[gentoo-commits] proj/linux-patches:4.15 commit in: /

[Mike Pagano]

commit:     14243423be4baa539a5f9b13c2ddbeed904b7cad
Author:     Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Sun Apr  8 14:30:59 2018 +0000
Commit:     Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Sun Apr  8 14:30:59 2018 +0000
URL:        https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=14243423

Linux patch 4.15.16

 0000_README              |    4 +
 1015_linux-4.15.16.patch | 2899 ++++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 2903 insertions(+)

diff --git a/0000_README b/0000_README
index f1a4ce6..ba8435c 100644
--- a/0000_README
+++ b/0000_README
@@ -103,6 +103,10 @@ Patch:  1014_linux-4.15.15.patch
 From:   http://www.kernel.org
 Desc:   Linux 4.15.15
 
+Patch:  1015_linux-4.15.16.patch
+From:   http://www.kernel.org
+Desc:   Linux 4.15.16
+
 Patch:  1500_XATTR_USER_PREFIX.patch
 From:   https://bugs.gentoo.org/show_bug.cgi?id=470644
 Desc:   Support for namespace user.pax.* on tmpfs.

diff --git a/1015_linux-4.15.16.patch b/1015_linux-4.15.16.patch
new file mode 100644
index 0000000..bec9a07
--- /dev/null
+++ b/1015_linux-4.15.16.patch
@@ -0,0 +1,2899 @@
+diff --git a/Documentation/devicetree/bindings/serial/8250.txt b/Documentation/devicetree/bindings/serial/8250.txt
+index dad3b2ec66d4..aeb6db4e35c3 100644
+--- a/Documentation/devicetree/bindings/serial/8250.txt
++++ b/Documentation/devicetree/bindings/serial/8250.txt
+@@ -24,6 +24,7 @@ Required properties:
+ 	- "ti,da830-uart"
+ 	- "aspeed,ast2400-vuart"
+ 	- "aspeed,ast2500-vuart"
++	- "nuvoton,npcm750-uart"
+ 	- "serial" if the port type is unknown.
+ - reg : offset and length of the register set for the device.
+ - interrupts : should contain uart interrupt.
+diff --git a/Makefile b/Makefile
+index 20c9b7bfeed4..b28f0f721ec7 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 15
+-SUBLEVEL = 15
++SUBLEVEL = 16
+ EXTRAVERSION =
+ NAME = Fearless Coyote
+ 
+diff --git a/arch/arm/boot/dts/am335x-pepper.dts b/arch/arm/boot/dts/am335x-pepper.dts
+index 9fb7426070ce..03c7d77023c6 100644
+--- a/arch/arm/boot/dts/am335x-pepper.dts
++++ b/arch/arm/boot/dts/am335x-pepper.dts
+@@ -139,7 +139,7 @@
+ &audio_codec {
+ 	status = "okay";
+ 
+-	reset-gpios = <&gpio1 16 GPIO_ACTIVE_LOW>;
++	gpio-reset = <&gpio1 16 GPIO_ACTIVE_LOW>;
+ 	AVDD-supply = <&ldo3_reg>;
+ 	IOVDD-supply = <&ldo3_reg>;
+ 	DRVDD-supply = <&ldo3_reg>;
+diff --git a/arch/arm/boot/dts/dra76-evm.dts b/arch/arm/boot/dts/dra76-evm.dts
+index b024a65c6e27..f64aab450315 100644
+--- a/arch/arm/boot/dts/dra76-evm.dts
++++ b/arch/arm/boot/dts/dra76-evm.dts
+@@ -148,6 +148,7 @@
+ 		compatible = "ti,tps65917";
+ 		reg = <0x58>;
+ 		ti,system-power-controller;
++		ti,palmas-override-powerhold;
+ 		interrupt-controller;
+ 		#interrupt-cells = <2>;
+ 
+diff --git a/arch/arm/boot/dts/omap3-n900.dts b/arch/arm/boot/dts/omap3-n900.dts
+index 5362139d5312..669c51c00c00 100644
+--- a/arch/arm/boot/dts/omap3-n900.dts
++++ b/arch/arm/boot/dts/omap3-n900.dts
+@@ -558,7 +558,7 @@
+ 	tlv320aic3x: tlv320aic3x@18 {
+ 		compatible = "ti,tlv320aic3x";
+ 		reg = <0x18>;
+-		reset-gpios = <&gpio2 28 GPIO_ACTIVE_LOW>; /* 60 */
++		gpio-reset = <&gpio2 28 GPIO_ACTIVE_HIGH>; /* 60 */
+ 		ai3x-gpio-func = <
+ 			0 /* AIC3X_GPIO1_FUNC_DISABLED */
+ 			5 /* AIC3X_GPIO2_FUNC_DIGITAL_MIC_INPUT */
+@@ -575,7 +575,7 @@
+ 	tlv320aic3x_aux: tlv320aic3x@19 {
+ 		compatible = "ti,tlv320aic3x";
+ 		reg = <0x19>;
+-		reset-gpios = <&gpio2 28 GPIO_ACTIVE_LOW>; /* 60 */
++		gpio-reset = <&gpio2 28 GPIO_ACTIVE_HIGH>; /* 60 */
+ 
+ 		AVDD-supply = <&vmmc2>;
+ 		DRVDD-supply = <&vmmc2>;
+diff --git a/arch/arm/boot/dts/sun6i-a31s-sinovoip-bpi-m2.dts b/arch/arm/boot/dts/sun6i-a31s-sinovoip-bpi-m2.dts
+index 51e6f1d21c32..b2758dd8ce43 100644
+--- a/arch/arm/boot/dts/sun6i-a31s-sinovoip-bpi-m2.dts
++++ b/arch/arm/boot/dts/sun6i-a31s-sinovoip-bpi-m2.dts
+@@ -42,7 +42,6 @@
+ 
+ /dts-v1/;
+ #include "sun6i-a31s.dtsi"
+-#include "sunxi-common-regulators.dtsi"
+ #include <dt-bindings/gpio/gpio.h>
+ 
+ / {
+@@ -99,6 +98,7 @@
+ 	pinctrl-0 = <&gmac_pins_rgmii_a>, <&gmac_phy_reset_pin_bpi_m2>;
+ 	phy = <&phy1>;
+ 	phy-mode = "rgmii";
++	phy-supply = <&reg_dldo1>;
+ 	snps,reset-gpio = <&pio 0 21 GPIO_ACTIVE_HIGH>; /* PA21 */
+ 	snps,reset-active-low;
+ 	snps,reset-delays-us = <0 10000 30000>;
+@@ -118,7 +118,7 @@
+ &mmc0 {
+ 	pinctrl-names = "default";
+ 	pinctrl-0 = <&mmc0_pins_a>, <&mmc0_cd_pin_bpi_m2>;
+-	vmmc-supply = <&reg_vcc3v0>;
++	vmmc-supply = <&reg_dcdc1>;
+ 	bus-width = <4>;
+ 	cd-gpios = <&pio 0 4 GPIO_ACTIVE_HIGH>; /* PA4 */
+ 	cd-inverted;
+@@ -132,7 +132,7 @@
+ &mmc2 {
+ 	pinctrl-names = "default";
+ 	pinctrl-0 = <&mmc2_pins_a>;
+-	vmmc-supply = <&reg_vcc3v0>;
++	vmmc-supply = <&reg_aldo1>;
+ 	mmc-pwrseq = <&mmc2_pwrseq>;
+ 	bus-width = <4>;
+ 	non-removable;
+@@ -163,6 +163,8 @@
+ 		reg = <0x68>;
+ 		interrupt-parent = <&nmi_intc>;
+ 		interrupts = <0 IRQ_TYPE_LEVEL_LOW>;
++		eldoin-supply = <&reg_dcdc1>;
++		x-powers,drive-vbus-en;
+ 	};
+ };
+ 
+@@ -193,7 +195,28 @@
+ 
+ #include "axp22x.dtsi"
+ 
++&reg_aldo1 {
++	regulator-min-microvolt = <3300000>;
++	regulator-max-microvolt = <3300000>;
++	regulator-name = "vcc-wifi";
++};
++
++&reg_aldo2 {
++	regulator-always-on;
++	regulator-min-microvolt = <2500000>;
++	regulator-max-microvolt = <2500000>;
++	regulator-name = "vcc-gmac";
++};
++
++&reg_aldo3 {
++	regulator-always-on;
++	regulator-min-microvolt = <3000000>;
++	regulator-max-microvolt = <3000000>;
++	regulator-name = "avcc";
++};
++
+ &reg_dc5ldo {
++	regulator-always-on;
+ 	regulator-min-microvolt = <700000>;
+ 	regulator-max-microvolt = <1320000>;
+ 	regulator-name = "vdd-cpus";
+@@ -233,6 +256,40 @@
+ 	regulator-name = "vcc-dram";
+ };
+ 
++&reg_dldo1 {
++	regulator-min-microvolt = <3000000>;
++	regulator-max-microvolt = <3000000>;
++	regulator-name = "vcc-mac";
++};
++
++&reg_dldo2 {
++	regulator-min-microvolt = <2800000>;
++	regulator-max-microvolt = <2800000>;
++	regulator-name = "avdd-csi";
++};
++
++&reg_dldo3 {
++	regulator-always-on;
++	regulator-min-microvolt = <3300000>;
++	regulator-max-microvolt = <3300000>;
++	regulator-name = "vcc-pb";
++};
++
++&reg_eldo1 {
++	regulator-min-microvolt = <1800000>;
++	regulator-max-microvolt = <1800000>;
++	regulator-name = "vdd-csi";
++	status = "okay";
++};
++
++&reg_ldo_io1 {
++	regulator-always-on;
++	regulator-min-microvolt = <1800000>;
++	regulator-max-microvolt = <1800000>;
++	regulator-name = "vcc-pm-cpus";
++	status = "okay";
++};
++
+ &uart0 {
+ 	pinctrl-names = "default";
+ 	pinctrl-0 = <&uart0_pins_a>;
+diff --git a/arch/arm/crypto/Makefile b/arch/arm/crypto/Makefile
+index 30ef8e291271..c9919c2b7ad1 100644
+--- a/arch/arm/crypto/Makefile
++++ b/arch/arm/crypto/Makefile
+@@ -54,6 +54,7 @@ crct10dif-arm-ce-y	:= crct10dif-ce-core.o crct10dif-ce-glue.o
+ crc32-arm-ce-y:= crc32-ce-core.o crc32-ce-glue.o
+ chacha20-neon-y := chacha20-neon-core.o chacha20-neon-glue.o
+ 
++ifdef REGENERATE_ARM_CRYPTO
+ quiet_cmd_perl = PERL    $@
+       cmd_perl = $(PERL) $(<) > $(@)
+ 
+@@ -62,5 +63,6 @@ $(src)/sha256-core.S_shipped: $(src)/sha256-armv4.pl
+ 
+ $(src)/sha512-core.S_shipped: $(src)/sha512-armv4.pl
+ 	$(call cmd,perl)
++endif
+ 
+ .PRECIOUS: $(obj)/sha256-core.S $(obj)/sha512-core.S
+diff --git a/arch/arm/plat-omap/include/plat/sram.h b/arch/arm/plat-omap/include/plat/sram.h
+index fb061cf0d736..30a07730807a 100644
+--- a/arch/arm/plat-omap/include/plat/sram.h
++++ b/arch/arm/plat-omap/include/plat/sram.h
+@@ -5,13 +5,4 @@ void omap_map_sram(unsigned long start, unsigned long size,
+ 			unsigned long skip, int cached);
+ void omap_sram_reset(void);
+ 
+-extern void *omap_sram_push_address(unsigned long size);
+-
+-/* Macro to push a function to the internal SRAM, using the fncpy API */
+-#define omap_sram_push(funcp, size) ({				\
+-	typeof(&(funcp)) _res = NULL;				\
+-	void *_sram_address = omap_sram_push_address(size);	\
+-	if (_sram_address)					\
+-		_res = fncpy(_sram_address, &(funcp), size);	\
+-	_res;							\
+-})
++extern void *omap_sram_push(void *funcp, unsigned long size);
+diff --git a/arch/arm/plat-omap/sram.c b/arch/arm/plat-omap/sram.c
+index a5bc92d7e476..921840acf65c 100644
+--- a/arch/arm/plat-omap/sram.c
++++ b/arch/arm/plat-omap/sram.c
+@@ -23,6 +23,7 @@
+ #include <asm/fncpy.h>
+ #include <asm/tlb.h>
+ #include <asm/cacheflush.h>
++#include <asm/set_memory.h>
+ 
+ #include <asm/mach/map.h>
+ 
+@@ -42,7 +43,7 @@ static void __iomem *omap_sram_ceil;
+  * Note that fncpy requires the returned address to be aligned
+  * to an 8-byte boundary.
+  */
+-void *omap_sram_push_address(unsigned long size)
++static void *omap_sram_push_address(unsigned long size)
+ {
+ 	unsigned long available, new_ceil = (unsigned long)omap_sram_ceil;
+ 
+@@ -60,6 +61,30 @@ void *omap_sram_push_address(unsigned long size)
+ 	return (void *)omap_sram_ceil;
+ }
+ 
++void *omap_sram_push(void *funcp, unsigned long size)
++{
++	void *sram;
++	unsigned long base;
++	int pages;
++	void *dst = NULL;
++
++	sram = omap_sram_push_address(size);
++	if (!sram)
++		return NULL;
++
++	base = (unsigned long)sram & PAGE_MASK;
++	pages = PAGE_ALIGN(size) / PAGE_SIZE;
++
++	set_memory_rw(base, pages);
++
++	dst = fncpy(sram, funcp, size);
++
++	set_memory_ro(base, pages);
++	set_memory_x(base, pages);
++
++	return dst;
++}
++
+ /*
+  * The SRAM context is lost during off-idle and stack
+  * needs to be reset.
+@@ -75,6 +100,9 @@ void omap_sram_reset(void)
+ void __init omap_map_sram(unsigned long start, unsigned long size,
+ 				 unsigned long skip, int cached)
+ {
++	unsigned long base;
++	int pages;
++
+ 	if (size == 0)
+ 		return;
+ 
+@@ -95,4 +123,10 @@ void __init omap_map_sram(unsigned long start, unsigned long size,
+ 	 */
+ 	memset_io(omap_sram_base + omap_sram_skip, 0,
+ 		  omap_sram_size - omap_sram_skip);
++
++	base = (unsigned long)omap_sram_base;
++	pages = PAGE_ALIGN(omap_sram_size) / PAGE_SIZE;
++
++	set_memory_ro(base, pages);
++	set_memory_x(base, pages);
+ }
+diff --git a/arch/arm/vfp/vfpmodule.c b/arch/arm/vfp/vfpmodule.c
+index a71a48e71fff..aa7496be311d 100644
+--- a/arch/arm/vfp/vfpmodule.c
++++ b/arch/arm/vfp/vfpmodule.c
+@@ -648,7 +648,7 @@ int vfp_restore_user_hwstate(struct user_vfp __user *ufp,
+  */
+ static int vfp_dying_cpu(unsigned int cpu)
+ {
+-	vfp_force_reload(cpu, current_thread_info());
++	vfp_current_hw_state[cpu] = NULL;
+ 	return 0;
+ }
+ 
+diff --git a/arch/arm64/crypto/Makefile b/arch/arm64/crypto/Makefile
+index b5edc5918c28..12fd81af1d1c 100644
+--- a/arch/arm64/crypto/Makefile
++++ b/arch/arm64/crypto/Makefile
+@@ -58,6 +58,7 @@ CFLAGS_aes-glue-ce.o	:= -DUSE_V8_CRYPTO_EXTENSIONS
+ $(obj)/aes-glue-%.o: $(src)/aes-glue.c FORCE
+ 	$(call if_changed_rule,cc_o_c)
+ 
++ifdef REGENERATE_ARM64_CRYPTO
+ quiet_cmd_perlasm = PERLASM $@
+       cmd_perlasm = $(PERL) $(<) void $(@)
+ 
+@@ -66,5 +67,6 @@ $(src)/sha256-core.S_shipped: $(src)/sha512-armv8.pl
+ 
+ $(src)/sha512-core.S_shipped: $(src)/sha512-armv8.pl
+ 	$(call cmd,perlasm)
++endif
+ 
+ .PRECIOUS: $(obj)/sha256-core.S $(obj)/sha512-core.S
+diff --git a/arch/powerpc/include/asm/book3s/64/mmu.h b/arch/powerpc/include/asm/book3s/64/mmu.h
+index c9448e19847a..62290feddd56 100644
+--- a/arch/powerpc/include/asm/book3s/64/mmu.h
++++ b/arch/powerpc/include/asm/book3s/64/mmu.h
+@@ -87,6 +87,9 @@ typedef struct {
+ 	/* Number of bits in the mm_cpumask */
+ 	atomic_t active_cpus;
+ 
++	/* Number of users of the external (Nest) MMU */
++	atomic_t copros;
++
+ 	/* NPU NMMU context */
+ 	struct npu_context *npu_context;
+ 
+diff --git a/arch/powerpc/include/asm/mmu_context.h b/arch/powerpc/include/asm/mmu_context.h
+index e2a2b8400490..4f8a03c74e3f 100644
+--- a/arch/powerpc/include/asm/mmu_context.h
++++ b/arch/powerpc/include/asm/mmu_context.h
+@@ -92,15 +92,23 @@ static inline void dec_mm_active_cpus(struct mm_struct *mm)
+ static inline void mm_context_add_copro(struct mm_struct *mm)
+ {
+ 	/*
+-	 * On hash, should only be called once over the lifetime of
+-	 * the context, as we can't decrement the active cpus count
+-	 * and flush properly for the time being.
++	 * If any copro is in use, increment the active CPU count
++	 * in order to force TLB invalidations to be global as to
++	 * propagate to the Nest MMU.
+ 	 */
+-	inc_mm_active_cpus(mm);
++	if (atomic_inc_return(&mm->context.copros) == 1)
++		inc_mm_active_cpus(mm);
+ }
+ 
+ static inline void mm_context_remove_copro(struct mm_struct *mm)
+ {
++	int c;
++
++	c = atomic_dec_if_positive(&mm->context.copros);
++
++	/* Detect imbalance between add and remove */
++	WARN_ON(c < 0);
++
+ 	/*
+ 	 * Need to broadcast a global flush of the full mm before
+ 	 * decrementing active_cpus count, as the next TLBI may be
+@@ -111,7 +119,7 @@ static inline void mm_context_remove_copro(struct mm_struct *mm)
+ 	 * for the time being. Invalidations will remain global if
+ 	 * used on hash.
