[gentoo-commits] proj/linux-patches:4.9 commit in: /

[Mike Pagano]

commit:     9876d1f9f2910ed10d2b590547570755b6847dbc
Author:     Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Fri Aug 11 17:41:44 2017 +0000
Commit:     Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Fri Aug 11 17:41:44 2017 +0000
URL:        https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=9876d1f9

Linux patch 4.9.42

 0000_README             |    4 +
 1041_linux-4.9.42.patch | 3113 +++++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 3117 insertions(+)

diff --git a/0000_README b/0000_README
index eacc709..c5dce51 100644
--- a/0000_README
+++ b/0000_README
@@ -207,6 +207,10 @@ Patch:  1040_linux-4.9.41.patch
 From:   http://www.kernel.org
 Desc:   Linux 4.9.41
 
+Patch:  1041_linux-4.9.42.patch
+From:   http://www.kernel.org
+Desc:   Linux 4.9.42
+
 Patch:  1500_XATTR_USER_PREFIX.patch
 From:   https://bugs.gentoo.org/show_bug.cgi?id=470644
 Desc:   Support for namespace user.pax.* on tmpfs.

diff --git a/1041_linux-4.9.42.patch b/1041_linux-4.9.42.patch
new file mode 100644
index 0000000..7b92a09
--- /dev/null
+++ b/1041_linux-4.9.42.patch
@@ -0,0 +1,3113 @@
+diff --git a/Makefile b/Makefile
+index 82eb3d1ee801..34d4d9f8a4b2 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 4
+ PATCHLEVEL = 9
+-SUBLEVEL = 41
++SUBLEVEL = 42
+ EXTRAVERSION =
+ NAME = Roaring Lionus
+ 
+diff --git a/arch/arm/boot/dts/Makefile b/arch/arm/boot/dts/Makefile
+index 7037201c5e3a..f3baa896ce84 100644
+--- a/arch/arm/boot/dts/Makefile
++++ b/arch/arm/boot/dts/Makefile
+@@ -820,6 +820,7 @@ dtb-$(CONFIG_MACH_SUN8I) += \
+ 	sun8i-a83t-allwinner-h8homlet-v2.dtb \
+ 	sun8i-a83t-cubietruck-plus.dtb \
+ 	sun8i-h3-bananapi-m2-plus.dtb \
++	sun8i-h3-nanopi-m1.dtb	\
+ 	sun8i-h3-nanopi-neo.dtb \
+ 	sun8i-h3-orangepi-2.dtb \
+ 	sun8i-h3-orangepi-lite.dtb \
+diff --git a/arch/arm/boot/dts/armada-388-gp.dts b/arch/arm/boot/dts/armada-388-gp.dts
+index 895fa6cfa15a..563901e0ec07 100644
+--- a/arch/arm/boot/dts/armada-388-gp.dts
++++ b/arch/arm/boot/dts/armada-388-gp.dts
+@@ -75,7 +75,7 @@
+ 					pinctrl-names = "default";
+ 					pinctrl-0 = <&pca0_pins>;
+ 					interrupt-parent = <&gpio0>;
+-					interrupts = <18 IRQ_TYPE_EDGE_FALLING>;
++					interrupts = <18 IRQ_TYPE_LEVEL_LOW>;
+ 					gpio-controller;
+ 					#gpio-cells = <2>;
+ 					interrupt-controller;
+@@ -87,7 +87,7 @@
+ 					compatible = "nxp,pca9555";
+ 					pinctrl-names = "default";
+ 					interrupt-parent = <&gpio0>;
+-					interrupts = <18 IRQ_TYPE_EDGE_FALLING>;
++					interrupts = <18 IRQ_TYPE_LEVEL_LOW>;
+ 					gpio-controller;
+ 					#gpio-cells = <2>;
+ 					interrupt-controller;
+diff --git a/arch/arm/boot/dts/sun7i-a20-olinuxino-lime2-emmc.dts b/arch/arm/boot/dts/sun7i-a20-olinuxino-lime2-emmc.dts
+index 5ea4915f6d75..10d307408f23 100644
+--- a/arch/arm/boot/dts/sun7i-a20-olinuxino-lime2-emmc.dts
++++ b/arch/arm/boot/dts/sun7i-a20-olinuxino-lime2-emmc.dts
+@@ -56,7 +56,7 @@
+ };
+ 
+ &pio {
+-	mmc2_pins_nrst: mmc2@0 {
++	mmc2_pins_nrst: mmc2-rst-pin {
+ 		allwinner,pins = "PC16";
+ 		allwinner,function = "gpio_out";
+ 		allwinner,drive = <SUN4I_PINCTRL_10_MA>;
+diff --git a/arch/arm/boot/dts/tango4-vantage-1172.dts b/arch/arm/boot/dts/tango4-vantage-1172.dts
+index 4cab64cb581e..e3a51e3538b7 100644
+--- a/arch/arm/boot/dts/tango4-vantage-1172.dts
++++ b/arch/arm/boot/dts/tango4-vantage-1172.dts
+@@ -21,7 +21,7 @@
+ };
+ 
+ &eth0 {
+-	phy-connection-type = "rgmii";
++	phy-connection-type = "rgmii-id";
+ 	phy-handle = <&eth0_phy>;
+ 	#address-cells = <1>;
+ 	#size-cells = <0>;
+diff --git a/arch/arm/include/asm/ftrace.h b/arch/arm/include/asm/ftrace.h
+index bfe2a2f5a644..22b73112b75f 100644
+--- a/arch/arm/include/asm/ftrace.h
++++ b/arch/arm/include/asm/ftrace.h
+@@ -54,6 +54,24 @@ static inline void *return_address(unsigned int level)
+ 
+ #define ftrace_return_address(n) return_address(n)
+ 
++#define ARCH_HAS_SYSCALL_MATCH_SYM_NAME
++
++static inline bool arch_syscall_match_sym_name(const char *sym,
++					       const char *name)
++{
++	if (!strcmp(sym, "sys_mmap2"))
++		sym = "sys_mmap_pgoff";
++	else if (!strcmp(sym, "sys_statfs64_wrapper"))
++		sym = "sys_statfs64";
++	else if (!strcmp(sym, "sys_fstatfs64_wrapper"))
++		sym = "sys_fstatfs64";
++	else if (!strcmp(sym, "sys_arm_fadvise64_64"))
++		sym = "sys_fadvise64_64";
++
++	/* Ignore case since sym may start with "SyS" instead of "sys" */
++	return !strcasecmp(sym, name);
++}
++
+ #endif /* ifndef __ASSEMBLY__ */
+ 
+ #endif /* _ASM_ARM_FTRACE */
+diff --git a/arch/parisc/kernel/cache.c b/arch/parisc/kernel/cache.c
+index c721ea2fdbd8..df757c9675e6 100644
+--- a/arch/parisc/kernel/cache.c
++++ b/arch/parisc/kernel/cache.c
+@@ -604,13 +604,12 @@ void flush_cache_range(struct vm_area_struct *vma,
+ 	if (parisc_requires_coherency())
+ 		flush_tlb_range(vma, start, end);
+ 
+-	if ((end - start) >= parisc_cache_flush_threshold) {
++	if ((end - start) >= parisc_cache_flush_threshold
++	    || vma->vm_mm->context != mfsp(3)) {
+ 		flush_cache_all();
+ 		return;
+ 	}
+ 
+-	BUG_ON(vma->vm_mm->context != mfsp(3));
+-
+ 	flush_user_dcache_range_asm(start, end);
+ 	if (vma->vm_flags & VM_EXEC)
+ 		flush_user_icache_range_asm(start, end);
+diff --git a/arch/powerpc/kernel/irq.c b/arch/powerpc/kernel/irq.c
+index 3c05c311e35e..028a22bfa90c 100644
+--- a/arch/powerpc/kernel/irq.c
++++ b/arch/powerpc/kernel/irq.c
+@@ -146,6 +146,19 @@ notrace unsigned int __check_irq_replay(void)
+ 
+ 	/* Clear bit 0 which we wouldn't clear otherwise */
+ 	local_paca->irq_happened &= ~PACA_IRQ_HARD_DIS;
++	if (happened & PACA_IRQ_HARD_DIS) {
++		/*
++		 * We may have missed a decrementer interrupt if hard disabled.
++		 * Check the decrementer register in case we had a rollover
++		 * while hard disabled.
++		 */
++		if (!(happened & PACA_IRQ_DEC)) {
++			if (decrementer_check_overflow()) {
++				local_paca->irq_happened |= PACA_IRQ_DEC;
++				happened |= PACA_IRQ_DEC;
++			}
++		}
++	}
+ 
+ 	/*
+ 	 * Force the delivery of pending soft-disabled interrupts on PS3.
+@@ -171,7 +184,7 @@ notrace unsigned int __check_irq_replay(void)
+ 	 * in case we also had a rollover while hard disabled
+ 	 */
+ 	local_paca->irq_happened &= ~PACA_IRQ_DEC;
+-	if ((happened & PACA_IRQ_DEC) || decrementer_check_overflow())
++	if (happened & PACA_IRQ_DEC)
+ 		return 0x900;
+ 
+ 	/* Finally check if an external interrupt happened */
+diff --git a/arch/powerpc/kernel/ptrace.c b/arch/powerpc/kernel/ptrace.c
+index 5c8f12fe9721..dcbb9144c16d 100644
+--- a/arch/powerpc/kernel/ptrace.c
++++ b/arch/powerpc/kernel/ptrace.c
+@@ -127,12 +127,19 @@ static void flush_tmregs_to_thread(struct task_struct *tsk)
+ 	 * If task is not current, it will have been flushed already to
+ 	 * it's thread_struct during __switch_to().
+ 	 *
+-	 * A reclaim flushes ALL the state.
++	 * A reclaim flushes ALL the state or if not in TM save TM SPRs
++	 * in the appropriate thread structures from live.
+ 	 */
+ 
+-	if (tsk == current && MSR_TM_SUSPENDED(mfmsr()))
+-		tm_reclaim_current(TM_CAUSE_SIGNAL);
++	if (tsk != current)
++		return;
+ 
++	if (MSR_TM_SUSPENDED(mfmsr())) {
++		tm_reclaim_current(TM_CAUSE_SIGNAL);
++	} else {
++		tm_enable();
++		tm_save_sprs(&(tsk->thread));
++	}
+ }
+ #else
+ static inline void flush_tmregs_to_thread(struct task_struct *tsk) { }
+diff --git a/arch/sparc/include/asm/trap_block.h b/arch/sparc/include/asm/trap_block.h
+index ec9c04de3664..ff05992dae7a 100644
+--- a/arch/sparc/include/asm/trap_block.h
++++ b/arch/sparc/include/asm/trap_block.h
+@@ -54,6 +54,7 @@ extern struct trap_per_cpu trap_block[NR_CPUS];
+ void init_cur_cpu_trap(struct thread_info *);
+ void setup_tba(void);
+ extern int ncpus_probed;
++extern u64 cpu_mondo_counter[NR_CPUS];
+ 
+ unsigned long real_hard_smp_processor_id(void);
+ 
+diff --git a/arch/sparc/kernel/smp_64.c b/arch/sparc/kernel/smp_64.c
+index d5807d24b98f..2deb89ef1d5f 100644
+--- a/arch/sparc/kernel/smp_64.c
++++ b/arch/sparc/kernel/smp_64.c
+@@ -621,22 +621,48 @@ static void cheetah_xcall_deliver(struct trap_per_cpu *tb, int cnt)
+ 	}
+ }
+ 
+-/* Multi-cpu list version.  */
++#define	CPU_MONDO_COUNTER(cpuid)	(cpu_mondo_counter[cpuid])
++#define	MONDO_USEC_WAIT_MIN		2
++#define	MONDO_USEC_WAIT_MAX		100
++#define	MONDO_RETRY_LIMIT		500000
++
++/* Multi-cpu list version.
++ *
++ * Deliver xcalls to 'cnt' number of cpus in 'cpu_list'.
++ * Sometimes not all cpus receive the mondo, requiring us to re-send
++ * the mondo until all cpus have received, or cpus are truly stuck
++ * unable to receive mondo, and we timeout.
++ * Occasionally a target cpu strand is borrowed briefly by hypervisor to
++ * perform guest service, such as PCIe error handling. Consider the
++ * service time, 1 second overall wait is reasonable for 1 cpu.
++ * Here two in-between mondo check wait time are defined: 2 usec for
++ * single cpu quick turn around and up to 100usec for large cpu count.
++ * Deliver mondo to large number of cpus could take longer, we adjusts
++ * the retry count as long as target cpus are making forward progress.
++ */
+ static void hypervisor_xcall_deliver(struct trap_per_cpu *tb, int cnt)
+ {
+-	int retries, this_cpu, prev_sent, i, saw_cpu_error;
++	int this_cpu, tot_cpus, prev_sent, i, rem;
++	int usec_wait, retries, tot_retries;
++	u16 first_cpu = 0xffff;
++	unsigned long xc_rcvd = 0;
+ 	unsigned long status;
++	int ecpuerror_id = 0;
++	int enocpu_id = 0;
+ 	u16 *cpu_list;
++	u16 cpu;
+ 
+ 	this_cpu = smp_processor_id();
+-
+ 	cpu_list = __va(tb->cpu_list_pa);
+-
+-	saw_cpu_error = 0;
+-	retries = 0;
++	usec_wait = cnt * MONDO_USEC_WAIT_MIN;
++	if (usec_wait > MONDO_USEC_WAIT_MAX)
++		usec_wait = MONDO_USEC_WAIT_MAX;
++	retries = tot_retries = 0;
++	tot_cpus = cnt;
+ 	prev_sent = 0;
++
+ 	do {
+-		int forward_progress, n_sent;
++		int n_sent, mondo_delivered, target_cpu_busy;
+ 
+ 		status = sun4v_cpu_mondo_send(cnt,
+ 					      tb->cpu_list_pa,
+@@ -644,94 +670,113 @@ static void hypervisor_xcall_deliver(struct trap_per_cpu *tb, int cnt)
+ 
+ 		/* HV_EOK means all cpus received the xcall, we're done.  */
+ 		if (likely(status == HV_EOK))
+-			break;
++			goto xcall_done;
++
++		/* If not these non-fatal errors, panic */
++		if (unlikely((status != HV_EWOULDBLOCK) &&
++			(status != HV_ECPUERROR) &&
++			(status != HV_ENOCPU)))
++			goto fatal_errors;
+ 
+ 		/* First, see if we made any forward progress.
++		 *
++		 * Go through the cpu_list, count the target cpus that have
++		 * received our mondo (n_sent), and those that did not (rem).
++		 * Re-pack cpu_list with the cpus remain to be retried in the
++		 * front - this simplifies tracking the truly stalled cpus.
+ 		 *
+ 		 * The hypervisor indicates successful sends by setting
+ 		 * cpu list entries to the value 0xffff.
++		 *
++		 * EWOULDBLOCK means some target cpus did not receive the
++		 * mondo and retry usually helps.
++		 *
++		 * ECPUERROR means at least one target cpu is in error state,
++		 * it's usually safe to skip the faulty cpu and retry.
++		 *
++		 * ENOCPU means one of the target cpu doesn't belong to the
++		 * domain, perhaps offlined which is unexpected, but not
++		 * fatal and it's okay to skip the offlined cpu.
+ 		 */
++		rem = 0;
+ 		n_sent = 0;
+ 		for (i = 0; i < cnt; i++) {
+-			if (likely(cpu_list[i] == 0xffff))
++			cpu = cpu_list[i];
++			if (likely(cpu == 0xffff)) {
+ 				n_sent++;
++			} else if ((status == HV_ECPUERROR) &&
++				(sun4v_cpu_state(cpu) == HV_CPU_STATE_ERROR)) {
++				ecpuerror_id = cpu + 1;
++			} else if (status == HV_ENOCPU && !cpu_online(cpu)) {
++				enocpu_id = cpu + 1;
++			} else {
++				cpu_list[rem++] = cpu;
++			}
+ 		}
+ 
+-		forward_progress = 0;
+-		if (n_sent > prev_sent)
+-			forward_progress = 1;
++		/* No cpu remained, we're done. */
++		if (rem == 0)
++			break;
+ 
+-		prev_sent = n_sent;
++		/* Otherwise, update the cpu count for retry. */
++		cnt = rem;
+ 
+-		/* If we get a HV_ECPUERROR, then one or more of the cpus
+-		 * in the list are in error state.  Use the cpu_state()
+-		 * hypervisor call to find out which cpus are in error state.
++		/* Record the overall number of mondos received by the
++		 * first of the remaining cpus.
+ 		 */
+-		if (unlikely(status == HV_ECPUERROR)) {
+-			for (i = 0; i < cnt; i++) {
+-				long err;
+-				u16 cpu;
++		if (first_cpu != cpu_list[0]) {
++			first_cpu = cpu_list[0];
++			xc_rcvd = CPU_MONDO_COUNTER(first_cpu);
++		}
+ 
+-				cpu = cpu_list[i];
+-				if (cpu == 0xffff)
+-					continue;
++		/* Was any mondo delivered successfully? */
++		mondo_delivered = (n_sent > prev_sent);
++		prev_sent = n_sent;
+ 
+-				err = sun4v_cpu_state(cpu);
+-				if (err == HV_CPU_STATE_ERROR) {
+-					saw_cpu_error = (cpu + 1);
+-					cpu_list[i] = 0xffff;
+-				}
+-			}
+-		} else if (unlikely(status != HV_EWOULDBLOCK))
+-			goto fatal_mondo_error;
++		/* or, was any target cpu busy processing other mondos? */
++		target_cpu_busy = (xc_rcvd < CPU_MONDO_COUNTER(first_cpu));
++		xc_rcvd = CPU_MONDO_COUNTER(first_cpu);
+ 
+-		/* Don't bother rewriting the CPU list, just leave the
+-		 * 0xffff and non-0xffff entries in there and the
+-		 * hypervisor will do the right thing.
+-		 *
+-		 * Only advance timeout state if we didn't make any
+-		 * forward progress.
++		/* Retry count is for no progress. If we're making progress,
++		 * reset the retry count.
+ 		 */
+-		if (unlikely(!forward_progress)) {
+-			if (unlikely(++retries > 10000))
+-				goto fatal_mondo_timeout;
+-
+-			/* Delay a little bit to let other cpus catch up
+-			 * on their cpu mondo queue work.
+-			 */
+-			udelay(2 * cnt);
++		if (likely(mondo_delivered || target_cpu_busy)) {
++			tot_retries += retries;
++			retries = 0;
++		} else if (unlikely(retries > MONDO_RETRY_LIMIT)) {
++			goto fatal_mondo_timeout;
+ 		}
+-	} while (1);
+ 
+-	if (unlikely(saw_cpu_error))
+-		goto fatal_mondo_cpu_error;
++		/* Delay a little bit to let other cpus catch up on
++		 * their cpu mondo queue work.
