grsecurity-3.1-4.9.10-20170216201620170216

15 files changed, 2368 insertions, 4553 deletions

diff --git a/4.9.9/0000_README b/4.9.10/0000_README
index e2a9385..3bc6d08 100644
--- a/4.9.9/0000_README
+++ b/4.9.10/0000_README
@@ -2,15 +2,11 @@ README
 -----------------------------------------------------------------------------
 Individual Patch Descriptions:
 -----------------------------------------------------------------------------
-Patch:	1007_linux-4.9.8.patch
+Patch:	1009_linux-4.9.10.patch
 From:	http://www.kernel.org
-Desc:	Linux 4.9.8
+Desc:	Linux 4.9.10
 
-Patch:	1008_linux-4.9.9.patch
-From:	http://www.kernel.org
-Desc:	Linux 4.9.9
-
-Patch:	4420_grsecurity-3.1-4.9.9-201702122044.patch
+Patch:	4420_grsecurity-3.1-4.9.10-201702162016.patch
 From:	http://www.grsecurity.net
 Desc:	hardened-sources base patch from upstream grsecurity
 
diff --git a/4.9.10/1009_linux-4.9.10.patch b/4.9.10/1009_linux-4.9.10.patch
new file mode 100644
index 0000000..1767b59
--- /dev/null
+++ b/4.9.10/1009_linux-4.9.10.patch
@@ -0,0 +1,2157 @@
+diff --git a/Makefile b/Makefile
+index c0c41c9..d2fe757 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 4
+ PATCHLEVEL = 9
+-SUBLEVEL = 9
++SUBLEVEL = 10
+ EXTRAVERSION =
+ NAME = Roaring Lionus
+ 
+diff --git a/arch/arc/kernel/unaligned.c b/arch/arc/kernel/unaligned.c
+index 91ebe38..5f69c3b 100644
+--- a/arch/arc/kernel/unaligned.c
++++ b/arch/arc/kernel/unaligned.c
+@@ -243,7 +243,7 @@ int misaligned_fixup(unsigned long address, struct pt_regs *regs,
+ 
+ 	/* clear any remanants of delay slot */
+ 	if (delay_mode(regs)) {
+-		regs->ret = regs->bta ~1U;
++		regs->ret = regs->bta & ~1U;
+ 		regs->status32 &= ~STATUS_DE_MASK;
+ 	} else {
+ 		regs->ret += state.instr_len;
+diff --git a/arch/arm/boot/dts/imx6dl.dtsi b/arch/arm/boot/dts/imx6dl.dtsi
+index 1ade195..7aa120f 100644
+--- a/arch/arm/boot/dts/imx6dl.dtsi
++++ b/arch/arm/boot/dts/imx6dl.dtsi
+@@ -137,7 +137,7 @@
+ &gpio4 {
+ 	gpio-ranges = <&iomuxc  5 136 1>, <&iomuxc  6 145 1>, <&iomuxc  7 150 1>,
+ 		      <&iomuxc  8 146 1>, <&iomuxc  9 151 1>, <&iomuxc 10 147 1>,
+-		      <&iomuxc 11 151 1>, <&iomuxc 12 148 1>, <&iomuxc 13 153 1>,
++		      <&iomuxc 11 152 1>, <&iomuxc 12 148 1>, <&iomuxc 13 153 1>,
+ 		      <&iomuxc 14 149 1>, <&iomuxc 15 154 1>, <&iomuxc 16  39 7>,
+ 		      <&iomuxc 23  56 1>, <&iomuxc 24  61 7>, <&iomuxc 31  46 1>;
+ };
+diff --git a/arch/arm/kernel/ptrace.c b/arch/arm/kernel/ptrace.c
+index ce131ed..ae738a6 100644
+--- a/arch/arm/kernel/ptrace.c
++++ b/arch/arm/kernel/ptrace.c
+@@ -600,7 +600,7 @@ static int gpr_set(struct task_struct *target,
+ 		   const void *kbuf, const void __user *ubuf)
+ {
+ 	int ret;
+-	struct pt_regs newregs;
++	struct pt_regs newregs = *task_pt_regs(target);
+ 
+ 	ret = user_regset_copyin(&pos, &count, &kbuf, &ubuf,
+ 				 &newregs,
+diff --git a/arch/arm/mm/fault.c b/arch/arm/mm/fault.c
+index 3a2e678..0122ad1 100644
+--- a/arch/arm/mm/fault.c
++++ b/arch/arm/mm/fault.c
+@@ -610,9 +610,9 @@ static int __init early_abort_handler(unsigned long addr, unsigned int fsr,
+ 
+ void __init early_abt_enable(void)
+ {
+-	fsr_info[22].fn = early_abort_handler;
++	fsr_info[FSR_FS_AEA].fn = early_abort_handler;
+ 	local_abt_enable();
+-	fsr_info[22].fn = do_bad;
++	fsr_info[FSR_FS_AEA].fn = do_bad;
+ }
+ 
+ #ifndef CONFIG_ARM_LPAE
+diff --git a/arch/arm/mm/fault.h b/arch/arm/mm/fault.h
+index 67532f2..afc1f84 100644
+--- a/arch/arm/mm/fault.h
++++ b/arch/arm/mm/fault.h
+@@ -11,11 +11,15 @@
+ #define FSR_FS5_0		(0x3f)
+ 
+ #ifdef CONFIG_ARM_LPAE
++#define FSR_FS_AEA		17
++
+ static inline int fsr_fs(unsigned int fsr)
+ {
+ 	return fsr & FSR_FS5_0;
+ }
+ #else
++#define FSR_FS_AEA		22
++
+ static inline int fsr_fs(unsigned int fsr)
+ {
+ 	return (fsr & FSR_FS3_0) | (fsr & FSR_FS4) >> 6;
+diff --git a/arch/powerpc/include/asm/reg.h b/arch/powerpc/include/asm/reg.h
+index 9e1499f..13f5fad 100644
+--- a/arch/powerpc/include/asm/reg.h
++++ b/arch/powerpc/include/asm/reg.h
+@@ -641,9 +641,10 @@
+ #define   SRR1_ISI_N_OR_G	0x10000000 /* ISI: Access is no-exec or G */
+ #define   SRR1_ISI_PROT		0x08000000 /* ISI: Other protection fault */
+ #define   SRR1_WAKEMASK		0x00380000 /* reason for wakeup */
+-#define   SRR1_WAKEMASK_P8	0x003c0000 /* reason for wakeup on POWER8 */
++#define   SRR1_WAKEMASK_P8	0x003c0000 /* reason for wakeup on POWER8 and 9 */
+ #define   SRR1_WAKESYSERR	0x00300000 /* System error */
+ #define   SRR1_WAKEEE		0x00200000 /* External interrupt */
++#define   SRR1_WAKEHVI		0x00240000 /* Hypervisor Virtualization Interrupt (P9) */
+ #define   SRR1_WAKEMT		0x00280000 /* mtctrl */
+ #define	  SRR1_WAKEHMI		0x00280000 /* Hypervisor maintenance */
+ #define   SRR1_WAKEDEC		0x00180000 /* Decrementer interrupt */
+diff --git a/arch/powerpc/include/asm/xics.h b/arch/powerpc/include/asm/xics.h
+index f0b2385..e0b9e57 100644
+--- a/arch/powerpc/include/asm/xics.h
++++ b/arch/powerpc/include/asm/xics.h
+@@ -44,6 +44,7 @@ static inline int icp_hv_init(void) { return -ENODEV; }
+ 
+ #ifdef CONFIG_PPC_POWERNV
+ extern int icp_opal_init(void);
++extern void icp_opal_flush_interrupt(void);
+ #else
+ static inline int icp_opal_init(void) { return -ENODEV; }
+ #endif
+diff --git a/arch/powerpc/mm/tlb-radix.c b/arch/powerpc/mm/tlb-radix.c
+index 3493cf4..71697ff 100644
+--- a/arch/powerpc/mm/tlb-radix.c
++++ b/arch/powerpc/mm/tlb-radix.c
+@@ -50,9 +50,7 @@ static inline void _tlbiel_pid(unsigned long pid, unsigned long ric)
+ 	for (set = 0; set < POWER9_TLB_SETS_RADIX ; set++) {
+ 		__tlbiel_pid(pid, set, ric);
+ 	}
+-	if (cpu_has_feature(CPU_FTR_POWER9_DD1))
+-		asm volatile(PPC_INVALIDATE_ERAT : : :"memory");
+-	return;
++	asm volatile(PPC_INVALIDATE_ERAT "; isync" : : :"memory");
+ }
+ 
+ static inline void _tlbie_pid(unsigned long pid, unsigned long ric)
+@@ -85,8 +83,6 @@ static inline void _tlbiel_va(unsigned long va, unsigned long pid,
+ 	asm volatile(PPC_TLBIEL(%0, %4, %3, %2, %1)
+ 		     : : "r"(rb), "i"(r), "i"(prs), "i"(ric), "r"(rs) : "memory");
+ 	asm volatile("ptesync": : :"memory");
+-	if (cpu_has_feature(CPU_FTR_POWER9_DD1))
+-		asm volatile(PPC_INVALIDATE_ERAT : : :"memory");
+ }
+ 
+ static inline void _tlbie_va(unsigned long va, unsigned long pid,
+diff --git a/arch/powerpc/platforms/powernv/smp.c b/arch/powerpc/platforms/powernv/smp.c
+index c789258..eec0e8d 100644
+--- a/arch/powerpc/platforms/powernv/smp.c
++++ b/arch/powerpc/platforms/powernv/smp.c
+@@ -155,8 +155,10 @@ static void pnv_smp_cpu_kill_self(void)
+ 		wmask = SRR1_WAKEMASK_P8;
+ 
+ 	idle_states = pnv_get_supported_cpuidle_states();
++
+ 	/* We don't want to take decrementer interrupts while we are offline,
+-	 * so clear LPCR:PECE1. We keep PECE2 enabled.
++	 * so clear LPCR:PECE1. We keep PECE2 (and LPCR_PECE_HVEE on P9)
++	 * enabled as to let IPIs in.
+ 	 */
+ 	mtspr(SPRN_LPCR, mfspr(SPRN_LPCR) & ~(u64)LPCR_PECE1);
+ 
+@@ -206,8 +208,12 @@ static void pnv_smp_cpu_kill_self(void)
+ 		 * contains 0.
+ 		 */
+ 		if (((srr1 & wmask) == SRR1_WAKEEE) ||
++		    ((srr1 & wmask) == SRR1_WAKEHVI) ||
+ 		    (local_paca->irq_happened & PACA_IRQ_EE)) {
+-			icp_native_flush_interrupt();
++			if (cpu_has_feature(CPU_FTR_ARCH_300))
++				icp_opal_flush_interrupt();
++			else
++				icp_native_flush_interrupt();
+ 		} else if ((srr1 & wmask) == SRR1_WAKEHDBELL) {
+ 			unsigned long msg = PPC_DBELL_TYPE(PPC_DBELL_SERVER);
+ 			asm volatile(PPC_MSGCLR(%0) : : "r" (msg));
+@@ -221,6 +227,8 @@ static void pnv_smp_cpu_kill_self(void)
+ 		if (srr1 && !generic_check_cpu_restart(cpu))
+ 			DBG("CPU%d Unexpected exit while offline !\n", cpu);
+ 	}
++
++	/* Re-enable decrementer interrupts */
+ 	mtspr(SPRN_LPCR, mfspr(SPRN_LPCR) | LPCR_PECE1);
+ 	DBG("CPU%d coming online...\n", cpu);
+ }
+diff --git a/arch/powerpc/sysdev/xics/icp-opal.c b/arch/powerpc/sysdev/xics/icp-opal.c
+index 60c5765..c96c0cb 100644
+--- a/arch/powerpc/sysdev/xics/icp-opal.c
++++ b/arch/powerpc/sysdev/xics/icp-opal.c
+@@ -132,6 +132,35 @@ static irqreturn_t icp_opal_ipi_action(int irq, void *dev_id)
+ 	return smp_ipi_demux();
+ }
+ 
++/*
++ * Called when an interrupt is received on an off-line CPU to
++ * clear the interrupt, so that the CPU can go back to nap mode.
++ */
++void icp_opal_flush_interrupt(void)
++{
++	unsigned int xirr;
++	unsigned int vec;
++
++	do {
++		xirr = icp_opal_get_xirr();
++		vec = xirr & 0x00ffffff;
++		if (vec == XICS_IRQ_SPURIOUS)
++			break;
++		if (vec == XICS_IPI) {
++			/* Clear pending IPI */
++			int cpu = smp_processor_id();
++			kvmppc_set_host_ipi(cpu, 0);
++			opal_int_set_mfrr(get_hard_smp_processor_id(cpu), 0xff);
++		} else {
++			pr_err("XICS: hw interrupt 0x%x to offline cpu, "
++			       "disabling\n", vec);
++			xics_mask_unknown_vec(vec);
++		}
++
++		/* EOI the interrupt */
++	} while (opal_int_eoi(xirr) > 0);
++}
++
+ #endif /* CONFIG_SMP */
+ 
+ static const struct icp_ops icp_opal_ops = {
+diff --git a/arch/x86/include/asm/processor.h b/arch/x86/include/asm/processor.h
+index 984a7bf..83db0ea 100644
+--- a/arch/x86/include/asm/processor.h
++++ b/arch/x86/include/asm/processor.h
+@@ -104,6 +104,7 @@ struct cpuinfo_x86 {
+ 	__u8			x86_phys_bits;
+ 	/* CPUID returned core id bits: */
+ 	__u8			x86_coreid_bits;
++	__u8			cu_id;
+ 	/* Max extended CPUID function supported: */
+ 	__u32			extended_cpuid_level;
+ 	/* Maximum supported CPUID level, -1=no CPUID: */
+diff --git a/arch/x86/kernel/apic/io_apic.c b/arch/x86/kernel/apic/io_apic.c
+index 7249f15..d1e2556 100644
+--- a/arch/x86/kernel/apic/io_apic.c
++++ b/arch/x86/kernel/apic/io_apic.c
+@@ -1876,7 +1876,6 @@ static struct irq_chip ioapic_chip __read_mostly = {
+ 	.irq_ack		= irq_chip_ack_parent,
+ 	.irq_eoi		= ioapic_ack_level,
+ 	.irq_set_affinity	= ioapic_set_affinity,
+-	.irq_retrigger		= irq_chip_retrigger_hierarchy,
+ 	.flags			= IRQCHIP_SKIP_SET_WAKE,
+ };
+ 
+@@ -1888,7 +1887,6 @@ static struct irq_chip ioapic_ir_chip __read_mostly = {
+ 	.irq_ack		= irq_chip_ack_parent,
+ 	.irq_eoi		= ioapic_ir_ack_level,
+ 	.irq_set_affinity	= ioapic_set_affinity,
+-	.irq_retrigger		= irq_chip_retrigger_hierarchy,
+ 	.flags			= IRQCHIP_SKIP_SET_WAKE,
+ };
+ 
+diff --git a/arch/x86/kernel/cpu/amd.c b/arch/x86/kernel/cpu/amd.c
+index 1d31672..2b4cf04 100644
+--- a/arch/x86/kernel/cpu/amd.c
++++ b/arch/x86/kernel/cpu/amd.c
+@@ -309,8 +309,22 @@ static void amd_get_topology(struct cpuinfo_x86 *c)
+ 
+ 	/* get information required for multi-node processors */
+ 	if (boot_cpu_has(X86_FEATURE_TOPOEXT)) {
++		u32 eax, ebx, ecx, edx;
+ 
+-		node_id = cpuid_ecx(0x8000001e) & 7;
++		cpuid(0x8000001e, &eax, &ebx, &ecx, &edx);
++
++		node_id  = ecx & 0xff;
++		smp_num_siblings = ((ebx >> 8) & 0xff) + 1;
++
++		if (c->x86 == 0x15)
++			c->cu_id = ebx & 0xff;
++
++		if (c->x86 >= 0x17) {
++			c->cpu_core_id = ebx & 0xff;
++
++			if (smp_num_siblings > 1)
++				c->x86_max_cores /= smp_num_siblings;
++		}
+ 
+ 		/*
+ 		 * We may have multiple LLCs if L3 caches exist, so check if we
+diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c
+index 023c7bf..4eece91 100644
+--- a/arch/x86/kernel/cpu/common.c
++++ b/arch/x86/kernel/cpu/common.c
+@@ -1015,6 +1015,7 @@ static void identify_cpu(struct cpuinfo_x86 *c)
+ 	c->x86_model_id[0] = '\0';  /* Unset */
+ 	c->x86_max_cores = 1;
+ 	c->x86_coreid_bits = 0;
++	c->cu_id = 0xff;
+ #ifdef CONFIG_X86_64
+ 	c->x86_clflush_size = 64;
+ 	c->x86_phys_bits = 36;
+diff --git a/arch/x86/kernel/smpboot.c b/arch/x86/kernel/smpboot.c
+index e9bbe02..36171bc 100644
+--- a/arch/x86/kernel/smpboot.c
++++ b/arch/x86/kernel/smpboot.c
+@@ -423,9 +423,15 @@ static bool match_smt(struct cpuinfo_x86 *c, struct cpuinfo_x86 *o)
+ 		int cpu1 = c->cpu_index, cpu2 = o->cpu_index;
+ 
+ 		if (c->phys_proc_id == o->phys_proc_id &&
+-		    per_cpu(cpu_llc_id, cpu1) == per_cpu(cpu_llc_id, cpu2) &&
+-		    c->cpu_core_id == o->cpu_core_id)
+-			return topology_sane(c, o, "smt");
++		    per_cpu(cpu_llc_id, cpu1) == per_cpu(cpu_llc_id, cpu2)) {
++			if (c->cpu_core_id == o->cpu_core_id)
++				return topology_sane(c, o, "smt");
++
++			if ((c->cu_id != 0xff) &&
++			    (o->cu_id != 0xff) &&
++			    (c->cu_id == o->cu_id))
++				return topology_sane(c, o, "smt");
++		}
+ 
+ 	} else if (c->phys_proc_id == o->phys_proc_id &&
+ 		   c->cpu_core_id == o->cpu_core_id) {
+diff --git a/arch/x86/mm/dump_pagetables.c b/arch/x86/mm/dump_pagetables.c
+index ea9c49a..8aa6bea 100644
+--- a/arch/x86/mm/dump_pagetables.c
++++ b/arch/x86/mm/dump_pagetables.c
+@@ -15,6 +15,7 @@
+ #include <linux/debugfs.h>
+ #include <linux/mm.h>
+ #include <linux/init.h>
++#include <linux/sched.h>
+ #include <linux/seq_file.h>
+ 
+ #include <asm/pgtable.h>
+@@ -406,6 +407,7 @@ static void ptdump_walk_pgd_level_core(struct seq_file *m, pgd_t *pgd,
+ 		} else
+ 			note_page(m, &st, __pgprot(0), 1);
+ 
++		cond_resched();
+ 		start++;
+ 	}
+ 
+diff --git a/crypto/algif_aead.c b/crypto/algif_aead.c
+index e9c0993..e8817e2 100644
+--- a/crypto/algif_aead.c
++++ b/crypto/algif_aead.c
+@@ -671,9 +671,9 @@ static int aead_recvmsg_sync(struct socket *sock, struct msghdr *msg, int flags)
+ unlock:
+ 	list_for_each_entry_safe(rsgl, tmp, &ctx->list, list) {
+ 		af_alg_free_sg(&rsgl->sgl);
++		list_del(&rsgl->list);
+ 		if (rsgl != &ctx->first_rsgl)
+ 			sock_kfree_s(sk, rsgl, sizeof(*rsgl));
+-		list_del(&rsgl->list);
+ 	}
+ 	INIT_LIST_HEAD(&ctx->list);
+ 	aead_wmem_wakeup(sk);
+diff --git a/drivers/acpi/nfit/core.c b/drivers/acpi/nfit/core.c
+index 312c4b4..6eb6733 100644
+--- a/drivers/acpi/nfit/core.c
++++ b/drivers/acpi/nfit/core.c
+@@ -2704,6 +2704,7 @@ static int acpi_nfit_flush_probe(struct nvdimm_bus_descriptor *nd_desc)
+ 	struct acpi_nfit_desc *acpi_desc = to_acpi_nfit_desc(nd_desc);
+ 	struct device *dev = acpi_desc->dev;
+ 	struct acpi_nfit_flush_work flush;
++	int rc;
+ 
+ 	/* bounce the device lock to flush acpi_nfit_add / acpi_nfit_notify */
+ 	device_lock(dev);
+@@ -2716,7 +2717,10 @@ static int acpi_nfit_flush_probe(struct nvdimm_bus_descriptor *nd_desc)
+ 	INIT_WORK_ONSTACK(&flush.work, flush_probe);
+ 	COMPLETION_INITIALIZER_ONSTACK(flush.cmp);
+ 	queue_work(nfit_wq, &flush.work);
+-	return wait_for_completion_interruptible(&flush.cmp);
++
++	rc = wait_for_completion_interruptible(&flush.cmp);
++	cancel_work_sync(&flush.work);
++	return rc;
+ }
+ 
+ static int acpi_nfit_clear_to_send(struct nvdimm_bus_descriptor *nd_desc,
+diff --git a/drivers/cpufreq/intel_pstate.c b/drivers/cpufreq/intel_pstate.c
+index 4737520..80fa656 100644
+--- a/drivers/cpufreq/intel_pstate.c
++++ b/drivers/cpufreq/intel_pstate.c
+@@ -820,6 +820,25 @@ static void intel_pstate_hwp_enable(struct cpudata *cpudata)
+ 	wrmsrl_on_cpu(cpudata->cpu, MSR_PM_ENABLE, 0x1);
+ }
+ 
++#define MSR_IA32_POWER_CTL_BIT_EE	19
++
++/* Disable energy efficiency optimization */
++static void intel_pstate_disable_ee(int cpu)
++{
++	u64 power_ctl;
++	int ret;
++
++	ret = rdmsrl_on_cpu(cpu, MSR_IA32_POWER_CTL, &power_ctl);
++	if (ret)
++		return;
++
++	if (!(power_ctl & BIT(MSR_IA32_POWER_CTL_BIT_EE))) {
++		pr_info("Disabling energy efficiency optimization\n");
++		power_ctl |= BIT(MSR_IA32_POWER_CTL_BIT_EE);
++		wrmsrl_on_cpu(cpu, MSR_IA32_POWER_CTL, power_ctl);
++	}
++}
++
+ static int atom_get_min_pstate(void)
+ {
+ 	u64 value;
+@@ -1420,6 +1439,11 @@ static const struct x86_cpu_id intel_pstate_cpu_oob_ids[] __initconst = {
+ 	{}
+ };
+ 
++static const struct x86_cpu_id intel_pstate_cpu_ee_disable_ids[] = {
++	ICPU(INTEL_FAM6_KABYLAKE_DESKTOP, core_params),
++	{}
++};
++
+ static int intel_pstate_init_cpu(unsigned int cpunum)
+ {
+ 	struct cpudata *cpu;
+@@ -1435,6 +1459,12 @@ static int intel_pstate_init_cpu(unsigned int cpunum)
+ 	cpu->cpu = cpunum;
+ 
+ 	if (hwp_active) {
++		const struct x86_cpu_id *id;
++
++		id = x86_match_cpu(intel_pstate_cpu_ee_disable_ids);
++		if (id)
++			intel_pstate_disable_ee(cpunum);
++
+ 		intel_pstate_hwp_enable(cpu);
+ 		pid_params.sample_rate_ms = 50;
+ 		pid_params.sample_rate_ns = 50 * NSEC_PER_MSEC;
+diff --git a/drivers/crypto/ccp/ccp-dev-v5.c b/drivers/crypto/ccp/ccp-dev-v5.c
+index faf3cb3..a388bf2 100644
+--- a/drivers/crypto/ccp/ccp-dev-v5.c
++++ b/drivers/crypto/ccp/ccp-dev-v5.c
+@@ -955,7 +955,7 @@ static irqreturn_t ccp5_irq_handler(int irq, void *data)
+ static void ccp5_config(struct ccp_device *ccp)
+ {
+ 	/* Public side */
+-	iowrite32(0x00001249, ccp->io_regs + CMD5_REQID_CONFIG_OFFSET);
++	iowrite32(0x0, ccp->io_regs + CMD5_REQID_CONFIG_OFFSET);
+ }
+ 
+ static void ccp5other_config(struct ccp_device *ccp)
+diff --git a/drivers/crypto/ccp/ccp-dev.h b/drivers/crypto/ccp/ccp-dev.h
+index da5f4a6..340aef1 100644
+--- a/drivers/crypto/ccp/ccp-dev.h
++++ b/drivers/crypto/ccp/ccp-dev.h
+@@ -238,6 +238,7 @@ struct ccp_dma_chan {
+ 	struct ccp_device *ccp;
+ 
+ 	spinlock_t lock;
++	struct list_head created;
+ 	struct list_head pending;
+ 	struct list_head active;
+ 	struct list_head complete;
+diff --git a/drivers/crypto/ccp/ccp-dmaengine.c b/drivers/crypto/ccp/ccp-dmaengine.c
+index 6553912..e5d9278 100644
+--- a/drivers/crypto/ccp/ccp-dmaengine.c
++++ b/drivers/crypto/ccp/ccp-dmaengine.c
+@@ -63,6 +63,7 @@ static void ccp_free_chan_resources(struct dma_chan *dma_chan)
+ 	ccp_free_desc_resources(chan->ccp, &chan->complete);
+ 	ccp_free_desc_resources(chan->ccp, &chan->active);
+ 	ccp_free_desc_resources(chan->ccp, &chan->pending);
++	ccp_free_desc_resources(chan->ccp, &chan->created);
+ 
+ 	spin_unlock_irqrestore(&chan->lock, flags);
+ }
+@@ -273,6 +274,7 @@ static dma_cookie_t ccp_tx_submit(struct dma_async_tx_descriptor *tx_desc)
+ 	spin_lock_irqsave(&chan->lock, flags);
+ 
+ 	cookie = dma_cookie_assign(tx_desc);
++	list_del(&desc->entry);
+ 	list_add_tail(&desc->entry, &chan->pending);
+ 
+ 	spin_unlock_irqrestore(&chan->lock, flags);
+@@ -426,7 +428,7 @@ static struct ccp_dma_desc *ccp_create_desc(struct dma_chan *dma_chan,
+ 
+ 	spin_lock_irqsave(&chan->lock, sflags);
+ 
+-	list_add_tail(&desc->entry, &chan->pending);
++	list_add_tail(&desc->entry, &chan->created);
+ 
+ 	spin_unlock_irqrestore(&chan->lock, sflags);
+ 
+@@ -610,6 +612,7 @@ static int ccp_terminate_all(struct dma_chan *dma_chan)
+ 	/*TODO: Purge the complete list? */
+ 	ccp_free_desc_resources(chan->ccp, &chan->active);
+ 	ccp_free_desc_resources(chan->ccp, &chan->pending);
++	ccp_free_desc_resources(chan->ccp, &chan->created);
+ 
+ 	spin_unlock_irqrestore(&chan->lock, flags);
+ 
+@@ -679,6 +682,7 @@ int ccp_dmaengine_register(struct ccp_device *ccp)
+ 		chan->ccp = ccp;
+ 
+ 		spin_lock_init(&chan->lock);
++		INIT_LIST_HEAD(&chan->created);
+ 		INIT_LIST_HEAD(&chan->pending);
+ 		INIT_LIST_HEAD(&chan->active);
+ 		INIT_LIST_HEAD(&chan->complete);
+diff --git a/drivers/crypto/chelsio/chcr_core.c b/drivers/crypto/chelsio/chcr_core.c
+index fb5f9bb..6aece3f 100644
+--- a/drivers/crypto/chelsio/chcr_core.c
++++ b/drivers/crypto/chelsio/chcr_core.c
+@@ -51,6 +51,7 @@ static struct cxgb4_uld_info chcr_uld_info = {
+ int assign_chcr_device(struct chcr_dev **dev)
+ {
+ 	struct uld_ctx *u_ctx;
++	int ret = -ENXIO;
+ 
+ 	/*
+ 	 * Which device to use if multiple devices are available TODO
+@@ -58,15 +59,14 @@ int assign_chcr_device(struct chcr_dev **dev)
+ 	 * must go to the same device to maintain the ordering.
+ 	 */
+ 	mutex_lock(&dev_mutex); /* TODO ? */
+-	u_ctx = list_first_entry(&uld_ctx_list, struct uld_ctx, entry);
+-	if (!u_ctx) {
+-		mutex_unlock(&dev_mutex);
+-		return -ENXIO;
++	list_for_each_entry(u_ctx, &uld_ctx_list, entry)
++		if (u_ctx && u_ctx->dev) {
++			*dev = u_ctx->dev;
++			ret = 0;
++			break;
+ 	}
+-
+-	*dev = u_ctx->dev;
+ 	mutex_unlock(&dev_mutex);
+-	return 0;
++	return ret;
+ }
+ 
+ static int chcr_dev_add(struct uld_ctx *u_ctx)
+@@ -203,10 +203,8 @@ static int chcr_uld_state_change(void *handle, enum cxgb4_state state)
+ 
+ static int __init chcr_crypto_init(void)
+ {
+-	if (cxgb4_register_uld(CXGB4_ULD_CRYPTO, &chcr_uld_info)) {
++	if (cxgb4_register_uld(CXGB4_ULD_CRYPTO, &chcr_uld_info))
+ 		pr_err("ULD register fail: No chcr crypto support in cxgb4");
+-		return -1;
+-	}
+ 
+ 	return 0;
+ }
+diff --git a/drivers/crypto/qat/qat_c62x/adf_drv.c b/drivers/crypto/qat/qat_c62x/adf_drv.c
+index bc5cbc1..5b2d78a 100644
+--- a/drivers/crypto/qat/qat_c62x/adf_drv.c
++++ b/drivers/crypto/qat/qat_c62x/adf_drv.c
+@@ -233,7 +233,7 @@ static int adf_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
+ 			      &hw_data->accel_capabilities_mask);
+ 
+ 	/* Find and map all the device's BARS */
+-	i = 0;
++	i = (hw_data->fuses & ADF_DEVICE_FUSECTL_MASK) ? 1 : 0;
+ 	bar_mask = pci_select_bars(pdev, IORESOURCE_MEM);
+ 	for_each_set_bit(bar_nr, (const unsigned long *)&bar_mask,
+ 			 ADF_PCI_MAX_BARS * 2) {
+diff --git a/drivers/crypto/qat/qat_common/adf_accel_devices.h b/drivers/crypto/qat/qat_common/adf_accel_devices.h
+index e882253..33f0a62 100644
+--- a/drivers/crypto/qat/qat_common/adf_accel_devices.h
++++ b/drivers/crypto/qat/qat_common/adf_accel_devices.h
+@@ -69,6 +69,7 @@
+ #define ADF_ERRSOU5 (0x3A000 + 0xD8)
+ #define ADF_DEVICE_FUSECTL_OFFSET 0x40
+ #define ADF_DEVICE_LEGFUSE_OFFSET 0x4C
++#define ADF_DEVICE_FUSECTL_MASK 0x80000000
+ #define ADF_PCI_MAX_BARS 3
+ #define ADF_DEVICE_NAME_LENGTH 32
+ #define ADF_ETR_MAX_RINGS_PER_BANK 16
+diff --git a/drivers/crypto/qat/qat_common/qat_hal.c b/drivers/crypto/qat/qat_common/qat_hal.c
+index 1e480f1..8c4fd25 100644
+--- a/drivers/crypto/qat/qat_common/qat_hal.c
++++ b/drivers/crypto/qat/qat_common/qat_hal.c
+@@ -456,7 +456,7 @@ static int qat_hal_init_esram(struct icp_qat_fw_loader_handle *handle)
+ 	unsigned int csr_val;
+ 	int times = 30;
+ 
+-	if (handle->pci_dev->device == ADF_C3XXX_PCI_DEVICE_ID)
++	if (handle->pci_dev->device != ADF_DH895XCC_PCI_DEVICE_ID)
+ 		return 0;
+ 
+ 	csr_val = ADF_CSR_RD(csr_addr, 0);
+@@ -716,7 +716,7 @@ int qat_hal_init(struct adf_accel_dev *accel_dev)
+ 		(void __iomem *)((uintptr_t)handle->hal_cap_ae_xfer_csr_addr_v +
+ 				 LOCAL_TO_XFER_REG_OFFSET);
+ 	handle->pci_dev = pci_info->pci_dev;
+-	if (handle->pci_dev->device != ADF_C3XXX_PCI_DEVICE_ID) {
++	if (handle->pci_dev->device == ADF_DH895XCC_PCI_DEVICE_ID) {
+ 		sram_bar =
+ 			&pci_info->pci_bars[hw_data->get_sram_bar_id(hw_data)];
+ 		handle->hal_sram_addr_v = sram_bar->virt_addr;
+diff --git a/drivers/gpu/drm/drm_atomic.c b/drivers/gpu/drm/drm_atomic.c
+index e6862a7..4e19bde 100644
+--- a/drivers/gpu/drm/drm_atomic.c
++++ b/drivers/gpu/drm/drm_atomic.c
+@@ -1759,16 +1759,16 @@ int drm_mode_atomic_ioctl(struct drm_device *dev,
+ 
+ 	if (ret && arg->flags & DRM_MODE_PAGE_FLIP_EVENT) {
+ 		/*
+-		 * TEST_ONLY and PAGE_FLIP_EVENT are mutually exclusive,
+-		 * if they weren't, this code should be called on success
+-		 * for TEST_ONLY too.
++		 * Free the allocated event. drm_atomic_helper_setup_commit
++		 * can allocate an event too, so only free it if it's ours
++		 * to prevent a double free in drm_atomic_state_clear.
+ 		 */
+-
+ 		for_each_crtc_in_state(state, crtc, crtc_state, i) {
+-			if (!crtc_state->event)
+-				continue;
+-
+-			drm_event_cancel_free(dev, &crtc_state->event->base);
++			struct drm_pending_vblank_event *event = crtc_state->event;
++			if (event && (event->base.fence || event->base.file_priv)) {
++				drm_event_cancel_free(dev, &event->base);
++				crtc_state->event = NULL;
++			}
+ 		}
+ 	}
+ 
+diff --git a/drivers/gpu/drm/i915/i915_gem_execbuffer.c b/drivers/gpu/drm/i915/i915_gem_execbuffer.c
+index a218c2e..0c400f8 100644
+--- a/drivers/gpu/drm/i915/i915_gem_execbuffer.c
++++ b/drivers/gpu/drm/i915/i915_gem_execbuffer.c
+@@ -1215,14 +1215,14 @@ validate_exec_list(struct drm_device *dev,
+ 			if (exec[i].offset !=
+ 			    gen8_canonical_addr(exec[i].offset & PAGE_MASK))
+ 				return -EINVAL;
+-
+-			/* From drm_mm perspective address space is continuous,
+-			 * so from this point we're always using non-canonical
+-			 * form internally.
+-			 */
+-			exec[i].offset = gen8_noncanonical_addr(exec[i].offset);
+ 		}
+ 
++		/* From drm_mm perspective address space is continuous,
++		 * so from this point we're always using non-canonical
++		 * form internally.
++		 */
++		exec[i].offset = gen8_noncanonical_addr(exec[i].offset);
++
+ 		if (exec[i].alignment && !is_power_of_2(exec[i].alignment))
+ 			return -EINVAL;
+ 
+diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
+index 8079e5b..b9be8a6 100644
+--- a/drivers/gpu/drm/i915/intel_display.c
++++ b/drivers/gpu/drm/i915/intel_display.c
+@@ -4280,10 +4280,10 @@ static void page_flip_completed(struct intel_crtc *intel_crtc)
+ 	drm_crtc_vblank_put(&intel_crtc->base);
+ 
+ 	wake_up_all(&dev_priv->pending_flip_queue);
+-	queue_work(dev_priv->wq, &work->unpin_work);
+-
+ 	trace_i915_flip_complete(intel_crtc->plane,
+ 				 work->pending_flip_obj);
++
++	queue_work(dev_priv->wq, &work->unpin_work);
+ }
+ 
+ static int intel_crtc_wait_for_pending_flips(struct drm_crtc *crtc)
+diff --git a/drivers/gpu/drm/i915/intel_dpll_mgr.c b/drivers/gpu/drm/i915/intel_dpll_mgr.c
+index 1c59ca5..cae27c5 100644
+--- a/drivers/gpu/drm/i915/intel_dpll_mgr.c
++++ b/drivers/gpu/drm/i915/intel_dpll_mgr.c
+@@ -1723,7 +1723,8 @@ bxt_get_dpll(struct intel_crtc *crtc,
+ 		return NULL;
+ 
+ 	if ((encoder->type == INTEL_OUTPUT_DP ||
+-	     encoder->type == INTEL_OUTPUT_EDP) &&
++	     encoder->type == INTEL_OUTPUT_EDP ||
++	     encoder->type == INTEL_OUTPUT_DP_MST) &&
+ 	    !bxt_ddi_dp_set_dpll_hw_state(clock, &dpll_hw_state))
+ 		return NULL;
+ 
+diff --git a/drivers/hv/channel.c b/drivers/hv/channel.c
+index 16f91c8..5fb4c6d 100644
+--- a/drivers/hv/channel.c
++++ b/drivers/hv/channel.c
+@@ -39,7 +39,7 @@
+  * vmbus_setevent- Trigger an event notification on the specified
+  * channel.
+  */
+-static void vmbus_setevent(struct vmbus_channel *channel)
++void vmbus_setevent(struct vmbus_channel *channel)
+ {
+ 	struct hv_monitor_page *monitorpage;
+ 
+@@ -65,6 +65,7 @@ static void vmbus_setevent(struct vmbus_channel *channel)
+ 		vmbus_set_event(channel);
+ 	}
+ }
++EXPORT_SYMBOL_GPL(vmbus_setevent);
+ 
+ /*
+  * vmbus_open - Open the specified channel.
+@@ -635,8 +636,6 @@ int vmbus_sendpacket_ctl(struct vmbus_channel *channel, void *buffer,
+ 	u32 packetlen_aligned = ALIGN(packetlen, sizeof(u64));
+ 	struct kvec bufferlist[3];
+ 	u64 aligned_data = 0;
+-	int ret;
+-	bool signal = false;
+ 	bool lock = channel->acquire_ring_lock;
+ 	int num_vecs = ((bufferlen != 0) ? 3 : 1);
+ 
+@@ -656,33 +655,9 @@ int vmbus_sendpacket_ctl(struct vmbus_channel *channel, void *buffer,
+ 	bufferlist[2].iov_base = &aligned_data;
+ 	bufferlist[2].iov_len = (packetlen_aligned - packetlen);
+ 
+-	ret = hv_ringbuffer_write(&channel->outbound, bufferlist, num_vecs,
+-				  &signal, lock, channel->signal_policy);
+-
+-	/*
+-	 * Signalling the host is conditional on many factors:
+-	 * 1. The ring state changed from being empty to non-empty.
+-	 *    This is tracked by the variable "signal".
+-	 * 2. The variable kick_q tracks if more data will be placed
+-	 *    on the ring. We will not signal if more data is
+-	 *    to be placed.
+-	 *
+-	 * Based on the channel signal state, we will decide
+-	 * which signaling policy will be applied.
+-	 *
+-	 * If we cannot write to the ring-buffer; signal the host
+-	 * even if we may not have written anything. This is a rare
+-	 * enough condition that it should not matter.
+-	 * NOTE: in this case, the hvsock channel is an exception, because
+-	 * it looks the host side's hvsock implementation has a throttling
+-	 * mechanism which can hurt the performance otherwise.
+-	 */
+-
+-	if (((ret == 0) && kick_q && signal) ||
+-	    (ret && !is_hvsock_channel(channel)))
+-		vmbus_setevent(channel);
++	return hv_ringbuffer_write(channel, bufferlist, num_vecs,
++				   lock, kick_q);
+ 
+-	return ret;
+ }
+ EXPORT_SYMBOL(vmbus_sendpacket_ctl);
+ 
+@@ -723,7 +698,6 @@ int vmbus_sendpacket_pagebuffer_ctl(struct vmbus_channel *channel,
+ 				     u32 flags,
+ 				     bool kick_q)
+ {
+-	int ret;
+ 	int i;
+ 	struct vmbus_channel_packet_page_buffer desc;
+ 	u32 descsize;
+@@ -731,7 +705,6 @@ int vmbus_sendpacket_pagebuffer_ctl(struct vmbus_channel *channel,
+ 	u32 packetlen_aligned;
+ 	struct kvec bufferlist[3];
+ 	u64 aligned_data = 0;
+-	bool signal = false;
+ 	bool lock = channel->acquire_ring_lock;
+ 
+ 	if (pagecount > MAX_PAGE_BUFFER_COUNT)
+@@ -769,29 +742,8 @@ int vmbus_sendpacket_pagebuffer_ctl(struct vmbus_channel *channel,
+ 	bufferlist[2].iov_base = &aligned_data;
+ 	bufferlist[2].iov_len = (packetlen_aligned - packetlen);
+ 
+-	ret = hv_ringbuffer_write(&channel->outbound, bufferlist, 3,
+-				  &signal, lock, channel->signal_policy);
+-
+-	/*
+-	 * Signalling the host is conditional on many factors:
+-	 * 1. The ring state changed from being empty to non-empty.
+-	 *    This is tracked by the variable "signal".
+-	 * 2. The variable kick_q tracks if more data will be placed
+-	 *    on the ring. We will not signal if more data is
+-	 *    to be placed.
+-	 *
+-	 * Based on the channel signal state, we will decide
+-	 * which signaling policy will be applied.
+-	 *
+-	 * If we cannot write to the ring-buffer; signal the host
+-	 * even if we may not have written anything. This is a rare
+-	 * enough condition that it should not matter.
+-	 */
+-
+-	if (((ret == 0) && kick_q && signal) || (ret))
+-		vmbus_setevent(channel);
+-
+-	return ret;
++	return hv_ringbuffer_write(channel, bufferlist, 3,
++				   lock, kick_q);
+ }
+ EXPORT_SYMBOL_GPL(vmbus_sendpacket_pagebuffer_ctl);
+ 
+@@ -822,12 +774,10 @@ int vmbus_sendpacket_mpb_desc(struct vmbus_channel *channel,
+ 			      u32 desc_size,
+ 			      void *buffer, u32 bufferlen, u64 requestid)
+ {
+-	int ret;
+ 	u32 packetlen;
+ 	u32 packetlen_aligned;
+ 	struct kvec bufferlist[3];
+ 	u64 aligned_data = 0;
+-	bool signal = false;
+ 	bool lock = channel->acquire_ring_lock;
+ 
+ 	packetlen = desc_size + bufferlen;
+@@ -848,13 +798,8 @@ int vmbus_sendpacket_mpb_desc(struct vmbus_channel *channel,
+ 	bufferlist[2].iov_base = &aligned_data;
+ 	bufferlist[2].iov_len = (packetlen_aligned - packetlen);
+ 
+-	ret = hv_ringbuffer_write(&channel->outbound, bufferlist, 3,
+-				  &signal, lock, channel->signal_policy);
+-
+-	if (ret == 0 && signal)
+-		vmbus_setevent(channel);
+-
+-	return ret;
++	return hv_ringbuffer_write(channel, bufferlist, 3,
++				   lock, true);
+ }
+ EXPORT_SYMBOL_GPL(vmbus_sendpacket_mpb_desc);
+ 
+@@ -866,14 +811,12 @@ int vmbus_sendpacket_multipagebuffer(struct vmbus_channel *channel,
+ 				struct hv_multipage_buffer *multi_pagebuffer,
+ 				void *buffer, u32 bufferlen, u64 requestid)
+ {
+-	int ret;
+ 	struct vmbus_channel_packet_multipage_buffer desc;
+ 	u32 descsize;
+ 	u32 packetlen;
+ 	u32 packetlen_aligned;
+ 	struct kvec bufferlist[3];
+ 	u64 aligned_data = 0;
+-	bool signal = false;
+ 	bool lock = channel->acquire_ring_lock;
+ 	u32 pfncount = NUM_PAGES_SPANNED(multi_pagebuffer->offset,
+ 					 multi_pagebuffer->len);
+@@ -913,13 +856,8 @@ int vmbus_sendpacket_multipagebuffer(struct vmbus_channel *channel,
+ 	bufferlist[2].iov_base = &aligned_data;
+ 	bufferlist[2].iov_len = (packetlen_aligned - packetlen);
+ 
+-	ret = hv_ringbuffer_write(&channel->outbound, bufferlist, 3,
+-				  &signal, lock, channel->signal_policy);
+-
+-	if (ret == 0 && signal)
+-		vmbus_setevent(channel);
+-
+-	return ret;
++	return hv_ringbuffer_write(channel, bufferlist, 3,
++				   lock, true);
+ }
+ EXPORT_SYMBOL_GPL(vmbus_sendpacket_multipagebuffer);
+ 
+@@ -941,16 +879,9 @@ __vmbus_recvpacket(struct vmbus_channel *channel, void *buffer,
+ 		   u32 bufferlen, u32 *buffer_actual_len, u64 *requestid,
+ 		   bool raw)
+ {
+-	int ret;
+-	bool signal = false;
++	return hv_ringbuffer_read(channel, buffer, bufferlen,
++				  buffer_actual_len, requestid, raw);
+ 
+-	ret = hv_ringbuffer_read(&channel->inbound, buffer, bufferlen,
+-				 buffer_actual_len, requestid, &signal, raw);
+-
+-	if (signal)
+-		vmbus_setevent(channel);
+-
+-	return ret;
+ }
+ 
+ int vmbus_recvpacket(struct vmbus_channel *channel, void *buffer,
+diff --git a/drivers/hv/channel_mgmt.c b/drivers/hv/channel_mgmt.c
+index 1bc1d479..caf3418 100644
+--- a/drivers/hv/channel_mgmt.c
++++ b/drivers/hv/channel_mgmt.c
+@@ -449,8 +449,6 @@ static void vmbus_process_offer(struct vmbus_channel *newchannel)
+ 	}
+ 
+ 	dev_type = hv_get_dev_type(newchannel);
+-	if (dev_type == HV_NIC)
+-		set_channel_signal_state(newchannel, HV_SIGNAL_POLICY_EXPLICIT);
+ 
+ 	init_vp_index(newchannel, dev_type);
+ 
+diff --git a/drivers/hv/hyperv_vmbus.h b/drivers/hv/hyperv_vmbus.h
+index a5b4442..2b13f2a 100644
+--- a/drivers/hv/hyperv_vmbus.h
++++ b/drivers/hv/hyperv_vmbus.h
+@@ -527,14 +527,14 @@ int hv_ringbuffer_init(struct hv_ring_buffer_info *ring_info,
+ 
+ void hv_ringbuffer_cleanup(struct hv_ring_buffer_info *ring_info);
+ 
+-int hv_ringbuffer_write(struct hv_ring_buffer_info *ring_info,
++int hv_ringbuffer_write(struct vmbus_channel *channel,
+ 		    struct kvec *kv_list,
+-		    u32 kv_count, bool *signal, bool lock,
+-		    enum hv_signal_policy policy);
++		    u32 kv_count, bool lock,
++		    bool kick_q);
+ 
+-int hv_ringbuffer_read(struct hv_ring_buffer_info *inring_info,
++int hv_ringbuffer_read(struct vmbus_channel *channel,
+ 		       void *buffer, u32 buflen, u32 *buffer_actual_len,
+-		       u64 *requestid, bool *signal, bool raw);
++		       u64 *requestid, bool raw);
+ 
+ void hv_ringbuffer_get_debuginfo(struct hv_ring_buffer_info *ring_info,
+ 			    struct hv_ring_buffer_debug_info *debug_info);
+diff --git a/drivers/hv/ring_buffer.c b/drivers/hv/ring_buffer.c
+index 08043da..308dbda 100644
+--- a/drivers/hv/ring_buffer.c
++++ b/drivers/hv/ring_buffer.c
+@@ -66,21 +66,25 @@ u32 hv_end_read(struct hv_ring_buffer_info *rbi)
+  *	   once the ring buffer is empty, it will clear the
+  *	   interrupt_mask and re-check to see if new data has
+  *	   arrived.
++ *
++ * KYS: Oct. 30, 2016:
++ * It looks like Windows hosts have logic to deal with DOS attacks that
++ * can be triggered if it receives interrupts when it is not expecting
++ * the interrupt. The host expects interrupts only when the ring
++ * transitions from empty to non-empty (or full to non full on the guest
++ * to host ring).
++ * So, base the signaling decision solely on the ring state until the
++ * host logic is fixed.
+  */
+ 
+-static bool hv_need_to_signal(u32 old_write, struct hv_ring_buffer_info *rbi,
+-			      enum hv_signal_policy policy)
++static void hv_signal_on_write(u32 old_write, struct vmbus_channel *channel,
++			       bool kick_q)
+ {
++	struct hv_ring_buffer_info *rbi = &channel->outbound;
++
+ 	virt_mb();
+ 	if (READ_ONCE(rbi->ring_buffer->interrupt_mask))
+-		return false;
+-
+-	/*
+-	 * When the client wants to control signaling,
+-	 * we only honour the host interrupt mask.
+-	 */
+-	if (policy == HV_SIGNAL_POLICY_EXPLICIT)
+-		return true;
++		return;
+ 
+ 	/* check interrupt_mask before read_index */
+ 	virt_rmb();
+@@ -89,9 +93,9 @@ static bool hv_need_to_signal(u32 old_write, struct hv_ring_buffer_info *rbi,
+ 	 * ring transitions from being empty to non-empty.
+ 	 */
+ 	if (old_write == READ_ONCE(rbi->ring_buffer->read_index))
+-		return true;
++		vmbus_setevent(channel);
+ 
+-	return false;
++	return;
+ }
+ 
+ /* Get the next write location for the specified ring buffer. */
+@@ -280,9 +284,9 @@ void hv_ringbuffer_cleanup(struct hv_ring_buffer_info *ring_info)
+ }
+ 
+ /* Write to the ring buffer. */
+-int hv_ringbuffer_write(struct hv_ring_buffer_info *outring_info,
+-		    struct kvec *kv_list, u32 kv_count, bool *signal, bool lock,
+-		    enum hv_signal_policy policy)
++int hv_ringbuffer_write(struct vmbus_channel *channel,
++		    struct kvec *kv_list, u32 kv_count, bool lock,
++		    bool kick_q)
+ {
+ 	int i = 0;
+ 	u32 bytes_avail_towrite;
+@@ -292,6 +296,7 @@ int hv_ringbuffer_write(struct hv_ring_buffer_info *outring_info,
+ 	u32 old_write;
+ 	u64 prev_indices = 0;
+ 	unsigned long flags = 0;
++	struct hv_ring_buffer_info *outring_info = &channel->outbound;
+ 
+ 	for (i = 0; i < kv_count; i++)
+ 		totalbytes_towrite += kv_list[i].iov_len;
+@@ -344,13 +349,13 @@ int hv_ringbuffer_write(struct hv_ring_buffer_info *outring_info,
+ 	if (lock)
+ 		spin_unlock_irqrestore(&outring_info->ring_lock, flags);
+ 
+-	*signal = hv_need_to_signal(old_write, outring_info, policy);
++	hv_signal_on_write(old_write, channel, kick_q);
+ 	return 0;
+ }
+ 
+-int hv_ringbuffer_read(struct hv_ring_buffer_info *inring_info,
++int hv_ringbuffer_read(struct vmbus_channel *channel,
+ 		       void *buffer, u32 buflen, u32 *buffer_actual_len,
+-		       u64 *requestid, bool *signal, bool raw)
++		       u64 *requestid, bool raw)
+ {
+ 	u32 bytes_avail_toread;
+ 	u32 next_read_location = 0;
+@@ -359,6 +364,7 @@ int hv_ringbuffer_read(struct hv_ring_buffer_info *inring_info,
+ 	u32 offset;
+ 	u32 packetlen;
+ 	int ret = 0;
++	struct hv_ring_buffer_info *inring_info = &channel->inbound;
+ 
+ 	if (buflen <= 0)
+ 		return -EINVAL;
+@@ -377,6 +383,7 @@ int hv_ringbuffer_read(struct hv_ring_buffer_info *inring_info,
+ 		return ret;
+ 	}
+ 
++	init_cached_read_index(channel);
+ 	next_read_location = hv_get_next_read_location(inring_info);
+ 	next_read_location = hv_copyfrom_ringbuffer(inring_info, &desc,
+ 						    sizeof(desc),
+@@ -416,7 +423,7 @@ int hv_ringbuffer_read(struct hv_ring_buffer_info *inring_info,
+ 	/* Update the read index */
+ 	hv_set_next_read_location(inring_info, next_read_location);
+ 
+-	*signal = hv_need_to_signal_on_read(inring_info);
++	hv_signal_on_read(channel);
+ 
+ 	return ret;
+ }
+diff --git a/drivers/infiniband/sw/rxe/rxe_mr.c b/drivers/infiniband/sw/rxe/rxe_mr.c
+index 1869152..9b732c5 100644
+--- a/drivers/infiniband/sw/rxe/rxe_mr.c
++++ b/drivers/infiniband/sw/rxe/rxe_mr.c
+@@ -59,9 +59,11 @@ int mem_check_range(struct rxe_mem *mem, u64 iova, size_t length)
+ 
+ 	case RXE_MEM_TYPE_MR:
+ 	case RXE_MEM_TYPE_FMR:
+-		return ((iova < mem->iova) ||
+-			((iova + length) > (mem->iova + mem->length))) ?
+-			-EFAULT : 0;
++		if (iova < mem->iova ||
++		    length > mem->length ||
++		    iova > mem->iova + mem->length - length)
++			return -EFAULT;
++		return 0;
+ 
+ 	default:
+ 		return -EFAULT;
+diff --git a/drivers/infiniband/sw/rxe/rxe_resp.c b/drivers/infiniband/sw/rxe/rxe_resp.c
+index dd3d88a..ccf6247 100644
+--- a/drivers/infiniband/sw/rxe/rxe_resp.c
++++ b/drivers/infiniband/sw/rxe/rxe_resp.c
+@@ -472,7 +472,7 @@ static enum resp_states check_rkey(struct rxe_qp *qp,
+ 				goto err2;