+ 	 */
+-	if (radix_enabled()) {
++	if (c == 0 && radix_enabled()) {
+ 		flush_all_mm(mm);
+ 		dec_mm_active_cpus(mm);
+ 	}
+diff --git a/arch/powerpc/kernel/exceptions-64s.S b/arch/powerpc/kernel/exceptions-64s.S
+index 2dc10bf646b8..9b060a41185e 100644
+--- a/arch/powerpc/kernel/exceptions-64s.S
++++ b/arch/powerpc/kernel/exceptions-64s.S
+@@ -706,7 +706,7 @@ EXC_COMMON_BEGIN(bad_addr_slb)
+ 	ld	r3, PACA_EXSLB+EX_DAR(r13)
+ 	std	r3, _DAR(r1)
+ 	beq	cr6, 2f
+-	li	r10, 0x480		/* fix trap number for I-SLB miss */
++	li	r10, 0x481		/* fix trap number for I-SLB miss */
+ 	std	r10, _TRAP(r1)
+ 2:	bl	save_nvgprs
+ 	addi	r3, r1, STACK_FRAME_OVERHEAD
+diff --git a/arch/powerpc/kernel/irq.c b/arch/powerpc/kernel/irq.c
+index b7a84522e652..c933632aa08d 100644
+--- a/arch/powerpc/kernel/irq.c
++++ b/arch/powerpc/kernel/irq.c
+@@ -475,6 +475,14 @@ void force_external_irq_replay(void)
+ 	 */
+ 	WARN_ON(!arch_irqs_disabled());
+ 
++	/*
++	 * Interrupts must always be hard disabled before irq_happened is
++	 * modified (to prevent lost update in case of interrupt between
++	 * load and store).
++	 */
++	__hard_irq_disable();
++	local_paca->irq_happened |= PACA_IRQ_HARD_DIS;
++
+ 	/* Indicate in the PACA that we have an interrupt to replay */
+ 	local_paca->irq_happened |= PACA_IRQ_EE;
+ }
+diff --git a/arch/powerpc/mm/mmu_context_book3s64.c b/arch/powerpc/mm/mmu_context_book3s64.c
+index 59c0766ae4e0..5066276229f8 100644
+--- a/arch/powerpc/mm/mmu_context_book3s64.c
++++ b/arch/powerpc/mm/mmu_context_book3s64.c
+@@ -171,6 +171,7 @@ int init_new_context(struct task_struct *tsk, struct mm_struct *mm)
+ 	mm_iommu_init(mm);
+ #endif
+ 	atomic_set(&mm->context.active_cpus, 0);
++	atomic_set(&mm->context.copros, 0);
+ 
+ 	return 0;
+ }
+diff --git a/arch/powerpc/mm/tlb-radix.c b/arch/powerpc/mm/tlb-radix.c
+index 913a2b81b177..91afe00abbb0 100644
+--- a/arch/powerpc/mm/tlb-radix.c
++++ b/arch/powerpc/mm/tlb-radix.c
+@@ -85,7 +85,23 @@ static inline void _tlbiel_pid(unsigned long pid, unsigned long ric)
+ static inline void _tlbie_pid(unsigned long pid, unsigned long ric)
+ {
+ 	asm volatile("ptesync": : :"memory");
+-	__tlbie_pid(pid, ric);
++
++	/*
++	 * Workaround the fact that the "ric" argument to __tlbie_pid
++	 * must be a compile-time contraint to match the "i" constraint
++	 * in the asm statement.
++	 */
++	switch (ric) {
++	case RIC_FLUSH_TLB:
++		__tlbie_pid(pid, RIC_FLUSH_TLB);
++		break;
++	case RIC_FLUSH_PWC:
++		__tlbie_pid(pid, RIC_FLUSH_PWC);
++		break;
++	case RIC_FLUSH_ALL:
++	default:
++		__tlbie_pid(pid, RIC_FLUSH_ALL);
++	}
+ 	asm volatile("eieio; tlbsync; ptesync": : :"memory");
+ }
+ 
+@@ -245,6 +261,16 @@ void radix__local_flush_tlb_page(struct vm_area_struct *vma, unsigned long vmadd
+ }
+ EXPORT_SYMBOL(radix__local_flush_tlb_page);
+ 
++static bool mm_needs_flush_escalation(struct mm_struct *mm)
++{
++	/*
++	 * P9 nest MMU has issues with the page walk cache
++	 * caching PTEs and not flushing them properly when
++	 * RIC = 0 for a PID/LPID invalidate
++	 */
++	return atomic_read(&mm->context.copros) != 0;
++}
++
+ #ifdef CONFIG_SMP
+ void radix__flush_tlb_mm(struct mm_struct *mm)
+ {
+@@ -255,9 +281,12 @@ void radix__flush_tlb_mm(struct mm_struct *mm)
+ 		return;
+ 
+ 	preempt_disable();
+-	if (!mm_is_thread_local(mm))
+-		_tlbie_pid(pid, RIC_FLUSH_TLB);
+-	else
++	if (!mm_is_thread_local(mm)) {
++		if (mm_needs_flush_escalation(mm))
++			_tlbie_pid(pid, RIC_FLUSH_ALL);
++		else
++			_tlbie_pid(pid, RIC_FLUSH_TLB);
++	} else
+ 		_tlbiel_pid(pid, RIC_FLUSH_TLB);
+ 	preempt_enable();
+ }
+@@ -369,10 +398,14 @@ void radix__flush_tlb_range(struct vm_area_struct *vma, unsigned long start,
+ 	}
+ 
+ 	if (full) {
+-		if (local)
++		if (local) {
+ 			_tlbiel_pid(pid, RIC_FLUSH_TLB);
+-		else
+-			_tlbie_pid(pid, RIC_FLUSH_TLB);
++		} else {
++			if (mm_needs_flush_escalation(mm))
++				_tlbie_pid(pid, RIC_FLUSH_ALL);
++			else
++				_tlbie_pid(pid, RIC_FLUSH_TLB);
++		}
+ 	} else {
+ 		bool hflush = false;
+ 		unsigned long hstart, hend;
+@@ -482,6 +515,9 @@ static inline void __radix__flush_tlb_range_psize(struct mm_struct *mm,
+ 	}
+ 
+ 	if (full) {
++		if (!local && mm_needs_flush_escalation(mm))
++			also_pwc = true;
++
+ 		if (local)
+ 			_tlbiel_pid(pid, also_pwc ? RIC_FLUSH_ALL : RIC_FLUSH_TLB);
+ 		else
+diff --git a/arch/x86/crypto/cast5_avx_glue.c b/arch/x86/crypto/cast5_avx_glue.c
+index dbea6020ffe7..575292a33bdf 100644
+--- a/arch/x86/crypto/cast5_avx_glue.c
++++ b/arch/x86/crypto/cast5_avx_glue.c
+@@ -66,8 +66,6 @@ static int ecb_crypt(struct blkcipher_desc *desc, struct blkcipher_walk *walk,
+ 	void (*fn)(struct cast5_ctx *ctx, u8 *dst, const u8 *src);
+ 	int err;
+ 
+-	fn = (enc) ? cast5_ecb_enc_16way : cast5_ecb_dec_16way;
+-
+ 	err = blkcipher_walk_virt(desc, walk);
+ 	desc->flags &= ~CRYPTO_TFM_REQ_MAY_SLEEP;
+ 
+@@ -79,6 +77,7 @@ static int ecb_crypt(struct blkcipher_desc *desc, struct blkcipher_walk *walk,
+ 
+ 		/* Process multi-block batch */
+ 		if (nbytes >= bsize * CAST5_PARALLEL_BLOCKS) {
++			fn = (enc) ? cast5_ecb_enc_16way : cast5_ecb_dec_16way;
+ 			do {
+ 				fn(ctx, wdst, wsrc);
+ 
+diff --git a/arch/x86/include/asm/hw_irq.h b/arch/x86/include/asm/hw_irq.h
+index 2851077b6051..32e666e1231e 100644
+--- a/arch/x86/include/asm/hw_irq.h
++++ b/arch/x86/include/asm/hw_irq.h
+@@ -36,6 +36,7 @@ extern asmlinkage void kvm_posted_intr_wakeup_ipi(void);
+ extern asmlinkage void kvm_posted_intr_nested_ipi(void);
+ extern asmlinkage void error_interrupt(void);
+ extern asmlinkage void irq_work_interrupt(void);
++extern asmlinkage void uv_bau_message_intr1(void);
+ 
+ extern asmlinkage void spurious_interrupt(void);
+ extern asmlinkage void thermal_interrupt(void);
+diff --git a/arch/x86/kernel/idt.c b/arch/x86/kernel/idt.c
+index 50bee5fe1140..2c3a1b4294eb 100644
+--- a/arch/x86/kernel/idt.c
++++ b/arch/x86/kernel/idt.c
+@@ -140,6 +140,9 @@ static const __initconst struct idt_data apic_idts[] = {
+ # ifdef CONFIG_IRQ_WORK
+ 	INTG(IRQ_WORK_VECTOR,		irq_work_interrupt),
+ # endif
++#ifdef CONFIG_X86_UV
++	INTG(UV_BAU_MESSAGE,		uv_bau_message_intr1),
++#endif
+ 	INTG(SPURIOUS_APIC_VECTOR,	spurious_interrupt),
+ 	INTG(ERROR_APIC_VECTOR,		error_interrupt),
+ #endif
+diff --git a/arch/x86/platform/uv/tlb_uv.c b/arch/x86/platform/uv/tlb_uv.c
+index 7d5d53f36a7a..0b530c53de1f 100644
+--- a/arch/x86/platform/uv/tlb_uv.c
++++ b/arch/x86/platform/uv/tlb_uv.c
+@@ -2254,8 +2254,6 @@ static int __init uv_bau_init(void)
+ 			init_uvhub(uvhub, vector, uv_base_pnode);
+ 	}
+ 
+-	alloc_intr_gate(vector, uv_bau_message_intr1);
+-
+ 	for_each_possible_blade(uvhub) {
+ 		if (uv_blade_nr_possible_cpus(uvhub)) {
+ 			unsigned long val;
+diff --git a/block/bio.c b/block/bio.c
+index 9ef6cf3addb3..2dd0c1305be5 100644
+--- a/block/bio.c
++++ b/block/bio.c
+@@ -43,9 +43,9 @@
+  * break badly! cannot be bigger than what you can fit into an
+  * unsigned short
+  */
+-#define BV(x) { .nr_vecs = x, .name = "biovec-"__stringify(x) }
++#define BV(x, n) { .nr_vecs = x, .name = "biovec-"#n }
+ static struct biovec_slab bvec_slabs[BVEC_POOL_NR] __read_mostly = {
+-	BV(1), BV(4), BV(16), BV(64), BV(128), BV(BIO_MAX_PAGES),
++	BV(1, 1), BV(4, 4), BV(16, 16), BV(64, 64), BV(128, 128), BV(BIO_MAX_PAGES, max),
+ };
+ #undef BV
+ 
+diff --git a/block/partitions/msdos.c b/block/partitions/msdos.c
+index 0af3a3db6fb0..82c44f7df911 100644
+--- a/block/partitions/msdos.c
++++ b/block/partitions/msdos.c
+@@ -301,7 +301,9 @@ static void parse_bsd(struct parsed_partitions *state,
+ 			continue;
+ 		bsd_start = le32_to_cpu(p->p_offset);
+ 		bsd_size = le32_to_cpu(p->p_size);
+-		if (memcmp(flavour, "bsd\0", 4) == 0)
++		/* FreeBSD has relative offset if C partition offset is zero */
++		if (memcmp(flavour, "bsd\0", 4) == 0 &&
++		    le32_to_cpu(l->d_partitions[2].p_offset) == 0)
+ 			bsd_start += offset;
+ 		if (offset == bsd_start && size == bsd_size)
+ 			/* full parent partition, we have it already */
+diff --git a/crypto/ahash.c b/crypto/ahash.c
+index 266fc1d64f61..c03cc177870b 100644
+--- a/crypto/ahash.c
++++ b/crypto/ahash.c
+@@ -92,13 +92,14 @@ int crypto_hash_walk_done(struct crypto_hash_walk *walk, int err)
+ 
+ 	if (nbytes && walk->offset & alignmask && !err) {
+ 		walk->offset = ALIGN(walk->offset, alignmask + 1);
+-		walk->data += walk->offset;
+-
+ 		nbytes = min(nbytes,
+ 			     ((unsigned int)(PAGE_SIZE)) - walk->offset);
+ 		walk->entrylen -= nbytes;
+ 
+-		return nbytes;
++		if (nbytes) {
++			walk->data += walk->offset;
++			return nbytes;
++		}
+ 	}
+ 
+ 	if (walk->flags & CRYPTO_ALG_ASYNC)
+diff --git a/crypto/lrw.c b/crypto/lrw.c
+index cbbd7c50ad19..1d813a6d3fec 100644
+--- a/crypto/lrw.c
++++ b/crypto/lrw.c
+@@ -313,7 +313,7 @@ static void exit_crypt(struct skcipher_request *req)
+ 	rctx->left = 0;
+ 
+ 	if (rctx->ext)
+-		kfree(rctx->ext);
++		kzfree(rctx->ext);
+ }
+ 
+ static int do_encrypt(struct skcipher_request *req, int err)
+diff --git a/crypto/testmgr.h b/crypto/testmgr.h
+index a714b6293959..a3cd18476e40 100644
+--- a/crypto/testmgr.h
++++ b/crypto/testmgr.h
+@@ -548,7 +548,7 @@ static const struct akcipher_testvec rsa_tv_template[] = {
+ static const struct akcipher_testvec pkcs1pad_rsa_tv_template[] = {
+ 	{
+ 	.key =
+-	"\x30\x82\x03\x1f\x02\x01\x10\x02\x82\x01\x01\x00\xd7\x1e\x77\x82"
++	"\x30\x82\x03\x1f\x02\x01\x00\x02\x82\x01\x01\x00\xd7\x1e\x77\x82"
+ 	"\x8c\x92\x31\xe7\x69\x02\xa2\xd5\x5c\x78\xde\xa2\x0c\x8f\xfe\x28"
+ 	"\x59\x31\xdf\x40\x9c\x60\x61\x06\xb9\x2f\x62\x40\x80\x76\xcb\x67"
+ 	"\x4a\xb5\x59\x56\x69\x17\x07\xfa\xf9\x4c\xbd\x6c\x37\x7a\x46\x7d"
+@@ -597,8 +597,8 @@ static const struct akcipher_testvec pkcs1pad_rsa_tv_template[] = {
+ 	"\xfe\xf8\x27\x1b\xd6\x55\x60\x5e\x48\xb7\x6d\x9a\xa8\x37\xf9\x7a"
+ 	"\xde\x1b\xcd\x5d\x1a\x30\xd4\xe9\x9e\x5b\x3c\x15\xf8\x9c\x1f\xda"
+ 	"\xd1\x86\x48\x55\xce\x83\xee\x8e\x51\xc7\xde\x32\x12\x47\x7d\x46"
+-	"\xb8\x35\xdf\x41\x02\x01\x30\x02\x01\x30\x02\x01\x30\x02\x01\x30"
+-	"\x02\x01\x30",
++	"\xb8\x35\xdf\x41\x02\x01\x00\x02\x01\x00\x02\x01\x00\x02\x01\x00"
++	"\x02\x01\x00",
+ 	.key_len = 804,
+ 	/*
+ 	 * m is SHA256 hash of following message:
+diff --git a/drivers/base/arch_topology.c b/drivers/base/arch_topology.c
+index 4de87b0b53c8..8bfd498d3090 100644
+--- a/drivers/base/arch_topology.c
++++ b/drivers/base/arch_topology.c
+@@ -175,11 +175,11 @@ bool __init topology_parse_cpu_capacity(struct device_node *cpu_node, int cpu)
+ }
+ 
+ #ifdef CONFIG_CPU_FREQ
+-static cpumask_var_t cpus_to_visit __initdata;
+-static void __init parsing_done_workfn(struct work_struct *work);
+-static __initdata DECLARE_WORK(parsing_done_work, parsing_done_workfn);
++static cpumask_var_t cpus_to_visit;
++static void parsing_done_workfn(struct work_struct *work);
++static DECLARE_WORK(parsing_done_work, parsing_done_workfn);
+ 
+-static int __init
++static int
+ init_cpu_capacity_callback(struct notifier_block *nb,
+ 			   unsigned long val,
+ 			   void *data)
+@@ -215,7 +215,7 @@ init_cpu_capacity_callback(struct notifier_block *nb,
+ 	return 0;
+ }
+ 
+-static struct notifier_block init_cpu_capacity_notifier __initdata = {
++static struct notifier_block init_cpu_capacity_notifier = {
+ 	.notifier_call = init_cpu_capacity_callback,
+ };
+ 
+@@ -248,7 +248,7 @@ static int __init register_cpufreq_notifier(void)
+ }
+ core_initcall(register_cpufreq_notifier);
+ 
+-static void __init parsing_done_workfn(struct work_struct *work)
++static void parsing_done_workfn(struct work_struct *work)
+ {
+ 	cpufreq_unregister_notifier(&init_cpu_capacity_notifier,
+ 					 CPUFREQ_POLICY_NOTIFIER);
+diff --git a/drivers/char/mem.c b/drivers/char/mem.c
+index 052011bcf100..ffeb60d3434c 100644
+--- a/drivers/char/mem.c
++++ b/drivers/char/mem.c
+@@ -137,7 +137,7 @@ static ssize_t read_mem(struct file *file, char __user *buf,
+ 
+ 	while (count > 0) {
+ 		unsigned long remaining;
+-		int allowed;
++		int allowed, probe;
+ 
+ 		sz = size_inside_page(p, count);
+ 
+@@ -160,9 +160,9 @@ static ssize_t read_mem(struct file *file, char __user *buf,
+ 			if (!ptr)
+ 				goto failed;
+ 
+-			err = probe_kernel_read(bounce, ptr, sz);
++			probe = probe_kernel_read(bounce, ptr, sz);
+ 			unxlate_dev_mem_ptr(p, ptr);
+-			if (err)
++			if (probe)
+ 				goto failed;