++		 */
++		if (!mondo_delivered)
++			udelay(usec_wait);
+ 
+-	return;
++		retries++;
++	} while (1);
+ 
+-fatal_mondo_cpu_error:
+-	printk(KERN_CRIT "CPU[%d]: SUN4V mondo cpu error, some target cpus "
+-	       "(including %d) were in error state\n",
+-	       this_cpu, saw_cpu_error - 1);
++xcall_done:
++	if (unlikely(ecpuerror_id > 0)) {
++		pr_crit("CPU[%d]: SUN4V mondo cpu error, target cpu(%d) was in error state\n",
++		       this_cpu, ecpuerror_id - 1);
++	} else if (unlikely(enocpu_id > 0)) {
++		pr_crit("CPU[%d]: SUN4V mondo cpu error, target cpu(%d) does not belong to the domain\n",
++		       this_cpu, enocpu_id - 1);
++	}
+ 	return;
+ 
++fatal_errors:
++	/* fatal errors include bad alignment, etc */
++	pr_crit("CPU[%d]: Args were cnt(%d) cpulist_pa(%lx) mondo_block_pa(%lx)\n",
++	       this_cpu, tot_cpus, tb->cpu_list_pa, tb->cpu_mondo_block_pa);
++	panic("Unexpected SUN4V mondo error %lu\n", status);
++
+ fatal_mondo_timeout:
+-	printk(KERN_CRIT "CPU[%d]: SUN4V mondo timeout, no forward "
+-	       " progress after %d retries.\n",
+-	       this_cpu, retries);
+-	goto dump_cpu_list_and_out;
+-
+-fatal_mondo_error:
+-	printk(KERN_CRIT "CPU[%d]: Unexpected SUN4V mondo error %lu\n",
+-	       this_cpu, status);
+-	printk(KERN_CRIT "CPU[%d]: Args were cnt(%d) cpulist_pa(%lx) "
+-	       "mondo_block_pa(%lx)\n",
+-	       this_cpu, cnt, tb->cpu_list_pa, tb->cpu_mondo_block_pa);
+-
+-dump_cpu_list_and_out:
+-	printk(KERN_CRIT "CPU[%d]: CPU list [ ", this_cpu);
+-	for (i = 0; i < cnt; i++)
+-		printk("%u ", cpu_list[i]);
+-	printk("]\n");
++	/* some cpus being non-responsive to the cpu mondo */
++	pr_crit("CPU[%d]: SUN4V mondo timeout, cpu(%d) made no forward progress after %d retries. Total target cpus(%d).\n",
++	       this_cpu, first_cpu, (tot_retries + retries), tot_cpus);
++	panic("SUN4V mondo timeout panic\n");
+ }
+ 
+ static void (*xcall_deliver_impl)(struct trap_per_cpu *, int);
+diff --git a/arch/sparc/kernel/sun4v_ivec.S b/arch/sparc/kernel/sun4v_ivec.S
+index 559bc5e9c199..34631995859a 100644
+--- a/arch/sparc/kernel/sun4v_ivec.S
++++ b/arch/sparc/kernel/sun4v_ivec.S
+@@ -26,6 +26,21 @@ sun4v_cpu_mondo:
+ 	ldxa	[%g0] ASI_SCRATCHPAD, %g4
+ 	sub	%g4, TRAP_PER_CPU_FAULT_INFO, %g4
+ 
++	/* Get smp_processor_id() into %g3 */
++	sethi	%hi(trap_block), %g5
++	or	%g5, %lo(trap_block), %g5
++	sub	%g4, %g5, %g3
++	srlx	%g3, TRAP_BLOCK_SZ_SHIFT, %g3
++
++	/* Increment cpu_mondo_counter[smp_processor_id()] */
++	sethi	%hi(cpu_mondo_counter), %g5
++	or	%g5, %lo(cpu_mondo_counter), %g5
++	sllx	%g3, 3, %g3
++	add	%g5, %g3, %g5
++	ldx	[%g5], %g3
++	add	%g3, 1, %g3
++	stx	%g3, [%g5]
++
+ 	/* Get CPU mondo queue base phys address into %g7.  */
+ 	ldx	[%g4 + TRAP_PER_CPU_CPU_MONDO_PA], %g7
+ 
+diff --git a/arch/sparc/kernel/traps_64.c b/arch/sparc/kernel/traps_64.c
+index d44fb806bbd7..32dafb920908 100644
+--- a/arch/sparc/kernel/traps_64.c
++++ b/arch/sparc/kernel/traps_64.c
+@@ -2732,6 +2732,7 @@ void do_getpsr(struct pt_regs *regs)
+ 	}
+ }
+ 
++u64 cpu_mondo_counter[NR_CPUS] = {0};
+ struct trap_per_cpu trap_block[NR_CPUS];
+ EXPORT_SYMBOL(trap_block);
+ 
+diff --git a/arch/sparc/lib/U3memcpy.S b/arch/sparc/lib/U3memcpy.S
+index 54f98706b03b..5a8cb37f0a3b 100644
+--- a/arch/sparc/lib/U3memcpy.S
++++ b/arch/sparc/lib/U3memcpy.S
+@@ -145,13 +145,13 @@ ENDPROC(U3_retl_o2_plus_GS_plus_0x08)
+ ENTRY(U3_retl_o2_and_7_plus_GS)
+ 	and	%o2, 7, %o2
+ 	retl
+-	 add	%o2, GLOBAL_SPARE, %o2
++	 add	%o2, GLOBAL_SPARE, %o0
+ ENDPROC(U3_retl_o2_and_7_plus_GS)
+ ENTRY(U3_retl_o2_and_7_plus_GS_plus_8)
+ 	add	GLOBAL_SPARE, 8, GLOBAL_SPARE
+ 	and	%o2, 7, %o2
+ 	retl
+-	 add	%o2, GLOBAL_SPARE, %o2
++	 add	%o2, GLOBAL_SPARE, %o0
+ ENDPROC(U3_retl_o2_and_7_plus_GS_plus_8)
+ #endif
+ 
+diff --git a/arch/x86/boot/string.c b/arch/x86/boot/string.c
+index cc3bd583dce1..9e240fcba784 100644
+--- a/arch/x86/boot/string.c
++++ b/arch/x86/boot/string.c
+@@ -14,6 +14,7 @@
+ 
+ #include <linux/types.h>
+ #include "ctype.h"
++#include "string.h"
+ 
+ int memcmp(const void *s1, const void *s2, size_t len)
+ {
+diff --git a/arch/x86/boot/string.h b/arch/x86/boot/string.h
+index 725e820602b1..113588ddb43f 100644
+--- a/arch/x86/boot/string.h
++++ b/arch/x86/boot/string.h
+@@ -18,4 +18,13 @@ int memcmp(const void *s1, const void *s2, size_t len);
+ #define memset(d,c,l) __builtin_memset(d,c,l)
+ #define memcmp	__builtin_memcmp
+ 
++extern int strcmp(const char *str1, const char *str2);
++extern int strncmp(const char *cs, const char *ct, size_t count);
++extern size_t strlen(const char *s);
++extern char *strstr(const char *s1, const char *s2);
++extern size_t strnlen(const char *s, size_t maxlen);
++extern unsigned int atou(const char *s);
++extern unsigned long long simple_strtoull(const char *cp, char **endp,
++					  unsigned int base);
++
+ #endif /* BOOT_STRING_H */
+diff --git a/arch/x86/kernel/kvm.c b/arch/x86/kernel/kvm.c
+index 9cf697ceedbf..55ffd9dc2258 100644
+--- a/arch/x86/kernel/kvm.c
++++ b/arch/x86/kernel/kvm.c
+@@ -152,6 +152,8 @@ void kvm_async_pf_task_wait(u32 token)
+ 		if (hlist_unhashed(&n.link))
+ 			break;
+ 
++		rcu_irq_exit();
++
+ 		if (!n.halted) {
+ 			local_irq_enable();
+ 			schedule();
+@@ -160,11 +162,11 @@ void kvm_async_pf_task_wait(u32 token)
+ 			/*
+ 			 * We cannot reschedule. So halt.
+ 			 */
+-			rcu_irq_exit();
+ 			native_safe_halt();
+ 			local_irq_disable();
+-			rcu_irq_enter();
+ 		}
++
++		rcu_irq_enter();
+ 	}
+ 	if (!n.halted)
+ 		finish_swait(&n.wq, &wait);
+diff --git a/drivers/ata/libata-scsi.c b/drivers/ata/libata-scsi.c
+index 8e575fbdf31d..e3e10e8f6f6a 100644
+--- a/drivers/ata/libata-scsi.c
++++ b/drivers/ata/libata-scsi.c
+@@ -2971,10 +2971,12 @@ static unsigned int atapi_xlat(struct ata_queued_cmd *qc)
+ static struct ata_device *ata_find_dev(struct ata_port *ap, int devno)
+ {
+ 	if (!sata_pmp_attached(ap)) {
+-		if (likely(devno < ata_link_max_devices(&ap->link)))
++		if (likely(devno >= 0 &&
++			   devno < ata_link_max_devices(&ap->link)))
+ 			return &ap->link.device[devno];
+ 	} else {
+-		if (likely(devno < ap->nr_pmp_links))
++		if (likely(devno >= 0 &&
++			   devno < ap->nr_pmp_links))
+ 			return &ap->pmp_link[devno].device[0];
+ 	}
+ 
+diff --git a/drivers/base/property.c b/drivers/base/property.c
+index 43a36d68c3fd..06f66687fe0b 100644
+--- a/drivers/base/property.c
++++ b/drivers/base/property.c
+@@ -182,11 +182,12 @@ static int pset_prop_read_string(struct property_set *pset,
+ 	return 0;
+ }
+ 
+-static inline struct fwnode_handle *dev_fwnode(struct device *dev)
++struct fwnode_handle *dev_fwnode(struct device *dev)
+ {
+ 	return IS_ENABLED(CONFIG_OF) && dev->of_node ?
+ 		&dev->of_node->fwnode : dev->fwnode;
+ }
++EXPORT_SYMBOL_GPL(dev_fwnode);
+ 
+ /**
+  * device_property_present - check if a property of a device is present
+diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c
+index c9441f9d4585..98b767d3171e 100644
+--- a/drivers/block/nbd.c
++++ b/drivers/block/nbd.c
+@@ -929,6 +929,7 @@ static int __init nbd_init(void)
+ 		return -ENOMEM;
+ 
+ 	for (i = 0; i < nbds_max; i++) {
++		struct request_queue *q;
+ 		struct gendisk *disk = alloc_disk(1 << part_shift);
+ 		if (!disk)
+ 			goto out;
+@@ -954,12 +955,13 @@ static int __init nbd_init(void)
+ 		 * every gendisk to have its very own request_queue struct.
+ 		 * These structs are big so we dynamically allocate them.
+ 		 */
+-		disk->queue = blk_mq_init_queue(&nbd_dev[i].tag_set);
+-		if (!disk->queue) {
++		q = blk_mq_init_queue(&nbd_dev[i].tag_set);
++		if (IS_ERR(q)) {
+ 			blk_mq_free_tag_set(&nbd_dev[i].tag_set);
+ 			put_disk(disk);
+ 			goto out;
+ 		}
++		disk->queue = q;
+ 
+ 		/*
+ 		 * Tell the block layer that we are not a rotational device
+diff --git a/drivers/block/virtio_blk.c b/drivers/block/virtio_blk.c
+index 3c3b8f601469..10332c24f961 100644
+--- a/drivers/block/virtio_blk.c
++++ b/drivers/block/virtio_blk.c
+@@ -630,11 +630,12 @@ static int virtblk_probe(struct virtio_device *vdev)
+ 	if (err)
+ 		goto out_put_disk;
+ 
+-	q = vblk->disk->queue = blk_mq_init_queue(&vblk->tag_set);
++	q = blk_mq_init_queue(&vblk->tag_set);
+ 	if (IS_ERR(q)) {
+ 		err = -ENOMEM;
+ 		goto out_free_tags;
+ 	}
++	vblk->disk->queue = q;
+ 
+ 	q->queuedata = vblk;
+ 
+diff --git a/drivers/clk/samsung/clk-exynos5420.c b/drivers/clk/samsung/clk-exynos5420.c
+index 8c8b495cbf0d..cdc092a1d9ef 100644
+--- a/drivers/clk/samsung/clk-exynos5420.c
++++ b/drivers/clk/samsung/clk-exynos5420.c
+@@ -586,7 +586,7 @@ static const struct samsung_gate_clock exynos5800_gate_clks[] __initconst = {
+ 	GATE(CLK_ACLK550_CAM, "aclk550_cam", "mout_user_aclk550_cam",
+ 				GATE_BUS_TOP, 24, 0, 0),
+ 	GATE(CLK_ACLK432_SCALER, "aclk432_scaler", "mout_user_aclk432_scaler",
+-				GATE_BUS_TOP, 27, 0, 0),
++				GATE_BUS_TOP, 27, CLK_IS_CRITICAL, 0),
+ };
+ 
+ static const struct samsung_mux_clock exynos5420_mux_clks[] __initconst = {
+@@ -956,20 +956,20 @@ static const struct samsung_gate_clock exynos5x_gate_clks[] __initconst = {
+ 	GATE(CLK_SMMU_G2D, "smmu_g2d", "aclk333_g2d", GATE_IP_G2D, 7, 0, 0),
+ 
+ 	GATE(0, "aclk200_fsys", "mout_user_aclk200_fsys",
+-			GATE_BUS_FSYS0, 9, CLK_IGNORE_UNUSED, 0),
++			GATE_BUS_FSYS0, 9, CLK_IS_CRITICAL, 0),
+ 	GATE(0, "aclk200_fsys2", "mout_user_aclk200_fsys2",
+ 			GATE_BUS_FSYS0, 10, CLK_IGNORE_UNUSED, 0),
+ 
+ 	GATE(0, "aclk333_g2d", "mout_user_aclk333_g2d",
+ 			GATE_BUS_TOP, 0, CLK_IGNORE_UNUSED, 0),
+ 	GATE(0, "aclk266_g2d", "mout_user_aclk266_g2d",
+-			GATE_BUS_TOP, 1, CLK_IGNORE_UNUSED, 0),
++			GATE_BUS_TOP, 1, CLK_IS_CRITICAL, 0),
+ 	GATE(0, "aclk300_jpeg", "mout_user_aclk300_jpeg",
+ 			GATE_BUS_TOP, 4, CLK_IGNORE_UNUSED, 0),
+ 	GATE(0, "aclk333_432_isp0", "mout_user_aclk333_432_isp0",
+ 			GATE_BUS_TOP, 5, 0, 0),
+ 	GATE(0, "aclk300_gscl", "mout_user_aclk300_gscl",
+-			GATE_BUS_TOP, 6, CLK_IGNORE_UNUSED, 0),
++			GATE_BUS_TOP, 6, CLK_IS_CRITICAL, 0),
+ 	GATE(0, "aclk333_432_gscl", "mout_user_aclk333_432_gscl",
+ 			GATE_BUS_TOP, 7, CLK_IGNORE_UNUSED, 0),
+ 	GATE(0, "aclk333_432_isp", "mout_user_aclk333_432_isp",
+@@ -983,20 +983,20 @@ static const struct samsung_gate_clock exynos5x_gate_clks[] __initconst = {
+ 	GATE(0, "aclk166", "mout_user_aclk166",
+ 			GATE_BUS_TOP, 14, CLK_IGNORE_UNUSED, 0),
+ 	GATE(CLK_ACLK333, "aclk333", "mout_user_aclk333",
+-			GATE_BUS_TOP, 15, CLK_IGNORE_UNUSED, 0),
++			GATE_BUS_TOP, 15, CLK_IS_CRITICAL, 0),
+ 	GATE(0, "aclk400_isp", "mout_user_aclk400_isp",
+ 			GATE_BUS_TOP, 16, 0, 0),
+ 	GATE(0, "aclk400_mscl", "mout_user_aclk400_mscl",
+ 			GATE_BUS_TOP, 17, 0, 0),
+ 	GATE(0, "aclk200_disp1", "mout_user_aclk200_disp1",
+-			GATE_BUS_TOP, 18, 0, 0),
++			GATE_BUS_TOP, 18, CLK_IS_CRITICAL, 0),
+ 	GATE(CLK_SCLK_MPHY_IXTAL24, "sclk_mphy_ixtal24", "mphy_refclk_ixtal24",
+ 			GATE_BUS_TOP, 28, 0, 0),
+ 	GATE(CLK_SCLK_HSIC_12M, "sclk_hsic_12m", "ff_hsic_12m",
+ 			GATE_BUS_TOP, 29, 0, 0),
+ 
+ 	GATE(0, "aclk300_disp1", "mout_user_aclk300_disp1",
+-			SRC_MASK_TOP2, 24, 0, 0),
++			SRC_MASK_TOP2, 24, CLK_IS_CRITICAL, 0),
+ 
+ 	GATE(CLK_MAU_EPLL, "mau_epll", "mout_mau_epll_clk",
+ 			SRC_MASK_TOP7, 20, 0, 0),
+diff --git a/drivers/gpio/gpiolib.c b/drivers/gpio/gpiolib.c
+index f2bb5122d2c2..063d176baa24 100644
+--- a/drivers/gpio/gpiolib.c
++++ b/drivers/gpio/gpiolib.c
+@@ -703,24 +703,23 @@ static irqreturn_t lineevent_irq_thread(int irq, void *p)
+ {
+ 	struct lineevent_state *le = p;
+ 	struct gpioevent_data ge;
+-	int ret;
++	int ret, level;
+ 
+ 	ge.timestamp = ktime_get_real_ns();
++	level = gpiod_get_value_cansleep(le->desc);
+ 
+ 	if (le->eflags & GPIOEVENT_REQUEST_RISING_EDGE
+ 	    && le->eflags & GPIOEVENT_REQUEST_FALLING_EDGE) {
+-		int level = gpiod_get_value_cansleep(le->desc);
+-
+ 		if (level)
+ 			/* Emit low-to-high event */
+ 			ge.id = GPIOEVENT_EVENT_RISING_EDGE;
+ 		else
+ 			/* Emit high-to-low event */
+ 			ge.id = GPIOEVENT_EVENT_FALLING_EDGE;
+-	} else if (le->eflags & GPIOEVENT_REQUEST_RISING_EDGE) {
++	} else if (le->eflags & GPIOEVENT_REQUEST_RISING_EDGE && level) {
+ 		/* Emit low-to-high event */
+ 		ge.id = GPIOEVENT_EVENT_RISING_EDGE;
+-	} else if (le->eflags & GPIOEVENT_REQUEST_FALLING_EDGE) {
++	} else if (le->eflags & GPIOEVENT_REQUEST_FALLING_EDGE && !level) {
+ 		/* Emit high-to-low event */
+ 		ge.id = GPIOEVENT_EVENT_FALLING_EDGE;
+ 	} else {
+diff --git a/drivers/gpu/drm/amd/amdgpu/si.c b/drivers/gpu/drm/amd/amdgpu/si.c
+index dc9511c5ecb8..327bdf13e8bc 100644
+--- a/drivers/gpu/drm/amd/amdgpu/si.c
++++ b/drivers/gpu/drm/amd/amdgpu/si.c
+@@ -1301,6 +1301,7 @@ static void si_init_golden_registers(struct amdgpu_device *adev)
+ 		amdgpu_program_register_sequence(adev,
+ 						 pitcairn_mgcg_cgcg_init,
+ 						 (const u32)ARRAY_SIZE(pitcairn_mgcg_cgcg_init));
++		break;
+ 	case CHIP_VERDE:
+ 		amdgpu_program_register_sequence(adev,
+ 						 verde_golden_registers,
+@@ -1325,6 +1326,7 @@ static void si_init_golden_registers(struct amdgpu_device *adev)
+ 		amdgpu_program_register_sequence(adev,
+ 						 oland_mgcg_cgcg_init,
+ 						 (const u32)ARRAY_SIZE(oland_mgcg_cgcg_init));
++		break;
+ 	case CHIP_HAINAN:
+ 		amdgpu_program_register_sequence(adev,
+ 						 hainan_golden_registers,
+diff --git a/drivers/gpu/drm/virtio/virtgpu_fb.c b/drivers/gpu/drm/virtio/virtgpu_fb.c
+index 2242a80866a9..dc2976c2bed3 100644
+--- a/drivers/gpu/drm/virtio/virtgpu_fb.c
++++ b/drivers/gpu/drm/virtio/virtgpu_fb.c
+@@ -337,7 +337,7 @@ static int virtio_gpufb_create(struct drm_fb_helper *helper,
+ 	info->fbops = &virtio_gpufb_ops;
+ 	info->pixmap.flags = FB_PIXMAP_SYSTEM;
+ 
+-	info->screen_base = obj->vmap;
++	info->screen_buffer = obj->vmap;
+ 	info->screen_size = obj->gem_base.size;
+ 	drm_fb_helper_fill_fix(info, fb->pitches[0], fb->depth);
+ 	drm_fb_helper_fill_var(info, &vfbdev->helper,
+diff --git a/drivers/infiniband/hw/cxgb4/cm.c b/drivers/infiniband/hw/cxgb4/cm.c
+index f1510cc76d2d..9398143d7c5e 100644
+--- a/drivers/infiniband/hw/cxgb4/cm.c
++++ b/drivers/infiniband/hw/cxgb4/cm.c
+@@ -1804,20 +1804,21 @@ static int rx_data(struct c4iw_dev *dev, struct sk_buff *skb)
+ 	skb_trim(skb, dlen);
+ 	mutex_lock(&ep->com.mutex);
+ 
+-	/* update RX credits */
+-	update_rx_credits(ep, dlen);
+-
+ 	switch (ep->com.state) {
+ 	case MPA_REQ_SENT:
++		update_rx_credits(ep, dlen);
+ 		ep->rcv_seq += dlen;
+ 		disconnect = process_mpa_reply(ep, skb);
+ 		break;
+ 	case MPA_REQ_WAIT:
++		update_rx_credits(ep, dlen);
+ 		ep->rcv_seq += dlen;
+ 		disconnect = process_mpa_request(ep, skb);
+ 		break;
+ 	case FPDU_MODE: {
+ 		struct c4iw_qp_attributes attrs;
++
++		update_rx_credits(ep, dlen);
+ 		BUG_ON(!ep->com.qp);
+ 		if (status)
+ 			pr_err("%s Unexpected streaming data." \
+diff --git a/drivers/iommu/amd_iommu.c b/drivers/iommu/amd_iommu.c
+index 41800b6d492e..c380b7e8f1c6 100644
+--- a/drivers/iommu/amd_iommu.c
++++ b/drivers/iommu/amd_iommu.c
+@@ -4294,6 +4294,7 @@ static int amd_ir_set_vcpu_affinity(struct irq_data *data, void *vcpu_info)
+ 		/* Setting */
+ 		irte->hi.fields.ga_root_ptr = (pi_data->base >> 12);
+ 		irte->hi.fields.vector = vcpu_pi_info->vector;
++		irte->lo.fields_vapic.ga_log_intr = 1;
+ 		irte->lo.fields_vapic.guest_mode = 1;
+ 		irte->lo.fields_vapic.ga_tag = pi_data->ga_tag;
+ 
+diff --git a/drivers/media/pci/saa7164/saa7164-bus.c b/drivers/media/pci/saa7164/saa7164-bus.c
+index a18fe5d47238..b4857cd7069e 100644
+--- a/drivers/media/pci/saa7164/saa7164-bus.c
++++ b/drivers/media/pci/saa7164/saa7164-bus.c