+ 			}
+ 
+-			resid = mtu;
++			qp->resp.resid = mtu;
+ 		} else {
+ 			if (pktlen != resid) {
+ 				state = RESPST_ERR_LENGTH;
+diff --git a/drivers/input/misc/uinput.c b/drivers/input/misc/uinput.c
+index 92595b9..022be0e 100644
+--- a/drivers/input/misc/uinput.c
++++ b/drivers/input/misc/uinput.c
+@@ -263,13 +263,21 @@ static int uinput_create_device(struct uinput_device *udev)
+ 		return -EINVAL;
+ 	}
+ 
+-	if (test_bit(ABS_MT_SLOT, dev->absbit)) {
+-		nslot = input_abs_get_max(dev, ABS_MT_SLOT) + 1;
+-		error = input_mt_init_slots(dev, nslot, 0);
+-		if (error)
++	if (test_bit(EV_ABS, dev->evbit)) {
++		input_alloc_absinfo(dev);
++		if (!dev->absinfo) {
++			error = -EINVAL;
+ 			goto fail1;
+-	} else if (test_bit(ABS_MT_POSITION_X, dev->absbit)) {
+-		input_set_events_per_packet(dev, 60);
++		}
++
++		if (test_bit(ABS_MT_SLOT, dev->absbit)) {
++			nslot = input_abs_get_max(dev, ABS_MT_SLOT) + 1;
++			error = input_mt_init_slots(dev, nslot, 0);
++			if (error)
++				goto fail1;
++		} else if (test_bit(ABS_MT_POSITION_X, dev->absbit)) {
++			input_set_events_per_packet(dev, 60);
++		}
+ 	}
+ 
+ 	if (test_bit(EV_FF, dev->evbit) && !udev->ff_effects_max) {
+diff --git a/drivers/md/dm-rq.c b/drivers/md/dm-rq.c
+index 31a89c8..2c96542 100644
+--- a/drivers/md/dm-rq.c
++++ b/drivers/md/dm-rq.c
+@@ -804,6 +804,10 @@ static void dm_old_request_fn(struct request_queue *q)
+ 		int srcu_idx;
+ 		struct dm_table *map = dm_get_live_table(md, &srcu_idx);
+ 
++		if (unlikely(!map)) {
++			dm_put_live_table(md, srcu_idx);
++			return;
++		}
+ 		ti = dm_table_find_target(map, pos);
+ 		dm_put_live_table(md, srcu_idx);
+ 	}
+diff --git a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_reg.h b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_reg.h
+index 878950a..2cf8b1d 100644
+--- a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_reg.h
++++ b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_reg.h
+@@ -1007,9 +1007,7 @@
+ 
+ static inline void dsaf_write_reg(void __iomem *base, u32 reg, u32 value)
+ {
+-	u8 __iomem *reg_addr = ACCESS_ONCE(base);
+-
+-	writel(value, reg_addr + reg);
++	writel(value, base + reg);
+ }
+ 
+ #define dsaf_write_dev(a, reg, value) \
+@@ -1017,9 +1015,7 @@ static inline void dsaf_write_reg(void __iomem *base, u32 reg, u32 value)
+ 
+ static inline u32 dsaf_read_reg(u8 __iomem *base, u32 reg)
+ {
+-	u8 __iomem *reg_addr = ACCESS_ONCE(base);
+-
+-	return readl(reg_addr + reg);
++	return readl(base + reg);
+ }
+ 
+ static inline void dsaf_write_syscon(struct regmap *base, u32 reg, u32 value)
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c b/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c
+index 27ff401..51c6a57 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c
+@@ -991,6 +991,7 @@ static int mlx5e_set_rxfh(struct net_device *dev, const u32 *indir,
+ {
+ 	struct mlx5e_priv *priv = netdev_priv(dev);
+ 	int inlen = MLX5_ST_SZ_BYTES(modify_tir_in);
++	bool hash_changed = false;
+ 	void *in;
+ 
+ 	if ((hfunc != ETH_RSS_HASH_NO_CHANGE) &&
+@@ -1012,14 +1013,21 @@ static int mlx5e_set_rxfh(struct net_device *dev, const u32 *indir,
+ 		mlx5e_redirect_rqt(priv, rqtn, MLX5E_INDIR_RQT_SIZE, 0);
+ 	}
+ 
+-	if (key)
++	if (hfunc != ETH_RSS_HASH_NO_CHANGE &&
++	    hfunc != priv->params.rss_hfunc) {
++		priv->params.rss_hfunc = hfunc;
++		hash_changed = true;
++	}
++
++	if (key) {
+ 		memcpy(priv->params.toeplitz_hash_key, key,
+ 		       sizeof(priv->params.toeplitz_hash_key));
++		hash_changed = hash_changed ||
++			       priv->params.rss_hfunc == ETH_RSS_HASH_TOP;
++	}
+ 
+-	if (hfunc != ETH_RSS_HASH_NO_CHANGE)
+-		priv->params.rss_hfunc = hfunc;
+-
+-	mlx5e_modify_tirs_hash(priv, in, inlen);
++	if (hash_changed)
++		mlx5e_modify_tirs_hash(priv, in, inlen);
+ 
+ 	mutex_unlock(&priv->state_lock);
+ 
+diff --git a/drivers/net/hyperv/netvsc.c b/drivers/net/hyperv/netvsc.c
+index 720b5fa..c2ac39a 100644
+--- a/drivers/net/hyperv/netvsc.c
++++ b/drivers/net/hyperv/netvsc.c
+@@ -1288,6 +1288,9 @@ void netvsc_channel_cb(void *context)
+ 	ndev = hv_get_drvdata(device);
+ 	buffer = get_per_channel_state(channel);
+ 
++	/* commit_rd_index() -> hv_signal_on_read() needs this. */
++	init_cached_read_index(channel);
++
+ 	do {
+ 		desc = get_next_pkt_raw(channel);
+ 		if (desc != NULL) {
+@@ -1340,6 +1343,9 @@ void netvsc_channel_cb(void *context)
+ 
+ 			bufferlen = bytes_recvd;
+ 		}
++
++		init_cached_read_index(channel);
++
+ 	} while (1);
+ 
+ 	if (bufferlen > NETVSC_PACKET_SIZE)
+diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8192ce/sw.c b/drivers/net/wireless/realtek/rtlwifi/rtl8192ce/sw.c
+index 8b6e37c..20bfb37 100644
+--- a/drivers/net/wireless/realtek/rtlwifi/rtl8192ce/sw.c
++++ b/drivers/net/wireless/realtek/rtlwifi/rtl8192ce/sw.c
+@@ -96,7 +96,7 @@ int rtl92c_init_sw_vars(struct ieee80211_hw *hw)
+ 	struct rtl_priv *rtlpriv = rtl_priv(hw);
+ 	struct rtl_pci *rtlpci = rtl_pcidev(rtl_pcipriv(hw));
+ 	struct rtl_hal *rtlhal = rtl_hal(rtl_priv(hw));
+-	char *fw_name = "rtlwifi/rtl8192cfwU.bin";
++	char *fw_name;
+ 
+ 	rtl8192ce_bt_reg_init(hw);
+ 
+@@ -168,8 +168,13 @@ int rtl92c_init_sw_vars(struct ieee80211_hw *hw)
+ 	}
+ 
+ 	/* request fw */
+-	if (IS_81XXC_VENDOR_UMC_B_CUT(rtlhal->version))
++	if (IS_VENDOR_UMC_A_CUT(rtlhal->version) &&
++	    !IS_92C_SERIAL(rtlhal->version))
++		fw_name = "rtlwifi/rtl8192cfwU.bin";
++	else if (IS_81XXC_VENDOR_UMC_B_CUT(rtlhal->version))
+ 		fw_name = "rtlwifi/rtl8192cfwU_B.bin";
++	else
++		fw_name = "rtlwifi/rtl8192cfw.bin";
+ 
+ 	rtlpriv->max_fw_size = 0x4000;
+ 	pr_info("Using firmware %s\n", fw_name);
+diff --git a/drivers/net/xen-netfront.c b/drivers/net/xen-netfront.c
+index bf2744e..0cdcb21 100644
+--- a/drivers/net/xen-netfront.c
++++ b/drivers/net/xen-netfront.c
+@@ -1397,6 +1397,8 @@ static void xennet_disconnect_backend(struct netfront_info *info)
+ 	for (i = 0; i < num_queues && info->queues; ++i) {
+ 		struct netfront_queue *queue = &info->queues[i];
+ 
++		del_timer_sync(&queue->rx_refill_timer);
++
+ 		if (queue->tx_irq && (queue->tx_irq == queue->rx_irq))
+ 			unbind_from_irqhandler(queue->tx_irq, queue);
+ 		if (queue->tx_irq && (queue->tx_irq != queue->rx_irq)) {
+@@ -1751,7 +1753,6 @@ static void xennet_destroy_queues(struct netfront_info *info)
+ 
+ 		if (netif_running(info->netdev))
+ 			napi_disable(&queue->napi);
+-		del_timer_sync(&queue->rx_refill_timer);
+ 		netif_napi_del(&queue->napi);
+ 	}
+ 
+diff --git a/drivers/nvdimm/namespace_devs.c b/drivers/nvdimm/namespace_devs.c
+index 1480734..aefca64 100644
+--- a/drivers/nvdimm/namespace_devs.c
++++ b/drivers/nvdimm/namespace_devs.c
+@@ -962,8 +962,8 @@ static ssize_t __size_store(struct device *dev, unsigned long long val)
+ 	struct nvdimm_drvdata *ndd;
+ 	struct nd_label_id label_id;
+ 	u32 flags = 0, remainder;
++	int rc, i, id = -1;
+ 	u8 *uuid = NULL;
+-	int rc, i;
+ 
+ 	if (dev->driver || ndns->claim)
+ 		return -EBUSY;
+@@ -972,11 +972,13 @@ static ssize_t __size_store(struct device *dev, unsigned long long val)
+ 		struct nd_namespace_pmem *nspm = to_nd_namespace_pmem(dev);
+ 
+ 		uuid = nspm->uuid;
++		id = nspm->id;
+ 	} else if (is_namespace_blk(dev)) {
+ 		struct nd_namespace_blk *nsblk = to_nd_namespace_blk(dev);
+ 
+ 		uuid = nsblk->uuid;
+ 		flags = NSLABEL_FLAG_LOCAL;
++		id = nsblk->id;
+ 	}
+ 
+ 	/*
+@@ -1039,10 +1041,11 @@ static ssize_t __size_store(struct device *dev, unsigned long long val)
+ 
+ 	/*
+ 	 * Try to delete the namespace if we deleted all of its
+-	 * allocation, this is not the seed device for the region, and
+-	 * it is not actively claimed by a btt instance.
++	 * allocation, this is not the seed or 0th device for the
++	 * region, and it is not actively claimed by a btt, pfn, or dax
++	 * instance.
+ 	 */
+-	if (val == 0 && nd_region->ns_seed != dev && !ndns->claim)
++	if (val == 0 && id != 0 && nd_region->ns_seed != dev && !ndns->claim)
+ 		nd_device_unregister(dev, ND_ASYNC);
+ 
+ 	return rc;
+diff --git a/drivers/nvdimm/pfn_devs.c b/drivers/nvdimm/pfn_devs.c
+index a2ac9e6..6c033c9 100644
+--- a/drivers/nvdimm/pfn_devs.c
++++ b/drivers/nvdimm/pfn_devs.c
+@@ -627,15 +627,12 @@ static int nd_pfn_init(struct nd_pfn *nd_pfn)
+ 	size = resource_size(&nsio->res);
+ 	npfns = (size - start_pad - end_trunc - SZ_8K) / SZ_4K;
+ 	if (nd_pfn->mode == PFN_MODE_PMEM) {
+-		unsigned long memmap_size;
+-
+ 		/*
+ 		 * vmemmap_populate_hugepages() allocates the memmap array in
+ 		 * HPAGE_SIZE chunks.
+ 		 */
+-		memmap_size = ALIGN(64 * npfns, HPAGE_SIZE);
+-		offset = ALIGN(start + SZ_8K + memmap_size + dax_label_reserve,
+-				nd_pfn->align) - start;
++		offset = ALIGN(start + SZ_8K + 64 * npfns + dax_label_reserve,
++				max(nd_pfn->align, HPAGE_SIZE)) - start;
+ 	} else if (nd_pfn->mode == PFN_MODE_RAM)
+ 		offset = ALIGN(start + SZ_8K + dax_label_reserve,
+ 				nd_pfn->align) - start;
+diff --git a/drivers/s390/scsi/zfcp_fsf.c b/drivers/s390/scsi/zfcp_fsf.c
+index 75f820ca..27ff38f 100644
+--- a/drivers/s390/scsi/zfcp_fsf.c
++++ b/drivers/s390/scsi/zfcp_fsf.c
+@@ -1583,7 +1583,7 @@ static void zfcp_fsf_open_wka_port_handler(struct zfcp_fsf_req *req)
+ int zfcp_fsf_open_wka_port(struct zfcp_fc_wka_port *wka_port)
+ {
+ 	struct zfcp_qdio *qdio = wka_port->adapter->qdio;
+-	struct zfcp_fsf_req *req = NULL;
++	struct zfcp_fsf_req *req;
+ 	int retval = -EIO;
+ 
+ 	spin_lock_irq(&qdio->req_q_lock);
+@@ -1612,7 +1612,7 @@ int zfcp_fsf_open_wka_port(struct zfcp_fc_wka_port *wka_port)
+ 		zfcp_fsf_req_free(req);
+ out:
+ 	spin_unlock_irq(&qdio->req_q_lock);
+-	if (req && !IS_ERR(req))
++	if (!retval)
+ 		zfcp_dbf_rec_run_wka("fsowp_1", wka_port, req->req_id);
+ 	return retval;
+ }
+@@ -1638,7 +1638,7 @@ static void zfcp_fsf_close_wka_port_handler(struct zfcp_fsf_req *req)
+ int zfcp_fsf_close_wka_port(struct zfcp_fc_wka_port *wka_port)
+ {
+ 	struct zfcp_qdio *qdio = wka_port->adapter->qdio;
+-	struct zfcp_fsf_req *req = NULL;
++	struct zfcp_fsf_req *req;
+ 	int retval = -EIO;
+ 
+ 	spin_lock_irq(&qdio->req_q_lock);
+@@ -1667,7 +1667,7 @@ int zfcp_fsf_close_wka_port(struct zfcp_fc_wka_port *wka_port)
+ 		zfcp_fsf_req_free(req);
+ out:
+ 	spin_unlock_irq(&qdio->req_q_lock);
+-	if (req && !IS_ERR(req))
++	if (!retval)
+ 		zfcp_dbf_rec_run_wka("fscwp_1", wka_port, req->req_id);
+ 	return retval;
+ }
+diff --git a/drivers/scsi/aacraid/comminit.c b/drivers/scsi/aacraid/comminit.c
+index 341ea32..792d3e7 100644
+--- a/drivers/scsi/aacraid/comminit.c
++++ b/drivers/scsi/aacraid/comminit.c
+@@ -50,9 +50,13 @@ struct aac_common aac_config = {
+ 
+ static inline int aac_is_msix_mode(struct aac_dev *dev)
+ {
+-	u32 status;
++	u32 status = 0;
+ 
+-	status = src_readl(dev, MUnit.OMR);
++	if (dev->pdev->device == PMC_DEVICE_S6 ||
++		dev->pdev->device == PMC_DEVICE_S7 ||
++		dev->pdev->device == PMC_DEVICE_S8) {
++		status = src_readl(dev, MUnit.OMR);
++	}
+ 	return (status & AAC_INT_MODE_MSIX);
+ }
+ 
+diff --git a/drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c b/drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c
+index e3b911c..91dfd58 100644
+--- a/drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c
++++ b/drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c
+@@ -3929,6 +3929,7 @@ static struct configfs_attribute *ibmvscsis_tpg_attrs[] = {
+ static const struct target_core_fabric_ops ibmvscsis_ops = {
+ 	.module				= THIS_MODULE,
+ 	.name				= "ibmvscsis",
++	.max_data_sg_nents		= MAX_TXU / PAGE_SIZE,
+ 	.get_fabric_name		= ibmvscsis_get_fabric_name,
+ 	.tpg_get_wwn			= ibmvscsis_get_fabric_wwn,
+ 	.tpg_get_tag			= ibmvscsis_get_tag,
+diff --git a/drivers/scsi/mpt3sas/mpt3sas_scsih.c b/drivers/scsi/mpt3sas/mpt3sas_scsih.c
+index f84a608..8a7941b 100644
+--- a/drivers/scsi/mpt3sas/mpt3sas_scsih.c
++++ b/drivers/scsi/mpt3sas/mpt3sas_scsih.c
+@@ -51,6 +51,7 @@
+ #include <linux/workqueue.h>
+ #include <linux/delay.h>
+ #include <linux/pci.h>
++#include <linux/pci-aspm.h>
+ #include <linux/interrupt.h>
+ #include <linux/aer.h>
+ #include <linux/raid_class.h>
+@@ -8706,6 +8707,8 @@ _scsih_probe(struct pci_dev *pdev, const struct pci_device_id *id)
+ 
+ 	switch (hba_mpi_version) {
+ 	case MPI2_VERSION:
++		pci_disable_link_state(pdev, PCIE_LINK_STATE_L0S |
++			PCIE_LINK_STATE_L1 | PCIE_LINK_STATE_CLKPM);
+ 		/* Use mpt2sas driver host template for SAS 2.0 HBA's */
+ 		shost = scsi_host_alloc(&mpt2sas_driver_template,
+ 		  sizeof(struct MPT3SAS_ADAPTER));
+diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c
+index 078d797..bea819e 100644
+--- a/drivers/scsi/qla2xxx/qla_os.c
++++ b/drivers/scsi/qla2xxx/qla_os.c
+@@ -1459,7 +1459,7 @@ qla2x00_abort_all_cmds(scsi_qla_host_t *vha, int res)
+ 				/* Don't abort commands in adapter during EEH
+ 				 * recovery as it's not accessible/responding.
+ 				 */
+-				if (!ha->flags.eeh_busy) {
++				if (GET_CMD_SP(sp) && !ha->flags.eeh_busy) {
+ 					/* Get a reference to the sp and drop the lock.
+ 					 * The reference ensures this sp->done() call
+ 					 * - and not the call in qla2xxx_eh_abort() -
+diff --git a/drivers/target/target_core_device.c b/drivers/target/target_core_device.c
+index 6b42348..ea9617c 100644
+--- a/drivers/target/target_core_device.c
++++ b/drivers/target/target_core_device.c
+@@ -351,7 +351,15 @@ int core_enable_device_list_for_node(
+ 			kfree(new);
+ 			return -EINVAL;
+ 		}
+-		BUG_ON(orig->se_lun_acl != NULL);
++		if (orig->se_lun_acl != NULL) {
++			pr_warn_ratelimited("Detected existing explicit"
++				" se_lun_acl->se_lun_group reference for %s"
++				" mapped_lun: %llu, failing\n",
++				 nacl->initiatorname, mapped_lun);
++			mutex_unlock(&nacl->lun_entry_mutex);
++			kfree(new);
++			return -EINVAL;
++		}
+ 
+ 		rcu_assign_pointer(new->se_lun, lun);
+ 		rcu_assign_pointer(new->se_lun_acl, lun_acl);
+diff --git a/drivers/target/target_core_sbc.c b/drivers/target/target_core_sbc.c
+index 04f616b..aabd660 100644
+--- a/drivers/target/target_core_sbc.c
++++ b/drivers/target/target_core_sbc.c
+@@ -450,6 +450,7 @@ static sense_reason_t compare_and_write_post(struct se_cmd *cmd, bool success,
+ 					     int *post_ret)
+ {
+ 	struct se_device *dev = cmd->se_dev;
++	sense_reason_t ret = TCM_NO_SENSE;
+ 
+ 	/*
+ 	 * Only set SCF_COMPARE_AND_WRITE_POST to force a response fall-through
+@@ -457,9 +458,12 @@ static sense_reason_t compare_and_write_post(struct se_cmd *cmd, bool success,
+ 	 * sent to the backend driver.
+ 	 */
+ 	spin_lock_irq(&cmd->t_state_lock);
+-	if ((cmd->transport_state & CMD_T_SENT) && !cmd->scsi_status) {
++	if (cmd->transport_state & CMD_T_SENT) {
+ 		cmd->se_cmd_flags |= SCF_COMPARE_AND_WRITE_POST;
+ 		*post_ret = 1;
++
++		if (cmd->scsi_status == SAM_STAT_CHECK_CONDITION)
++			ret = TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE;
+ 	}
+ 	spin_unlock_irq(&cmd->t_state_lock);
+ 
+@@ -469,7 +473,7 @@ static sense_reason_t compare_and_write_post(struct se_cmd *cmd, bool success,
+ 	 */
+ 	up(&dev->caw_sem);
+ 
+-	return TCM_NO_SENSE;
++	return ret;
+ }
+ 
+ static sense_reason_t compare_and_write_callback(struct se_cmd *cmd, bool success,
+diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c
+index 7dfefd6..767d1eb6 100644
+--- a/drivers/target/target_core_transport.c
++++ b/drivers/target/target_core_transport.c
+@@ -457,8 +457,20 @@ static void target_complete_nacl(struct kref *kref)
+ {
+ 	struct se_node_acl *nacl = container_of(kref,
+ 				struct se_node_acl, acl_kref);
++	struct se_portal_group *se_tpg = nacl->se_tpg;
+ 
+-	complete(&nacl->acl_free_comp);
++	if (!nacl->dynamic_stop) {
++		complete(&nacl->acl_free_comp);
++		return;
++	}
++
++	mutex_lock(&se_tpg->acl_node_mutex);
++	list_del(&nacl->acl_list);
++	mutex_unlock(&se_tpg->acl_node_mutex);
++
++	core_tpg_wait_for_nacl_pr_ref(nacl);
++	core_free_device_list_for_node(nacl, se_tpg);
++	kfree(nacl);
+ }
+ 
+ void target_put_nacl(struct se_node_acl *nacl)
+@@ -499,12 +511,39 @@ EXPORT_SYMBOL(transport_deregister_session_configfs);
+ void transport_free_session(struct se_session *se_sess)
+ {
+ 	struct se_node_acl *se_nacl = se_sess->se_node_acl;
++
+ 	/*
+ 	 * Drop the se_node_acl->nacl_kref obtained from within
+ 	 * core_tpg_get_initiator_node_acl().
+ 	 */
+ 	if (se_nacl) {
++		struct se_portal_group *se_tpg = se_nacl->se_tpg;
++		const struct target_core_fabric_ops *se_tfo = se_tpg->se_tpg_tfo;
++		unsigned long flags;
++
+ 		se_sess->se_node_acl = NULL;
++
++		/*
++		 * Also determine if we need to drop the extra ->cmd_kref if
++		 * it had been previously dynamically generated, and
++		 * the endpoint is not caching dynamic ACLs.
++		 */
++		mutex_lock(&se_tpg->acl_node_mutex);
++		if (se_nacl->dynamic_node_acl &&
++		    !se_tfo->tpg_check_demo_mode_cache(se_tpg)) {
++			spin_lock_irqsave(&se_nacl->nacl_sess_lock, flags);
++			if (list_empty(&se_nacl->acl_sess_list))
++				se_nacl->dynamic_stop = true;
++			spin_unlock_irqrestore(&se_nacl->nacl_sess_lock, flags);
++
++			if (se_nacl->dynamic_stop)
++				list_del(&se_nacl->acl_list);
++		}
++		mutex_unlock(&se_tpg->acl_node_mutex);
++
++		if (se_nacl->dynamic_stop)
++			target_put_nacl(se_nacl);
++
+ 		target_put_nacl(se_nacl);
+ 	}
+ 	if (se_sess->sess_cmd_map) {
+@@ -518,16 +557,12 @@ EXPORT_SYMBOL(transport_free_session);
+ void transport_deregister_session(struct se_session *se_sess)
+ {
+ 	struct se_portal_group *se_tpg = se_sess->se_tpg;
+-	const struct target_core_fabric_ops *se_tfo;
+-	struct se_node_acl *se_nacl;
+ 	unsigned long flags;
+-	bool drop_nacl = false;
+ 
+ 	if (!se_tpg) {
+ 		transport_free_session(se_sess);
+ 		return;
+ 	}
+-	se_tfo = se_tpg->se_tpg_tfo;
+ 
+ 	spin_lock_irqsave(&se_tpg->session_lock, flags);
+ 	list_del(&se_sess->sess_list);
+@@ -535,33 +570,15 @@ void transport_deregister_session(struct se_session *se_sess)
+ 	se_sess->fabric_sess_ptr = NULL;
+ 	spin_unlock_irqrestore(&se_tpg->session_lock, flags);
+ 
+-	/*
+-	 * Determine if we need to do extra work for this initiator node's
+-	 * struct se_node_acl if it had been previously dynamically generated.
+-	 */
+-	se_nacl = se_sess->se_node_acl;
+-
+-	mutex_lock(&se_tpg->acl_node_mutex);
+-	if (se_nacl && se_nacl->dynamic_node_acl) {
+-		if (!se_tfo->tpg_check_demo_mode_cache(se_tpg)) {
+-			list_del(&se_nacl->acl_list);
+-			drop_nacl = true;
+-		}
+-	}
+-	mutex_unlock(&se_tpg->acl_node_mutex);
+-
+-	if (drop_nacl) {
+-		core_tpg_wait_for_nacl_pr_ref(se_nacl);
+-		core_free_device_list_for_node(se_nacl, se_tpg);
+-		se_sess->se_node_acl = NULL;
+-		kfree(se_nacl);
+-	}
+ 	pr_debug("TARGET_CORE[%s]: Deregistered fabric_sess\n",
+ 		se_tpg->se_tpg_tfo->get_fabric_name());
+ 	/*
+ 	 * If last kref is dropping now for an explicit NodeACL, awake sleeping
+ 	 * ->acl_free_comp caller to wakeup configfs se_node_acl->acl_group
+ 	 * removal context from within transport_free_session() code.
++	 *
++	 * For dynamic ACL, target_put_nacl() uses target_complete_nacl()
++	 * to release all remaining generate_node_acl=1 created ACL resources.
+ 	 */
+ 
+ 	transport_free_session(se_sess);
+@@ -3086,7 +3103,6 @@ static void target_tmr_work(struct work_struct *work)
+ 		spin_unlock_irqrestore(&cmd->t_state_lock, flags);
+ 		goto check_stop;
+ 	}
+-	cmd->t_state = TRANSPORT_ISTATE_PROCESSING;
+ 	spin_unlock_irqrestore(&cmd->t_state_lock, flags);
+ 
+ 	cmd->se_tfo->queue_tm_rsp(cmd);
+@@ -3099,11 +3115,25 @@ int transport_generic_handle_tmr(
+ 	struct se_cmd *cmd)
+ {
+ 	unsigned long flags;
++	bool aborted = false;
+ 
+ 	spin_lock_irqsave(&cmd->t_state_lock, flags);
+-	cmd->transport_state |= CMD_T_ACTIVE;
++	if (cmd->transport_state & CMD_T_ABORTED) {
++		aborted = true;
++	} else {
++		cmd->t_state = TRANSPORT_ISTATE_PROCESSING;
++		cmd->transport_state |= CMD_T_ACTIVE;
++	}
+ 	spin_unlock_irqrestore(&cmd->t_state_lock, flags);
+ 
++	if (aborted) {
++		pr_warn_ratelimited("handle_tmr caught CMD_T_ABORTED TMR %d"
++			"ref_tag: %llu tag: %llu\n", cmd->se_tmr_req->function,
++			cmd->se_tmr_req->ref_task_tag, cmd->tag);
++		transport_cmd_check_stop_to_fabric(cmd);
++		return 0;
++	}
++
+ 	INIT_WORK(&cmd->work, target_tmr_work);
+ 	queue_work(cmd->se_dev->tmr_wq, &cmd->work);
+ 	return 0;
+diff --git a/drivers/target/target_core_xcopy.c b/drivers/target/target_core_xcopy.c
+index 094a144..18848ba 100644
+--- a/drivers/target/target_core_xcopy.c
++++ b/drivers/target/target_core_xcopy.c
+@@ -836,7 +836,7 @@ static void target_xcopy_do_work(struct work_struct *work)
+ 			" CHECK_CONDITION -> sending response\n", rc);
+ 		ec_cmd->scsi_status = SAM_STAT_CHECK_CONDITION;
+ 	}
+-	target_complete_cmd(ec_cmd, SAM_STAT_CHECK_CONDITION);
++	target_complete_cmd(ec_cmd, ec_cmd->scsi_status);
+ }
+ 
+ sense_reason_t target_do_xcopy(struct se_cmd *se_cmd)
+diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
+index 7acbd2c..1782804 100644
+--- a/fs/btrfs/ioctl.c
++++ b/fs/btrfs/ioctl.c
+@@ -5648,6 +5648,10 @@ long btrfs_ioctl(struct file *file, unsigned int
+ #ifdef CONFIG_COMPAT
+ long btrfs_compat_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
+ {
++	/*
++	 * These all access 32-bit values anyway so no further
++	 * handling is necessary.
++	 */
+ 	switch (cmd) {
+ 	case FS_IOC32_GETFLAGS:
+ 		cmd = FS_IOC_GETFLAGS;
+@@ -5658,8 +5662,6 @@ long btrfs_compat_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
+ 	case FS_IOC32_GETVERSION:
+ 		cmd = FS_IOC_GETVERSION;
+ 		break;
+-	default:
+-		return -ENOIOCTLCMD;
+ 	}
+ 
+ 	return btrfs_ioctl(file, cmd, (unsigned long) compat_ptr(arg));
+diff --git a/include/linux/cpumask.h b/include/linux/cpumask.h
+index da7fbf1..fa3b155 100644
+--- a/include/linux/cpumask.h
++++ b/include/linux/cpumask.h
+@@ -560,7 +560,7 @@ static inline void cpumask_copy(struct cpumask *dstp,
+ static inline int cpumask_parse_user(const char __user *buf, int len,
+ 				     struct cpumask *dstp)
+ {
+-	return bitmap_parse_user(buf, len, cpumask_bits(dstp), nr_cpu_ids);
++	return bitmap_parse_user(buf, len, cpumask_bits(dstp), nr_cpumask_bits);
+ }
+ 
+ /**
+@@ -575,7 +575,7 @@ static inline int cpumask_parselist_user(const char __user *buf, int len,
+ 				     struct cpumask *dstp)
+ {
+ 	return bitmap_parselist_user(buf, len, cpumask_bits(dstp),
+-				     nr_cpu_ids);
++				     nr_cpumask_bits);
+ }
+ 
+ /**
+@@ -590,7 +590,7 @@ static inline int cpumask_parse(const char *buf, struct cpumask *dstp)
+ 	char *nl = strchr(buf, '\n');
+ 	unsigned int len = nl ? (unsigned int)(nl - buf) : strlen(buf);
+ 
+-	return bitmap_parse(buf, len, cpumask_bits(dstp), nr_cpu_ids);
++	return bitmap_parse(buf, len, cpumask_bits(dstp), nr_cpumask_bits);
+ }
+ 
+ /**
+@@ -602,7 +602,7 @@ static inline int cpumask_parse(const char *buf, struct cpumask *dstp)
+  */
+ static inline int cpulist_parse(const char *buf, struct cpumask *dstp)
+ {
+-	return bitmap_parselist(buf, cpumask_bits(dstp), nr_cpu_ids);
++	return bitmap_parselist(buf, cpumask_bits(dstp), nr_cpumask_bits);
+ }
+ 
+ /**
+diff --git a/include/linux/hyperv.h b/include/linux/hyperv.h
+index cd184bd..c92a083 100644
+--- a/include/linux/hyperv.h
++++ b/include/linux/hyperv.h
+@@ -128,6 +128,7 @@ struct hv_ring_buffer_info {
+ 	u32 ring_data_startoffset;
+ 	u32 priv_write_index;
+ 	u32 priv_read_index;
++	u32 cached_read_index;
+ };
+ 
+ /*
+@@ -180,6 +181,19 @@ static inline u32 hv_get_bytes_to_write(struct hv_ring_buffer_info *rbi)
+ 	return write;
+ }
+ 
++static inline u32 hv_get_cached_bytes_to_write(
++	const struct hv_ring_buffer_info *rbi)
++{
++	u32 read_loc, write_loc, dsize, write;
++
++	dsize = rbi->ring_datasize;
++	read_loc = rbi->cached_read_index;
++	write_loc = rbi->ring_buffer->write_index;
++
++	write = write_loc >= read_loc ? dsize - (write_loc - read_loc) :
++		read_loc - write_loc;
++	return write;
++}
+ /*
+  * VMBUS version is 32 bit entity broken up into
+  * two 16 bit quantities: major_number. minor_number.
+@@ -1447,6 +1461,7 @@ void hv_event_tasklet_enable(struct vmbus_channel *channel);
+ 
+ void hv_process_channel_removal(struct vmbus_channel *channel, u32 relid);
+ 
++void vmbus_setevent(struct vmbus_channel *channel);
+ /*
+  * Negotiated version with the Host.
+  */
+@@ -1479,10 +1494,11 @@ hv_get_ring_buffer(struct hv_ring_buffer_info *ring_info)
+  *    there is room for the producer to send the pending packet.
+  */
+ 
+-static inline  bool hv_need_to_signal_on_read(struct hv_ring_buffer_info *rbi)
++static inline  void hv_signal_on_read(struct vmbus_channel *channel)
+ {
+-	u32 cur_write_sz;
++	u32 cur_write_sz, cached_write_sz;
+ 	u32 pending_sz;
++	struct hv_ring_buffer_info *rbi = &channel->inbound;
+ 
+ 	/*
+ 	 * Issue a full memory barrier before making the signaling decision.
+@@ -1500,14 +1516,26 @@ static inline  bool hv_need_to_signal_on_read(struct hv_ring_buffer_info *rbi)
+ 	pending_sz = READ_ONCE(rbi->ring_buffer->pending_send_sz);
+ 	/* If the other end is not blocked on write don't bother. */
+ 	if (pending_sz == 0)
+-		return false;
++		return;
+ 
+ 	cur_write_sz = hv_get_bytes_to_write(rbi);
+ 
+-	if (cur_write_sz >= pending_sz)
+-		return true;
++	if (cur_write_sz < pending_sz)
++		return;
++
++	cached_write_sz = hv_get_cached_bytes_to_write(rbi);
++	if (cached_write_sz < pending_sz)
++		vmbus_setevent(channel);
++
++	return;
++}
++
++static inline void
++init_cached_read_index(struct vmbus_channel *channel)
++{
++	struct hv_ring_buffer_info *rbi = &channel->inbound;
+ 
+-	return false;
++	rbi->cached_read_index = rbi->ring_buffer->read_index;
+ }
+ 
+ /*
+@@ -1571,6 +1599,8 @@ static inline void put_pkt_raw(struct vmbus_channel *channel,
+  * This call commits the read index and potentially signals the host.
+  * Here is the pattern for using the "in-place" consumption APIs:
+  *
++ * init_cached_read_index();
++ *
+  * while (get_next_pkt_raw() {
+  *	process the packet "in-place";
+  *	put_pkt_raw();
+@@ -1589,8 +1619,7 @@ static inline void commit_rd_index(struct vmbus_channel *channel)
+ 	virt_rmb();
+ 	ring_info->ring_buffer->read_index = ring_info->priv_read_index;
+ 
+-	if (hv_need_to_signal_on_read(ring_info))
+-		vmbus_set_event(channel);
++	hv_signal_on_read(channel);
+ }
+ 
+ 
+diff --git a/include/target/target_core_base.h b/include/target/target_core_base.h
+index c211900..48bc1ac 100644
+--- a/include/target/target_core_base.h
++++ b/include/target/target_core_base.h
+@@ -538,6 +538,7 @@ struct se_node_acl {
+ 	char			initiatorname[TRANSPORT_IQN_LEN];
+ 	/* Used to signal demo mode created ACL, disabled by default */
+ 	bool			dynamic_node_acl;
++	bool			dynamic_stop;
+ 	u32			queue_depth;
+ 	u32			acl_index;
+ 	enum target_prot_type	saved_prot_type;
+diff --git a/kernel/events/core.c b/kernel/events/core.c
+index b1cfd74..4b33231 100644
+--- a/kernel/events/core.c
++++ b/kernel/events/core.c
+@@ -3461,14 +3461,15 @@ struct perf_read_data {
+ 	int ret;
+ };
+ 
+-static int find_cpu_to_read(struct perf_event *event, int local_cpu)
++static int __perf_event_read_cpu(struct perf_event *event, int event_cpu)
+ {
+-	int event_cpu = event->oncpu;
+ 	u16 local_pkg, event_pkg;
+ 
+ 	if (event->group_caps & PERF_EV_CAP_READ_ACTIVE_PKG) {
+-		event_pkg =  topology_physical_package_id(event_cpu);
+-		local_pkg =  topology_physical_package_id(local_cpu);
++		int local_cpu = smp_processor_id();
++
++		event_pkg = topology_physical_package_id(event_cpu);
++		local_pkg = topology_physical_package_id(local_cpu);
+ 
+ 		if (event_pkg == local_pkg)
+ 			return local_cpu;
+@@ -3598,7 +3599,7 @@ u64 perf_event_read_local(struct perf_event *event)
+ 
+ static int perf_event_read(struct perf_event *event, bool group)
+ {
+-	int ret = 0, cpu_to_read, local_cpu;
++	int event_cpu, ret = 0;
+ 
+ 	/*
+ 	 * If event is enabled and currently active on a CPU, update the
+@@ -3611,21 +3612,25 @@ static int perf_event_read(struct perf_event *event, bool group)
+ 			.ret = 0,
+ 		};
+ 
+-		local_cpu = get_cpu();
+-		cpu_to_read = find_cpu_to_read(event, local_cpu);
+-		put_cpu();
++		event_cpu = READ_ONCE(event->oncpu);
++		if ((unsigned)event_cpu >= nr_cpu_ids)
++			return 0;
++
++		preempt_disable();
++		event_cpu = __perf_event_read_cpu(event, event_cpu);
+ 
+ 		/*
+ 		 * Purposely ignore the smp_call_function_single() return
+ 		 * value.
+ 		 *
+-		 * If event->oncpu isn't a valid CPU it means the event got
++		 * If event_cpu isn't a valid CPU it means the event got
+ 		 * scheduled out and that will have updated the event count.
+ 		 *
+ 		 * Therefore, either way, we'll have an up-to-date event count
+ 		 * after this.
+ 		 */
+-		(void)smp_call_function_single(cpu_to_read, __perf_event_read, &data, 1);
++		(void)smp_call_function_single(event_cpu, __perf_event_read, &data, 1);
++		preempt_enable();
+ 		ret = data.ret;
+ 	} else if (event->state == PERF_EVENT_STATE_INACTIVE) {
+ 		struct perf_event_context *ctx = event->ctx;
+diff --git a/kernel/stacktrace.c b/kernel/stacktrace.c
+index b6e4c16..9c15a91 100644
+--- a/kernel/stacktrace.c
++++ b/kernel/stacktrace.c
+@@ -18,10 +18,8 @@ void print_stack_trace(struct stack_trace *trace, int spaces)
+ 	if (WARN_ON(!trace->entries))
+ 		return;
+ 
+-	for (i = 0; i < trace->nr_entries; i++) {
+-		printk("%*c", 1 + spaces, ' ');
+-		print_ip_sym(trace->entries[i]);
+-	}
++	for (i = 0; i < trace->nr_entries; i++)
++		printk("%*c%pS\n", 1 + spaces, ' ', (void *)trace->entries[i]);
+ }
+ EXPORT_SYMBOL_GPL(print_stack_trace);
+ 
+@@ -29,7 +27,6 @@ int snprint_stack_trace(char *buf, size_t size,
+ 			struct stack_trace *trace, int spaces)
+ {
+ 	int i;
+-	unsigned long ip;
+ 	int generated;
+ 	int total = 0;
+ 
+@@ -37,9 +34,8 @@ int snprint_stack_trace(char *buf, size_t size,
+ 		return 0;
+ 
+ 	for (i = 0; i < trace->nr_entries; i++) {
+-		ip = trace->entries[i];
+-		generated = snprintf(buf, size, "%*c[<%p>] %pS\n",
+-				1 + spaces, ' ', (void *) ip, (void *) ip);
++		generated = snprintf(buf, size, "%*c%pS\n", 1 + spaces, ' ',
++				     (void *)trace->entries[i]);
+ 
+ 		total += generated;
+ 
+diff --git a/mm/slub.c b/mm/slub.c
+index 2b3e740..7aa0e97 100644
+--- a/mm/slub.c
++++ b/mm/slub.c
+@@ -1419,6 +1419,10 @@ static int init_cache_random_seq(struct kmem_cache *s)
+ 	int err;
+ 	unsigned long i, count = oo_objects(s->oo);
+ 
++	/* Bailout if already initialised */
++	if (s->random_seq)
++		return 0;
++
+ 	err = cache_random_seq_create(s, count, GFP_KERNEL);
+ 	if (err) {
+ 		pr_err("SLUB: Unable to initialize free list for %s\n",
+diff --git a/net/mac80211/mesh.c b/net/mac80211/mesh.c
+index 42120d9..50e1b7f 100644
+--- a/net/mac80211/mesh.c
++++ b/net/mac80211/mesh.c
+@@ -339,7 +339,7 @@ int mesh_add_vendor_ies(struct ieee80211_sub_if_data *sdata,
+ 	/* fast-forward to vendor IEs */
+ 	offset = ieee80211_ie_split_vendor(ifmsh->ie, ifmsh->ie_len, 0);
+ 
+-	if (offset) {
++	if (offset < ifmsh->ie_len) {
+ 		len = ifmsh->ie_len - offset;
+ 		data = ifmsh->ie + offset;
+ 		if (skb_tailroom(skb) < len)
+diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
+index 1b3c18c..cd7a419 100644
+--- a/net/wireless/nl80211.c
++++ b/net/wireless/nl80211.c
+@@ -5874,6 +5874,7 @@ do {									    \
+ 			break;
+ 		}
+ 		cfg->ht_opmode = ht_opmode;
++		mask |= (1 << (NL80211_MESHCONF_HT_OPMODE - 1));
+ 	}
+ 	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathToRootTimeout,
+ 				  1, 65535, mask,
+diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
+index 09fd610..c2da45a 100644
+--- a/security/selinux/hooks.c
++++ b/security/selinux/hooks.c
+@@ -5858,7 +5858,7 @@ static int selinux_setprocattr(struct task_struct *p,
+ 		return error;
+ 
+ 	/* Obtain a SID for the context, if one was specified. */
+-	if (size && str[1] && str[1] != '\n') {
++	if (size && str[0] && str[0] != '\n') {
+ 		if (str[size-1] == '\n') {
+ 			str[size-1] = 0;
+ 			size--;
+diff --git a/sound/core/seq/seq_memory.c b/sound/core/seq/seq_memory.c
+index c850345..dfa5156 100644
+--- a/sound/core/seq/seq_memory.c
++++ b/sound/core/seq/seq_memory.c
+@@ -419,7 +419,6 @@ int snd_seq_pool_done(struct snd_seq_pool *pool)
+ {
+ 	unsigned long flags;
+ 	struct snd_seq_event_cell *ptr;
+-	int max_count = 5 * HZ;
+ 
+ 	if (snd_BUG_ON(!pool))
+ 		return -EINVAL;
+@@ -432,14 +431,8 @@ int snd_seq_pool_done(struct snd_seq_pool *pool)
+ 	if (waitqueue_active(&pool->output_sleep))
+ 		wake_up(&pool->output_sleep);
+ 
+-	while (atomic_read(&pool->counter) > 0) {
+-		if (max_count == 0) {
+-			pr_warn("ALSA: snd_seq_pool_done timeout: %d cells remain\n", atomic_read(&pool->counter));
+-			break;
+-		}
++	while (atomic_read(&pool->counter) > 0)
+ 		schedule_timeout_uninterruptible(1);
+-		max_count--;
+-	}
+ 	
+ 	/* release all resources */
+ 	spin_lock_irqsave(&pool->lock, flags);
+diff --git a/sound/core/seq/seq_queue.c b/sound/core/seq/seq_queue.c
+index 0bec02e..450c518 100644
+--- a/sound/core/seq/seq_queue.c
++++ b/sound/core/seq/seq_queue.c
+@@ -181,6 +181,8 @@ void __exit snd_seq_queues_delete(void)
+ 	}
+ }
+ 
++static void queue_use(struct snd_seq_queue *queue, int client, int use);
++
+ /* allocate a new queue -
+  * return queue index value or negative value for error
+  */
+@@ -192,11 +194,11 @@ int snd_seq_queue_alloc(int client, int locked, unsigned int info_flags)
+ 	if (q == NULL)
+ 		return -ENOMEM;
+ 	q->info_flags = info_flags;
++	queue_use(q, client, 1);
+ 	if (queue_list_add(q) < 0) {
+ 		queue_delete(q);
+ 		return -ENOMEM;
+ 	}
+-	snd_seq_queue_use(q->queue, client, 1); /* use this queue */
+ 	return q->queue;
+ }
+ 
+@@ -502,19 +504,9 @@ int snd_seq_queue_timer_set_tempo(int queueid, int client,
+ 	return result;
+ }
+ 
+-
+-/* use or unuse this queue -
+- * if it is the first client, starts the timer.
+- * if it is not longer used by any clients, stop the timer.
+- */
+-int snd_seq_queue_use(int queueid, int client, int use)
++/* use or unuse this queue */
++static void queue_use(struct snd_seq_queue *queue, int client, int use)
+ {
+-	struct snd_seq_queue *queue;
+-
+-	queue = queueptr(queueid);
+-	if (queue == NULL)
+-		return -EINVAL;
+-	mutex_lock(&queue->timer_mutex);
+ 	if (use) {
+ 		if (!test_and_set_bit(client, queue->clients_bitmap))
+ 			queue->clients++;
+@@ -529,6 +521,21 @@ int snd_seq_queue_use(int queueid, int client, int use)
+ 	} else {
+ 		snd_seq_timer_close(queue);
+ 	}
++}
++
++/* use or unuse this queue -
++ * if it is the first client, starts the timer.
++ * if it is not longer used by any clients, stop the timer.
++ */
++int snd_seq_queue_use(int queueid, int client, int use)
++{
++	struct snd_seq_queue *queue;
++
++	queue = queueptr(queueid);
++	if (queue == NULL)
++		return -EINVAL;
++	mutex_lock(&queue->timer_mutex);
++	queue_use(queue, client, use);
+ 	mutex_unlock(&queue->timer_mutex);
+ 	queuefree(queue);
+ 	return 0;
+diff --git a/sound/pci/hda/patch_hdmi.c b/sound/pci/hda/patch_hdmi.c
+index 56e5204..4bf4833 100644
+--- a/sound/pci/hda/patch_hdmi.c
++++ b/sound/pci/hda/patch_hdmi.c
+@@ -3638,6 +3638,7 @@ HDA_CODEC_ENTRY(0x10de0070, "GPU 70 HDMI/DP",	patch_nvhdmi),
+ HDA_CODEC_ENTRY(0x10de0071, "GPU 71 HDMI/DP",	patch_nvhdmi),
+ HDA_CODEC_ENTRY(0x10de0072, "GPU 72 HDMI/DP",	patch_nvhdmi),
+ HDA_CODEC_ENTRY(0x10de007d, "GPU 7d HDMI/DP",	patch_nvhdmi),
++HDA_CODEC_ENTRY(0x10de0080, "GPU 80 HDMI/DP",	patch_nvhdmi),
+ HDA_CODEC_ENTRY(0x10de0082, "GPU 82 HDMI/DP",	patch_nvhdmi),
+ HDA_CODEC_ENTRY(0x10de0083, "GPU 83 HDMI/DP",	patch_nvhdmi),
+ HDA_CODEC_ENTRY(0x10de8001, "MCP73 HDMI",	patch_nvhdmi_2ch),
+diff --git a/sound/usb/line6/driver.c b/sound/usb/line6/driver.c
+index 90009c0..ab3c280 100644
+--- a/sound/usb/line6/driver.c
++++ b/sound/usb/line6/driver.c
+@@ -754,8 +754,9 @@ int line6_probe(struct usb_interface *interface,
+ 		goto error;
+ 	}
+ 
++	line6_get_interval(line6);
++
+ 	if (properties->capabilities & LINE6_CAP_CONTROL) {
+-		line6_get_interval(line6);
+ 		ret = line6_init_cap_control(line6);
+ 		if (ret < 0)
+ 			goto error;
+diff --git a/tools/perf/builtin-diff.c b/tools/perf/builtin-diff.c
+index 9ff0db4..933aeec 100644
+--- a/tools/perf/builtin-diff.c
++++ b/tools/perf/builtin-diff.c
+@@ -1199,7 +1199,7 @@ static int ui_init(void)
+ 		BUG_ON(1);
+ 	}
+ 
+-	perf_hpp__register_sort_field(fmt);
++	perf_hpp__prepend_sort_field(fmt);
+ 	return 0;
+ }
+ 
+diff --git a/tools/perf/ui/hist.c b/tools/perf/ui/hist.c
+index 3738839..18cfcdc9 100644
+--- a/tools/perf/ui/hist.c
++++ b/tools/perf/ui/hist.c
+@@ -521,6 +521,12 @@ void perf_hpp_list__register_sort_field(struct perf_hpp_list *list,
+ 	list_add_tail(&format->sort_list, &list->sorts);
+ }
+ 
++void perf_hpp_list__prepend_sort_field(struct perf_hpp_list *list,
++				       struct perf_hpp_fmt *format)
++{
++	list_add(&format->sort_list, &list->sorts);
++}
++
+ void perf_hpp__column_unregister(struct perf_hpp_fmt *format)
+ {
+ 	list_del(&format->list);
+@@ -560,6 +566,10 @@ void perf_hpp__setup_output_field(struct perf_hpp_list *list)
+ 	perf_hpp_list__for_each_sort_list(list, fmt) {
+ 		struct perf_hpp_fmt *pos;
+ 
++		/* skip sort-only fields ("sort_compute" in perf diff) */
++		if (!fmt->entry && !fmt->color)
++			continue;
++
+ 		perf_hpp_list__for_each_format(list, pos) {
+ 			if (fmt_equal(fmt, pos))
+ 				goto next;
+diff --git a/tools/perf/util/hist.h b/tools/perf/util/hist.h
+index 9928fed..a440a04 100644
+--- a/tools/perf/util/hist.h
++++ b/tools/perf/util/hist.h
+@@ -282,6 +282,8 @@ void perf_hpp_list__column_register(struct perf_hpp_list *list,
+ 				    struct perf_hpp_fmt *format);
+ void perf_hpp_list__register_sort_field(struct perf_hpp_list *list,
+ 					struct perf_hpp_fmt *format);
++void perf_hpp_list__prepend_sort_field(struct perf_hpp_list *list,
++				       struct perf_hpp_fmt *format);
+ 
+ static inline void perf_hpp__column_register(struct perf_hpp_fmt *format)
+ {
+@@ -293,6 +295,11 @@ static inline void perf_hpp__register_sort_field(struct perf_hpp_fmt *format)
+ 	perf_hpp_list__register_sort_field(&perf_hpp_list, format);
+ }
+ 
++static inline void perf_hpp__prepend_sort_field(struct perf_hpp_fmt *format)
++{
++	perf_hpp_list__prepend_sort_field(&perf_hpp_list, format);
++}
++
+ #define perf_hpp_list__for_each_format(_list, format) \
+ 	list_for_each_entry(format, &(_list)->fields, list)
+ 
diff --git a/4.9.9/4420_grsecurity-3.1-4.9.9-201702122044.patch b/4.9.10/4420_grsecurity-3.1-4.9.10-201702162016.patch
index 32e3834..ef4d7f3 100644
--- a/4.9.9/4420_grsecurity-3.1-4.9.9-201702122044.patch
+++ b/4.9.10/4420_grsecurity-3.1-4.9.10-201702162016.patch
@@ -419,7 +419,7 @@ index 3d0ae15..84e5412 100644
        cmd_syscalls = $(CONFIG_SHELL) $< $(CC) $(c_flags) $(missing_syscalls_flags)
  