+ 
+ 			remaining = copy_to_user(buf, bounce, sz);
+diff --git a/drivers/cpufreq/cpufreq.c b/drivers/cpufreq/cpufreq.c
+index d6a3038a128d..41d148af7748 100644
+--- a/drivers/cpufreq/cpufreq.c
++++ b/drivers/cpufreq/cpufreq.c
+@@ -637,8 +637,6 @@ static int cpufreq_parse_governor(char *str_governor, unsigned int *policy,
+ 			*governor = t;
+ 			err = 0;
+ 		}
+-		if (t && !try_module_get(t->owner))
+-			t = NULL;
+ 
+ 		mutex_unlock(&cpufreq_governor_mutex);
+ 	}
+@@ -767,10 +765,6 @@ static ssize_t store_scaling_governor(struct cpufreq_policy *policy,
+ 		return -EINVAL;
+ 
+ 	ret = cpufreq_set_policy(policy, &new_policy);
+-
+-	if (new_policy.governor)
+-		module_put(new_policy.governor->owner);
+-
+ 	return ret ? ret : count;
+ }
+ 
+diff --git a/drivers/crypto/caam/ctrl.c b/drivers/crypto/caam/ctrl.c
+index e1d4ae1153c4..39f70411f28f 100644
+--- a/drivers/crypto/caam/ctrl.c
++++ b/drivers/crypto/caam/ctrl.c
+@@ -813,9 +813,6 @@ static int caam_probe(struct platform_device *pdev)
+ 	return 0;
+ 
+ caam_remove:
+-#ifdef CONFIG_DEBUG_FS
+-	debugfs_remove_recursive(ctrlpriv->dfs_root);
+-#endif
+ 	caam_remove(pdev);
+ 	return ret;
+ 
+diff --git a/drivers/crypto/ccp/ccp-crypto-rsa.c b/drivers/crypto/ccp/ccp-crypto-rsa.c
+index e6db8672d89c..05850dfd7940 100644
+--- a/drivers/crypto/ccp/ccp-crypto-rsa.c
++++ b/drivers/crypto/ccp/ccp-crypto-rsa.c
+@@ -60,10 +60,9 @@ static int ccp_rsa_complete(struct crypto_async_request *async_req, int ret)
+ 
+ static unsigned int ccp_rsa_maxsize(struct crypto_akcipher *tfm)
+ {
+-	if (ccp_version() > CCP_VERSION(3, 0))
+-		return CCP5_RSA_MAXMOD;
+-	else
+-		return CCP_RSA_MAXMOD;
++	struct ccp_ctx *ctx = akcipher_tfm_ctx(tfm);
++
++	return ctx->u.rsa.n_len;
+ }
+ 
+ static int ccp_rsa_crypt(struct akcipher_request *req, bool encrypt)
+diff --git a/drivers/crypto/inside-secure/safexcel.c b/drivers/crypto/inside-secure/safexcel.c
+index 4bcef78a08aa..d4c81cb73bee 100644
+--- a/drivers/crypto/inside-secure/safexcel.c
++++ b/drivers/crypto/inside-secure/safexcel.c
+@@ -789,7 +789,7 @@ static int safexcel_probe(struct platform_device *pdev)
+ 		return PTR_ERR(priv->base);
+ 	}
+ 
+-	priv->clk = of_clk_get(dev->of_node, 0);
++	priv->clk = devm_clk_get(&pdev->dev, NULL);
+ 	if (!IS_ERR(priv->clk)) {
+ 		ret = clk_prepare_enable(priv->clk);
+ 		if (ret) {
+diff --git a/drivers/crypto/talitos.c b/drivers/crypto/talitos.c
+index 6882fa2f8bad..c805d0122c0b 100644
+--- a/drivers/crypto/talitos.c
++++ b/drivers/crypto/talitos.c
+@@ -832,8 +832,6 @@ struct talitos_ctx {
+ 	unsigned int keylen;
+ 	unsigned int enckeylen;
+ 	unsigned int authkeylen;
+-	dma_addr_t dma_buf;
+-	dma_addr_t dma_hw_context;
+ };
+ 
+ #define HASH_MAX_BLOCK_SIZE		SHA512_BLOCK_SIZE
+@@ -1130,10 +1128,10 @@ static int sg_to_link_tbl_offset(struct scatterlist *sg, int sg_count,
+ 	return count;
+ }
+ 
+-static int talitos_sg_map(struct device *dev, struct scatterlist *src,
+-		   unsigned int len, struct talitos_edesc *edesc,
+-		   struct talitos_ptr *ptr,
+-		   int sg_count, unsigned int offset, int tbl_off)
++static int talitos_sg_map_ext(struct device *dev, struct scatterlist *src,
++			      unsigned int len, struct talitos_edesc *edesc,
++			      struct talitos_ptr *ptr, int sg_count,
++			      unsigned int offset, int tbl_off, int elen)
+ {
+ 	struct talitos_private *priv = dev_get_drvdata(dev);
+ 	bool is_sec1 = has_ftr_sec1(priv);
+@@ -1142,6 +1140,7 @@ static int talitos_sg_map(struct device *dev, struct scatterlist *src,
+ 		to_talitos_ptr(ptr, 0, 0, is_sec1);
+ 		return 1;
+ 	}
++	to_talitos_ptr_ext_set(ptr, elen, is_sec1);
+ 	if (sg_count == 1) {
+ 		to_talitos_ptr(ptr, sg_dma_address(src) + offset, len, is_sec1);
+ 		return sg_count;
+@@ -1150,7 +1149,7 @@ static int talitos_sg_map(struct device *dev, struct scatterlist *src,
+ 		to_talitos_ptr(ptr, edesc->dma_link_tbl + offset, len, is_sec1);
+ 		return sg_count;
+ 	}
+-	sg_count = sg_to_link_tbl_offset(src, sg_count, offset, len,
++	sg_count = sg_to_link_tbl_offset(src, sg_count, offset, len + elen,
+ 					 &edesc->link_tbl[tbl_off]);
+ 	if (sg_count == 1) {
+ 		/* Only one segment now, so no link tbl needed*/
+@@ -1164,6 +1163,15 @@ static int talitos_sg_map(struct device *dev, struct scatterlist *src,
+ 	return sg_count;
+ }
+ 
++static int talitos_sg_map(struct device *dev, struct scatterlist *src,
++			  unsigned int len, struct talitos_edesc *edesc,
++			  struct talitos_ptr *ptr, int sg_count,
++			  unsigned int offset, int tbl_off)
++{
++	return talitos_sg_map_ext(dev, src, len, edesc, ptr, sg_count, offset,
++				  tbl_off, 0);
++}
++
+ /*
+  * fill in and submit ipsec_esp descriptor
+  */
+@@ -1181,7 +1189,7 @@ static int ipsec_esp(struct talitos_edesc *edesc, struct aead_request *areq,
+ 	unsigned int ivsize = crypto_aead_ivsize(aead);
+ 	int tbl_off = 0;
+ 	int sg_count, ret;
+-	int sg_link_tbl_len;
++	int elen = 0;
+ 	bool sync_needed = false;
+ 	struct talitos_private *priv = dev_get_drvdata(dev);
+ 	bool is_sec1 = has_ftr_sec1(priv);
+@@ -1223,17 +1231,11 @@ static int ipsec_esp(struct talitos_edesc *edesc, struct aead_request *areq,
+ 	 * extent is bytes of HMAC postpended to ciphertext,
+ 	 * typically 12 for ipsec
+ 	 */
+-	sg_link_tbl_len = cryptlen;
+-
+-	if (is_ipsec_esp) {
+-		to_talitos_ptr_ext_set(&desc->ptr[4], authsize, is_sec1);
+-
+-		if (desc->hdr & DESC_HDR_MODE1_MDEU_CICV)
+-			sg_link_tbl_len += authsize;
+-	}
++	if (is_ipsec_esp && (desc->hdr & DESC_HDR_MODE1_MDEU_CICV))
++		elen = authsize;
+ 
+-	ret = talitos_sg_map(dev, areq->src, sg_link_tbl_len, edesc,
+-			     &desc->ptr[4], sg_count, areq->assoclen, tbl_off);
++	ret = talitos_sg_map_ext(dev, areq->src, cryptlen, edesc, &desc->ptr[4],
++				 sg_count, areq->assoclen, tbl_off, elen);
+ 
+ 	if (ret > 1) {
+ 		tbl_off += ret;
+@@ -1690,9 +1692,30 @@ static void common_nonsnoop_hash_unmap(struct device *dev,
+ 				       struct ahash_request *areq)
+ {
+ 	struct talitos_ahash_req_ctx *req_ctx = ahash_request_ctx(areq);
++	struct talitos_private *priv = dev_get_drvdata(dev);
++	bool is_sec1 = has_ftr_sec1(priv);
++	struct talitos_desc *desc = &edesc->desc;
++	struct talitos_desc *desc2 = desc + 1;
++
++	unmap_single_talitos_ptr(dev, &edesc->desc.ptr[5], DMA_FROM_DEVICE);
++	if (desc->next_desc &&
++	    desc->ptr[5].ptr != desc2->ptr[5].ptr)
++		unmap_single_talitos_ptr(dev, &desc2->ptr[5], DMA_FROM_DEVICE);
+ 
+ 	talitos_sg_unmap(dev, edesc, req_ctx->psrc, NULL, 0, 0);
+ 
++	/* When using hashctx-in, must unmap it. */
++	if (from_talitos_ptr_len(&edesc->desc.ptr[1], is_sec1))
++		unmap_single_talitos_ptr(dev, &edesc->desc.ptr[1],
++					 DMA_TO_DEVICE);
++	else if (desc->next_desc)
++		unmap_single_talitos_ptr(dev, &desc2->ptr[1],
++					 DMA_TO_DEVICE);
++
++	if (is_sec1 && req_ctx->nbuf)
++		unmap_single_talitos_ptr(dev, &desc->ptr[3],
++					 DMA_TO_DEVICE);
++
+ 	if (edesc->dma_len)
+ 		dma_unmap_single(dev, edesc->dma_link_tbl, edesc->dma_len,
+ 				 DMA_BIDIRECTIONAL);
+@@ -1766,8 +1789,10 @@ static int common_nonsnoop_hash(struct talitos_edesc *edesc,
+ 
+ 	/* hash context in */
+ 	if (!req_ctx->first || req_ctx->swinit) {
+-		to_talitos_ptr(&desc->ptr[1], ctx->dma_hw_context,
+-			       req_ctx->hw_context_size, is_sec1);
++		map_single_talitos_ptr(dev, &desc->ptr[1],
++				       req_ctx->hw_context_size,
++				       (char *)req_ctx->hw_context,
++				       DMA_TO_DEVICE);
+ 		req_ctx->swinit = 0;
+ 	}
+ 	/* Indicate next op is not the first. */
+@@ -1793,10 +1818,9 @@ static int common_nonsnoop_hash(struct talitos_edesc *edesc,
+ 	 * data in
+ 	 */
+ 	if (is_sec1 && req_ctx->nbuf) {
+-		dma_addr_t dma_buf = ctx->dma_buf + req_ctx->buf_idx *
+-						    HASH_MAX_BLOCK_SIZE;
+-
+-		to_talitos_ptr(&desc->ptr[3], dma_buf, req_ctx->nbuf, is_sec1);
++		map_single_talitos_ptr(dev, &desc->ptr[3], req_ctx->nbuf,
++				       req_ctx->buf[req_ctx->buf_idx],
++				       DMA_TO_DEVICE);
+ 	} else {
+ 		sg_count = talitos_sg_map(dev, req_ctx->psrc, length, edesc,
+ 					  &desc->ptr[3], sg_count, offset, 0);
+@@ -1812,8 +1836,9 @@ static int common_nonsnoop_hash(struct talitos_edesc *edesc,
+ 				       crypto_ahash_digestsize(tfm),
+ 				       areq->result, DMA_FROM_DEVICE);
+ 	else
+-		to_talitos_ptr(&desc->ptr[5], ctx->dma_hw_context,
+-			       req_ctx->hw_context_size, is_sec1);
++		map_single_talitos_ptr(dev, &desc->ptr[5],
++				       req_ctx->hw_context_size,
++				       req_ctx->hw_context, DMA_FROM_DEVICE);
+ 
+ 	/* last DWORD empty */
+ 
+@@ -1832,9 +1857,14 @@ static int common_nonsnoop_hash(struct talitos_edesc *edesc,
+ 		desc->hdr |= DESC_HDR_MODE0_MDEU_CONT;
+ 		desc->hdr &= ~DESC_HDR_DONE_NOTIFY;
+ 
+-		to_talitos_ptr(&desc2->ptr[1], ctx->dma_hw_context,
+-			       req_ctx->hw_context_size, is_sec1);
+-
++		if (desc->ptr[1].ptr)
++			copy_talitos_ptr(&desc2->ptr[1], &desc->ptr[1],
++					 is_sec1);
++		else
++			map_single_talitos_ptr(dev, &desc2->ptr[1],
++					       req_ctx->hw_context_size,
++					       req_ctx->hw_context,
++					       DMA_TO_DEVICE);
+ 		copy_talitos_ptr(&desc2->ptr[2], &desc->ptr[2], is_sec1);
+ 		sg_count = talitos_sg_map(dev, req_ctx->psrc, length, edesc,
+ 					  &desc2->ptr[3], sg_count, offset, 0);
+@@ -1842,8 +1872,10 @@ static int common_nonsnoop_hash(struct talitos_edesc *edesc,
+ 			sync_needed = true;
+ 		copy_talitos_ptr(&desc2->ptr[5], &desc->ptr[5], is_sec1);
+ 		if (req_ctx->last)
+-			to_talitos_ptr(&desc->ptr[5], ctx->dma_hw_context,
+-				       req_ctx->hw_context_size, is_sec1);
++			map_single_talitos_ptr(dev, &desc->ptr[5],
++					       req_ctx->hw_context_size,
++					       req_ctx->hw_context,
++					       DMA_FROM_DEVICE);
+ 
+ 		next_desc = dma_map_single(dev, &desc2->hdr1, TALITOS_DESC_SIZE,
+ 					   DMA_BIDIRECTIONAL);
+@@ -1881,12 +1913,8 @@ static struct talitos_edesc *ahash_edesc_alloc(struct ahash_request *areq,
+ static int ahash_init(struct ahash_request *areq)
+ {
+ 	struct crypto_ahash *tfm = crypto_ahash_reqtfm(areq);
+-	struct talitos_ctx *ctx = crypto_ahash_ctx(tfm);
+-	struct device *dev = ctx->dev;
+ 	struct talitos_ahash_req_ctx *req_ctx = ahash_request_ctx(areq);
+ 	unsigned int size;
+-	struct talitos_private *priv = dev_get_drvdata(dev);
+-	bool is_sec1 = has_ftr_sec1(priv);
+ 
+ 	/* Initialize the context */
+ 	req_ctx->buf_idx = 0;
+@@ -1898,18 +1926,6 @@ static int ahash_init(struct ahash_request *areq)
+ 			: TALITOS_MDEU_CONTEXT_SIZE_SHA384_SHA512;
+ 	req_ctx->hw_context_size = size;
+ 
+-	if (ctx->dma_hw_context)
+-		dma_unmap_single(dev, ctx->dma_hw_context, size,
+-				 DMA_BIDIRECTIONAL);
+-	ctx->dma_hw_context = dma_map_single(dev, req_ctx->hw_context, size,
+-					     DMA_BIDIRECTIONAL);
+-	if (ctx->dma_buf)
+-		dma_unmap_single(dev, ctx->dma_buf, sizeof(req_ctx->buf),
+-				 DMA_TO_DEVICE);
+-	if (is_sec1)
+-		ctx->dma_buf = dma_map_single(dev, req_ctx->buf,
+-					      sizeof(req_ctx->buf),
+-					      DMA_TO_DEVICE);
+ 	return 0;
+ }
+ 
+@@ -1920,9 +1936,6 @@ static int ahash_init(struct ahash_request *areq)
+ static int ahash_init_sha224_swinit(struct ahash_request *areq)
+ {
+ 	struct talitos_ahash_req_ctx *req_ctx = ahash_request_ctx(areq);
+-	struct crypto_ahash *tfm = crypto_ahash_reqtfm(areq);
+-	struct talitos_ctx *ctx = crypto_ahash_ctx(tfm);
+-	struct device *dev = ctx->dev;
+ 
+ 	ahash_init(areq);
+ 	req_ctx->swinit = 1;/* prevent h/w initting context with sha256 values*/
+@@ -1940,9 +1953,6 @@ static int ahash_init_sha224_swinit(struct ahash_request *areq)
+ 	req_ctx->hw_context[8] = 0;
+ 	req_ctx->hw_context[9] = 0;
+ 
+-	dma_sync_single_for_device(dev, ctx->dma_hw_context,
+-				   req_ctx->hw_context_size, DMA_TO_DEVICE);
+-
+ 	return 0;
+ }
+ 
+@@ -2046,13 +2056,6 @@ static int ahash_process_req(struct ahash_request *areq, unsigned int nbytes)
+ 	/* request SEC to INIT hash. */
+ 	if (req_ctx->first && !req_ctx->swinit)
+ 		edesc->desc.hdr |= DESC_HDR_MODE0_MDEU_INIT;
+-	if (is_sec1) {
+-		dma_addr_t dma_buf = ctx->dma_buf + req_ctx->buf_idx *
+-						    HASH_MAX_BLOCK_SIZE;
+-
+-		dma_sync_single_for_device(dev, dma_buf,
+-					   req_ctx->nbuf, DMA_TO_DEVICE);
+-	}
+ 
+ 	/* When the tfm context has a keylen, it's an HMAC.
+ 	 * A first or last (ie. not middle) descriptor must request HMAC.