+@@ -393,11 +393,11 @@ int saa7164_bus_get(struct saa7164_dev *dev, struct tmComResInfo* msg,
+ 	msg_tmp.size = le16_to_cpu((__force __le16)msg_tmp.size);
+ 	msg_tmp.command = le32_to_cpu((__force __le32)msg_tmp.command);
+ 	msg_tmp.controlselector = le16_to_cpu((__force __le16)msg_tmp.controlselector);
++	memcpy(msg, &msg_tmp, sizeof(*msg));
+ 
+ 	/* No need to update the read positions, because this was a peek */
+ 	/* If the caller specifically want to peek, return */
+ 	if (peekonly) {
+-		memcpy(msg, &msg_tmp, sizeof(*msg));
+ 		goto peekout;
+ 	}
+ 
+@@ -442,21 +442,15 @@ int saa7164_bus_get(struct saa7164_dev *dev, struct tmComResInfo* msg,
+ 		space_rem = bus->m_dwSizeGetRing - curr_grp;
+ 
+ 		if (space_rem < sizeof(*msg)) {
+-			/* msg wraps around the ring */
+-			memcpy_fromio(msg, bus->m_pdwGetRing + curr_grp, space_rem);
+-			memcpy_fromio((u8 *)msg + space_rem, bus->m_pdwGetRing,
+-				sizeof(*msg) - space_rem);
+ 			if (buf)
+ 				memcpy_fromio(buf, bus->m_pdwGetRing + sizeof(*msg) -
+ 					space_rem, buf_size);
+ 
+ 		} else if (space_rem == sizeof(*msg)) {
+-			memcpy_fromio(msg, bus->m_pdwGetRing + curr_grp, sizeof(*msg));
+ 			if (buf)
+ 				memcpy_fromio(buf, bus->m_pdwGetRing, buf_size);
+ 		} else {
+ 			/* Additional data wraps around the ring */
+-			memcpy_fromio(msg, bus->m_pdwGetRing + curr_grp, sizeof(*msg));
+ 			if (buf) {
+ 				memcpy_fromio(buf, bus->m_pdwGetRing + curr_grp +
+ 					sizeof(*msg), space_rem - sizeof(*msg));
+@@ -469,15 +463,10 @@ int saa7164_bus_get(struct saa7164_dev *dev, struct tmComResInfo* msg,
+ 
+ 	} else {
+ 		/* No wrapping */
+-		memcpy_fromio(msg, bus->m_pdwGetRing + curr_grp, sizeof(*msg));
+ 		if (buf)
+ 			memcpy_fromio(buf, bus->m_pdwGetRing + curr_grp + sizeof(*msg),
+ 				buf_size);
+ 	}
+-	/* Convert from little endian to CPU */
+-	msg->size = le16_to_cpu((__force __le16)msg->size);
+-	msg->command = le32_to_cpu((__force __le32)msg->command);
+-	msg->controlselector = le16_to_cpu((__force __le16)msg->controlselector);
+ 
+ 	/* Update the read positions, adjusting the ring */
+ 	saa7164_writel(bus->m_dwGetReadPos, new_grp);
+diff --git a/drivers/media/platform/davinci/vpfe_capture.c b/drivers/media/platform/davinci/vpfe_capture.c
+index 6efb2f1631c4..bdb7a0a00932 100644
+--- a/drivers/media/platform/davinci/vpfe_capture.c
++++ b/drivers/media/platform/davinci/vpfe_capture.c
+@@ -1725,27 +1725,9 @@ static long vpfe_param_handler(struct file *file, void *priv,
+ 
+ 	switch (cmd) {
+ 	case VPFE_CMD_S_CCDC_RAW_PARAMS:
++		ret = -EINVAL;
+ 		v4l2_warn(&vpfe_dev->v4l2_dev,
+-			  "VPFE_CMD_S_CCDC_RAW_PARAMS: experimental ioctl\n");
+-		if (ccdc_dev->hw_ops.set_params) {
+-			ret = ccdc_dev->hw_ops.set_params(param);
+-			if (ret) {
+-				v4l2_dbg(1, debug, &vpfe_dev->v4l2_dev,
+-					"Error setting parameters in CCDC\n");
+-				goto unlock_out;
+-			}
+-			ret = vpfe_get_ccdc_image_format(vpfe_dev,
+-							 &vpfe_dev->fmt);
+-			if (ret < 0) {
+-				v4l2_dbg(1, debug, &vpfe_dev->v4l2_dev,
+-					"Invalid image format at CCDC\n");
+-				goto unlock_out;
+-			}
+-		} else {
+-			ret = -EINVAL;
+-			v4l2_dbg(1, debug, &vpfe_dev->v4l2_dev,
+-				"VPFE_CMD_S_CCDC_RAW_PARAMS not supported\n");
+-		}
++			"VPFE_CMD_S_CCDC_RAW_PARAMS not supported\n");
+ 		break;
+ 	default:
+ 		ret = -ENOTTY;
+diff --git a/drivers/media/rc/ir-lirc-codec.c b/drivers/media/rc/ir-lirc-codec.c
+index c3277308a70b..b49f80cb49c9 100644
+--- a/drivers/media/rc/ir-lirc-codec.c
++++ b/drivers/media/rc/ir-lirc-codec.c
+@@ -254,7 +254,7 @@ static long ir_lirc_ioctl(struct file *filep, unsigned int cmd,
+ 		return 0;
+ 
+ 	case LIRC_GET_REC_RESOLUTION:
+-		val = dev->rx_resolution;
++		val = dev->rx_resolution / 1000;
+ 		break;
+ 
+ 	case LIRC_SET_WIDEBAND_RECEIVER:
+diff --git a/drivers/mmc/core/host.c b/drivers/mmc/core/host.c
+index 98f25ffb4258..848b3453517e 100644
+--- a/drivers/mmc/core/host.c
++++ b/drivers/mmc/core/host.c
+@@ -179,19 +179,17 @@ static void mmc_retune_timer(unsigned long data)
+  */
+ int mmc_of_parse(struct mmc_host *host)
+ {
+-	struct device_node *np;
++	struct device *dev = host->parent;
+ 	u32 bus_width;
+ 	int ret;
+ 	bool cd_cap_invert, cd_gpio_invert = false;
+ 	bool ro_cap_invert, ro_gpio_invert = false;
+ 
+-	if (!host->parent || !host->parent->of_node)
++	if (!dev || !dev_fwnode(dev))
+ 		return 0;
+ 
+-	np = host->parent->of_node;
+-
+ 	/* "bus-width" is translated to MMC_CAP_*_BIT_DATA flags */
+-	if (of_property_read_u32(np, "bus-width", &bus_width) < 0) {
++	if (device_property_read_u32(dev, "bus-width", &bus_width) < 0) {
+ 		dev_dbg(host->parent,
+ 			"\"bus-width\" property is missing, assuming 1 bit.\n");
+ 		bus_width = 1;
+@@ -213,7 +211,7 @@ int mmc_of_parse(struct mmc_host *host)
+ 	}
+ 
+ 	/* f_max is obtained from the optional "max-frequency" property */
+-	of_property_read_u32(np, "max-frequency", &host->f_max);
++	device_property_read_u32(dev, "max-frequency", &host->f_max);
+ 
+ 	/*
+ 	 * Configure CD and WP pins. They are both by default active low to
+@@ -228,12 +226,12 @@ int mmc_of_parse(struct mmc_host *host)
+ 	 */
+ 
+ 	/* Parse Card Detection */
+-	if (of_property_read_bool(np, "non-removable")) {
++	if (device_property_read_bool(dev, "non-removable")) {
+ 		host->caps |= MMC_CAP_NONREMOVABLE;
+ 	} else {
+-		cd_cap_invert = of_property_read_bool(np, "cd-inverted");
++		cd_cap_invert = device_property_read_bool(dev, "cd-inverted");
+ 
+-		if (of_property_read_bool(np, "broken-cd"))
++		if (device_property_read_bool(dev, "broken-cd"))
+ 			host->caps |= MMC_CAP_NEEDS_POLL;
+ 
+ 		ret = mmc_gpiod_request_cd(host, "cd", 0, true,
+@@ -259,7 +257,7 @@ int mmc_of_parse(struct mmc_host *host)
+ 	}
+ 
+ 	/* Parse Write Protection */
+-	ro_cap_invert = of_property_read_bool(np, "wp-inverted");
++	ro_cap_invert = device_property_read_bool(dev, "wp-inverted");
+ 
+ 	ret = mmc_gpiod_request_ro(host, "wp", 0, false, 0, &ro_gpio_invert);
+ 	if (!ret)
+@@ -267,62 +265,62 @@ int mmc_of_parse(struct mmc_host *host)
+ 	else if (ret != -ENOENT && ret != -ENOSYS)
+ 		return ret;
+ 
+-	if (of_property_read_bool(np, "disable-wp"))
++	if (device_property_read_bool(dev, "disable-wp"))
+ 		host->caps2 |= MMC_CAP2_NO_WRITE_PROTECT;
+ 
+ 	/* See the comment on CD inversion above */
+ 	if (ro_cap_invert ^ ro_gpio_invert)
+ 		host->caps2 |= MMC_CAP2_RO_ACTIVE_HIGH;
+ 
+-	if (of_property_read_bool(np, "cap-sd-highspeed"))
++	if (device_property_read_bool(dev, "cap-sd-highspeed"))
+ 		host->caps |= MMC_CAP_SD_HIGHSPEED;
+-	if (of_property_read_bool(np, "cap-mmc-highspeed"))
++	if (device_property_read_bool(dev, "cap-mmc-highspeed"))
+ 		host->caps |= MMC_CAP_MMC_HIGHSPEED;
+-	if (of_property_read_bool(np, "sd-uhs-sdr12"))
++	if (device_property_read_bool(dev, "sd-uhs-sdr12"))
+ 		host->caps |= MMC_CAP_UHS_SDR12;
+-	if (of_property_read_bool(np, "sd-uhs-sdr25"))
++	if (device_property_read_bool(dev, "sd-uhs-sdr25"))
+ 		host->caps |= MMC_CAP_UHS_SDR25;
+-	if (of_property_read_bool(np, "sd-uhs-sdr50"))
++	if (device_property_read_bool(dev, "sd-uhs-sdr50"))
+ 		host->caps |= MMC_CAP_UHS_SDR50;
+-	if (of_property_read_bool(np, "sd-uhs-sdr104"))
++	if (device_property_read_bool(dev, "sd-uhs-sdr104"))
+ 		host->caps |= MMC_CAP_UHS_SDR104;
+-	if (of_property_read_bool(np, "sd-uhs-ddr50"))
++	if (device_property_read_bool(dev, "sd-uhs-ddr50"))
+ 		host->caps |= MMC_CAP_UHS_DDR50;
+-	if (of_property_read_bool(np, "cap-power-off-card"))
++	if (device_property_read_bool(dev, "cap-power-off-card"))
+ 		host->caps |= MMC_CAP_POWER_OFF_CARD;
+-	if (of_property_read_bool(np, "cap-mmc-hw-reset"))
++	if (device_property_read_bool(dev, "cap-mmc-hw-reset"))
+ 		host->caps |= MMC_CAP_HW_RESET;
+-	if (of_property_read_bool(np, "cap-sdio-irq"))
++	if (device_property_read_bool(dev, "cap-sdio-irq"))
+ 		host->caps |= MMC_CAP_SDIO_IRQ;
+-	if (of_property_read_bool(np, "full-pwr-cycle"))
++	if (device_property_read_bool(dev, "full-pwr-cycle"))
+ 		host->caps2 |= MMC_CAP2_FULL_PWR_CYCLE;
+-	if (of_property_read_bool(np, "keep-power-in-suspend"))
++	if (device_property_read_bool(dev, "keep-power-in-suspend"))
+ 		host->pm_caps |= MMC_PM_KEEP_POWER;
+-	if (of_property_read_bool(np, "wakeup-source") ||
+-	    of_property_read_bool(np, "enable-sdio-wakeup")) /* legacy */
++	if (device_property_read_bool(dev, "wakeup-source") ||
++	    device_property_read_bool(dev, "enable-sdio-wakeup")) /* legacy */
+ 		host->pm_caps |= MMC_PM_WAKE_SDIO_IRQ;
+-	if (of_property_read_bool(np, "mmc-ddr-1_8v"))
++	if (device_property_read_bool(dev, "mmc-ddr-1_8v"))
+ 		host->caps |= MMC_CAP_1_8V_DDR;
+-	if (of_property_read_bool(np, "mmc-ddr-1_2v"))
++	if (device_property_read_bool(dev, "mmc-ddr-1_2v"))
+ 		host->caps |= MMC_CAP_1_2V_DDR;
+-	if (of_property_read_bool(np, "mmc-hs200-1_8v"))
++	if (device_property_read_bool(dev, "mmc-hs200-1_8v"))
+ 		host->caps2 |= MMC_CAP2_HS200_1_8V_SDR;
+-	if (of_property_read_bool(np, "mmc-hs200-1_2v"))
++	if (device_property_read_bool(dev, "mmc-hs200-1_2v"))
+ 		host->caps2 |= MMC_CAP2_HS200_1_2V_SDR;
+-	if (of_property_read_bool(np, "mmc-hs400-1_8v"))
++	if (device_property_read_bool(dev, "mmc-hs400-1_8v"))
+ 		host->caps2 |= MMC_CAP2_HS400_1_8V | MMC_CAP2_HS200_1_8V_SDR;
+-	if (of_property_read_bool(np, "mmc-hs400-1_2v"))
++	if (device_property_read_bool(dev, "mmc-hs400-1_2v"))
+ 		host->caps2 |= MMC_CAP2_HS400_1_2V | MMC_CAP2_HS200_1_2V_SDR;
+-	if (of_property_read_bool(np, "mmc-hs400-enhanced-strobe"))
++	if (device_property_read_bool(dev, "mmc-hs400-enhanced-strobe"))
+ 		host->caps2 |= MMC_CAP2_HS400_ES;
+-	if (of_property_read_bool(np, "no-sdio"))
++	if (device_property_read_bool(dev, "no-sdio"))
+ 		host->caps2 |= MMC_CAP2_NO_SDIO;
+-	if (of_property_read_bool(np, "no-sd"))
++	if (device_property_read_bool(dev, "no-sd"))
+ 		host->caps2 |= MMC_CAP2_NO_SD;
+-	if (of_property_read_bool(np, "no-mmc"))
++	if (device_property_read_bool(dev, "no-mmc"))
+ 		host->caps2 |= MMC_CAP2_NO_MMC;
+ 
+-	host->dsr_req = !of_property_read_u32(np, "dsr", &host->dsr);
++	host->dsr_req = !device_property_read_u32(dev, "dsr", &host->dsr);
+ 	if (host->dsr_req && (host->dsr & ~0xffff)) {
+ 		dev_err(host->parent,
+ 			"device tree specified broken value for DSR: 0x%x, ignoring\n",
+diff --git a/drivers/mmc/core/mmc.c b/drivers/mmc/core/mmc.c
+index f57700c4b8f0..323dba35bc9a 100644
+--- a/drivers/mmc/core/mmc.c
++++ b/drivers/mmc/core/mmc.c
+@@ -1690,7 +1690,7 @@ static int mmc_init_card(struct mmc_host *host, u32 ocr,
+ 		err = mmc_select_hs400(card);
+ 		if (err)
+ 			goto free_card;
+-	} else {
++	} else if (!mmc_card_hs400es(card)) {
+ 		/* Select the desired bus width optionally */
+ 		err = mmc_select_bus_width(card);
+ 		if (err > 0 && mmc_card_hs(card)) {
+diff --git a/drivers/mmc/host/dw_mmc.c b/drivers/mmc/host/dw_mmc.c
+index df478ae72e23..f81f4175f49a 100644
+--- a/drivers/mmc/host/dw_mmc.c
++++ b/drivers/mmc/host/dw_mmc.c
+@@ -2610,8 +2610,8 @@ static int dw_mci_init_slot(struct dw_mci *host, unsigned int id)
+ 	host->slot[id] = slot;
+ 
+ 	mmc->ops = &dw_mci_ops;
+-	if (of_property_read_u32_array(host->dev->of_node,
+-				       "clock-freq-min-max", freq, 2)) {
++	if (device_property_read_u32_array(host->dev, "clock-freq-min-max",
++					   freq, 2)) {
+ 		mmc->f_min = DW_MCI_FREQ_MIN;
+ 		mmc->f_max = DW_MCI_FREQ_MAX;
+ 	} else {
+@@ -2709,7 +2709,6 @@ static void dw_mci_init_dma(struct dw_mci *host)
+ {
+ 	int addr_config;
+ 	struct device *dev = host->dev;
+-	struct device_node *np = dev->of_node;
+ 
+ 	/*
+ 	* Check tansfer mode from HCON[17:16]
+@@ -2770,8 +2769,9 @@ static void dw_mci_init_dma(struct dw_mci *host)
+ 		dev_info(host->dev, "Using internal DMA controller.\n");
+ 	} else {
+ 		/* TRANS_MODE_EDMAC: check dma bindings again */
+-		if ((of_property_count_strings(np, "dma-names") < 0) ||
+-		    (!of_find_property(np, "dmas", NULL))) {
++		if ((device_property_read_string_array(dev, "dma-names",
++						       NULL, 0) < 0) ||
++		    !device_property_present(dev, "dmas")) {
+ 			goto no_dma;
+ 		}
+ 		host->dma_ops = &dw_mci_edmac_ops;
+@@ -2931,7 +2931,6 @@ static struct dw_mci_board *dw_mci_parse_dt(struct dw_mci *host)
+ {
+ 	struct dw_mci_board *pdata;
+ 	struct device *dev = host->dev;
+-	struct device_node *np = dev->of_node;
+ 	const struct dw_mci_drv_data *drv_data = host->drv_data;
+ 	int ret;
+ 	u32 clock_frequency;
+@@ -2948,15 +2947,16 @@ static struct dw_mci_board *dw_mci_parse_dt(struct dw_mci *host)
+ 	}
+ 
+ 	/* find out number of slots supported */
+-	of_property_read_u32(np, "num-slots", &pdata->num_slots);
++	device_property_read_u32(dev, "num-slots", &pdata->num_slots);
+ 
+-	if (of_property_read_u32(np, "fifo-depth", &pdata->fifo_depth))
++	if (device_property_read_u32(dev, "fifo-depth", &pdata->fifo_depth))
+ 		dev_info(dev,
+ 			 "fifo-depth property not found, using value of FIFOTH register as default\n");
+ 
+-	of_property_read_u32(np, "card-detect-delay", &pdata->detect_delay_ms);
++	device_property_read_u32(dev, "card-detect-delay",
++				 &pdata->detect_delay_ms);
+ 
+-	if (!of_property_read_u32(np, "clock-frequency", &clock_frequency))
++	if (!device_property_read_u32(dev, "clock-frequency", &clock_frequency))
+ 		pdata->bus_hz = clock_frequency;
+ 
+ 	if (drv_data && drv_data->parse_dt) {
+diff --git a/drivers/mmc/host/sdhci-of-at91.c b/drivers/mmc/host/sdhci-of-at91.c
+index a8b430ff117b..83b84ffec27d 100644
+--- a/drivers/mmc/host/sdhci-of-at91.c
++++ b/drivers/mmc/host/sdhci-of-at91.c
+@@ -31,6 +31,7 @@
+ 
+ #define SDMMC_MC1R	0x204
+ #define		SDMMC_MC1R_DDR		BIT(3)
++#define		SDMMC_MC1R_FCD		BIT(7)
+ #define SDMMC_CACR	0x230
+ #define		SDMMC_CACR_CAPWREN	BIT(0)
+ #define		SDMMC_CACR_KEY		(0x46 << 8)
+@@ -43,6 +44,15 @@ struct sdhci_at91_priv {
+ 	struct clk *mainck;
+ };
+ 
++static void sdhci_at91_set_force_card_detect(struct sdhci_host *host)
++{
++	u8 mc1r;
++
++	mc1r = readb(host->ioaddr + SDMMC_MC1R);
++	mc1r |= SDMMC_MC1R_FCD;
++	writeb(mc1r, host->ioaddr + SDMMC_MC1R);
++}
++
+ static void sdhci_at91_set_clock(struct sdhci_host *host, unsigned int clock)
+ {
+ 	u16 clk;
+@@ -112,10 +122,18 @@ void sdhci_at91_set_uhs_signaling(struct sdhci_host *host, unsigned int timing)
+ 	sdhci_set_uhs_signaling(host, timing);
+ }
+ 
++static void sdhci_at91_reset(struct sdhci_host *host, u8 mask)
++{
++	sdhci_reset(host, mask);
++
++	if (host->mmc->caps & MMC_CAP_NONREMOVABLE)
++		sdhci_at91_set_force_card_detect(host);
++}
++
+ static const struct sdhci_ops sdhci_at91_sama5d2_ops = {
+ 	.set_clock		= sdhci_at91_set_clock,
+ 	.set_bus_width		= sdhci_set_bus_width,
+-	.reset			= sdhci_reset,
++	.reset			= sdhci_at91_reset,
+ 	.set_uhs_signaling	= sdhci_at91_set_uhs_signaling,
+ 	.set_power		= sdhci_at91_set_power,
+ };
+@@ -322,6 +340,21 @@ static int sdhci_at91_probe(struct platform_device *pdev)
+ 		host->quirks &= ~SDHCI_QUIRK_BROKEN_CARD_DETECTION;
+ 	}
+ 
++	/*
++	 * If the device attached to the MMC bus is not removable, it is safer
++	 * to set the Force Card Detect bit. People often don't connect the
++	 * card detect signal and use this pin for another purpose. If the card
++	 * detect pin is not muxed to SDHCI controller, a default value is
++	 * used. This value can be different from a SoC revision to another
++	 * one. Problems come when this default value is not card present. To
++	 * avoid this case, if the device is non removable then the card
++	 * detection procedure using the SDMCC_CD signal is bypassed.
