[gentoo-commits] proj/linux-patches:4.19 commit in: /

[Mike Pagano]

commit:     754b21641176c91012ec25b458b4d7d40efab80b
Author:     Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Thu Jan  9 11:15:33 2020 +0000
Commit:     Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Thu Jan  9 11:15:33 2020 +0000
URL:        https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=754b2164

Linux patch 4.19.94

Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>

 0000_README              |    4 +
 1093_linux-4.19.94.patch | 4602 ++++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 4606 insertions(+)

diff --git a/0000_README b/0000_README
index bedb928..a11cb8a 100644
--- a/0000_README
+++ b/0000_README
@@ -411,6 +411,10 @@ Patch:  1092_linux-4.19.93.patch
 From:   https://www.kernel.org
 Desc:   Linux 4.19.93
 
+Patch:  1093_linux-4.19.94.patch
+From:   https://www.kernel.org
+Desc:   Linux 4.19.94
+
 Patch:  1500_XATTR_USER_PREFIX.patch
 From:   https://bugs.gentoo.org/show_bug.cgi?id=470644
 Desc:   Support for namespace user.pax.* on tmpfs.

diff --git a/1093_linux-4.19.94.patch b/1093_linux-4.19.94.patch
new file mode 100644
index 0000000..34de981
--- /dev/null
+++ b/1093_linux-4.19.94.patch
@@ -0,0 +1,4602 @@
+diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt
+index 2c0d6ae221a1..e6b6ec974eeb 100644
+--- a/Documentation/admin-guide/kernel-parameters.txt
++++ b/Documentation/admin-guide/kernel-parameters.txt
+@@ -113,7 +113,7 @@
+ 			the GPE dispatcher.
+ 			This facility can be used to prevent such uncontrolled
+ 			GPE floodings.
+-			Format: <int>
++			Format: <byte>
+ 
+ 	acpi_no_auto_serialize	[HW,ACPI]
+ 			Disable auto-serialization of AML methods
+diff --git a/Documentation/devicetree/bindings/clock/renesas,rcar-usb2-clock-sel.txt b/Documentation/devicetree/bindings/clock/renesas,rcar-usb2-clock-sel.txt
+index e96e085271c1..83f6c6a7c41c 100644
+--- a/Documentation/devicetree/bindings/clock/renesas,rcar-usb2-clock-sel.txt
++++ b/Documentation/devicetree/bindings/clock/renesas,rcar-usb2-clock-sel.txt
+@@ -46,7 +46,7 @@ Required properties:
+ Example (R-Car H3):
+ 
+ 	usb2_clksel: clock-controller@e6590630 {
+-		compatible = "renesas,r8a77950-rcar-usb2-clock-sel",
++		compatible = "renesas,r8a7795-rcar-usb2-clock-sel",
+ 			     "renesas,rcar-gen3-usb2-clock-sel";
+ 		reg = <0 0xe6590630 0 0x02>;
+ 		clocks = <&cpg CPG_MOD 703>, <&usb_extal>, <&usb_xtal>;
+diff --git a/Makefile b/Makefile
+index b3b166c93125..3c892a77194f 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 93
++SUBLEVEL = 94
+ EXTRAVERSION =
+ NAME = "People's Front"
+ 
+diff --git a/arch/arm64/boot/dts/amlogic/meson-gxbb-odroidc2.dts b/arch/arm64/boot/dts/amlogic/meson-gxbb-odroidc2.dts
+index 00f7be6d83f7..09a27e066d8e 100644
+--- a/arch/arm64/boot/dts/amlogic/meson-gxbb-odroidc2.dts
++++ b/arch/arm64/boot/dts/amlogic/meson-gxbb-odroidc2.dts
+@@ -293,7 +293,7 @@
+ };
+ 
+ &usb0_phy {
+-	status = "okay";
++	status = "disabled";
+ 	phy-supply = <&usb_otg_pwr>;
+ };
+ 
+@@ -303,7 +303,7 @@
+ };
+ 
+ &usb0 {
+-	status = "okay";
++	status = "disabled";
+ };
+ 
+ &usb1 {
+diff --git a/arch/arm64/include/asm/pgtable-prot.h b/arch/arm64/include/asm/pgtable-prot.h
+index e060c2746f36..5be015e2133a 100644
+--- a/arch/arm64/include/asm/pgtable-prot.h
++++ b/arch/arm64/include/asm/pgtable-prot.h
+@@ -96,13 +96,12 @@
+ #define PAGE_SHARED_EXEC	__pgprot(_PAGE_DEFAULT | PTE_USER | PTE_RDONLY | PTE_NG | PTE_PXN | PTE_WRITE)
+ #define PAGE_READONLY		__pgprot(_PAGE_DEFAULT | PTE_USER | PTE_RDONLY | PTE_NG | PTE_PXN | PTE_UXN)
+ #define PAGE_READONLY_EXEC	__pgprot(_PAGE_DEFAULT | PTE_USER | PTE_RDONLY | PTE_NG | PTE_PXN)
+-#define PAGE_EXECONLY		__pgprot(_PAGE_DEFAULT | PTE_RDONLY | PTE_NG | PTE_PXN)
+ 
+ #define __P000  PAGE_NONE
+ #define __P001  PAGE_READONLY
+ #define __P010  PAGE_READONLY
+ #define __P011  PAGE_READONLY
+-#define __P100  PAGE_EXECONLY
++#define __P100  PAGE_READONLY_EXEC
+ #define __P101  PAGE_READONLY_EXEC
+ #define __P110  PAGE_READONLY_EXEC
+ #define __P111  PAGE_READONLY_EXEC
+@@ -111,7 +110,7 @@
+ #define __S001  PAGE_READONLY
+ #define __S010  PAGE_SHARED
+ #define __S011  PAGE_SHARED
+-#define __S100  PAGE_EXECONLY
++#define __S100  PAGE_READONLY_EXEC
+ #define __S101  PAGE_READONLY_EXEC
+ #define __S110  PAGE_SHARED_EXEC
+ #define __S111  PAGE_SHARED_EXEC
+diff --git a/arch/arm64/include/asm/pgtable.h b/arch/arm64/include/asm/pgtable.h
+index 7ae553c15b9a..291fed0a9df8 100644
+--- a/arch/arm64/include/asm/pgtable.h
++++ b/arch/arm64/include/asm/pgtable.h
+@@ -105,12 +105,8 @@ extern unsigned long empty_zero_page[PAGE_SIZE / sizeof(unsigned long)];
+ #define pte_dirty(pte)		(pte_sw_dirty(pte) || pte_hw_dirty(pte))
+ 
+ #define pte_valid(pte)		(!!(pte_val(pte) & PTE_VALID))
+-/*
+- * Execute-only user mappings do not have the PTE_USER bit set. All valid
+- * kernel mappings have the PTE_UXN bit set.
+- */
+ #define pte_valid_not_user(pte) \
+-	((pte_val(pte) & (PTE_VALID | PTE_USER | PTE_UXN)) == (PTE_VALID | PTE_UXN))
++	((pte_val(pte) & (PTE_VALID | PTE_USER)) == PTE_VALID)
+ #define pte_valid_young(pte) \
+ 	((pte_val(pte) & (PTE_VALID | PTE_AF)) == (PTE_VALID | PTE_AF))
+ #define pte_valid_user(pte) \
+@@ -126,8 +122,8 @@ extern unsigned long empty_zero_page[PAGE_SIZE / sizeof(unsigned long)];
+ 
+ /*
+  * p??_access_permitted() is true for valid user mappings (subject to the
+- * write permission check) other than user execute-only which do not have the
+- * PTE_USER bit set. PROT_NONE mappings do not have the PTE_VALID bit set.
++ * write permission check). PROT_NONE mappings do not have the PTE_VALID bit
++ * set.
+  */
+ #define pte_access_permitted(pte, write) \
+ 	(pte_valid_user(pte) && (!(write) || pte_write(pte)))
+diff --git a/arch/arm64/mm/fault.c b/arch/arm64/mm/fault.c
+index 88cf0a0cb616..b046006a387f 100644
+--- a/arch/arm64/mm/fault.c
++++ b/arch/arm64/mm/fault.c
+@@ -428,7 +428,7 @@ static int __kprobes do_page_fault(unsigned long addr, unsigned int esr,
+ 	struct mm_struct *mm;
+ 	struct siginfo si;
+ 	vm_fault_t fault, major = 0;
+-	unsigned long vm_flags = VM_READ | VM_WRITE;
++	unsigned long vm_flags = VM_READ | VM_WRITE | VM_EXEC;
+ 	unsigned int mm_flags = FAULT_FLAG_ALLOW_RETRY | FAULT_FLAG_KILLABLE;
+ 
+ 	if (notify_page_fault(regs, esr))
+diff --git a/arch/mips/include/asm/thread_info.h b/arch/mips/include/asm/thread_info.h
+index 4993db40482c..ee26f9a4575d 100644
+--- a/arch/mips/include/asm/thread_info.h
++++ b/arch/mips/include/asm/thread_info.h
+@@ -49,8 +49,26 @@ struct thread_info {
+ 	.addr_limit	= KERNEL_DS,		\
+ }
+ 
+-/* How to get the thread information struct from C.  */
++/*
++ * A pointer to the struct thread_info for the currently executing thread is
++ * held in register $28/$gp.
++ *
++ * We declare __current_thread_info as a global register variable rather than a
++ * local register variable within current_thread_info() because clang doesn't
++ * support explicit local register variables.
++ *
++ * When building the VDSO we take care not to declare the global register
++ * variable because this causes GCC to not preserve the value of $28/$gp in
++ * functions that change its value (which is common in the PIC VDSO when
++ * accessing the GOT). Since the VDSO shouldn't be accessing
++ * __current_thread_info anyway we declare it extern in order to cause a link
++ * failure if it's referenced.
++ */
++#ifdef __VDSO__
++extern struct thread_info *__current_thread_info;
++#else
+ register struct thread_info *__current_thread_info __asm__("$28");
++#endif
+ 
+ static inline struct thread_info *current_thread_info(void)
+ {
+diff --git a/arch/powerpc/include/asm/kvm_ppc.h b/arch/powerpc/include/asm/kvm_ppc.h
+index e991821dd7fa..a061c3d48c48 100644
+--- a/arch/powerpc/include/asm/kvm_ppc.h
++++ b/arch/powerpc/include/asm/kvm_ppc.h
+@@ -458,9 +458,100 @@ static inline u32 kvmppc_get_xics_latch(void)
+ 	return xirr;
+ }
+ 
+-static inline void kvmppc_set_host_ipi(int cpu, u8 host_ipi)
++/*
++ * To avoid the need to unnecessarily exit fully to the host kernel, an IPI to
++ * a CPU thread that's running/napping inside of a guest is by default regarded
++ * as a request to wake the CPU (if needed) and continue execution within the
++ * guest, potentially to process new state like externally-generated
++ * interrupts or IPIs sent from within the guest itself (e.g. H_PROD/H_IPI).
++ *
++ * To force an exit to the host kernel, kvmppc_set_host_ipi() must be called
++ * prior to issuing the IPI to set the corresponding 'host_ipi' flag in the
++ * target CPU's PACA. To avoid unnecessary exits to the host, this flag should
++ * be immediately cleared via kvmppc_clear_host_ipi() by the IPI handler on
++ * the receiving side prior to processing the IPI work.
++ *
++ * NOTE:
++ *
++ * We currently issue an smp_mb() at the beginning of kvmppc_set_host_ipi().
++ * This is to guard against sequences such as the following:
++ *
++ *      CPU
++ *        X: smp_muxed_ipi_set_message():
++ *        X:   smp_mb()
++ *        X:   message[RESCHEDULE] = 1
++ *        X: doorbell_global_ipi(42):
++ *        X:   kvmppc_set_host_ipi(42)
++ *        X:   ppc_msgsnd_sync()/smp_mb()
++ *        X:   ppc_msgsnd() -> 42
++ *       42: doorbell_exception(): // from CPU X
++ *       42:   ppc_msgsync()
++ *      105: smp_muxed_ipi_set_message():
++ *      105:   smb_mb()
++ *           // STORE DEFERRED DUE TO RE-ORDERING
++ *    --105:   message[CALL_FUNCTION] = 1
++ *    | 105: doorbell_global_ipi(42):
++ *    | 105:   kvmppc_set_host_ipi(42)
++ *    |  42:   kvmppc_clear_host_ipi(42)
++ *    |  42: smp_ipi_demux_relaxed()
++ *    |  42: // returns to executing guest
++ *    |      // RE-ORDERED STORE COMPLETES
++ *    ->105:   message[CALL_FUNCTION] = 1
++ *      105:   ppc_msgsnd_sync()/smp_mb()
++ *      105:   ppc_msgsnd() -> 42
++ *       42: local_paca->kvm_hstate.host_ipi == 0 // IPI ignored
++ *      105: // hangs waiting on 42 to process messages/call_single_queue
++ *
++ * We also issue an smp_mb() at the end of kvmppc_clear_host_ipi(). This is
++ * to guard against sequences such as the following (as well as to create
++ * a read-side pairing with the barrier in kvmppc_set_host_ipi()):
++ *
++ *      CPU
++ *        X: smp_muxed_ipi_set_message():
++ *        X:   smp_mb()
++ *        X:   message[RESCHEDULE] = 1
++ *        X: doorbell_global_ipi(42):
++ *        X:   kvmppc_set_host_ipi(42)
++ *        X:   ppc_msgsnd_sync()/smp_mb()
++ *        X:   ppc_msgsnd() -> 42
++ *       42: doorbell_exception(): // from CPU X
++ *       42:   ppc_msgsync()
++ *           // STORE DEFERRED DUE TO RE-ORDERING
++ *    -- 42:   kvmppc_clear_host_ipi(42)
++ *    |  42: smp_ipi_demux_relaxed()
++ *    | 105: smp_muxed_ipi_set_message():
++ *    | 105:   smb_mb()
++ *    | 105:   message[CALL_FUNCTION] = 1
++ *    | 105: doorbell_global_ipi(42):
++ *    | 105:   kvmppc_set_host_ipi(42)
++ *    |      // RE-ORDERED STORE COMPLETES
++ *    -> 42:   kvmppc_clear_host_ipi(42)
++ *       42: // returns to executing guest
++ *      105:   ppc_msgsnd_sync()/smp_mb()
++ *      105:   ppc_msgsnd() -> 42
++ *       42: local_paca->kvm_hstate.host_ipi == 0 // IPI ignored
++ *      105: // hangs waiting on 42 to process messages/call_single_queue
++ */
++static inline void kvmppc_set_host_ipi(int cpu)
+ {
+-	paca_ptrs[cpu]->kvm_hstate.host_ipi = host_ipi;
++	/*
++	 * order stores of IPI messages vs. setting of host_ipi flag
++	 *
++	 * pairs with the barrier in kvmppc_clear_host_ipi()
++	 */
++	smp_mb();
++	paca_ptrs[cpu]->kvm_hstate.host_ipi = 1;
++}
++
++static inline void kvmppc_clear_host_ipi(int cpu)
++{
++	paca_ptrs[cpu]->kvm_hstate.host_ipi = 0;
++	/*
++	 * order clearing of host_ipi flag vs. processing of IPI messages
++	 *
++	 * pairs with the barrier in kvmppc_set_host_ipi()
++	 */
++	smp_mb();
+ }
+ 
+ static inline void kvmppc_fast_vcpu_kick(struct kvm_vcpu *vcpu)
+@@ -489,7 +580,10 @@ static inline u32 kvmppc_get_xics_latch(void)
+ 	return 0;
+ }
+ 
+-static inline void kvmppc_set_host_ipi(int cpu, u8 host_ipi)
++static inline void kvmppc_set_host_ipi(int cpu)
++{}
++
++static inline void kvmppc_clear_host_ipi(int cpu)
+ {}
+ 
+ static inline void kvmppc_fast_vcpu_kick(struct kvm_vcpu *vcpu)
+diff --git a/arch/powerpc/kernel/dbell.c b/arch/powerpc/kernel/dbell.c
+index b6fe883b1016..5828144555af 100644
+--- a/arch/powerpc/kernel/dbell.c
++++ b/arch/powerpc/kernel/dbell.c
+@@ -36,7 +36,7 @@ void doorbell_global_ipi(int cpu)
+ {
+ 	u32 tag = get_hard_smp_processor_id(cpu);
+ 
+-	kvmppc_set_host_ipi(cpu, 1);
++	kvmppc_set_host_ipi(cpu);
+ 	/* Order previous accesses vs. msgsnd, which is treated as a store */
+ 	ppc_msgsnd_sync();
+ 	ppc_msgsnd(PPC_DBELL_MSGTYPE, 0, tag);
+@@ -51,7 +51,7 @@ void doorbell_core_ipi(int cpu)
+ {
+ 	u32 tag = cpu_thread_in_core(cpu);
+ 
+-	kvmppc_set_host_ipi(cpu, 1);
++	kvmppc_set_host_ipi(cpu);
+ 	/* Order previous accesses vs. msgsnd, which is treated as a store */
+ 	ppc_msgsnd_sync();
+ 	ppc_msgsnd(PPC_DBELL_MSGTYPE, 0, tag);
+@@ -86,7 +86,7 @@ void doorbell_exception(struct pt_regs *regs)
+ 
+ 	may_hard_irq_enable();
+ 
+-	kvmppc_set_host_ipi(smp_processor_id(), 0);
++	kvmppc_clear_host_ipi(smp_processor_id());
+ 	__this_cpu_inc(irq_stat.doorbell_irqs);
+ 
+ 	smp_ipi_demux_relaxed(); /* already performed the barrier */
+diff --git a/arch/powerpc/kvm/book3s_hv_rm_xics.c b/arch/powerpc/kvm/book3s_hv_rm_xics.c
+index 758d1d23215e..aaafb9f080d5 100644
+--- a/arch/powerpc/kvm/book3s_hv_rm_xics.c
++++ b/arch/powerpc/kvm/book3s_hv_rm_xics.c
+@@ -61,7 +61,7 @@ static inline void icp_send_hcore_msg(int hcore, struct kvm_vcpu *vcpu)
+ 	hcpu = hcore << threads_shift;
+ 	kvmppc_host_rm_ops_hv->rm_core[hcore].rm_data = vcpu;
+ 	smp_muxed_ipi_set_message(hcpu, PPC_MSG_RM_HOST_ACTION);
+-	kvmppc_set_host_ipi(hcpu, 1);
++	kvmppc_set_host_ipi(hcpu);
+ 	smp_mb();
+ 	kvmhv_rm_send_ipi(hcpu);
+ }
+diff --git a/arch/powerpc/platforms/powernv/smp.c b/arch/powerpc/platforms/powernv/smp.c
+index fdd9577d1798..3d3c989e44dd 100644
+--- a/arch/powerpc/platforms/powernv/smp.c
++++ b/arch/powerpc/platforms/powernv/smp.c
+@@ -223,7 +223,7 @@ static void pnv_smp_cpu_kill_self(void)
+ 		 * for coming online, which are handled via
+ 		 * generic_check_cpu_restart() calls.
+ 		 */
+-		kvmppc_set_host_ipi(cpu, 0);
++		kvmppc_clear_host_ipi(cpu);
+ 
+ 		srr1 = pnv_cpu_offline(cpu);
+ 
+diff --git a/arch/powerpc/platforms/pseries/hvconsole.c b/arch/powerpc/platforms/pseries/hvconsole.c
+index 74da18de853a..73ec15cd2708 100644
+--- a/arch/powerpc/platforms/pseries/hvconsole.c
++++ b/arch/powerpc/platforms/pseries/hvconsole.c
+@@ -62,7 +62,7 @@ EXPORT_SYMBOL(hvc_get_chars);
+  * @vtermno: The vtermno or unit_address of the adapter from which the data
+  *	originated.
+  * @buf: The character buffer that contains the character data to send to
+- *	firmware.
++ *	firmware. Must be at least 16 bytes, even if count is less than 16.
+  * @count: Send this number of characters.
+  */
+ int hvc_put_chars(uint32_t vtermno, const char *buf, int count)
+diff --git a/arch/powerpc/sysdev/xics/icp-native.c b/arch/powerpc/sysdev/xics/icp-native.c
+index 37bfbc54aacb..340de58a15bd 100644
+--- a/arch/powerpc/sysdev/xics/icp-native.c
++++ b/arch/powerpc/sysdev/xics/icp-native.c
+@@ -145,7 +145,7 @@ static unsigned int icp_native_get_irq(void)
+ 
+ static void icp_native_cause_ipi(int cpu)
+ {
+-	kvmppc_set_host_ipi(cpu, 1);
++	kvmppc_set_host_ipi(cpu);
+ 	icp_native_set_qirr(cpu, IPI_PRIORITY);
+ }
+ 
+@@ -184,7 +184,7 @@ void icp_native_flush_interrupt(void)
+ 	if (vec == XICS_IPI) {
+ 		/* Clear pending IPI */
+ 		int cpu = smp_processor_id();
+-		kvmppc_set_host_ipi(cpu, 0);
++		kvmppc_clear_host_ipi(cpu);
+ 		icp_native_set_qirr(cpu, 0xff);
+ 	} else {
+ 		pr_err("XICS: hw interrupt 0x%x to offline cpu, disabling\n",
+@@ -205,7 +205,7 @@ static irqreturn_t icp_native_ipi_action(int irq, void *dev_id)
+ {
+ 	int cpu = smp_processor_id();
+ 
+-	kvmppc_set_host_ipi(cpu, 0);
++	kvmppc_clear_host_ipi(cpu);
+ 	icp_native_set_qirr(cpu, 0xff);
+ 
+ 	return smp_ipi_demux();
+diff --git a/arch/powerpc/sysdev/xics/icp-opal.c b/arch/powerpc/sysdev/xics/icp-opal.c
+index c71d2ea42627..e3e52cf035a9 100644
+--- a/arch/powerpc/sysdev/xics/icp-opal.c
++++ b/arch/powerpc/sysdev/xics/icp-opal.c
+@@ -130,7 +130,7 @@ static void icp_opal_cause_ipi(int cpu)
+ {
+ 	int hw_cpu = get_hard_smp_processor_id(cpu);
+ 
+-	kvmppc_set_host_ipi(cpu, 1);
++	kvmppc_set_host_ipi(cpu);
+ 	opal_int_set_mfrr(hw_cpu, IPI_PRIORITY);
+ }
+ 
+@@ -138,7 +138,7 @@ static irqreturn_t icp_opal_ipi_action(int irq, void *dev_id)
+ {
+ 	int cpu = smp_processor_id();
+ 
+-	kvmppc_set_host_ipi(cpu, 0);
++	kvmppc_clear_host_ipi(cpu);
+ 	opal_int_set_mfrr(get_hard_smp_processor_id(cpu), 0xff);
+ 
+ 	return smp_ipi_demux();
+@@ -161,7 +161,7 @@ void icp_opal_flush_interrupt(void)
+ 		if (vec == XICS_IPI) {
+ 			/* Clear pending IPI */
+ 			int cpu = smp_processor_id();
+-			kvmppc_set_host_ipi(cpu, 0);
++			kvmppc_clear_host_ipi(cpu);
+ 			opal_int_set_mfrr(get_hard_smp_processor_id(cpu), 0xff);
+ 		} else {
+ 			pr_err("XICS: hw interrupt 0x%x to offline cpu, "
+diff --git a/arch/riscv/kernel/ftrace.c b/arch/riscv/kernel/ftrace.c
+index a840b7d074f7..6d39f64e4dce 100644
+--- a/arch/riscv/kernel/ftrace.c
++++ b/arch/riscv/kernel/ftrace.c
+@@ -142,7 +142,7 @@ void prepare_ftrace_return(unsigned long *parent, unsigned long self_addr,
+ 	 */
+ 	old = *parent;
+ 
+-	if (function_graph_enter(old, self_addr, frame_pointer, parent))
++	if (!function_graph_enter(old, self_addr, frame_pointer, parent))
+ 		*parent = return_hooker;
+ }
+ 
+diff --git a/arch/s390/kernel/perf_cpum_sf.c b/arch/s390/kernel/perf_cpum_sf.c
+index 5c3fd9032b74..5bfb1ce129f4 100644
+--- a/arch/s390/kernel/perf_cpum_sf.c
++++ b/arch/s390/kernel/perf_cpum_sf.c
+@@ -1261,18 +1261,28 @@ static void hw_perf_event_update(struct perf_event *event, int flush_all)
+ 		 */
+ 		if (flush_all && done)
+ 			break;
+-
+-		/* If an event overflow happened, discard samples by
+-		 * processing any remaining sample-data-blocks.
+-		 */
+-		if (event_overflow)
+-			flush_all = 1;
+ 	}
+ 
+ 	/* Account sample overflows in the event hardware structure */
+ 	if (sampl_overflow)
+ 		OVERFLOW_REG(hwc) = DIV_ROUND_UP(OVERFLOW_REG(hwc) +
+ 						 sampl_overflow, 1 + num_sdb);
++
++	/* Perf_event_overflow() and perf_event_account_interrupt() limit
++	 * the interrupt rate to an upper limit. Roughly 1000 samples per
++	 * task tick.
++	 * Hitting this limit results in a large number
++	 * of throttled REF_REPORT_THROTTLE entries and the samples
++	 * are dropped.
++	 * Slightly increase the interval to avoid hitting this limit.
++	 */
++	if (event_overflow) {
++		SAMPL_RATE(hwc) += DIV_ROUND_UP(SAMPL_RATE(hwc), 10);
++		debug_sprintf_event(sfdbg, 1, "%s: rate adjustment %ld\n",
++				    __func__,
++				    DIV_ROUND_UP(SAMPL_RATE(hwc), 10));
++	}
++
+ 	if (sampl_overflow || event_overflow)
+ 		debug_sprintf_event(sfdbg, 4, "hw_perf_event_update: "
+ 				    "overflow stats: sample=%llu event=%llu\n",
+diff --git a/arch/s390/kernel/smp.c b/arch/s390/kernel/smp.c
+index df2413f26a8f..ecd24711f3aa 100644
+--- a/arch/s390/kernel/smp.c
++++ b/arch/s390/kernel/smp.c
+@@ -715,39 +715,67 @@ static void __ref smp_get_core_info(struct sclp_core_info *info, int early)
+ 
+ static int smp_add_present_cpu(int cpu);
+ 
+-static int __smp_rescan_cpus(struct sclp_core_info *info, int sysfs_add)
++static int smp_add_core(struct sclp_core_entry *core, cpumask_t *avail,
++			bool configured, bool early)
+ {
+ 	struct pcpu *pcpu;
+-	cpumask_t avail;
+-	int cpu, nr, i, j;
++	int cpu, nr, i;
+ 	u16 address;
+ 
+ 	nr = 0;
+-	cpumask_xor(&avail, cpu_possible_mask, cpu_present_mask);
+-	cpu = cpumask_first(&avail);
+-	for (i = 0; (i < info->combined) && (cpu < nr_cpu_ids); i++) {
+-		if (sclp.has_core_type && info->core[i].type != boot_core_type)
++	if (sclp.has_core_type && core->type != boot_core_type)
++		return nr;
++	cpu = cpumask_first(avail);
++	address = core->core_id << smp_cpu_mt_shift;
++	for (i = 0; (i <= smp_cpu_mtid) && (cpu < nr_cpu_ids); i++) {
++		if (pcpu_find_address(cpu_present_mask, address + i))
+ 			continue;
+-		address = info->core[i].core_id << smp_cpu_mt_shift;
+-		for (j = 0; j <= smp_cpu_mtid; j++) {
+-			if (pcpu_find_address(cpu_present_mask, address + j))
+-				continue;
+-			pcpu = pcpu_devices + cpu;
+-			pcpu->address = address + j;
+-			pcpu->state =
+-				(cpu >= info->configured*(smp_cpu_mtid + 1)) ?
