[gentoo-commits] proj/hardened-patchset:master commit in: 4.7.5/, 4.7.4/

[Anthony G. Basile]

commit:     e4d3fa8f47469ab0c22a1ce0f78725f0d482c550
Author:     Anthony G. Basile <blueness <AT> gentoo <DOT> org>
AuthorDate: Wed Sep 28 08:51:05 2016 +0000
Commit:     Anthony G. Basile <blueness <AT> gentoo <DOT> org>
CommitDate: Wed Sep 28 08:51:05 2016 +0000
URL:        https://gitweb.gentoo.org/proj/hardened-patchset.git/commit/?id=e4d3fa8f

grsecurity-3.1-4.7.5-201609261522

 4.7.4/1000_linux-4.7.1.patch                       | 1141 ---
 4.7.4/1001_linux-4.7.2.patch                       | 7668 --------------------
 4.7.4/1002_linux-4.7.3.patch                       | 4418 -----------
 4.7.4/1003_linux-4.7.4.patch                       | 2424 -------
 {4.7.4 => 4.7.5}/0000_README                       |   18 +-
 .../4420_grsecurity-3.1-4.7.5-201609261522.patch   | 1100 ++-
 {4.7.4 => 4.7.5}/4425_grsec_remove_EI_PAX.patch    |    0
 {4.7.4 => 4.7.5}/4427_force_XATTR_PAX_tmpfs.patch  |    0
 .../4430_grsec-remove-localversion-grsec.patch     |    0
 {4.7.4 => 4.7.5}/4435_grsec-mute-warnings.patch    |    0
 .../4440_grsec-remove-protected-paths.patch        |    0
 .../4450_grsec-kconfig-default-gids.patch          |    0
 .../4465_selinux-avc_audit-log-curr_ip.patch       |    0
 {4.7.4 => 4.7.5}/4470_disable-compat_vdso.patch    |    0
 {4.7.4 => 4.7.5}/4475_emutramp_default_on.patch    |    0
 15 files changed, 731 insertions(+), 16038 deletions(-)

diff --git a/4.7.4/1000_linux-4.7.1.patch b/4.7.4/1000_linux-4.7.1.patch
deleted file mode 100644
index 79c652a..0000000
--- a/4.7.4/1000_linux-4.7.1.patch
+++ /dev/null
@@ -1,1141 +0,0 @@
-diff --git a/Documentation/cpu-freq/pcc-cpufreq.txt b/Documentation/cpu-freq/pcc-cpufreq.txt
-index 0a94224..9e3c3b3 100644
---- a/Documentation/cpu-freq/pcc-cpufreq.txt
-+++ b/Documentation/cpu-freq/pcc-cpufreq.txt
-@@ -159,8 +159,8 @@ to be strictly associated with a P-state.
- 
- 2.2 cpuinfo_transition_latency:
- -------------------------------
--The cpuinfo_transition_latency field is CPUFREQ_ETERNAL. The PCC specification
--does not include a field to expose this value currently.
-+The cpuinfo_transition_latency field is 0. The PCC specification does
-+not include a field to expose this value currently.
- 
- 2.3 cpuinfo_cur_freq:
- ---------------------
-diff --git a/Makefile b/Makefile
-index 66da9a3..84335c0 100644
---- a/Makefile
-+++ b/Makefile
-@@ -1,6 +1,6 @@
- VERSION = 4
- PATCHLEVEL = 7
--SUBLEVEL = 0
-+SUBLEVEL = 1
- EXTRAVERSION =
- NAME = Psychotic Stoned Sheep
- 
-diff --git a/arch/arm/kernel/sys_oabi-compat.c b/arch/arm/kernel/sys_oabi-compat.c
-index 087acb5..5f221ac 100644
---- a/arch/arm/kernel/sys_oabi-compat.c
-+++ b/arch/arm/kernel/sys_oabi-compat.c
-@@ -279,8 +279,12 @@ asmlinkage long sys_oabi_epoll_wait(int epfd,
- 	mm_segment_t fs;
- 	long ret, err, i;
- 
--	if (maxevents <= 0 || maxevents > (INT_MAX/sizeof(struct epoll_event)))
-+	if (maxevents <= 0 ||
-+			maxevents > (INT_MAX/sizeof(*kbuf)) ||
-+			maxevents > (INT_MAX/sizeof(*events)))
- 		return -EINVAL;
-+	if (!access_ok(VERIFY_WRITE, events, sizeof(*events) * maxevents))
-+		return -EFAULT;
- 	kbuf = kmalloc(sizeof(*kbuf) * maxevents, GFP_KERNEL);
- 	if (!kbuf)
- 		return -ENOMEM;
-@@ -317,6 +321,8 @@ asmlinkage long sys_oabi_semtimedop(int semid,
- 
- 	if (nsops < 1 || nsops > SEMOPM)
- 		return -EINVAL;
-+	if (!access_ok(VERIFY_READ, tsops, sizeof(*tsops) * nsops))
-+		return -EFAULT;
- 	sops = kmalloc(sizeof(*sops) * nsops, GFP_KERNEL);
- 	if (!sops)
- 		return -ENOMEM;
-diff --git a/arch/mips/kernel/scall64-n32.S b/arch/mips/kernel/scall64-n32.S
-index 9c0b387..51d3988 100644
---- a/arch/mips/kernel/scall64-n32.S
-+++ b/arch/mips/kernel/scall64-n32.S
-@@ -348,7 +348,7 @@ EXPORT(sysn32_call_table)
- 	PTR	sys_ni_syscall			/* available, was setaltroot */
- 	PTR	sys_add_key
- 	PTR	sys_request_key
--	PTR	sys_keyctl			/* 6245 */
-+	PTR	compat_sys_keyctl		/* 6245 */
- 	PTR	sys_set_thread_area
- 	PTR	sys_inotify_init
- 	PTR	sys_inotify_add_watch
-diff --git a/arch/mips/kernel/scall64-o32.S b/arch/mips/kernel/scall64-o32.S
-index f4f28b1..6efa713 100644
---- a/arch/mips/kernel/scall64-o32.S
-+++ b/arch/mips/kernel/scall64-o32.S
-@@ -504,7 +504,7 @@ EXPORT(sys32_call_table)
- 	PTR	sys_ni_syscall			/* available, was setaltroot */
- 	PTR	sys_add_key			/* 4280 */
- 	PTR	sys_request_key
--	PTR	sys_keyctl
-+	PTR	compat_sys_keyctl
- 	PTR	sys_set_thread_area
- 	PTR	sys_inotify_init
- 	PTR	sys_inotify_add_watch		/* 4285 */
-diff --git a/arch/x86/entry/syscalls/syscall_32.tbl b/arch/x86/entry/syscalls/syscall_32.tbl
-index 4cddd17..f848572 100644
---- a/arch/x86/entry/syscalls/syscall_32.tbl
-+++ b/arch/x86/entry/syscalls/syscall_32.tbl
-@@ -294,7 +294,7 @@
- # 285 sys_setaltroot
- 286	i386	add_key			sys_add_key
- 287	i386	request_key		sys_request_key
--288	i386	keyctl			sys_keyctl
-+288	i386	keyctl			sys_keyctl			compat_sys_keyctl
- 289	i386	ioprio_set		sys_ioprio_set
- 290	i386	ioprio_get		sys_ioprio_get
- 291	i386	inotify_init		sys_inotify_init
-diff --git a/arch/x86/include/asm/microcode.h b/arch/x86/include/asm/microcode.h
-index 9d3a96c..01c2d14 100644
---- a/arch/x86/include/asm/microcode.h
-+++ b/arch/x86/include/asm/microcode.h
-@@ -133,13 +133,11 @@ static inline unsigned int x86_cpuid_family(void)
- #ifdef CONFIG_MICROCODE
- extern void __init load_ucode_bsp(void);
- extern void load_ucode_ap(void);
--extern int __init save_microcode_in_initrd(void);
- void reload_early_microcode(void);
- extern bool get_builtin_firmware(struct cpio_data *cd, const char *name);
- #else
- static inline void __init load_ucode_bsp(void)			{ }
- static inline void load_ucode_ap(void)				{ }
--static inline int __init save_microcode_in_initrd(void)		{ return 0; }
- static inline void reload_early_microcode(void)			{ }
- static inline bool
- get_builtin_firmware(struct cpio_data *cd, const char *name)	{ return false; }
-diff --git a/arch/x86/kernel/cpu/microcode/core.c b/arch/x86/kernel/cpu/microcode/core.c
-index ac360bf..12823b6 100644
---- a/arch/x86/kernel/cpu/microcode/core.c
-+++ b/arch/x86/kernel/cpu/microcode/core.c
-@@ -175,7 +175,7 @@ void load_ucode_ap(void)
- 	}
- }
- 
--int __init save_microcode_in_initrd(void)
-+static int __init save_microcode_in_initrd(void)
- {
- 	struct cpuinfo_x86 *c = &boot_cpu_data;
- 
-@@ -691,4 +691,5 @@ int __init microcode_init(void)
- 	return error;
- 
- }
-+fs_initcall(save_microcode_in_initrd);
- late_initcall(microcode_init);
-diff --git a/arch/x86/mm/init.c b/arch/x86/mm/init.c
-index 372aad2..dffd162 100644
---- a/arch/x86/mm/init.c
-+++ b/arch/x86/mm/init.c
-@@ -696,13 +696,6 @@ void free_initmem(void)
- void __init free_initrd_mem(unsigned long start, unsigned long end)
- {
- 	/*
--	 * Remember, initrd memory may contain microcode or other useful things.
--	 * Before we lose initrd mem, we need to find a place to hold them
--	 * now that normal virtual memory is enabled.
--	 */
--	save_microcode_in_initrd();
--
--	/*
- 	 * end could be not aligned, and We can not align that,
- 	 * decompresser could be confused by aligned initrd_end
- 	 * We already reserve the end partial page before in
-diff --git a/arch/x86/power/hibernate_asm_64.S b/arch/x86/power/hibernate_asm_64.S
-index 3177c2b..8eee0e9 100644
---- a/arch/x86/power/hibernate_asm_64.S
-+++ b/arch/x86/power/hibernate_asm_64.S
-@@ -24,7 +24,6 @@
- #include <asm/frame.h>
- 
- ENTRY(swsusp_arch_suspend)
--	FRAME_BEGIN
- 	movq	$saved_context, %rax
- 	movq	%rsp, pt_regs_sp(%rax)
- 	movq	%rbp, pt_regs_bp(%rax)
-@@ -48,6 +47,7 @@ ENTRY(swsusp_arch_suspend)
- 	movq	%cr3, %rax
- 	movq	%rax, restore_cr3(%rip)
- 
-+	FRAME_BEGIN
- 	call swsusp_save
- 	FRAME_END
- 	ret
-@@ -104,7 +104,6 @@ ENTRY(core_restore_code)
- 	 /* code below belongs to the image kernel */
- 	.align PAGE_SIZE
- ENTRY(restore_registers)
--	FRAME_BEGIN
- 	/* go back to the original page tables */
- 	movq    %r9, %cr3
- 
-@@ -145,6 +144,5 @@ ENTRY(restore_registers)
- 	/* tell the hibernation core that we've just restored the memory */
- 	movq	%rax, in_suspend(%rip)
- 
--	FRAME_END
- 	ret
- ENDPROC(restore_registers)
-diff --git a/block/genhd.c b/block/genhd.c
-index 9f42526..3eebd25 100644
---- a/block/genhd.c
-+++ b/block/genhd.c
-@@ -856,6 +856,7 @@ static void disk_seqf_stop(struct seq_file *seqf, void *v)
- 	if (iter) {
- 		class_dev_iter_exit(iter);
- 		kfree(iter);
-+		seqf->private = NULL;
- 	}
- }
- 
-diff --git a/crypto/gcm.c b/crypto/gcm.c
-index bec329b..d9ea5f9 100644
---- a/crypto/gcm.c
-+++ b/crypto/gcm.c
-@@ -639,7 +639,9 @@ static int crypto_gcm_create_common(struct crypto_template *tmpl,
- 
- 	ghash_alg = crypto_find_alg(ghash_name, &crypto_ahash_type,
- 				    CRYPTO_ALG_TYPE_HASH,
--				    CRYPTO_ALG_TYPE_AHASH_MASK);
-+				    CRYPTO_ALG_TYPE_AHASH_MASK |
-+				    crypto_requires_sync(algt->type,
-+							 algt->mask));
- 	if (IS_ERR(ghash_alg))
- 		return PTR_ERR(ghash_alg);
- 
-diff --git a/crypto/scatterwalk.c b/crypto/scatterwalk.c
-index ea5815c..bc769c4 100644
---- a/crypto/scatterwalk.c
-+++ b/crypto/scatterwalk.c
-@@ -72,7 +72,8 @@ static void scatterwalk_pagedone(struct scatter_walk *walk, int out,
- 
- void scatterwalk_done(struct scatter_walk *walk, int out, int more)
- {
--	if (!(scatterwalk_pagelen(walk) & (PAGE_SIZE - 1)) || !more)
-+	if (!more || walk->offset >= walk->sg->offset + walk->sg->length ||
-+	    !(walk->offset & (PAGE_SIZE - 1)))
- 		scatterwalk_pagedone(walk, out, more);
- }
- EXPORT_SYMBOL_GPL(scatterwalk_done);
-diff --git a/drivers/char/random.c b/drivers/char/random.c
-index 0158d3b..87ab9f6 100644
---- a/drivers/char/random.c
-+++ b/drivers/char/random.c
-@@ -723,15 +723,18 @@ retry:
- 	}
- }
- 
--static void credit_entropy_bits_safe(struct entropy_store *r, int nbits)
-+static int credit_entropy_bits_safe(struct entropy_store *r, int nbits)
- {
- 	const int nbits_max = (int)(~0U >> (ENTROPY_SHIFT + 1));
- 
-+	if (nbits < 0)
-+		return -EINVAL;
-+
- 	/* Cap the value to avoid overflows */
- 	nbits = min(nbits,  nbits_max);
--	nbits = max(nbits, -nbits_max);
- 
- 	credit_entropy_bits(r, nbits);
-+	return 0;
- }
- 
- /*********************************************************************
-@@ -1543,8 +1546,7 @@ static long random_ioctl(struct file *f, unsigned int cmd, unsigned long arg)
- 			return -EPERM;
- 		if (get_user(ent_count, p))
- 			return -EFAULT;
--		credit_entropy_bits_safe(&input_pool, ent_count);
--		return 0;
-+		return credit_entropy_bits_safe(&input_pool, ent_count);
- 	case RNDADDENTROPY:
- 		if (!capable(CAP_SYS_ADMIN))
- 			return -EPERM;
-@@ -1558,8 +1560,7 @@ static long random_ioctl(struct file *f, unsigned int cmd, unsigned long arg)
- 				    size);
- 		if (retval < 0)
- 			return retval;
--		credit_entropy_bits_safe(&input_pool, ent_count);
--		return 0;
-+		return credit_entropy_bits_safe(&input_pool, ent_count);
- 	case RNDZAPENTCNT:
- 	case RNDCLEARPOOL:
- 		/*
-diff --git a/drivers/cpufreq/pcc-cpufreq.c b/drivers/cpufreq/pcc-cpufreq.c
-index a7ecb9a..3f0ce2a 100644
---- a/drivers/cpufreq/pcc-cpufreq.c
-+++ b/drivers/cpufreq/pcc-cpufreq.c
-@@ -555,8 +555,6 @@ static int pcc_cpufreq_cpu_init(struct cpufreq_policy *policy)
- 	policy->min = policy->cpuinfo.min_freq =
- 		ioread32(&pcch_hdr->minimum_frequency) * 1000;
- 
--	policy->cpuinfo.transition_latency = CPUFREQ_ETERNAL;
--
- 	pr_debug("init: policy->max is %d, policy->min is %d\n",
- 		policy->max, policy->min);
- out:
-diff --git a/drivers/infiniband/hw/hfi1/Kconfig b/drivers/infiniband/hw/hfi1/Kconfig
-index a925fb0..f846fd5 100644
---- a/drivers/infiniband/hw/hfi1/Kconfig
-+++ b/drivers/infiniband/hw/hfi1/Kconfig
-@@ -3,7 +3,6 @@ config INFINIBAND_HFI1
- 	depends on X86_64 && INFINIBAND_RDMAVT
- 	select MMU_NOTIFIER
- 	select CRC32
--	default m
- 	---help---
- 	This is a low-level driver for Intel OPA Gen1 adapter.