++	 * This bit is reset when a software reset for all command is performed
++	 * so we need to implement our own reset function to set back this bit.
++	 */
++	if (host->mmc->caps & MMC_CAP_NONREMOVABLE)
++		sdhci_at91_set_force_card_detect(host);
++
+ 	pm_runtime_put_autosuspend(&pdev->dev);
+ 
+ 	return 0;
+diff --git a/drivers/net/dsa/b53/b53_common.c b/drivers/net/dsa/b53/b53_common.c
+index 947adda3397d..3ec573c13dac 100644
+--- a/drivers/net/dsa/b53/b53_common.c
++++ b/drivers/net/dsa/b53/b53_common.c
+@@ -1558,6 +1558,7 @@ static const struct b53_chip_data b53_switch_chips[] = {
+ 		.dev_name = "BCM53125",
+ 		.vlans = 4096,
+ 		.enabled_ports = 0xff,
++		.arl_entries = 4,
+ 		.cpu_port = B53_CPU_PORT,
+ 		.vta_regs = B53_VTA_REGS,
+ 		.duplex_reg = B53_DUPLEX_STAT_GE,
+diff --git a/drivers/net/ethernet/aurora/nb8800.c b/drivers/net/ethernet/aurora/nb8800.c
+index e078d8da978c..29d29af612d1 100644
+--- a/drivers/net/ethernet/aurora/nb8800.c
++++ b/drivers/net/ethernet/aurora/nb8800.c
+@@ -609,7 +609,7 @@ static void nb8800_mac_config(struct net_device *dev)
+ 		mac_mode |= HALF_DUPLEX;
+ 
+ 	if (gigabit) {
+-		if (priv->phy_mode == PHY_INTERFACE_MODE_RGMII)
++		if (phy_interface_is_rgmii(dev->phydev))
+ 			mac_mode |= RGMII_MODE;
+ 
+ 		mac_mode |= GMAC_MODE;
+@@ -1277,11 +1277,10 @@ static int nb8800_tangox_init(struct net_device *dev)
+ 		break;
+ 
+ 	case PHY_INTERFACE_MODE_RGMII:
+-		pad_mode = PAD_MODE_RGMII;
+-		break;
+-
++	case PHY_INTERFACE_MODE_RGMII_ID:
++	case PHY_INTERFACE_MODE_RGMII_RXID:
+ 	case PHY_INTERFACE_MODE_RGMII_TXID:
+-		pad_mode = PAD_MODE_RGMII | PAD_MODE_GTX_CLK_DELAY;
++		pad_mode = PAD_MODE_RGMII;
+ 		break;
+ 
+ 	default:
+diff --git a/drivers/net/ethernet/broadcom/tg3.c b/drivers/net/ethernet/broadcom/tg3.c
+index a927a730da10..edae2dcc4927 100644
+--- a/drivers/net/ethernet/broadcom/tg3.c
++++ b/drivers/net/ethernet/broadcom/tg3.c
+@@ -8720,11 +8720,14 @@ static void tg3_free_consistent(struct tg3 *tp)
+ 	tg3_mem_rx_release(tp);
+ 	tg3_mem_tx_release(tp);
+ 
++	/* Protect tg3_get_stats64() from reading freed tp->hw_stats. */
++	tg3_full_lock(tp, 0);
+ 	if (tp->hw_stats) {
+ 		dma_free_coherent(&tp->pdev->dev, sizeof(struct tg3_hw_stats),
+ 				  tp->hw_stats, tp->stats_mapping);
+ 		tp->hw_stats = NULL;
+ 	}
++	tg3_full_unlock(tp);
+ }
+ 
+ /*
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/cmd.c b/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
+index cb45390c7623..f7fabecc104f 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
+@@ -770,6 +770,10 @@ static void cb_timeout_handler(struct work_struct *work)
+ 	mlx5_cmd_comp_handler(dev, 1UL << ent->idx, true);
+ }
+ 
++static void free_msg(struct mlx5_core_dev *dev, struct mlx5_cmd_msg *msg);
++static void mlx5_free_cmd_msg(struct mlx5_core_dev *dev,
++			      struct mlx5_cmd_msg *msg);
++
+ static void cmd_work_handler(struct work_struct *work)
+ {
+ 	struct mlx5_cmd_work_ent *ent = container_of(work, struct mlx5_cmd_work_ent, work);
+@@ -779,16 +783,27 @@ static void cmd_work_handler(struct work_struct *work)
+ 	struct mlx5_cmd_layout *lay;
+ 	struct semaphore *sem;
+ 	unsigned long flags;
++	int alloc_ret;
+ 
+ 	sem = ent->page_queue ? &cmd->pages_sem : &cmd->sem;
+ 	down(sem);
+ 	if (!ent->page_queue) {
+-		ent->idx = alloc_ent(cmd);
+-		if (ent->idx < 0) {
++		alloc_ret = alloc_ent(cmd);
++		if (alloc_ret < 0) {
++			if (ent->callback) {
++				ent->callback(-EAGAIN, ent->context);
++				mlx5_free_cmd_msg(dev, ent->out);
++				free_msg(dev, ent->in);
++				free_cmd(ent);
++			} else {
++				ent->ret = -EAGAIN;
++				complete(&ent->done);
++			}
+ 			mlx5_core_err(dev, "failed to allocate command entry\n");
+ 			up(sem);
+ 			return;
+ 		}
++		ent->idx = alloc_ret;
+ 	} else {
+ 		ent->idx = cmd->max_reg_cmds;
+ 		spin_lock_irqsave(&cmd->alloc_lock, flags);
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_clock.c b/drivers/net/ethernet/mellanox/mlx5/core/en_clock.c
+index 13dc388667b6..1612ec0d9103 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en_clock.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_clock.c
+@@ -62,12 +62,14 @@ static void mlx5e_timestamp_overflow(struct work_struct *work)
+ 	struct delayed_work *dwork = to_delayed_work(work);
+ 	struct mlx5e_tstamp *tstamp = container_of(dwork, struct mlx5e_tstamp,
+ 						   overflow_work);
++	struct mlx5e_priv *priv = container_of(tstamp, struct mlx5e_priv, tstamp);
+ 	unsigned long flags;
+ 
+ 	write_lock_irqsave(&tstamp->lock, flags);
+ 	timecounter_read(&tstamp->clock);
+ 	write_unlock_irqrestore(&tstamp->lock, flags);
+-	schedule_delayed_work(&tstamp->overflow_work, tstamp->overflow_period);
++	queue_delayed_work(priv->wq, &tstamp->overflow_work,
++			   msecs_to_jiffies(tstamp->overflow_period * 1000));
+ }
+ 
+ int mlx5e_hwstamp_set(struct net_device *dev, struct ifreq *ifr)
+@@ -263,7 +265,7 @@ void mlx5e_timestamp_init(struct mlx5e_priv *priv)
+ 
+ 	INIT_DELAYED_WORK(&tstamp->overflow_work, mlx5e_timestamp_overflow);
+ 	if (tstamp->overflow_period)
+-		schedule_delayed_work(&tstamp->overflow_work, 0);
++		queue_delayed_work(priv->wq, &tstamp->overflow_work, 0);
+ 	else
+ 		mlx5_core_warn(priv->mdev, "invalid overflow period, overflow_work is not scheduled\n");
+ 
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_fs_ethtool.c b/drivers/net/ethernet/mellanox/mlx5/core/en_fs_ethtool.c
+index e034dbc4913d..cf070fc0fb6b 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en_fs_ethtool.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_fs_ethtool.c
+@@ -276,7 +276,7 @@ static void add_rule_to_list(struct mlx5e_priv *priv,
+ 
+ static bool outer_header_zero(u32 *match_criteria)
+ {
+-	int size = MLX5_ST_SZ_BYTES(fte_match_param);
++	int size = MLX5_FLD_SZ_BYTES(fte_match_param, outer_headers);
+ 	char *outer_headers_c = MLX5_ADDR_OF(fte_match_param, match_criteria,
+ 					     outer_headers);
+ 
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c b/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c
+index 6ffd5d2a70aa..52a38106448e 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c
+@@ -651,9 +651,14 @@ int esw_offloads_init(struct mlx5_eswitch *esw, int nvports)
+ 	int vport;
+ 	int err;
+ 
++	/* disable PF RoCE so missed packets don't go through RoCE steering */
++	mlx5_dev_list_lock();
++	mlx5_remove_dev_by_protocol(esw->dev, MLX5_INTERFACE_PROTOCOL_IB);
++	mlx5_dev_list_unlock();
++
+ 	err = esw_create_offloads_fdb_table(esw, nvports);
+ 	if (err)
+-		return err;
++		goto create_fdb_err;
+ 
+ 	err = esw_create_offloads_table(esw);
+ 	if (err)
+@@ -673,11 +678,6 @@ int esw_offloads_init(struct mlx5_eswitch *esw, int nvports)
+ 			goto err_reps;
+ 	}
+ 
+-	/* disable PF RoCE so missed packets don't go through RoCE steering */
+-	mlx5_dev_list_lock();
+-	mlx5_remove_dev_by_protocol(esw->dev, MLX5_INTERFACE_PROTOCOL_IB);
+-	mlx5_dev_list_unlock();
+-
+ 	return 0;
+ 
+ err_reps:
+@@ -694,6 +694,13 @@ int esw_offloads_init(struct mlx5_eswitch *esw, int nvports)
+ 
+ create_ft_err:
+ 	esw_destroy_offloads_fdb_table(esw);
++
++create_fdb_err:
++	/* enable back PF RoCE */
++	mlx5_dev_list_lock();
++	mlx5_add_dev_by_protocol(esw->dev, MLX5_INTERFACE_PROTOCOL_IB);
++	mlx5_dev_list_unlock();
++
+ 	return err;
+ }
+ 
+@@ -701,11 +708,6 @@ static int esw_offloads_stop(struct mlx5_eswitch *esw)
+ {
+ 	int err, err1, num_vfs = esw->dev->priv.sriov.num_vfs;
+ 
+-	/* enable back PF RoCE */
+-	mlx5_dev_list_lock();
+-	mlx5_add_dev_by_protocol(esw->dev, MLX5_INTERFACE_PROTOCOL_IB);
+-	mlx5_dev_list_unlock();
+-
+ 	mlx5_eswitch_disable_sriov(esw);
+ 	err = mlx5_eswitch_enable_sriov(esw, num_vfs, SRIOV_LEGACY);
+ 	if (err) {
+@@ -715,6 +717,11 @@ static int esw_offloads_stop(struct mlx5_eswitch *esw)
+ 			esw_warn(esw->dev, "Failed setting eswitch back to offloads, err %d\n", err);
+ 	}
+ 
++	/* enable back PF RoCE */
++	mlx5_dev_list_lock();
++	mlx5_add_dev_by_protocol(esw->dev, MLX5_INTERFACE_PROTOCOL_IB);
++	mlx5_dev_list_unlock();
++
+ 	return err;
+ }
+ 
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/lag.c b/drivers/net/ethernet/mellanox/mlx5/core/lag.c
+index b5d5519542e8..0ca4623bda6b 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/lag.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/lag.c
+@@ -157,22 +157,17 @@ static bool mlx5_lag_is_bonded(struct mlx5_lag *ldev)
+ static void mlx5_infer_tx_affinity_mapping(struct lag_tracker *tracker,
+ 					   u8 *port1, u8 *port2)
+ {
+-	if (tracker->tx_type == NETDEV_LAG_TX_TYPE_ACTIVEBACKUP) {
+-		if (tracker->netdev_state[0].tx_enabled) {
+-			*port1 = 1;
+-			*port2 = 1;
+-		} else {
+-			*port1 = 2;
+-			*port2 = 2;
+-		}
+-	} else {
+-		*port1 = 1;
+-		*port2 = 2;
+-		if (!tracker->netdev_state[0].link_up)
+-			*port1 = 2;
+-		else if (!tracker->netdev_state[1].link_up)
+-			*port2 = 1;
++	*port1 = 1;
++	*port2 = 2;
++	if (!tracker->netdev_state[0].tx_enabled ||
++	    !tracker->netdev_state[0].link_up) {
++		*port1 = 2;
++		return;
+ 	}
++
++	if (!tracker->netdev_state[1].tx_enabled ||
++	    !tracker->netdev_state[1].link_up)
++		*port2 = 1;
+ }
+ 
+ static void mlx5_activate_lag(struct mlx5_lag *ldev,
+diff --git a/drivers/net/ethernet/renesas/sh_eth.c b/drivers/net/ethernet/renesas/sh_eth.c
+index 12be259394c6..2140dedab712 100644
+--- a/drivers/net/ethernet/renesas/sh_eth.c
++++ b/drivers/net/ethernet/renesas/sh_eth.c
+@@ -574,6 +574,7 @@ static struct sh_eth_cpu_data r8a7740_data = {
+ 	.rpadir_value   = 2 << 16,
+ 	.no_trimd	= 1,
+ 	.no_ade		= 1,
++	.hw_crc		= 1,
+ 	.tsu		= 1,
+ 	.select_mii	= 1,
+ 	.shift_rd0	= 1,
+@@ -802,7 +803,7 @@ static struct sh_eth_cpu_data sh7734_data = {
+ 
+ 	.ecsr_value	= ECSR_ICD | ECSR_MPD,
+ 	.ecsipr_value	= ECSIPR_LCHNGIP | ECSIPR_ICDIP | ECSIPR_MPDIP,
+-	.eesipr_value	= DMAC_M_RFRMER | DMAC_M_ECI | 0x003fffff,
++	.eesipr_value	= DMAC_M_RFRMER | DMAC_M_ECI | 0x003f07ff,
+ 
+ 	.tx_check	= EESR_TC1 | EESR_FTC,
+ 	.eesr_err_check	= EESR_TWB1 | EESR_TWB | EESR_TABT | EESR_RABT |
+@@ -832,7 +833,7 @@ static struct sh_eth_cpu_data sh7763_data = {
+ 
+ 	.ecsr_value	= ECSR_ICD | ECSR_MPD,
+ 	.ecsipr_value	= ECSIPR_LCHNGIP | ECSIPR_ICDIP | ECSIPR_MPDIP,
+-	.eesipr_value	= DMAC_M_RFRMER | DMAC_M_ECI | 0x003fffff,
++	.eesipr_value	= DMAC_M_RFRMER | DMAC_M_ECI | 0x003f07ff,
+ 
+ 	.tx_check	= EESR_TC1 | EESR_FTC,
+ 	.eesr_err_check	= EESR_TWB1 | EESR_TWB | EESR_TABT | EESR_RABT |
+diff --git a/drivers/net/irda/mcs7780.c b/drivers/net/irda/mcs7780.c
+index bca6a1e72d1d..e1bb802d4a4d 100644
+--- a/drivers/net/irda/mcs7780.c
++++ b/drivers/net/irda/mcs7780.c
+@@ -141,9 +141,19 @@ static int mcs_set_reg(struct mcs_cb *mcs, __u16 reg, __u16 val)
+ static int mcs_get_reg(struct mcs_cb *mcs, __u16 reg, __u16 * val)
+ {
+ 	struct usb_device *dev = mcs->usbdev;
+-	int ret = usb_control_msg(dev, usb_rcvctrlpipe(dev, 0), MCS_RDREQ,
+-				  MCS_RD_RTYPE, 0, reg, val, 2,
+-				  msecs_to_jiffies(MCS_CTRL_TIMEOUT));
++	void *dmabuf;
++	int ret;
++
++	dmabuf = kmalloc(sizeof(__u16), GFP_KERNEL);
++	if (!dmabuf)
++		return -ENOMEM;
++
++	ret = usb_control_msg(dev, usb_rcvctrlpipe(dev, 0), MCS_RDREQ,
++			      MCS_RD_RTYPE, 0, reg, dmabuf, 2,
++			      msecs_to_jiffies(MCS_CTRL_TIMEOUT));
++
++	memcpy(val, dmabuf, sizeof(__u16));
++	kfree(dmabuf);
+ 
+ 	return ret;
+ }
+diff --git a/drivers/net/phy/dp83867.c b/drivers/net/phy/dp83867.c
+index 4cad95552cf1..01cf094bee18 100644
+--- a/drivers/net/phy/dp83867.c
++++ b/drivers/net/phy/dp83867.c
+@@ -29,6 +29,7 @@
+ #define MII_DP83867_MICR	0x12
+ #define MII_DP83867_ISR		0x13
+ #define DP83867_CTRL		0x1f
++#define DP83867_CFG3		0x1e
+ 
+ /* Extended Registers */
+ #define DP83867_RGMIICTL	0x0032
+@@ -90,6 +91,8 @@ static int dp83867_config_intr(struct phy_device *phydev)
+ 		micr_status |=
+ 			(MII_DP83867_MICR_AN_ERR_INT_EN |
+ 			MII_DP83867_MICR_SPEED_CHNG_INT_EN |
++			MII_DP83867_MICR_AUTONEG_COMP_INT_EN |
++			MII_DP83867_MICR_LINK_STS_CHNG_INT_EN |
+ 			MII_DP83867_MICR_DUP_MODE_CHNG_INT_EN |
+ 			MII_DP83867_MICR_SLEEP_MODE_CHNG_INT_EN);
+ 
+@@ -190,6 +193,13 @@ static int dp83867_config_init(struct phy_device *phydev)
+ 				       DP83867_DEVADDR, delay);
+ 	}
+ 
++	/* Enable Interrupt output INT_OE in CFG3 register */
++	if (phy_interrupt_is_valid(phydev)) {
++		val = phy_read(phydev, DP83867_CFG3);
++		val |= BIT(7);
++		phy_write(phydev, DP83867_CFG3, val);
++	}
++
+ 	return 0;
+ }
+ 
+diff --git a/drivers/net/phy/phy.c b/drivers/net/phy/phy.c
+index edd30ebbf275..775a6e1fdef9 100644
+--- a/drivers/net/phy/phy.c
++++ b/drivers/net/phy/phy.c
+@@ -674,6 +674,9 @@ void phy_stop_machine(struct phy_device *phydev)
+ 	if (phydev->state > PHY_UP && phydev->state != PHY_HALTED)
+ 		phydev->state = PHY_UP;
+ 	mutex_unlock(&phydev->lock);
++
++	/* Now we can run the state machine synchronously */
++	phy_state_machine(&phydev->state_queue.work);
+ }
+ 
+ /**
+@@ -1060,6 +1063,15 @@ void phy_state_machine(struct work_struct *work)
+ 			if (old_link != phydev->link)
+ 				phydev->state = PHY_CHANGELINK;
+ 		}
++		/*
++		 * Failsafe: check that nobody set phydev->link=0 between two
++		 * poll cycles, otherwise we won't leave RUNNING state as long
++		 * as link remains down.