+-				CPU_STATE_STANDBY : CPU_STATE_CONFIGURED;
+-			smp_cpu_set_polarization(cpu, POLARIZATION_UNKNOWN);
+-			set_cpu_present(cpu, true);
+-			if (sysfs_add && smp_add_present_cpu(cpu) != 0)
+-				set_cpu_present(cpu, false);
+-			else
+-				nr++;
+-			cpu = cpumask_next(cpu, &avail);
+-			if (cpu >= nr_cpu_ids)
++		pcpu = pcpu_devices + cpu;
++		pcpu->address = address + i;
++		if (configured)
++			pcpu->state = CPU_STATE_CONFIGURED;
++		else
++			pcpu->state = CPU_STATE_STANDBY;
++		smp_cpu_set_polarization(cpu, POLARIZATION_UNKNOWN);
++		set_cpu_present(cpu, true);
++		if (!early && smp_add_present_cpu(cpu) != 0)
++			set_cpu_present(cpu, false);
++		else
++			nr++;
++		cpumask_clear_cpu(cpu, avail);
++		cpu = cpumask_next(cpu, avail);
++	}
++	return nr;
++}
++
++static int __smp_rescan_cpus(struct sclp_core_info *info, bool early)
++{
++	struct sclp_core_entry *core;
++	cpumask_t avail;
++	bool configured;
++	u16 core_id;
++	int nr, i;
++
++	nr = 0;
++	cpumask_xor(&avail, cpu_possible_mask, cpu_present_mask);
++	/*
++	 * Add IPL core first (which got logical CPU number 0) to make sure
++	 * that all SMT threads get subsequent logical CPU numbers.
++	 */
++	if (early) {
++		core_id = pcpu_devices[0].address >> smp_cpu_mt_shift;
++		for (i = 0; i < info->configured; i++) {
++			core = &info->core[i];
++			if (core->core_id == core_id) {
++				nr += smp_add_core(core, &avail, true, early);
+ 				break;
++			}
+ 		}
+ 	}
++	for (i = 0; i < info->combined; i++) {
++		configured = i < info->configured;
++		nr += smp_add_core(&info->core[i], &avail, configured, early);
++	}
+ 	return nr;
+ }
+ 
+@@ -793,7 +821,7 @@ void __init smp_detect_cpus(void)
+ 
+ 	/* Add CPUs present at boot */
+ 	get_online_cpus();
+-	__smp_rescan_cpus(info, 0);
++	__smp_rescan_cpus(info, true);
+ 	put_online_cpus();
+ 	memblock_free_early((unsigned long)info, sizeof(*info));
+ }
+@@ -1145,7 +1173,7 @@ int __ref smp_rescan_cpus(void)
+ 	smp_get_core_info(info, 0);
+ 	get_online_cpus();
+ 	mutex_lock(&smp_cpu_state_mutex);
+-	nr = __smp_rescan_cpus(info, 1);
++	nr = __smp_rescan_cpus(info, false);
+ 	mutex_unlock(&smp_cpu_state_mutex);
+ 	put_online_cpus();
+ 	kfree(info);
+diff --git a/arch/x86/events/intel/bts.c b/arch/x86/events/intel/bts.c
+index 7139f6bf27ad..510f9461407e 100644
+--- a/arch/x86/events/intel/bts.c
++++ b/arch/x86/events/intel/bts.c
+@@ -71,9 +71,17 @@ struct bts_buffer {
+ 
+ static struct pmu bts_pmu;
+ 
++static int buf_nr_pages(struct page *page)
++{
++	if (!PagePrivate(page))
++		return 1;
++
++	return 1 << page_private(page);
++}
++
+ static size_t buf_size(struct page *page)
+ {
+-	return 1 << (PAGE_SHIFT + page_private(page));
++	return buf_nr_pages(page) * PAGE_SIZE;
+ }
+ 
+ static void *
+@@ -91,9 +99,7 @@ bts_buffer_setup_aux(struct perf_event *event, void **pages,
+ 	/* count all the high order buffers */
+ 	for (pg = 0, nbuf = 0; pg < nr_pages;) {
+ 		page = virt_to_page(pages[pg]);
+-		if (WARN_ON_ONCE(!PagePrivate(page) && nr_pages > 1))
+-			return NULL;
+-		pg += 1 << page_private(page);
++		pg += buf_nr_pages(page);
+ 		nbuf++;
+ 	}
+ 
+@@ -117,7 +123,7 @@ bts_buffer_setup_aux(struct perf_event *event, void **pages,
+ 		unsigned int __nr_pages;
+ 
+ 		page = virt_to_page(pages[pg]);
+-		__nr_pages = PagePrivate(page) ? 1 << page_private(page) : 1;
++		__nr_pages = buf_nr_pages(page);
+ 		buf->buf[nbuf].page = page;
+ 		buf->buf[nbuf].offset = offset;
+ 		buf->buf[nbuf].displacement = (pad ? BTS_RECORD_SIZE - pad : 0);
+diff --git a/block/compat_ioctl.c b/block/compat_ioctl.c
+index 6ca015f92766..6490b2759bcb 100644
+--- a/block/compat_ioctl.c
++++ b/block/compat_ioctl.c
+@@ -6,6 +6,7 @@
+ #include <linux/compat.h>
+ #include <linux/elevator.h>
+ #include <linux/hdreg.h>
++#include <linux/pr.h>
+ #include <linux/slab.h>
+ #include <linux/syscalls.h>
+ #include <linux/types.h>
+@@ -354,6 +355,8 @@ long compat_blkdev_ioctl(struct file *file, unsigned cmd, unsigned long arg)
+ 	 * but we call blkdev_ioctl, which gets the lock for us
+ 	 */
+ 	case BLKRRPART:
++	case BLKREPORTZONE:
++	case BLKRESETZONE:
+ 		return blkdev_ioctl(bdev, mode, cmd,
+ 				(unsigned long)compat_ptr(arg));
+ 	case BLKBSZSET_32:
+@@ -401,6 +404,14 @@ long compat_blkdev_ioctl(struct file *file, unsigned cmd, unsigned long arg)
+ 	case BLKTRACETEARDOWN: /* compatible */
+ 		ret = blk_trace_ioctl(bdev, cmd, compat_ptr(arg));
+ 		return ret;
++	case IOC_PR_REGISTER:
++	case IOC_PR_RESERVE:
++	case IOC_PR_RELEASE:
++	case IOC_PR_PREEMPT:
++	case IOC_PR_PREEMPT_ABORT:
++	case IOC_PR_CLEAR:
++		return blkdev_ioctl(bdev, mode, cmd,
++				(unsigned long)compat_ptr(arg));
+ 	default:
+ 		if (disk->fops->compat_ioctl)
+ 			ret = disk->fops->compat_ioctl(bdev, mode, cmd, arg);
+diff --git a/drivers/acpi/sysfs.c b/drivers/acpi/sysfs.c
+index 41324f0b1bee..f8150c7bfe88 100644
+--- a/drivers/acpi/sysfs.c
++++ b/drivers/acpi/sysfs.c
+@@ -816,14 +816,14 @@ end:
+  * interface:
+  *   echo unmask > /sys/firmware/acpi/interrupts/gpe00
+  */
+-#define ACPI_MASKABLE_GPE_MAX	0xFF
++#define ACPI_MASKABLE_GPE_MAX	0x100
+ static DECLARE_BITMAP(acpi_masked_gpes_map, ACPI_MASKABLE_GPE_MAX) __initdata;
+ 
+ static int __init acpi_gpe_set_masked_gpes(char *val)
+ {
+ 	u8 gpe;
+ 
+-	if (kstrtou8(val, 0, &gpe) || gpe > ACPI_MASKABLE_GPE_MAX)
++	if (kstrtou8(val, 0, &gpe))
+ 		return -EINVAL;
+ 	set_bit(gpe, acpi_masked_gpes_map);
+ 
+@@ -835,7 +835,7 @@ void __init acpi_gpe_apply_masked_gpes(void)
+ {
+ 	acpi_handle handle;
+ 	acpi_status status;
+-	u8 gpe;
++	u16 gpe;
+ 
+ 	for_each_set_bit(gpe, acpi_masked_gpes_map, ACPI_MASKABLE_GPE_MAX) {
+ 		status = acpi_get_gpe_device(gpe, &handle);
+diff --git a/drivers/ata/ahci_brcm.c b/drivers/ata/ahci_brcm.c
+index f3d557777d82..0192cab1b862 100644
+--- a/drivers/ata/ahci_brcm.c
++++ b/drivers/ata/ahci_brcm.c
+@@ -25,6 +25,7 @@
+ #include <linux/module.h>
+ #include <linux/of.h>
+ #include <linux/platform_device.h>
++#include <linux/reset.h>
+ #include <linux/string.h>
+ 
+ #include "ahci.h"
+@@ -84,8 +85,7 @@ enum brcm_ahci_version {
+ };
+ 
+ enum brcm_ahci_quirks {
+-	BRCM_AHCI_QUIRK_NO_NCQ		= BIT(0),
+-	BRCM_AHCI_QUIRK_SKIP_PHY_ENABLE	= BIT(1),
++	BRCM_AHCI_QUIRK_SKIP_PHY_ENABLE	= BIT(0),
+ };
+ 
+ struct brcm_ahci_priv {
+@@ -94,6 +94,7 @@ struct brcm_ahci_priv {
+ 	u32 port_mask;
+ 	u32 quirks;
+ 	enum brcm_ahci_version version;
++	struct reset_control *rcdev;
+ };
+ 
+ static inline u32 brcm_sata_readreg(void __iomem *addr)
+@@ -220,19 +221,12 @@ static void brcm_sata_phys_disable(struct brcm_ahci_priv *priv)
+ 			brcm_sata_phy_disable(priv, i);
+ }
+ 
+-static u32 brcm_ahci_get_portmask(struct platform_device *pdev,
++static u32 brcm_ahci_get_portmask(struct ahci_host_priv *hpriv,
+ 				  struct brcm_ahci_priv *priv)
+ {
+-	void __iomem *ahci;
+-	struct resource *res;
+ 	u32 impl;
+ 
+-	res = platform_get_resource_byname(pdev, IORESOURCE_MEM, "ahci");
+-	ahci = devm_ioremap_resource(&pdev->dev, res);
+-	if (IS_ERR(ahci))
+-		return 0;
+-
+-	impl = readl(ahci + HOST_PORTS_IMPL);
++	impl = readl(hpriv->mmio + HOST_PORTS_IMPL);
+ 
+ 	if (fls(impl) > SATA_TOP_MAX_PHYS)
+ 		dev_warn(priv->dev, "warning: more ports than PHYs (%#x)\n",
+@@ -240,9 +234,6 @@ static u32 brcm_ahci_get_portmask(struct platform_device *pdev,
+ 	else if (!impl)
+ 		dev_info(priv->dev, "no ports found\n");
+ 
+-	devm_iounmap(&pdev->dev, ahci);
+-	devm_release_mem_region(&pdev->dev, res->start, resource_size(res));
+-
+ 	return impl;
+ }
+ 
+@@ -292,6 +283,13 @@ static unsigned int brcm_ahci_read_id(struct ata_device *dev,
+ 	/* Perform the SATA PHY reset sequence */
+ 	brcm_sata_phy_disable(priv, ap->port_no);
+ 
++	/* Reset the SATA clock */
++	ahci_platform_disable_clks(hpriv);
++	msleep(10);
++
++	ahci_platform_enable_clks(hpriv);
++	msleep(10);
++
+ 	/* Bring the PHY back on */
+ 	brcm_sata_phy_enable(priv, ap->port_no);
+ 
+@@ -354,11 +352,10 @@ static int brcm_ahci_suspend(struct device *dev)
+ 	struct ata_host *host = dev_get_drvdata(dev);
+ 	struct ahci_host_priv *hpriv = host->private_data;
+ 	struct brcm_ahci_priv *priv = hpriv->plat_data;
+-	int ret;
+ 
+-	ret = ahci_platform_suspend(dev);
+ 	brcm_sata_phys_disable(priv);
+-	return ret;
++
++	return ahci_platform_suspend(dev);
+ }
+ 
+ static int brcm_ahci_resume(struct device *dev)
+@@ -366,11 +363,44 @@ static int brcm_ahci_resume(struct device *dev)
+ 	struct ata_host *host = dev_get_drvdata(dev);
+ 	struct ahci_host_priv *hpriv = host->private_data;
+ 	struct brcm_ahci_priv *priv = hpriv->plat_data;
++	int ret;
++
++	/* Make sure clocks are turned on before re-configuration */
++	ret = ahci_platform_enable_clks(hpriv);
++	if (ret)
++		return ret;
+ 
+ 	brcm_sata_init(priv);
+ 	brcm_sata_phys_enable(priv);
+ 	brcm_sata_alpm_init(hpriv);
+-	return ahci_platform_resume(dev);
++
++	/* Since we had to enable clocks earlier on, we cannot use
++	 * ahci_platform_resume() as-is since a second call to
++	 * ahci_platform_enable_resources() would bump up the resources
++	 * (regulators, clocks, PHYs) count artificially so we copy the part
++	 * after ahci_platform_enable_resources().
++	 */
++	ret = ahci_platform_enable_phys(hpriv);
++	if (ret)
++		goto out_disable_phys;
++
++	ret = ahci_platform_resume_host(dev);
++	if (ret)
++		goto out_disable_platform_phys;
++
++	/* We resumed so update PM runtime state */
++	pm_runtime_disable(dev);
++	pm_runtime_set_active(dev);
++	pm_runtime_enable(dev);
++
++	return 0;
++
++out_disable_platform_phys:
++	ahci_platform_disable_phys(hpriv);
++out_disable_phys:
++	brcm_sata_phys_disable(priv);
++	ahci_platform_disable_clks(hpriv);
++	return ret;
+ }
+ #endif
+ 
+@@ -411,44 +441,76 @@ static int brcm_ahci_probe(struct platform_device *pdev)
+ 	if (IS_ERR(priv->top_ctrl))
+ 		return PTR_ERR(priv->top_ctrl);
+ 
+-	if ((priv->version == BRCM_SATA_BCM7425) ||
+-		(priv->version == BRCM_SATA_NSP)) {
+-		priv->quirks |= BRCM_AHCI_QUIRK_NO_NCQ;
++	/* Reset is optional depending on platform */
++	priv->rcdev = devm_reset_control_get(&pdev->dev, "ahci");
++	if (!IS_ERR_OR_NULL(priv->rcdev))
++		reset_control_deassert(priv->rcdev);
++
++	hpriv = ahci_platform_get_resources(pdev, 0);
++	if (IS_ERR(hpriv)) {
++		ret = PTR_ERR(hpriv);
++		goto out_reset;
++	}
++
++	hpriv->plat_data = priv;
++	hpriv->flags = AHCI_HFLAG_WAKE_BEFORE_STOP | AHCI_HFLAG_NO_WRITE_TO_RO;
++
++	switch (priv->version) {
++	case BRCM_SATA_BCM7425:
++		hpriv->flags |= AHCI_HFLAG_DELAY_ENGINE;
++		/* fall through */
++	case BRCM_SATA_NSP:
++		hpriv->flags |= AHCI_HFLAG_NO_NCQ;
+ 		priv->quirks |= BRCM_AHCI_QUIRK_SKIP_PHY_ENABLE;
++		break;
++	default:
++		break;
+ 	}
+ 
++	ret = ahci_platform_enable_clks(hpriv);
++	if (ret)
++		goto out_reset;
++
++	/* Must be first so as to configure endianness including that
++	 * of the standard AHCI register space.
++	 */
+ 	brcm_sata_init(priv);
+ 
+-	priv->port_mask = brcm_ahci_get_portmask(pdev, priv);
+-	if (!priv->port_mask)
+-		return -ENODEV;
++	/* Initializes priv->port_mask which is used below */
++	priv->port_mask = brcm_ahci_get_portmask(hpriv, priv);
++	if (!priv->port_mask) {
++		ret = -ENODEV;
++		goto out_disable_clks;
++	}
+ 
++	/* Must be done before ahci_platform_enable_phys() */
+ 	brcm_sata_phys_enable(priv);
+ 
+-	hpriv = ahci_platform_get_resources(pdev, 0);
+-	if (IS_ERR(hpriv))
+-		return PTR_ERR(hpriv);
+-	hpriv->plat_data = priv;
+-	hpriv->flags = AHCI_HFLAG_WAKE_BEFORE_STOP;
+-
+ 	brcm_sata_alpm_init(hpriv);
+ 
+-	ret = ahci_platform_enable_resources(hpriv);
++	ret = ahci_platform_enable_phys(hpriv);
+ 	if (ret)
+-		return ret;
+-
+-	if (priv->quirks & BRCM_AHCI_QUIRK_NO_NCQ)
+-		hpriv->flags |= AHCI_HFLAG_NO_NCQ;
+-	hpriv->flags |= AHCI_HFLAG_NO_WRITE_TO_RO;
++		goto out_disable_phys;
+ 
+ 	ret = ahci_platform_init_host(pdev, hpriv, &ahci_brcm_port_info,
+ 				      &ahci_platform_sht);
+ 	if (ret)
+-		return ret;
++		goto out_disable_platform_phys;
+ 
+ 	dev_info(dev, "Broadcom AHCI SATA3 registered\n");
+ 
+ 	return 0;
++
++out_disable_platform_phys:
++	ahci_platform_disable_phys(hpriv);
++out_disable_phys:
++	brcm_sata_phys_disable(priv);
++out_disable_clks:
++	ahci_platform_disable_clks(hpriv);
++out_reset:
++	if (!IS_ERR_OR_NULL(priv->rcdev))
++		reset_control_assert(priv->rcdev);
++	return ret;
+ }
+ 
+ static int brcm_ahci_remove(struct platform_device *pdev)
+@@ -458,12 +520,12 @@ static int brcm_ahci_remove(struct platform_device *pdev)
+ 	struct brcm_ahci_priv *priv = hpriv->plat_data;
+ 	int ret;
+ 
++	brcm_sata_phys_disable(priv);
++
+ 	ret = ata_platform_remove_one(pdev);
+ 	if (ret)
+ 		return ret;
+ 
+-	brcm_sata_phys_disable(priv);
+-
+ 	return 0;
+ }
+ 
+diff --git a/drivers/ata/libahci_platform.c b/drivers/ata/libahci_platform.c
+index 5bece9752ed6..522b543f718d 100644
+--- a/drivers/ata/libahci_platform.c
++++ b/drivers/ata/libahci_platform.c
+@@ -47,7 +47,7 @@ EXPORT_SYMBOL_GPL(ahci_platform_ops);
+  * RETURNS:
+  * 0 on success otherwise a negative error code
+  */
+-static int ahci_platform_enable_phys(struct ahci_host_priv *hpriv)
++int ahci_platform_enable_phys(struct ahci_host_priv *hpriv)
+ {
+ 	int rc, i;
+ 
+@@ -72,6 +72,7 @@ disable_phys:
+ 	}
+ 	return rc;
+ }
++EXPORT_SYMBOL_GPL(ahci_platform_enable_phys);
+ 
+ /**
+  * ahci_platform_disable_phys - Disable PHYs
+@@ -79,7 +80,7 @@ disable_phys:
+  *
+  * This function disables all PHYs found in hpriv->phys.
+  */
+-static void ahci_platform_disable_phys(struct ahci_host_priv *hpriv)
++void ahci_platform_disable_phys(struct ahci_host_priv *hpriv)
+ {
+ 	int i;
+ 
+@@ -88,6 +89,7 @@ static void ahci_platform_disable_phys(struct ahci_host_priv *hpriv)
+ 		phy_exit(hpriv->phys[i]);
+ 	}
+ }
++EXPORT_SYMBOL_GPL(ahci_platform_disable_phys);
+ 
+ /**
+  * ahci_platform_enable_clks - Enable platform clocks
+diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
+index 85ee6c35d8e0..b45b6f7722ce 100644
+--- a/drivers/ata/libata-core.c
++++ b/drivers/ata/libata-core.c
+@@ -5343,6 +5343,30 @@ void ata_qc_complete(struct ata_queued_cmd *qc)
+ 	}
+ }
+ 
++/**
++ *	ata_qc_get_active - get bitmask of active qcs
++ *	@ap: port in question
++ *
++ *	LOCKING:
++ *	spin_lock_irqsave(host lock)
++ *
++ *	RETURNS:
++ *	Bitmask of active qcs
++ */
++u64 ata_qc_get_active(struct ata_port *ap)
++{
++	u64 qc_active = ap->qc_active;
++
++	/* ATA_TAG_INTERNAL is sent to hw as tag 0 */
++	if (qc_active & (1ULL << ATA_TAG_INTERNAL)) {
++		qc_active |= (1 << 0);
++		qc_active &= ~(1ULL << ATA_TAG_INTERNAL);
++	}
++
++	return qc_active;
++}
++EXPORT_SYMBOL_GPL(ata_qc_get_active);
++
+ /**
+  *	ata_qc_complete_multiple - Complete multiple qcs successfully
+  *	@ap: port in question
+diff --git a/drivers/ata/sata_fsl.c b/drivers/ata/sata_fsl.c
+index 4dc528bf8e85..ae52a45fab5f 100644
+--- a/drivers/ata/sata_fsl.c
++++ b/drivers/ata/sata_fsl.c
+@@ -1283,7 +1283,7 @@ static void sata_fsl_host_intr(struct ata_port *ap)
+ 				     i, ioread32(hcr_base + CC),
+ 				     ioread32(hcr_base + CA));
+ 		}
+-		ata_qc_complete_multiple(ap, ap->qc_active ^ done_mask);
++		ata_qc_complete_multiple(ap, ata_qc_get_active(ap) ^ done_mask);
+ 		return;
+ 
+ 	} else if ((ap->qc_active & (1ULL << ATA_TAG_INTERNAL))) {
+diff --git a/drivers/ata/sata_mv.c b/drivers/ata/sata_mv.c
+index 73ba8e134ca9..ab2e9f62ddc1 100644
+--- a/drivers/ata/sata_mv.c
++++ b/drivers/ata/sata_mv.c
+@@ -2840,7 +2840,7 @@ static void mv_process_crpb_entries(struct ata_port *ap, struct mv_port_priv *pp
+ 	}
+ 
+ 	if (work_done) {
+-		ata_qc_complete_multiple(ap, ap->qc_active ^ done_mask);
++		ata_qc_complete_multiple(ap, ata_qc_get_active(ap) ^ done_mask);
+ 
+ 		/* Update the software queue position index in hardware */
+ 		writelfl((pp->crpb_dma & EDMA_RSP_Q_BASE_LO_MASK) |
+diff --git a/drivers/ata/sata_nv.c b/drivers/ata/sata_nv.c
+index 72c9b922a77b..761577d57ff3 100644
+--- a/drivers/ata/sata_nv.c
++++ b/drivers/ata/sata_nv.c
+@@ -1000,7 +1000,7 @@ static irqreturn_t nv_adma_interrupt(int irq, void *dev_instance)
+ 					check_commands = 0;
+ 				check_commands &= ~(1 << pos);
+ 			}
+-			ata_qc_complete_multiple(ap, ap->qc_active ^ done_mask);
++			ata_qc_complete_multiple(ap, ata_qc_get_active(ap) ^ done_mask);
+ 		}
+ 	}
+ 
+diff --git a/drivers/block/xen-blkback/blkback.c b/drivers/block/xen-blkback/blkback.c
+index fd1e19f1a49f..3666afa639d1 100644
+--- a/drivers/block/xen-blkback/blkback.c
++++ b/drivers/block/xen-blkback/blkback.c
+@@ -936,6 +936,8 @@ next:
+ out_of_memory:
+ 	pr_alert("%s: out of memory\n", __func__);
+ 	put_free_pages(ring, pages_to_gnt, segs_to_map);
++	for (i = last_map; i < num; i++)
++		pages[i]->handle = BLKBACK_INVALID_HANDLE;
+ 	return -ENOMEM;
+ }
+ 
+diff --git a/drivers/block/xen-blkback/xenbus.c b/drivers/block/xen-blkback/xenbus.c
+index 55869b362fdf..25c41ce070a7 100644
+--- a/drivers/block/xen-blkback/xenbus.c
++++ b/drivers/block/xen-blkback/xenbus.c
+@@ -179,6 +179,15 @@ static struct xen_blkif *xen_blkif_alloc(domid_t domid)
+ 	blkif->domid = domid;
+ 	atomic_set(&blkif->refcnt, 1);
+ 	init_completion(&blkif->drain_complete);
++
++	/*
++	 * Because freeing back to the cache may be deferred, it is not
++	 * safe to unload the module (and hence destroy the cache) until
++	 * this has completed. To prevent premature unloading, take an
++	 * extra module reference here and release only when the object
++	 * has been freed back to the cache.
++	 */
++	__module_get(THIS_MODULE);
+ 	INIT_WORK(&blkif->free_work, xen_blkif_deferred_free);
+ 
+ 	return blkif;
+@@ -328,6 +337,7 @@ static void xen_blkif_free(struct xen_blkif *blkif)
+ 
+ 	/* Make sure everything is drained before shutting down */
+ 	kmem_cache_free(xen_blkif_cachep, blkif);
++	module_put(THIS_MODULE);
+ }
+ 
+ int __init xen_blkif_interface_init(void)
+diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
+index 08936bf696d3..1b0adf5c2376 100644
+--- a/drivers/bluetooth/btusb.c
++++ b/drivers/bluetooth/btusb.c
+@@ -1138,7 +1138,7 @@ static int btusb_open(struct hci_dev *hdev)
+ 	if (data->setup_on_usb) {
+ 		err = data->setup_on_usb(hdev);
+ 		if (err < 0)
+-			return err;
++			goto setup_fail;
+ 	}
+ 
+ 	data->intf->needs_remote_wakeup = 1;
+@@ -1170,6 +1170,7 @@ done:
+ 
+ failed:
+ 	clear_bit(BTUSB_INTR_RUNNING, &data->flags);
++setup_fail:
+ 	usb_autopm_put_interface(data->intf);
+ 	return err;
+ }
+diff --git a/drivers/devfreq/devfreq.c b/drivers/devfreq/devfreq.c
+index 61fbaa89d7b4..1229bfb3180e 100644
+--- a/drivers/devfreq/devfreq.c
++++ b/drivers/devfreq/devfreq.c
+@@ -538,26 +538,30 @@ static int devfreq_notifier_call(struct notifier_block *nb, unsigned long type,
+ 				 void *devp)
+ {
+ 	struct devfreq *devfreq = container_of(nb, struct devfreq, nb);
+-	int ret;
++	int err = -EINVAL;
+ 
+ 	mutex_lock(&devfreq->lock);
+ 
+ 	devfreq->scaling_min_freq = find_available_min_freq(devfreq);
+-	if (!devfreq->scaling_min_freq) {
+-		mutex_unlock(&devfreq->lock);
+-		return -EINVAL;
+-	}
++	if (!devfreq->scaling_min_freq)
++		goto out;
+ 
+ 	devfreq->scaling_max_freq = find_available_max_freq(devfreq);
+ 	if (!devfreq->scaling_max_freq) {
+-		mutex_unlock(&devfreq->lock);
+-		return -EINVAL;
++		devfreq->scaling_max_freq = ULONG_MAX;
++		goto out;
+ 	}
+ 
+-	ret = update_devfreq(devfreq);
++	err = update_devfreq(devfreq);
++
++out:
+ 	mutex_unlock(&devfreq->lock);
++	if (err)
++		dev_err(devfreq->dev.parent,
++			"failed to update frequency from OPP notifier (%d)\n",
++			err);
+ 
+-	return ret;
++	return NOTIFY_OK;
+ }
+ 
+ /**
+@@ -571,11 +575,6 @@ static void devfreq_dev_release(struct device *dev)
+ 	struct devfreq *devfreq = to_devfreq(dev);
+ 
+ 	mutex_lock(&devfreq_list_lock);
+-	if (IS_ERR(find_device_devfreq(devfreq->dev.parent))) {
+-		mutex_unlock(&devfreq_list_lock);
+-		dev_warn(&devfreq->dev, "releasing devfreq which doesn't exist\n");
+-		return;
+-	}
+ 	list_del(&devfreq->node);
+ 	mutex_unlock(&devfreq_list_lock);
+ 
+@@ -630,6 +629,7 @@ struct devfreq *devfreq_add_device(struct device *dev,
+ 	devfreq->dev.parent = dev;
+ 	devfreq->dev.class = devfreq_class;
+ 	devfreq->dev.release = devfreq_dev_release;
++	INIT_LIST_HEAD(&devfreq->node);
+ 	devfreq->profile = profile;
+ 	strncpy(devfreq->governor_name, governor_name, DEVFREQ_NAME_LEN);
+ 	devfreq->previous_freq = profile->initial_freq;
+@@ -1086,7 +1086,7 @@ static ssize_t available_governors_show(struct device *d,
+ 	 * The devfreq with immutable governor (e.g., passive) shows
+ 	 * only own governor.
