linux kernel 4.9.864.9-89

2 files changed, 1739 insertions, 0 deletions

diff --git a/0000_README b/0000_README
index bf6df96c..f21a5fb5 100644
--- a/0000_README
+++ b/0000_README
@@ -383,6 +383,10 @@ Patch:  1084_linux-4.9.85.patch
 From:   http://www.kernel.org
 Desc:   Linux 4.9.85
 
+Patch:  1085_linux-4.9.86.patch
+From:   http://www.kernel.org
+Desc:   Linux 4.9.86
+
 Patch:  1500_XATTR_USER_PREFIX.patch
 From:   https://bugs.gentoo.org/show_bug.cgi?id=470644
 Desc:   Support for namespace user.pax.* on tmpfs.
diff --git a/1085_linux-4.9.86.patch b/1085_linux-4.9.86.patch
new file mode 100644
index 00000000..069a8600
--- /dev/null
+++ b/1085_linux-4.9.86.patch
@@ -0,0 +1,1735 @@
+diff --git a/Makefile b/Makefile
+index 77deaa395d69..e918d25e95bb 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 4
+ PATCHLEVEL = 9
+-SUBLEVEL = 85
++SUBLEVEL = 86
+ EXTRAVERSION =
+ NAME = Roaring Lionus
+ 
+diff --git a/arch/arm/boot/dts/ls1021a-qds.dts b/arch/arm/boot/dts/ls1021a-qds.dts
+index 940875316d0f..67b4de0e3439 100644
+--- a/arch/arm/boot/dts/ls1021a-qds.dts
++++ b/arch/arm/boot/dts/ls1021a-qds.dts
+@@ -215,7 +215,7 @@
+ 				reg = <0x2a>;
+ 				VDDA-supply = <&reg_3p3v>;
+ 				VDDIO-supply = <&reg_3p3v>;
+-				clocks = <&sys_mclk 1>;
++				clocks = <&sys_mclk>;
+ 			};
+ 		};
+ 	};
+diff --git a/arch/arm/boot/dts/ls1021a-twr.dts b/arch/arm/boot/dts/ls1021a-twr.dts
+index a8b148ad1dd2..44715c8ef756 100644
+--- a/arch/arm/boot/dts/ls1021a-twr.dts
++++ b/arch/arm/boot/dts/ls1021a-twr.dts
+@@ -187,7 +187,7 @@
+ 		reg = <0x0a>;
+ 		VDDA-supply = <&reg_3p3v>;
+ 		VDDIO-supply = <&reg_3p3v>;
+-		clocks = <&sys_mclk 1>;
++		clocks = <&sys_mclk>;
+ 	};
+ };
+ 
+diff --git a/arch/arm/kvm/mmu.c b/arch/arm/kvm/mmu.c
+index 2a35c1963f6d..7f868d9bb5ed 100644
+--- a/arch/arm/kvm/mmu.c
++++ b/arch/arm/kvm/mmu.c
+@@ -1284,7 +1284,7 @@ static int user_mem_abort(struct kvm_vcpu *vcpu, phys_addr_t fault_ipa,
+ 		return -EFAULT;
+ 	}
+ 
+-	if (vma_kernel_pagesize(vma) && !logging_active) {
++	if (vma_kernel_pagesize(vma) == PMD_SIZE && !logging_active) {
+ 		hugetlb = true;
+ 		gfn = (fault_ipa & PMD_MASK) >> PAGE_SHIFT;
+ 	} else {
+diff --git a/arch/arm/lib/csumpartialcopyuser.S b/arch/arm/lib/csumpartialcopyuser.S
+index 1712f132b80d..b83fdc06286a 100644
+--- a/arch/arm/lib/csumpartialcopyuser.S
++++ b/arch/arm/lib/csumpartialcopyuser.S
+@@ -85,7 +85,11 @@
+ 		.pushsection .text.fixup,"ax"
+ 		.align	4
+ 9001:		mov	r4, #-EFAULT
++#ifdef CONFIG_CPU_SW_DOMAIN_PAN
++		ldr	r5, [sp, #9*4]		@ *err_ptr
++#else
+ 		ldr	r5, [sp, #8*4]		@ *err_ptr
++#endif
+ 		str	r4, [r5]
+ 		ldmia	sp, {r1, r2}		@ retrieve dst, len
+ 		add	r2, r2, r1
+diff --git a/arch/mips/lib/Makefile b/arch/mips/lib/Makefile
+index 0344e575f522..fba4ca56e46a 100644
+--- a/arch/mips/lib/Makefile
++++ b/arch/mips/lib/Makefile
+@@ -15,4 +15,5 @@ obj-$(CONFIG_CPU_R3000)		+= r3k_dump_tlb.o
+ obj-$(CONFIG_CPU_TX39XX)	+= r3k_dump_tlb.o
+ 
+ # libgcc-style stuff needed in the kernel
+-obj-y += ashldi3.o ashrdi3.o bswapsi.o bswapdi.o cmpdi2.o lshrdi3.o ucmpdi2.o
++obj-y += ashldi3.o ashrdi3.o bswapsi.o bswapdi.o cmpdi2.o lshrdi3.o multi3.o \
++	 ucmpdi2.o
+diff --git a/arch/mips/lib/libgcc.h b/arch/mips/lib/libgcc.h
+index 05909d58e2fe..56ea0df60a44 100644
+--- a/arch/mips/lib/libgcc.h
++++ b/arch/mips/lib/libgcc.h
+@@ -9,10 +9,18 @@ typedef int word_type __attribute__ ((mode (__word__)));
+ struct DWstruct {
+ 	int high, low;
+ };
++
++struct TWstruct {
++	long long high, low;
++};
+ #elif defined(__LITTLE_ENDIAN)
+ struct DWstruct {
+ 	int low, high;
+ };
++
++struct TWstruct {
++	long long low, high;
++};
+ #else
+ #error I feel sick.
+ #endif
+@@ -22,4 +30,13 @@ typedef union {
+ 	long long ll;
+ } DWunion;
+ 
++#if defined(CONFIG_64BIT) && defined(CONFIG_CPU_MIPSR6)
++typedef int ti_type __attribute__((mode(TI)));
++
++typedef union {
++	struct TWstruct s;
++	ti_type ti;
++} TWunion;
++#endif
++
+ #endif /* __ASM_LIBGCC_H */
+diff --git a/arch/mips/lib/multi3.c b/arch/mips/lib/multi3.c
+new file mode 100644
+index 000000000000..111ad475aa0c
+--- /dev/null
++++ b/arch/mips/lib/multi3.c
+@@ -0,0 +1,54 @@
++// SPDX-License-Identifier: GPL-2.0
++#include <linux/export.h>
++
++#include "libgcc.h"
++
++/*
++ * GCC 7 suboptimally generates __multi3 calls for mips64r6, so for that
++ * specific case only we'll implement it here.
++ *
++ * See https://gcc.gnu.org/bugzilla/show_bug.cgi?id=82981
++ */
++#if defined(CONFIG_64BIT) && defined(CONFIG_CPU_MIPSR6) && (__GNUC__ == 7)
++
++/* multiply 64-bit values, low 64-bits returned */
++static inline long long notrace dmulu(long long a, long long b)
++{
++	long long res;
++
++	asm ("dmulu %0,%1,%2" : "=r" (res) : "r" (a), "r" (b));
++	return res;
++}
++
++/* multiply 64-bit unsigned values, high 64-bits of 128-bit result returned */
++static inline long long notrace dmuhu(long long a, long long b)
++{
++	long long res;
++
++	asm ("dmuhu %0,%1,%2" : "=r" (res) : "r" (a), "r" (b));
++	return res;
++}
++
++/* multiply 128-bit values, low 128-bits returned */
++ti_type notrace __multi3(ti_type a, ti_type b)
++{
++	TWunion res, aa, bb;
++
++	aa.ti = a;
++	bb.ti = b;
++
++	/*
++	 * a * b =           (a.lo * b.lo)
++	 *         + 2^64  * (a.hi * b.lo + a.lo * b.hi)
++	 *        [+ 2^128 * (a.hi * b.hi)]
++	 */
++	res.s.low = dmulu(aa.s.low, bb.s.low);
++	res.s.high = dmuhu(aa.s.low, bb.s.low);
++	res.s.high += dmulu(aa.s.high, bb.s.low);
++	res.s.high += dmulu(aa.s.low, bb.s.high);
++
++	return res.ti;
++}
++EXPORT_SYMBOL(__multi3);
++
++#endif /* 64BIT && CPU_MIPSR6 && GCC7 */
+diff --git a/arch/sh/boards/mach-se/770x/setup.c b/arch/sh/boards/mach-se/770x/setup.c
+index 658326f44df8..5e0267624d8d 100644
+--- a/arch/sh/boards/mach-se/770x/setup.c
++++ b/arch/sh/boards/mach-se/770x/setup.c
+@@ -8,6 +8,7 @@
+  */
+ #include <linux/init.h>
+ #include <linux/platform_device.h>
++#include <linux/sh_eth.h>
+ #include <mach-se/mach/se.h>
+ #include <mach-se/mach/mrshpc.h>
+ #include <asm/machvec.h>
+@@ -114,6 +115,11 @@ static struct platform_device heartbeat_device = {
+ #if defined(CONFIG_CPU_SUBTYPE_SH7710) ||\
+ 	defined(CONFIG_CPU_SUBTYPE_SH7712)
+ /* SH771X Ethernet driver */
++static struct sh_eth_plat_data sh_eth_plat = {
++	.phy = PHY_ID,
++	.phy_interface = PHY_INTERFACE_MODE_MII,
++};
++
+ static struct resource sh_eth0_resources[] = {
+ 	[0] = {
+ 		.start = SH_ETH0_BASE,
+@@ -131,7 +137,7 @@ static struct platform_device sh_eth0_device = {
+ 	.name = "sh771x-ether",
+ 	.id = 0,
+ 	.dev = {
+-		.platform_data = PHY_ID,
++		.platform_data = &sh_eth_plat,
+ 	},
+ 	.num_resources = ARRAY_SIZE(sh_eth0_resources),
+ 	.resource = sh_eth0_resources,
+@@ -154,7 +160,7 @@ static struct platform_device sh_eth1_device = {
+ 	.name = "sh771x-ether",
+ 	.id = 1,
+ 	.dev = {
+-		.platform_data = PHY_ID,
++		.platform_data = &sh_eth_plat,
+ 	},
+ 	.num_resources = ARRAY_SIZE(sh_eth1_resources),
+ 	.resource = sh_eth1_resources,