- config HFI1_DEBUG_SDMA_ORDER
-diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
-index a2afa3b..4d79819 100644
---- a/drivers/net/bonding/bond_main.c
-+++ b/drivers/net/bonding/bond_main.c
-@@ -1422,7 +1422,16 @@ int bond_enslave(struct net_device *bond_dev, struct net_device *slave_dev)
- 		return -EINVAL;
- 	}
- 
--	if (slave_ops->ndo_set_mac_address == NULL) {
-+	if (slave_dev->type == ARPHRD_INFINIBAND &&
-+	    BOND_MODE(bond) != BOND_MODE_ACTIVEBACKUP) {
-+		netdev_warn(bond_dev, "Type (%d) supports only active-backup mode\n",
-+			    slave_dev->type);
-+		res = -EOPNOTSUPP;
-+		goto err_undo_flags;
-+	}
-+
-+	if (!slave_ops->ndo_set_mac_address ||
-+	    slave_dev->type == ARPHRD_INFINIBAND) {
- 		netdev_warn(bond_dev, "The slave device specified does not support setting the MAC address\n");
- 		if (BOND_MODE(bond) == BOND_MODE_ACTIVEBACKUP &&
- 		    bond->params.fail_over_mac != BOND_FOM_ACTIVE) {
-diff --git a/drivers/net/ethernet/qlogic/qed/qed_spq.c b/drivers/net/ethernet/qlogic/qed/qed_spq.c
-index b122f60..03601df 100644
---- a/drivers/net/ethernet/qlogic/qed/qed_spq.c
-+++ b/drivers/net/ethernet/qlogic/qed/qed_spq.c
-@@ -809,13 +809,12 @@ int qed_spq_completion(struct qed_hwfn *p_hwfn,
- 			 * in a bitmap and increasing the chain consumer only
- 			 * for the first successive completed entries.
- 			 */
--			bitmap_set(p_spq->p_comp_bitmap, pos, SPQ_RING_SIZE);
-+			__set_bit(pos, p_spq->p_comp_bitmap);
- 
- 			while (test_bit(p_spq->comp_bitmap_idx,
- 					p_spq->p_comp_bitmap)) {
--				bitmap_clear(p_spq->p_comp_bitmap,
--					     p_spq->comp_bitmap_idx,
--					     SPQ_RING_SIZE);
-+				__clear_bit(p_spq->comp_bitmap_idx,
-+					    p_spq->p_comp_bitmap);
- 				p_spq->comp_bitmap_idx++;
- 				qed_chain_return_produced(&p_spq->chain);
- 			}
-diff --git a/drivers/net/macsec.c b/drivers/net/macsec.c
-index 8bcd78f..a70b6c4 100644
---- a/drivers/net/macsec.c
-+++ b/drivers/net/macsec.c
-@@ -942,7 +942,6 @@ static struct sk_buff *macsec_decrypt(struct sk_buff *skb,
- 	}
- 
- 	macsec_skb_cb(skb)->req = req;
--	macsec_skb_cb(skb)->rx_sa = rx_sa;
- 	skb->dev = dev;
- 	aead_request_set_callback(req, 0, macsec_decrypt_done, skb);
- 
-@@ -1169,6 +1168,8 @@ static rx_handler_result_t macsec_handle_frame(struct sk_buff **pskb)
- 		}
- 	}
- 
-+	macsec_skb_cb(skb)->rx_sa = rx_sa;
-+
- 	/* Disabled && !changed text => skip validation */
- 	if (hdr->tci_an & MACSEC_TCI_C ||
- 	    secy->validate_frames != MACSEC_VALIDATE_DISABLED)
-diff --git a/drivers/tty/serial/mvebu-uart.c b/drivers/tty/serial/mvebu-uart.c
-index ce362bd..45b57c2 100644
---- a/drivers/tty/serial/mvebu-uart.c
-+++ b/drivers/tty/serial/mvebu-uart.c
-@@ -300,6 +300,8 @@ static int mvebu_uart_startup(struct uart_port *port)
- static void mvebu_uart_shutdown(struct uart_port *port)
- {
- 	writel(0, port->membase + UART_CTRL);
-+
-+	free_irq(port->irq, port);
- }
- 
- static void mvebu_uart_set_termios(struct uart_port *port,
-diff --git a/fs/dcache.c b/fs/dcache.c
-index d6847d7..1ed81bb 100644
---- a/fs/dcache.c
-+++ b/fs/dcache.c
-@@ -622,7 +622,6 @@ static struct dentry *dentry_kill(struct dentry *dentry)
- 
- failed:
- 	spin_unlock(&dentry->d_lock);
--	cpu_relax();
- 	return dentry; /* try again with same dentry */
- }
- 
-@@ -796,6 +795,8 @@ void dput(struct dentry *dentry)
- 		return;
- 
- repeat:
-+	might_sleep();
-+
- 	rcu_read_lock();
- 	if (likely(fast_dput(dentry))) {
- 		rcu_read_unlock();
-@@ -829,8 +830,10 @@ repeat:
- 
- kill_it:
- 	dentry = dentry_kill(dentry);
--	if (dentry)
-+	if (dentry) {
-+		cond_resched();
- 		goto repeat;
-+	}
- }
- EXPORT_SYMBOL(dput);
- 
-diff --git a/fs/ext4/balloc.c b/fs/ext4/balloc.c
-index 3020fd7..1ea5054 100644
---- a/fs/ext4/balloc.c
-+++ b/fs/ext4/balloc.c
-@@ -208,6 +208,9 @@ static int ext4_init_block_bitmap(struct super_block *sb,
- 	memset(bh->b_data, 0, sb->s_blocksize);
- 
- 	bit_max = ext4_num_base_meta_clusters(sb, block_group);
-+	if ((bit_max >> 3) >= bh->b_size)
-+		return -EFSCORRUPTED;
-+
- 	for (bit = 0; bit < bit_max; bit++)
- 		ext4_set_bit(bit, bh->b_data);
- 
-diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c
-index 2a2eef9..d7ccb7f 100644
---- a/fs/ext4/extents.c
-+++ b/fs/ext4/extents.c
-@@ -381,9 +381,13 @@ static int ext4_valid_extent(struct inode *inode, struct ext4_extent *ext)
- 	ext4_fsblk_t block = ext4_ext_pblock(ext);
- 	int len = ext4_ext_get_actual_len(ext);
- 	ext4_lblk_t lblock = le32_to_cpu(ext->ee_block);
--	ext4_lblk_t last = lblock + len - 1;
- 
--	if (len == 0 || lblock > last)
-+	/*
-+	 * We allow neither:
-+	 *  - zero length
-+	 *  - overflow/wrap-around
-+	 */
-+	if (lblock + len <= lblock)
- 		return 0;
- 	return ext4_data_block_valid(EXT4_SB(inode->i_sb), block, len);
- }
-@@ -474,6 +478,10 @@ static int __ext4_ext_check(const char *function, unsigned int line,
- 		error_msg = "invalid extent entries";
- 		goto corrupted;
- 	}
-+	if (unlikely(depth > 32)) {
-+		error_msg = "too large eh_depth";
-+		goto corrupted;
-+	}
- 	/* Verify checksum on non-root extent tree nodes */
- 	if (ext_depth(inode) != depth &&
- 	    !ext4_extent_block_csum_verify(inode, eh)) {
-diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
-index f7140ca..b747ec0 100644
---- a/fs/ext4/inode.c
-+++ b/fs/ext4/inode.c
-@@ -205,9 +205,9 @@ void ext4_evict_inode(struct inode *inode)
- 		 * Note that directories do not have this problem because they
- 		 * don't use page cache.
- 		 */
--		if (ext4_should_journal_data(inode) &&
--		    (S_ISLNK(inode->i_mode) || S_ISREG(inode->i_mode)) &&
--		    inode->i_ino != EXT4_JOURNAL_INO) {
-+		if (inode->i_ino != EXT4_JOURNAL_INO &&
-+		    ext4_should_journal_data(inode) &&
-+		    (S_ISLNK(inode->i_mode) || S_ISREG(inode->i_mode))) {
- 			journal_t *journal = EXT4_SB(inode->i_sb)->s_journal;
- 			tid_t commit_tid = EXT4_I(inode)->i_datasync_tid;
- 
-@@ -2748,13 +2748,36 @@ retry:
- 				done = true;
- 			}
- 		}
--		ext4_journal_stop(handle);
-+		/*
-+		 * Caution: If the handle is synchronous,
-+		 * ext4_journal_stop() can wait for transaction commit
-+		 * to finish which may depend on writeback of pages to
-+		 * complete or on page lock to be released.  In that
-+		 * case, we have to wait until after after we have
-+		 * submitted all the IO, released page locks we hold,
-+		 * and dropped io_end reference (for extent conversion
-+		 * to be able to complete) before stopping the handle.
-+		 */
-+		if (!ext4_handle_valid(handle) || handle->h_sync == 0) {
-+			ext4_journal_stop(handle);
-+			handle = NULL;
-+		}
- 		/* Submit prepared bio */
- 		ext4_io_submit(&mpd.io_submit);
- 		/* Unlock pages we didn't use */
- 		mpage_release_unused_pages(&mpd, give_up_on_write);
--		/* Drop our io_end reference we got from init */
--		ext4_put_io_end(mpd.io_submit.io_end);
-+		/*
-+		 * Drop our io_end reference we got from init. We have
-+		 * to be careful and use deferred io_end finishing if
-+		 * we are still holding the transaction as we can
-+		 * release the last reference to io_end which may end
-+		 * up doing unwritten extent conversion.
-+		 */
-+		if (handle) {
-+			ext4_put_io_end_defer(mpd.io_submit.io_end);
-+			ext4_journal_stop(handle);
-+		} else
-+			ext4_put_io_end(mpd.io_submit.io_end);
- 
- 		if (ret == -ENOSPC && sbi->s_journal) {
- 			/*
-diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c
-index c1ab3ec..7f42eda 100644
---- a/fs/ext4/mballoc.c
-+++ b/fs/ext4/mballoc.c
-@@ -2939,7 +2939,7 @@ ext4_mb_mark_diskspace_used(struct ext4_allocation_context *ac,
- 		ext4_error(sb, "Allocating blocks %llu-%llu which overlap "
- 			   "fs metadata", block, block+len);
- 		/* File system mounted not to panic on error
--		 * Fix the bitmap and repeat the block allocation
-+		 * Fix the bitmap and return EFSCORRUPTED
- 		 * We leak some of the blocks here.
- 		 */
- 		ext4_lock_group(sb, ac->ac_b_ex.fe_group);
-@@ -2948,7 +2948,7 @@ ext4_mb_mark_diskspace_used(struct ext4_allocation_context *ac,
- 		ext4_unlock_group(sb, ac->ac_b_ex.fe_group);
- 		err = ext4_handle_dirty_metadata(handle, NULL, bitmap_bh);
- 		if (!err)
--			err = -EAGAIN;
-+			err = -EFSCORRUPTED;
- 		goto out_err;
- 	}
- 
-@@ -4513,18 +4513,7 @@ repeat:
- 	}
- 	if (likely(ac->ac_status == AC_STATUS_FOUND)) {
- 		*errp = ext4_mb_mark_diskspace_used(ac, handle, reserv_clstrs);
--		if (*errp == -EAGAIN) {
--			/*
--			 * drop the reference that we took
--			 * in ext4_mb_use_best_found
--			 */
--			ext4_mb_release_context(ac);
--			ac->ac_b_ex.fe_group = 0;
--			ac->ac_b_ex.fe_start = 0;
--			ac->ac_b_ex.fe_len = 0;
--			ac->ac_status = AC_STATUS_CONTINUE;
--			goto repeat;
--		} else if (*errp) {
-+		if (*errp) {
- 			ext4_discard_allocated_blocks(ac);
- 			goto errout;
- 		} else {
-diff --git a/fs/ext4/super.c b/fs/ext4/super.c
-index 3822a5a..639bd756 100644
---- a/fs/ext4/super.c
-+++ b/fs/ext4/super.c
-@@ -2278,6 +2278,16 @@ static void ext4_orphan_cleanup(struct super_block *sb,
- 	while (es->s_last_orphan) {
- 		struct inode *inode;
- 
-+		/*
-+		 * We may have encountered an error during cleanup; if
-+		 * so, skip the rest.
