Linux patch 5.10.1455.10-154

Signed-off-by: Mike Pagano <mpagano@gentoo.org>

2 files changed, 1882 insertions, 0 deletions

diff --git a/0000_README b/0000_README
index 7aedc075..0670d018 100644
--- a/0000_README
+++ b/0000_README
@@ -619,6 +619,10 @@ Patch:  1143_linux-5.10.144.patch
 From:   http://www.kernel.org
 Desc:   Linux 5.10.144
 
+Patch:  1144_linux-5.10.145.patch
+From:   http://www.kernel.org
+Desc:   Linux 5.10.145
+
 Patch:  1500_XATTR_USER_PREFIX.patch
 From:   https://bugs.gentoo.org/show_bug.cgi?id=470644
 Desc:   Support for namespace user.pax.* on tmpfs.
diff --git a/1144_linux-5.10.145.patch b/1144_linux-5.10.145.patch
new file mode 100644
index 00000000..c4117822
--- /dev/null
+++ b/1144_linux-5.10.145.patch
@@ -0,0 +1,1878 @@
+diff --git a/Makefile b/Makefile
+index 21aa9b04164d1..76c85e40beea3 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 5
+ PATCHLEVEL = 10
+-SUBLEVEL = 144
++SUBLEVEL = 145
+ EXTRAVERSION =
+ NAME = Dare mighty things
+ 
+diff --git a/arch/mips/cavium-octeon/octeon-irq.c b/arch/mips/cavium-octeon/octeon-irq.c
+index 6501a842c41a5..191bcaf565138 100644
+--- a/arch/mips/cavium-octeon/octeon-irq.c
++++ b/arch/mips/cavium-octeon/octeon-irq.c
+@@ -127,6 +127,16 @@ static void octeon_irq_free_cd(struct irq_domain *d, unsigned int irq)
+ static int octeon_irq_force_ciu_mapping(struct irq_domain *domain,
+ 					int irq, int line, int bit)
+ {
++	struct device_node *of_node;
++	int ret;
++
++	of_node = irq_domain_get_of_node(domain);
++	if (!of_node)
++		return -EINVAL;
++	ret = irq_alloc_desc_at(irq, of_node_to_nid(of_node));
++	if (ret < 0)
++		return ret;
++
+ 	return irq_domain_associate(domain, irq, line << 6 | bit);
+ }
+ 
+diff --git a/arch/parisc/Kconfig b/arch/parisc/Kconfig
+index 2d89f79f460cb..07a4d4badd697 100644
+--- a/arch/parisc/Kconfig
++++ b/arch/parisc/Kconfig
+@@ -315,6 +315,16 @@ config IRQSTACKS
+ 	  for handling hard and soft interrupts.  This can help avoid
+ 	  overflowing the process kernel stacks.
+ 
++config TLB_PTLOCK
++	bool "Use page table locks in TLB fault handler"
++	depends on SMP
++	default n
++	help
++	  Select this option to enable page table locking in the TLB
++	  fault handler. This ensures that page table entries are
++	  updated consistently on SMP machines at the expense of some
++	  loss in performance.
++
+ config HOTPLUG_CPU
+ 	bool
+ 	default y if SMP
+diff --git a/arch/parisc/include/asm/mmu_context.h b/arch/parisc/include/asm/mmu_context.h
+index cb5f2f7304213..aba69ff79e8c1 100644
+--- a/arch/parisc/include/asm/mmu_context.h
++++ b/arch/parisc/include/asm/mmu_context.h
+@@ -5,6 +5,7 @@
+ #include <linux/mm.h>
+ #include <linux/sched.h>
+ #include <linux/atomic.h>
++#include <linux/spinlock.h>
+ #include <asm-generic/mm_hooks.h>
+ 
+ static inline void enter_lazy_tlb(struct mm_struct *mm, struct task_struct *tsk)
+@@ -52,6 +53,12 @@ static inline void switch_mm_irqs_off(struct mm_struct *prev,
+ 		struct mm_struct *next, struct task_struct *tsk)
+ {
+ 	if (prev != next) {
++#ifdef CONFIG_TLB_PTLOCK
++		/* put physical address of page_table_lock in cr28 (tr4)
++		   for TLB faults */
++		spinlock_t *pgd_lock = &next->page_table_lock;
++		mtctl(__pa(__ldcw_align(&pgd_lock->rlock.raw_lock)), 28);
++#endif
+ 		mtctl(__pa(next->pgd), 25);
+ 		load_context(next->context);
+ 	}
+diff --git a/arch/parisc/include/asm/page.h b/arch/parisc/include/asm/page.h
+index 8802ce651a3af..0561568f7b489 100644
+--- a/arch/parisc/include/asm/page.h
++++ b/arch/parisc/include/asm/page.h
+@@ -112,7 +112,7 @@ extern int npmem_ranges;
+ #else
+ #define BITS_PER_PTE_ENTRY	2
+ #define BITS_PER_PMD_ENTRY	2
+-#define BITS_PER_PGD_ENTRY	BITS_PER_PMD_ENTRY
++#define BITS_PER_PGD_ENTRY	2
+ #endif
+ #define PGD_ENTRY_SIZE	(1UL << BITS_PER_PGD_ENTRY)
+ #define PMD_ENTRY_SIZE	(1UL << BITS_PER_PMD_ENTRY)
+diff --git a/arch/parisc/include/asm/pgalloc.h b/arch/parisc/include/asm/pgalloc.h
+index a6482b2ce0eab..dda5570853116 100644
+--- a/arch/parisc/include/asm/pgalloc.h
++++ b/arch/parisc/include/asm/pgalloc.h
+@@ -15,47 +15,23 @@
+ #define __HAVE_ARCH_PGD_FREE
+ #include <asm-generic/pgalloc.h>
+ 
+-/* Allocate the top level pgd (page directory)
+- *
+- * Here (for 64 bit kernels) we implement a Hybrid L2/L3 scheme: we
+- * allocate the first pmd adjacent to the pgd.  This means that we can
+- * subtract a constant offset to get to it.  The pmd and pgd sizes are
+- * arranged so that a single pmd covers 4GB (giving a full 64-bit
+- * process access to 8TB) so our lookups are effectively L2 for the
+- * first 4GB of the kernel (i.e. for all ILP32 processes and all the
+- * kernel for machines with under 4GB of memory) */
++/* Allocate the top level pgd (page directory) */
+ static inline pgd_t *pgd_alloc(struct mm_struct *mm)
+ {
+-	pgd_t *pgd = (pgd_t *)__get_free_pages(GFP_KERNEL,
+-					       PGD_ALLOC_ORDER);
+-	pgd_t *actual_pgd = pgd;
++	pgd_t *pgd;
+ 
+-	if (likely(pgd != NULL)) {
+-		memset(pgd, 0, PAGE_SIZE<<PGD_ALLOC_ORDER);
+-#if CONFIG_PGTABLE_LEVELS == 3
+-		actual_pgd += PTRS_PER_PGD;
+-		/* Populate first pmd with allocated memory.  We mark it
+-		 * with PxD_FLAG_ATTACHED as a signal to the system that this
+-		 * pmd entry may not be cleared. */
+-		set_pgd(actual_pgd, __pgd((PxD_FLAG_PRESENT |
+-				        PxD_FLAG_VALID |
+-					PxD_FLAG_ATTACHED)
+-			+ (__u32)(__pa((unsigned long)pgd) >> PxD_VALUE_SHIFT)));
+-		/* The first pmd entry also is marked with PxD_FLAG_ATTACHED as
+-		 * a signal that this pmd may not be freed */
+-		set_pgd(pgd, __pgd(PxD_FLAG_ATTACHED));
+-#endif
+-	}
+-	spin_lock_init(pgd_spinlock(actual_pgd));
+-	return actual_pgd;
++	pgd = (pgd_t *) __get_free_pages(GFP_KERNEL, PGD_ORDER);
++	if (unlikely(pgd == NULL))
++		return NULL;
++
++	memset(pgd, 0, PAGE_SIZE << PGD_ORDER);
++
++	return pgd;
+ }
+ 
+ static inline void pgd_free(struct mm_struct *mm, pgd_t *pgd)
+ {
+-#if CONFIG_PGTABLE_LEVELS == 3
+-	pgd -= PTRS_PER_PGD;
+-#endif
+-	free_pages((unsigned long)pgd, PGD_ALLOC_ORDER);
++	free_pages((unsigned long)pgd, PGD_ORDER);
+ }
+ 
+ #if CONFIG_PGTABLE_LEVELS == 3
+@@ -70,41 +46,25 @@ static inline void pud_populate(struct mm_struct *mm, pud_t *pud, pmd_t *pmd)
+ 
+ static inline pmd_t *pmd_alloc_one(struct mm_struct *mm, unsigned long address)
+ {
+-	return (pmd_t *)__get_free_pages(GFP_PGTABLE_KERNEL, PMD_ORDER);
++	pmd_t *pmd;
++
++	pmd = (pmd_t *)__get_free_pages(GFP_PGTABLE_KERNEL, PMD_ORDER);
++	if (likely(pmd))
++		memset ((void *)pmd, 0, PAGE_SIZE << PMD_ORDER);
++	return pmd;
+ }
+ 
+ static inline void pmd_free(struct mm_struct *mm, pmd_t *pmd)
+ {
+-	if (pmd_flag(*pmd) & PxD_FLAG_ATTACHED) {
+-		/*
+-		 * This is the permanent pmd attached to the pgd;
+-		 * cannot free it.
+-		 * Increment the counter to compensate for the decrement
+-		 * done by generic mm code.
+-		 */
+-		mm_inc_nr_pmds(mm);
+-		return;
+-	}
+ 	free_pages((unsigned long)pmd, PMD_ORDER);
+ }
+-
+ #endif
+ 
+ static inline void
+ pmd_populate_kernel(struct mm_struct *mm, pmd_t *pmd, pte_t *pte)
+ {
+-#if CONFIG_PGTABLE_LEVELS == 3
+-	/* preserve the gateway marker if this is the beginning of
+-	 * the permanent pmd */
+-	if(pmd_flag(*pmd) & PxD_FLAG_ATTACHED)
+-		set_pmd(pmd, __pmd((PxD_FLAG_PRESENT |
+-				PxD_FLAG_VALID |
+-				PxD_FLAG_ATTACHED)
+-			+ (__u32)(__pa((unsigned long)pte) >> PxD_VALUE_SHIFT)));
+-	else
+-#endif
+-		set_pmd(pmd, __pmd((PxD_FLAG_PRESENT | PxD_FLAG_VALID)
+-			+ (__u32)(__pa((unsigned long)pte) >> PxD_VALUE_SHIFT)));
++	set_pmd(pmd, __pmd((PxD_FLAG_PRESENT | PxD_FLAG_VALID)
++		+ (__u32)(__pa((unsigned long)pte) >> PxD_VALUE_SHIFT)));
+ }
+ 
+ #define pmd_populate(mm, pmd, pte_page) \
+diff --git a/arch/parisc/include/asm/pgtable.h b/arch/parisc/include/asm/pgtable.h
+index 75cf84070fc91..8964798b8274e 100644
+--- a/arch/parisc/include/asm/pgtable.h
++++ b/arch/parisc/include/asm/pgtable.h
+@@ -23,8 +23,6 @@
+ #include <asm/processor.h>
+ #include <asm/cache.h>
+ 
+-static inline spinlock_t *pgd_spinlock(pgd_t *);
+-
+ /*
+  * kern_addr_valid(ADDR) tests if ADDR is pointing to valid kernel
+  * memory.  For the return value to be meaningful, ADDR must be >=
+@@ -42,12 +40,8 @@ static inline spinlock_t *pgd_spinlock(pgd_t *);
+ 
+ /* This is for the serialization of PxTLB broadcasts. At least on the N class
+  * systems, only one PxTLB inter processor broadcast can be active at any one
+- * time on the Merced bus.