+ 	 */
+-	if (df->governor->immutable) {
++	if (df->governor && df->governor->immutable) {
+ 		count = scnprintf(&buf[count], DEVFREQ_NAME_LEN,
+ 				   "%s ", df->governor_name);
+ 	/*
+diff --git a/drivers/firewire/net.c b/drivers/firewire/net.c
+index 82ba110d9d1a..bbabfca812bb 100644
+--- a/drivers/firewire/net.c
++++ b/drivers/firewire/net.c
+@@ -249,7 +249,11 @@ static int fwnet_header_cache(const struct neighbour *neigh,
+ 	h = (struct fwnet_header *)((u8 *)hh->hh_data + HH_DATA_OFF(sizeof(*h)));
+ 	h->h_proto = type;
+ 	memcpy(h->h_dest, neigh->ha, net->addr_len);
+-	hh->hh_len = FWNET_HLEN;
++
++	/* Pairs with the READ_ONCE() in neigh_resolve_output(),
++	 * neigh_hh_output() and neigh_update_hhs().
++	 */
++	smp_store_release(&hh->hh_len, FWNET_HLEN);
+ 
+ 	return 0;
+ }
+diff --git a/drivers/gpio/gpiolib.c b/drivers/gpio/gpiolib.c
+index b81a27c7f89c..a24f13df42f4 100644
+--- a/drivers/gpio/gpiolib.c
++++ b/drivers/gpio/gpiolib.c
+@@ -217,6 +217,14 @@ int gpiod_get_direction(struct gpio_desc *desc)
+ 	chip = gpiod_to_chip(desc);
+ 	offset = gpio_chip_hwgpio(desc);
+ 
++	/*
++	 * Open drain emulation using input mode may incorrectly report
++	 * input here, fix that up.
++	 */
++	if (test_bit(FLAG_OPEN_DRAIN, &desc->flags) &&
++	    test_bit(FLAG_IS_OUT, &desc->flags))
++		return 0;
++
+ 	if (!chip->get_direction)
+ 		return status;
+ 
+diff --git a/drivers/gpu/drm/amd/amdgpu/df_v3_6.c b/drivers/gpu/drm/amd/amdgpu/df_v3_6.c
+index d5ebe566809b..a1c941229f4b 100644
+--- a/drivers/gpu/drm/amd/amdgpu/df_v3_6.c
++++ b/drivers/gpu/drm/amd/amdgpu/df_v3_6.c
+@@ -75,23 +75,29 @@ static void df_v3_6_update_medium_grain_clock_gating(struct amdgpu_device *adev,
+ {
+ 	u32 tmp;
+ 
+-	/* Put DF on broadcast mode */
+-	adev->df_funcs->enable_broadcast_mode(adev, true);
+-
+-	if (enable && (adev->cg_flags & AMD_CG_SUPPORT_DF_MGCG)) {
+-		tmp = RREG32_SOC15(DF, 0, mmDF_PIE_AON0_DfGlobalClkGater);
+-		tmp &= ~DF_PIE_AON0_DfGlobalClkGater__MGCGMode_MASK;
+-		tmp |= DF_V3_6_MGCG_ENABLE_15_CYCLE_DELAY;
+-		WREG32_SOC15(DF, 0, mmDF_PIE_AON0_DfGlobalClkGater, tmp);
+-	} else {
+-		tmp = RREG32_SOC15(DF, 0, mmDF_PIE_AON0_DfGlobalClkGater);
+-		tmp &= ~DF_PIE_AON0_DfGlobalClkGater__MGCGMode_MASK;
+-		tmp |= DF_V3_6_MGCG_DISABLE;
+-		WREG32_SOC15(DF, 0, mmDF_PIE_AON0_DfGlobalClkGater, tmp);
++	if (adev->cg_flags & AMD_CG_SUPPORT_DF_MGCG) {
++		/* Put DF on broadcast mode */
++		adev->df_funcs->enable_broadcast_mode(adev, true);
++
++		if (enable) {
++			tmp = RREG32_SOC15(DF, 0,
++					mmDF_PIE_AON0_DfGlobalClkGater);
++			tmp &= ~DF_PIE_AON0_DfGlobalClkGater__MGCGMode_MASK;
++			tmp |= DF_V3_6_MGCG_ENABLE_15_CYCLE_DELAY;
++			WREG32_SOC15(DF, 0,
++					mmDF_PIE_AON0_DfGlobalClkGater, tmp);
++		} else {
++			tmp = RREG32_SOC15(DF, 0,
++					mmDF_PIE_AON0_DfGlobalClkGater);
++			tmp &= ~DF_PIE_AON0_DfGlobalClkGater__MGCGMode_MASK;
++			tmp |= DF_V3_6_MGCG_DISABLE;
++			WREG32_SOC15(DF, 0,
++					mmDF_PIE_AON0_DfGlobalClkGater, tmp);
++		}
++
++		/* Exit broadcast mode */
++		adev->df_funcs->enable_broadcast_mode(adev, false);
+ 	}
+-
+-	/* Exit broadcast mode */
+-	adev->df_funcs->enable_broadcast_mode(adev, false);
+ }
+ 
+ static void df_v3_6_get_clockgating_state(struct amdgpu_device *adev,
+diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c b/drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c
+index 5a9534a82d40..e1cb7fa89e4d 100644
+--- a/drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c
++++ b/drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c
+@@ -6405,7 +6405,23 @@ static void gfx_v8_0_ring_emit_fence_gfx(struct amdgpu_ring *ring, u64 addr,
+ 	bool write64bit = flags & AMDGPU_FENCE_FLAG_64BIT;
+ 	bool int_sel = flags & AMDGPU_FENCE_FLAG_INT;
+ 
+-	/* EVENT_WRITE_EOP - flush caches, send int */
++	/* Workaround for cache flush problems. First send a dummy EOP
++	 * event down the pipe with seq one below.
++	 */
++	amdgpu_ring_write(ring, PACKET3(PACKET3_EVENT_WRITE_EOP, 4));
++	amdgpu_ring_write(ring, (EOP_TCL1_ACTION_EN |
++				 EOP_TC_ACTION_EN |
++				 EOP_TC_WB_ACTION_EN |
++				 EVENT_TYPE(CACHE_FLUSH_AND_INV_TS_EVENT) |
++				 EVENT_INDEX(5)));
++	amdgpu_ring_write(ring, addr & 0xfffffffc);
++	amdgpu_ring_write(ring, (upper_32_bits(addr) & 0xffff) |
++				DATA_SEL(1) | INT_SEL(0));
++	amdgpu_ring_write(ring, lower_32_bits(seq - 1));
++	amdgpu_ring_write(ring, upper_32_bits(seq - 1));
++
++	/* Then send the real EOP event down the pipe:
++	 * EVENT_WRITE_EOP - flush caches, send int */
+ 	amdgpu_ring_write(ring, PACKET3(PACKET3_EVENT_WRITE_EOP, 4));
+ 	amdgpu_ring_write(ring, (EOP_TCL1_ACTION_EN |
+ 				 EOP_TC_ACTION_EN |
+@@ -7154,7 +7170,7 @@ static const struct amdgpu_ring_funcs gfx_v8_0_ring_funcs_gfx = {
+ 		5 +  /* COND_EXEC */
+ 		7 +  /* PIPELINE_SYNC */
+ 		VI_FLUSH_GPU_TLB_NUM_WREG * 5 + 9 + /* VM_FLUSH */
+-		8 +  /* FENCE for VM_FLUSH */
++		12 +  /* FENCE for VM_FLUSH */
+ 		20 + /* GDS switch */
+ 		4 + /* double SWITCH_BUFFER,
+ 		       the first COND_EXEC jump to the place just
+@@ -7166,7 +7182,7 @@ static const struct amdgpu_ring_funcs gfx_v8_0_ring_funcs_gfx = {
+ 		31 + /*	DE_META */
+ 		3 + /* CNTX_CTRL */
+ 		5 + /* HDP_INVL */
+-		8 + 8 + /* FENCE x2 */
++		12 + 12 + /* FENCE x2 */
+ 		2, /* SWITCH_BUFFER */
+ 	.emit_ib_size =	4, /* gfx_v8_0_ring_emit_ib_gfx */
+ 	.emit_ib = gfx_v8_0_ring_emit_ib_gfx,
+diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_link.c b/drivers/gpu/drm/amd/display/dc/core/dc_link.c
+index c6f7c1344a9b..2f42964fb9f4 100644
+--- a/drivers/gpu/drm/amd/display/dc/core/dc_link.c
++++ b/drivers/gpu/drm/amd/display/dc/core/dc_link.c
+@@ -348,7 +348,7 @@ bool dc_link_is_dp_sink_present(struct dc_link *link)
+ 
+ 	if (GPIO_RESULT_OK != dal_ddc_open(
+ 		ddc, GPIO_MODE_INPUT, GPIO_DDC_CONFIG_TYPE_MODE_I2C)) {
+-		dal_gpio_destroy_ddc(&ddc);
++		dal_ddc_close(ddc);
+ 
+ 		return present;
+ 	}
+diff --git a/drivers/gpu/drm/drm_dp_mst_topology.c b/drivers/gpu/drm/drm_dp_mst_topology.c
+index 65f58e23e03d..77347a258f6c 100644
+--- a/drivers/gpu/drm/drm_dp_mst_topology.c
++++ b/drivers/gpu/drm/drm_dp_mst_topology.c
+@@ -1582,7 +1582,11 @@ static void process_single_up_tx_qlock(struct drm_dp_mst_topology_mgr *mgr,
+ 	if (ret != 1)
+ 		DRM_DEBUG_KMS("failed to send msg in q %d\n", ret);
+ 
+-	txmsg->dst->tx_slots[txmsg->seqno] = NULL;
++	if (txmsg->seqno != -1) {
++		WARN_ON((unsigned int)txmsg->seqno >
++			ARRAY_SIZE(txmsg->dst->tx_slots));
++		txmsg->dst->tx_slots[txmsg->seqno] = NULL;
++	}
+ }
+ 
+ static void drm_dp_queue_down_tx(struct drm_dp_mst_topology_mgr *mgr,
+diff --git a/drivers/gpu/drm/drm_property.c b/drivers/gpu/drm/drm_property.c
+index cdb10f885a4f..69dfed57c2f8 100644
+--- a/drivers/gpu/drm/drm_property.c
++++ b/drivers/gpu/drm/drm_property.c
+@@ -556,7 +556,7 @@ drm_property_create_blob(struct drm_device *dev, size_t length,
+ 	struct drm_property_blob *blob;
+ 	int ret;
+ 
+-	if (!length || length > ULONG_MAX - sizeof(struct drm_property_blob))
++	if (!length || length > INT_MAX - sizeof(struct drm_property_blob))
+ 		return ERR_PTR(-EINVAL);
+ 
+ 	blob = kvzalloc(sizeof(struct drm_property_blob)+length, GFP_KERNEL);
+diff --git a/drivers/gpu/drm/msm/msm_gpu.c b/drivers/gpu/drm/msm/msm_gpu.c
+index 52a2146dc1f2..5e6c78ea3a3f 100644
+--- a/drivers/gpu/drm/msm/msm_gpu.c
++++ b/drivers/gpu/drm/msm/msm_gpu.c
+@@ -25,6 +25,7 @@
+ #include <linux/pm_opp.h>
+ #include <linux/devfreq.h>
+ #include <linux/devcoredump.h>
++#include <linux/sched/task.h>
+ 
+ /*
+  * Power Management:
+diff --git a/drivers/gpu/drm/nouveau/nouveau_connector.h b/drivers/gpu/drm/nouveau/nouveau_connector.h
+index dc7454e7f19a..b46e99f7641e 100644
+--- a/drivers/gpu/drm/nouveau/nouveau_connector.h
++++ b/drivers/gpu/drm/nouveau/nouveau_connector.h
+@@ -29,6 +29,7 @@
+ 
+ #include <nvif/notify.h>
+ 
++#include <drm/drm_crtc.h>
+ #include <drm/drm_edid.h>
+ #include <drm/drm_encoder.h>
+ #include <drm/drm_dp_helper.h>
+@@ -37,6 +38,60 @@
+ 
+ struct nvkm_i2c_port;
+ 
++#define nouveau_conn_atom(p)                                                   \
++	container_of((p), struct nouveau_conn_atom, state)
++
++struct nouveau_conn_atom {
++	struct drm_connector_state state;
++
++	struct {
++		/* The enum values specifically defined here match nv50/gf119
++		 * hw values, and the code relies on this.
++		 */
++		enum {
++			DITHERING_MODE_OFF = 0x00,
++			DITHERING_MODE_ON = 0x01,
++			DITHERING_MODE_DYNAMIC2X2 = 0x10 | DITHERING_MODE_ON,
++			DITHERING_MODE_STATIC2X2 = 0x18 | DITHERING_MODE_ON,
++			DITHERING_MODE_TEMPORAL = 0x20 | DITHERING_MODE_ON,
++			DITHERING_MODE_AUTO
++		} mode;
++		enum {
++			DITHERING_DEPTH_6BPC = 0x00,
++			DITHERING_DEPTH_8BPC = 0x02,
++			DITHERING_DEPTH_AUTO
++		} depth;
++	} dither;
++
++	struct {
++		int mode;	/* DRM_MODE_SCALE_* */
++		struct {
++			enum {
++				UNDERSCAN_OFF,
++				UNDERSCAN_ON,
++				UNDERSCAN_AUTO,
++			} mode;
++			u32 hborder;
++			u32 vborder;
++		} underscan;
++		bool full;
++	} scaler;
++
++	struct {
++		int color_vibrance;
++		int vibrant_hue;
++	} procamp;
++
++	union {
++		struct {
++			bool dither:1;
++			bool scaler:1;
++			bool procamp:1;
++		};
++		u8 mask;
++	} set;
++};
++
+ struct nouveau_connector {
+ 	struct drm_connector base;
+ 	enum dcb_connector_type type;
+@@ -111,61 +166,6 @@ extern int nouveau_ignorelid;
+ extern int nouveau_duallink;
+ extern int nouveau_hdmimhz;
+ 
+-#include <drm/drm_crtc.h>
+-#define nouveau_conn_atom(p)                                                   \
+-	container_of((p), struct nouveau_conn_atom, state)
+-
+-struct nouveau_conn_atom {
+-	struct drm_connector_state state;
+-
+-	struct {
+-		/* The enum values specifically defined here match nv50/gf119
+-		 * hw values, and the code relies on this.
+-		 */
+-		enum {
+-			DITHERING_MODE_OFF = 0x00,
+-			DITHERING_MODE_ON = 0x01,
+-			DITHERING_MODE_DYNAMIC2X2 = 0x10 | DITHERING_MODE_ON,
+-			DITHERING_MODE_STATIC2X2 = 0x18 | DITHERING_MODE_ON,
+-			DITHERING_MODE_TEMPORAL = 0x20 | DITHERING_MODE_ON,
+-			DITHERING_MODE_AUTO
+-		} mode;
+-		enum {
+-			DITHERING_DEPTH_6BPC = 0x00,
+-			DITHERING_DEPTH_8BPC = 0x02,
+-			DITHERING_DEPTH_AUTO
+-		} depth;
+-	} dither;
+-
+-	struct {
+-		int mode;	/* DRM_MODE_SCALE_* */
+-		struct {
+-			enum {
+-				UNDERSCAN_OFF,
+-				UNDERSCAN_ON,
+-				UNDERSCAN_AUTO,
+-			} mode;
+-			u32 hborder;
+-			u32 vborder;
+-		} underscan;
+-		bool full;
+-	} scaler;
+-
+-	struct {
+-		int color_vibrance;
+-		int vibrant_hue;
+-	} procamp;
+-
+-	union {
+-		struct {
+-			bool dither:1;
+-			bool scaler:1;
+-			bool procamp:1;
+-		};
+-		u8 mask;
+-	} set;
+-};
+-
+ void nouveau_conn_attach_properties(struct drm_connector *);
+ void nouveau_conn_reset(struct drm_connector *);
+ struct drm_connector_state *
+diff --git a/drivers/gpu/drm/sun4i/sun4i_hdmi_enc.c b/drivers/gpu/drm/sun4i/sun4i_hdmi_enc.c
+index 416da5376701..8ad36f574df8 100644
+--- a/drivers/gpu/drm/sun4i/sun4i_hdmi_enc.c
++++ b/drivers/gpu/drm/sun4i/sun4i_hdmi_enc.c
+@@ -651,8 +651,6 @@ static void sun4i_hdmi_unbind(struct device *dev, struct device *master,
+ 	struct sun4i_hdmi *hdmi = dev_get_drvdata(dev);
+ 
+ 	cec_unregister_adapter(hdmi->cec_adap);
+-	drm_connector_cleanup(&hdmi->connector);
+-	drm_encoder_cleanup(&hdmi->encoder);
+ 	i2c_del_adapter(hdmi->i2c);
+ 	clk_disable_unprepare(hdmi->mod_clk);
+ 	clk_disable_unprepare(hdmi->bus_clk);
+diff --git a/drivers/hid/i2c-hid/i2c-hid-core.c b/drivers/hid/i2c-hid/i2c-hid-core.c
+index 2f940c1de616..0a39e444e308 100644
+--- a/drivers/hid/i2c-hid/i2c-hid-core.c
++++ b/drivers/hid/i2c-hid/i2c-hid-core.c
+@@ -51,6 +51,7 @@
+ #define I2C_HID_QUIRK_NO_RUNTIME_PM		BIT(2)
+ #define I2C_HID_QUIRK_DELAY_AFTER_SLEEP		BIT(3)
+ #define I2C_HID_QUIRK_BOGUS_IRQ			BIT(4)
++#define I2C_HID_QUIRK_RESET_ON_RESUME		BIT(5)
+ 
+ /* flags */
+ #define I2C_HID_STARTED		0
+@@ -182,6 +183,8 @@ static const struct i2c_hid_quirks {
+ 		I2C_HID_QUIRK_NO_RUNTIME_PM },
+ 	{ USB_VENDOR_ID_ELAN, HID_ANY_ID,
+ 		 I2C_HID_QUIRK_BOGUS_IRQ },
++	{ USB_VENDOR_ID_ALPS_JP, HID_ANY_ID,
++		 I2C_HID_QUIRK_RESET_ON_RESUME },
+ 	{ 0, 0 }
+ };
+ 
+@@ -1290,8 +1293,15 @@ static int i2c_hid_resume(struct device *dev)
+ 	 * solves "incomplete reports" on Raydium devices 2386:3118 and
+ 	 * 2386:4B33 and fixes various SIS touchscreens no longer sending
+ 	 * data after a suspend/resume.
++	 *
++	 * However some ALPS touchpads generate IRQ storm without reset, so
++	 * let's still reset them here.
+ 	 */
+-	ret = i2c_hid_set_power(client, I2C_HID_PWR_ON);
++	if (ihid->quirks & I2C_HID_QUIRK_RESET_ON_RESUME)
++		ret = i2c_hid_hwreset(client);
++	else
++		ret = i2c_hid_set_power(client, I2C_HID_PWR_ON);
++
+ 	if (ret)
+ 		return ret;
+ 
+diff --git a/drivers/iio/adc/max9611.c b/drivers/iio/adc/max9611.c
+index 0884435eec68..9f1a5ef0b444 100644
+--- a/drivers/iio/adc/max9611.c
++++ b/drivers/iio/adc/max9611.c
+@@ -92,6 +92,12 @@
+ #define MAX9611_TEMP_SCALE_NUM		1000000
+ #define MAX9611_TEMP_SCALE_DIV		2083
+ 
++/*
++ * Conversion time is 2 ms (typically) at Ta=25 degreeC
++ * No maximum value is known, so play it safe.
++ */
++#define MAX9611_CONV_TIME_US_RANGE	3000, 3300
++
+ struct max9611_dev {
+ 	struct device *dev;
+ 	struct i2c_client *i2c_client;
+@@ -239,11 +245,9 @@ static int max9611_read_single(struct max9611_dev *max9611,
+ 		return ret;
+ 	}
+ 
+-	/*
+-	 * need a delay here to make register configuration
+-	 * stabilize. 1 msec at least, from empirical testing.
+-	 */
+-	usleep_range(1000, 2000);
++	/* need a delay here to make register configuration stabilize. */
++
++	usleep_range(MAX9611_CONV_TIME_US_RANGE);
+ 
+ 	ret = i2c_smbus_read_word_swapped(max9611->i2c_client, reg_addr);
+ 	if (ret < 0) {
+@@ -510,7 +514,7 @@ static int max9611_init(struct max9611_dev *max9611)
+ 			MAX9611_REG_CTRL2, 0);
+ 		return ret;
+ 	}
+-	usleep_range(1000, 2000);
++	usleep_range(MAX9611_CONV_TIME_US_RANGE);
+ 
+ 	return 0;
+ }
+diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c
+index 1f373ba573b6..319bfef00a4a 100644
+--- a/drivers/infiniband/core/cma.c
++++ b/drivers/infiniband/core/cma.c
+@@ -4658,6 +4658,7 @@ static int __init cma_init(void)
+ err:
+ 	unregister_netdevice_notifier(&cma_nb);
+ 	ib_sa_unregister_client(&sa_client);
++	unregister_pernet_subsys(&cma_pernet_operations);
+ err_wq:
+ 	destroy_workqueue(cma_wq);
+ 	return ret;
+diff --git a/drivers/infiniband/hw/mlx4/main.c b/drivers/infiniband/hw/mlx4/main.c
+index 0bbeaaae47e0..9386bb57b3d7 100644
+--- a/drivers/infiniband/hw/mlx4/main.c
++++ b/drivers/infiniband/hw/mlx4/main.c
+@@ -3069,16 +3069,17 @@ static void mlx4_ib_remove(struct mlx4_dev *dev, void *ibdev_ptr)
+ 	ibdev->ib_active = false;
+ 	flush_workqueue(wq);
+ 
+-	mlx4_ib_close_sriov(ibdev);
+-	mlx4_ib_mad_cleanup(ibdev);
+-	ib_unregister_device(&ibdev->ib_dev);
+-	mlx4_ib_diag_cleanup(ibdev);
+ 	if (ibdev->iboe.nb.notifier_call) {
+ 		if (unregister_netdevice_notifier(&ibdev->iboe.nb))
+ 			pr_warn("failure unregistering notifier\n");
+ 		ibdev->iboe.nb.notifier_call = NULL;
+ 	}
+ 
++	mlx4_ib_close_sriov(ibdev);
++	mlx4_ib_mad_cleanup(ibdev);
++	ib_unregister_device(&ibdev->ib_dev);
++	mlx4_ib_diag_cleanup(ibdev);
++
+ 	mlx4_qp_release_range(dev, ibdev->steer_qpn_base,
+ 			      ibdev->steer_qpn_count);
+ 	kfree(ibdev->ib_uc_qpns_bitmap);
+diff --git a/drivers/infiniband/hw/mlx5/main.c b/drivers/infiniband/hw/mlx5/main.c
+index f4ffdc588ea0..df5be462dd28 100644
+--- a/drivers/infiniband/hw/mlx5/main.c
++++ b/drivers/infiniband/hw/mlx5/main.c
+@@ -3286,10 +3286,6 @@ static struct mlx5_ib_flow_handler *_create_flow_rule(struct mlx5_ib_dev *dev,
+ 	}
+ 
+ 	INIT_LIST_HEAD(&handler->list);
+-	if (dst) {
+-		memcpy(&dest_arr[0], dst, sizeof(*dst));
+-		dest_num++;
+-	}
+ 
+ 	for (spec_index = 0; spec_index < flow_attr->num_of_specs; spec_index++) {
+ 		err = parse_flow_attr(dev->mdev, spec->match_criteria,
+@@ -3303,6 +3299,11 @@ static struct mlx5_ib_flow_handler *_create_flow_rule(struct mlx5_ib_dev *dev,
+ 		ib_flow += ((union ib_flow_spec *)ib_flow)->size;
+ 	}
+ 
++	if (dst && !(flow_act.action & MLX5_FLOW_CONTEXT_ACTION_DROP)) {
++		memcpy(&dest_arr[0], dst, sizeof(*dst));
++		dest_num++;
++	}
++
+ 	if (!flow_is_multicast_only(flow_attr))
+ 		set_underlay_qp(dev, spec, underlay_qpn);
+ 
+@@ -3340,10 +3341,8 @@ static struct mlx5_ib_flow_handler *_create_flow_rule(struct mlx5_ib_dev *dev,
+ 	}
+ 
+ 	if (flow_act.action & MLX5_FLOW_CONTEXT_ACTION_DROP) {
+-		if (!(flow_act.action & MLX5_FLOW_CONTEXT_ACTION_COUNT)) {
++		if (!dest_num)
+ 			rule_dst = NULL;
+-			dest_num = 0;
+-		}
+ 	} else {
+ 		if (is_egress)
+ 			flow_act.action |= MLX5_FLOW_CONTEXT_ACTION_ALLOW;
+diff --git a/drivers/infiniband/sw/rxe/rxe_recv.c b/drivers/infiniband/sw/rxe/rxe_recv.c
+index d30dbac24583..695a607e2d14 100644
+--- a/drivers/infiniband/sw/rxe/rxe_recv.c
++++ b/drivers/infiniband/sw/rxe/rxe_recv.c
+@@ -391,7 +391,7 @@ void rxe_rcv(struct sk_buff *skb)
+ 
+ 	calc_icrc = rxe_icrc_hdr(pkt, skb);
+ 	calc_icrc = rxe_crc32(rxe, calc_icrc, (u8 *)payload_addr(pkt),
+-			      payload_size(pkt));
++			      payload_size(pkt) + bth_pad(pkt));
+ 	calc_icrc = (__force u32)cpu_to_be32(~calc_icrc);
+ 	if (unlikely(calc_icrc != pack_icrc)) {
+ 		if (skb->protocol == htons(ETH_P_IPV6))
+diff --git a/drivers/infiniband/sw/rxe/rxe_req.c b/drivers/infiniband/sw/rxe/rxe_req.c
+index f7dd8de79941..1c1eae0ef8c2 100644
+--- a/drivers/infiniband/sw/rxe/rxe_req.c
++++ b/drivers/infiniband/sw/rxe/rxe_req.c
+@@ -500,6 +500,12 @@ static int fill_packet(struct rxe_qp *qp, struct rxe_send_wqe *wqe,
+ 			if (err)
+ 				return err;
+ 		}
++		if (bth_pad(pkt)) {
++			u8 *pad = payload_addr(pkt) + paylen;
++
++			memset(pad, 0, bth_pad(pkt));
++			crc = rxe_crc32(rxe, crc, pad, bth_pad(pkt));
++		}
+ 	}
+ 	p = payload_addr(pkt) + paylen + bth_pad(pkt);
+ 
+diff --git a/drivers/infiniband/sw/rxe/rxe_resp.c b/drivers/infiniband/sw/rxe/rxe_resp.c
+index 681d8e0913d0..9078cfd3b8bd 100644
+--- a/drivers/infiniband/sw/rxe/rxe_resp.c
++++ b/drivers/infiniband/sw/rxe/rxe_resp.c
+@@ -737,6 +737,13 @@ static enum resp_states read_reply(struct rxe_qp *qp,
+ 	if (err)
+ 		pr_err("Failed copying memory\n");
+ 
++	if (bth_pad(&ack_pkt)) {
++		struct rxe_dev *rxe = to_rdev(qp->ibqp.device);
++		u8 *pad = payload_addr(&ack_pkt) + payload;
++
++		memset(pad, 0, bth_pad(&ack_pkt));
++		icrc = rxe_crc32(rxe, icrc, pad, bth_pad(&ack_pkt));
++	}
+ 	p = payload_addr(&ack_pkt) + payload + bth_pad(&ack_pkt);
+ 	*p = ~icrc;
+ 
+diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c
+index 6800dcd50a11..abcb4c3a76c1 100644
+--- a/drivers/md/raid1.c
++++ b/drivers/md/raid1.c
+@@ -2756,7 +2756,7 @@ static sector_t raid1_sync_request(struct mddev *mddev, sector_t sector_nr,
+ 				write_targets++;
+ 			}
+ 		}
+-		if (bio->bi_end_io) {
++		if (rdev && bio->bi_end_io) {
+ 			atomic_inc(&rdev->nr_pending);
+ 			bio->bi_iter.bi_sector = sector_nr + rdev->data_offset;
+ 			bio_set_dev(bio, rdev->bdev);
+diff --git a/drivers/media/cec/cec-adap.c b/drivers/media/cec/cec-adap.c
+index dd6f3e6ce006..ba7e976bf6dc 100644
+--- a/drivers/media/cec/cec-adap.c
++++ b/drivers/media/cec/cec-adap.c
+@@ -365,7 +365,8 @@ static void cec_data_cancel(struct cec_data *data, u8 tx_status)
+ 	} else {
+ 		list_del_init(&data->list);
+ 		if (!(data->msg.tx_status & CEC_TX_STATUS_OK))
+-			data->adap->transmit_queue_sz--;
++			if (!WARN_ON(!data->adap->transmit_queue_sz))
++				data->adap->transmit_queue_sz--;
+ 	}
+ 
+ 	if (data->msg.tx_status & CEC_TX_STATUS_OK) {
+@@ -417,6 +418,14 @@ static void cec_flush(struct cec_adapter *adap)
+ 		 * need to do anything special in that case.