-+		 */
-+		if (EXT4_SB(sb)->s_mount_state & EXT4_ERROR_FS) {
-+			jbd_debug(1, "Skipping orphan recovery on fs with errors.\n");
-+			es->s_last_orphan = 0;
-+			break;
-+		}
-+
- 		inode = ext4_orphan_get(sb, le32_to_cpu(es->s_last_orphan));
- 		if (IS_ERR(inode)) {
- 			es->s_last_orphan = 0;
-@@ -3416,6 +3426,13 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent)
- 		goto failed_mount;
- 	}
- 
-+	if (le16_to_cpu(sbi->s_es->s_reserved_gdt_blocks) > (blocksize / 4)) {
-+		ext4_msg(sb, KERN_ERR,
-+			 "Number of reserved GDT blocks insanely large: %d",
-+			 le16_to_cpu(sbi->s_es->s_reserved_gdt_blocks));
-+		goto failed_mount;
-+	}
-+
- 	if (sbi->s_mount_opt & EXT4_MOUNT_DAX) {
- 		err = bdev_dax_supported(sb, blocksize);
- 		if (err)
-diff --git a/fs/fuse/file.c b/fs/fuse/file.c
-index 9154f86..6cac3dc 100644
---- a/fs/fuse/file.c
-+++ b/fs/fuse/file.c
-@@ -417,6 +417,15 @@ static int fuse_flush(struct file *file, fl_owner_t id)
- 	fuse_sync_writes(inode);
- 	inode_unlock(inode);
- 
-+	if (test_bit(AS_ENOSPC, &file->f_mapping->flags) &&
-+	    test_and_clear_bit(AS_ENOSPC, &file->f_mapping->flags))
-+		err = -ENOSPC;
-+	if (test_bit(AS_EIO, &file->f_mapping->flags) &&
-+	    test_and_clear_bit(AS_EIO, &file->f_mapping->flags))
-+		err = -EIO;
-+	if (err)
-+		return err;
-+
- 	req = fuse_get_req_nofail_nopages(fc, file);
- 	memset(&inarg, 0, sizeof(inarg));
- 	inarg.fh = ff->fh;
-@@ -462,6 +471,21 @@ int fuse_fsync_common(struct file *file, loff_t start, loff_t end,
- 		goto out;
- 
- 	fuse_sync_writes(inode);
-+
-+	/*
-+	 * Due to implementation of fuse writeback
-+	 * filemap_write_and_wait_range() does not catch errors.
-+	 * We have to do this directly after fuse_sync_writes()
-+	 */
-+	if (test_bit(AS_ENOSPC, &file->f_mapping->flags) &&
-+	    test_and_clear_bit(AS_ENOSPC, &file->f_mapping->flags))
-+		err = -ENOSPC;
-+	if (test_bit(AS_EIO, &file->f_mapping->flags) &&
-+	    test_and_clear_bit(AS_EIO, &file->f_mapping->flags))
-+		err = -EIO;
-+	if (err)
-+		goto out;
-+
- 	err = sync_inode_metadata(inode, 1);
- 	if (err)
- 		goto out;
-diff --git a/fs/fuse/inode.c b/fs/fuse/inode.c
-index 9961d843..9b7cb37 100644
---- a/fs/fuse/inode.c
-+++ b/fs/fuse/inode.c
-@@ -942,7 +942,7 @@ static void fuse_send_init(struct fuse_conn *fc, struct fuse_req *req)
- 	arg->flags |= FUSE_ASYNC_READ | FUSE_POSIX_LOCKS | FUSE_ATOMIC_O_TRUNC |
- 		FUSE_EXPORT_SUPPORT | FUSE_BIG_WRITES | FUSE_DONT_MASK |
- 		FUSE_SPLICE_WRITE | FUSE_SPLICE_MOVE | FUSE_SPLICE_READ |
--		FUSE_FLOCK_LOCKS | FUSE_IOCTL_DIR | FUSE_AUTO_INVAL_DATA |
-+		FUSE_FLOCK_LOCKS | FUSE_HAS_IOCTL_DIR | FUSE_AUTO_INVAL_DATA |
- 		FUSE_DO_READDIRPLUS | FUSE_READDIRPLUS_AUTO | FUSE_ASYNC_DIO |
- 		FUSE_WRITEBACK_CACHE | FUSE_NO_OPEN_SUPPORT |
- 		FUSE_PARALLEL_DIROPS;
-diff --git a/fs/inode.c b/fs/inode.c
-index 4ccbc21..9ea4219 100644
---- a/fs/inode.c
-+++ b/fs/inode.c
-@@ -345,7 +345,7 @@ EXPORT_SYMBOL(inc_nlink);
- void address_space_init_once(struct address_space *mapping)
- {
- 	memset(mapping, 0, sizeof(*mapping));
--	INIT_RADIX_TREE(&mapping->page_tree, GFP_ATOMIC);
-+	INIT_RADIX_TREE(&mapping->page_tree, GFP_ATOMIC | __GFP_ACCOUNT);
- 	spin_lock_init(&mapping->tree_lock);
- 	init_rwsem(&mapping->i_mmap_rwsem);
- 	INIT_LIST_HEAD(&mapping->private_list);
-@@ -1740,8 +1740,8 @@ static int __remove_privs(struct dentry *dentry, int kill)
-  */
- int file_remove_privs(struct file *file)
- {
--	struct dentry *dentry = file->f_path.dentry;
--	struct inode *inode = d_inode(dentry);
-+	struct dentry *dentry = file_dentry(file);
-+	struct inode *inode = file_inode(file);
- 	int kill;
- 	int error = 0;
- 
-@@ -1749,7 +1749,7 @@ int file_remove_privs(struct file *file)
- 	if (IS_NOSEC(inode))
- 		return 0;
- 
--	kill = file_needs_remove_privs(file);
-+	kill = dentry_needs_remove_privs(dentry);
- 	if (kill < 0)
- 		return kill;
- 	if (kill)
-diff --git a/fs/ioctl.c b/fs/ioctl.c
-index 116a333..0f56deb 100644
---- a/fs/ioctl.c
-+++ b/fs/ioctl.c
-@@ -590,6 +590,7 @@ static long ioctl_file_dedupe_range(struct file *file, void __user *arg)
- 		goto out;
- 	}
- 
-+	same->dest_count = count;
- 	ret = vfs_dedupe_file_range(file, same);
- 	if (ret)
- 		goto out;
-diff --git a/ipc/msg.c b/ipc/msg.c
-index 1471db9..c6521c2 100644
---- a/ipc/msg.c
-+++ b/ipc/msg.c
-@@ -680,7 +680,7 @@ long do_msgsnd(int msqid, long mtype, void __user *mtext,
- 		rcu_read_lock();
- 		ipc_lock_object(&msq->q_perm);
- 
--		ipc_rcu_putref(msq, ipc_rcu_free);
-+		ipc_rcu_putref(msq, msg_rcu_free);
- 		/* raced with RMID? */
- 		if (!ipc_valid_object(&msq->q_perm)) {
- 			err = -EIDRM;
-diff --git a/ipc/sem.c b/ipc/sem.c
-index b3757ea..5d2f875 100644
---- a/ipc/sem.c
-+++ b/ipc/sem.c
-@@ -449,7 +449,7 @@ static inline struct sem_array *sem_obtain_object_check(struct ipc_namespace *ns
- static inline void sem_lock_and_putref(struct sem_array *sma)
- {
- 	sem_lock(sma, NULL, -1);
--	ipc_rcu_putref(sma, ipc_rcu_free);
-+	ipc_rcu_putref(sma, sem_rcu_free);
- }
- 
- static inline void sem_rmid(struct ipc_namespace *ns, struct sem_array *s)
-@@ -1392,7 +1392,7 @@ static int semctl_main(struct ipc_namespace *ns, int semid, int semnum,
- 			rcu_read_unlock();
- 			sem_io = ipc_alloc(sizeof(ushort)*nsems);
- 			if (sem_io == NULL) {
--				ipc_rcu_putref(sma, ipc_rcu_free);
-+				ipc_rcu_putref(sma, sem_rcu_free);
- 				return -ENOMEM;
- 			}
- 
-@@ -1426,20 +1426,20 @@ static int semctl_main(struct ipc_namespace *ns, int semid, int semnum,
- 		if (nsems > SEMMSL_FAST) {
- 			sem_io = ipc_alloc(sizeof(ushort)*nsems);
- 			if (sem_io == NULL) {
--				ipc_rcu_putref(sma, ipc_rcu_free);
-+				ipc_rcu_putref(sma, sem_rcu_free);
- 				return -ENOMEM;
- 			}
- 		}
- 
- 		if (copy_from_user(sem_io, p, nsems*sizeof(ushort))) {
--			ipc_rcu_putref(sma, ipc_rcu_free);
-+			ipc_rcu_putref(sma, sem_rcu_free);
- 			err = -EFAULT;
- 			goto out_free;
- 		}
- 
- 		for (i = 0; i < nsems; i++) {
- 			if (sem_io[i] > SEMVMX) {
--				ipc_rcu_putref(sma, ipc_rcu_free);
-+				ipc_rcu_putref(sma, sem_rcu_free);
- 				err = -ERANGE;
- 				goto out_free;
- 			}
-@@ -1731,7 +1731,7 @@ static struct sem_undo *find_alloc_undo(struct ipc_namespace *ns, int semid)
- 	/* step 2: allocate new undo structure */
- 	new = kzalloc(sizeof(struct sem_undo) + sizeof(short)*nsems, GFP_KERNEL);
- 	if (!new) {
--		ipc_rcu_putref(sma, ipc_rcu_free);
-+		ipc_rcu_putref(sma, sem_rcu_free);
- 		return ERR_PTR(-ENOMEM);
- 	}
- 
-diff --git a/lib/radix-tree.c b/lib/radix-tree.c
-index 8b7d845..bc7852f 100644
---- a/lib/radix-tree.c
-+++ b/lib/radix-tree.c
-@@ -274,10 +274,11 @@ radix_tree_node_alloc(struct radix_tree_root *root)
- 
- 		/*
- 		 * Even if the caller has preloaded, try to allocate from the
--		 * cache first for the new node to get accounted.
-+		 * cache first for the new node to get accounted to the memory
-+		 * cgroup.
- 		 */
- 		ret = kmem_cache_alloc(radix_tree_node_cachep,
--				       gfp_mask | __GFP_ACCOUNT | __GFP_NOWARN);
-+				       gfp_mask | __GFP_NOWARN);
- 		if (ret)
- 			goto out;
- 
-@@ -300,8 +301,7 @@ radix_tree_node_alloc(struct radix_tree_root *root)
- 		kmemleak_update_trace(ret);
- 		goto out;
- 	}
--	ret = kmem_cache_alloc(radix_tree_node_cachep,
--			       gfp_mask | __GFP_ACCOUNT);
-+	ret = kmem_cache_alloc(radix_tree_node_cachep, gfp_mask);
- out:
- 	BUG_ON(radix_tree_is_internal_node(ret));
- 	return ret;
-@@ -348,6 +348,12 @@ static int __radix_tree_preload(gfp_t gfp_mask)
- 	struct radix_tree_node *node;
- 	int ret = -ENOMEM;
- 
-+	/*
-+	 * Nodes preloaded by one cgroup can be be used by another cgroup, so
-+	 * they should never be accounted to any particular memory cgroup.
-+	 */
-+	gfp_mask &= ~__GFP_ACCOUNT;
-+
- 	preempt_disable();
- 	rtp = this_cpu_ptr(&radix_tree_preloads);
- 	while (rtp->nr < RADIX_TREE_PRELOAD_SIZE) {
-diff --git a/mm/memcontrol.c b/mm/memcontrol.c
-index 5339c89..ca847d9 100644
---- a/mm/memcontrol.c
-+++ b/mm/memcontrol.c
-@@ -4083,14 +4083,32 @@ static struct cftype mem_cgroup_legacy_files[] = {
- 
- static DEFINE_IDR(mem_cgroup_idr);
- 
--static void mem_cgroup_id_get(struct mem_cgroup *memcg)
-+static void mem_cgroup_id_get_many(struct mem_cgroup *memcg, unsigned int n)
- {
--	atomic_inc(&memcg->id.ref);
-+	atomic_add(n, &memcg->id.ref);
- }
- 
--static void mem_cgroup_id_put(struct mem_cgroup *memcg)
-+static struct mem_cgroup *mem_cgroup_id_get_online(struct mem_cgroup *memcg)
- {
--	if (atomic_dec_and_test(&memcg->id.ref)) {
-+	while (!atomic_inc_not_zero(&memcg->id.ref)) {
-+		/*
-+		 * The root cgroup cannot be destroyed, so it's refcount must
-+		 * always be >= 1.
-+		 */
-+		if (WARN_ON_ONCE(memcg == root_mem_cgroup)) {
-+			VM_BUG_ON(1);
-+			break;
-+		}
-+		memcg = parent_mem_cgroup(memcg);
-+		if (!memcg)
-+			memcg = root_mem_cgroup;
-+	}
-+	return memcg;
-+}
-+
-+static void mem_cgroup_id_put_many(struct mem_cgroup *memcg, unsigned int n)
-+{
-+	if (atomic_sub_and_test(n, &memcg->id.ref)) {
- 		idr_remove(&mem_cgroup_idr, memcg->id.id);
- 		memcg->id.id = 0;
- 
-@@ -4099,6 +4117,16 @@ static void mem_cgroup_id_put(struct mem_cgroup *memcg)
- 	}
- }
- 
-+static inline void mem_cgroup_id_get(struct mem_cgroup *memcg)
-+{
-+	mem_cgroup_id_get_many(memcg, 1);
-+}
-+
-+static inline void mem_cgroup_id_put(struct mem_cgroup *memcg)
-+{
-+	mem_cgroup_id_put_many(memcg, 1);
-+}
-+
- /**
-  * mem_cgroup_from_id - look up a memcg from a memcg id
-  * @id: the memcg id to look up
-@@ -4736,6 +4764,8 @@ static void __mem_cgroup_clear_mc(void)
- 		if (!mem_cgroup_is_root(mc.from))
- 			page_counter_uncharge(&mc.from->memsw, mc.moved_swap);
- 
-+		mem_cgroup_id_put_many(mc.from, mc.moved_swap);
-+
- 		/*
- 		 * we charged both to->memory and to->memsw, so we
- 		 * should uncharge to->memory.