++		 */
++		if (!phydev->link && phydev->state == PHY_RUNNING) {
++			phydev->state = PHY_CHANGELINK;
++			phydev_err(phydev, "no link in PHY_RUNNING\n");
++		}
+ 		break;
+ 	case PHY_CHANGELINK:
+ 		err = phy_read_status(phydev);
+diff --git a/drivers/net/phy/phy_device.c b/drivers/net/phy/phy_device.c
+index 9e7b7836774f..bf02f8e4648a 100644
+--- a/drivers/net/phy/phy_device.c
++++ b/drivers/net/phy/phy_device.c
+@@ -1714,6 +1714,8 @@ static int phy_remove(struct device *dev)
+ {
+ 	struct phy_device *phydev = to_phy_device(dev);
+ 
++	cancel_delayed_work_sync(&phydev->state_queue);
++
+ 	mutex_lock(&phydev->lock);
+ 	phydev->state = PHY_DOWN;
+ 	mutex_unlock(&phydev->lock);
+diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
+index 8744b9beda33..8e3c6f4bdaa0 100644
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
+@@ -4161,11 +4161,6 @@ struct brcmf_sdio *brcmf_sdio_probe(struct brcmf_sdio_dev *sdiodev)
+ 		goto fail;
+ 	}
+ 
+-	/* allocate scatter-gather table. sg support
+-	 * will be disabled upon allocation failure.
+-	 */
+-	brcmf_sdiod_sgtable_alloc(bus->sdiodev);
+-
+ 	/* Query the F2 block size, set roundup accordingly */
+ 	bus->blocksize = bus->sdiodev->func[2]->cur_blksize;
+ 	bus->roundup = min(max_roundup, bus->blocksize);
+diff --git a/drivers/net/wireless/intel/iwlwifi/dvm/tx.c b/drivers/net/wireless/intel/iwlwifi/dvm/tx.c
+index 4b97371c3b42..838946d17b59 100644
+--- a/drivers/net/wireless/intel/iwlwifi/dvm/tx.c
++++ b/drivers/net/wireless/intel/iwlwifi/dvm/tx.c
+@@ -1190,11 +1190,11 @@ void iwlagn_rx_reply_tx(struct iwl_priv *priv, struct iwl_rx_cmd_buffer *rxb)
+ 				next_reclaimed;
+ 			IWL_DEBUG_TX_REPLY(priv, "Next reclaimed packet:%d\n",
+ 						  next_reclaimed);
++			iwlagn_check_ratid_empty(priv, sta_id, tid);
+ 		}
+ 
+ 		iwl_trans_reclaim(priv->trans, txq_id, ssn, &skbs);
+ 
+-		iwlagn_check_ratid_empty(priv, sta_id, tid);
+ 		freed = 0;
+ 
+ 		/* process frames */
+diff --git a/drivers/net/xen-netback/common.h b/drivers/net/xen-netback/common.h
+index 3ce1f7da8647..cb7365bdf6e0 100644
+--- a/drivers/net/xen-netback/common.h
++++ b/drivers/net/xen-netback/common.h
+@@ -199,6 +199,7 @@ struct xenvif_queue { /* Per-queue data for xenvif */
+ 	unsigned long   remaining_credit;
+ 	struct timer_list credit_timeout;
+ 	u64 credit_window_start;
++	bool rate_limited;
+ 
+ 	/* Statistics */
+ 	struct xenvif_stats stats;
+diff --git a/drivers/net/xen-netback/interface.c b/drivers/net/xen-netback/interface.c
+index b009d7966b46..5bfaf5578810 100644
+--- a/drivers/net/xen-netback/interface.c
++++ b/drivers/net/xen-netback/interface.c
+@@ -105,7 +105,11 @@ static int xenvif_poll(struct napi_struct *napi, int budget)
+ 
+ 	if (work_done < budget) {
+ 		napi_complete(napi);
+-		xenvif_napi_schedule_or_enable_events(queue);
++		/* If the queue is rate-limited, it shall be
++		 * rescheduled in the timer callback.
++		 */
++		if (likely(!queue->rate_limited))
++			xenvif_napi_schedule_or_enable_events(queue);
+ 	}
+ 
+ 	return work_done;
+diff --git a/drivers/net/xen-netback/netback.c b/drivers/net/xen-netback/netback.c
+index 47b481095d77..d9b5b73c35a0 100644
+--- a/drivers/net/xen-netback/netback.c
++++ b/drivers/net/xen-netback/netback.c
+@@ -179,6 +179,7 @@ static void tx_add_credit(struct xenvif_queue *queue)
+ 		max_credit = ULONG_MAX; /* wrapped: clamp to ULONG_MAX */
+ 
+ 	queue->remaining_credit = min(max_credit, max_burst);
++	queue->rate_limited = false;
+ }
+ 
+ void xenvif_tx_credit_callback(unsigned long data)
+@@ -685,8 +686,10 @@ static bool tx_credit_exceeded(struct xenvif_queue *queue, unsigned size)
+ 		msecs_to_jiffies(queue->credit_usec / 1000);
+ 
+ 	/* Timer could already be pending in rare cases. */
+-	if (timer_pending(&queue->credit_timeout))
++	if (timer_pending(&queue->credit_timeout)) {
++		queue->rate_limited = true;
+ 		return true;
++	}
+ 
+ 	/* Passed the point where we can replenish credit? */
+ 	if (time_after_eq64(now, next_credit)) {
+@@ -701,6 +704,7 @@ static bool tx_credit_exceeded(struct xenvif_queue *queue, unsigned size)
+ 		mod_timer(&queue->credit_timeout,
+ 			  next_credit);
+ 		queue->credit_window_start = next_credit;
++		queue->rate_limited = true;
+ 
+ 		return true;
+ 	}
+diff --git a/drivers/scsi/qla2xxx/qla_attr.c b/drivers/scsi/qla2xxx/qla_attr.c
+index ad33238cef17..8c4641b518b5 100644
+--- a/drivers/scsi/qla2xxx/qla_attr.c
++++ b/drivers/scsi/qla2xxx/qla_attr.c
+@@ -243,12 +243,15 @@ qla2x00_sysfs_read_optrom(struct file *filp, struct kobject *kobj,
+ 	struct qla_hw_data *ha = vha->hw;
+ 	ssize_t rval = 0;
+ 
++	mutex_lock(&ha->optrom_mutex);
++
+ 	if (ha->optrom_state != QLA_SREADING)
+-		return 0;
++		goto out;
+ 
+-	mutex_lock(&ha->optrom_mutex);
+ 	rval = memory_read_from_buffer(buf, count, &off, ha->optrom_buffer,
+ 	    ha->optrom_region_size);
++
++out:
+ 	mutex_unlock(&ha->optrom_mutex);
+ 
+ 	return rval;
+@@ -263,14 +266,19 @@ qla2x00_sysfs_write_optrom(struct file *filp, struct kobject *kobj,
+ 	    struct device, kobj)));
+ 	struct qla_hw_data *ha = vha->hw;
+ 
+-	if (ha->optrom_state != QLA_SWRITING)
++	mutex_lock(&ha->optrom_mutex);
++
++	if (ha->optrom_state != QLA_SWRITING) {
++		mutex_unlock(&ha->optrom_mutex);
+ 		return -EINVAL;
+-	if (off > ha->optrom_region_size)
++	}
++	if (off > ha->optrom_region_size) {
++		mutex_unlock(&ha->optrom_mutex);
+ 		return -ERANGE;
++	}
+ 	if (off + count > ha->optrom_region_size)
+ 		count = ha->optrom_region_size - off;
+ 
+-	mutex_lock(&ha->optrom_mutex);
+ 	memcpy(&ha->optrom_buffer[off], buf, count);
+ 	mutex_unlock(&ha->optrom_mutex);
+ 
+diff --git a/drivers/spi/spi-axi-spi-engine.c b/drivers/spi/spi-axi-spi-engine.c
+index 2b1456e5e221..c1eafbd7610a 100644
+--- a/drivers/spi/spi-axi-spi-engine.c
++++ b/drivers/spi/spi-axi-spi-engine.c
+@@ -494,7 +494,8 @@ static int spi_engine_probe(struct platform_device *pdev)
+ 			SPI_ENGINE_VERSION_MAJOR(version),
+ 			SPI_ENGINE_VERSION_MINOR(version),
+ 			SPI_ENGINE_VERSION_PATCH(version));
+-		return -ENODEV;
++		ret = -ENODEV;
++		goto err_put_master;
+ 	}
+ 
+ 	spi_engine->clk = devm_clk_get(&pdev->dev, "s_axi_aclk");
+diff --git a/drivers/target/iscsi/iscsi_target_nego.c b/drivers/target/iscsi/iscsi_target_nego.c
+index 6693d7c69f97..e8efb4299a95 100644
+--- a/drivers/target/iscsi/iscsi_target_nego.c
++++ b/drivers/target/iscsi/iscsi_target_nego.c
+@@ -490,14 +490,60 @@ static void iscsi_target_restore_sock_callbacks(struct iscsi_conn *conn)
+ 
+ static int iscsi_target_do_login(struct iscsi_conn *, struct iscsi_login *);
+ 
+-static bool iscsi_target_sk_state_check(struct sock *sk)
++static bool __iscsi_target_sk_check_close(struct sock *sk)
+ {
+ 	if (sk->sk_state == TCP_CLOSE_WAIT || sk->sk_state == TCP_CLOSE) {
+-		pr_debug("iscsi_target_sk_state_check: TCP_CLOSE_WAIT|TCP_CLOSE,"
++		pr_debug("__iscsi_target_sk_check_close: TCP_CLOSE_WAIT|TCP_CLOSE,"
+ 			"returning FALSE\n");
+-		return false;
++		return true;
+ 	}
+-	return true;
++	return false;
++}
++
++static bool iscsi_target_sk_check_close(struct iscsi_conn *conn)
++{
++	bool state = false;
++
++	if (conn->sock) {
++		struct sock *sk = conn->sock->sk;
++
++		read_lock_bh(&sk->sk_callback_lock);
++		state = (__iscsi_target_sk_check_close(sk) ||
++			 test_bit(LOGIN_FLAGS_CLOSED, &conn->login_flags));
++		read_unlock_bh(&sk->sk_callback_lock);
++	}
++	return state;
++}
++
++static bool iscsi_target_sk_check_flag(struct iscsi_conn *conn, unsigned int flag)
++{
++	bool state = false;
++
++	if (conn->sock) {
++		struct sock *sk = conn->sock->sk;
++
++		read_lock_bh(&sk->sk_callback_lock);
++		state = test_bit(flag, &conn->login_flags);
++		read_unlock_bh(&sk->sk_callback_lock);
++	}
++	return state;
++}
++
++static bool iscsi_target_sk_check_and_clear(struct iscsi_conn *conn, unsigned int flag)
++{
++	bool state = false;
++
++	if (conn->sock) {
++		struct sock *sk = conn->sock->sk;
++
++		write_lock_bh(&sk->sk_callback_lock);
++		state = (__iscsi_target_sk_check_close(sk) ||
++			 test_bit(LOGIN_FLAGS_CLOSED, &conn->login_flags));
++		if (!state)
++			clear_bit(flag, &conn->login_flags);
++		write_unlock_bh(&sk->sk_callback_lock);
++	}
++	return state;
+ }
+ 
+ static void iscsi_target_login_drop(struct iscsi_conn *conn, struct iscsi_login *login)
+@@ -537,6 +583,20 @@ static void iscsi_target_do_login_rx(struct work_struct *work)
+ 
+ 	pr_debug("entering iscsi_target_do_login_rx, conn: %p, %s:%d\n",
+ 			conn, current->comm, current->pid);
++	/*
++	 * If iscsi_target_do_login_rx() has been invoked by ->sk_data_ready()
++	 * before initial PDU processing in iscsi_target_start_negotiation()
++	 * has completed, go ahead and retry until it's cleared.
++	 *
++	 * Otherwise if the TCP connection drops while this is occuring,
++	 * iscsi_target_start_negotiation() will detect the failure, call
++	 * cancel_delayed_work_sync(&conn->login_work), and cleanup the
++	 * remaining iscsi connection resources from iscsi_np process context.
++	 */
++	if (iscsi_target_sk_check_flag(conn, LOGIN_FLAGS_INITIAL_PDU)) {
++		schedule_delayed_work(&conn->login_work, msecs_to_jiffies(10));
++		return;
++	}
+ 
+ 	spin_lock(&tpg->tpg_state_lock);
+ 	state = (tpg->tpg_state == TPG_STATE_ACTIVE);
+@@ -544,26 +604,12 @@ static void iscsi_target_do_login_rx(struct work_struct *work)
+ 
+ 	if (!state) {
+ 		pr_debug("iscsi_target_do_login_rx: tpg_state != TPG_STATE_ACTIVE\n");
+-		iscsi_target_restore_sock_callbacks(conn);
+-		iscsi_target_login_drop(conn, login);
+-		iscsit_deaccess_np(np, tpg, tpg_np);
+-		return;
++		goto err;
+ 	}
+ 
+-	if (conn->sock) {
+-		struct sock *sk = conn->sock->sk;
+-
+-		read_lock_bh(&sk->sk_callback_lock);
+-		state = iscsi_target_sk_state_check(sk);
+-		read_unlock_bh(&sk->sk_callback_lock);
+-
+-		if (!state) {
+-			pr_debug("iscsi_target_do_login_rx, TCP state CLOSE\n");
+-			iscsi_target_restore_sock_callbacks(conn);
+-			iscsi_target_login_drop(conn, login);
+-			iscsit_deaccess_np(np, tpg, tpg_np);
+-			return;
+-		}
++	if (iscsi_target_sk_check_close(conn)) {
++		pr_debug("iscsi_target_do_login_rx, TCP state CLOSE\n");
++		goto err;
+ 	}
+ 
+ 	conn->login_kworker = current;
+@@ -581,34 +627,29 @@ static void iscsi_target_do_login_rx(struct work_struct *work)
+ 	flush_signals(current);
+ 	conn->login_kworker = NULL;
+ 
+-	if (rc < 0) {
+-		iscsi_target_restore_sock_callbacks(conn);
+-		iscsi_target_login_drop(conn, login);
+-		iscsit_deaccess_np(np, tpg, tpg_np);
+-		return;
+-	}
++	if (rc < 0)
++		goto err;
+ 
+ 	pr_debug("iscsi_target_do_login_rx after rx_login_io, %p, %s:%d\n",
+ 			conn, current->comm, current->pid);
+ 
+ 	rc = iscsi_target_do_login(conn, login);
+ 	if (rc < 0) {
+-		iscsi_target_restore_sock_callbacks(conn);
+-		iscsi_target_login_drop(conn, login);
+-		iscsit_deaccess_np(np, tpg, tpg_np);
++		goto err;
+ 	} else if (!rc) {
+-		if (conn->sock) {
+-			struct sock *sk = conn->sock->sk;
+-
+-			write_lock_bh(&sk->sk_callback_lock);
+-			clear_bit(LOGIN_FLAGS_READ_ACTIVE, &conn->login_flags);
+-			write_unlock_bh(&sk->sk_callback_lock);
+-		}
++		if (iscsi_target_sk_check_and_clear(conn, LOGIN_FLAGS_READ_ACTIVE))
++			goto err;
+ 	} else if (rc == 1) {
+ 		iscsi_target_nego_release(conn);
+ 		iscsi_post_login_handler(np, conn, zero_tsih);
+ 		iscsit_deaccess_np(np, tpg, tpg_np);
+ 	}
++	return;
++
++err:
++	iscsi_target_restore_sock_callbacks(conn);
++	iscsi_target_login_drop(conn, login);
++	iscsit_deaccess_np(np, tpg, tpg_np);
+ }
+ 
+ static void iscsi_target_do_cleanup(struct work_struct *work)
+@@ -656,31 +697,54 @@ static void iscsi_target_sk_state_change(struct sock *sk)
+ 		orig_state_change(sk);
+ 		return;
+ 	}
++	state = __iscsi_target_sk_check_close(sk);
++	pr_debug("__iscsi_target_sk_close_change: state: %d\n", state);
++
+ 	if (test_bit(LOGIN_FLAGS_READ_ACTIVE, &conn->login_flags)) {
+ 		pr_debug("Got LOGIN_FLAGS_READ_ACTIVE=1 sk_state_change"
+ 			 " conn: %p\n", conn);
++		if (state)
++			set_bit(LOGIN_FLAGS_CLOSED, &conn->login_flags);
+ 		write_unlock_bh(&sk->sk_callback_lock);
+ 		orig_state_change(sk);
+ 		return;
+ 	}
+-	if (test_and_set_bit(LOGIN_FLAGS_CLOSED, &conn->login_flags)) {
++	if (test_bit(LOGIN_FLAGS_CLOSED, &conn->login_flags)) {
+ 		pr_debug("Got LOGIN_FLAGS_CLOSED=1 sk_state_change conn: %p\n",
+ 			 conn);
+ 		write_unlock_bh(&sk->sk_callback_lock);
+ 		orig_state_change(sk);
+ 		return;
+ 	}
++	/*
++	 * If the TCP connection has dropped, go ahead and set LOGIN_FLAGS_CLOSED,
++	 * but only queue conn->login_work -> iscsi_target_do_login_rx()
++	 * processing if LOGIN_FLAGS_INITIAL_PDU has already been cleared.
++	 *
++	 * When iscsi_target_do_login_rx() runs, iscsi_target_sk_check_close()
++	 * will detect the dropped TCP connection from delayed workqueue context.
++	 *
++	 * If LOGIN_FLAGS_INITIAL_PDU is still set, which means the initial
++	 * iscsi_target_start_negotiation() is running, iscsi_target_do_login()
++	 * via iscsi_target_sk_check_close() or iscsi_target_start_negotiation()
++	 * via iscsi_target_sk_check_and_clear() is responsible for detecting the
++	 * dropped TCP connection in iscsi_np process context, and cleaning up
++	 * the remaining iscsi connection resources.