+ 		 */
+ 	}
++	/*
++	 * If something went wrong and this counter isn't what it should
++	 * be, then this will reset it back to 0. Warn if it is not 0,
++	 * since it indicates a bug, either in this framework or in a
++	 * CEC driver.
++	 */
++	if (WARN_ON(adap->transmit_queue_sz))
++		adap->transmit_queue_sz = 0;
+ }
+ 
+ /*
+@@ -441,7 +450,7 @@ int cec_thread_func(void *_adap)
+ 		bool timeout = false;
+ 		u8 attempts;
+ 
+-		if (adap->transmitting) {
++		if (adap->transmit_in_progress) {
+ 			int err;
+ 
+ 			/*
+@@ -476,7 +485,7 @@ int cec_thread_func(void *_adap)
+ 			goto unlock;
+ 		}
+ 
+-		if (adap->transmitting && timeout) {
++		if (adap->transmit_in_progress && timeout) {
+ 			/*
+ 			 * If we timeout, then log that. Normally this does
+ 			 * not happen and it is an indication of a faulty CEC
+@@ -485,14 +494,18 @@ int cec_thread_func(void *_adap)
+ 			 * so much traffic on the bus that the adapter was
+ 			 * unable to transmit for CEC_XFER_TIMEOUT_MS (2.1s).
+ 			 */
+-			pr_warn("cec-%s: message %*ph timed out\n", adap->name,
+-				adap->transmitting->msg.len,
+-				adap->transmitting->msg.msg);
++			if (adap->transmitting) {
++				pr_warn("cec-%s: message %*ph timed out\n", adap->name,
++					adap->transmitting->msg.len,
++					adap->transmitting->msg.msg);
++				/* Just give up on this. */
++				cec_data_cancel(adap->transmitting,
++						CEC_TX_STATUS_TIMEOUT);
++			} else {
++				pr_warn("cec-%s: transmit timed out\n", adap->name);
++			}
+ 			adap->transmit_in_progress = false;
+ 			adap->tx_timeouts++;
+-			/* Just give up on this. */
+-			cec_data_cancel(adap->transmitting,
+-					CEC_TX_STATUS_TIMEOUT);
+ 			goto unlock;
+ 		}
+ 
+@@ -507,7 +520,8 @@ int cec_thread_func(void *_adap)
+ 		data = list_first_entry(&adap->transmit_queue,
+ 					struct cec_data, list);
+ 		list_del_init(&data->list);
+-		adap->transmit_queue_sz--;
++		if (!WARN_ON(!data->adap->transmit_queue_sz))
++			adap->transmit_queue_sz--;
+ 
+ 		/* Make this the current transmitting message */
+ 		adap->transmitting = data;
+@@ -1038,11 +1052,11 @@ void cec_received_msg_ts(struct cec_adapter *adap,
+ 			valid_la = false;
+ 		else if (!cec_msg_is_broadcast(msg) && !(dir_fl & DIRECTED))
+ 			valid_la = false;
+-		else if (cec_msg_is_broadcast(msg) && !(dir_fl & BCAST1_4))
++		else if (cec_msg_is_broadcast(msg) && !(dir_fl & BCAST))
+ 			valid_la = false;
+ 		else if (cec_msg_is_broadcast(msg) &&
+-			 adap->log_addrs.cec_version >= CEC_OP_CEC_VERSION_2_0 &&
+-			 !(dir_fl & BCAST2_0))
++			 adap->log_addrs.cec_version < CEC_OP_CEC_VERSION_2_0 &&
++			 !(dir_fl & BCAST1_4))
+ 			valid_la = false;
+ 	}
+ 	if (valid_la && min_len) {
+diff --git a/drivers/media/usb/b2c2/flexcop-usb.c b/drivers/media/usb/b2c2/flexcop-usb.c
+index f1807c16438d..427cda457af6 100644
+--- a/drivers/media/usb/b2c2/flexcop-usb.c
++++ b/drivers/media/usb/b2c2/flexcop-usb.c
+@@ -294,7 +294,7 @@ static int flexcop_usb_i2c_req(struct flexcop_i2c_adapter *i2c,
+ 
+ 	mutex_unlock(&fc_usb->data_mutex);
+ 
+-	return 0;
++	return ret;
+ }
+ 
+ /* actual bus specific access functions,
+diff --git a/drivers/media/usb/dvb-usb/af9005.c b/drivers/media/usb/dvb-usb/af9005.c
+index 16e946e01d2c..25871979123f 100644
+--- a/drivers/media/usb/dvb-usb/af9005.c
++++ b/drivers/media/usb/dvb-usb/af9005.c
+@@ -985,8 +985,9 @@ static int af9005_identify_state(struct usb_device *udev,
+ 	else if (reply == 0x02)
+ 		*cold = 0;
+ 	else
+-		return -EIO;
+-	deb_info("Identify state cold = %d\n", *cold);
++		ret = -EIO;
++	if (!ret)
++		deb_info("Identify state cold = %d\n", *cold);
+ 
+ err:
+ 	kfree(buf);
+diff --git a/drivers/media/usb/pulse8-cec/pulse8-cec.c b/drivers/media/usb/pulse8-cec/pulse8-cec.c
+index 6e3bdd71e273..f5899321e5a3 100644
+--- a/drivers/media/usb/pulse8-cec/pulse8-cec.c
++++ b/drivers/media/usb/pulse8-cec/pulse8-cec.c
+@@ -121,6 +121,7 @@ struct pulse8 {
+ 	unsigned int vers;
+ 	struct completion cmd_done;
+ 	struct work_struct work;
++	u8 work_result;
+ 	struct delayed_work ping_eeprom_work;
+ 	struct cec_msg rx_msg;
+ 	u8 data[DATA_SIZE];
+@@ -142,8 +143,10 @@ static void pulse8_irq_work_handler(struct work_struct *work)
+ {
+ 	struct pulse8 *pulse8 =
+ 		container_of(work, struct pulse8, work);
++	u8 result = pulse8->work_result;
+ 
+-	switch (pulse8->data[0] & 0x3f) {
++	pulse8->work_result = 0;
++	switch (result & 0x3f) {
+ 	case MSGCODE_FRAME_DATA:
+ 		cec_received_msg(pulse8->adap, &pulse8->rx_msg);
+ 		break;
+@@ -177,12 +180,12 @@ static irqreturn_t pulse8_interrupt(struct serio *serio, unsigned char data,
+ 		pulse8->escape = false;
+ 	} else if (data == MSGEND) {
+ 		struct cec_msg *msg = &pulse8->rx_msg;
++		u8 msgcode = pulse8->buf[0];
+ 
+ 		if (debug)
+ 			dev_info(pulse8->dev, "received: %*ph\n",
+ 				 pulse8->idx, pulse8->buf);
+-		pulse8->data[0] = pulse8->buf[0];
+-		switch (pulse8->buf[0] & 0x3f) {
++		switch (msgcode & 0x3f) {
+ 		case MSGCODE_FRAME_START:
+ 			msg->len = 1;
+ 			msg->msg[0] = pulse8->buf[1];
+@@ -191,14 +194,20 @@ static irqreturn_t pulse8_interrupt(struct serio *serio, unsigned char data,
+ 			if (msg->len == CEC_MAX_MSG_SIZE)
+ 				break;
+ 			msg->msg[msg->len++] = pulse8->buf[1];
+-			if (pulse8->buf[0] & MSGCODE_FRAME_EOM)
++			if (msgcode & MSGCODE_FRAME_EOM) {
++				WARN_ON(pulse8->work_result);
++				pulse8->work_result = msgcode;
+ 				schedule_work(&pulse8->work);
++				break;
++			}
+ 			break;
+ 		case MSGCODE_TRANSMIT_SUCCEEDED:
+ 		case MSGCODE_TRANSMIT_FAILED_LINE:
+ 		case MSGCODE_TRANSMIT_FAILED_ACK:
+ 		case MSGCODE_TRANSMIT_FAILED_TIMEOUT_DATA:
+ 		case MSGCODE_TRANSMIT_FAILED_TIMEOUT_LINE:
++			WARN_ON(pulse8->work_result);
++			pulse8->work_result = msgcode;
+ 			schedule_work(&pulse8->work);
+ 			break;
+ 		case MSGCODE_HIGH_ERROR:
+diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c b/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c
+index 799010ed04e0..b5d7ef4da17f 100644
+--- a/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c
++++ b/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c
+@@ -973,6 +973,8 @@ static bool ath9k_rx_prepare(struct ath9k_htc_priv *priv,
+ 	struct ath_htc_rx_status *rxstatus;
+ 	struct ath_rx_status rx_stats;
+ 	bool decrypt_error = false;
++	__be16 rs_datalen;
++	bool is_phyerr;
+ 
+ 	if (skb->len < HTC_RX_FRAME_HEADER_SIZE) {
+ 		ath_err(common, "Corrupted RX frame, dropping (len: %d)\n",
+@@ -982,11 +984,24 @@ static bool ath9k_rx_prepare(struct ath9k_htc_priv *priv,
+ 
+ 	rxstatus = (struct ath_htc_rx_status *)skb->data;
+ 
+-	if (be16_to_cpu(rxstatus->rs_datalen) -
+-	    (skb->len - HTC_RX_FRAME_HEADER_SIZE) != 0) {
++	rs_datalen = be16_to_cpu(rxstatus->rs_datalen);
++	if (unlikely(rs_datalen -
++	    (skb->len - HTC_RX_FRAME_HEADER_SIZE) != 0)) {
+ 		ath_err(common,
+ 			"Corrupted RX data len, dropping (dlen: %d, skblen: %d)\n",
+-			rxstatus->rs_datalen, skb->len);
++			rs_datalen, skb->len);
++		goto rx_next;
++	}
++
++	is_phyerr = rxstatus->rs_status & ATH9K_RXERR_PHY;
++	/*
++	 * Discard zero-length packets and packets smaller than an ACK
++	 * which are not PHY_ERROR (short radar pulses have a length of 3)
++	 */
++	if (unlikely(!rs_datalen || (rs_datalen < 10 && !is_phyerr))) {
++		ath_warn(common,
++			 "Short RX data len, dropping (dlen: %d)\n",
++			 rs_datalen);
+ 		goto rx_next;
+ 	}
+ 
+@@ -1011,7 +1026,7 @@ static bool ath9k_rx_prepare(struct ath9k_htc_priv *priv,
+ 	 * Process PHY errors and return so that the packet
+ 	 * can be dropped.
+ 	 */
+-	if (rx_stats.rs_status & ATH9K_RXERR_PHY) {
++	if (unlikely(is_phyerr)) {
+ 		/* TODO: Not using DFS processing now. */
+ 		if (ath_cmn_process_fft(&priv->spec_priv, hdr,
+ 				    &rx_stats, rx_status->mactime)) {
+diff --git a/drivers/nvme/host/fc.c b/drivers/nvme/host/fc.c
+index 565bddcfd130..1875f6b8a907 100644
+--- a/drivers/nvme/host/fc.c
++++ b/drivers/nvme/host/fc.c
+@@ -342,7 +342,8 @@ nvme_fc_register_localport(struct nvme_fc_port_info *pinfo,
+ 	    !template->ls_req || !template->fcp_io ||
+ 	    !template->ls_abort || !template->fcp_abort ||
+ 	    !template->max_hw_queues || !template->max_sgl_segments ||
+-	    !template->max_dif_sgl_segments || !template->dma_boundary) {
++	    !template->max_dif_sgl_segments || !template->dma_boundary ||
++	    !template->module) {
+ 		ret = -EINVAL;
+ 		goto out_reghost_failed;
+ 	}
+@@ -1986,6 +1987,7 @@ nvme_fc_ctrl_free(struct kref *ref)
+ {
+ 	struct nvme_fc_ctrl *ctrl =
+ 		container_of(ref, struct nvme_fc_ctrl, ref);
++	struct nvme_fc_lport *lport = ctrl->lport;
+ 	unsigned long flags;
+ 
+ 	if (ctrl->ctrl.tagset) {
+@@ -2011,6 +2013,7 @@ nvme_fc_ctrl_free(struct kref *ref)
+ 	if (ctrl->ctrl.opts)
+ 		nvmf_free_options(ctrl->ctrl.opts);
+ 	kfree(ctrl);
++	module_put(lport->ops->module);
+ }
+ 
+ static void
+@@ -2891,10 +2894,22 @@ nvme_fc_reconnect_or_delete(struct nvme_fc_ctrl *ctrl, int status)
+ static void
+ __nvme_fc_terminate_io(struct nvme_fc_ctrl *ctrl)
+ {
+-	nvme_stop_keep_alive(&ctrl->ctrl);
++	/*
++	 * if state is connecting - the error occurred as part of a
++	 * reconnect attempt. The create_association error paths will
++	 * clean up any outstanding io.
++	 *
++	 * if it's a different state - ensure all pending io is
++	 * terminated. Given this can delay while waiting for the
++	 * aborted io to return, we recheck adapter state below
++	 * before changing state.
++	 */
++	if (ctrl->ctrl.state != NVME_CTRL_CONNECTING) {
++		nvme_stop_keep_alive(&ctrl->ctrl);
+ 
+-	/* will block will waiting for io to terminate */
+-	nvme_fc_delete_association(ctrl);
++		/* will block will waiting for io to terminate */
++		nvme_fc_delete_association(ctrl);
++	}
+ 
+ 	if (ctrl->ctrl.state != NVME_CTRL_CONNECTING &&
+ 	    !nvme_change_ctrl_state(&ctrl->ctrl, NVME_CTRL_CONNECTING))
+@@ -3040,10 +3055,15 @@ nvme_fc_init_ctrl(struct device *dev, struct nvmf_ctrl_options *opts,
+ 		goto out_fail;
+ 	}
+ 
++	if (!try_module_get(lport->ops->module)) {
++		ret = -EUNATCH;
++		goto out_free_ctrl;
++	}
++
+ 	idx = ida_simple_get(&nvme_fc_ctrl_cnt, 0, 0, GFP_KERNEL);
+ 	if (idx < 0) {
+ 		ret = -ENOSPC;
+-		goto out_free_ctrl;
++		goto out_mod_put;
+ 	}
+ 
+ 	ctrl->ctrl.opts = opts;
+@@ -3185,6 +3205,8 @@ out_free_queues:
+ out_free_ida:
+ 	put_device(ctrl->dev);
+ 	ida_simple_remove(&nvme_fc_ctrl_cnt, ctrl->cnum);
++out_mod_put:
++	module_put(lport->ops->module);
+ out_free_ctrl:
+ 	kfree(ctrl);
+ out_fail:
+diff --git a/drivers/nvme/target/fcloop.c b/drivers/nvme/target/fcloop.c
+index 291f4121f516..f0536d341f2f 100644
+--- a/drivers/nvme/target/fcloop.c
++++ b/drivers/nvme/target/fcloop.c
+@@ -825,6 +825,7 @@ fcloop_targetport_delete(struct nvmet_fc_target_port *targetport)
+ #define FCLOOP_DMABOUND_4G		0xFFFFFFFF
+ 
+ static struct nvme_fc_port_template fctemplate = {
++	.module			= THIS_MODULE,
+ 	.localport_delete	= fcloop_localport_delete,
+ 	.remoteport_delete	= fcloop_remoteport_delete,
+ 	.create_queue		= fcloop_create_queue,
+diff --git a/drivers/platform/x86/pmc_atom.c b/drivers/platform/x86/pmc_atom.c
+index 429166e6ec9e..9c94ebb251cb 100644
+--- a/drivers/platform/x86/pmc_atom.c
++++ b/drivers/platform/x86/pmc_atom.c
+@@ -452,6 +452,14 @@ static const struct dmi_system_id critclk_systems[] = {
+ 			DMI_MATCH(DMI_PRODUCT_VERSION, "6ES7647-8B"),
+ 		},
+ 	},
++	{
++		.ident = "CONNECT X300",
++		.matches = {
++			DMI_MATCH(DMI_SYS_VENDOR, "SIEMENS AG"),
++			DMI_MATCH(DMI_PRODUCT_VERSION, "A5E45074588"),
++		},
++	},
++
+ 	{ /*sentinel*/ }
+ };
+ 
+diff --git a/drivers/regulator/ab8500.c b/drivers/regulator/ab8500.c
+index 83dba3fbfe0c..60578820432d 100644
+--- a/drivers/regulator/ab8500.c
++++ b/drivers/regulator/ab8500.c
+@@ -956,23 +956,6 @@ static struct ab8500_regulator_info
+ 		.update_val_idle	= 0x82,
+ 		.update_val_normal	= 0x02,
+ 	},
+-	[AB8505_LDO_USB] = {
+-		.desc = {
+-			.name           = "LDO-USB",
+-			.ops            = &ab8500_regulator_mode_ops,
+-			.type           = REGULATOR_VOLTAGE,
+-			.id             = AB8505_LDO_USB,
+-			.owner          = THIS_MODULE,
+-			.n_voltages     = 1,
+-			.volt_table	= fixed_3300000_voltage,
+-		},
+-		.update_bank            = 0x03,
+-		.update_reg             = 0x82,
+-		.update_mask            = 0x03,
+-		.update_val		= 0x01,
+-		.update_val_idle	= 0x03,
+-		.update_val_normal	= 0x01,
+-	},
+ 	[AB8505_LDO_AUDIO] = {
+ 		.desc = {
+ 			.name		= "LDO-AUDIO",
+diff --git a/drivers/scsi/libsas/sas_discover.c b/drivers/scsi/libsas/sas_discover.c
+index 0148ae62a52a..e320534310b1 100644
+--- a/drivers/scsi/libsas/sas_discover.c
++++ b/drivers/scsi/libsas/sas_discover.c
+@@ -97,12 +97,21 @@ static int sas_get_port_device(struct asd_sas_port *port)
+ 		else
+ 			dev->dev_type = SAS_SATA_DEV;
+ 		dev->tproto = SAS_PROTOCOL_SATA;
+-	} else {
++	} else if (port->oob_mode == SAS_OOB_MODE) {
+ 		struct sas_identify_frame *id =
+ 			(struct sas_identify_frame *) dev->frame_rcvd;
+ 		dev->dev_type = id->dev_type;
+ 		dev->iproto = id->initiator_bits;
+ 		dev->tproto = id->target_bits;
++	} else {
++		/* If the oob mode is OOB_NOT_CONNECTED, the port is
++		 * disconnected due to race with PHY down. We cannot
++		 * continue to discover this port
++		 */
++		sas_put_device(dev);
++		pr_warn("Port %016llx is disconnected when discovering\n",
++			SAS_ADDR(port->attached_sas_addr));
++		return -ENODEV;
+ 	}
+ 
+ 	sas_init_dev(dev);
+diff --git a/drivers/scsi/lpfc/lpfc_bsg.c b/drivers/scsi/lpfc/lpfc_bsg.c
+index 99aea52e584b..21f104c5eab6 100644
+--- a/drivers/scsi/lpfc/lpfc_bsg.c
++++ b/drivers/scsi/lpfc/lpfc_bsg.c
+@@ -4419,12 +4419,6 @@ lpfc_bsg_write_ebuf_set(struct lpfc_hba *phba, struct bsg_job *job,
+ 	phba->mbox_ext_buf_ctx.seqNum++;
+ 	nemb_tp = phba->mbox_ext_buf_ctx.nembType;
+ 
+-	dd_data = kmalloc(sizeof(struct bsg_job_data), GFP_KERNEL);
+-	if (!dd_data) {
+-		rc = -ENOMEM;
+-		goto job_error;
+-	}
+-
+ 	pbuf = (uint8_t *)dmabuf->virt;
+ 	size = job->request_payload.payload_len;
+ 	sg_copy_to_buffer(job->request_payload.sg_list,
+@@ -4461,6 +4455,13 @@ lpfc_bsg_write_ebuf_set(struct lpfc_hba *phba, struct bsg_job *job,
+ 				"2968 SLI_CONFIG ext-buffer wr all %d "
+ 				"ebuffers received\n",
+ 				phba->mbox_ext_buf_ctx.numBuf);
++
++		dd_data = kmalloc(sizeof(struct bsg_job_data), GFP_KERNEL);
++		if (!dd_data) {
++			rc = -ENOMEM;
++			goto job_error;
++		}
++
+ 		/* mailbox command structure for base driver */
+ 		pmboxq = mempool_alloc(phba->mbox_mem_pool, GFP_KERNEL);
+ 		if (!pmboxq) {
+@@ -4509,6 +4510,8 @@ lpfc_bsg_write_ebuf_set(struct lpfc_hba *phba, struct bsg_job *job,
+ 	return SLI_CONFIG_HANDLED;
+ 
+ job_error:
++	if (pmboxq)
++		mempool_free(pmboxq, phba->mbox_mem_pool);
+ 	lpfc_bsg_dma_page_free(phba, dmabuf);
+ 	kfree(dd_data);
+ 
+diff --git a/drivers/scsi/lpfc/lpfc_nvme.c b/drivers/scsi/lpfc/lpfc_nvme.c
+index f73726e55e44..6c355d87c709 100644
+--- a/drivers/scsi/lpfc/lpfc_nvme.c
++++ b/drivers/scsi/lpfc/lpfc_nvme.c
+@@ -1903,6 +1903,8 @@ lpfc_nvme_fcp_abort(struct nvme_fc_local_port *pnvme_lport,
+ 
+ /* Declare and initialization an instance of the FC NVME template. */
+ static struct nvme_fc_port_template lpfc_nvme_template = {
++	.module	= THIS_MODULE,
++
+ 	/* initiator-based functions */
+ 	.localport_delete  = lpfc_nvme_localport_delete,
+ 	.remoteport_delete = lpfc_nvme_remoteport_delete,
+diff --git a/drivers/scsi/qedf/qedf_els.c b/drivers/scsi/qedf/qedf_els.c
+index 04f0c4d2e256..5178cd03666a 100644
+--- a/drivers/scsi/qedf/qedf_els.c
++++ b/drivers/scsi/qedf/qedf_els.c
+@@ -23,8 +23,6 @@ static int qedf_initiate_els(struct qedf_rport *fcport, unsigned int op,
+ 	int rc = 0;
+ 	uint32_t did, sid;
+ 	uint16_t xid;
+-	uint32_t start_time = jiffies / HZ;
+-	uint32_t current_time;
+ 	struct fcoe_wqe *sqe;
+ 	unsigned long flags;
+ 	u16 sqe_idx;
+@@ -59,18 +57,12 @@ static int qedf_initiate_els(struct qedf_rport *fcport, unsigned int op,
+ 		goto els_err;
+ 	}
+ 
+-retry_els:
+ 	els_req = qedf_alloc_cmd(fcport, QEDF_ELS);
+ 	if (!els_req) {
+-		current_time = jiffies / HZ;
+-		if ((current_time - start_time) > 10) {
+-			QEDF_INFO(&(qedf->dbg_ctx), QEDF_LOG_ELS,
+-				   "els: Failed els 0x%x\n", op);
+-			rc = -ENOMEM;
+-			goto els_err;
+-		}
+-		mdelay(20 * USEC_PER_MSEC);
+-		goto retry_els;
++		QEDF_INFO(&qedf->dbg_ctx, QEDF_LOG_ELS,
++			  "Failed to alloc ELS request 0x%x\n", op);
++		rc = -ENOMEM;
++		goto els_err;
+ 	}
+ 
+ 	QEDF_INFO(&(qedf->dbg_ctx), QEDF_LOG_ELS, "initiate_els els_req = "
+diff --git a/drivers/scsi/qla2xxx/qla_init.c b/drivers/scsi/qla2xxx/qla_init.c
+index 4512aaa16f78..851f75b12216 100644
+--- a/drivers/scsi/qla2xxx/qla_init.c
++++ b/drivers/scsi/qla2xxx/qla_init.c
+@@ -4815,14 +4815,8 @@ qla2x00_configure_loop(scsi_qla_host_t *vha)
+ 		set_bit(RSCN_UPDATE, &flags);
+ 		clear_bit(LOCAL_LOOP_UPDATE, &flags);
+ 
+-	} else if (ha->current_topology == ISP_CFG_N) {
+-		clear_bit(RSCN_UPDATE, &flags);
+-		if (qla_tgt_mode_enabled(vha)) {
+-			/* allow the other side to start the login */
+-			clear_bit(LOCAL_LOOP_UPDATE, &flags);
+-			set_bit(RELOGIN_NEEDED, &vha->dpc_flags);
+-		}
+-	} else if (ha->current_topology == ISP_CFG_NL) {
++	} else if (ha->current_topology == ISP_CFG_NL ||
++		   ha->current_topology == ISP_CFG_N) {
+ 		clear_bit(RSCN_UPDATE, &flags);
+ 		set_bit(LOCAL_LOOP_UPDATE, &flags);
+ 	} else if (!vha->flags.online ||
+diff --git a/drivers/scsi/qla2xxx/qla_iocb.c b/drivers/scsi/qla2xxx/qla_iocb.c
+index c699bbb8485b..7e47321e003c 100644
+--- a/drivers/scsi/qla2xxx/qla_iocb.c
++++ b/drivers/scsi/qla2xxx/qla_iocb.c
+@@ -2537,7 +2537,8 @@ qla24xx_els_logo_iocb(srb_t *sp, struct els_entry_24xx *els_iocb)
+ 		ql_dbg(ql_dbg_io + ql_dbg_buffer, vha, 0x3073,
+ 		    "PLOGI ELS IOCB:\n");
+ 		ql_dump_buffer(ql_log_info, vha, 0x0109,
+-		    (uint8_t *)els_iocb, 0x70);
++		    (uint8_t *)els_iocb,
++		    sizeof(*els_iocb));
+ 	} else {
+ 		els_iocb->tx_byte_count = sizeof(struct els_logo_payload);
+ 		els_iocb->tx_address[0] =
+@@ -2703,7 +2704,8 @@ qla24xx_els_dcmd2_iocb(scsi_qla_host_t *vha, int els_opcode,
+ 
+ 	ql_dbg(ql_dbg_disc + ql_dbg_buffer, vha, 0x3073, "PLOGI buffer:\n");
+ 	ql_dump_buffer(ql_dbg_disc + ql_dbg_buffer, vha, 0x0109,
+-	    (uint8_t *)elsio->u.els_plogi.els_plogi_pyld, 0x70);
++	    (uint8_t *)elsio->u.els_plogi.els_plogi_pyld,
++	    sizeof(*elsio->u.els_plogi.els_plogi_pyld));
+ 
+ 	rval = qla2x00_start_sp(sp);
+ 	if (rval != QLA_SUCCESS) {
+diff --git a/drivers/scsi/qla2xxx/qla_isr.c b/drivers/scsi/qla2xxx/qla_isr.c
+index afe15b3e45fb..e6d162945f5d 100644
+--- a/drivers/scsi/qla2xxx/qla_isr.c
++++ b/drivers/scsi/qla2xxx/qla_isr.c
+@@ -1049,8 +1049,6 @@ global_port_update:
+ 			ql_dbg(ql_dbg_async, vha, 0x5011,
+ 			    "Asynchronous PORT UPDATE ignored %04x/%04x/%04x.\n",
+ 			    mb[1], mb[2], mb[3]);
+-
+-			qlt_async_event(mb[0], vha, mb);
+ 			break;
+ 		}
+ 
+@@ -1067,8 +1065,6 @@ global_port_update:
+ 		set_bit(LOOP_RESYNC_NEEDED, &vha->dpc_flags);
+ 		set_bit(LOCAL_LOOP_UPDATE, &vha->dpc_flags);
+ 		set_bit(VP_CONFIG_OK, &vha->vp_flags);
+-
+-		qlt_async_event(mb[0], vha, mb);
+ 		break;
+ 
+ 	case MBA_RSCN_UPDATE:		/* State Change Registration */
+diff --git a/drivers/scsi/qla2xxx/qla_mbx.c b/drivers/scsi/qla2xxx/qla_mbx.c
+index b01f69dd4b28..abef3b29fa10 100644
+--- a/drivers/scsi/qla2xxx/qla_mbx.c
++++ b/drivers/scsi/qla2xxx/qla_mbx.c
+@@ -3871,6 +3871,7 @@ qla24xx_report_id_acquisition(scsi_qla_host_t *vha,
+ 					vha->d_id.b24 = 0;
+ 					vha->d_id.b.al_pa = 1;
+ 					ha->flags.n2n_bigger = 1;
++					ha->flags.n2n_ae = 0;
+ 
+ 					id.b.al_pa = 2;
+ 					ql_dbg(ql_dbg_async, vha, 0x5075,
+@@ -3881,6 +3882,7 @@ qla24xx_report_id_acquisition(scsi_qla_host_t *vha,
+ 					    "Format 1: Remote login - Waiting for WWPN %8phC.\n",
+ 					    rptid_entry->u.f1.port_name);
+ 					ha->flags.n2n_bigger = 0;
++					ha->flags.n2n_ae = 1;
+ 				}
+ 				qla24xx_post_newsess_work(vha, &id,
+ 				    rptid_entry->u.f1.port_name,
+@@ -3892,7 +3894,6 @@ qla24xx_report_id_acquisition(scsi_qla_host_t *vha,
+ 			/* if our portname is higher then initiate N2N login */
+ 
+ 			set_bit(N2N_LOGIN_NEEDED, &vha->dpc_flags);
+-			ha->flags.n2n_ae = 1;
+ 			return;
+ 			break;
+ 		case TOPO_FL:
+diff --git a/drivers/scsi/qla2xxx/qla_nvme.c b/drivers/scsi/qla2xxx/qla_nvme.c
+index 5590d6e8b576..db367e428095 100644
+--- a/drivers/scsi/qla2xxx/qla_nvme.c
++++ b/drivers/scsi/qla2xxx/qla_nvme.c
+@@ -560,6 +560,7 @@ static void qla_nvme_remoteport_delete(struct nvme_fc_remote_port *rport)
+ }
+ 
+ static struct nvme_fc_port_template qla_nvme_fc_transport = {
++	.module	= THIS_MODULE,
+ 	.localport_delete = qla_nvme_localport_delete,
+ 	.remoteport_delete = qla_nvme_remoteport_delete,
+ 	.create_queue   = qla_nvme_alloc_queue,
+diff --git a/drivers/scsi/qla2xxx/qla_target.c b/drivers/scsi/qla2xxx/qla_target.c
+index 210ce294038d..e9545411ec5a 100644
+--- a/drivers/scsi/qla2xxx/qla_target.c
++++ b/drivers/scsi/qla2xxx/qla_target.c
+@@ -1261,7 +1261,6 @@ void qlt_schedule_sess_for_deletion(struct fc_port *sess)
+ 	    "Scheduling sess %p for deletion %8phC\n",
+ 	    sess, sess->port_name);
+ 
+-	INIT_WORK(&sess->del_work, qla24xx_delete_sess_fn);
+ 	WARN_ON(!queue_work(sess->vha->hw->wq, &sess->del_work));
+ }
+ 
+@@ -4780,6 +4779,7 @@ static int qlt_handle_login(struct scsi_qla_host *vha,
+ 
+ 	switch (sess->disc_state) {
+ 	case DSC_DELETED:
++	case DSC_LOGIN_PEND:
+ 		qlt_plogi_ack_unref(vha, pla);
+ 		break;
+ 
+diff --git a/drivers/scsi/qla4xxx/ql4_os.c b/drivers/scsi/qla4xxx/ql4_os.c
+index 25c8ce54a976..f8acf101af3d 100644
+--- a/drivers/scsi/qla4xxx/ql4_os.c
++++ b/drivers/scsi/qla4xxx/ql4_os.c
+@@ -4280,7 +4280,6 @@ static int qla4xxx_mem_alloc(struct scsi_qla_host *ha)
+ 	return QLA_SUCCESS;
+ 
+ mem_alloc_error_exit:
+-	qla4xxx_mem_free(ha);
+ 	return QLA_ERROR;
+ }
+ 
+diff --git a/drivers/tty/hvc/hvc_vio.c b/drivers/tty/hvc/hvc_vio.c
+index 59eaa620bf13..80fd06fbd712 100644
+--- a/drivers/tty/hvc/hvc_vio.c
++++ b/drivers/tty/hvc/hvc_vio.c
+@@ -107,6 +107,14 @@ static int hvterm_raw_get_chars(uint32_t vtermno, char *buf, int count)
+ 	return got;
+ }
+ 
++/**
++ * hvterm_raw_put_chars: send characters to firmware for given vterm adapter
++ * @vtermno: The virtual terminal number.