+-
+- * PTE updates are protected by locks in the PMD.
+- */
++ * time on the Merced bus. */
+ extern spinlock_t pa_tlb_flush_lock;
+-extern spinlock_t pa_swapper_pg_lock;
+ #if defined(CONFIG_64BIT) && defined(CONFIG_SMP)
+ extern int pa_serialize_tlb_flushes;
+ #else
+@@ -82,22 +76,25 @@ static inline void purge_tlb_entries(struct mm_struct *mm, unsigned long addr)
+ 	purge_tlb_end(flags);
+ }
+ 
++extern void __update_cache(pte_t pte);
++
+ /* Certain architectures need to do special things when PTEs
+  * within a page table are directly modified.  Thus, the following
+  * hook is made available.
+  */
+-#define set_pte(pteptr, pteval)                                 \
+-        do{                                                     \
+-                *(pteptr) = (pteval);                           \
+-        } while(0)
+-
+-#define set_pte_at(mm, addr, ptep, pteval)			\
+-	do {							\
+-		unsigned long flags;				\
+-		spin_lock_irqsave(pgd_spinlock((mm)->pgd), flags);\
+-		set_pte(ptep, pteval);				\
+-		purge_tlb_entries(mm, addr);			\
+-		spin_unlock_irqrestore(pgd_spinlock((mm)->pgd), flags);\
++#define set_pte(pteptr, pteval)			\
++	do {					\
++		*(pteptr) = (pteval);		\
++		mb();				\
++	} while(0)
++
++#define set_pte_at(mm, addr, pteptr, pteval)	\
++	do {					\
++		if (pte_present(pteval) &&	\
++		    pte_user(pteval))		\
++			__update_cache(pteval);	\
++		*(pteptr) = (pteval);		\
++		purge_tlb_entries(mm, addr);	\
+ 	} while (0)
+ 
+ #endif /* !__ASSEMBLY__ */
+@@ -120,12 +117,10 @@ static inline void purge_tlb_entries(struct mm_struct *mm, unsigned long addr)
+ #define KERNEL_INITIAL_SIZE	(1 << KERNEL_INITIAL_ORDER)
+ 
+ #if CONFIG_PGTABLE_LEVELS == 3
+-#define PGD_ORDER	1 /* Number of pages per pgd */
+-#define PMD_ORDER	1 /* Number of pages per pmd */
+-#define PGD_ALLOC_ORDER	(2 + 1) /* first pgd contains pmd */
++#define PMD_ORDER	1
++#define PGD_ORDER	0
+ #else
+-#define PGD_ORDER	1 /* Number of pages per pgd */
+-#define PGD_ALLOC_ORDER	(PGD_ORDER + 1)
++#define PGD_ORDER	1
+ #endif
+ 
+ /* Definitions for 3rd level (we use PLD here for Page Lower directory
+@@ -240,11 +235,9 @@ static inline void purge_tlb_entries(struct mm_struct *mm, unsigned long addr)
+  * able to effectively address 40/42/44-bits of physical address space
+  * depending on 4k/16k/64k PAGE_SIZE */
+ #define _PxD_PRESENT_BIT   31
+-#define _PxD_ATTACHED_BIT  30
+-#define _PxD_VALID_BIT     29
++#define _PxD_VALID_BIT     30
+ 
+ #define PxD_FLAG_PRESENT  (1 << xlate_pabit(_PxD_PRESENT_BIT))
+-#define PxD_FLAG_ATTACHED (1 << xlate_pabit(_PxD_ATTACHED_BIT))
+ #define PxD_FLAG_VALID    (1 << xlate_pabit(_PxD_VALID_BIT))
+ #define PxD_FLAG_MASK     (0xf)
+ #define PxD_FLAG_SHIFT    (4)
+@@ -317,6 +310,7 @@ extern unsigned long *empty_zero_page;
+ 
+ #define pte_none(x)     (pte_val(x) == 0)
+ #define pte_present(x)	(pte_val(x) & _PAGE_PRESENT)
++#define pte_user(x)	(pte_val(x) & _PAGE_USER)
+ #define pte_clear(mm, addr, xp)  set_pte_at(mm, addr, xp, __pte(0))
+ 
+ #define pmd_flag(x)	(pmd_val(x) & PxD_FLAG_MASK)
+@@ -326,23 +320,10 @@ extern unsigned long *empty_zero_page;
+ #define pgd_flag(x)	(pgd_val(x) & PxD_FLAG_MASK)
+ #define pgd_address(x)	((unsigned long)(pgd_val(x) &~ PxD_FLAG_MASK) << PxD_VALUE_SHIFT)
+ 
+-#if CONFIG_PGTABLE_LEVELS == 3
+-/* The first entry of the permanent pmd is not there if it contains
+- * the gateway marker */
+-#define pmd_none(x)	(!pmd_val(x) || pmd_flag(x) == PxD_FLAG_ATTACHED)
+-#else
+ #define pmd_none(x)	(!pmd_val(x))
+-#endif
+ #define pmd_bad(x)	(!(pmd_flag(x) & PxD_FLAG_VALID))
+ #define pmd_present(x)	(pmd_flag(x) & PxD_FLAG_PRESENT)
+ static inline void pmd_clear(pmd_t *pmd) {
+-#if CONFIG_PGTABLE_LEVELS == 3
+-	if (pmd_flag(*pmd) & PxD_FLAG_ATTACHED)
+-		/* This is the entry pointing to the permanent pmd
+-		 * attached to the pgd; cannot clear it */
+-		set_pmd(pmd, __pmd(PxD_FLAG_ATTACHED));
+-	else
+-#endif
+ 		set_pmd(pmd,  __pmd(0));
+ }
+ 
+@@ -358,12 +339,6 @@ static inline void pmd_clear(pmd_t *pmd) {
+ #define pud_bad(x)      (!(pud_flag(x) & PxD_FLAG_VALID))
+ #define pud_present(x)  (pud_flag(x) & PxD_FLAG_PRESENT)
+ static inline void pud_clear(pud_t *pud) {
+-#if CONFIG_PGTABLE_LEVELS == 3
+-	if(pud_flag(*pud) & PxD_FLAG_ATTACHED)
+-		/* This is the permanent pmd attached to the pud; cannot
+-		 * free it */
+-		return;
+-#endif
+ 	set_pud(pud, __pud(0));
+ }
+ #endif
+@@ -443,7 +418,7 @@ extern void paging_init (void);
+ 
+ #define PG_dcache_dirty         PG_arch_1
+ 
+-extern void update_mmu_cache(struct vm_area_struct *, unsigned long, pte_t *);
++#define update_mmu_cache(vms,addr,ptep) __update_cache(*ptep)
+ 
+ /* Encode and de-code a swap entry */
+ 
+@@ -456,32 +431,18 @@ extern void update_mmu_cache(struct vm_area_struct *, unsigned long, pte_t *);
+ #define __pte_to_swp_entry(pte)		((swp_entry_t) { pte_val(pte) })
+ #define __swp_entry_to_pte(x)		((pte_t) { (x).val })
+ 
+-
+-static inline spinlock_t *pgd_spinlock(pgd_t *pgd)
+-{
+-	if (unlikely(pgd == swapper_pg_dir))
+-		return &pa_swapper_pg_lock;
+-	return (spinlock_t *)((char *)pgd + (PAGE_SIZE << (PGD_ALLOC_ORDER - 1)));
+-}
+-
+-
+ static inline int ptep_test_and_clear_young(struct vm_area_struct *vma, unsigned long addr, pte_t *ptep)
+ {
+ 	pte_t pte;
+-	unsigned long flags;
+ 
+ 	if (!pte_young(*ptep))
+ 		return 0;
+ 
+-	spin_lock_irqsave(pgd_spinlock(vma->vm_mm->pgd), flags);
+ 	pte = *ptep;
+ 	if (!pte_young(pte)) {
+-		spin_unlock_irqrestore(pgd_spinlock(vma->vm_mm->pgd), flags);
+ 		return 0;
+ 	}
+-	set_pte(ptep, pte_mkold(pte));
+-	purge_tlb_entries(vma->vm_mm, addr);
+-	spin_unlock_irqrestore(pgd_spinlock(vma->vm_mm->pgd), flags);
++	set_pte_at(vma->vm_mm, addr, ptep, pte_mkold(pte));
+ 	return 1;
+ }
+ 
+@@ -489,24 +450,16 @@ struct mm_struct;
+ static inline pte_t ptep_get_and_clear(struct mm_struct *mm, unsigned long addr, pte_t *ptep)
+ {
+ 	pte_t old_pte;
+-	unsigned long flags;
+ 
+-	spin_lock_irqsave(pgd_spinlock(mm->pgd), flags);
+ 	old_pte = *ptep;
+-	set_pte(ptep, __pte(0));
+-	purge_tlb_entries(mm, addr);
+-	spin_unlock_irqrestore(pgd_spinlock(mm->pgd), flags);
++	set_pte_at(mm, addr, ptep, __pte(0));
+ 
+ 	return old_pte;
+ }
+ 
+ static inline void ptep_set_wrprotect(struct mm_struct *mm, unsigned long addr, pte_t *ptep)
+ {
+-	unsigned long flags;
+-	spin_lock_irqsave(pgd_spinlock(mm->pgd), flags);
+-	set_pte(ptep, pte_wrprotect(*ptep));
+-	purge_tlb_entries(mm, addr);
+-	spin_unlock_irqrestore(pgd_spinlock(mm->pgd), flags);
++	set_pte_at(mm, addr, ptep, pte_wrprotect(*ptep));
+ }
+ 
+ #define pte_same(A,B)	(pte_val(A) == pte_val(B))
+diff --git a/arch/parisc/kernel/asm-offsets.c b/arch/parisc/kernel/asm-offsets.c
+index 305768a40773f..cd2cc1b1648c0 100644
+--- a/arch/parisc/kernel/asm-offsets.c
++++ b/arch/parisc/kernel/asm-offsets.c
+@@ -268,7 +268,6 @@ int main(void)
+ 	DEFINE(ASM_BITS_PER_PGD, BITS_PER_PGD);
+ 	DEFINE(ASM_BITS_PER_PMD, BITS_PER_PMD);
+ 	DEFINE(ASM_BITS_PER_PTE, BITS_PER_PTE);
+-	DEFINE(ASM_PGD_PMD_OFFSET, -(PAGE_SIZE << PGD_ORDER));
+ 	DEFINE(ASM_PMD_ENTRY, ((PAGE_OFFSET & PMD_MASK) >> PMD_SHIFT));
+ 	DEFINE(ASM_PGD_ENTRY, PAGE_OFFSET >> PGDIR_SHIFT);
+ 	DEFINE(ASM_PGD_ENTRY_SIZE, PGD_ENTRY_SIZE);
+diff --git a/arch/parisc/kernel/cache.c b/arch/parisc/kernel/cache.c
+index 86a1a63563fd5..c81ab0cb89255 100644
+--- a/arch/parisc/kernel/cache.c
++++ b/arch/parisc/kernel/cache.c
+@@ -83,9 +83,9 @@ EXPORT_SYMBOL(flush_cache_all_local);
+ #define pfn_va(pfn)	__va(PFN_PHYS(pfn))
+ 
+ void
+-update_mmu_cache(struct vm_area_struct *vma, unsigned long address, pte_t *ptep)
++__update_cache(pte_t pte)
+ {
+-	unsigned long pfn = pte_pfn(*ptep);
++	unsigned long pfn = pte_pfn(pte);
+ 	struct page *page;
+ 
+ 	/* We don't have pte special.  As a result, we can be called with
+diff --git a/arch/parisc/kernel/entry.S b/arch/parisc/kernel/entry.S
+index 3da39140babcf..05bed27eef859 100644
+--- a/arch/parisc/kernel/entry.S
++++ b/arch/parisc/kernel/entry.S
+@@ -35,10 +35,9 @@
+ 	.level 2.0
+ #endif
+ 
+-	.import		pa_tlb_lock,data
+-	.macro  load_pa_tlb_lock reg
+-	mfctl		%cr25,\reg
+-	addil		L%(PAGE_SIZE << (PGD_ALLOC_ORDER - 1)),\reg
++	/* Get aligned page_table_lock address for this mm from cr28/tr4 */
++	.macro  get_ptl reg
++	mfctl	%cr28,\reg
+ 	.endm
+ 
+ 	/* space_to_prot macro creates a prot id from a space id */
+@@ -407,7 +406,9 @@
+ # endif
+ #endif
+ 	dep             %r0,31,PAGE_SHIFT,\pmd  /* clear offset */
++#if CONFIG_PGTABLE_LEVELS < 3
+ 	copy		%r0,\pte
++#endif
+ 	ldw,s		\index(\pmd),\pmd
+ 	bb,>=,n		\pmd,_PxD_PRESENT_BIT,\fault
+ 	dep		%r0,31,PxD_FLAG_SHIFT,\pmd /* clear flags */
+@@ -417,38 +418,23 @@
+ 	shladd		\index,BITS_PER_PTE_ENTRY,\pmd,\pmd /* pmd is now pte */
+ 	.endm
+ 
+-	/* Look up PTE in a 3-Level scheme.