+@@ -2106,12 +2109,7 @@ static int ahash_export(struct ahash_request *areq, void *out)
+ {
+ 	struct talitos_ahash_req_ctx *req_ctx = ahash_request_ctx(areq);
+ 	struct talitos_export_state *export = out;
+-	struct crypto_ahash *ahash = crypto_ahash_reqtfm(areq);
+-	struct talitos_ctx *ctx = crypto_ahash_ctx(ahash);
+-	struct device *dev = ctx->dev;
+ 
+-	dma_sync_single_for_cpu(dev, ctx->dma_hw_context,
+-				req_ctx->hw_context_size, DMA_FROM_DEVICE);
+ 	memcpy(export->hw_context, req_ctx->hw_context,
+ 	       req_ctx->hw_context_size);
+ 	memcpy(export->buf, req_ctx->buf[req_ctx->buf_idx], req_ctx->nbuf);
+@@ -2130,31 +2128,14 @@ static int ahash_import(struct ahash_request *areq, const void *in)
+ 	struct crypto_ahash *tfm = crypto_ahash_reqtfm(areq);
+ 	const struct talitos_export_state *export = in;
+ 	unsigned int size;
+-	struct talitos_ctx *ctx = crypto_ahash_ctx(tfm);
+-	struct device *dev = ctx->dev;
+-	struct talitos_private *priv = dev_get_drvdata(dev);
+-	bool is_sec1 = has_ftr_sec1(priv);
+ 
+ 	memset(req_ctx, 0, sizeof(*req_ctx));
+ 	size = (crypto_ahash_digestsize(tfm) <= SHA256_DIGEST_SIZE)
+ 			? TALITOS_MDEU_CONTEXT_SIZE_MD5_SHA1_SHA256
+ 			: TALITOS_MDEU_CONTEXT_SIZE_SHA384_SHA512;
+ 	req_ctx->hw_context_size = size;
+-	if (ctx->dma_hw_context)
+-		dma_unmap_single(dev, ctx->dma_hw_context, size,
+-				 DMA_BIDIRECTIONAL);
+-
+ 	memcpy(req_ctx->hw_context, export->hw_context, size);
+-	ctx->dma_hw_context = dma_map_single(dev, req_ctx->hw_context, size,
+-					     DMA_BIDIRECTIONAL);
+-	if (ctx->dma_buf)
+-		dma_unmap_single(dev, ctx->dma_buf, sizeof(req_ctx->buf),
+-				 DMA_TO_DEVICE);
+ 	memcpy(req_ctx->buf[0], export->buf, export->nbuf);
+-	if (is_sec1)
+-		ctx->dma_buf = dma_map_single(dev, req_ctx->buf,
+-					      sizeof(req_ctx->buf),
+-					      DMA_TO_DEVICE);
+ 	req_ctx->swinit = export->swinit;
+ 	req_ctx->first = export->first;
+ 	req_ctx->last = export->last;
+@@ -3064,27 +3045,6 @@ static void talitos_cra_exit(struct crypto_tfm *tfm)
+ 		dma_unmap_single(dev, ctx->dma_key, ctx->keylen, DMA_TO_DEVICE);
+ }
+ 
+-static void talitos_cra_exit_ahash(struct crypto_tfm *tfm)
+-{
+-	struct talitos_ctx *ctx = crypto_tfm_ctx(tfm);
+-	struct device *dev = ctx->dev;
+-	unsigned int size;
+-
+-	talitos_cra_exit(tfm);
+-
+-	size = (crypto_ahash_digestsize(__crypto_ahash_cast(tfm)) <=
+-		SHA256_DIGEST_SIZE)
+-	       ? TALITOS_MDEU_CONTEXT_SIZE_MD5_SHA1_SHA256
+-	       : TALITOS_MDEU_CONTEXT_SIZE_SHA384_SHA512;
+-
+-	if (ctx->dma_hw_context)
+-		dma_unmap_single(dev, ctx->dma_hw_context, size,
+-				 DMA_BIDIRECTIONAL);
+-	if (ctx->dma_buf)
+-		dma_unmap_single(dev, ctx->dma_buf, HASH_MAX_BLOCK_SIZE * 2,
+-				 DMA_TO_DEVICE);
+-}
+-
+ /*
+  * given the alg's descriptor header template, determine whether descriptor
+  * type and primary/secondary execution units required match the hw
+@@ -3183,7 +3143,7 @@ static struct talitos_crypto_alg *talitos_alg_alloc(struct device *dev,
+ 	case CRYPTO_ALG_TYPE_AHASH:
+ 		alg = &t_alg->algt.alg.hash.halg.base;
+ 		alg->cra_init = talitos_cra_init_ahash;
+-		alg->cra_exit = talitos_cra_exit_ahash;
++		alg->cra_exit = talitos_cra_exit;
+ 		alg->cra_type = &crypto_ahash_type;
+ 		t_alg->algt.alg.hash.init = ahash_init;
+ 		t_alg->algt.alg.hash.update = ahash_update;
+diff --git a/drivers/gpu/drm/i915/intel_ddi.c b/drivers/gpu/drm/i915/intel_ddi.c
+index 58a3755544b2..38e53d6b8127 100644
+--- a/drivers/gpu/drm/i915/intel_ddi.c
++++ b/drivers/gpu/drm/i915/intel_ddi.c
+@@ -2208,8 +2208,7 @@ static void intel_ddi_pre_enable_dp(struct intel_encoder *encoder,
+ 		intel_prepare_dp_ddi_buffers(encoder);
+ 
+ 	intel_ddi_init_dp_buf_reg(encoder);
+-	if (!is_mst)
+-		intel_dp_sink_dpms(intel_dp, DRM_MODE_DPMS_ON);
++	intel_dp_sink_dpms(intel_dp, DRM_MODE_DPMS_ON);
+ 	intel_dp_start_link_train(intel_dp);
+ 	if (port != PORT_A || INTEL_GEN(dev_priv) >= 9)
+ 		intel_dp_stop_link_train(intel_dp);
+@@ -2294,19 +2293,12 @@ static void intel_ddi_post_disable_dp(struct intel_encoder *encoder,
+ 	struct drm_i915_private *dev_priv = to_i915(encoder->base.dev);
+ 	struct intel_digital_port *dig_port = enc_to_dig_port(&encoder->base);
+ 	struct intel_dp *intel_dp = &dig_port->dp;
+-	/*
+-	 * old_crtc_state and old_conn_state are NULL when called from
+-	 * DP_MST. The main connector associated with this port is never
+-	 * bound to a crtc for MST.
+-	 */
+-	bool is_mst = !old_crtc_state;
+ 
+ 	/*
+ 	 * Power down sink before disabling the port, otherwise we end
+ 	 * up getting interrupts from the sink on detecting link loss.
+ 	 */
+-	if (!is_mst)
+-		intel_dp_sink_dpms(intel_dp, DRM_MODE_DPMS_OFF);
++	intel_dp_sink_dpms(intel_dp, DRM_MODE_DPMS_OFF);
+ 
+ 	intel_disable_ddi_buf(encoder);
+ 
+diff --git a/drivers/i2c/busses/i2c-stm32f7.c b/drivers/i2c/busses/i2c-stm32f7.c
+index b445b3bb0bb1..f273e28c39db 100644
+--- a/drivers/i2c/busses/i2c-stm32f7.c
++++ b/drivers/i2c/busses/i2c-stm32f7.c
+@@ -888,6 +888,11 @@ static int stm32f7_i2c_probe(struct platform_device *pdev)
+ 	}
+ 
+ 	setup = of_device_get_match_data(&pdev->dev);
++	if (!setup) {
++		dev_err(&pdev->dev, "Can't get device data\n");
++		ret = -ENODEV;
++		goto clk_free;
++	}
+ 	i2c_dev->setup = *setup;
+ 
+ 	ret = device_property_read_u32(i2c_dev->dev, "i2c-scl-rising-time-ns",
+diff --git a/drivers/infiniband/core/addr.c b/drivers/infiniband/core/addr.c
+index f4e8185bccd3..0885b8cfbe0b 100644
+--- a/drivers/infiniband/core/addr.c
++++ b/drivers/infiniband/core/addr.c
+@@ -207,6 +207,22 @@ int rdma_addr_size(struct sockaddr *addr)
+ }
+ EXPORT_SYMBOL(rdma_addr_size);
+ 
++int rdma_addr_size_in6(struct sockaddr_in6 *addr)
++{
++	int ret = rdma_addr_size((struct sockaddr *) addr);
++
++	return ret <= sizeof(*addr) ? ret : 0;
++}
++EXPORT_SYMBOL(rdma_addr_size_in6);
++
++int rdma_addr_size_kss(struct __kernel_sockaddr_storage *addr)
++{
++	int ret = rdma_addr_size((struct sockaddr *) addr);
++
++	return ret <= sizeof(*addr) ? ret : 0;
++}
++EXPORT_SYMBOL(rdma_addr_size_kss);
++
+ static struct rdma_addr_client self;
+ 
+ void rdma_addr_register_client(struct rdma_addr_client *client)
+@@ -598,6 +614,15 @@ static void process_one_req(struct work_struct *_work)
+ 	list_del(&req->list);
+ 	mutex_unlock(&lock);
+ 
++	/*
++	 * Although the work will normally have been canceled by the
++	 * workqueue, it can still be requeued as long as it is on the
++	 * req_list, so it could have been requeued before we grabbed &lock.
++	 * We need to cancel it after it is removed from req_list to really be
++	 * sure it is safe to free.
++	 */
++	cancel_delayed_work(&req->work);
++
+ 	req->callback(req->status, (struct sockaddr *)&req->src_addr,
+ 		req->addr, req->context);
+ 	put_client(req->client);
+diff --git a/drivers/infiniband/core/ucma.c b/drivers/infiniband/core/ucma.c
+index 77ca9da570a2..722235bed075 100644
+--- a/drivers/infiniband/core/ucma.c
++++ b/drivers/infiniband/core/ucma.c
+@@ -132,7 +132,7 @@ static inline struct ucma_context *_ucma_find_context(int id,
+ 	ctx = idr_find(&ctx_idr, id);
+ 	if (!ctx)
+ 		ctx = ERR_PTR(-ENOENT);
+-	else if (ctx->file != file)
++	else if (ctx->file != file || !ctx->cm_id)
+ 		ctx = ERR_PTR(-EINVAL);
+ 	return ctx;
+ }
+@@ -456,6 +456,7 @@ static ssize_t ucma_create_id(struct ucma_file *file, const char __user *inbuf,
+ 	struct rdma_ucm_create_id cmd;
+ 	struct rdma_ucm_create_id_resp resp;
+ 	struct ucma_context *ctx;
++	struct rdma_cm_id *cm_id;
+ 	enum ib_qp_type qp_type;
+ 	int ret;
+ 
+@@ -476,10 +477,10 @@ static ssize_t ucma_create_id(struct ucma_file *file, const char __user *inbuf,
+ 		return -ENOMEM;
+ 
+ 	ctx->uid = cmd.uid;
+-	ctx->cm_id = rdma_create_id(current->nsproxy->net_ns,
+-				    ucma_event_handler, ctx, cmd.ps, qp_type);
+-	if (IS_ERR(ctx->cm_id)) {
+-		ret = PTR_ERR(ctx->cm_id);
++	cm_id = rdma_create_id(current->nsproxy->net_ns,
++			       ucma_event_handler, ctx, cmd.ps, qp_type);
++	if (IS_ERR(cm_id)) {
++		ret = PTR_ERR(cm_id);
+ 		goto err1;
+ 	}
+ 
+@@ -489,14 +490,19 @@ static ssize_t ucma_create_id(struct ucma_file *file, const char __user *inbuf,
+ 		ret = -EFAULT;
+ 		goto err2;
+ 	}
++
++	ctx->cm_id = cm_id;
+ 	return 0;
+ 
+ err2:
+-	rdma_destroy_id(ctx->cm_id);
++	rdma_destroy_id(cm_id);
+ err1:
+ 	mutex_lock(&mut);
+ 	idr_remove(&ctx_idr, ctx->id);
+ 	mutex_unlock(&mut);
++	mutex_lock(&file->mut);
++	list_del(&ctx->list);
++	mutex_unlock(&file->mut);
+ 	kfree(ctx);
+ 	return ret;
+ }
+@@ -626,6 +632,9 @@ static ssize_t ucma_bind_ip(struct ucma_file *file, const char __user *inbuf,
+ 	if (copy_from_user(&cmd, inbuf, sizeof(cmd)))
+ 		return -EFAULT;
+ 
++	if (!rdma_addr_size_in6(&cmd.addr))
++		return -EINVAL;
++
+ 	ctx = ucma_get_ctx(file, cmd.id);
+ 	if (IS_ERR(ctx))
+ 		return PTR_ERR(ctx);
+@@ -639,22 +648,21 @@ static ssize_t ucma_bind(struct ucma_file *file, const char __user *inbuf,
+ 			 int in_len, int out_len)
+ {
+ 	struct rdma_ucm_bind cmd;
+-	struct sockaddr *addr;
+ 	struct ucma_context *ctx;
+ 	int ret;
+ 
+ 	if (copy_from_user(&cmd, inbuf, sizeof(cmd)))
+ 		return -EFAULT;
+ 
+-	addr = (struct sockaddr *) &cmd.addr;
+-	if (cmd.reserved || !cmd.addr_size || (cmd.addr_size != rdma_addr_size(addr)))
++	if (cmd.reserved || !cmd.addr_size ||
++	    cmd.addr_size != rdma_addr_size_kss(&cmd.addr))
+ 		return -EINVAL;
+ 
+ 	ctx = ucma_get_ctx(file, cmd.id);
+ 	if (IS_ERR(ctx))
+ 		return PTR_ERR(ctx);
+ 
+-	ret = rdma_bind_addr(ctx->cm_id, addr);
++	ret = rdma_bind_addr(ctx->cm_id, (struct sockaddr *) &cmd.addr);
+ 	ucma_put_ctx(ctx);
+ 	return ret;
+ }
+@@ -670,13 +678,16 @@ static ssize_t ucma_resolve_ip(struct ucma_file *file,
+ 	if (copy_from_user(&cmd, inbuf, sizeof(cmd)))
+ 		return -EFAULT;
+ 
++	if (!rdma_addr_size_in6(&cmd.src_addr) ||
++	    !rdma_addr_size_in6(&cmd.dst_addr))
++		return -EINVAL;
++
+ 	ctx = ucma_get_ctx(file, cmd.id);
+ 	if (IS_ERR(ctx))
+ 		return PTR_ERR(ctx);
+ 
+ 	ret = rdma_resolve_addr(ctx->cm_id, (struct sockaddr *) &cmd.src_addr,
+-				(struct sockaddr *) &cmd.dst_addr,
+-				cmd.timeout_ms);
++				(struct sockaddr *) &cmd.dst_addr, cmd.timeout_ms);
+ 	ucma_put_ctx(ctx);
+ 	return ret;
+ }
+@@ -686,24 +697,23 @@ static ssize_t ucma_resolve_addr(struct ucma_file *file,
+ 				 int in_len, int out_len)
+ {
+ 	struct rdma_ucm_resolve_addr cmd;
+-	struct sockaddr *src, *dst;
+ 	struct ucma_context *ctx;
+ 	int ret;
+ 
+ 	if (copy_from_user(&cmd, inbuf, sizeof(cmd)))
+ 		return -EFAULT;
+ 
+-	src = (struct sockaddr *) &cmd.src_addr;
+-	dst = (struct sockaddr *) &cmd.dst_addr;
+-	if (cmd.reserved || (cmd.src_size && (cmd.src_size != rdma_addr_size(src))) ||
+-	    !cmd.dst_size || (cmd.dst_size != rdma_addr_size(dst)))
++	if (cmd.reserved ||
++	    (cmd.src_size && (cmd.src_size != rdma_addr_size_kss(&cmd.src_addr))) ||
++	    !cmd.dst_size || (cmd.dst_size != rdma_addr_size_kss(&cmd.dst_addr)))
+ 		return -EINVAL;
+ 
+ 	ctx = ucma_get_ctx(file, cmd.id);
+ 	if (IS_ERR(ctx))
+ 		return PTR_ERR(ctx);
+ 
+-	ret = rdma_resolve_addr(ctx->cm_id, src, dst, cmd.timeout_ms);
++	ret = rdma_resolve_addr(ctx->cm_id, (struct sockaddr *) &cmd.src_addr,
++				(struct sockaddr *) &cmd.dst_addr, cmd.timeout_ms);
+ 	ucma_put_ctx(ctx);
+ 	return ret;
+ }
+@@ -1155,6 +1165,11 @@ static ssize_t ucma_init_qp_attr(struct ucma_file *file,
+ 	if (IS_ERR(ctx))
+ 		return PTR_ERR(ctx);
+ 
++	if (!ctx->cm_id->device) {
++		ret = -EINVAL;
++		goto out;
++	}
++
+ 	resp.qp_attr_mask = 0;
+ 	memset(&qp_attr, 0, sizeof qp_attr);
+ 	qp_attr.qp_state = cmd.qp_state;
+@@ -1320,7 +1335,7 @@ static ssize_t ucma_notify(struct ucma_file *file, const char __user *inbuf,
+ {
+ 	struct rdma_ucm_notify cmd;
+ 	struct ucma_context *ctx;
+-	int ret;
++	int ret = -EINVAL;
+ 
+ 	if (copy_from_user(&cmd, inbuf, sizeof(cmd)))
+ 		return -EFAULT;
+@@ -1329,7 +1344,9 @@ static ssize_t ucma_notify(struct ucma_file *file, const char __user *inbuf,
+ 	if (IS_ERR(ctx))
+ 		return PTR_ERR(ctx);
+ 
+-	ret = rdma_notify(ctx->cm_id, (enum ib_event_type) cmd.event);
++	if (ctx->cm_id->device)
++		ret = rdma_notify(ctx->cm_id, (enum ib_event_type)cmd.event);
++
+ 	ucma_put_ctx(ctx);
+ 	return ret;
+ }
+@@ -1415,7 +1432,7 @@ static ssize_t ucma_join_ip_multicast(struct ucma_file *file,
+ 	join_cmd.response = cmd.response;
+ 	join_cmd.uid = cmd.uid;
+ 	join_cmd.id = cmd.id;
+-	join_cmd.addr_size = rdma_addr_size((struct sockaddr *) &cmd.addr);
++	join_cmd.addr_size = rdma_addr_size_in6(&cmd.addr);
+ 	if (!join_cmd.addr_size)
+ 		return -EINVAL;
+ 
+@@ -1434,7 +1451,7 @@ static ssize_t ucma_join_multicast(struct ucma_file *file,
+ 	if (copy_from_user(&cmd, inbuf, sizeof(cmd)))
+ 		return -EFAULT;
+ 
+-	if (!rdma_addr_size((struct sockaddr *)&cmd.addr))
++	if (!rdma_addr_size_kss(&cmd.addr))
+ 		return -EINVAL;
+ 
+ 	return ucma_process_join(file, &cmd, out_len);
+diff --git a/drivers/input/mouse/alps.c b/drivers/input/mouse/alps.c
+index dbe57da8c1a1..4a3bc168a4a7 100644
+--- a/drivers/input/mouse/alps.c
++++ b/drivers/input/mouse/alps.c
+@@ -2544,13 +2544,31 @@ static int alps_update_btn_info_ss4_v2(unsigned char otp[][4],
+ }
+ 
+ static int alps_update_dual_info_ss4_v2(unsigned char otp[][4],
+-				       struct alps_data *priv)
++					struct alps_data *priv,
++					struct psmouse *psmouse)
+ {
+ 	bool is_dual = false;
++	int reg_val = 0;
++	struct ps2dev *ps2dev = &psmouse->ps2dev;
+ 
+-	if (IS_SS4PLUS_DEV(priv->dev_id))
++	if (IS_SS4PLUS_DEV(priv->dev_id)) {
+ 		is_dual = (otp[0][0] >> 4) & 0x01;
+ 
++		if (!is_dual) {
++			/* For support TrackStick of Thinkpad L/E series */
++			if (alps_exit_command_mode(psmouse) == 0 &&
++				alps_enter_command_mode(psmouse) == 0) {
++				reg_val = alps_command_mode_read_reg(psmouse,
++									0xD7);
++			}
++			alps_exit_command_mode(psmouse);
++			ps2_command(ps2dev, NULL, PSMOUSE_CMD_ENABLE);
++
++			if (reg_val == 0x0C || reg_val == 0x1D)
++				is_dual = true;
++		}
++	}
++
+ 	if (is_dual)
+ 		priv->flags |= ALPS_DUALPOINT |
+ 					ALPS_DUALPOINT_WITH_PRESSURE;
+@@ -2573,7 +2591,7 @@ static int alps_set_defaults_ss4_v2(struct psmouse *psmouse,
+ 
+ 	alps_update_btn_info_ss4_v2(otp, priv);
+ 
+-	alps_update_dual_info_ss4_v2(otp, priv);
++	alps_update_dual_info_ss4_v2(otp, priv, psmouse);
+ 
+ 	return 0;
+ }
+diff --git a/drivers/input/serio/i8042-x86ia64io.h b/drivers/input/serio/i8042-x86ia64io.h
+index 6cbbdc6e9687..b353d494ad40 100644
+--- a/drivers/input/serio/i8042-x86ia64io.h
++++ b/drivers/input/serio/i8042-x86ia64io.h
+@@ -530,6 +530,20 @@ static const struct dmi_system_id __initconst i8042_dmi_nomux_table[] = {
+ 	{ }
+ };
+ 
++static const struct dmi_system_id i8042_dmi_forcemux_table[] __initconst = {
++	{
++		/*
++		 * Sony Vaio VGN-CS series require MUX or the touch sensor
++		 * buttons will disturb touchpad operation
++		 */
++		.matches = {
++			DMI_MATCH(DMI_SYS_VENDOR, "Sony Corporation"),
++			DMI_MATCH(DMI_PRODUCT_NAME, "VGN-CS"),
++		},
++	},
++	{ }
++};
++
+ /*
+  * On some Asus laptops, just running self tests cause problems.