-@@ -4743,9 +4773,9 @@ static void __mem_cgroup_clear_mc(void)
- 		if (!mem_cgroup_is_root(mc.to))
- 			page_counter_uncharge(&mc.to->memory, mc.moved_swap);
- 
--		css_put_many(&mc.from->css, mc.moved_swap);
-+		mem_cgroup_id_get_many(mc.to, mc.moved_swap);
-+		css_put_many(&mc.to->css, mc.moved_swap);
- 
--		/* we've already done css_get(mc.to) */
- 		mc.moved_swap = 0;
- 	}
- 	memcg_oom_recover(from);
-@@ -5805,7 +5835,7 @@ subsys_initcall(mem_cgroup_init);
-  */
- void mem_cgroup_swapout(struct page *page, swp_entry_t entry)
- {
--	struct mem_cgroup *memcg;
-+	struct mem_cgroup *memcg, *swap_memcg;
- 	unsigned short oldid;
- 
- 	VM_BUG_ON_PAGE(PageLRU(page), page);
-@@ -5820,16 +5850,27 @@ void mem_cgroup_swapout(struct page *page, swp_entry_t entry)
- 	if (!memcg)
- 		return;
- 
--	mem_cgroup_id_get(memcg);
--	oldid = swap_cgroup_record(entry, mem_cgroup_id(memcg));
-+	/*
-+	 * In case the memcg owning these pages has been offlined and doesn't
-+	 * have an ID allocated to it anymore, charge the closest online
-+	 * ancestor for the swap instead and transfer the memory+swap charge.
-+	 */
-+	swap_memcg = mem_cgroup_id_get_online(memcg);
-+	oldid = swap_cgroup_record(entry, mem_cgroup_id(swap_memcg));
- 	VM_BUG_ON_PAGE(oldid, page);
--	mem_cgroup_swap_statistics(memcg, true);
-+	mem_cgroup_swap_statistics(swap_memcg, true);
- 
- 	page->mem_cgroup = NULL;
- 
- 	if (!mem_cgroup_is_root(memcg))
- 		page_counter_uncharge(&memcg->memory, 1);
- 
-+	if (memcg != swap_memcg) {
-+		if (!mem_cgroup_is_root(swap_memcg))
-+			page_counter_charge(&swap_memcg->memsw, 1);
-+		page_counter_uncharge(&memcg->memsw, 1);
-+	}
-+
- 	/*
- 	 * Interrupts should be disabled here because the caller holds the
- 	 * mapping->tree_lock lock which is taken with interrupts-off. It is
-@@ -5868,11 +5909,14 @@ int mem_cgroup_try_charge_swap(struct page *page, swp_entry_t entry)
- 	if (!memcg)
- 		return 0;
- 
-+	memcg = mem_cgroup_id_get_online(memcg);
-+
- 	if (!mem_cgroup_is_root(memcg) &&
--	    !page_counter_try_charge(&memcg->swap, 1, &counter))
-+	    !page_counter_try_charge(&memcg->swap, 1, &counter)) {
-+		mem_cgroup_id_put(memcg);
- 		return -ENOMEM;
-+	}
- 
--	mem_cgroup_id_get(memcg);
- 	oldid = swap_cgroup_record(entry, mem_cgroup_id(memcg));
- 	VM_BUG_ON_PAGE(oldid, page);
- 	mem_cgroup_swap_statistics(memcg, true);
-diff --git a/mm/mempool.c b/mm/mempool.c
-index 8f65464..47a659d 100644
---- a/mm/mempool.c
-+++ b/mm/mempool.c
-@@ -306,7 +306,7 @@ EXPORT_SYMBOL(mempool_resize);
-  * returns NULL. Note that due to preallocation, this function
-  * *never* fails when called from process contexts. (it might
-  * fail if called from an IRQ context.)
-- * Note: neither __GFP_NOMEMALLOC nor __GFP_ZERO are supported.
-+ * Note: using __GFP_ZERO is not supported.
-  */
- void *mempool_alloc(mempool_t *pool, gfp_t gfp_mask)
- {
-@@ -315,27 +315,16 @@ void *mempool_alloc(mempool_t *pool, gfp_t gfp_mask)
- 	wait_queue_t wait;
- 	gfp_t gfp_temp;
- 
--	/* If oom killed, memory reserves are essential to prevent livelock */
--	VM_WARN_ON_ONCE(gfp_mask & __GFP_NOMEMALLOC);
--	/* No element size to zero on allocation */
- 	VM_WARN_ON_ONCE(gfp_mask & __GFP_ZERO);
--
- 	might_sleep_if(gfp_mask & __GFP_DIRECT_RECLAIM);
- 
-+	gfp_mask |= __GFP_NOMEMALLOC;	/* don't allocate emergency reserves */
- 	gfp_mask |= __GFP_NORETRY;	/* don't loop in __alloc_pages */
- 	gfp_mask |= __GFP_NOWARN;	/* failures are OK */
- 
- 	gfp_temp = gfp_mask & ~(__GFP_DIRECT_RECLAIM|__GFP_IO);
- 
- repeat_alloc:
--	if (likely(pool->curr_nr)) {
--		/*
--		 * Don't allocate from emergency reserves if there are
--		 * elements available.  This check is racy, but it will
--		 * be rechecked each loop.
--		 */
--		gfp_temp |= __GFP_NOMEMALLOC;
--	}
- 
- 	element = pool->alloc(gfp_temp, pool->pool_data);
- 	if (likely(element != NULL))
-@@ -359,12 +348,11 @@ repeat_alloc:
- 	 * We use gfp mask w/o direct reclaim or IO for the first round.  If
- 	 * alloc failed with that and @pool was empty, retry immediately.
- 	 */
--	if ((gfp_temp & ~__GFP_NOMEMALLOC) != gfp_mask) {
-+	if (gfp_temp != gfp_mask) {
- 		spin_unlock_irqrestore(&pool->lock, flags);
- 		gfp_temp = gfp_mask;
- 		goto repeat_alloc;
- 	}
--	gfp_temp = gfp_mask;
- 
- 	/* We must not sleep if !__GFP_DIRECT_RECLAIM */
- 	if (!(gfp_mask & __GFP_DIRECT_RECLAIM)) {
-diff --git a/net/bridge/br_input.c b/net/bridge/br_input.c
-index 43d2cd8..28d5ec2 100644
---- a/net/bridge/br_input.c
-+++ b/net/bridge/br_input.c
-@@ -288,6 +288,14 @@ rx_handler_result_t br_handle_frame(struct sk_buff **pskb)
- 		case 0x01:	/* IEEE MAC (Pause) */
- 			goto drop;
- 
-+		case 0x0E:	/* 802.1AB LLDP */
-+			fwd_mask |= p->br->group_fwd_mask;
-+			if (fwd_mask & (1u << dest[5]))
-+				goto forward;
-+			*pskb = skb;
-+			__br_handle_local_finish(skb);
-+			return RX_HANDLER_PASS;
-+
- 		default:
- 			/* Allow selective forwarding for most other protocols */
- 			fwd_mask |= p->br->group_fwd_mask;
-diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
-index e00e972..700b72c 100644
---- a/net/ipv4/tcp_output.c
-+++ b/net/ipv4/tcp_output.c
-@@ -236,7 +236,8 @@ void tcp_select_initial_window(int __space, __u32 mss,
- 		/* Set window scaling on max possible window
- 		 * See RFC1323 for an explanation of the limit to 14
- 		 */
--		space = max_t(u32, sysctl_tcp_rmem[2], sysctl_rmem_max);
-+		space = max_t(u32, space, sysctl_tcp_rmem[2]);
-+		space = max_t(u32, space, sysctl_rmem_max);
- 		space = min_t(u32, space, *window_clamp);
- 		while (space > 65535 && (*rcv_wscale) < 14) {
- 			space >>= 1;
-diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
-index 4aed8fc..e61f7cd 100644
---- a/net/ipv4/udp.c
-+++ b/net/ipv4/udp.c
-@@ -1581,9 +1581,7 @@ int udp_queue_rcv_skb(struct sock *sk, struct sk_buff *skb)
- 	    udp_lib_checksum_complete(skb))
- 			goto csum_error;
- 
--	if (sk_filter(sk, skb))
--		goto drop;
--	if (unlikely(skb->len < sizeof(struct udphdr)))
-+	if (sk_filter_trim_cap(sk, skb, sizeof(struct udphdr)))
- 		goto drop;
- 
- 	udp_csum_pull_header(skb);
-diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
-index 47f837a..047c75a 100644
---- a/net/ipv6/addrconf.c
-+++ b/net/ipv6/addrconf.c
-@@ -3562,6 +3562,10 @@ restart:
- 		if (state != INET6_IFADDR_STATE_DEAD) {
- 			__ipv6_ifa_notify(RTM_DELADDR, ifa);
- 			inet6addr_notifier_call_chain(NETDEV_DOWN, ifa);
-+		} else {
-+			if (idev->cnf.forwarding)
-+				addrconf_leave_anycast(ifa);
-+			addrconf_leave_solict(ifa->idev, &ifa->addr);
- 		}
- 
- 		write_lock_bh(&idev->lock);
-diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
-index acc09705..42a2edf 100644
---- a/net/ipv6/udp.c
-+++ b/net/ipv6/udp.c
-@@ -618,9 +618,7 @@ int udpv6_queue_rcv_skb(struct sock *sk, struct sk_buff *skb)
- 	    udp_lib_checksum_complete(skb))
- 		goto csum_error;
- 
--	if (sk_filter(sk, skb))
--		goto drop;
--	if (unlikely(skb->len < sizeof(struct udphdr)))
-+	if (sk_filter_trim_cap(sk, skb, sizeof(struct udphdr)))
- 		goto drop;
- 
- 	udp_csum_pull_header(skb);
-diff --git a/net/irda/af_irda.c b/net/irda/af_irda.c
-index 923abd6..8d2f7c9 100644
---- a/net/irda/af_irda.c
-+++ b/net/irda/af_irda.c
-@@ -1024,8 +1024,11 @@ static int irda_connect(struct socket *sock, struct sockaddr *uaddr,
- 	}
- 
- 	/* Check if we have opened a local TSAP */
--	if (!self->tsap)
--		irda_open_tsap(self, LSAP_ANY, addr->sir_name);
-+	if (!self->tsap) {
-+		err = irda_open_tsap(self, LSAP_ANY, addr->sir_name);
-+		if (err)
-+			goto out;
-+	}
- 
- 	/* Move to connecting socket, start sending Connect Requests */
- 	sock->state = SS_CONNECTING;
-diff --git a/net/sctp/input.c b/net/sctp/input.c
-index 47cf460..f093322 100644
---- a/net/sctp/input.c
-+++ b/net/sctp/input.c
-@@ -328,6 +328,7 @@ int sctp_backlog_rcv(struct sock *sk, struct sk_buff *skb)
- 		 */
- 
- 		sk = rcvr->sk;
-+		local_bh_disable();
- 		bh_lock_sock(sk);
- 
- 		if (sock_owned_by_user(sk)) {
-@@ -339,6 +340,7 @@ int sctp_backlog_rcv(struct sock *sk, struct sk_buff *skb)
- 			sctp_inq_push(inqueue, chunk);
- 
- 		bh_unlock_sock(sk);
-+		local_bh_enable();
- 
- 		/* If the chunk was backloged again, don't drop refs */
- 		if (backloged)
-diff --git a/net/sctp/inqueue.c b/net/sctp/inqueue.c
-index 9d87bba..b335ffc 100644
---- a/net/sctp/inqueue.c
-+++ b/net/sctp/inqueue.c
-@@ -89,12 +89,10 @@ void sctp_inq_push(struct sctp_inq *q, struct sctp_chunk *chunk)
- 	 * Eventually, we should clean up inqueue to not rely
- 	 * on the BH related data structures.
- 	 */
--	local_bh_disable();
- 	list_add_tail(&chunk->list, &q->in_chunk_list);
- 	if (chunk->asoc)
- 		chunk->asoc->stats.ipackets++;
- 	q->immediate.func(&q->immediate);
--	local_bh_enable();
- }
- 
- /* Peek at the next chunk on the inqeue. */
-diff --git a/net/sctp/socket.c b/net/sctp/socket.c
-index 67154b8..7f5689a 100644
---- a/net/sctp/socket.c
-+++ b/net/sctp/socket.c
-@@ -4301,6 +4301,7 @@ int sctp_transport_walk_start(struct rhashtable_iter *iter)
- 
- 	err = rhashtable_walk_start(iter);
- 	if (err && err != -EAGAIN) {
-+		rhashtable_walk_stop(iter);
- 		rhashtable_walk_exit(iter);
- 		return err;
- 	}
-diff --git a/security/apparmor/apparmorfs.c b/security/apparmor/apparmorfs.c
-index ad4fa49..9068369 100644
---- a/security/apparmor/apparmorfs.c
-+++ b/security/apparmor/apparmorfs.c
-@@ -331,6 +331,7 @@ static int aa_fs_seq_hash_show(struct seq_file *seq, void *v)
- 			seq_printf(seq, "%.2x", profile->hash[i]);
- 		seq_puts(seq, "\n");
- 	}
-+	aa_put_profile(profile);
- 
- 	return 0;
- }

diff --git a/4.7.4/1001_linux-4.7.2.patch b/4.7.4/1001_linux-4.7.2.patch
deleted file mode 100644
index d0ef798..0000000
--- a/4.7.4/1001_linux-4.7.2.patch
+++ /dev/null
@@ -1,7668 +0,0 @@
-diff --git a/Documentation/module-signing.txt b/Documentation/module-signing.txt
-index 696d5ca..f0e3361 100644
---- a/Documentation/module-signing.txt
-+++ b/Documentation/module-signing.txt
-@@ -271,3 +271,9 @@ Since the private key is used to sign modules, viruses and malware could use
- the private key to sign modules and compromise the operating system.  The
- private key must be either destroyed or moved to a secure location and not kept
- in the root node of the kernel source tree.