+-	 *
+-	 * Here we implement a Hybrid L2/L3 scheme: we allocate the
+-	 * first pmd adjacent to the pgd.  This means that we can
+-	 * subtract a constant offset to get to it.  The pmd and pgd
+-	 * sizes are arranged so that a single pmd covers 4GB (giving
+-	 * a full LP64 process access to 8TB) so our lookups are
+-	 * effectively L2 for the first 4GB of the kernel (i.e. for
+-	 * all ILP32 processes and all the kernel for machines with
+-	 * under 4GB of memory) */
++	/* Look up PTE in a 3-Level scheme. */
+ 	.macro		L3_ptep pgd,pte,index,va,fault
+-#if CONFIG_PGTABLE_LEVELS == 3 /* we might have a 2-Level scheme, e.g. with 16kb page size */
++#if CONFIG_PGTABLE_LEVELS == 3
++	copy		%r0,\pte
+ 	extrd,u		\va,63-ASM_PGDIR_SHIFT,ASM_BITS_PER_PGD,\index
+-	extrd,u,*=	\va,63-ASM_PGDIR_SHIFT,64-ASM_PGDIR_SHIFT,%r0
+ 	ldw,s		\index(\pgd),\pgd
+-	extrd,u,*=	\va,63-ASM_PGDIR_SHIFT,64-ASM_PGDIR_SHIFT,%r0
+ 	bb,>=,n		\pgd,_PxD_PRESENT_BIT,\fault
+-	extrd,u,*=	\va,63-ASM_PGDIR_SHIFT,64-ASM_PGDIR_SHIFT,%r0
+-	shld		\pgd,PxD_VALUE_SHIFT,\index
+-	extrd,u,*=	\va,63-ASM_PGDIR_SHIFT,64-ASM_PGDIR_SHIFT,%r0
+-	copy		\index,\pgd
+-	extrd,u,*<>	\va,63-ASM_PGDIR_SHIFT,64-ASM_PGDIR_SHIFT,%r0
+-	ldo		ASM_PGD_PMD_OFFSET(\pgd),\pgd
++	shld		\pgd,PxD_VALUE_SHIFT,\pgd
+ #endif
+ 	L2_ptep		\pgd,\pte,\index,\va,\fault
+ 	.endm
+ 
+-	/* Acquire pa_tlb_lock lock and check page is present. */
+-	.macro		tlb_lock	spc,ptp,pte,tmp,tmp1,fault
+-#ifdef CONFIG_SMP
++	/* Acquire page_table_lock and check page is present. */
++	.macro		ptl_lock	spc,ptp,pte,tmp,tmp1,fault
++#ifdef CONFIG_TLB_PTLOCK
+ 98:	cmpib,COND(=),n	0,\spc,2f
+-	load_pa_tlb_lock \tmp
++	get_ptl		\tmp
+ 1:	LDCW		0(\tmp),\tmp1
+ 	cmpib,COND(=)	0,\tmp1,1b
+ 	nop
+@@ -463,26 +449,26 @@
+ 3:
+ 	.endm
+ 
+-	/* Release pa_tlb_lock lock without reloading lock address.
++	/* Release page_table_lock without reloading lock address.
+ 	   Note that the values in the register spc are limited to
+ 	   NR_SPACE_IDS (262144). Thus, the stw instruction always
+ 	   stores a nonzero value even when register spc is 64 bits.
+ 	   We use an ordered store to ensure all prior accesses are
+ 	   performed prior to releasing the lock. */
+-	.macro		tlb_unlock0	spc,tmp
+-#ifdef CONFIG_SMP
++	.macro		ptl_unlock0	spc,tmp
++#ifdef CONFIG_TLB_PTLOCK
+ 98:	or,COND(=)	%r0,\spc,%r0
+ 	stw,ma		\spc,0(\tmp)
+ 99:	ALTERNATIVE(98b, 99b, ALT_COND_NO_SMP, INSN_NOP)
+ #endif
+ 	.endm
+ 
+-	/* Release pa_tlb_lock lock. */
+-	.macro		tlb_unlock1	spc,tmp
+-#ifdef CONFIG_SMP
+-98:	load_pa_tlb_lock \tmp
++	/* Release page_table_lock. */
++	.macro		ptl_unlock1	spc,tmp
++#ifdef CONFIG_TLB_PTLOCK
++98:	get_ptl		\tmp
++	ptl_unlock0	\spc,\tmp
+ 99:	ALTERNATIVE(98b, 99b, ALT_COND_NO_SMP, INSN_NOP)
+-	tlb_unlock0	\spc,\tmp
+ #endif
+ 	.endm
+ 
+@@ -1165,14 +1151,14 @@ dtlb_miss_20w:
+ 
+ 	L3_ptep		ptp,pte,t0,va,dtlb_check_alias_20w
+ 
+-	tlb_lock	spc,ptp,pte,t0,t1,dtlb_check_alias_20w
++	ptl_lock	spc,ptp,pte,t0,t1,dtlb_check_alias_20w
+ 	update_accessed	ptp,pte,t0,t1
+ 
+ 	make_insert_tlb	spc,pte,prot,t1
+ 	
+ 	idtlbt          pte,prot
+ 
+-	tlb_unlock1	spc,t0
++	ptl_unlock1	spc,t0
+ 	rfir
+ 	nop
+ 
+@@ -1191,14 +1177,14 @@ nadtlb_miss_20w:
+ 
+ 	L3_ptep		ptp,pte,t0,va,nadtlb_check_alias_20w
+ 
+-	tlb_lock	spc,ptp,pte,t0,t1,nadtlb_check_alias_20w
++	ptl_lock	spc,ptp,pte,t0,t1,nadtlb_check_alias_20w
+ 	update_accessed	ptp,pte,t0,t1
+ 
+ 	make_insert_tlb	spc,pte,prot,t1
+ 
+ 	idtlbt          pte,prot
+ 
+-	tlb_unlock1	spc,t0
++	ptl_unlock1	spc,t0
+ 	rfir
+ 	nop
+ 
+@@ -1219,7 +1205,7 @@ dtlb_miss_11:
+ 
+ 	L2_ptep		ptp,pte,t0,va,dtlb_check_alias_11
+ 
+-	tlb_lock	spc,ptp,pte,t0,t1,dtlb_check_alias_11
++	ptl_lock	spc,ptp,pte,t0,t1,dtlb_check_alias_11
+ 	update_accessed	ptp,pte,t0,t1
+ 
+ 	make_insert_tlb_11	spc,pte,prot
+@@ -1232,7 +1218,7 @@ dtlb_miss_11:
+ 
+ 	mtsp		t1, %sr1	/* Restore sr1 */
+ 
+-	tlb_unlock1	spc,t0
++	ptl_unlock1	spc,t0
+ 	rfir
+ 	nop
+ 
+@@ -1252,7 +1238,7 @@ nadtlb_miss_11:
+ 
+ 	L2_ptep		ptp,pte,t0,va,nadtlb_check_alias_11
+ 
+-	tlb_lock	spc,ptp,pte,t0,t1,nadtlb_check_alias_11
++	ptl_lock	spc,ptp,pte,t0,t1,nadtlb_check_alias_11
+ 	update_accessed	ptp,pte,t0,t1
+ 
+ 	make_insert_tlb_11	spc,pte,prot
+@@ -1265,7 +1251,7 @@ nadtlb_miss_11:
+ 
+ 	mtsp		t1, %sr1	/* Restore sr1 */
+ 
+-	tlb_unlock1	spc,t0
++	ptl_unlock1	spc,t0
+ 	rfir
+ 	nop
+ 
+@@ -1285,7 +1271,7 @@ dtlb_miss_20:
+ 
+ 	L2_ptep		ptp,pte,t0,va,dtlb_check_alias_20
+ 
+-	tlb_lock	spc,ptp,pte,t0,t1,dtlb_check_alias_20
++	ptl_lock	spc,ptp,pte,t0,t1,dtlb_check_alias_20
+ 	update_accessed	ptp,pte,t0,t1
+ 
+ 	make_insert_tlb	spc,pte,prot,t1
+@@ -1294,7 +1280,7 @@ dtlb_miss_20:
+ 
+ 	idtlbt          pte,prot
+ 
+-	tlb_unlock1	spc,t0
++	ptl_unlock1	spc,t0
+ 	rfir
+ 	nop
+ 
+@@ -1313,7 +1299,7 @@ nadtlb_miss_20:
+ 
+ 	L2_ptep		ptp,pte,t0,va,nadtlb_check_alias_20
+ 
+-	tlb_lock	spc,ptp,pte,t0,t1,nadtlb_check_alias_20
++	ptl_lock	spc,ptp,pte,t0,t1,nadtlb_check_alias_20
+ 	update_accessed	ptp,pte,t0,t1
+ 
+ 	make_insert_tlb	spc,pte,prot,t1
+@@ -1322,7 +1308,7 @@ nadtlb_miss_20:
+ 	
+ 	idtlbt		pte,prot
+ 
+-	tlb_unlock1	spc,t0
++	ptl_unlock1	spc,t0
+ 	rfir
+ 	nop
+ 
+@@ -1422,14 +1408,14 @@ itlb_miss_20w:
+ 
+ 	L3_ptep		ptp,pte,t0,va,itlb_fault
+ 
+-	tlb_lock	spc,ptp,pte,t0,t1,itlb_fault
++	ptl_lock	spc,ptp,pte,t0,t1,itlb_fault
+ 	update_accessed	ptp,pte,t0,t1
+ 
+ 	make_insert_tlb	spc,pte,prot,t1
+ 	
+ 	iitlbt          pte,prot
+ 
+-	tlb_unlock1	spc,t0
++	ptl_unlock1	spc,t0
+ 	rfir
+ 	nop
+ 
+@@ -1446,14 +1432,14 @@ naitlb_miss_20w:
+ 
+ 	L3_ptep		ptp,pte,t0,va,naitlb_check_alias_20w
+ 
+-	tlb_lock	spc,ptp,pte,t0,t1,naitlb_check_alias_20w
++	ptl_lock	spc,ptp,pte,t0,t1,naitlb_check_alias_20w
+ 	update_accessed	ptp,pte,t0,t1
+ 
+ 	make_insert_tlb	spc,pte,prot,t1
+ 
+ 	iitlbt          pte,prot
+ 
+-	tlb_unlock1	spc,t0
++	ptl_unlock1	spc,t0
+ 	rfir
+ 	nop
+ 
+@@ -1474,7 +1460,7 @@ itlb_miss_11:
+ 
+ 	L2_ptep		ptp,pte,t0,va,itlb_fault
+ 
+-	tlb_lock	spc,ptp,pte,t0,t1,itlb_fault
++	ptl_lock	spc,ptp,pte,t0,t1,itlb_fault
+ 	update_accessed	ptp,pte,t0,t1
+ 
+ 	make_insert_tlb_11	spc,pte,prot
+@@ -1487,7 +1473,7 @@ itlb_miss_11:
+ 
+ 	mtsp		t1, %sr1	/* Restore sr1 */
+ 
+-	tlb_unlock1	spc,t0
++	ptl_unlock1	spc,t0
+ 	rfir
+ 	nop
+ 
+@@ -1498,7 +1484,7 @@ naitlb_miss_11:
+ 
+ 	L2_ptep		ptp,pte,t0,va,naitlb_check_alias_11
+ 
+-	tlb_lock	spc,ptp,pte,t0,t1,naitlb_check_alias_11
++	ptl_lock	spc,ptp,pte,t0,t1,naitlb_check_alias_11
+ 	update_accessed	ptp,pte,t0,t1
+ 
+ 	make_insert_tlb_11	spc,pte,prot
+@@ -1511,7 +1497,7 @@ naitlb_miss_11:
+ 
+ 	mtsp		t1, %sr1	/* Restore sr1 */
+ 