 diff --git a/Makefile b/Makefile
-index c0c41c9..630adc4 100644
+index d2fe757..92fd198 100644
 --- a/Makefile
 +++ b/Makefile
 @@ -302,7 +302,9 @@ CONFIG_SHELL := $(shell if [ -x "$$BASH" ]; then echo $$BASH; \
@@ -3161,7 +3161,7 @@ index 91d2d5b..042c26e 100644
  }
  #endif
 diff --git a/arch/arm/kernel/ptrace.c b/arch/arm/kernel/ptrace.c
-index ce131ed..26f9765 100644
+index ae738a6..ee4d46f 100644
 --- a/arch/arm/kernel/ptrace.c
 +++ b/arch/arm/kernel/ptrace.c
 @@ -928,10 +928,19 @@ static void tracehook_report_syscall(struct pt_regs *regs,
@@ -3938,7 +3938,7 @@ index c8c8b9e..c55cc79 100644
  		atomic64_set(&mm->context.id, asid);
  	}
 diff --git a/arch/arm/mm/fault.c b/arch/arm/mm/fault.c
-index 3a2e678..ebdbf80 100644
+index 0122ad1..1aae1cb 100644
 --- a/arch/arm/mm/fault.c
 +++ b/arch/arm/mm/fault.c
 @@ -25,6 +25,7 @@
@@ -4172,7 +4172,7 @@ index 3a2e678..ebdbf80 100644
  		inf->name, ifsr, addr);
  
 diff --git a/arch/arm/mm/fault.h b/arch/arm/mm/fault.h
-index 67532f2..10b646e 100644
+index afc1f84..b1daab5 100644
 --- a/arch/arm/mm/fault.h
 +++ b/arch/arm/mm/fault.h
 @@ -3,6 +3,7 @@
@@ -4183,7 +4183,7 @@ index 67532f2..10b646e 100644
   */
  #define FSR_LNX_PF		(1 << 31)
  #define FSR_WRITE		(1 << 11)
-@@ -22,6 +23,17 @@ static inline int fsr_fs(unsigned int fsr)
+@@ -26,6 +27,17 @@ static inline int fsr_fs(unsigned int fsr)
  }
  #endif
  
@@ -9234,7 +9234,7 @@ index 4ba26dd..2d1137d 100644
  #define PAGE_KERNEL_RO	__pgprot(_PAGE_BASE | _PAGE_KERNEL_RO)
  #define PAGE_KERNEL_ROX	__pgprot(_PAGE_BASE | _PAGE_KERNEL_ROX)
 diff --git a/arch/powerpc/include/asm/reg.h b/arch/powerpc/include/asm/reg.h
-index 9e1499f..4e03a24 100644
+index 13f5fad..6ec27c3 100644
 --- a/arch/powerpc/include/asm/reg.h
 +++ b/arch/powerpc/include/asm/reg.h
 @@ -270,6 +270,7 @@
@@ -26426,10 +26426,10 @@ index 17f2186..f394307 100644
  
  /*
 diff --git a/arch/x86/include/asm/processor.h b/arch/x86/include/asm/processor.h
-index 984a7bf..c3e410d 100644
+index 83db0ea..137bc2c 100644
 --- a/arch/x86/include/asm/processor.h
 +++ b/arch/x86/include/asm/processor.h
-@@ -135,7 +135,7 @@ struct cpuinfo_x86 {
+@@ -136,7 +136,7 @@ struct cpuinfo_x86 {
  	/* Index into per_cpu list: */
  	u16			cpu_index;
  	u32			microcode;
@@ -26438,7 +26438,7 @@ index 984a7bf..c3e410d 100644
  
  #define X86_VENDOR_INTEL	0
  #define X86_VENDOR_CYRIX	1
-@@ -159,7 +159,7 @@ extern __u32			cpu_caps_cleared[NCAPINTS];
+@@ -160,7 +160,7 @@ extern __u32			cpu_caps_cleared[NCAPINTS];
  extern __u32			cpu_caps_set[NCAPINTS];
  
  #ifdef CONFIG_SMP
@@ -26447,7 +26447,7 @@ index 984a7bf..c3e410d 100644
  #define cpu_data(cpu)		per_cpu(cpu_info, cpu)
  #else
  #define cpu_info		boot_cpu_data
-@@ -205,9 +205,21 @@ static inline void native_cpuid(unsigned int *eax, unsigned int *ebx,
+@@ -206,9 +206,21 @@ static inline void native_cpuid(unsigned int *eax, unsigned int *ebx,
  	    : "memory");
  }
  
@@ -26470,7 +26470,7 @@ index 984a7bf..c3e410d 100644
  }
  
  #ifdef CONFIG_X86_32
-@@ -307,11 +319,9 @@ struct tss_struct {
+@@ -308,11 +320,9 @@ struct tss_struct {
  
  } ____cacheline_aligned;
  
@@ -26483,7 +26483,7 @@ index 984a7bf..c3e410d 100644
  
  /*
   * Save the original ist values for checking stack pointers during debugging
-@@ -340,6 +350,7 @@ DECLARE_PER_CPU_FIRST(union irq_stack_union, irq_stack_union) __visible;
+@@ -341,6 +351,7 @@ DECLARE_PER_CPU_FIRST(union irq_stack_union, irq_stack_union) __visible;
  DECLARE_INIT_PER_CPU(irq_stack_union);
  
  DECLARE_PER_CPU(char *, irq_stack_ptr);
@@ -26491,7 +26491,7 @@ index 984a7bf..c3e410d 100644
  DECLARE_PER_CPU(unsigned int, irq_count);
  extern asmlinkage void ignore_sysret(void);
  #else	/* X86_64 */
-@@ -388,6 +399,7 @@ struct thread_struct {
+@@ -389,6 +400,7 @@ struct thread_struct {
  	unsigned short		ds;
  	unsigned short		fsindex;
  	unsigned short		gsindex;
@@ -26499,7 +26499,7 @@ index 984a7bf..c3e410d 100644
  #endif
  
  	u32			status;		/* thread synchronous flags */
-@@ -404,6 +416,9 @@ struct thread_struct {
+@@ -405,6 +417,9 @@ struct thread_struct {
  	unsigned long gs;
  #endif
  
@@ -26509,7 +26509,7 @@ index 984a7bf..c3e410d 100644
  	/* Save middle states of ptrace breakpoints */
  	struct perf_event	*ptrace_bps[HBP_NUM];
  	/* Debug status used for traps, single steps, etc... */
-@@ -425,17 +440,11 @@ struct thread_struct {
+@@ -426,17 +441,11 @@ struct thread_struct {
  	unsigned		io_bitmap_max;
  
  	mm_segment_t		addr_limit;
@@ -26529,7 +26529,7 @@ index 984a7bf..c3e410d 100644
  
  /*
   * Thread-synchronous status.
-@@ -487,12 +496,8 @@ static inline void native_swapgs(void)
+@@ -488,12 +497,8 @@ static inline void native_swapgs(void)
  
  static inline unsigned long current_top_of_stack(void)
  {
@@ -26542,7 +26542,7 @@ index 984a7bf..c3e410d 100644
  }
  
  #ifdef CONFIG_PARAVIRT
-@@ -717,20 +722,30 @@ static inline void spin_lock_prefetch(const void *x)
+@@ -718,20 +723,30 @@ static inline void spin_lock_prefetch(const void *x)
  #define TOP_OF_INIT_STACK ((unsigned long)&init_stack + sizeof(init_stack) - \
  			   TOP_OF_KERNEL_STACK_PADDING)
  
@@ -26574,7 +26574,7 @@ index 984a7bf..c3e410d 100644
  }
  
  /*
-@@ -743,12 +758,7 @@ static inline void spin_lock_prefetch(const void *x)
+@@ -744,12 +759,7 @@ static inline void spin_lock_prefetch(const void *x)
   * "struct pt_regs" is possible, but they may contain the
   * completely wrong values.
   */
@@ -26588,7 +26588,7 @@ index 984a7bf..c3e410d 100644
  
  #define KSTK_ESP(task)		(task_pt_regs(task)->sp)
  
-@@ -762,13 +772,13 @@ static inline void spin_lock_prefetch(const void *x)
+@@ -763,13 +773,13 @@ static inline void spin_lock_prefetch(const void *x)
   * particular problem by preventing anything from being mapped
   * at the maximum canonical address.
   */
@@ -26604,7 +26604,7 @@ index 984a7bf..c3e410d 100644
  
  #define TASK_SIZE		(test_thread_flag(TIF_ADDR32) ? \
  					IA32_PAGE_OFFSET : TASK_SIZE_MAX)
-@@ -781,6 +791,7 @@ static inline void spin_lock_prefetch(const void *x)
+@@ -782,6 +792,7 @@ static inline void spin_lock_prefetch(const void *x)
  #define INIT_THREAD  {						\
  	.sp0			= TOP_OF_INIT_STACK,		\
  	.addr_limit		= KERNEL_DS,			\
@@ -26612,7 +26612,7 @@ index 984a7bf..c3e410d 100644
  }
  
  #define task_pt_regs(tsk)	((struct pt_regs *)(tsk)->thread.sp0 - 1)
-@@ -799,6 +810,10 @@ extern void start_thread(struct pt_regs *regs, unsigned long new_ip,
+@@ -800,6 +811,10 @@ extern void start_thread(struct pt_regs *regs, unsigned long new_ip,
   */
  #define TASK_UNMAPPED_BASE	(PAGE_ALIGN(TASK_SIZE / 3))
  
@@ -26623,7 +26623,7 @@ index 984a7bf..c3e410d 100644
  #define KSTK_EIP(task)		(task_pt_regs(task)->ip)
  
  /* Get/set a process' ability to use the timestamp counter instruction */
-@@ -844,7 +859,7 @@ static inline uint32_t hypervisor_cpuid_base(const char *sig, uint32_t leaves)
+@@ -845,7 +860,7 @@ static inline uint32_t hypervisor_cpuid_base(const char *sig, uint32_t leaves)
  	return 0;
  }
  
@@ -26632,7 +26632,7 @@ index 984a7bf..c3e410d 100644
  extern void free_init_pages(char *what, unsigned long begin, unsigned long end);
  
  void default_idle(void);
-@@ -854,6 +869,6 @@ bool xen_set_default_idle(void);
+@@ -855,6 +870,6 @@ bool xen_set_default_idle(void);
  #define xen_set_default_idle 0
  #endif
  
@@ -29131,7 +29131,7 @@ index f223491..9083344 100644
  	apic_printk(APIC_DEBUG, KERN_DEBUG "APIC error on CPU%d: %02x",
  		    smp_processor_id(), v);
 diff --git a/arch/x86/kernel/apic/io_apic.c b/arch/x86/kernel/apic/io_apic.c
-index 7249f15..8e941bd 100644
+index d1e2556..2f6454d 100644
 --- a/arch/x86/kernel/apic/io_apic.c
 +++ b/arch/x86/kernel/apic/io_apic.c
 @@ -1683,7 +1683,7 @@ static unsigned int startup_ioapic_irq(struct irq_data *data)
@@ -29161,7 +29161,7 @@ index 7249f15..8e941bd 100644
  	.name			= "IO-APIC",
  	.irq_startup		= startup_ioapic_irq,
  	.irq_mask		= mask_ioapic_irq,
-@@ -1880,7 +1880,7 @@ static struct irq_chip ioapic_chip __read_mostly = {
+@@ -1879,7 +1879,7 @@ static struct irq_chip ioapic_chip __read_mostly = {
  	.flags			= IRQCHIP_SKIP_SET_WAKE,
  };
  
@@ -29170,7 +29170,7 @@ index 7249f15..8e941bd 100644
  	.name			= "IR-IO-APIC",
  	.irq_startup		= startup_ioapic_irq,
  	.irq_mask		= mask_ioapic_irq,
-@@ -1939,7 +1939,7 @@ static void ack_lapic_irq(struct irq_data *data)
+@@ -1937,7 +1937,7 @@ static void ack_lapic_irq(struct irq_data *data)
  	ack_APIC_irq();
  }
  
@@ -29377,10 +29377,10 @@ index 4a8697f..8a13428 100644
  obj-y			+= common.o
  obj-y			+= rdrand.o
 diff --git a/arch/x86/kernel/cpu/amd.c b/arch/x86/kernel/cpu/amd.c
-index 1d31672..542cba3 100644
+index 2b4cf04..c73b25e 100644
 --- a/arch/x86/kernel/cpu/amd.c
 +++ b/arch/x86/kernel/cpu/amd.c
-@@ -794,7 +794,7 @@ static void init_amd(struct cpuinfo_x86 *c)
+@@ -808,7 +808,7 @@ static void init_amd(struct cpuinfo_x86 *c)
  static unsigned int amd_size_cache(struct cpuinfo_x86 *c, unsigned int size)
  {
  	/* AMD errata T13 (order #21922) */
@@ -29410,7 +29410,7 @@ index a972ac4..938c163 100644
  
  	/*
 diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c
-index 023c7bf..1ce29b3 100644
+index 4eece91..9eeb03b 100644
 --- a/arch/x86/kernel/cpu/common.c
 +++ b/arch/x86/kernel/cpu/common.c
 @@ -93,60 +93,6 @@ static const struct cpu_dev default_cpu = {
@@ -29616,7 +29616,7 @@ index 023c7bf..1ce29b3 100644
  	}
  }
  
-@@ -1063,6 +1118,20 @@ static void identify_cpu(struct cpuinfo_x86 *c)
+@@ -1064,6 +1119,20 @@ static void identify_cpu(struct cpuinfo_x86 *c)
  	setup_smep(c);
  	setup_smap(c);
  
@@ -29637,7 +29637,7 @@ index 023c7bf..1ce29b3 100644
  	/*
  	 * The vendor-specific functions might have changed features.
  	 * Now we do "generic changes."
-@@ -1108,10 +1177,14 @@ static void identify_cpu(struct cpuinfo_x86 *c)
+@@ -1109,10 +1178,14 @@ static void identify_cpu(struct cpuinfo_x86 *c)
  	 * executed, c == &boot_cpu_data.
  	 */
  	if (c != &boot_cpu_data) {
@@ -29652,7 +29652,7 @@ index 023c7bf..1ce29b3 100644
  		/* OR, i.e. replicate the bug flags */
  		for (i = NCAPINTS; i < NCAPINTS + NBUGINTS; i++)
  			c->x86_capability[i] |= boot_cpu_data.x86_capability[i];
-@@ -1141,7 +1214,7 @@ void enable_sep_cpu(void)
+@@ -1142,7 +1215,7 @@ void enable_sep_cpu(void)
  		return;
  
  	cpu = get_cpu();
@@ -29661,7 +29661,7 @@ index 023c7bf..1ce29b3 100644
  
  	/*
  	 * We cache MSR_IA32_SYSENTER_CS's value in the TSS's ss1 field --
-@@ -1307,6 +1380,8 @@ EXPORT_PER_CPU_SYMBOL(current_task);
+@@ -1308,6 +1381,8 @@ EXPORT_PER_CPU_SYMBOL(current_task);
  
  DEFINE_PER_CPU(char *, irq_stack_ptr) =
  	init_per_cpu_var(irq_stack_union.irq_stack) + IRQ_STACK_SIZE;
@@ -29670,7 +29670,7 @@ index 023c7bf..1ce29b3 100644
  
  DEFINE_PER_CPU(unsigned int, irq_count) __visible = -1;
  
-@@ -1399,21 +1474,21 @@ EXPORT_PER_CPU_SYMBOL(current_task);
+@@ -1400,21 +1475,21 @@ EXPORT_PER_CPU_SYMBOL(current_task);
  DEFINE_PER_CPU(int, __preempt_count) = INIT_PREEMPT_COUNT;
  EXPORT_PER_CPU_SYMBOL(__preempt_count);
  
@@ -29699,7 +29699,7 @@ index 023c7bf..1ce29b3 100644
  /*
   * Clear all 6 debug registers:
   */
-@@ -1489,7 +1564,7 @@ void cpu_init(void)
+@@ -1490,7 +1565,7 @@ void cpu_init(void)
  	 */
  	load_ucode_ap();
  
@@ -29708,7 +29708,7 @@ index 023c7bf..1ce29b3 100644
  	oist = &per_cpu(orig_ist, cpu);
  
  #ifdef CONFIG_NUMA
-@@ -1521,7 +1596,6 @@ void cpu_init(void)
+@@ -1522,7 +1597,6 @@ void cpu_init(void)
  	wrmsrl(MSR_KERNEL_GS_BASE, 0);
  	barrier();
  
@@ -29716,7 +29716,7 @@ index 023c7bf..1ce29b3 100644
  	x2apic_setup();
  
  	/*
-@@ -1573,7 +1647,7 @@ void cpu_init(void)
+@@ -1574,7 +1648,7 @@ void cpu_init(void)
  {
  	int cpu = smp_processor_id();
  	struct task_struct *curr = current;
@@ -34538,7 +34538,7 @@ index c00cb64..73f6b30 100644
  	.smp_prepare_cpus	= native_smp_prepare_cpus,
  	.smp_cpus_done		= native_smp_cpus_done,
 diff --git a/arch/x86/kernel/smpboot.c b/arch/x86/kernel/smpboot.c
-index e9bbe02..aaaed9d 100644
+index 36171bc..e32a454 100644
 --- a/arch/x86/kernel/smpboot.c
 +++ b/arch/x86/kernel/smpboot.c
 @@ -94,7 +94,7 @@ EXPORT_PER_CPU_SYMBOL(cpu_core_map);
@@ -34572,7 +34572,7 @@ index e9bbe02..aaaed9d 100644
  	/*
  	 * Check TSC synchronization with the BP:
  	 */
-@@ -925,13 +928,11 @@ void common_cpu_up(unsigned int cpu, struct task_struct *idle)
+@@ -931,13 +934,11 @@ void common_cpu_up(unsigned int cpu, struct task_struct *idle)
  	per_cpu(current_task, cpu) = idle;
  
  #ifdef CONFIG_X86_32
@@ -34587,7 +34587,7 @@ index e9bbe02..aaaed9d 100644
  }
  
  /*
-@@ -952,9 +953,11 @@ static int do_boot_cpu(int apicid, int cpu, struct task_struct *idle)
+@@ -958,9 +959,11 @@ static int do_boot_cpu(int apicid, int cpu, struct task_struct *idle)
  	unsigned long timeout;
  
  	idle->thread.sp = (unsigned long) (((struct pt_regs *)
@@ -34600,7 +34600,7 @@ index e9bbe02..aaaed9d 100644
  	initial_code = (unsigned long)start_secondary;
  	initial_stack  = idle->thread.sp;
  
-@@ -1102,6 +1105,15 @@ int native_cpu_up(unsigned int cpu, struct task_struct *tidle)
+@@ -1108,6 +1111,15 @@ int native_cpu_up(unsigned int cpu, struct task_struct *tidle)
  
  	common_cpu_up(cpu, tidle);
  
@@ -37310,10 +37310,18 @@ index 9b33024..cdbc725 100644
  
  ENDPROC(this_cpu_cmpxchg16b_emu)
 diff --git a/arch/x86/lib/cmpxchg8b_emu.S b/arch/x86/lib/cmpxchg8b_emu.S
-index 03a186f..34c859b 100644
+index 03a186f..6793bf2 100644
 --- a/arch/x86/lib/cmpxchg8b_emu.S
 +++ b/arch/x86/lib/cmpxchg8b_emu.S
-@@ -38,7 +38,7 @@ ENTRY(cmpxchg8b_emu)
+@@ -8,6 +8,7 @@
+ 
+ #include <linux/linkage.h>
+ #include <asm/export.h>
++#include <asm/alternative-asm.h>
+ 
+ .text
+ 
+@@ -38,7 +39,7 @@ ENTRY(cmpxchg8b_emu)
  	movl %ecx, 4(%esi)
  
  	popfl
@@ -37322,7 +37330,7 @@ index 03a186f..34c859b 100644
  
  .Lnot_same:
  	movl  (%esi), %eax
-@@ -46,7 +46,7 @@ ENTRY(cmpxchg8b_emu)
+@@ -46,7 +47,7 @@ ENTRY(cmpxchg8b_emu)
  	movl 4(%esi), %edx
  
  	popfl
@@ -40044,10 +40052,10 @@ index 96d2b84..b3db380 100644
 +CFLAGS_uderef_64.o		:= -fcall-saved-rax -fcall-saved-rdi -fcall-saved-rsi -fcall-saved-rdx -fcall-saved-rcx -fcall-saved-r8 -fcall-saved-r9 -fcall-saved-r10 -fcall-saved-r11
 +
 diff --git a/arch/x86/mm/dump_pagetables.c b/arch/x86/mm/dump_pagetables.c
-index ea9c49a..7ab033a 100644
+index 8aa6bea..1181e44 100644
 --- a/arch/x86/mm/dump_pagetables.c
 +++ b/arch/x86/mm/dump_pagetables.c
-@@ -27,6 +27,7 @@
+@@ -28,6 +28,7 @@
  struct pg_state {
  	int level;
  	pgprot_t current_prot;
@@ -40055,7 +40063,7 @@ index ea9c49a..7ab033a 100644
  	unsigned long start_address;
  	unsigned long current_address;
  	const struct addr_marker *marker;
-@@ -184,6 +185,23 @@ static unsigned long normalize_addr(unsigned long u)
+@@ -185,6 +186,23 @@ static unsigned long normalize_addr(unsigned long u)
  #endif
  }
  
@@ -40079,7 +40087,7 @@ index ea9c49a..7ab033a 100644
  /*
   * This function gets called on a break in a continuous series
   * of PTE entries; the next one is different so we need to
-@@ -200,11 +218,13 @@ static void note_page(struct seq_file *m, struct pg_state *st,
+@@ -201,11 +219,13 @@ static void note_page(struct seq_file *m, struct pg_state *st,
  	 * we have now. "break" is either changing perms, levels or
  	 * address space marker.
  	 */
@@ -40093,7 +40101,7 @@ index ea9c49a..7ab033a 100644
  		st->current_prot = new_prot;
  		st->level = level;
  		st->marker = address_markers;
-@@ -216,9 +236,8 @@ static void note_page(struct seq_file *m, struct pg_state *st,
+@@ -217,9 +237,8 @@ static void note_page(struct seq_file *m, struct pg_state *st,
  		const char *unit = units;
  		unsigned long delta;
  		int width = sizeof(unsigned long) * 2;
@@ -40104,7 +40112,7 @@ index ea9c49a..7ab033a 100644
  			WARN_ONCE(1,
  				  "x86/mm: Found insecure W+X mapping at address %p/%pS\n",
  				  (void *)st->start_address,
-@@ -304,9 +323,10 @@ static void walk_pmd_level(struct seq_file *m, struct pg_state *st, pud_t addr,
+@@ -305,9 +324,10 @@ static void walk_pmd_level(struct seq_file *m, struct pg_state *st, pud_t addr,
  	start = (pmd_t *) pud_page_vaddr(addr);
  	for (i = 0; i < PTRS_PER_PMD; i++) {
  		st->current_address = normalize_addr(P + i * PMD_LEVEL_MULT);
@@ -40116,7 +40124,7 @@ index ea9c49a..7ab033a 100644
  				note_page(m, st, __pgprot(prot), 3);
  			} else {
  				walk_pte_level(m, st, *start,
-@@ -337,9 +357,10 @@ static void walk_pud_level(struct seq_file *m, struct pg_state *st, pgd_t addr,
+@@ -338,9 +358,10 @@ static void walk_pud_level(struct seq_file *m, struct pg_state *st, pgd_t addr,
  
  	for (i = 0; i < PTRS_PER_PUD; i++) {
  		st->current_address = normalize_addr(P + i * PUD_LEVEL_MULT);
@@ -40128,7 +40136,7 @@ index ea9c49a..7ab033a 100644
  				note_page(m, st, __pgprot(prot), 2);
  			} else {
  				walk_pmd_level(m, st, *start,
-@@ -395,9 +416,10 @@ static void ptdump_walk_pgd_level_core(struct seq_file *m, pgd_t *pgd,
+@@ -396,9 +417,10 @@ static void ptdump_walk_pgd_level_core(struct seq_file *m, pgd_t *pgd,
  
  	for (i = 0; i < PTRS_PER_PGD; i++) {
  		st.current_address = normalize_addr(i * PGD_LEVEL_MULT);
@@ -49938,7 +49946,7 @@ index 3a1f49f..42a478e 100644
  }
  EXPORT_SYMBOL_GPL(od_unregister_powersave_bias_handler);
 diff --git a/drivers/cpufreq/intel_pstate.c b/drivers/cpufreq/intel_pstate.c
-index 4737520..4cafa68 100644
+index 80fa656..fe055932 100644
 --- a/drivers/cpufreq/intel_pstate.c
 +++ b/drivers/cpufreq/intel_pstate.c
 @@ -283,13 +283,13 @@ struct pstate_funcs {
@@ -50018,7 +50026,7 @@ index 4737520..4cafa68 100644
  				  const char *buf, size_t count)
  {
  	unsigned int input;
-@@ -1154,7 +1154,7 @@ static void intel_pstate_set_pstate(struct cpudata *cpu, int pstate)
+@@ -1173,7 +1173,7 @@ static void intel_pstate_set_pstate(struct cpudata *cpu, int pstate)
  	 * right CPU.
  	 */
  	wrmsrl_on_cpu(cpu->cpu, MSR_IA32_PERF_CTL,
@@ -50027,7 +50035,7 @@ index 4737520..4cafa68 100644
  }
  
  static void intel_pstate_set_min_pstate(struct cpudata *cpu)
-@@ -1173,14 +1173,14 @@ static void intel_pstate_max_within_limits(struct cpudata *cpu)
+@@ -1192,14 +1192,14 @@ static void intel_pstate_max_within_limits(struct cpudata *cpu)
  
  static void intel_pstate_get_cpu_pstates(struct cpudata *cpu)
  {
@@ -50049,7 +50057,7 @@ index 4737520..4cafa68 100644
  
  	intel_pstate_set_min_pstate(cpu);
  }
-@@ -1329,7 +1329,7 @@ static inline void intel_pstate_update_pstate(struct cpudata *cpu, int pstate)
+@@ -1348,7 +1348,7 @@ static inline void intel_pstate_update_pstate(struct cpudata *cpu, int pstate)
  		return;
  
  	cpu->pstate.current_pstate = pstate;
@@ -50058,7 +50066,7 @@ index 4737520..4cafa68 100644
  }
  
  static inline void intel_pstate_adjust_busy_pstate(struct cpudata *cpu)
-@@ -1340,7 +1340,7 @@ static inline void intel_pstate_adjust_busy_pstate(struct cpudata *cpu)
+@@ -1359,7 +1359,7 @@ static inline void intel_pstate_adjust_busy_pstate(struct cpudata *cpu)
  	from = cpu->pstate.current_pstate;
  
  	target_pstate = cpu->policy == CPUFREQ_POLICY_PERFORMANCE ?
@@ -50067,7 +50075,7 @@ index 4737520..4cafa68 100644
  
  	intel_pstate_update_pstate(cpu, target_pstate);
  
-@@ -1653,15 +1653,15 @@ static unsigned int force_load __initdata;
+@@ -1683,15 +1683,15 @@ static unsigned int force_load __initdata;
  
  static int __init intel_pstate_msrs_not_valid(void)
  {
@@ -50087,7 +50095,7 @@ index 4737520..4cafa68 100644
  {
  	pid_params.sample_rate_ms = policy->sample_rate_ms;
  	pid_params.sample_rate_ns = pid_params.sample_rate_ms * NSEC_PER_MSEC;
-@@ -1674,15 +1674,7 @@ static void __init copy_pid_params(struct pstate_adjust_policy *policy)
+@@ -1704,15 +1704,7 @@ static void __init copy_pid_params(struct pstate_adjust_policy *policy)
  
  static void __init copy_cpu_funcs(struct pstate_funcs *funcs)
  {
@@ -52837,7 +52845,7 @@ index 670beeb..642dcef 100644
  	 * deal with them for Intel hardware.
  	 */
 diff --git a/drivers/gpu/drm/i915/i915_gem_execbuffer.c b/drivers/gpu/drm/i915/i915_gem_execbuffer.c
-index a218c2e..c834d0b 100644
+index 0c400f8..4f2bba6 100644
 --- a/drivers/gpu/drm/i915/i915_gem_execbuffer.c
 +++ b/drivers/gpu/drm/i915/i915_gem_execbuffer.c
 @@ -1187,12 +1187,12 @@ i915_gem_check_execbuffer(struct drm_i915_gem_execbuffer2 *exec)
@@ -53057,7 +53065,7 @@ index 3fc286c..4c19f25 100644
  
  /**
 diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
-index 8079e5b..70051e8 100644
+index b9be8a6..05d5f12 100644
 --- a/drivers/gpu/drm/i915/intel_display.c
 +++ b/drivers/gpu/drm/i915/intel_display.c
 @@ -16133,13 +16133,13 @@ struct intel_quirk {
@@ -55316,10 +55324,10 @@ index c13fb5b..55a3802 100644
  
  	*off += size;
 diff --git a/drivers/hv/channel.c b/drivers/hv/channel.c
-index 16f91c8..a45059b 100644
+index 5fb4c6d..29316a6 100644
 --- a/drivers/hv/channel.c
 +++ b/drivers/hv/channel.c
-@@ -397,7 +397,7 @@ int vmbus_establish_gpadl(struct vmbus_channel *channel, void *kbuffer,
+@@ -398,7 +398,7 @@ int vmbus_establish_gpadl(struct vmbus_channel *channel, void *kbuffer,
  	int ret = 0;
  
  	next_gpadl_handle =
@@ -55328,7 +55336,7 @@ index 16f91c8..a45059b 100644
  
  	ret = create_gpadl_header(kbuffer, size, &msginfo);
  	if (ret)
-@@ -742,9 +742,7 @@ int vmbus_sendpacket_pagebuffer_ctl(struct vmbus_channel *channel,
+@@ -715,9 +715,7 @@ int vmbus_sendpacket_pagebuffer_ctl(struct vmbus_channel *channel,
  	 * Adjust the size down since vmbus_channel_packet_page_buffer is the
  	 * largest size we support
  	 */
@@ -55496,7 +55504,7 @@ index fdf8da9..d3fefc5 100644
  	cap_msg.caps.cap_bits.balloon = 1;
  	cap_msg.caps.cap_bits.hot_add = 1;
 diff --git a/drivers/hv/hyperv_vmbus.h b/drivers/hv/hyperv_vmbus.h
-index a5b4442..b3b5e3e 100644
+index 2b13f2a..e150466 100644
 --- a/drivers/hv/hyperv_vmbus.h
 +++ b/drivers/hv/hyperv_vmbus.h
 @@ -567,7 +567,7 @@ enum vmbus_connect_state {
@@ -74069,6 +74077,19 @@ index 2478ccd..1194b50 100644
  		mwifiex_shutdown_sw(adapter, adapter->card_sem);
  	}
  }
+diff --git a/drivers/net/wireless/marvell/mwifiex/util.c b/drivers/net/wireless/marvell/mwifiex/util.c
+index 18fbb96..db73632 100644
+--- a/drivers/net/wireless/marvell/mwifiex/util.c
++++ b/drivers/net/wireless/marvell/mwifiex/util.c
+@@ -751,7 +751,7 @@ void mwifiex_hist_data_reset(struct mwifiex_private *priv)
+ void *mwifiex_alloc_dma_align_buf(int rx_len, gfp_t flags)
+ {
+ 	struct sk_buff *skb;
+-	int buf_len, pad;
++	long buf_len, pad;
+ 
+ 	buf_len = rx_len + MWIFIEX_RX_HEADROOM + MWIFIEX_DMA_ALIGN_SZ;
+ 
 diff --git a/drivers/net/wireless/ralink/rt2x00/rt2400pci.c b/drivers/net/wireless/ralink/rt2x00/rt2400pci.c
 index 155f343..5db43e7 100644
 --- a/drivers/net/wireless/ralink/rt2x00/rt2400pci.c
@@ -74920,7 +74941,7 @@ index 74dc2bf..e942c3b 100644
  	struct xenvif *vif = netdev_priv(dev);
  	struct xenvif_queue *queue = NULL;
 diff --git a/drivers/net/xen-netfront.c b/drivers/net/xen-netfront.c
-index bf2744e..c8b5fd0 100644
+index 0cdcb21..72354a5 100644
 --- a/drivers/net/xen-netfront.c
 +++ b/drivers/net/xen-netfront.c
 @@ -550,7 +550,7 @@ static u16 xennet_select_queue(struct net_device *dev, struct sk_buff *skb,
@@ -79178,10 +79199,10 @@ index a1a5ceb..8e83e34 100644
  	int ret = param_set_int(val, kp);
  	struct MPT3SAS_ADAPTER *ioc;
 diff --git a/drivers/scsi/mpt3sas/mpt3sas_scsih.c b/drivers/scsi/mpt3sas/mpt3sas_scsih.c
-index f84a608..b6e984c 100644
+index 8a7941b..eb919a5 100644
 --- a/drivers/scsi/mpt3sas/mpt3sas_scsih.c
 +++ b/drivers/scsi/mpt3sas/mpt3sas_scsih.c
-@@ -280,7 +280,7 @@ struct _scsi_io_transfer {
+@@ -281,7 +281,7 @@ struct _scsi_io_transfer {
   * Note: The logging levels are defined in mpt3sas_debug.h.
   */
  static int
@@ -79190,7 +79211,7 @@ index f84a608..b6e984c 100644
  {
  	int ret = param_set_int(val, kp);
  	struct MPT3SAS_ADAPTER *ioc;
-@@ -8952,7 +8952,7 @@ scsih_resume(struct pci_dev *pdev)
+@@ -8955,7 +8955,7 @@ scsih_resume(struct pci_dev *pdev)
   *      PCI_ERS_RESULT_NEED_RESET or PCI_ERS_RESULT_DISCONNECT
   */
  static pci_ers_result_t
@@ -79454,7 +79475,7 @@ index 6ca0081..fbb9efd 100644
  extern void qla2x00_free_sysfs_attr(scsi_qla_host_t *, bool);
  extern void qla2x00_init_host_attr(scsi_qla_host_t *);
 diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c
-index 078d797..1735786 100644
+index bea819e..fb745e0 100644
 --- a/drivers/scsi/qla2xxx/qla_os.c
 +++ b/drivers/scsi/qla2xxx/qla_os.c
 @@ -301,12 +301,12 @@ struct scsi_transport_template *qla2xxx_transport_vport_template = NULL;
@@ -83879,6 +83900,28 @@ index 7d90e25..0780424 100644
  	}
  	info->fbops = &lynxfb_ops;
  
+diff --git a/drivers/staging/unisys/visorbus/visorchipset.c b/drivers/staging/unisys/visorbus/visorchipset.c
+index 5987149..15c44ea 100644
+--- a/drivers/staging/unisys/visorbus/visorchipset.c
++++ b/drivers/staging/unisys/visorbus/visorchipset.c
+@@ -2234,7 +2234,7 @@ static __init uint32_t visorutil_spar_detect(void)
+ 	}
+ }
+ 
+-static int init_unisys(void)
++static __init int init_unisys(void)
+ {
+ 	int result;
+ 
+@@ -2249,7 +2249,7 @@ static int init_unisys(void)
+ 	return 0;
+ };
+ 
+-static void exit_unisys(void)
++static __exit void exit_unisys(void)
+ {
+ 	acpi_bus_unregister_driver(&unisys_acpi_driver);
+ }
 diff --git a/drivers/staging/unisys/visornic/visornic_main.c b/drivers/staging/unisys/visornic/visornic_main.c
 index 1367007..d7a3530 100644
 --- a/drivers/staging/unisys/visornic/visornic_main.c
@@ -138051,7 +138094,7 @@ index bb31373..e85eb5f 100644
  #ifdef CONFIG_CPU_IDLE
  extern int cpuidle_register_governor(struct cpuidle_governor *gov);
 diff --git a/include/linux/cpumask.h b/include/linux/cpumask.h
-index da7fbf1..c2a221b 100644
+index fa3b155..258dde5 100644
 --- a/include/linux/cpumask.h
 +++ b/include/linux/cpumask.h
 @@ -131,17 +131,17 @@ static inline unsigned int cpumask_first(const struct cpumask *srcp)
@@ -148744,7 +148787,7 @@ index e9fdb52..cfb547d 100644
  	new_table.data = &new_value;
  	ret = proc_dointvec_minmax(&new_table, write, buffer, lenp, ppos);
 diff --git a/kernel/events/core.c b/kernel/events/core.c
-index b1cfd74..62fe53a 100644
+index 4b33231..e0edf1b 100644
 --- a/kernel/events/core.c
 +++ b/kernel/events/core.c
 @@ -389,8 +389,15 @@ static struct srcu_struct pmus_srcu;
@@ -148793,7 +148836,7 @@ index b1cfd74..62fe53a 100644
  {
  	u64 frequency = event->attr.sample_freq;
  	u64 sec = NSEC_PER_SEC;
-@@ -4267,9 +4275,9 @@ u64 perf_event_read_value(struct perf_event *event, u64 *enabled, u64 *running)
+@@ -4272,9 +4280,9 @@ u64 perf_event_read_value(struct perf_event *event, u64 *enabled, u64 *running)
  	total += perf_event_count(event);
  