+  */
+@@ -620,6 +634,13 @@ static const struct dmi_system_id __initconst i8042_dmi_reset_table[] = {
+ 			DMI_MATCH(DMI_PRODUCT_NAME, "20046"),
+ 		},
+ 	},
++	{
++		/* Lenovo ThinkPad L460 */
++		.matches = {
++			DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
++			DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad L460"),
++		},
++	},
+ 	{
+ 		/* Clevo P650RS, 650RP6, Sager NP8152-S, and others */
+ 		.matches = {
+@@ -1163,6 +1184,9 @@ static int __init i8042_platform_init(void)
+ 	if (dmi_check_system(i8042_dmi_nomux_table))
+ 		i8042_nomux = true;
+ 
++	if (dmi_check_system(i8042_dmi_forcemux_table))
++		i8042_nomux = false;
++
+ 	if (dmi_check_system(i8042_dmi_notimeout_table))
+ 		i8042_notimeout = true;
+ 
+diff --git a/drivers/media/usb/usbtv/usbtv-core.c b/drivers/media/usb/usbtv/usbtv-core.c
+index 127f8a0c098b..0c2e628e8723 100644
+--- a/drivers/media/usb/usbtv/usbtv-core.c
++++ b/drivers/media/usb/usbtv/usbtv-core.c
+@@ -112,6 +112,8 @@ static int usbtv_probe(struct usb_interface *intf,
+ 	return 0;
+ 
+ usbtv_audio_fail:
++	/* we must not free at this point */
++	usb_get_dev(usbtv->udev);
+ 	usbtv_video_free(usbtv);
+ 
+ usbtv_video_fail:
+diff --git a/drivers/misc/mei/main.c b/drivers/misc/mei/main.c
+index e825f013e54e..22efc039f302 100644
+--- a/drivers/misc/mei/main.c
++++ b/drivers/misc/mei/main.c
+@@ -507,7 +507,6 @@ static long mei_ioctl(struct file *file, unsigned int cmd, unsigned long data)
+ 		break;
+ 
+ 	default:
+-		dev_err(dev->dev, ": unsupported ioctl %d.\n", cmd);
+ 		rets = -ENOIOCTLCMD;
+ 	}
+ 
+diff --git a/drivers/mtd/chips/jedec_probe.c b/drivers/mtd/chips/jedec_probe.c
+index 7c0b27d132b1..b479bd81120b 100644
+--- a/drivers/mtd/chips/jedec_probe.c
++++ b/drivers/mtd/chips/jedec_probe.c
+@@ -1889,6 +1889,8 @@ static inline u32 jedec_read_mfr(struct map_info *map, uint32_t base,
+ 	do {
+ 		uint32_t ofs = cfi_build_cmd_addr(0 + (bank << 8), map, cfi);
+ 		mask = (1 << (cfi->device_type * 8)) - 1;
++		if (ofs >= map->size)
++			return 0;
+ 		result = map_read(map, base + ofs);
+ 		bank++;
+ 	} while ((result.x[0] & mask) == CFI_MFR_CONTINUATION);
+diff --git a/drivers/mtd/nand/atmel/pmecc.c b/drivers/mtd/nand/atmel/pmecc.c
+index fcbe4fd6e684..ca0a70389ba9 100644
+--- a/drivers/mtd/nand/atmel/pmecc.c
++++ b/drivers/mtd/nand/atmel/pmecc.c
+@@ -426,7 +426,7 @@ static int get_strength(struct atmel_pmecc_user *user)
+ 
+ static int get_sectorsize(struct atmel_pmecc_user *user)
+ {
+-	return user->cache.cfg & PMECC_LOOKUP_TABLE_SIZE_1024 ? 1024 : 512;
++	return user->cache.cfg & PMECC_CFG_SECTOR1024 ? 1024 : 512;
+ }
+ 
+ static void atmel_pmecc_gen_syndrome(struct atmel_pmecc_user *user, int sector)
+diff --git a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_gmac.c b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_gmac.c
+index 86944bc3b273..74bd260ca02a 100644
+--- a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_gmac.c
++++ b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_gmac.c
+@@ -666,7 +666,7 @@ static void hns_gmac_get_strings(u32 stringset, u8 *data)
+ 
+ static int hns_gmac_get_sset_count(int stringset)
+ {
+-	if (stringset == ETH_SS_STATS || stringset == ETH_SS_PRIV_FLAGS)
++	if (stringset == ETH_SS_STATS)
+ 		return ARRAY_SIZE(g_gmac_stats_string);
+ 
+ 	return 0;
+diff --git a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_ppe.c b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_ppe.c
+index b62816c1574e..93e71e27401b 100644
+--- a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_ppe.c
++++ b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_ppe.c
+@@ -422,7 +422,7 @@ void hns_ppe_update_stats(struct hns_ppe_cb *ppe_cb)
+ 
+ int hns_ppe_get_sset_count(int stringset)
+ {
+-	if (stringset == ETH_SS_STATS || stringset == ETH_SS_PRIV_FLAGS)
++	if (stringset == ETH_SS_STATS)
+ 		return ETH_PPE_STATIC_NUM;
+ 	return 0;
+ }
+diff --git a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_rcb.c b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_rcb.c
+index 6f3570cfb501..e2e28532e4dc 100644
+--- a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_rcb.c
++++ b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_rcb.c
+@@ -876,7 +876,7 @@ void hns_rcb_get_stats(struct hnae_queue *queue, u64 *data)
+  */
+ int hns_rcb_get_ring_sset_count(int stringset)
+ {
+-	if (stringset == ETH_SS_STATS || stringset == ETH_SS_PRIV_FLAGS)
++	if (stringset == ETH_SS_STATS)
+ 		return HNS_RING_STATIC_REG_NUM;
+ 
+ 	return 0;
+diff --git a/drivers/net/ethernet/hisilicon/hns/hns_ethtool.c b/drivers/net/ethernet/hisilicon/hns/hns_ethtool.c
+index 7ea7f8a4aa2a..2e14a3ae1d8b 100644
+--- a/drivers/net/ethernet/hisilicon/hns/hns_ethtool.c
++++ b/drivers/net/ethernet/hisilicon/hns/hns_ethtool.c
+@@ -993,8 +993,10 @@ int hns_get_sset_count(struct net_device *netdev, int stringset)
+ 			cnt--;
+ 
+ 		return cnt;
+-	} else {
++	} else if (stringset == ETH_SS_STATS) {
+ 		return (HNS_NET_STATS_CNT + ops->get_sset_count(h, stringset));
++	} else {
++		return -EOPNOTSUPP;
+ 	}
+ }
+ 
+diff --git a/drivers/parport/parport_pc.c b/drivers/parport/parport_pc.c
+index 489492b608cf..380916bff9e0 100644
+--- a/drivers/parport/parport_pc.c
++++ b/drivers/parport/parport_pc.c
+@@ -2646,6 +2646,7 @@ enum parport_pc_pci_cards {
+ 	netmos_9901,
+ 	netmos_9865,
+ 	quatech_sppxp100,
++	wch_ch382l,
+ };
+ 
+ 
+@@ -2708,6 +2709,7 @@ static struct parport_pc_pci {
+ 	/* netmos_9901 */               { 1, { { 0, -1 }, } },
+ 	/* netmos_9865 */               { 1, { { 0, -1 }, } },
+ 	/* quatech_sppxp100 */		{ 1, { { 0, 1 }, } },
++	/* wch_ch382l */		{ 1, { { 2, -1 }, } },
+ };
+ 
+ static const struct pci_device_id parport_pc_pci_tbl[] = {
+@@ -2797,6 +2799,8 @@ static const struct pci_device_id parport_pc_pci_tbl[] = {
+ 	/* Quatech SPPXP-100 Parallel port PCI ExpressCard */
+ 	{ PCI_VENDOR_ID_QUATECH, PCI_DEVICE_ID_QUATECH_SPPXP_100,
+ 	  PCI_ANY_ID, PCI_ANY_ID, 0, 0, quatech_sppxp100 },
++	/* WCH CH382L PCI-E single parallel port card */
++	{ 0x1c00, 0x3050, 0x1c00, 0x3050, 0, 0, wch_ch382l },
+ 	{ 0, } /* terminate list */
+ };
+ MODULE_DEVICE_TABLE(pci, parport_pc_pci_tbl);
+diff --git a/drivers/phy/qualcomm/phy-qcom-ufs.c b/drivers/phy/qualcomm/phy-qcom-ufs.c
+index c5ff4525edef..c5493ea51282 100644
+--- a/drivers/phy/qualcomm/phy-qcom-ufs.c
++++ b/drivers/phy/qualcomm/phy-qcom-ufs.c
+@@ -675,3 +675,8 @@ int ufs_qcom_phy_power_off(struct phy *generic_phy)
+ 	return 0;
+ }
+ EXPORT_SYMBOL_GPL(ufs_qcom_phy_power_off);
++
++MODULE_AUTHOR("Yaniv Gardi <ygardi@××××××××××.org>");
++MODULE_AUTHOR("Vivek Gautam <vivek.gautam@××××××××××.org>");
++MODULE_DESCRIPTION("Universal Flash Storage (UFS) QCOM PHY");
++MODULE_LICENSE("GPL v2");
+diff --git a/drivers/staging/comedi/drivers/ni_mio_common.c b/drivers/staging/comedi/drivers/ni_mio_common.c
+index 398347fedc47..2cac160993bb 100644
+--- a/drivers/staging/comedi/drivers/ni_mio_common.c
++++ b/drivers/staging/comedi/drivers/ni_mio_common.c
+@@ -1284,6 +1284,8 @@ static void ack_a_interrupt(struct comedi_device *dev, unsigned short a_status)
+ 		ack |= NISTC_INTA_ACK_AI_START;
+ 	if (a_status & NISTC_AI_STATUS1_STOP)
+ 		ack |= NISTC_INTA_ACK_AI_STOP;
++	if (a_status & NISTC_AI_STATUS1_OVER)
++		ack |= NISTC_INTA_ACK_AI_ERR;
+ 	if (ack)
+ 		ni_stc_writew(dev, ack, NISTC_INTA_ACK_REG);
+ }
+diff --git a/drivers/tty/serial/8250/8250_of.c b/drivers/tty/serial/8250/8250_of.c
+index 160b8906d9b9..9835b1c1cbe1 100644
+--- a/drivers/tty/serial/8250/8250_of.c
++++ b/drivers/tty/serial/8250/8250_of.c
+@@ -316,6 +316,7 @@ static const struct of_device_id of_platform_serial_table[] = {
+ 	{ .compatible = "mrvl,mmp-uart",
+ 		.data = (void *)PORT_XSCALE, },
+ 	{ .compatible = "ti,da830-uart", .data = (void *)PORT_DA830, },
++	{ .compatible = "nuvoton,npcm750-uart", .data = (void *)PORT_NPCM, },
+ 	{ /* end of list */ },
+ };
+ MODULE_DEVICE_TABLE(of, of_platform_serial_table);
+diff --git a/drivers/tty/serial/8250/8250_port.c b/drivers/tty/serial/8250/8250_port.c
+index 11434551ac0a..2cda4b28c78a 100644
+--- a/drivers/tty/serial/8250/8250_port.c
++++ b/drivers/tty/serial/8250/8250_port.c
+@@ -47,6 +47,10 @@
+ #define UART_EXAR_SLEEP		0x8b	/* Sleep mode */
+ #define UART_EXAR_DVID		0x8d	/* Device identification */
+ 
++/* Nuvoton NPCM timeout register */
++#define UART_NPCM_TOR          7
++#define UART_NPCM_TOIE         BIT(7)  /* Timeout Interrupt Enable */
++
+ /*
+  * Debugging.
+  */
+@@ -293,6 +297,15 @@ static const struct serial8250_config uart_config[] = {
+ 				  UART_FCR_CLEAR_RCVR | UART_FCR_CLEAR_XMIT,
+ 		.flags		= UART_CAP_FIFO,
+ 	},
++	[PORT_NPCM] = {
++		.name		= "Nuvoton 16550",
++		.fifo_size	= 16,
++		.tx_loadsz	= 16,
++		.fcr		= UART_FCR_ENABLE_FIFO | UART_FCR_R_TRIG_10 |
++				  UART_FCR_CLEAR_RCVR | UART_FCR_CLEAR_XMIT,
++		.rxtrig_bytes	= {1, 4, 8, 14},
++		.flags		= UART_CAP_FIFO,
++	},
+ };
+ 
+ /* Uart divisor latch read */
+@@ -2161,6 +2174,15 @@ int serial8250_do_startup(struct uart_port *port)
+ 				UART_DA830_PWREMU_MGMT_FREE);
+ 	}
+ 
++	if (port->type == PORT_NPCM) {
++		/*
++		 * Nuvoton calls the scratch register 'UART_TOR' (timeout
++		 * register). Enable it, and set TIOC (timeout interrupt
++		 * comparator) to be 0x20 for correct operation.
++		 */
++		serial_port_out(port, UART_NPCM_TOR, UART_NPCM_TOIE | 0x20);
++	}
++
+ #ifdef CONFIG_SERIAL_8250_RSA
+ 	/*
+ 	 * If this is an RSA port, see if we can kick it up to the
+@@ -2483,6 +2505,15 @@ static unsigned int xr17v35x_get_divisor(struct uart_8250_port *up,
+ 	return quot_16 >> 4;
+ }
+ 
++/* Nuvoton NPCM UARTs have a custom divisor calculation */
++static unsigned int npcm_get_divisor(struct uart_8250_port *up,
++		unsigned int baud)
++{
++	struct uart_port *port = &up->port;
++
++	return DIV_ROUND_CLOSEST(port->uartclk, 16 * baud + 2) - 2;
++}
++
+ static unsigned int serial8250_get_divisor(struct uart_8250_port *up,
+ 					   unsigned int baud,
+ 					   unsigned int *frac)
+@@ -2503,6 +2534,8 @@ static unsigned int serial8250_get_divisor(struct uart_8250_port *up,
+ 		quot = 0x8002;
+ 	else if (up->port.type == PORT_XR17V35X)
+ 		quot = xr17v35x_get_divisor(up, baud, frac);
++	else if (up->port.type == PORT_NPCM)
++		quot = npcm_get_divisor(up, baud);
+ 	else
+ 		quot = uart_get_divisor(port, baud);
+ 
+diff --git a/drivers/tty/vt/vt.c b/drivers/tty/vt/vt.c
+index b4e57c5a8bba..f97251f39c26 100644
+--- a/drivers/tty/vt/vt.c
++++ b/drivers/tty/vt/vt.c
+@@ -1354,6 +1354,11 @@ static void csi_m(struct vc_data *vc)
+ 		case 3:
+ 			vc->vc_italic = 1;
+ 			break;
++		case 21:
++			/*
++			 * No console drivers support double underline, so
++			 * convert it to a single underline.
