diff -druNp --no-dereference linux-libre-4.9.208-gnu/arch/arm/boot/dts/am437x-gp-evm.dts linux-libre-4.9.209-gnu/arch/arm/boot/dts/am437x-gp-evm.dts
--- linux-libre-4.9.208-gnu/arch/arm/boot/dts/am437x-gp-evm.dts	2020-01-04 07:41:15.000000000 -0500
+++ linux-libre-4.9.209-gnu/arch/arm/boot/dts/am437x-gp-evm.dts	2020-01-12 05:24:28.000000000 -0500
@@ -79,7 +79,7 @@
 		};
 
 	lcd0: display {
-		compatible = "osddisplays,osd057T0559-34ts", "panel-dpi";
+		compatible = "osddisplays,osd070t1718-19ts", "panel-dpi";
 		label = "lcd";
 
 		panel-timing {
diff -druNp --no-dereference linux-libre-4.9.208-gnu/arch/arm/boot/dts/am43x-epos-evm.dts linux-libre-4.9.209-gnu/arch/arm/boot/dts/am43x-epos-evm.dts
--- linux-libre-4.9.208-gnu/arch/arm/boot/dts/am43x-epos-evm.dts	2020-01-04 07:41:15.000000000 -0500
+++ linux-libre-4.9.209-gnu/arch/arm/boot/dts/am43x-epos-evm.dts	2020-01-12 05:24:28.000000000 -0500
@@ -41,7 +41,7 @@
 	};
 
 	lcd0: display {
-		compatible = "osddisplays,osd057T0559-34ts", "panel-dpi";
+		compatible = "osddisplays,osd070t1718-19ts", "panel-dpi";
 		label = "lcd";
 
 		panel-timing {
diff -druNp --no-dereference linux-libre-4.9.208-gnu/arch/arm/mach-vexpress/spc.c linux-libre-4.9.209-gnu/arch/arm/mach-vexpress/spc.c
--- linux-libre-4.9.208-gnu/arch/arm/mach-vexpress/spc.c	2020-01-04 07:41:15.000000000 -0500
+++ linux-libre-4.9.209-gnu/arch/arm/mach-vexpress/spc.c	2020-01-12 05:24:28.000000000 -0500
@@ -555,8 +555,9 @@ static struct clk *ve_spc_clk_register(s
 
 static int __init ve_spc_clk_init(void)
 {
-	int cpu;
+	int cpu, cluster;
 	struct clk *clk;
+	bool init_opp_table[MAX_CLUSTERS] = { false };
 
 	if (!info)
 		return 0; /* Continue only if SPC is initialised */
@@ -582,8 +583,17 @@ static int __init ve_spc_clk_init(void)
 			continue;
 		}
 
+		cluster = topology_physical_package_id(cpu_dev->id);
+		if (init_opp_table[cluster])
+			continue;
+
 		if (ve_init_opp_table(cpu_dev))
 			pr_warn("failed to initialise cpu%d opp table\n", cpu);
+		else if (dev_pm_opp_set_sharing_cpus(cpu_dev,
+			 topology_core_cpumask(cpu_dev->id)))
+			pr_warn("failed to mark OPPs shared for cpu%d\n", cpu);
+		else
+			init_opp_table[cluster] = true;
 	}
 
 	platform_device_register_simple("vexpress-spc-cpufreq", -1, NULL, 0);
diff -druNp --no-dereference linux-libre-4.9.208-gnu/arch/arm64/include/asm/pgtable.h linux-libre-4.9.209-gnu/arch/arm64/include/asm/pgtable.h
--- linux-libre-4.9.208-gnu/arch/arm64/include/asm/pgtable.h	2020-01-04 07:41:15.000000000 -0500
+++ linux-libre-4.9.209-gnu/arch/arm64/include/asm/pgtable.h	2020-01-12 05:24:28.000000000 -0500
@@ -83,12 +83,8 @@ extern unsigned long empty_zero_page[PAG
 #define pte_dirty(pte)		(pte_sw_dirty(pte) || pte_hw_dirty(pte))
 
 #define pte_valid(pte)		(!!(pte_val(pte) & PTE_VALID))
-/*
- * Execute-only user mappings do not have the PTE_USER bit set. All valid
- * kernel mappings have the PTE_UXN bit set.
- */
 #define pte_valid_not_user(pte) \
-	((pte_val(pte) & (PTE_VALID | PTE_USER | PTE_UXN)) == (PTE_VALID | PTE_UXN))
+	((pte_val(pte) & (PTE_VALID | PTE_USER)) == PTE_VALID)
 #define pte_valid_young(pte) \
 	((pte_val(pte) & (PTE_VALID | PTE_AF)) == (PTE_VALID | PTE_AF))
 #define pte_valid_user(pte) \
@@ -104,8 +100,8 @@ extern unsigned long empty_zero_page[PAG
 
 /*
  * p??_access_permitted() is true for valid user mappings (subject to the
- * write permission check) other than user execute-only which do not have the
- * PTE_USER bit set. PROT_NONE mappings do not have the PTE_VALID bit set.
+ * write permission check). PROT_NONE mappings do not have the PTE_VALID bit
+ * set.
  */
 #define pte_access_permitted(pte, write) \
 	(pte_valid_user(pte) && (!(write) || pte_write(pte)))
diff -druNp --no-dereference linux-libre-4.9.208-gnu/arch/arm64/include/asm/pgtable-prot.h linux-libre-4.9.209-gnu/arch/arm64/include/asm/pgtable-prot.h
--- linux-libre-4.9.208-gnu/arch/arm64/include/asm/pgtable-prot.h	2020-01-04 07:41:15.000000000 -0500
+++ linux-libre-4.9.209-gnu/arch/arm64/include/asm/pgtable-prot.h	2020-01-12 05:24:28.000000000 -0500
@@ -77,13 +77,12 @@
 #define PAGE_COPY_EXEC		__pgprot(_PAGE_DEFAULT | PTE_USER | PTE_NG | PTE_PXN)
 #define PAGE_READONLY		__pgprot(_PAGE_DEFAULT | PTE_USER | PTE_NG | PTE_PXN | PTE_UXN)
 #define PAGE_READONLY_EXEC	__pgprot(_PAGE_DEFAULT | PTE_USER | PTE_NG | PTE_PXN)
-#define PAGE_EXECONLY		__pgprot(_PAGE_DEFAULT | PTE_NG | PTE_PXN)
 
 #define __P000  PAGE_NONE
 #define __P001  PAGE_READONLY
 #define __P010  PAGE_COPY
 #define __P011  PAGE_COPY
-#define __P100  PAGE_EXECONLY
+#define __P100  PAGE_READONLY_EXEC
 #define __P101  PAGE_READONLY_EXEC
 #define __P110  PAGE_COPY_EXEC
 #define __P111  PAGE_COPY_EXEC
@@ -92,7 +91,7 @@
 #define __S001  PAGE_READONLY
 #define __S010  PAGE_SHARED
 #define __S011  PAGE_SHARED
-#define __S100  PAGE_EXECONLY
+#define __S100  PAGE_READONLY_EXEC
 #define __S101  PAGE_READONLY_EXEC
 #define __S110  PAGE_SHARED_EXEC
 #define __S111  PAGE_SHARED_EXEC
diff -druNp --no-dereference linux-libre-4.9.208-gnu/arch/arm64/mm/fault.c linux-libre-4.9.209-gnu/arch/arm64/mm/fault.c
--- linux-libre-4.9.208-gnu/arch/arm64/mm/fault.c	2020-01-04 07:41:15.000000000 -0500
+++ linux-libre-4.9.209-gnu/arch/arm64/mm/fault.c	2020-01-12 05:24:28.000000000 -0500
@@ -319,7 +319,7 @@ static int __kprobes do_page_fault(unsig
 	struct task_struct *tsk;
 	struct mm_struct *mm;
 	int fault, sig, code;
-	unsigned long vm_flags = VM_READ | VM_WRITE;
+	unsigned long vm_flags = VM_READ | VM_WRITE | VM_EXEC;
 	unsigned int mm_flags = FAULT_FLAG_ALLOW_RETRY | FAULT_FLAG_KILLABLE;
 
 	if (notify_page_fault(regs, esr))
diff -druNp --no-dereference linux-libre-4.9.208-gnu/arch/mips/include/asm/thread_info.h linux-libre-4.9.209-gnu/arch/mips/include/asm/thread_info.h
--- linux-libre-4.9.208-gnu/arch/mips/include/asm/thread_info.h	2020-01-04 07:41:15.000000000 -0500
+++ linux-libre-4.9.209-gnu/arch/mips/include/asm/thread_info.h	2020-01-12 05:24:28.000000000 -0500
@@ -52,8 +52,26 @@ struct thread_info {
 #define init_thread_info	(init_thread_union.thread_info)
 #define init_stack		(init_thread_union.stack)
 
-/* How to get the thread information struct from C.  */
+/*
+ * A pointer to the struct thread_info for the currently executing thread is
+ * held in register $28/$gp.
+ *
+ * We declare __current_thread_info as a global register variable rather than a
+ * local register variable within current_thread_info() because clang doesn't
+ * support explicit local register variables.
+ *
+ * When building the VDSO we take care not to declare the global register
+ * variable because this causes GCC to not preserve the value of $28/$gp in
+ * functions that change its value (which is common in the PIC VDSO when
+ * accessing the GOT). Since the VDSO shouldn't be accessing
+ * __current_thread_info anyway we declare it extern in order to cause a link
+ * failure if it's referenced.
+ */
+#ifdef __VDSO__
+extern struct thread_info *__current_thread_info;
+#else
 register struct thread_info *__current_thread_info __asm__("$28");
+#endif
 
 static inline struct thread_info *current_thread_info(void)
 {
diff -druNp --no-dereference linux-libre-4.9.208-gnu/arch/parisc/include/asm/cmpxchg.h linux-libre-4.9.209-gnu/arch/parisc/include/asm/cmpxchg.h
--- linux-libre-4.9.208-gnu/arch/parisc/include/asm/cmpxchg.h	2020-01-04 07:41:15.000000000 -0500
+++ linux-libre-4.9.209-gnu/arch/parisc/include/asm/cmpxchg.h	2020-01-12 05:24:28.000000000 -0500
@@ -43,8 +43,14 @@ __xchg(unsigned long x, __volatile__ voi
 **		if (((unsigned long)p & 0xf) == 0)
 **			return __ldcw(p);
 */
-#define xchg(ptr, x) \
-	((__typeof__(*(ptr)))__xchg((unsigned long)(x), (ptr), sizeof(*(ptr))))
+#define xchg(ptr, x)							\
+({									\
+	__typeof__(*(ptr)) __ret;					\
+	__typeof__(*(ptr)) _x_ = (x);					\
+	__ret = (__typeof__(*(ptr)))					\
+		__xchg((unsigned long)_x_, (ptr), sizeof(*(ptr)));	\
+	__ret;								\
+})
 
 /* bug catcher for when unsupported size is used - won't link */
 extern void __cmpxchg_called_with_bad_pointer(void);
diff -druNp --no-dereference linux-libre-4.9.208-gnu/arch/powerpc/mm/mem.c linux-libre-4.9.209-gnu/arch/powerpc/mm/mem.c
--- linux-libre-4.9.208-gnu/arch/powerpc/mm/mem.c	2020-01-04 07:41:15.000000000 -0500
+++ linux-libre-4.9.209-gnu/arch/powerpc/mm/mem.c	2020-01-12 05:24:28.000000000 -0500
@@ -345,6 +345,14 @@ void __init mem_init(void)
 	BUILD_BUG_ON(MMU_PAGE_COUNT > 16);
 
 #ifdef CONFIG_SWIOTLB
+	/*
+	 * Some platforms (e.g. 85xx) limit DMA-able memory way below
+	 * 4G. We force memblock to bottom-up mode to ensure that the
+	 * memory allocated in swiotlb_init() is DMA-able.
+	 * As it's the last memblock allocation, no need to reset it
+	 * back to to-down.
+	 */
+	memblock_set_bottom_up(true);
 	swiotlb_init(0);
 #endif
 
diff -druNp --no-dereference linux-libre-4.9.208-gnu/arch/powerpc/platforms/pseries/hvconsole.c linux-libre-4.9.209-gnu/arch/powerpc/platforms/pseries/hvconsole.c
--- linux-libre-4.9.208-gnu/arch/powerpc/platforms/pseries/hvconsole.c	2020-01-04 07:41:15.000000000 -0500
+++ linux-libre-4.9.209-gnu/arch/powerpc/platforms/pseries/hvconsole.c	2020-01-12 05:24:28.000000000 -0500
@@ -62,7 +62,7 @@ EXPORT_SYMBOL(hvc_get_chars);
  * @vtermno: The vtermno or unit_address of the adapter from which the data
  *	originated.
  * @buf: The character buffer that contains the character data to send to
- *	firmware.
+ *	firmware. Must be at least 16 bytes, even if count is less than 16.
  * @count: Send this number of characters.
  */
 int hvc_put_chars(uint32_t vtermno, const char *buf, int count)
diff -druNp --no-dereference linux-libre-4.9.208-gnu/arch/s390/kernel/perf_cpum_sf.c linux-libre-4.9.209-gnu/arch/s390/kernel/perf_cpum_sf.c
--- linux-libre-4.9.208-gnu/arch/s390/kernel/perf_cpum_sf.c	2020-01-04 07:41:15.000000000 -0500
+++ linux-libre-4.9.209-gnu/arch/s390/kernel/perf_cpum_sf.c	2020-01-12 05:24:28.000000000 -0500
@@ -1295,18 +1295,28 @@ static void hw_perf_event_update(struct
 		 */
 		if (flush_all && done)
 			break;
-
-		/* If an event overflow happened, discard samples by
-		 * processing any remaining sample-data-blocks.
-		 */
-		if (event_overflow)
-			flush_all = 1;
 	}
 
 	/* Account sample overflows in the event hardware structure */
 	if (sampl_overflow)
 		OVERFLOW_REG(hwc) = DIV_ROUND_UP(OVERFLOW_REG(hwc) +
 						 sampl_overflow, 1 + num_sdb);
+
+	/* Perf_event_overflow() and perf_event_account_interrupt() limit
+	 * the interrupt rate to an upper limit. Roughly 1000 samples per
+	 * task tick.
+	 * Hitting this limit results in a large number
+	 * of throttled REF_REPORT_THROTTLE entries and the samples
+	 * are dropped.
+	 * Slightly increase the interval to avoid hitting this limit.
+	 */
+	if (event_overflow) {
+		SAMPL_RATE(hwc) += DIV_ROUND_UP(SAMPL_RATE(hwc), 10);
+		debug_sprintf_event(sfdbg, 1, "%s: rate adjustment %ld\n",
+				    __func__,
+				    DIV_ROUND_UP(SAMPL_RATE(hwc), 10));
+	}
+
 	if (sampl_overflow || event_overflow)
 		debug_sprintf_event(sfdbg, 4, "hw_perf_event_update: "
 				    "overflow stats: sample=%llu event=%llu\n",
diff -druNp --no-dereference linux-libre-4.9.208-gnu/arch/s390/kernel/smp.c linux-libre-4.9.209-gnu/arch/s390/kernel/smp.c
--- linux-libre-4.9.208-gnu/arch/s390/kernel/smp.c	2020-01-04 07:41:15.000000000 -0500
+++ linux-libre-4.9.209-gnu/arch/s390/kernel/smp.c	2020-01-12 05:24:28.000000000 -0500
@@ -691,39 +691,67 @@ static struct sclp_core_info *smp_get_co
 
 static int smp_add_present_cpu(int cpu);
 
-static int __smp_rescan_cpus(struct sclp_core_info *info, int sysfs_add)
+static int smp_add_core(struct sclp_core_entry *core, cpumask_t *avail,
+			bool configured, bool early)
 {
 	struct pcpu *pcpu;
-	cpumask_t avail;
-	int cpu, nr, i, j;
+	int cpu, nr, i;
 	u16 address;
 
 	nr = 0;
-	cpumask_xor(&avail, cpu_possible_mask, cpu_present_mask);
-	cpu = cpumask_first(&avail);
-	for (i = 0; (i < info->combined) && (cpu < nr_cpu_ids); i++) {
-		if (sclp.has_core_type && info->core[i].type != boot_core_type)
+	if (sclp.has_core_type && core->type != boot_core_type)
+		return nr;
+	cpu = cpumask_first(avail);
+	address = core->core_id << smp_cpu_mt_shift;
+	for (i = 0; (i <= smp_cpu_mtid) && (cpu < nr_cpu_ids); i++) {
+		if (pcpu_find_address(cpu_present_mask, address + i))
 			continue;
-		address = info->core[i].core_id << smp_cpu_mt_shift;
-		for (j = 0; j <= smp_cpu_mtid; j++) {
-			if (pcpu_find_address(cpu_present_mask, address + j))
-				continue;
-			pcpu = pcpu_devices + cpu;
-			pcpu->address = address + j;
-			pcpu->state =
-				(cpu >= info->configured*(smp_cpu_mtid + 1)) ?
-				CPU_STATE_STANDBY : CPU_STATE_CONFIGURED;
-			smp_cpu_set_polarization(cpu, POLARIZATION_UNKNOWN);
-			set_cpu_present(cpu, true);
-			if (sysfs_add && smp_add_present_cpu(cpu) != 0)
-				set_cpu_present(cpu, false);
-			else
-				nr++;
-			cpu = cpumask_next(cpu, &avail);
-			if (cpu >= nr_cpu_ids)
+		pcpu = pcpu_devices + cpu;
+		pcpu->address = address + i;
+		if (configured)
+			pcpu->state = CPU_STATE_CONFIGURED;
+		else
+			pcpu->state = CPU_STATE_STANDBY;
+		smp_cpu_set_polarization(cpu, POLARIZATION_UNKNOWN);
+		set_cpu_present(cpu, true);
+		if (!early && smp_add_present_cpu(cpu) != 0)
+			set_cpu_present(cpu, false);
+		else
+			nr++;
+		cpumask_clear_cpu(cpu, avail);
+		cpu = cpumask_next(cpu, avail);
+	}
+	return nr;
+}
+
+static int __smp_rescan_cpus(struct sclp_core_info *info, bool early)
+{
+	struct sclp_core_entry *core;
+	cpumask_t avail;
+	bool configured;
+	u16 core_id;
+	int nr, i;
+
+	nr = 0;
+	cpumask_xor(&avail, cpu_possible_mask, cpu_present_mask);
+	/*
+	 * Add IPL core first (which got logical CPU number 0) to make sure
+	 * that all SMT threads get subsequent logical CPU numbers.
+	 */
+	if (early) {
+		core_id = pcpu_devices[0].address >> smp_cpu_mt_shift;
+		for (i = 0; i < info->configured; i++) {
+			core = &info->core[i];
+			if (core->core_id == core_id) {
+				nr += smp_add_core(core, &avail, true, early);
 				break;
+			}
 		}
 	}
+	for (i = 0; i < info->combined; i++) {
+		configured = i < info->configured;
+		nr += smp_add_core(&info->core[i], &avail, configured, early);
+	}
 	return nr;
 }
 