++ * @buf: The characters to send. Because of the underlying hypercall in
++ *       hvc_put_chars(), this buffer must be at least 16 bytes long, even if
++ *       you are sending fewer chars.
++ * @count: number of chars to send.
++ */
+ static int hvterm_raw_put_chars(uint32_t vtermno, const char *buf, int count)
+ {
+ 	struct hvterm_priv *pv = hvterm_privs[vtermno];
+@@ -219,6 +227,7 @@ static const struct hv_ops hvterm_hvsi_ops = {
+ static void udbg_hvc_putc(char c)
+ {
+ 	int count = -1;
++	unsigned char bounce_buffer[16];
+ 
+ 	if (!hvterm_privs[0])
+ 		return;
+@@ -229,7 +238,12 @@ static void udbg_hvc_putc(char c)
+ 	do {
+ 		switch(hvterm_privs[0]->proto) {
+ 		case HV_PROTOCOL_RAW:
+-			count = hvterm_raw_put_chars(0, &c, 1);
++			/*
++			 * hvterm_raw_put_chars requires at least a 16-byte
++			 * buffer, so go via the bounce buffer
++			 */
++			bounce_buffer[0] = c;
++			count = hvterm_raw_put_chars(0, bounce_buffer, 1);
+ 			break;
+ 		case HV_PROTOCOL_HVSI:
+ 			count = hvterm_hvsi_put_chars(0, &c, 1);
+diff --git a/drivers/tty/serial/msm_serial.c b/drivers/tty/serial/msm_serial.c
+index c10d9cc553c6..4caeca67fd14 100644
+--- a/drivers/tty/serial/msm_serial.c
++++ b/drivers/tty/serial/msm_serial.c
+@@ -1580,6 +1580,7 @@ static void __msm_console_write(struct uart_port *port, const char *s,
+ 	int num_newlines = 0;
+ 	bool replaced = false;
+ 	void __iomem *tf;
++	int locked = 1;
+ 
+ 	if (is_uartdm)
+ 		tf = port->membase + UARTDM_TF;
+@@ -1592,7 +1593,13 @@ static void __msm_console_write(struct uart_port *port, const char *s,
+ 			num_newlines++;
+ 	count += num_newlines;
+ 
+-	spin_lock(&port->lock);
++	if (port->sysrq)
++		locked = 0;
++	else if (oops_in_progress)
++		locked = spin_trylock(&port->lock);
++	else
++		spin_lock(&port->lock);
++
+ 	if (is_uartdm)
+ 		msm_reset_dm_count(port, count);
+ 
+@@ -1628,7 +1635,9 @@ static void __msm_console_write(struct uart_port *port, const char *s,
+ 		iowrite32_rep(tf, buf, 1);
+ 		i += num_chars;
+ 	}
+-	spin_unlock(&port->lock);
++
++	if (locked)
++		spin_unlock(&port->lock);
+ }
+ 
+ static void msm_console_write(struct console *co, const char *s,
+diff --git a/drivers/usb/gadget/function/f_ecm.c b/drivers/usb/gadget/function/f_ecm.c
+index 6ce044008cf6..460d5d7c984f 100644
+--- a/drivers/usb/gadget/function/f_ecm.c
++++ b/drivers/usb/gadget/function/f_ecm.c
+@@ -621,8 +621,12 @@ static void ecm_disable(struct usb_function *f)
+ 
+ 	DBG(cdev, "ecm deactivated\n");
+ 
+-	if (ecm->port.in_ep->enabled)
++	if (ecm->port.in_ep->enabled) {
+ 		gether_disconnect(&ecm->port);
++	} else {
++		ecm->port.in_ep->desc = NULL;
++		ecm->port.out_ep->desc = NULL;
++	}
+ 
+ 	usb_ep_disable(ecm->notify);
+ 	ecm->notify->desc = NULL;
+diff --git a/drivers/usb/gadget/function/f_rndis.c b/drivers/usb/gadget/function/f_rndis.c
+index d48df36622b7..0d8e4a364ca6 100644
+--- a/drivers/usb/gadget/function/f_rndis.c
++++ b/drivers/usb/gadget/function/f_rndis.c
+@@ -618,6 +618,7 @@ static void rndis_disable(struct usb_function *f)
+ 	gether_disconnect(&rndis->port);
+ 
+ 	usb_ep_disable(rndis->notify);
++	rndis->notify->desc = NULL;
+ }
+ 
+ /*-------------------------------------------------------------------------*/
+diff --git a/drivers/xen/balloon.c b/drivers/xen/balloon.c
+index 747a15acbce3..6fa7209f24f4 100644
+--- a/drivers/xen/balloon.c
++++ b/drivers/xen/balloon.c
+@@ -395,7 +395,8 @@ static struct notifier_block xen_memory_nb = {
+ #else
+ static enum bp_state reserve_additional_memory(void)
+ {
+-	balloon_stats.target_pages = balloon_stats.current_pages;
++	balloon_stats.target_pages = balloon_stats.current_pages +
++				     balloon_stats.target_unpopulated;
+ 	return BP_ECANCELED;
+ }
+ #endif /* CONFIG_XEN_BALLOON_MEMORY_HOTPLUG */
+diff --git a/fs/afs/dynroot.c b/fs/afs/dynroot.c
+index f29c6dade7f6..069273a2483f 100644
+--- a/fs/afs/dynroot.c
++++ b/fs/afs/dynroot.c
+@@ -145,6 +145,9 @@ static struct dentry *afs_dynroot_lookup(struct inode *dir, struct dentry *dentr
+ 
+ 	ASSERTCMP(d_inode(dentry), ==, NULL);
+ 
++	if (flags & LOOKUP_CREATE)
++		return ERR_PTR(-EOPNOTSUPP);
++
+ 	if (dentry->d_name.len >= AFSNAMEMAX) {
+ 		_leave(" = -ENAMETOOLONG");
+ 		return ERR_PTR(-ENAMETOOLONG);
+diff --git a/fs/afs/server.c b/fs/afs/server.c
+index 1d329e6981d5..2c7f6211c360 100644
+--- a/fs/afs/server.c
++++ b/fs/afs/server.c
+@@ -34,18 +34,11 @@ static void afs_dec_servers_outstanding(struct afs_net *net)
+ struct afs_server *afs_find_server(struct afs_net *net,
+ 				   const struct sockaddr_rxrpc *srx)
+ {
+-	const struct sockaddr_in6 *a = &srx->transport.sin6, *b;
+ 	const struct afs_addr_list *alist;
+ 	struct afs_server *server = NULL;
+ 	unsigned int i;
+-	bool ipv6 = true;
+ 	int seq = 0, diff;
+ 
+-	if (srx->transport.sin6.sin6_addr.s6_addr32[0] == 0 ||
+-	    srx->transport.sin6.sin6_addr.s6_addr32[1] == 0 ||
+-	    srx->transport.sin6.sin6_addr.s6_addr32[2] == htonl(0xffff))
+-		ipv6 = false;
+-
+ 	rcu_read_lock();
+ 
+ 	do {
+@@ -54,7 +47,8 @@ struct afs_server *afs_find_server(struct afs_net *net,
+ 		server = NULL;
+ 		read_seqbegin_or_lock(&net->fs_addr_lock, &seq);
+ 
+-		if (ipv6) {
++		if (srx->transport.family == AF_INET6) {
++			const struct sockaddr_in6 *a = &srx->transport.sin6, *b;
+ 			hlist_for_each_entry_rcu(server, &net->fs_addresses6, addr6_link) {
+ 				alist = rcu_dereference(server->addresses);
+ 				for (i = alist->nr_ipv4; i < alist->nr_addrs; i++) {
+@@ -70,15 +64,16 @@ struct afs_server *afs_find_server(struct afs_net *net,
+ 				}
+ 			}
+ 		} else {
++			const struct sockaddr_in *a = &srx->transport.sin, *b;
+ 			hlist_for_each_entry_rcu(server, &net->fs_addresses4, addr4_link) {
+ 				alist = rcu_dereference(server->addresses);
+ 				for (i = 0; i < alist->nr_ipv4; i++) {
+-					b = &alist->addrs[i].transport.sin6;
+-					diff = ((u16 __force)a->sin6_port -
+-						(u16 __force)b->sin6_port);
++					b = &alist->addrs[i].transport.sin;
++					diff = ((u16 __force)a->sin_port -
++						(u16 __force)b->sin_port);
+ 					if (diff == 0)
+-						diff = ((u32 __force)a->sin6_addr.s6_addr32[3] -
+-							(u32 __force)b->sin6_addr.s6_addr32[3]);
++						diff = ((u32 __force)a->sin_addr.s_addr -
++							(u32 __force)b->sin_addr.s_addr);
+ 					if (diff == 0)
+ 						goto found;
+ 				}
+diff --git a/fs/afs/super.c b/fs/afs/super.c
+index 4d3e274207fb..bd2608297473 100644
+--- a/fs/afs/super.c
++++ b/fs/afs/super.c
+@@ -404,7 +404,6 @@ static int afs_fill_super(struct super_block *sb,
+ 	/* allocate the root inode and dentry */
+ 	if (as->dyn_root) {
+ 		inode = afs_iget_pseudo_dir(sb, true);
+-		sb->s_flags	|= SB_RDONLY;
+ 	} else {
+ 		sprintf(sb->s_id, "%u", as->volume->vid);
+ 		afs_activate_volume(as->volume);
+diff --git a/fs/block_dev.c b/fs/block_dev.c
+index 1c25dae083a8..c158bad9a075 100644
+--- a/fs/block_dev.c
++++ b/fs/block_dev.c
+@@ -1328,11 +1328,7 @@ static void flush_disk(struct block_device *bdev, bool kill_dirty)
+ 		       "resized disk %s\n",
+ 		       bdev->bd_disk ? bdev->bd_disk->disk_name : "");
+ 	}
+-
+-	if (!bdev->bd_disk)
+-		return;
+-	if (disk_part_scan_enabled(bdev->bd_disk))
+-		bdev->bd_invalidated = 1;
++	bdev->bd_invalidated = 1;
+ }
+ 
+ /**
+@@ -1430,6 +1426,19 @@ EXPORT_SYMBOL(bd_set_size);
+ 
+ static void __blkdev_put(struct block_device *bdev, fmode_t mode, int for_part);
+ 
++static void bdev_disk_changed(struct block_device *bdev, bool invalidate)
++{
++	if (disk_part_scan_enabled(bdev->bd_disk)) {
++		if (invalidate)
++			invalidate_partitions(bdev->bd_disk, bdev);
++		else
++			rescan_partitions(bdev->bd_disk, bdev);
++	} else {
++		check_disk_size_change(bdev->bd_disk, bdev, !invalidate);
++		bdev->bd_invalidated = 0;
++	}
++}
++
+ /*
+  * bd_mutex locking:
+  *
+@@ -1512,12 +1521,9 @@ static int __blkdev_get(struct block_device *bdev, fmode_t mode, int for_part)
+ 			 * The latter is necessary to prevent ghost
+ 			 * partitions on a removed medium.
+ 			 */
+-			if (bdev->bd_invalidated) {
+-				if (!ret)
+-					rescan_partitions(disk, bdev);
+-				else if (ret == -ENOMEDIUM)
+-					invalidate_partitions(disk, bdev);
+-			}
++			if (bdev->bd_invalidated &&
++			    (!ret || ret == -ENOMEDIUM))
++				bdev_disk_changed(bdev, ret == -ENOMEDIUM);
+ 
+ 			if (ret)
+ 				goto out_clear;
+@@ -1550,12 +1556,9 @@ static int __blkdev_get(struct block_device *bdev, fmode_t mode, int for_part)
+ 			if (bdev->bd_disk->fops->open)
+ 				ret = bdev->bd_disk->fops->open(bdev, mode);
+ 			/* the same as first opener case, read comment there */
+-			if (bdev->bd_invalidated) {
+-				if (!ret)
+-					rescan_partitions(bdev->bd_disk, bdev);
+-				else if (ret == -ENOMEDIUM)
+-					invalidate_partitions(bdev->bd_disk, bdev);
+-			}
++			if (bdev->bd_invalidated &&
++			    (!ret || ret == -ENOMEDIUM))
++				bdev_disk_changed(bdev, ret == -ENOMEDIUM);
+ 			if (ret)
+ 				goto out_unlock_bdev;
+ 		}
+diff --git a/fs/compat_ioctl.c b/fs/compat_ioctl.c
+index 3a03f74a8cc4..c6fe9914440e 100644
+--- a/fs/compat_ioctl.c
++++ b/fs/compat_ioctl.c
+@@ -1401,10 +1401,11 @@ COMPAT_SYSCALL_DEFINE3(ioctl, unsigned int, fd, unsigned int, cmd,
+ #endif
+ 
+ 	case FICLONE:
++		goto do_ioctl;
+ 	case FICLONERANGE:
+ 	case FIDEDUPERANGE:
+ 	case FS_IOC_FIEMAP:
+-		goto do_ioctl;
++		goto found_handler;
+ 
+ 	case FIBMAP:
+ 	case FIGETBSZ:
+diff --git a/fs/locks.c b/fs/locks.c
+index 2ecb4db8c840..28270e74be34 100644
+--- a/fs/locks.c
++++ b/fs/locks.c
+@@ -2678,7 +2678,7 @@ static void lock_get_status(struct seq_file *f, struct file_lock *fl,
+ 	}
+ 	if (inode) {
+ 		/* userspace relies on this representation of dev_t */
+-		seq_printf(f, "%d %02x:%02x:%ld ", fl_pid,
++		seq_printf(f, "%d %02x:%02x:%lu ", fl_pid,
+ 				MAJOR(inode->i_sb->s_dev),
+ 				MINOR(inode->i_sb->s_dev), inode->i_ino);
+ 	} else {
+diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c
+index 5f62007140cf..c8ce128e0054 100644
+--- a/fs/nfsd/nfs4state.c
++++ b/fs/nfsd/nfs4state.c
+@@ -3072,12 +3072,17 @@ static bool replay_matches_cache(struct svc_rqst *rqstp,
+ 	    (bool)seq->cachethis)
+ 		return false;
+ 	/*
+-	 * If there's an error than the reply can have fewer ops than
+-	 * the call.  But if we cached a reply with *more* ops than the
+-	 * call you're sending us now, then this new call is clearly not
+-	 * really a replay of the old one:
++	 * If there's an error then the reply can have fewer ops than
++	 * the call.
+ 	 */
+-	if (slot->sl_opcnt < argp->opcnt)
++	if (slot->sl_opcnt < argp->opcnt && !slot->sl_status)
++		return false;
++	/*
++	 * But if we cached a reply with *more* ops than the call you're
++	 * sending us now, then this new call is clearly not really a
++	 * replay of the old one:
++	 */
++	if (slot->sl_opcnt > argp->opcnt)
+ 		return false;
+ 	/* This is the only check explicitly called by spec: */
+ 	if (!same_creds(&rqstp->rq_cred, &slot->sl_cred))
+diff --git a/fs/pstore/ram.c b/fs/pstore/ram.c
+index 631ae057ab53..bafbab2dd039 100644
+--- a/fs/pstore/ram.c
++++ b/fs/pstore/ram.c
+@@ -437,6 +437,17 @@ static int notrace ramoops_pstore_write(struct pstore_record *record)
+ 
+ 	prz = cxt->dprzs[cxt->dump_write_cnt];
+ 
++	/*
++	 * Since this is a new crash dump, we need to reset the buffer in
++	 * case it still has an old dump present. Without this, the new dump
++	 * will get appended, which would seriously confuse anything trying
++	 * to check dump file contents. Specifically, ramoops_read_kmsg_hdr()
++	 * expects to find a dump header in the beginning of buffer data, so
++	 * we must to reset the buffer values, in order to ensure that the
++	 * header will be written to the beginning of the buffer.
++	 */
++	persistent_ram_zap(prz);
++
+ 	/* Build header and append record contents. */
+ 	hlen = ramoops_write_kmsg_hdr(prz, record);
+ 	size = record->size;
+diff --git a/fs/ubifs/tnc_commit.c b/fs/ubifs/tnc_commit.c
+index dba87d09b989..95630f9f40dd 100644
+--- a/fs/ubifs/tnc_commit.c
++++ b/fs/ubifs/tnc_commit.c
+@@ -219,7 +219,7 @@ static int is_idx_node_in_use(struct ubifs_info *c, union ubifs_key *key,
+ /**
+  * layout_leb_in_gaps - layout index nodes using in-the-gaps method.
+  * @c: UBIFS file-system description object
+- * @p: return LEB number here
++ * @p: return LEB number in @c->gap_lebs[p]
+  *
+  * This function lays out new index nodes for dirty znodes using in-the-gaps
+  * method of TNC commit.
+@@ -228,7 +228,7 @@ static int is_idx_node_in_use(struct ubifs_info *c, union ubifs_key *key,
+  * This function returns the number of index nodes written into the gaps, or a
+  * negative error code on failure.
+  */
+-static int layout_leb_in_gaps(struct ubifs_info *c, int *p)
++static int layout_leb_in_gaps(struct ubifs_info *c, int p)
+ {
+ 	struct ubifs_scan_leb *sleb;
+ 	struct ubifs_scan_node *snod;
+@@ -243,7 +243,7 @@ static int layout_leb_in_gaps(struct ubifs_info *c, int *p)
+ 		 * filled, however we do not check there at present.
+ 		 */
+ 		return lnum; /* Error code */
+-	*p = lnum;
++	c->gap_lebs[p] = lnum;
+ 	dbg_gc("LEB %d", lnum);
+ 	/*
+ 	 * Scan the index LEB.  We use the generic scan for this even though
+@@ -362,7 +362,7 @@ static int get_leb_cnt(struct ubifs_info *c, int cnt)
+  */
+ static int layout_in_gaps(struct ubifs_info *c, int cnt)
+ {
+-	int err, leb_needed_cnt, written, *p;
++	int err, leb_needed_cnt, written, p = 0, old_idx_lebs, *gap_lebs;
+ 
+ 	dbg_gc("%d znodes to write", cnt);
+ 
+@@ -371,9 +371,9 @@ static int layout_in_gaps(struct ubifs_info *c, int cnt)
+ 	if (!c->gap_lebs)
+ 		return -ENOMEM;
+ 
+-	p = c->gap_lebs;
++	old_idx_lebs = c->lst.idx_lebs;
+ 	do {
+-		ubifs_assert(c, p < c->gap_lebs + c->lst.idx_lebs);
++		ubifs_assert(c, p < c->lst.idx_lebs);
+ 		written = layout_leb_in_gaps(c, p);
+ 		if (written < 0) {
+ 			err = written;
+@@ -399,9 +399,29 @@ static int layout_in_gaps(struct ubifs_info *c, int cnt)
+ 		leb_needed_cnt = get_leb_cnt(c, cnt);
+ 		dbg_gc("%d znodes remaining, need %d LEBs, have %d", cnt,
+ 		       leb_needed_cnt, c->ileb_cnt);
++		/*
++		 * Dynamically change the size of @c->gap_lebs to prevent
++		 * oob, because @c->lst.idx_lebs could be increased by
++		 * function @get_idx_gc_leb (called by layout_leb_in_gaps->
++		 * ubifs_find_dirty_idx_leb) during loop. Only enlarge
++		 * @c->gap_lebs when needed.
++		 *
++		 */
++		if (leb_needed_cnt > c->ileb_cnt && p >= old_idx_lebs &&
++		    old_idx_lebs < c->lst.idx_lebs) {
++			old_idx_lebs = c->lst.idx_lebs;
++			gap_lebs = krealloc(c->gap_lebs, sizeof(int) *
++					       (old_idx_lebs + 1), GFP_NOFS);
++			if (!gap_lebs) {
++				kfree(c->gap_lebs);
++				c->gap_lebs = NULL;
++				return -ENOMEM;
++			}
++			c->gap_lebs = gap_lebs;
++		}
+ 	} while (leb_needed_cnt > c->ileb_cnt);
+ 
+-	*p = -1;
++	c->gap_lebs[p] = -1;
+ 	return 0;
+ }
+ 
+diff --git a/fs/xfs/libxfs/xfs_bmap.c b/fs/xfs/libxfs/xfs_bmap.c
+index 38dc0b43c366..0b7145fdb8aa 100644
+--- a/fs/xfs/libxfs/xfs_bmap.c
++++ b/fs/xfs/libxfs/xfs_bmap.c
+@@ -5239,7 +5239,7 @@ __xfs_bunmapi(
+ 		 * Make sure we don't touch multiple AGF headers out of order
+ 		 * in a single transaction, as that could cause AB-BA deadlocks.