+-	tlb_unlock1	spc,t0
++	ptl_unlock1	spc,t0
+ 	rfir
+ 	nop
+ 
+@@ -1532,7 +1518,7 @@ itlb_miss_20:
+ 
+ 	L2_ptep		ptp,pte,t0,va,itlb_fault
+ 
+-	tlb_lock	spc,ptp,pte,t0,t1,itlb_fault
++	ptl_lock	spc,ptp,pte,t0,t1,itlb_fault
+ 	update_accessed	ptp,pte,t0,t1
+ 
+ 	make_insert_tlb	spc,pte,prot,t1
+@@ -1541,7 +1527,7 @@ itlb_miss_20:
+ 
+ 	iitlbt          pte,prot
+ 
+-	tlb_unlock1	spc,t0
++	ptl_unlock1	spc,t0
+ 	rfir
+ 	nop
+ 
+@@ -1552,7 +1538,7 @@ naitlb_miss_20:
+ 
+ 	L2_ptep		ptp,pte,t0,va,naitlb_check_alias_20
+ 
+-	tlb_lock	spc,ptp,pte,t0,t1,naitlb_check_alias_20
++	ptl_lock	spc,ptp,pte,t0,t1,naitlb_check_alias_20
+ 	update_accessed	ptp,pte,t0,t1
+ 
+ 	make_insert_tlb	spc,pte,prot,t1
+@@ -1561,7 +1547,7 @@ naitlb_miss_20:
+ 
+ 	iitlbt          pte,prot
+ 
+-	tlb_unlock1	spc,t0
++	ptl_unlock1	spc,t0
+ 	rfir
+ 	nop
+ 
+@@ -1584,14 +1570,14 @@ dbit_trap_20w:
+ 
+ 	L3_ptep		ptp,pte,t0,va,dbit_fault
+ 
+-	tlb_lock	spc,ptp,pte,t0,t1,dbit_fault
++	ptl_lock	spc,ptp,pte,t0,t1,dbit_fault
+ 	update_dirty	ptp,pte,t1
+ 
+ 	make_insert_tlb	spc,pte,prot,t1
+ 		
+ 	idtlbt          pte,prot
+ 
+-	tlb_unlock0	spc,t0
++	ptl_unlock0	spc,t0
+ 	rfir
+ 	nop
+ #else
+@@ -1604,7 +1590,7 @@ dbit_trap_11:
+ 
+ 	L2_ptep		ptp,pte,t0,va,dbit_fault
+ 
+-	tlb_lock	spc,ptp,pte,t0,t1,dbit_fault
++	ptl_lock	spc,ptp,pte,t0,t1,dbit_fault
+ 	update_dirty	ptp,pte,t1
+ 
+ 	make_insert_tlb_11	spc,pte,prot
+@@ -1617,7 +1603,7 @@ dbit_trap_11:
+ 
+ 	mtsp            t1, %sr1     /* Restore sr1 */
+ 
+-	tlb_unlock0	spc,t0
++	ptl_unlock0	spc,t0
+ 	rfir
+ 	nop
+ 
+@@ -1628,7 +1614,7 @@ dbit_trap_20:
+ 
+ 	L2_ptep		ptp,pte,t0,va,dbit_fault
+ 
+-	tlb_lock	spc,ptp,pte,t0,t1,dbit_fault
++	ptl_lock	spc,ptp,pte,t0,t1,dbit_fault
+ 	update_dirty	ptp,pte,t1
+ 
+ 	make_insert_tlb	spc,pte,prot,t1
+@@ -1637,7 +1623,7 @@ dbit_trap_20:
+ 	
+ 	idtlbt		pte,prot
+ 
+-	tlb_unlock0	spc,t0
++	ptl_unlock0	spc,t0
+ 	rfir
+ 	nop
+ #endif
+diff --git a/arch/parisc/mm/hugetlbpage.c b/arch/parisc/mm/hugetlbpage.c
+index d7ba014a7fbb5..43652de5f139f 100644
+--- a/arch/parisc/mm/hugetlbpage.c
++++ b/arch/parisc/mm/hugetlbpage.c
+@@ -142,24 +142,17 @@ static void __set_huge_pte_at(struct mm_struct *mm, unsigned long addr,
+ void set_huge_pte_at(struct mm_struct *mm, unsigned long addr,
+ 		     pte_t *ptep, pte_t entry)
+ {
+-	unsigned long flags;
+-
+-	spin_lock_irqsave(pgd_spinlock((mm)->pgd), flags);
+ 	__set_huge_pte_at(mm, addr, ptep, entry);
+-	spin_unlock_irqrestore(pgd_spinlock((mm)->pgd), flags);
+ }
+ 
+ 
+ pte_t huge_ptep_get_and_clear(struct mm_struct *mm, unsigned long addr,
+ 			      pte_t *ptep)
+ {
+-	unsigned long flags;
+ 	pte_t entry;
+ 
+-	spin_lock_irqsave(pgd_spinlock((mm)->pgd), flags);
+ 	entry = *ptep;
+ 	__set_huge_pte_at(mm, addr, ptep, __pte(0));
+-	spin_unlock_irqrestore(pgd_spinlock((mm)->pgd), flags);
+ 
+ 	return entry;
+ }
+@@ -168,29 +161,23 @@ pte_t huge_ptep_get_and_clear(struct mm_struct *mm, unsigned long addr,
+ void huge_ptep_set_wrprotect(struct mm_struct *mm,
+ 				unsigned long addr, pte_t *ptep)
+ {
+-	unsigned long flags;
+ 	pte_t old_pte;
+ 
+-	spin_lock_irqsave(pgd_spinlock((mm)->pgd), flags);
+ 	old_pte = *ptep;
+ 	__set_huge_pte_at(mm, addr, ptep, pte_wrprotect(old_pte));
+-	spin_unlock_irqrestore(pgd_spinlock((mm)->pgd), flags);
+ }
+ 
+ int huge_ptep_set_access_flags(struct vm_area_struct *vma,
+ 				unsigned long addr, pte_t *ptep,
+ 				pte_t pte, int dirty)
+ {
+-	unsigned long flags;
+ 	int changed;
+ 	struct mm_struct *mm = vma->vm_mm;
+ 
+-	spin_lock_irqsave(pgd_spinlock((mm)->pgd), flags);
+ 	changed = !pte_same(*ptep, pte);
+ 	if (changed) {
+ 		__set_huge_pte_at(mm, addr, ptep, pte);
+ 	}
+-	spin_unlock_irqrestore(pgd_spinlock((mm)->pgd), flags);
+ 	return changed;
+ }
+ 
+diff --git a/arch/parisc/mm/init.c b/arch/parisc/mm/init.c
+index 319afa00cdf7b..6a083fc87a038 100644
+--- a/arch/parisc/mm/init.c
++++ b/arch/parisc/mm/init.c
+@@ -37,11 +37,6 @@ extern int  data_start;
+ extern void parisc_kernel_start(void);	/* Kernel entry point in head.S */
+ 
+ #if CONFIG_PGTABLE_LEVELS == 3
+-/* NOTE: This layout exactly conforms to the hybrid L2/L3 page table layout
+- * with the first pmd adjacent to the pgd and below it. gcc doesn't actually
+- * guarantee that global objects will be laid out in memory in the same order
+- * as the order of declaration, so put these in different sections and use
+- * the linker script to order them. */
+ pmd_t pmd0[PTRS_PER_PMD] __section(".data..vm0.pmd") __attribute__ ((aligned(PAGE_SIZE)));
+ #endif
+ 
+@@ -558,6 +553,11 @@ void __init mem_init(void)
+ 	BUILD_BUG_ON(PGD_ENTRY_SIZE != sizeof(pgd_t));
+ 	BUILD_BUG_ON(PAGE_SHIFT + BITS_PER_PTE + BITS_PER_PMD + BITS_PER_PGD
+ 			> BITS_PER_LONG);
++#if CONFIG_PGTABLE_LEVELS == 3
++	BUILD_BUG_ON(PT_INITIAL > PTRS_PER_PMD);
++#else
++	BUILD_BUG_ON(PT_INITIAL > PTRS_PER_PGD);
++#endif
+ 
+ 	high_memory = __va((max_pfn << PAGE_SHIFT));
+ 	set_max_mapnr(max_low_pfn);
+diff --git a/arch/powerpc/kvm/book3s_hv.c b/arch/powerpc/kvm/book3s_hv.c
+index 38b7a3491aac0..1d25932389951 100644
+--- a/arch/powerpc/kvm/book3s_hv.c
++++ b/arch/powerpc/kvm/book3s_hv.c
+@@ -3399,8 +3399,22 @@ static noinline void kvmppc_run_core(struct kvmppc_vcore *vc)
+ 
+ 	kvmppc_set_host_core(pcpu);
+ 
++	context_tracking_guest_exit();
++	if (!vtime_accounting_enabled_this_cpu()) {
++		local_irq_enable();
++		/*
++		 * Service IRQs here before vtime_account_guest_exit() so any
++		 * ticks that occurred while running the guest are accounted to
++		 * the guest. If vtime accounting is enabled, accounting uses
++		 * TB rather than ticks, so it can be done without enabling
++		 * interrupts here, which has the problem that it accounts
++		 * interrupt processing overhead to the host.
++		 */
++		local_irq_disable();
++	}
++	vtime_account_guest_exit();
++
+ 	local_irq_enable();
+-	guest_exit();
+ 
+ 	/* Let secondaries go back to the offline loop */
+ 	for (i = 0; i < controlled_threads; ++i) {
+@@ -4235,8 +4249,22 @@ int kvmhv_run_single_vcpu(struct kvm_vcpu *vcpu, u64 time_limit,
+ 
+ 	kvmppc_set_host_core(pcpu);
+ 
++	context_tracking_guest_exit();
++	if (!vtime_accounting_enabled_this_cpu()) {
++		local_irq_enable();
++		/*
++		 * Service IRQs here before vtime_account_guest_exit() so any
++		 * ticks that occurred while running the guest are accounted to
++		 * the guest. If vtime accounting is enabled, accounting uses
++		 * TB rather than ticks, so it can be done without enabling
++		 * interrupts here, which has the problem that it accounts
++		 * interrupt processing overhead to the host.