@@ -771,7 +799,7 @@ static void __init smp_detect_cpus(void)
 
 	/* Add CPUs present at boot */
 	get_online_cpus();
-	__smp_rescan_cpus(info, 0);
+	__smp_rescan_cpus(info, true);
 	put_online_cpus();
 	kfree(info);
 }
@@ -1127,7 +1155,7 @@ int __ref smp_rescan_cpus(void)
 		return -ENOMEM;
 	get_online_cpus();
 	mutex_lock(&smp_cpu_state_mutex);
-	nr = __smp_rescan_cpus(info, 1);
+	nr = __smp_rescan_cpus(info, false);
 	mutex_unlock(&smp_cpu_state_mutex);
 	put_online_cpus();
 	kfree(info);
diff -druNp --no-dereference linux-libre-4.9.208-gnu/arch/tile/lib/atomic_asm_32.S linux-libre-4.9.209-gnu/arch/tile/lib/atomic_asm_32.S
--- linux-libre-4.9.208-gnu/arch/tile/lib/atomic_asm_32.S	2020-01-04 07:41:15.000000000 -0500
+++ linux-libre-4.9.209-gnu/arch/tile/lib/atomic_asm_32.S	2020-01-12 05:24:28.000000000 -0500
@@ -24,8 +24,7 @@
  * has an opportunity to return -EFAULT to the user if needed.
  * The 64-bit routines just return a "long long" with the value,
  * since they are only used from kernel space and don't expect to fault.
- * Support for 16-bit ops is included in the framework but we don't provide
- * any (x86_64 has an atomic_inc_short(), so we might want to some day).
+ * Support for 16-bit ops is included in the framework but we don't provide any.
  *
  * Note that the caller is advised to issue a suitable L1 or L2
  * prefetch on the address being manipulated to avoid extra stalls.
diff -druNp --no-dereference linux-libre-4.9.208-gnu/arch/x86/events/core.c linux-libre-4.9.209-gnu/arch/x86/events/core.c
--- linux-libre-4.9.208-gnu/arch/x86/events/core.c	2020-01-04 07:41:15.000000000 -0500
+++ linux-libre-4.9.209-gnu/arch/x86/events/core.c	2020-01-12 05:24:28.000000000 -0500
@@ -374,7 +374,7 @@ int x86_add_exclusive(unsigned int what)
 	 * LBR and BTS are still mutually exclusive.
 	 */
 	if (x86_pmu.lbr_pt_coexist && what == x86_lbr_exclusive_pt)
-		return 0;
+		goto out;
 
 	if (!atomic_inc_not_zero(&x86_pmu.lbr_exclusive[what])) {
 		mutex_lock(&pmc_reserve_mutex);
@@ -386,6 +386,7 @@ int x86_add_exclusive(unsigned int what)
 		mutex_unlock(&pmc_reserve_mutex);
 	}
 
+out:
 	atomic_inc(&active_events);
 	return 0;
 
@@ -396,11 +397,15 @@ fail_unlock:
 
 void x86_del_exclusive(unsigned int what)
 {
+	atomic_dec(&active_events);
+
+	/*
+	 * See the comment in x86_add_exclusive().
+	 */
 	if (x86_pmu.lbr_pt_coexist && what == x86_lbr_exclusive_pt)
 		return;
 
 	atomic_dec(&x86_pmu.lbr_exclusive[what]);
-	atomic_dec(&active_events);
 }
 
 int x86_setup_perfctr(struct perf_event *event)
diff -druNp --no-dereference linux-libre-4.9.208-gnu/arch/x86/include/asm/atomic.h linux-libre-4.9.209-gnu/arch/x86/include/asm/atomic.h
--- linux-libre-4.9.208-gnu/arch/x86/include/asm/atomic.h	2020-01-04 07:41:15.000000000 -0500
+++ linux-libre-4.9.209-gnu/arch/x86/include/asm/atomic.h	2020-01-12 05:24:28.000000000 -0500
@@ -249,19 +249,6 @@ static __always_inline int __atomic_add_
 	return c;
 }
 
-/**
- * atomic_inc_short - increment of a short integer
- * @v: pointer to type int
- *
- * Atomically adds 1 to @v
- * Returns the new value of @u
- */
-static __always_inline short int atomic_inc_short(short int *v)
-{
-	asm(LOCK_PREFIX "addw $1, %0" : "+m" (*v));
-	return *v;
-}
-
 #ifdef CONFIG_X86_32
 # include <asm/atomic64_32.h>
 #else
diff -druNp --no-dereference linux-libre-4.9.208-gnu/block/blk-map.c linux-libre-4.9.209-gnu/block/blk-map.c
--- linux-libre-4.9.208-gnu/block/blk-map.c	2020-01-04 07:41:15.000000000 -0500
+++ linux-libre-4.9.209-gnu/block/blk-map.c	2020-01-12 05:24:28.000000000 -0500
@@ -142,7 +142,7 @@ int blk_rq_map_user_iov(struct request_q
 	return 0;
 
 unmap_rq:
-	__blk_rq_unmap_user(bio);
+	blk_rq_unmap_user(bio);
 fail:
 	rq->bio = NULL;
 	return ret;
diff -druNp --no-dereference linux-libre-4.9.208-gnu/block/compat_ioctl.c linux-libre-4.9.209-gnu/block/compat_ioctl.c
--- linux-libre-4.9.208-gnu/block/compat_ioctl.c	2020-01-04 07:41:15.000000000 -0500
+++ linux-libre-4.9.209-gnu/block/compat_ioctl.c	2020-01-12 05:24:28.000000000 -0500
@@ -5,6 +5,7 @@
 #include <linux/compat.h>
 #include <linux/elevator.h>
 #include <linux/hdreg.h>
+#include <linux/pr.h>
 #include <linux/slab.h>
 #include <linux/syscalls.h>
 #include <linux/types.h>
@@ -406,6 +407,14 @@ long compat_blkdev_ioctl(struct file *fi
 	case BLKTRACETEARDOWN: /* compatible */
 		ret = blk_trace_ioctl(bdev, cmd, compat_ptr(arg));
 		return ret;
+	case IOC_PR_REGISTER:
+	case IOC_PR_RESERVE:
+	case IOC_PR_RELEASE:
+	case IOC_PR_PREEMPT:
+	case IOC_PR_PREEMPT_ABORT:
+	case IOC_PR_CLEAR:
+		return blkdev_ioctl(bdev, mode, cmd,
+				(unsigned long)compat_ptr(arg));
 	default:
 		if (disk->fops->compat_ioctl)
 			ret = disk->fops->compat_ioctl(bdev, mode, cmd, arg);
diff -druNp --no-dereference linux-libre-4.9.208-gnu/drivers/ata/ahci_brcm.c linux-libre-4.9.209-gnu/drivers/ata/ahci_brcm.c
--- linux-libre-4.9.208-gnu/drivers/ata/ahci_brcm.c	2020-01-04 07:41:15.000000000 -0500
+++ linux-libre-4.9.209-gnu/drivers/ata/ahci_brcm.c	2020-01-12 05:24:28.000000000 -0500
@@ -25,6 +25,7 @@
 #include <linux/module.h>
 #include <linux/of.h>
 #include <linux/platform_device.h>
+#include <linux/reset.h>
 #include <linux/string.h>
 
 #include "ahci.h"
@@ -88,6 +89,7 @@ struct brcm_ahci_priv {
 	u32 port_mask;
 	u32 quirks;
 	enum brcm_ahci_version version;
+	struct reset_control *rcdev;
 };
 
 static const struct ata_port_info ahci_brcm_port_info = {
@@ -226,19 +228,12 @@ static void brcm_sata_phys_disable(struc
 			brcm_sata_phy_disable(priv, i);
 }
 
-static u32 brcm_ahci_get_portmask(struct platform_device *pdev,
+static u32 brcm_ahci_get_portmask(struct ahci_host_priv *hpriv,
 				  struct brcm_ahci_priv *priv)
 {
-	void __iomem *ahci;
-	struct resource *res;
 	u32 impl;
 
-	res = platform_get_resource_byname(pdev, IORESOURCE_MEM, "ahci");
-	ahci = devm_ioremap_resource(&pdev->dev, res);
-	if (IS_ERR(ahci))
-		return 0;
-
-	impl = readl(ahci + HOST_PORTS_IMPL);
+	impl = readl(hpriv->mmio + HOST_PORTS_IMPL);
 
 	if (fls(impl) > SATA_TOP_MAX_PHYS)
 		dev_warn(priv->dev, "warning: more ports than PHYs (%#x)\n",
@@ -246,9 +241,6 @@ static u32 brcm_ahci_get_portmask(struct
 	else if (!impl)
 		dev_info(priv->dev, "no ports found\n");
 
-	devm_iounmap(&pdev->dev, ahci);
-	devm_release_mem_region(&pdev->dev, res->start, resource_size(res));
-
 	return impl;
 }
 
@@ -275,11 +267,10 @@ static int brcm_ahci_suspend(struct devi
 	struct ata_host *host = dev_get_drvdata(dev);
 	struct ahci_host_priv *hpriv = host->private_data;
 	struct brcm_ahci_priv *priv = hpriv->plat_data;
-	int ret;
 
-	ret = ahci_platform_suspend(dev);
 	brcm_sata_phys_disable(priv);
-	return ret;
+
+	return ahci_platform_suspend(dev);
 }
 
 static int brcm_ahci_resume(struct device *dev)
@@ -287,11 +278,44 @@ static int brcm_ahci_resume(struct devic
 	struct ata_host *host = dev_get_drvdata(dev);
 	struct ahci_host_priv *hpriv = host->private_data;
 	struct brcm_ahci_priv *priv = hpriv->plat_data;
+	int ret;
+
+	/* Make sure clocks are turned on before re-configuration */
+	ret = ahci_platform_enable_clks(hpriv);
+	if (ret)
+		return ret;
 
 	brcm_sata_init(priv);
 	brcm_sata_phys_enable(priv);
 	brcm_sata_alpm_init(hpriv);
-	return ahci_platform_resume(dev);
+
+	/* Since we had to enable clocks earlier on, we cannot use
+	 * ahci_platform_resume() as-is since a second call to
+	 * ahci_platform_enable_resources() would bump up the resources
+	 * (regulators, clocks, PHYs) count artificially so we copy the part
+	 * after ahci_platform_enable_resources().
+	 */
+	ret = ahci_platform_enable_phys(hpriv);
+	if (ret)
+		goto out_disable_phys;
+
+	ret = ahci_platform_resume_host(dev);
+	if (ret)
+		goto out_disable_platform_phys;
+
+	/* We resumed so update PM runtime state */
+	pm_runtime_disable(dev);
+	pm_runtime_set_active(dev);
+	pm_runtime_enable(dev);
+
+	return 0;
+
+out_disable_platform_phys:
+	ahci_platform_disable_phys(hpriv);
+out_disable_phys:
+	brcm_sata_phys_disable(priv);
+	ahci_platform_disable_clks(hpriv);
+	return ret;
 }
 #endif
 
@@ -332,43 +356,73 @@ static int brcm_ahci_probe(struct platfo
 	if (IS_ERR(priv->top_ctrl))
 		return PTR_ERR(priv->top_ctrl);
 
+	/* Reset is optional depending on platform */
+	priv->rcdev = devm_reset_control_get(&pdev->dev, "ahci");
+	if (!IS_ERR_OR_NULL(priv->rcdev))
+		reset_control_deassert(priv->rcdev);
+
 	if ((priv->version == BRCM_SATA_BCM7425) ||
 		(priv->version == BRCM_SATA_NSP)) {
 		priv->quirks |= BRCM_AHCI_QUIRK_NO_NCQ;
 		priv->quirks |= BRCM_AHCI_QUIRK_SKIP_PHY_ENABLE;
 	}
 
+	hpriv = ahci_platform_get_resources(pdev);
+	if (IS_ERR(hpriv)) {
+		ret = PTR_ERR(hpriv);
+		goto out_reset;
+	}
+
+	ret = ahci_platform_enable_clks(hpriv);
+	if (ret)
+		goto out_reset;
+
+	/* Must be first so as to configure endianness including that
+	 * of the standard AHCI register space.
+	 */
 	brcm_sata_init(priv);
 
-	priv->port_mask = brcm_ahci_get_portmask(pdev, priv);
-	if (!priv->port_mask)
-		return -ENODEV;
+	/* Initializes priv->port_mask which is used below */
+	priv->port_mask = brcm_ahci_get_portmask(hpriv, priv);
+	if (!priv->port_mask) {
+		ret = -ENODEV;
+		goto out_disable_clks;
+	}
 
+	/* Must be done before ahci_platform_enable_phys() */
 	brcm_sata_phys_enable(priv);
 
-	hpriv = ahci_platform_get_resources(pdev);
-	if (IS_ERR(hpriv))
-		return PTR_ERR(hpriv);
 	hpriv->plat_data = priv;
 	hpriv->flags = AHCI_HFLAG_WAKE_BEFORE_STOP;
 
 	brcm_sata_alpm_init(hpriv);
 
-	ret = ahci_platform_enable_resources(hpriv);
-	if (ret)
-		return ret;
-
 	if (priv->quirks & BRCM_AHCI_QUIRK_NO_NCQ)
 		hpriv->flags |= AHCI_HFLAG_NO_NCQ;
 
+	ret = ahci_platform_enable_phys(hpriv);
+	if (ret)
+		goto out_disable_phys;
+
 	ret = ahci_platform_init_host(pdev, hpriv, &ahci_brcm_port_info,
 				      &ahci_platform_sht);
 	if (ret)
-		return ret;
+		goto out_disable_platform_phys;
 
 	dev_info(dev, "Broadcom AHCI SATA3 registered\n");
 
 	return 0;
+
+out_disable_platform_phys:
+	ahci_platform_disable_phys(hpriv);
+out_disable_phys:
+	brcm_sata_phys_disable(priv);
+out_disable_clks:
+	ahci_platform_disable_clks(hpriv);
+out_reset:
+	if (!IS_ERR_OR_NULL(priv->rcdev))
+		reset_control_assert(priv->rcdev);
+	return ret;
 }
 
 static int brcm_ahci_remove(struct platform_device *pdev)
@@ -378,12 +432,12 @@ static int brcm_ahci_remove(struct platf
 	struct brcm_ahci_priv *priv = hpriv->plat_data;
 	int ret;
 
+	brcm_sata_phys_disable(priv);
+
 	ret = ata_platform_remove_one(pdev);
 	if (ret)
 		return ret;
 
-	brcm_sata_phys_disable(priv);
-
 	return 0;
 }
 
diff -druNp --no-dereference linux-libre-4.9.208-gnu/drivers/ata/libahci_platform.c linux-libre-4.9.209-gnu/drivers/ata/libahci_platform.c
--- linux-libre-4.9.208-gnu/drivers/ata/libahci_platform.c	2020-01-04 07:41:15.000000000 -0500
+++ linux-libre-4.9.209-gnu/drivers/ata/libahci_platform.c	2020-01-12 05:24:28.000000000 -0500
@@ -46,7 +46,7 @@ EXPORT_SYMBOL_GPL(ahci_platform_ops);
  * RETURNS:
  * 0 on success otherwise a negative error code
  */
-static int ahci_platform_enable_phys(struct ahci_host_priv *hpriv)
+int ahci_platform_enable_phys(struct ahci_host_priv *hpriv)
 {
 	int rc, i;
 
@@ -71,6 +71,7 @@ disable_phys:
 	}
 	return rc;
 }
+EXPORT_SYMBOL_GPL(ahci_platform_enable_phys);
 
 /**
  * ahci_platform_disable_phys - Disable PHYs
@@ -78,7 +79,7 @@ disable_phys:
  *
  * This function disables all PHYs found in hpriv->phys.
  */
-static void ahci_platform_disable_phys(struct ahci_host_priv *hpriv)
+void ahci_platform_disable_phys(struct ahci_host_priv *hpriv)
 {
 	int i;
 