  	*enabled += event->total_time_enabled +
@@ -148805,7 +148848,7 @@ index b1cfd74..62fe53a 100644
  
  	list_for_each_entry(child, &event->child_list, child_list) {
  		(void)perf_event_read(child, false);
-@@ -4301,12 +4309,12 @@ static int __perf_read_group_add(struct perf_event *leader,
+@@ -4306,12 +4314,12 @@ static int __perf_read_group_add(struct perf_event *leader,
  	 */
  	if (read_format & PERF_FORMAT_TOTAL_TIME_ENABLED) {
  		values[n++] += leader->total_time_enabled +
@@ -148820,7 +148863,7 @@ index b1cfd74..62fe53a 100644
  	}
  
  	/*
-@@ -4829,10 +4837,10 @@ void perf_event_update_userpage(struct perf_event *event)
+@@ -4834,10 +4842,10 @@ void perf_event_update_userpage(struct perf_event *event)
  		userpg->offset -= local64_read(&event->hw.prev_count);
  
  	userpg->time_enabled = enabled +
@@ -148833,7 +148876,7 @@ index b1cfd74..62fe53a 100644
  
  	arch_perf_update_userpage(event, userpg, now);
  
-@@ -5535,7 +5543,7 @@ perf_output_sample_ustack(struct perf_output_handle *handle, u64 dump_size,
+@@ -5540,7 +5548,7 @@ perf_output_sample_ustack(struct perf_output_handle *handle, u64 dump_size,
  
  		/* Data. */
  		sp = perf_user_stack_pointer(regs);
@@ -148842,7 +148885,7 @@ index b1cfd74..62fe53a 100644
  		dyn_size = dump_size - rem;
  
  		perf_output_skip(handle, rem);
-@@ -5626,11 +5634,11 @@ static void perf_output_read_one(struct perf_output_handle *handle,
+@@ -5631,11 +5639,11 @@ static void perf_output_read_one(struct perf_output_handle *handle,
  	values[n++] = perf_event_count(event);
  	if (read_format & PERF_FORMAT_TOTAL_TIME_ENABLED) {
  		values[n++] = enabled +
@@ -148856,7 +148899,7 @@ index b1cfd74..62fe53a 100644
  	}
  	if (read_format & PERF_FORMAT_ID)
  		values[n++] = primary_event_id(event);
-@@ -8705,8 +8713,7 @@ perf_event_mux_interval_ms_store(struct device *dev,
+@@ -8710,8 +8718,7 @@ perf_event_mux_interval_ms_store(struct device *dev,
  		cpuctx = per_cpu_ptr(pmu->pmu_cpu_context, cpu);
  		cpuctx->hrtimer_interval = ns_to_ktime(NSEC_PER_MSEC * timer);
  
@@ -148866,7 +148909,7 @@ index b1cfd74..62fe53a 100644
  	}
  	put_online_cpus();
  	mutex_unlock(&mux_interval_mutex);
-@@ -9152,7 +9159,7 @@ perf_event_alloc(struct perf_event_attr *attr, int cpu,
+@@ -9157,7 +9164,7 @@ perf_event_alloc(struct perf_event_attr *attr, int cpu,
  	event->parent		= parent_event;
  
  	event->ns		= get_pid_ns(task_active_pid_ns(current));
@@ -148875,7 +148918,7 @@ index b1cfd74..62fe53a 100644
  
  	event->state		= PERF_EVENT_STATE_INACTIVE;
  
-@@ -9587,6 +9594,11 @@ SYSCALL_DEFINE5(perf_event_open,
+@@ -9592,6 +9599,11 @@ SYSCALL_DEFINE5(perf_event_open,
  	if (flags & ~PERF_FLAG_ALL)
  		return -EINVAL;
  
@@ -148887,7 +148930,7 @@ index b1cfd74..62fe53a 100644
  	err = perf_copy_attr(attr_uptr, &attr);
  	if (err)
  		return err;
-@@ -10126,10 +10138,10 @@ static void sync_child_event(struct perf_event *child_event,
+@@ -10131,10 +10143,10 @@ static void sync_child_event(struct perf_event *child_event,
  	/*
  	 * Add back the child's count to the parent's count:
  	 */
@@ -153143,7 +153186,7 @@ index 4a5c6e7..96ef058 100644
  	mutex_unlock(&smpboot_threads_lock);
  	put_online_cpus();
 diff --git a/kernel/softirq.c b/kernel/softirq.c
-index 744fa61..32960f2 100644
+index 744fa61..ab73a78 100644
 --- a/kernel/softirq.c
 +++ b/kernel/softirq.c
 @@ -53,7 +53,7 @@ irq_cpustat_t irq_stat[NR_CPUS] ____cacheline_aligned;
@@ -153155,7 +153198,7 @@ index 744fa61..32960f2 100644
  
  DEFINE_PER_CPU(struct task_struct *, ksoftirqd);
  
-@@ -281,7 +281,7 @@ asmlinkage __visible void __softirq_entry __do_softirq(void)
+@@ -281,10 +281,10 @@ asmlinkage __visible void __softirq_entry __do_softirq(void)
  		kstat_incr_softirqs_this_cpu(vec_nr);
  
  		trace_softirq_entry(vec_nr);
@@ -153163,7 +153206,11 @@ index 744fa61..32960f2 100644
 +		h->action();
  		trace_softirq_exit(vec_nr);
  		if (unlikely(prev_count != preempt_count())) {
- 			pr_err("huh, entered softirq %u %s %p with preempt_count %08x, exited with %08x?\n",
+-			pr_err("huh, entered softirq %u %s %p with preempt_count %08x, exited with %08x?\n",
++			pr_err("huh, entered softirq %u %s %pA with preempt_count %08x, exited with %08x?\n",
+ 			       vec_nr, softirq_to_name[vec_nr], h->action,
+ 			       prev_count, preempt_count());
+ 			preempt_count_set(prev_count);
 @@ -444,7 +444,7 @@ void __raise_softirq_irqoff(unsigned int nr)
  	or_softirq_pending(1UL << nr);
  }
@@ -161396,7 +161443,7 @@ index 5ec1580..eea07f2 100644
  EXPORT_SYMBOL(kmem_cache_free);
  
 diff --git a/mm/slub.c b/mm/slub.c
-index 2b3e740..ca3813c 100644
+index 7aa0e97..ca3813c 100644
 --- a/mm/slub.c
 +++ b/mm/slub.c
 @@ -34,6 +34,7 @@
@@ -161471,18 +161518,7 @@ index 2b3e740..ca3813c 100644
  	       s, (void *)t->addr, jiffies - t->when, t->cpu, t->pid);
  #ifdef CONFIG_STACKTRACE
  	{
-@@ -1419,6 +1430,10 @@ static int init_cache_random_seq(struct kmem_cache *s)
- 	int err;
- 	unsigned long i, count = oo_objects(s->oo);
- 
-+	/* Bailout if already initialised */
-+	if (s->random_seq)
-+		return 0;
-+
- 	err = cache_random_seq_create(s, count, GFP_KERNEL);
- 	if (err) {
- 		pr_err("SLUB: Unable to initialize free list for %s\n",
-@@ -2911,6 +2926,23 @@ static __always_inline void do_slab_free(struct kmem_cache *s,
+@@ -2915,6 +2926,23 @@ static __always_inline void do_slab_free(struct kmem_cache *s,
  	void *tail_obj = tail ? : head;
  	struct kmem_cache_cpu *c;
  	unsigned long tid;
@@ -161506,7 +161542,7 @@ index 2b3e740..ca3813c 100644
  redo:
  	/*
  	 * Determine the currently cpus per cpu slab.
-@@ -3714,7 +3746,7 @@ static int __init setup_slub_min_objects(char *str)
+@@ -3718,7 +3746,7 @@ static int __init setup_slub_min_objects(char *str)
  
  __setup("slub_min_objects=", setup_slub_min_objects);
  
@@ -161515,7 +161551,7 @@ index 2b3e740..ca3813c 100644
  {
  	struct kmem_cache *s;
  	void *ret;
-@@ -3752,7 +3784,7 @@ static void *kmalloc_large_node(size_t size, gfp_t flags, int node)
+@@ -3756,7 +3784,7 @@ static void *kmalloc_large_node(size_t size, gfp_t flags, int node)
  	return ptr;
  }
  
@@ -161524,7 +161560,7 @@ index 2b3e740..ca3813c 100644
  {
  	struct kmem_cache *s;
  	void *ret;
-@@ -3783,9 +3815,41 @@ void *__kmalloc_node(size_t size, gfp_t flags, int node)
+@@ -3787,9 +3815,41 @@ void *__kmalloc_node(size_t size, gfp_t flags, int node)
  EXPORT_SYMBOL(__kmalloc_node);
  #endif
  
@@ -161567,7 +161603,7 @@ index 2b3e740..ca3813c 100644
   *
   * Returns NULL if check passes, otherwise const char * to name of cache
   * to indicate an error.
-@@ -3795,15 +3859,15 @@ const char *__check_heap_object(const void *ptr, unsigned long n,
+@@ -3799,15 +3859,15 @@ const char *__check_heap_object(const void *ptr, unsigned long n,
  {
  	struct kmem_cache *s;
  	unsigned long offset;
@@ -161585,7 +161621,7 @@ index 2b3e740..ca3813c 100644
  
  	/* Find offset within object. */
  	offset = (ptr - page_address(page)) % s->size;
-@@ -3815,11 +3879,16 @@ const char *__check_heap_object(const void *ptr, unsigned long n,
+@@ -3819,11 +3879,16 @@ const char *__check_heap_object(const void *ptr, unsigned long n,
  		offset -= s->red_left_pad;
  	}
  
@@ -161606,7 +161642,7 @@ index 2b3e740..ca3813c 100644
  }
  #endif /* CONFIG_HARDENED_USERCOPY */
  
-@@ -3861,6 +3930,7 @@ void kfree(const void *x)
+@@ -3865,6 +3930,7 @@ void kfree(const void *x)
  	if (unlikely(ZERO_OR_NULL_PTR(x)))
  		return;
  
@@ -161614,7 +161650,7 @@ index 2b3e740..ca3813c 100644
  	page = virt_to_head_page(x);
  	if (unlikely(!PageSlab(page))) {
  		BUG_ON(!PageCompound(page));
-@@ -4131,7 +4201,7 @@ void __init kmem_cache_init(void)
+@@ -4135,7 +4201,7 @@ void __init kmem_cache_init(void)
  	kmem_cache = &boot_kmem_cache;
  
  	create_boot_cache(kmem_cache_node, "kmem_cache_node",
@@ -161623,7 +161659,7 @@ index 2b3e740..ca3813c 100644
  
  	register_hotmemory_notifier(&slab_memory_callback_nb);
  
-@@ -4141,7 +4211,7 @@ void __init kmem_cache_init(void)
+@@ -4145,7 +4211,7 @@ void __init kmem_cache_init(void)
  	create_boot_cache(kmem_cache, "kmem_cache",
  			offsetof(struct kmem_cache, node) +
  				nr_node_ids * sizeof(struct kmem_cache_node *),
@@ -161632,7 +161668,7 @@ index 2b3e740..ca3813c 100644
  
  	kmem_cache = bootstrap(&boot_kmem_cache);
  
-@@ -4180,7 +4250,7 @@ __kmem_cache_alias(const char *name, size_t size, size_t align,
+@@ -4184,7 +4250,7 @@ __kmem_cache_alias(const char *name, size_t size, size_t align,
  
  	s = find_mergeable(size, align, flags, name, ctor);
  	if (s) {
@@ -161641,7 +161677,7 @@ index 2b3e740..ca3813c 100644
  
  		/*
  		 * Adjust the object sizes so that we clear
-@@ -4196,7 +4266,7 @@ __kmem_cache_alias(const char *name, size_t size, size_t align,
+@@ -4200,7 +4266,7 @@ __kmem_cache_alias(const char *name, size_t size, size_t align,
  		}
  
  		if (sysfs_slab_alias(s, name)) {
@@ -161650,7 +161686,7 @@ index 2b3e740..ca3813c 100644
  			s = NULL;
  		}
  	}
-@@ -4208,6 +4278,8 @@ int __kmem_cache_create(struct kmem_cache *s, unsigned long flags)
+@@ -4212,6 +4278,8 @@ int __kmem_cache_create(struct kmem_cache *s, unsigned long flags)
  {
  	int err;
  
@@ -161659,7 +161695,7 @@ index 2b3e740..ca3813c 100644
  	err = kmem_cache_open(s, flags);
  	if (err)
  		return err;
-@@ -4276,7 +4348,7 @@ void *__kmalloc_node_track_caller(size_t size, gfp_t gfpflags,
+@@ -4280,7 +4348,7 @@ void *__kmalloc_node_track_caller(size_t size, gfp_t gfpflags,
  }
  #endif
  
@@ -161668,7 +161704,7 @@ index 2b3e740..ca3813c 100644
  static int count_inuse(struct page *page)
  {
  	return page->inuse;
-@@ -4557,7 +4629,11 @@ static int list_locations(struct kmem_cache *s, char *buf,
+@@ -4561,7 +4629,11 @@ static int list_locations(struct kmem_cache *s, char *buf,
  		len += sprintf(buf + len, "%7ld ", l->count);
  
  		if (l->addr)
@@ -161680,7 +161716,7 @@ index 2b3e740..ca3813c 100644
  		else
  			len += sprintf(buf + len, "<not-available>");
  
-@@ -4655,12 +4731,12 @@ static void __init resiliency_test(void)
+@@ -4659,12 +4731,12 @@ static void __init resiliency_test(void)
  	validate_slab_cache(kmalloc_caches[9]);
  }
  #else
@@ -161695,7 +161731,7 @@ index 2b3e740..ca3813c 100644
  enum slab_stat_type {
  	SL_ALL,			/* All slabs */
  	SL_PARTIAL,		/* Only partially allocated slabs */
-@@ -4897,13 +4973,17 @@ static ssize_t ctor_show(struct kmem_cache *s, char *buf)
+@@ -4901,13 +4973,17 @@ static ssize_t ctor_show(struct kmem_cache *s, char *buf)
  {
  	if (!s->ctor)
  		return 0;
@@ -161714,7 +161750,7 @@ index 2b3e740..ca3813c 100644
  }
  SLAB_ATTR_RO(aliases);
  
-@@ -4991,6 +5071,22 @@ static ssize_t cache_dma_show(struct kmem_cache *s, char *buf)
+@@ -4995,6 +5071,22 @@ static ssize_t cache_dma_show(struct kmem_cache *s, char *buf)
  SLAB_ATTR_RO(cache_dma);
  #endif
  
@@ -161737,7 +161773,7 @@ index 2b3e740..ca3813c 100644
  static ssize_t destroy_by_rcu_show(struct kmem_cache *s, char *buf)
  {
  	return sprintf(buf, "%d\n", !!(s->flags & SLAB_DESTROY_BY_RCU));
-@@ -5046,7 +5142,7 @@ static ssize_t trace_store(struct kmem_cache *s, const char *buf,
+@@ -5050,7 +5142,7 @@ static ssize_t trace_store(struct kmem_cache *s, const char *buf,
  	 * as well as cause other issues like converting a mergeable
  	 * cache into an umergeable one.
  	 */
@@ -161746,7 +161782,7 @@ index 2b3e740..ca3813c 100644
  		return -EINVAL;
  
  	s->flags &= ~SLAB_TRACE;
-@@ -5164,7 +5260,7 @@ static ssize_t failslab_show(struct kmem_cache *s, char *buf)
+@@ -5168,7 +5260,7 @@ static ssize_t failslab_show(struct kmem_cache *s, char *buf)
  static ssize_t failslab_store(struct kmem_cache *s, const char *buf,
  							size_t length)
  {
@@ -161755,7 +161791,7 @@ index 2b3e740..ca3813c 100644
  		return -EINVAL;
  
  	s->flags &= ~SLAB_FAILSLAB;
-@@ -5296,7 +5392,7 @@ STAT_ATTR(CPU_PARTIAL_NODE, cpu_partial_node);
+@@ -5300,7 +5392,7 @@ STAT_ATTR(CPU_PARTIAL_NODE, cpu_partial_node);
  STAT_ATTR(CPU_PARTIAL_DRAIN, cpu_partial_drain);
  #endif
  
@@ -161764,7 +161800,7 @@ index 2b3e740..ca3813c 100644
  	&slab_size_attr.attr,
  	&object_size_attr.attr,
  	&objs_per_slab_attr.attr,
-@@ -5331,6 +5427,12 @@ static struct attribute *slab_attrs[] = {
+@@ -5335,6 +5427,12 @@ static struct attribute *slab_attrs[] = {
  #ifdef CONFIG_ZONE_DMA
  	&cache_dma_attr.attr,
  #endif
@@ -161777,7 +161813,7 @@ index 2b3e740..ca3813c 100644
  #ifdef CONFIG_NUMA
  	&remote_node_defrag_ratio_attr.attr,
  #endif
-@@ -5574,6 +5676,7 @@ static char *create_unique_id(struct kmem_cache *s)
+@@ -5578,6 +5676,7 @@ static char *create_unique_id(struct kmem_cache *s)
  	return name;
  }
  
@@ -161785,7 +161821,7 @@ index 2b3e740..ca3813c 100644
  static int sysfs_slab_add(struct kmem_cache *s)
  {
  	int err;
-@@ -5645,6 +5748,7 @@ void sysfs_slab_remove(struct kmem_cache *s)
+@@ -5649,6 +5748,7 @@ void sysfs_slab_remove(struct kmem_cache *s)
  	kobject_del(&s->kobj);
  	kobject_put(&s->kobj);
  }
@@ -161793,7 +161829,7 @@ index 2b3e740..ca3813c 100644
  
  /*
   * Need to buffer aliases during bootup until sysfs becomes
-@@ -5658,6 +5762,7 @@ struct saved_alias {
+@@ -5662,6 +5762,7 @@ struct saved_alias {
  
  static struct saved_alias *alias_list;
  
@@ -161801,7 +161837,7 @@ index 2b3e740..ca3813c 100644
  static int sysfs_slab_alias(struct kmem_cache *s, const char *name)
  {
  	struct saved_alias *al;
-@@ -5680,6 +5785,7 @@ static int sysfs_slab_alias(struct kmem_cache *s, const char *name)
+@@ -5684,6 +5785,7 @@ static int sysfs_slab_alias(struct kmem_cache *s, const char *name)
  	alias_list = al;
  	return 0;
  }
@@ -170432,33 +170468,6 @@ index 6cfb6e9..eaa7ef4 100644
  		linkwatch_fire_event(dev);
  	}
  }
-diff --git a/net/sched/sch_tbf.c b/net/sched/sch_tbf.c
-index 303355c..d6ce615 100644
---- a/net/sched/sch_tbf.c
-+++ b/net/sched/sch_tbf.c
-@@ -162,7 +162,8 @@ static int tbf_segment(struct sk_buff *skb, struct Qdisc *sch,
- 	struct sk_buff *segs, *nskb;
- 	netdev_features_t features = netif_skb_features(skb);
- 	unsigned int len = 0, prev_len = qdisc_pkt_len(skb);
--	int ret, nb;
-+	int ret;
-+	unsigned int nb;
- 
- 	segs = skb_gso_segment(skb, features & ~NETIF_F_GSO_MASK);
- 
-@@ -185,8 +186,10 @@ static int tbf_segment(struct sk_buff *skb, struct Qdisc *sch,
- 		segs = nskb;
- 	}
- 	sch->q.qlen += nb;
--	if (nb > 1)
--		qdisc_tree_reduce_backlog(sch, 1 - nb, prev_len - len);
-+	if (nb > 1) {
-+		nb--;
-+		qdisc_tree_reduce_backlog(sch, -nb, prev_len - len);
-+	}
- 	consume_skb(skb);
- 	return nb > 0 ? NET_XMIT_SUCCESS : NET_XMIT_DROP;
- }
 diff --git a/net/sctp/ipv6.c b/net/sctp/ipv6.c
 index 176af30..585194b 100644
 --- a/net/sctp/ipv6.c
@@ -174500,10 +174509,10 @@ index 0000000..7514850
 +fi
 diff --git a/scripts/gcc-plugins/initify_plugin.c b/scripts/gcc-plugins/initify_plugin.c
 new file mode 100644
-index 0000000..ad28ed6
+index 0000000..1c8d204
 --- /dev/null
 +++ b/scripts/gcc-plugins/initify_plugin.c
-@@ -0,0 +1,1831 @@
+@@ -0,0 +1,1865 @@
 +/*
 + * Copyright 2015-2017 by Emese Revfy <re.emese@gmail.com>
 + * Licensed under the GPL v2
@@ -174553,7 +174562,7 @@ index 0000000..ad28ed6
 +__visible int plugin_is_GPL_compatible;
 +
 +static struct plugin_info initify_plugin_info = {
-+	.version	=	"20170112",
++	.version	=	"20170215",
 +	.help		=	"disable\tturn off the initify plugin\n"
 +				"verbose\tprint all initified strings and all"
 +				" functions which should be __init/__exit\n"
@@ -174622,14 +174631,37 @@ index 0000000..ad28ed6
 +{
 +	delete visited;
 +}
++
++typedef struct hash_set<struct cgraph_node *> cgraph_set;
++
++static inline bool pointer_set_insert(cgraph_set *visited, struct cgraph_node *node)
++{
++	return visited->add(node);
++}
++
++static inline cgraph_set* cgraph_pointer_set_create(void)
++{
++	return new hash_set<struct cgraph_node *>;
++}
++
++static inline void pointer_set_destroy(cgraph_set *visited)
++{
++	delete visited;
++}
 +#else
 +typedef struct pointer_set_t gimple_set;
 +typedef struct pointer_set_t tree_set;
++typedef struct pointer_set_t cgraph_set;
 +
 +static inline tree_set *tree_pointer_set_create(void)
 +{
 +	return pointer_set_create();
 +}
++
++static inline cgraph_set *cgraph_pointer_set_create(void)
++{
++	return pointer_set_create();
++}
 +#endif
 +
 +static gimple initify_get_def_stmt(const_tree node)
@@ -175295,7 +175327,8 @@ index 0000000..ad28ed6
 +
 +	if (fndecl == NULL_TREE)
 +		fndecl = gimple_call_fn(call);
-+	gcc_assert(fndecl != NULL_TREE);
++	if (fndecl == NULL_TREE)
++		return false;
 +
 +	if (is_negative_nocapture_arg(fndecl, -arg_num) && is_return_value_captured(visited_defs, call))
 +		return false;
@@ -175658,7 +175691,7 @@ index 0000000..ad28ed6
 +	tree var;
 +
 +	FOR_EACH_LOCAL_DECL(cfun, i, var) {
-+		tree str, init_val;
++		tree str, init_val, asm_name;
 +
 +		if (TREE_CODE(TREE_TYPE(var)) != ARRAY_TYPE)
 +			continue;
@@ -175669,6 +175702,10 @@ index 0000000..ad28ed6
 +		if (TREE_CODE(init_val) != STRING_CST)
 +			continue;
 +
++		asm_name = DECL_ASSEMBLER_NAME(var);
++		if (asm_name != NULL_TREE && TREE_SYMBOL_REFERENCED(asm_name))
++			continue;
++
 +		if (has_capture_use_local_var(var))
 +			continue;
 +
@@ -176044,18 +176081,21 @@ index 0000000..ad28ed6
 +	return false;
 +}
 +
-+static void has_non_init_clone(struct cgraph_node *node, bool *has_non_init)
++static bool has_non_init_clone(cgraph_set *visited, struct cgraph_node *node)
 +{
-+	if (*has_non_init)
-+		return;
++	if (!node)
++		return false;
++
++	if (pointer_set_insert(visited, node))
++		return false;
 +
 +	if (has_non_init_caller(node))
-+		*has_non_init = true;
++		return true;
 +
-+	if (node->clones)
-+		has_non_init_clone(node->clones, has_non_init);
-+	if (node->clone_of)
-+		has_non_init_clone(node->clone_of, has_non_init);
++	if (has_non_init_clone(visited, node->clones))
++		return true;
++
++	return has_non_init_clone(visited, node->clone_of);
 +}
 +
 +/*
@@ -176064,6 +176104,7 @@ index 0000000..ad28ed6
 + */
 +static bool should_init_exit(struct cgraph_node *callee)
 +{
++	cgraph_set *visited;
 +	bool has_non_init;
 +	const_tree callee_decl = NODE_DECL(callee);
 +
@@ -176079,8 +176120,10 @@ index 0000000..ad28ed6
 +	if (NODE_SYMBOL(callee)->address_taken)
 +		return false;
 +
-+	has_non_init = false;
-+	has_non_init_clone(callee, &has_non_init);
++	visited = cgraph_pointer_set_create();
++	has_non_init = has_non_init_clone(visited, callee);
++	pointer_set_destroy(visited);
++
 +	return !has_non_init;
 +}
 +
@@ -224547,7 +224590,7 @@ index 062c446..a4b6f4c 100644
  };
  
 diff --git a/sound/core/seq/seq_memory.c b/sound/core/seq/seq_memory.c
-index c850345..ec0a853 100644
+index dfa5156..05c2b75 100644
 --- a/sound/core/seq/seq_memory.c
 +++ b/sound/core/seq/seq_memory.c
 @@ -87,7 +87,7 @@ int snd_seq_dump_var_event(const struct snd_seq_event *event,
@@ -225456,7 +225499,7 @@ index a020920..55579f6 100644
  
