->hash = SKB_HASH;
         skb->queue_mapping = SKB_QUEUE_MAP;
         skb->vlan_tci = SKB_VLAN_TCI;
+        skb->vlan_proto = htons(ETH_P_IP);
         skb->dev = &dev;
         skb->dev->ifindex = SKB_DEV_IFINDEX;
         skb->dev->type = SKB_DEV_TYPE;
diff --git a/lib/test_hash.c b/lib/test_hash.c
index 66c5fc8351e8..cac20c5fb304 100644
--- a/lib/test_hash.c
+++ b/lib/test_hash.c
@@ -143,7 +143,7 @@ static int __init
 test_hash_init(void)
 {
         char buf[SIZE+1];
-        u32 string_or = 0, hash_or[2][33] = { 0 };
+        u32 string_or = 0, hash_or[2][33] = { { 0, } };
         unsigned tests = 0;
         unsigned long long h64 = 0;
         int i, j;
@@ -219,21 +219,27 @@ test_hash_init(void)
         }
 
         /* Issue notices about skipped tests. */
-#ifndef HAVE_ARCH__HASH_32
-        pr_info("__hash_32() has no arch implementation to test.");
-#elif HAVE_ARCH__HASH_32 != 1
+#ifdef HAVE_ARCH__HASH_32
+#if HAVE_ARCH__HASH_32 != 1
         pr_info("__hash_32() is arch-specific; not compared to generic.");
 #endif
-#ifndef HAVE_ARCH_HASH_32
-        pr_info("hash_32() has no arch implementation to test.");
-#elif HAVE_ARCH_HASH_32 != 1
+#else
+        pr_info("__hash_32() has no arch implementation to test.");
+#endif
+#ifdef HAVE_ARCH_HASH_32
+#if HAVE_ARCH_HASH_32 != 1
         pr_info("hash_32() is arch-specific; not compared to generic.");
 #endif
-#ifndef HAVE_ARCH_HASH_64
-        pr_info("hash_64() has no arch implementation to test.");
-#elif HAVE_ARCH_HASH_64 != 1
+#else
+        pr_info("hash_32() has no arch implementation to test.");
+#endif
+#ifdef HAVE_ARCH_HASH_64
+#if HAVE_ARCH_HASH_64 != 1
         pr_info("hash_64() is arch-specific; not compared to generic.");
 #endif
+#else
+        pr_info("hash_64() has no arch implementation to test.");
+#endif
 
         pr_notice("%u tests passed.", tests);
 
diff --git a/lib/test_rhashtable.c b/lib/test_rhashtable.c
index 297fdb5e74bd..64e899b63337 100644
--- a/lib/test_rhashtable.c
+++ b/lib/test_rhashtable.c
@@ -38,7 +38,7 @@ MODULE_PARM_DESC(runs, "Number of test runs per variant (default: 4)");
 
 static int max_size = 0;
 module_param(max_size, int, 0);
-MODULE_PARM_DESC(runs, "Maximum table size (default: calculated)");
+MODULE_PARM_DESC(max_size, "Maximum table size (default: calculated)");
 
 static bool shrinking = false;
 module_param(shrinking, bool, 0);
diff --git a/lib/ucs2_string.c b/lib/ucs2_string.c
index f0b323abb4c6..ae8d2491133c 100644
--- a/lib/ucs2_string.c
+++ b/lib/ucs2_string.c
@@ -56,7 +56,7 @@ ucs2_utf8size(const ucs2_char_t *src)
         unsigned long i;
         unsigned long j = 0;
 
-        for (i = 0; i < ucs2_strlen(src); i++) {
+        for (i = 0; src[i]; i++) {
                 u16 c = src[i];
 