@@ -87,6 +88,7 @@ static void ahci_platform_disable_phys(s
 		phy_exit(hpriv->phys[i]);
 	}
 }
+EXPORT_SYMBOL_GPL(ahci_platform_disable_phys);
 
 /**
  * ahci_platform_enable_clks - Enable platform clocks
diff -druNp --no-dereference linux-libre-4.9.208-gnu/drivers/block/xen-blkback/blkback.c linux-libre-4.9.209-gnu/drivers/block/xen-blkback/blkback.c
--- linux-libre-4.9.208-gnu/drivers/block/xen-blkback/blkback.c	2020-01-04 07:41:15.000000000 -0500
+++ linux-libre-4.9.209-gnu/drivers/block/xen-blkback/blkback.c	2020-01-12 05:24:28.000000000 -0500
@@ -929,6 +929,8 @@ next:
 out_of_memory:
 	pr_alert("%s: out of memory\n", __func__);
 	put_free_pages(ring, pages_to_gnt, segs_to_map);
+	for (i = last_map; i < num; i++)
+		pages[i]->handle = BLKBACK_INVALID_HANDLE;
 	return -ENOMEM;
 }
 
diff -druNp --no-dereference linux-libre-4.9.208-gnu/drivers/block/xen-blkback/xenbus.c linux-libre-4.9.209-gnu/drivers/block/xen-blkback/xenbus.c
--- linux-libre-4.9.208-gnu/drivers/block/xen-blkback/xenbus.c	2020-01-04 07:41:15.000000000 -0500
+++ linux-libre-4.9.209-gnu/drivers/block/xen-blkback/xenbus.c	2020-01-12 05:24:28.000000000 -0500
@@ -178,6 +178,15 @@ static struct xen_blkif *xen_blkif_alloc
 	blkif->domid = domid;
 	atomic_set(&blkif->refcnt, 1);
 	init_completion(&blkif->drain_complete);
+
+	/*
+	 * Because freeing back to the cache may be deferred, it is not
+	 * safe to unload the module (and hence destroy the cache) until
+	 * this has completed. To prevent premature unloading, take an
+	 * extra module reference here and release only when the object
+	 * has been freed back to the cache.
+	 */
+	__module_get(THIS_MODULE);
 	INIT_WORK(&blkif->free_work, xen_blkif_deferred_free);
 
 	return blkif;
@@ -322,6 +331,7 @@ static void xen_blkif_free(struct xen_bl
 
 	/* Make sure everything is drained before shutting down */
 	kmem_cache_free(xen_blkif_cachep, blkif);
+	module_put(THIS_MODULE);
 }
 
 int __init xen_blkif_interface_init(void)
diff -druNp --no-dereference linux-libre-4.9.208-gnu/drivers/bluetooth/btusb.c linux-libre-4.9.209-gnu/drivers/bluetooth/btusb.c
--- linux-libre-4.9.208-gnu/drivers/bluetooth/btusb.c	2020-01-04 11:57:11.000000000 -0500
+++ linux-libre-4.9.209-gnu/drivers/bluetooth/btusb.c	2020-01-12 12:30:05.000000000 -0500
@@ -1069,7 +1069,7 @@ static int btusb_open(struct hci_dev *hd
 	if (data->setup_on_usb) {
 		err = data->setup_on_usb(hdev);
 		if (err < 0)
-			return err;
+			goto setup_fail;
 	}
 
 	data->intf->needs_remote_wakeup = 1;
@@ -1101,6 +1101,7 @@ done:
 
 failed:
 	clear_bit(BTUSB_INTR_RUNNING, &data->flags);
+setup_fail:
 	usb_autopm_put_interface(data->intf);
 	return err;
 }
diff -druNp --no-dereference linux-libre-4.9.208-gnu/drivers/devfreq/devfreq.c linux-libre-4.9.209-gnu/drivers/devfreq/devfreq.c
--- linux-libre-4.9.208-gnu/drivers/devfreq/devfreq.c	2020-01-04 07:41:15.000000000 -0500
+++ linux-libre-4.9.209-gnu/drivers/devfreq/devfreq.c	2020-01-12 05:24:28.000000000 -0500
@@ -482,11 +482,6 @@ static int devfreq_notifier_call(struct
 static void _remove_devfreq(struct devfreq *devfreq)
 {
 	mutex_lock(&devfreq_list_lock);
-	if (IS_ERR(find_device_devfreq(devfreq->dev.parent))) {
-		mutex_unlock(&devfreq_list_lock);
-		dev_warn(&devfreq->dev, "releasing devfreq which doesn't exist\n");
-		return;
-	}
 	list_del(&devfreq->node);
 	mutex_unlock(&devfreq_list_lock);
 
@@ -558,6 +553,7 @@ struct devfreq *devfreq_add_device(struc
 	devfreq->dev.parent = dev;
 	devfreq->dev.class = devfreq_class;
 	devfreq->dev.release = devfreq_dev_release;
+	INIT_LIST_HEAD(&devfreq->node);
 	devfreq->profile = profile;
 	strncpy(devfreq->governor_name, governor_name, DEVFREQ_NAME_LEN);
 	devfreq->previous_freq = profile->initial_freq;
@@ -986,7 +982,7 @@ static ssize_t available_governors_show(
 	 * The devfreq with immutable governor (e.g., passive) shows
 	 * only own governor.
 	 */
-	if (df->governor->immutable) {
+	if (df->governor && df->governor->immutable) {
 		count = scnprintf(&buf[count], DEVFREQ_NAME_LEN,
 				   "%s ", df->governor_name);
 	/*
diff -druNp --no-dereference linux-libre-4.9.208-gnu/drivers/firewire/net.c linux-libre-4.9.209-gnu/drivers/firewire/net.c
--- linux-libre-4.9.208-gnu/drivers/firewire/net.c	2020-01-04 07:41:15.000000000 -0500
+++ linux-libre-4.9.209-gnu/drivers/firewire/net.c	2020-01-12 05:24:28.000000000 -0500
@@ -249,7 +249,11 @@ static int fwnet_header_cache(const stru
 	h = (struct fwnet_header *)((u8 *)hh->hh_data + HH_DATA_OFF(sizeof(*h)));
 	h->h_proto = type;
 	memcpy(h->h_dest, neigh->ha, net->addr_len);
-	hh->hh_len = FWNET_HLEN;
+
+	/* Pairs with the READ_ONCE() in neigh_resolve_output(),
+	 * neigh_hh_output() and neigh_update_hhs().
+	 */
+	smp_store_release(&hh->hh_len, FWNET_HLEN);
 
 	return 0;
 }
diff -druNp --no-dereference linux-libre-4.9.208-gnu/drivers/firmware/efi/libstub/gop.c linux-libre-4.9.209-gnu/drivers/firmware/efi/libstub/gop.c
--- linux-libre-4.9.208-gnu/drivers/firmware/efi/libstub/gop.c	2020-01-04 07:41:15.000000000 -0500
+++ linux-libre-4.9.209-gnu/drivers/firmware/efi/libstub/gop.c	2020-01-12 05:24:28.000000000 -0500
@@ -86,30 +86,6 @@ setup_pixel_info(struct screen_info *si,
 }
 
 static efi_status_t
-__gop_query32(efi_system_table_t *sys_table_arg,
-	      struct efi_graphics_output_protocol_32 *gop32,
-	      struct efi_graphics_output_mode_info **info,
-	      unsigned long *size, u64 *fb_base)
-{
-	struct efi_graphics_output_protocol_mode_32 *mode;
-	efi_graphics_output_protocol_query_mode query_mode;
-	efi_status_t status;
-	unsigned long m;
-
-	m = gop32->mode;
-	mode = (struct efi_graphics_output_protocol_mode_32 *)m;
-	query_mode = (void *)(unsigned long)gop32->query_mode;
-
-	status = __efi_call_early(query_mode, (void *)gop32, mode->mode, size,
-				  info);
-	if (status != EFI_SUCCESS)
-		return status;
-
-	*fb_base = mode->frame_buffer_base;
-	return status;
-}
-
-static efi_status_t
 setup_gop32(efi_system_table_t *sys_table_arg, struct screen_info *si,
             efi_guid_t *proto, unsigned long size, void **gop_handle)
 {
@@ -121,7 +97,7 @@ setup_gop32(efi_system_table_t *sys_tabl
 	u64 fb_base;
 	struct efi_pixel_bitmask pixel_info;
 	int pixel_format;
-	efi_status_t status = EFI_NOT_FOUND;
+	efi_status_t status;
 	u32 *handles = (u32 *)(unsigned long)gop_handle;
 	int i;
 
@@ -130,6 +106,7 @@ setup_gop32(efi_system_table_t *sys_tabl
 
 	nr_gops = size / sizeof(u32);
 	for (i = 0; i < nr_gops; i++) {
+		struct efi_graphics_output_protocol_mode_32 *mode;
 		struct efi_graphics_output_mode_info *info = NULL;
 		efi_guid_t conout_proto = EFI_CONSOLE_OUT_DEVICE_GUID;
 		bool conout_found = false;
@@ -147,9 +124,11 @@ setup_gop32(efi_system_table_t *sys_tabl
 		if (status == EFI_SUCCESS)
 			conout_found = true;
 
-		status = __gop_query32(sys_table_arg, gop32, &info, &size,
-				       &current_fb_base);
-		if (status == EFI_SUCCESS && (!first_gop || conout_found) &&
+		mode = (void *)(unsigned long)gop32->mode;
+		info = (void *)(unsigned long)mode->info;
+		current_fb_base = mode->frame_buffer_base;
+
+		if ((!first_gop || conout_found) &&
 		    info->pixel_format != PIXEL_BLT_ONLY) {
 			/*
 			 * Systems that use the UEFI Console Splitter may
@@ -177,7 +156,7 @@ setup_gop32(efi_system_table_t *sys_tabl
 
 	/* Did we find any GOPs? */
 	if (!first_gop)
-		goto out;
+		return EFI_NOT_FOUND;
 
 	/* EFI framebuffer */
 	si->orig_video_isVGA = VIDEO_TYPE_EFI;
@@ -199,32 +178,8 @@ setup_gop32(efi_system_table_t *sys_tabl
 	si->lfb_size = si->lfb_linelength * si->lfb_height;
 
 	si->capabilities |= VIDEO_CAPABILITY_SKIP_QUIRKS;
-out:
-	return status;
-}
 
-static efi_status_t
-__gop_query64(efi_system_table_t *sys_table_arg,
-	      struct efi_graphics_output_protocol_64 *gop64,
-	      struct efi_graphics_output_mode_info **info,
-	      unsigned long *size, u64 *fb_base)
-{
-	struct efi_graphics_output_protocol_mode_64 *mode;
-	efi_graphics_output_protocol_query_mode query_mode;
-	efi_status_t status;
-	unsigned long m;
-
-	m = gop64->mode;
-	mode = (struct efi_graphics_output_protocol_mode_64 *)m;
-	query_mode = (void *)(unsigned long)gop64->query_mode;
-
-	status = __efi_call_early(query_mode, (void *)gop64, mode->mode, size,
-				  info);
-	if (status != EFI_SUCCESS)
-		return status;
-
-	*fb_base = mode->frame_buffer_base;
-	return status;
+	return EFI_SUCCESS;
 }
 
 static efi_status_t
@@ -239,7 +194,7 @@ setup_gop64(efi_system_table_t *sys_tabl
 	u64 fb_base;
 	struct efi_pixel_bitmask pixel_info;
 	int pixel_format;
-	efi_status_t status = EFI_NOT_FOUND;
+	efi_status_t status;
 	u64 *handles = (u64 *)(unsigned long)gop_handle;
 	int i;
 
@@ -248,6 +203,7 @@ setup_gop64(efi_system_table_t *sys_tabl
 
 	nr_gops = size / sizeof(u64);
 	for (i = 0; i < nr_gops; i++) {
+		struct efi_graphics_output_protocol_mode_64 *mode;
 		struct efi_graphics_output_mode_info *info = NULL;
 		efi_guid_t conout_proto = EFI_CONSOLE_OUT_DEVICE_GUID;
 		bool conout_found = false;
@@ -265,9 +221,11 @@ setup_gop64(efi_system_table_t *sys_tabl
 		if (status == EFI_SUCCESS)
 			conout_found = true;
 
-		status = __gop_query64(sys_table_arg, gop64, &info, &size,
-				       &current_fb_base);
-		if (status == EFI_SUCCESS && (!first_gop || conout_found) &&
+		mode = (void *)(unsigned long)gop64->mode;
+		info = (void *)(unsigned long)mode->info;
+		current_fb_base = mode->frame_buffer_base;
+
+		if ((!first_gop || conout_found) &&
 		    info->pixel_format != PIXEL_BLT_ONLY) {
 			/*
 			 * Systems that use the UEFI Console Splitter may
@@ -295,7 +253,7 @@ setup_gop64(efi_system_table_t *sys_tabl
 
 	/* Did we find any GOPs? */
 	if (!first_gop)
-		goto out;
+		return EFI_NOT_FOUND;
 
 	/* EFI framebuffer */
 	si->orig_video_isVGA = VIDEO_TYPE_EFI;
@@ -317,8 +275,8 @@ setup_gop64(efi_system_table_t *sys_tabl
 	si->lfb_size = si->lfb_linelength * si->lfb_height;
 
 	si->capabilities |= VIDEO_CAPABILITY_SKIP_QUIRKS;
-out:
-	return status;
+
+	return EFI_SUCCESS;
 }
 
 /*
diff -druNp --no-dereference linux-libre-4.9.208-gnu/drivers/gpio/gpiolib.c linux-libre-4.9.209-gnu/drivers/gpio/gpiolib.c
--- linux-libre-4.9.208-gnu/drivers/gpio/gpiolib.c	2020-01-04 07:41:15.000000000 -0500
+++ linux-libre-4.9.209-gnu/drivers/gpio/gpiolib.c	2020-01-12 05:24:28.000000000 -0500
@@ -188,6 +188,14 @@ int gpiod_get_direction(struct gpio_desc
 	chip = gpiod_to_chip(desc);
 	offset = gpio_chip_hwgpio(desc);
 
+	/*
+	 * Open drain emulation using input mode may incorrectly report
+	 * input here, fix that up.
+	 */
+	if (test_bit(FLAG_OPEN_DRAIN, &desc->flags) &&
+	    test_bit(FLAG_IS_OUT, &desc->flags))
+		return 0;
+
 	if (!chip->get_direction)
 		return status;
 
diff -druNp --no-dereference linux-libre-4.9.208-gnu/drivers/gpu/drm/drm_dp_mst_topology.c linux-libre-4.9.209-gnu/drivers/gpu/drm/drm_dp_mst_topology.c
--- linux-libre-4.9.208-gnu/drivers/gpu/drm/drm_dp_mst_topology.c	2020-01-04 07:41:15.000000000 -0500
+++ linux-libre-4.9.209-gnu/drivers/gpu/drm/drm_dp_mst_topology.c	2020-01-12 05:24:28.000000000 -0500
@@ -1536,7 +1536,11 @@ static void process_single_up_tx_qlock(s
 	if (ret != 1)
 		DRM_DEBUG_KMS("failed to send msg in q %d\n", ret);
 
-	txmsg->dst->tx_slots[txmsg->seqno] = NULL;
+	if (txmsg->seqno != -1) {
+		WARN_ON((unsigned int)txmsg->seqno >
+			ARRAY_SIZE(txmsg->dst->tx_slots));
+		txmsg->dst->tx_slots[txmsg->seqno] = NULL;
+	}
 }
 
 static void drm_dp_queue_down_tx(struct drm_dp_mst_topology_mgr *mgr,
diff -druNp --no-dereference linux-libre-4.9.208-gnu/drivers/gpu/drm/drm_property.c linux-libre-4.9.209-gnu/drivers/gpu/drm/drm_property.c
--- linux-libre-4.9.208-gnu/drivers/gpu/drm/drm_property.c	2020-01-04 07:41:15.000000000 -0500
+++ linux-libre-4.9.209-gnu/drivers/gpu/drm/drm_property.c	2020-01-12 05:24:28.000000000 -0500
@@ -554,7 +554,7 @@ drm_property_create_blob(struct drm_devi
 	struct drm_property_blob *blob;
 	int ret;
 
-	if (!length || length > ULONG_MAX - sizeof(struct drm_property_blob))
+	if (!length || length > INT_MAX - sizeof(struct drm_property_blob))
 		return ERR_PTR(-EINVAL);
 
 	blob = kzalloc(sizeof(struct drm_property_blob)+length, GFP_KERNEL);
diff -druNp --no-dereference linux-libre-4.9.208-gnu/drivers/infiniband/core/cma.c linux-libre-4.9.209-gnu/drivers/infiniband/core/cma.c
--- linux-libre-4.9.208-gnu/drivers/infiniband/core/cma.c	2020-01-04 07:41:15.000000000 -0500
+++ linux-libre-4.9.209-gnu/drivers/infiniband/core/cma.c	2020-01-12 05:24:28.000000000 -0500
@@ -4440,6 +4440,7 @@ err:
 	unregister_netdevice_notifier(&cma_nb);
 	rdma_addr_unregister_client(&addr_client);
 	ib_sa_unregister_client(&sa_client);
+	unregister_pernet_subsys(&cma_pernet_operations);
 err_wq:
 	destroy_workqueue(cma_wq);
 	return ret;
diff -druNp --no-dereference linux-libre-4.9.208-gnu/drivers/infiniband/hw/mlx4/main.c linux-libre-4.9.209-gnu/drivers/infiniband/hw/mlx4/main.c
--- linux-libre-4.9.208-gnu/drivers/infiniband/hw/mlx4/main.c	2020-01-04 07:41:15.000000000 -0500
+++ linux-libre-4.9.209-gnu/drivers/infiniband/hw/mlx4/main.c	2020-01-12 05:24:28.000000000 -0500
@@ -3031,16 +3031,17 @@ static void mlx4_ib_remove(struct mlx4_d
 	ibdev->ib_active = false;
 	flush_workqueue(wq);
 