+diff --git a/arch/x86/include/asm/asm.h b/arch/x86/include/asm/asm.h
+index 7bb29a416b77..f35f246a26bf 100644
+--- a/arch/x86/include/asm/asm.h
++++ b/arch/x86/include/asm/asm.h
+@@ -128,6 +128,7 @@
+ #endif
+ 
+ #ifndef __ASSEMBLY__
++#ifndef __BPF__
+ /*
+  * This output constraint should be used for any inline asm which has a "call"
+  * instruction.  Otherwise the asm may be inserted before the frame pointer
+@@ -137,5 +138,6 @@
+ register unsigned long current_stack_pointer asm(_ASM_SP);
+ #define ASM_CALL_CONSTRAINT "+r" (current_stack_pointer)
+ #endif
++#endif
+ 
+ #endif /* _ASM_X86_ASM_H */
+diff --git a/drivers/dma/fsl-edma.c b/drivers/dma/fsl-edma.c
+index 6775f2c74e25..c7568869284e 100644
+--- a/drivers/dma/fsl-edma.c
++++ b/drivers/dma/fsl-edma.c
+@@ -863,11 +863,11 @@ static void fsl_edma_irq_exit(
+ 	}
+ }
+ 
+-static void fsl_disable_clocks(struct fsl_edma_engine *fsl_edma)
++static void fsl_disable_clocks(struct fsl_edma_engine *fsl_edma, int nr_clocks)
+ {
+ 	int i;
+ 
+-	for (i = 0; i < DMAMUX_NR; i++)
++	for (i = 0; i < nr_clocks; i++)
+ 		clk_disable_unprepare(fsl_edma->muxclk[i]);
+ }
+ 
+@@ -904,25 +904,25 @@ static int fsl_edma_probe(struct platform_device *pdev)
+ 
+ 		res = platform_get_resource(pdev, IORESOURCE_MEM, 1 + i);
+ 		fsl_edma->muxbase[i] = devm_ioremap_resource(&pdev->dev, res);
+-		if (IS_ERR(fsl_edma->muxbase[i]))
++		if (IS_ERR(fsl_edma->muxbase[i])) {
++			/* on error: disable all previously enabled clks */
++			fsl_disable_clocks(fsl_edma, i);
+ 			return PTR_ERR(fsl_edma->muxbase[i]);
++		}
+ 
+ 		sprintf(clkname, "dmamux%d", i);
+ 		fsl_edma->muxclk[i] = devm_clk_get(&pdev->dev, clkname);
+ 		if (IS_ERR(fsl_edma->muxclk[i])) {
+ 			dev_err(&pdev->dev, "Missing DMAMUX block clock.\n");
++			/* on error: disable all previously enabled clks */
++			fsl_disable_clocks(fsl_edma, i);
+ 			return PTR_ERR(fsl_edma->muxclk[i]);
+ 		}
+ 
+ 		ret = clk_prepare_enable(fsl_edma->muxclk[i]);
+-		if (ret) {
+-			/* disable only clks which were enabled on error */
+-			for (; i >= 0; i--)
+-				clk_disable_unprepare(fsl_edma->muxclk[i]);
+-
+-			dev_err(&pdev->dev, "DMAMUX clk block failed.\n");
+-			return ret;
+-		}
++		if (ret)
++			/* on error: disable all previously enabled clks */
++			fsl_disable_clocks(fsl_edma, i);
+ 
+ 	}
+ 
+@@ -976,7 +976,7 @@ static int fsl_edma_probe(struct platform_device *pdev)
+ 	if (ret) {
+ 		dev_err(&pdev->dev,
+ 			"Can't register Freescale eDMA engine. (%d)\n", ret);
+-		fsl_disable_clocks(fsl_edma);
++		fsl_disable_clocks(fsl_edma, DMAMUX_NR);
+ 		return ret;
+ 	}
+ 
+@@ -985,7 +985,7 @@ static int fsl_edma_probe(struct platform_device *pdev)
+ 		dev_err(&pdev->dev,
+ 			"Can't register Freescale eDMA of_dma. (%d)\n", ret);
+ 		dma_async_device_unregister(&fsl_edma->dma_dev);
+-		fsl_disable_clocks(fsl_edma);
++		fsl_disable_clocks(fsl_edma, DMAMUX_NR);
+ 		return ret;
+ 	}
+ 
+@@ -1015,7 +1015,7 @@ static int fsl_edma_remove(struct platform_device *pdev)
+ 	fsl_edma_cleanup_vchan(&fsl_edma->dma_dev);
+ 	of_dma_controller_free(np);
+ 	dma_async_device_unregister(&fsl_edma->dma_dev);
+-	fsl_disable_clocks(fsl_edma);
++	fsl_disable_clocks(fsl_edma, DMAMUX_NR);
+ 
+ 	return 0;
+ }
+diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/pci/base.c b/drivers/gpu/drm/nouveau/nvkm/subdev/pci/base.c
+index a4cb82495cee..245c946ea661 100644
+--- a/drivers/gpu/drm/nouveau/nvkm/subdev/pci/base.c
++++ b/drivers/gpu/drm/nouveau/nvkm/subdev/pci/base.c
+@@ -136,6 +136,13 @@ nvkm_pci_init(struct nvkm_subdev *subdev)
+ 		return ret;
+ 
+ 	pci->irq = pdev->irq;
++
++	/* Ensure MSI interrupts are armed, for the case where there are
++	 * already interrupts pending (for whatever reason) at load time.
++	 */
++	if (pci->msi)
++		pci->func->msi_rearm(pci);
++
+ 	return ret;
+ }
+ 
+diff --git a/drivers/gpu/drm/ttm/ttm_page_alloc.c b/drivers/gpu/drm/ttm/ttm_page_alloc.c
+index ddd6badd0eee..c756b2b7f5dc 100644
+--- a/drivers/gpu/drm/ttm/ttm_page_alloc.c
++++ b/drivers/gpu/drm/ttm/ttm_page_alloc.c
+@@ -818,6 +818,8 @@ int ttm_page_alloc_init(struct ttm_mem_global *glob, unsigned max_pages)
+ 	pr_info("Initializing pool allocator\n");
+ 
+ 	_manager = kzalloc(sizeof(*_manager), GFP_KERNEL);
++	if (!_manager)
++		return -ENOMEM;
+ 
+ 	ttm_page_pool_init_locked(&_manager->wc_pool, GFP_HIGHUSER, "wc");
+ 
+diff --git a/drivers/i2c/busses/i2c-designware-core.c b/drivers/i2c/busses/i2c-designware-core.c
+index 809f4d4e93a0..340e037b3224 100644
+--- a/drivers/i2c/busses/i2c-designware-core.c
++++ b/drivers/i2c/busses/i2c-designware-core.c
+@@ -507,7 +507,7 @@ static void i2c_dw_xfer_init(struct dw_i2c_dev *dev)
+ 	i2c_dw_disable_int(dev);
+ 
+ 	/* Enable the adapter */
+-	__i2c_dw_enable(dev, true);
++	__i2c_dw_enable_and_wait(dev, true);
+ 
+ 	/* Clear and enable interrupts */
+ 	dw_readl(dev, DW_IC_CLR_INTR);
+diff --git a/drivers/infiniband/hw/mlx4/mr.c b/drivers/infiniband/hw/mlx4/mr.c
+index 5d73989d9771..ae41623e0f13 100644
+--- a/drivers/infiniband/hw/mlx4/mr.c
++++ b/drivers/infiniband/hw/mlx4/mr.c
+@@ -406,7 +406,6 @@ struct ib_mr *mlx4_ib_alloc_mr(struct ib_pd *pd,
+ 		goto err_free_mr;
+ 
+ 	mr->max_pages = max_num_sg;
+-
+ 	err = mlx4_mr_enable(dev->dev, &mr->mmr);
+ 	if (err)
+ 		goto err_free_pl;
+@@ -417,6 +416,7 @@ struct ib_mr *mlx4_ib_alloc_mr(struct ib_pd *pd,
+ 	return &mr->ibmr;
+ 
+ err_free_pl:
++	mr->ibmr.device = pd->device;
+ 	mlx4_free_priv_pages(mr);
+ err_free_mr:
+ 	(void) mlx4_mr_free(dev->dev, &mr->mmr);
+diff --git a/drivers/infiniband/hw/mlx5/mr.c b/drivers/infiniband/hw/mlx5/mr.c
+index 0a260a06876d..c7d5786d366b 100644
+--- a/drivers/infiniband/hw/mlx5/mr.c
++++ b/drivers/infiniband/hw/mlx5/mr.c
+@@ -1648,6 +1648,7 @@ struct ib_mr *mlx5_ib_alloc_mr(struct ib_pd *pd,
+ 	MLX5_SET(mkc, mkc, access_mode, mr->access_mode);
+ 	MLX5_SET(mkc, mkc, umr_en, 1);
+ 
++	mr->ibmr.device = pd->device;
+ 	err = mlx5_core_create_mkey(dev->mdev, &mr->mmkey, in, inlen);
+ 	if (err)
+ 		goto err_destroy_psv;
+diff --git a/drivers/infiniband/ulp/ipoib/ipoib_main.c b/drivers/infiniband/ulp/ipoib/ipoib_main.c
+index 183db0cd849e..e37e918cb935 100644
+--- a/drivers/infiniband/ulp/ipoib/ipoib_main.c
++++ b/drivers/infiniband/ulp/ipoib/ipoib_main.c
+@@ -919,8 +919,8 @@ static int path_rec_start(struct net_device *dev,
+ 	return 0;
+ }
+ 
+-static void neigh_add_path(struct sk_buff *skb, u8 *daddr,
+-			   struct net_device *dev)
++static struct ipoib_neigh *neigh_add_path(struct sk_buff *skb, u8 *daddr,
++					  struct net_device *dev)
+ {
+ 	struct ipoib_dev_priv *priv = netdev_priv(dev);
+ 	struct ipoib_path *path;
+@@ -933,7 +933,15 @@ static void neigh_add_path(struct sk_buff *skb, u8 *daddr,
+ 		spin_unlock_irqrestore(&priv->lock, flags);
+ 		++dev->stats.tx_dropped;
+ 		dev_kfree_skb_any(skb);
+-		return;
++		return NULL;
++	}
++
++	/* To avoid race condition, make sure that the
++	 * neigh will be added only once.