++			 */
+ 		case 4:
+ 			vc->vc_underline = 1;
+ 			break;
+@@ -1389,7 +1394,6 @@ static void csi_m(struct vc_data *vc)
+ 			vc->vc_disp_ctrl = 1;
+ 			vc->vc_toggle_meta = 1;
+ 			break;
+-		case 21:
+ 		case 22:
+ 			vc->vc_intensity = 1;
+ 			break;
+diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c
+index 06d502b3e913..de1e759dd512 100644
+--- a/drivers/usb/serial/cp210x.c
++++ b/drivers/usb/serial/cp210x.c
+@@ -155,6 +155,7 @@ static const struct usb_device_id id_table[] = {
+ 	{ USB_DEVICE(0x12B8, 0xEC62) }, /* Link G4+ ECU */
+ 	{ USB_DEVICE(0x13AD, 0x9999) }, /* Baltech card reader */
+ 	{ USB_DEVICE(0x1555, 0x0004) }, /* Owen AC4 USB-RS485 Converter */
++	{ USB_DEVICE(0x155A, 0x1006) },	/* ELDAT Easywave RX09 */
+ 	{ USB_DEVICE(0x166A, 0x0201) }, /* Clipsal 5500PACA C-Bus Pascal Automation Controller */
+ 	{ USB_DEVICE(0x166A, 0x0301) }, /* Clipsal 5800PC C-Bus Wireless PC Interface */
+ 	{ USB_DEVICE(0x166A, 0x0303) }, /* Clipsal 5500PCU C-Bus USB interface */
+diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
+index fc68952c994a..e456617216f9 100644
+--- a/drivers/usb/serial/ftdi_sio.c
++++ b/drivers/usb/serial/ftdi_sio.c
+@@ -769,6 +769,7 @@ static const struct usb_device_id id_table_combined[] = {
+ 		.driver_info = (kernel_ulong_t)&ftdi_NDI_device_quirk },
+ 	{ USB_DEVICE(TELLDUS_VID, TELLDUS_TELLSTICK_PID) },
+ 	{ USB_DEVICE(NOVITUS_VID, NOVITUS_BONO_E_PID) },
++	{ USB_DEVICE(FTDI_VID, RTSYSTEMS_USB_VX8_PID) },
+ 	{ USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_S03_PID) },
+ 	{ USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_59_PID) },
+ 	{ USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_57A_PID) },
+@@ -931,6 +932,7 @@ static const struct usb_device_id id_table_combined[] = {
+ 	{ USB_DEVICE(FTDI_VID, FTDI_SCIENCESCOPE_LS_LOGBOOK_PID) },
+ 	{ USB_DEVICE(FTDI_VID, FTDI_SCIENCESCOPE_HS_LOGBOOK_PID) },
+ 	{ USB_DEVICE(FTDI_VID, FTDI_CINTERION_MC55I_PID) },
++	{ USB_DEVICE(FTDI_VID, FTDI_FHE_PID) },
+ 	{ USB_DEVICE(FTDI_VID, FTDI_DOTEC_PID) },
+ 	{ USB_DEVICE(QIHARDWARE_VID, MILKYMISTONE_JTAGSERIAL_PID),
+ 		.driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
+diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h
+index 8b4ecd2bd297..975d02666c5a 100644
+--- a/drivers/usb/serial/ftdi_sio_ids.h
++++ b/drivers/usb/serial/ftdi_sio_ids.h
+@@ -923,6 +923,9 @@
+ /*
+  * RT Systems programming cables for various ham radios
+  */
++/* This device uses the VID of FTDI */
++#define RTSYSTEMS_USB_VX8_PID   0x9e50  /* USB-VX8 USB to 7 pin modular plug for Yaesu VX-8 radio */
++
+ #define RTSYSTEMS_VID		0x2100	/* Vendor ID */
+ #define RTSYSTEMS_USB_S03_PID	0x9001	/* RTS-03 USB to Serial Adapter */
+ #define RTSYSTEMS_USB_59_PID	0x9e50	/* USB-59 USB to 8 pin plug */
+@@ -1441,6 +1444,12 @@
+  */
+ #define FTDI_CINTERION_MC55I_PID	0xA951
+ 
++/*
++ * Product: FirmwareHubEmulator
++ * Manufacturer: Harman Becker Automotive Systems
++ */
++#define FTDI_FHE_PID		0xA9A0
++
+ /*
+  * Product: Comet Caller ID decoder
+  * Manufacturer: Crucible Technologies
+diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
+index c04183cc2117..ae07b3a2fb5d 100644
+--- a/fs/btrfs/inode.c
++++ b/fs/btrfs/inode.c
+@@ -1257,6 +1257,8 @@ static noinline int csum_exist_in_range(struct btrfs_fs_info *fs_info,
+ 		list_del(&sums->list);
+ 		kfree(sums);
+ 	}
++	if (ret < 0)
++		return ret;
+ 	return 1;
+ }
+ 
+@@ -1389,10 +1391,23 @@ static noinline int run_delalloc_nocow(struct inode *inode,
+ 				goto out_check;
+ 			if (btrfs_extent_readonly(fs_info, disk_bytenr))
+ 				goto out_check;
+-			if (btrfs_cross_ref_exist(root, ino,
+-						  found_key.offset -
+-						  extent_offset, disk_bytenr))
++			ret = btrfs_cross_ref_exist(root, ino,
++						    found_key.offset -
++						    extent_offset, disk_bytenr);
++			if (ret) {
++				/*
++				 * ret could be -EIO if the above fails to read
++				 * metadata.
++				 */
++				if (ret < 0) {
++					if (cow_start != (u64)-1)
++						cur_offset = cow_start;
++					goto error;
++				}
++
++				WARN_ON_ONCE(nolock);
+ 				goto out_check;
++			}
+ 			disk_bytenr += extent_offset;
+ 			disk_bytenr += cur_offset - found_key.offset;
+ 			num_bytes = min(end + 1, extent_end) - cur_offset;
+@@ -1410,10 +1425,22 @@ static noinline int run_delalloc_nocow(struct inode *inode,
+ 			 * this ensure that csum for a given extent are
+ 			 * either valid or do not exist.
+ 			 */
+-			if (csum_exist_in_range(fs_info, disk_bytenr,
+-						num_bytes)) {
++			ret = csum_exist_in_range(fs_info, disk_bytenr,
++						  num_bytes);
++			if (ret) {
+ 				if (!nolock)
+ 					btrfs_end_write_no_snapshotting(root);
++
++				/*
++				 * ret could be -EIO if the above fails to read
++				 * metadata.
++				 */
++				if (ret < 0) {
++					if (cow_start != (u64)-1)
++						cur_offset = cow_start;
++					goto error;
++				}
++				WARN_ON_ONCE(nolock);
+ 				goto out_check;
+ 			}
+ 			if (!btrfs_inc_nocow_writers(fs_info, disk_bytenr)) {
+diff --git a/fs/ceph/file.c b/fs/ceph/file.c
+index 5c17125f45c7..0024d3e61bcd 100644
+--- a/fs/ceph/file.c
++++ b/fs/ceph/file.c
+@@ -635,7 +635,8 @@ static ssize_t ceph_sync_read(struct kiocb *iocb, struct iov_iter *to,
+ struct ceph_aio_request {
+ 	struct kiocb *iocb;
+ 	size_t total_len;
+-	int write;
++	bool write;
++	bool should_dirty;
+ 	int error;
+ 	struct list_head osd_reqs;
+ 	unsigned num_reqs;
+@@ -745,7 +746,7 @@ static void ceph_aio_complete_req(struct ceph_osd_request *req)
+ 		}
+ 	}
+ 
+-	ceph_put_page_vector(osd_data->pages, num_pages, !aio_req->write);
++	ceph_put_page_vector(osd_data->pages, num_pages, aio_req->should_dirty);
+ 	ceph_osdc_put_request(req);
+ 
+ 	if (rc < 0)
+@@ -842,6 +843,7 @@ ceph_direct_read_write(struct kiocb *iocb, struct iov_iter *iter,
+ 	size_t count = iov_iter_count(iter);
+ 	loff_t pos = iocb->ki_pos;
+ 	bool write = iov_iter_rw(iter) == WRITE;
++	bool should_dirty = !write && iter_is_iovec(iter);
+ 
+ 	if (write && ceph_snap(file_inode(file)) != CEPH_NOSNAP)
+ 		return -EROFS;
+@@ -909,6 +911,7 @@ ceph_direct_read_write(struct kiocb *iocb, struct iov_iter *iter,
+ 			if (aio_req) {
+ 				aio_req->iocb = iocb;
+ 				aio_req->write = write;
++				aio_req->should_dirty = should_dirty;
+ 				INIT_LIST_HEAD(&aio_req->osd_reqs);
+ 				if (write) {
+ 					aio_req->mtime = mtime;
+@@ -966,7 +969,7 @@ ceph_direct_read_write(struct kiocb *iocb, struct iov_iter *iter,
+ 				len = ret;
+ 		}
+ 
+-		ceph_put_page_vector(pages, num_pages, !write);
++		ceph_put_page_vector(pages, num_pages, should_dirty);
+ 
+ 		ceph_osdc_put_request(req);
+ 		if (ret < 0)
+diff --git a/include/linux/bitmap.h b/include/linux/bitmap.h
+index 3489253e38fc..1347b33399e1 100644
+--- a/include/linux/bitmap.h
++++ b/include/linux/bitmap.h
+@@ -271,12 +271,20 @@ static inline void bitmap_complement(unsigned long *dst, const unsigned long *sr
+ 		__bitmap_complement(dst, src, nbits);
+ }
+ 
++#ifdef __LITTLE_ENDIAN
++#define BITMAP_MEM_ALIGNMENT 8
++#else
++#define BITMAP_MEM_ALIGNMENT (8 * sizeof(unsigned long))
++#endif
++#define BITMAP_MEM_MASK (BITMAP_MEM_ALIGNMENT - 1)
++
+ static inline int bitmap_equal(const unsigned long *src1,
+ 			const unsigned long *src2, unsigned int nbits)
+ {
+ 	if (small_const_nbits(nbits))
+ 		return !((*src1 ^ *src2) & BITMAP_LAST_WORD_MASK(nbits));
+-	if (__builtin_constant_p(nbits & 7) && IS_ALIGNED(nbits, 8))
++	if (__builtin_constant_p(nbits & BITMAP_MEM_MASK) &&
++	    IS_ALIGNED(nbits, BITMAP_MEM_ALIGNMENT))
+ 		return !memcmp(src1, src2, nbits / 8);
+ 	return __bitmap_equal(src1, src2, nbits);
+ }
+@@ -327,8 +335,10 @@ static __always_inline void bitmap_set(unsigned long *map, unsigned int start,
+ {
+ 	if (__builtin_constant_p(nbits) && nbits == 1)
+ 		__set_bit(start, map);
+-	else if (__builtin_constant_p(start & 7) && IS_ALIGNED(start, 8) &&
+-		 __builtin_constant_p(nbits & 7) && IS_ALIGNED(nbits, 8))
++	else if (__builtin_constant_p(start & BITMAP_MEM_MASK) &&
++		 IS_ALIGNED(start, BITMAP_MEM_ALIGNMENT) &&
++		 __builtin_constant_p(nbits & BITMAP_MEM_MASK) &&
++		 IS_ALIGNED(nbits, BITMAP_MEM_ALIGNMENT))
+ 		memset((char *)map + start / 8, 0xff, nbits / 8);
+ 	else
+ 		__bitmap_set(map, start, nbits);
+@@ -339,8 +349,10 @@ static __always_inline void bitmap_clear(unsigned long *map, unsigned int start,
+ {
+ 	if (__builtin_constant_p(nbits) && nbits == 1)
+ 		__clear_bit(start, map);
+-	else if (__builtin_constant_p(start & 7) && IS_ALIGNED(start, 8) &&
+-		 __builtin_constant_p(nbits & 7) && IS_ALIGNED(nbits, 8))
++	else if (__builtin_constant_p(start & BITMAP_MEM_MASK) &&
++		 IS_ALIGNED(start, BITMAP_MEM_ALIGNMENT) &&
++		 __builtin_constant_p(nbits & BITMAP_MEM_MASK) &&
++		 IS_ALIGNED(nbits, BITMAP_MEM_ALIGNMENT))
+ 		memset((char *)map + start / 8, 0, nbits / 8);
+ 	else
+ 		__bitmap_clear(map, start, nbits);
+diff --git a/include/linux/netfilter/x_tables.h b/include/linux/netfilter/x_tables.h
+index 33f7530f96b9..8e46c35d654b 100644
+--- a/include/linux/netfilter/x_tables.h
++++ b/include/linux/netfilter/x_tables.h
+@@ -285,6 +285,8 @@ unsigned int *xt_alloc_entry_offsets(unsigned int size);
+ bool xt_find_jump_offset(const unsigned int *offsets,
+ 			 unsigned int target, unsigned int size);
+ 
++int xt_check_proc_name(const char *name, unsigned int size);
++
+ int xt_check_match(struct xt_mtchk_param *, unsigned int size, u_int8_t proto,
+ 		   bool inv_proto);
+ int xt_check_target(struct xt_tgchk_param *, unsigned int size, u_int8_t proto,
+diff --git a/include/rdma/ib_addr.h b/include/rdma/ib_addr.h
+index 18c564f60e93..60e5cabee928 100644
+--- a/include/rdma/ib_addr.h
++++ b/include/rdma/ib_addr.h
+@@ -130,6 +130,8 @@ void rdma_copy_addr(struct rdma_dev_addr *dev_addr,
+ 		    const unsigned char *dst_dev_addr);
+ 
+ int rdma_addr_size(struct sockaddr *addr);
++int rdma_addr_size_in6(struct sockaddr_in6 *addr);
++int rdma_addr_size_kss(struct __kernel_sockaddr_storage *addr);
+ 
+ int rdma_addr_find_smac_by_sgid(union ib_gid *sgid, u8 *smac, u16 *vlan_id);
+ int rdma_addr_find_l2_eth_by_grh(const union ib_gid *sgid,
+diff --git a/include/uapi/linux/serial_core.h b/include/uapi/linux/serial_core.h
+index 1c8413f93e3d..dce5f9dae121 100644
+--- a/include/uapi/linux/serial_core.h
++++ b/include/uapi/linux/serial_core.h
+@@ -76,6 +76,9 @@
+ #define PORT_SUNZILOG	38
+ #define PORT_SUNSAB	39
+ 
++/* Nuvoton UART */
++#define PORT_NPCM	40
++
+ /* Intel EG20 */
+ #define PORT_PCH_8LINE	44
+ #define PORT_PCH_2LINE	45
+diff --git a/ipc/shm.c b/ipc/shm.c
+index 7acda23430aa..50e88fc060b1 100644
+--- a/ipc/shm.c
++++ b/ipc/shm.c
+@@ -386,6 +386,17 @@ static int shm_fault(struct vm_fault *vmf)
+ 	return sfd->vm_ops->fault(vmf);
+ }
+ 
++static int shm_split(struct vm_area_struct *vma, unsigned long addr)
++{
++	struct file *file = vma->vm_file;
++	struct shm_file_data *sfd = shm_file_data(file);
++
++	if (sfd->vm_ops && sfd->vm_ops->split)
++		return sfd->vm_ops->split(vma, addr);
++
++	return 0;
++}
++
+ #ifdef CONFIG_NUMA
+ static int shm_set_policy(struct vm_area_struct *vma, struct mempolicy *new)
+ {
+@@ -510,6 +521,7 @@ static const struct vm_operations_struct shm_vm_ops = {
+ 	.open	= shm_open,	/* callback for a new vm-area open */
+ 	.close	= shm_close,	/* callback for when the vm-area is released */
+ 	.fault	= shm_fault,
++	.split	= shm_split,
+ #if defined(CONFIG_NUMA)
+ 	.set_policy = shm_set_policy,
+ 	.get_policy = shm_get_policy,
+diff --git a/kernel/events/hw_breakpoint.c b/kernel/events/hw_breakpoint.c
+index 3f8cb1e14588..253ae2da13c3 100644
+--- a/kernel/events/hw_breakpoint.c
++++ b/kernel/events/hw_breakpoint.c
+@@ -427,16 +427,9 @@ EXPORT_SYMBOL_GPL(register_user_hw_breakpoint);
+  * modify_user_hw_breakpoint - modify a user-space hardware breakpoint
+  * @bp: the breakpoint structure to modify
+  * @attr: new breakpoint attributes
+- * @triggered: callback to trigger when we hit the breakpoint
+- * @tsk: pointer to 'task_struct' of the process to which the address belongs
+  */
+ int modify_user_hw_breakpoint(struct perf_event *bp, struct perf_event_attr *attr)
+ {
+-	u64 old_addr = bp->attr.bp_addr;
+-	u64 old_len = bp->attr.bp_len;
+-	int old_type = bp->attr.bp_type;
+-	int err = 0;
+-
+ 	/*
+ 	 * modify_user_hw_breakpoint can be invoked with IRQs disabled and hence it
+ 	 * will not be possible to raise IPIs that invoke __perf_event_disable.