-+
-+If you use the same private key to sign modules for multiple kernel
-+configurations, you must ensure that the module version information is
-+sufficient to prevent loading a module into a different kernel.  Either
-+set CONFIG_MODVERSIONS=y or ensure that each configuration has a different
-+kernel release string by changing EXTRAVERSION or CONFIG_LOCALVERSION.
-diff --git a/Makefile b/Makefile
-index 84335c0..bb98f1c 100644
---- a/Makefile
-+++ b/Makefile
-@@ -1,6 +1,6 @@
- VERSION = 4
- PATCHLEVEL = 7
--SUBLEVEL = 1
-+SUBLEVEL = 2
- EXTRAVERSION =
- NAME = Psychotic Stoned Sheep
- 
-diff --git a/arch/arc/include/asm/pgtable.h b/arch/arc/include/asm/pgtable.h
-index 858f98e..0f92d97 100644
---- a/arch/arc/include/asm/pgtable.h
-+++ b/arch/arc/include/asm/pgtable.h
-@@ -110,7 +110,7 @@
- #define ___DEF (_PAGE_PRESENT | _PAGE_CACHEABLE)
- 
- /* Set of bits not changed in pte_modify */
--#define _PAGE_CHG_MASK	(PAGE_MASK | _PAGE_ACCESSED | _PAGE_DIRTY)
-+#define _PAGE_CHG_MASK	(PAGE_MASK | _PAGE_ACCESSED | _PAGE_DIRTY | _PAGE_SPECIAL)
- 
- /* More Abbrevaited helpers */
- #define PAGE_U_NONE     __pgprot(___DEF)
-diff --git a/arch/arc/mm/dma.c b/arch/arc/mm/dma.c
-index 73d7e4c..ab74b5d 100644
---- a/arch/arc/mm/dma.c
-+++ b/arch/arc/mm/dma.c
-@@ -92,7 +92,8 @@ static void *arc_dma_alloc(struct device *dev, size_t size,
- static void arc_dma_free(struct device *dev, size_t size, void *vaddr,
- 		dma_addr_t dma_handle, struct dma_attrs *attrs)
- {
--	struct page *page = virt_to_page(dma_handle);
-+	phys_addr_t paddr = plat_dma_to_phys(dev, dma_handle);
-+	struct page *page = virt_to_page(paddr);
- 	int is_non_coh = 1;
- 
- 	is_non_coh = dma_get_attr(DMA_ATTR_NON_CONSISTENT, attrs) ||
-diff --git a/arch/arm/boot/dts/arm-realview-pbx-a9.dts b/arch/arm/boot/dts/arm-realview-pbx-a9.dts
-index db808f9..90d00b4 100644
---- a/arch/arm/boot/dts/arm-realview-pbx-a9.dts
-+++ b/arch/arm/boot/dts/arm-realview-pbx-a9.dts
-@@ -70,13 +70,12 @@
- 		 * associativity as these may be erroneously set
- 		 * up by boot loader(s).
- 		 */
--		cache-size = <1048576>; // 1MB
--		cache-sets = <4096>;
-+		cache-size = <131072>; // 128KB
-+		cache-sets = <512>;
- 		cache-line-size = <32>;
- 		arm,parity-disable;
--		arm,tag-latency = <1>;
--		arm,data-latency = <1 1>;
--		arm,dirty-latency = <1>;
-+		arm,tag-latency = <1 1 1>;
-+		arm,data-latency = <1 1 1>;
- 	};
- 
- 	scu: scu@1f000000 {
-diff --git a/arch/arm/boot/dts/sun4i-a10-a1000.dts b/arch/arm/boot/dts/sun4i-a10-a1000.dts
-index c92a1ae..fa70b8f 100644
---- a/arch/arm/boot/dts/sun4i-a10-a1000.dts
-+++ b/arch/arm/boot/dts/sun4i-a10-a1000.dts
-@@ -84,6 +84,7 @@
- 		regulator-name = "emac-3v3";
- 		regulator-min-microvolt = <3300000>;
- 		regulator-max-microvolt = <3300000>;
-+		startup-delay-us = <20000>;
- 		enable-active-high;
- 		gpio = <&pio 7 15 GPIO_ACTIVE_HIGH>;
- 	};
-diff --git a/arch/arm/boot/dts/sun4i-a10-hackberry.dts b/arch/arm/boot/dts/sun4i-a10-hackberry.dts
-index 2b17c51..6de83a6 100644
---- a/arch/arm/boot/dts/sun4i-a10-hackberry.dts
-+++ b/arch/arm/boot/dts/sun4i-a10-hackberry.dts
-@@ -66,6 +66,7 @@
- 		regulator-name = "emac-3v3";
- 		regulator-min-microvolt = <3300000>;
- 		regulator-max-microvolt = <3300000>;
-+		startup-delay-us = <20000>;
- 		enable-active-high;
- 		gpio = <&pio 7 19 GPIO_ACTIVE_HIGH>;
- 	};
-diff --git a/arch/arm/boot/dts/sun4i-a10-jesurun-q5.dts b/arch/arm/boot/dts/sun4i-a10-jesurun-q5.dts
-index 7afc7a6..e28f080 100644
---- a/arch/arm/boot/dts/sun4i-a10-jesurun-q5.dts
-+++ b/arch/arm/boot/dts/sun4i-a10-jesurun-q5.dts
-@@ -80,6 +80,7 @@
- 		regulator-name = "emac-3v3";
- 		regulator-min-microvolt = <3300000>;
- 		regulator-max-microvolt = <3300000>;
-+		startup-delay-us = <20000>;
- 		enable-active-high;
- 		gpio = <&pio 7 19 GPIO_ACTIVE_HIGH>;   /* PH19 */
- 	};
-diff --git a/arch/arm/boot/dts/sun5i-a10s-wobo-i5.dts b/arch/arm/boot/dts/sun5i-a10s-wobo-i5.dts
-index 9fea918..39731a7 100644
---- a/arch/arm/boot/dts/sun5i-a10s-wobo-i5.dts
-+++ b/arch/arm/boot/dts/sun5i-a10s-wobo-i5.dts
-@@ -79,6 +79,7 @@
- 		regulator-name = "emac-3v3";
- 		regulator-min-microvolt = <3300000>;
- 		regulator-max-microvolt = <3300000>;
-+		startup-delay-us = <20000>;
- 		enable-active-high;
- 		gpio = <&pio 0 2 GPIO_ACTIVE_HIGH>;
- 	};
-diff --git a/arch/arm/boot/dts/tegra124-jetson-tk1.dts b/arch/arm/boot/dts/tegra124-jetson-tk1.dts
-index 941f362..f4d8125 100644
---- a/arch/arm/boot/dts/tegra124-jetson-tk1.dts
-+++ b/arch/arm/boot/dts/tegra124-jetson-tk1.dts
-@@ -1386,7 +1386,7 @@
- 	 *   Pin 41: BR_UART1_TXD
- 	 *   Pin 44: BR_UART1_RXD
- 	 */
--	serial@70006000 {
-+	serial@0,70006000 {
- 		compatible = "nvidia,tegra124-hsuart", "nvidia,tegra30-hsuart";
- 		status = "okay";
- 	};
-@@ -1398,7 +1398,7 @@
- 	 *   Pin 71: UART2_CTS_L
- 	 *   Pin 74: UART2_RTS_L
- 	 */
--	serial@70006040 {
-+	serial@0,70006040 {
- 		compatible = "nvidia,tegra124-hsuart", "nvidia,tegra30-hsuart";
- 		status = "okay";
- 	};
-diff --git a/arch/arm/configs/aspeed_g4_defconfig b/arch/arm/configs/aspeed_g4_defconfig
-index b6e54ee..ca39c04 100644
---- a/arch/arm/configs/aspeed_g4_defconfig
-+++ b/arch/arm/configs/aspeed_g4_defconfig
-@@ -58,7 +58,7 @@ CONFIG_SERIAL_OF_PLATFORM=y
- # CONFIG_IOMMU_SUPPORT is not set
- CONFIG_FIRMWARE_MEMMAP=y
- CONFIG_FANOTIFY=y
--CONFIG_PRINTK_TIME=1
-+CONFIG_PRINTK_TIME=y
- CONFIG_DYNAMIC_DEBUG=y
- CONFIG_STRIP_ASM_SYMS=y
- CONFIG_PAGE_POISONING=y
-diff --git a/arch/arm/configs/aspeed_g5_defconfig b/arch/arm/configs/aspeed_g5_defconfig
-index 8926051..4f366b0 100644
---- a/arch/arm/configs/aspeed_g5_defconfig
-+++ b/arch/arm/configs/aspeed_g5_defconfig
-@@ -59,7 +59,7 @@ CONFIG_SERIAL_OF_PLATFORM=y
- # CONFIG_IOMMU_SUPPORT is not set
- CONFIG_FIRMWARE_MEMMAP=y
- CONFIG_FANOTIFY=y
--CONFIG_PRINTK_TIME=1
-+CONFIG_PRINTK_TIME=y
- CONFIG_DYNAMIC_DEBUG=y
- CONFIG_STRIP_ASM_SYMS=y
- CONFIG_PAGE_POISONING=y
-diff --git a/arch/arm/mm/dma-mapping.c b/arch/arm/mm/dma-mapping.c
-index ff7ed56..d2485c7 100644
---- a/arch/arm/mm/dma-mapping.c
-+++ b/arch/arm/mm/dma-mapping.c
-@@ -49,6 +49,7 @@ struct arm_dma_alloc_args {
- 	pgprot_t prot;
- 	const void *caller;
- 	bool want_vaddr;
-+	int coherent_flag;
- };
- 
- struct arm_dma_free_args {
-@@ -59,6 +60,9 @@ struct arm_dma_free_args {
- 	bool want_vaddr;
- };
- 
-+#define NORMAL	    0
-+#define COHERENT    1
-+
- struct arm_dma_allocator {
- 	void *(*alloc)(struct arm_dma_alloc_args *args,
- 		       struct page **ret_page);
-@@ -272,7 +276,7 @@ static u64 get_coherent_dma_mask(struct device *dev)
- 	return mask;
- }
- 
--static void __dma_clear_buffer(struct page *page, size_t size)
-+static void __dma_clear_buffer(struct page *page, size_t size, int coherent_flag)
- {
- 	/*
- 	 * Ensure that the allocated pages are zeroed, and that any data
-@@ -284,17 +288,21 @@ static void __dma_clear_buffer(struct page *page, size_t size)
- 		while (size > 0) {
- 			void *ptr = kmap_atomic(page);
- 			memset(ptr, 0, PAGE_SIZE);
--			dmac_flush_range(ptr, ptr + PAGE_SIZE);
-+			if (coherent_flag != COHERENT)
-+				dmac_flush_range(ptr, ptr + PAGE_SIZE);
- 			kunmap_atomic(ptr);
- 			page++;
- 			size -= PAGE_SIZE;
- 		}
--		outer_flush_range(base, end);
-+		if (coherent_flag != COHERENT)
-+			outer_flush_range(base, end);
- 	} else {
- 		void *ptr = page_address(page);
- 		memset(ptr, 0, size);
--		dmac_flush_range(ptr, ptr + size);
--		outer_flush_range(__pa(ptr), __pa(ptr) + size);
-+		if (coherent_flag != COHERENT) {
-+			dmac_flush_range(ptr, ptr + size);
-+			outer_flush_range(__pa(ptr), __pa(ptr) + size);
-+		}
- 	}
- }
- 
-@@ -302,7 +310,8 @@ static void __dma_clear_buffer(struct page *page, size_t size)
-  * Allocate a DMA buffer for 'dev' of size 'size' using the
-  * specified gfp mask.  Note that 'size' must be page aligned.
-  */
--static struct page *__dma_alloc_buffer(struct device *dev, size_t size, gfp_t gfp)
-+static struct page *__dma_alloc_buffer(struct device *dev, size_t size,
-+				       gfp_t gfp, int coherent_flag)
- {
- 	unsigned long order = get_order(size);
- 	struct page *page, *p, *e;
-@@ -318,7 +327,7 @@ static struct page *__dma_alloc_buffer(struct device *dev, size_t size, gfp_t gf
- 	for (p = page + (size >> PAGE_SHIFT), e = page + (1 << order); p < e; p++)
- 		__free_page(p);
- 
--	__dma_clear_buffer(page, size);
-+	__dma_clear_buffer(page, size, coherent_flag);
- 
- 	return page;
- }
-@@ -340,7 +349,8 @@ static void __dma_free_buffer(struct page *page, size_t size)
- 
- static void *__alloc_from_contiguous(struct device *dev, size_t size,
- 				     pgprot_t prot, struct page **ret_page,
--				     const void *caller, bool want_vaddr);
-+				     const void *caller, bool want_vaddr,
-+				     int coherent_flag);
- 
- static void *__alloc_remap_buffer(struct device *dev, size_t size, gfp_t gfp,
- 				 pgprot_t prot, struct page **ret_page,
-@@ -405,10 +415,13 @@ static int __init atomic_pool_init(void)
- 	atomic_pool = gen_pool_create(PAGE_SHIFT, -1);
- 	if (!atomic_pool)
- 		goto out;
--
-+	/*
-+	 * The atomic pool is only used for non-coherent allocations
-+	 * so we must pass NORMAL for coherent_flag.