++	 */
++	if (unlikely(!list_empty(&neigh->list))) {
++		spin_unlock_irqrestore(&priv->lock, flags);
++		return neigh;
+ 	}
+ 
+ 	path = __path_find(dev, daddr + 4);
+@@ -971,7 +979,7 @@ static void neigh_add_path(struct sk_buff *skb, u8 *daddr,
+ 			spin_unlock_irqrestore(&priv->lock, flags);
+ 			ipoib_send(dev, skb, path->ah, IPOIB_QPN(daddr));
+ 			ipoib_neigh_put(neigh);
+-			return;
++			return NULL;
+ 		}
+ 	} else {
+ 		neigh->ah  = NULL;
+@@ -988,7 +996,7 @@ static void neigh_add_path(struct sk_buff *skb, u8 *daddr,
+ 
+ 	spin_unlock_irqrestore(&priv->lock, flags);
+ 	ipoib_neigh_put(neigh);
+-	return;
++	return NULL;
+ 
+ err_path:
+ 	ipoib_neigh_free(neigh);
+@@ -998,6 +1006,8 @@ static void neigh_add_path(struct sk_buff *skb, u8 *daddr,
+ 
+ 	spin_unlock_irqrestore(&priv->lock, flags);
+ 	ipoib_neigh_put(neigh);
++
++	return NULL;
+ }
+ 
+ static void unicast_arp_send(struct sk_buff *skb, struct net_device *dev,
+@@ -1103,8 +1113,9 @@ static int ipoib_start_xmit(struct sk_buff *skb, struct net_device *dev)
+ 	case htons(ETH_P_TIPC):
+ 		neigh = ipoib_neigh_get(dev, phdr->hwaddr);
+ 		if (unlikely(!neigh)) {
+-			neigh_add_path(skb, phdr->hwaddr, dev);
+-			return NETDEV_TX_OK;
++			neigh = neigh_add_path(skb, phdr->hwaddr, dev);
++			if (likely(!neigh))
++				return NETDEV_TX_OK;
+ 		}
+ 		break;
+ 	case htons(ETH_P_ARP):
+diff --git a/drivers/infiniband/ulp/ipoib/ipoib_multicast.c b/drivers/infiniband/ulp/ipoib/ipoib_multicast.c
+index fddff403d5d2..6b6826f3e446 100644
+--- a/drivers/infiniband/ulp/ipoib/ipoib_multicast.c
++++ b/drivers/infiniband/ulp/ipoib/ipoib_multicast.c
+@@ -818,7 +818,10 @@ void ipoib_mcast_send(struct net_device *dev, u8 *daddr, struct sk_buff *skb)
+ 		spin_lock_irqsave(&priv->lock, flags);
+ 		if (!neigh) {
+ 			neigh = ipoib_neigh_alloc(daddr, dev);
+-			if (neigh) {
++			/* Make sure that the neigh will be added only
++			 * once to mcast list.
++			 */
++			if (neigh && list_empty(&neigh->list)) {
+ 				kref_get(&mcast->ah->ref);
+ 				neigh->ah	= mcast->ah;
+ 				list_add_tail(&neigh->list, &mcast->neigh_list);
+diff --git a/drivers/leds/led-core.c b/drivers/leds/led-core.c
+index 3bce44893021..d70d4a5273b8 100644
+--- a/drivers/leds/led-core.c
++++ b/drivers/leds/led-core.c
+@@ -186,7 +186,7 @@ void led_blink_set(struct led_classdev *led_cdev,
+ 		   unsigned long *delay_on,
+ 		   unsigned long *delay_off)
+ {
+-	del_timer_sync(&led_cdev->blink_timer);
++	led_stop_software_blink(led_cdev);
+ 
+ 	led_cdev->flags &= ~LED_BLINK_ONESHOT;
+ 	led_cdev->flags &= ~LED_BLINK_ONESHOT_STOP;
+diff --git a/drivers/mtd/nand/brcmnand/brcmnand.c b/drivers/mtd/nand/brcmnand/brcmnand.c
+index 1a4a790054e4..ef9a6b22c9fa 100644
+--- a/drivers/mtd/nand/brcmnand/brcmnand.c
++++ b/drivers/mtd/nand/brcmnand/brcmnand.c
+@@ -1763,7 +1763,7 @@ static int brcmnand_read(struct mtd_info *mtd, struct nand_chip *chip,
+ 			err = brcmstb_nand_verify_erased_page(mtd, chip, buf,
+ 							      addr);
+ 			/* erased page bitflips corrected */
+-			if (err > 0)
++			if (err >= 0)
+ 				return err;
+ 		}
+ 
+diff --git a/drivers/mtd/nand/gpmi-nand/gpmi-nand.c b/drivers/mtd/nand/gpmi-nand/gpmi-nand.c
+index 6c062b8251d2..427039b77668 100644
+--- a/drivers/mtd/nand/gpmi-nand/gpmi-nand.c
++++ b/drivers/mtd/nand/gpmi-nand/gpmi-nand.c
+@@ -1059,9 +1059,6 @@ static int gpmi_ecc_read_page(struct mtd_info *mtd, struct nand_chip *chip,
+ 		return ret;
+ 	}
+ 
+-	/* handle the block mark swapping */
+-	block_mark_swapping(this, payload_virt, auxiliary_virt);
+-
+ 	/* Loop over status bytes, accumulating ECC status. */
+ 	status = auxiliary_virt + nfc_geo->auxiliary_status_offset;
+ 
+@@ -1150,6 +1147,9 @@ static int gpmi_ecc_read_page(struct mtd_info *mtd, struct nand_chip *chip,
+ 		max_bitflips = max_t(unsigned int, max_bitflips, *status);
+ 	}
+ 
++	/* handle the block mark swapping */
++	block_mark_swapping(this, buf, auxiliary_virt);
++
+ 	if (oob_required) {
+ 		/*
+ 		 * It's time to deliver the OOB bytes. See gpmi_ecc_read_oob()
+diff --git a/drivers/net/can/flexcan.c b/drivers/net/can/flexcan.c
+index 16f7cadda5c3..47f43bdecd51 100644
+--- a/drivers/net/can/flexcan.c
++++ b/drivers/net/can/flexcan.c
+@@ -493,7 +493,7 @@ static int flexcan_start_xmit(struct sk_buff *skb, struct net_device *dev)
+ 		data = be32_to_cpup((__be32 *)&cf->data[0]);
+ 		flexcan_write(data, &regs->mb[FLEXCAN_TX_BUF_ID].data[0]);
+ 	}
+-	if (cf->can_dlc > 3) {
++	if (cf->can_dlc > 4) {
+ 		data = be32_to_cpup((__be32 *)&cf->data[4]);
+ 		flexcan_write(data, &regs->mb[FLEXCAN_TX_BUF_ID].data[1]);
+ 	}
+diff --git a/drivers/net/ethernet/arc/emac_main.c b/drivers/net/ethernet/arc/emac_main.c
+index be865b4dada2..aba4853e6b70 100644
+--- a/drivers/net/ethernet/arc/emac_main.c
++++ b/drivers/net/ethernet/arc/emac_main.c
+@@ -210,39 +210,48 @@ static int arc_emac_rx(struct net_device *ndev, int budget)
+ 			continue;
+ 		}
+ 
+-		pktlen = info & LEN_MASK;
+-		stats->rx_packets++;
+-		stats->rx_bytes += pktlen;
+-		skb = rx_buff->skb;
+-		skb_put(skb, pktlen);
+-		skb->dev = ndev;
+-		skb->protocol = eth_type_trans(skb, ndev);
+-
+-		dma_unmap_single(&ndev->dev, dma_unmap_addr(rx_buff, addr),
+-				 dma_unmap_len(rx_buff, len), DMA_FROM_DEVICE);
+-
+-		/* Prepare the BD for next cycle */
+-		rx_buff->skb = netdev_alloc_skb_ip_align(ndev,
+-							 EMAC_BUFFER_SIZE);
+-		if (unlikely(!rx_buff->skb)) {
++		/* Prepare the BD for next cycle. netif_receive_skb()
++		 * only if new skb was allocated and mapped to avoid holes
++		 * in the RX fifo.
++		 */
++		skb = netdev_alloc_skb_ip_align(ndev, EMAC_BUFFER_SIZE);
++		if (unlikely(!skb)) {
++			if (net_ratelimit())
++				netdev_err(ndev, "cannot allocate skb\n");
++			/* Return ownership to EMAC */
++			rxbd->info = cpu_to_le32(FOR_EMAC | EMAC_BUFFER_SIZE);
+ 			stats->rx_errors++;
+-			/* Because receive_skb is below, increment rx_dropped */
+ 			stats->rx_dropped++;
+ 			continue;
+ 		}
+ 
+-		/* receive_skb only if new skb was allocated to avoid holes */
+-		netif_receive_skb(skb);
+-
+-		addr = dma_map_single(&ndev->dev, (void *)rx_buff->skb->data,
++		addr = dma_map_single(&ndev->dev, (void *)skb->data,
+ 				      EMAC_BUFFER_SIZE, DMA_FROM_DEVICE);
+ 		if (dma_mapping_error(&ndev->dev, addr)) {
+ 			if (net_ratelimit())
+-				netdev_err(ndev, "cannot dma map\n");
+-			dev_kfree_skb(rx_buff->skb);
++				netdev_err(ndev, "cannot map dma buffer\n");
++			dev_kfree_skb(skb);
++			/* Return ownership to EMAC */
++			rxbd->info = cpu_to_le32(FOR_EMAC | EMAC_BUFFER_SIZE);
+ 			stats->rx_errors++;
++			stats->rx_dropped++;
+ 			continue;
+ 		}
++
++		/* unmap previosly mapped skb */
++		dma_unmap_single(&ndev->dev, dma_unmap_addr(rx_buff, addr),
++				 dma_unmap_len(rx_buff, len), DMA_FROM_DEVICE);
++
++		pktlen = info & LEN_MASK;
++		stats->rx_packets++;
++		stats->rx_bytes += pktlen;
++		skb_put(rx_buff->skb, pktlen);
++		rx_buff->skb->dev = ndev;
++		rx_buff->skb->protocol = eth_type_trans(rx_buff->skb, ndev);
++
++		netif_receive_skb(rx_buff->skb);
++
++		rx_buff->skb = skb;
+ 		dma_unmap_addr_set(rx_buff, addr, addr);
+ 		dma_unmap_len_set(rx_buff, len, EMAC_BUFFER_SIZE);
+ 
+diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
+index 0a5ee1d973ac..596f88b693ef 100644
+--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
++++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
+@@ -3034,7 +3034,7 @@ int bnx2x_nic_unload(struct bnx2x *bp, int unload_mode, bool keep_link)
+ 
+ 	del_timer_sync(&bp->timer);
+ 
+-	if (IS_PF(bp)) {
++	if (IS_PF(bp) && !BP_NOMCP(bp)) {
+ 		/* Set ALWAYS_ALIVE bit in shmem */
+ 		bp->fw_drv_pulse_wr_seq |= DRV_PULSE_ALWAYS_ALIVE;
+ 		bnx2x_drv_pulse(bp);
+@@ -3120,7 +3120,7 @@ int bnx2x_nic_unload(struct bnx2x *bp, int unload_mode, bool keep_link)
+ 	bp->cnic_loaded = false;
+ 
+ 	/* Clear driver version indication in shmem */
+-	if (IS_PF(bp))
++	if (IS_PF(bp) && !BP_NOMCP(bp))
+ 		bnx2x_update_mng_version(bp);
+ 
+ 	/* Check if there are pending parity attentions. If there are - set
+diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
+index 5d958b5bb8b1..554c4086b3c6 100644
+--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
++++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
+@@ -9578,6 +9578,15 @@ static int bnx2x_init_shmem(struct bnx2x *bp)
+ 
+ 	do {
+ 		bp->common.shmem_base = REG_RD(bp, MISC_REG_SHARED_MEM_ADDR);
++
++		/* If we read all 0xFFs, means we are in PCI error state and
++		 * should bail out to avoid crashes on adapter's FW reads.