+@@ -451,27 +444,18 @@ int modify_user_hw_breakpoint(struct perf_event *bp, struct perf_event_attr *att
+ 	bp->attr.bp_addr = attr->bp_addr;
+ 	bp->attr.bp_type = attr->bp_type;
+ 	bp->attr.bp_len = attr->bp_len;
++	bp->attr.disabled = 1;
+ 
+-	if (attr->disabled)
+-		goto end;
+-
+-	err = validate_hw_breakpoint(bp);
+-	if (!err)
+-		perf_event_enable(bp);
++	if (!attr->disabled) {
++		int err = validate_hw_breakpoint(bp);
+ 
+-	if (err) {
+-		bp->attr.bp_addr = old_addr;
+-		bp->attr.bp_type = old_type;
+-		bp->attr.bp_len = old_len;
+-		if (!bp->attr.disabled)
+-			perf_event_enable(bp);
++		if (err)
++			return err;
+ 
+-		return err;
++		perf_event_enable(bp);
++		bp->attr.disabled = 0;
+ 	}
+ 
+-end:
+-	bp->attr.disabled = attr->disabled;
+-
+ 	return 0;
+ }
+ EXPORT_SYMBOL_GPL(modify_user_hw_breakpoint);
+diff --git a/mm/percpu-km.c b/mm/percpu-km.c
+index d2a76642c4ae..0d88d7bd5706 100644
+--- a/mm/percpu-km.c
++++ b/mm/percpu-km.c
+@@ -34,7 +34,7 @@
+ #include <linux/log2.h>
+ 
+ static int pcpu_populate_chunk(struct pcpu_chunk *chunk,
+-			       int page_start, int page_end)
++			       int page_start, int page_end, gfp_t gfp)
+ {
+ 	return 0;
+ }
+@@ -45,18 +45,18 @@ static void pcpu_depopulate_chunk(struct pcpu_chunk *chunk,
+ 	/* nada */
+ }
+ 
+-static struct pcpu_chunk *pcpu_create_chunk(void)
++static struct pcpu_chunk *pcpu_create_chunk(gfp_t gfp)
+ {
+ 	const int nr_pages = pcpu_group_sizes[0] >> PAGE_SHIFT;
+ 	struct pcpu_chunk *chunk;
+ 	struct page *pages;
+ 	int i;
+ 
+-	chunk = pcpu_alloc_chunk();
++	chunk = pcpu_alloc_chunk(gfp);
+ 	if (!chunk)
+ 		return NULL;
+ 
+-	pages = alloc_pages(GFP_KERNEL, order_base_2(nr_pages));
++	pages = alloc_pages(gfp | GFP_KERNEL, order_base_2(nr_pages));
+ 	if (!pages) {
+ 		pcpu_free_chunk(chunk);
+ 		return NULL;
+diff --git a/mm/percpu-vm.c b/mm/percpu-vm.c
+index 9158e5a81391..0af71eb2fff0 100644
+--- a/mm/percpu-vm.c
++++ b/mm/percpu-vm.c
+@@ -37,7 +37,7 @@ static struct page **pcpu_get_pages(void)
+ 	lockdep_assert_held(&pcpu_alloc_mutex);
+ 
+ 	if (!pages)
+-		pages = pcpu_mem_zalloc(pages_size);
++		pages = pcpu_mem_zalloc(pages_size, 0);
+ 	return pages;
+ }
+ 
+@@ -73,18 +73,21 @@ static void pcpu_free_pages(struct pcpu_chunk *chunk,
+  * @pages: array to put the allocated pages into, indexed by pcpu_page_idx()
+  * @page_start: page index of the first page to be allocated
+  * @page_end: page index of the last page to be allocated + 1
++ * @gfp: allocation flags passed to the underlying allocator
+  *
+  * Allocate pages [@page_start,@page_end) into @pages for all units.
+  * The allocation is for @chunk.  Percpu core doesn't care about the
+  * content of @pages and will pass it verbatim to pcpu_map_pages().
+  */
+ static int pcpu_alloc_pages(struct pcpu_chunk *chunk,
+-			    struct page **pages, int page_start, int page_end)
++			    struct page **pages, int page_start, int page_end,
++			    gfp_t gfp)
+ {
+-	const gfp_t gfp = GFP_KERNEL | __GFP_HIGHMEM;
+ 	unsigned int cpu, tcpu;
+ 	int i;
+ 
++	gfp |= GFP_KERNEL | __GFP_HIGHMEM;
++
+ 	for_each_possible_cpu(cpu) {
+ 		for (i = page_start; i < page_end; i++) {
+ 			struct page **pagep = &pages[pcpu_page_idx(cpu, i)];
+@@ -262,6 +265,7 @@ static void pcpu_post_map_flush(struct pcpu_chunk *chunk,
+  * @chunk: chunk of interest
+  * @page_start: the start page
+  * @page_end: the end page
++ * @gfp: allocation flags passed to the underlying memory allocator
+  *
+  * For each cpu, populate and map pages [@page_start,@page_end) into
+  * @chunk.
+@@ -270,7 +274,7 @@ static void pcpu_post_map_flush(struct pcpu_chunk *chunk,
+  * pcpu_alloc_mutex, does GFP_KERNEL allocation.
+  */
+ static int pcpu_populate_chunk(struct pcpu_chunk *chunk,
+-			       int page_start, int page_end)
++			       int page_start, int page_end, gfp_t gfp)
+ {
+ 	struct page **pages;
+ 
+@@ -278,7 +282,7 @@ static int pcpu_populate_chunk(struct pcpu_chunk *chunk,
+ 	if (!pages)
+ 		return -ENOMEM;
+ 
+-	if (pcpu_alloc_pages(chunk, pages, page_start, page_end))
++	if (pcpu_alloc_pages(chunk, pages, page_start, page_end, gfp))
+ 		return -ENOMEM;
+ 
+ 	if (pcpu_map_pages(chunk, pages, page_start, page_end)) {
+@@ -325,12 +329,12 @@ static void pcpu_depopulate_chunk(struct pcpu_chunk *chunk,
+ 	pcpu_free_pages(chunk, pages, page_start, page_end);
+ }
+ 
+-static struct pcpu_chunk *pcpu_create_chunk(void)
++static struct pcpu_chunk *pcpu_create_chunk(gfp_t gfp)
+ {
+ 	struct pcpu_chunk *chunk;
+ 	struct vm_struct **vms;
+ 
+-	chunk = pcpu_alloc_chunk();
++	chunk = pcpu_alloc_chunk(gfp);
+ 	if (!chunk)
+ 		return NULL;
+ 
+diff --git a/mm/percpu.c b/mm/percpu.c
+index 50e7fdf84055..3248afb3862c 100644
+--- a/mm/percpu.c
++++ b/mm/percpu.c
+@@ -447,10 +447,12 @@ static void pcpu_next_fit_region(struct pcpu_chunk *chunk, int alloc_bits,
+ /**
+  * pcpu_mem_zalloc - allocate memory
+  * @size: bytes to allocate
++ * @gfp: allocation flags
+  *
+  * Allocate @size bytes.  If @size is smaller than PAGE_SIZE,
+- * kzalloc() is used; otherwise, vzalloc() is used.  The returned
+- * memory is always zeroed.
++ * kzalloc() is used; otherwise, the equivalent of vzalloc() is used.
++ * This is to facilitate passing through whitelisted flags.  The
++ * returned memory is always zeroed.
+  *
+  * CONTEXT:
+  * Does GFP_KERNEL allocation.
+@@ -458,15 +460,16 @@ static void pcpu_next_fit_region(struct pcpu_chunk *chunk, int alloc_bits,
+  * RETURNS:
+  * Pointer to the allocated area on success, NULL on failure.
+  */
+-static void *pcpu_mem_zalloc(size_t size)
++static void *pcpu_mem_zalloc(size_t size, gfp_t gfp)
+ {
+ 	if (WARN_ON_ONCE(!slab_is_available()))
+ 		return NULL;
+ 
+ 	if (size <= PAGE_SIZE)
+-		return kzalloc(size, GFP_KERNEL);
++		return kzalloc(size, gfp | GFP_KERNEL);
+ 	else
+-		return vzalloc(size);
++		return __vmalloc(size, gfp | GFP_KERNEL | __GFP_ZERO,
++				 PAGE_KERNEL);
+ }
+ 
+ /**
+@@ -1154,12 +1157,12 @@ static struct pcpu_chunk * __init pcpu_alloc_first_chunk(unsigned long tmp_addr,
+ 	return chunk;
+ }
+ 
+-static struct pcpu_chunk *pcpu_alloc_chunk(void)
++static struct pcpu_chunk *pcpu_alloc_chunk(gfp_t gfp)
+ {
+ 	struct pcpu_chunk *chunk;
+ 	int region_bits;
+ 
+-	chunk = pcpu_mem_zalloc(pcpu_chunk_struct_size);
++	chunk = pcpu_mem_zalloc(pcpu_chunk_struct_size, gfp);
+ 	if (!chunk)
+ 		return NULL;
+ 
+@@ -1168,17 +1171,17 @@ static struct pcpu_chunk *pcpu_alloc_chunk(void)
+ 	region_bits = pcpu_chunk_map_bits(chunk);
+ 
+ 	chunk->alloc_map = pcpu_mem_zalloc(BITS_TO_LONGS(region_bits) *
+-					   sizeof(chunk->alloc_map[0]));
++					   sizeof(chunk->alloc_map[0]), gfp);
+ 	if (!chunk->alloc_map)
+ 		goto alloc_map_fail;
+ 
+ 	chunk->bound_map = pcpu_mem_zalloc(BITS_TO_LONGS(region_bits + 1) *
+-					   sizeof(chunk->bound_map[0]));
++					   sizeof(chunk->bound_map[0]), gfp);
+ 	if (!chunk->bound_map)
+ 		goto bound_map_fail;
+ 
+ 	chunk->md_blocks = pcpu_mem_zalloc(pcpu_chunk_nr_blocks(chunk) *
+-					   sizeof(chunk->md_blocks[0]));
++					   sizeof(chunk->md_blocks[0]), gfp);
+ 	if (!chunk->md_blocks)
+ 		goto md_blocks_fail;
+ 
+@@ -1277,9 +1280,10 @@ static void pcpu_chunk_depopulated(struct pcpu_chunk *chunk,
+  * pcpu_addr_to_page		- translate address to physical address
+  * pcpu_verify_alloc_info	- check alloc_info is acceptable during init
+  */
+-static int pcpu_populate_chunk(struct pcpu_chunk *chunk, int off, int size);
++static int pcpu_populate_chunk(struct pcpu_chunk *chunk, int off, int size,
++			       gfp_t gfp);
+ static void pcpu_depopulate_chunk(struct pcpu_chunk *chunk, int off, int size);
+-static struct pcpu_chunk *pcpu_create_chunk(void);
++static struct pcpu_chunk *pcpu_create_chunk(gfp_t gfp);
+ static void pcpu_destroy_chunk(struct pcpu_chunk *chunk);
+ static struct page *pcpu_addr_to_page(void *addr);
+ static int __init pcpu_verify_alloc_info(const struct pcpu_alloc_info *ai);
+@@ -1421,7 +1425,7 @@ static void __percpu *pcpu_alloc(size_t size, size_t align, bool reserved,
+ 	}
+ 
+ 	if (list_empty(&pcpu_slot[pcpu_nr_slots - 1])) {
+-		chunk = pcpu_create_chunk();
++		chunk = pcpu_create_chunk(0);
+ 		if (!chunk) {
+ 			err = "failed to allocate new chunk";
+ 			goto fail;
+@@ -1450,7 +1454,7 @@ static void __percpu *pcpu_alloc(size_t size, size_t align, bool reserved,
+ 					   page_start, page_end) {
+ 			WARN_ON(chunk->immutable);
+ 
+-			ret = pcpu_populate_chunk(chunk, rs, re);
++			ret = pcpu_populate_chunk(chunk, rs, re, 0);
+ 
+ 			spin_lock_irqsave(&pcpu_lock, flags);
+ 			if (ret) {
+@@ -1561,10 +1565,17 @@ void __percpu *__alloc_reserved_percpu(size_t size, size_t align)
+  * pcpu_balance_workfn - manage the amount of free chunks and populated pages
+  * @work: unused
+  *
+- * Reclaim all fully free chunks except for the first one.
++ * Reclaim all fully free chunks except for the first one.  This is also
++ * responsible for maintaining the pool of empty populated pages.  However,
++ * it is possible that this is called when physical memory is scarce causing
++ * OOM killer to be triggered.  We should avoid doing so until an actual
++ * allocation causes the failure as it is possible that requests can be
++ * serviced from already backed regions.
+  */
+ static void pcpu_balance_workfn(struct work_struct *work)
+ {
++	/* gfp flags passed to underlying allocators */
++	const gfp_t gfp = __GFP_NORETRY | __GFP_NOWARN;
+ 	LIST_HEAD(to_free);
+ 	struct list_head *free_head = &pcpu_slot[pcpu_nr_slots - 1];
+ 	struct pcpu_chunk *chunk, *next;
+@@ -1645,7 +1656,7 @@ static void pcpu_balance_workfn(struct work_struct *work)
+ 					   chunk->nr_pages) {
+ 			int nr = min(re - rs, nr_to_pop);
+ 
+-			ret = pcpu_populate_chunk(chunk, rs, rs + nr);
++			ret = pcpu_populate_chunk(chunk, rs, rs + nr, gfp);
+ 			if (!ret) {
+ 				nr_to_pop -= nr;
+ 				spin_lock_irq(&pcpu_lock);
+@@ -1662,7 +1673,7 @@ static void pcpu_balance_workfn(struct work_struct *work)
+ 
+ 	if (nr_to_pop) {
+ 		/* ran out of chunks to populate, create a new one and retry */
+-		chunk = pcpu_create_chunk();
++		chunk = pcpu_create_chunk(gfp);
+ 		if (chunk) {
+ 			spin_lock_irq(&pcpu_lock);
+ 			pcpu_chunk_relocate(chunk, -1);
+diff --git a/net/bluetooth/smp.c b/net/bluetooth/smp.c
+index 01117ae84f1d..a2ddae2f37d7 100644
+--- a/net/bluetooth/smp.c
++++ b/net/bluetooth/smp.c
+@@ -2296,8 +2296,14 @@ static u8 smp_cmd_security_req(struct l2cap_conn *conn, struct sk_buff *skb)
+ 	else
+ 		sec_level = authreq_to_seclevel(auth);
+ 
+-	if (smp_sufficient_security(hcon, sec_level, SMP_USE_LTK))
++	if (smp_sufficient_security(hcon, sec_level, SMP_USE_LTK)) {
++		/* If link is already encrypted with sufficient security we
++		 * still need refresh encryption as per Core Spec 5.0 Vol 3,
++		 * Part H 2.4.6
++		 */
++		smp_ltk_encrypt(conn, hcon->sec_level);
+ 		return 0;
++	}
+ 
+ 	if (sec_level > hcon->pending_sec_level)
+ 		hcon->pending_sec_level = sec_level;
+diff --git a/net/bridge/netfilter/ebt_among.c b/net/bridge/netfilter/ebt_among.c
+index 59baaecd3e54..0b589a6b365c 100644
+--- a/net/bridge/netfilter/ebt_among.c
++++ b/net/bridge/netfilter/ebt_among.c
+@@ -177,6 +177,28 @@ static bool poolsize_invalid(const struct ebt_mac_wormhash *w)
+ 	return w && w->poolsize >= (INT_MAX / sizeof(struct ebt_mac_wormhash_tuple));
+ }
+ 
++static bool wormhash_offset_invalid(int off, unsigned int len)
++{
++	if (off == 0) /* not present */
++		return false;
++
++	if (off < (int)sizeof(struct ebt_among_info) ||
++	    off % __alignof__(struct ebt_mac_wormhash))
++		return true;
++
++	off += sizeof(struct ebt_mac_wormhash);
++
++	return off > len;
++}
++
++static bool wormhash_sizes_valid(const struct ebt_mac_wormhash *wh, int a, int b)
++{
++	if (a == 0)
++		a = sizeof(struct ebt_among_info);
++
++	return ebt_mac_wormhash_size(wh) + a == b;
++}
++
+ static int ebt_among_mt_check(const struct xt_mtchk_param *par)
+ {
+ 	const struct ebt_among_info *info = par->matchinfo;
+@@ -189,6 +211,10 @@ static int ebt_among_mt_check(const struct xt_mtchk_param *par)
+ 	if (expected_length > em->match_size)
+ 		return -EINVAL;
+ 
++	if (wormhash_offset_invalid(info->wh_dst_ofs, em->match_size) ||
++	    wormhash_offset_invalid(info->wh_src_ofs, em->match_size))
++		return -EINVAL;
++
+ 	wh_dst = ebt_among_wh_dst(info);
+ 	if (poolsize_invalid(wh_dst))
+ 		return -EINVAL;
+@@ -201,6 +227,14 @@ static int ebt_among_mt_check(const struct xt_mtchk_param *par)
+ 	if (poolsize_invalid(wh_src))
+ 		return -EINVAL;
+ 
++	if (info->wh_src_ofs < info->wh_dst_ofs) {
++		if (!wormhash_sizes_valid(wh_src, info->wh_src_ofs, info->wh_dst_ofs))
++			return -EINVAL;
++	} else {
++		if (!wormhash_sizes_valid(wh_dst, info->wh_dst_ofs, info->wh_src_ofs))
++			return -EINVAL;
++	}
++
+ 	expected_length += ebt_mac_wormhash_size(wh_src);
+ 
+ 	if (em->match_size != EBT_ALIGN(expected_length)) {
+diff --git a/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c b/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
+index a5727036a8a8..a9670b642ba4 100644
+--- a/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
++++ b/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
+@@ -159,8 +159,20 @@ static unsigned int ipv4_conntrack_local(void *priv,
+ 	    ip_hdrlen(skb) < sizeof(struct iphdr))
+ 		return NF_ACCEPT;
+ 
+-	if (ip_is_fragment(ip_hdr(skb))) /* IP_NODEFRAG setsockopt set */
++	if (ip_is_fragment(ip_hdr(skb))) { /* IP_NODEFRAG setsockopt set */
++		enum ip_conntrack_info ctinfo;
++		struct nf_conn *tmpl;
++
++		tmpl = nf_ct_get(skb, &ctinfo);