-+	 */
- 	if (dev_get_cma_area(NULL))
- 		ptr = __alloc_from_contiguous(NULL, atomic_pool_size, prot,
--					      &page, atomic_pool_init, true);
-+				      &page, atomic_pool_init, true, NORMAL);
- 	else
- 		ptr = __alloc_remap_buffer(NULL, atomic_pool_size, gfp, prot,
- 					   &page, atomic_pool_init, true);
-@@ -522,7 +535,11 @@ static void *__alloc_remap_buffer(struct device *dev, size_t size, gfp_t gfp,
- {
- 	struct page *page;
- 	void *ptr = NULL;
--	page = __dma_alloc_buffer(dev, size, gfp);
-+	/*
-+	 * __alloc_remap_buffer is only called when the device is
-+	 * non-coherent
-+	 */
-+	page = __dma_alloc_buffer(dev, size, gfp, NORMAL);
- 	if (!page)
- 		return NULL;
- 	if (!want_vaddr)
-@@ -577,7 +594,8 @@ static int __free_from_pool(void *start, size_t size)
- 
- static void *__alloc_from_contiguous(struct device *dev, size_t size,
- 				     pgprot_t prot, struct page **ret_page,
--				     const void *caller, bool want_vaddr)
-+				     const void *caller, bool want_vaddr,
-+				     int coherent_flag)
- {
- 	unsigned long order = get_order(size);
- 	size_t count = size >> PAGE_SHIFT;
-@@ -588,7 +606,7 @@ static void *__alloc_from_contiguous(struct device *dev, size_t size,
- 	if (!page)
- 		return NULL;
- 
--	__dma_clear_buffer(page, size);
-+	__dma_clear_buffer(page, size, coherent_flag);
- 
- 	if (!want_vaddr)
- 		goto out;
-@@ -638,7 +656,7 @@ static inline pgprot_t __get_dma_pgprot(struct dma_attrs *attrs, pgprot_t prot)
- #define __get_dma_pgprot(attrs, prot)				__pgprot(0)
- #define __alloc_remap_buffer(dev, size, gfp, prot, ret, c, wv)	NULL
- #define __alloc_from_pool(size, ret_page)			NULL
--#define __alloc_from_contiguous(dev, size, prot, ret, c, wv)	NULL
-+#define __alloc_from_contiguous(dev, size, prot, ret, c, wv, coherent_flag)	NULL
- #define __free_from_pool(cpu_addr, size)			do { } while (0)
- #define __free_from_contiguous(dev, page, cpu_addr, size, wv)	do { } while (0)
- #define __dma_free_remap(cpu_addr, size)			do { } while (0)
-@@ -649,7 +667,8 @@ static void *__alloc_simple_buffer(struct device *dev, size_t size, gfp_t gfp,
- 				   struct page **ret_page)
- {
- 	struct page *page;
--	page = __dma_alloc_buffer(dev, size, gfp);
-+	/* __alloc_simple_buffer is only called when the device is coherent */
-+	page = __dma_alloc_buffer(dev, size, gfp, COHERENT);
- 	if (!page)
- 		return NULL;
- 
-@@ -679,7 +698,7 @@ static void *cma_allocator_alloc(struct arm_dma_alloc_args *args,
- {
- 	return __alloc_from_contiguous(args->dev, args->size, args->prot,
- 				       ret_page, args->caller,
--				       args->want_vaddr);
-+				       args->want_vaddr, args->coherent_flag);
- }
- 
- static void cma_allocator_free(struct arm_dma_free_args *args)
-@@ -746,6 +765,7 @@ static void *__dma_alloc(struct device *dev, size_t size, dma_addr_t *handle,
- 		.prot = prot,
- 		.caller = caller,
- 		.want_vaddr = !dma_get_attr(DMA_ATTR_NO_KERNEL_MAPPING, attrs),
-+		.coherent_flag = is_coherent ? COHERENT : NORMAL,
- 	};
- 
- #ifdef CONFIG_DMA_API_DEBUG
-@@ -1253,7 +1273,8 @@ static inline void __free_iova(struct dma_iommu_mapping *mapping,
- static const int iommu_order_array[] = { 9, 8, 4, 0 };
- 
- static struct page **__iommu_alloc_buffer(struct device *dev, size_t size,
--					  gfp_t gfp, struct dma_attrs *attrs)
-+					  gfp_t gfp, struct dma_attrs *attrs,
-+					  int coherent_flag)
- {
- 	struct page **pages;
- 	int count = size >> PAGE_SHIFT;
-@@ -1277,7 +1298,7 @@ static struct page **__iommu_alloc_buffer(struct device *dev, size_t size,
- 		if (!page)
- 			goto error;
- 
--		__dma_clear_buffer(page, size);
-+		__dma_clear_buffer(page, size, coherent_flag);
- 
- 		for (i = 0; i < count; i++)
- 			pages[i] = page + i;
-@@ -1327,7 +1348,7 @@ static struct page **__iommu_alloc_buffer(struct device *dev, size_t size,
- 				pages[i + j] = pages[i] + j;
- 		}
- 
--		__dma_clear_buffer(pages[i], PAGE_SIZE << order);
-+		__dma_clear_buffer(pages[i], PAGE_SIZE << order, coherent_flag);
- 		i += 1 << order;
- 		count -= 1 << order;
- 	}
-@@ -1505,7 +1526,8 @@ static void *arm_iommu_alloc_attrs(struct device *dev, size_t size,
- 	 */
- 	gfp &= ~(__GFP_COMP);
- 
--	pages = __iommu_alloc_buffer(dev, size, gfp, attrs);
-+	/* For now always consider we are in a non-coherent case */
-+	pages = __iommu_alloc_buffer(dev, size, gfp, attrs, NORMAL);
- 	if (!pages)
- 		return NULL;
- 
-diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig
-index 5a0a691..2038492 100644
---- a/arch/arm64/Kconfig
-+++ b/arch/arm64/Kconfig
-@@ -872,7 +872,7 @@ config RELOCATABLE
- 
- config RANDOMIZE_BASE
- 	bool "Randomize the address of the kernel image"
--	select ARM64_MODULE_PLTS
-+	select ARM64_MODULE_PLTS if MODULES
- 	select RELOCATABLE
- 	help
- 	  Randomizes the virtual address at which the kernel image is
-diff --git a/arch/arm64/boot/dts/rockchip/rk3368.dtsi b/arch/arm64/boot/dts/rockchip/rk3368.dtsi
-index 8b4a7c9..080203e 100644
---- a/arch/arm64/boot/dts/rockchip/rk3368.dtsi
-+++ b/arch/arm64/boot/dts/rockchip/rk3368.dtsi
-@@ -670,7 +670,7 @@
- 		#address-cells = <0>;
- 
- 		reg = <0x0 0xffb71000 0x0 0x1000>,
--		      <0x0 0xffb72000 0x0 0x1000>,
-+		      <0x0 0xffb72000 0x0 0x2000>,
- 		      <0x0 0xffb74000 0x0 0x2000>,
- 		      <0x0 0xffb76000 0x0 0x2000>;
- 		interrupts = <GIC_PPI 9
-diff --git a/arch/arm64/kernel/debug-monitors.c b/arch/arm64/kernel/debug-monitors.c
-index 4fbf3c5..0800d23 100644
---- a/arch/arm64/kernel/debug-monitors.c
-+++ b/arch/arm64/kernel/debug-monitors.c
-@@ -151,7 +151,6 @@ static int debug_monitors_init(void)
- 	/* Clear the OS lock. */
- 	on_each_cpu(clear_os_lock, NULL, 1);
- 	isb();
--	local_dbg_enable();
- 
- 	/* Register hotplug handler. */
- 	__register_cpu_notifier(&os_lock_nb);
-diff --git a/arch/arm64/kernel/hibernate.c b/arch/arm64/kernel/hibernate.c
-index 21ab5df..65d81f9 100644
---- a/arch/arm64/kernel/hibernate.c
-+++ b/arch/arm64/kernel/hibernate.c
-@@ -35,6 +35,7 @@
- #include <asm/sections.h>
- #include <asm/smp.h>
- #include <asm/suspend.h>
-+#include <asm/sysreg.h>
- #include <asm/virt.h>
- 
- /*
-@@ -217,12 +218,22 @@ static int create_safe_exec_page(void *src_start, size_t length,
- 	set_pte(pte, __pte(virt_to_phys((void *)dst) |
- 			 pgprot_val(PAGE_KERNEL_EXEC)));
- 
--	/* Load our new page tables */
--	asm volatile("msr	ttbr0_el1, %0;"
--		     "isb;"
--		     "tlbi	vmalle1is;"
--		     "dsb	ish;"
--		     "isb" : : "r"(virt_to_phys(pgd)));
-+	/*
-+	 * Load our new page tables. A strict BBM approach requires that we
-+	 * ensure that TLBs are free of any entries that may overlap with the
-+	 * global mappings we are about to install.
-+	 *
-+	 * For a real hibernate/resume cycle TTBR0 currently points to a zero
-+	 * page, but TLBs may contain stale ASID-tagged entries (e.g. for EFI
-+	 * runtime services), while for a userspace-driven test_resume cycle it
-+	 * points to userspace page tables (and we must point it at a zero page
-+	 * ourselves). Elsewhere we only (un)install the idmap with preemption
-+	 * disabled, so T0SZ should be as required regardless.
-+	 */
-+	cpu_set_reserved_ttbr0();
-+	local_flush_tlb_all();
-+	write_sysreg(virt_to_phys(pgd), ttbr0_el1);
-+	isb();
- 
- 	*phys_dst_addr = virt_to_phys((void *)dst);
- 
-@@ -394,6 +405,38 @@ int swsusp_arch_resume(void)
- 					  void *, phys_addr_t, phys_addr_t);
- 
- 	/*
-+	 * Restoring the memory image will overwrite the ttbr1 page tables.
-+	 * Create a second copy of just the linear map, and use this when
-+	 * restoring.
-+	 */
-+	tmp_pg_dir = (pgd_t *)get_safe_page(GFP_ATOMIC);
-+	if (!tmp_pg_dir) {
-+		pr_err("Failed to allocate memory for temporary page tables.");
-+		rc = -ENOMEM;
-+		goto out;
-+	}
-+	rc = copy_page_tables(tmp_pg_dir, PAGE_OFFSET, 0);
-+	if (rc)
-+		goto out;
-+
-+	/*
-+	 * Since we only copied the linear map, we need to find restore_pblist's
-+	 * linear map address.
-+	 */
-+	lm_restore_pblist = LMADDR(restore_pblist);
-+
-+	/*
-+	 * We need a zero page that is zero before & after resume in order to
-+	 * to break before make on the ttbr1 page tables.
-+	 */
-+	zero_page = (void *)get_safe_page(GFP_ATOMIC);
-+	if (!zero_page) {
-+		pr_err("Failed to allocate zero page.");
-+		rc = -ENOMEM;
-+		goto out;
-+	}
-+
-+	/*
- 	 * Locate the exit code in the bottom-but-one page, so that *NULL
- 	 * still has disastrous affects.
- 	 */
-@@ -419,27 +462,6 @@ int swsusp_arch_resume(void)
- 	__flush_dcache_area(hibernate_exit, exit_size);
- 
- 	/*
--	 * Restoring the memory image will overwrite the ttbr1 page tables.
--	 * Create a second copy of just the linear map, and use this when
--	 * restoring.
--	 */
--	tmp_pg_dir = (pgd_t *)get_safe_page(GFP_ATOMIC);
--	if (!tmp_pg_dir) {
--		pr_err("Failed to allocate memory for temporary page tables.");
--		rc = -ENOMEM;
--		goto out;
--	}
--	rc = copy_page_tables(tmp_pg_dir, PAGE_OFFSET, 0);
--	if (rc)
--		goto out;
--
--	/*
--	 * Since we only copied the linear map, we need to find restore_pblist's
--	 * linear map address.
--	 */
--	lm_restore_pblist = LMADDR(restore_pblist);
--
--	/*
- 	 * KASLR will cause the el2 vectors to be in a different location in
- 	 * the resumed kernel. Load hibernate's temporary copy into el2.
- 	 *
-@@ -453,12 +475,6 @@ int swsusp_arch_resume(void)
- 		__hyp_set_vectors(el2_vectors);
- 	}
- 
--	/*
--	 * We need a zero page that is zero before & after resume in order to
--	 * to break before make on the ttbr1 page tables.
--	 */
--	zero_page = (void *)get_safe_page(GFP_ATOMIC);
--
- 	hibernate_exit(virt_to_phys(tmp_pg_dir), resume_hdr.ttbr1_el1,
- 		       resume_hdr.reenter_kernel, lm_restore_pblist,
- 		       resume_hdr.__hyp_stub_vectors, virt_to_phys(zero_page));
-diff --git a/arch/arm64/kernel/smp.c b/arch/arm64/kernel/smp.c
-index 62ff3c0..490db85 100644
---- a/arch/arm64/kernel/smp.c
-+++ b/arch/arm64/kernel/smp.c
-@@ -267,7 +267,6 @@ asmlinkage void secondary_start_kernel(void)
- 	set_cpu_online(cpu, true);
- 	complete(&cpu_running);
- 
--	local_dbg_enable();
- 	local_irq_enable();
- 	local_async_enable();
- 
-@@ -437,9 +436,9 @@ void __init smp_cpus_done(unsigned int max_cpus)
- 
- void __init smp_prepare_boot_cpu(void)
- {
-+	set_my_cpu_offset(per_cpu_offset(smp_processor_id()));
- 	cpuinfo_store_boot_cpu();
- 	save_boot_cpu_run_el();
--	set_my_cpu_offset(per_cpu_offset(smp_processor_id()));
- }
- 
- static u64 __init of_get_cpu_mpidr(struct device_node *dn)
-@@ -694,6 +693,13 @@ void __init smp_prepare_cpus(unsigned int max_cpus)
- 	smp_store_cpu_info(smp_processor_id());
- 
- 	/*
-+	 * If UP is mandated by "nosmp" (which implies "maxcpus=0"), don't set
-+	 * secondary CPUs present.
-+	 */
-+	if (max_cpus == 0)
-+		return;
-+
-+	/*
- 	 * Initialise the present map (which describes the set of CPUs
- 	 * actually populated at the present time) and release the
- 	 * secondaries from the bootloader.