++		 */
++		if (bp->common.shmem_base == 0xFFFFFFFF) {
++			bp->flags |= NO_MCP_FLAG;
++			return -ENODEV;
++		}
++
+ 		if (bp->common.shmem_base) {
+ 			val = SHMEM_RD(bp, validity_map[BP_PORT(bp)]);
+ 			if (val & SHR_MEM_VALIDITY_MB)
+@@ -14312,7 +14321,10 @@ static pci_ers_result_t bnx2x_io_slot_reset(struct pci_dev *pdev)
+ 		BNX2X_ERR("IO slot reset --> driver unload\n");
+ 
+ 		/* MCP should have been reset; Need to wait for validity */
+-		bnx2x_init_shmem(bp);
++		if (bnx2x_init_shmem(bp)) {
++			rtnl_unlock();
++			return PCI_ERS_RESULT_DISCONNECT;
++		}
+ 
+ 		if (IS_PF(bp) && SHMEM2_HAS(bp, drv_capabilities_flag)) {
+ 			u32 v;
+diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_sriov.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_sriov.c
+index 60e2af8678bd..393cce3bf2fc 100644
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_sriov.c
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_sriov.c
+@@ -68,7 +68,7 @@ static int bnxt_vf_ndo_prep(struct bnxt *bp, int vf_id)
+ 		netdev_err(bp->dev, "vf ndo called though sriov is disabled\n");
+ 		return -EINVAL;
+ 	}
+-	if (vf_id >= bp->pf.max_vfs) {
++	if (vf_id >= bp->pf.active_vfs) {
+ 		netdev_err(bp->dev, "Invalid VF id %d\n", vf_id);
+ 		return -EINVAL;
+ 	}
+diff --git a/drivers/net/ethernet/broadcom/tg3.c b/drivers/net/ethernet/broadcom/tg3.c
+index bb22d325e965..795a133fb074 100644
+--- a/drivers/net/ethernet/broadcom/tg3.c
++++ b/drivers/net/ethernet/broadcom/tg3.c
+@@ -10049,6 +10049,16 @@ static int tg3_reset_hw(struct tg3 *tp, bool reset_phy)
+ 
+ 	tw32(GRC_MODE, tp->grc_mode | val);
+ 
++	/* On one of the AMD platform, MRRS is restricted to 4000 because of
++	 * south bridge limitation. As a workaround, Driver is setting MRRS
++	 * to 2048 instead of default 4096.
++	 */
++	if (tp->pdev->subsystem_vendor == PCI_VENDOR_ID_DELL &&
++	    tp->pdev->subsystem_device == TG3PCI_SUBDEVICE_ID_DELL_5762) {
++		val = tr32(TG3PCI_DEV_STATUS_CTRL) & ~MAX_READ_REQ_MASK;
++		tw32(TG3PCI_DEV_STATUS_CTRL, val | MAX_READ_REQ_SIZE_2048);
++	}
++
+ 	/* Setup the timer prescalar register.  Clock is always 66Mhz. */
+ 	val = tr32(GRC_MISC_CFG);
+ 	val &= ~0xff;
+@@ -14228,7 +14238,8 @@ static int tg3_change_mtu(struct net_device *dev, int new_mtu)
+ 	 */
+ 	if (tg3_asic_rev(tp) == ASIC_REV_57766 ||
+ 	    tg3_asic_rev(tp) == ASIC_REV_5717 ||
+-	    tg3_asic_rev(tp) == ASIC_REV_5719)
++	    tg3_asic_rev(tp) == ASIC_REV_5719 ||
++	    tg3_asic_rev(tp) == ASIC_REV_5720)
+ 		reset_phy = true;
+ 
+ 	err = tg3_restart_hw(tp, reset_phy);
+diff --git a/drivers/net/ethernet/broadcom/tg3.h b/drivers/net/ethernet/broadcom/tg3.h
+index 3b5e98ecba00..6e51b793615c 100644
+--- a/drivers/net/ethernet/broadcom/tg3.h
++++ b/drivers/net/ethernet/broadcom/tg3.h
+@@ -95,6 +95,7 @@
+ #define TG3PCI_SUBDEVICE_ID_DELL_JAGUAR		0x0106
+ #define TG3PCI_SUBDEVICE_ID_DELL_MERLOT		0x0109
+ #define TG3PCI_SUBDEVICE_ID_DELL_SLIM_MERLOT	0x010a
++#define TG3PCI_SUBDEVICE_ID_DELL_5762		0x07f0
+ #define TG3PCI_SUBVENDOR_ID_COMPAQ		PCI_VENDOR_ID_COMPAQ
+ #define TG3PCI_SUBDEVICE_ID_COMPAQ_BANSHEE	0x007c
+ #define TG3PCI_SUBDEVICE_ID_COMPAQ_BANSHEE_2	0x009a
+@@ -280,6 +281,9 @@
+ #define TG3PCI_STD_RING_PROD_IDX	0x00000098 /* 64-bit */
+ #define TG3PCI_RCV_RET_RING_CON_IDX	0x000000a0 /* 64-bit */
+ /* 0xa8 --> 0xb8 unused */
++#define TG3PCI_DEV_STATUS_CTRL		0x000000b4
++#define  MAX_READ_REQ_SIZE_2048		 0x00004000
++#define  MAX_READ_REQ_MASK		 0x00007000
+ #define TG3PCI_DUAL_MAC_CTRL		0x000000b8
+ #define  DUAL_MAC_CTRL_CH_MASK		 0x00000003
+ #define  DUAL_MAC_CTRL_ID		 0x00000004
+diff --git a/drivers/net/ethernet/freescale/gianfar_ptp.c b/drivers/net/ethernet/freescale/gianfar_ptp.c
+index 57798814160d..ec4b6997f24a 100644
+--- a/drivers/net/ethernet/freescale/gianfar_ptp.c
++++ b/drivers/net/ethernet/freescale/gianfar_ptp.c
+@@ -314,11 +314,10 @@ static int ptp_gianfar_adjtime(struct ptp_clock_info *ptp, s64 delta)
+ 	now = tmr_cnt_read(etsects);
+ 	now += delta;
+ 	tmr_cnt_write(etsects, now);
++	set_fipers(etsects);
+ 
+ 	spin_unlock_irqrestore(&etsects->lock, flags);
+ 
+-	set_fipers(etsects);
+-
+ 	return 0;
+ }
+ 
+diff --git a/drivers/net/ethernet/intel/e1000/e1000.h b/drivers/net/ethernet/intel/e1000/e1000.h
+index d7bdea79e9fa..8fd2458060a0 100644
+--- a/drivers/net/ethernet/intel/e1000/e1000.h
++++ b/drivers/net/ethernet/intel/e1000/e1000.h
+@@ -331,7 +331,8 @@ struct e1000_adapter {
+ enum e1000_state_t {
+ 	__E1000_TESTING,
+ 	__E1000_RESETTING,
+-	__E1000_DOWN
++	__E1000_DOWN,
++	__E1000_DISABLED
+ };
+ 
+ #undef pr_fmt
+diff --git a/drivers/net/ethernet/intel/e1000/e1000_main.c b/drivers/net/ethernet/intel/e1000/e1000_main.c
+index f42129d09e2c..dd112aa5cebb 100644
+--- a/drivers/net/ethernet/intel/e1000/e1000_main.c
++++ b/drivers/net/ethernet/intel/e1000/e1000_main.c
+@@ -940,7 +940,7 @@ static int e1000_init_hw_struct(struct e1000_adapter *adapter,
+ static int e1000_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
+ {
+ 	struct net_device *netdev;
+-	struct e1000_adapter *adapter;
++	struct e1000_adapter *adapter = NULL;
+ 	struct e1000_hw *hw;
+ 
+ 	static int cards_found;
+@@ -950,6 +950,7 @@ static int e1000_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
+ 	u16 tmp = 0;
+ 	u16 eeprom_apme_mask = E1000_EEPROM_APME;
+ 	int bars, need_ioport;
++	bool disable_dev = false;
+ 
+ 	/* do not allocate ioport bars when not needed */
+ 	need_ioport = e1000_is_need_ioport(pdev);
+@@ -1250,11 +1251,13 @@ static int e1000_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
+ 	iounmap(hw->ce4100_gbe_mdio_base_virt);
+ 	iounmap(hw->hw_addr);
+ err_ioremap:
++	disable_dev = !test_and_set_bit(__E1000_DISABLED, &adapter->flags);
+ 	free_netdev(netdev);
+ err_alloc_etherdev:
+ 	pci_release_selected_regions(pdev, bars);
+ err_pci_reg:
+-	pci_disable_device(pdev);
++	if (!adapter || disable_dev)
++		pci_disable_device(pdev);
+ 	return err;
+ }
+ 
+@@ -1272,6 +1275,7 @@ static void e1000_remove(struct pci_dev *pdev)
+ 	struct net_device *netdev = pci_get_drvdata(pdev);
+ 	struct e1000_adapter *adapter = netdev_priv(netdev);
+ 	struct e1000_hw *hw = &adapter->hw;
++	bool disable_dev;
+ 
+ 	e1000_down_and_stop(adapter);
+ 	e1000_release_manageability(adapter);
+@@ -1290,9 +1294,11 @@ static void e1000_remove(struct pci_dev *pdev)
+ 		iounmap(hw->flash_address);
+ 	pci_release_selected_regions(pdev, adapter->bars);
+ 
++	disable_dev = !test_and_set_bit(__E1000_DISABLED, &adapter->flags);
+ 	free_netdev(netdev);
+ 
+-	pci_disable_device(pdev);
++	if (disable_dev)
++		pci_disable_device(pdev);
+ }
+ 
+ /**
+@@ -5166,7 +5172,8 @@ static int __e1000_shutdown(struct pci_dev *pdev, bool *enable_wake)
+ 	if (netif_running(netdev))
+ 		e1000_free_irq(adapter);
+ 
+-	pci_disable_device(pdev);
++	if (!test_and_set_bit(__E1000_DISABLED, &adapter->flags))
++		pci_disable_device(pdev);
+ 
+ 	return 0;
+ }
+@@ -5210,6 +5217,10 @@ static int e1000_resume(struct pci_dev *pdev)
+ 		pr_err("Cannot enable PCI device from suspend\n");
+ 		return err;
+ 	}
++
++	/* flush memory to make sure state is correct */
++	smp_mb__before_atomic();
++	clear_bit(__E1000_DISABLED, &adapter->flags);
+ 	pci_set_master(pdev);
+ 
+ 	pci_enable_wake(pdev, PCI_D3hot, 0);
+@@ -5284,7 +5295,9 @@ static pci_ers_result_t e1000_io_error_detected(struct pci_dev *pdev,
+ 
+ 	if (netif_running(netdev))
+ 		e1000_down(adapter);
+-	pci_disable_device(pdev);
++
++	if (!test_and_set_bit(__E1000_DISABLED, &adapter->flags))
++		pci_disable_device(pdev);
+ 
+ 	/* Request a slot slot reset. */
+ 	return PCI_ERS_RESULT_NEED_RESET;
+@@ -5312,6 +5325,10 @@ static pci_ers_result_t e1000_io_slot_reset(struct pci_dev *pdev)
+ 		pr_err("Cannot re-enable PCI device after reset.\n");
+ 		return PCI_ERS_RESULT_DISCONNECT;
+ 	}
++
++	/* flush memory to make sure state is correct */
++	smp_mb__before_atomic();
++	clear_bit(__E1000_DISABLED, &adapter->flags);
+ 	pci_set_master(pdev);
+ 
+ 	pci_enable_wake(pdev, PCI_D3hot, 0);
+diff --git a/drivers/net/ethernet/intel/i40e/i40e_txrx.c b/drivers/net/ethernet/intel/i40e/i40e_txrx.c
+index c5430394fac9..28b640fa2e35 100644
+--- a/drivers/net/ethernet/intel/i40e/i40e_txrx.c
++++ b/drivers/net/ethernet/intel/i40e/i40e_txrx.c
+@@ -2670,10 +2670,30 @@ bool __i40e_chk_linearize(struct sk_buff *skb)
+ 	/* Walk through fragments adding latest fragment, testing it, and
+ 	 * then removing stale fragments from the sum.