++		if (tmpl && nf_ct_is_template(tmpl)) {
++			/* when skipping ct, clear templates to avoid fooling
++			 * later targets/matches
++			 */
++			skb->_nfct = 0;
++			nf_ct_put(tmpl);
++		}
+ 		return NF_ACCEPT;
++	}
+ 
+ 	return nf_conntrack_in(state->net, PF_INET, state->hook, skb);
+ }
+diff --git a/net/ipv6/ip6_vti.c b/net/ipv6/ip6_vti.c
+index fa3ae1cb50d3..8c184f84f353 100644
+--- a/net/ipv6/ip6_vti.c
++++ b/net/ipv6/ip6_vti.c
+@@ -626,7 +626,6 @@ static void vti6_link_config(struct ip6_tnl *t)
+ {
+ 	struct net_device *dev = t->dev;
+ 	struct __ip6_tnl_parm *p = &t->parms;
+-	struct net_device *tdev = NULL;
+ 
+ 	memcpy(dev->dev_addr, &p->laddr, sizeof(struct in6_addr));
+ 	memcpy(dev->broadcast, &p->raddr, sizeof(struct in6_addr));
+@@ -639,25 +638,6 @@ static void vti6_link_config(struct ip6_tnl *t)
+ 		dev->flags |= IFF_POINTOPOINT;
+ 	else
+ 		dev->flags &= ~IFF_POINTOPOINT;
+-
+-	if (p->flags & IP6_TNL_F_CAP_XMIT) {
+-		int strict = (ipv6_addr_type(&p->raddr) &
+-			      (IPV6_ADDR_MULTICAST | IPV6_ADDR_LINKLOCAL));
+-		struct rt6_info *rt = rt6_lookup(t->net,
+-						 &p->raddr, &p->laddr,
+-						 p->link, strict);
+-
+-		if (rt)
+-			tdev = rt->dst.dev;
+-		ip6_rt_put(rt);
+-	}
+-
+-	if (!tdev && p->link)
+-		tdev = __dev_get_by_index(t->net, p->link);
+-
+-	if (tdev)
+-		dev->mtu = max_t(int, tdev->mtu - dev->hard_header_len,
+-				 IPV6_MIN_MTU);
+ }
+ 
+ /**
+diff --git a/net/ipv6/route.c b/net/ipv6/route.c
+index 08a2a65d3304..1f0d94439c77 100644
+--- a/net/ipv6/route.c
++++ b/net/ipv6/route.c
+@@ -1627,11 +1627,10 @@ static void rt6_age_examine_exception(struct rt6_exception_bucket *bucket,
+ 		struct neighbour *neigh;
+ 		__u8 neigh_flags = 0;
+ 
+-		neigh = dst_neigh_lookup(&rt->dst, &rt->rt6i_gateway);
+-		if (neigh) {
++		neigh = __ipv6_neigh_lookup_noref(rt->dst.dev, &rt->rt6i_gateway);
++		if (neigh)
+ 			neigh_flags = neigh->flags;
+-			neigh_release(neigh);
+-		}
++
+ 		if (!(neigh_flags & NTF_ROUTER)) {
+ 			RT6_TRACE("purging route %p via non-router but gateway\n",
+ 				  rt);
+@@ -1655,7 +1654,8 @@ void rt6_age_exceptions(struct rt6_info *rt,
+ 	if (!rcu_access_pointer(rt->rt6i_exception_bucket))
+ 		return;
+ 
+-	spin_lock_bh(&rt6_exception_lock);
++	rcu_read_lock_bh();
++	spin_lock(&rt6_exception_lock);
+ 	bucket = rcu_dereference_protected(rt->rt6i_exception_bucket,
+ 				    lockdep_is_held(&rt6_exception_lock));
+ 
+@@ -1669,7 +1669,8 @@ void rt6_age_exceptions(struct rt6_info *rt,
+ 			bucket++;
+ 		}
+ 	}
+-	spin_unlock_bh(&rt6_exception_lock);
++	spin_unlock(&rt6_exception_lock);
++	rcu_read_unlock_bh();
+ }
+ 
+ struct rt6_info *ip6_pol_route(struct net *net, struct fib6_table *table,
+diff --git a/net/l2tp/l2tp_core.c b/net/l2tp/l2tp_core.c
+index e8b26afeb194..083fa2ffee15 100644
+--- a/net/l2tp/l2tp_core.c
++++ b/net/l2tp/l2tp_core.c
+@@ -111,6 +111,13 @@ struct l2tp_net {
+ 	spinlock_t l2tp_session_hlist_lock;
+ };
+ 
++#if IS_ENABLED(CONFIG_IPV6)
++static bool l2tp_sk_is_v6(struct sock *sk)
++{
++	return sk->sk_family == PF_INET6 &&
++	       !ipv6_addr_v4mapped(&sk->sk_v6_daddr);
++}
++#endif
+ 
+ static inline struct l2tp_tunnel *l2tp_tunnel(struct sock *sk)
+ {
+@@ -1058,7 +1065,7 @@ static int l2tp_xmit_core(struct l2tp_session *session, struct sk_buff *skb,
+ 	/* Queue the packet to IP for output */
+ 	skb->ignore_df = 1;
+ #if IS_ENABLED(CONFIG_IPV6)
+-	if (tunnel->sock->sk_family == PF_INET6 && !tunnel->v4mapped)
++	if (l2tp_sk_is_v6(tunnel->sock))
+ 		error = inet6_csk_xmit(tunnel->sock, skb, NULL);
+ 	else
+ #endif
+@@ -1121,6 +1128,15 @@ int l2tp_xmit_skb(struct l2tp_session *session, struct sk_buff *skb, int hdr_len
+ 		goto out_unlock;
+ 	}
+ 
++	/* The user-space may change the connection status for the user-space
++	 * provided socket at run time: we must check it under the socket lock
++	 */
++	if (tunnel->fd >= 0 && sk->sk_state != TCP_ESTABLISHED) {
++		kfree_skb(skb);
++		ret = NET_XMIT_DROP;
++		goto out_unlock;
++	}
++
+ 	/* Get routing info from the tunnel socket */
+ 	skb_dst_drop(skb);
+ 	skb_dst_set(skb, dst_clone(__sk_dst_check(sk, 0)));
+@@ -1140,7 +1156,7 @@ int l2tp_xmit_skb(struct l2tp_session *session, struct sk_buff *skb, int hdr_len
+ 
+ 		/* Calculate UDP checksum if configured to do so */
+ #if IS_ENABLED(CONFIG_IPV6)
+-		if (sk->sk_family == PF_INET6 && !tunnel->v4mapped)
++		if (l2tp_sk_is_v6(sk))
+ 			udp6_set_csum(udp_get_no_check6_tx(sk),
+ 				      skb, &inet6_sk(sk)->saddr,
+ 				      &sk->sk_v6_daddr, udp_len);
+@@ -1520,24 +1536,6 @@ int l2tp_tunnel_create(struct net *net, int fd, int version, u32 tunnel_id, u32
+ 	if (cfg != NULL)
+ 		tunnel->debug = cfg->debug;
+ 
+-#if IS_ENABLED(CONFIG_IPV6)
+-	if (sk->sk_family == PF_INET6) {
+-		struct ipv6_pinfo *np = inet6_sk(sk);
+-
+-		if (ipv6_addr_v4mapped(&np->saddr) &&
+-		    ipv6_addr_v4mapped(&sk->sk_v6_daddr)) {
+-			struct inet_sock *inet = inet_sk(sk);
+-
+-			tunnel->v4mapped = true;
+-			inet->inet_saddr = np->saddr.s6_addr32[3];
+-			inet->inet_rcv_saddr = sk->sk_v6_rcv_saddr.s6_addr32[3];
+-			inet->inet_daddr = sk->sk_v6_daddr.s6_addr32[3];
+-		} else {
+-			tunnel->v4mapped = false;
+-		}
+-	}
+-#endif
+-
+ 	/* Mark socket as an encapsulation socket. See net/ipv4/udp.c */
+ 	tunnel->encap = encap;
+ 	if (encap == L2TP_ENCAPTYPE_UDP) {
+diff --git a/net/l2tp/l2tp_core.h b/net/l2tp/l2tp_core.h
+index 8ecb1d357445..3fddfb207113 100644
+--- a/net/l2tp/l2tp_core.h
++++ b/net/l2tp/l2tp_core.h
+@@ -193,9 +193,6 @@ struct l2tp_tunnel {
+ 	struct sock		*sock;		/* Parent socket */
+ 	int			fd;		/* Parent fd, if tunnel socket
+ 						 * was created by userspace */
+-#if IS_ENABLED(CONFIG_IPV6)
+-	bool			v4mapped;
+-#endif
+ 
+ 	struct work_struct	del_work;
+ 
+diff --git a/net/netfilter/x_tables.c b/net/netfilter/x_tables.c
+index d7070d18db20..a33def530adf 100644
+--- a/net/netfilter/x_tables.c
++++ b/net/netfilter/x_tables.c
+@@ -423,6 +423,36 @@ textify_hooks(char *buf, size_t size, unsigned int mask, uint8_t nfproto)
+ 	return buf;
+ }
+ 
++/**
++ * xt_check_proc_name - check that name is suitable for /proc file creation
++ *
++ * @name: file name candidate
++ * @size: length of buffer
++ *
++ * some x_tables modules wish to create a file in /proc.
++ * This function makes sure that the name is suitable for this
++ * purpose, it checks that name is NUL terminated and isn't a 'special'
++ * name, like "..".
++ *
++ * returns negative number on error or 0 if name is useable.
++ */
++int xt_check_proc_name(const char *name, unsigned int size)
++{
++	if (name[0] == '\0')
++		return -EINVAL;
++
++	if (strnlen(name, size) == size)
++		return -ENAMETOOLONG;
++
++	if (strcmp(name, ".") == 0 ||
++	    strcmp(name, "..") == 0 ||
++	    strchr(name, '/'))
++		return -EINVAL;
++
++	return 0;
++}
++EXPORT_SYMBOL(xt_check_proc_name);
++
+ int xt_check_match(struct xt_mtchk_param *par,
+ 		   unsigned int size, u_int8_t proto, bool inv_proto)
+ {
+@@ -1008,7 +1038,12 @@ struct xt_table_info *xt_alloc_table_info(unsigned int size)
+ 	if ((size >> PAGE_SHIFT) + 2 > totalram_pages)
+ 		return NULL;
+ 
+-	info = kvmalloc(sz, GFP_KERNEL);
++	/* __GFP_NORETRY is not fully supported by kvmalloc but it should
++	 * work reasonably well if sz is too large and bail out rather
++	 * than shoot all processes down before realizing there is nothing
++	 * more to reclaim.
++	 */
++	info = kvmalloc(sz, GFP_KERNEL | __GFP_NORETRY);
+ 	if (!info)
+ 		return NULL;
+ 
+diff --git a/net/netfilter/xt_hashlimit.c b/net/netfilter/xt_hashlimit.c
+index b8a3e740ffd4..0c034597b9b8 100644
+--- a/net/netfilter/xt_hashlimit.c
++++ b/net/netfilter/xt_hashlimit.c
+@@ -915,8 +915,9 @@ static int hashlimit_mt_check_v1(const struct xt_mtchk_param *par)
+ 	struct hashlimit_cfg3 cfg = {};
+ 	int ret;
+ 
+-	if (info->name[sizeof(info->name) - 1] != '\0')
+-		return -EINVAL;
++	ret = xt_check_proc_name(info->name, sizeof(info->name));
++	if (ret)
++		return ret;
+ 
+ 	ret = cfg_copy(&cfg, (void *)&info->cfg, 1);
+ 
+@@ -933,8 +934,9 @@ static int hashlimit_mt_check_v2(const struct xt_mtchk_param *par)
+ 	struct hashlimit_cfg3 cfg = {};
+ 	int ret;
+ 
+-	if (info->name[sizeof(info->name) - 1] != '\0')
+-		return -EINVAL;
++	ret = xt_check_proc_name(info->name, sizeof(info->name));
++	if (ret)
++		return ret;
+ 
+ 	ret = cfg_copy(&cfg, (void *)&info->cfg, 2);
+ 
+@@ -948,9 +950,11 @@ static int hashlimit_mt_check_v2(const struct xt_mtchk_param *par)
+ static int hashlimit_mt_check(const struct xt_mtchk_param *par)
+ {
+ 	struct xt_hashlimit_mtinfo3 *info = par->matchinfo;
++	int ret;
+ 
+-	if (info->name[sizeof(info->name) - 1] != '\0')
+-		return -EINVAL;
++	ret = xt_check_proc_name(info->name, sizeof(info->name));
++	if (ret)
++		return ret;
+ 
+ 	return hashlimit_mt_check_common(par, &info->hinfo, &info->cfg,
+ 					 info->name, 3);
+diff --git a/net/netfilter/xt_recent.c b/net/netfilter/xt_recent.c
+index 245fa350a7a8..cf96d230e5a3 100644
+--- a/net/netfilter/xt_recent.c
++++ b/net/netfilter/xt_recent.c
+@@ -361,9 +361,9 @@ static int recent_mt_check(const struct xt_mtchk_param *par,
+ 			info->hit_count, XT_RECENT_MAX_NSTAMPS - 1);
+ 		return -EINVAL;
+ 	}
+-	if (info->name[0] == '\0' ||
+-	    strnlen(info->name, XT_RECENT_NAME_LEN) == XT_RECENT_NAME_LEN)
+-		return -EINVAL;
++	ret = xt_check_proc_name(info->name, sizeof(info->name));
++	if (ret)
++		return ret;
+ 
+ 	if (ip_pkt_list_tot && info->hit_count < ip_pkt_list_tot)
+ 		nstamp_mask = roundup_pow_of_two(ip_pkt_list_tot) - 1;
+diff --git a/net/xfrm/xfrm_ipcomp.c b/net/xfrm/xfrm_ipcomp.c
+index ccfdc7115a83..a00ec715aa46 100644
+--- a/net/xfrm/xfrm_ipcomp.c
++++ b/net/xfrm/xfrm_ipcomp.c
+@@ -283,7 +283,7 @@ static struct crypto_comp * __percpu *ipcomp_alloc_tfms(const char *alg_name)
+ 		struct crypto_comp *tfm;
+ 
+ 		/* This can be any valid CPU ID so we don't need locking. */
+-		tfm = __this_cpu_read(*pos->tfms);
++		tfm = this_cpu_read(*pos->tfms);
+ 
+ 		if (!strcmp(crypto_comp_name(tfm), alg_name)) {
+ 			pos->users++;
+diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c
+index 54e21f19d722..f9d2f2233f09 100644
+--- a/net/xfrm/xfrm_state.c
++++ b/net/xfrm/xfrm_state.c
+@@ -2056,6 +2056,11 @@ int xfrm_user_policy(struct sock *sk, int optname, u8 __user *optval, int optlen
+ 	struct xfrm_mgr *km;
+ 	struct xfrm_policy *pol = NULL;
+ 
++#ifdef CONFIG_COMPAT
++	if (in_compat_syscall())
++		return -EOPNOTSUPP;
++#endif
++
+ 	if (!optval && !optlen) {
+ 		xfrm_sk_policy_insert(sk, XFRM_POLICY_IN, NULL);
+ 		xfrm_sk_policy_insert(sk, XFRM_POLICY_OUT, NULL);
+diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
+index 7f52b8eb177d..080035f056d9 100644
+--- a/net/xfrm/xfrm_user.c
++++ b/net/xfrm/xfrm_user.c
+@@ -121,22 +121,17 @@ static inline int verify_replay(struct xfrm_usersa_info *p,
+ 	struct nlattr *rt = attrs[XFRMA_REPLAY_ESN_VAL];
+ 	struct xfrm_replay_state_esn *rs;
+ 
+-	if (p->flags & XFRM_STATE_ESN) {
+-		if (!rt)
+-			return -EINVAL;
++	if (!rt)
++		return (p->flags & XFRM_STATE_ESN) ? -EINVAL : 0;
+ 
+-		rs = nla_data(rt);
++	rs = nla_data(rt);
+ 
+-		if (rs->bmp_len > XFRMA_REPLAY_ESN_MAX / sizeof(rs->bmp[0]) / 8)
+-			return -EINVAL;
+-
+-		if (nla_len(rt) < (int)xfrm_replay_state_esn_len(rs) &&
+-		    nla_len(rt) != sizeof(*rs))
+-			return -EINVAL;
+-	}
++	if (rs->bmp_len > XFRMA_REPLAY_ESN_MAX / sizeof(rs->bmp[0]) / 8)
++		return -EINVAL;
+ 
+-	if (!rt)
+-		return 0;
++	if (nla_len(rt) < (int)xfrm_replay_state_esn_len(rs) &&
++	    nla_len(rt) != sizeof(*rs))
++		return -EINVAL;
+ 
+ 	/* As only ESP and AH support ESN feature. */
+ 	if ((p->id.proto != IPPROTO_ESP) && (p->id.proto != IPPROTO_AH))
+diff --git a/sound/core/oss/pcm_oss.c b/sound/core/oss/pcm_oss.c
+index 012881461058..d6e9a18fd821 100644
+--- a/sound/core/oss/pcm_oss.c
++++ b/sound/core/oss/pcm_oss.c
+@@ -1326,7 +1326,7 @@ static ssize_t snd_pcm_oss_write2(struct snd_pcm_substream *substream, const cha
+ static ssize_t snd_pcm_oss_write1(struct snd_pcm_substream *substream, const char __user *buf, size_t bytes)
+ {
+ 	size_t xfer = 0;
+-	ssize_t tmp;
++	ssize_t tmp = 0;
+ 	struct snd_pcm_runtime *runtime = substream->runtime;
+ 
+ 	if (atomic_read(&substream->mmap_count))
+@@ -1433,7 +1433,7 @@ static ssize_t snd_pcm_oss_read2(struct snd_pcm_substream *substream, char *buf,
+ static ssize_t snd_pcm_oss_read1(struct snd_pcm_substream *substream, char __user *buf, size_t bytes)
+ {
+ 	size_t xfer = 0;
+-	ssize_t tmp;
++	ssize_t tmp = 0;
+ 	struct snd_pcm_runtime *runtime = substream->runtime;
+ 
+ 	if (atomic_read(&substream->mmap_count))
+diff --git a/sound/core/pcm_native.c b/sound/core/pcm_native.c
+index f08772568c17..b01cc015a93c 100644
+--- a/sound/core/pcm_native.c
++++ b/sound/core/pcm_native.c
+@@ -3422,7 +3422,7 @@ int snd_pcm_lib_default_mmap(struct snd_pcm_substream *substream,
+ 					 area,
+ 					 substream->runtime->dma_area,
+ 					 substream->runtime->dma_addr,
+-					 area->vm_end - area->vm_start);
++					 substream->runtime->dma_bytes);
+ #endif /* CONFIG_X86 */
+ 	/* mmap with fault handler */
+ 	area->vm_ops = &snd_pcm_vm_ops_data_fault;
+diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c
+index ea8f3de92fa4..794224e1d6df 100644
+--- a/sound/usb/quirks.c
++++ b/sound/usb/quirks.c
+@@ -1171,6 +1171,7 @@ static bool is_teac_dsd_dac(unsigned int id)
+ 	switch (id) {
+ 	case USB_ID(0x0644, 0x8043): /* TEAC UD-501/UD-503/NT-503 */
+ 	case USB_ID(0x0644, 0x8044): /* Esoteric D-05X */
++	case USB_ID(0x0644, 0x804a): /* TEAC UD-301 */
+ 		return true;
+ 	}
+ 	return false;