-	mlx4_ib_close_sriov(ibdev);
-	mlx4_ib_mad_cleanup(ibdev);
-	ib_unregister_device(&ibdev->ib_dev);
-	mlx4_ib_diag_cleanup(ibdev);
 	if (ibdev->iboe.nb.notifier_call) {
 		if (unregister_netdevice_notifier(&ibdev->iboe.nb))
 			pr_warn("failure unregistering notifier\n");
 		ibdev->iboe.nb.notifier_call = NULL;
 	}
 
+	mlx4_ib_close_sriov(ibdev);
+	mlx4_ib_mad_cleanup(ibdev);
+	ib_unregister_device(&ibdev->ib_dev);
+	mlx4_ib_diag_cleanup(ibdev);
+
 	mlx4_qp_release_range(dev, ibdev->steer_qpn_base,
 			      ibdev->steer_qpn_count);
 	kfree(ibdev->ib_uc_qpns_bitmap);
diff -druNp --no-dereference linux-libre-4.9.208-gnu/drivers/md/raid1.c linux-libre-4.9.209-gnu/drivers/md/raid1.c
--- linux-libre-4.9.208-gnu/drivers/md/raid1.c	2020-01-04 07:41:15.000000000 -0500
+++ linux-libre-4.9.209-gnu/drivers/md/raid1.c	2020-01-12 05:24:28.000000000 -0500
@@ -2633,7 +2633,7 @@ static sector_t raid1_sync_request(struc
 				write_targets++;
 			}
 		}
-		if (bio->bi_end_io) {
+		if (rdev && bio->bi_end_io) {
 			atomic_inc(&rdev->nr_pending);
 			bio->bi_iter.bi_sector = sector_nr + rdev->data_offset;
 			bio->bi_bdev = rdev->bdev;
diff -druNp --no-dereference linux-libre-4.9.208-gnu/drivers/media/usb/b2c2/flexcop-usb.c linux-libre-4.9.209-gnu/drivers/media/usb/b2c2/flexcop-usb.c
--- linux-libre-4.9.208-gnu/drivers/media/usb/b2c2/flexcop-usb.c	2020-01-04 07:41:15.000000000 -0500
+++ linux-libre-4.9.209-gnu/drivers/media/usb/b2c2/flexcop-usb.c	2020-01-12 05:24:28.000000000 -0500
@@ -295,7 +295,7 @@ static int flexcop_usb_i2c_req(struct fl
 
 	mutex_unlock(&fc_usb->data_mutex);
 
-	return 0;
+	return ret;
 }
 
 /* actual bus specific access functions,
diff -druNp --no-dereference linux-libre-4.9.208-gnu/drivers/media/usb/dvb-usb/af9005.c linux-libre-4.9.209-gnu/drivers/media/usb/dvb-usb/af9005.c
--- linux-libre-4.9.208-gnu/drivers/media/usb/dvb-usb/af9005.c	2020-01-04 11:37:44.000000000 -0500
+++ linux-libre-4.9.209-gnu/drivers/media/usb/dvb-usb/af9005.c	2020-01-12 12:14:10.000000000 -0500
@@ -990,8 +990,9 @@ static int af9005_identify_state(struct
 	else if (reply == 0x02)
 		*cold = 0;
 	else
-		return -EIO;
-	deb_info("Identify state cold = %d\n", *cold);
+		ret = -EIO;
+	if (!ret)
+		deb_info("Identify state cold = %d\n", *cold);
 
 err:
 	kfree(buf);
diff -druNp --no-dereference linux-libre-4.9.208-gnu/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.h linux-libre-4.9.209-gnu/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.h
--- linux-libre-4.9.208-gnu/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.h	2020-01-04 07:41:15.000000000 -0500
+++ linux-libre-4.9.209-gnu/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.h	2020-01-12 05:24:28.000000000 -0500
@@ -1112,7 +1112,7 @@ static inline u8 bnx2x_get_path_func_num
 		for (i = 0; i < E1H_FUNC_MAX / 2; i++) {
 			u32 func_config =
 				MF_CFG_RD(bp,
-					  func_mf_config[BP_PORT(bp) + 2 * i].
+					  func_mf_config[BP_PATH(bp) + 2 * i].
 					  config);
 			func_num +=
 				((func_config & FUNC_MF_CFG_FUNC_HIDE) ? 0 : 1);
diff -druNp --no-dereference linux-libre-4.9.208-gnu/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c linux-libre-4.9.209-gnu/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
--- linux-libre-4.9.208-gnu/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c	2020-01-04 11:46:07.000000000 -0500
+++ linux-libre-4.9.209-gnu/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c	2020-01-12 12:22:10.000000000 -0500
@@ -9989,10 +9989,18 @@ static void bnx2x_recovery_failed(struct
  */
 static void bnx2x_parity_recover(struct bnx2x *bp)
 {
-	bool global = false;
 	u32 error_recovered, error_unrecovered;
-	bool is_parity;
+	bool is_parity, global = false;
+#ifdef CONFIG_BNX2X_SRIOV
+	int vf_idx;
+
+	for (vf_idx = 0; vf_idx < bp->requested_nr_virtfn; vf_idx++) {
+		struct bnx2x_virtf *vf = BP_VF(bp, vf_idx);
 
+		if (vf)
+			vf->state = VF_LOST;
+	}
+#endif
 	DP(NETIF_MSG_HW, "Handling parity\n");
 	while (1) {
 		switch (bp->recovery_state) {
diff -druNp --no-dereference linux-libre-4.9.208-gnu/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.h linux-libre-4.9.209-gnu/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.h
--- linux-libre-4.9.208-gnu/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.h	2020-01-04 07:41:15.000000000 -0500
+++ linux-libre-4.9.209-gnu/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.h	2020-01-12 05:24:28.000000000 -0500
@@ -139,6 +139,7 @@ struct bnx2x_virtf {
 #define VF_ACQUIRED	1	/* VF acquired, but not initialized */
 #define VF_ENABLED	2	/* VF Enabled */
 #define VF_RESET	3	/* VF FLR'd, pending cleanup */
+#define VF_LOST		4	/* Recovery while VFs are loaded */
 
 	bool flr_clnup_stage;	/* true during flr cleanup */
 
diff -druNp --no-dereference linux-libre-4.9.208-gnu/drivers/net/ethernet/broadcom/bnx2x/bnx2x_vfpf.c linux-libre-4.9.209-gnu/drivers/net/ethernet/broadcom/bnx2x/bnx2x_vfpf.c
--- linux-libre-4.9.208-gnu/drivers/net/ethernet/broadcom/bnx2x/bnx2x_vfpf.c	2020-01-04 07:41:15.000000000 -0500
+++ linux-libre-4.9.209-gnu/drivers/net/ethernet/broadcom/bnx2x/bnx2x_vfpf.c	2020-01-12 05:24:28.000000000 -0500
@@ -2095,6 +2095,18 @@ static void bnx2x_vf_mbx_request(struct
 {
 	int i;
 
+	if (vf->state == VF_LOST) {
+		/* Just ack the FW and return if VFs are lost
+		 * in case of parity error. VFs are supposed to be timedout
+		 * on waiting for PF response.
+		 */
+		DP(BNX2X_MSG_IOV,
+		   "VF 0x%x lost, not handling the request\n", vf->abs_vfid);
+
+		storm_memset_vf_mbx_ack(bp, vf->abs_vfid);
+		return;
+	}
+
 	/* check if tlv type is known */
 	if (bnx2x_tlv_supported(mbx->first_tlv.tl.type)) {
 		/* Lock the per vf op mutex and note the locker's identity.
diff -druNp --no-dereference linux-libre-4.9.208-gnu/drivers/net/ethernet/stmicro/stmmac/dwmac-sunxi.c linux-libre-4.9.209-gnu/drivers/net/ethernet/stmicro/stmmac/dwmac-sunxi.c
--- linux-libre-4.9.208-gnu/drivers/net/ethernet/stmicro/stmmac/dwmac-sunxi.c	2020-01-04 07:41:15.000000000 -0500
+++ linux-libre-4.9.209-gnu/drivers/net/ethernet/stmicro/stmmac/dwmac-sunxi.c	2020-01-12 05:24:28.000000000 -0500
@@ -53,7 +53,7 @@ static int sun7i_gmac_init(struct platfo
 	 * rate, which then uses the auto-reparenting feature of the
 	 * clock driver, and enabling/disabling the clock.
 	 */
-	if (gmac->interface == PHY_INTERFACE_MODE_RGMII) {
+	if (phy_interface_mode_is_rgmii(gmac->interface)) {
 		clk_set_rate(gmac->tx_clk, SUN7I_GMAC_GMII_RGMII_RATE);
 		clk_prepare_enable(gmac->tx_clk);
 		gmac->clk_enabled = 1;
diff -druNp --no-dereference linux-libre-4.9.208-gnu/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c linux-libre-4.9.209-gnu/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
--- linux-libre-4.9.208-gnu/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c	2020-01-04 07:41:15.000000000 -0500
+++ linux-libre-4.9.209-gnu/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c	2020-01-12 05:24:28.000000000 -0500
@@ -55,7 +55,7 @@
 #include <linux/of_mdio.h>
 #include "dwmac1000.h"
 
-#define	STMMAC_ALIGN(x)		__ALIGN_KERNEL(x, SMP_CACHE_BYTES)
+#define	STMMAC_ALIGN(x)		ALIGN(ALIGN(x, SMP_CACHE_BYTES), 16)
 #define	TSO_MAX_BUFF_SIZE	(SZ_16K - 1)
 
 /* Module parameters */
diff -druNp --no-dereference linux-libre-4.9.208-gnu/drivers/net/macvlan.c linux-libre-4.9.209-gnu/drivers/net/macvlan.c
--- linux-libre-4.9.208-gnu/drivers/net/macvlan.c	2020-01-04 07:41:15.000000000 -0500
+++ linux-libre-4.9.209-gnu/drivers/net/macvlan.c	2020-01-12 05:24:28.000000000 -0500
@@ -234,7 +234,7 @@ static void macvlan_broadcast(struct sk_
 			      struct net_device *src,
 			      enum macvlan_mode mode)
 {
-	const struct ethhdr *eth = eth_hdr(skb);
+	const struct ethhdr *eth = skb_eth_hdr(skb);
 	const struct macvlan_dev *vlan;
 	struct sk_buff *nskb;
 	unsigned int i;
diff -druNp --no-dereference linux-libre-4.9.208-gnu/drivers/net/usb/lan78xx.c linux-libre-4.9.209-gnu/drivers/net/usb/lan78xx.c
--- linux-libre-4.9.208-gnu/drivers/net/usb/lan78xx.c	2020-01-04 07:41:15.000000000 -0500
+++ linux-libre-4.9.209-gnu/drivers/net/usb/lan78xx.c	2020-01-12 05:24:28.000000000 -0500
@@ -442,7 +442,7 @@ static int lan78xx_read_stats(struct lan
 		}
 	} else {
 		netdev_warn(dev->net,
-			    "Failed to read stat ret = 0x%x", ret);
+			    "Failed to read stat ret = %d", ret);
 	}
 
 	kfree(stats);
@@ -2407,11 +2407,6 @@ static int lan78xx_stop(struct net_devic
 	return 0;
 }
 
-static int lan78xx_linearize(struct sk_buff *skb)
-{
-	return skb_linearize(skb);
-}
-
 static struct sk_buff *lan78xx_tx_prep(struct lan78xx_net *dev,
 				       struct sk_buff *skb, gfp_t flags)
 {
@@ -2422,8 +2417,10 @@ static struct sk_buff *lan78xx_tx_prep(s
 		return NULL;
 	}
 
-	if (lan78xx_linearize(skb) < 0)
+	if (skb_linearize(skb)) {
+		dev_kfree_skb_any(skb);
 		return NULL;
+	}
 
 	tx_cmd_a = (u32)(skb->len & TX_CMD_A_LEN_MASK_) | TX_CMD_A_FCS_;
 
diff -druNp --no-dereference linux-libre-4.9.208-gnu/drivers/net/vxlan.c linux-libre-4.9.209-gnu/drivers/net/vxlan.c
--- linux-libre-4.9.208-gnu/drivers/net/vxlan.c	2020-01-04 07:41:15.000000000 -0500
+++ linux-libre-4.9.209-gnu/drivers/net/vxlan.c	2020-01-12 05:24:28.000000000 -0500
@@ -2104,7 +2104,7 @@ static void vxlan_xmit_one(struct sk_buf
 		else if (info->key.tun_flags & TUNNEL_DONT_FRAGMENT)
 			df = htons(IP_DF);
 
-		tos = ip_tunnel_ecn_encap(tos, old_iph, skb);
+		tos = ip_tunnel_ecn_encap(RT_TOS(tos), old_iph, skb);
 		ttl = ttl ? : ip4_dst_hoplimit(&rt->dst);
 		err = vxlan_build_skb(skb, &rt->dst, sizeof(struct iphdr),
 				      vni, md, flags, udp_sum);
@@ -2163,7 +2163,7 @@ static void vxlan_xmit_one(struct sk_buf
 		if (!info)
 			udp_sum = !(flags & VXLAN_F_UDP_ZERO_CSUM6_TX);
 
-		tos = ip_tunnel_ecn_encap(tos, old_iph, skb);
+		tos = ip_tunnel_ecn_encap(RT_TOS(tos), old_iph, skb);
 		ttl = ttl ? : ip6_dst_hoplimit(ndst);
 		skb_scrub_packet(skb, xnet);
 		err = vxlan_build_skb(skb, ndst, sizeof(struct ipv6hdr),
diff -druNp --no-dereference linux-libre-4.9.208-gnu/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c linux-libre-4.9.209-gnu/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c
--- linux-libre-4.9.208-gnu/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c	2020-01-04 07:41:15.000000000 -0500
+++ linux-libre-4.9.209-gnu/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c	2020-01-12 05:24:28.000000000 -0500
@@ -972,6 +972,8 @@ static bool ath9k_rx_prepare(struct ath9
 	struct ath_htc_rx_status *rxstatus;
 	struct ath_rx_status rx_stats;
 	bool decrypt_error = false;
+	__be16 rs_datalen;
+	bool is_phyerr;
 
 	if (skb->len < HTC_RX_FRAME_HEADER_SIZE) {
 		ath_err(common, "Corrupted RX frame, dropping (len: %d)\n",
@@ -981,11 +983,24 @@ static bool ath9k_rx_prepare(struct ath9
 
 	rxstatus = (struct ath_htc_rx_status *)skb->data;
 
-	if (be16_to_cpu(rxstatus->rs_datalen) -
-	    (skb->len - HTC_RX_FRAME_HEADER_SIZE) != 0) {
+	rs_datalen = be16_to_cpu(rxstatus->rs_datalen);
+	if (unlikely(rs_datalen -
+	    (skb->len - HTC_RX_FRAME_HEADER_SIZE) != 0)) {
 		ath_err(common,
 			"Corrupted RX data len, dropping (dlen: %d, skblen: %d)\n",
-			rxstatus->rs_datalen, skb->len);
+			rs_datalen, skb->len);
+		goto rx_next;
+	}
+
+	is_phyerr = rxstatus->rs_status & ATH9K_RXERR_PHY;
+	/*
+	 * Discard zero-length packets and packets smaller than an ACK
+	 * which are not PHY_ERROR (short radar pulses have a length of 3)
+	 */
+	if (unlikely(!rs_datalen || (rs_datalen < 10 && !is_phyerr))) {
+		ath_warn(common,
+			 "Short RX data len, dropping (dlen: %d)\n",
+			 rs_datalen);
 		goto rx_next;
 	}
 
@@ -1010,7 +1025,7 @@ static bool ath9k_rx_prepare(struct ath9
 	 * Process PHY errors and return so that the packet
 	 * can be dropped.
 	 */
-	if (rx_stats.rs_status & ATH9K_RXERR_PHY) {
+	if (unlikely(is_phyerr)) {
 		/* TODO: Not using DFS processing now. */
 		if (ath_cmn_process_fft(&priv->spec_priv, hdr,
 				    &rx_stats, rx_status->mactime)) {
diff -druNp --no-dereference linux-libre-4.9.208-gnu/drivers/regulator/ab8500.c linux-libre-4.9.209-gnu/drivers/regulator/ab8500.c
--- linux-libre-4.9.208-gnu/drivers/regulator/ab8500.c	2020-01-04 07:41:15.000000000 -0500
+++ linux-libre-4.9.209-gnu/drivers/regulator/ab8500.c	2020-01-12 05:24:28.000000000 -0500
@@ -1099,23 +1099,6 @@ static struct ab8500_regulator_info
 		.update_val_idle	= 0x82,
 		.update_val_normal	= 0x02,
 	},
-	[AB8505_LDO_USB] = {
-		.desc = {
-			.name           = "LDO-USB",
-			.ops            = &ab8500_regulator_mode_ops,
-			.type           = REGULATOR_VOLTAGE,
-			.id             = AB8505_LDO_USB,
-			.owner          = THIS_MODULE,
-			.n_voltages     = 1,
-			.volt_table	= fixed_3300000_voltage,
-		},
-		.update_bank            = 0x03,
-		.update_reg             = 0x82,
-		.update_mask            = 0x03,
-		.update_val		= 0x01,
-		.update_val_idle	= 0x03,
-		.update_val_normal	= 0x01,
-	},
 	[AB8505_LDO_AUDIO] = {
 		.desc = {
 			.name		= "LDO-AUDIO",
diff -druNp --no-dereference linux-libre-4.9.208-gnu/drivers/regulator/rn5t618-regulator.c linux-libre-4.9.209-gnu/drivers/regulator/rn5t618-regulator.c
--- linux-libre-4.9.208-gnu/drivers/regulator/rn5t618-regulator.c	2020-01-04 07:41:15.000000000 -0500
+++ linux-libre-4.9.209-gnu/drivers/regulator/rn5t618-regulator.c	2020-01-12 05:24:28.000000000 -0500
@@ -127,6 +127,7 @@ static struct platform_driver rn5t618_re
 
 module_platform_driver(rn5t618_regulator_driver);
 