+ 	 */
+-	stale = &skb_shinfo(skb)->frags[0];
+-	for (;;) {
++	for (stale = &skb_shinfo(skb)->frags[0];; stale++) {
++		int stale_size = skb_frag_size(stale);
++
+ 		sum += skb_frag_size(frag++);
+ 
++		/* The stale fragment may present us with a smaller
++		 * descriptor than the actual fragment size. To account
++		 * for that we need to remove all the data on the front and
++		 * figure out what the remainder would be in the last
++		 * descriptor associated with the fragment.
++		 */
++		if (stale_size > I40E_MAX_DATA_PER_TXD) {
++			int align_pad = -(stale->page_offset) &
++					(I40E_MAX_READ_REQ_SIZE - 1);
++
++			sum -= align_pad;
++			stale_size -= align_pad;
++
++			do {
++				sum -= I40E_MAX_DATA_PER_TXD_ALIGNED;
++				stale_size -= I40E_MAX_DATA_PER_TXD_ALIGNED;
++			} while (stale_size > I40E_MAX_DATA_PER_TXD);
++		}
++
+ 		/* if sum is negative we failed to make sufficient progress */
+ 		if (sum < 0)
+ 			return true;
+@@ -2681,7 +2701,7 @@ bool __i40e_chk_linearize(struct sk_buff *skb)
+ 		if (!nr_frags--)
+ 			break;
+ 
+-		sum -= skb_frag_size(stale++);
++		sum -= stale_size;
+ 	}
+ 
+ 	return false;
+diff --git a/drivers/net/ethernet/intel/i40evf/i40e_txrx.c b/drivers/net/ethernet/intel/i40evf/i40e_txrx.c
+index c03800d1000a..90ebc5ac16fd 100644
+--- a/drivers/net/ethernet/intel/i40evf/i40e_txrx.c
++++ b/drivers/net/ethernet/intel/i40evf/i40e_txrx.c
+@@ -1872,10 +1872,30 @@ bool __i40evf_chk_linearize(struct sk_buff *skb)
+ 	/* Walk through fragments adding latest fragment, testing it, and
+ 	 * then removing stale fragments from the sum.
+ 	 */
+-	stale = &skb_shinfo(skb)->frags[0];
+-	for (;;) {
++	for (stale = &skb_shinfo(skb)->frags[0];; stale++) {
++		int stale_size = skb_frag_size(stale);
++
+ 		sum += skb_frag_size(frag++);
+ 
++		/* The stale fragment may present us with a smaller
++		 * descriptor than the actual fragment size. To account
++		 * for that we need to remove all the data on the front and
++		 * figure out what the remainder would be in the last
++		 * descriptor associated with the fragment.
++		 */
++		if (stale_size > I40E_MAX_DATA_PER_TXD) {
++			int align_pad = -(stale->page_offset) &
++					(I40E_MAX_READ_REQ_SIZE - 1);
++
++			sum -= align_pad;
++			stale_size -= align_pad;
++
++			do {
++				sum -= I40E_MAX_DATA_PER_TXD_ALIGNED;
++				stale_size -= I40E_MAX_DATA_PER_TXD_ALIGNED;
++			} while (stale_size > I40E_MAX_DATA_PER_TXD);
++		}
++
+ 		/* if sum is negative we failed to make sufficient progress */
+ 		if (sum < 0)
+ 			return true;
+@@ -1883,7 +1903,7 @@ bool __i40evf_chk_linearize(struct sk_buff *skb)
+ 		if (!nr_frags--)
+ 			break;
+ 
+-		sum -= skb_frag_size(stale++);
++		sum -= stale_size;
+ 	}
+ 
+ 	return false;
+diff --git a/drivers/net/ethernet/mediatek/mtk_eth_soc.c b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
+index 4832223f1500..20de37a414fe 100644
+--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.c
++++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
+@@ -1842,11 +1842,12 @@ static int mtk_hw_init(struct mtk_eth *eth)
+ 	/* set GE2 TUNE */
+ 	regmap_write(eth->pctl, GPIO_BIAS_CTRL, 0x0);
+ 
+-	/* GE1, Force 1000M/FD, FC ON */
+-	mtk_w32(eth, MAC_MCR_FIXED_LINK, MTK_MAC_MCR(0));
+-
+-	/* GE2, Force 1000M/FD, FC ON */
+-	mtk_w32(eth, MAC_MCR_FIXED_LINK, MTK_MAC_MCR(1));
++	/* Set linkdown as the default for each GMAC. Its own MCR would be set
++	 * up with the more appropriate value when mtk_phy_link_adjust call is
++	 * being invoked.
++	 */
++	for (i = 0; i < MTK_MAC_COUNT; i++)
++		mtk_w32(eth, 0, MTK_MAC_MCR(i));
+ 
+ 	/* Enable RX VLan Offloading */
+ 	mtk_w32(eth, 1, MTK_CDMP_EG_CTRL);
+diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_hwtstamp.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_hwtstamp.c
+index 10d6059b2f26..f4074e25fb71 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_hwtstamp.c
++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_hwtstamp.c
+@@ -38,6 +38,7 @@ static u32 stmmac_config_sub_second_increment(void __iomem *ioaddr,
+ {
+ 	u32 value = readl(ioaddr + PTP_TCR);
+ 	unsigned long data;
++	u32 reg_value;
+ 
+ 	/* For GMAC3.x, 4.x versions, convert the ptp_clock to nano second
+ 	 *	formula = (1/ptp_clock) * 1000000000
+@@ -54,10 +55,11 @@ static u32 stmmac_config_sub_second_increment(void __iomem *ioaddr,
+ 
+ 	data &= PTP_SSIR_SSINC_MASK;
+ 
++	reg_value = data;
+ 	if (gmac4)
+-		data = data << GMAC4_PTP_SSIR_SSINC_SHIFT;
++		reg_value <<= GMAC4_PTP_SSIR_SSINC_SHIFT;
+ 
+-	writel(data, ioaddr + PTP_SSIR);
++	writel(reg_value, ioaddr + PTP_SSIR);
+ 
+ 	return data;
+ }
+diff --git a/drivers/net/macvlan.c b/drivers/net/macvlan.c
+index 6d55049cd3dc..e8ad4d060da7 100644
+--- a/drivers/net/macvlan.c
++++ b/drivers/net/macvlan.c
+@@ -1377,9 +1377,14 @@ int macvlan_common_newlink(struct net *src_net, struct net_device *dev,
+ 	return 0;
+ 
+ unregister_netdev:
++	/* macvlan_uninit would free the macvlan port */
+ 	unregister_netdevice(dev);
++	return err;
+ destroy_macvlan_port:
+-	if (create)
++	/* the macvlan port may be freed by macvlan_uninit when fail to register.
++	 * so we destroy the macvlan port only when it's valid.