++	 */
++	if (state) {
++		pr_debug("iscsi_target_sk_state_change got failed state\n");
++		set_bit(LOGIN_FLAGS_CLOSED, &conn->login_flags);
++		state = test_bit(LOGIN_FLAGS_INITIAL_PDU, &conn->login_flags);
++		write_unlock_bh(&sk->sk_callback_lock);
+ 
+-	state = iscsi_target_sk_state_check(sk);
+-	write_unlock_bh(&sk->sk_callback_lock);
+-
+-	pr_debug("iscsi_target_sk_state_change: state: %d\n", state);
++		orig_state_change(sk);
+ 
+-	if (!state) {
+-		pr_debug("iscsi_target_sk_state_change got failed state\n");
+-		schedule_delayed_work(&conn->login_cleanup_work, 0);
++		if (!state)
++			schedule_delayed_work(&conn->login_work, 0);
+ 		return;
+ 	}
++	write_unlock_bh(&sk->sk_callback_lock);
++
+ 	orig_state_change(sk);
+ }
+ 
+@@ -945,6 +1009,15 @@ static int iscsi_target_do_login(struct iscsi_conn *conn, struct iscsi_login *lo
+ 			if (iscsi_target_handle_csg_one(conn, login) < 0)
+ 				return -1;
+ 			if (login_rsp->flags & ISCSI_FLAG_LOGIN_TRANSIT) {
++				/*
++				 * Check to make sure the TCP connection has not
++				 * dropped asynchronously while session reinstatement
++				 * was occuring in this kthread context, before
++				 * transitioning to full feature phase operation.
++				 */
++				if (iscsi_target_sk_check_close(conn))
++					return -1;
++
+ 				login->tsih = conn->sess->tsih;
+ 				login->login_complete = 1;
+ 				iscsi_target_restore_sock_callbacks(conn);
+@@ -971,21 +1044,6 @@ static int iscsi_target_do_login(struct iscsi_conn *conn, struct iscsi_login *lo
+ 		break;
+ 	}
+ 
+-	if (conn->sock) {
+-		struct sock *sk = conn->sock->sk;
+-		bool state;
+-
+-		read_lock_bh(&sk->sk_callback_lock);
+-		state = iscsi_target_sk_state_check(sk);
+-		read_unlock_bh(&sk->sk_callback_lock);
+-
+-		if (!state) {
+-			pr_debug("iscsi_target_do_login() failed state for"
+-				 " conn: %p\n", conn);
+-			return -1;
+-		}
+-	}
+-
+ 	return 0;
+ }
+ 
+@@ -1252,13 +1310,25 @@ int iscsi_target_start_negotiation(
+        if (conn->sock) {
+                struct sock *sk = conn->sock->sk;
+ 
+-               write_lock_bh(&sk->sk_callback_lock);
+-               set_bit(LOGIN_FLAGS_READY, &conn->login_flags);
+-               write_unlock_bh(&sk->sk_callback_lock);
+-       }
++		write_lock_bh(&sk->sk_callback_lock);
++		set_bit(LOGIN_FLAGS_READY, &conn->login_flags);
++		set_bit(LOGIN_FLAGS_INITIAL_PDU, &conn->login_flags);
++		write_unlock_bh(&sk->sk_callback_lock);
++	}
++	/*
++	 * If iscsi_target_do_login returns zero to signal more PDU
++	 * exchanges are required to complete the login, go ahead and
++	 * clear LOGIN_FLAGS_INITIAL_PDU but only if the TCP connection
++	 * is still active.
++	 *
++	 * Otherwise if TCP connection dropped asynchronously, go ahead
++	 * and perform connection cleanup now.
++	 */
++	ret = iscsi_target_do_login(conn, login);
++	if (!ret && iscsi_target_sk_check_and_clear(conn, LOGIN_FLAGS_INITIAL_PDU))
++		ret = -1;
+ 
+-       ret = iscsi_target_do_login(conn, login);
+-       if (ret < 0) {
++	if (ret < 0) {
+ 		cancel_delayed_work_sync(&conn->login_work);
+ 		cancel_delayed_work_sync(&conn->login_cleanup_work);
+ 		iscsi_target_restore_sock_callbacks(conn);
+diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
+index 14a37ff0b9e3..705bb5f5a87f 100644
+--- a/fs/btrfs/extent-tree.c
++++ b/fs/btrfs/extent-tree.c
+@@ -4759,10 +4759,6 @@ static void shrink_delalloc(struct btrfs_root *root, u64 to_reclaim, u64 orig,
+ 		else
+ 			flush = BTRFS_RESERVE_NO_FLUSH;
+ 		spin_lock(&space_info->lock);
+-		if (can_overcommit(root, space_info, orig, flush)) {
+-			spin_unlock(&space_info->lock);
+-			break;
+-		}
+ 		if (list_empty(&space_info->tickets) &&
+ 		    list_empty(&space_info->priority_tickets)) {
+ 			spin_unlock(&space_info->lock);
+diff --git a/fs/ext4/file.c b/fs/ext4/file.c
+index 9e77c089e8cb..d17d12ed6f73 100644
+--- a/fs/ext4/file.c
++++ b/fs/ext4/file.c
+@@ -469,6 +469,8 @@ static int ext4_find_unwritten_pgoff(struct inode *inode,
+ 				lastoff = page_offset(page);
+ 				bh = head = page_buffers(page);
+ 				do {
++					if (lastoff + bh->b_size <= startoff)
++						goto next;
+ 					if (buffer_uptodate(bh) ||
+ 					    buffer_unwritten(bh)) {
+ 						if (whence == SEEK_DATA)
+@@ -483,6 +485,7 @@ static int ext4_find_unwritten_pgoff(struct inode *inode,
+ 						unlock_page(page);
+ 						goto out;
+ 					}
++next:
+ 					lastoff += bh->b_size;
+ 					bh = bh->b_this_page;
+ 				} while (bh != head);
+diff --git a/fs/ext4/resize.c b/fs/ext4/resize.c
+index cf681004b196..95bf46654153 100644
+--- a/fs/ext4/resize.c
++++ b/fs/ext4/resize.c
+@@ -1926,7 +1926,8 @@ int ext4_resize_fs(struct super_block *sb, ext4_fsblk_t n_blocks_count)
+ 			n_desc_blocks = o_desc_blocks +
+ 				le16_to_cpu(es->s_reserved_gdt_blocks);
+ 			n_group = n_desc_blocks * EXT4_DESC_PER_BLOCK(sb);
+-			n_blocks_count = n_group * EXT4_BLOCKS_PER_GROUP(sb);
++			n_blocks_count = (ext4_fsblk_t)n_group *
++				EXT4_BLOCKS_PER_GROUP(sb);
+ 			n_group--; /* set to last group number */
+ 		}
+ 
+diff --git a/fs/f2fs/super.c b/fs/f2fs/super.c
+index 7e0c002c12e9..eb20b8767f3c 100644
+--- a/fs/f2fs/super.c
++++ b/fs/f2fs/super.c
+@@ -1424,6 +1424,8 @@ int sanity_check_ckpt(struct f2fs_sb_info *sbi)
+ 	unsigned int total, fsmeta;
+ 	struct f2fs_super_block *raw_super = F2FS_RAW_SUPER(sbi);
+ 	struct f2fs_checkpoint *ckpt = F2FS_CKPT(sbi);
++	unsigned int main_segs, blocks_per_seg;
++	int i;
+ 
+ 	total = le32_to_cpu(raw_super->segment_count);
+ 	fsmeta = le32_to_cpu(raw_super->segment_count_ckpt);
+@@ -1435,6 +1437,20 @@ int sanity_check_ckpt(struct f2fs_sb_info *sbi)
+ 	if (unlikely(fsmeta >= total))
+ 		return 1;
+ 
++	main_segs = le32_to_cpu(raw_super->segment_count_main);
++	blocks_per_seg = sbi->blocks_per_seg;
++
++	for (i = 0; i < NR_CURSEG_NODE_TYPE; i++) {
++		if (le32_to_cpu(ckpt->cur_node_segno[i]) >= main_segs ||
++			le16_to_cpu(ckpt->cur_node_blkoff[i]) >= blocks_per_seg)
++			return 1;
++	}
++	for (i = 0; i < NR_CURSEG_DATA_TYPE; i++) {
++		if (le32_to_cpu(ckpt->cur_data_segno[i]) >= main_segs ||
++			le16_to_cpu(ckpt->cur_data_blkoff[i]) >= blocks_per_seg)
++			return 1;
++	}
++
+ 	if (unlikely(f2fs_cp_error(sbi))) {
+ 		f2fs_msg(sbi->sb, KERN_ERR, "A bug case: need to run fsck");
+ 		return 1;
+diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
+index 46ca7881d80d..a53b8e0c896a 100644
+--- a/fs/nfs/nfs4proc.c
++++ b/fs/nfs/nfs4proc.c
+@@ -7410,7 +7410,7 @@ static void nfs4_exchange_id_done(struct rpc_task *task, void *data)
+ 			cdata->res.server_scope = NULL;
+ 		}
+ 		/* Save the EXCHANGE_ID verifier session trunk tests */
+-		memcpy(clp->cl_confirm.data, cdata->args.verifier->data,
++		memcpy(clp->cl_confirm.data, cdata->args.verifier.data,
+ 		       sizeof(clp->cl_confirm.data));
+ 	}
+ out:
+@@ -7447,7 +7447,6 @@ static const struct rpc_call_ops nfs4_exchange_id_call_ops = {
+ static int _nfs4_proc_exchange_id(struct nfs_client *clp, struct rpc_cred *cred,
+ 			u32 sp4_how, struct rpc_xprt *xprt)
+ {
+-	nfs4_verifier verifier;
+ 	struct rpc_message msg = {
+ 		.rpc_proc = &nfs4_procedures[NFSPROC4_CLNT_EXCHANGE_ID],
+ 		.rpc_cred = cred,
+@@ -7470,8 +7469,7 @@ static int _nfs4_proc_exchange_id(struct nfs_client *clp, struct rpc_cred *cred,
+ 	if (!calldata)
+ 		goto out;
+ 
+-	if (!xprt)
+-		nfs4_init_boot_verifier(clp, &verifier);
++	nfs4_init_boot_verifier(clp, &calldata->args.verifier);
+ 
+ 	status = nfs4_init_uniform_client_string(clp);
+ 	if (status)
+@@ -7516,9 +7514,8 @@ static int _nfs4_proc_exchange_id(struct nfs_client *clp, struct rpc_cred *cred,
+ 		task_setup_data.rpc_xprt = xprt;
+ 		task_setup_data.flags =
+ 				RPC_TASK_SOFT|RPC_TASK_SOFTCONN|RPC_TASK_ASYNC;
+-		calldata->args.verifier = &clp->cl_confirm;
+-	} else {
+-		calldata->args.verifier = &verifier;
++		memcpy(calldata->args.verifier.data, clp->cl_confirm.data,
++				sizeof(calldata->args.verifier.data));
+ 	}
+ 	calldata->args.client = clp;
+ #ifdef CONFIG_NFS_V4_1_MIGRATION
+diff --git a/fs/nfs/nfs4xdr.c b/fs/nfs/nfs4xdr.c
+index c9c4d9855976..5e2724a928ed 100644
+--- a/fs/nfs/nfs4xdr.c
++++ b/fs/nfs/nfs4xdr.c
+@@ -1761,7 +1761,7 @@ static void encode_exchange_id(struct xdr_stream *xdr,
+ 	int len = 0;
+ 
+ 	encode_op_hdr(xdr, OP_EXCHANGE_ID, decode_exchange_id_maxsz, hdr);
+-	encode_nfs4_verifier(xdr, args->verifier);
++	encode_nfs4_verifier(xdr, &args->verifier);
+ 
+ 	encode_string(xdr, strlen(args->client->cl_owner_id),
+ 			args->client->cl_owner_id);
+diff --git a/include/linux/cpuset.h b/include/linux/cpuset.h
+index bfc204e70338..cd32a49ae81e 100644
+--- a/include/linux/cpuset.h
++++ b/include/linux/cpuset.h
+@@ -16,6 +16,19 @@
+ 
+ #ifdef CONFIG_CPUSETS
+ 
++/*
++ * Static branch rewrites can happen in an arbitrary order for a given
++ * key. In code paths where we need to loop with read_mems_allowed_begin() and
++ * read_mems_allowed_retry() to get a consistent view of mems_allowed, we need
++ * to ensure that begin() always gets rewritten before retry() in the
++ * disabled -> enabled transition. If not, then if local irqs are disabled
++ * around the loop, we can deadlock since retry() would always be
++ * comparing the latest value of the mems_allowed seqcount against 0 as
++ * begin() still would see cpusets_enabled() as false. The enabled -> disabled
++ * transition should happen in reverse order for the same reasons (want to stop
++ * looking at real value of mems_allowed.sequence in retry() first).
++ */
++extern struct static_key_false cpusets_pre_enable_key;
+ extern struct static_key_false cpusets_enabled_key;
+ static inline bool cpusets_enabled(void)
+ {
+@@ -30,12 +43,14 @@ static inline int nr_cpusets(void)
+ 
+ static inline void cpuset_inc(void)
+ {
++	static_branch_inc(&cpusets_pre_enable_key);
+ 	static_branch_inc(&cpusets_enabled_key);
+ }
+ 
+ static inline void cpuset_dec(void)
+ {
+ 	static_branch_dec(&cpusets_enabled_key);
++	static_branch_dec(&cpusets_pre_enable_key);
+ }
+ 
+ extern int cpuset_init(void);
+@@ -113,7 +128,7 @@ extern void cpuset_print_current_mems_allowed(void);
+  */
+ static inline unsigned int read_mems_allowed_begin(void)
+ {
+-	if (!cpusets_enabled())
++	if (!static_branch_unlikely(&cpusets_pre_enable_key))
+ 		return 0;
+ 
+ 	return read_seqcount_begin(&current->mems_allowed_seq);
+@@ -127,7 +142,7 @@ static inline unsigned int read_mems_allowed_begin(void)
+  */
+ static inline bool read_mems_allowed_retry(unsigned int seq)
+ {
+-	if (!cpusets_enabled())
++	if (!static_branch_unlikely(&cpusets_enabled_key))
+ 		return false;
+ 
+ 	return read_seqcount_retry(&current->mems_allowed_seq, seq);
+diff --git a/include/linux/mm_types.h b/include/linux/mm_types.h
+index 08d947fc4c59..e8471c2ca83a 100644
+--- a/include/linux/mm_types.h
++++ b/include/linux/mm_types.h
+@@ -507,6 +507,10 @@ struct mm_struct {
+ 	 * PROT_NONE or PROT_NUMA mapped page.
+ 	 */
+ 	bool tlb_flush_pending;
++#endif
++#ifdef CONFIG_ARCH_WANT_BATCHED_UNMAP_TLB_FLUSH
++	/* See flush_tlb_batched_pending() */
++	bool tlb_flush_batched;
+ #endif
+ 	struct uprobes_state uprobes_state;
+ #ifdef CONFIG_X86_INTEL_MPX
+diff --git a/include/linux/nfs_xdr.h b/include/linux/nfs_xdr.h
+index beb1e10f446e..3bf867a0c3b3 100644
+--- a/include/linux/nfs_xdr.h
++++ b/include/linux/nfs_xdr.h
+@@ -1199,7 +1199,7 @@ struct nfs41_state_protection {
+ 
+ struct nfs41_exchange_id_args {
+ 	struct nfs_client		*client;
+-	nfs4_verifier			*verifier;
++	nfs4_verifier			verifier;
+ 	u32				flags;
+ 	struct nfs41_state_protection	state_protect;
+ };
+diff --git a/include/linux/property.h b/include/linux/property.h
+index 856e50b2140c..338f9b76914b 100644
+--- a/include/linux/property.h
++++ b/include/linux/property.h
+@@ -33,6 +33,8 @@ enum dev_dma_attr {
+ 	DEV_DMA_COHERENT,
+ };
+ 
++struct fwnode_handle *dev_fwnode(struct device *dev);
++
+ bool device_property_present(struct device *dev, const char *propname);
+ int device_property_read_u8_array(struct device *dev, const char *propname,
+ 				  u8 *val, size_t nval);
+diff --git a/include/linux/sched.h b/include/linux/sched.h
+index f425eb3318ab..14f58cf06054 100644
+--- a/include/linux/sched.h
++++ b/include/linux/sched.h
+@@ -830,6 +830,16 @@ struct signal_struct {
+ 
+ #define SIGNAL_UNKILLABLE	0x00000040 /* for init: ignore fatal signals */
+ 
++#define SIGNAL_STOP_MASK (SIGNAL_CLD_MASK | SIGNAL_STOP_STOPPED | \
++			  SIGNAL_STOP_CONTINUED)
++
++static inline void signal_set_stop_flags(struct signal_struct *sig,
++					 unsigned int flags)
++{
++	WARN_ON(sig->flags & (SIGNAL_GROUP_EXIT|SIGNAL_GROUP_COREDUMP));
++	sig->flags = (sig->flags & ~SIGNAL_STOP_MASK) | flags;
++}
++
+ /* If true, all threads except ->group_exit_task have pending SIGKILL */
+ static inline int signal_group_exit(const struct signal_struct *sig)
+ {
+diff --git a/include/linux/slab.h b/include/linux/slab.h
+index 084b12bad198..4c5363566815 100644
+--- a/include/linux/slab.h
++++ b/include/linux/slab.h
+@@ -226,7 +226,7 @@ static inline const char *__check_heap_object(const void *ptr,
+  * (PAGE_SIZE*2).  Larger requests are passed to the page allocator.
+  */
+ #define KMALLOC_SHIFT_HIGH	(PAGE_SHIFT + 1)
+-#define KMALLOC_SHIFT_MAX	(MAX_ORDER + PAGE_SHIFT)
++#define KMALLOC_SHIFT_MAX	(MAX_ORDER + PAGE_SHIFT - 1)
+ #ifndef KMALLOC_SHIFT_LOW
+ #define KMALLOC_SHIFT_LOW	3
+ #endif
+@@ -239,7 +239,7 @@ static inline const char *__check_heap_object(const void *ptr,
+  * be allocated from the same page.
+  */
+ #define KMALLOC_SHIFT_HIGH	PAGE_SHIFT
+-#define KMALLOC_SHIFT_MAX	30
++#define KMALLOC_SHIFT_MAX	(MAX_ORDER + PAGE_SHIFT - 1)
+ #ifndef KMALLOC_SHIFT_LOW
+ #define KMALLOC_SHIFT_LOW	3
+ #endif
+diff --git a/include/linux/workqueue.h b/include/linux/workqueue.h
+index fc6e22186405..733a21ef8da4 100644
+--- a/include/linux/workqueue.h
++++ b/include/linux/workqueue.h
+@@ -311,6 +311,7 @@ enum {
+ 
+ 	__WQ_DRAINING		= 1 << 16, /* internal: workqueue is draining */
+ 	__WQ_ORDERED		= 1 << 17, /* internal: workqueue is ordered */
++	__WQ_ORDERED_EXPLICIT	= 1 << 18, /* internal: alloc_ordered_workqueue() */
+ 	__WQ_LEGACY		= 1 << 18, /* internal: create*_workqueue() */
+ 
+ 	WQ_MAX_ACTIVE		= 512,	  /* I like 512, better ideas? */
+@@ -409,7 +410,8 @@ __alloc_workqueue_key(const char *fmt, unsigned int flags, int max_active,
+  * Pointer to the allocated workqueue on success, %NULL on failure.