-diff --git a/arch/arm64/kernel/vmlinux.lds.S b/arch/arm64/kernel/vmlinux.lds.S
-index 435e820..e564d45 100644
---- a/arch/arm64/kernel/vmlinux.lds.S
-+++ b/arch/arm64/kernel/vmlinux.lds.S
-@@ -181,9 +181,9 @@ SECTIONS
- 		*(.hash)
- 	}
- 
--	__rela_offset	= ADDR(.rela) - KIMAGE_VADDR;
-+	__rela_offset	= ABSOLUTE(ADDR(.rela) - KIMAGE_VADDR);
- 	__rela_size	= SIZEOF(.rela);
--	__dynsym_offset	= ADDR(.dynsym) - KIMAGE_VADDR;
-+	__dynsym_offset	= ABSOLUTE(ADDR(.dynsym) - KIMAGE_VADDR);
- 
- 	. = ALIGN(SEGMENT_ALIGN);
- 	__init_end = .;
-diff --git a/arch/arm64/kvm/hyp/sysreg-sr.c b/arch/arm64/kvm/hyp/sysreg-sr.c
-index 0f7c40e..9341376 100644
---- a/arch/arm64/kvm/hyp/sysreg-sr.c
-+++ b/arch/arm64/kvm/hyp/sysreg-sr.c
-@@ -27,8 +27,8 @@ static void __hyp_text __sysreg_do_nothing(struct kvm_cpu_context *ctxt) { }
- /*
-  * Non-VHE: Both host and guest must save everything.
-  *
-- * VHE: Host must save tpidr*_el[01], actlr_el1, sp0, pc, pstate, and
-- * guest must save everything.
-+ * VHE: Host must save tpidr*_el[01], actlr_el1, mdscr_el1, sp0, pc,
-+ * pstate, and guest must save everything.
-  */
- 
- static void __hyp_text __sysreg_save_common_state(struct kvm_cpu_context *ctxt)
-@@ -37,6 +37,7 @@ static void __hyp_text __sysreg_save_common_state(struct kvm_cpu_context *ctxt)
- 	ctxt->sys_regs[TPIDR_EL0]	= read_sysreg(tpidr_el0);
- 	ctxt->sys_regs[TPIDRRO_EL0]	= read_sysreg(tpidrro_el0);
- 	ctxt->sys_regs[TPIDR_EL1]	= read_sysreg(tpidr_el1);
-+	ctxt->sys_regs[MDSCR_EL1]	= read_sysreg(mdscr_el1);
- 	ctxt->gp_regs.regs.sp		= read_sysreg(sp_el0);
- 	ctxt->gp_regs.regs.pc		= read_sysreg_el2(elr);
- 	ctxt->gp_regs.regs.pstate	= read_sysreg_el2(spsr);
-@@ -61,7 +62,6 @@ static void __hyp_text __sysreg_save_state(struct kvm_cpu_context *ctxt)
- 	ctxt->sys_regs[AMAIR_EL1]	= read_sysreg_el1(amair);
- 	ctxt->sys_regs[CNTKCTL_EL1]	= read_sysreg_el1(cntkctl);
- 	ctxt->sys_regs[PAR_EL1]		= read_sysreg(par_el1);
--	ctxt->sys_regs[MDSCR_EL1]	= read_sysreg(mdscr_el1);
- 
- 	ctxt->gp_regs.sp_el1		= read_sysreg(sp_el1);
- 	ctxt->gp_regs.elr_el1		= read_sysreg_el1(elr);
-@@ -90,6 +90,7 @@ static void __hyp_text __sysreg_restore_common_state(struct kvm_cpu_context *ctx
- 	write_sysreg(ctxt->sys_regs[TPIDR_EL0],	  tpidr_el0);
- 	write_sysreg(ctxt->sys_regs[TPIDRRO_EL0], tpidrro_el0);
- 	write_sysreg(ctxt->sys_regs[TPIDR_EL1],	  tpidr_el1);
-+	write_sysreg(ctxt->sys_regs[MDSCR_EL1],	  mdscr_el1);
- 	write_sysreg(ctxt->gp_regs.regs.sp,	  sp_el0);
- 	write_sysreg_el2(ctxt->gp_regs.regs.pc,	  elr);
- 	write_sysreg_el2(ctxt->gp_regs.regs.pstate, spsr);
-@@ -114,7 +115,6 @@ static void __hyp_text __sysreg_restore_state(struct kvm_cpu_context *ctxt)
- 	write_sysreg_el1(ctxt->sys_regs[AMAIR_EL1],	amair);
- 	write_sysreg_el1(ctxt->sys_regs[CNTKCTL_EL1], 	cntkctl);
- 	write_sysreg(ctxt->sys_regs[PAR_EL1],		par_el1);
--	write_sysreg(ctxt->sys_regs[MDSCR_EL1],		mdscr_el1);
- 
- 	write_sysreg(ctxt->gp_regs.sp_el1,		sp_el1);
- 	write_sysreg_el1(ctxt->gp_regs.elr_el1,		elr);
-diff --git a/arch/arm64/kvm/inject_fault.c b/arch/arm64/kvm/inject_fault.c
-index e9e0e6d..898c0e6 100644
---- a/arch/arm64/kvm/inject_fault.c
-+++ b/arch/arm64/kvm/inject_fault.c
-@@ -132,16 +132,14 @@ static u64 get_except_vector(struct kvm_vcpu *vcpu, enum exception_type type)
- static void inject_abt64(struct kvm_vcpu *vcpu, bool is_iabt, unsigned long addr)
- {
- 	unsigned long cpsr = *vcpu_cpsr(vcpu);
--	bool is_aarch32;
-+	bool is_aarch32 = vcpu_mode_is_32bit(vcpu);
- 	u32 esr = 0;
- 
--	is_aarch32 = vcpu_mode_is_32bit(vcpu);
--
--	*vcpu_spsr(vcpu) = cpsr;
- 	*vcpu_elr_el1(vcpu) = *vcpu_pc(vcpu);
--
- 	*vcpu_pc(vcpu) = get_except_vector(vcpu, except_type_sync);
-+
- 	*vcpu_cpsr(vcpu) = PSTATE_FAULT_BITS_64;
-+	*vcpu_spsr(vcpu) = cpsr;
- 
- 	vcpu_sys_reg(vcpu, FAR_EL1) = addr;
- 
-@@ -172,11 +170,11 @@ static void inject_undef64(struct kvm_vcpu *vcpu)
- 	unsigned long cpsr = *vcpu_cpsr(vcpu);
- 	u32 esr = (ESR_ELx_EC_UNKNOWN << ESR_ELx_EC_SHIFT);
- 
--	*vcpu_spsr(vcpu) = cpsr;
- 	*vcpu_elr_el1(vcpu) = *vcpu_pc(vcpu);
--
- 	*vcpu_pc(vcpu) = get_except_vector(vcpu, except_type_sync);
-+
- 	*vcpu_cpsr(vcpu) = PSTATE_FAULT_BITS_64;
-+	*vcpu_spsr(vcpu) = cpsr;
- 
- 	/*
- 	 * Build an unknown exception, depending on the instruction
-diff --git a/arch/arm64/mm/mmu.c b/arch/arm64/mm/mmu.c
-index 0f85a46..3e90a2c 100644
---- a/arch/arm64/mm/mmu.c
-+++ b/arch/arm64/mm/mmu.c
-@@ -748,9 +748,9 @@ void *__init __fixmap_remap_fdt(phys_addr_t dt_phys, int *size, pgprot_t prot)
- 	/*
- 	 * Check whether the physical FDT address is set and meets the minimum
- 	 * alignment requirement. Since we are relying on MIN_FDT_ALIGN to be
--	 * at least 8 bytes so that we can always access the size field of the
--	 * FDT header after mapping the first chunk, double check here if that
--	 * is indeed the case.
-+	 * at least 8 bytes so that we can always access the magic and size
-+	 * fields of the FDT header after mapping the first chunk, double check
-+	 * here if that is indeed the case.
- 	 */
- 	BUILD_BUG_ON(MIN_FDT_ALIGN < 8);
- 	if (!dt_phys || dt_phys % MIN_FDT_ALIGN)
-@@ -778,7 +778,7 @@ void *__init __fixmap_remap_fdt(phys_addr_t dt_phys, int *size, pgprot_t prot)
- 	create_mapping_noalloc(round_down(dt_phys, SWAPPER_BLOCK_SIZE),
- 			dt_virt_base, SWAPPER_BLOCK_SIZE, prot);
- 
--	if (fdt_check_header(dt_virt) != 0)
-+	if (fdt_magic(dt_virt) != FDT_MAGIC)
- 		return NULL;
- 
- 	*size = fdt_totalsize(dt_virt);
-diff --git a/arch/arm64/mm/proc.S b/arch/arm64/mm/proc.S
-index c431787..5bb61de 100644
---- a/arch/arm64/mm/proc.S
-+++ b/arch/arm64/mm/proc.S
-@@ -180,6 +180,8 @@ ENTRY(__cpu_setup)
- 	msr	cpacr_el1, x0			// Enable FP/ASIMD
- 	mov	x0, #1 << 12			// Reset mdscr_el1 and disable
- 	msr	mdscr_el1, x0			// access to the DCC from EL0
-+	isb					// Unmask debug exceptions now,
-+	enable_dbg				// since this is per-cpu
- 	reset_pmuserenr_el0 x0			// Disable PMU access from EL0
- 	/*
- 	 * Memory region attributes for LPAE:
-diff --git a/arch/metag/include/asm/cmpxchg_lnkget.h b/arch/metag/include/asm/cmpxchg_lnkget.h
-index 0154e28..2369ad3 100644
---- a/arch/metag/include/asm/cmpxchg_lnkget.h
-+++ b/arch/metag/include/asm/cmpxchg_lnkget.h
-@@ -73,7 +73,7 @@ static inline unsigned long __cmpxchg_u32(volatile int *m, unsigned long old,
- 		      "	DCACHE	[%2], %0\n"
- #endif
- 		      "2:\n"
--		      : "=&d" (temp), "=&da" (retval)
-+		      : "=&d" (temp), "=&d" (retval)
- 		      : "da" (m), "bd" (old), "da" (new)
- 		      : "cc"
- 		      );
-diff --git a/arch/mips/kernel/cevt-r4k.c b/arch/mips/kernel/cevt-r4k.c
-index e4c21bb..804d2a2 100644
---- a/arch/mips/kernel/cevt-r4k.c
-+++ b/arch/mips/kernel/cevt-r4k.c
-@@ -276,12 +276,7 @@ int r4k_clockevent_init(void)
- 				  CLOCK_EVT_FEAT_C3STOP |
- 				  CLOCK_EVT_FEAT_PERCPU;
- 
--	clockevent_set_clock(cd, mips_hpt_frequency);
--
--	/* Calculate the min / max delta */
--	cd->max_delta_ns	= clockevent_delta2ns(0x7fffffff, cd);
- 	min_delta		= calculate_min_delta();
--	cd->min_delta_ns	= clockevent_delta2ns(min_delta, cd);
- 
- 	cd->rating		= 300;
- 	cd->irq			= irq;
-@@ -289,7 +284,7 @@ int r4k_clockevent_init(void)
- 	cd->set_next_event	= mips_next_event;
- 	cd->event_handler	= mips_event_handler;
- 
--	clockevents_register_device(cd);
-+	clockevents_config_and_register(cd, mips_hpt_frequency, min_delta, 0x7fffffff);
- 
- 	if (cp0_timer_irq_installed)
- 		return 0;
-diff --git a/arch/mips/kernel/csrc-r4k.c b/arch/mips/kernel/csrc-r4k.c
-index 1f91056..d76275d 100644
---- a/arch/mips/kernel/csrc-r4k.c
-+++ b/arch/mips/kernel/csrc-r4k.c
-@@ -23,7 +23,7 @@ static struct clocksource clocksource_mips = {
- 	.flags		= CLOCK_SOURCE_IS_CONTINUOUS,
- };
- 
--static u64 notrace r4k_read_sched_clock(void)
-+static u64 __maybe_unused notrace r4k_read_sched_clock(void)
- {
- 	return read_c0_count();
- }
-@@ -82,7 +82,9 @@ int __init init_r4k_clocksource(void)
- 
- 	clocksource_register_hz(&clocksource_mips, mips_hpt_frequency);
- 
-+#ifndef CONFIG_CPU_FREQ
- 	sched_clock_register(r4k_read_sched_clock, 32, mips_hpt_frequency);
-+#endif
- 
- 	return 0;
- }
-diff --git a/arch/mips/kvm/emulate.c b/arch/mips/kvm/emulate.c
-index 645c8a1..2b42a74 100644
---- a/arch/mips/kvm/emulate.c
-+++ b/arch/mips/kvm/emulate.c
-@@ -1615,8 +1615,14 @@ enum emulation_result kvm_mips_emulate_cache(uint32_t inst, uint32_t *opc,
- 
- 	preempt_disable();
- 	if (KVM_GUEST_KSEGX(va) == KVM_GUEST_KSEG0) {
--		if (kvm_mips_host_tlb_lookup(vcpu, va) < 0)
--			kvm_mips_handle_kseg0_tlb_fault(va, vcpu);
-+		if (kvm_mips_host_tlb_lookup(vcpu, va) < 0 &&
-+		    kvm_mips_handle_kseg0_tlb_fault(va, vcpu)) {
-+			kvm_err("%s: handling mapped kseg0 tlb fault for %lx, vcpu: %p, ASID: %#lx\n",
-+				__func__, va, vcpu, read_c0_entryhi());
-+			er = EMULATE_FAIL;
-+			preempt_enable();
-+			goto done;
-+		}
- 	} else if ((KVM_GUEST_KSEGX(va) < KVM_GUEST_KSEG0) ||
- 		   KVM_GUEST_KSEGX(va) == KVM_GUEST_KSEG23) {
- 		int index;
-@@ -1654,14 +1660,19 @@ enum emulation_result kvm_mips_emulate_cache(uint32_t inst, uint32_t *opc,
- 								run, vcpu);
- 				preempt_enable();
- 				goto dont_update_pc;
--			} else {
--				/*
--				 * We fault an entry from the guest tlb to the
--				 * shadow host TLB
--				 */
--				kvm_mips_handle_mapped_seg_tlb_fault(vcpu, tlb,
--								     NULL,
--								     NULL);
-+			}
-+			/*
-+			 * We fault an entry from the guest tlb to the
-+			 * shadow host TLB
-+			 */
-+			if (kvm_mips_handle_mapped_seg_tlb_fault(vcpu, tlb,
-+								 NULL, NULL)) {
-+				kvm_err("%s: handling mapped seg tlb fault for %lx, index: %u, vcpu: %p, ASID: %#lx\n",
-+					__func__, va, index, vcpu,
-+					read_c0_entryhi());
-+				er = EMULATE_FAIL;
-+				preempt_enable();
-+				goto done;
- 			}
- 		}
- 	} else {
-@@ -2625,8 +2636,13 @@ enum emulation_result kvm_mips_handle_tlbmiss(unsigned long cause,
- 			 * OK we have a Guest TLB entry, now inject it into the
- 			 * shadow host TLB
- 			 */
--			kvm_mips_handle_mapped_seg_tlb_fault(vcpu, tlb, NULL,
--							     NULL);
-+			if (kvm_mips_handle_mapped_seg_tlb_fault(vcpu, tlb,
-+								 NULL, NULL)) {
-+				kvm_err("%s: handling mapped seg tlb fault for %lx, index: %u, vcpu: %p, ASID: %#lx\n",
-+					__func__, va, index, vcpu,
-+					read_c0_entryhi());
-+				er = EMULATE_FAIL;
-+			}
- 		}
- 	}
- 
-diff --git a/arch/mips/kvm/tlb.c b/arch/mips/kvm/tlb.c
-index ed021ae..ad2270f 100644
---- a/arch/mips/kvm/tlb.c
-+++ b/arch/mips/kvm/tlb.c
-@@ -284,7 +284,7 @@ int kvm_mips_handle_kseg0_tlb_fault(unsigned long badvaddr,
- 	}
- 
- 	gfn = (KVM_GUEST_CPHYSADDR(badvaddr) >> PAGE_SHIFT);
--	if (gfn >= kvm->arch.guest_pmap_npages) {
-+	if ((gfn | 1) >= kvm->arch.guest_pmap_npages) {
- 		kvm_err("%s: Invalid gfn: %#llx, BadVaddr: %#lx\n", __func__,
- 			gfn, badvaddr);
- 		kvm_mips_dump_host_tlbs();
-@@ -373,26 +373,40 @@ int kvm_mips_handle_mapped_seg_tlb_fault(struct kvm_vcpu *vcpu,
- 	unsigned long entryhi = 0, entrylo0 = 0, entrylo1 = 0;
- 	struct kvm *kvm = vcpu->kvm;
- 	kvm_pfn_t pfn0, pfn1;
-+	gfn_t gfn0, gfn1;
-+	long tlb_lo[2];
- 	int ret;
- 
--	if ((tlb->tlb_hi & VPN2_MASK) == 0) {
--		pfn0 = 0;
--		pfn1 = 0;
--	} else {
--		if (kvm_mips_map_page(kvm, mips3_tlbpfn_to_paddr(tlb->tlb_lo0)
--					   >> PAGE_SHIFT) < 0)
--			return -1;
--
--		if (kvm_mips_map_page(kvm, mips3_tlbpfn_to_paddr(tlb->tlb_lo1)
--					   >> PAGE_SHIFT) < 0)
--			return -1;
--
--		pfn0 = kvm->arch.guest_pmap[mips3_tlbpfn_to_paddr(tlb->tlb_lo0)
--					    >> PAGE_SHIFT];
--		pfn1 = kvm->arch.guest_pmap[mips3_tlbpfn_to_paddr(tlb->tlb_lo1)
--					    >> PAGE_SHIFT];
-+	tlb_lo[0] = tlb->tlb_lo0;
-+	tlb_lo[1] = tlb->tlb_lo1;
-+
-+	/*
-+	 * The commpage address must not be mapped to anything else if the guest
-+	 * TLB contains entries nearby, or commpage accesses will break.