++		 */
++		local_irq_disable();
++	}
++	vtime_account_guest_exit();
++
+ 	local_irq_enable();
+-	guest_exit();
+ 
+ 	cpumask_clear_cpu(pcpu, &kvm->arch.cpu_in_guest);
+ 
+diff --git a/arch/powerpc/kvm/booke.c b/arch/powerpc/kvm/booke.c
+index b1abcb8164397..75381beb7514a 100644
+--- a/arch/powerpc/kvm/booke.c
++++ b/arch/powerpc/kvm/booke.c
+@@ -1016,7 +1016,21 @@ int kvmppc_handle_exit(struct kvm_vcpu *vcpu, unsigned int exit_nr)
+ 	}
+ 
+ 	trace_kvm_exit(exit_nr, vcpu);
+-	guest_exit_irqoff();
++
++	context_tracking_guest_exit();
++	if (!vtime_accounting_enabled_this_cpu()) {
++		local_irq_enable();
++		/*
++		 * Service IRQs here before vtime_account_guest_exit() so any
++		 * ticks that occurred while running the guest are accounted to
++		 * the guest. If vtime accounting is enabled, accounting uses
++		 * TB rather than ticks, so it can be done without enabling
++		 * interrupts here, which has the problem that it accounts
++		 * interrupt processing overhead to the host.
++		 */
++		local_irq_disable();
++	}
++	vtime_account_guest_exit();
+ 
+ 	local_irq_enable();
+ 
+diff --git a/arch/powerpc/platforms/pseries/mobility.c b/arch/powerpc/platforms/pseries/mobility.c
+index 2f73cb5bf12d5..f386a7bc38114 100644
+--- a/arch/powerpc/platforms/pseries/mobility.c
++++ b/arch/powerpc/platforms/pseries/mobility.c
+@@ -59,18 +59,31 @@ static int mobility_rtas_call(int token, char *buf, s32 scope)
+ 	return rc;
+ }
+ 
+-static int delete_dt_node(__be32 phandle)
++static int delete_dt_node(struct device_node *dn)
+ {
+-	struct device_node *dn;
++	struct device_node *pdn;
++	bool is_platfac;
+ 
+-	dn = of_find_node_by_phandle(be32_to_cpu(phandle));
+-	if (!dn)
+-		return -ENOENT;
++	pdn = of_get_parent(dn);
++	is_platfac = of_node_is_type(dn, "ibm,platform-facilities") ||
++		     of_node_is_type(pdn, "ibm,platform-facilities");
++	of_node_put(pdn);
+ 
+-	pr_debug("removing node %pOFfp\n", dn);
++	/*
++	 * The drivers that bind to nodes in the platform-facilities
++	 * hierarchy don't support node removal, and the removal directive
++	 * from firmware is always followed by an add of an equivalent
++	 * node. The capability (e.g. RNG, encryption, compression)
++	 * represented by the node is never interrupted by the migration.
++	 * So ignore changes to this part of the tree.
++	 */
++	if (is_platfac) {
++		pr_notice("ignoring remove operation for %pOFfp\n", dn);
++		return 0;
++	}
+ 
++	pr_debug("removing node %pOFfp\n", dn);
+ 	dlpar_detach_node(dn);
+-	of_node_put(dn);
+ 	return 0;
+ }
+ 
+@@ -135,10 +148,9 @@ static int update_dt_property(struct device_node *dn, struct property **prop,
+ 	return 0;
+ }
+ 
+-static int update_dt_node(__be32 phandle, s32 scope)
++static int update_dt_node(struct device_node *dn, s32 scope)
+ {
+ 	struct update_props_workarea *upwa;
+-	struct device_node *dn;
+ 	struct property *prop = NULL;
+ 	int i, rc, rtas_rc;
+ 	char *prop_data;
+@@ -155,14 +167,8 @@ static int update_dt_node(__be32 phandle, s32 scope)
+ 	if (!rtas_buf)
+ 		return -ENOMEM;
+ 
+-	dn = of_find_node_by_phandle(be32_to_cpu(phandle));
+-	if (!dn) {
+-		kfree(rtas_buf);
+-		return -ENOENT;
+-	}
+-
+ 	upwa = (struct update_props_workarea *)&rtas_buf[0];
+-	upwa->phandle = phandle;
++	upwa->phandle = cpu_to_be32(dn->phandle);
+ 
+ 	do {
+ 		rtas_rc = mobility_rtas_call(update_properties_token, rtas_buf,
+@@ -221,25 +227,30 @@ static int update_dt_node(__be32 phandle, s32 scope)
+ 		cond_resched();
+ 	} while (rtas_rc == 1);
+ 
+-	of_node_put(dn);
+ 	kfree(rtas_buf);
+ 	return 0;
+ }
+ 
+-static int add_dt_node(__be32 parent_phandle, __be32 drc_index)
++static int add_dt_node(struct device_node *parent_dn, __be32 drc_index)
+ {
+ 	struct device_node *dn;
+-	struct device_node *parent_dn;
+ 	int rc;
+ 
+-	parent_dn = of_find_node_by_phandle(be32_to_cpu(parent_phandle));
+-	if (!parent_dn)
+-		return -ENOENT;
+-
+ 	dn = dlpar_configure_connector(drc_index, parent_dn);
+-	if (!dn) {
+-		of_node_put(parent_dn);
++	if (!dn)
+ 		return -ENOENT;
++
++	/*
++	 * Since delete_dt_node() ignores this node type, this is the
++	 * necessary counterpart. We also know that a platform-facilities
++	 * node returned from dlpar_configure_connector() has children
++	 * attached, and dlpar_attach_node() only adds the parent, leaking
++	 * the children. So ignore these on the add side for now.
++	 */
++	if (of_node_is_type(dn, "ibm,platform-facilities")) {
++		pr_notice("ignoring add operation for %pOF\n", dn);
++		dlpar_free_cc_nodes(dn);
++		return 0;
+ 	}
+ 
+ 	rc = dlpar_attach_node(dn, parent_dn);
+@@ -248,7 +259,6 @@ static int add_dt_node(__be32 parent_phandle, __be32 drc_index)
+ 
+ 	pr_debug("added node %pOFfp\n", dn);
+ 
+-	of_node_put(parent_dn);
+ 	return rc;
+ }
+ 
+@@ -281,22 +291,31 @@ int pseries_devicetree_update(s32 scope)
+ 			data++;
+ 
+ 			for (i = 0; i < node_count; i++) {
++				struct device_node *np;
+ 				__be32 phandle = *data++;
+ 				__be32 drc_index;
+ 
++				np = of_find_node_by_phandle(be32_to_cpu(phandle));
++				if (!np) {
++					pr_warn("Failed lookup: phandle 0x%x for action 0x%x\n",
++						be32_to_cpu(phandle), action);
++					continue;
++				}
++
+ 				switch (action) {
+ 				case DELETE_DT_NODE:
+-					delete_dt_node(phandle);
++					delete_dt_node(np);
+ 					break;
+ 				case UPDATE_DT_NODE:
+-					update_dt_node(phandle, scope);
++					update_dt_node(np, scope);
+ 					break;
+ 				case ADD_DT_NODE:
+ 					drc_index = *data++;
+-					add_dt_node(phandle, drc_index);
++					add_dt_node(np, drc_index);
+ 					break;
+ 				}
+ 
++				of_node_put(np);
+ 				cond_resched();
+ 			}
+ 		}
+diff --git a/drivers/dma/bestcomm/ata.c b/drivers/dma/bestcomm/ata.c
+index 2fd87f83cf90b..e169f18da551f 100644
+--- a/drivers/dma/bestcomm/ata.c
++++ b/drivers/dma/bestcomm/ata.c
+@@ -133,7 +133,7 @@ void bcom_ata_reset_bd(struct bcom_task *tsk)
+ 	struct bcom_ata_var *var;
+ 
+ 	/* Reset all BD */
+-	memset(tsk->bd, 0x00, tsk->num_bd * tsk->bd_size);
++	memset_io(tsk->bd, 0x00, tsk->num_bd * tsk->bd_size);
+ 
+ 	tsk->index = 0;
+ 	tsk->outdex = 0;
+diff --git a/drivers/dma/bestcomm/bestcomm.c b/drivers/dma/bestcomm/bestcomm.c
+index d91cbbe7a48fb..8c42e5ca00a99 100644
+--- a/drivers/dma/bestcomm/bestcomm.c
++++ b/drivers/dma/bestcomm/bestcomm.c
+@@ -95,7 +95,7 @@ bcom_task_alloc(int bd_count, int bd_size, int priv_size)
+ 		tsk->bd = bcom_sram_alloc(bd_count * bd_size, 4, &tsk->bd_pa);
+ 		if (!tsk->bd)
+ 			goto error;
+-		memset(tsk->bd, 0x00, bd_count * bd_size);
++		memset_io(tsk->bd, 0x00, bd_count * bd_size);
+ 
+ 		tsk->num_bd = bd_count;
+ 		tsk->bd_size = bd_size;
+@@ -186,16 +186,16 @@ bcom_load_image(int task, u32 *task_image)
+ 	inc = bcom_task_inc(task);
+ 
+ 	/* Clear & copy */
+-	memset(var, 0x00, BCOM_VAR_SIZE);
+-	memset(inc, 0x00, BCOM_INC_SIZE);
++	memset_io(var, 0x00, BCOM_VAR_SIZE);
++	memset_io(inc, 0x00, BCOM_INC_SIZE);
+ 
+ 	desc_src = (u32 *)(hdr + 1);
+ 	var_src = desc_src + hdr->desc_size;
+ 	inc_src = var_src + hdr->var_size;
+ 
+-	memcpy(desc, desc_src, hdr->desc_size * sizeof(u32));
+-	memcpy(var + hdr->first_var, var_src, hdr->var_size * sizeof(u32));
+-	memcpy(inc, inc_src, hdr->inc_size * sizeof(u32));
++	memcpy_toio(desc, desc_src, hdr->desc_size * sizeof(u32));
++	memcpy_toio(var + hdr->first_var, var_src, hdr->var_size * sizeof(u32));
++	memcpy_toio(inc, inc_src, hdr->inc_size * sizeof(u32));
+ 
+ 	return 0;
+ }
+@@ -302,13 +302,13 @@ static int bcom_engine_init(void)
+ 		return -ENOMEM;
+ 	}
+ 
+-	memset(bcom_eng->tdt, 0x00, tdt_size);
+-	memset(bcom_eng->ctx, 0x00, ctx_size);
+-	memset(bcom_eng->var, 0x00, var_size);
+-	memset(bcom_eng->fdt, 0x00, fdt_size);
++	memset_io(bcom_eng->tdt, 0x00, tdt_size);
++	memset_io(bcom_eng->ctx, 0x00, ctx_size);
++	memset_io(bcom_eng->var, 0x00, var_size);
++	memset_io(bcom_eng->fdt, 0x00, fdt_size);
+ 