++	 */
++	if (create && macvlan_port_get_rtnl(dev))
+ 		macvlan_port_destroy(port->dev);
+ 	return err;
+ }
+diff --git a/drivers/net/phy/mdio-sun4i.c b/drivers/net/phy/mdio-sun4i.c
+index 135296508a7e..6425ce04d3f9 100644
+--- a/drivers/net/phy/mdio-sun4i.c
++++ b/drivers/net/phy/mdio-sun4i.c
+@@ -118,8 +118,10 @@ static int sun4i_mdio_probe(struct platform_device *pdev)
+ 
+ 	data->regulator = devm_regulator_get(&pdev->dev, "phy");
+ 	if (IS_ERR(data->regulator)) {
+-		if (PTR_ERR(data->regulator) == -EPROBE_DEFER)
+-			return -EPROBE_DEFER;
++		if (PTR_ERR(data->regulator) == -EPROBE_DEFER) {
++			ret = -EPROBE_DEFER;
++			goto err_out_free_mdiobus;
++		}
+ 
+ 		dev_info(&pdev->dev, "no regulator found\n");
+ 		data->regulator = NULL;
+diff --git a/drivers/net/phy/mdio-xgene.c b/drivers/net/phy/mdio-xgene.c
+index 92af182951be..8eb077b677f6 100644
+--- a/drivers/net/phy/mdio-xgene.c
++++ b/drivers/net/phy/mdio-xgene.c
+@@ -197,8 +197,11 @@ static int xgene_mdio_reset(struct xgene_mdio_pdata *pdata)
+ 	}
+ 
+ 	ret = xgene_enet_ecc_init(pdata);
+-	if (ret)
++	if (ret) {
++		if (pdata->dev->of_node)
++			clk_disable_unprepare(pdata->clk);
+ 		return ret;
++	}
+ 	xgene_gmac_reset(pdata);
+ 
+ 	return 0;
+@@ -364,8 +367,10 @@ static int xgene_mdio_probe(struct platform_device *pdev)
+ 		return ret;
+ 
+ 	mdio_bus = mdiobus_alloc();
+-	if (!mdio_bus)
+-		return -ENOMEM;
++	if (!mdio_bus) {
++		ret = -ENOMEM;
++		goto out_clk;
++	}
+ 
+ 	mdio_bus->name = "APM X-Gene MDIO bus";
+ 
+@@ -394,7 +399,7 @@ static int xgene_mdio_probe(struct platform_device *pdev)
+ 		mdio_bus->phy_mask = ~0;
+ 		ret = mdiobus_register(mdio_bus);
+ 		if (ret)
+-			goto out;
++			goto out_mdiobus;
+ 
+ 		acpi_walk_namespace(ACPI_TYPE_DEVICE, ACPI_HANDLE(dev), 1,
+ 				    acpi_register_phy, NULL, mdio_bus, NULL);
+@@ -402,16 +407,20 @@ static int xgene_mdio_probe(struct platform_device *pdev)
+ 	}
+ 
+ 	if (ret)
+-		goto out;
++		goto out_mdiobus;
+ 
+ 	pdata->mdio_bus = mdio_bus;
+ 	xgene_mdio_status = true;
+ 
+ 	return 0;
+ 
+-out:
++out_mdiobus:
+ 	mdiobus_free(mdio_bus);
+ 
++out_clk:
++	if (dev->of_node)
++		clk_disable_unprepare(pdata->clk);
++
+ 	return ret;
+ }
+ 
+diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
+index e1e5e8438457..a30d6a6dbd95 100644
+--- a/drivers/net/usb/qmi_wwan.c
++++ b/drivers/net/usb/qmi_wwan.c
+@@ -805,6 +805,7 @@ static const struct usb_device_id products[] = {
+ 	{QMI_FIXED_INTF(0x05c6, 0x9084, 4)},
+ 	{QMI_FIXED_INTF(0x05c6, 0x920d, 0)},
+ 	{QMI_FIXED_INTF(0x05c6, 0x920d, 5)},
++	{QMI_QUIRK_SET_DTR(0x05c6, 0x9625, 4)},	/* YUGA CLM920-NC5 */
+ 	{QMI_FIXED_INTF(0x0846, 0x68a2, 8)},
+ 	{QMI_FIXED_INTF(0x12d1, 0x140c, 1)},	/* Huawei E173 */
+ 	{QMI_FIXED_INTF(0x12d1, 0x14ac, 1)},	/* Huawei E1820 */
+@@ -914,6 +915,7 @@ static const struct usb_device_id products[] = {
+ 	{QMI_FIXED_INTF(0x2357, 0x9000, 4)},	/* TP-LINK MA260 */
+ 	{QMI_QUIRK_SET_DTR(0x1bc7, 0x1040, 2)},	/* Telit LE922A */
+ 	{QMI_FIXED_INTF(0x1bc7, 0x1100, 3)},	/* Telit ME910 */
++	{QMI_FIXED_INTF(0x1bc7, 0x1101, 3)},	/* Telit ME910 dual modem */
+ 	{QMI_FIXED_INTF(0x1bc7, 0x1200, 5)},	/* Telit LE920 */
+ 	{QMI_FIXED_INTF(0x1bc7, 0x1201, 2)},	/* Telit LE920 */
+ 	{QMI_FIXED_INTF(0x1c9e, 0x9b01, 3)},	/* XS Stick W100-2 from 4G Systems */
+diff --git a/drivers/net/wireless/mac80211_hwsim.c b/drivers/net/wireless/mac80211_hwsim.c
+index 4b462dc21c41..61e85eac706a 100644
+--- a/drivers/net/wireless/mac80211_hwsim.c
++++ b/drivers/net/wireless/mac80211_hwsim.c
+@@ -3154,7 +3154,7 @@ static int hwsim_get_radio_nl(struct sk_buff *msg, struct genl_info *info)
+ 		if (!net_eq(wiphy_net(data->hw->wiphy), genl_info_net(info)))
+ 			continue;
+ 
+-		skb = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
++		skb = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
+ 		if (!skb) {
+ 			res = -ENOMEM;
+ 			goto out_err;
+diff --git a/drivers/net/xen-netfront.c b/drivers/net/xen-netfront.c
+index 1a9dadf7b3cc..b09c81e882b4 100644
+--- a/drivers/net/xen-netfront.c
++++ b/drivers/net/xen-netfront.c
+@@ -1345,6 +1345,7 @@ static struct net_device *xennet_create_dev(struct xenbus_device *dev)
+ 
+ 	netif_carrier_off(netdev);
+ 
++	xenbus_switch_state(dev, XenbusStateInitialising);
+ 	return netdev;
+ 
+  exit:
+diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c
+index 719ee5fb2626..ad9d82eb2aed 100644
+--- a/drivers/nvme/host/core.c
++++ b/drivers/nvme/host/core.c
+@@ -1204,7 +1204,8 @@ static void nvme_set_queue_limits(struct nvme_ctrl *ctrl,
+ 		blk_queue_max_hw_sectors(q, ctrl->max_hw_sectors);
+ 		blk_queue_max_segments(q, min_t(u32, max_segments, USHRT_MAX));
+ 	}
+-	if (ctrl->quirks & NVME_QUIRK_STRIPE_SIZE)
++	if ((ctrl->quirks & NVME_QUIRK_STRIPE_SIZE) &&
++	    is_power_of_2(ctrl->max_hw_sectors))
+ 		blk_queue_chunk_sectors(q, ctrl->max_hw_sectors);
+ 	blk_queue_virt_boundary(q, ctrl->page_size - 1);
+ 	if (ctrl->vwc & NVME_CTRL_VWC_PRESENT)
+diff --git a/drivers/s390/block/dasd_3990_erp.c b/drivers/s390/block/dasd_3990_erp.c
+index 8305ab688d57..a20dc2940d2d 100644
+--- a/drivers/s390/block/dasd_3990_erp.c
++++ b/drivers/s390/block/dasd_3990_erp.c
+@@ -2755,6 +2755,16 @@ dasd_3990_erp_action(struct dasd_ccw_req * cqr)
+ 		erp = dasd_3990_erp_handle_match_erp(cqr, erp);
+ 	}
+ 
++
++	/*
++	 * For path verification work we need to stick with the path that was
++	 * originally chosen so that the per path configuration data is
++	 * assigned correctly.
++	 */
++	if (test_bit(DASD_CQR_VERIFY_PATH, &erp->flags) && cqr->lpm) {
++		erp->lpm = cqr->lpm;
++	}
++
+ 	if (device->features & DASD_FEATURE_ERPLOG) {
+ 		/* print current erp_chain */
+ 		dev_err(&device->cdev->dev,
+diff --git a/drivers/scsi/storvsc_drv.c b/drivers/scsi/storvsc_drv.c
+index 2bf96d33428a..0dd1984e381e 100644
+--- a/drivers/scsi/storvsc_drv.c
++++ b/drivers/scsi/storvsc_drv.c
+@@ -915,10 +915,11 @@ static void storvsc_handle_error(struct vmscsi_request *vm_srb,
+ 		case TEST_UNIT_READY:
+ 			break;
+ 		default:
+-			set_host_byte(scmnd, DID_TARGET_FAILURE);
++			set_host_byte(scmnd, DID_ERROR);
+ 		}
+ 		break;
+ 	case SRB_STATUS_INVALID_LUN:
++		set_host_byte(scmnd, DID_NO_CONNECT);
+ 		do_work = true;
+ 		process_err_fn = storvsc_remove_lun;
+ 		break;
+diff --git a/drivers/spi/spi-atmel.c b/drivers/spi/spi-atmel.c
+index 8feac599e9ab..44be6b593b30 100644
+--- a/drivers/spi/spi-atmel.c
++++ b/drivers/spi/spi-atmel.c
+@@ -1669,12 +1669,12 @@ static int atmel_spi_remove(struct platform_device *pdev)
+ 	pm_runtime_get_sync(&pdev->dev);
+ 
+ 	/* reset the hardware and block queue progress */
+-	spin_lock_irq(&as->lock);
+ 	if (as->use_dma) {
+ 		atmel_spi_stop_dma(as);
+ 		atmel_spi_release_dma(as);
+ 	}
+ 
++	spin_lock_irq(&as->lock);
+ 	spi_writel(as, CR, SPI_BIT(SWRST));
+ 	spi_writel(as, CR, SPI_BIT(SWRST)); /* AT91SAM9263 Rev B workaround */
+ 	spi_readl(as, SR);
+diff --git a/drivers/xen/gntdev.c b/drivers/xen/gntdev.c
+index 79b8ab4c6663..910b5d40c6e9 100644
+--- a/drivers/xen/gntdev.c
++++ b/drivers/xen/gntdev.c
+@@ -378,10 +378,8 @@ static int unmap_grant_pages(struct grant_map *map, int offset, int pages)
+ 		}
+ 		range = 0;
+ 		while (range < pages) {
+-			if (map->unmap_ops[offset+range].handle == -1) {
+-				range--;
++			if (map->unmap_ops[offset+range].handle == -1)
+ 				break;
+-			}
+ 			range++;
+ 		}
+ 		err = __unmap_grant_pages(map, offset, range);
+@@ -1079,8 +1077,10 @@ static int gntdev_mmap(struct file *flip, struct vm_area_struct *vma)
+ out_unlock_put:
+ 	mutex_unlock(&priv->lock);
+ out_put_map:
+-	if (use_ptemod)
++	if (use_ptemod) {
+ 		map->vma = NULL;
++		unmap_grant_pages(map, 0, map->count);
++	}
+ 	gntdev_put_map(priv, map);
+ 	return err;
+ }
+diff --git a/fs/f2fs/extent_cache.c b/fs/f2fs/extent_cache.c
+index 7b32ce979fe1..63e519658d73 100644
+--- a/fs/f2fs/extent_cache.c
++++ b/fs/f2fs/extent_cache.c
+@@ -177,7 +177,7 @@ static void __drop_largest_extent(struct inode *inode,
+ }
+ 
+ /* return true, if inode page is changed */
+-bool f2fs_init_extent_tree(struct inode *inode, struct f2fs_extent *i_ext)
++static bool __f2fs_init_extent_tree(struct inode *inode, struct f2fs_extent *i_ext)
+ {
+ 	struct f2fs_sb_info *sbi = F2FS_I_SB(inode);
+ 	struct extent_tree *et;
+@@ -215,6 +215,16 @@ bool f2fs_init_extent_tree(struct inode *inode, struct f2fs_extent *i_ext)
+ 	return false;
+ }
+ 
++bool f2fs_init_extent_tree(struct inode *inode, struct f2fs_extent *i_ext)
++{
++	bool ret =  __f2fs_init_extent_tree(inode, i_ext);
++
++	if (!F2FS_I(inode)->extent_tree)
++		set_inode_flag(inode, FI_NO_EXTENT);
++
++	return ret;
++}
++
+ static bool f2fs_lookup_extent_tree(struct inode *inode, pgoff_t pgofs,
+ 							struct extent_info *ei)
+ {
+diff --git a/fs/super.c b/fs/super.c
+index 1058bf3e8724..7e9beab77259 100644
+--- a/fs/super.c
++++ b/fs/super.c
+@@ -519,7 +519,11 @@ struct super_block *sget_userns(struct file_system_type *type,
+ 	hlist_add_head(&s->s_instances, &type->fs_supers);
+ 	spin_unlock(&sb_lock);
+ 	get_filesystem(type);
+-	register_shrinker(&s->s_shrink);
++	err = register_shrinker(&s->s_shrink);
++	if (err) {
++		deactivate_locked_super(s);
++		s = ERR_PTR(err);
++	}
+ 	return s;
+ }
+ 
+diff --git a/fs/xfs/xfs_qm.c b/fs/xfs/xfs_qm.c
+index 1fdd3face2d9..e3edaa547216 100644
+--- a/fs/xfs/xfs_qm.c
++++ b/fs/xfs/xfs_qm.c
+@@ -47,7 +47,7 @@
+ STATIC int	xfs_qm_init_quotainos(xfs_mount_t *);
+ STATIC int	xfs_qm_init_quotainfo(xfs_mount_t *);
+ 
+-
++STATIC void	xfs_qm_destroy_quotainos(xfs_quotainfo_t *qi);
+ STATIC void	xfs_qm_dqfree_one(struct xfs_dquot *dqp);
+ /*
+  * We use the batch lookup interface to iterate over the dquots as it
+@@ -694,9 +694,17 @@ xfs_qm_init_quotainfo(
+ 	qinf->qi_shrinker.scan_objects = xfs_qm_shrink_scan;
+ 	qinf->qi_shrinker.seeks = DEFAULT_SEEKS;
+ 	qinf->qi_shrinker.flags = SHRINKER_NUMA_AWARE;
+-	register_shrinker(&qinf->qi_shrinker);
++
++	error = register_shrinker(&qinf->qi_shrinker);
++	if (error)
++		goto out_free_inos;
++
+ 	return 0;
+ 
++out_free_inos:
++	mutex_destroy(&qinf->qi_quotaofflock);
++	mutex_destroy(&qinf->qi_tree_lock);
++	xfs_qm_destroy_quotainos(qinf);
+ out_free_lru:
+ 	list_lru_destroy(&qinf->qi_lru);
+ out_free_qinf:
+@@ -705,7 +713,6 @@ xfs_qm_init_quotainfo(
+ 	return error;
+ }
+ 
+-
+ /*
+  * Gets called when unmounting a filesystem or when all quotas get
+  * turned off.