+MODULE_ALIAS("platform:rn5t618-regulator");
 MODULE_AUTHOR("Beniamino Galvani <b.galvani@gmail.com>");
 MODULE_DESCRIPTION("RN5T618 regulator driver");
 MODULE_LICENSE("GPL v2");
diff -druNp --no-dereference linux-libre-4.9.208-gnu/drivers/scsi/libsas/sas_discover.c linux-libre-4.9.209-gnu/drivers/scsi/libsas/sas_discover.c
--- linux-libre-4.9.208-gnu/drivers/scsi/libsas/sas_discover.c	2020-01-04 07:41:15.000000000 -0500
+++ linux-libre-4.9.209-gnu/drivers/scsi/libsas/sas_discover.c	2020-01-12 05:24:28.000000000 -0500
@@ -97,12 +97,21 @@ static int sas_get_port_device(struct as
 		else
 			dev->dev_type = SAS_SATA_DEV;
 		dev->tproto = SAS_PROTOCOL_SATA;
-	} else {
+	} else if (port->oob_mode == SAS_OOB_MODE) {
 		struct sas_identify_frame *id =
 			(struct sas_identify_frame *) dev->frame_rcvd;
 		dev->dev_type = id->dev_type;
 		dev->iproto = id->initiator_bits;
 		dev->tproto = id->target_bits;
+	} else {
+		/* If the oob mode is OOB_NOT_CONNECTED, the port is
+		 * disconnected due to race with PHY down. We cannot
+		 * continue to discover this port
+		 */
+		sas_put_device(dev);
+		pr_warn("Port %016llx is disconnected when discovering\n",
+			SAS_ADDR(port->attached_sas_addr));
+		return -ENODEV;
 	}
 
 	sas_init_dev(dev);
diff -druNp --no-dereference linux-libre-4.9.208-gnu/drivers/scsi/lpfc/lpfc_bsg.c linux-libre-4.9.209-gnu/drivers/scsi/lpfc/lpfc_bsg.c
--- linux-libre-4.9.208-gnu/drivers/scsi/lpfc/lpfc_bsg.c	2020-01-04 07:41:15.000000000 -0500
+++ linux-libre-4.9.209-gnu/drivers/scsi/lpfc/lpfc_bsg.c	2020-01-12 05:24:28.000000000 -0500
@@ -4352,12 +4352,6 @@ lpfc_bsg_write_ebuf_set(struct lpfc_hba
 	phba->mbox_ext_buf_ctx.seqNum++;
 	nemb_tp = phba->mbox_ext_buf_ctx.nembType;
 
-	dd_data = kmalloc(sizeof(struct bsg_job_data), GFP_KERNEL);
-	if (!dd_data) {
-		rc = -ENOMEM;
-		goto job_error;
-	}
-
 	pbuf = (uint8_t *)dmabuf->virt;
 	size = job->request_payload.payload_len;
 	sg_copy_to_buffer(job->request_payload.sg_list,
@@ -4394,6 +4388,13 @@ lpfc_bsg_write_ebuf_set(struct lpfc_hba
 				"2968 SLI_CONFIG ext-buffer wr all %d "
 				"ebuffers received\n",
 				phba->mbox_ext_buf_ctx.numBuf);
+
+		dd_data = kmalloc(sizeof(struct bsg_job_data), GFP_KERNEL);
+		if (!dd_data) {
+			rc = -ENOMEM;
+			goto job_error;
+		}
+
 		/* mailbox command structure for base driver */
 		pmboxq = mempool_alloc(phba->mbox_mem_pool, GFP_KERNEL);
 		if (!pmboxq) {
@@ -4441,6 +4442,8 @@ lpfc_bsg_write_ebuf_set(struct lpfc_hba
 	return SLI_CONFIG_HANDLED;
 
 job_error:
+	if (pmboxq)
+		mempool_free(pmboxq, phba->mbox_mem_pool);
 	lpfc_bsg_dma_page_free(phba, dmabuf);
 	kfree(dd_data);
 
diff -druNp --no-dereference linux-libre-4.9.208-gnu/drivers/scsi/qla2xxx/qla_isr.c linux-libre-4.9.209-gnu/drivers/scsi/qla2xxx/qla_isr.c
--- linux-libre-4.9.208-gnu/drivers/scsi/qla2xxx/qla_isr.c	2020-01-04 07:41:15.000000000 -0500
+++ linux-libre-4.9.209-gnu/drivers/scsi/qla2xxx/qla_isr.c	2020-01-12 05:24:28.000000000 -0500
@@ -973,8 +973,6 @@ global_port_update:
 			ql_dbg(ql_dbg_async, vha, 0x5011,
 			    "Asynchronous PORT UPDATE ignored %04x/%04x/%04x.\n",
 			    mb[1], mb[2], mb[3]);
-
-			qlt_async_event(mb[0], vha, mb);
 			break;
 		}
 
@@ -995,8 +993,6 @@ global_port_update:
 		set_bit(LOOP_RESYNC_NEEDED, &vha->dpc_flags);
 		set_bit(LOCAL_LOOP_UPDATE, &vha->dpc_flags);
 		set_bit(VP_CONFIG_OK, &vha->vp_flags);
-
-		qlt_async_event(mb[0], vha, mb);
 		break;
 
 	case MBA_RSCN_UPDATE:		/* State Change Registration */
diff -druNp --no-dereference linux-libre-4.9.208-gnu/drivers/scsi/qla4xxx/ql4_os.c linux-libre-4.9.209-gnu/drivers/scsi/qla4xxx/ql4_os.c
--- linux-libre-4.9.208-gnu/drivers/scsi/qla4xxx/ql4_os.c	2020-01-04 07:41:15.000000000 -0500
+++ linux-libre-4.9.209-gnu/drivers/scsi/qla4xxx/ql4_os.c	2020-01-12 05:24:28.000000000 -0500
@@ -4285,7 +4285,6 @@ static int qla4xxx_mem_alloc(struct scsi
 	return QLA_SUCCESS;
 
 mem_alloc_error_exit:
-	qla4xxx_mem_free(ha);
 	return QLA_ERROR;
 }
 
diff -druNp --no-dereference linux-libre-4.9.208-gnu/drivers/spi/spi-cavium-thunderx.c linux-libre-4.9.209-gnu/drivers/spi/spi-cavium-thunderx.c
--- linux-libre-4.9.208-gnu/drivers/spi/spi-cavium-thunderx.c	2020-01-04 07:41:15.000000000 -0500
+++ linux-libre-4.9.209-gnu/drivers/spi/spi-cavium-thunderx.c	2020-01-12 05:24:28.000000000 -0500
@@ -81,6 +81,7 @@ static int thunderx_spi_probe(struct pci
 
 error:
 	clk_disable_unprepare(p->clk);
+	pci_release_regions(pdev);
 	spi_master_put(master);
 	return ret;
 }
@@ -95,6 +96,7 @@ static void thunderx_spi_remove(struct p
 		return;
 
 	clk_disable_unprepare(p->clk);
+	pci_release_regions(pdev);
 	/* Put everything in a known state. */
 	writeq(0, p->register_base + OCTEON_SPI_CFG(p));
 }
diff -druNp --no-dereference linux-libre-4.9.208-gnu/drivers/tty/hvc/hvc_vio.c linux-libre-4.9.209-gnu/drivers/tty/hvc/hvc_vio.c
--- linux-libre-4.9.208-gnu/drivers/tty/hvc/hvc_vio.c	2020-01-04 07:41:15.000000000 -0500
+++ linux-libre-4.9.209-gnu/drivers/tty/hvc/hvc_vio.c	2020-01-12 05:24:28.000000000 -0500
@@ -120,6 +120,14 @@ static int hvterm_raw_get_chars(uint32_t
 	return got;
 }
 
+/**
+ * hvterm_raw_put_chars: send characters to firmware for given vterm adapter
+ * @vtermno: The virtual terminal number.
+ * @buf: The characters to send. Because of the underlying hypercall in
+ *       hvc_put_chars(), this buffer must be at least 16 bytes long, even if
+ *       you are sending fewer chars.
+ * @count: number of chars to send.
+ */
 static int hvterm_raw_put_chars(uint32_t vtermno, const char *buf, int count)
 {
 	struct hvterm_priv *pv = hvterm_privs[vtermno];
@@ -232,6 +240,7 @@ static const struct hv_ops hvterm_hvsi_o
 static void udbg_hvc_putc(char c)
 {
 	int count = -1;
+	unsigned char bounce_buffer[16];
 
 	if (!hvterm_privs[0])
 		return;
@@ -242,7 +251,12 @@ static void udbg_hvc_putc(char c)
 	do {
 		switch(hvterm_privs[0]->proto) {
 		case HV_PROTOCOL_RAW:
-			count = hvterm_raw_put_chars(0, &c, 1);
+			/*
+			 * hvterm_raw_put_chars requires at least a 16-byte
+			 * buffer, so go via the bounce buffer
+			 */
+			bounce_buffer[0] = c;
+			count = hvterm_raw_put_chars(0, bounce_buffer, 1);
 			break;
 		case HV_PROTOCOL_HVSI:
 			count = hvterm_hvsi_put_chars(0, &c, 1);
diff -druNp --no-dereference linux-libre-4.9.208-gnu/drivers/tty/serial/msm_serial.c linux-libre-4.9.209-gnu/drivers/tty/serial/msm_serial.c
--- linux-libre-4.9.208-gnu/drivers/tty/serial/msm_serial.c	2020-01-04 07:41:15.000000000 -0500
+++ linux-libre-4.9.209-gnu/drivers/tty/serial/msm_serial.c	2020-01-12 05:24:28.000000000 -0500
@@ -1579,6 +1579,7 @@ static void __msm_console_write(struct u
 	int num_newlines = 0;
 	bool replaced = false;
 	void __iomem *tf;
+	int locked = 1;
 
 	if (is_uartdm)
 		tf = port->membase + UARTDM_TF;
@@ -1591,7 +1592,13 @@ static void __msm_console_write(struct u
 			num_newlines++;
 	count += num_newlines;
 
-	spin_lock(&port->lock);
+	if (port->sysrq)
+		locked = 0;
+	else if (oops_in_progress)
+		locked = spin_trylock(&port->lock);
+	else
+		spin_lock(&port->lock);
+
 	if (is_uartdm)
 		msm_reset_dm_count(port, count);
 
@@ -1627,7 +1634,9 @@ static void __msm_console_write(struct u
 		iowrite32_rep(tf, buf, 1);
 		i += num_chars;
 	}
-	spin_unlock(&port->lock);
+
+	if (locked)
+		spin_unlock(&port->lock);
 }
 
 static void msm_console_write(struct console *co, const char *s,
diff -druNp --no-dereference linux-libre-4.9.208-gnu/drivers/usb/core/config.c linux-libre-4.9.209-gnu/drivers/usb/core/config.c
--- linux-libre-4.9.208-gnu/drivers/usb/core/config.c	2020-01-04 07:41:15.000000000 -0500
+++ linux-libre-4.9.209-gnu/drivers/usb/core/config.c	2020-01-12 05:24:28.000000000 -0500
@@ -198,9 +198,58 @@ static const unsigned short super_speed_
 	[USB_ENDPOINT_XFER_INT] = 1024,
 };
 
-static int usb_parse_endpoint(struct device *ddev, int cfgno, int inum,
-    int asnum, struct usb_host_interface *ifp, int num_ep,
-    unsigned char *buffer, int size)
+static bool endpoint_is_duplicate(struct usb_endpoint_descriptor *e1,
+		struct usb_endpoint_descriptor *e2)
+{
+	if (e1->bEndpointAddress == e2->bEndpointAddress)
+		return true;
+
+	if (usb_endpoint_xfer_control(e1) || usb_endpoint_xfer_control(e2)) {
+		if (usb_endpoint_num(e1) == usb_endpoint_num(e2))
+			return true;
+	}
+
+	return false;
+}
+
+/*
+ * Check for duplicate endpoint addresses in other interfaces and in the
+ * altsetting currently being parsed.
+ */
+static bool config_endpoint_is_duplicate(struct usb_host_config *config,
+		int inum, int asnum, struct usb_endpoint_descriptor *d)
+{
+	struct usb_endpoint_descriptor *epd;
+	struct usb_interface_cache *intfc;
+	struct usb_host_interface *alt;
+	int i, j, k;
+
+	for (i = 0; i < config->desc.bNumInterfaces; ++i) {
+		intfc = config->intf_cache[i];
+
+		for (j = 0; j < intfc->num_altsetting; ++j) {
+			alt = &intfc->altsetting[j];
+
+			if (alt->desc.bInterfaceNumber == inum &&
+					alt->desc.bAlternateSetting != asnum)
+				continue;
+
+			for (k = 0; k < alt->desc.bNumEndpoints; ++k) {
+				epd = &alt->endpoint[k].desc;
+
+				if (endpoint_is_duplicate(epd, d))
+					return true;
+			}
+		}
+	}
+
+	return false;
+}
+
+static int usb_parse_endpoint(struct device *ddev, int cfgno,
+		struct usb_host_config *config, int inum, int asnum,
+		struct usb_host_interface *ifp, int num_ep,
+		unsigned char *buffer, int size)
 {
 	unsigned char *buffer0 = buffer;
 	struct usb_endpoint_descriptor *d;
@@ -237,13 +286,10 @@ static int usb_parse_endpoint(struct dev
 		goto skip_to_next_endpoint_or_interface_descriptor;
 
 	/* Check for duplicate endpoint addresses */
-	for (i = 0; i < ifp->desc.bNumEndpoints; ++i) {
-		if (ifp->endpoint[i].desc.bEndpointAddress ==
-		    d->bEndpointAddress) {
-			dev_warn(ddev, "config %d interface %d altsetting %d has a duplicate endpoint with address 0x%X, skipping\n",
-			    cfgno, inum, asnum, d->bEndpointAddress);
-			goto skip_to_next_endpoint_or_interface_descriptor;
-		}
+	if (config_endpoint_is_duplicate(config, inum, asnum, d)) {
+		dev_warn(ddev, "config %d interface %d altsetting %d has a duplicate endpoint with address 0x%X, skipping\n",
+				cfgno, inum, asnum, d->bEndpointAddress);
+		goto skip_to_next_endpoint_or_interface_descriptor;
 	}
 
 	endpoint = &ifp->endpoint[ifp->desc.bNumEndpoints];
@@ -517,8 +563,8 @@ static int usb_parse_interface(struct de
 		if (((struct usb_descriptor_header *) buffer)->bDescriptorType
 		     == USB_DT_INTERFACE)
 			break;
-		retval = usb_parse_endpoint(ddev, cfgno, inum, asnum, alt,
-		    num_ep, buffer, size);
+		retval = usb_parse_endpoint(ddev, cfgno, config, inum, asnum,
+				alt, num_ep, buffer, size);
 		if (retval < 0)
 			return retval;
 		++n;
diff -druNp --no-dereference linux-libre-4.9.208-gnu/drivers/usb/gadget/function/f_ecm.c linux-libre-4.9.209-gnu/drivers/usb/gadget/function/f_ecm.c
--- linux-libre-4.9.208-gnu/drivers/usb/gadget/function/f_ecm.c	2020-01-04 07:41:15.000000000 -0500
+++ linux-libre-4.9.209-gnu/drivers/usb/gadget/function/f_ecm.c	2020-01-12 05:24:28.000000000 -0500
@@ -625,8 +625,12 @@ static void ecm_disable(struct usb_funct
 
 	DBG(cdev, "ecm deactivated\n");
 