  
 diff --git a/sound/usb/line6/driver.c b/sound/usb/line6/driver.c
-index 90009c0..41ed071 100644
+index ab3c280..e5cb292 100644
 --- a/sound/usb/line6/driver.c
 +++ b/sound/usb/line6/driver.c
 @@ -337,7 +337,7 @@ int line6_read_data(struct usb_line6 *line6, unsigned address, void *data,
diff --git a/4.9.9/4425_grsec_remove_EI_PAX.patch b/4.9.10/4425_grsec_remove_EI_PAX.patch
index 594598a..594598a 100644
--- a/4.9.9/4425_grsec_remove_EI_PAX.patch
+++ b/4.9.10/4425_grsec_remove_EI_PAX.patch
diff --git a/4.9.9/4426_default_XATTR_PAX_FLAGS.patch b/4.9.10/4426_default_XATTR_PAX_FLAGS.patch
index f7e97b5..f7e97b5 100644
--- a/4.9.9/4426_default_XATTR_PAX_FLAGS.patch
+++ b/4.9.10/4426_default_XATTR_PAX_FLAGS.patch
diff --git a/4.9.9/4427_force_XATTR_PAX_tmpfs.patch b/4.9.10/4427_force_XATTR_PAX_tmpfs.patch
index 3871139..3871139 100644
--- a/4.9.9/4427_force_XATTR_PAX_tmpfs.patch
+++ b/4.9.10/4427_force_XATTR_PAX_tmpfs.patch
diff --git a/4.9.9/4430_grsec-remove-localversion-grsec.patch b/4.9.10/4430_grsec-remove-localversion-grsec.patch
index 31cf878..31cf878 100644
--- a/4.9.9/4430_grsec-remove-localversion-grsec.patch
+++ b/4.9.10/4430_grsec-remove-localversion-grsec.patch
diff --git a/4.9.9/4435_grsec-mute-warnings.patch b/4.9.10/4435_grsec-mute-warnings.patch
index 8929222..8929222 100644
--- a/4.9.9/4435_grsec-mute-warnings.patch
+++ b/4.9.10/4435_grsec-mute-warnings.patch
diff --git a/4.9.9/4440_grsec-remove-protected-paths.patch b/4.9.10/4440_grsec-remove-protected-paths.patch
index 741546d..741546d 100644
--- a/4.9.9/4440_grsec-remove-protected-paths.patch
+++ b/4.9.10/4440_grsec-remove-protected-paths.patch
diff --git a/4.9.9/4450_grsec-kconfig-default-gids.patch b/4.9.10/4450_grsec-kconfig-default-gids.patch
index cee6e27..cee6e27 100644
--- a/4.9.9/4450_grsec-kconfig-default-gids.patch
+++ b/4.9.10/4450_grsec-kconfig-default-gids.patch
diff --git a/4.9.9/4465_selinux-avc_audit-log-curr_ip.patch b/4.9.10/4465_selinux-avc_audit-log-curr_ip.patch
index 06a5294..06a5294 100644
--- a/4.9.9/4465_selinux-avc_audit-log-curr_ip.patch
+++ b/4.9.10/4465_selinux-avc_audit-log-curr_ip.patch
diff --git a/4.9.9/4470_disable-compat_vdso.patch b/4.9.10/4470_disable-compat_vdso.patch
index a1401d8..a1401d8 100644
--- a/4.9.9/4470_disable-compat_vdso.patch
+++ b/4.9.10/4470_disable-compat_vdso.patch
diff --git a/4.9.9/4475_emutramp_default_on.patch b/4.9.10/4475_emutramp_default_on.patch
index feb8c7b..feb8c7b 100644
--- a/4.9.9/4475_emutramp_default_on.patch
+++ b/4.9.10/4475_emutramp_default_on.patch
diff --git a/4.9.9/1007_linux-4.9.8.patch b/4.9.9/1007_linux-4.9.8.patch
deleted file mode 100644
index a93aab4..0000000
--- a/4.9.9/1007_linux-4.9.8.patch
+++ /dev/null
@@ -1,2048 +0,0 @@
-diff --git a/Makefile b/Makefile
-index da704d9..1130803 100644
---- a/Makefile
-+++ b/Makefile
-@@ -1,6 +1,6 @@
- VERSION = 4
- PATCHLEVEL = 9
--SUBLEVEL = 7
-+SUBLEVEL = 8
- EXTRAVERSION =
- NAME = Roaring Lionus
- 
-diff --git a/drivers/net/ethernet/broadcom/bcmsysport.c b/drivers/net/ethernet/broadcom/bcmsysport.c
-index 25d1eb4..be7ec5a 100644
---- a/drivers/net/ethernet/broadcom/bcmsysport.c
-+++ b/drivers/net/ethernet/broadcom/bcmsysport.c
-@@ -710,11 +710,8 @@ static unsigned int __bcm_sysport_tx_reclaim(struct bcm_sysport_priv *priv,
- 	unsigned int c_index, last_c_index, last_tx_cn, num_tx_cbs;
- 	unsigned int pkts_compl = 0, bytes_compl = 0;
- 	struct bcm_sysport_cb *cb;
--	struct netdev_queue *txq;
- 	u32 hw_ind;
- 
--	txq = netdev_get_tx_queue(ndev, ring->index);
--
- 	/* Compute how many descriptors have been processed since last call */
- 	hw_ind = tdma_readl(priv, TDMA_DESC_RING_PROD_CONS_INDEX(ring->index));
- 	c_index = (hw_ind >> RING_CONS_INDEX_SHIFT) & RING_CONS_INDEX_MASK;
-@@ -745,9 +742,6 @@ static unsigned int __bcm_sysport_tx_reclaim(struct bcm_sysport_priv *priv,
- 
- 	ring->c_index = c_index;
- 
--	if (netif_tx_queue_stopped(txq) && pkts_compl)
--		netif_tx_wake_queue(txq);
--
- 	netif_dbg(priv, tx_done, ndev,
- 		  "ring=%d c_index=%d pkts_compl=%d, bytes_compl=%d\n",
- 		  ring->index, ring->c_index, pkts_compl, bytes_compl);
-@@ -759,16 +753,33 @@ static unsigned int __bcm_sysport_tx_reclaim(struct bcm_sysport_priv *priv,
- static unsigned int bcm_sysport_tx_reclaim(struct bcm_sysport_priv *priv,
- 					   struct bcm_sysport_tx_ring *ring)
- {
-+	struct netdev_queue *txq;
- 	unsigned int released;
- 	unsigned long flags;
- 
-+	txq = netdev_get_tx_queue(priv->netdev, ring->index);
-+
- 	spin_lock_irqsave(&ring->lock, flags);
- 	released = __bcm_sysport_tx_reclaim(priv, ring);
-+	if (released)
-+		netif_tx_wake_queue(txq);
-+
- 	spin_unlock_irqrestore(&ring->lock, flags);
- 
- 	return released;
- }
- 
-+/* Locked version of the per-ring TX reclaim, but does not wake the queue */
-+static void bcm_sysport_tx_clean(struct bcm_sysport_priv *priv,
-+				 struct bcm_sysport_tx_ring *ring)
-+{
-+	unsigned long flags;
-+
-+	spin_lock_irqsave(&ring->lock, flags);
-+	__bcm_sysport_tx_reclaim(priv, ring);
-+	spin_unlock_irqrestore(&ring->lock, flags);
-+}
-+
- static int bcm_sysport_tx_poll(struct napi_struct *napi, int budget)
- {
- 	struct bcm_sysport_tx_ring *ring =
-@@ -1253,7 +1264,7 @@ static void bcm_sysport_fini_tx_ring(struct bcm_sysport_priv *priv,
- 	napi_disable(&ring->napi);
- 	netif_napi_del(&ring->napi);
- 
--	bcm_sysport_tx_reclaim(priv, ring);
-+	bcm_sysport_tx_clean(priv, ring);
- 
- 	kfree(ring->cbs);
- 	ring->cbs = NULL;
-diff --git a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
-index fb8bb02..d223e7c 100644
---- a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
-+++ b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
-@@ -1740,8 +1740,11 @@ int mlx4_en_start_port(struct net_device *dev)
- 	/* Process all completions if exist to prevent
- 	 * the queues freezing if they are full
- 	 */
--	for (i = 0; i < priv->rx_ring_num; i++)
-+	for (i = 0; i < priv->rx_ring_num; i++) {
-+		local_bh_disable();
- 		napi_schedule(&priv->rx_cq[i]->napi);
-+		local_bh_enable();
-+	}
- 
- 	netif_tx_start_all_queues(dev);
- 	netif_device_attach(dev);
-diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
-index 33495d8..e7b2158 100644
---- a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
-+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
-@@ -193,6 +193,9 @@ static inline bool mlx5e_rx_cache_put(struct mlx5e_rq *rq,
- 		return false;
- 	}
- 
-+	if (unlikely(page_is_pfmemalloc(dma_info->page)))
-+		return false;
-+
- 	cache->page_cache[cache->tail] = *dma_info;
- 	cache->tail = tail_next;
- 	return true;
-diff --git a/drivers/net/ethernet/mellanox/mlxsw/pci.h b/drivers/net/ethernet/mellanox/mlxsw/pci.h
-index d942a3e..846fd4d 100644
---- a/drivers/net/ethernet/mellanox/mlxsw/pci.h
-+++ b/drivers/net/ethernet/mellanox/mlxsw/pci.h
-@@ -211,21 +211,21 @@ MLXSW_ITEM32(pci, eqe, owner, 0x0C, 0, 1);
- /* pci_eqe_cmd_token
-  * Command completion event - token
-  */
--MLXSW_ITEM32(pci, eqe, cmd_token, 0x08, 16, 16);
-+MLXSW_ITEM32(pci, eqe, cmd_token, 0x00, 16, 16);
- 
- /* pci_eqe_cmd_status
-  * Command completion event - status
-  */
--MLXSW_ITEM32(pci, eqe, cmd_status, 0x08, 0, 8);
-+MLXSW_ITEM32(pci, eqe, cmd_status, 0x00, 0, 8);
- 
- /* pci_eqe_cmd_out_param_h
-  * Command completion event - output parameter - higher part
-  */
--MLXSW_ITEM32(pci, eqe, cmd_out_param_h, 0x0C, 0, 32);
-+MLXSW_ITEM32(pci, eqe, cmd_out_param_h, 0x04, 0, 32);
- 
- /* pci_eqe_cmd_out_param_l
-  * Command completion event - output parameter - lower part
-  */
--MLXSW_ITEM32(pci, eqe, cmd_out_param_l, 0x10, 0, 32);
-+MLXSW_ITEM32(pci, eqe, cmd_out_param_l, 0x08, 0, 32);
- 
- #endif
-diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
-index dda5761..f902c4d 100644
---- a/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
-+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
-@@ -684,6 +684,7 @@ static netdev_tx_t mlxsw_sp_port_xmit(struct sk_buff *skb,
- 			dev_kfree_skb_any(skb_orig);
- 			return NETDEV_TX_OK;
- 		}
-+		dev_consume_skb_any(skb_orig);
- 	}
- 
- 	if (eth_skb_pad(skb)) {
-diff --git a/drivers/net/ethernet/mellanox/mlxsw/switchx2.c b/drivers/net/ethernet/mellanox/mlxsw/switchx2.c
-index 92bda87..d548f0a 100644
---- a/drivers/net/ethernet/mellanox/mlxsw/switchx2.c
-+++ b/drivers/net/ethernet/mellanox/mlxsw/switchx2.c
-@@ -314,6 +314,7 @@ static netdev_tx_t mlxsw_sx_port_xmit(struct sk_buff *skb,
- 			dev_kfree_skb_any(skb_orig);
- 			return NETDEV_TX_OK;
- 		}
-+		dev_consume_skb_any(skb_orig);
- 	}
- 	mlxsw_sx_txhdr_construct(skb, &tx_info);
- 	/* TX header is consumed by HW on the way so we shouldn't count its
-diff --git a/drivers/net/ethernet/renesas/ravb_main.c b/drivers/net/ethernet/renesas/ravb_main.c
-index d6a2178..862f18e 100644
---- a/drivers/net/ethernet/renesas/ravb_main.c
-+++ b/drivers/net/ethernet/renesas/ravb_main.c
-@@ -1508,6 +1508,19 @@ static netdev_tx_t ravb_start_xmit(struct sk_buff *skb, struct net_device *ndev)
- 	buffer = PTR_ALIGN(priv->tx_align[q], DPTR_ALIGN) +
- 		 entry / NUM_TX_DESC * DPTR_ALIGN;
- 	len = PTR_ALIGN(skb->data, DPTR_ALIGN) - skb->data;
-+	/* Zero length DMA descriptors are problematic as they seem to
-+	 * terminate DMA transfers. Avoid them by simply using a length of
-+	 * DPTR_ALIGN (4) when skb data is aligned to DPTR_ALIGN.
-+	 *
-+	 * As skb is guaranteed to have at least ETH_ZLEN (60) bytes of
-+	 * data by the call to skb_put_padto() above this is safe with
-+	 * respect to both the length of the first DMA descriptor (len)
-+	 * overflowing the available data and the length of the second DMA
-+	 * descriptor (skb->len - len) being negative.
-+	 */
-+	if (len == 0)
-+		len = DPTR_ALIGN;
-+
- 	memcpy(buffer, skb->data, len);
- 	dma_addr = dma_map_single(ndev->dev.parent, buffer, len, DMA_TO_DEVICE);
- 	if (dma_mapping_error(ndev->dev.parent, dma_addr))
-diff --git a/drivers/net/hyperv/netvsc_drv.c b/drivers/net/hyperv/netvsc_drv.c
-index c9140c3..ff038e5 100644
---- a/drivers/net/hyperv/netvsc_drv.c
-+++ b/drivers/net/hyperv/netvsc_drv.c
-@@ -659,6 +659,7 @@ int netvsc_recv_callback(struct hv_device *device_obj,
- 	 * policy filters on the host). Deliver these via the VF
- 	 * interface in the guest.
- 	 */
-+	rcu_read_lock();
- 	vf_netdev = rcu_dereference(net_device_ctx->vf_netdev);
- 	if (vf_netdev && (vf_netdev->flags & IFF_UP))
- 		net = vf_netdev;
-@@ -667,6 +668,7 @@ int netvsc_recv_callback(struct hv_device *device_obj,
- 	skb = netvsc_alloc_recv_skb(net, packet, csum_info, *data, vlan_tci);
- 	if (unlikely(!skb)) {
- 		++net->stats.rx_dropped;
-+		rcu_read_unlock();
- 		return NVSP_STAT_FAIL;
- 	}
- 
-@@ -696,6 +698,7 @@ int netvsc_recv_callback(struct hv_device *device_obj,
- 	 * TODO - use NAPI?
- 	 */
- 	netif_rx(skb);
-+	rcu_read_unlock();
- 
- 	return 0;
- }
-diff --git a/drivers/net/macvtap.c b/drivers/net/macvtap.c
-index 7869b06..6f38daf 100644
---- a/drivers/net/macvtap.c
-+++ b/drivers/net/macvtap.c
-@@ -827,7 +827,7 @@ static ssize_t macvtap_put_user(struct macvtap_queue *q,
- 			return -EINVAL;
- 
- 		ret = virtio_net_hdr_from_skb(skb, &vnet_hdr,
--					      macvtap_is_little_endian(q));
-+					      macvtap_is_little_endian(q), true);
- 		if (ret)
- 			BUG();
- 
-diff --git a/drivers/net/phy/bcm63xx.c b/drivers/net/phy/bcm63xx.c
-index e741bf6..b0492ef 100644
---- a/drivers/net/phy/bcm63xx.c
-+++ b/drivers/net/phy/bcm63xx.c
-@@ -21,6 +21,23 @@ MODULE_DESCRIPTION("Broadcom 63xx internal PHY driver");
- MODULE_AUTHOR("Maxime Bizon <mbizon@freebox.fr>");
- MODULE_LICENSE("GPL");
- 
-+static int bcm63xx_config_intr(struct phy_device *phydev)
-+{
-+	int reg, err;
-+
-+	reg = phy_read(phydev, MII_BCM63XX_IR);
-+	if (reg < 0)
-+		return reg;
-+
-+	if (phydev->interrupts == PHY_INTERRUPT_ENABLED)
-+		reg &= ~MII_BCM63XX_IR_GMASK;
-+	else
-+		reg |= MII_BCM63XX_IR_GMASK;
-+
-+	err = phy_write(phydev, MII_BCM63XX_IR, reg);
-+	return err;
-+}
-+
- static int bcm63xx_config_init(struct phy_device *phydev)
- {
- 	int reg, err;
-@@ -55,7 +72,7 @@ static struct phy_driver bcm63xx_driver[] = {
- 	.config_aneg	= genphy_config_aneg,
- 	.read_status	= genphy_read_status,
- 	.ack_interrupt	= bcm_phy_ack_intr,
--	.config_intr	= bcm_phy_config_intr,
-+	.config_intr	= bcm63xx_config_intr,
- }, {
- 	/* same phy as above, with just a different OUI */
- 	.phy_id		= 0x002bdc00,
-@@ -67,7 +84,7 @@ static struct phy_driver bcm63xx_driver[] = {
- 	.config_aneg	= genphy_config_aneg,
- 	.read_status	= genphy_read_status,
- 	.ack_interrupt	= bcm_phy_ack_intr,
--	.config_intr	= bcm_phy_config_intr,
-+	.config_intr	= bcm63xx_config_intr,
- } };
- 
- module_phy_driver(bcm63xx_driver);
-diff --git a/drivers/net/tun.c b/drivers/net/tun.c
-index db6acec..18402d7 100644
---- a/drivers/net/tun.c
-+++ b/drivers/net/tun.c
-@@ -1374,7 +1374,7 @@ static ssize_t tun_put_user(struct tun_struct *tun,
- 			return -EINVAL;
- 
- 		ret = virtio_net_hdr_from_skb(skb, &gso,
--					      tun_is_little_endian(tun));
-+					      tun_is_little_endian(tun), true);
- 		if (ret) {
- 			struct skb_shared_info *sinfo = skb_shinfo(skb);
- 			pr_err("unexpected GSO type: "
-diff --git a/drivers/net/usb/cdc_ether.c b/drivers/net/usb/cdc_ether.c
-index dd623f6..b82be81 100644
---- a/drivers/net/usb/cdc_ether.c
-+++ b/drivers/net/usb/cdc_ether.c
-@@ -531,6 +531,7 @@ static const struct driver_info wwan_info = {
- #define SAMSUNG_VENDOR_ID	0x04e8
- #define LENOVO_VENDOR_ID	0x17ef
- #define NVIDIA_VENDOR_ID	0x0955
-+#define HP_VENDOR_ID		0x03f0
- 
- static const struct usb_device_id	products[] = {
- /* BLACKLIST !!
-@@ -677,6 +678,13 @@ static const struct usb_device_id	products[] = {
- 	.driver_info = 0,
- },
- 
-+/* HP lt2523 (Novatel E371) - handled by qmi_wwan */
-+{
-+	USB_DEVICE_AND_INTERFACE_INFO(HP_VENDOR_ID, 0x421d, USB_CLASS_COMM,
-+				      USB_CDC_SUBCLASS_ETHERNET, USB_CDC_PROTO_NONE),
-+	.driver_info = 0,
-+},
-+
- /* AnyDATA ADU960S - handled by qmi_wwan */
- {
- 	USB_DEVICE_AND_INTERFACE_INFO(0x16d5, 0x650a, USB_CLASS_COMM,
-diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
-index 6fe1cdb..24d5272 100644
---- a/drivers/net/usb/qmi_wwan.c
-+++ b/drivers/net/usb/qmi_wwan.c
-@@ -654,6 +654,13 @@ static const struct usb_device_id products[] = {
- 					      USB_CDC_PROTO_NONE),
- 		.driver_info        = (unsigned long)&qmi_wwan_info,
- 	},
-+	{	/* HP lt2523 (Novatel E371) */
-+		USB_DEVICE_AND_INTERFACE_INFO(0x03f0, 0x421d,
-+					      USB_CLASS_COMM,
-+					      USB_CDC_SUBCLASS_ETHERNET,
-+					      USB_CDC_PROTO_NONE),
-+		.driver_info        = (unsigned long)&qmi_wwan_info,
-+	},
- 	{	/* HP lt4112 LTE/HSPA+ Gobi 4G Module (Huawei me906e) */
- 		USB_DEVICE_AND_INTERFACE_INFO(0x03f0, 0x581d, USB_CLASS_VENDOR_SPEC, 1, 7),
- 		.driver_info = (unsigned long)&qmi_wwan_info,
-diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c
-index 4b5cb16..90b426c 100644
---- a/drivers/net/usb/r8152.c
-+++ b/drivers/net/usb/r8152.c
-@@ -32,7 +32,7 @@
- #define NETNEXT_VERSION		"08"
- 
- /* Information for net */
--#define NET_VERSION		"6"
-+#define NET_VERSION		"7"
- 
- #define DRIVER_VERSION		"v1." NETNEXT_VERSION "." NET_VERSION
- #define DRIVER_AUTHOR "Realtek linux nic maintainers <nic_swsd@realtek.com>"
-@@ -1730,7 +1730,7 @@ static u8 r8152_rx_csum(struct r8152 *tp, struct rx_desc *rx_desc)
- 	u8 checksum = CHECKSUM_NONE;
- 	u32 opts2, opts3;
- 
--	if (tp->version == RTL_VER_01 || tp->version == RTL_VER_02)
-+	if (!(tp->netdev->features & NETIF_F_RXCSUM))
- 		goto return_result;
- 
- 	opts2 = le32_to_cpu(rx_desc->opts2);
-@@ -3572,6 +3572,8 @@ static bool delay_autosuspend(struct r8152 *tp)
- 	 */
- 	if (!sw_linking && tp->rtl_ops.in_nway(tp))
- 		return true;
-+	else if (!skb_queue_empty(&tp->tx_queue))
-+		return true;
- 	else
- 		return false;
- }
-@@ -4358,6 +4360,11 @@ static int rtl8152_probe(struct usb_interface *intf,
- 				NETIF_F_HIGHDMA | NETIF_F_FRAGLIST |
- 				NETIF_F_IPV6_CSUM | NETIF_F_TSO6;
- 
-+	if (tp->version == RTL_VER_01) {
-+		netdev->features &= ~NETIF_F_RXCSUM;
-+		netdev->hw_features &= ~NETIF_F_RXCSUM;
-+	}
-+
- 	netdev->ethtool_ops = &ops;
- 	netif_set_gso_max_size(netdev, RTL_LIMITED_TSO_SIZE);
- 
-diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
-index cbf1c61..51fc0c3 100644
---- a/drivers/net/virtio_net.c
-+++ b/drivers/net/virtio_net.c
-@@ -840,7 +840,7 @@ static int xmit_skb(struct send_queue *sq, struct sk_buff *skb)
- 		hdr = skb_vnet_hdr(skb);
- 
- 	if (virtio_net_hdr_from_skb(skb, &hdr->hdr,
--				    virtio_is_little_endian(vi->vdev)))
-+				    virtio_is_little_endian(vi->vdev), false))
- 		BUG();
- 
- 	if (vi->mergeable_rx_bufs)
-diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c
-index 2ba01ca..0fafaa9 100644
---- a/drivers/net/vxlan.c
-+++ b/drivers/net/vxlan.c
-@@ -2887,7 +2887,7 @@ static int vxlan_dev_configure(struct net *src_net, struct net_device *dev,
- 	memcpy(&vxlan->cfg, conf, sizeof(*conf));
- 	if (!vxlan->cfg.dst_port) {
- 		if (conf->flags & VXLAN_F_GPE)
--			vxlan->cfg.dst_port = 4790; /* IANA assigned VXLAN-GPE port */
-+			vxlan->cfg.dst_port = htons(4790); /* IANA VXLAN-GPE port */
- 		else
- 			vxlan->cfg.dst_port = default_port;
- 	}
-diff --git a/fs/xfs/libxfs/xfs_alloc.c b/fs/xfs/libxfs/xfs_alloc.c
-index 5050056..9f06a21 100644
---- a/fs/xfs/libxfs/xfs_alloc.c
-+++ b/fs/xfs/libxfs/xfs_alloc.c
-@@ -95,10 +95,7 @@ unsigned int
- xfs_alloc_set_aside(
- 	struct xfs_mount	*mp)
- {
--	unsigned int		blocks;
--
--	blocks = 4 + (mp->m_sb.sb_agcount * XFS_ALLOC_AGFL_RESERVE);
--	return blocks;
-+	return mp->m_sb.sb_agcount * (XFS_ALLOC_AGFL_RESERVE + 4);
- }
- 
- /*
-@@ -365,36 +362,12 @@ xfs_alloc_fix_len(
- 		return;
- 	ASSERT(rlen >= args->minlen && rlen <= args->maxlen);
- 	ASSERT(rlen % args->prod == args->mod);
-+	ASSERT(args->pag->pagf_freeblks + args->pag->pagf_flcount >=
-+		rlen + args->minleft);
- 	args->len = rlen;
- }
- 
- /*
-- * Fix up length if there is too little space left in the a.g.
-- * Return 1 if ok, 0 if too little, should give up.
-- */
--STATIC int
--xfs_alloc_fix_minleft(
--	xfs_alloc_arg_t	*args)		/* allocation argument structure */
--{
--	xfs_agf_t	*agf;		/* a.g. freelist header */
--	int		diff;		/* free space difference */
--
--	if (args->minleft == 0)
--		return 1;
--	agf = XFS_BUF_TO_AGF(args->agbp);
--	diff = be32_to_cpu(agf->agf_freeblks)
--		- args->len - args->minleft;
--	if (diff >= 0)
--		return 1;
--	args->len += diff;		/* shrink the allocated space */
--	/* casts to (int) catch length underflows */
--	if ((int)args->len >= (int)args->minlen)
--		return 1;
--	args->agbno = NULLAGBLOCK;
--	return 0;
--}
--
--/*
-  * Update the two btrees, logically removing from freespace the extent
-  * starting at rbno, rlen blocks.  The extent is contained within the
-  * actual (current) free extent fbno for flen blocks.
-@@ -689,8 +662,6 @@ xfs_alloc_ag_vextent(
- 	xfs_alloc_arg_t	*args)	/* argument structure for allocation */
- {
- 	int		error=0;
--	xfs_extlen_t	reservation;
--	xfs_extlen_t	oldmax;
- 
- 	ASSERT(args->minlen > 0);
- 	ASSERT(args->maxlen > 0);
-@@ -699,20 +670,6 @@ xfs_alloc_ag_vextent(
- 	ASSERT(args->alignment > 0);
- 
- 	/*
--	 * Clamp maxlen to the amount of free space minus any reservations
--	 * that have been made.
--	 */
--	oldmax = args->maxlen;
--	reservation = xfs_ag_resv_needed(args->pag, args->resv);
--	if (args->maxlen > args->pag->pagf_freeblks - reservation)
--		args->maxlen = args->pag->pagf_freeblks - reservation;
--	if (args->maxlen == 0) {
--		args->agbno = NULLAGBLOCK;
--		args->maxlen = oldmax;
--		return 0;
--	}
--
--	/*
- 	 * Branch to correct routine based on the type.
- 	 */
- 	args->wasfromfl = 0;
-@@ -731,8 +688,6 @@ xfs_alloc_ag_vextent(
- 		/* NOTREACHED */
- 	}
- 
--	args->maxlen = oldmax;
--
- 	if (error || args->agbno == NULLAGBLOCK)
- 		return error;
- 
-@@ -841,9 +796,6 @@ xfs_alloc_ag_vextent_exact(
- 	args->len = XFS_AGBLOCK_MIN(tend, args->agbno + args->maxlen)
- 						- args->agbno;
- 	xfs_alloc_fix_len(args);
--	if (!xfs_alloc_fix_minleft(args))
--		goto not_found;
--
- 	ASSERT(args->agbno + args->len <= tend);
- 
- 	/*
-@@ -1149,12 +1101,7 @@ xfs_alloc_ag_vextent_near(
- 		XFS_WANT_CORRUPTED_GOTO(args->mp, i == 1, error0);
- 		ASSERT(ltbno + ltlen <= be32_to_cpu(XFS_BUF_TO_AGF(args->agbp)->agf_length));
- 		args->len = blen;
--		if (!xfs_alloc_fix_minleft(args)) {
--			xfs_btree_del_cursor(cnt_cur, XFS_BTREE_NOERROR);
--			trace_xfs_alloc_near_nominleft(args);
--			return 0;
--		}
--		blen = args->len;
-+
- 		/*
- 		 * We are allocating starting at bnew for blen blocks.
- 		 */
-@@ -1346,12 +1293,6 @@ xfs_alloc_ag_vextent_near(
- 	 */
- 	args->len = XFS_EXTLEN_MIN(ltlena, args->maxlen);
- 	xfs_alloc_fix_len(args);
--	if (!xfs_alloc_fix_minleft(args)) {
--		trace_xfs_alloc_near_nominleft(args);
--		xfs_btree_del_cursor(bno_cur_lt, XFS_BTREE_NOERROR);
--		xfs_btree_del_cursor(cnt_cur, XFS_BTREE_NOERROR);
--		return 0;
--	}
- 	rlen = args->len;
- 	(void)xfs_alloc_compute_diff(args->agbno, rlen, args->alignment,
- 				     args->datatype, ltbnoa, ltlena, &ltnew);
-@@ -1553,8 +1494,6 @@ xfs_alloc_ag_vextent_size(
- 	}
- 	xfs_alloc_fix_len(args);
- 
--	if (!xfs_alloc_fix_minleft(args))
--		goto out_nominleft;
- 	rlen = args->len;
- 	XFS_WANT_CORRUPTED_GOTO(args->mp, rlen <= flen, error0);
- 	/*
-@@ -2056,7 +1995,7 @@ xfs_alloc_space_available(
- 	int			flags)
- {
- 	struct xfs_perag	*pag = args->pag;
--	xfs_extlen_t		longest;
-+	xfs_extlen_t		alloc_len, longest;
- 	xfs_extlen_t		reservation; /* blocks that are still reserved */
- 	int			available;
- 
-@@ -2066,17 +2005,28 @@ xfs_alloc_space_available(
- 	reservation = xfs_ag_resv_needed(pag, args->resv);
- 
- 	/* do we have enough contiguous free space for the allocation? */
-+	alloc_len = args->minlen + (args->alignment - 1) + args->minalignslop;
- 	longest = xfs_alloc_longest_free_extent(args->mp, pag, min_free,
- 			reservation);
--	if ((args->minlen + args->alignment + args->minalignslop - 1) > longest)
-+	if (longest < alloc_len)
- 		return false;
- 
- 	/* do we have enough free space remaining for the allocation? */
- 	available = (int)(pag->pagf_freeblks + pag->pagf_flcount -
--			  reservation - min_free - args->total);
--	if (available < (int)args->minleft || available <= 0)
-+			  reservation - min_free - args->minleft);
-+	if (available < (int)max(args->total, alloc_len))
- 		return false;
- 
-+	/*
-+	 * Clamp maxlen to the amount of free space available for the actual
-+	 * extent allocation.
-+	 */
-+	if (available < (int)args->maxlen && !(flags & XFS_ALLOC_FLAG_CHECK)) {
-+		args->maxlen = available;
-+		ASSERT(args->maxlen > 0);
-+		ASSERT(args->maxlen >= args->minlen);
-+	}
-+
- 	return true;
- }
- 
-@@ -2122,7 +2072,8 @@ xfs_alloc_fix_freelist(
- 	}
- 
- 	need = xfs_alloc_min_freelist(mp, pag);
--	if (!xfs_alloc_space_available(args, need, flags))
-+	if (!xfs_alloc_space_available(args, need, flags |
-+			XFS_ALLOC_FLAG_CHECK))
- 		goto out_agbp_relse;
- 
- 	/*
-@@ -2638,12 +2589,10 @@ xfs_alloc_vextent(
- 	xfs_agblock_t	agsize;	/* allocation group size */
- 	int		error;
- 	int		flags;	/* XFS_ALLOC_FLAG_... locking flags */
--	xfs_extlen_t	minleft;/* minimum left value, temp copy */
- 	xfs_mount_t	*mp;	/* mount structure pointer */
- 	xfs_agnumber_t	sagno;	/* starting allocation group number */
- 	xfs_alloctype_t	type;	/* input allocation type */
- 	int		bump_rotor = 0;
--	int		no_min = 0;
- 	xfs_agnumber_t	rotorstep = xfs_rotorstep; /* inode32 agf stepper */
- 
- 	mp = args->mp;
-@@ -2672,7 +2621,6 @@ xfs_alloc_vextent(
- 		trace_xfs_alloc_vextent_badargs(args);
- 		return 0;
- 	}
--	minleft = args->minleft;
- 
- 	switch (type) {
- 	case XFS_ALLOCTYPE_THIS_AG:
-@@ -2683,9 +2631,7 @@ xfs_alloc_vextent(
- 		 */
- 		args->agno = XFS_FSB_TO_AGNO(mp, args->fsbno);
- 		args->pag = xfs_perag_get(mp, args->agno);
--		args->minleft = 0;
- 		error = xfs_alloc_fix_freelist(args, 0);
--		args->minleft = minleft;
- 		if (error) {
- 			trace_xfs_alloc_vextent_nofix(args);
- 			goto error0;
-@@ -2750,9 +2696,7 @@ xfs_alloc_vextent(
- 		 */
- 		for (;;) {
- 			args->pag = xfs_perag_get(mp, args->agno);
--			if (no_min) args->minleft = 0;
- 			error = xfs_alloc_fix_freelist(args, flags);
--			args->minleft = minleft;
- 			if (error) {
- 				trace_xfs_alloc_vextent_nofix(args);
- 				goto error0;
-@@ -2792,20 +2736,17 @@ xfs_alloc_vextent(
- 			 * or switch to non-trylock mode.
- 			 */
- 			if (args->agno == sagno) {
--				if (no_min == 1) {
-+				if (flags == 0) {
- 					args->agbno = NULLAGBLOCK;
- 					trace_xfs_alloc_vextent_allfailed(args);
- 					break;
- 				}
--				if (flags == 0) {
--					no_min = 1;
--				} else {
--					flags = 0;
--					if (type == XFS_ALLOCTYPE_START_BNO) {
--						args->agbno = XFS_FSB_TO_AGBNO(mp,
--							args->fsbno);
--						args->type = XFS_ALLOCTYPE_NEAR_BNO;
--					}
-+
-+				flags = 0;
-+				if (type == XFS_ALLOCTYPE_START_BNO) {
-+					args->agbno = XFS_FSB_TO_AGBNO(mp,
-+						args->fsbno);
-+					args->type = XFS_ALLOCTYPE_NEAR_BNO;
- 				}
- 			}
- 			xfs_perag_put(args->pag);
-diff --git a/fs/xfs/libxfs/xfs_alloc.h b/fs/xfs/libxfs/xfs_alloc.h
-index 7c404a6..1d0f48a 100644
---- a/fs/xfs/libxfs/xfs_alloc.h
-+++ b/fs/xfs/libxfs/xfs_alloc.h
-@@ -56,7 +56,7 @@ typedef unsigned int xfs_alloctype_t;
- #define	XFS_ALLOC_FLAG_FREEING	0x00000002  /* indicate caller is freeing extents*/
- #define	XFS_ALLOC_FLAG_NORMAP	0x00000004  /* don't modify the rmapbt */
- #define	XFS_ALLOC_FLAG_NOSHRINK	0x00000008  /* don't shrink the freelist */
--
-+#define	XFS_ALLOC_FLAG_CHECK	0x00000010  /* test only, don't modify args */
- 
- /*
-  * Argument structure for xfs_alloc routines.
-diff --git a/fs/xfs/libxfs/xfs_attr.c b/fs/xfs/libxfs/xfs_attr.c
-index af1ecb1..6622d46 100644
---- a/fs/xfs/libxfs/xfs_attr.c
-+++ b/fs/xfs/libxfs/xfs_attr.c
-@@ -131,9 +131,6 @@ xfs_attr_get(
- 	if (XFS_FORCED_SHUTDOWN(ip->i_mount))
- 		return -EIO;
- 
--	if (!xfs_inode_hasattr(ip))
--		return -ENOATTR;
--
- 	error = xfs_attr_args_init(&args, ip, name, flags);
- 	if (error)
- 		return error;
-@@ -392,9 +389,6 @@ xfs_attr_remove(
- 	if (XFS_FORCED_SHUTDOWN(dp->i_mount))
- 		return -EIO;
- 
--	if (!xfs_inode_hasattr(dp))
--		return -ENOATTR;
--
- 	error = xfs_attr_args_init(&args, dp, name, flags);
- 	if (error)
- 		return error;
-diff --git a/fs/xfs/libxfs/xfs_bmap.c b/fs/xfs/libxfs/xfs_bmap.c
-index 89d727b..f52fd63 100644
---- a/fs/xfs/libxfs/xfs_bmap.c
-+++ b/fs/xfs/libxfs/xfs_bmap.c
-@@ -3720,7 +3720,7 @@ xfs_bmap_btalloc(
- 		align = xfs_get_cowextsz_hint(ap->ip);
- 	else if (xfs_alloc_is_userdata(ap->datatype))
- 		align = xfs_get_extsz_hint(ap->ip);
--	if (unlikely(align)) {
-+	if (align) {
- 		error = xfs_bmap_extsize_align(mp, &ap->got, &ap->prev,
- 						align, 0, ap->eof, 0, ap->conv,
- 						&ap->offset, &ap->length);
-@@ -3792,7 +3792,7 @@ xfs_bmap_btalloc(
- 		args.minlen = ap->minlen;
- 	}
- 	/* apply extent size hints if obtained earlier */
--	if (unlikely(align)) {
-+	if (align) {
- 		args.prod = align;
- 		if ((args.mod = (xfs_extlen_t)do_mod(ap->offset, args.prod)))
- 			args.mod = (xfs_extlen_t)(args.prod - args.mod);
-@@ -3903,7 +3903,6 @@ xfs_bmap_btalloc(
- 		args.fsbno = 0;
- 		args.type = XFS_ALLOCTYPE_FIRST_AG;
- 		args.total = ap->minlen;
--		args.minleft = 0;
- 		if ((error = xfs_alloc_vextent(&args)))
- 			return error;
- 		ap->dfops->dop_low = true;
-@@ -4437,8 +4436,6 @@ xfs_bmapi_allocate(
- 	if (error)
- 		return error;
- 
--	if (bma->dfops->dop_low)
--		bma->minleft = 0;
- 	if (bma->cur)
- 		bma->cur->bc_private.b.firstblock = *bma->firstblock;
- 	if (bma->blkno == NULLFSBLOCK)
-@@ -4610,8 +4607,6 @@ xfs_bmapi_write(
- 	int			n;		/* current extent index */
- 	xfs_fileoff_t		obno;		/* old block number (offset) */
- 	int			whichfork;	/* data or attr fork */
--	char			inhole;		/* current location is hole in file */
--	char			wasdelay;	/* old extent was delayed */
- 
- #ifdef DEBUG
- 	xfs_fileoff_t		orig_bno;	/* original block number value */
-@@ -4697,22 +4692,44 @@ xfs_bmapi_write(
- 	bma.firstblock = firstblock;
- 
- 	while (bno < end && n < *nmap) {
--		inhole = eof || bma.got.br_startoff > bno;
--		wasdelay = !inhole && isnullstartblock(bma.got.br_startblock);
-+		bool			need_alloc = false, wasdelay = false;
- 
--		/*
--		 * Make sure we only reflink into a hole.
--		 */
--		if (flags & XFS_BMAPI_REMAP)
--			ASSERT(inhole);
--		if (flags & XFS_BMAPI_COWFORK)
--			ASSERT(!inhole);
-+		/* in hole or beyoned EOF? */
-+		if (eof || bma.got.br_startoff > bno) {
-+			if (flags & XFS_BMAPI_DELALLOC) {
-+				/*
-+				 * For the COW fork we can reasonably get a
-+				 * request for converting an extent that races
-+				 * with other threads already having converted
-+				 * part of it, as there converting COW to
-+				 * regular blocks is not protected using the
-+				 * IOLOCK.
-+				 */
-+				ASSERT(flags & XFS_BMAPI_COWFORK);
-+				if (!(flags & XFS_BMAPI_COWFORK)) {
-+					error = -EIO;
-+					goto error0;
-+				}
-+
-+				if (eof || bno >= end)
-+					break;
-+			} else {
-+				need_alloc = true;
-+			}
-+		} else {
-+			/*
-+			 * Make sure we only reflink into a hole.
-+			 */
-+			ASSERT(!(flags & XFS_BMAPI_REMAP));
-+			if (isnullstartblock(bma.got.br_startblock))
-+				wasdelay = true;
-+		}
- 
- 		/*
- 		 * First, deal with the hole before the allocated space
- 		 * that we found, if any.
- 		 */
--		if (inhole || wasdelay) {
-+		if (need_alloc || wasdelay) {
- 			bma.eof = eof;
- 			bma.conv = !!(flags & XFS_BMAPI_CONVERT);
- 			bma.wasdel = wasdelay;
-diff --git a/fs/xfs/libxfs/xfs_bmap.h b/fs/xfs/libxfs/xfs_bmap.h
-index d6d175a..e7d40b3 100644
---- a/fs/xfs/libxfs/xfs_bmap.h
-+++ b/fs/xfs/libxfs/xfs_bmap.h
-@@ -110,6 +110,9 @@ struct xfs_extent_free_item
- /* Map something in the CoW fork. */
- #define XFS_BMAPI_COWFORK	0x200
- 
-+/* Only convert delalloc space, don't allocate entirely new extents */
-+#define XFS_BMAPI_DELALLOC	0x400
-+
- #define XFS_BMAPI_FLAGS \
- 	{ XFS_BMAPI_ENTIRE,	"ENTIRE" }, \
- 	{ XFS_BMAPI_METADATA,	"METADATA" }, \
-@@ -120,7 +123,8 @@ struct xfs_extent_free_item
- 	{ XFS_BMAPI_CONVERT,	"CONVERT" }, \
- 	{ XFS_BMAPI_ZERO,	"ZERO" }, \
- 	{ XFS_BMAPI_REMAP,	"REMAP" }, \
--	{ XFS_BMAPI_COWFORK,	"COWFORK" }
-+	{ XFS_BMAPI_COWFORK,	"COWFORK" }, \
-+	{ XFS_BMAPI_DELALLOC,	"DELALLOC" }
- 
- 
- static inline int xfs_bmapi_aflag(int w)
-diff --git a/fs/xfs/libxfs/xfs_bmap_btree.c b/fs/xfs/libxfs/xfs_bmap_btree.c
-index 049fa59..f76c169 100644
---- a/fs/xfs/libxfs/xfs_bmap_btree.c
-+++ b/fs/xfs/libxfs/xfs_bmap_btree.c
-@@ -502,12 +502,11 @@ xfs_bmbt_alloc_block(
- 	if (args.fsbno == NULLFSBLOCK && args.minleft) {
- 		/*
- 		 * Could not find an AG with enough free space to satisfy
--		 * a full btree split.  Try again without minleft and if
-+		 * a full btree split.  Try again and if
- 		 * successful activate the lowspace algorithm.
- 		 */
- 		args.fsbno = 0;
- 		args.type = XFS_ALLOCTYPE_FIRST_AG;
--		args.minleft = 0;
- 		error = xfs_alloc_vextent(&args);
- 		if (error)
- 			goto error0;
-diff --git a/fs/xfs/libxfs/xfs_dir2.c b/fs/xfs/libxfs/xfs_dir2.c
-index 20a96dd..7825d78 100644
---- a/fs/xfs/libxfs/xfs_dir2.c
-+++ b/fs/xfs/libxfs/xfs_dir2.c
-@@ -36,21 +36,29 @@
- struct xfs_name xfs_name_dotdot = { (unsigned char *)"..", 2, XFS_DIR3_FT_DIR };
- 
- /*
-- * @mode, if set, indicates that the type field needs to be set up.
-- * This uses the transformation from file mode to DT_* as defined in linux/fs.h
-- * for file type specification. This will be propagated into the directory
-- * structure if appropriate for the given operation and filesystem config.
-+ * Convert inode mode to directory entry filetype
-  */
--const unsigned char xfs_mode_to_ftype[S_IFMT >> S_SHIFT] = {
--	[0]			= XFS_DIR3_FT_UNKNOWN,
--	[S_IFREG >> S_SHIFT]    = XFS_DIR3_FT_REG_FILE,
--	[S_IFDIR >> S_SHIFT]    = XFS_DIR3_FT_DIR,
--	[S_IFCHR >> S_SHIFT]    = XFS_DIR3_FT_CHRDEV,
--	[S_IFBLK >> S_SHIFT]    = XFS_DIR3_FT_BLKDEV,
--	[S_IFIFO >> S_SHIFT]    = XFS_DIR3_FT_FIFO,
--	[S_IFSOCK >> S_SHIFT]   = XFS_DIR3_FT_SOCK,
--	[S_IFLNK >> S_SHIFT]    = XFS_DIR3_FT_SYMLINK,
--};
-+unsigned char xfs_mode_to_ftype(int mode)
-+{
-+	switch (mode & S_IFMT) {
-+	case S_IFREG:
-+		return XFS_DIR3_FT_REG_FILE;
-+	case S_IFDIR:
-+		return XFS_DIR3_FT_DIR;
-+	case S_IFCHR:
-+		return XFS_DIR3_FT_CHRDEV;
-+	case S_IFBLK:
-+		return XFS_DIR3_FT_BLKDEV;
-+	case S_IFIFO:
-+		return XFS_DIR3_FT_FIFO;
-+	case S_IFSOCK:
-+		return XFS_DIR3_FT_SOCK;
-+	case S_IFLNK:
-+		return XFS_DIR3_FT_SYMLINK;
-+	default:
-+		return XFS_DIR3_FT_UNKNOWN;
-+	}
-+}
- 
- /*
-  * ASCII case-insensitive (ie. A-Z) support for directories that was
-@@ -631,7 +639,8 @@ xfs_dir2_isblock(
- 	if ((rval = xfs_bmap_last_offset(args->dp, &last, XFS_DATA_FORK)))
- 		return rval;
- 	rval = XFS_FSB_TO_B(args->dp->i_mount, last) == args->geo->blksize;
--	ASSERT(rval == 0 || args->dp->i_d.di_size == args->geo->blksize);
-+	if (rval != 0 && args->dp->i_d.di_size != args->geo->blksize)
-+		return -EFSCORRUPTED;
- 	*vp = rval;
- 	return 0;
- }
-diff --git a/fs/xfs/libxfs/xfs_dir2.h b/fs/xfs/libxfs/xfs_dir2.h
-index becc926..ae0d55b 100644
---- a/fs/xfs/libxfs/xfs_dir2.h
-+++ b/fs/xfs/libxfs/xfs_dir2.h
-@@ -18,6 +18,9 @@
- #ifndef __XFS_DIR2_H__
- #define __XFS_DIR2_H__
- 
-+#include "xfs_da_format.h"
-+#include "xfs_da_btree.h"
-+
- struct xfs_defer_ops;
- struct xfs_da_args;
- struct xfs_inode;
-@@ -32,10 +35,9 @@ struct xfs_dir2_data_unused;
- extern struct xfs_name	xfs_name_dotdot;
- 
- /*
-- * directory filetype conversion tables.
-+ * Convert inode mode to directory entry filetype
-  */
--#define S_SHIFT 12
--extern const unsigned char xfs_mode_to_ftype[];
-+extern unsigned char xfs_mode_to_ftype(int mode);
- 
- /*
-  * directory operations vector for encode/decode routines
-diff --git a/fs/xfs/libxfs/xfs_inode_buf.c b/fs/xfs/libxfs/xfs_inode_buf.c
-index c906e50..37ee7f0 100644
---- a/fs/xfs/libxfs/xfs_inode_buf.c
-+++ b/fs/xfs/libxfs/xfs_inode_buf.c
-@@ -29,6 +29,7 @@
- #include "xfs_icache.h"
- #include "xfs_trans.h"
- #include "xfs_ialloc.h"
-+#include "xfs_dir2.h"
- 
- /*
-  * Check that none of the inode's in the buffer have a next
-@@ -386,6 +387,7 @@ xfs_dinode_verify(
- 	struct xfs_inode	*ip,
- 	struct xfs_dinode	*dip)
- {
-+	uint16_t		mode;
- 	uint16_t		flags;
- 	uint64_t		flags2;
- 
-@@ -396,8 +398,12 @@ xfs_dinode_verify(
- 	if (be64_to_cpu(dip->di_size) & (1ULL << 63))
- 		return false;
- 
--	/* No zero-length symlinks. */
--	if (S_ISLNK(be16_to_cpu(dip->di_mode)) && dip->di_size == 0)
-+	mode = be16_to_cpu(dip->di_mode);
-+	if (mode && xfs_mode_to_ftype(mode) == XFS_DIR3_FT_UNKNOWN)
-+		return false;
-+
-+	/* No zero-length symlinks/dirs. */
-+	if ((S_ISLNK(mode) || S_ISDIR(mode)) && dip->di_size == 0)
- 		return false;
- 
- 	/* only version 3 or greater inodes are extensively verified here */
-diff --git a/fs/xfs/libxfs/xfs_sb.c b/fs/xfs/libxfs/xfs_sb.c
-index 2580262..584ec89 100644
---- a/fs/xfs/libxfs/xfs_sb.c
-+++ b/fs/xfs/libxfs/xfs_sb.c
-@@ -242,7 +242,7 @@ xfs_mount_validate_sb(
- 	    sbp->sb_blocklog < XFS_MIN_BLOCKSIZE_LOG			||
- 	    sbp->sb_blocklog > XFS_MAX_BLOCKSIZE_LOG			||
- 	    sbp->sb_blocksize != (1 << sbp->sb_blocklog)		||
--	    sbp->sb_dirblklog > XFS_MAX_BLOCKSIZE_LOG			||
-+	    sbp->sb_dirblklog + sbp->sb_blocklog > XFS_MAX_BLOCKSIZE_LOG ||
- 	    sbp->sb_inodesize < XFS_DINODE_MIN_SIZE			||
- 	    sbp->sb_inodesize > XFS_DINODE_MAX_SIZE			||
- 	    sbp->sb_inodelog < XFS_DINODE_MIN_LOG			||
-diff --git a/fs/xfs/xfs_bmap_util.c b/fs/xfs/xfs_bmap_util.c
-index 0670a8b..efb8ccd 100644
---- a/fs/xfs/xfs_bmap_util.c
-+++ b/fs/xfs/xfs_bmap_util.c
-@@ -528,7 +528,6 @@ xfs_getbmap(
- 	xfs_bmbt_irec_t		*map;		/* buffer for user's data */
- 	xfs_mount_t		*mp;		/* file system mount point */
- 	int			nex;		/* # of user extents can do */
--	int			nexleft;	/* # of user extents left */
- 	int			subnex;		/* # of bmapi's can do */
- 	int			nmap;		/* number of map entries */
- 	struct getbmapx		*out;		/* output structure */
-@@ -686,10 +685,8 @@ xfs_getbmap(
- 		goto out_free_map;
- 	}
- 
--	nexleft = nex;
--
- 	do {
--		nmap = (nexleft > subnex) ? subnex : nexleft;
-+		nmap = (nex> subnex) ? subnex : nex;
- 		error = xfs_bmapi_read(ip, XFS_BB_TO_FSBT(mp, bmv->bmv_offset),
- 				       XFS_BB_TO_FSB(mp, bmv->bmv_length),
- 				       map, &nmap, bmapi_flags);
-@@ -697,8 +694,8 @@ xfs_getbmap(
- 			goto out_free_map;
- 		ASSERT(nmap <= subnex);
- 
--		for (i = 0; i < nmap && nexleft && bmv->bmv_length &&
--				cur_ext < bmv->bmv_count; i++) {
-+		for (i = 0; i < nmap && bmv->bmv_length &&
-+				cur_ext < bmv->bmv_count - 1; i++) {
- 			out[cur_ext].bmv_oflags = 0;
- 			if (map[i].br_state == XFS_EXT_UNWRITTEN)
- 				out[cur_ext].bmv_oflags |= BMV_OF_PREALLOC;
-@@ -760,16 +757,27 @@ xfs_getbmap(
- 				continue;
- 			}
- 
-+			/*
-+			 * In order to report shared extents accurately,
-+			 * we report each distinct shared/unshared part
-+			 * of a single bmbt record using multiple bmap
-+			 * extents.  To make that happen, we iterate the
-+			 * same map array item multiple times, each
-+			 * time trimming out the subextent that we just
-+			 * reported.
-+			 *
-+			 * Because of this, we must check the out array
-+			 * index (cur_ext) directly against bmv_count-1
-+			 * to avoid overflows.