+@@ -722,19 +729,8 @@ xfs_qm_destroy_quotainfo(
+ 
+ 	unregister_shrinker(&qi->qi_shrinker);
+ 	list_lru_destroy(&qi->qi_lru);
+-
+-	if (qi->qi_uquotaip) {
+-		IRELE(qi->qi_uquotaip);
+-		qi->qi_uquotaip = NULL; /* paranoia */
+-	}
+-	if (qi->qi_gquotaip) {
+-		IRELE(qi->qi_gquotaip);
+-		qi->qi_gquotaip = NULL;
+-	}
+-	if (qi->qi_pquotaip) {
+-		IRELE(qi->qi_pquotaip);
+-		qi->qi_pquotaip = NULL;
+-	}
++	xfs_qm_destroy_quotainos(qi);
++	mutex_destroy(&qi->qi_tree_lock);
+ 	mutex_destroy(&qi->qi_quotaofflock);
+ 	kmem_free(qi);
+ 	mp->m_quotainfo = NULL;
+@@ -1619,6 +1615,24 @@ xfs_qm_init_quotainos(
+ 	return error;
+ }
+ 
++STATIC void
++xfs_qm_destroy_quotainos(
++	xfs_quotainfo_t	*qi)
++{
++	if (qi->qi_uquotaip) {
++		IRELE(qi->qi_uquotaip);
++		qi->qi_uquotaip = NULL; /* paranoia */
++	}
++	if (qi->qi_gquotaip) {
++		IRELE(qi->qi_gquotaip);
++		qi->qi_gquotaip = NULL;
++	}
++	if (qi->qi_pquotaip) {
++		IRELE(qi->qi_pquotaip);
++		qi->qi_pquotaip = NULL;
++	}
++}
++
+ STATIC void
+ xfs_qm_dqfree_one(
+ 	struct xfs_dquot	*dqp)
+diff --git a/include/uapi/linux/libc-compat.h b/include/uapi/linux/libc-compat.h
+index 44b8a6bd5fe1..774cb2db1b89 100644
+--- a/include/uapi/linux/libc-compat.h
++++ b/include/uapi/linux/libc-compat.h
+@@ -167,46 +167,99 @@
+ 
+ /* If we did not see any headers from any supported C libraries,
+  * or we are being included in the kernel, then define everything
+- * that we need. */
++ * that we need. Check for previous __UAPI_* definitions to give
++ * unsupported C libraries a way to opt out of any kernel definition. */
+ #else /* !defined(__GLIBC__) */
+ 
+ /* Definitions for if.h */
++#ifndef __UAPI_DEF_IF_IFCONF
+ #define __UAPI_DEF_IF_IFCONF 1
++#endif
++#ifndef __UAPI_DEF_IF_IFMAP
+ #define __UAPI_DEF_IF_IFMAP 1
++#endif
++#ifndef __UAPI_DEF_IF_IFNAMSIZ
+ #define __UAPI_DEF_IF_IFNAMSIZ 1
++#endif
++#ifndef __UAPI_DEF_IF_IFREQ
+ #define __UAPI_DEF_IF_IFREQ 1
++#endif
+ /* Everything up to IFF_DYNAMIC, matches net/if.h until glibc 2.23 */
++#ifndef __UAPI_DEF_IF_NET_DEVICE_FLAGS
+ #define __UAPI_DEF_IF_NET_DEVICE_FLAGS 1
++#endif
+ /* For the future if glibc adds IFF_LOWER_UP, IFF_DORMANT and IFF_ECHO */
++#ifndef __UAPI_DEF_IF_NET_DEVICE_FLAGS_LOWER_UP_DORMANT_ECHO
+ #define __UAPI_DEF_IF_NET_DEVICE_FLAGS_LOWER_UP_DORMANT_ECHO 1
++#endif
+ 
+ /* Definitions for in.h */
++#ifndef __UAPI_DEF_IN_ADDR
+ #define __UAPI_DEF_IN_ADDR		1
++#endif
++#ifndef __UAPI_DEF_IN_IPPROTO
+ #define __UAPI_DEF_IN_IPPROTO		1
++#endif
++#ifndef __UAPI_DEF_IN_PKTINFO
+ #define __UAPI_DEF_IN_PKTINFO		1
++#endif
++#ifndef __UAPI_DEF_IP_MREQ
+ #define __UAPI_DEF_IP_MREQ		1
++#endif
++#ifndef __UAPI_DEF_SOCKADDR_IN
+ #define __UAPI_DEF_SOCKADDR_IN		1
++#endif
++#ifndef __UAPI_DEF_IN_CLASS
+ #define __UAPI_DEF_IN_CLASS		1
++#endif
+ 
+ /* Definitions for in6.h */
++#ifndef __UAPI_DEF_IN6_ADDR
+ #define __UAPI_DEF_IN6_ADDR		1
++#endif
++#ifndef __UAPI_DEF_IN6_ADDR_ALT
+ #define __UAPI_DEF_IN6_ADDR_ALT		1
++#endif
++#ifndef __UAPI_DEF_SOCKADDR_IN6
+ #define __UAPI_DEF_SOCKADDR_IN6		1
++#endif
++#ifndef __UAPI_DEF_IPV6_MREQ
+ #define __UAPI_DEF_IPV6_MREQ		1
++#endif
++#ifndef __UAPI_DEF_IPPROTO_V6
+ #define __UAPI_DEF_IPPROTO_V6		1
++#endif
++#ifndef __UAPI_DEF_IPV6_OPTIONS
+ #define __UAPI_DEF_IPV6_OPTIONS		1
++#endif
++#ifndef __UAPI_DEF_IN6_PKTINFO
+ #define __UAPI_DEF_IN6_PKTINFO		1
++#endif
++#ifndef __UAPI_DEF_IP6_MTUINFO
+ #define __UAPI_DEF_IP6_MTUINFO		1
++#endif
+ 
+ /* Definitions for ipx.h */
++#ifndef __UAPI_DEF_SOCKADDR_IPX
+ #define __UAPI_DEF_SOCKADDR_IPX			1
++#endif
++#ifndef __UAPI_DEF_IPX_ROUTE_DEFINITION
+ #define __UAPI_DEF_IPX_ROUTE_DEFINITION		1
++#endif
++#ifndef __UAPI_DEF_IPX_INTERFACE_DEFINITION
+ #define __UAPI_DEF_IPX_INTERFACE_DEFINITION	1
++#endif
++#ifndef __UAPI_DEF_IPX_CONFIG_DATA
+ #define __UAPI_DEF_IPX_CONFIG_DATA		1
++#endif
++#ifndef __UAPI_DEF_IPX_ROUTE_DEF
+ #define __UAPI_DEF_IPX_ROUTE_DEF		1
++#endif
+ 
+ /* Definitions for xattr.h */
++#ifndef __UAPI_DEF_XATTR
+ #define __UAPI_DEF_XATTR		1
++#endif
+ 
+ #endif /* __GLIBC__ */
+ 
+diff --git a/kernel/irq/debug.h b/kernel/irq/debug.h
+index e75e29e4434a..3514d955af94 100644
+--- a/kernel/irq/debug.h
++++ b/kernel/irq/debug.h
+@@ -11,6 +11,11 @@
+ 
+ static inline void print_irq_desc(unsigned int irq, struct irq_desc *desc)
+ {
++	static DEFINE_RATELIMIT_STATE(ratelimit, 5 * HZ, 5);
++
++	if (!__ratelimit(&ratelimit))
++		return;
++
+ 	printk("irq %d, desc: %p, depth: %d, count: %d, unhandled: %d\n",
+ 		irq, desc, desc->depth, desc->irq_count, desc->irqs_unhandled);
+ 	printk("->handle_irq():  %p, ", desc->handle_irq);
+diff --git a/kernel/time/hrtimer.c b/kernel/time/hrtimer.c
+index 54fd2fed36e9..c93729661be0 100644
+--- a/kernel/time/hrtimer.c
++++ b/kernel/time/hrtimer.c
+@@ -1134,7 +1134,12 @@ static void __hrtimer_init(struct hrtimer *timer, clockid_t clock_id,
+ 
+ 	cpu_base = raw_cpu_ptr(&hrtimer_bases);
+ 
+-	if (clock_id == CLOCK_REALTIME && mode != HRTIMER_MODE_ABS)
++	/*
++	 * POSIX magic: Relative CLOCK_REALTIME timers are not affected by
++	 * clock modifications, so they needs to become CLOCK_MONOTONIC to
++	 * ensure POSIX compliance.