-	if (ecm->port.in_ep->enabled)
+	if (ecm->port.in_ep->enabled) {
 		gether_disconnect(&ecm->port);
+	} else {
+		ecm->port.in_ep->desc = NULL;
+		ecm->port.out_ep->desc = NULL;
+	}
 
 	usb_ep_disable(ecm->notify);
 	ecm->notify->desc = NULL;
diff -druNp --no-dereference linux-libre-4.9.208-gnu/drivers/usb/gadget/function/f_rndis.c linux-libre-4.9.209-gnu/drivers/usb/gadget/function/f_rndis.c
--- linux-libre-4.9.208-gnu/drivers/usb/gadget/function/f_rndis.c	2020-01-04 07:41:15.000000000 -0500
+++ linux-libre-4.9.209-gnu/drivers/usb/gadget/function/f_rndis.c	2020-01-12 05:24:28.000000000 -0500
@@ -622,6 +622,7 @@ static void rndis_disable(struct usb_fun
 	gether_disconnect(&rndis->port);
 
 	usb_ep_disable(rndis->notify);
+	rndis->notify->desc = NULL;
 }
 
 /*-------------------------------------------------------------------------*/
diff -druNp --no-dereference linux-libre-4.9.208-gnu/drivers/usb/serial/option.c linux-libre-4.9.209-gnu/drivers/usb/serial/option.c
--- linux-libre-4.9.208-gnu/drivers/usb/serial/option.c	2020-01-04 07:41:15.000000000 -0500
+++ linux-libre-4.9.209-gnu/drivers/usb/serial/option.c	2020-01-12 05:24:28.000000000 -0500
@@ -1167,6 +1167,8 @@ static const struct usb_device_id option
 	  .driver_info = NCTRL(0) | RSVD(3) },
 	{ USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1102, 0xff),	/* Telit ME910 (ECM) */
 	  .driver_info = NCTRL(0) },
+	{ USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x110a, 0xff),	/* Telit ME910G1 */
+	  .driver_info = NCTRL(0) | RSVD(3) },
 	{ USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE910),
 	  .driver_info = NCTRL(0) | RSVD(1) | RSVD(2) },
 	{ USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE910_USBCFG4),
diff -druNp --no-dereference linux-libre-4.9.208-gnu/drivers/xen/balloon.c linux-libre-4.9.209-gnu/drivers/xen/balloon.c
--- linux-libre-4.9.208-gnu/drivers/xen/balloon.c	2020-01-04 07:41:15.000000000 -0500
+++ linux-libre-4.9.209-gnu/drivers/xen/balloon.c	2020-01-12 05:24:28.000000000 -0500
@@ -403,7 +403,8 @@ static struct notifier_block xen_memory_
 #else
 static enum bp_state reserve_additional_memory(void)
 {
-	balloon_stats.target_pages = balloon_stats.current_pages;
+	balloon_stats.target_pages = balloon_stats.current_pages +
+				     balloon_stats.target_unpopulated;
 	return BP_ECANCELED;
 }
 #endif /* CONFIG_XEN_BALLOON_MEMORY_HOTPLUG */
diff -druNp --no-dereference linux-libre-4.9.208-gnu/fs/compat_ioctl.c linux-libre-4.9.209-gnu/fs/compat_ioctl.c
--- linux-libre-4.9.208-gnu/fs/compat_ioctl.c	2020-01-04 07:41:15.000000000 -0500
+++ linux-libre-4.9.209-gnu/fs/compat_ioctl.c	2020-01-12 05:24:28.000000000 -0500
@@ -1585,9 +1585,10 @@ COMPAT_SYSCALL_DEFINE3(ioctl, unsigned i
 #endif
 
 	case FICLONE:
+		goto do_ioctl;
 	case FICLONERANGE:
 	case FIDEDUPERANGE:
-		goto do_ioctl;
+		goto found_handler;
 
 	case FIBMAP:
 	case FIGETBSZ:
diff -druNp --no-dereference linux-libre-4.9.208-gnu/fs/locks.c linux-libre-4.9.209-gnu/fs/locks.c
--- linux-libre-4.9.208-gnu/fs/locks.c	2020-01-04 07:41:15.000000000 -0500
+++ linux-libre-4.9.209-gnu/fs/locks.c	2020-01-12 05:24:28.000000000 -0500
@@ -2681,7 +2681,7 @@ static void lock_get_status(struct seq_f
 	}
 	if (inode) {
 		/* userspace relies on this representation of dev_t */
-		seq_printf(f, "%d %02x:%02x:%ld ", fl_pid,
+		seq_printf(f, "%d %02x:%02x:%lu ", fl_pid,
 				MAJOR(inode->i_sb->s_dev),
 				MINOR(inode->i_sb->s_dev), inode->i_ino);
 	} else {
diff -druNp --no-dereference linux-libre-4.9.208-gnu/fs/nfsd/nfs4state.c linux-libre-4.9.209-gnu/fs/nfsd/nfs4state.c
--- linux-libre-4.9.208-gnu/fs/nfsd/nfs4state.c	2020-01-04 07:41:15.000000000 -0500
+++ linux-libre-4.9.209-gnu/fs/nfsd/nfs4state.c	2020-01-12 05:24:28.000000000 -0500
@@ -3067,12 +3067,17 @@ static bool replay_matches_cache(struct
 	    (bool)seq->cachethis)
 		return false;
 	/*
-	 * If there's an error than the reply can have fewer ops than
-	 * the call.  But if we cached a reply with *more* ops than the
-	 * call you're sending us now, then this new call is clearly not
-	 * really a replay of the old one:
+	 * If there's an error then the reply can have fewer ops than
+	 * the call.
 	 */
-	if (slot->sl_opcnt < argp->opcnt)
+	if (slot->sl_opcnt < argp->opcnt && !slot->sl_status)
+		return false;
+	/*
+	 * But if we cached a reply with *more* ops than the call you're
+	 * sending us now, then this new call is clearly not really a
+	 * replay of the old one:
+	 */
+	if (slot->sl_opcnt > argp->opcnt)
 		return false;
 	/* This is the only check explicitly called by spec: */
 	if (!same_creds(&rqstp->rq_cred, &slot->sl_cred))
diff -druNp --no-dereference linux-libre-4.9.208-gnu/fs/pstore/ram.c linux-libre-4.9.209-gnu/fs/pstore/ram.c
--- linux-libre-4.9.208-gnu/fs/pstore/ram.c	2020-01-04 07:41:15.000000000 -0500
+++ linux-libre-4.9.209-gnu/fs/pstore/ram.c	2020-01-12 05:24:28.000000000 -0500
@@ -321,6 +321,17 @@ static int notrace ramoops_pstore_write_
 
 	prz = cxt->przs[cxt->dump_write_cnt];
 
+	/*
+	 * Since this is a new crash dump, we need to reset the buffer in
+	 * case it still has an old dump present. Without this, the new dump
+	 * will get appended, which would seriously confuse anything trying
+	 * to check dump file contents. Specifically, ramoops_read_kmsg_hdr()
+	 * expects to find a dump header in the beginning of buffer data, so
+	 * we must to reset the buffer values, in order to ensure that the
+	 * header will be written to the beginning of the buffer.
+	 */
+	persistent_ram_zap(prz);
+
 	hlen = ramoops_write_kmsg_hdr(prz, compressed);
 	if (size + hlen > prz->buffer_size)
 		size = prz->buffer_size - hlen;
diff -druNp --no-dereference linux-libre-4.9.208-gnu/fs/xfs/libxfs/xfs_bmap.c linux-libre-4.9.209-gnu/fs/xfs/libxfs/xfs_bmap.c
--- linux-libre-4.9.208-gnu/fs/xfs/libxfs/xfs_bmap.c	2020-01-04 07:41:15.000000000 -0500
+++ linux-libre-4.9.209-gnu/fs/xfs/libxfs/xfs_bmap.c	2020-01-12 05:24:28.000000000 -0500
@@ -5688,7 +5688,7 @@ __xfs_bunmapi(
 		 * Make sure we don't touch multiple AGF headers out of order
 		 * in a single transaction, as that could cause AB-BA deadlocks.
 		 */
-		if (!wasdel) {
+		if (!wasdel && !isrt) {
 			agno = XFS_FSB_TO_AGNO(mp, del.br_startblock);
 			if (prev_agno != NULLAGNUMBER && prev_agno > agno)
 				break;
diff -druNp --no-dereference linux-libre-4.9.208-gnu/fs/xfs/xfs_log.c linux-libre-4.9.209-gnu/fs/xfs/xfs_log.c
--- linux-libre-4.9.208-gnu/fs/xfs/xfs_log.c	2020-01-04 07:41:15.000000000 -0500
+++ linux-libre-4.9.209-gnu/fs/xfs/xfs_log.c	2020-01-12 05:24:28.000000000 -0500
@@ -1540,6 +1540,8 @@ out_free_iclog:
 		if (iclog->ic_bp)
 			xfs_buf_free(iclog->ic_bp);
 		kmem_free(iclog);
+		if (prev_iclog == log->l_iclog)
+			break;
 	}
 	spinlock_destroy(&log->l_icloglock);
 	xfs_buf_free(log->l_xbuf);
diff -druNp --no-dereference linux-libre-4.9.208-gnu/include/linux/ahci_platform.h linux-libre-4.9.209-gnu/include/linux/ahci_platform.h
--- linux-libre-4.9.208-gnu/include/linux/ahci_platform.h	2020-01-04 07:41:15.000000000 -0500
+++ linux-libre-4.9.209-gnu/include/linux/ahci_platform.h	2020-01-12 05:24:28.000000000 -0500
@@ -23,6 +23,8 @@ struct ahci_host_priv;
 struct platform_device;
 struct scsi_host_template;
 
+int ahci_platform_enable_phys(struct ahci_host_priv *hpriv);
+void ahci_platform_disable_phys(struct ahci_host_priv *hpriv);
 int ahci_platform_enable_clks(struct ahci_host_priv *hpriv);
 void ahci_platform_disable_clks(struct ahci_host_priv *hpriv);
 int ahci_platform_enable_regulators(struct ahci_host_priv *hpriv);
diff -druNp --no-dereference linux-libre-4.9.208-gnu/include/linux/dmaengine.h linux-libre-4.9.209-gnu/include/linux/dmaengine.h
--- linux-libre-4.9.208-gnu/include/linux/dmaengine.h	2020-01-04 07:41:15.000000000 -0500
+++ linux-libre-4.9.209-gnu/include/linux/dmaengine.h	2020-01-12 05:24:28.000000000 -0500
@@ -1358,8 +1358,11 @@ static inline int dma_get_slave_caps(str
 static inline int dmaengine_desc_set_reuse(struct dma_async_tx_descriptor *tx)
 {
 	struct dma_slave_caps caps;
+	int ret;
 
-	dma_get_slave_caps(tx->chan, &caps);
+	ret = dma_get_slave_caps(tx->chan, &caps);
+	if (ret)
+		return ret;
 
 	if (caps.descriptor_reuse) {
 		tx->flags |= DMA_CTRL_REUSE;
diff -druNp --no-dereference linux-libre-4.9.208-gnu/include/linux/if_ether.h linux-libre-4.9.209-gnu/include/linux/if_ether.h
--- linux-libre-4.9.208-gnu/include/linux/if_ether.h	2020-01-04 07:41:15.000000000 -0500
+++ linux-libre-4.9.209-gnu/include/linux/if_ether.h	2020-01-12 05:24:28.000000000 -0500
@@ -28,6 +28,14 @@ static inline struct ethhdr *eth_hdr(con
 	return (struct ethhdr *)skb_mac_header(skb);
 }
 
+/* Prefer this version in TX path, instead of
+ * skb_reset_mac_header() + eth_hdr()
+ */
+static inline struct ethhdr *skb_eth_hdr(const struct sk_buff *skb)
+{
+	return (struct ethhdr *)skb->data;
+}
+
 static inline struct ethhdr *inner_eth_hdr(const struct sk_buff *skb)
 {
 	return (struct ethhdr *)skb_inner_mac_header(skb);
diff -druNp --no-dereference linux-libre-4.9.208-gnu/include/linux/regulator/ab8500.h linux-libre-4.9.209-gnu/include/linux/regulator/ab8500.h
--- linux-libre-4.9.208-gnu/include/linux/regulator/ab8500.h	2020-01-04 07:41:15.000000000 -0500
+++ linux-libre-4.9.209-gnu/include/linux/regulator/ab8500.h	2020-01-12 05:24:28.000000000 -0500
@@ -38,7 +38,6 @@ enum ab8505_regulator_id {
 	AB8505_LDO_AUX6,
 	AB8505_LDO_INTCORE,
 	AB8505_LDO_ADC,
-	AB8505_LDO_USB,
 	AB8505_LDO_AUDIO,
 	AB8505_LDO_ANAMIC1,
 	AB8505_LDO_ANAMIC2,
diff -druNp --no-dereference linux-libre-4.9.208-gnu/include/net/neighbour.h linux-libre-4.9.209-gnu/include/net/neighbour.h
--- linux-libre-4.9.208-gnu/include/net/neighbour.h	2020-01-04 07:41:15.000000000 -0500
+++ linux-libre-4.9.209-gnu/include/net/neighbour.h	2020-01-12 05:24:28.000000000 -0500
@@ -454,7 +454,7 @@ static inline int neigh_hh_output(const
 
 	do {
 		seq = read_seqbegin(&hh->hh_lock);
-		hh_len = hh->hh_len;
+		hh_len = READ_ONCE(hh->hh_len);
 		if (likely(hh_len <= HH_DATA_MOD)) {
 			hh_alen = HH_DATA_MOD;
 
diff -druNp --no-dereference linux-libre-4.9.208-gnu/include/uapi/linux/netfilter/xt_sctp.h linux-libre-4.9.209-gnu/include/uapi/linux/netfilter/xt_sctp.h
--- linux-libre-4.9.208-gnu/include/uapi/linux/netfilter/xt_sctp.h	2020-01-04 07:41:15.000000000 -0500
+++ linux-libre-4.9.209-gnu/include/uapi/linux/netfilter/xt_sctp.h	2020-01-12 05:24:28.000000000 -0500
@@ -40,19 +40,19 @@ struct xt_sctp_info {
 #define SCTP_CHUNKMAP_SET(chunkmap, type) 		\
 	do { 						\
 		(chunkmap)[type / bytes(__u32)] |= 	\
-			1 << (type % bytes(__u32));	\
+			1u << (type % bytes(__u32));	\
 	} while (0)
 
 #define SCTP_CHUNKMAP_CLEAR(chunkmap, type)		 	\
 	do {							\
 		(chunkmap)[type / bytes(__u32)] &= 		\
-			~(1 << (type % bytes(__u32)));	\
+			~(1u << (type % bytes(__u32)));	\
 	} while (0)
 
 #define SCTP_CHUNKMAP_IS_SET(chunkmap, type) 			\
 ({								\
 	((chunkmap)[type / bytes (__u32)] & 		\
-		(1 << (type % bytes (__u32)))) ? 1: 0;	\
+		(1u << (type % bytes (__u32)))) ? 1: 0;	\
 })
 
 #define SCTP_CHUNKMAP_RESET(chunkmap) \
diff -druNp --no-dereference linux-libre-4.9.208-gnu/kernel/cred.c linux-libre-4.9.209-gnu/kernel/cred.c
--- linux-libre-4.9.208-gnu/kernel/cred.c	2020-01-04 07:41:15.000000000 -0500
+++ linux-libre-4.9.209-gnu/kernel/cred.c	2020-01-12 05:24:28.000000000 -0500
@@ -219,7 +219,7 @@ struct cred *cred_alloc_blank(void)
 	new->magic = CRED_MAGIC;
 #endif
 
-	if (security_cred_alloc_blank(new, GFP_KERNEL) < 0)
+	if (security_cred_alloc_blank(new, GFP_KERNEL_ACCOUNT) < 0)
 		goto error;
 
 	return new;
@@ -278,7 +278,7 @@ struct cred *prepare_creds(void)
 	new->security = NULL;
 #endif
 
-	if (security_prepare_creds(new, old, GFP_KERNEL) < 0)
+	if (security_prepare_creds(new, old, GFP_KERNEL_ACCOUNT) < 0)
 		goto error;
 	validate_creds(new);
 	return new;
@@ -653,7 +653,7 @@ struct cred *prepare_kernel_cred(struct
 #ifdef CONFIG_SECURITY
 	new->security = NULL;
 #endif
-	if (security_prepare_creds(new, old, GFP_KERNEL) < 0)
+	if (security_prepare_creds(new, old, GFP_KERNEL_ACCOUNT) < 0)
 		goto error;
 
 	put_cred(old);
diff -druNp --no-dereference linux-libre-4.9.208-gnu/kernel/locking/spinlock_debug.c linux-libre-4.9.209-gnu/kernel/locking/spinlock_debug.c
--- linux-libre-4.9.208-gnu/kernel/locking/spinlock_debug.c	2020-01-04 07:41:15.000000000 -0500
+++ linux-libre-4.9.209-gnu/kernel/locking/spinlock_debug.c	2020-01-12 05:24:28.000000000 -0500
@@ -51,19 +51,19 @@ EXPORT_SYMBOL(__rwlock_init);
 
 static void spin_dump(raw_spinlock_t *lock, const char *msg)
 {
-	struct task_struct *owner = NULL;
+	struct task_struct *owner = READ_ONCE(lock->owner);
 
-	if (lock->owner && lock->owner != SPINLOCK_OWNER_INIT)
-		owner = lock->owner;
+	if (owner == SPINLOCK_OWNER_INIT)
+		owner = NULL;
 	printk(KERN_EMERG "BUG: spinlock %s on CPU#%d, %s/%d\n",
 		msg, raw_smp_processor_id(),
 		current->comm, task_pid_nr(current));
 	printk(KERN_EMERG " lock: %pS, .magic: %08x, .owner: %s/%d, "
 			".owner_cpu: %d\n",
-		lock, lock->magic,
+		lock, READ_ONCE(lock->magic),
 		owner ? owner->comm : "<none>",
 		owner ? task_pid_nr(owner) : -1,
-		lock->owner_cpu);
+		READ_ONCE(lock->owner_cpu));
 	dump_stack();
 }
 