+ 		 */
+-		if (!wasdel) {
++		if (!wasdel && !isrt) {
+ 			agno = XFS_FSB_TO_AGNO(mp, del.br_startblock);
+ 			if (prev_agno != NULLAGNUMBER && prev_agno > agno)
+ 				break;
+diff --git a/fs/xfs/scrub/common.h b/fs/xfs/scrub/common.h
+index 2d4324d12f9a..51ea2ab124b7 100644
+--- a/fs/xfs/scrub/common.h
++++ b/fs/xfs/scrub/common.h
+@@ -14,8 +14,15 @@
+ static inline bool
+ xchk_should_terminate(
+ 	struct xfs_scrub	*sc,
+-	int				*error)
++	int			*error)
+ {
++	/*
++	 * If preemption is disabled, we need to yield to the scheduler every
++	 * few seconds so that we don't run afoul of the soft lockup watchdog
++	 * or RCU stall detector.
++	 */
++	cond_resched();
++
+ 	if (fatal_signal_pending(current)) {
+ 		if (*error == 0)
+ 			*error = -EAGAIN;
+diff --git a/fs/xfs/xfs_log.c b/fs/xfs/xfs_log.c
+index c3b610b687d1..7bba551cbf90 100644
+--- a/fs/xfs/xfs_log.c
++++ b/fs/xfs/xfs_log.c
+@@ -1578,6 +1578,8 @@ out_free_iclog:
+ 		if (iclog->ic_bp)
+ 			xfs_buf_free(iclog->ic_bp);
+ 		kmem_free(iclog);
++		if (prev_iclog == log->l_iclog)
++			break;
+ 	}
+ 	spinlock_destroy(&log->l_icloglock);
+ 	xfs_buf_free(log->l_xbuf);
+diff --git a/include/linux/ahci_platform.h b/include/linux/ahci_platform.h
+index eaedca5fe6fc..345c3b510045 100644
+--- a/include/linux/ahci_platform.h
++++ b/include/linux/ahci_platform.h
+@@ -23,6 +23,8 @@ struct ahci_host_priv;
+ struct platform_device;
+ struct scsi_host_template;
+ 
++int ahci_platform_enable_phys(struct ahci_host_priv *hpriv);
++void ahci_platform_disable_phys(struct ahci_host_priv *hpriv);
+ int ahci_platform_enable_clks(struct ahci_host_priv *hpriv);
+ void ahci_platform_disable_clks(struct ahci_host_priv *hpriv);
+ int ahci_platform_enable_regulators(struct ahci_host_priv *hpriv);
+diff --git a/include/linux/dmaengine.h b/include/linux/dmaengine.h
+index d49ec5c31944..0647f436f88c 100644
+--- a/include/linux/dmaengine.h
++++ b/include/linux/dmaengine.h
+@@ -1373,8 +1373,11 @@ static inline int dma_get_slave_caps(struct dma_chan *chan,
+ static inline int dmaengine_desc_set_reuse(struct dma_async_tx_descriptor *tx)
+ {
+ 	struct dma_slave_caps caps;
++	int ret;
+ 
+-	dma_get_slave_caps(tx->chan, &caps);
++	ret = dma_get_slave_caps(tx->chan, &caps);
++	if (ret)
++		return ret;
+ 
+ 	if (caps.descriptor_reuse) {
+ 		tx->flags |= DMA_CTRL_REUSE;
+diff --git a/include/linux/libata.h b/include/linux/libata.h
+index 38c95d66ab12..aff09d0b3545 100644
+--- a/include/linux/libata.h
++++ b/include/linux/libata.h
+@@ -1190,6 +1190,7 @@ extern unsigned int ata_do_dev_read_id(struct ata_device *dev,
+ 					struct ata_taskfile *tf, u16 *id);
+ extern void ata_qc_complete(struct ata_queued_cmd *qc);
+ extern int ata_qc_complete_multiple(struct ata_port *ap, u64 qc_active);
++extern u64 ata_qc_get_active(struct ata_port *ap);
+ extern void ata_scsi_simulate(struct ata_device *dev, struct scsi_cmnd *cmd);
+ extern int ata_std_bios_param(struct scsi_device *sdev,
+ 			      struct block_device *bdev,
+diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
+index 9dfa0ae173ac..d5527e3828d1 100644
+--- a/include/linux/netdevice.h
++++ b/include/linux/netdevice.h
+@@ -1619,6 +1619,8 @@ enum netdev_priv_flags {
+  * 	@perm_addr:		Permanent hw address
+  * 	@addr_assign_type:	Hw address assignment type
+  * 	@addr_len:		Hardware address length
++ *	@upper_level:		Maximum depth level of upper devices.
++ *	@lower_level:		Maximum depth level of lower devices.
+  *	@neigh_priv_len:	Used in neigh_alloc()
+  * 	@dev_id:		Used to differentiate devices that share
+  * 				the same link layer address
+@@ -1853,6 +1855,8 @@ struct net_device {
+ 	unsigned char		perm_addr[MAX_ADDR_LEN];
+ 	unsigned char		addr_assign_type;
+ 	unsigned char		addr_len;
++	unsigned char		upper_level;
++	unsigned char		lower_level;
+ 	unsigned short		neigh_priv_len;
+ 	unsigned short          dev_id;
+ 	unsigned short          dev_port;
+diff --git a/include/linux/nvme-fc-driver.h b/include/linux/nvme-fc-driver.h
+index 496ff759f84c..2f3ae41c212d 100644
+--- a/include/linux/nvme-fc-driver.h
++++ b/include/linux/nvme-fc-driver.h
+@@ -282,6 +282,8 @@ struct nvme_fc_remote_port {
+  *
+  * Host/Initiator Transport Entrypoints/Parameters:
+  *
++ * @module:  The LLDD module using the interface
++ *
+  * @localport_delete:  The LLDD initiates deletion of a localport via
+  *       nvme_fc_deregister_localport(). However, the teardown is
+  *       asynchronous. This routine is called upon the completion of the
+@@ -395,6 +397,8 @@ struct nvme_fc_remote_port {
+  *       Value is Mandatory. Allowed to be zero.
+  */
+ struct nvme_fc_port_template {
++	struct module	*module;
++
+ 	/* initiator-based functions */
+ 	void	(*localport_delete)(struct nvme_fc_local_port *);
+ 	void	(*remoteport_delete)(struct nvme_fc_remote_port *);
+diff --git a/include/linux/regulator/ab8500.h b/include/linux/regulator/ab8500.h
+index 6d46f962685d..06978ce01302 100644
+--- a/include/linux/regulator/ab8500.h
++++ b/include/linux/regulator/ab8500.h
+@@ -38,7 +38,6 @@ enum ab8505_regulator_id {
+ 	AB8505_LDO_AUX6,
+ 	AB8505_LDO_INTCORE,
+ 	AB8505_LDO_ADC,
+-	AB8505_LDO_USB,
+ 	AB8505_LDO_AUDIO,
+ 	AB8505_LDO_ANAMIC1,
+ 	AB8505_LDO_ANAMIC2,
+diff --git a/include/net/neighbour.h b/include/net/neighbour.h
+index c84807c1c5bd..5ce035984a4d 100644
+--- a/include/net/neighbour.h
++++ b/include/net/neighbour.h
+@@ -459,7 +459,7 @@ static inline int neigh_hh_output(const struct hh_cache *hh, struct sk_buff *skb
+ 
+ 	do {
+ 		seq = read_seqbegin(&hh->hh_lock);
+-		hh_len = hh->hh_len;
++		hh_len = READ_ONCE(hh->hh_len);
+ 		if (likely(hh_len <= HH_DATA_MOD)) {
+ 			hh_alen = HH_DATA_MOD;
+ 
+diff --git a/kernel/cred.c b/kernel/cred.c
+index 5ab1f7ec946e..a9f0f8b21d8c 100644
+--- a/kernel/cred.c
++++ b/kernel/cred.c
+@@ -220,7 +220,7 @@ struct cred *cred_alloc_blank(void)
+ 	new->magic = CRED_MAGIC;
+ #endif
+ 
+-	if (security_cred_alloc_blank(new, GFP_KERNEL) < 0)
++	if (security_cred_alloc_blank(new, GFP_KERNEL_ACCOUNT) < 0)
+ 		goto error;
+ 
+ 	return new;
+@@ -279,7 +279,7 @@ struct cred *prepare_creds(void)
+ 	new->security = NULL;
+ #endif
+ 
+-	if (security_prepare_creds(new, old, GFP_KERNEL) < 0)
++	if (security_prepare_creds(new, old, GFP_KERNEL_ACCOUNT) < 0)
+ 		goto error;
+ 	validate_creds(new);
+ 	return new;
+@@ -654,7 +654,7 @@ struct cred *prepare_kernel_cred(struct task_struct *daemon)
+ #ifdef CONFIG_SECURITY
+ 	new->security = NULL;
+ #endif
+-	if (security_prepare_creds(new, old, GFP_KERNEL) < 0)
++	if (security_prepare_creds(new, old, GFP_KERNEL_ACCOUNT) < 0)
+ 		goto error;
+ 
+ 	put_cred(old);
+diff --git a/kernel/exit.c b/kernel/exit.c
+index e10de9836dd7..54c3269b8dda 100644
+--- a/kernel/exit.c
++++ b/kernel/exit.c
+@@ -578,10 +578,6 @@ static struct task_struct *find_child_reaper(struct task_struct *father,
+ 	}
+ 
+ 	write_unlock_irq(&tasklist_lock);
+-	if (unlikely(pid_ns == &init_pid_ns)) {
+-		panic("Attempted to kill init! exitcode=0x%08x\n",
+-			father->signal->group_exit_code ?: father->exit_code);
+-	}
+ 
+ 	list_for_each_entry_safe(p, n, dead, ptrace_entry) {
+ 		list_del_init(&p->ptrace_entry);
+@@ -845,6 +841,14 @@ void __noreturn do_exit(long code)
+ 	acct_update_integrals(tsk);
+ 	group_dead = atomic_dec_and_test(&tsk->signal->live);
+ 	if (group_dead) {
++		/*
++		 * If the last thread of global init has exited, panic
++		 * immediately to get a useable coredump.
++		 */
++		if (unlikely(is_global_init(tsk)))
++			panic("Attempted to kill init! exitcode=0x%08x\n",
++				tsk->signal->group_exit_code ?: (int)code);
++
+ #ifdef CONFIG_POSIX_TIMERS
+ 		hrtimer_cancel(&tsk->signal->real_timer);
+ 		exit_itimers(tsk->signal);
+diff --git a/kernel/power/snapshot.c b/kernel/power/snapshot.c
+index 3d37c279c090..f2635fc751d9 100644
+--- a/kernel/power/snapshot.c
++++ b/kernel/power/snapshot.c
+@@ -736,8 +736,15 @@ zone_found:
+ 	 * We have found the zone. Now walk the radix tree to find the leaf node
+ 	 * for our PFN.
+ 	 */
++
++	/*
++	 * If the zone we wish to scan is the the current zone and the
++	 * pfn falls into the current node then we do not need to walk
++	 * the tree.
++	 */
+ 	node = bm->cur.node;
+-	if (((pfn - zone->start_pfn) & ~BM_BLOCK_MASK) == bm->cur.node_pfn)
++	if (zone == bm->cur.zone &&
++	    ((pfn - zone->start_pfn) & ~BM_BLOCK_MASK) == bm->cur.node_pfn)
+ 		goto node_found;
+ 
+ 	node      = zone->rtree;
+diff --git a/kernel/taskstats.c b/kernel/taskstats.c
+index 4e62a4a8fa91..82393952683c 100644
+--- a/kernel/taskstats.c
++++ b/kernel/taskstats.c
+@@ -564,25 +564,33 @@ static int taskstats_user_cmd(struct sk_buff *skb, struct genl_info *info)
+ static struct taskstats *taskstats_tgid_alloc(struct task_struct *tsk)
+ {
+ 	struct signal_struct *sig = tsk->signal;
+-	struct taskstats *stats;
++	struct taskstats *stats_new, *stats;
+ 
+-	if (sig->stats || thread_group_empty(tsk))
+-		goto ret;
++	/* Pairs with smp_store_release() below. */
++	stats = smp_load_acquire(&sig->stats);
++	if (stats || thread_group_empty(tsk))
++		return stats;
+ 
+ 	/* No problem if kmem_cache_zalloc() fails */
+-	stats = kmem_cache_zalloc(taskstats_cache, GFP_KERNEL);
++	stats_new = kmem_cache_zalloc(taskstats_cache, GFP_KERNEL);
+ 
+ 	spin_lock_irq(&tsk->sighand->siglock);
+-	if (!sig->stats) {
+-		sig->stats = stats;
+-		stats = NULL;
++	stats = sig->stats;
++	if (!stats) {
++		/*
++		 * Pairs with smp_store_release() above and order the
++		 * kmem_cache_zalloc().
++		 */
++		smp_store_release(&sig->stats, stats_new);
++		stats = stats_new;
++		stats_new = NULL;
+ 	}
+ 	spin_unlock_irq(&tsk->sighand->siglock);
+ 
+-	if (stats)
+-		kmem_cache_free(taskstats_cache, stats);
+-ret:
+-	return sig->stats;
++	if (stats_new)
++		kmem_cache_free(taskstats_cache, stats_new);
++
++	return stats;
+ }
+ 
+ /* Send pid data out on exit */
+diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
+index b84eb9659e95..37a435bac161 100644
+--- a/kernel/trace/ftrace.c
++++ b/kernel/trace/ftrace.c
+@@ -554,8 +554,7 @@ static int function_stat_show(struct seq_file *m, void *v)
+ 	}
+ 
+ #ifdef CONFIG_FUNCTION_GRAPH_TRACER
+-	avg = rec->time;
+-	do_div(avg, rec->counter);
++	avg = div64_ul(rec->time, rec->counter);
+ 	if (tracing_thresh && (avg < tracing_thresh))
+ 		goto out;
+ #endif
+@@ -581,7 +580,8 @@ static int function_stat_show(struct seq_file *m, void *v)
+ 		 * Divide only 1000 for ns^2 -> us^2 conversion.
+ 		 * trace_print_graph_duration will divide 1000 again.
+ 		 */
+-		do_div(stddev, rec->counter * (rec->counter - 1) * 1000);
++		stddev = div64_ul(stddev,
++				  rec->counter * (rec->counter - 1) * 1000);
+ 	}
+ 
+ 	trace_seq_init(&s);
+diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
+index b6ff2f84df17..e61aa1c68e99 100644
+--- a/kernel/trace/trace.c
++++ b/kernel/trace/trace.c
+@@ -4370,6 +4370,10 @@ int trace_keep_overwrite(struct tracer *tracer, u32 mask, int set)
+ 
+ int set_tracer_flag(struct trace_array *tr, unsigned int mask, int enabled)
+ {
++	if ((mask == TRACE_ITER_RECORD_TGID) ||
++	    (mask == TRACE_ITER_RECORD_CMD))
++		lockdep_assert_held(&event_mutex);
++
+ 	/* do nothing if flag is already set */
+ 	if (!!(tr->trace_flags & mask) == !!enabled)
+ 		return 0;
+@@ -4435,6 +4439,7 @@ static int trace_set_options(struct trace_array *tr, char *option)
+ 		cmp += 2;
+ 	}
+ 
++	mutex_lock(&event_mutex);
+ 	mutex_lock(&trace_types_lock);
+ 
+ 	ret = match_string(trace_options, -1, cmp);
+@@ -4445,6 +4450,7 @@ static int trace_set_options(struct trace_array *tr, char *option)
+ 		ret = set_tracer_flag(tr, 1 << ret, !neg);
+ 
+ 	mutex_unlock(&trace_types_lock);
++	mutex_unlock(&event_mutex);
+ 
+ 	/*
+ 	 * If the first trailing whitespace is replaced with '\0' by strstrip,
+@@ -7457,9 +7463,11 @@ trace_options_core_write(struct file *filp, const char __user *ubuf, size_t cnt,
+ 	if (val != 0 && val != 1)
+ 		return -EINVAL;
+ 
++	mutex_lock(&event_mutex);
+ 	mutex_lock(&trace_types_lock);
+ 	ret = set_tracer_flag(tr, 1 << index, val);
+ 	mutex_unlock(&trace_types_lock);
++	mutex_unlock(&event_mutex);
+ 
+ 	if (ret < 0)
+ 		return ret;
+diff --git a/kernel/trace/trace_events.c b/kernel/trace/trace_events.c
+index 017f737237e6..ec340e1cbffc 100644
+--- a/kernel/trace/trace_events.c
++++ b/kernel/trace/trace_events.c
+@@ -327,7 +327,8 @@ void trace_event_enable_cmd_record(bool enable)
+ 	struct trace_event_file *file;
+ 	struct trace_array *tr;
+ 
+-	mutex_lock(&event_mutex);
++	lockdep_assert_held(&event_mutex);
++
+ 	do_for_each_event_file(tr, file) {
+ 
+ 		if (!(file->flags & EVENT_FILE_FL_ENABLED))
+@@ -341,7 +342,6 @@ void trace_event_enable_cmd_record(bool enable)
+ 			clear_bit(EVENT_FILE_FL_RECORDED_CMD_BIT, &file->flags);
+ 		}
+ 	} while_for_each_event_file();
+-	mutex_unlock(&event_mutex);
+ }
+ 
+ void trace_event_enable_tgid_record(bool enable)
+@@ -349,7 +349,8 @@ void trace_event_enable_tgid_record(bool enable)
+ 	struct trace_event_file *file;
+ 	struct trace_array *tr;
+ 
+-	mutex_lock(&event_mutex);
++	lockdep_assert_held(&event_mutex);
++
+ 	do_for_each_event_file(tr, file) {
+ 		if (!(file->flags & EVENT_FILE_FL_ENABLED))
+ 			continue;
+@@ -363,7 +364,6 @@ void trace_event_enable_tgid_record(bool enable)
+ 				  &file->flags);
+ 		}
+ 	} while_for_each_event_file();
+-	mutex_unlock(&event_mutex);
+ }
+ 
+ static int __ftrace_event_enable_disable(struct trace_event_file *file,
+diff --git a/kernel/trace/trace_events_filter.c b/kernel/trace/trace_events_filter.c
+index 2fb78467582b..b949c3917c67 100644
+--- a/kernel/trace/trace_events_filter.c
++++ b/kernel/trace/trace_events_filter.c
+@@ -1642,7 +1642,7 @@ static int process_system_preds(struct trace_subsystem_dir *dir,
+ 	parse_error(pe, FILT_ERR_BAD_SUBSYS_FILTER, 0);
+ 	return -EINVAL;
+  fail_mem:
+-	kfree(filter);
++	__free_filter(filter);
+ 	/* If any call succeeded, we still need to sync */
+ 	if (!fail)
+ 		tracepoint_synchronize_unregister();
+diff --git a/kernel/trace/trace_events_hist.c b/kernel/trace/trace_events_hist.c
+index 11d952650fa7..0fb92d0c7b20 100644
+--- a/kernel/trace/trace_events_hist.c
++++ b/kernel/trace/trace_events_hist.c
+@@ -665,7 +665,26 @@ static notrace void trace_event_raw_event_synth(void *__data,
+ 			strscpy(str_field, str_val, STR_VAR_LEN_MAX);
+ 			n_u64 += STR_VAR_LEN_MAX / sizeof(u64);
+ 		} else {
+-			entry->fields[n_u64] = var_ref_vals[var_ref_idx + i];
++			struct synth_field *field = event->fields[i];
++			u64 val = var_ref_vals[var_ref_idx + i];
++
++			switch (field->size) {
++			case 1:
++				*(u8 *)&entry->fields[n_u64] = (u8)val;
++				break;
++
++			case 2:
++				*(u16 *)&entry->fields[n_u64] = (u16)val;
++				break;
++
++			case 4:
++				*(u32 *)&entry->fields[n_u64] = (u32)val;
++				break;
++
++			default:
++				entry->fields[n_u64] = val;
++				break;
++			}
+ 			n_u64++;
+ 		}
+ 	}
+diff --git a/kernel/trace/tracing_map.c b/kernel/trace/tracing_map.c
+index 9a1c22310323..9e31bfc818ff 100644
+--- a/kernel/trace/tracing_map.c
++++ b/kernel/trace/tracing_map.c
+@@ -148,8 +148,8 @@ static int tracing_map_cmp_atomic64(void *val_a, void *val_b)
+ #define DEFINE_TRACING_MAP_CMP_FN(type)					\
+ static int tracing_map_cmp_##type(void *val_a, void *val_b)		\
+ {									\
+-	type a = *(type *)val_a;					\
+-	type b = *(type *)val_b;					\
++	type a = (type)(*(u64 *)val_a);					\
++	type b = (type)(*(u64 *)val_b);					\
+ 									\
+ 	return (a > b) ? 1 : ((a < b) ? -1 : 0);			\
+ }
+diff --git a/mm/migrate.c b/mm/migrate.c
+index 4d3588c01203..593557c107d2 100644
+--- a/mm/migrate.c
++++ b/mm/migrate.c
+@@ -1508,9 +1508,11 @@ static int do_move_pages_to_node(struct mm_struct *mm,
+ /*
+  * Resolves the given address to a struct page, isolates it from the LRU and
+  * puts it to the given pagelist.