-+			 */
- 			if (inject_map.br_startblock != NULLFSBLOCK) {
- 				map[i] = inject_map;
- 				i--;
--			} else
--				nexleft--;
-+			}
- 			bmv->bmv_entries++;
- 			cur_ext++;
- 		}
--	} while (nmap && nexleft && bmv->bmv_length &&
--		 cur_ext < bmv->bmv_count);
-+	} while (nmap && bmv->bmv_length && cur_ext < bmv->bmv_count - 1);
- 
-  out_free_map:
- 	kmem_free(map);
-diff --git a/fs/xfs/xfs_buf.c b/fs/xfs/xfs_buf.c
-index b5b9bff..d7a67d7 100644
---- a/fs/xfs/xfs_buf.c
-+++ b/fs/xfs/xfs_buf.c
-@@ -423,6 +423,7 @@ xfs_buf_allocate_memory(
- out_free_pages:
- 	for (i = 0; i < bp->b_page_count; i++)
- 		__free_page(bp->b_pages[i]);
-+	bp->b_flags &= ~_XBF_PAGES;
- 	return error;
- }
- 
-diff --git a/fs/xfs/xfs_dquot.c b/fs/xfs/xfs_dquot.c
-index 7a30b8f..9d06cc3 100644
---- a/fs/xfs/xfs_dquot.c
-+++ b/fs/xfs/xfs_dquot.c
-@@ -710,6 +710,10 @@ xfs_dq_get_next_id(
- 	/* Simple advance */
- 	next_id = *id + 1;
- 
-+	/* If we'd wrap past the max ID, stop */
-+	if (next_id < *id)
-+		return -ENOENT;
-+
- 	/* If new ID is within the current chunk, advancing it sufficed */
- 	if (next_id % mp->m_quotainfo->qi_dqperchunk) {
- 		*id = next_id;
-diff --git a/fs/xfs/xfs_iomap.c b/fs/xfs/xfs_iomap.c
-index 15a83813..cdc6bdd 100644
---- a/fs/xfs/xfs_iomap.c
-+++ b/fs/xfs/xfs_iomap.c
-@@ -681,7 +681,7 @@ xfs_iomap_write_allocate(
- 	xfs_trans_t	*tp;
- 	int		nimaps;
- 	int		error = 0;
--	int		flags = 0;
-+	int		flags = XFS_BMAPI_DELALLOC;
- 	int		nres;
- 
- 	if (whichfork == XFS_COW_FORK)
-diff --git a/fs/xfs/xfs_iops.c b/fs/xfs/xfs_iops.c
-index 405a65c..f5e0f60 100644
---- a/fs/xfs/xfs_iops.c
-+++ b/fs/xfs/xfs_iops.c
-@@ -98,12 +98,27 @@ xfs_init_security(
- static void
- xfs_dentry_to_name(
- 	struct xfs_name	*namep,
-+	struct dentry	*dentry)
-+{
-+	namep->name = dentry->d_name.name;
-+	namep->len = dentry->d_name.len;
-+	namep->type = XFS_DIR3_FT_UNKNOWN;
-+}
-+
-+static int
-+xfs_dentry_mode_to_name(
-+	struct xfs_name	*namep,
- 	struct dentry	*dentry,
- 	int		mode)
- {
- 	namep->name = dentry->d_name.name;
- 	namep->len = dentry->d_name.len;
--	namep->type = xfs_mode_to_ftype[(mode & S_IFMT) >> S_SHIFT];
-+	namep->type = xfs_mode_to_ftype(mode);
-+
-+	if (unlikely(namep->type == XFS_DIR3_FT_UNKNOWN))
-+		return -EFSCORRUPTED;
-+
-+	return 0;
- }
- 
- STATIC void
-@@ -119,7 +134,7 @@ xfs_cleanup_inode(
- 	 * xfs_init_security we must back out.
- 	 * ENOSPC can hit here, among other things.
- 	 */
--	xfs_dentry_to_name(&teardown, dentry, 0);
-+	xfs_dentry_to_name(&teardown, dentry);
- 
- 	xfs_remove(XFS_I(dir), &teardown, XFS_I(inode));
- }
-@@ -154,8 +169,12 @@ xfs_generic_create(
- 	if (error)
- 		return error;
- 
-+	/* Verify mode is valid also for tmpfile case */
-+	error = xfs_dentry_mode_to_name(&name, dentry, mode);
-+	if (unlikely(error))
-+		goto out_free_acl;
-+
- 	if (!tmpfile) {
--		xfs_dentry_to_name(&name, dentry, mode);
- 		error = xfs_create(XFS_I(dir), &name, mode, rdev, &ip);
- 	} else {
- 		error = xfs_create_tmpfile(XFS_I(dir), dentry, mode, &ip);
-@@ -248,7 +267,7 @@ xfs_vn_lookup(
- 	if (dentry->d_name.len >= MAXNAMELEN)
- 		return ERR_PTR(-ENAMETOOLONG);
- 
--	xfs_dentry_to_name(&name, dentry, 0);
-+	xfs_dentry_to_name(&name, dentry);
- 	error = xfs_lookup(XFS_I(dir), &name, &cip, NULL);
- 	if (unlikely(error)) {
- 		if (unlikely(error != -ENOENT))
-@@ -275,7 +294,7 @@ xfs_vn_ci_lookup(
- 	if (dentry->d_name.len >= MAXNAMELEN)
- 		return ERR_PTR(-ENAMETOOLONG);
- 
--	xfs_dentry_to_name(&xname, dentry, 0);
-+	xfs_dentry_to_name(&xname, dentry);
- 	error = xfs_lookup(XFS_I(dir), &xname, &ip, &ci_name);
- 	if (unlikely(error)) {
- 		if (unlikely(error != -ENOENT))
-@@ -310,7 +329,9 @@ xfs_vn_link(
- 	struct xfs_name	name;
- 	int		error;
- 
--	xfs_dentry_to_name(&name, dentry, inode->i_mode);
-+	error = xfs_dentry_mode_to_name(&name, dentry, inode->i_mode);
-+	if (unlikely(error))
-+		return error;
- 
- 	error = xfs_link(XFS_I(dir), XFS_I(inode), &name);
- 	if (unlikely(error))
-@@ -329,7 +350,7 @@ xfs_vn_unlink(
- 	struct xfs_name	name;
- 	int		error;
- 
--	xfs_dentry_to_name(&name, dentry, 0);
-+	xfs_dentry_to_name(&name, dentry);
- 
- 	error = xfs_remove(XFS_I(dir), &name, XFS_I(d_inode(dentry)));
- 	if (error)
-@@ -359,7 +380,9 @@ xfs_vn_symlink(
- 
- 	mode = S_IFLNK |
- 		(irix_symlink_mode ? 0777 & ~current_umask() : S_IRWXUGO);
--	xfs_dentry_to_name(&name, dentry, mode);
-+	error = xfs_dentry_mode_to_name(&name, dentry, mode);
-+	if (unlikely(error))
-+		goto out;
- 
- 	error = xfs_symlink(XFS_I(dir), &name, symname, mode, &cip);
- 	if (unlikely(error))
-@@ -395,6 +418,7 @@ xfs_vn_rename(
- {
- 	struct inode	*new_inode = d_inode(ndentry);
- 	int		omode = 0;
-+	int		error;
- 	struct xfs_name	oname;
- 	struct xfs_name	nname;
- 
-@@ -405,8 +429,14 @@ xfs_vn_rename(
- 	if (flags & RENAME_EXCHANGE)
- 		omode = d_inode(ndentry)->i_mode;
- 
--	xfs_dentry_to_name(&oname, odentry, omode);
--	xfs_dentry_to_name(&nname, ndentry, d_inode(odentry)->i_mode);
-+	error = xfs_dentry_mode_to_name(&oname, odentry, omode);
-+	if (omode && unlikely(error))
-+		return error;
-+
-+	error = xfs_dentry_mode_to_name(&nname, ndentry,
-+					d_inode(odentry)->i_mode);
-+	if (unlikely(error))
-+		return error;
- 
- 	return xfs_rename(XFS_I(odir), &oname, XFS_I(d_inode(odentry)),
- 			  XFS_I(ndir), &nname,
-diff --git a/fs/xfs/xfs_linux.h b/fs/xfs/xfs_linux.h
-index 68640fb..1455b2520 100644
---- a/fs/xfs/xfs_linux.h
-+++ b/fs/xfs/xfs_linux.h
-@@ -330,11 +330,11 @@ static inline __uint64_t howmany_64(__uint64_t x, __uint32_t y)
- }
- 
- #define ASSERT_ALWAYS(expr)	\
--	(unlikely(expr) ? (void)0 : assfail(#expr, __FILE__, __LINE__))
-+	(likely(expr) ? (void)0 : assfail(#expr, __FILE__, __LINE__))
- 
- #ifdef DEBUG
- #define ASSERT(expr)	\
--	(unlikely(expr) ? (void)0 : assfail(#expr, __FILE__, __LINE__))
-+	(likely(expr) ? (void)0 : assfail(#expr, __FILE__, __LINE__))
- 
- #ifndef STATIC
- # define STATIC noinline
-@@ -345,7 +345,7 @@ static inline __uint64_t howmany_64(__uint64_t x, __uint32_t y)
- #ifdef XFS_WARN
- 
- #define ASSERT(expr)	\
--	(unlikely(expr) ? (void)0 : asswarn(#expr, __FILE__, __LINE__))
-+	(likely(expr) ? (void)0 : asswarn(#expr, __FILE__, __LINE__))
- 
- #ifndef STATIC
- # define STATIC static noinline
-diff --git a/fs/xfs/xfs_log.c b/fs/xfs/xfs_log.c
-index 3b74fa0..4017aa9 100644
---- a/fs/xfs/xfs_log.c
-+++ b/fs/xfs/xfs_log.c
-@@ -3324,12 +3324,8 @@ xfs_log_force(
- 	xfs_mount_t	*mp,
- 	uint		flags)
- {
--	int	error;
--
- 	trace_xfs_log_force(mp, 0, _RET_IP_);
--	error = _xfs_log_force(mp, flags, NULL);
--	if (error)
--		xfs_warn(mp, "%s: error %d returned.", __func__, error);
-+	_xfs_log_force(mp, flags, NULL);
- }
- 
- /*
-@@ -3473,12 +3469,8 @@ xfs_log_force_lsn(
- 	xfs_lsn_t	lsn,
- 	uint		flags)
- {
--	int	error;
--
- 	trace_xfs_log_force(mp, lsn, _RET_IP_);
--	error = _xfs_log_force_lsn(mp, lsn, flags, NULL);
--	if (error)
--		xfs_warn(mp, "%s: error %d returned.", __func__, error);
-+	_xfs_log_force_lsn(mp, lsn, flags, NULL);
- }
- 
- /*
-diff --git a/include/linux/tcp.h b/include/linux/tcp.h
-index a17ae7b..647532b 100644
---- a/include/linux/tcp.h
-+++ b/include/linux/tcp.h
-@@ -62,8 +62,13 @@ static inline unsigned int tcp_optlen(const struct sk_buff *skb)
- 
- /* TCP Fast Open Cookie as stored in memory */
- struct tcp_fastopen_cookie {
-+	union {
-+		u8	val[TCP_FASTOPEN_COOKIE_MAX];
-+#if IS_ENABLED(CONFIG_IPV6)
-+		struct in6_addr addr;
-+#endif
-+	};
- 	s8	len;
--	u8	val[TCP_FASTOPEN_COOKIE_MAX];
- 	bool	exp;	/* In RFC6994 experimental option format */
- };
- 
-diff --git a/include/linux/virtio_net.h b/include/linux/virtio_net.h
-index 1c912f8..f211c34 100644
---- a/include/linux/virtio_net.h
-+++ b/include/linux/virtio_net.h
-@@ -56,7 +56,8 @@ static inline int virtio_net_hdr_to_skb(struct sk_buff *skb,
- 
- static inline int virtio_net_hdr_from_skb(const struct sk_buff *skb,
- 					  struct virtio_net_hdr *hdr,
--					  bool little_endian)
-+					  bool little_endian,
-+					  bool has_data_valid)
- {
- 	memset(hdr, 0, sizeof(*hdr));
- 
-@@ -91,7 +92,8 @@ static inline int virtio_net_hdr_from_skb(const struct sk_buff *skb,
- 				skb_checksum_start_offset(skb));
- 		hdr->csum_offset = __cpu_to_virtio16(little_endian,
- 				skb->csum_offset);
--	} else if (skb->ip_summed == CHECKSUM_UNNECESSARY) {
-+	} else if (has_data_valid &&
-+		   skb->ip_summed == CHECKSUM_UNNECESSARY) {
- 		hdr->flags = VIRTIO_NET_HDR_F_DATA_VALID;
- 	} /* else everything is zero */
- 
-diff --git a/include/net/lwtunnel.h b/include/net/lwtunnel.h
-index ea3f80f..fc7c0db 100644
---- a/include/net/lwtunnel.h
-+++ b/include/net/lwtunnel.h
-@@ -43,13 +43,12 @@ struct lwtunnel_encap_ops {
- 	int (*get_encap_size)(struct lwtunnel_state *lwtstate);
- 	int (*cmp_encap)(struct lwtunnel_state *a, struct lwtunnel_state *b);
- 	int (*xmit)(struct sk_buff *skb);
-+
-+	struct module *owner;
- };
- 
- #ifdef CONFIG_LWTUNNEL
--static inline void lwtstate_free(struct lwtunnel_state *lws)
--{
--	kfree(lws);
--}
-+void lwtstate_free(struct lwtunnel_state *lws);
- 
- static inline struct lwtunnel_state *
- lwtstate_get(struct lwtunnel_state *lws)
-@@ -106,6 +105,8 @@ int lwtunnel_encap_add_ops(const struct lwtunnel_encap_ops *op,
- 			   unsigned int num);
- int lwtunnel_encap_del_ops(const struct lwtunnel_encap_ops *op,
- 			   unsigned int num);
-+int lwtunnel_valid_encap_type(u16 encap_type);
-+int lwtunnel_valid_encap_type_attr(struct nlattr *attr, int len);
- int lwtunnel_build_state(struct net_device *dev, u16 encap_type,
- 			 struct nlattr *encap,
- 			 unsigned int family, const void *cfg,
-@@ -169,6 +170,15 @@ static inline int lwtunnel_encap_del_ops(const struct lwtunnel_encap_ops *op,
- 	return -EOPNOTSUPP;
- }
- 
-+static inline int lwtunnel_valid_encap_type(u16 encap_type)
-+{
-+	return -EOPNOTSUPP;
-+}
-+static inline int lwtunnel_valid_encap_type_attr(struct nlattr *attr, int len)
-+{
-+	return -EOPNOTSUPP;
-+}
-+
- static inline int lwtunnel_build_state(struct net_device *dev, u16 encap_type,
- 				       struct nlattr *encap,
- 				       unsigned int family, const void *cfg,
-diff --git a/net/ax25/ax25_subr.c b/net/ax25/ax25_subr.c
-index 655a7d4..983f0b5 100644
---- a/net/ax25/ax25_subr.c
-+++ b/net/ax25/ax25_subr.c
-@@ -264,7 +264,7 @@ void ax25_disconnect(ax25_cb *ax25, int reason)
- {
- 	ax25_clear_queues(ax25);
- 
--	if (!sock_flag(ax25->sk, SOCK_DESTROY))
-+	if (!ax25->sk || !sock_flag(ax25->sk, SOCK_DESTROY))
- 		ax25_stop_heartbeat(ax25);
- 	ax25_stop_t1timer(ax25);
- 	ax25_stop_t2timer(ax25);
-diff --git a/net/bridge/br_netlink.c b/net/bridge/br_netlink.c
-index e99037c..0474106 100644
---- a/net/bridge/br_netlink.c
-+++ b/net/bridge/br_netlink.c
-@@ -781,20 +781,6 @@ static int br_validate(struct nlattr *tb[], struct nlattr *data[])
- 	return 0;
- }
- 
--static int br_dev_newlink(struct net *src_net, struct net_device *dev,
--			  struct nlattr *tb[], struct nlattr *data[])
--{
--	struct net_bridge *br = netdev_priv(dev);
--
--	if (tb[IFLA_ADDRESS]) {
--		spin_lock_bh(&br->lock);
--		br_stp_change_bridge_id(br, nla_data(tb[IFLA_ADDRESS]));
--		spin_unlock_bh(&br->lock);
--	}
--
--	return register_netdevice(dev);
--}
--
- static int br_port_slave_changelink(struct net_device *brdev,
- 				    struct net_device *dev,
- 				    struct nlattr *tb[],
-@@ -1093,6 +1079,25 @@ static int br_changelink(struct net_device *brdev, struct nlattr *tb[],
- 	return 0;
- }
- 
-+static int br_dev_newlink(struct net *src_net, struct net_device *dev,
-+			  struct nlattr *tb[], struct nlattr *data[])
-+{
-+	struct net_bridge *br = netdev_priv(dev);
-+	int err;
-+
-+	if (tb[IFLA_ADDRESS]) {
-+		spin_lock_bh(&br->lock);
-+		br_stp_change_bridge_id(br, nla_data(tb[IFLA_ADDRESS]));
-+		spin_unlock_bh(&br->lock);
-+	}
-+
-+	err = br_changelink(dev, tb, data);
-+	if (err)
-+		return err;
-+
-+	return register_netdevice(dev);
-+}
-+
- static size_t br_get_size(const struct net_device *brdev)
- {
- 	return nla_total_size(sizeof(u32)) +	/* IFLA_BR_FORWARD_DELAY  */
-diff --git a/net/core/dev.c b/net/core/dev.c
-index e1d731f..df51c50 100644
---- a/net/core/dev.c
-+++ b/net/core/dev.c
-@@ -2815,9 +2815,9 @@ static netdev_features_t harmonize_features(struct sk_buff *skb,
- 	if (skb->ip_summed != CHECKSUM_NONE &&
- 	    !can_checksum_protocol(features, type)) {
- 		features &= ~(NETIF_F_CSUM_MASK | NETIF_F_GSO_MASK);
--	} else if (illegal_highdma(skb->dev, skb)) {
--		features &= ~NETIF_F_SG;
- 	}
-+	if (illegal_highdma(skb->dev, skb))
-+		features &= ~NETIF_F_SG;
- 
- 	return features;
- }
-diff --git a/net/core/lwtunnel.c b/net/core/lwtunnel.c
-index e5f84c2..afa64f0 100644
---- a/net/core/lwtunnel.c
-+++ b/net/core/lwtunnel.c
-@@ -26,6 +26,7 @@
- #include <net/lwtunnel.h>
- #include <net/rtnetlink.h>
- #include <net/ip6_fib.h>
-+#include <net/nexthop.h>
- 
- #ifdef CONFIG_MODULES
- 
-@@ -65,6 +66,15 @@ EXPORT_SYMBOL(lwtunnel_state_alloc);
- static const struct lwtunnel_encap_ops __rcu *
- 		lwtun_encaps[LWTUNNEL_ENCAP_MAX + 1] __read_mostly;
- 
-+void lwtstate_free(struct lwtunnel_state *lws)
-+{
-+	const struct lwtunnel_encap_ops *ops = lwtun_encaps[lws->type];
-+
-+	kfree(lws);
-+	module_put(ops->owner);
-+}
-+EXPORT_SYMBOL(lwtstate_free);
-+
- int lwtunnel_encap_add_ops(const struct lwtunnel_encap_ops *ops,
- 			   unsigned int num)
- {
-@@ -110,25 +120,77 @@ int lwtunnel_build_state(struct net_device *dev, u16 encap_type,
- 	ret = -EOPNOTSUPP;
- 	rcu_read_lock();
- 	ops = rcu_dereference(lwtun_encaps[encap_type]);
-+	if (likely(ops && ops->build_state && try_module_get(ops->owner))) {
-+		ret = ops->build_state(dev, encap, family, cfg, lws);
-+		if (ret)
-+			module_put(ops->owner);
-+	}
-+	rcu_read_unlock();
-+
-+	return ret;
-+}
-+EXPORT_SYMBOL(lwtunnel_build_state);
-+
-+int lwtunnel_valid_encap_type(u16 encap_type)
-+{
-+	const struct lwtunnel_encap_ops *ops;
-+	int ret = -EINVAL;
-+
-+	if (encap_type == LWTUNNEL_ENCAP_NONE ||
-+	    encap_type > LWTUNNEL_ENCAP_MAX)
-+		return ret;
-+
-+	rcu_read_lock();
-+	ops = rcu_dereference(lwtun_encaps[encap_type]);
-+	rcu_read_unlock();
- #ifdef CONFIG_MODULES
- 	if (!ops) {
- 		const char *encap_type_str = lwtunnel_encap_str(encap_type);
- 
- 		if (encap_type_str) {
--			rcu_read_unlock();
-+			__rtnl_unlock();
- 			request_module("rtnl-lwt-%s", encap_type_str);
-+			rtnl_lock();
-+
- 			rcu_read_lock();
- 			ops = rcu_dereference(lwtun_encaps[encap_type]);
-+			rcu_read_unlock();
- 		}
- 	}
- #endif
--	if (likely(ops && ops->build_state))
--		ret = ops->build_state(dev, encap, family, cfg, lws);
--	rcu_read_unlock();
-+	return ops ? 0 : -EOPNOTSUPP;
-+}
-+EXPORT_SYMBOL(lwtunnel_valid_encap_type);
- 
--	return ret;
-+int lwtunnel_valid_encap_type_attr(struct nlattr *attr, int remaining)
-+{
-+	struct rtnexthop *rtnh = (struct rtnexthop *)attr;
-+	struct nlattr *nla_entype;
-+	struct nlattr *attrs;
-+	struct nlattr *nla;
-+	u16 encap_type;
-+	int attrlen;
-+
-+	while (rtnh_ok(rtnh, remaining)) {
-+		attrlen = rtnh_attrlen(rtnh);
-+		if (attrlen > 0) {
-+			attrs = rtnh_attrs(rtnh);
-+			nla = nla_find(attrs, attrlen, RTA_ENCAP);
-+			nla_entype = nla_find(attrs, attrlen, RTA_ENCAP_TYPE);
-+
-+			if (nla_entype) {
-+				encap_type = nla_get_u16(nla_entype);
-+
-+				if (lwtunnel_valid_encap_type(encap_type) != 0)
-+					return -EOPNOTSUPP;
-+			}
-+		}
-+		rtnh = rtnh_next(rtnh, &remaining);
-+	}
-+
-+	return 0;
- }
--EXPORT_SYMBOL(lwtunnel_build_state);
-+EXPORT_SYMBOL(lwtunnel_valid_encap_type_attr);
- 
- int lwtunnel_fill_encap(struct sk_buff *skb, struct lwtunnel_state *lwtstate)
- {
-diff --git a/net/dsa/slave.c b/net/dsa/slave.c
-index 30e2e21..3ff9d97 100644
---- a/net/dsa/slave.c
-+++ b/net/dsa/slave.c
-@@ -1201,6 +1201,8 @@ int dsa_slave_suspend(struct net_device *slave_dev)
- {
- 	struct dsa_slave_priv *p = netdev_priv(slave_dev);
- 
-+	netif_device_detach(slave_dev);
-+
- 	if (p->phy) {
- 		phy_stop(p->phy);
- 		p->old_pause = -1;
-diff --git a/net/ipv4/fib_frontend.c b/net/ipv4/fib_frontend.c
-index 3e4f183..5b03d7f 100644
---- a/net/ipv4/fib_frontend.c
-+++ b/net/ipv4/fib_frontend.c
-@@ -46,6 +46,7 @@
- #include <net/rtnetlink.h>
- #include <net/xfrm.h>
- #include <net/l3mdev.h>
-+#include <net/lwtunnel.h>
- #include <trace/events/fib.h>
- 
- #ifndef CONFIG_IP_MULTIPLE_TABLES
-@@ -676,6 +677,10 @@ static int rtm_to_fib_config(struct net *net, struct sk_buff *skb,
- 			cfg->fc_mx_len = nla_len(attr);
- 			break;
- 		case RTA_MULTIPATH:
-+			err = lwtunnel_valid_encap_type_attr(nla_data(attr),
-+							     nla_len(attr));
-+			if (err < 0)
-+				goto errout;
- 			cfg->fc_mp = nla_data(attr);
- 			cfg->fc_mp_len = nla_len(attr);
- 			break;
-@@ -690,6 +695,9 @@ static int rtm_to_fib_config(struct net *net, struct sk_buff *skb,
- 			break;
- 		case RTA_ENCAP_TYPE:
- 			cfg->fc_encap_type = nla_get_u16(attr);
-+			err = lwtunnel_valid_encap_type(cfg->fc_encap_type);
-+			if (err < 0)
-+				goto errout;
- 			break;
- 		}
- 	}
-diff --git a/net/ipv4/fib_semantics.c b/net/ipv4/fib_semantics.c
-index a8508b7..6a40680 100644
---- a/net/ipv4/fib_semantics.c
-+++ b/net/ipv4/fib_semantics.c
-@@ -1278,8 +1278,9 @@ int fib_dump_info(struct sk_buff *skb, u32 portid, u32 seq, int event,
- 		    nla_put_u32(skb, RTA_FLOW, fi->fib_nh[0].nh_tclassid))
- 			goto nla_put_failure;
- #endif
--		if (fi->fib_nh->nh_lwtstate)
--			lwtunnel_fill_encap(skb, fi->fib_nh->nh_lwtstate);
-+		if (fi->fib_nh->nh_lwtstate &&
-+		    lwtunnel_fill_encap(skb, fi->fib_nh->nh_lwtstate) < 0)
-+			goto nla_put_failure;
- 	}
- #ifdef CONFIG_IP_ROUTE_MULTIPATH
- 	if (fi->fib_nhs > 1) {
-@@ -1315,8 +1316,10 @@ int fib_dump_info(struct sk_buff *skb, u32 portid, u32 seq, int event,
- 			    nla_put_u32(skb, RTA_FLOW, nh->nh_tclassid))
- 				goto nla_put_failure;
- #endif
--			if (nh->nh_lwtstate)
--				lwtunnel_fill_encap(skb, nh->nh_lwtstate);
-+			if (nh->nh_lwtstate &&
-+			    lwtunnel_fill_encap(skb, nh->nh_lwtstate) < 0)
-+				goto nla_put_failure;
-+
- 			/* length of rtnetlink header + attributes */
- 			rtnh->rtnh_len = nlmsg_get_pos(skb) - (void *) rtnh;
- 		} endfor_nexthops(fi);
-diff --git a/net/ipv4/ip_tunnel_core.c b/net/ipv4/ip_tunnel_core.c
-index fed3d29..0fd1976 100644
---- a/net/ipv4/ip_tunnel_core.c
-+++ b/net/ipv4/ip_tunnel_core.c
-@@ -313,6 +313,7 @@ static const struct lwtunnel_encap_ops ip_tun_lwt_ops = {
- 	.fill_encap = ip_tun_fill_encap_info,
- 	.get_encap_size = ip_tun_encap_nlsize,
- 	.cmp_encap = ip_tun_cmp_encap,
-+	.owner = THIS_MODULE,
- };
- 
- static const struct nla_policy ip6_tun_policy[LWTUNNEL_IP6_MAX + 1] = {
-@@ -403,6 +404,7 @@ static const struct lwtunnel_encap_ops ip6_tun_lwt_ops = {
- 	.fill_encap = ip6_tun_fill_encap_info,
- 	.get_encap_size = ip6_tun_encap_nlsize,
- 	.cmp_encap = ip_tun_cmp_encap,
-+	.owner = THIS_MODULE,
- };
- 
- void __init ip_tunnel_core_init(void)
-diff --git a/net/ipv4/route.c b/net/ipv4/route.c
-index 8197b06..d851cae 100644
---- a/net/ipv4/route.c
-+++ b/net/ipv4/route.c
-@@ -2440,7 +2440,7 @@ static int rt_fill_info(struct net *net,  __be32 dst, __be32 src, u32 table_id,
- 	r->rtm_dst_len	= 32;
- 	r->rtm_src_len	= 0;
- 	r->rtm_tos	= fl4->flowi4_tos;
--	r->rtm_table	= table_id;
-+	r->rtm_table	= table_id < 256 ? table_id : RT_TABLE_COMPAT;
- 	if (nla_put_u32(skb, RTA_TABLE, table_id))
- 		goto nla_put_failure;
- 	r->rtm_type	= rt->rt_type;
-diff --git a/net/ipv4/tcp_fastopen.c b/net/ipv4/tcp_fastopen.c
-index 4e777a3..dd2560c 100644
---- a/net/ipv4/tcp_fastopen.c
-+++ b/net/ipv4/tcp_fastopen.c
-@@ -113,7 +113,7 @@ static bool tcp_fastopen_cookie_gen(struct request_sock *req,
- 		struct tcp_fastopen_cookie tmp;
- 
- 		if (__tcp_fastopen_cookie_gen(&ip6h->saddr, &tmp)) {
--			struct in6_addr *buf = (struct in6_addr *) tmp.val;
-+			struct in6_addr *buf = &tmp.addr;
- 			int i;
- 
- 			for (i = 0; i < 4; i++)
-@@ -205,6 +205,7 @@ static struct sock *tcp_fastopen_create_child(struct sock *sk,
- 	 * scaled. So correct it appropriately.
- 	 */
- 	tp->snd_wnd = ntohs(tcp_hdr(skb)->window);
-+	tp->max_window = tp->snd_wnd;
- 
- 	/* Activate the retrans timer so that SYNACK can be retransmitted.
- 	 * The request socket is not added to the ehash
-diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
-index 4bc5ba3..95dfcba 100644
---- a/net/ipv6/addrconf.c
-+++ b/net/ipv6/addrconf.c
-@@ -5515,8 +5515,7 @@ static void addrconf_disable_change(struct net *net, __s32 newf)
- 	struct net_device *dev;
- 	struct inet6_dev *idev;
- 
--	rcu_read_lock();
--	for_each_netdev_rcu(net, dev) {
-+	for_each_netdev(net, dev) {
- 		idev = __in6_dev_get(dev);
- 		if (idev) {
- 			int changed = (!idev->cnf.disable_ipv6) ^ (!newf);
-@@ -5525,7 +5524,6 @@ static void addrconf_disable_change(struct net *net, __s32 newf)
- 				dev_disable_change(idev);
- 		}
- 	}
--	rcu_read_unlock();
- }
- 
- static int addrconf_disable_ipv6(struct ctl_table *table, int *p, int newf)
-diff --git a/net/ipv6/ila/ila_lwt.c b/net/ipv6/ila/ila_lwt.c
-index e50c27a..f3db364 100644
---- a/net/ipv6/ila/ila_lwt.c
-+++ b/net/ipv6/ila/ila_lwt.c
-@@ -164,6 +164,7 @@ static const struct lwtunnel_encap_ops ila_encap_ops = {
- 	.fill_encap = ila_fill_encap_info,
- 	.get_encap_size = ila_encap_nlsize,
- 	.cmp_encap = ila_encap_cmp,
-+	.owner = THIS_MODULE,
- };
- 
- int ila_lwt_init(void)
-diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c
-index d76674e..f95437f 100644
---- a/net/ipv6/ip6_tunnel.c
-+++ b/net/ipv6/ip6_tunnel.c
-@@ -1108,7 +1108,7 @@ int ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev, __u8 dsfield,
- 				     t->parms.name);
- 		goto tx_err_dst_release;
- 	}
--	mtu = dst_mtu(dst) - psh_hlen;
-+	mtu = dst_mtu(dst) - psh_hlen - t->tun_hlen;
- 	if (encap_limit >= 0) {
- 		max_headroom += 8;
- 		mtu -= 8;
-@@ -1117,7 +1117,7 @@ int ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev, __u8 dsfield,
- 		mtu = IPV6_MIN_MTU;
- 	if (skb_dst(skb) && !t->parms.collect_md)
- 		skb_dst(skb)->ops->update_pmtu(skb_dst(skb), NULL, skb, mtu);
--	if (skb->len > mtu && !skb_is_gso(skb)) {
-+	if (skb->len - t->tun_hlen > mtu && !skb_is_gso(skb)) {
- 		*pmtu = mtu;
- 		err = -EMSGSIZE;
- 		goto tx_err_dst_release;
-diff --git a/net/ipv6/route.c b/net/ipv6/route.c
-index 1b57e11..bff4460 100644
---- a/net/ipv6/route.c
-+++ b/net/ipv6/route.c
-@@ -2885,6 +2885,11 @@ static int rtm_to_fib6_config(struct sk_buff *skb, struct nlmsghdr *nlh,
- 	if (tb[RTA_MULTIPATH]) {
- 		cfg->fc_mp = nla_data(tb[RTA_MULTIPATH]);
- 		cfg->fc_mp_len = nla_len(tb[RTA_MULTIPATH]);
-+
-+		err = lwtunnel_valid_encap_type_attr(cfg->fc_mp,
-+						     cfg->fc_mp_len);
-+		if (err < 0)
-+			goto errout;
- 	}
- 
- 	if (tb[RTA_PREF]) {
-@@ -2898,9 +2903,14 @@ static int rtm_to_fib6_config(struct sk_buff *skb, struct nlmsghdr *nlh,
- 	if (tb[RTA_ENCAP])
- 		cfg->fc_encap = tb[RTA_ENCAP];
- 
--	if (tb[RTA_ENCAP_TYPE])
-+	if (tb[RTA_ENCAP_TYPE]) {
- 		cfg->fc_encap_type = nla_get_u16(tb[RTA_ENCAP_TYPE]);
- 
-+		err = lwtunnel_valid_encap_type(cfg->fc_encap_type);
-+		if (err < 0)
-+			goto errout;
-+	}
-+
- 	if (tb[RTA_EXPIRES]) {
- 		unsigned long timeout = addrconf_timeout_fixup(nla_get_u32(tb[RTA_EXPIRES]), HZ);
- 
-@@ -3306,7 +3316,8 @@ static int rt6_fill_node(struct net *net,
- 	if (nla_put_u8(skb, RTA_PREF, IPV6_EXTRACT_PREF(rt->rt6i_flags)))
- 		goto nla_put_failure;
- 
--	lwtunnel_fill_encap(skb, rt->dst.lwtstate);
-+	if (lwtunnel_fill_encap(skb, rt->dst.lwtstate) < 0)
-+		goto nla_put_failure;
- 
- 	nlmsg_end(skb, nlh);
- 	return 0;
-diff --git a/net/mpls/af_mpls.c b/net/mpls/af_mpls.c
-index 15fe976..5b77377 100644
---- a/net/mpls/af_mpls.c
-+++ b/net/mpls/af_mpls.c
-@@ -98,18 +98,19 @@ bool mpls_pkt_too_big(const struct sk_buff *skb, unsigned int mtu)
- }
- EXPORT_SYMBOL_GPL(mpls_pkt_too_big);
- 
--static u32 mpls_multipath_hash(struct mpls_route *rt,
--			       struct sk_buff *skb, bool bos)
-+static u32 mpls_multipath_hash(struct mpls_route *rt, struct sk_buff *skb)
- {
- 	struct mpls_entry_decoded dec;
-+	unsigned int mpls_hdr_len = 0;
- 	struct mpls_shim_hdr *hdr;
- 	bool eli_seen = false;
- 	int label_index;
- 	u32 hash = 0;
- 
--	for (label_index = 0; label_index < MAX_MP_SELECT_LABELS && !bos;
-+	for (label_index = 0; label_index < MAX_MP_SELECT_LABELS;
- 	     label_index++) {
--		if (!pskb_may_pull(skb, sizeof(*hdr) * label_index))
-+		mpls_hdr_len += sizeof(*hdr);
-+		if (!pskb_may_pull(skb, mpls_hdr_len))
- 			break;
- 
- 		/* Read and decode the current label */
-@@ -134,37 +135,38 @@ static u32 mpls_multipath_hash(struct mpls_route *rt,
- 			eli_seen = true;
- 		}
- 
--		bos = dec.bos;
--		if (bos && pskb_may_pull(skb, sizeof(*hdr) * label_index +
--					 sizeof(struct iphdr))) {
-+		if (!dec.bos)
-+			continue;
-+
-+		/* found bottom label; does skb have room for a header? */
-+		if (pskb_may_pull(skb, mpls_hdr_len + sizeof(struct iphdr))) {
- 			const struct iphdr *v4hdr;
- 
--			v4hdr = (const struct iphdr *)(mpls_hdr(skb) +
--						       label_index);
-+			v4hdr = (const struct iphdr *)(hdr + 1);
- 			if (v4hdr->version == 4) {
- 				hash = jhash_3words(ntohl(v4hdr->saddr),
- 						    ntohl(v4hdr->daddr),
- 						    v4hdr->protocol, hash);
- 			} else if (v4hdr->version == 6 &&
--				pskb_may_pull(skb, sizeof(*hdr) * label_index +
--					      sizeof(struct ipv6hdr))) {
-+				   pskb_may_pull(skb, mpls_hdr_len +
-+						 sizeof(struct ipv6hdr))) {
- 				const struct ipv6hdr *v6hdr;
- 
--				v6hdr = (const struct ipv6hdr *)(mpls_hdr(skb) +
--								label_index);
--
-+				v6hdr = (const struct ipv6hdr *)(hdr + 1);
- 				hash = __ipv6_addr_jhash(&v6hdr->saddr, hash);
- 				hash = __ipv6_addr_jhash(&v6hdr->daddr, hash);
- 				hash = jhash_1word(v6hdr->nexthdr, hash);
- 			}
- 		}
-+
-+		break;
- 	}
- 
- 	return hash;
- }
- 
- static struct mpls_nh *mpls_select_multipath(struct mpls_route *rt,
--					     struct sk_buff *skb, bool bos)
-+					     struct sk_buff *skb)
- {
- 	int alive = ACCESS_ONCE(rt->rt_nhn_alive);
- 	u32 hash = 0;
-@@ -180,7 +182,7 @@ static struct mpls_nh *mpls_select_multipath(struct mpls_route *rt,
- 	if (alive <= 0)
- 		return NULL;
- 
--	hash = mpls_multipath_hash(rt, skb, bos);
-+	hash = mpls_multipath_hash(rt, skb);
- 	nh_index = hash % alive;
- 	if (alive == rt->rt_nhn)
- 		goto out;
-@@ -278,17 +280,11 @@ static int mpls_forward(struct sk_buff *skb, struct net_device *dev,
- 	hdr = mpls_hdr(skb);
- 	dec = mpls_entry_decode(hdr);
- 
--	/* Pop the label */
--	skb_pull(skb, sizeof(*hdr));
--	skb_reset_network_header(skb);
--
--	skb_orphan(skb);
--
- 	rt = mpls_route_input_rcu(net, dec.label);
- 	if (!rt)
- 		goto drop;
- 
--	nh = mpls_select_multipath(rt, skb, dec.bos);
-+	nh = mpls_select_multipath(rt, skb);
- 	if (!nh)
- 		goto drop;
- 
-@@ -297,6 +293,12 @@ static int mpls_forward(struct sk_buff *skb, struct net_device *dev,
- 	if (!mpls_output_possible(out_dev))
- 		goto drop;
- 
-+	/* Pop the label */
-+	skb_pull(skb, sizeof(*hdr));
-+	skb_reset_network_header(skb);
-+
-+	skb_orphan(skb);
-+
- 	if (skb_warn_if_lro(skb))
- 		goto drop;
- 
-diff --git a/net/mpls/mpls_iptunnel.c b/net/mpls/mpls_iptunnel.c
-index cf52cf3..bc9aaf5 100644
---- a/net/mpls/mpls_iptunnel.c
-+++ b/net/mpls/mpls_iptunnel.c
-@@ -218,6 +218,7 @@ static const struct lwtunnel_encap_ops mpls_iptun_ops = {
- 	.fill_encap = mpls_fill_encap_info,
- 	.get_encap_size = mpls_encap_nlsize,
- 	.cmp_encap = mpls_encap_cmp,
-+	.owner = THIS_MODULE,
- };
- 
- static int __init mpls_iptunnel_init(void)
-diff --git a/net/openvswitch/conntrack.c b/net/openvswitch/conntrack.c
-index fecefa2..eab210b 100644
---- a/net/openvswitch/conntrack.c
-+++ b/net/openvswitch/conntrack.c
-@@ -514,7 +514,7 @@ static int ovs_ct_nat_execute(struct sk_buff *skb, struct nf_conn *ct,
- 	int hooknum, nh_off, err = NF_ACCEPT;
- 
- 	nh_off = skb_network_offset(skb);
--	skb_pull(skb, nh_off);
-+	skb_pull_rcsum(skb, nh_off);
- 
- 	/* See HOOK2MANIP(). */
- 	if (maniptype == NF_NAT_MANIP_SRC)
-@@ -579,6 +579,7 @@ static int ovs_ct_nat_execute(struct sk_buff *skb, struct nf_conn *ct,
- 	err = nf_nat_packet(ct, ctinfo, hooknum, skb);
- push:
- 	skb_push(skb, nh_off);
-+	skb_postpush_rcsum(skb, skb->data, nh_off);
- 
- 	return err;
- }
-@@ -890,7 +891,7 @@ int ovs_ct_execute(struct net *net, struct sk_buff *skb,
- 
- 	/* The conntrack module expects to be working at L3. */
- 	nh_ofs = skb_network_offset(skb);
--	skb_pull(skb, nh_ofs);
-+	skb_pull_rcsum(skb, nh_ofs);
- 
- 	if (key->ip.frag != OVS_FRAG_TYPE_NONE) {
- 		err = handle_fragments(net, key, info->zone.id, skb);
-@@ -904,6 +905,7 @@ int ovs_ct_execute(struct net *net, struct sk_buff *skb,
- 		err = ovs_ct_lookup(net, key, info, skb);
- 
- 	skb_push(skb, nh_ofs);
-+	skb_postpush_rcsum(skb, skb->data, nh_ofs);
- 	if (err)
- 		kfree_skb(skb);
- 	return err;
-diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
-index dd23323..94e4a59 100644
---- a/net/packet/af_packet.c
-+++ b/net/packet/af_packet.c
-@@ -1972,7 +1972,7 @@ static int __packet_rcv_vnet(const struct sk_buff *skb,
- {
- 	*vnet_hdr = (const struct virtio_net_hdr) { 0 };
- 
--	if (virtio_net_hdr_from_skb(skb, vnet_hdr, vio_le()))
-+	if (virtio_net_hdr_from_skb(skb, vnet_hdr, vio_le(), true))
- 		BUG();
- 
- 	return 0;
-diff --git a/net/sched/act_api.c b/net/sched/act_api.c
-index f893d18..c6c2a93 100644
---- a/net/sched/act_api.c
-+++ b/net/sched/act_api.c
-@@ -903,8 +903,6 @@ tca_action_gd(struct net *net, struct nlattr *nla, struct nlmsghdr *n,
- 			goto err;
- 		}
- 		act->order = i;
--		if (event == RTM_GETACTION)
--			act->tcfa_refcnt++;
- 		list_add_tail(&act->list, &actions);
- 	}
- 
-@@ -917,7 +915,8 @@ tca_action_gd(struct net *net, struct nlattr *nla, struct nlmsghdr *n,
- 		return ret;
- 	}
- err:
--	tcf_action_destroy(&actions, 0);
-+	if (event != RTM_GETACTION)
-+		tcf_action_destroy(&actions, 0);
- 	return ret;
- }
- 
-diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
-index 2358f26..2d03d5b 100644
---- a/net/unix/af_unix.c
-+++ b/net/unix/af_unix.c
-@@ -995,6 +995,7 @@ static int unix_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
- 	unsigned int hash;
- 	struct unix_address *addr;
- 	struct hlist_head *list;
-+	struct path path = { NULL, NULL };
- 
- 	err = -EINVAL;
- 	if (sunaddr->sun_family != AF_UNIX)
-@@ -1010,9 +1011,20 @@ static int unix_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
- 		goto out;
- 	addr_len = err;
- 
-+	if (sun_path[0]) {
-+		umode_t mode = S_IFSOCK |
-+		       (SOCK_INODE(sock)->i_mode & ~current_umask());
-+		err = unix_mknod(sun_path, mode, &path);
-+		if (err) {
-+			if (err == -EEXIST)
-+				err = -EADDRINUSE;
-+			goto out;
-+		}
-+	}
-+
- 	err = mutex_lock_interruptible(&u->bindlock);
- 	if (err)
--		goto out;
-+		goto out_put;
- 
- 	err = -EINVAL;
- 	if (u->addr)
-@@ -1029,16 +1041,6 @@ static int unix_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
- 	atomic_set(&addr->refcnt, 1);
- 
- 	if (sun_path[0]) {
--		struct path path;
--		umode_t mode = S_IFSOCK |
--		       (SOCK_INODE(sock)->i_mode & ~current_umask());
--		err = unix_mknod(sun_path, mode, &path);
--		if (err) {
--			if (err == -EEXIST)
--				err = -EADDRINUSE;
--			unix_release_addr(addr);
--			goto out_up;
--		}
- 		addr->hash = UNIX_HASH_SIZE;
- 		hash = d_real_inode(path.dentry)->i_ino & (UNIX_HASH_SIZE - 1);
- 		spin_lock(&unix_table_lock);
-@@ -1065,6 +1067,9 @@ static int unix_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
- 	spin_unlock(&unix_table_lock);
- out_up:
- 	mutex_unlock(&u->bindlock);
-+out_put:
-+	if (err)
-+		path_put(&path);
- out:
- 	return err;
- }
diff --git a/4.9.9/1008_linux-4.9.9.patch b/4.9.9/1008_linux-4.9.9.patch
deleted file mode 100644
index 411ce9b..0000000
--- a/4.9.9/1008_linux-4.9.9.patch
+++ /dev/null
@@ -1,2333 +0,0 @@
-diff --git a/Makefile b/Makefile
-index 1130803..c0c41c9 100644
---- a/Makefile
-+++ b/Makefile
-@@ -1,6 +1,6 @@
- VERSION = 4
- PATCHLEVEL = 9
--SUBLEVEL = 8
-+SUBLEVEL = 9
- EXTRAVERSION =
- NAME = Roaring Lionus
- 
-diff --git a/arch/arm64/crypto/aes-modes.S b/arch/arm64/crypto/aes-modes.S
-index c53dbea..838dad5 100644
---- a/arch/arm64/crypto/aes-modes.S
-+++ b/arch/arm64/crypto/aes-modes.S
-@@ -193,15 +193,16 @@ AES_ENTRY(aes_cbc_encrypt)
- 	cbz		w6, .Lcbcencloop
- 
- 	ld1		{v0.16b}, [x5]			/* get iv */
--	enc_prepare	w3, x2, x5
-+	enc_prepare	w3, x2, x6
- 
- .Lcbcencloop:
- 	ld1		{v1.16b}, [x1], #16		/* get next pt block */
- 	eor		v0.16b, v0.16b, v1.16b		/* ..and xor with iv */
--	encrypt_block	v0, w3, x2, x5, w6
-+	encrypt_block	v0, w3, x2, x6, w7
- 	st1		{v0.16b}, [x0], #16
- 	subs		w4, w4, #1
- 	bne		.Lcbcencloop
-+	st1		{v0.16b}, [x5]			/* return iv */
- 	ret
- AES_ENDPROC(aes_cbc_encrypt)
- 
-@@ -211,7 +212,7 @@ AES_ENTRY(aes_cbc_decrypt)
- 	cbz		w6, .LcbcdecloopNx
- 
- 	ld1		{v7.16b}, [x5]			/* get iv */
--	dec_prepare	w3, x2, x5
-+	dec_prepare	w3, x2, x6
- 
- .LcbcdecloopNx:
- #if INTERLEAVE >= 2
-@@ -248,7 +249,7 @@ AES_ENTRY(aes_cbc_decrypt)
- .Lcbcdecloop:
- 	ld1		{v1.16b}, [x1], #16		/* get next ct block */
- 	mov		v0.16b, v1.16b			/* ...and copy to v0 */
--	decrypt_block	v0, w3, x2, x5, w6
-+	decrypt_block	v0, w3, x2, x6, w7
- 	eor		v0.16b, v0.16b, v7.16b		/* xor with iv => pt */
- 	mov		v7.16b, v1.16b			/* ct is next iv */
- 	st1		{v0.16b}, [x0], #16
-@@ -256,6 +257,7 @@ AES_ENTRY(aes_cbc_decrypt)
- 	bne		.Lcbcdecloop
- .Lcbcdecout:
- 	FRAME_POP
-+	st1		{v7.16b}, [x5]			/* return iv */
- 	ret
- AES_ENDPROC(aes_cbc_decrypt)
- 
-@@ -267,24 +269,15 @@ AES_ENDPROC(aes_cbc_decrypt)
- 
- AES_ENTRY(aes_ctr_encrypt)
- 	FRAME_PUSH
--	cbnz		w6, .Lctrfirst		/* 1st time around? */
--	umov		x5, v4.d[1]		/* keep swabbed ctr in reg */
--	rev		x5, x5
--#if INTERLEAVE >= 2
--	cmn		w5, w4			/* 32 bit overflow? */
--	bcs		.Lctrinc
--	add		x5, x5, #1		/* increment BE ctr */
--	b		.LctrincNx
--#else
--	b		.Lctrinc
--#endif
--.Lctrfirst:
-+	cbz		w6, .Lctrnotfirst	/* 1st time around? */
- 	enc_prepare	w3, x2, x6
- 	ld1		{v4.16b}, [x5]
--	umov		x5, v4.d[1]		/* keep swabbed ctr in reg */
--	rev		x5, x5
-+
-+.Lctrnotfirst:
-+	umov		x8, v4.d[1]		/* keep swabbed ctr in reg */
-+	rev		x8, x8
- #if INTERLEAVE >= 2
--	cmn		w5, w4			/* 32 bit overflow? */
-+	cmn		w8, w4			/* 32 bit overflow? */
- 	bcs		.Lctrloop
- .LctrloopNx:
- 	subs		w4, w4, #INTERLEAVE
-@@ -292,11 +285,11 @@ AES_ENTRY(aes_ctr_encrypt)
- #if INTERLEAVE == 2
- 	mov		v0.8b, v4.8b
- 	mov		v1.8b, v4.8b
--	rev		x7, x5
--	add		x5, x5, #1
-+	rev		x7, x8
-+	add		x8, x8, #1
- 	ins		v0.d[1], x7
--	rev		x7, x5
--	add		x5, x5, #1
-+	rev		x7, x8
-+	add		x8, x8, #1
- 	ins		v1.d[1], x7
- 	ld1		{v2.16b-v3.16b}, [x1], #32	/* get 2 input blocks */
- 	do_encrypt_block2x
-@@ -305,7 +298,7 @@ AES_ENTRY(aes_ctr_encrypt)
- 	st1		{v0.16b-v1.16b}, [x0], #32
- #else
- 	ldr		q8, =0x30000000200000001	/* addends 1,2,3[,0] */
--	dup		v7.4s, w5
-+	dup		v7.4s, w8
- 	mov		v0.16b, v4.16b
- 	add		v7.4s, v7.4s, v8.4s
- 	mov		v1.16b, v4.16b
-@@ -323,18 +316,12 @@ AES_ENTRY(aes_ctr_encrypt)
- 	eor		v2.16b, v7.16b, v2.16b
- 	eor		v3.16b, v5.16b, v3.16b
- 	st1		{v0.16b-v3.16b}, [x0], #64
--	add		x5, x5, #INTERLEAVE
-+	add		x8, x8, #INTERLEAVE
- #endif
--	cbz		w4, .LctroutNx
--.LctrincNx:
--	rev		x7, x5
-+	rev		x7, x8
- 	ins		v4.d[1], x7
-+	cbz		w4, .Lctrout
- 	b		.LctrloopNx
--.LctroutNx:
--	sub		x5, x5, #1
--	rev		x7, x5
--	ins		v4.d[1], x7
--	b		.Lctrout
- .Lctr1x:
- 	adds		w4, w4, #INTERLEAVE
- 	beq		.Lctrout
-@@ -342,30 +329,39 @@ AES_ENTRY(aes_ctr_encrypt)
- .Lctrloop:
- 	mov		v0.16b, v4.16b
- 	encrypt_block	v0, w3, x2, x6, w7
-+
-+	adds		x8, x8, #1		/* increment BE ctr */
-+	rev		x7, x8
-+	ins		v4.d[1], x7
-+	bcs		.Lctrcarry		/* overflow? */
-+
-+.Lctrcarrydone:
- 	subs		w4, w4, #1
- 	bmi		.Lctrhalfblock		/* blocks < 0 means 1/2 block */
- 	ld1		{v3.16b}, [x1], #16
- 	eor		v3.16b, v0.16b, v3.16b
- 	st1		{v3.16b}, [x0], #16
--	beq		.Lctrout
--.Lctrinc:
--	adds		x5, x5, #1		/* increment BE ctr */
--	rev		x7, x5
--	ins		v4.d[1], x7
--	bcc		.Lctrloop		/* no overflow? */
--	umov		x7, v4.d[0]		/* load upper word of ctr  */
--	rev		x7, x7			/* ... to handle the carry */
--	add		x7, x7, #1
--	rev		x7, x7
--	ins		v4.d[0], x7
--	b		.Lctrloop
-+	bne		.Lctrloop
-+
-+.Lctrout:
-+	st1		{v4.16b}, [x5]		/* return next CTR value */
-+	FRAME_POP
-+	ret
-+
- .Lctrhalfblock:
- 	ld1		{v3.8b}, [x1]
- 	eor		v3.8b, v0.8b, v3.8b
- 	st1		{v3.8b}, [x0]
--.Lctrout:
- 	FRAME_POP
- 	ret
-+
-+.Lctrcarry:
-+	umov		x7, v4.d[0]		/* load upper word of ctr  */
-+	rev		x7, x7			/* ... to handle the carry */
-+	add		x7, x7, #1
-+	rev		x7, x7
-+	ins		v4.d[0], x7
-+	b		.Lctrcarrydone
- AES_ENDPROC(aes_ctr_encrypt)
- 	.ltorg
- 
-diff --git a/arch/powerpc/include/asm/cpu_has_feature.h b/arch/powerpc/include/asm/cpu_has_feature.h
-index b312b15..6e834ca 100644
---- a/arch/powerpc/include/asm/cpu_has_feature.h
-+++ b/arch/powerpc/include/asm/cpu_has_feature.h
-@@ -23,7 +23,9 @@ static __always_inline bool cpu_has_feature(unsigned long feature)
- {
- 	int i;
- 
-+#ifndef __clang__ /* clang can't cope with this */
- 	BUILD_BUG_ON(!__builtin_constant_p(feature));
-+#endif
- 
- #ifdef CONFIG_JUMP_LABEL_FEATURE_CHECK_DEBUG
- 	if (!static_key_initialized) {
-diff --git a/arch/powerpc/include/asm/mmu.h b/arch/powerpc/include/asm/mmu.h
-index e311c25..a244e09 100644
---- a/arch/powerpc/include/asm/mmu.h
-+++ b/arch/powerpc/include/asm/mmu.h