@@ -80,16 +80,16 @@ static void spin_bug(raw_spinlock_t *loc
 static inline void
 debug_spin_lock_before(raw_spinlock_t *lock)
 {
-	SPIN_BUG_ON(lock->magic != SPINLOCK_MAGIC, lock, "bad magic");
-	SPIN_BUG_ON(lock->owner == current, lock, "recursion");
-	SPIN_BUG_ON(lock->owner_cpu == raw_smp_processor_id(),
+	SPIN_BUG_ON(READ_ONCE(lock->magic) != SPINLOCK_MAGIC, lock, "bad magic");
+	SPIN_BUG_ON(READ_ONCE(lock->owner) == current, lock, "recursion");
+	SPIN_BUG_ON(READ_ONCE(lock->owner_cpu) == raw_smp_processor_id(),
 							lock, "cpu recursion");
 }
 
 static inline void debug_spin_lock_after(raw_spinlock_t *lock)
 {
-	lock->owner_cpu = raw_smp_processor_id();
-	lock->owner = current;
+	WRITE_ONCE(lock->owner_cpu, raw_smp_processor_id());
+	WRITE_ONCE(lock->owner, current);
 }
 
 static inline void debug_spin_unlock(raw_spinlock_t *lock)
@@ -99,8 +99,8 @@ static inline void debug_spin_unlock(raw
 	SPIN_BUG_ON(lock->owner != current, lock, "wrong owner");
 	SPIN_BUG_ON(lock->owner_cpu != raw_smp_processor_id(),
 							lock, "wrong CPU");
-	lock->owner = SPINLOCK_OWNER_INIT;
-	lock->owner_cpu = -1;
+	WRITE_ONCE(lock->owner, SPINLOCK_OWNER_INIT);
+	WRITE_ONCE(lock->owner_cpu, -1);
 }
 
 /*
@@ -183,8 +183,8 @@ static inline void debug_write_lock_befo
 
 static inline void debug_write_lock_after(rwlock_t *lock)
 {
-	lock->owner_cpu = raw_smp_processor_id();
-	lock->owner = current;
+	WRITE_ONCE(lock->owner_cpu, raw_smp_processor_id());
+	WRITE_ONCE(lock->owner, current);
 }
 
 static inline void debug_write_unlock(rwlock_t *lock)
@@ -193,8 +193,8 @@ static inline void debug_write_unlock(rw
 	RWLOCK_BUG_ON(lock->owner != current, lock, "wrong owner");
 	RWLOCK_BUG_ON(lock->owner_cpu != raw_smp_processor_id(),
 							lock, "wrong CPU");
-	lock->owner = SPINLOCK_OWNER_INIT;
-	lock->owner_cpu = -1;
+	WRITE_ONCE(lock->owner, SPINLOCK_OWNER_INIT);
+	WRITE_ONCE(lock->owner_cpu, -1);
 }
 
 void do_raw_write_lock(rwlock_t *lock)
diff -druNp --no-dereference linux-libre-4.9.208-gnu/kernel/power/snapshot.c linux-libre-4.9.209-gnu/kernel/power/snapshot.c
--- linux-libre-4.9.208-gnu/kernel/power/snapshot.c	2020-01-04 07:41:15.000000000 -0500
+++ linux-libre-4.9.209-gnu/kernel/power/snapshot.c	2020-01-12 05:24:28.000000000 -0500
@@ -732,8 +732,15 @@ zone_found:
 	 * We have found the zone. Now walk the radix tree to find the leaf node
 	 * for our PFN.
 	 */
+
+	/*
+	 * If the zone we wish to scan is the the current zone and the
+	 * pfn falls into the current node then we do not need to walk
+	 * the tree.
+	 */
 	node = bm->cur.node;
-	if (((pfn - zone->start_pfn) & ~BM_BLOCK_MASK) == bm->cur.node_pfn)
+	if (zone == bm->cur.zone &&
+	    ((pfn - zone->start_pfn) & ~BM_BLOCK_MASK) == bm->cur.node_pfn)
 		goto node_found;
 
 	node      = zone->rtree;
diff -druNp --no-dereference linux-libre-4.9.208-gnu/kernel/taskstats.c linux-libre-4.9.209-gnu/kernel/taskstats.c
--- linux-libre-4.9.208-gnu/kernel/taskstats.c	2020-01-04 07:41:15.000000000 -0500
+++ linux-libre-4.9.209-gnu/kernel/taskstats.c	2020-01-12 05:24:28.000000000 -0500
@@ -559,25 +559,33 @@ static int taskstats_user_cmd(struct sk_
 static struct taskstats *taskstats_tgid_alloc(struct task_struct *tsk)
 {
 	struct signal_struct *sig = tsk->signal;
-	struct taskstats *stats;
+	struct taskstats *stats_new, *stats;
 
-	if (sig->stats || thread_group_empty(tsk))
-		goto ret;
+	/* Pairs with smp_store_release() below. */
+	stats = smp_load_acquire(&sig->stats);
+	if (stats || thread_group_empty(tsk))
+		return stats;
 
 	/* No problem if kmem_cache_zalloc() fails */
-	stats = kmem_cache_zalloc(taskstats_cache, GFP_KERNEL);
+	stats_new = kmem_cache_zalloc(taskstats_cache, GFP_KERNEL);
 
 	spin_lock_irq(&tsk->sighand->siglock);
-	if (!sig->stats) {
-		sig->stats = stats;
-		stats = NULL;
+	stats = sig->stats;
+	if (!stats) {
+		/*
+		 * Pairs with smp_store_release() above and order the
+		 * kmem_cache_zalloc().
+		 */
+		smp_store_release(&sig->stats, stats_new);
+		stats = stats_new;
+		stats_new = NULL;
 	}
 	spin_unlock_irq(&tsk->sighand->siglock);
 
-	if (stats)
-		kmem_cache_free(taskstats_cache, stats);
-ret:
-	return sig->stats;
+	if (stats_new)
+		kmem_cache_free(taskstats_cache, stats_new);
+
+	return stats;
 }
 
 /* Send pid data out on exit */
diff -druNp --no-dereference linux-libre-4.9.208-gnu/kernel/trace/ftrace.c linux-libre-4.9.209-gnu/kernel/trace/ftrace.c
--- linux-libre-4.9.208-gnu/kernel/trace/ftrace.c	2020-01-04 07:41:15.000000000 -0500
+++ linux-libre-4.9.209-gnu/kernel/trace/ftrace.c	2020-01-12 05:24:28.000000000 -0500
@@ -609,8 +609,7 @@ static int function_stat_show(struct seq
 	}
 
 #ifdef CONFIG_FUNCTION_GRAPH_TRACER
-	avg = rec->time;
-	do_div(avg, rec->counter);
+	avg = div64_ul(rec->time, rec->counter);
 	if (tracing_thresh && (avg < tracing_thresh))
 		goto out;
 #endif
@@ -636,7 +635,8 @@ static int function_stat_show(struct seq
 		 * Divide only 1000 for ns^2 -> us^2 conversion.
 		 * trace_print_graph_duration will divide 1000 again.
 		 */
-		do_div(stddev, rec->counter * (rec->counter - 1) * 1000);
+		stddev = div64_ul(stddev,
+				  rec->counter * (rec->counter - 1) * 1000);
 	}
 
 	trace_seq_init(&s);
diff -druNp --no-dereference linux-libre-4.9.208-gnu/kernel/trace/tracing_map.c linux-libre-4.9.209-gnu/kernel/trace/tracing_map.c
--- linux-libre-4.9.208-gnu/kernel/trace/tracing_map.c	2020-01-04 07:41:15.000000000 -0500
+++ linux-libre-4.9.209-gnu/kernel/trace/tracing_map.c	2020-01-12 05:24:28.000000000 -0500
@@ -90,8 +90,8 @@ static int tracing_map_cmp_atomic64(void
 #define DEFINE_TRACING_MAP_CMP_FN(type)					\
 static int tracing_map_cmp_##type(void *val_a, void *val_b)		\
 {									\
-	type a = *(type *)val_a;					\
-	type b = *(type *)val_b;					\
+	type a = (type)(*(u64 *)val_a);					\
+	type b = (type)(*(u64 *)val_b);					\
 									\
 	return (a > b) ? 1 : ((a < b) ? -1 : 0);			\
 }
diff -druNp --no-dereference linux-libre-4.9.208-gnu/Makefile linux-libre-4.9.209-gnu/Makefile
--- linux-libre-4.9.208-gnu/Makefile	2020-01-04 11:31:08.000000000 -0500
+++ linux-libre-4.9.209-gnu/Makefile	2020-01-12 12:06:29.000000000 -0500
@@ -1,6 +1,6 @@
 VERSION = 4
 PATCHLEVEL = 9
-SUBLEVEL = 208
+SUBLEVEL = 209
 EXTRAVERSION = -gnu
 NAME = Roaring Lionus
 
diff -druNp --no-dereference linux-libre-4.9.208-gnu/mm/mmap.c linux-libre-4.9.209-gnu/mm/mmap.c
--- linux-libre-4.9.208-gnu/mm/mmap.c	2020-01-04 07:41:15.000000000 -0500
+++ linux-libre-4.9.209-gnu/mm/mmap.c	2020-01-12 05:24:28.000000000 -0500
@@ -87,12 +87,6 @@ static void unmap_region(struct mm_struc
  * MAP_PRIVATE	r: (no) no	r: (yes) yes	r: (no) yes	r: (no) yes
  *		w: (no) no	w: (no) no	w: (copy) copy	w: (no) no
  *		x: (no) no	x: (no) yes	x: (no) yes	x: (yes) yes
- *
- * On arm64, PROT_EXEC has the following behaviour for both MAP_SHARED and
- * MAP_PRIVATE:
- *								r: (no) no
- *								w: (no) no
- *								x: (yes) yes
  */
 pgprot_t protection_map[16] = {
 	__P000, __P001, __P010, __P011, __P100, __P101, __P110, __P111,
diff -druNp --no-dereference linux-libre-4.9.208-gnu/mm/zsmalloc.c linux-libre-4.9.209-gnu/mm/zsmalloc.c
--- linux-libre-4.9.208-gnu/mm/zsmalloc.c	2020-01-04 07:41:15.000000000 -0500
+++ linux-libre-4.9.209-gnu/mm/zsmalloc.c	2020-01-12 05:24:28.000000000 -0500
@@ -2138,6 +2138,11 @@ int zs_page_migrate(struct address_space
 		zs_pool_dec_isolated(pool);
 	}
 
+	if (page_zone(newpage) != page_zone(page)) {
+		dec_zone_page_state(page, NR_ZSPAGES);
+		inc_zone_page_state(newpage, NR_ZSPAGES);
+	}
+
 	reset_page(page);
 	put_page(page);
 	page = newpage;
diff -druNp --no-dereference linux-libre-4.9.208-gnu/net/8021q/vlan_dev.c linux-libre-4.9.209-gnu/net/8021q/vlan_dev.c
--- linux-libre-4.9.208-gnu/net/8021q/vlan_dev.c	2020-01-04 07:41:15.000000000 -0500
+++ linux-libre-4.9.209-gnu/net/8021q/vlan_dev.c	2020-01-12 05:24:28.000000000 -0500
@@ -610,7 +610,8 @@ static int vlan_dev_init(struct net_devi
 	return 0;
 }
 
-static void vlan_dev_uninit(struct net_device *dev)
+/* Note: this function might be called multiple times for the same device. */
+void vlan_dev_uninit(struct net_device *dev)
 {
 	struct vlan_priority_tci_mapping *pm;
 	struct vlan_dev_priv *vlan = vlan_dev_priv(dev);
diff -druNp --no-dereference linux-libre-4.9.208-gnu/net/8021q/vlan.h linux-libre-4.9.209-gnu/net/8021q/vlan.h
--- linux-libre-4.9.208-gnu/net/8021q/vlan.h	2020-01-04 07:41:15.000000000 -0500
+++ linux-libre-4.9.209-gnu/net/8021q/vlan.h	2020-01-12 05:24:28.000000000 -0500
@@ -109,6 +109,7 @@ int vlan_check_real_dev(struct net_devic
 void vlan_setup(struct net_device *dev);
 int register_vlan_dev(struct net_device *dev);
 void unregister_vlan_dev(struct net_device *dev, struct list_head *head);
+void vlan_dev_uninit(struct net_device *dev);
 bool vlan_dev_inherit_address(struct net_device *dev,
 			      struct net_device *real_dev);
 
diff -druNp --no-dereference linux-libre-4.9.208-gnu/net/8021q/vlan_netlink.c linux-libre-4.9.209-gnu/net/8021q/vlan_netlink.c
--- linux-libre-4.9.208-gnu/net/8021q/vlan_netlink.c	2020-01-04 07:41:15.000000000 -0500
+++ linux-libre-4.9.209-gnu/net/8021q/vlan_netlink.c	2020-01-12 05:24:28.000000000 -0500
@@ -92,11 +92,13 @@ static int vlan_changelink(struct net_de
 	struct ifla_vlan_flags *flags;
 	struct ifla_vlan_qos_mapping *m;
 	struct nlattr *attr;
-	int rem;
+	int rem, err;
 
 	if (data[IFLA_VLAN_FLAGS]) {
 		flags = nla_data(data[IFLA_VLAN_FLAGS]);
-		vlan_dev_change_flags(dev, flags->flags, flags->mask);
+		err = vlan_dev_change_flags(dev, flags->flags, flags->mask);
+		if (err)
+			return err;
 	}
 	if (data[IFLA_VLAN_INGRESS_QOS]) {
 		nla_for_each_nested(attr, data[IFLA_VLAN_INGRESS_QOS], rem) {
@@ -107,7 +109,9 @@ static int vlan_changelink(struct net_de
 	if (data[IFLA_VLAN_EGRESS_QOS]) {
 		nla_for_each_nested(attr, data[IFLA_VLAN_EGRESS_QOS], rem) {
 			m = nla_data(attr);
-			vlan_dev_set_egress_priority(dev, m->from, m->to);
+			err = vlan_dev_set_egress_priority(dev, m->from, m->to);
+			if (err)
+				return err;
 		}
 	}
 	return 0;
@@ -153,10 +157,11 @@ static int vlan_newlink(struct net *src_
 		return -EINVAL;
 
 	err = vlan_changelink(dev, tb, data);
-	if (err < 0)
-		return err;
-
-	return register_vlan_dev(dev);
+	if (!err)
+		err = register_vlan_dev(dev);
+	if (err)
+		vlan_dev_uninit(dev);
+	return err;
 }
 
 static inline size_t vlan_qos_map_size(unsigned int n)
diff -druNp --no-dereference linux-libre-4.9.208-gnu/net/bluetooth/hci_conn.c linux-libre-4.9.209-gnu/net/bluetooth/hci_conn.c
--- linux-libre-4.9.208-gnu/net/bluetooth/hci_conn.c	2020-01-04 07:41:15.000000000 -0500
+++ linux-libre-4.9.209-gnu/net/bluetooth/hci_conn.c	2020-01-12 05:24:28.000000000 -0500
@@ -1054,8 +1054,10 @@ struct hci_conn *hci_connect_le_scan(str
 	if (!conn)
 		return ERR_PTR(-ENOMEM);
 
-	if (hci_explicit_conn_params_set(hdev, dst, dst_type) < 0)
+	if (hci_explicit_conn_params_set(hdev, dst, dst_type) < 0) {
+		hci_conn_del(conn);
 		return ERR_PTR(-EBUSY);
+	}
 
 	conn->state = BT_CONNECT;
 	set_bit(HCI_CONN_SCANNING, &conn->flags);
diff -druNp --no-dereference linux-libre-4.9.208-gnu/net/bluetooth/l2cap_core.c linux-libre-4.9.209-gnu/net/bluetooth/l2cap_core.c
--- linux-libre-4.9.208-gnu/net/bluetooth/l2cap_core.c	2020-01-04 07:41:15.000000000 -0500
+++ linux-libre-4.9.209-gnu/net/bluetooth/l2cap_core.c	2020-01-12 05:24:28.000000000 -0500
@@ -4908,10 +4908,8 @@ void __l2cap_physical_cfm(struct l2cap_c
 	BT_DBG("chan %p, result %d, local_amp_id %d, remote_amp_id %d",
 	       chan, result, local_amp_id, remote_amp_id);
 
-	if (chan->state == BT_DISCONN || chan->state == BT_CLOSED) {
-		l2cap_chan_unlock(chan);
+	if (chan->state == BT_DISCONN || chan->state == BT_CLOSED)
 		return;
-	}
 
 	if (chan->state != BT_CONNECTED) {
 		l2cap_do_create(chan, result, local_amp_id, remote_amp_id);
diff -druNp --no-dereference linux-libre-4.9.208-gnu/net/core/neighbour.c linux-libre-4.9.209-gnu/net/core/neighbour.c
--- linux-libre-4.9.208-gnu/net/core/neighbour.c	2020-01-04 07:41:15.000000000 -0500
+++ linux-libre-4.9.209-gnu/net/core/neighbour.c	2020-01-12 05:24:28.000000000 -0500
@@ -1058,7 +1058,7 @@ static void neigh_update_hhs(struct neig
 
 	if (update) {
 		hh = &neigh->hh;
-		if (hh->hh_len) {
+		if (READ_ONCE(hh->hh_len)) {
 			write_seqlock_bh(&hh->hh_lock);
 			update(hh, neigh->dev, neigh->ha);
 			write_sequnlock_bh(&hh->hh_lock);
@@ -1319,7 +1319,7 @@ int neigh_resolve_output(struct neighbou
 		struct net_device *dev = neigh->dev;
 		unsigned int seq;
 