+- * Returns -errno if the page cannot be found/isolated or 0 when it has been
+- * queued or the page doesn't need to be migrated because it is already on
+- * the target node
++ * Returns:
++ *     errno - if the page cannot be found/isolated
++ *     0 - when it doesn't have to be migrated because it is already on the
++ *         target node
++ *     1 - when it has been queued
+  */
+ static int add_page_for_migration(struct mm_struct *mm, unsigned long addr,
+ 		int node, struct list_head *pagelist, bool migrate_all)
+@@ -1549,7 +1551,7 @@ static int add_page_for_migration(struct mm_struct *mm, unsigned long addr,
+ 	if (PageHuge(page)) {
+ 		if (PageHead(page)) {
+ 			isolate_huge_page(page, pagelist);
+-			err = 0;
++			err = 1;
+ 		}
+ 	} else {
+ 		struct page *head;
+@@ -1559,7 +1561,7 @@ static int add_page_for_migration(struct mm_struct *mm, unsigned long addr,
+ 		if (err)
+ 			goto out_putpage;
+ 
+-		err = 0;
++		err = 1;
+ 		list_add_tail(&head->lru, pagelist);
+ 		mod_node_page_state(page_pgdat(head),
+ 			NR_ISOLATED_ANON + page_is_file_cache(head),
+@@ -1636,8 +1638,17 @@ static int do_pages_move(struct mm_struct *mm, nodemask_t task_nodes,
+ 		 */
+ 		err = add_page_for_migration(mm, addr, current_node,
+ 				&pagelist, flags & MPOL_MF_MOVE_ALL);
+-		if (!err)
++
++		if (!err) {
++			/* The page is already on the target node */
++			err = store_status(status, i, current_node, 1);
++			if (err)
++				goto out_flush;
+ 			continue;
++		} else if (err > 0) {
++			/* The page is successfully queued for migration */
++			continue;
++		}
+ 
+ 		err = store_status(status, i, err, 1);
+ 		if (err)
+diff --git a/mm/mmap.c b/mm/mmap.c
+index 1480880ff814..a98f09b83019 100644
+--- a/mm/mmap.c
++++ b/mm/mmap.c
+@@ -89,12 +89,6 @@ static void unmap_region(struct mm_struct *mm,
+  * MAP_PRIVATE	r: (no) no	r: (yes) yes	r: (no) yes	r: (no) yes
+  *		w: (no) no	w: (no) no	w: (copy) copy	w: (no) no
+  *		x: (no) no	x: (no) yes	x: (no) yes	x: (yes) yes
+- *
+- * On arm64, PROT_EXEC has the following behaviour for both MAP_SHARED and
+- * MAP_PRIVATE:
+- *								r: (no) no
+- *								w: (no) no
+- *								x: (yes) yes
+  */
+ pgprot_t protection_map[16] __ro_after_init = {
+ 	__P000, __P001, __P010, __P011, __P100, __P101, __P110, __P111,
+diff --git a/mm/zsmalloc.c b/mm/zsmalloc.c
+index 4b9063d12b93..85cc29c93d93 100644
+--- a/mm/zsmalloc.c
++++ b/mm/zsmalloc.c
+@@ -2092,6 +2092,11 @@ static int zs_page_migrate(struct address_space *mapping, struct page *newpage,
+ 		zs_pool_dec_isolated(pool);
+ 	}
+ 
++	if (page_zone(newpage) != page_zone(page)) {
++		dec_zone_page_state(page, NR_ZSPAGES);
++		inc_zone_page_state(newpage, NR_ZSPAGES);
++	}
++
+ 	reset_page(page);
+ 	put_page(page);
+ 	page = newpage;
+diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c
+index f5c27065ad44..db735d0d931e 100644
+--- a/net/bluetooth/hci_conn.c
++++ b/net/bluetooth/hci_conn.c
+@@ -1173,8 +1173,10 @@ struct hci_conn *hci_connect_le_scan(struct hci_dev *hdev, bdaddr_t *dst,
+ 	if (!conn)
+ 		return ERR_PTR(-ENOMEM);
+ 
+-	if (hci_explicit_conn_params_set(hdev, dst, dst_type) < 0)
++	if (hci_explicit_conn_params_set(hdev, dst, dst_type) < 0) {
++		hci_conn_del(conn);
+ 		return ERR_PTR(-EBUSY);
++	}
+ 
+ 	conn->state = BT_CONNECT;
+ 	set_bit(HCI_CONN_SCANNING, &conn->flags);
+diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
+index 974c1b8a689c..0d84d1f820d4 100644
+--- a/net/bluetooth/l2cap_core.c
++++ b/net/bluetooth/l2cap_core.c
+@@ -4918,10 +4918,8 @@ void __l2cap_physical_cfm(struct l2cap_chan *chan, int result)
+ 	BT_DBG("chan %p, result %d, local_amp_id %d, remote_amp_id %d",
+ 	       chan, result, local_amp_id, remote_amp_id);
+ 
+-	if (chan->state == BT_DISCONN || chan->state == BT_CLOSED) {
+-		l2cap_chan_unlock(chan);
++	if (chan->state == BT_DISCONN || chan->state == BT_CLOSED)
+ 		return;
+-	}
+ 
+ 	if (chan->state != BT_CONNECTED) {
+ 		l2cap_do_create(chan, result, local_amp_id, remote_amp_id);
+diff --git a/net/core/dev.c b/net/core/dev.c
+index 8ff21d461f08..a26d87073f71 100644
+--- a/net/core/dev.c
++++ b/net/core/dev.c
+@@ -149,6 +149,7 @@
+ #include "net-sysfs.h"
+ 
+ #define MAX_GRO_SKBS 8
++#define MAX_NEST_DEV 8
+ 
+ /* This should be increased if a protocol with a bigger head is added. */
+ #define GRO_MAX_HEAD (MAX_HEADER + 128)
+@@ -6542,6 +6543,21 @@ struct net_device *netdev_upper_get_next_dev_rcu(struct net_device *dev,
+ }
+ EXPORT_SYMBOL(netdev_upper_get_next_dev_rcu);
+ 
++static struct net_device *netdev_next_upper_dev(struct net_device *dev,
++						struct list_head **iter)
++{
++	struct netdev_adjacent *upper;
++
++	upper = list_entry((*iter)->next, struct netdev_adjacent, list);
++
++	if (&upper->list == &dev->adj_list.upper)
++		return NULL;
++
++	*iter = &upper->list;
++
++	return upper->dev;
++}
++
+ static struct net_device *netdev_next_upper_dev_rcu(struct net_device *dev,
+ 						    struct list_head **iter)
+ {
+@@ -6559,28 +6575,93 @@ static struct net_device *netdev_next_upper_dev_rcu(struct net_device *dev,
+ 	return upper->dev;
+ }
+ 
++static int netdev_walk_all_upper_dev(struct net_device *dev,
++				     int (*fn)(struct net_device *dev,
++					       void *data),
++				     void *data)
++{
++	struct net_device *udev, *next, *now, *dev_stack[MAX_NEST_DEV + 1];
++	struct list_head *niter, *iter, *iter_stack[MAX_NEST_DEV + 1];
++	int ret, cur = 0;
++
++	now = dev;
++	iter = &dev->adj_list.upper;
++
++	while (1) {
++		if (now != dev) {
++			ret = fn(now, data);
++			if (ret)
++				return ret;
++		}
++
++		next = NULL;
++		while (1) {
++			udev = netdev_next_upper_dev(now, &iter);
++			if (!udev)
++				break;
++
++			next = udev;
++			niter = &udev->adj_list.upper;
++			dev_stack[cur] = now;
++			iter_stack[cur++] = iter;
++			break;
++		}
++
++		if (!next) {
++			if (!cur)
++				return 0;
++			next = dev_stack[--cur];
++			niter = iter_stack[cur];
++		}
++
++		now = next;
++		iter = niter;
++	}
++
++	return 0;
++}
++
+ int netdev_walk_all_upper_dev_rcu(struct net_device *dev,
+ 				  int (*fn)(struct net_device *dev,
+ 					    void *data),
+ 				  void *data)
+ {
+-	struct net_device *udev;
+-	struct list_head *iter;
+-	int ret;
++	struct net_device *udev, *next, *now, *dev_stack[MAX_NEST_DEV + 1];
++	struct list_head *niter, *iter, *iter_stack[MAX_NEST_DEV + 1];
++	int ret, cur = 0;
+ 
+-	for (iter = &dev->adj_list.upper,
+-	     udev = netdev_next_upper_dev_rcu(dev, &iter);
+-	     udev;
+-	     udev = netdev_next_upper_dev_rcu(dev, &iter)) {
+-		/* first is the upper device itself */
+-		ret = fn(udev, data);
+-		if (ret)
+-			return ret;
++	now = dev;
++	iter = &dev->adj_list.upper;
+ 
+-		/* then look at all of its upper devices */
+-		ret = netdev_walk_all_upper_dev_rcu(udev, fn, data);
+-		if (ret)
+-			return ret;
++	while (1) {
++		if (now != dev) {
++			ret = fn(now, data);
++			if (ret)
++				return ret;
++		}
++
++		next = NULL;
++		while (1) {
++			udev = netdev_next_upper_dev_rcu(now, &iter);
++			if (!udev)
++				break;
++
++			next = udev;
++			niter = &udev->adj_list.upper;
++			dev_stack[cur] = now;
++			iter_stack[cur++] = iter;
++			break;
++		}
++
++		if (!next) {
++			if (!cur)
++				return 0;
++			next = dev_stack[--cur];
++			niter = iter_stack[cur];
++		}
++
++		now = next;
++		iter = niter;
+ 	}
+ 
+ 	return 0;
+@@ -6688,23 +6769,42 @@ int netdev_walk_all_lower_dev(struct net_device *dev,
+ 					void *data),
+ 			      void *data)
+ {
+-	struct net_device *ldev;
+-	struct list_head *iter;
+-	int ret;
++	struct net_device *ldev, *next, *now, *dev_stack[MAX_NEST_DEV + 1];
++	struct list_head *niter, *iter, *iter_stack[MAX_NEST_DEV + 1];
++	int ret, cur = 0;
+ 
+-	for (iter = &dev->adj_list.lower,
+-	     ldev = netdev_next_lower_dev(dev, &iter);
+-	     ldev;
+-	     ldev = netdev_next_lower_dev(dev, &iter)) {
+-		/* first is the lower device itself */
+-		ret = fn(ldev, data);
+-		if (ret)
+-			return ret;
++	now = dev;
++	iter = &dev->adj_list.lower;
+ 
+-		/* then look at all of its lower devices */
+-		ret = netdev_walk_all_lower_dev(ldev, fn, data);
+-		if (ret)
+-			return ret;
++	while (1) {
++		if (now != dev) {
++			ret = fn(now, data);
++			if (ret)
++				return ret;
++		}
++
++		next = NULL;
++		while (1) {
++			ldev = netdev_next_lower_dev(now, &iter);
++			if (!ldev)
++				break;
++
++			next = ldev;
++			niter = &ldev->adj_list.lower;
++			dev_stack[cur] = now;
++			iter_stack[cur++] = iter;
++			break;
++		}
++
++		if (!next) {
++			if (!cur)
++				return 0;
++			next = dev_stack[--cur];
++			niter = iter_stack[cur];
++		}
++
++		now = next;
++		iter = niter;
+ 	}
+ 
+ 	return 0;
+@@ -6725,28 +6825,93 @@ static struct net_device *netdev_next_lower_dev_rcu(struct net_device *dev,
+ 	return lower->dev;
+ }
+ 
+-int netdev_walk_all_lower_dev_rcu(struct net_device *dev,
+-				  int (*fn)(struct net_device *dev,
+-					    void *data),
+-				  void *data)
++static u8 __netdev_upper_depth(struct net_device *dev)
++{
++	struct net_device *udev;
++	struct list_head *iter;
++	u8 max_depth = 0;
++
++	for (iter = &dev->adj_list.upper,
++	     udev = netdev_next_upper_dev(dev, &iter);
++	     udev;
++	     udev = netdev_next_upper_dev(dev, &iter)) {
++		if (max_depth < udev->upper_level)
++			max_depth = udev->upper_level;
++	}
++
++	return max_depth;
++}
++
++static u8 __netdev_lower_depth(struct net_device *dev)
+ {
+ 	struct net_device *ldev;
+ 	struct list_head *iter;
+-	int ret;
++	u8 max_depth = 0;
+ 
+ 	for (iter = &dev->adj_list.lower,
+-	     ldev = netdev_next_lower_dev_rcu(dev, &iter);
++	     ldev = netdev_next_lower_dev(dev, &iter);
+ 	     ldev;
+-	     ldev = netdev_next_lower_dev_rcu(dev, &iter)) {
+-		/* first is the lower device itself */
+-		ret = fn(ldev, data);
+-		if (ret)
+-			return ret;
++	     ldev = netdev_next_lower_dev(dev, &iter)) {
++		if (max_depth < ldev->lower_level)
++			max_depth = ldev->lower_level;
++	}
+ 
+-		/* then look at all of its lower devices */
+-		ret = netdev_walk_all_lower_dev_rcu(ldev, fn, data);
+-		if (ret)
+-			return ret;
++	return max_depth;
++}
++
++static int __netdev_update_upper_level(struct net_device *dev, void *data)
++{
++	dev->upper_level = __netdev_upper_depth(dev) + 1;
++	return 0;
++}
++
++static int __netdev_update_lower_level(struct net_device *dev, void *data)
++{
++	dev->lower_level = __netdev_lower_depth(dev) + 1;
++	return 0;
++}
++
++int netdev_walk_all_lower_dev_rcu(struct net_device *dev,
++				  int (*fn)(struct net_device *dev,
++					    void *data),
++				  void *data)
++{
++	struct net_device *ldev, *next, *now, *dev_stack[MAX_NEST_DEV + 1];
++	struct list_head *niter, *iter, *iter_stack[MAX_NEST_DEV + 1];
++	int ret, cur = 0;
++
++	now = dev;
++	iter = &dev->adj_list.lower;
++
++	while (1) {
++		if (now != dev) {
++			ret = fn(now, data);
++			if (ret)
++				return ret;
++		}
++
++		next = NULL;
++		while (1) {
++			ldev = netdev_next_lower_dev_rcu(now, &iter);
++			if (!ldev)
++				break;
++
++			next = ldev;
++			niter = &ldev->adj_list.lower;
++			dev_stack[cur] = now;
++			iter_stack[cur++] = iter;
++			break;
++		}
++
++		if (!next) {
++			if (!cur)
++				return 0;
++			next = dev_stack[--cur];
++			niter = iter_stack[cur];
++		}
++
++		now = next;
++		iter = niter;
+ 	}
+ 
+ 	return 0;
+@@ -7003,6 +7168,9 @@ static int __netdev_upper_dev_link(struct net_device *dev,
+ 	if (netdev_has_upper_dev(upper_dev, dev))
+ 		return -EBUSY;
+ 
++	if ((dev->lower_level + upper_dev->upper_level) > MAX_NEST_DEV)
++		return -EMLINK;
++
+ 	if (!master) {
+ 		if (netdev_has_upper_dev(dev, upper_dev))
+ 			return -EEXIST;
+@@ -7029,6 +7197,12 @@ static int __netdev_upper_dev_link(struct net_device *dev,
+ 	if (ret)
+ 		goto rollback;
+ 
++	__netdev_update_upper_level(dev, NULL);
++	netdev_walk_all_lower_dev(dev, __netdev_update_upper_level, NULL);
++
++	__netdev_update_lower_level(upper_dev, NULL);
++	netdev_walk_all_upper_dev(upper_dev, __netdev_update_lower_level, NULL);
++
+ 	return 0;
+ 
+ rollback:
+@@ -7111,6 +7285,12 @@ void netdev_upper_dev_unlink(struct net_device *dev,
+ 
+ 	call_netdevice_notifiers_info(NETDEV_CHANGEUPPER,
+ 				      &changeupper_info.info);
++
++	__netdev_update_upper_level(dev, NULL);
++	netdev_walk_all_lower_dev(dev, __netdev_update_upper_level, NULL);
++
++	__netdev_update_lower_level(upper_dev, NULL);
++	netdev_walk_all_upper_dev(upper_dev, __netdev_update_lower_level, NULL);
+ }
+ EXPORT_SYMBOL(netdev_upper_dev_unlink);
+ 
+@@ -8978,6 +9158,8 @@ struct net_device *alloc_netdev_mqs(int sizeof_priv, const char *name,
+ 
+ 	dev->gso_max_size = GSO_MAX_SIZE;
+ 	dev->gso_max_segs = GSO_MAX_SEGS;
++	dev->upper_level = 1;
++	dev->lower_level = 1;
+ 
+ 	INIT_LIST_HEAD(&dev->napi_list);
+ 	INIT_LIST_HEAD(&dev->unreg_list);
+diff --git a/net/core/neighbour.c b/net/core/neighbour.c
+index 7597afee7068..e260d44ebdca 100644
+--- a/net/core/neighbour.c
++++ b/net/core/neighbour.c
+@@ -1097,7 +1097,7 @@ static void neigh_update_hhs(struct neighbour *neigh)
+ 
+ 	if (update) {
+ 		hh = &neigh->hh;
+-		if (hh->hh_len) {
++		if (READ_ONCE(hh->hh_len)) {
+ 			write_seqlock_bh(&hh->hh_lock);
+ 			update(hh, neigh->dev, neigh->ha);
+ 			write_sequnlock_bh(&hh->hh_lock);
+@@ -1360,7 +1360,7 @@ int neigh_resolve_output(struct neighbour *neigh, struct sk_buff *skb)
+ 		struct net_device *dev = neigh->dev;
+ 		unsigned int seq;
+ 
+-		if (dev->header_ops->cache && !neigh->hh.hh_len)
++		if (dev->header_ops->cache && !READ_ONCE(neigh->hh.hh_len))
+ 			neigh_hh_init(neigh);
+ 
+ 		do {
+diff --git a/net/ethernet/eth.c b/net/ethernet/eth.c
+index fd8faa0dfa61..ca06e9a53d15 100644
+--- a/net/ethernet/eth.c
++++ b/net/ethernet/eth.c
+@@ -239,7 +239,12 @@ int eth_header_cache(const struct neighbour *neigh, struct hh_cache *hh, __be16
+ 	eth->h_proto = type;
+ 	memcpy(eth->h_source, dev->dev_addr, ETH_ALEN);
+ 	memcpy(eth->h_dest, neigh->ha, ETH_ALEN);
+-	hh->hh_len = ETH_HLEN;
++
++	/* Pairs with READ_ONCE() in neigh_resolve_output(),
++	 * neigh_hh_output() and neigh_update_hhs().
++	 */
++	smp_store_release(&hh->hh_len, ETH_HLEN);
++
+ 	return 0;
+ }
+ EXPORT_SYMBOL(eth_header_cache);
+diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
+index a7a804bece7a..7561fa1bcc3e 100644
+--- a/net/ipv4/tcp.c
++++ b/net/ipv4/tcp.c
+@@ -488,7 +488,7 @@ static void tcp_tx_timestamp(struct sock *sk, u16 tsflags)
+ static inline bool tcp_stream_is_readable(const struct tcp_sock *tp,
+ 					  int target, struct sock *sk)
+ {
+-	return (tp->rcv_nxt - tp->copied_seq >= target) ||
++	return (READ_ONCE(tp->rcv_nxt) - tp->copied_seq >= target) ||
+ 		(sk->sk_prot->stream_memory_read ?
+ 		sk->sk_prot->stream_memory_read(sk) : false);
+ }
+@@ -2866,7 +2866,7 @@ static int do_tcp_setsockopt(struct sock *sk, int level,
+ 		else if (tp->repair_queue == TCP_SEND_QUEUE)
+ 			tp->write_seq = val;
+ 		else if (tp->repair_queue == TCP_RECV_QUEUE)
+-			tp->rcv_nxt = val;
++			WRITE_ONCE(tp->rcv_nxt, val);
+ 		else
+ 			err = -EINVAL;
+ 		break;
+diff --git a/net/ipv4/tcp_diag.c b/net/ipv4/tcp_diag.c
+index 81148f7a2323..c9e97f304f98 100644
+--- a/net/ipv4/tcp_diag.c
++++ b/net/ipv4/tcp_diag.c
+@@ -30,7 +30,7 @@ static void tcp_diag_get_info(struct sock *sk, struct inet_diag_msg *r,
+ 	} else if (sk->sk_type == SOCK_STREAM) {
+ 		const struct tcp_sock *tp = tcp_sk(sk);
+ 
+-		r->idiag_rqueue = max_t(int, tp->rcv_nxt - tp->copied_seq, 0);
++		r->idiag_rqueue = max_t(int, READ_ONCE(tp->rcv_nxt) - tp->copied_seq, 0);
+ 		r->idiag_wqueue = tp->write_seq - tp->snd_una;
+ 	}
+ 	if (info)
+diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
+index 57e8dad956ec..3a08ee81cbc3 100644
+--- a/net/ipv4/tcp_input.c
++++ b/net/ipv4/tcp_input.c
+@@ -3348,7 +3348,7 @@ static void tcp_rcv_nxt_update(struct tcp_sock *tp, u32 seq)
+ 
+ 	sock_owned_by_me((struct sock *)tp);
+ 	tp->bytes_received += delta;
+-	tp->rcv_nxt = seq;
++	WRITE_ONCE(tp->rcv_nxt, seq);
+ }
+ 
+ /* Update our send window.
+@@ -5829,7 +5829,7 @@ static int tcp_rcv_synsent_state_process(struct sock *sk, struct sk_buff *skb,
+ 		/* Ok.. it's good. Set up sequence numbers and
+ 		 * move to established.
+ 		 */
+-		tp->rcv_nxt = TCP_SKB_CB(skb)->seq + 1;
++		WRITE_ONCE(tp->rcv_nxt, TCP_SKB_CB(skb)->seq + 1);
+ 		tp->rcv_wup = TCP_SKB_CB(skb)->seq + 1;
+ 
+ 		/* RFC1323: The window in SYN & SYN/ACK segments is
+@@ -5932,7 +5932,7 @@ discard:
+ 			tp->tcp_header_len = sizeof(struct tcphdr);
+ 		}
+ 
+-		tp->rcv_nxt = TCP_SKB_CB(skb)->seq + 1;
++		WRITE_ONCE(tp->rcv_nxt, TCP_SKB_CB(skb)->seq + 1);
+ 		tp->copied_seq = tp->rcv_nxt;
+ 		tp->rcv_wup = TCP_SKB_CB(skb)->seq + 1;
+ 
+diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
+index 5553f6a833f3..6da393016c11 100644
+--- a/net/ipv4/tcp_ipv4.c
++++ b/net/ipv4/tcp_ipv4.c
+@@ -2330,7 +2330,8 @@ static void get_tcp4_sock(struct sock *sk, struct seq_file *f, int i)
+ 		/* Because we don't lock the socket,
+ 		 * we might find a transient negative value.
+ 		 */
+-		rx_queue = max_t(int, tp->rcv_nxt - tp->copied_seq, 0);
++		rx_queue = max_t(int, READ_ONCE(tp->rcv_nxt) -
++				      tp->copied_seq, 0);
+ 
+ 	seq_printf(f, "%4d: %08X:%04X %08X:%04X %02X %08X:%08X %02X:%08lX "
+ 			"%08X %5u %8d %lu %d %pK %lu %lu %u %u %d",
+diff --git a/net/ipv4/tcp_minisocks.c b/net/ipv4/tcp_minisocks.c
+index 12affb7864d9..7ba8a90772b0 100644
+--- a/net/ipv4/tcp_minisocks.c
++++ b/net/ipv4/tcp_minisocks.c
+@@ -454,6 +454,7 @@ struct sock *tcp_create_openreq_child(const struct sock *sk,
+ 	struct tcp_request_sock *treq = tcp_rsk(req);
+ 	struct inet_connection_sock *newicsk;
+ 	struct tcp_sock *oldtp, *newtp;
++	u32 seq;
+ 
+ 	if (!newsk)
+ 		return NULL;
+@@ -467,8 +468,10 @@ struct sock *tcp_create_openreq_child(const struct sock *sk,
+ 	/* Now setup tcp_sock */
+ 	newtp->pred_flags = 0;
+ 
+-	newtp->rcv_wup = newtp->copied_seq =
+-	newtp->rcv_nxt = treq->rcv_isn + 1;
++	seq = treq->rcv_isn + 1;
++	newtp->rcv_wup = seq;
++	newtp->copied_seq = seq;
++	WRITE_ONCE(newtp->rcv_nxt, seq);
+ 	newtp->segs_in = 1;
+ 
+ 	newtp->snd_sml = newtp->snd_una =
+diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
+index 9a117a79af65..c5f4e89b6ff3 100644
+--- a/net/ipv6/tcp_ipv6.c
++++ b/net/ipv6/tcp_ipv6.c
+@@ -1839,7 +1839,8 @@ static void get_tcp6_sock(struct seq_file *seq, struct sock *sp, int i)
+ 		/* Because we don't lock the socket,
+ 		 * we might find a transient negative value.
+ 		 */
+-		rx_queue = max_t(int, tp->rcv_nxt - tp->copied_seq, 0);
++		rx_queue = max_t(int, READ_ONCE(tp->rcv_nxt) -
++				      tp->copied_seq, 0);
+ 
+ 	seq_printf(seq,
+ 		   "%4d: %08X%08X%08X%08X:%04X %08X%08X%08X%08X:%04X "
+diff --git a/net/netfilter/nft_tproxy.c b/net/netfilter/nft_tproxy.c
+index f92a82c73880..95980154ef02 100644
+--- a/net/netfilter/nft_tproxy.c
++++ b/net/netfilter/nft_tproxy.c
+@@ -50,7 +50,7 @@ static void nft_tproxy_eval_v4(const struct nft_expr *expr,
+ 	taddr = nf_tproxy_laddr4(skb, taddr, iph->daddr);
+ 
+ 	if (priv->sreg_port)
+-		tport = regs->data[priv->sreg_port];
++		tport = nft_reg_load16(&regs->data[priv->sreg_port]);
+ 	if (!tport)
+ 		tport = hp->dest;
+ 
+@@ -117,7 +117,7 @@ static void nft_tproxy_eval_v6(const struct nft_expr *expr,
+ 	taddr = *nf_tproxy_laddr6(skb, &taddr, &iph->daddr);
+ 
+ 	if (priv->sreg_port)
+-		tport = regs->data[priv->sreg_port];
++		tport = nft_reg_load16(&regs->data[priv->sreg_port]);
+ 	if (!tport)
+ 		tport = hp->dest;
+ 
+diff --git a/net/rxrpc/peer_event.c b/net/rxrpc/peer_event.c
+index dc7fdaf20445..42582a9ff81d 100644
+--- a/net/rxrpc/peer_event.c
++++ b/net/rxrpc/peer_event.c
+@@ -153,6 +153,9 @@ void rxrpc_error_report(struct sock *sk)
+ 	struct rxrpc_peer *peer;
+ 	struct sk_buff *skb;
+ 
++	if (unlikely(!local))
++		return;
++
+ 	_enter("%p{%d}", sk, local->debug_id);
+ 
+ 	skb = sock_dequeue_err_skb(sk);
+diff --git a/net/socket.c b/net/socket.c
+index 18d27b8c2511..1290aad5d1c3 100644
+--- a/net/socket.c
++++ b/net/socket.c
+@@ -867,7 +867,7 @@ static ssize_t sock_read_iter(struct kiocb *iocb, struct iov_iter *to)
+ 			     .msg_iocb = iocb};
+ 	ssize_t res;
+ 
+-	if (file->f_flags & O_NONBLOCK)
++	if (file->f_flags & O_NONBLOCK || (iocb->ki_flags & IOCB_NOWAIT))
+ 		msg.msg_flags = MSG_DONTWAIT;
+ 
+ 	if (iocb->ki_pos != 0)
+@@ -892,7 +892,7 @@ static ssize_t sock_write_iter(struct kiocb *iocb, struct iov_iter *from)
+ 	if (iocb->ki_pos != 0)
+ 		return -ESPIPE;
+ 
+-	if (file->f_flags & O_NONBLOCK)
++	if (file->f_flags & O_NONBLOCK || (iocb->ki_flags & IOCB_NOWAIT))
+ 		msg.msg_flags = MSG_DONTWAIT;
+ 
+ 	if (sock->type == SOCK_SEQPACKET)
+diff --git a/security/apparmor/apparmorfs.c b/security/apparmor/apparmorfs.c
+index d95a7e41a29d..0a57d105cc5b 100644
+--- a/security/apparmor/apparmorfs.c
++++ b/security/apparmor/apparmorfs.c
+@@ -593,7 +593,7 @@ static __poll_t ns_revision_poll(struct file *file, poll_table *pt)
+ 
+ void __aa_bump_ns_revision(struct aa_ns *ns)
+ {
+-	ns->revision++;
++	WRITE_ONCE(ns->revision, ns->revision + 1);
+ 	wake_up_interruptible(&ns->wait);
+ }
+ 
+diff --git a/security/apparmor/domain.c b/security/apparmor/domain.c
+index 11975ec8d566..bdf9e4cefe25 100644
+--- a/security/apparmor/domain.c
++++ b/security/apparmor/domain.c
+@@ -321,6 +321,7 @@ static int aa_xattrs_match(const struct linux_binprm *bprm,
+ 
+ 	if (!bprm || !profile->xattr_count)
+ 		return 0;
++	might_sleep();
+ 
+ 	/* transition from exec match to xattr set */
+ 	state = aa_dfa_null_transition(profile->xmatch, state);
+@@ -365,10 +366,11 @@ out:
+ }
+ 
+ /**
+- * __attach_match_ - find an attachment match
++ * find_attach - do attachment search for unconfined processes
+  * @bprm - binprm structure of transitioning task
+- * @name - to match against  (NOT NULL)
++ * @ns: the current namespace  (NOT NULL)
+  * @head - profile list to walk  (NOT NULL)
++ * @name - to match against  (NOT NULL)
+  * @info - info message if there was an error (NOT NULL)
+  *
+  * Do a linear search on the profiles in the list.  There is a matching
+@@ -378,12 +380,11 @@ out:
+  *
+  * Requires: @head not be shared or have appropriate locks held
+  *