-@@ -160,7 +160,9 @@ static __always_inline bool mmu_has_feature(unsigned long feature)
- {
- 	int i;
- 
-+#ifndef __clang__ /* clang can't cope with this */
- 	BUILD_BUG_ON(!__builtin_constant_p(feature));
-+#endif
- 
- #ifdef CONFIG_JUMP_LABEL_FEATURE_CHECK_DEBUG
- 	if (!static_key_initialized) {
-diff --git a/arch/powerpc/kernel/eeh_driver.c b/arch/powerpc/kernel/eeh_driver.c
-index 5c31369..a5dd493 100644
---- a/arch/powerpc/kernel/eeh_driver.c
-+++ b/arch/powerpc/kernel/eeh_driver.c
-@@ -545,7 +545,7 @@ static void *eeh_pe_detach_dev(void *data, void *userdata)
- static void *__eeh_clear_pe_frozen_state(void *data, void *flag)
- {
- 	struct eeh_pe *pe = (struct eeh_pe *)data;
--	bool *clear_sw_state = flag;
-+	bool clear_sw_state = *(bool *)flag;
- 	int i, rc = 1;
- 
- 	for (i = 0; rc && i < 3; i++)
-diff --git a/arch/powerpc/kernel/prom_init.c b/arch/powerpc/kernel/prom_init.c
-index 88ac964..1e8c572 100644
---- a/arch/powerpc/kernel/prom_init.c
-+++ b/arch/powerpc/kernel/prom_init.c
-@@ -2747,6 +2747,9 @@ static void __init prom_find_boot_cpu(void)
- 
- 	cpu_pkg = call_prom("instance-to-package", 1, 1, prom_cpu);
- 
-+	if (!PHANDLE_VALID(cpu_pkg))
-+		return;
-+
- 	prom_getprop(cpu_pkg, "reg", &rval, sizeof(rval));
- 	prom.cpu = be32_to_cpu(rval);
- 
-diff --git a/arch/powerpc/mm/pgtable-radix.c b/arch/powerpc/mm/pgtable-radix.c
-index ebb7f46..9a25dce 100644
---- a/arch/powerpc/mm/pgtable-radix.c
-+++ b/arch/powerpc/mm/pgtable-radix.c
-@@ -65,7 +65,7 @@ int radix__map_kernel_page(unsigned long ea, unsigned long pa,
- 		if (!pmdp)
- 			return -ENOMEM;
- 		if (map_page_size == PMD_SIZE) {
--			ptep = (pte_t *)pudp;
-+			ptep = pmdp_ptep(pmdp);
- 			goto set_the_pte;
- 		}
- 		ptep = pte_alloc_kernel(pmdp, ea);
-@@ -90,7 +90,7 @@ int radix__map_kernel_page(unsigned long ea, unsigned long pa,
- 		}
- 		pmdp = pmd_offset(pudp, ea);
- 		if (map_page_size == PMD_SIZE) {
--			ptep = (pte_t *)pudp;
-+			ptep = pmdp_ptep(pmdp);
- 			goto set_the_pte;
- 		}
- 		if (!pmd_present(*pmdp)) {
-diff --git a/arch/x86/events/intel/uncore.c b/arch/x86/events/intel/uncore.c
-index dbaaf7dc..19d646a 100644
---- a/arch/x86/events/intel/uncore.c
-+++ b/arch/x86/events/intel/uncore.c
-@@ -763,30 +763,6 @@ static void uncore_pmu_unregister(struct intel_uncore_pmu *pmu)
- 	pmu->registered = false;
- }
- 
--static void __uncore_exit_boxes(struct intel_uncore_type *type, int cpu)
--{
--	struct intel_uncore_pmu *pmu = type->pmus;
--	struct intel_uncore_box *box;
--	int i, pkg;
--
--	if (pmu) {
--		pkg = topology_physical_package_id(cpu);
--		for (i = 0; i < type->num_boxes; i++, pmu++) {
--			box = pmu->boxes[pkg];
--			if (box)
--				uncore_box_exit(box);
--		}
--	}
--}
--
--static void uncore_exit_boxes(void *dummy)
--{
--	struct intel_uncore_type **types;
--
--	for (types = uncore_msr_uncores; *types; types++)
--		__uncore_exit_boxes(*types++, smp_processor_id());
--}
--
- static void uncore_free_boxes(struct intel_uncore_pmu *pmu)
- {
- 	int pkg;
-@@ -1077,22 +1053,12 @@ static int uncore_cpu_dying(unsigned int cpu)
- 	return 0;
- }
- 
--static int first_init;
--
- static int uncore_cpu_starting(unsigned int cpu)
- {
- 	struct intel_uncore_type *type, **types = uncore_msr_uncores;
- 	struct intel_uncore_pmu *pmu;
- 	struct intel_uncore_box *box;
--	int i, pkg, ncpus = 1;
--
--	if (first_init) {
--		/*
--		 * On init we get the number of online cpus in the package
--		 * and set refcount for all of them.
--		 */
--		ncpus = cpumask_weight(topology_core_cpumask(cpu));
--	}
-+	int i, pkg;
- 
- 	pkg = topology_logical_package_id(cpu);
- 	for (; *types; types++) {
-@@ -1103,7 +1069,7 @@ static int uncore_cpu_starting(unsigned int cpu)
- 			if (!box)
- 				continue;
- 			/* The first cpu on a package activates the box */
--			if (atomic_add_return(ncpus, &box->refcnt) == ncpus)
-+			if (atomic_inc_return(&box->refcnt) == 1)
- 				uncore_box_init(box);
- 		}
- 	}
-@@ -1407,19 +1373,17 @@ static int __init intel_uncore_init(void)
- 					  "PERF_X86_UNCORE_PREP",
- 					  uncore_cpu_prepare, NULL);
- 	}
--	first_init = 1;
-+
- 	cpuhp_setup_state(CPUHP_AP_PERF_X86_UNCORE_STARTING,
- 			  "AP_PERF_X86_UNCORE_STARTING",
- 			  uncore_cpu_starting, uncore_cpu_dying);
--	first_init = 0;
-+
- 	cpuhp_setup_state(CPUHP_AP_PERF_X86_UNCORE_ONLINE,
- 			  "AP_PERF_X86_UNCORE_ONLINE",
- 			  uncore_event_cpu_online, uncore_event_cpu_offline);
- 	return 0;
- 
- err:
--	/* Undo box->init_box() */
--	on_each_cpu_mask(&uncore_cpu_mask, uncore_exit_boxes, NULL, 1);
- 	uncore_types_exit(uncore_msr_uncores);
- 	uncore_pci_exit();
- 	return ret;
-diff --git a/arch/x86/kernel/apic/io_apic.c b/arch/x86/kernel/apic/io_apic.c
-index 3d8ff40..7249f15 100644
---- a/arch/x86/kernel/apic/io_apic.c
-+++ b/arch/x86/kernel/apic/io_apic.c
-@@ -2118,6 +2118,7 @@ static inline void __init check_timer(void)
- 			if (idx != -1 && irq_trigger(idx))
- 				unmask_ioapic_irq(irq_get_chip_data(0));
- 		}
-+		irq_domain_deactivate_irq(irq_data);
- 		irq_domain_activate_irq(irq_data);
- 		if (timer_irq_works()) {
- 			if (disable_timer_pin_1 > 0)
-@@ -2139,6 +2140,7 @@ static inline void __init check_timer(void)
- 		 * legacy devices should be connected to IO APIC #0
- 		 */
- 		replace_pin_at_irq_node(data, node, apic1, pin1, apic2, pin2);
-+		irq_domain_deactivate_irq(irq_data);
- 		irq_domain_activate_irq(irq_data);
- 		legacy_pic->unmask(0);
- 		if (timer_irq_works()) {
-diff --git a/arch/x86/kernel/hpet.c b/arch/x86/kernel/hpet.c
-index 274fab9..932348fb 100644
---- a/arch/x86/kernel/hpet.c
-+++ b/arch/x86/kernel/hpet.c
-@@ -352,6 +352,7 @@ static int hpet_resume(struct clock_event_device *evt, int timer)
- 	} else {
- 		struct hpet_dev *hdev = EVT_TO_HPET_DEV(evt);
- 
-+		irq_domain_deactivate_irq(irq_get_irq_data(hdev->irq));
- 		irq_domain_activate_irq(irq_get_irq_data(hdev->irq));
- 		disable_irq(hdev->irq);
- 		irq_set_affinity(hdev->irq, cpumask_of(hdev->cpu));
-diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
-index 487b957..731044e 100644
---- a/arch/x86/kvm/x86.c
-+++ b/arch/x86/kvm/x86.c
-@@ -3148,6 +3148,7 @@ static void fill_xsave(u8 *dest, struct kvm_vcpu *vcpu)
- 	memcpy(dest, xsave, XSAVE_HDR_OFFSET);
- 
- 	/* Set XSTATE_BV */
-+	xstate_bv &= vcpu->arch.guest_supported_xcr0 | XFEATURE_MASK_FPSSE;
- 	*(u64 *)(dest + XSAVE_HDR_OFFSET) = xstate_bv;
- 
- 	/*
-diff --git a/arch/x86/platform/efi/efi_64.c b/arch/x86/platform/efi/efi_64.c
-index 319148b..2f25a36 100644
---- a/arch/x86/platform/efi/efi_64.c
-+++ b/arch/x86/platform/efi/efi_64.c
-@@ -269,6 +269,22 @@ int __init efi_setup_page_tables(unsigned long pa_memmap, unsigned num_pages)
- 	efi_scratch.use_pgd = true;
- 
- 	/*
-+	 * Certain firmware versions are way too sentimential and still believe
-+	 * they are exclusive and unquestionable owners of the first physical page,
-+	 * even though they explicitly mark it as EFI_CONVENTIONAL_MEMORY
-+	 * (but then write-access it later during SetVirtualAddressMap()).
-+	 *
-+	 * Create a 1:1 mapping for this page, to avoid triple faults during early
-+	 * boot with such firmware. We are free to hand this page to the BIOS,
-+	 * as trim_bios_range() will reserve the first page and isolate it away
-+	 * from memory allocators anyway.
-+	 */
-+	if (kernel_map_pages_in_pgd(pgd, 0x0, 0x0, 1, _PAGE_RW)) {
-+		pr_err("Failed to create 1:1 mapping for the first page!\n");
-+		return 1;
-+	}
-+
-+	/*
- 	 * When making calls to the firmware everything needs to be 1:1
- 	 * mapped and addressable with 32-bit pointers. Map the kernel
- 	 * text and allocate a new stack because we can't rely on the
-diff --git a/arch/xtensa/kernel/setup.c b/arch/xtensa/kernel/setup.c
-index 88a044a..32cdc2c 100644
---- a/arch/xtensa/kernel/setup.c
-+++ b/arch/xtensa/kernel/setup.c
-@@ -540,7 +540,7 @@ subsys_initcall(topology_init);
- 
- void cpu_reset(void)
- {
--#if XCHAL_HAVE_PTP_MMU
-+#if XCHAL_HAVE_PTP_MMU && IS_ENABLED(CONFIG_MMU)
- 	local_irq_disable();
- 	/*
- 	 * We have full MMU: all autoload ways, ways 7, 8 and 9 of DTLB must
-diff --git a/crypto/algapi.c b/crypto/algapi.c
-index df939b5..1fad2a6 100644
---- a/crypto/algapi.c
-+++ b/crypto/algapi.c
-@@ -356,6 +356,7 @@ int crypto_register_alg(struct crypto_alg *alg)
- 	struct crypto_larval *larval;
- 	int err;
- 
-+	alg->cra_flags &= ~CRYPTO_ALG_DEAD;
- 	err = crypto_check_alg(alg);
- 	if (err)
- 		return err;
-diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
-index 223a770..33e363d 100644
---- a/drivers/ata/libata-core.c
-+++ b/drivers/ata/libata-core.c
-@@ -1695,6 +1695,8 @@ unsigned ata_exec_internal_sg(struct ata_device *dev,
- 
- 		if (qc->err_mask & ~AC_ERR_OTHER)
- 			qc->err_mask &= ~AC_ERR_OTHER;
-+	} else if (qc->tf.command == ATA_CMD_REQ_SENSE_DATA) {
-+		qc->result_tf.command |= ATA_SENSE;
- 	}
- 
- 	/* finish up */
-@@ -4316,10 +4318,10 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = {
- 	{ "ST380013AS",		"3.20",		ATA_HORKAGE_MAX_SEC_1024 },
- 
- 	/*
--	 * Device times out with higher max sects.
-+	 * These devices time out with higher max sects.
- 	 * https://bugzilla.kernel.org/show_bug.cgi?id=121671
- 	 */
--	{ "LITEON CX1-JB256-HP", NULL,		ATA_HORKAGE_MAX_SEC_1024 },
-+	{ "LITEON CX1-JB*-HP",	NULL,		ATA_HORKAGE_MAX_SEC_1024 },
- 
- 	/* Devices we expect to fail diagnostics */
- 
-diff --git a/drivers/ata/sata_mv.c b/drivers/ata/sata_mv.c
-index 823e938..2f32782 100644
---- a/drivers/ata/sata_mv.c
-+++ b/drivers/ata/sata_mv.c
-@@ -4132,6 +4132,9 @@ static int mv_platform_probe(struct platform_device *pdev)
- 	host->iomap = NULL;
- 	hpriv->base = devm_ioremap(&pdev->dev, res->start,
- 				   resource_size(res));
-+	if (!hpriv->base)
-+		return -ENOMEM;
-+
- 	hpriv->base -= SATAHC0_REG_BASE;
- 
- 	hpriv->clk = clk_get(&pdev->dev, NULL);
-diff --git a/drivers/base/memory.c b/drivers/base/memory.c
-index e7f86a8..c5cdd19 100644
---- a/drivers/base/memory.c
-+++ b/drivers/base/memory.c
-@@ -391,33 +391,33 @@ static ssize_t show_valid_zones(struct device *dev,
- {
- 	struct memory_block *mem = to_memory_block(dev);
- 	unsigned long start_pfn, end_pfn;
-+	unsigned long valid_start, valid_end, valid_pages;
- 	unsigned long nr_pages = PAGES_PER_SECTION * sections_per_block;
--	struct page *first_page;
- 	struct zone *zone;
- 	int zone_shift = 0;
- 
- 	start_pfn = section_nr_to_pfn(mem->start_section_nr);
- 	end_pfn = start_pfn + nr_pages;
--	first_page = pfn_to_page(start_pfn);
- 
- 	/* The block contains more than one zone can not be offlined. */
--	if (!test_pages_in_a_zone(start_pfn, end_pfn))
-+	if (!test_pages_in_a_zone(start_pfn, end_pfn, &valid_start, &valid_end))
- 		return sprintf(buf, "none\n");
- 
--	zone = page_zone(first_page);
-+	zone = page_zone(pfn_to_page(valid_start));
-+	valid_pages = valid_end - valid_start;
- 
- 	/* MMOP_ONLINE_KEEP */
- 	sprintf(buf, "%s", zone->name);
- 
- 	/* MMOP_ONLINE_KERNEL */
--	zone_can_shift(start_pfn, nr_pages, ZONE_NORMAL, &zone_shift);
-+	zone_can_shift(valid_start, valid_pages, ZONE_NORMAL, &zone_shift);
- 	if (zone_shift) {
- 		strcat(buf, " ");
- 		strcat(buf, (zone + zone_shift)->name);
- 	}
- 
- 	/* MMOP_ONLINE_MOVABLE */
--	zone_can_shift(start_pfn, nr_pages, ZONE_MOVABLE, &zone_shift);
-+	zone_can_shift(valid_start, valid_pages, ZONE_MOVABLE, &zone_shift);
- 	if (zone_shift) {
- 		strcat(buf, " ");
- 		strcat(buf, (zone + zone_shift)->name);
-diff --git a/drivers/bcma/bcma_private.h b/drivers/bcma/bcma_private.h
-index f642c42..168fa17 100644
---- a/drivers/bcma/bcma_private.h
-+++ b/drivers/bcma/bcma_private.h
-@@ -45,6 +45,9 @@ int bcma_sprom_get(struct bcma_bus *bus);
- void bcma_core_chipcommon_early_init(struct bcma_drv_cc *cc);
- void bcma_core_chipcommon_init(struct bcma_drv_cc *cc);
- void bcma_chipco_bcm4331_ext_pa_lines_ctl(struct bcma_drv_cc *cc, bool enable);
-+#ifdef CONFIG_BCMA_DRIVER_MIPS
-+void bcma_chipco_serial_init(struct bcma_drv_cc *cc);
-+#endif /* CONFIG_BCMA_DRIVER_MIPS */
- 
- /* driver_chipcommon_b.c */
- int bcma_core_chipcommon_b_init(struct bcma_drv_cc_b *ccb);
-diff --git a/drivers/bcma/driver_chipcommon.c b/drivers/bcma/driver_chipcommon.c
-index b4f6520..62f5bfa 100644
---- a/drivers/bcma/driver_chipcommon.c
-+++ b/drivers/bcma/driver_chipcommon.c
-@@ -15,8 +15,6 @@
- #include <linux/platform_device.h>
- #include <linux/bcma/bcma.h>
- 
--static void bcma_chipco_serial_init(struct bcma_drv_cc *cc);
--
- static inline u32 bcma_cc_write32_masked(struct bcma_drv_cc *cc, u16 offset,
- 					 u32 mask, u32 value)
- {
-@@ -186,9 +184,6 @@ void bcma_core_chipcommon_early_init(struct bcma_drv_cc *cc)
- 	if (cc->capabilities & BCMA_CC_CAP_PMU)
- 		bcma_pmu_early_init(cc);
- 
--	if (IS_BUILTIN(CONFIG_BCM47XX) && bus->hosttype == BCMA_HOSTTYPE_SOC)
--		bcma_chipco_serial_init(cc);
--
- 	if (bus->hosttype == BCMA_HOSTTYPE_SOC)
- 		bcma_core_chipcommon_flash_detect(cc);
- 
-@@ -378,9 +373,9 @@ u32 bcma_chipco_gpio_pulldown(struct bcma_drv_cc *cc, u32 mask, u32 value)
- 	return res;
- }
- 
--static void bcma_chipco_serial_init(struct bcma_drv_cc *cc)
-+#ifdef CONFIG_BCMA_DRIVER_MIPS
-+void bcma_chipco_serial_init(struct bcma_drv_cc *cc)
- {
--#if IS_BUILTIN(CONFIG_BCM47XX)
- 	unsigned int irq;
- 	u32 baud_base;
- 	u32 i;
-@@ -422,5 +417,5 @@ static void bcma_chipco_serial_init(struct bcma_drv_cc *cc)
- 		ports[i].baud_base = baud_base;
- 		ports[i].reg_shift = 0;
- 	}
--#endif /* CONFIG_BCM47XX */
- }
-+#endif /* CONFIG_BCMA_DRIVER_MIPS */
-diff --git a/drivers/bcma/driver_mips.c b/drivers/bcma/driver_mips.c
-index 96f1713..89af807 100644
---- a/drivers/bcma/driver_mips.c
-+++ b/drivers/bcma/driver_mips.c
-@@ -278,9 +278,12 @@ static void bcma_core_mips_nvram_init(struct bcma_drv_mips *mcore)
- 
- void bcma_core_mips_early_init(struct bcma_drv_mips *mcore)
- {
-+	struct bcma_bus *bus = mcore->core->bus;
-+
- 	if (mcore->early_setup_done)
- 		return;
- 
-+	bcma_chipco_serial_init(&bus->drv_cc);
- 	bcma_core_mips_nvram_init(mcore);
- 
- 	mcore->early_setup_done = true;
-diff --git a/drivers/dma/cppi41.c b/drivers/dma/cppi41.c
-index d5ba43a..55c1782 100644
---- a/drivers/dma/cppi41.c
-+++ b/drivers/dma/cppi41.c
-@@ -153,6 +153,8 @@ struct cppi41_dd {
- 
- 	/* context for suspend/resume */
- 	unsigned int dma_tdfdq;
-+
-+	bool is_suspended;
- };
- 
- #define FIST_COMPLETION_QUEUE	93
-@@ -257,6 +259,10 @@ static struct cppi41_channel *desc_to_chan(struct cppi41_dd *cdd, u32 desc)
- 	BUG_ON(desc_num >= ALLOC_DECS_NUM);
- 	c = cdd->chan_busy[desc_num];
- 	cdd->chan_busy[desc_num] = NULL;
-+
-+	/* Usecount for chan_busy[], paired with push_desc_queue() */
-+	pm_runtime_put(cdd->ddev.dev);
-+
- 	return c;
- }
- 
-@@ -447,6 +453,15 @@ static void push_desc_queue(struct cppi41_channel *c)
- 	 */
- 	__iowmb();
- 
-+	/*
-+	 * DMA transfers can take at least 200ms to complete with USB mass
-+	 * storage connected. To prevent autosuspend timeouts, we must use
-+	 * pm_runtime_get/put() when chan_busy[] is modified. This will get
-+	 * cleared in desc_to_chan() or cppi41_stop_chan() depending on the
-+	 * outcome of the transfer.
-+	 */
-+	pm_runtime_get(cdd->ddev.dev);
-+
- 	desc_phys = lower_32_bits(c->desc_phys);
- 	desc_num = (desc_phys - cdd->descs_phys) / sizeof(struct cppi41_desc);
- 	WARN_ON(cdd->chan_busy[desc_num]);
-@@ -457,20 +472,26 @@ static void push_desc_queue(struct cppi41_channel *c)
- 	cppi_writel(reg, cdd->qmgr_mem + QMGR_QUEUE_D(c->q_num));
- }
- 
--static void pending_desc(struct cppi41_channel *c)
-+/*
-+ * Caller must hold cdd->lock to prevent push_desc_queue()
-+ * getting called out of order. We have both cppi41_dma_issue_pending()
-+ * and cppi41_runtime_resume() call this function.
-+ */
-+static void cppi41_run_queue(struct cppi41_dd *cdd)
- {
--	struct cppi41_dd *cdd = c->cdd;
--	unsigned long flags;
-+	struct cppi41_channel *c, *_c;
- 
--	spin_lock_irqsave(&cdd->lock, flags);
--	list_add_tail(&c->node, &cdd->pending);
--	spin_unlock_irqrestore(&cdd->lock, flags);
-+	list_for_each_entry_safe(c, _c, &cdd->pending, node) {
-+		push_desc_queue(c);
-+		list_del(&c->node);
-+	}
- }
- 
- static void cppi41_dma_issue_pending(struct dma_chan *chan)
- {
- 	struct cppi41_channel *c = to_cpp41_chan(chan);
- 	struct cppi41_dd *cdd = c->cdd;
-+	unsigned long flags;
- 	int error;
- 
- 	error = pm_runtime_get(cdd->ddev.dev);
-@@ -482,10 +503,11 @@ static void cppi41_dma_issue_pending(struct dma_chan *chan)
- 		return;
- 	}
- 
--	if (likely(pm_runtime_active(cdd->ddev.dev)))
--		push_desc_queue(c);
--	else
--		pending_desc(c);
-+	spin_lock_irqsave(&cdd->lock, flags);
-+	list_add_tail(&c->node, &cdd->pending);
-+	if (!cdd->is_suspended)
-+		cppi41_run_queue(cdd);
-+	spin_unlock_irqrestore(&cdd->lock, flags);
- 
- 	pm_runtime_mark_last_busy(cdd->ddev.dev);
- 	pm_runtime_put_autosuspend(cdd->ddev.dev);
-@@ -705,6 +727,9 @@ static int cppi41_stop_chan(struct dma_chan *chan)
- 	WARN_ON(!cdd->chan_busy[desc_num]);
- 	cdd->chan_busy[desc_num] = NULL;
- 
-+	/* Usecount for chan_busy[], paired with push_desc_queue() */
-+	pm_runtime_put(cdd->ddev.dev);
-+
- 	return 0;
- }
- 
-@@ -1150,8 +1175,12 @@ static int __maybe_unused cppi41_resume(struct device *dev)
- static int __maybe_unused cppi41_runtime_suspend(struct device *dev)
- {
- 	struct cppi41_dd *cdd = dev_get_drvdata(dev);
-+	unsigned long flags;
- 
-+	spin_lock_irqsave(&cdd->lock, flags);
-+	cdd->is_suspended = true;
- 	WARN_ON(!list_empty(&cdd->pending));
-+	spin_unlock_irqrestore(&cdd->lock, flags);
- 
- 	return 0;
- }
-@@ -1159,14 +1188,11 @@ static int __maybe_unused cppi41_runtime_suspend(struct device *dev)
- static int __maybe_unused cppi41_runtime_resume(struct device *dev)
- {
- 	struct cppi41_dd *cdd = dev_get_drvdata(dev);
--	struct cppi41_channel *c, *_c;
- 	unsigned long flags;
- 
- 	spin_lock_irqsave(&cdd->lock, flags);
--	list_for_each_entry_safe(c, _c, &cdd->pending, node) {
--		push_desc_queue(c);
--		list_del(&c->node);
--	}
-+	cdd->is_suspended = false;
-+	cppi41_run_queue(cdd);
- 	spin_unlock_irqrestore(&cdd->lock, flags);
- 
- 	return 0;
-diff --git a/drivers/firmware/efi/libstub/fdt.c b/drivers/firmware/efi/libstub/fdt.c
-index 921dfa0..260c4b4 100644
---- a/drivers/firmware/efi/libstub/fdt.c
-+++ b/drivers/firmware/efi/libstub/fdt.c
-@@ -187,6 +187,7 @@ static efi_status_t update_fdt_memmap(void *fdt, struct efi_boot_memmap *map)
- struct exit_boot_struct {
- 	efi_memory_desc_t *runtime_map;
- 	int *runtime_entry_count;
-+	void *new_fdt_addr;
- };
- 
- static efi_status_t exit_boot_func(efi_system_table_t *sys_table_arg,
-@@ -202,7 +203,7 @@ static efi_status_t exit_boot_func(efi_system_table_t *sys_table_arg,
- 	efi_get_virtmap(*map->map, *map->map_size, *map->desc_size,
- 			p->runtime_map, p->runtime_entry_count);
- 
--	return EFI_SUCCESS;
-+	return update_fdt_memmap(p->new_fdt_addr, map);
- }
- 
- /*
-@@ -300,22 +301,13 @@ efi_status_t allocate_new_fdt_and_exit_boot(efi_system_table_t *sys_table,
- 
- 	priv.runtime_map = runtime_map;
- 	priv.runtime_entry_count = &runtime_entry_count;
-+	priv.new_fdt_addr = (void *)*new_fdt_addr;
- 	status = efi_exit_boot_services(sys_table, handle, &map, &priv,
- 					exit_boot_func);
- 
- 	if (status == EFI_SUCCESS) {
- 		efi_set_virtual_address_map_t *svam;
- 
--		status = update_fdt_memmap((void *)*new_fdt_addr, &map);
--		if (status != EFI_SUCCESS) {
--			/*
--			 * The kernel won't get far without the memory map, but
--			 * may still be able to print something meaningful so
--			 * return success here.
--			 */
--			return EFI_SUCCESS;
--		}
--
- 		/* Install the new virtual address map */
- 		svam = sys_table->runtime->set_virtual_address_map;
- 		status = svam(runtime_entry_count * desc_size, desc_size,
-diff --git a/drivers/gpu/drm/amd/amdgpu/gmc_v6_0.c b/drivers/gpu/drm/amd/amdgpu/gmc_v6_0.c
-index b13c8aa..6df924f 100644
---- a/drivers/gpu/drm/amd/amdgpu/gmc_v6_0.c
-+++ b/drivers/gpu/drm/amd/amdgpu/gmc_v6_0.c
-@@ -227,6 +227,9 @@ static void gmc_v6_0_mc_program(struct amdgpu_device *adev)
- 	}
- 	WREG32(HDP_REG_COHERENCY_FLUSH_CNTL, 0);
- 
-+	if (adev->mode_info.num_crtc)
-+		amdgpu_display_set_vga_render_state(adev, false);
-+
- 	gmc_v6_0_mc_stop(adev, &save);
- 
- 	if (gmc_v6_0_wait_for_idle((void *)adev)) {
-@@ -256,7 +259,6 @@ static void gmc_v6_0_mc_program(struct amdgpu_device *adev)
- 		dev_warn(adev->dev, "Wait for MC idle timedout !\n");
- 	}
- 	gmc_v6_0_mc_resume(adev, &save);
--	amdgpu_display_set_vga_render_state(adev, false);
- }
- 
- static int gmc_v6_0_mc_init(struct amdgpu_device *adev)
-diff --git a/drivers/gpu/drm/i915/intel_lrc.c b/drivers/gpu/drm/i915/intel_lrc.c
-index 67db157..4147e51 100644
---- a/drivers/gpu/drm/i915/intel_lrc.c
-+++ b/drivers/gpu/drm/i915/intel_lrc.c
-@@ -2152,30 +2152,42 @@ static int execlists_context_deferred_alloc(struct i915_gem_context *ctx,
- 
- void intel_lr_context_resume(struct drm_i915_private *dev_priv)
- {
--	struct i915_gem_context *ctx = dev_priv->kernel_context;
- 	struct intel_engine_cs *engine;
-+	struct i915_gem_context *ctx;
-+
-+	/* Because we emit WA_TAIL_DWORDS there may be a disparity
-+	 * between our bookkeeping in ce->ring->head and ce->ring->tail and
-+	 * that stored in context. As we only write new commands from
-+	 * ce->ring->tail onwards, everything before that is junk. If the GPU
-+	 * starts reading from its RING_HEAD from the context, it may try to
-+	 * execute that junk and die.
-+	 *
-+	 * So to avoid that we reset the context images upon resume. For
-+	 * simplicity, we just zero everything out.
-+	 */
-+	list_for_each_entry(ctx, &dev_priv->context_list, link) {
-+		for_each_engine(engine, dev_priv) {
-+			struct intel_context *ce = &ctx->engine[engine->id];
-+			u32 *reg;
- 
--	for_each_engine(engine, dev_priv) {
--		struct intel_context *ce = &ctx->engine[engine->id];
--		void *vaddr;
--		uint32_t *reg_state;
--
--		if (!ce->state)
--			continue;
--
--		vaddr = i915_gem_object_pin_map(ce->state->obj, I915_MAP_WB);
--		if (WARN_ON(IS_ERR(vaddr)))
--			continue;
-+			if (!ce->state)
-+				continue;
- 
--		reg_state = vaddr + LRC_STATE_PN * PAGE_SIZE;
-+			reg = i915_gem_object_pin_map(ce->state->obj,
-+						      I915_MAP_WB);
-+			if (WARN_ON(IS_ERR(reg)))
-+				continue;
- 
--		reg_state[CTX_RING_HEAD+1] = 0;
--		reg_state[CTX_RING_TAIL+1] = 0;
-+			reg += LRC_STATE_PN * PAGE_SIZE / sizeof(*reg);
-+			reg[CTX_RING_HEAD+1] = 0;
-+			reg[CTX_RING_TAIL+1] = 0;
- 
--		ce->state->obj->dirty = true;
--		i915_gem_object_unpin_map(ce->state->obj);
-+			ce->state->obj->dirty = true;
-+			i915_gem_object_unpin_map(ce->state->obj);
- 
--		ce->ring->head = 0;
--		ce->ring->tail = 0;
-+			ce->ring->head = ce->ring->tail = 0;
-+			ce->ring->last_retired_head = -1;
-+			intel_ring_update_space(ce->ring);
-+		}
- 	}
- }
-diff --git a/drivers/gpu/drm/nouveau/dispnv04/hw.c b/drivers/gpu/drm/nouveau/dispnv04/hw.c
-index 74856a8..e64f524 100644
---- a/drivers/gpu/drm/nouveau/dispnv04/hw.c
-+++ b/drivers/gpu/drm/nouveau/dispnv04/hw.c
-@@ -222,6 +222,7 @@ nouveau_hw_get_clock(struct drm_device *dev, enum nvbios_pll_type plltype)
- 		uint32_t mpllP;
- 
- 		pci_read_config_dword(pci_get_bus_and_slot(0, 3), 0x6c, &mpllP);
-+		mpllP = (mpllP >> 8) & 0xf;
- 		if (!mpllP)
- 			mpllP = 4;
- 
-@@ -232,7 +233,7 @@ nouveau_hw_get_clock(struct drm_device *dev, enum nvbios_pll_type plltype)
- 		uint32_t clock;
- 
- 		pci_read_config_dword(pci_get_bus_and_slot(0, 5), 0x4c, &clock);
--		return clock;
-+		return clock / 1000;
- 	}
- 
- 	ret = nouveau_hw_get_pllvals(dev, plltype, &pllvals);
-diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/disp/hdagt215.c b/drivers/gpu/drm/nouveau/nvkm/engine/disp/hdagt215.c
-index 6f0436d..f8f2f16 100644
---- a/drivers/gpu/drm/nouveau/nvkm/engine/disp/hdagt215.c
-+++ b/drivers/gpu/drm/nouveau/nvkm/engine/disp/hdagt215.c
-@@ -59,7 +59,7 @@ gt215_hda_eld(NV50_DISP_MTHD_V1)
- 			);
- 		}
- 		for (i = 0; i < size; i++)
--			nvkm_wr32(device, 0x61c440 + soff, (i << 8) | args->v0.data[0]);
-+			nvkm_wr32(device, 0x61c440 + soff, (i << 8) | args->v0.data[i]);
- 		for (; i < 0x60; i++)
- 			nvkm_wr32(device, 0x61c440 + soff, (i << 8));
- 		nvkm_mask(device, 0x61c448 + soff, 0x80000003, 0x80000003);
-diff --git a/drivers/hid/hid-cp2112.c b/drivers/hid/hid-cp2112.c
-index 60d3020..e06c134 100644
---- a/drivers/hid/hid-cp2112.c
-+++ b/drivers/hid/hid-cp2112.c
-@@ -167,7 +167,7 @@ struct cp2112_device {
- 	atomic_t xfer_avail;
- 	struct gpio_chip gc;
- 	u8 *in_out_buffer;
--	spinlock_t lock;
-+	struct mutex lock;
- };
- 
- static int gpio_push_pull = 0xFF;
-@@ -179,10 +179,9 @@ static int cp2112_gpio_direction_input(struct gpio_chip *chip, unsigned offset)
- 	struct cp2112_device *dev = gpiochip_get_data(chip);
- 	struct hid_device *hdev = dev->hdev;
- 	u8 *buf = dev->in_out_buffer;
--	unsigned long flags;
- 	int ret;
- 
--	spin_lock_irqsave(&dev->lock, flags);
-+	mutex_lock(&dev->lock);
- 
- 	ret = hid_hw_raw_request(hdev, CP2112_GPIO_CONFIG, buf,
- 				 CP2112_GPIO_CONFIG_LENGTH, HID_FEATURE_REPORT,
-@@ -206,8 +205,8 @@ static int cp2112_gpio_direction_input(struct gpio_chip *chip, unsigned offset)
- 	ret = 0;
- 
- exit:
--	spin_unlock_irqrestore(&dev->lock, flags);
--	return ret <= 0 ? ret : -EIO;
-+	mutex_unlock(&dev->lock);
-+	return ret < 0 ? ret : -EIO;
- }
- 
- static void cp2112_gpio_set(struct gpio_chip *chip, unsigned offset, int value)
-@@ -215,10 +214,9 @@ static void cp2112_gpio_set(struct gpio_chip *chip, unsigned offset, int value)
- 	struct cp2112_device *dev = gpiochip_get_data(chip);
- 	struct hid_device *hdev = dev->hdev;
- 	u8 *buf = dev->in_out_buffer;
--	unsigned long flags;
- 	int ret;
- 
--	spin_lock_irqsave(&dev->lock, flags);
-+	mutex_lock(&dev->lock);
- 
- 	buf[0] = CP2112_GPIO_SET;
- 	buf[1] = value ? 0xff : 0;
-@@ -230,7 +228,7 @@ static void cp2112_gpio_set(struct gpio_chip *chip, unsigned offset, int value)
- 	if (ret < 0)
- 		hid_err(hdev, "error setting GPIO values: %d\n", ret);
- 
--	spin_unlock_irqrestore(&dev->lock, flags);
-+	mutex_unlock(&dev->lock);
- }
- 
- static int cp2112_gpio_get(struct gpio_chip *chip, unsigned offset)
-@@ -238,10 +236,9 @@ static int cp2112_gpio_get(struct gpio_chip *chip, unsigned offset)
- 	struct cp2112_device *dev = gpiochip_get_data(chip);
- 	struct hid_device *hdev = dev->hdev;
- 	u8 *buf = dev->in_out_buffer;
--	unsigned long flags;
- 	int ret;
- 
--	spin_lock_irqsave(&dev->lock, flags);
-+	mutex_lock(&dev->lock);
- 
- 	ret = hid_hw_raw_request(hdev, CP2112_GPIO_GET, buf,
- 				 CP2112_GPIO_GET_LENGTH, HID_FEATURE_REPORT,
-@@ -255,7 +252,7 @@ static int cp2112_gpio_get(struct gpio_chip *chip, unsigned offset)
- 	ret = (buf[1] >> offset) & 1;
- 
- exit:
--	spin_unlock_irqrestore(&dev->lock, flags);
-+	mutex_unlock(&dev->lock);
- 
- 	return ret;
- }
-@@ -266,10 +263,9 @@ static int cp2112_gpio_direction_output(struct gpio_chip *chip,
- 	struct cp2112_device *dev = gpiochip_get_data(chip);
- 	struct hid_device *hdev = dev->hdev;
- 	u8 *buf = dev->in_out_buffer;
--	unsigned long flags;
- 	int ret;
- 
--	spin_lock_irqsave(&dev->lock, flags);
-+	mutex_lock(&dev->lock);
- 
- 	ret = hid_hw_raw_request(hdev, CP2112_GPIO_CONFIG, buf,
- 				 CP2112_GPIO_CONFIG_LENGTH, HID_FEATURE_REPORT,
-@@ -290,7 +286,7 @@ static int cp2112_gpio_direction_output(struct gpio_chip *chip,
- 		goto fail;
- 	}
- 
--	spin_unlock_irqrestore(&dev->lock, flags);
-+	mutex_unlock(&dev->lock);
- 
- 	/*
- 	 * Set gpio value when output direction is already set,
-@@ -301,7 +297,7 @@ static int cp2112_gpio_direction_output(struct gpio_chip *chip,
- 	return 0;
- 
- fail:
--	spin_unlock_irqrestore(&dev->lock, flags);
-+	mutex_unlock(&dev->lock);
- 	return ret < 0 ? ret : -EIO;
- }
- 
-@@ -1057,7 +1053,7 @@ static int cp2112_probe(struct hid_device *hdev, const struct hid_device_id *id)
- 	if (!dev->in_out_buffer)
- 		return -ENOMEM;
- 
--	spin_lock_init(&dev->lock);
-+	mutex_init(&dev->lock);
- 
- 	ret = hid_parse(hdev);
- 	if (ret) {
-diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
-index 575aa65..9845189 100644
---- a/drivers/hid/hid-ids.h
-+++ b/drivers/hid/hid-ids.h
-@@ -76,6 +76,9 @@
- #define USB_VENDOR_ID_ALPS_JP		0x044E
- #define HID_DEVICE_ID_ALPS_U1_DUAL	0x120B
- 
-+#define USB_VENDOR_ID_AMI		0x046b
-+#define USB_DEVICE_ID_AMI_VIRT_KEYBOARD_AND_MOUSE	0xff10
-+
- #define USB_VENDOR_ID_ANTON		0x1130
- #define USB_DEVICE_ID_ANTON_TOUCH_PAD	0x3101
- 
-diff --git a/drivers/hid/hid-lg.c b/drivers/hid/hid-lg.c
-index c5c5fbe..52026dc 100644
---- a/drivers/hid/hid-lg.c
-+++ b/drivers/hid/hid-lg.c
-@@ -872,7 +872,7 @@ static const struct hid_device_id lg_devices[] = {
- 	{ HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_WINGMAN_FFG),
- 		.driver_data = LG_NOGET | LG_FF4 },
- 	{ HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_RUMBLEPAD2),
--		.driver_data = LG_FF2 },
-+		.driver_data = LG_NOGET | LG_FF2 },
- 	{ HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_FLIGHT_SYSTEM_G940),
- 		.driver_data = LG_FF3 },
- 	{ HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_SPACENAVIGATOR),
-diff --git a/drivers/hid/usbhid/hid-quirks.c b/drivers/hid/usbhid/hid-quirks.c
-index e6cfd32..cde060f 100644
---- a/drivers/hid/usbhid/hid-quirks.c
-+++ b/drivers/hid/usbhid/hid-quirks.c
-@@ -57,6 +57,7 @@ static const struct hid_blacklist {
- 	{ USB_VENDOR_ID_AIREN, USB_DEVICE_ID_AIREN_SLIMPLUS, HID_QUIRK_NOGET },
- 	{ USB_VENDOR_ID_AKAI, USB_DEVICE_ID_AKAI_MPKMINI2, HID_QUIRK_NO_INIT_REPORTS },
- 	{ USB_VENDOR_ID_AKAI_09E8, USB_DEVICE_ID_AKAI_09E8_MIDIMIX, HID_QUIRK_NO_INIT_REPORTS },
-+	{ USB_VENDOR_ID_AMI, USB_DEVICE_ID_AMI_VIRT_KEYBOARD_AND_MOUSE, HID_QUIRK_ALWAYS_POLL },
- 	{ USB_VENDOR_ID_ATEN, USB_DEVICE_ID_ATEN_UC100KM, HID_QUIRK_NOGET },
- 	{ USB_VENDOR_ID_ATEN, USB_DEVICE_ID_ATEN_CS124U, HID_QUIRK_NOGET },
- 	{ USB_VENDOR_ID_ATEN, USB_DEVICE_ID_ATEN_2PORTKVM, HID_QUIRK_NOGET },
-diff --git a/drivers/hid/wacom_wac.c b/drivers/hid/wacom_wac.c
-index 1cb7992..623be90 100644
---- a/drivers/hid/wacom_wac.c
-+++ b/drivers/hid/wacom_wac.c
-@@ -164,19 +164,21 @@ static int wacom_pl_irq(struct wacom_wac *wacom)
- 		wacom->id[0] = STYLUS_DEVICE_ID;
- 	}
- 
--	pressure = (signed char)((data[7] << 1) | ((data[4] >> 2) & 1));
--	if (features->pressure_max > 255)
--		pressure = (pressure << 1) | ((data[4] >> 6) & 1);
--	pressure += (features->pressure_max + 1) / 2;
--
--	input_report_abs(input, ABS_X, data[3] | (data[2] << 7) | ((data[1] & 0x03) << 14));
--	input_report_abs(input, ABS_Y, data[6] | (data[5] << 7) | ((data[4] & 0x03) << 14));
--	input_report_abs(input, ABS_PRESSURE, pressure);
--
--	input_report_key(input, BTN_TOUCH, data[4] & 0x08);
--	input_report_key(input, BTN_STYLUS, data[4] & 0x10);
--	/* Only allow the stylus2 button to be reported for the pen tool. */
--	input_report_key(input, BTN_STYLUS2, (wacom->tool[0] == BTN_TOOL_PEN) && (data[4] & 0x20));
-+	if (prox) {
-+		pressure = (signed char)((data[7] << 1) | ((data[4] >> 2) & 1));
-+		if (features->pressure_max > 255)
-+			pressure = (pressure << 1) | ((data[4] >> 6) & 1);
-+		pressure += (features->pressure_max + 1) / 2;
-+
-+		input_report_abs(input, ABS_X, data[3] | (data[2] << 7) | ((data[1] & 0x03) << 14));
-+		input_report_abs(input, ABS_Y, data[6] | (data[5] << 7) | ((data[4] & 0x03) << 14));
-+		input_report_abs(input, ABS_PRESSURE, pressure);
-+
-+		input_report_key(input, BTN_TOUCH, data[4] & 0x08);
-+		input_report_key(input, BTN_STYLUS, data[4] & 0x10);
-+		/* Only allow the stylus2 button to be reported for the pen tool. */
-+		input_report_key(input, BTN_STYLUS2, (wacom->tool[0] == BTN_TOOL_PEN) && (data[4] & 0x20));
-+	}
- 
- 	if (!prox)
- 		wacom->id[0] = 0;
-diff --git a/drivers/iio/adc/palmas_gpadc.c b/drivers/iio/adc/palmas_gpadc.c
-index 2bbf0c5..7d61b56 100644
---- a/drivers/iio/adc/palmas_gpadc.c
-+++ b/drivers/iio/adc/palmas_gpadc.c
-@@ -775,7 +775,7 @@ static int palmas_adc_wakeup_reset(struct palmas_gpadc *adc)
- 
- static int palmas_gpadc_suspend(struct device *dev)
- {
--	struct iio_dev *indio_dev = dev_to_iio_dev(dev);
-+	struct iio_dev *indio_dev = dev_get_drvdata(dev);
- 	struct palmas_gpadc *adc = iio_priv(indio_dev);
- 	int wakeup = adc->wakeup1_enable || adc->wakeup2_enable;
- 	int ret;
-@@ -798,7 +798,7 @@ static int palmas_gpadc_suspend(struct device *dev)
- 
- static int palmas_gpadc_resume(struct device *dev)
- {
--	struct iio_dev *indio_dev = dev_to_iio_dev(dev);
-+	struct iio_dev *indio_dev = dev_get_drvdata(dev);
- 	struct palmas_gpadc *adc = iio_priv(indio_dev);
- 	int wakeup = adc->wakeup1_enable || adc->wakeup2_enable;
- 	int ret;
-diff --git a/drivers/iio/health/afe4403.c b/drivers/iio/health/afe4403.c
-index 9a08146..6bb23a4 100644
---- a/drivers/iio/health/afe4403.c
-+++ b/drivers/iio/health/afe4403.c
-@@ -422,7 +422,7 @@ MODULE_DEVICE_TABLE(of, afe4403_of_match);
- 
- static int __maybe_unused afe4403_suspend(struct device *dev)
- {
--	struct iio_dev *indio_dev = dev_to_iio_dev(dev);
-+	struct iio_dev *indio_dev = spi_get_drvdata(to_spi_device(dev));
- 	struct afe4403_data *afe = iio_priv(indio_dev);
- 	int ret;
- 
-@@ -443,7 +443,7 @@ static int __maybe_unused afe4403_suspend(struct device *dev)
- 
- static int __maybe_unused afe4403_resume(struct device *dev)
- {
--	struct iio_dev *indio_dev = dev_to_iio_dev(dev);
-+	struct iio_dev *indio_dev = spi_get_drvdata(to_spi_device(dev));
- 	struct afe4403_data *afe = iio_priv(indio_dev);
- 	int ret;
- 
-diff --git a/drivers/iio/health/afe4404.c b/drivers/iio/health/afe4404.c
-index 4526640..964f523 100644
---- a/drivers/iio/health/afe4404.c
-+++ b/drivers/iio/health/afe4404.c
-@@ -428,7 +428,7 @@ MODULE_DEVICE_TABLE(of, afe4404_of_match);
- 
- static int __maybe_unused afe4404_suspend(struct device *dev)
- {
--	struct iio_dev *indio_dev = dev_to_iio_dev(dev);
-+	struct iio_dev *indio_dev = i2c_get_clientdata(to_i2c_client(dev));
- 	struct afe4404_data *afe = iio_priv(indio_dev);
- 	int ret;
- 
-@@ -449,7 +449,7 @@ static int __maybe_unused afe4404_suspend(struct device *dev)
- 
- static int __maybe_unused afe4404_resume(struct device *dev)
- {
--	struct iio_dev *indio_dev = dev_to_iio_dev(dev);
-+	struct iio_dev *indio_dev = i2c_get_clientdata(to_i2c_client(dev));
- 	struct afe4404_data *afe = iio_priv(indio_dev);
- 	int ret;
- 
-diff --git a/drivers/iio/health/max30100.c b/drivers/iio/health/max30100.c
-index 90ab8a2d..183c143 100644
---- a/drivers/iio/health/max30100.c
-+++ b/drivers/iio/health/max30100.c
-@@ -238,7 +238,7 @@ static irqreturn_t max30100_interrupt_handler(int irq, void *private)
- 
- 	mutex_lock(&data->lock);
- 
--	while (cnt || (cnt = max30100_fifo_count(data) > 0)) {
-+	while (cnt || (cnt = max30100_fifo_count(data)) > 0) {
- 		ret = max30100_read_measurement(data);
- 		if (ret)
- 			break;
-diff --git a/drivers/iio/humidity/dht11.c b/drivers/iio/humidity/dht11.c
-index 9c47bc9..2a22ad9 100644
---- a/drivers/iio/humidity/dht11.c
-+++ b/drivers/iio/humidity/dht11.c
-@@ -71,7 +71,8 @@
-  * a) select an implementation using busy loop polling on those systems
-  * b) use the checksum to do some probabilistic decoding
-  */
--#define DHT11_START_TRANSMISSION	18  /* ms */
-+#define DHT11_START_TRANSMISSION_MIN	18000  /* us */
-+#define DHT11_START_TRANSMISSION_MAX	20000  /* us */
- #define DHT11_MIN_TIMERES	34000  /* ns */
- #define DHT11_THRESHOLD		49000  /* ns */
- #define DHT11_AMBIG_LOW		23000  /* ns */
-@@ -228,7 +229,8 @@ static int dht11_read_raw(struct iio_dev *iio_dev,
- 		ret = gpio_direction_output(dht11->gpio, 0);
- 		if (ret)
- 			goto err;
--		msleep(DHT11_START_TRANSMISSION);
-+		usleep_range(DHT11_START_TRANSMISSION_MIN,
-+			     DHT11_START_TRANSMISSION_MAX);
- 		ret = gpio_direction_input(dht11->gpio);
- 		if (ret)
- 			goto err;
-diff --git a/drivers/infiniband/hw/cxgb4/qp.c b/drivers/infiniband/hw/cxgb4/qp.c
-index bb0fde6..cc2243f 100644
---- a/drivers/infiniband/hw/cxgb4/qp.c
-+++ b/drivers/infiniband/hw/cxgb4/qp.c
-@@ -321,7 +321,8 @@ static int create_qp(struct c4iw_rdev *rdev, struct t4_wq *wq,
- 		FW_RI_RES_WR_DCAEN_V(0) |
- 		FW_RI_RES_WR_DCACPU_V(0) |
- 		FW_RI_RES_WR_FBMIN_V(2) |
--		FW_RI_RES_WR_FBMAX_V(2) |
-+		(t4_sq_onchip(&wq->sq) ? FW_RI_RES_WR_FBMAX_V(2) :
-+					 FW_RI_RES_WR_FBMAX_V(3)) |
- 		FW_RI_RES_WR_CIDXFTHRESHO_V(0) |
- 		FW_RI_RES_WR_CIDXFTHRESH_V(0) |
- 		FW_RI_RES_WR_EQSIZE_V(eqsize));
-@@ -345,7 +346,7 @@ static int create_qp(struct c4iw_rdev *rdev, struct t4_wq *wq,
- 		FW_RI_RES_WR_DCAEN_V(0) |
- 		FW_RI_RES_WR_DCACPU_V(0) |
- 		FW_RI_RES_WR_FBMIN_V(2) |
--		FW_RI_RES_WR_FBMAX_V(2) |
-+		FW_RI_RES_WR_FBMAX_V(3) |
- 		FW_RI_RES_WR_CIDXFTHRESHO_V(0) |
- 		FW_RI_RES_WR_CIDXFTHRESH_V(0) |
- 		FW_RI_RES_WR_EQSIZE_V(eqsize));
-diff --git a/drivers/mmc/host/sdhci.c b/drivers/mmc/host/sdhci.c
-index e1e274a..ba637ff 100644
---- a/drivers/mmc/host/sdhci.c
-+++ b/drivers/mmc/host/sdhci.c
-@@ -2719,7 +2719,8 @@ static irqreturn_t sdhci_irq(int irq, void *dev_id)
- 		if (intmask & SDHCI_INT_RETUNE)
- 			mmc_retune_needed(host->mmc);
- 
--		if (intmask & SDHCI_INT_CARD_INT) {
-+		if ((intmask & SDHCI_INT_CARD_INT) &&
-+		    (host->ier & SDHCI_INT_CARD_INT)) {
- 			sdhci_enable_sdio_irq_nolock(host, false);
- 			host->thread_isr |= SDHCI_INT_CARD_INT;
- 			result = IRQ_WAKE_THREAD;
-diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-8000.c b/drivers/net/wireless/intel/iwlwifi/iwl-8000.c
-index d02ca14..8d3e53f 100644