+  */
+ #define alloc_ordered_workqueue(fmt, flags, args...)			\
+-	alloc_workqueue(fmt, WQ_UNBOUND | __WQ_ORDERED | (flags), 1, ##args)
++	alloc_workqueue(fmt, WQ_UNBOUND | __WQ_ORDERED |		\
++			__WQ_ORDERED_EXPLICIT | (flags), 1, ##args)
+ 
+ #define create_workqueue(name)						\
+ 	alloc_workqueue("%s", __WQ_LEGACY | WQ_MEM_RECLAIM, 1, (name))
+diff --git a/include/net/iw_handler.h b/include/net/iw_handler.h
+index e0f4109e64c6..c2aa73e5e6bb 100644
+--- a/include/net/iw_handler.h
++++ b/include/net/iw_handler.h
+@@ -556,7 +556,8 @@ iwe_stream_add_point(struct iw_request_info *info, char *stream, char *ends,
+ 		memcpy(stream + lcp_len,
+ 		       ((char *) &iwe->u) + IW_EV_POINT_OFF,
+ 		       IW_EV_POINT_PK_LEN - IW_EV_LCP_PK_LEN);
+-		memcpy(stream + point_len, extra, iwe->u.data.length);
++		if (iwe->u.data.length && extra)
++			memcpy(stream + point_len, extra, iwe->u.data.length);
+ 		stream += event_len;
+ 	}
+ 	return stream;
+diff --git a/include/net/sctp/sctp.h b/include/net/sctp/sctp.h
+index 31acc3f4f132..61d9ce89d10d 100644
+--- a/include/net/sctp/sctp.h
++++ b/include/net/sctp/sctp.h
+@@ -460,6 +460,8 @@ _sctp_walk_params((pos), (chunk), ntohs((chunk)->chunk_hdr.length), member)
+ 
+ #define _sctp_walk_params(pos, chunk, end, member)\
+ for (pos.v = chunk->member;\
++     (pos.v + offsetof(struct sctp_paramhdr, length) + sizeof(pos.p->length) <=\
++      (void *)chunk + end) &&\
+      pos.v <= (void *)chunk + end - ntohs(pos.p->length) &&\
+      ntohs(pos.p->length) >= sizeof(sctp_paramhdr_t);\
+      pos.v += SCTP_PAD4(ntohs(pos.p->length)))
+@@ -470,6 +472,8 @@ _sctp_walk_errors((err), (chunk_hdr), ntohs((chunk_hdr)->length))
+ #define _sctp_walk_errors(err, chunk_hdr, end)\
+ for (err = (sctp_errhdr_t *)((void *)chunk_hdr + \
+ 	    sizeof(sctp_chunkhdr_t));\
++     ((void *)err + offsetof(sctp_errhdr_t, length) + sizeof(err->length) <=\
++      (void *)chunk_hdr + end) &&\
+      (void *)err <= (void *)chunk_hdr + end - ntohs(err->length) &&\
+      ntohs(err->length) >= sizeof(sctp_errhdr_t); \
+      err = (sctp_errhdr_t *)((void *)err + SCTP_PAD4(ntohs(err->length))))
+diff --git a/include/target/iscsi/iscsi_target_core.h b/include/target/iscsi/iscsi_target_core.h
+index 33b2e75bf2eb..c8132b419148 100644
+--- a/include/target/iscsi/iscsi_target_core.h
++++ b/include/target/iscsi/iscsi_target_core.h
+@@ -563,6 +563,7 @@ struct iscsi_conn {
+ #define LOGIN_FLAGS_READ_ACTIVE		1
+ #define LOGIN_FLAGS_CLOSED		2
+ #define LOGIN_FLAGS_READY		4
++#define LOGIN_FLAGS_INITIAL_PDU		8
+ 	unsigned long		login_flags;
+ 	struct delayed_work	login_work;
+ 	struct delayed_work	login_cleanup_work;
+diff --git a/kernel/cgroup.c b/kernel/cgroup.c
+index 1fde8eec9529..4c233437ee1a 100644
+--- a/kernel/cgroup.c
++++ b/kernel/cgroup.c
+@@ -3487,11 +3487,11 @@ static ssize_t cgroup_subtree_control_write(struct kernfs_open_file *of,
+ 	cgrp->subtree_control &= ~disable;
+ 
+ 	ret = cgroup_apply_control(cgrp);
+-
+ 	cgroup_finalize_control(cgrp, ret);
++	if (ret)
++		goto out_unlock;
+ 
+ 	kernfs_activate(cgrp->kn);
+-	ret = 0;
+ out_unlock:
+ 	cgroup_kn_unlock(of->kn);
+ 	return ret ?: nbytes;
+@@ -5718,6 +5718,10 @@ int __init cgroup_init(void)
+ 
+ 		if (ss->bind)
+ 			ss->bind(init_css_set.subsys[ssid]);
++
++		mutex_lock(&cgroup_mutex);
++		css_populate_dir(init_css_set.subsys[ssid]);
++		mutex_unlock(&cgroup_mutex);
+ 	}
+ 
+ 	/* init_css_set.subsys[] has been updated, re-hash */
+diff --git a/kernel/cpuset.c b/kernel/cpuset.c
+index 24d175d2b62d..247afb108343 100644
+--- a/kernel/cpuset.c
++++ b/kernel/cpuset.c
+@@ -61,6 +61,7 @@
+ #include <linux/cgroup.h>
+ #include <linux/wait.h>
+ 
++DEFINE_STATIC_KEY_FALSE(cpusets_pre_enable_key);
+ DEFINE_STATIC_KEY_FALSE(cpusets_enabled_key);
+ 
+ /* See "Frequency meter" comments, below. */
+diff --git a/kernel/signal.c b/kernel/signal.c
+index deb04d5983ed..e48668c3c972 100644
+--- a/kernel/signal.c
++++ b/kernel/signal.c
+@@ -346,7 +346,7 @@ static bool task_participate_group_stop(struct task_struct *task)
+ 	 * fresh group stop.  Read comment in do_signal_stop() for details.
+ 	 */
+ 	if (!sig->group_stop_count && !(sig->flags & SIGNAL_STOP_STOPPED)) {
+-		sig->flags = SIGNAL_STOP_STOPPED;
++		signal_set_stop_flags(sig, SIGNAL_STOP_STOPPED);
+ 		return true;
+ 	}
+ 	return false;
+@@ -845,7 +845,7 @@ static bool prepare_signal(int sig, struct task_struct *p, bool force)
+ 			 * will take ->siglock, notice SIGNAL_CLD_MASK, and
+ 			 * notify its parent. See get_signal_to_deliver().
+ 			 */
+-			signal->flags = why | SIGNAL_STOP_CONTINUED;
++			signal_set_stop_flags(signal, why | SIGNAL_STOP_CONTINUED);
+ 			signal->group_stop_count = 0;
+ 			signal->group_exit_code = 0;
+ 		}
+diff --git a/kernel/time/timer.c b/kernel/time/timer.c
+index c611c47de884..944ad64277a6 100644
+--- a/kernel/time/timer.c
++++ b/kernel/time/timer.c
+@@ -1536,7 +1536,7 @@ u64 get_next_timer_interrupt(unsigned long basej, u64 basem)
+ 		base->is_idle = false;
+ 	} else {
+ 		if (!is_max_delta)
+-			expires = basem + (nextevt - basej) * TICK_NSEC;
++			expires = basem + (u64)(nextevt - basej) * TICK_NSEC;
+ 		/*
+ 		 * If we expect to sleep more than a tick, mark the base idle:
+ 		 */
+diff --git a/kernel/workqueue.c b/kernel/workqueue.c
+index 479d840db286..776dda02e751 100644
+--- a/kernel/workqueue.c
++++ b/kernel/workqueue.c
+@@ -3730,8 +3730,12 @@ static int apply_workqueue_attrs_locked(struct workqueue_struct *wq,
+ 		return -EINVAL;
+ 
+ 	/* creating multiple pwqs breaks ordering guarantee */
+-	if (WARN_ON((wq->flags & __WQ_ORDERED) && !list_empty(&wq->pwqs)))
+-		return -EINVAL;
++	if (!list_empty(&wq->pwqs)) {
++		if (WARN_ON(wq->flags & __WQ_ORDERED_EXPLICIT))
++			return -EINVAL;
++
++		wq->flags &= ~__WQ_ORDERED;
++	}
+ 
+ 	ctx = apply_wqattrs_prepare(wq, attrs);
+ 	if (!ctx)
+@@ -3915,6 +3919,16 @@ struct workqueue_struct *__alloc_workqueue_key(const char *fmt,
+ 	struct workqueue_struct *wq;
+ 	struct pool_workqueue *pwq;
+ 
++	/*
++	 * Unbound && max_active == 1 used to imply ordered, which is no
++	 * longer the case on NUMA machines due to per-node pools.  While
++	 * alloc_ordered_workqueue() is the right way to create an ordered
++	 * workqueue, keep the previous behavior to avoid subtle breakages
++	 * on NUMA.
++	 */
++	if ((flags & WQ_UNBOUND) && max_active == 1)
++		flags |= __WQ_ORDERED;
++
+ 	/* see the comment above the definition of WQ_POWER_EFFICIENT */
+ 	if ((flags & WQ_POWER_EFFICIENT) && wq_power_efficient)
+ 		flags |= WQ_UNBOUND;
+@@ -4103,13 +4117,14 @@ void workqueue_set_max_active(struct workqueue_struct *wq, int max_active)
+ 	struct pool_workqueue *pwq;
+ 
+ 	/* disallow meddling with max_active for ordered workqueues */
+-	if (WARN_ON(wq->flags & __WQ_ORDERED))
++	if (WARN_ON(wq->flags & __WQ_ORDERED_EXPLICIT))
+ 		return;
+ 
+ 	max_active = wq_clamp_max_active(max_active, wq->flags, wq->name);
+ 
+ 	mutex_lock(&wq->mutex);
+ 
++	wq->flags &= ~__WQ_ORDERED;
+ 	wq->saved_max_active = max_active;
+ 
+ 	for_each_pwq(pwq, wq)
+@@ -5214,7 +5229,7 @@ int workqueue_sysfs_register(struct workqueue_struct *wq)
+ 	 * attributes breaks ordering guarantee.  Disallow exposing ordered
+ 	 * workqueues.
+ 	 */
+-	if (WARN_ON(wq->flags & __WQ_ORDERED))
++	if (WARN_ON(wq->flags & __WQ_ORDERED_EXPLICIT))
+ 		return -EINVAL;
+ 
+ 	wq->wq_dev = wq_dev = kzalloc(sizeof(*wq_dev), GFP_KERNEL);
+diff --git a/lib/Kconfig.debug b/lib/Kconfig.debug
+index a6c8db1d62f6..f60e67217f18 100644
+--- a/lib/Kconfig.debug
++++ b/lib/Kconfig.debug
+@@ -145,7 +145,7 @@ config DEBUG_INFO_REDUCED
+ 
+ config DEBUG_INFO_SPLIT
+ 	bool "Produce split debuginfo in .dwo files"
+-	depends on DEBUG_INFO
++	depends on DEBUG_INFO && !FRV
+ 	help
+ 	  Generate debug info into separate .dwo files. This significantly
+ 	  reduces the build directory size for builds with DEBUG_INFO,
+diff --git a/mm/internal.h b/mm/internal.h
+index 537ac9951f5f..34a5459e5989 100644
+--- a/mm/internal.h
++++ b/mm/internal.h
+@@ -472,6 +472,7 @@ struct tlbflush_unmap_batch;
+ #ifdef CONFIG_ARCH_WANT_BATCHED_UNMAP_TLB_FLUSH
+ void try_to_unmap_flush(void);
+ void try_to_unmap_flush_dirty(void);
++void flush_tlb_batched_pending(struct mm_struct *mm);
+ #else
+ static inline void try_to_unmap_flush(void)
+ {
+@@ -479,7 +480,9 @@ static inline void try_to_unmap_flush(void)
+ static inline void try_to_unmap_flush_dirty(void)
+ {
+ }
+-
++static inline void flush_tlb_batched_pending(struct mm_struct *mm)
++{
++}
+ #endif /* CONFIG_ARCH_WANT_BATCHED_UNMAP_TLB_FLUSH */
+ 
+ extern const struct trace_print_flags pageflag_names[];
+diff --git a/mm/madvise.c b/mm/madvise.c
+index 93fb63e88b5e..253b1533fba5 100644
+--- a/mm/madvise.c
++++ b/mm/madvise.c
+@@ -21,6 +21,7 @@
+ #include <linux/swap.h>
+ #include <linux/swapops.h>
+ #include <linux/mmu_notifier.h>
++#include "internal.h"
+ 
+ #include <asm/tlb.h>
+ 
+@@ -282,6 +283,7 @@ static int madvise_free_pte_range(pmd_t *pmd, unsigned long addr,
+ 		return 0;
+ 
+ 	orig_pte = pte = pte_offset_map_lock(mm, pmd, addr, &ptl);
++	flush_tlb_batched_pending(mm);
+ 	arch_enter_lazy_mmu_mode();
+ 	for (; addr != end; pte++, addr += PAGE_SIZE) {
+ 		ptent = *pte;
+diff --git a/mm/memory.c b/mm/memory.c
+index e6a5a1f20492..9bf3da0d0e14 100644
+--- a/mm/memory.c
++++ b/mm/memory.c
+@@ -1124,6 +1124,7 @@ static unsigned long zap_pte_range(struct mmu_gather *tlb,
+ 	init_rss_vec(rss);
+ 	start_pte = pte_offset_map_lock(mm, pmd, addr, &ptl);
+ 	pte = start_pte;
++	flush_tlb_batched_pending(mm);
+ 	arch_enter_lazy_mmu_mode();
+ 	do {
+ 		pte_t ptent = *pte;
+diff --git a/mm/mprotect.c b/mm/mprotect.c
+index 11936526b08b..ae740c9b1f9b 100644
+--- a/mm/mprotect.c
++++ b/mm/mprotect.c
+@@ -74,6 +74,7 @@ static unsigned long change_pte_range(struct vm_area_struct *vma, pmd_t *pmd,
+ 	if (!pte)
+ 		return 0;
+ 
++	flush_tlb_batched_pending(vma->vm_mm);
+ 	arch_enter_lazy_mmu_mode();
+ 	do {
+ 		oldpte = *pte;
+diff --git a/mm/mremap.c b/mm/mremap.c
+index 30d7d2482eea..15976716dd40 100644
+--- a/mm/mremap.c
++++ b/mm/mremap.c
+@@ -142,6 +142,7 @@ static void move_ptes(struct vm_area_struct *vma, pmd_t *old_pmd,
+ 	new_ptl = pte_lockptr(mm, new_pmd);
+ 	if (new_ptl != old_ptl)
+ 		spin_lock_nested(new_ptl, SINGLE_DEPTH_NESTING);
++	flush_tlb_batched_pending(vma->vm_mm);
+ 	arch_enter_lazy_mmu_mode();
+ 
+ 	for (; old_addr < old_end; old_pte++, old_addr += PAGE_SIZE,
+diff --git a/mm/page_alloc.c b/mm/page_alloc.c
+index 56df8c24689d..77b797c2d094 100644
+--- a/mm/page_alloc.c
++++ b/mm/page_alloc.c
+@@ -1875,14 +1875,14 @@ int move_freepages(struct zone *zone,
+ #endif
+ 
+ 	for (page = start_page; page <= end_page;) {
+-		/* Make sure we are not inadvertently changing nodes */
+-		VM_BUG_ON_PAGE(page_to_nid(page) != zone_to_nid(zone), page);
+-
+ 		if (!pfn_valid_within(page_to_pfn(page))) {
+ 			page++;
+ 			continue;
+ 		}
+ 
++		/* Make sure we are not inadvertently changing nodes */
++		VM_BUG_ON_PAGE(page_to_nid(page) != zone_to_nid(zone), page);
++
+ 		if (!PageBuddy(page)) {
+ 			page++;
+ 			continue;
+@@ -6445,8 +6445,8 @@ unsigned long free_reserved_area(void *start, void *end, int poison, char *s)
+ 	}
+ 
+ 	if (pages && s)
+-		pr_info("Freeing %s memory: %ldK (%p - %p)\n",
+-			s, pages << (PAGE_SHIFT - 10), start, end);
++		pr_info("Freeing %s memory: %ldK\n",
++			s, pages << (PAGE_SHIFT - 10));
+ 
+ 	return pages;
+ }
+diff --git a/mm/rmap.c b/mm/rmap.c
+index cd37c1c7e21b..94488b0362f8 100644
+--- a/mm/rmap.c
++++ b/mm/rmap.c
+@@ -616,6 +616,13 @@ static void set_tlb_ubc_flush_pending(struct mm_struct *mm,
+ 	cpumask_or(&tlb_ubc->cpumask, &tlb_ubc->cpumask, mm_cpumask(mm));
+ 	tlb_ubc->flush_required = true;
+ 
++	/*
++	 * Ensure compiler does not re-order the setting of tlb_flush_batched
++	 * before the PTE is cleared.
++	 */
++	barrier();
++	mm->tlb_flush_batched = true;
++
+ 	/*
+ 	 * If the PTE was dirty then it's best to assume it's writable. The
+ 	 * caller must use try_to_unmap_flush_dirty() or try_to_unmap_flush()
+@@ -643,6 +650,35 @@ static bool should_defer_flush(struct mm_struct *mm, enum ttu_flags flags)
+ 
+ 	return should_defer;
+ }
++
++/*
++ * Reclaim unmaps pages under the PTL but do not flush the TLB prior to
++ * releasing the PTL if TLB flushes are batched. It's possible for a parallel
++ * operation such as mprotect or munmap to race between reclaim unmapping
++ * the page and flushing the page. If this race occurs, it potentially allows
++ * access to data via a stale TLB entry. Tracking all mm's that have TLB
++ * batching in flight would be expensive during reclaim so instead track
++ * whether TLB batching occurred in the past and if so then do a flush here
++ * if required. This will cost one additional flush per reclaim cycle paid
++ * by the first operation at risk such as mprotect and mumap.
++ *
++ * This must be called under the PTL so that an access to tlb_flush_batched
++ * that is potentially a "reclaim vs mprotect/munmap/etc" race will synchronise
++ * via the PTL.
++ */
++void flush_tlb_batched_pending(struct mm_struct *mm)
++{
++	if (mm->tlb_flush_batched) {
++		flush_tlb_mm(mm);
++
++		/*
++		 * Do not allow the compiler to re-order the clearing of
++		 * tlb_flush_batched before the tlb is flushed.
++		 */
++		barrier();
++		mm->tlb_flush_batched = false;
++	}
++}
+ #else
+ static void set_tlb_ubc_flush_pending(struct mm_struct *mm,
+ 		struct page *page, bool writable)
+diff --git a/net/core/dev_ioctl.c b/net/core/dev_ioctl.c
+index b94b1d293506..151e047ce072 100644
+--- a/net/core/dev_ioctl.c
++++ b/net/core/dev_ioctl.c
+@@ -28,6 +28,7 @@ static int dev_ifname(struct net *net, struct ifreq __user *arg)
+ 
+ 	if (copy_from_user(&ifr, arg, sizeof(struct ifreq)))
+ 		return -EFAULT;
++	ifr.ifr_name[IFNAMSIZ-1] = 0;
+ 
+ 	error = netdev_get_name(net, ifr.ifr_name, ifr.ifr_ifindex);
+ 	if (error)
+diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
+index 9c6fd7f83a4a..4d2629781e8b 100644
+--- a/net/core/rtnetlink.c
++++ b/net/core/rtnetlink.c
+@@ -1965,7 +1965,8 @@ static int do_setlink(const struct sk_buff *skb,
+ 		struct sockaddr *sa;
+ 		int len;
+ 
+-		len = sizeof(sa_family_t) + dev->addr_len;
++		len = sizeof(sa_family_t) + max_t(size_t, dev->addr_len,
++						  sizeof(*sa));
+ 		sa = kmalloc(len, GFP_KERNEL);
+ 		if (!sa) {
+ 			err = -ENOMEM;
+diff --git a/net/dccp/feat.c b/net/dccp/feat.c
+index 1704948e6a12..f227f002c73d 100644
+--- a/net/dccp/feat.c
++++ b/net/dccp/feat.c
+@@ -1471,9 +1471,12 @@ int dccp_feat_init(struct sock *sk)
+ 	 * singleton values (which always leads to failure).
+ 	 * These settings can still (later) be overridden via sockopts.