+ 	/* Copy the FDT for the EU#3 */
+-	memcpy(&bcom_eng->fdt[48], fdt_ops, sizeof(fdt_ops));
++	memcpy_toio(&bcom_eng->fdt[48], fdt_ops, sizeof(fdt_ops));
+ 
+ 	/* Initialize Task base structure */
+ 	for (task=0; task<BCOM_MAX_TASKS; task++)
+diff --git a/drivers/dma/bestcomm/fec.c b/drivers/dma/bestcomm/fec.c
+index 7f1fb1c999e43..d203618ac11fe 100644
+--- a/drivers/dma/bestcomm/fec.c
++++ b/drivers/dma/bestcomm/fec.c
+@@ -140,7 +140,7 @@ bcom_fec_rx_reset(struct bcom_task *tsk)
+ 	tsk->index = 0;
+ 	tsk->outdex = 0;
+ 
+-	memset(tsk->bd, 0x00, tsk->num_bd * tsk->bd_size);
++	memset_io(tsk->bd, 0x00, tsk->num_bd * tsk->bd_size);
+ 
+ 	/* Configure some stuff */
+ 	bcom_set_task_pragma(tsk->tasknum, BCOM_FEC_RX_BD_PRAGMA);
+@@ -241,7 +241,7 @@ bcom_fec_tx_reset(struct bcom_task *tsk)
+ 	tsk->index = 0;
+ 	tsk->outdex = 0;
+ 
+-	memset(tsk->bd, 0x00, tsk->num_bd * tsk->bd_size);
++	memset_io(tsk->bd, 0x00, tsk->num_bd * tsk->bd_size);
+ 
+ 	/* Configure some stuff */
+ 	bcom_set_task_pragma(tsk->tasknum, BCOM_FEC_TX_BD_PRAGMA);
+diff --git a/drivers/dma/bestcomm/gen_bd.c b/drivers/dma/bestcomm/gen_bd.c
+index 906ddba6a6f5d..8a24a5cbc2633 100644
+--- a/drivers/dma/bestcomm/gen_bd.c
++++ b/drivers/dma/bestcomm/gen_bd.c
+@@ -142,7 +142,7 @@ bcom_gen_bd_rx_reset(struct bcom_task *tsk)
+ 	tsk->index = 0;
+ 	tsk->outdex = 0;
+ 
+-	memset(tsk->bd, 0x00, tsk->num_bd * tsk->bd_size);
++	memset_io(tsk->bd, 0x00, tsk->num_bd * tsk->bd_size);
+ 
+ 	/* Configure some stuff */
+ 	bcom_set_task_pragma(tsk->tasknum, BCOM_GEN_RX_BD_PRAGMA);
+@@ -226,7 +226,7 @@ bcom_gen_bd_tx_reset(struct bcom_task *tsk)
+ 	tsk->index = 0;
+ 	tsk->outdex = 0;
+ 
+-	memset(tsk->bd, 0x00, tsk->num_bd * tsk->bd_size);
++	memset_io(tsk->bd, 0x00, tsk->num_bd * tsk->bd_size);
+ 
+ 	/* Configure some stuff */
+ 	bcom_set_task_pragma(tsk->tasknum, BCOM_GEN_TX_BD_PRAGMA);
+diff --git a/drivers/gpio/gpio-mpc8xxx.c b/drivers/gpio/gpio-mpc8xxx.c
+index d60d5520707dc..60c2533a39a5f 100644
+--- a/drivers/gpio/gpio-mpc8xxx.c
++++ b/drivers/gpio/gpio-mpc8xxx.c
+@@ -169,6 +169,7 @@ static int mpc8xxx_irq_set_type(struct irq_data *d, unsigned int flow_type)
+ 
+ 	switch (flow_type) {
+ 	case IRQ_TYPE_EDGE_FALLING:
++	case IRQ_TYPE_LEVEL_LOW:
+ 		raw_spin_lock_irqsave(&mpc8xxx_gc->lock, flags);
+ 		gc->write_reg(mpc8xxx_gc->regs + GPIO_ICR,
+ 			gc->read_reg(mpc8xxx_gc->regs + GPIO_ICR)
+diff --git a/drivers/gpu/drm/meson/meson_plane.c b/drivers/gpu/drm/meson/meson_plane.c
+index 35338ed182099..255c6b863f8d2 100644
+--- a/drivers/gpu/drm/meson/meson_plane.c
++++ b/drivers/gpu/drm/meson/meson_plane.c
+@@ -163,7 +163,7 @@ static void meson_plane_atomic_update(struct drm_plane *plane,
+ 
+ 	/* Enable OSD and BLK0, set max global alpha */
+ 	priv->viu.osd1_ctrl_stat = OSD_ENABLE |
+-				   (0xFF << OSD_GLOBAL_ALPHA_SHIFT) |
++				   (0x100 << OSD_GLOBAL_ALPHA_SHIFT) |
+ 				   OSD_BLK0_ENABLE;
+ 
+ 	priv->viu.osd1_ctrl_stat2 = readl(priv->io_base +
+diff --git a/drivers/gpu/drm/meson/meson_viu.c b/drivers/gpu/drm/meson/meson_viu.c
+index bb7e109534de1..d4b907889a21d 100644
+--- a/drivers/gpu/drm/meson/meson_viu.c
++++ b/drivers/gpu/drm/meson/meson_viu.c
+@@ -94,7 +94,7 @@ static void meson_viu_set_g12a_osd1_matrix(struct meson_drm *priv,
+ 		priv->io_base + _REG(VPP_WRAP_OSD1_MATRIX_COEF11_12));
+ 	writel(((m[9] & 0x1fff) << 16) | (m[10] & 0x1fff),
+ 		priv->io_base + _REG(VPP_WRAP_OSD1_MATRIX_COEF20_21));
+-	writel((m[11] & 0x1fff) << 16,
++	writel((m[11] & 0x1fff),
+ 		priv->io_base +	_REG(VPP_WRAP_OSD1_MATRIX_COEF22));
+ 
+ 	writel(((m[18] & 0xfff) << 16) | (m[19] & 0xfff),
+diff --git a/drivers/net/dsa/mv88e6xxx/chip.c b/drivers/net/dsa/mv88e6xxx/chip.c
+index 7b7a8a74405df..371b345635e62 100644
+--- a/drivers/net/dsa/mv88e6xxx/chip.c
++++ b/drivers/net/dsa/mv88e6xxx/chip.c
+@@ -666,44 +666,48 @@ static void mv88e6xxx_mac_config(struct dsa_switch *ds, int port,
+ {
+ 	struct mv88e6xxx_chip *chip = ds->priv;
+ 	struct mv88e6xxx_port *p;
+-	int err;
++	int err = 0;
+ 
+ 	p = &chip->ports[port];
+ 
+-	/* FIXME: is this the correct test? If we're in fixed mode on an
+-	 * internal port, why should we process this any different from
+-	 * PHY mode? On the other hand, the port may be automedia between
+-	 * an internal PHY and the serdes...
+-	 */
+-	if ((mode == MLO_AN_PHY) && mv88e6xxx_phy_is_internal(ds, port))
+-		return;
+-
+ 	mv88e6xxx_reg_lock(chip);
+-	/* In inband mode, the link may come up at any time while the link
+-	 * is not forced down. Force the link down while we reconfigure the
+-	 * interface mode.
+-	 */
+-	if (mode == MLO_AN_INBAND && p->interface != state->interface &&
+-	    chip->info->ops->port_set_link)
+-		chip->info->ops->port_set_link(chip, port, LINK_FORCED_DOWN);
+-
+-	err = mv88e6xxx_port_config_interface(chip, port, state->interface);
+-	if (err && err != -EOPNOTSUPP)
+-		goto err_unlock;
+ 
+-	err = mv88e6xxx_serdes_pcs_config(chip, port, mode, state->interface,
+-					  state->advertising);
+-	/* FIXME: we should restart negotiation if something changed - which
+-	 * is something we get if we convert to using phylinks PCS operations.
+-	 */
+-	if (err > 0)
+-		err = 0;
++	if (mode != MLO_AN_PHY || !mv88e6xxx_phy_is_internal(ds, port)) {
++		/* In inband mode, the link may come up at any time while the
++		 * link is not forced down. Force the link down while we
++		 * reconfigure the interface mode.
++		 */
++		if (mode == MLO_AN_INBAND &&
++		    p->interface != state->interface &&
++		    chip->info->ops->port_set_link)
++			chip->info->ops->port_set_link(chip, port,
++						       LINK_FORCED_DOWN);
++
++		err = mv88e6xxx_port_config_interface(chip, port,
++						      state->interface);
++		if (err && err != -EOPNOTSUPP)
++			goto err_unlock;
++
++		err = mv88e6xxx_serdes_pcs_config(chip, port, mode,
++						  state->interface,
++						  state->advertising);
++		/* FIXME: we should restart negotiation if something changed -
++		 * which is something we get if we convert to using phylinks
++		 * PCS operations.
++		 */
++		if (err > 0)
++			err = 0;
++	}
+ 
+ 	/* Undo the forced down state above after completing configuration
+-	 * irrespective of its state on entry, which allows the link to come up.
++	 * irrespective of its state on entry, which allows the link to come
++	 * up in the in-band case where there is no separate SERDES. Also
++	 * ensure that the link can come up if the PPU is in use and we are
++	 * in PHY mode (we treat the PPU as an effective in-band mechanism.)
+ 	 */
+-	if (mode == MLO_AN_INBAND && p->interface != state->interface &&
+-	    chip->info->ops->port_set_link)
++	if (chip->info->ops->port_set_link &&
++	    ((mode == MLO_AN_INBAND && p->interface != state->interface) ||
++	     (mode == MLO_AN_PHY && mv88e6xxx_port_ppu_updates(chip, port))))
+ 		chip->info->ops->port_set_link(chip, port, LINK_UNFORCED);
+ 
+ 	p->interface = state->interface;
+diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
+index 48e8b94e4a7c5..1502069f3a4e2 100644
+--- a/drivers/net/usb/qmi_wwan.c
++++ b/drivers/net/usb/qmi_wwan.c
+@@ -1024,6 +1024,7 @@ static const struct usb_device_id products[] = {
+ 	{QMI_MATCH_FF_FF_FF(0x2c7c, 0x0512)},	/* Quectel EG12/EM12 */
+ 	{QMI_MATCH_FF_FF_FF(0x2c7c, 0x0620)},	/* Quectel EM160R-GL */
+ 	{QMI_MATCH_FF_FF_FF(0x2c7c, 0x0800)},	/* Quectel RM500Q-GL */
++	{QMI_MATCH_FF_FF_FF(0x2c7c, 0x0801)},	/* Quectel RM520N */
+ 
+ 	/* 3. Combined interface devices matching on interface number */
+ 	{QMI_FIXED_INTF(0x0408, 0xea42, 4)},	/* Yota / Megafon M100-1 */
+diff --git a/drivers/net/wireless/mac80211_hwsim.c b/drivers/net/wireless/mac80211_hwsim.c
+index 8e412125a49c1..50190ded7edc7 100644
+--- a/drivers/net/wireless/mac80211_hwsim.c
++++ b/drivers/net/wireless/mac80211_hwsim.c
+@@ -4209,6 +4209,10 @@ static int hwsim_virtio_handle_cmd(struct sk_buff *skb)