---- a/drivers/net/wireless/intel/iwlwifi/iwl-8000.c
-+++ b/drivers/net/wireless/intel/iwlwifi/iwl-8000.c
-@@ -91,7 +91,7 @@
- 
- #define IWL8000_FW_PRE "iwlwifi-8000C-"
- #define IWL8000_MODULE_FIRMWARE(api) \
--	IWL8000_FW_PRE "-" __stringify(api) ".ucode"
-+	IWL8000_FW_PRE __stringify(api) ".ucode"
- 
- #define IWL8265_FW_PRE "iwlwifi-8265-"
- #define IWL8265_MODULE_FIRMWARE(api) \
-diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/sta.c b/drivers/net/wireless/intel/iwlwifi/mvm/sta.c
-index fc77188..52de3c6 100644
---- a/drivers/net/wireless/intel/iwlwifi/mvm/sta.c
-+++ b/drivers/net/wireless/intel/iwlwifi/mvm/sta.c
-@@ -1144,9 +1144,10 @@ static void iwl_mvm_realloc_queues_after_restart(struct iwl_mvm *mvm,
- 		.frame_limit = IWL_FRAME_LIMIT,
- 	};
- 
--	/* Make sure reserved queue is still marked as such (or allocated) */
--	mvm->queue_info[mvm_sta->reserved_queue].status =
--		IWL_MVM_QUEUE_RESERVED;
-+	/* Make sure reserved queue is still marked as such (if allocated) */
-+	if (mvm_sta->reserved_queue != IEEE80211_INVAL_HW_QUEUE)
-+		mvm->queue_info[mvm_sta->reserved_queue].status =
-+			IWL_MVM_QUEUE_RESERVED;
- 
- 	for (i = 0; i <= IWL_MAX_TID_COUNT; i++) {
- 		struct iwl_mvm_tid_data *tid_data = &mvm_sta->tid_data[i];
-diff --git a/drivers/pci/pcie/aspm.c b/drivers/pci/pcie/aspm.c
-index 0ec649d..b0916b1 100644
---- a/drivers/pci/pcie/aspm.c
-+++ b/drivers/pci/pcie/aspm.c
-@@ -518,25 +518,32 @@ static struct pcie_link_state *alloc_pcie_link_state(struct pci_dev *pdev)
- 	link = kzalloc(sizeof(*link), GFP_KERNEL);
- 	if (!link)
- 		return NULL;
-+
- 	INIT_LIST_HEAD(&link->sibling);
- 	INIT_LIST_HEAD(&link->children);
- 	INIT_LIST_HEAD(&link->link);
- 	link->pdev = pdev;
--	if (pci_pcie_type(pdev) != PCI_EXP_TYPE_ROOT_PORT) {
-+
-+	/*
-+	 * Root Ports and PCI/PCI-X to PCIe Bridges are roots of PCIe
-+	 * hierarchies.
-+	 */
-+	if (pci_pcie_type(pdev) == PCI_EXP_TYPE_ROOT_PORT ||
-+	    pci_pcie_type(pdev) == PCI_EXP_TYPE_PCIE_BRIDGE) {
-+		link->root = link;
-+	} else {
- 		struct pcie_link_state *parent;
-+
- 		parent = pdev->bus->parent->self->link_state;
- 		if (!parent) {
- 			kfree(link);
- 			return NULL;
- 		}
-+
- 		link->parent = parent;
-+		link->root = link->parent->root;
- 		list_add(&link->link, &parent->children);
- 	}
--	/* Setup a pointer to the root port link */
--	if (!link->parent)
--		link->root = link;
--	else
--		link->root = link->parent->root;
- 
- 	list_add(&link->sibling, &link_list);
- 	pdev->link_state = link;
-diff --git a/drivers/pinctrl/intel/pinctrl-baytrail.c b/drivers/pinctrl/intel/pinctrl-baytrail.c
-index 0790153..583ae3f 100644
---- a/drivers/pinctrl/intel/pinctrl-baytrail.c
-+++ b/drivers/pinctrl/intel/pinctrl-baytrail.c
-@@ -731,16 +731,23 @@ static void __iomem *byt_gpio_reg(struct byt_gpio *vg, unsigned int offset,
- 				  int reg)
- {
- 	struct byt_community *comm = byt_get_community(vg, offset);
--	u32 reg_offset = 0;
-+	u32 reg_offset;
- 
- 	if (!comm)
- 		return NULL;
- 
- 	offset -= comm->pin_base;
--	if (reg == BYT_INT_STAT_REG)
-+	switch (reg) {
-+	case BYT_INT_STAT_REG:
- 		reg_offset = (offset / 32) * 4;
--	else
-+		break;
-+	case BYT_DEBOUNCE_REG:
-+		reg_offset = 0;
-+		break;
-+	default:
- 		reg_offset = comm->pad_map[offset] * 16;
-+		break;
-+	}
- 
- 	return comm->reg_base + reg_offset + reg;
- }
-@@ -1612,7 +1619,9 @@ static void byt_gpio_irq_handler(struct irq_desc *desc)
- 			continue;
- 		}
- 
-+		raw_spin_lock(&vg->lock);
- 		pending = readl(reg);
-+		raw_spin_unlock(&vg->lock);
- 		for_each_set_bit(pin, &pending, 32) {
- 			virq = irq_find_mapping(vg->chip.irqdomain, base + pin);
- 			generic_handle_irq(virq);
-diff --git a/drivers/pinctrl/intel/pinctrl-merrifield.c b/drivers/pinctrl/intel/pinctrl-merrifield.c
-index 7826c7f..9931be6 100644
---- a/drivers/pinctrl/intel/pinctrl-merrifield.c
-+++ b/drivers/pinctrl/intel/pinctrl-merrifield.c
-@@ -794,6 +794,9 @@ static int mrfld_config_set(struct pinctrl_dev *pctldev, unsigned int pin,
- 	unsigned int i;
- 	int ret;
- 
-+	if (!mrfld_buf_available(mp, pin))
-+		return -ENOTSUPP;
-+
- 	for (i = 0; i < nconfigs; i++) {
- 		switch (pinconf_to_config_param(configs[i])) {
- 		case PIN_CONFIG_BIAS_DISABLE:
-diff --git a/drivers/regulator/axp20x-regulator.c b/drivers/regulator/axp20x-regulator.c
-index e6a512e..a3ade9e 100644
---- a/drivers/regulator/axp20x-regulator.c
-+++ b/drivers/regulator/axp20x-regulator.c
-@@ -272,7 +272,7 @@ static const struct regulator_desc axp806_regulators[] = {
- 			64, AXP806_DCDCD_V_CTRL, 0x3f, AXP806_PWR_OUT_CTRL1,
- 			BIT(3)),
- 	AXP_DESC(AXP806, DCDCE, "dcdce", "vine", 1100, 3400, 100,
--		 AXP806_DCDCB_V_CTRL, 0x1f, AXP806_PWR_OUT_CTRL1, BIT(4)),
-+		 AXP806_DCDCE_V_CTRL, 0x1f, AXP806_PWR_OUT_CTRL1, BIT(4)),
- 	AXP_DESC(AXP806, ALDO1, "aldo1", "aldoin", 700, 3300, 100,
- 		 AXP806_ALDO1_V_CTRL, 0x1f, AXP806_PWR_OUT_CTRL1, BIT(5)),
- 	AXP_DESC(AXP806, ALDO2, "aldo2", "aldoin", 700, 3400, 100,
-diff --git a/drivers/staging/greybus/timesync_platform.c b/drivers/staging/greybus/timesync_platform.c
-index 113f3d6..27f75b1 100644
---- a/drivers/staging/greybus/timesync_platform.c
-+++ b/drivers/staging/greybus/timesync_platform.c
-@@ -45,12 +45,18 @@ u32 gb_timesync_platform_get_clock_rate(void)
- 
- int gb_timesync_platform_lock_bus(struct gb_timesync_svc *pdata)
- {
-+	if (!arche_platform_change_state_cb)
-+		return 0;
-+
- 	return arche_platform_change_state_cb(ARCHE_PLATFORM_STATE_TIME_SYNC,
- 					      pdata);
- }
- 
- void gb_timesync_platform_unlock_bus(void)
- {
-+	if (!arche_platform_change_state_cb)
-+		return;
-+
- 	arche_platform_change_state_cb(ARCHE_PLATFORM_STATE_ACTIVE, NULL);
- }
- 
-diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c
-index d2e50a2..24f9f98 100644
---- a/drivers/usb/core/quirks.c
-+++ b/drivers/usb/core/quirks.c
-@@ -37,6 +37,10 @@ static const struct usb_device_id usb_quirk_list[] = {
- 	/* CBM - Flash disk */
- 	{ USB_DEVICE(0x0204, 0x6025), .driver_info = USB_QUIRK_RESET_RESUME },
- 
-+	/* WORLDE easy key (easykey.25) MIDI controller  */
-+	{ USB_DEVICE(0x0218, 0x0401), .driver_info =
-+			USB_QUIRK_CONFIG_INTF_STRINGS },
-+
- 	/* HP 5300/5370C scanner */
- 	{ USB_DEVICE(0x03f0, 0x0701), .driver_info =
- 			USB_QUIRK_STRING_FETCH_255 },
-diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c
-index 17989b7..8d412d8 100644
---- a/drivers/usb/gadget/function/f_fs.c
-+++ b/drivers/usb/gadget/function/f_fs.c
-@@ -2269,6 +2269,8 @@ static int __ffs_data_do_os_desc(enum ffs_os_desc_type type,
- 		if (len < sizeof(*d) || h->interface >= ffs->interfaces_count)
- 			return -EINVAL;
- 		length = le32_to_cpu(d->dwSize);
-+		if (len < length)
-+			return -EINVAL;
- 		type = le32_to_cpu(d->dwPropertyDataType);
- 		if (type < USB_EXT_PROP_UNICODE ||
- 		    type > USB_EXT_PROP_UNICODE_MULTI) {
-@@ -2277,6 +2279,11 @@ static int __ffs_data_do_os_desc(enum ffs_os_desc_type type,
- 			return -EINVAL;
- 		}
- 		pnl = le16_to_cpu(d->wPropertyNameLength);
-+		if (length < 14 + pnl) {
-+			pr_vdebug("invalid os descriptor length: %d pnl:%d (descriptor %d)\n",
-+				  length, pnl, type);
-+			return -EINVAL;
-+		}
- 		pdl = le32_to_cpu(*(u32 *)((u8 *)data + 10 + pnl));
- 		if (length != 14 + pnl + pdl) {
- 			pr_vdebug("invalid os descriptor length: %d pnl:%d pdl:%d (descriptor %d)\n",
-@@ -2363,6 +2370,9 @@ static int __ffs_data_got_descs(struct ffs_data *ffs,
- 		}
- 	}
- 	if (flags & (1 << i)) {
-+		if (len < 4) {
-+			goto error;
-+		}
- 		os_descs_count = get_unaligned_le32(data);
- 		data += 4;
- 		len -= 4;
-@@ -2435,7 +2445,8 @@ static int __ffs_data_got_strings(struct ffs_data *ffs,
- 
- 	ENTER();
- 
--	if (unlikely(get_unaligned_le32(data) != FUNCTIONFS_STRINGS_MAGIC ||
-+	if (unlikely(len < 16 ||
-+		     get_unaligned_le32(data) != FUNCTIONFS_STRINGS_MAGIC ||
- 		     get_unaligned_le32(data + 4) != len))
- 		goto error;
- 	str_count  = get_unaligned_le32(data + 8);
-diff --git a/drivers/usb/musb/musb_core.c b/drivers/usb/musb/musb_core.c
-index c3e172e..338575f 100644
---- a/drivers/usb/musb/musb_core.c
-+++ b/drivers/usb/musb/musb_core.c
-@@ -578,11 +578,11 @@ static irqreturn_t musb_stage0_irq(struct musb *musb, u8 int_usb,
- 						| MUSB_PORT_STAT_RESUME;
- 				musb->rh_timer = jiffies
- 					+ msecs_to_jiffies(USB_RESUME_TIMEOUT);
--				musb->need_finish_resume = 1;
--
- 				musb->xceiv->otg->state = OTG_STATE_A_HOST;
- 				musb->is_active = 1;
- 				musb_host_resume_root_hub(musb);
-+				schedule_delayed_work(&musb->finish_resume_work,
-+					msecs_to_jiffies(USB_RESUME_TIMEOUT));
- 				break;
- 			case OTG_STATE_B_WAIT_ACON:
- 				musb->xceiv->otg->state = OTG_STATE_B_PERIPHERAL;
-@@ -2691,11 +2691,6 @@ static int musb_resume(struct device *dev)
- 	mask = MUSB_DEVCTL_BDEVICE | MUSB_DEVCTL_FSDEV | MUSB_DEVCTL_LSDEV;
- 	if ((devctl & mask) != (musb->context.devctl & mask))
- 		musb->port1_status = 0;
--	if (musb->need_finish_resume) {
--		musb->need_finish_resume = 0;
--		schedule_delayed_work(&musb->finish_resume_work,
--				      msecs_to_jiffies(USB_RESUME_TIMEOUT));
--	}
- 
- 	/*
- 	 * The USB HUB code expects the device to be in RPM_ACTIVE once it came
-@@ -2747,12 +2742,6 @@ static int musb_runtime_resume(struct device *dev)
- 
- 	musb_restore_context(musb);
- 
--	if (musb->need_finish_resume) {
--		musb->need_finish_resume = 0;
--		schedule_delayed_work(&musb->finish_resume_work,
--				msecs_to_jiffies(USB_RESUME_TIMEOUT));
--	}
--
- 	spin_lock_irqsave(&musb->lock, flags);
- 	error = musb_run_resume_work(musb);
- 	if (error)
-diff --git a/drivers/usb/musb/musb_core.h b/drivers/usb/musb/musb_core.h
-index 47331db..854fbf7 100644
---- a/drivers/usb/musb/musb_core.h
-+++ b/drivers/usb/musb/musb_core.h
-@@ -410,7 +410,6 @@ struct musb {
- 
- 	/* is_suspended means USB B_PERIPHERAL suspend */
- 	unsigned		is_suspended:1;
--	unsigned		need_finish_resume :1;
- 
- 	/* may_wakeup means remote wakeup is enabled */
- 	unsigned		may_wakeup:1;
-diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
-index 7ce31a4..42cc72e 100644
---- a/drivers/usb/serial/option.c
-+++ b/drivers/usb/serial/option.c
-@@ -2007,6 +2007,7 @@ static const struct usb_device_id option_ids[] = {
- 	{ USB_DEVICE_AND_INTERFACE_INFO(WETELECOM_VENDOR_ID, WETELECOM_PRODUCT_WMD200, 0xff, 0xff, 0xff) },
- 	{ USB_DEVICE_AND_INTERFACE_INFO(WETELECOM_VENDOR_ID, WETELECOM_PRODUCT_6802, 0xff, 0xff, 0xff) },
- 	{ USB_DEVICE_AND_INTERFACE_INFO(WETELECOM_VENDOR_ID, WETELECOM_PRODUCT_WMD300, 0xff, 0xff, 0xff) },
-+	{ USB_DEVICE_AND_INTERFACE_INFO(0x03f0, 0x421d, 0xff, 0xff, 0xff) }, /* HP lt2523 (Novatel E371) */
- 	{ } /* Terminating entry */
- };
- MODULE_DEVICE_TABLE(usb, option_ids);
-diff --git a/drivers/usb/serial/pl2303.c b/drivers/usb/serial/pl2303.c
-index 46fca6b..1db4b61 100644
---- a/drivers/usb/serial/pl2303.c
-+++ b/drivers/usb/serial/pl2303.c
-@@ -49,6 +49,7 @@ static const struct usb_device_id id_table[] = {
- 	{ USB_DEVICE(IODATA_VENDOR_ID, IODATA_PRODUCT_ID) },
- 	{ USB_DEVICE(IODATA_VENDOR_ID, IODATA_PRODUCT_ID_RSAQ5) },
- 	{ USB_DEVICE(ATEN_VENDOR_ID, ATEN_PRODUCT_ID) },
-+	{ USB_DEVICE(ATEN_VENDOR_ID, ATEN_PRODUCT_ID2) },
- 	{ USB_DEVICE(ATEN_VENDOR_ID2, ATEN_PRODUCT_ID) },
- 	{ USB_DEVICE(ELCOM_VENDOR_ID, ELCOM_PRODUCT_ID) },
- 	{ USB_DEVICE(ELCOM_VENDOR_ID, ELCOM_PRODUCT_ID_UCSGT) },
-diff --git a/drivers/usb/serial/pl2303.h b/drivers/usb/serial/pl2303.h
-index e3b7af8..09d9be8 100644
---- a/drivers/usb/serial/pl2303.h
-+++ b/drivers/usb/serial/pl2303.h
-@@ -27,6 +27,7 @@
- #define ATEN_VENDOR_ID		0x0557
- #define ATEN_VENDOR_ID2		0x0547
- #define ATEN_PRODUCT_ID		0x2008
-+#define ATEN_PRODUCT_ID2	0x2118
- 
- #define IODATA_VENDOR_ID	0x04bb
- #define IODATA_PRODUCT_ID	0x0a03
-diff --git a/drivers/usb/serial/qcserial.c b/drivers/usb/serial/qcserial.c
-index 1bc6089..696458d 100644
---- a/drivers/usb/serial/qcserial.c
-+++ b/drivers/usb/serial/qcserial.c
-@@ -124,6 +124,7 @@ static const struct usb_device_id id_table[] = {
- 	{USB_DEVICE(0x1410, 0xa021)},	/* Novatel Gobi 3000 Composite */
- 	{USB_DEVICE(0x413c, 0x8193)},	/* Dell Gobi 3000 QDL */
- 	{USB_DEVICE(0x413c, 0x8194)},	/* Dell Gobi 3000 Composite */
-+	{USB_DEVICE(0x413c, 0x81a6)},	/* Dell DW5570 QDL (MC8805) */
- 	{USB_DEVICE(0x1199, 0x68a4)},	/* Sierra Wireless QDL */
- 	{USB_DEVICE(0x1199, 0x68a5)},	/* Sierra Wireless Modem */
- 	{USB_DEVICE(0x1199, 0x68a8)},	/* Sierra Wireless QDL */
-diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c
-index c6f2d89..64613fb 100644
---- a/drivers/vhost/vhost.c
-+++ b/drivers/vhost/vhost.c
-@@ -130,14 +130,14 @@ static long vhost_get_vring_endian(struct vhost_virtqueue *vq, u32 idx,
- 
- static void vhost_init_is_le(struct vhost_virtqueue *vq)
- {
--	if (vhost_has_feature(vq, VIRTIO_F_VERSION_1))
--		vq->is_le = true;
-+	vq->is_le = vhost_has_feature(vq, VIRTIO_F_VERSION_1)
-+		|| virtio_legacy_is_little_endian();
- }
- #endif /* CONFIG_VHOST_CROSS_ENDIAN_LEGACY */
- 
- static void vhost_reset_is_le(struct vhost_virtqueue *vq)
- {
--	vq->is_le = virtio_legacy_is_little_endian();
-+	vhost_init_is_le(vq);
- }
- 
- struct vhost_flush_struct {
-@@ -1713,10 +1713,8 @@ int vhost_vq_init_access(struct vhost_virtqueue *vq)
- 	int r;
- 	bool is_le = vq->is_le;
- 
--	if (!vq->private_data) {
--		vhost_reset_is_le(vq);
-+	if (!vq->private_data)
- 		return 0;
--	}
- 
- 	vhost_init_is_le(vq);
- 
-diff --git a/drivers/virtio/virtio_ring.c b/drivers/virtio/virtio_ring.c
-index f136048..489bfc6 100644
---- a/drivers/virtio/virtio_ring.c
-+++ b/drivers/virtio/virtio_ring.c
-@@ -159,13 +159,6 @@ static bool vring_use_dma_api(struct virtio_device *vdev)
- 	if (xen_domain())
- 		return true;
- 
--	/*
--	 * On ARM-based machines, the DMA ops will do the right thing,
--	 * so always use them with legacy devices.
--	 */
--	if (IS_ENABLED(CONFIG_ARM) || IS_ENABLED(CONFIG_ARM64))
--		return !virtio_has_feature(vdev, VIRTIO_F_VERSION_1);
--
- 	return false;
- }
- 
-diff --git a/fs/cifs/readdir.c b/fs/cifs/readdir.c
-index 8f6a2a5..a27fc87 100644
---- a/fs/cifs/readdir.c
-+++ b/fs/cifs/readdir.c
-@@ -285,6 +285,7 @@ initiate_cifs_search(const unsigned int xid, struct file *file)
- 			rc = -ENOMEM;
- 			goto error_exit;
- 		}
-+		spin_lock_init(&cifsFile->file_info_lock);
- 		file->private_data = cifsFile;
- 		cifsFile->tlink = cifs_get_tlink(tlink);
- 		tcon = tlink_tcon(tlink);
-diff --git a/fs/dax.c b/fs/dax.c
-index 014defd..bf6218d 100644
---- a/fs/dax.c
-+++ b/fs/dax.c
-@@ -1270,6 +1270,11 @@ iomap_dax_actor(struct inode *inode, loff_t pos, loff_t length, void *data,
- 		struct blk_dax_ctl dax = { 0 };
- 		ssize_t map_len;
- 
-+		if (fatal_signal_pending(current)) {
-+			ret = -EINTR;
-+			break;
-+		}
-+
- 		dax.sector = iomap->blkno +
- 			(((pos & PAGE_MASK) - iomap->offset) >> 9);
- 		dax.size = (length + offset + PAGE_SIZE - 1) & PAGE_MASK;
-diff --git a/fs/ext4/super.c b/fs/ext4/super.c
-index 478630a..bbc316d 100644
---- a/fs/ext4/super.c
-+++ b/fs/ext4/super.c
-@@ -3827,6 +3827,15 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent)
- 			(EXT4_MAX_BLOCK_FILE_PHYS / EXT4_BLOCKS_PER_GROUP(sb)));
- 	db_count = (sbi->s_groups_count + EXT4_DESC_PER_BLOCK(sb) - 1) /
- 		   EXT4_DESC_PER_BLOCK(sb);
-+	if (ext4_has_feature_meta_bg(sb)) {
-+		if (le32_to_cpu(es->s_first_meta_bg) >= db_count) {
-+			ext4_msg(sb, KERN_WARNING,
-+				 "first meta block group too large: %u "
-+				 "(group descriptor block count %u)",
-+				 le32_to_cpu(es->s_first_meta_bg), db_count);
-+			goto failed_mount;
-+		}
-+	}
- 	sbi->s_group_desc = ext4_kvmalloc(db_count *
- 					  sizeof(struct buffer_head *),
- 					  GFP_KERNEL);
-diff --git a/fs/iomap.c b/fs/iomap.c
-index a8ee8c3..814ae8f 100644
---- a/fs/iomap.c
-+++ b/fs/iomap.c
-@@ -113,6 +113,9 @@ iomap_write_begin(struct inode *inode, loff_t pos, unsigned len, unsigned flags,
- 
- 	BUG_ON(pos + len > iomap->offset + iomap->length);
- 
-+	if (fatal_signal_pending(current))
-+		return -EINTR;
-+
- 	page = grab_cache_page_write_begin(inode->i_mapping, index, flags);
- 	if (!page)
- 		return -ENOMEM;
-diff --git a/fs/nfsd/nfs4layouts.c b/fs/nfsd/nfs4layouts.c
-index 42aace4..6481369 100644
---- a/fs/nfsd/nfs4layouts.c
-+++ b/fs/nfsd/nfs4layouts.c
-@@ -223,10 +223,11 @@ nfsd4_alloc_layout_stateid(struct nfsd4_compound_state *cstate,
- 	struct nfs4_layout_stateid *ls;
- 	struct nfs4_stid *stp;
- 
--	stp = nfs4_alloc_stid(cstate->clp, nfs4_layout_stateid_cache);
-+	stp = nfs4_alloc_stid(cstate->clp, nfs4_layout_stateid_cache,
-+					nfsd4_free_layout_stateid);
- 	if (!stp)
- 		return NULL;
--	stp->sc_free = nfsd4_free_layout_stateid;
-+
- 	get_nfs4_file(fp);
- 	stp->sc_file = fp;
- 
-diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c
-index 4b4beaa..a0dee8a 100644
---- a/fs/nfsd/nfs4state.c
-+++ b/fs/nfsd/nfs4state.c
-@@ -633,8 +633,8 @@ find_or_hash_clnt_odstate(struct nfs4_file *fp, struct nfs4_clnt_odstate *new)
- 	return co;
- }
- 
--struct nfs4_stid *nfs4_alloc_stid(struct nfs4_client *cl,
--					 struct kmem_cache *slab)
-+struct nfs4_stid *nfs4_alloc_stid(struct nfs4_client *cl, struct kmem_cache *slab,
-+				  void (*sc_free)(struct nfs4_stid *))
- {
- 	struct nfs4_stid *stid;
- 	int new_id;
-@@ -650,6 +650,8 @@ struct nfs4_stid *nfs4_alloc_stid(struct nfs4_client *cl,
- 	idr_preload_end();
- 	if (new_id < 0)
- 		goto out_free;
-+
-+	stid->sc_free = sc_free;
- 	stid->sc_client = cl;
- 	stid->sc_stateid.si_opaque.so_id = new_id;
- 	stid->sc_stateid.si_opaque.so_clid = cl->cl_clientid;
-@@ -675,15 +677,12 @@ struct nfs4_stid *nfs4_alloc_stid(struct nfs4_client *cl,
- static struct nfs4_ol_stateid * nfs4_alloc_open_stateid(struct nfs4_client *clp)
- {
- 	struct nfs4_stid *stid;
--	struct nfs4_ol_stateid *stp;
- 
--	stid = nfs4_alloc_stid(clp, stateid_slab);
-+	stid = nfs4_alloc_stid(clp, stateid_slab, nfs4_free_ol_stateid);
- 	if (!stid)
- 		return NULL;
- 
--	stp = openlockstateid(stid);
--	stp->st_stid.sc_free = nfs4_free_ol_stateid;
--	return stp;
-+	return openlockstateid(stid);
- }
- 
- static void nfs4_free_deleg(struct nfs4_stid *stid)
-@@ -781,11 +780,10 @@ alloc_init_deleg(struct nfs4_client *clp, struct svc_fh *current_fh,
- 		goto out_dec;
- 	if (delegation_blocked(&current_fh->fh_handle))
- 		goto out_dec;
--	dp = delegstateid(nfs4_alloc_stid(clp, deleg_slab));
-+	dp = delegstateid(nfs4_alloc_stid(clp, deleg_slab, nfs4_free_deleg));
- 	if (dp == NULL)
- 		goto out_dec;
- 
--	dp->dl_stid.sc_free = nfs4_free_deleg;
- 	/*
- 	 * delegation seqid's are never incremented.  The 4.1 special
- 	 * meaning of seqid 0 isn't meaningful, really, but let's avoid
-@@ -5580,7 +5578,6 @@ init_lock_stateid(struct nfs4_ol_stateid *stp, struct nfs4_lockowner *lo,
- 	stp->st_stateowner = nfs4_get_stateowner(&lo->lo_owner);
- 	get_nfs4_file(fp);
- 	stp->st_stid.sc_file = fp;
--	stp->st_stid.sc_free = nfs4_free_lock_stateid;
- 	stp->st_access_bmap = 0;
- 	stp->st_deny_bmap = open_stp->st_deny_bmap;
- 	stp->st_openstp = open_stp;
-@@ -5623,7 +5620,7 @@ find_or_create_lock_stateid(struct nfs4_lockowner *lo, struct nfs4_file *fi,
- 	lst = find_lock_stateid(lo, fi);
- 	if (lst == NULL) {
- 		spin_unlock(&clp->cl_lock);
--		ns = nfs4_alloc_stid(clp, stateid_slab);
-+		ns = nfs4_alloc_stid(clp, stateid_slab, nfs4_free_lock_stateid);
- 		if (ns == NULL)
- 			return NULL;
- 
-diff --git a/fs/nfsd/state.h b/fs/nfsd/state.h
-index c939936..4516e8b 100644
---- a/fs/nfsd/state.h
-+++ b/fs/nfsd/state.h
-@@ -603,8 +603,8 @@ extern __be32 nfs4_preprocess_stateid_op(struct svc_rqst *rqstp,
- __be32 nfsd4_lookup_stateid(struct nfsd4_compound_state *cstate,
- 		     stateid_t *stateid, unsigned char typemask,
- 		     struct nfs4_stid **s, struct nfsd_net *nn);
--struct nfs4_stid *nfs4_alloc_stid(struct nfs4_client *cl,
--		struct kmem_cache *slab);
-+struct nfs4_stid *nfs4_alloc_stid(struct nfs4_client *cl, struct kmem_cache *slab,
-+				  void (*sc_free)(struct nfs4_stid *));
- void nfs4_unhash_stid(struct nfs4_stid *s);
- void nfs4_put_stid(struct nfs4_stid *s);
- void nfs4_inc_and_copy_stateid(stateid_t *dst, struct nfs4_stid *stid);
-diff --git a/include/linux/irq.h b/include/linux/irq.h
-index e798755..39e3254 100644
---- a/include/linux/irq.h
-+++ b/include/linux/irq.h
-@@ -184,6 +184,7 @@ struct irq_data {
-  *
-  * IRQD_TRIGGER_MASK		- Mask for the trigger type bits
-  * IRQD_SETAFFINITY_PENDING	- Affinity setting is pending
-+ * IRQD_ACTIVATED		- Interrupt has already been activated
-  * IRQD_NO_BALANCING		- Balancing disabled for this IRQ
-  * IRQD_PER_CPU			- Interrupt is per cpu
-  * IRQD_AFFINITY_SET		- Interrupt affinity was set
-@@ -202,6 +203,7 @@ struct irq_data {
- enum {
- 	IRQD_TRIGGER_MASK		= 0xf,
- 	IRQD_SETAFFINITY_PENDING	= (1 <<  8),
-+	IRQD_ACTIVATED			= (1 <<  9),
- 	IRQD_NO_BALANCING		= (1 << 10),
- 	IRQD_PER_CPU			= (1 << 11),
- 	IRQD_AFFINITY_SET		= (1 << 12),
-@@ -312,6 +314,21 @@ static inline bool irqd_affinity_is_managed(struct irq_data *d)
- 	return __irqd_to_state(d) & IRQD_AFFINITY_MANAGED;
- }
- 
-+static inline bool irqd_is_activated(struct irq_data *d)
-+{
-+	return __irqd_to_state(d) & IRQD_ACTIVATED;
-+}
-+
-+static inline void irqd_set_activated(struct irq_data *d)
-+{
-+	__irqd_to_state(d) |= IRQD_ACTIVATED;
-+}
-+
-+static inline void irqd_clr_activated(struct irq_data *d)
-+{
-+	__irqd_to_state(d) &= ~IRQD_ACTIVATED;
-+}
-+
- #undef __irqd_to_state
- 
- static inline irq_hw_number_t irqd_to_hwirq(struct irq_data *d)
-diff --git a/include/linux/memory_hotplug.h b/include/linux/memory_hotplug.h
-index c1784c0..134a2f6 100644
---- a/include/linux/memory_hotplug.h
-+++ b/include/linux/memory_hotplug.h
-@@ -85,7 +85,8 @@ extern int zone_grow_waitqueues(struct zone *zone, unsigned long nr_pages);
- extern int add_one_highpage(struct page *page, int pfn, int bad_ppro);
- /* VM interface that may be used by firmware interface */
- extern int online_pages(unsigned long, unsigned long, int);
--extern int test_pages_in_a_zone(unsigned long, unsigned long);
-+extern int test_pages_in_a_zone(unsigned long start_pfn, unsigned long end_pfn,
-+	unsigned long *valid_start, unsigned long *valid_end);
- extern void __offline_isolated_pages(unsigned long, unsigned long);
- 
- typedef void (*online_page_callback_t)(struct page *page);
-diff --git a/include/linux/percpu-refcount.h b/include/linux/percpu-refcount.h
-index 1c7eec0..3a481a4 100644
---- a/include/linux/percpu-refcount.h
-+++ b/include/linux/percpu-refcount.h
-@@ -204,7 +204,7 @@ static inline void percpu_ref_get(struct percpu_ref *ref)
- static inline bool percpu_ref_tryget(struct percpu_ref *ref)
- {
- 	unsigned long __percpu *percpu_count;
--	int ret;
-+	bool ret;
- 
- 	rcu_read_lock_sched();
- 
-@@ -238,7 +238,7 @@ static inline bool percpu_ref_tryget(struct percpu_ref *ref)
- static inline bool percpu_ref_tryget_live(struct percpu_ref *ref)
- {
- 	unsigned long __percpu *percpu_count;
--	int ret = false;
-+	bool ret = false;
- 
- 	rcu_read_lock_sched();
- 
-diff --git a/kernel/cgroup.c b/kernel/cgroup.c
-index 85bc9be..4e2f3de 100644
---- a/kernel/cgroup.c
-+++ b/kernel/cgroup.c
-@@ -5219,6 +5219,11 @@ static struct cgroup_subsys_state *css_create(struct cgroup *cgrp,
- 	return ERR_PTR(err);
- }
- 
-+/*
-+ * The returned cgroup is fully initialized including its control mask, but
-+ * it isn't associated with its kernfs_node and doesn't have the control
-+ * mask applied.
-+ */
- static struct cgroup *cgroup_create(struct cgroup *parent)
- {
- 	struct cgroup_root *root = parent->root;
-@@ -5283,11 +5288,6 @@ static struct cgroup *cgroup_create(struct cgroup *parent)
- 
- 	cgroup_propagate_control(cgrp);
- 
--	/* @cgrp doesn't have dir yet so the following will only create csses */
--	ret = cgroup_apply_control_enable(cgrp);
--	if (ret)
--		goto out_destroy;
--
- 	return cgrp;
- 
- out_cancel_ref:
-@@ -5295,9 +5295,6 @@ static struct cgroup *cgroup_create(struct cgroup *parent)
- out_free_cgrp:
- 	kfree(cgrp);
- 	return ERR_PTR(ret);
--out_destroy:
--	cgroup_destroy_locked(cgrp);
--	return ERR_PTR(ret);
- }
- 
- static int cgroup_mkdir(struct kernfs_node *parent_kn, const char *name,
-diff --git a/kernel/events/core.c b/kernel/events/core.c
-index e5a8839..b1cfd74 100644
---- a/kernel/events/core.c
-+++ b/kernel/events/core.c
-@@ -1469,7 +1469,6 @@ ctx_group_list(struct perf_event *event, struct perf_event_context *ctx)
- static void
- list_add_event(struct perf_event *event, struct perf_event_context *ctx)
- {
--
- 	lockdep_assert_held(&ctx->lock);
- 
- 	WARN_ON_ONCE(event->attach_state & PERF_ATTACH_CONTEXT);
-@@ -1624,6 +1623,8 @@ static void perf_group_attach(struct perf_event *event)
- {
- 	struct perf_event *group_leader = event->group_leader, *pos;
- 
-+	lockdep_assert_held(&event->ctx->lock);
-+
- 	/*
- 	 * We can have double attach due to group movement in perf_event_open.
- 	 */
-@@ -1697,6 +1698,8 @@ static void perf_group_detach(struct perf_event *event)
- 	struct perf_event *sibling, *tmp;
- 	struct list_head *list = NULL;
- 
-+	lockdep_assert_held(&event->ctx->lock);
-+
- 	/*
- 	 * We can have double detach due to exit/hot-unplug + close.
- 	 */
-@@ -1895,9 +1898,29 @@ __perf_remove_from_context(struct perf_event *event,
-  */
- static void perf_remove_from_context(struct perf_event *event, unsigned long flags)
- {
--	lockdep_assert_held(&event->ctx->mutex);
-+	struct perf_event_context *ctx = event->ctx;
-+
-+	lockdep_assert_held(&ctx->mutex);
- 
- 	event_function_call(event, __perf_remove_from_context, (void *)flags);
-+
-+	/*
-+	 * The above event_function_call() can NO-OP when it hits
-+	 * TASK_TOMBSTONE. In that case we must already have been detached
-+	 * from the context (by perf_event_exit_event()) but the grouping
-+	 * might still be in-tact.
-+	 */
-+	WARN_ON_ONCE(event->attach_state & PERF_ATTACH_CONTEXT);
-+	if ((flags & DETACH_GROUP) &&
-+	    (event->attach_state & PERF_ATTACH_GROUP)) {
-+		/*
-+		 * Since in that case we cannot possibly be scheduled, simply
-+		 * detach now.
-+		 */
-+		raw_spin_lock_irq(&ctx->lock);
-+		perf_group_detach(event);
-+		raw_spin_unlock_irq(&ctx->lock);
-+	}
- }
- 
- /*
-@@ -6583,6 +6606,27 @@ static void perf_event_mmap_event(struct perf_mmap_event *mmap_event)
- 	char *buf = NULL;
- 	char *name;
- 
-+	if (vma->vm_flags & VM_READ)
-+		prot |= PROT_READ;
-+	if (vma->vm_flags & VM_WRITE)
-+		prot |= PROT_WRITE;
-+	if (vma->vm_flags & VM_EXEC)
-+		prot |= PROT_EXEC;
-+
-+	if (vma->vm_flags & VM_MAYSHARE)
-+		flags = MAP_SHARED;
-+	else
-+		flags = MAP_PRIVATE;
-+
-+	if (vma->vm_flags & VM_DENYWRITE)
-+		flags |= MAP_DENYWRITE;
-+	if (vma->vm_flags & VM_MAYEXEC)
-+		flags |= MAP_EXECUTABLE;
-+	if (vma->vm_flags & VM_LOCKED)
-+		flags |= MAP_LOCKED;
-+	if (vma->vm_flags & VM_HUGETLB)
-+		flags |= MAP_HUGETLB;
-+
- 	if (file) {
- 		struct inode *inode;
- 		dev_t dev;
-@@ -6609,27 +6653,6 @@ static void perf_event_mmap_event(struct perf_mmap_event *mmap_event)
- 		maj = MAJOR(dev);
- 		min = MINOR(dev);
- 
--		if (vma->vm_flags & VM_READ)
--			prot |= PROT_READ;
--		if (vma->vm_flags & VM_WRITE)
--			prot |= PROT_WRITE;
--		if (vma->vm_flags & VM_EXEC)
--			prot |= PROT_EXEC;
--
--		if (vma->vm_flags & VM_MAYSHARE)
--			flags = MAP_SHARED;
--		else
--			flags = MAP_PRIVATE;
--
--		if (vma->vm_flags & VM_DENYWRITE)
--			flags |= MAP_DENYWRITE;
--		if (vma->vm_flags & VM_MAYEXEC)
--			flags |= MAP_EXECUTABLE;
--		if (vma->vm_flags & VM_LOCKED)
--			flags |= MAP_LOCKED;
--		if (vma->vm_flags & VM_HUGETLB)
--			flags |= MAP_HUGETLB;
--
- 		goto got_name;
- 	} else {
- 		if (vma->vm_ops && vma->vm_ops->name) {
-diff --git a/kernel/irq/irqdomain.c b/kernel/irq/irqdomain.c
-index 8c0a0ae..b59e676 100644
---- a/kernel/irq/irqdomain.c
-+++ b/kernel/irq/irqdomain.c
-@@ -1346,6 +1346,30 @@ void irq_domain_free_irqs_parent(struct irq_domain *domain,
- }
- EXPORT_SYMBOL_GPL(irq_domain_free_irqs_parent);
- 
-+static void __irq_domain_activate_irq(struct irq_data *irq_data)
-+{
-+	if (irq_data && irq_data->domain) {
-+		struct irq_domain *domain = irq_data->domain;
-+
-+		if (irq_data->parent_data)
-+			__irq_domain_activate_irq(irq_data->parent_data);
-+		if (domain->ops->activate)
-+			domain->ops->activate(domain, irq_data);
-+	}
-+}
-+
-+static void __irq_domain_deactivate_irq(struct irq_data *irq_data)
-+{
-+	if (irq_data && irq_data->domain) {
-+		struct irq_domain *domain = irq_data->domain;
-+
-+		if (domain->ops->deactivate)
-+			domain->ops->deactivate(domain, irq_data);
-+		if (irq_data->parent_data)
-+			__irq_domain_deactivate_irq(irq_data->parent_data);
-+	}
-+}
-+
- /**
-  * irq_domain_activate_irq - Call domain_ops->activate recursively to activate
-  *			     interrupt
-@@ -1356,13 +1380,9 @@ EXPORT_SYMBOL_GPL(irq_domain_free_irqs_parent);
-  */
- void irq_domain_activate_irq(struct irq_data *irq_data)
- {
--	if (irq_data && irq_data->domain) {
--		struct irq_domain *domain = irq_data->domain;
--
--		if (irq_data->parent_data)
--			irq_domain_activate_irq(irq_data->parent_data);
--		if (domain->ops->activate)
--			domain->ops->activate(domain, irq_data);
-+	if (!irqd_is_activated(irq_data)) {
-+		__irq_domain_activate_irq(irq_data);
-+		irqd_set_activated(irq_data);
- 	}
- }
- 
-@@ -1376,13 +1396,9 @@ void irq_domain_activate_irq(struct irq_data *irq_data)
-  */
- void irq_domain_deactivate_irq(struct irq_data *irq_data)
- {
--	if (irq_data && irq_data->domain) {
--		struct irq_domain *domain = irq_data->domain;
--
--		if (domain->ops->deactivate)
--			domain->ops->deactivate(domain, irq_data);
--		if (irq_data->parent_data)
--			irq_domain_deactivate_irq(irq_data->parent_data);
-+	if (irqd_is_activated(irq_data)) {
-+		__irq_domain_deactivate_irq(irq_data);
-+		irqd_clr_activated(irq_data);
- 	}
- }
- 
-diff --git a/kernel/trace/trace_hwlat.c b/kernel/trace/trace_hwlat.c
-index b97286c..f00b013 100644
---- a/kernel/trace/trace_hwlat.c
-+++ b/kernel/trace/trace_hwlat.c
-@@ -266,7 +266,7 @@ static int get_sample(void)
- static struct cpumask save_cpumask;
- static bool disable_migrate;
- 
--static void move_to_next_cpu(void)
-+static void move_to_next_cpu(bool initmask)
- {
- 	static struct cpumask *current_mask;
- 	int next_cpu;
-@@ -275,7 +275,7 @@ static void move_to_next_cpu(void)
- 		return;
- 
- 	/* Just pick the first CPU on first iteration */
--	if (!current_mask) {
-+	if (initmask) {
- 		current_mask = &save_cpumask;
- 		get_online_cpus();
- 		cpumask_and(current_mask, cpu_online_mask, tracing_buffer_mask);
-@@ -330,10 +330,12 @@ static void move_to_next_cpu(void)
- static int kthread_fn(void *data)
- {
- 	u64 interval;
-+	bool initmask = true;
- 
- 	while (!kthread_should_stop()) {
- 
--		move_to_next_cpu();
-+		move_to_next_cpu(initmask);
-+		initmask = false;
- 
- 		local_irq_disable();
- 		get_sample();
-diff --git a/mm/filemap.c b/mm/filemap.c
-index 7798010..d8d7df8 100644
---- a/mm/filemap.c
-+++ b/mm/filemap.c
-@@ -1703,6 +1703,11 @@ static ssize_t do_generic_file_read(struct file *filp, loff_t *ppos,
- 
- 		cond_resched();
- find_page:
-+		if (fatal_signal_pending(current)) {
-+			error = -EINTR;
-+			goto out;
-+		}
-+
- 		page = find_get_page(mapping, index);
- 		if (!page) {
- 			page_cache_sync_readahead(mapping,
-diff --git a/mm/memory_hotplug.c b/mm/memory_hotplug.c
-index c3a8141..ede13734 100644
---- a/mm/memory_hotplug.c
-+++ b/mm/memory_hotplug.c
-@@ -1483,17 +1483,20 @@ bool is_mem_section_removable(unsigned long start_pfn, unsigned long nr_pages)
- }
- 
- /*
-- * Confirm all pages in a range [start, end) is belongs to the same zone.
-+ * Confirm all pages in a range [start, end) belong to the same zone.
-+ * When true, return its valid [start, end).
-  */
--int test_pages_in_a_zone(unsigned long start_pfn, unsigned long end_pfn)
-+int test_pages_in_a_zone(unsigned long start_pfn, unsigned long end_pfn,
-+			 unsigned long *valid_start, unsigned long *valid_end)
- {
- 	unsigned long pfn, sec_end_pfn;
-+	unsigned long start, end;
- 	struct zone *zone = NULL;
- 	struct page *page;
- 	int i;
--	for (pfn = start_pfn, sec_end_pfn = SECTION_ALIGN_UP(start_pfn);
-+	for (pfn = start_pfn, sec_end_pfn = SECTION_ALIGN_UP(start_pfn + 1);
- 	     pfn < end_pfn;
--	     pfn = sec_end_pfn + 1, sec_end_pfn += PAGES_PER_SECTION) {
-+	     pfn = sec_end_pfn, sec_end_pfn += PAGES_PER_SECTION) {
- 		/* Make sure the memory section is present first */
- 		if (!present_section_nr(pfn_to_section_nr(pfn)))
- 			continue;
-@@ -1509,10 +1512,20 @@ int test_pages_in_a_zone(unsigned long start_pfn, unsigned long end_pfn)
- 			page = pfn_to_page(pfn + i);
- 			if (zone && page_zone(page) != zone)
- 				return 0;
-+			if (!zone)
-+				start = pfn + i;
- 			zone = page_zone(page);
-+			end = pfn + MAX_ORDER_NR_PAGES;
- 		}
- 	}
--	return 1;
-+
-+	if (zone) {
-+		*valid_start = start;
-+		*valid_end = end;
-+		return 1;
-+	} else {
-+		return 0;
-+	}
- }
- 
- /*
-@@ -1859,6 +1872,7 @@ static int __ref __offline_pages(unsigned long start_pfn,
- 	long offlined_pages;
- 	int ret, drain, retry_max, node;
- 	unsigned long flags;
-+	unsigned long valid_start, valid_end;
- 	struct zone *zone;
- 	struct memory_notify arg;
- 
-@@ -1869,10 +1883,10 @@ static int __ref __offline_pages(unsigned long start_pfn,
- 		return -EINVAL;
- 	/* This makes hotplug much easier...and readable.
- 	   we assume this for now. .*/
--	if (!test_pages_in_a_zone(start_pfn, end_pfn))
-+	if (!test_pages_in_a_zone(start_pfn, end_pfn, &valid_start, &valid_end))
- 		return -EINVAL;
- 
--	zone = page_zone(pfn_to_page(start_pfn));
-+	zone = page_zone(pfn_to_page(valid_start));
- 	node = zone_to_nid(zone);
- 	nr_pages = end_pfn - start_pfn;
- 
-diff --git a/mm/zswap.c b/mm/zswap.c
-index 275b22c..dbef278 100644
---- a/mm/zswap.c
-+++ b/mm/zswap.c
-@@ -78,7 +78,13 @@ static u64 zswap_duplicate_entry;
- 
- /* Enable/disable zswap (disabled by default) */
- static bool zswap_enabled;
--module_param_named(enabled, zswap_enabled, bool, 0644);
-+static int zswap_enabled_param_set(const char *,
-+				   const struct kernel_param *);
-+static struct kernel_param_ops zswap_enabled_param_ops = {
-+	.set =		zswap_enabled_param_set,
-+	.get =		param_get_bool,
-+};
-+module_param_cb(enabled, &zswap_enabled_param_ops, &zswap_enabled, 0644);
- 
- /* Crypto compressor to use */
- #define ZSWAP_COMPRESSOR_DEFAULT "lzo"
-@@ -176,6 +182,9 @@ static atomic_t zswap_pools_count = ATOMIC_INIT(0);
- /* used by param callback function */
- static bool zswap_init_started;
- 
-+/* fatal error during init */
-+static bool zswap_init_failed;
-+
- /*********************************
- * helpers and fwd declarations
- **********************************/
-@@ -706,6 +715,11 @@ static int __zswap_param_set(const char *val, const struct kernel_param *kp,
- 	char *s = strstrip((char *)val);
- 	int ret;
- 
-+	if (zswap_init_failed) {
-+		pr_err("can't set param, initialization failed\n");
-+		return -ENODEV;
-+	}
-+
- 	/* no change required */
- 	if (!strcmp(s, *(char **)kp->arg))
- 		return 0;
-@@ -785,6 +799,17 @@ static int zswap_zpool_param_set(const char *val,
- 	return __zswap_param_set(val, kp, NULL, zswap_compressor);
- }
- 
-+static int zswap_enabled_param_set(const char *val,
-+				   const struct kernel_param *kp)
-+{
-+	if (zswap_init_failed) {
-+		pr_err("can't enable, initialization failed\n");
-+		return -ENODEV;
-+	}
-+
-+	return param_set_bool(val, kp);
-+}
-+
- /*********************************
- * writeback code
- **********************************/
-@@ -1271,6 +1296,9 @@ static int __init init_zswap(void)
- dstmem_fail:
- 	zswap_entry_cache_destroy();
- cache_fail:
-+	/* if built-in, we aren't unloaded on failure; don't allow use */
-+	zswap_init_failed = true;
-+	zswap_enabled = false;
- 	return -ENOMEM;
- }
- /* must be late so crypto has time to come up */
-diff --git a/net/can/bcm.c b/net/can/bcm.c
-index 436a753..5e9ed5e 100644
---- a/net/can/bcm.c
-+++ b/net/can/bcm.c
-@@ -734,14 +734,23 @@ static struct bcm_op *bcm_find_op(struct list_head *ops,
- 
- static void bcm_remove_op(struct bcm_op *op)
- {
--	hrtimer_cancel(&op->timer);
--	hrtimer_cancel(&op->thrtimer);
--
--	if (op->tsklet.func)
--		tasklet_kill(&op->tsklet);
-+	if (op->tsklet.func) {
-+		while (test_bit(TASKLET_STATE_SCHED, &op->tsklet.state) ||
-+		       test_bit(TASKLET_STATE_RUN, &op->tsklet.state) ||
-+		       hrtimer_active(&op->timer)) {
-+			hrtimer_cancel(&op->timer);
-+			tasklet_kill(&op->tsklet);
-+		}
-+	}
- 
--	if (op->thrtsklet.func)
--		tasklet_kill(&op->thrtsklet);
-+	if (op->thrtsklet.func) {
-+		while (test_bit(TASKLET_STATE_SCHED, &op->thrtsklet.state) ||
-+		       test_bit(TASKLET_STATE_RUN, &op->thrtsklet.state) ||
-+		       hrtimer_active(&op->thrtimer)) {
-+			hrtimer_cancel(&op->thrtimer);
-+			tasklet_kill(&op->thrtsklet);
-+		}
-+	}
- 
- 	if ((op->frames) && (op->frames != &op->sframe))
- 		kfree(op->frames);
-diff --git a/net/sunrpc/auth_gss/gss_rpc_xdr.c b/net/sunrpc/auth_gss/gss_rpc_xdr.c
-index dc6fb79..25d9a9c 100644
---- a/net/sunrpc/auth_gss/gss_rpc_xdr.c
-+++ b/net/sunrpc/auth_gss/gss_rpc_xdr.c
-@@ -260,7 +260,7 @@ static int gssx_dec_option_array(struct xdr_stream *xdr,
- 	if (!oa->data)
- 		return -ENOMEM;
- 
--	creds = kmalloc(sizeof(struct svc_cred), GFP_KERNEL);
-+	creds = kzalloc(sizeof(struct svc_cred), GFP_KERNEL);
- 	if (!creds) {
- 		kfree(oa->data);
- 		return -ENOMEM;