+ 	 */
+-	if (ccid_get_builtin_ccids(&tx.val, &tx.len) ||
+-	    ccid_get_builtin_ccids(&rx.val, &rx.len))
++	if (ccid_get_builtin_ccids(&tx.val, &tx.len))
+ 		return -ENOBUFS;
++	if (ccid_get_builtin_ccids(&rx.val, &rx.len)) {
++		kfree(tx.val);
++		return -ENOBUFS;
++	}
+ 
+ 	if (!dccp_feat_prefer(sysctl_dccp_tx_ccid, tx.val, tx.len) ||
+ 	    !dccp_feat_prefer(sysctl_dccp_rx_ccid, rx.val, rx.len))
+diff --git a/net/dccp/ipv4.c b/net/dccp/ipv4.c
+index 86b0933ecd45..8fc160098e11 100644
+--- a/net/dccp/ipv4.c
++++ b/net/dccp/ipv4.c
+@@ -637,6 +637,7 @@ int dccp_v4_conn_request(struct sock *sk, struct sk_buff *skb)
+ 		goto drop_and_free;
+ 
+ 	inet_csk_reqsk_queue_hash_add(sk, req, DCCP_TIMEOUT_INIT);
++	reqsk_put(req);
+ 	return 0;
+ 
+ drop_and_free:
+diff --git a/net/dccp/ipv6.c b/net/dccp/ipv6.c
+index 2ac9d2a1aaab..28e8252cc5ea 100644
+--- a/net/dccp/ipv6.c
++++ b/net/dccp/ipv6.c
+@@ -380,6 +380,7 @@ static int dccp_v6_conn_request(struct sock *sk, struct sk_buff *skb)
+ 		goto drop_and_free;
+ 
+ 	inet_csk_reqsk_queue_hash_add(sk, req, DCCP_TIMEOUT_INIT);
++	reqsk_put(req);
+ 	return 0;
+ 
+ drop_and_free:
+diff --git a/net/ipv4/fib_frontend.c b/net/ipv4/fib_frontend.c
+index 3d92534c4450..968d8e165e3d 100644
+--- a/net/ipv4/fib_frontend.c
++++ b/net/ipv4/fib_frontend.c
+@@ -1319,13 +1319,14 @@ static struct pernet_operations fib_net_ops = {
+ 
+ void __init ip_fib_init(void)
+ {
+-	rtnl_register(PF_INET, RTM_NEWROUTE, inet_rtm_newroute, NULL, NULL);
+-	rtnl_register(PF_INET, RTM_DELROUTE, inet_rtm_delroute, NULL, NULL);
+-	rtnl_register(PF_INET, RTM_GETROUTE, NULL, inet_dump_fib, NULL);
++	fib_trie_init();
+ 
+ 	register_pernet_subsys(&fib_net_ops);
++
+ 	register_netdevice_notifier(&fib_netdev_notifier);
+ 	register_inetaddr_notifier(&fib_inetaddr_notifier);
+ 
+-	fib_trie_init();
++	rtnl_register(PF_INET, RTM_NEWROUTE, inet_rtm_newroute, NULL, NULL);
++	rtnl_register(PF_INET, RTM_DELROUTE, inet_rtm_delroute, NULL, NULL);
++	rtnl_register(PF_INET, RTM_GETROUTE, NULL, inet_dump_fib, NULL);
+ }
+diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
+index e5c1dbef3626..06215ba88b93 100644
+--- a/net/ipv4/ip_output.c
++++ b/net/ipv4/ip_output.c
+@@ -936,7 +936,8 @@ static int __ip_append_data(struct sock *sk,
+ 		csummode = CHECKSUM_PARTIAL;
+ 
+ 	cork->length += length;
+-	if (((length > mtu) || (skb && skb_is_gso(skb))) &&
++	if ((((length + (skb ? skb->len : fragheaderlen)) > mtu) ||
++	     (skb && skb_is_gso(skb))) &&
+ 	    (sk->sk_protocol == IPPROTO_UDP) &&
+ 	    (rt->dst.dev->features & NETIF_F_UFO) && !rt->dst.header_len &&
+ 	    (sk->sk_type == SOCK_DGRAM) && !sk->sk_no_check_tx) {
+diff --git a/net/ipv4/netfilter/nf_reject_ipv4.c b/net/ipv4/netfilter/nf_reject_ipv4.c
+index fd8220213afc..146d86105183 100644
+--- a/net/ipv4/netfilter/nf_reject_ipv4.c
++++ b/net/ipv4/netfilter/nf_reject_ipv4.c
+@@ -126,6 +126,8 @@ void nf_send_reset(struct net *net, struct sk_buff *oldskb, int hook)
+ 	/* ip_route_me_harder expects skb->dst to be set */
+ 	skb_dst_set_noref(nskb, skb_dst(oldskb));
+ 
++	nskb->mark = IP4_REPLY_MARK(net, oldskb->mark);
++
+ 	skb_reserve(nskb, LL_MAX_HEADER);
+ 	niph = nf_reject_iphdr_put(nskb, oldskb, IPPROTO_TCP,
+ 				   ip4_dst_hoplimit(skb_dst(nskb)));
+diff --git a/net/ipv4/syncookies.c b/net/ipv4/syncookies.c
+index e3c4043c27de..b6f710d515d0 100644
+--- a/net/ipv4/syncookies.c
++++ b/net/ipv4/syncookies.c
+@@ -334,6 +334,7 @@ struct sock *cookie_v4_check(struct sock *sk, struct sk_buff *skb)
+ 	treq = tcp_rsk(req);
+ 	treq->rcv_isn		= ntohl(th->seq) - 1;
+ 	treq->snt_isn		= cookie;
++	treq->txhash		= net_tx_rndhash();
+ 	req->mss		= mss;
+ 	ireq->ir_num		= ntohs(th->dest);
+ 	ireq->ir_rmt_port	= th->source;
+diff --git a/net/ipv4/sysctl_net_ipv4.c b/net/ipv4/sysctl_net_ipv4.c
+index 80bc36b25de2..566cfc50f7cf 100644
+--- a/net/ipv4/sysctl_net_ipv4.c
++++ b/net/ipv4/sysctl_net_ipv4.c
+@@ -958,7 +958,7 @@ static struct ctl_table ipv4_net_table[] = {
+ 		.data		= &init_net.ipv4.sysctl_tcp_notsent_lowat,
+ 		.maxlen		= sizeof(unsigned int),
+ 		.mode		= 0644,
+-		.proc_handler	= proc_dointvec,
++		.proc_handler	= proc_douintvec,
+ 	},
+ #ifdef CONFIG_IP_ROUTE_MULTIPATH
+ 	{
+diff --git a/net/ipv4/tcp_bbr.c b/net/ipv4/tcp_bbr.c
+index 0ea66c2c9344..cb8db347c680 100644
+--- a/net/ipv4/tcp_bbr.c
++++ b/net/ipv4/tcp_bbr.c
+@@ -83,7 +83,8 @@ struct bbr {
+ 		cwnd_gain:10,	/* current gain for setting cwnd */
+ 		full_bw_cnt:3,	/* number of rounds without large bw gains */
+ 		cycle_idx:3,	/* current index in pacing_gain cycle array */
+-		unused_b:6;
++		has_seen_rtt:1, /* have we seen an RTT sample yet? */
++		unused_b:5;
+ 	u32	prior_cwnd;	/* prior cwnd upon entering loss recovery */
+ 	u32	full_bw;	/* recent bw, to estimate if pipe is full */
+ };
+@@ -182,6 +183,35 @@ static u64 bbr_rate_bytes_per_sec(struct sock *sk, u64 rate, int gain)
+ 	return rate >> BW_SCALE;
+ }
+ 
++/* Convert a BBR bw and gain factor to a pacing rate in bytes per second. */
++static u32 bbr_bw_to_pacing_rate(struct sock *sk, u32 bw, int gain)
++{
++	u64 rate = bw;
++
++	rate = bbr_rate_bytes_per_sec(sk, rate, gain);
++	rate = min_t(u64, rate, sk->sk_max_pacing_rate);
++	return rate;
++}
++
++/* Initialize pacing rate to: high_gain * init_cwnd / RTT. */
++static void bbr_init_pacing_rate_from_rtt(struct sock *sk)
++{
++	struct tcp_sock *tp = tcp_sk(sk);
++	struct bbr *bbr = inet_csk_ca(sk);
++	u64 bw;
++	u32 rtt_us;
++
++	if (tp->srtt_us) {		/* any RTT sample yet? */
++		rtt_us = max(tp->srtt_us >> 3, 1U);
++		bbr->has_seen_rtt = 1;
++	} else {			 /* no RTT sample yet */
++		rtt_us = USEC_PER_MSEC;	 /* use nominal default RTT */
++	}
++	bw = (u64)tp->snd_cwnd * BW_UNIT;
++	do_div(bw, rtt_us);
++	sk->sk_pacing_rate = bbr_bw_to_pacing_rate(sk, bw, bbr_high_gain);
++}
++
+ /* Pace using current bw estimate and a gain factor. In order to help drive the
+  * network toward lower queues while maintaining high utilization and low
+  * latency, the average pacing rate aims to be slightly (~1%) lower than the
+@@ -191,12 +221,13 @@ static u64 bbr_rate_bytes_per_sec(struct sock *sk, u64 rate, int gain)
+  */
+ static void bbr_set_pacing_rate(struct sock *sk, u32 bw, int gain)
+ {
++	struct tcp_sock *tp = tcp_sk(sk);
+ 	struct bbr *bbr = inet_csk_ca(sk);
+-	u64 rate = bw;
++	u32 rate = bbr_bw_to_pacing_rate(sk, bw, gain);
+ 
+-	rate = bbr_rate_bytes_per_sec(sk, rate, gain);
+-	rate = min_t(u64, rate, sk->sk_max_pacing_rate);
+-	if (bbr->mode != BBR_STARTUP || rate > sk->sk_pacing_rate)
++	if (unlikely(!bbr->has_seen_rtt && tp->srtt_us))
++		bbr_init_pacing_rate_from_rtt(sk);
++	if (bbr_full_bw_reached(sk) || rate > sk->sk_pacing_rate)
+ 		sk->sk_pacing_rate = rate;
+ }
+ 
+@@ -769,7 +800,6 @@ static void bbr_init(struct sock *sk)
+ {
+ 	struct tcp_sock *tp = tcp_sk(sk);
+ 	struct bbr *bbr = inet_csk_ca(sk);
+-	u64 bw;
+ 
+ 	bbr->prior_cwnd = 0;
+ 	bbr->tso_segs_goal = 0;	 /* default segs per skb until first ACK */
+@@ -785,11 +815,8 @@ static void bbr_init(struct sock *sk)
+ 
+ 	minmax_reset(&bbr->bw, bbr->rtt_cnt, 0);  /* init max bw to 0 */
+ 
+-	/* Initialize pacing rate to: high_gain * init_cwnd / RTT. */
+-	bw = (u64)tp->snd_cwnd * BW_UNIT;
+-	do_div(bw, (tp->srtt_us >> 3) ? : USEC_PER_MSEC);
+-	sk->sk_pacing_rate = 0;		/* force an update of sk_pacing_rate */
+-	bbr_set_pacing_rate(sk, bw, bbr_high_gain);
++	bbr->has_seen_rtt = 0;
++	bbr_init_pacing_rate_from_rtt(sk);
+ 
+ 	bbr->restore_cwnd = 0;
+ 	bbr->round_start = 0;
+diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
+index 5a4b8e7bcedd..a5cdf2a23609 100644
+--- a/net/ipv6/ip6_output.c
++++ b/net/ipv6/ip6_output.c
+@@ -662,8 +662,6 @@ int ip6_fragment(struct net *net, struct sock *sk, struct sk_buff *skb,
+ 		*prevhdr = NEXTHDR_FRAGMENT;
+ 		tmp_hdr = kmemdup(skb_network_header(skb), hlen, GFP_ATOMIC);
+ 		if (!tmp_hdr) {
+-			IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
+-				      IPSTATS_MIB_FRAGFAILS);
+ 			err = -ENOMEM;
+ 			goto fail;
+ 		}
+@@ -782,8 +780,6 @@ int ip6_fragment(struct net *net, struct sock *sk, struct sk_buff *skb,
+ 		frag = alloc_skb(len + hlen + sizeof(struct frag_hdr) +
+ 				 hroom + troom, GFP_ATOMIC);
+ 		if (!frag) {
+-			IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
+-				      IPSTATS_MIB_FRAGFAILS);
+ 			err = -ENOMEM;
+ 			goto fail;
+ 		}
+@@ -1376,7 +1372,7 @@ static int __ip6_append_data(struct sock *sk,
+ 	 */
+ 
+ 	cork->length += length;
+-	if ((((length + fragheaderlen) > mtu) ||
++	if ((((length + (skb ? skb->len : headersize)) > mtu) ||
+ 	     (skb && skb_is_gso(skb))) &&
+ 	    (sk->sk_protocol == IPPROTO_UDP) &&
+ 	    (rt->dst.dev->features & NETIF_F_UFO) && !rt->dst.header_len &&
+diff --git a/net/ipv6/netfilter/nf_reject_ipv6.c b/net/ipv6/netfilter/nf_reject_ipv6.c
+index 10090400c72f..eedee5d108d9 100644
+--- a/net/ipv6/netfilter/nf_reject_ipv6.c
++++ b/net/ipv6/netfilter/nf_reject_ipv6.c
+@@ -157,6 +157,7 @@ void nf_send_reset6(struct net *net, struct sk_buff *oldskb, int hook)
+ 	fl6.fl6_sport = otcph->dest;
+ 	fl6.fl6_dport = otcph->source;
+ 	fl6.flowi6_oif = l3mdev_master_ifindex(skb_dst(oldskb)->dev);
++	fl6.flowi6_mark = IP6_REPLY_MARK(net, oldskb->mark);
+ 	security_skb_classify_flow(oldskb, flowi6_to_flowi(&fl6));
+ 	dst = ip6_route_output(net, NULL, &fl6);
+ 	if (dst->error) {
+@@ -180,6 +181,8 @@ void nf_send_reset6(struct net *net, struct sk_buff *oldskb, int hook)
+ 
+ 	skb_dst_set(nskb, dst);
+ 
++	nskb->mark = fl6.flowi6_mark;
++
+ 	skb_reserve(nskb, hh_len + dst->header_len);
+ 	ip6h = nf_reject_ip6hdr_put(nskb, oldskb, IPPROTO_TCP,
+ 				    ip6_dst_hoplimit(dst));
+diff --git a/net/ipv6/output_core.c b/net/ipv6/output_core.c
+index e9065b8d3af8..abb2c307fbe8 100644
+--- a/net/ipv6/output_core.c
++++ b/net/ipv6/output_core.c
+@@ -78,7 +78,7 @@ EXPORT_SYMBOL(ipv6_select_ident);
+ 
+ int ip6_find_1stfragopt(struct sk_buff *skb, u8 **nexthdr)
+ {
+-	u16 offset = sizeof(struct ipv6hdr);
++	unsigned int offset = sizeof(struct ipv6hdr);
+ 	unsigned int packet_len = skb_tail_pointer(skb) -
+ 		skb_network_header(skb);
+ 	int found_rhdr = 0;
+@@ -86,6 +86,7 @@ int ip6_find_1stfragopt(struct sk_buff *skb, u8 **nexthdr)
+ 
+ 	while (offset <= packet_len) {
+ 		struct ipv6_opt_hdr *exthdr;
++		unsigned int len;
+ 
+ 		switch (**nexthdr) {
+ 
+@@ -111,7 +112,10 @@ int ip6_find_1stfragopt(struct sk_buff *skb, u8 **nexthdr)
+ 
+ 		exthdr = (struct ipv6_opt_hdr *)(skb_network_header(skb) +
+ 						 offset);
+-		offset += ipv6_optlen(exthdr);
++		len = ipv6_optlen(exthdr);
++		if (len + offset >= IPV6_MAXPLEN)
++			return -EINVAL;
++		offset += len;
+ 		*nexthdr = &exthdr->nexthdr;
+ 	}
+ 
+diff --git a/net/ipv6/syncookies.c b/net/ipv6/syncookies.c
+index 59c483937aec..7a86433d8896 100644
+--- a/net/ipv6/syncookies.c
++++ b/net/ipv6/syncookies.c
+@@ -209,6 +209,7 @@ struct sock *cookie_v6_check(struct sock *sk, struct sk_buff *skb)
+ 	treq->snt_synack.v64	= 0;
+ 	treq->rcv_isn = ntohl(th->seq) - 1;
+ 	treq->snt_isn = cookie;
++	treq->txhash = net_tx_rndhash();
+ 
+ 	/*
+ 	 * We need to lookup the dst_entry to get the correct window size.
+diff --git a/net/openvswitch/conntrack.c b/net/openvswitch/conntrack.c
+index 48386bff8b4e..b28e45b691de 100644
+--- a/net/openvswitch/conntrack.c
++++ b/net/openvswitch/conntrack.c
+@@ -1088,8 +1088,8 @@ static int parse_ct(const struct nlattr *attr, struct ovs_conntrack_info *info,
+ 
+ 	nla_for_each_nested(a, attr, rem) {
+ 		int type = nla_type(a);
+-		int maxlen = ovs_ct_attr_lens[type].maxlen;
+-		int minlen = ovs_ct_attr_lens[type].minlen;
++		int maxlen;
++		int minlen;
+ 
+ 		if (type > OVS_CT_ATTR_MAX) {
+ 			OVS_NLERR(log,
+@@ -1097,6 +1097,9 @@ static int parse_ct(const struct nlattr *attr, struct ovs_conntrack_info *info,
+ 				  type, OVS_CT_ATTR_MAX);
+ 			return -EINVAL;
+ 		}
++
++		maxlen = ovs_ct_attr_lens[type].maxlen;
++		minlen = ovs_ct_attr_lens[type].minlen;
+ 		if (nla_len(a) < minlen || nla_len(a) > maxlen) {
+ 			OVS_NLERR(log,
+ 				  "Conntrack attr type has unexpected length (type=%d, length=%d, expected=%d)",
+diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
+index 6a563e6e24de..365c83fcee02 100644
+--- a/net/packet/af_packet.c
++++ b/net/packet/af_packet.c
+@@ -4322,7 +4322,7 @@ static int packet_set_ring(struct sock *sk, union tpacket_req_u *req_u,
+ 		register_prot_hook(sk);
+ 	}
+ 	spin_unlock(&po->bind_lock);
+-	if (closing && (po->tp_version > TPACKET_V2)) {
++	if (pg_vec && (po->tp_version > TPACKET_V2)) {
+ 		/* Because we don't support block-based V3 on tx-ring */
+ 		if (!tx_ring)
+ 			prb_shutdown_retire_blk_timer(po, rb_queue);
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index bb1aad39d987..6f337f00ba58 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -2233,6 +2233,7 @@ static const struct snd_pci_quirk alc882_fixup_tbl[] = {
+ 	SND_PCI_QUIRK(0x1043, 0x8691, "ASUS ROG Ranger VIII", ALC882_FIXUP_GPIO3),
+ 	SND_PCI_QUIRK(0x104d, 0x9047, "Sony Vaio TT", ALC889_FIXUP_VAIO_TT),
+ 	SND_PCI_QUIRK(0x104d, 0x905a, "Sony Vaio Z", ALC882_FIXUP_NO_PRIMARY_HP),
++	SND_PCI_QUIRK(0x104d, 0x9060, "Sony Vaio VPCL14M1R", ALC882_FIXUP_NO_PRIMARY_HP),
+ 	SND_PCI_QUIRK(0x104d, 0x9043, "Sony Vaio VGC-LN51JGB", ALC882_FIXUP_NO_PRIMARY_HP),
+ 	SND_PCI_QUIRK(0x104d, 0x9044, "Sony VAIO AiO", ALC882_FIXUP_NO_PRIMARY_HP),
+ 
+diff --git a/sound/soc/codecs/rt5645.c b/sound/soc/codecs/rt5645.c
+index 10c2a564a715..1ac96ef9ee20 100644
+--- a/sound/soc/codecs/rt5645.c
++++ b/sound/soc/codecs/rt5645.c
+@@ -3833,6 +3833,9 @@ static int rt5645_i2c_probe(struct i2c_client *i2c,
+ 		}
+ 	}
+ 
++	regmap_update_bits(rt5645->regmap, RT5645_ADDA_CLK1,
++		RT5645_I2S_PD1_MASK, RT5645_I2S_PD1_2);
++
+ 	if (rt5645->pdata.jd_invert) {
+ 		regmap_update_bits(rt5645->regmap, RT5645_IRQ_CTRL2,
+ 			RT5645_JD_1_1_MASK, RT5645_JD_1_1_INV);
+diff --git a/sound/soc/soc-pcm.c b/sound/soc/soc-pcm.c
+index 21c3ef01c438..80088c98ce27 100644
+--- a/sound/soc/soc-pcm.c
++++ b/sound/soc/soc-pcm.c
+@@ -181,6 +181,10 @@ int dpcm_dapm_stream_event(struct snd_soc_pcm_runtime *fe, int dir,
+ 		dev_dbg(be->dev, "ASoC: BE %s event %d dir %d\n",
+ 				be->dai_link->name, event, dir);
+ 
++		if ((event == SND_SOC_DAPM_STREAM_STOP) &&
++		    (be->dpcm[dir].users >= 1))
++			continue;
++
+ 		snd_soc_dapm_stream_event(be, dir, event);
+ 	}
+