+ 
+ 	nlh = nlmsg_hdr(skb);
+ 	gnlh = nlmsg_data(nlh);
++
++	if (skb->len < nlh->nlmsg_len)
++		return -EINVAL;
++
+ 	err = genlmsg_parse(nlh, &hwsim_genl_family, tb, HWSIM_ATTR_MAX,
+ 			    hwsim_genl_policy, NULL);
+ 	if (err) {
+@@ -4251,7 +4255,8 @@ static void hwsim_virtio_rx_work(struct work_struct *work)
+ 	spin_unlock_irqrestore(&hwsim_virtio_lock, flags);
+ 
+ 	skb->data = skb->head;
+-	skb_set_tail_pointer(skb, len);
++	skb_reset_tail_pointer(skb);
++	skb_put(skb, len);
+ 	hwsim_virtio_handle_cmd(skb);
+ 
+ 	spin_lock_irqsave(&hwsim_virtio_lock, flags);
+diff --git a/drivers/of/fdt.c b/drivers/of/fdt.c
+index 57ff31b6b1e47..5a1b8688b4605 100644
+--- a/drivers/of/fdt.c
++++ b/drivers/of/fdt.c
+@@ -315,7 +315,7 @@ static int unflatten_dt_nodes(const void *blob,
+ 	for (offset = 0;
+ 	     offset >= 0 && depth >= initial_depth;
+ 	     offset = fdt_next_node(blob, offset, &depth)) {
+-		if (WARN_ON_ONCE(depth >= FDT_MAX_DEPTH))
++		if (WARN_ON_ONCE(depth >= FDT_MAX_DEPTH - 1))
+ 			continue;
+ 
+ 		if (!IS_ENABLED(CONFIG_OF_KOBJ) &&
+diff --git a/drivers/parisc/ccio-dma.c b/drivers/parisc/ccio-dma.c
+index ffd5000c23d39..be81b765858be 100644
+--- a/drivers/parisc/ccio-dma.c
++++ b/drivers/parisc/ccio-dma.c
+@@ -1546,6 +1546,7 @@ static int __init ccio_probe(struct parisc_device *dev)
+ 	}
+ 	ccio_ioc_init(ioc);
+ 	if (ccio_init_resources(ioc)) {
++		iounmap(ioc->ioc_regs);
+ 		kfree(ioc);
+ 		return -ENOMEM;
+ 	}
+diff --git a/drivers/pinctrl/sunxi/pinctrl-sun50i-a100-r.c b/drivers/pinctrl/sunxi/pinctrl-sun50i-a100-r.c
+index 21054fcacd345..18088f6f44b23 100644
+--- a/drivers/pinctrl/sunxi/pinctrl-sun50i-a100-r.c
++++ b/drivers/pinctrl/sunxi/pinctrl-sun50i-a100-r.c
+@@ -98,7 +98,7 @@ MODULE_DEVICE_TABLE(of, a100_r_pinctrl_match);
+ static struct platform_driver a100_r_pinctrl_driver = {
+ 	.probe	= a100_r_pinctrl_probe,
+ 	.driver	= {
+-		.name		= "sun50iw10p1-r-pinctrl",
++		.name		= "sun50i-a100-r-pinctrl",
+ 		.of_match_table	= a100_r_pinctrl_match,
+ 	},
+ };
+diff --git a/drivers/platform/x86/intel-hid.c b/drivers/platform/x86/intel-hid.c
+index 8a0cd5bf00657..cebddefba2f42 100644
+--- a/drivers/platform/x86/intel-hid.c
++++ b/drivers/platform/x86/intel-hid.c
+@@ -93,6 +93,13 @@ static const struct dmi_system_id button_array_table[] = {
+ 			DMI_MATCH(DMI_PRODUCT_FAMILY, "ThinkPad X1 Tablet Gen 2"),
+ 		},
+ 	},
++	{
++		.ident = "Microsoft Surface Go 3",
++		.matches = {
++			DMI_MATCH(DMI_SYS_VENDOR, "Microsoft Corporation"),
++			DMI_MATCH(DMI_PRODUCT_NAME, "Surface Go 3"),
++		},
++	},
+ 	{ }
+ };
+ 
+diff --git a/drivers/regulator/pfuze100-regulator.c b/drivers/regulator/pfuze100-regulator.c
+index 0a19500d3725e..44a8e500fb304 100644
+--- a/drivers/regulator/pfuze100-regulator.c
++++ b/drivers/regulator/pfuze100-regulator.c
+@@ -791,7 +791,7 @@ static int pfuze100_regulator_probe(struct i2c_client *client,
+ 		((pfuze_chip->chip_id == PFUZE3000) ? "3000" : "3001"))));
+ 
+ 	memcpy(pfuze_chip->regulator_descs, pfuze_chip->pfuze_regulators,
+-		sizeof(pfuze_chip->regulator_descs));
++		regulator_num * sizeof(struct pfuze_regulator));
+ 
+ 	ret = pfuze_parse_regulators_dt(pfuze_chip);
+ 	if (ret)
+diff --git a/drivers/usb/cdns3/gadget.c b/drivers/usb/cdns3/gadget.c
+index a37ea946459cc..c6fc14b169dac 100644
+--- a/drivers/usb/cdns3/gadget.c
++++ b/drivers/usb/cdns3/gadget.c
+@@ -352,19 +352,6 @@ static void cdns3_ep_inc_deq(struct cdns3_endpoint *priv_ep)
+ 	cdns3_ep_inc_trb(&priv_ep->dequeue, &priv_ep->ccs, priv_ep->num_trbs);
+ }
+ 
+-static void cdns3_move_deq_to_next_trb(struct cdns3_request *priv_req)
+-{
+-	struct cdns3_endpoint *priv_ep = priv_req->priv_ep;
+-	int current_trb = priv_req->start_trb;
+-
+-	while (current_trb != priv_req->end_trb) {
+-		cdns3_ep_inc_deq(priv_ep);
+-		current_trb = priv_ep->dequeue;
+-	}
+-
+-	cdns3_ep_inc_deq(priv_ep);
+-}
+-
+ /**
+  * cdns3_allow_enable_l1 - enable/disable permits to transition to L1.
+  * @priv_dev: Extended gadget object
+@@ -1518,10 +1505,11 @@ static void cdns3_transfer_completed(struct cdns3_device *priv_dev,
+ 
+ 		trb = priv_ep->trb_pool + priv_ep->dequeue;
+ 
+-		/* Request was dequeued and TRB was changed to TRB_LINK. */
+-		if (TRB_FIELD_TO_TYPE(le32_to_cpu(trb->control)) == TRB_LINK) {
++		/* The TRB was changed as link TRB, and the request was handled at ep_dequeue */
++		while (TRB_FIELD_TO_TYPE(le32_to_cpu(trb->control)) == TRB_LINK) {
+ 			trace_cdns3_complete_trb(priv_ep, trb);
+-			cdns3_move_deq_to_next_trb(priv_req);
++			cdns3_ep_inc_deq(priv_ep);
++			trb = priv_ep->trb_pool + priv_ep->dequeue;
+ 		}
+ 
+ 		if (!request->stream_id) {
+diff --git a/drivers/video/fbdev/i740fb.c b/drivers/video/fbdev/i740fb.c
+index ad5ced4ef972d..8fb4e01e1943f 100644
+--- a/drivers/video/fbdev/i740fb.c
++++ b/drivers/video/fbdev/i740fb.c
+@@ -662,6 +662,9 @@ static int i740fb_decode_var(const struct fb_var_screeninfo *var,
+ 
+ static int i740fb_check_var(struct fb_var_screeninfo *var, struct fb_info *info)
+ {
++	if (!var->pixclock)
++		return -EINVAL;
++
+ 	switch (var->bits_per_pixel) {
+ 	case 8:
+ 		var->red.offset	= var->green.offset = var->blue.offset = 0;
+diff --git a/drivers/video/fbdev/pxa3xx-gcu.c b/drivers/video/fbdev/pxa3xx-gcu.c
+index 9421d14d0eb02..9e9888e40c573 100644
+--- a/drivers/video/fbdev/pxa3xx-gcu.c
++++ b/drivers/video/fbdev/pxa3xx-gcu.c
+@@ -381,7 +381,7 @@ pxa3xx_gcu_write(struct file *file, const char *buff,
+ 	struct pxa3xx_gcu_batch	*buffer;
+ 	struct pxa3xx_gcu_priv *priv = to_pxa3xx_gcu_priv(file);
+ 
+-	int words = count / 4;
++	size_t words = count / 4;
+ 
+ 	/* Does not need to be atomic. There's a lock in user space,
+ 	 * but anyhow, this is just for statistics. */
+diff --git a/fs/afs/misc.c b/fs/afs/misc.c
+index 1d1a8debe4723..f1dc2162900a4 100644
+--- a/fs/afs/misc.c
++++ b/fs/afs/misc.c
+@@ -69,6 +69,7 @@ int afs_abort_to_error(u32 abort_code)
+ 		/* Unified AFS error table */
+ 	case UAEPERM:			return -EPERM;
+ 	case UAENOENT:			return -ENOENT;
++	case UAEAGAIN:			return -EAGAIN;
+ 	case UAEACCES:			return -EACCES;
+ 	case UAEBUSY:			return -EBUSY;
+ 	case UAEEXIST:			return -EEXIST;
+diff --git a/fs/cifs/file.c b/fs/cifs/file.c
+index 6c06870f90184..fafb69d338c26 100644
+--- a/fs/cifs/file.c
++++ b/fs/cifs/file.c
+@@ -3244,6 +3244,9 @@ static ssize_t __cifs_writev(
+ 
+ ssize_t cifs_direct_writev(struct kiocb *iocb, struct iov_iter *from)
+ {
++	struct file *file = iocb->ki_filp;
++
++	cifs_revalidate_mapping(file->f_inode);
+ 	return __cifs_writev(iocb, from, true);
+ }
+ 
+diff --git a/fs/cifs/transport.c b/fs/cifs/transport.c
+index 503a0056b60f2..383ae8744c337 100644
+--- a/fs/cifs/transport.c
++++ b/fs/cifs/transport.c
+@@ -209,8 +209,8 @@ smb_send_kvec(struct TCP_Server_Info *server, struct msghdr *smb_msg,
+ 
+ 	*sent = 0;
+ 
+-	smb_msg->msg_name = (struct sockaddr *) &server->dstaddr;
+-	smb_msg->msg_namelen = sizeof(struct sockaddr);
++	smb_msg->msg_name = NULL;
++	smb_msg->msg_namelen = 0;
+ 	smb_msg->msg_control = NULL;
+ 	smb_msg->msg_controllen = 0;
+ 	if (server->noblocksnd)
+diff --git a/fs/nfs/super.c b/fs/nfs/super.c
+index 4034102010f05..b3fcc27b95648 100644
+--- a/fs/nfs/super.c
++++ b/fs/nfs/super.c
+@@ -1029,22 +1029,31 @@ static void nfs_fill_super(struct super_block *sb, struct nfs_fs_context *ctx)
+ 	if (ctx && ctx->bsize)
+ 		sb->s_blocksize = nfs_block_size(ctx->bsize, &sb->s_blocksize_bits);
+ 
+-	if (server->nfs_client->rpc_ops->version != 2) {
+-		/* The VFS shouldn't apply the umask to mode bits. We will do
+-		 * so ourselves when necessary.
++	switch (server->nfs_client->rpc_ops->version) {
++	case 2:
++		sb->s_time_gran = 1000;
++		sb->s_time_min = 0;
++		sb->s_time_max = U32_MAX;
++		break;
++	case 3:
++		/*
++		 * The VFS shouldn't apply the umask to mode bits.
++		 * We will do so ourselves when necessary.