                 if (c >= 0x800)
diff --git a/lib/usercopy.c b/lib/usercopy.c
deleted file mode 100644
index 4f5b1ddbcd25..000000000000
--- a/lib/usercopy.c
+++ /dev/null
@@ -1,9 +0,0 @@
-#include <linux/export.h>
-#include <linux/bug.h>
-#include <linux/uaccess.h>
-
-void copy_from_user_overflow(void)
-{
-        WARN(1, "Buffer overflow detected!\n");
-}
-EXPORT_SYMBOL(copy_from_user_overflow);
diff --git a/lib/win_minmax.c b/lib/win_minmax.c
new file mode 100644
index 000000000000..c8420d404926
--- /dev/null
+++ b/lib/win_minmax.c
@@ -0,0 +1,98 @@
+/**
+ * lib/minmax.c: windowed min/max tracker
+ *
+ * Kathleen Nichols' algorithm for tracking the minimum (or maximum)
+ * value of a data stream over some fixed time interval.  (E.g.,
+ * the minimum RTT over the past five minutes.) It uses constant
+ * space and constant time per update yet almost always delivers
+ * the same minimum as an implementation that has to keep all the
+ * data in the window.
+ *
+ * The algorithm keeps track of the best, 2nd best & 3rd best min
+ * values, maintaining an invariant that the measurement time of
+ * the n'th best >= n-1'th best. It also makes sure that the three
+ * values are widely separated in the time window since that bounds
+ * the worse case error when that data is monotonically increasing
+ * over the window.
+ *
+ * Upon getting a new min, we can forget everything earlier because
+ * it has no value - the new min is <= everything else in the window
+ * by definition and it's the most recent. So we restart fresh on
+ * every new min and overwrites 2nd & 3rd choices. The same property
+ * holds for 2nd & 3rd best.
+ */
+#include <linux/module.h>
+#include <linux/win_minmax.h>
+
+/* As time advances, update the 1st, 2nd, and 3rd choices. */
+static u32 minmax_subwin_update(struct minmax *m, u32 win,
+                                const struct minmax_sample *val)
+{
+        u32 dt = val->t - m->s[0].t;
+
+        if (unlikely(dt > win)) {
+                /*
+                 * Passed entire window without a new val so make 2nd
+                 * choice the new val & 3rd choice the new 2nd choice.
+                 * we may have to iterate this since our 2nd choice
+                 * may also be outside the window (we checked on entry
+                 * that the third choice was in the window).
+                 */
+                m->s[0] = m->s[1];
+                m->s[1] = m->s[2];
+                m->s[2] = *val;
+                if (unlikely(val->t - m->s[0].t > win)) {
+                        m->s[0] = m->s[1];
+                        m->s[1] = m->s[2];
+                        m->s[2] = *val;
+                }
+        } else if (unlikely(m->s[1].t == m->s[0].t) && dt > win/4) {
+                /*
+                 * We've passed a quarter of the window without a new val
+                 * so take a 2nd choice from the 2nd quarter of the window.
+                 */
+                m->s[2] = m->s[1] = *val;
+        } else if (unlikely(m->s[2].t == m->s[1].t) && dt > win/2) {
+                /*
+                 * We've passed half the window without finding a new val
+                 * so take a 3rd choice from the last half of the window
+                 */
+                m->s[2] = *val;
+        }
+        return m->s[0].v;
+}
+
+/* Check if new measurement updates the 1st, 2nd or 3rd choice max. */
+u32 minmax_running_max(struct minmax *m, u32 win, u32 t, u32 meas)
+{
+        struct minmax_sample val = { .t = t, .v = meas };
+
+        if (unlikely(val.v >= m->s[0].v) ||       /* found new max? */
+            unlikely(val.t - m->s[2].t > win))    /* nothing left in window? */
+                return minmax_reset(m, t, meas);  /* forget earlier samples */
+
+        if (unlikely(val.v >= m->s[1].v))
+                m->s[2] = m->s[1] = val;
+        else if (unlikely(val.v >= m->s[2].v))
+                m->s[2] = val;
+
+        return minmax_subwin_update(m, win, &val);
+}
+EXPORT_SYMBOL(minmax_running_max);
+
+/* Check if new measurement updates the 1st, 2nd or 3rd choice min. */
+u32 minmax_running_min(struct minmax *m, u32 win, u32 t, u32 meas)
+{
+        struct minmax_sample val = { .t = t, .v = meas };
+
+        if (unlikely(val.v <= m->s[0].v) ||       /* found new min? */
+            unlikely(val.t - m->s[2].t > win))    /* nothing left in window? */
+                return minmax_reset(m, t, meas);  /* forget earlier samples */
+
+        if (unlikely(val.v <= m->s[1].v))
+                m->s[2] = m->s[1] = val;
+        else if (unlikely(val.v <= m->s[2].v))
+                m->s[2] = val;
+
+        return minmax_subwin_update(m, win, &val);
+}