+- * Returns: profile or NULL if no match found
++ * Returns: label or NULL if no match found
+  */
+-static struct aa_profile *__attach_match(const struct linux_binprm *bprm,
+-					 const char *name,
+-					 struct list_head *head,
+-					 const char **info)
++static struct aa_label *find_attach(const struct linux_binprm *bprm,
++				    struct aa_ns *ns, struct list_head *head,
++				    const char *name, const char **info)
+ {
+ 	int candidate_len = 0, candidate_xattrs = 0;
+ 	bool conflict = false;
+@@ -392,6 +393,8 @@ static struct aa_profile *__attach_match(const struct linux_binprm *bprm,
+ 	AA_BUG(!name);
+ 	AA_BUG(!head);
+ 
++	rcu_read_lock();
++restart:
+ 	list_for_each_entry_rcu(profile, head, base.list) {
+ 		if (profile->label.flags & FLAG_NULL &&
+ 		    &profile->label == ns_unconfined(profile->ns))
+@@ -417,16 +420,32 @@ static struct aa_profile *__attach_match(const struct linux_binprm *bprm,
+ 			perm = dfa_user_allow(profile->xmatch, state);
+ 			/* any accepting state means a valid match. */
+ 			if (perm & MAY_EXEC) {
+-				int ret;
++				int ret = 0;
+ 
+ 				if (count < candidate_len)
+ 					continue;
+ 
+-				ret = aa_xattrs_match(bprm, profile, state);
+-				/* Fail matching if the xattrs don't match */
+-				if (ret < 0)
+-					continue;
+-
++				if (bprm && profile->xattr_count) {
++					long rev = READ_ONCE(ns->revision);
++
++					if (!aa_get_profile_not0(profile))
++						goto restart;
++					rcu_read_unlock();
++					ret = aa_xattrs_match(bprm, profile,
++							      state);
++					rcu_read_lock();
++					aa_put_profile(profile);
++					if (rev !=
++					    READ_ONCE(ns->revision))
++						/* policy changed */
++						goto restart;
++					/*
++					 * Fail matching if the xattrs don't
++					 * match
++					 */
++					if (ret < 0)
++						continue;
++				}
+ 				/*
+ 				 * TODO: allow for more flexible best match
+ 				 *
+@@ -449,43 +468,28 @@ static struct aa_profile *__attach_match(const struct linux_binprm *bprm,
+ 				candidate_xattrs = ret;
+ 				conflict = false;
+ 			}
+-		} else if (!strcmp(profile->base.name, name))
++		} else if (!strcmp(profile->base.name, name)) {
+ 			/*
+ 			 * old exact non-re match, without conditionals such
+ 			 * as xattrs. no more searching required
+ 			 */
+-			return profile;
++			candidate = profile;
++			goto out;
++		}
+ 	}
+ 
+-	if (conflict) {
+-		*info = "conflicting profile attachments";
++	if (!candidate || conflict) {
++		if (conflict)
++			*info = "conflicting profile attachments";
++		rcu_read_unlock();
+ 		return NULL;
+ 	}
+ 
+-	return candidate;
+-}
+-
+-/**
+- * find_attach - do attachment search for unconfined processes
+- * @bprm - binprm structure of transitioning task
+- * @ns: the current namespace  (NOT NULL)
+- * @list: list to search  (NOT NULL)
+- * @name: the executable name to match against  (NOT NULL)
+- * @info: info message if there was an error
+- *
+- * Returns: label or NULL if no match found
+- */
+-static struct aa_label *find_attach(const struct linux_binprm *bprm,
+-				    struct aa_ns *ns, struct list_head *list,
+-				    const char *name, const char **info)
+-{
+-	struct aa_profile *profile;
+-
+-	rcu_read_lock();
+-	profile = aa_get_profile(__attach_match(bprm, name, list, info));
++out:
++	candidate = aa_get_newest_profile(candidate);
+ 	rcu_read_unlock();
+ 
+-	return profile ? &profile->label : NULL;
++	return &candidate->label;
+ }
+ 
+ static const char *next_name(int xtype, const char *name)
+diff --git a/security/apparmor/policy.c b/security/apparmor/policy.c
+index 1590e2de4e84..3a4293c46ad5 100644
+--- a/security/apparmor/policy.c
++++ b/security/apparmor/policy.c
+@@ -1126,8 +1126,8 @@ ssize_t aa_remove_profiles(struct aa_ns *policy_ns, struct aa_label *subj,
+ 	if (!name) {
+ 		/* remove namespace - can only happen if fqname[0] == ':' */
+ 		mutex_lock_nested(&ns->parent->lock, ns->level);
+-		__aa_remove_ns(ns);
+ 		__aa_bump_ns_revision(ns);
++		__aa_remove_ns(ns);
+ 		mutex_unlock(&ns->parent->lock);
+ 	} else {
+ 		/* remove profile */
+@@ -1139,9 +1139,9 @@ ssize_t aa_remove_profiles(struct aa_ns *policy_ns, struct aa_label *subj,
+ 			goto fail_ns_lock;
+ 		}
+ 		name = profile->base.hname;
++		__aa_bump_ns_revision(ns);
+ 		__remove_profile(profile);
+ 		__aa_labelset_update_subtree(ns);
+-		__aa_bump_ns_revision(ns);
+ 		mutex_unlock(&ns->lock);
+ 	}
+ 
+diff --git a/sound/firewire/motu/motu-proc.c b/sound/firewire/motu/motu-proc.c
+index ab6830a6d242..015b4ec2763f 100644
+--- a/sound/firewire/motu/motu-proc.c
++++ b/sound/firewire/motu/motu-proc.c
+@@ -17,7 +17,7 @@ static const char *const clock_names[] = {
+ 	[SND_MOTU_CLOCK_SOURCE_SPDIF_ON_OPT] = "S/PDIF on optical interface",
+ 	[SND_MOTU_CLOCK_SOURCE_SPDIF_ON_OPT_A] = "S/PDIF on optical interface A",
+ 	[SND_MOTU_CLOCK_SOURCE_SPDIF_ON_OPT_B] = "S/PDIF on optical interface B",
+-	[SND_MOTU_CLOCK_SOURCE_SPDIF_ON_COAX] = "S/PCIF on coaxial interface",
++	[SND_MOTU_CLOCK_SOURCE_SPDIF_ON_COAX] = "S/PDIF on coaxial interface",
+ 	[SND_MOTU_CLOCK_SOURCE_AESEBU_ON_XLR] = "AESEBU on XLR interface",
+ 	[SND_MOTU_CLOCK_SOURCE_WORD_ON_BNC] = "Word clock on BNC interface",
+ };
+diff --git a/sound/isa/cs423x/cs4236.c b/sound/isa/cs423x/cs4236.c
+index 70559e59d18f..7d4e18cb6351 100644
+--- a/sound/isa/cs423x/cs4236.c
++++ b/sound/isa/cs423x/cs4236.c
+@@ -293,7 +293,8 @@ static int snd_cs423x_pnp_init_mpu(int dev, struct pnp_dev *pdev)
+ 	} else {
+ 		mpu_port[dev] = pnp_port_start(pdev, 0);
+ 		if (mpu_irq[dev] >= 0 &&
+-		    pnp_irq_valid(pdev, 0) && pnp_irq(pdev, 0) >= 0) {
++		    pnp_irq_valid(pdev, 0) &&
++		    pnp_irq(pdev, 0) != (resource_size_t)-1) {
+ 			mpu_irq[dev] = pnp_irq(pdev, 0);
+ 		} else {
+ 			mpu_irq[dev] = -1;	/* disable interrupt */
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index 019dee96dbaa..1f6a036627e8 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -513,6 +513,7 @@ static void alc_shutup_pins(struct hda_codec *codec)
+ 	struct alc_spec *spec = codec->spec;
+ 
+ 	switch (codec->core.vendor_id) {
++	case 0x10ec0283:
+ 	case 0x10ec0286:
+ 	case 0x10ec0288:
+ 	case 0x10ec0298:
+@@ -5441,6 +5442,16 @@ static void alc295_fixup_disable_dac3(struct hda_codec *codec,
+ 	}
+ }
+ 
++/* force NID 0x17 (Bass Speaker) to DAC1 to share it with the main speaker */
++static void alc285_fixup_speaker2_to_dac1(struct hda_codec *codec,
++					  const struct hda_fixup *fix, int action)
++{
++	if (action == HDA_FIXUP_ACT_PRE_PROBE) {
++		hda_nid_t conn[1] = { 0x02 };
++		snd_hda_override_conn_list(codec, 0x17, 1, conn);
++	}
++}
++
+ /* Hook to update amp GPIO4 for automute */
+ static void alc280_hp_gpio4_automute_hook(struct hda_codec *codec,
+ 					  struct hda_jack_callback *jack)
+@@ -5661,6 +5672,7 @@ enum {
+ 	ALC225_FIXUP_DISABLE_MIC_VREF,
+ 	ALC225_FIXUP_DELL1_MIC_NO_PRESENCE,
+ 	ALC295_FIXUP_DISABLE_DAC3,
++	ALC285_FIXUP_SPEAKER2_TO_DAC1,
+ 	ALC280_FIXUP_HP_HEADSET_MIC,
+ 	ALC221_FIXUP_HP_FRONT_MIC,
+ 	ALC292_FIXUP_TPT460,
+@@ -5702,9 +5714,12 @@ enum {
+ 	ALC256_FIXUP_ASUS_HEADSET_MIC,
+ 	ALC256_FIXUP_ASUS_MIC_NO_PRESENCE,
+ 	ALC299_FIXUP_PREDATOR_SPK,
+-	ALC294_FIXUP_ASUS_INTSPK_HEADSET_MIC,
+ 	ALC256_FIXUP_MEDION_HEADSET_NO_PRESENCE,
+-	ALC294_FIXUP_ASUS_INTSPK_GPIO,
++	ALC289_FIXUP_DELL_SPK2,
++	ALC289_FIXUP_DUAL_SPK,
++	ALC294_FIXUP_SPK2_TO_DAC1,
++	ALC294_FIXUP_ASUS_DUAL_SPK,
++
+ };
+ 
+ static const struct hda_fixup alc269_fixups[] = {
+@@ -6441,6 +6456,10 @@ static const struct hda_fixup alc269_fixups[] = {
+ 		.type = HDA_FIXUP_FUNC,
+ 		.v.func = alc295_fixup_disable_dac3,
+ 	},
++	[ALC285_FIXUP_SPEAKER2_TO_DAC1] = {
++		.type = HDA_FIXUP_FUNC,
++		.v.func = alc285_fixup_speaker2_to_dac1,
++	},
+ 	[ALC256_FIXUP_DELL_INSPIRON_7559_SUBWOOFER] = {
+ 		.type = HDA_FIXUP_PINS,
+ 		.v.pins = (const struct hda_pintbl[]) {
+@@ -6748,33 +6767,45 @@ static const struct hda_fixup alc269_fixups[] = {
+ 			{ }
+ 		}
+ 	},
+-	[ALC294_FIXUP_ASUS_INTSPK_HEADSET_MIC] = {
++	[ALC256_FIXUP_MEDION_HEADSET_NO_PRESENCE] = {
+ 		.type = HDA_FIXUP_PINS,
+ 		.v.pins = (const struct hda_pintbl[]) {
+-			{ 0x14, 0x411111f0 }, /* disable confusing internal speaker */
+-			{ 0x19, 0x04a11150 }, /* use as headset mic, without its own jack detect */
++			{ 0x19, 0x04a11040 },
++			{ 0x21, 0x04211020 },
+ 			{ }
+ 		},
+ 		.chained = true,
+-		.chain_id = ALC269_FIXUP_HEADSET_MODE_NO_HP_MIC
++		.chain_id = ALC256_FIXUP_ASUS_HEADSET_MODE
+ 	},
+-	[ALC256_FIXUP_MEDION_HEADSET_NO_PRESENCE] = {
++	[ALC289_FIXUP_DELL_SPK2] = {
+ 		.type = HDA_FIXUP_PINS,
+ 		.v.pins = (const struct hda_pintbl[]) {
+-			{ 0x19, 0x04a11040 },
+-			{ 0x21, 0x04211020 },
++			{ 0x17, 0x90170130 }, /* bass spk */
+ 			{ }
+ 		},
+ 		.chained = true,
+-		.chain_id = ALC256_FIXUP_ASUS_HEADSET_MODE
++		.chain_id = ALC269_FIXUP_DELL4_MIC_NO_PRESENCE
+ 	},
+-	[ALC294_FIXUP_ASUS_INTSPK_GPIO] = {
++	[ALC289_FIXUP_DUAL_SPK] = {
++		.type = HDA_FIXUP_FUNC,
++		.v.func = alc285_fixup_speaker2_to_dac1,
++		.chained = true,
++		.chain_id = ALC289_FIXUP_DELL_SPK2
++	},
++	[ALC294_FIXUP_SPK2_TO_DAC1] = {
++		.type = HDA_FIXUP_FUNC,
++		.v.func = alc285_fixup_speaker2_to_dac1,
++		.chained = true,
++		.chain_id = ALC294_FIXUP_ASUS_HEADSET_MIC
++	},
++	[ALC294_FIXUP_ASUS_DUAL_SPK] = {
+ 		.type = HDA_FIXUP_FUNC,
+ 		/* The GPIO must be pulled to initialize the AMP */
+ 		.v.func = alc_fixup_gpio4,
+ 		.chained = true,
+-		.chain_id = ALC294_FIXUP_ASUS_INTSPK_HEADSET_MIC
++		.chain_id = ALC294_FIXUP_SPK2_TO_DAC1
+ 	},
++
+ };
+ 
+ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
+@@ -6847,6 +6878,8 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
+ 	SND_PCI_QUIRK(0x1028, 0x08ad, "Dell WYSE AIO", ALC225_FIXUP_DELL_WYSE_AIO_MIC_NO_PRESENCE),
+ 	SND_PCI_QUIRK(0x1028, 0x08ae, "Dell WYSE NB", ALC225_FIXUP_DELL1_MIC_NO_PRESENCE),
+ 	SND_PCI_QUIRK(0x1028, 0x0935, "Dell", ALC274_FIXUP_DELL_AIO_LINEOUT_VERB),
++	SND_PCI_QUIRK(0x1028, 0x097e, "Dell Precision", ALC289_FIXUP_DUAL_SPK),
++	SND_PCI_QUIRK(0x1028, 0x097d, "Dell Precision", ALC289_FIXUP_DUAL_SPK),
+ 	SND_PCI_QUIRK(0x1028, 0x164a, "Dell", ALC293_FIXUP_DELL1_MIC_NO_PRESENCE),
+ 	SND_PCI_QUIRK(0x1028, 0x164b, "Dell", ALC293_FIXUP_DELL1_MIC_NO_PRESENCE),
+ 	SND_PCI_QUIRK(0x103c, 0x1586, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC2),
+@@ -6934,7 +6967,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
+ 	SND_PCI_QUIRK(0x1043, 0x1427, "Asus Zenbook UX31E", ALC269VB_FIXUP_ASUS_ZENBOOK),
+ 	SND_PCI_QUIRK(0x1043, 0x1517, "Asus Zenbook UX31A", ALC269VB_FIXUP_ASUS_ZENBOOK_UX31A),
+ 	SND_PCI_QUIRK(0x1043, 0x16e3, "ASUS UX50", ALC269_FIXUP_STEREO_DMIC),
+-	SND_PCI_QUIRK(0x1043, 0x17d1, "ASUS UX431FL", ALC294_FIXUP_ASUS_INTSPK_GPIO),
++	SND_PCI_QUIRK(0x1043, 0x17d1, "ASUS UX431FL", ALC294_FIXUP_ASUS_DUAL_SPK),
+ 	SND_PCI_QUIRK(0x1043, 0x18b1, "Asus MJ401TA", ALC256_FIXUP_ASUS_HEADSET_MIC),
+ 	SND_PCI_QUIRK(0x1043, 0x1a13, "Asus G73Jw", ALC269_FIXUP_ASUS_G73JW),
+ 	SND_PCI_QUIRK(0x1043, 0x1a30, "ASUS X705UD", ALC256_FIXUP_ASUS_MIC),
+@@ -7006,6 +7039,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
+ 	SND_PCI_QUIRK(0x17aa, 0x224c, "Thinkpad", ALC298_FIXUP_TPT470_DOCK),
+ 	SND_PCI_QUIRK(0x17aa, 0x224d, "Thinkpad", ALC298_FIXUP_TPT470_DOCK),
+ 	SND_PCI_QUIRK(0x17aa, 0x225d, "Thinkpad T480", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
++	SND_PCI_QUIRK(0x17aa, 0x2293, "Thinkpad X1 Carbon 7th", ALC285_FIXUP_SPEAKER2_TO_DAC1),
+ 	SND_PCI_QUIRK(0x17aa, 0x30bb, "ThinkCentre AIO", ALC233_FIXUP_LENOVO_LINE2_MIC_HOTKEY),
+ 	SND_PCI_QUIRK(0x17aa, 0x30e2, "ThinkCentre AIO", ALC233_FIXUP_LENOVO_LINE2_MIC_HOTKEY),
+ 	SND_PCI_QUIRK(0x17aa, 0x310c, "ThinkCentre Station", ALC294_FIXUP_LENOVO_MIC_LOCATION),
+@@ -7189,6 +7223,7 @@ static const struct hda_model_fixup alc269_fixup_models[] = {
+ 	{.id = ALC255_FIXUP_DELL_SPK_NOISE, .name = "dell-spk-noise"},
+ 	{.id = ALC225_FIXUP_DELL1_MIC_NO_PRESENCE, .name = "alc225-dell1"},
+ 	{.id = ALC295_FIXUP_DISABLE_DAC3, .name = "alc295-disable-dac3"},
++	{.id = ALC285_FIXUP_SPEAKER2_TO_DAC1, .name = "alc285-speaker2-to-dac1"},
+ 	{.id = ALC280_FIXUP_HP_HEADSET_MIC, .name = "alc280-hp-headset"},
+ 	{.id = ALC221_FIXUP_HP_FRONT_MIC, .name = "alc221-hp-mic"},
+ 	{.id = ALC298_FIXUP_SPK_VOLUME, .name = "alc298-spk-volume"},
+diff --git a/sound/pci/ice1712/ice1724.c b/sound/pci/ice1712/ice1724.c
+index 057c2f394ea7..41ea8e7b389a 100644
+--- a/sound/pci/ice1712/ice1724.c
++++ b/sound/pci/ice1712/ice1724.c
+@@ -661,6 +661,7 @@ static int snd_vt1724_set_pro_rate(struct snd_ice1712 *ice, unsigned int rate,
+ 	unsigned long flags;
+ 	unsigned char mclk_change;
+ 	unsigned int i, old_rate;
++	bool call_set_rate = false;
+ 
+ 	if (rate > ice->hw_rates->list[ice->hw_rates->count - 1])
+ 		return -EINVAL;
+@@ -684,7 +685,7 @@ static int snd_vt1724_set_pro_rate(struct snd_ice1712 *ice, unsigned int rate,
+ 		 * setting clock rate for internal clock mode */
+ 		old_rate = ice->get_rate(ice);
+ 		if (force || (old_rate != rate))
+-			ice->set_rate(ice, rate);
++			call_set_rate = true;
+ 		else if (rate == ice->cur_rate) {
+ 			spin_unlock_irqrestore(&ice->reg_lock, flags);
+ 			return 0;
+@@ -692,12 +693,14 @@ static int snd_vt1724_set_pro_rate(struct snd_ice1712 *ice, unsigned int rate,
+ 	}
+ 
+ 	ice->cur_rate = rate;
++	spin_unlock_irqrestore(&ice->reg_lock, flags);
++
++	if (call_set_rate)
++		ice->set_rate(ice, rate);
+ 
+ 	/* setting master clock */
+ 	mclk_change = ice->set_mclk(ice, rate);
+ 
+-	spin_unlock_irqrestore(&ice->reg_lock, flags);
+-
+ 	if (mclk_change && ice->gpio.i2s_mclk_changed)
+ 		ice->gpio.i2s_mclk_changed(ice);
+ 	if (ice->gpio.set_pro_rate)
+diff --git a/sound/usb/card.h b/sound/usb/card.h
+index ac785d15ced4..7f11655bde50 100644
+--- a/sound/usb/card.h
++++ b/sound/usb/card.h
+@@ -142,6 +142,7 @@ struct snd_usb_substream {
+ 	struct snd_usb_endpoint *sync_endpoint;
+ 	unsigned long flags;
+ 	bool need_setup_ep;		/* (re)configure EP at prepare? */
++	bool need_setup_fmt;		/* (re)configure fmt after resume? */
+ 	unsigned int speed;		/* USB_SPEED_XXX */
+ 
+ 	u64 formats;			/* format bitmasks (all or'ed) */
+diff --git a/sound/usb/pcm.c b/sound/usb/pcm.c
+index 1828225ba882..9de4221de730 100644
+--- a/sound/usb/pcm.c
++++ b/sound/usb/pcm.c
+@@ -513,15 +513,15 @@ static int set_format(struct snd_usb_substream *subs, struct audioformat *fmt)
+ 	if (WARN_ON(!iface))
+ 		return -EINVAL;
+ 	alts = usb_altnum_to_altsetting(iface, fmt->altsetting);
+-	altsd = get_iface_desc(alts);
+-	if (WARN_ON(altsd->bAlternateSetting != fmt->altsetting))
++	if (WARN_ON(!alts))
+ 		return -EINVAL;
++	altsd = get_iface_desc(alts);
+ 
+-	if (fmt == subs->cur_audiofmt)
++	if (fmt == subs->cur_audiofmt && !subs->need_setup_fmt)
+ 		return 0;
+ 
+ 	/* close the old interface */
+-	if (subs->interface >= 0 && subs->interface != fmt->iface) {
++	if (subs->interface >= 0 && (subs->interface != fmt->iface || subs->need_setup_fmt)) {
+ 		if (!subs->stream->chip->keep_iface) {
+ 			err = usb_set_interface(subs->dev, subs->interface, 0);
+ 			if (err < 0) {
+@@ -535,6 +535,9 @@ static int set_format(struct snd_usb_substream *subs, struct audioformat *fmt)
+ 		subs->altset_idx = 0;
+ 	}
+ 
++	if (subs->need_setup_fmt)
++		subs->need_setup_fmt = false;
++
+ 	/* set interface */
+ 	if (iface->cur_altsetting != alts) {
+ 		err = snd_usb_select_mode_quirk(subs, fmt);
+@@ -1722,6 +1725,13 @@ static int snd_usb_substream_playback_trigger(struct snd_pcm_substream *substrea
+ 		subs->data_endpoint->retire_data_urb = retire_playback_urb;
+ 		subs->running = 0;
+ 		return 0;
++	case SNDRV_PCM_TRIGGER_SUSPEND:
++		if (subs->stream->chip->setup_fmt_after_resume_quirk) {
++			stop_endpoints(subs, true);
++			subs->need_setup_fmt = true;
++			return 0;
++		}
++		break;
+ 	}
+ 
+ 	return -EINVAL;
+@@ -1754,6 +1764,13 @@ static int snd_usb_substream_capture_trigger(struct snd_pcm_substream *substream
+ 		subs->data_endpoint->retire_data_urb = retire_capture_urb;
+ 		subs->running = 1;
+ 		return 0;
++	case SNDRV_PCM_TRIGGER_SUSPEND:
++		if (subs->stream->chip->setup_fmt_after_resume_quirk) {
++			stop_endpoints(subs, true);
++			subs->need_setup_fmt = true;
++			return 0;
++		}
++		break;
+ 	}
+ 
+ 	return -EINVAL;
+diff --git a/sound/usb/quirks-table.h b/sound/usb/quirks-table.h
+index 57c6209a4ccb..65f9c4ba62ee 100644
+--- a/sound/usb/quirks-table.h
++++ b/sound/usb/quirks-table.h
+@@ -3400,7 +3400,8 @@ AU0828_DEVICE(0x2040, 0x7270, "Hauppauge", "HVR-950Q"),
+ 		.vendor_name = "Dell",
+ 		.product_name = "WD19 Dock",
+ 		.profile_name = "Dell-WD15-Dock",
+-		.ifnum = QUIRK_NO_INTERFACE
++		.ifnum = QUIRK_ANY_INTERFACE,
++		.type = QUIRK_SETUP_FMT_AFTER_RESUME
+ 	}
+ },
+ 
+diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c
+index 052b4ada2d05..bc70212031df 100644
+--- a/sound/usb/quirks.c
++++ b/sound/usb/quirks.c
+@@ -519,6 +519,16 @@ static int create_standard_mixer_quirk(struct snd_usb_audio *chip,
+ 	return snd_usb_create_mixer(chip, quirk->ifnum, 0);
+ }
+ 
++
++static int setup_fmt_after_resume_quirk(struct snd_usb_audio *chip,
++				       struct usb_interface *iface,
++				       struct usb_driver *driver,
++				       const struct snd_usb_audio_quirk *quirk)
++{
++	chip->setup_fmt_after_resume_quirk = 1;
++	return 1;	/* Continue with creating streams and mixer */
++}
++
+ /*
+  * audio-interface quirks
+  *
+@@ -557,6 +567,7 @@ int snd_usb_create_quirk(struct snd_usb_audio *chip,
+ 		[QUIRK_AUDIO_EDIROL_UAXX] = create_uaxx_quirk,
+ 		[QUIRK_AUDIO_ALIGN_TRANSFER] = create_align_transfer_quirk,
+ 		[QUIRK_AUDIO_STANDARD_MIXER] = create_standard_mixer_quirk,
++		[QUIRK_SETUP_FMT_AFTER_RESUME] = setup_fmt_after_resume_quirk,
+ 	};
+ 
+ 	if (quirk->type < QUIRK_TYPE_COUNT) {
+diff --git a/sound/usb/usbaudio.h b/sound/usb/usbaudio.h
+index b9faeca645fd..4a0a5a071d51 100644
+--- a/sound/usb/usbaudio.h
++++ b/sound/usb/usbaudio.h
+@@ -44,7 +44,7 @@ struct snd_usb_audio {
+ 	wait_queue_head_t shutdown_wait;
+ 	unsigned int txfr_quirk:1; /* Subframe boundaries on transfers */
+ 	unsigned int tx_length_quirk:1; /* Put length specifier in transfers */
+-	
++	unsigned int setup_fmt_after_resume_quirk:1; /* setup the format to interface after resume */
+ 	int num_interfaces;
+ 	int num_suspended_intf;
+ 	int sample_rate_read_error;
+@@ -107,6 +107,7 @@ enum quirk_type {
+ 	QUIRK_AUDIO_EDIROL_UAXX,
+ 	QUIRK_AUDIO_ALIGN_TRANSFER,
+ 	QUIRK_AUDIO_STANDARD_MIXER,
++	QUIRK_SETUP_FMT_AFTER_RESUME,
+ 
+ 	QUIRK_TYPE_COUNT
+ };
+diff --git a/tools/testing/selftests/net/rtnetlink.sh b/tools/testing/selftests/net/rtnetlink.sh
+index e101af52d1d6..ff665de788ef 100755
+--- a/tools/testing/selftests/net/rtnetlink.sh
++++ b/tools/testing/selftests/net/rtnetlink.sh
+@@ -234,6 +234,26 @@ kci_test_route_get()
+ 	echo "PASS: route get"
+ }
+ 
++kci_test_addrlft()
++{
++	for i in $(seq 10 100) ;do
++		lft=$(((RANDOM%3) + 1))
++		ip addr add 10.23.11.$i/32 dev "$devdummy" preferred_lft $lft valid_lft $((lft+1))
++		check_err $?
++	done
++
++	sleep 5
++
++	ip addr show dev "$devdummy" | grep "10.23.11."
++	if [ $? -eq 0 ]; then
++		echo "FAIL: preferred_lft addresses remaining"
++		check_err 1
++		return
++	fi
++
++	echo "PASS: preferred_lft addresses have expired"
++}
++
+ kci_test_addrlabel()
+ {
+ 	ret=0
+@@ -965,6 +985,7 @@ kci_test_rtnl()
+ 
+ 	kci_test_polrouting
+ 	kci_test_route_get
++	kci_test_addrlft
+ 	kci_test_tc
+ 	kci_test_gre
+ 	kci_test_gretap
+diff --git a/tools/testing/selftests/rseq/param_test.c b/tools/testing/selftests/rseq/param_test.c
+index eec2663261f2..e8a657a5f48a 100644
+--- a/tools/testing/selftests/rseq/param_test.c
++++ b/tools/testing/selftests/rseq/param_test.c
+@@ -15,7 +15,7 @@
+ #include <errno.h>
+ #include <stddef.h>
+ 
+-static inline pid_t gettid(void)
++static inline pid_t rseq_gettid(void)
+ {
+ 	return syscall(__NR_gettid);
+ }
+@@ -373,11 +373,12 @@ void *test_percpu_spinlock_thread(void *arg)
+ 		rseq_percpu_unlock(&data->lock, cpu);
+ #ifndef BENCHMARK
+ 		if (i != 0 && !(i % (reps / 10)))
+-			printf_verbose("tid %d: count %lld\n", (int) gettid(), i);
++			printf_verbose("tid %d: count %lld\n",
++				       (int) rseq_gettid(), i);
+ #endif
+ 	}
+ 	printf_verbose("tid %d: number of rseq abort: %d, signals delivered: %u\n",
+-		       (int) gettid(), nr_abort, signals_delivered);
++		       (int) rseq_gettid(), nr_abort, signals_delivered);
+ 	if (!opt_disable_rseq && thread_data->reg &&
+ 	    rseq_unregister_current_thread())
+ 		abort();
+@@ -454,11 +455,12 @@ void *test_percpu_inc_thread(void *arg)
+ 		} while (rseq_unlikely(ret));
+ #ifndef BENCHMARK
+ 		if (i != 0 && !(i % (reps / 10)))
+-			printf_verbose("tid %d: count %lld\n", (int) gettid(), i);
++			printf_verbose("tid %d: count %lld\n",
++				       (int) rseq_gettid(), i);
+ #endif
+ 	}
+ 	printf_verbose("tid %d: number of rseq abort: %d, signals delivered: %u\n",
+-		       (int) gettid(), nr_abort, signals_delivered);
++		       (int) rseq_gettid(), nr_abort, signals_delivered);
+ 	if (!opt_disable_rseq && thread_data->reg &&
+ 	    rseq_unregister_current_thread())
+ 		abort();
+@@ -605,7 +607,7 @@ void *test_percpu_list_thread(void *arg)
+ 	}
+ 
+ 	printf_verbose("tid %d: number of rseq abort: %d, signals delivered: %u\n",
+-		       (int) gettid(), nr_abort, signals_delivered);
++		       (int) rseq_gettid(), nr_abort, signals_delivered);
+ 	if (!opt_disable_rseq && rseq_unregister_current_thread())
+ 		abort();
+ 
+@@ -796,7 +798,7 @@ void *test_percpu_buffer_thread(void *arg)
+ 	}
+ 
+ 	printf_verbose("tid %d: number of rseq abort: %d, signals delivered: %u\n",
+-		       (int) gettid(), nr_abort, signals_delivered);
++		       (int) rseq_gettid(), nr_abort, signals_delivered);
+ 	if (!opt_disable_rseq && rseq_unregister_current_thread())
+ 		abort();
+ 
+@@ -1011,7 +1013,7 @@ void *test_percpu_memcpy_buffer_thread(void *arg)
+ 	}
+ 
+ 	printf_verbose("tid %d: number of rseq abort: %d, signals delivered: %u\n",
+-		       (int) gettid(), nr_abort, signals_delivered);
++		       (int) rseq_gettid(), nr_abort, signals_delivered);
+ 	if (!opt_disable_rseq && rseq_unregister_current_thread())
+ 		abort();
+