++	 */
++	if (clock_id == CLOCK_REALTIME && mode & HRTIMER_MODE_REL)
+ 		clock_id = CLOCK_MONOTONIC;
+ 
+ 	base = hrtimer_clockid_to_base(clock_id);
+diff --git a/lib/mpi/longlong.h b/lib/mpi/longlong.h
+index 93336502af08..0f64fcee4ccd 100644
+--- a/lib/mpi/longlong.h
++++ b/lib/mpi/longlong.h
+@@ -671,7 +671,23 @@ do {						\
+ 	**************  MIPS/64  **************
+ 	***************************************/
+ #if (defined(__mips) && __mips >= 3) && W_TYPE_SIZE == 64
+-#if (__GNUC__ >= 5) || (__GNUC__ >= 4 && __GNUC_MINOR__ >= 4)
++#if defined(__mips_isa_rev) && __mips_isa_rev >= 6
++/*
++ * GCC ends up emitting a __multi3 intrinsic call for MIPS64r6 with the plain C
++ * code below, so we special case MIPS64r6 until the compiler can do better.
++ */
++#define umul_ppmm(w1, w0, u, v)						\
++do {									\
++	__asm__ ("dmulu %0,%1,%2"					\
++		 : "=d" ((UDItype)(w0))					\
++		 : "d" ((UDItype)(u)),					\
++		   "d" ((UDItype)(v)));					\
++	__asm__ ("dmuhu %0,%1,%2"					\
++		 : "=d" ((UDItype)(w1))					\
++		 : "d" ((UDItype)(u)),					\
++		   "d" ((UDItype)(v)));					\
++} while (0)
++#elif (__GNUC__ >= 5) || (__GNUC__ >= 4 && __GNUC_MINOR__ >= 4)
+ #define umul_ppmm(w1, w0, u, v) \
+ do {									\
+ 	typedef unsigned int __ll_UTItype __attribute__((mode(TI)));	\
+diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c
+index 131e6aa954bc..a2fcf7bdb597 100644
+--- a/net/ipv6/ip6_tunnel.c
++++ b/net/ipv6/ip6_tunnel.c
+@@ -1127,8 +1127,13 @@ int ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev, __u8 dsfield,
+ 		max_headroom += 8;
+ 		mtu -= 8;
+ 	}
+-	if (mtu < IPV6_MIN_MTU)
+-		mtu = IPV6_MIN_MTU;
++	if (skb->protocol == htons(ETH_P_IPV6)) {
++		if (mtu < IPV6_MIN_MTU)
++			mtu = IPV6_MIN_MTU;
++	} else if (mtu < 576) {
++		mtu = 576;
++	}
++
+ 	if (skb_dst(skb) && !t->parms.collect_md)
+ 		skb_dst(skb)->ops->update_pmtu(skb_dst(skb), NULL, skb, mtu);
+ 	if (skb->len - t->tun_hlen - eth_hlen > mtu && !skb_is_gso(skb)) {
+diff --git a/net/ipv6/route.c b/net/ipv6/route.c
+index 6e8bacb0b458..a8f80bd20c55 100644
+--- a/net/ipv6/route.c
++++ b/net/ipv6/route.c
+@@ -1651,6 +1651,7 @@ struct dst_entry *icmp6_dst_alloc(struct net_device *dev,
+ 	}
+ 
+ 	rt->dst.flags |= DST_HOST;
++	rt->dst.input = ip6_input;
+ 	rt->dst.output  = ip6_output;
+ 	atomic_set(&rt->dst.__refcnt, 1);
+ 	rt->rt6i_gateway  = fl6->daddr;
+diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
+index 439e597fd374..404284a14d75 100644
+--- a/net/mac80211/rx.c
++++ b/net/mac80211/rx.c
+@@ -3611,6 +3611,8 @@ static bool ieee80211_accept_frame(struct ieee80211_rx_data *rx)
+ 		}
+ 		return true;
+ 	case NL80211_IFTYPE_MESH_POINT:
++		if (ether_addr_equal(sdata->vif.addr, hdr->addr2))
++			return false;
+ 		if (multicast)
+ 			return true;
+ 		return ether_addr_equal(sdata->vif.addr, hdr->addr1);
+diff --git a/net/sctp/socket.c b/net/sctp/socket.c
+index fd5b9d573b38..8cdd6bbe2efa 100644
+--- a/net/sctp/socket.c
++++ b/net/sctp/socket.c
+@@ -4765,7 +4765,7 @@ static int sctp_getsockopt_autoclose(struct sock *sk, int len, char __user *optv
+ 	len = sizeof(int);
+ 	if (put_user(len, optlen))
+ 		return -EFAULT;
+-	if (copy_to_user(optval, &sctp_sk(sk)->autoclose, sizeof(int)))
++	if (copy_to_user(optval, &sctp_sk(sk)->autoclose, len))
+ 		return -EFAULT;
+ 	return 0;
+ }
+@@ -5342,6 +5342,9 @@ static int sctp_getsockopt_local_addrs(struct sock *sk, int len,
+ 		err = -EFAULT;
+ 		goto out;
+ 	}
++	/* XXX: We should have accounted for sizeof(struct sctp_getaddrs) too,
++	 * but we can't change it anymore.
++	 */
+ 	if (put_user(bytes_copied, optlen))
+ 		err = -EFAULT;
+ out:
+@@ -5778,7 +5781,7 @@ static int sctp_getsockopt_maxseg(struct sock *sk, int len,
+ 		params.assoc_id = 0;
+ 	} else if (len >= sizeof(struct sctp_assoc_value)) {
+ 		len = sizeof(struct sctp_assoc_value);
+-		if (copy_from_user(&params, optval, sizeof(params)))
++		if (copy_from_user(&params, optval, len))
+ 			return -EFAULT;
+ 	} else
+ 		return -EINVAL;
+@@ -5947,7 +5950,9 @@ static int sctp_getsockopt_active_key(struct sock *sk, int len,
+ 
+ 	if (len < sizeof(struct sctp_authkeyid))
+ 		return -EINVAL;
+-	if (copy_from_user(&val, optval, sizeof(struct sctp_authkeyid)))
++
++	len = sizeof(struct sctp_authkeyid);
++	if (copy_from_user(&val, optval, len))
+ 		return -EFAULT;
+ 
+ 	asoc = sctp_id2assoc(sk, val.scact_assoc_id);
+@@ -5959,7 +5964,6 @@ static int sctp_getsockopt_active_key(struct sock *sk, int len,
+ 	else
+ 		val.scact_keynumber = ep->active_key_id;
+ 
+-	len = sizeof(struct sctp_authkeyid);
+ 	if (put_user(len, optlen))
+ 		return -EFAULT;
+ 	if (copy_to_user(optval, &val, len))
+@@ -5985,7 +5989,7 @@ static int sctp_getsockopt_peer_auth_chunks(struct sock *sk, int len,
+ 	if (len < sizeof(struct sctp_authchunks))
+ 		return -EINVAL;
+ 
+-	if (copy_from_user(&val, optval, sizeof(struct sctp_authchunks)))
++	if (copy_from_user(&val, optval, sizeof(val)))
+ 		return -EFAULT;
+ 
+ 	to = p->gauth_chunks;
+@@ -6030,7 +6034,7 @@ static int sctp_getsockopt_local_auth_chunks(struct sock *sk, int len,
+ 	if (len < sizeof(struct sctp_authchunks))
+ 		return -EINVAL;
+ 
+-	if (copy_from_user(&val, optval, sizeof(struct sctp_authchunks)))
++	if (copy_from_user(&val, optval, sizeof(val)))
+ 		return -EFAULT;
+ 
+ 	to = p->gauth_chunks;
+diff --git a/net/tipc/bearer.c b/net/tipc/bearer.c
+index 52d74760fb68..ca68db207965 100644
+--- a/net/tipc/bearer.c
++++ b/net/tipc/bearer.c
+@@ -322,6 +322,7 @@ static int tipc_enable_bearer(struct net *net, const char *name,
+ 	if (res) {
+ 		pr_warn("Bearer <%s> rejected, enable failure (%d)\n",
+ 			name, -res);
++		kfree(b);
+ 		return -EINVAL;
+ 	}
+ 
+@@ -345,8 +346,10 @@ static int tipc_enable_bearer(struct net *net, const char *name,
+ 	if (skb)
+ 		tipc_bearer_xmit_skb(net, bearer_id, skb, &b->bcast_addr);
+ 
+-	if (tipc_mon_create(net, bearer_id))
++	if (tipc_mon_create(net, bearer_id)) {
++		bearer_disable(net, b);
+ 		return -ENOMEM;
++	}
+ 
+ 	pr_info("Enabled bearer <%s>, discovery domain %s, priority %u\n",
+ 		name,
+diff --git a/net/tipc/monitor.c b/net/tipc/monitor.c
+index 9e109bb1a207..0fcfb3916dcf 100644
+--- a/net/tipc/monitor.c
++++ b/net/tipc/monitor.c
+@@ -633,9 +633,13 @@ void tipc_mon_delete(struct net *net, int bearer_id)
+ {
+ 	struct tipc_net *tn = tipc_net(net);
+ 	struct tipc_monitor *mon = tipc_monitor(net, bearer_id);
+-	struct tipc_peer *self = get_self(net, bearer_id);
++	struct tipc_peer *self;
+ 	struct tipc_peer *peer, *tmp;
+ 
++	if (!mon)
++		return;
++
++	self = get_self(net, bearer_id);
+ 	write_lock_bh(&mon->lock);
+ 	tn->monitors[bearer_id] = NULL;
+ 	list_for_each_entry_safe(peer, tmp, &self->list, list) {
+diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
+index 91722e97cdd5..a89061d59c74 100644
+--- a/net/wireless/nl80211.c
++++ b/net/wireless/nl80211.c
+@@ -10777,7 +10777,8 @@ static int nl80211_nan_add_func(struct sk_buff *skb,
+ 		break;
+ 	case NL80211_NAN_FUNC_FOLLOW_UP:
+ 		if (!tb[NL80211_NAN_FUNC_FOLLOW_UP_ID] ||
+-		    !tb[NL80211_NAN_FUNC_FOLLOW_UP_REQ_ID]) {
++		    !tb[NL80211_NAN_FUNC_FOLLOW_UP_REQ_ID] ||
++		    !tb[NL80211_NAN_FUNC_FOLLOW_UP_DEST]) {
+ 			err = -EINVAL;
+ 			goto out;
+ 		}
+diff --git a/sound/soc/codecs/nau8825.c b/sound/soc/codecs/nau8825.c
+index f9f2737c4ad2..a4871c4adcb0 100644
+--- a/sound/soc/codecs/nau8825.c
++++ b/sound/soc/codecs/nau8825.c
+@@ -882,6 +882,7 @@ static int nau8825_adc_event(struct snd_soc_dapm_widget *w,
+ 
+ 	switch (event) {
+ 	case SND_SOC_DAPM_POST_PMU:
++		msleep(125);
+ 		regmap_update_bits(nau8825->regmap, NAU8825_REG_ENA_CTRL,
+ 			NAU8825_ENABLE_ADC, NAU8825_ENABLE_ADC);
+ 		break;