+ 		 */
+ 		sb->s_flags |= SB_POSIXACL;
+ 		sb->s_time_gran = 1;
+-		sb->s_export_op = &nfs_export_ops;
+-	} else
+-		sb->s_time_gran = 1000;
+-
+-	if (server->nfs_client->rpc_ops->version != 4) {
+ 		sb->s_time_min = 0;
+ 		sb->s_time_max = U32_MAX;
+-	} else {
++		sb->s_export_op = &nfs_export_ops;
++		break;
++	case 4:
++		sb->s_flags |= SB_POSIXACL;
++		sb->s_time_gran = 1;
+ 		sb->s_time_min = S64_MIN;
+ 		sb->s_time_max = S64_MAX;
++		if (server->caps & NFS_CAP_ATOMIC_OPEN_V1)
++			sb->s_export_op = &nfs_export_ops;
++		break;
+ 	}
+ 
+ 	sb->s_magic = NFS_SUPER_MAGIC;
+diff --git a/include/linux/of_device.h b/include/linux/of_device.h
+index 07ca187fc5e44..fe339106e02c4 100644
+--- a/include/linux/of_device.h
++++ b/include/linux/of_device.h
+@@ -113,8 +113,9 @@ static inline struct device_node *of_cpu_device_node_get(int cpu)
+ }
+ 
+ static inline int of_dma_configure_id(struct device *dev,
+-				   struct device_node *np,
+-				   bool force_dma)
++				      struct device_node *np,
++				      bool force_dma,
++				      const u32 *id)
+ {
+ 	return 0;
+ }
+diff --git a/kernel/cgroup/cgroup-v1.c b/kernel/cgroup/cgroup-v1.c
+index 1a0a9f820c69b..433b9e840b387 100644
+--- a/kernel/cgroup/cgroup-v1.c
++++ b/kernel/cgroup/cgroup-v1.c
+@@ -57,6 +57,7 @@ int cgroup_attach_task_all(struct task_struct *from, struct task_struct *tsk)
+ 	int retval = 0;
+ 
+ 	mutex_lock(&cgroup_mutex);
++	cpus_read_lock();
+ 	percpu_down_write(&cgroup_threadgroup_rwsem);
+ 	for_each_root(root) {
+ 		struct cgroup *from_cgrp;
+@@ -73,6 +74,7 @@ int cgroup_attach_task_all(struct task_struct *from, struct task_struct *tsk)
+ 			break;
+ 	}
+ 	percpu_up_write(&cgroup_threadgroup_rwsem);
++	cpus_read_unlock();
+ 	mutex_unlock(&cgroup_mutex);
+ 
+ 	return retval;
+diff --git a/kernel/trace/trace_preemptirq.c b/kernel/trace/trace_preemptirq.c
+index f4938040c2286..3aa55b8075608 100644
+--- a/kernel/trace/trace_preemptirq.c
++++ b/kernel/trace/trace_preemptirq.c
+@@ -94,15 +94,15 @@ __visible void trace_hardirqs_on_caller(unsigned long caller_addr)
+ 		this_cpu_write(tracing_irq_cpu, 0);
+ 	}
+ 
+-	lockdep_hardirqs_on_prepare(CALLER_ADDR0);
+-	lockdep_hardirqs_on(CALLER_ADDR0);
++	lockdep_hardirqs_on_prepare(caller_addr);
++	lockdep_hardirqs_on(caller_addr);
+ }
+ EXPORT_SYMBOL(trace_hardirqs_on_caller);
+ NOKPROBE_SYMBOL(trace_hardirqs_on_caller);
+ 
+ __visible void trace_hardirqs_off_caller(unsigned long caller_addr)
+ {
+-	lockdep_hardirqs_off(CALLER_ADDR0);
++	lockdep_hardirqs_off(caller_addr);
+ 
+ 	if (!this_cpu_read(tracing_irq_cpu)) {
+ 		this_cpu_write(tracing_irq_cpu, 1);
+diff --git a/net/rxrpc/call_event.c b/net/rxrpc/call_event.c
+index f8ecad2b730e8..2a93e7b5fbd05 100644
+--- a/net/rxrpc/call_event.c
++++ b/net/rxrpc/call_event.c
+@@ -166,7 +166,7 @@ static void rxrpc_resend(struct rxrpc_call *call, unsigned long now_j)
+ 	_enter("{%d,%d}", call->tx_hard_ack, call->tx_top);
+ 
+ 	now = ktime_get_real();
+-	max_age = ktime_sub(now, jiffies_to_usecs(call->peer->rto_j));
++	max_age = ktime_sub_us(now, jiffies_to_usecs(call->peer->rto_j));
+ 
+ 	spin_lock_bh(&call->lock);
+ 
+diff --git a/net/rxrpc/local_object.c b/net/rxrpc/local_object.c
+index 8c2881054266d..ebbf1b03b62cf 100644
+--- a/net/rxrpc/local_object.c
++++ b/net/rxrpc/local_object.c
+@@ -424,6 +424,9 @@ static void rxrpc_local_processor(struct work_struct *work)
+ 		container_of(work, struct rxrpc_local, processor);
+ 	bool again;
+ 
++	if (local->dead)
++		return;
++
+ 	trace_rxrpc_local(local->debug_id, rxrpc_local_processing,
+ 			  atomic_read(&local->usage), NULL);
+ 
+diff --git a/scripts/mksysmap b/scripts/mksysmap
+index 9aa23d15862a0..ad8bbc52267d0 100755
+--- a/scripts/mksysmap
++++ b/scripts/mksysmap
+@@ -41,4 +41,4 @@
+ # so we just ignore them to let readprofile continue to work.
+ # (At least sparc64 has __crc_ in the middle).
+ 
+-$NM -n $1 | grep -v '\( [aNUw] \)\|\(__crc_\)\|\( \$[adt]\)\|\( \.L\)' > $2
++$NM -n $1 | grep -v '\( [aNUw] \)\|\(__crc_\)\|\( \$[adt]\)\|\( \.L\)\|\( L0\)' > $2
+diff --git a/sound/pci/hda/hda_tegra.c b/sound/pci/hda/hda_tegra.c
+index 07787698b9738..1e44e337986e8 100644
+--- a/sound/pci/hda/hda_tegra.c
++++ b/sound/pci/hda/hda_tegra.c
+@@ -479,7 +479,8 @@ MODULE_DEVICE_TABLE(of, hda_tegra_match);
+ static int hda_tegra_probe(struct platform_device *pdev)
+ {
+ 	const unsigned int driver_flags = AZX_DCAPS_CORBRP_SELF_CLEAR |
+-					  AZX_DCAPS_PM_RUNTIME;
++					  AZX_DCAPS_PM_RUNTIME |
++					  AZX_DCAPS_4K_BDLE_BOUNDARY;
+ 	struct snd_card *card;
+ 	struct azx *chip;
+ 	struct hda_tegra *hda;
+diff --git a/sound/pci/hda/patch_sigmatel.c b/sound/pci/hda/patch_sigmatel.c
+index c662431bf13a5..b848e435b93fd 100644
+--- a/sound/pci/hda/patch_sigmatel.c
++++ b/sound/pci/hda/patch_sigmatel.c
+@@ -209,6 +209,7 @@ struct sigmatel_spec {
+ 
+ 	/* beep widgets */
+ 	hda_nid_t anabeep_nid;
++	bool beep_power_on;
+ 
+ 	/* SPDIF-out mux */
+ 	const char * const *spdif_labels;
+@@ -4447,6 +4448,28 @@ static int stac_suspend(struct hda_codec *codec)
+ 	stac_shutup(codec);
+ 	return 0;
+ }
++
++static int stac_check_power_status(struct hda_codec *codec, hda_nid_t nid)
++{
++#ifdef CONFIG_SND_HDA_INPUT_BEEP
++	struct sigmatel_spec *spec = codec->spec;
++#endif
++	int ret = snd_hda_gen_check_power_status(codec, nid);
++
++#ifdef CONFIG_SND_HDA_INPUT_BEEP
++	if (nid == spec->gen.beep_nid && codec->beep) {
++		if (codec->beep->enabled != spec->beep_power_on) {
++			spec->beep_power_on = codec->beep->enabled;
++			if (spec->beep_power_on)
++				snd_hda_power_up_pm(codec);
++			else
++				snd_hda_power_down_pm(codec);
++		}
++		ret |= spec->beep_power_on;
++	}
++#endif
++	return ret;
++}
+ #else
+ #define stac_suspend		NULL
+ #endif /* CONFIG_PM */
+@@ -4459,6 +4482,7 @@ static const struct hda_codec_ops stac_patch_ops = {
+ 	.unsol_event = snd_hda_jack_unsol_event,
+ #ifdef CONFIG_PM
+ 	.suspend = stac_suspend,
++	.check_power_status = stac_check_power_status,
+ #endif
+ 	.reboot_notify = stac_shutup,
+ };
+diff --git a/sound/soc/codecs/nau8824.c b/sound/soc/codecs/nau8824.c
+index c8ccfa2fff848..a95fe3fff1db8 100644
+--- a/sound/soc/codecs/nau8824.c
++++ b/sound/soc/codecs/nau8824.c
+@@ -1072,6 +1072,7 @@ static int nau8824_hw_params(struct snd_pcm_substream *substream,
+ 	struct snd_soc_component *component = dai->component;
+ 	struct nau8824 *nau8824 = snd_soc_component_get_drvdata(component);
+ 	unsigned int val_len = 0, osr, ctrl_val, bclk_fs, bclk_div;
++	int err = -EINVAL;
+ 
+ 	nau8824_sema_acquire(nau8824, HZ);
+ 
+@@ -1088,7 +1089,7 @@ static int nau8824_hw_params(struct snd_pcm_substream *substream,
+ 		osr &= NAU8824_DAC_OVERSAMPLE_MASK;
+ 		if (nau8824_clock_check(nau8824, substream->stream,
+ 			nau8824->fs, osr))
+-			return -EINVAL;
++			goto error;
+ 		regmap_update_bits(nau8824->regmap, NAU8824_REG_CLK_DIVIDER,
+ 			NAU8824_CLK_DAC_SRC_MASK,
+ 			osr_dac_sel[osr].clk_src << NAU8824_CLK_DAC_SRC_SFT);
+@@ -1098,7 +1099,7 @@ static int nau8824_hw_params(struct snd_pcm_substream *substream,
+ 		osr &= NAU8824_ADC_SYNC_DOWN_MASK;
+ 		if (nau8824_clock_check(nau8824, substream->stream,
+ 			nau8824->fs, osr))
+-			return -EINVAL;
++			goto error;
+ 		regmap_update_bits(nau8824->regmap, NAU8824_REG_CLK_DIVIDER,
+ 			NAU8824_CLK_ADC_SRC_MASK,
+ 			osr_adc_sel[osr].clk_src << NAU8824_CLK_ADC_SRC_SFT);
+@@ -1119,7 +1120,7 @@ static int nau8824_hw_params(struct snd_pcm_substream *substream,
+ 		else if (bclk_fs <= 256)
+ 			bclk_div = 0;
+ 		else
+-			return -EINVAL;
++			goto error;
+ 		regmap_update_bits(nau8824->regmap,
+ 			NAU8824_REG_PORT0_I2S_PCM_CTRL_2,
+ 			NAU8824_I2S_LRC_DIV_MASK | NAU8824_I2S_BLK_DIV_MASK,
+@@ -1140,15 +1141,17 @@ static int nau8824_hw_params(struct snd_pcm_substream *substream,
+ 		val_len |= NAU8824_I2S_DL_32;
+ 		break;
+ 	default:
+-		return -EINVAL;
++		goto error;
+ 	}
+ 
+ 	regmap_update_bits(nau8824->regmap, NAU8824_REG_PORT0_I2S_PCM_CTRL_1,
+ 		NAU8824_I2S_DL_MASK, val_len);
++	err = 0;
+ 
++ error:
+ 	nau8824_sema_release(nau8824);
+ 
+-	return 0;
++	return err;
+ }
+ 
+ static int nau8824_set_fmt(struct snd_soc_dai *dai, unsigned int fmt)
+@@ -1157,8 +1160,6 @@ static int nau8824_set_fmt(struct snd_soc_dai *dai, unsigned int fmt)
+ 	struct nau8824 *nau8824 = snd_soc_component_get_drvdata(component);
+ 	unsigned int ctrl1_val = 0, ctrl2_val = 0;
+ 
+-	nau8824_sema_acquire(nau8824, HZ);
+-
+ 	switch (fmt & SND_SOC_DAIFMT_MASTER_MASK) {
+ 	case SND_SOC_DAIFMT_CBM_CFM:
+ 		ctrl2_val |= NAU8824_I2S_MS_MASTER;
+@@ -1200,6 +1201,8 @@ static int nau8824_set_fmt(struct snd_soc_dai *dai, unsigned int fmt)
+ 		return -EINVAL;
+ 	}
+ 
++	nau8824_sema_acquire(nau8824, HZ);
++
+ 	regmap_update_bits(nau8824->regmap, NAU8824_REG_PORT0_I2S_PCM_CTRL_1,
+ 		NAU8824_I2S_DF_MASK | NAU8824_I2S_BP_MASK |
+ 		NAU8824_I2S_PCMB_EN, ctrl1_val);
+diff --git a/tools/include/uapi/asm/errno.h b/tools/include/uapi/asm/errno.h
+index d30439b4b8ab4..869379f91fe48 100644
+--- a/tools/include/uapi/asm/errno.h
++++ b/tools/include/uapi/asm/errno.h
+@@ -9,8 +9,8 @@
+ #include "../../../arch/alpha/include/uapi/asm/errno.h"
+ #elif defined(__mips__)
+ #include "../../../arch/mips/include/uapi/asm/errno.h"
+-#elif defined(__xtensa__)
+-#include "../../../arch/xtensa/include/uapi/asm/errno.h"
++#elif defined(__hppa__)
++#include "../../../arch/parisc/include/uapi/asm/errno.h"
+ #else
+ #include <asm-generic/errno.h>
+ #endif