-		if (dev->header_ops->cache && !neigh->hh.hh_len)
+		if (dev->header_ops->cache && !READ_ONCE(neigh->hh.hh_len))
 			neigh_hh_init(neigh);
 
 		do {
diff -druNp --no-dereference linux-libre-4.9.208-gnu/net/ethernet/eth.c linux-libre-4.9.209-gnu/net/ethernet/eth.c
--- linux-libre-4.9.208-gnu/net/ethernet/eth.c	2020-01-04 07:41:15.000000000 -0500
+++ linux-libre-4.9.209-gnu/net/ethernet/eth.c	2020-01-12 05:24:28.000000000 -0500
@@ -238,7 +238,12 @@ int eth_header_cache(const struct neighb
 	eth->h_proto = type;
 	memcpy(eth->h_source, dev->dev_addr, ETH_ALEN);
 	memcpy(eth->h_dest, neigh->ha, ETH_ALEN);
-	hh->hh_len = ETH_HLEN;
+
+	/* Pairs with READ_ONCE() in neigh_resolve_output(),
+	 * neigh_hh_output() and neigh_update_hhs().
+	 */
+	smp_store_release(&hh->hh_len, ETH_HLEN);
+
 	return 0;
 }
 EXPORT_SYMBOL(eth_header_cache);
diff -druNp --no-dereference linux-libre-4.9.208-gnu/net/ipv4/tcp_input.c linux-libre-4.9.209-gnu/net/ipv4/tcp_input.c
--- linux-libre-4.9.208-gnu/net/ipv4/tcp_input.c	2020-01-04 07:41:15.000000000 -0500
+++ linux-libre-4.9.209-gnu/net/ipv4/tcp_input.c	2020-01-12 05:24:28.000000000 -0500
@@ -1741,8 +1741,11 @@ tcp_sacktag_write_queue(struct sock *sk,
 		}
 
 		/* Ignore very old stuff early */
-		if (!after(sp[used_sacks].end_seq, prior_snd_una))
+		if (!after(sp[used_sacks].end_seq, prior_snd_una)) {
+			if (i == 0)
+				first_sack_index = -1;
 			continue;
+		}
 
 		used_sacks++;
 	}
diff -druNp --no-dereference linux-libre-4.9.208-gnu/net/llc/llc_station.c linux-libre-4.9.209-gnu/net/llc/llc_station.c
--- linux-libre-4.9.208-gnu/net/llc/llc_station.c	2020-01-04 07:41:15.000000000 -0500
+++ linux-libre-4.9.209-gnu/net/llc/llc_station.c	2020-01-12 05:24:28.000000000 -0500
@@ -32,7 +32,7 @@ static int llc_stat_ev_rx_null_dsap_xid_
 	return LLC_PDU_IS_CMD(pdu) &&			/* command PDU */
 	       LLC_PDU_TYPE_IS_U(pdu) &&		/* U type PDU */
 	       LLC_U_PDU_CMD(pdu) == LLC_1_PDU_CMD_XID &&
-	       !pdu->dsap ? 0 : 1;			/* NULL DSAP value */
+	       !pdu->dsap;				/* NULL DSAP value */
 }
 
 static int llc_stat_ev_rx_null_dsap_test_c(struct sk_buff *skb)
@@ -42,7 +42,7 @@ static int llc_stat_ev_rx_null_dsap_test
 	return LLC_PDU_IS_CMD(pdu) &&			/* command PDU */
 	       LLC_PDU_TYPE_IS_U(pdu) &&		/* U type PDU */
 	       LLC_U_PDU_CMD(pdu) == LLC_1_PDU_CMD_TEST &&
-	       !pdu->dsap ? 0 : 1;			/* NULL DSAP */
+	       !pdu->dsap;				/* NULL DSAP */
 }
 
 static int llc_station_ac_send_xid_r(struct sk_buff *skb)
diff -druNp --no-dereference linux-libre-4.9.208-gnu/net/netfilter/nf_conntrack_netlink.c linux-libre-4.9.209-gnu/net/netfilter/nf_conntrack_netlink.c
--- linux-libre-4.9.208-gnu/net/netfilter/nf_conntrack_netlink.c	2020-01-04 07:41:15.000000000 -0500
+++ linux-libre-4.9.209-gnu/net/netfilter/nf_conntrack_netlink.c	2020-01-12 05:24:28.000000000 -0500
@@ -3388,6 +3388,9 @@ static void __net_exit ctnetlink_net_exi
 
 	list_for_each_entry(net, net_exit_list, exit_list)
 		ctnetlink_net_exit(net);
+
+	/* wait for other cpus until they are done with ctnl_notifiers */
+	synchronize_rcu();
 }
 
 static struct pernet_operations ctnetlink_net_ops = {
diff -druNp --no-dereference linux-libre-4.9.208-gnu/net/rfkill/core.c linux-libre-4.9.209-gnu/net/rfkill/core.c
--- linux-libre-4.9.208-gnu/net/rfkill/core.c	2020-01-04 07:41:15.000000000 -0500
+++ linux-libre-4.9.209-gnu/net/rfkill/core.c	2020-01-12 05:24:28.000000000 -0500
@@ -940,10 +940,13 @@ static void rfkill_sync_work(struct work
 int __must_check rfkill_register(struct rfkill *rfkill)
 {
 	static unsigned long rfkill_no;
-	struct device *dev = &rfkill->dev;
+	struct device *dev;
 	int error;
 
-	BUG_ON(!rfkill);
+	if (!rfkill)
+		return -EINVAL;
+
+	dev = &rfkill->dev;
 
 	mutex_lock(&rfkill_global_mutex);
 
diff -druNp --no-dereference linux-libre-4.9.208-gnu/net/rxrpc/peer_event.c linux-libre-4.9.209-gnu/net/rxrpc/peer_event.c
--- linux-libre-4.9.208-gnu/net/rxrpc/peer_event.c	2020-01-04 07:41:15.000000000 -0500
+++ linux-libre-4.9.209-gnu/net/rxrpc/peer_event.c	2020-01-12 05:24:28.000000000 -0500
@@ -148,6 +148,9 @@ void rxrpc_error_report(struct sock *sk)
 	struct rxrpc_peer *peer;
 	struct sk_buff *skb;
 
+	if (unlikely(!local))
+		return;
+
 	_enter("%p{%d}", sk, local->debug_id);
 
 	skb = sock_dequeue_err_skb(sk);
diff -druNp --no-dereference linux-libre-4.9.208-gnu/net/sched/sch_fq.c linux-libre-4.9.209-gnu/net/sched/sch_fq.c
--- linux-libre-4.9.208-gnu/net/sched/sch_fq.c	2020-01-04 07:41:15.000000000 -0500
+++ linux-libre-4.9.209-gnu/net/sched/sch_fq.c	2020-01-12 05:24:28.000000000 -0500
@@ -736,7 +736,7 @@ static int fq_change(struct Qdisc *sch,
 	if (tb[TCA_FQ_QUANTUM]) {
 		u32 quantum = nla_get_u32(tb[TCA_FQ_QUANTUM]);
 
-		if (quantum > 0)
+		if (quantum > 0 && quantum <= (1 << 20))
 			q->quantum = quantum;
 		else
 			err = -EINVAL;
diff -druNp --no-dereference linux-libre-4.9.208-gnu/net/sched/sch_prio.c linux-libre-4.9.209-gnu/net/sched/sch_prio.c
--- linux-libre-4.9.208-gnu/net/sched/sch_prio.c	2020-01-04 07:41:15.000000000 -0500
+++ linux-libre-4.9.209-gnu/net/sched/sch_prio.c	2020-01-12 05:24:28.000000000 -0500
@@ -232,8 +232,14 @@ static int prio_graft(struct Qdisc *sch,
 	struct prio_sched_data *q = qdisc_priv(sch);
 	unsigned long band = arg - 1;
 
-	if (new == NULL)
-		new = &noop_qdisc;
+	if (!new) {
+		new = qdisc_create_dflt(sch->dev_queue, &pfifo_qdisc_ops,
+					TC_H_MAKE(sch->handle, arg));
+		if (!new)
+			new = &noop_qdisc;
+		else
+			qdisc_hash_add(new);
+	}
 
 	*old = qdisc_replace(sch, new, &q->queues[band]);
 	return 0;
diff -druNp --no-dereference linux-libre-4.9.208-gnu/net/sctp/sm_sideeffect.c linux-libre-4.9.209-gnu/net/sctp/sm_sideeffect.c
--- linux-libre-4.9.208-gnu/net/sctp/sm_sideeffect.c	2020-01-04 07:41:15.000000000 -0500
+++ linux-libre-4.9.209-gnu/net/sctp/sm_sideeffect.c	2020-01-12 05:24:28.000000000 -0500
@@ -1321,8 +1321,10 @@ static int sctp_cmd_interpreter(sctp_eve
 			/* Generate an INIT ACK chunk.  */
 			new_obj = sctp_make_init_ack(asoc, chunk, GFP_ATOMIC,
 						     0);
-			if (!new_obj)
-				goto nomem;
+			if (!new_obj) {
+				error = -ENOMEM;
+				break;
+			}
 
 			sctp_add_cmd_sf(commands, SCTP_CMD_REPLY,
 					SCTP_CHUNK(new_obj));
@@ -1344,7 +1346,8 @@ static int sctp_cmd_interpreter(sctp_eve
 			if (!new_obj) {
 				if (cmd->obj.chunk)
 					sctp_chunk_free(cmd->obj.chunk);
-				goto nomem;
+				error = -ENOMEM;
+				break;
 			}
 			sctp_add_cmd_sf(commands, SCTP_CMD_REPLY,
 					SCTP_CHUNK(new_obj));
@@ -1391,8 +1394,10 @@ static int sctp_cmd_interpreter(sctp_eve
 
 			/* Generate a SHUTDOWN chunk.  */
 			new_obj = sctp_make_shutdown(asoc, chunk);
-			if (!new_obj)
-				goto nomem;
+			if (!new_obj) {
+				error = -ENOMEM;
+				break;
+			}
 			sctp_add_cmd_sf(commands, SCTP_CMD_REPLY,
 					SCTP_CHUNK(new_obj));
 			break;
@@ -1721,11 +1726,17 @@ static int sctp_cmd_interpreter(sctp_eve
 			break;
 		}
 
-		if (error)
+		if (error) {
+			cmd = sctp_next_cmd(commands);
+			while (cmd) {
+				if (cmd->verb == SCTP_CMD_REPLY)
+					sctp_chunk_free(cmd->obj.chunk);
+				cmd = sctp_next_cmd(commands);
+			}
 			break;
+		}
 	}
 
-out:
 	/* If this is in response to a received chunk, wait until
 	 * we are done with the packet to open the queue so that we don't
 	 * send multiple packets in response to a single request.
@@ -1740,8 +1751,5 @@ out:
 		sp->data_ready_signalled = 0;
 
 	return error;
-nomem:
-	error = -ENOMEM;
-	goto out;
 }
 
diff -druNp --no-dereference linux-libre-4.9.208-gnu/samples/bpf/trace_event_user.c linux-libre-4.9.209-gnu/samples/bpf/trace_event_user.c
--- linux-libre-4.9.208-gnu/samples/bpf/trace_event_user.c	2020-01-04 07:41:15.000000000 -0500
+++ linux-libre-4.9.209-gnu/samples/bpf/trace_event_user.c	2020-01-12 05:24:28.000000000 -0500
@@ -33,9 +33,9 @@ static void print_ksym(__u64 addr)
 		return;
 	sym = ksym_search(addr);
 	printf("%s;", sym->name);
-	if (!strcmp(sym->name, "sys_read"))
+	if (!strstr(sym->name, "sys_read"))
 		sys_read_seen = true;
-	else if (!strcmp(sym->name, "sys_write"))
+	else if (!strstr(sym->name, "sys_write"))
 		sys_write_seen = true;
 }
 
diff -druNp --no-dereference linux-libre-4.9.208-gnu/scripts/kconfig/expr.c linux-libre-4.9.209-gnu/scripts/kconfig/expr.c
--- linux-libre-4.9.208-gnu/scripts/kconfig/expr.c	2020-01-04 07:41:15.000000000 -0500
+++ linux-libre-4.9.209-gnu/scripts/kconfig/expr.c	2020-01-12 05:24:28.000000000 -0500
@@ -201,6 +201,13 @@ static int expr_eq(struct expr *e1, stru
 {
 	int res, old_count;
 
+	/*
+	 * A NULL expr is taken to be yes, but there's also a different way to
+	 * represent yes. expr_is_yes() checks for either representation.
+	 */
+	if (!e1 || !e2)
+		return expr_is_yes(e1) && expr_is_yes(e2);
+
 	if (e1->type != e2->type)
 		return 0;
 	switch (e1->type) {
diff -druNp --no-dereference linux-libre-4.9.208-gnu/sound/isa/cs423x/cs4236.c linux-libre-4.9.209-gnu/sound/isa/cs423x/cs4236.c
--- linux-libre-4.9.208-gnu/sound/isa/cs423x/cs4236.c	2020-01-04 07:41:15.000000000 -0500
+++ linux-libre-4.9.209-gnu/sound/isa/cs423x/cs4236.c	2020-01-12 05:24:28.000000000 -0500
@@ -293,7 +293,8 @@ static int snd_cs423x_pnp_init_mpu(int d
 	} else {
 		mpu_port[dev] = pnp_port_start(pdev, 0);
 		if (mpu_irq[dev] >= 0 &&
-		    pnp_irq_valid(pdev, 0) && pnp_irq(pdev, 0) >= 0) {
+		    pnp_irq_valid(pdev, 0) &&
+		    pnp_irq(pdev, 0) != (resource_size_t)-1) {
 			mpu_irq[dev] = pnp_irq(pdev, 0);
 		} else {
 			mpu_irq[dev] = -1;	/* disable interrupt */
diff -druNp --no-dereference linux-libre-4.9.208-gnu/sound/pci/ice1712/ice1724.c linux-libre-4.9.209-gnu/sound/pci/ice1712/ice1724.c
--- linux-libre-4.9.208-gnu/sound/pci/ice1712/ice1724.c	2020-01-04 07:41:15.000000000 -0500
+++ linux-libre-4.9.209-gnu/sound/pci/ice1712/ice1724.c	2020-01-12 05:24:28.000000000 -0500
@@ -661,6 +661,7 @@ static int snd_vt1724_set_pro_rate(struc
 	unsigned long flags;
 	unsigned char mclk_change;
 	unsigned int i, old_rate;
+	bool call_set_rate = false;
 
 	if (rate > ice->hw_rates->list[ice->hw_rates->count - 1])
 		return -EINVAL;
@@ -684,7 +685,7 @@ static int snd_vt1724_set_pro_rate(struc
 		 * setting clock rate for internal clock mode */
 		old_rate = ice->get_rate(ice);
 		if (force || (old_rate != rate))
-			ice->set_rate(ice, rate);
+			call_set_rate = true;
 		else if (rate == ice->cur_rate) {
 			spin_unlock_irqrestore(&ice->reg_lock, flags);
 			return 0;
@@ -692,12 +693,14 @@ static int snd_vt1724_set_pro_rate(struc
 	}
 
 	ice->cur_rate = rate;
+	spin_unlock_irqrestore(&ice->reg_lock, flags);
+
+	if (call_set_rate)
+		ice->set_rate(ice, rate);
 
 	/* setting master clock */
 	mclk_change = ice->set_mclk(ice, rate);
 
-	spin_unlock_irqrestore(&ice->reg_lock, flags);
-
 	if (mclk_change && ice->gpio.i2s_mclk_changed)
 		ice->gpio.i2s_mclk_changed(ice);
 	if (ice->gpio.set_pro_rate)
diff -druNp --no-dereference linux-libre-4.9.208-gnu/sound/soc/codecs/wm8962.c linux-libre-4.9.209-gnu/sound/soc/codecs/wm8962.c
--- linux-libre-4.9.208-gnu/sound/soc/codecs/wm8962.c	2020-01-04 07:41:15.000000000 -0500
+++ linux-libre-4.9.209-gnu/sound/soc/codecs/wm8962.c	2020-01-12 05:24:28.000000000 -0500
@@ -2791,7 +2791,7 @@ static int fll_factors(struct _fll_div *
 
 	if (target % Fref == 0) {
 		fll_div->theta = 0;
-		fll_div->lambda = 0;
+		fll_div->lambda = 1;
 	} else {
 		gcd_fll = gcd(target, fratio * Fref);
 
@@ -2861,7 +2861,7 @@ static int wm8962_set_fll(struct snd_soc
 		return -EINVAL;
 	}
 
-	if (fll_div.theta || fll_div.lambda)
+	if (fll_div.theta)
 		fll1 |= WM8962_FLL_FRAC;
 
 	/* Stop the FLL while we reconfigure */
diff -druNp --no-dereference linux-libre-4.9.208-gnu/tools/perf/builtin-report.c linux-libre-4.9.209-gnu/tools/perf/builtin-report.c
--- linux-libre-4.9.208-gnu/tools/perf/builtin-report.c	2020-01-04 07:41:15.000000000 -0500
+++ linux-libre-4.9.209-gnu/tools/perf/builtin-report.c	2020-01-12 05:24:28.000000000 -0500
@@ -292,13 +292,6 @@ static int report__setup_sample_type(str
 				PERF_SAMPLE_BRANCH_ANY))
 		rep->nonany_branch_mode = true;
 
-#ifndef HAVE_LIBUNWIND_SUPPORT
-	if (dwarf_callchain_users) {
-		ui__warning("Please install libunwind development packages "
-			    "during the perf build.\n");
-	}
-#endif
-
 	return 0;
 }
 