-+	 */
-+	if (!((tlb->tlb_hi ^ KVM_GUEST_COMMPAGE_ADDR) &
-+			VPN2_MASK & (PAGE_MASK << 1)))
-+		tlb_lo[(KVM_GUEST_COMMPAGE_ADDR >> PAGE_SHIFT) & 1] = 0;
-+
-+	gfn0 = mips3_tlbpfn_to_paddr(tlb_lo[0]) >> PAGE_SHIFT;
-+	gfn1 = mips3_tlbpfn_to_paddr(tlb_lo[1]) >> PAGE_SHIFT;
-+	if (gfn0 >= kvm->arch.guest_pmap_npages ||
-+	    gfn1 >= kvm->arch.guest_pmap_npages) {
-+		kvm_err("%s: Invalid gfn: [%#llx, %#llx], EHi: %#lx\n",
-+			__func__, gfn0, gfn1, tlb->tlb_hi);
-+		kvm_mips_dump_guest_tlbs(vcpu);
-+		return -1;
- 	}
- 
-+	if (kvm_mips_map_page(kvm, gfn0) < 0)
-+		return -1;
-+
-+	if (kvm_mips_map_page(kvm, gfn1) < 0)
-+		return -1;
-+
-+	pfn0 = kvm->arch.guest_pmap[gfn0];
-+	pfn1 = kvm->arch.guest_pmap[gfn1];
-+
- 	if (hpa0)
- 		*hpa0 = pfn0 << PAGE_SHIFT;
- 
-@@ -401,9 +415,9 @@ int kvm_mips_handle_mapped_seg_tlb_fault(struct kvm_vcpu *vcpu,
- 
- 	/* Get attributes from the Guest TLB */
- 	entrylo0 = mips3_paddr_to_tlbpfn(pfn0 << PAGE_SHIFT) | (0x3 << 3) |
--		   (tlb->tlb_lo0 & MIPS3_PG_D) | (tlb->tlb_lo0 & MIPS3_PG_V);
-+		   (tlb_lo[0] & MIPS3_PG_D) | (tlb_lo[0] & MIPS3_PG_V);
- 	entrylo1 = mips3_paddr_to_tlbpfn(pfn1 << PAGE_SHIFT) | (0x3 << 3) |
--		   (tlb->tlb_lo1 & MIPS3_PG_D) | (tlb->tlb_lo1 & MIPS3_PG_V);
-+		   (tlb_lo[1] & MIPS3_PG_D) | (tlb_lo[1] & MIPS3_PG_V);
- 
- 	kvm_debug("@ %#lx tlb_lo0: 0x%08lx tlb_lo1: 0x%08lx\n", vcpu->arch.pc,
- 		  tlb->tlb_lo0, tlb->tlb_lo1);
-@@ -776,10 +790,16 @@ uint32_t kvm_get_inst(uint32_t *opc, struct kvm_vcpu *vcpu)
- 				local_irq_restore(flags);
- 				return KVM_INVALID_INST;
- 			}
--			kvm_mips_handle_mapped_seg_tlb_fault(vcpu,
--							     &vcpu->arch.
--							     guest_tlb[index],
--							     NULL, NULL);
-+			if (kvm_mips_handle_mapped_seg_tlb_fault(vcpu,
-+						&vcpu->arch.guest_tlb[index],
-+						NULL, NULL)) {
-+				kvm_err("%s: handling mapped seg tlb fault failed for %p, index: %u, vcpu: %p, ASID: %#lx\n",
-+					__func__, opc, index, vcpu,
-+					read_c0_entryhi());
-+				kvm_mips_dump_guest_tlbs(vcpu);
-+				local_irq_restore(flags);
-+				return KVM_INVALID_INST;
-+			}
- 			inst = *(opc);
- 		}
- 		local_irq_restore(flags);
-diff --git a/arch/mips/loongson64/loongson-3/hpet.c b/arch/mips/loongson64/loongson-3/hpet.c
-index 249039a..4788bea 100644
---- a/arch/mips/loongson64/loongson-3/hpet.c
-+++ b/arch/mips/loongson64/loongson-3/hpet.c
-@@ -13,8 +13,8 @@
- #define SMBUS_PCI_REG64		0x64
- #define SMBUS_PCI_REGB4		0xb4
- 
--#define HPET_MIN_CYCLES		64
--#define HPET_MIN_PROG_DELTA	(HPET_MIN_CYCLES + (HPET_MIN_CYCLES >> 1))
-+#define HPET_MIN_CYCLES		16
-+#define HPET_MIN_PROG_DELTA	(HPET_MIN_CYCLES * 12)
- 
- static DEFINE_SPINLOCK(hpet_lock);
- DEFINE_PER_CPU(struct clock_event_device, hpet_clockevent_device);
-@@ -157,14 +157,14 @@ static int hpet_tick_resume(struct clock_event_device *evt)
- static int hpet_next_event(unsigned long delta,
- 		struct clock_event_device *evt)
- {
--	unsigned int cnt;
--	int res;
-+	u32 cnt;
-+	s32 res;
- 
- 	cnt = hpet_read(HPET_COUNTER);
--	cnt += delta;
-+	cnt += (u32) delta;
- 	hpet_write(HPET_T0_CMP, cnt);
- 
--	res = (int)(cnt - hpet_read(HPET_COUNTER));
-+	res = (s32)(cnt - hpet_read(HPET_COUNTER));
- 
- 	return res < HPET_MIN_CYCLES ? -ETIME : 0;
- }
-@@ -230,7 +230,7 @@ void __init setup_hpet_timer(void)
- 
- 	cd = &per_cpu(hpet_clockevent_device, cpu);
- 	cd->name = "hpet";
--	cd->rating = 320;
-+	cd->rating = 100;
- 	cd->features = CLOCK_EVT_FEAT_PERIODIC | CLOCK_EVT_FEAT_ONESHOT;
- 	cd->set_state_shutdown = hpet_set_state_shutdown;
- 	cd->set_state_periodic = hpet_set_state_periodic;
-diff --git a/arch/mips/mm/uasm-mips.c b/arch/mips/mm/uasm-mips.c
-index 9c2220a..45e3b87 100644
---- a/arch/mips/mm/uasm-mips.c
-+++ b/arch/mips/mm/uasm-mips.c
-@@ -65,7 +65,7 @@ static struct insn insn_table[] = {
- #ifndef CONFIG_CPU_MIPSR6
- 	{ insn_cache,  M(cache_op, 0, 0, 0, 0, 0),  RS | RT | SIMM },
- #else
--	{ insn_cache,  M6(cache_op, 0, 0, 0, cache6_op),  RS | RT | SIMM9 },
-+	{ insn_cache,  M6(spec3_op, 0, 0, 0, cache6_op),  RS | RT | SIMM9 },
- #endif
- 	{ insn_daddiu, M(daddiu_op, 0, 0, 0, 0, 0), RS | RT | SIMM },
- 	{ insn_daddu, M(spec_op, 0, 0, 0, 0, daddu_op), RS | RT | RD },
-diff --git a/arch/powerpc/kernel/tm.S b/arch/powerpc/kernel/tm.S
-index b7019b5..298afcf 100644
---- a/arch/powerpc/kernel/tm.S
-+++ b/arch/powerpc/kernel/tm.S
-@@ -338,8 +338,6 @@ _GLOBAL(__tm_recheckpoint)
- 	 */
- 	subi	r7, r7, STACK_FRAME_OVERHEAD
- 
--	SET_SCRATCH0(r1)
--
- 	mfmsr	r6
- 	/* R4 = original MSR to indicate whether thread used FP/Vector etc. */
- 
-@@ -468,6 +466,7 @@ restore_gprs:
- 	 * until we turn MSR RI back on.
- 	 */
- 
-+	SET_SCRATCH0(r1)
- 	ld	r5, -8(r1)
- 	ld	r1, -16(r1)
- 
-diff --git a/arch/powerpc/kvm/book3s_hv_rmhandlers.S b/arch/powerpc/kvm/book3s_hv_rmhandlers.S
-index e571ad2..38e108e 100644
---- a/arch/powerpc/kvm/book3s_hv_rmhandlers.S
-+++ b/arch/powerpc/kvm/book3s_hv_rmhandlers.S
-@@ -655,112 +655,8 @@ END_FTR_SECTION_IFCLR(CPU_FTR_ARCH_207S)
- 
- #ifdef CONFIG_PPC_TRANSACTIONAL_MEM
- BEGIN_FTR_SECTION
--	b	skip_tm
--END_FTR_SECTION_IFCLR(CPU_FTR_TM)
--
--	/* Turn on TM/FP/VSX/VMX so we can restore them. */
--	mfmsr	r5
--	li	r6, MSR_TM >> 32
--	sldi	r6, r6, 32
--	or	r5, r5, r6
--	ori	r5, r5, MSR_FP
--	oris	r5, r5, (MSR_VEC | MSR_VSX)@h
--	mtmsrd	r5
--
--	/*
--	 * The user may change these outside of a transaction, so they must
--	 * always be context switched.
--	 */
--	ld	r5, VCPU_TFHAR(r4)
--	ld	r6, VCPU_TFIAR(r4)
--	ld	r7, VCPU_TEXASR(r4)
--	mtspr	SPRN_TFHAR, r5
--	mtspr	SPRN_TFIAR, r6
--	mtspr	SPRN_TEXASR, r7
--
--	ld	r5, VCPU_MSR(r4)
--	rldicl. r5, r5, 64 - MSR_TS_S_LG, 62
--	beq	skip_tm	/* TM not active in guest */
--
--	/* Make sure the failure summary is set, otherwise we'll program check
--	 * when we trechkpt.  It's possible that this might have been not set
--	 * on a kvmppc_set_one_reg() call but we shouldn't let this crash the
--	 * host.
--	 */
--	oris	r7, r7, (TEXASR_FS)@h
--	mtspr	SPRN_TEXASR, r7
--
--	/*
--	 * We need to load up the checkpointed state for the guest.
--	 * We need to do this early as it will blow away any GPRs, VSRs and
--	 * some SPRs.
--	 */
--
--	mr	r31, r4
--	addi	r3, r31, VCPU_FPRS_TM
--	bl	load_fp_state
--	addi	r3, r31, VCPU_VRS_TM
--	bl	load_vr_state
--	mr	r4, r31
--	lwz	r7, VCPU_VRSAVE_TM(r4)
--	mtspr	SPRN_VRSAVE, r7
--
--	ld	r5, VCPU_LR_TM(r4)
--	lwz	r6, VCPU_CR_TM(r4)
--	ld	r7, VCPU_CTR_TM(r4)
--	ld	r8, VCPU_AMR_TM(r4)
--	ld	r9, VCPU_TAR_TM(r4)
--	mtlr	r5
--	mtcr	r6
--	mtctr	r7
--	mtspr	SPRN_AMR, r8
--	mtspr	SPRN_TAR, r9
--
--	/*
--	 * Load up PPR and DSCR values but don't put them in the actual SPRs
--	 * till the last moment to avoid running with userspace PPR and DSCR for
--	 * too long.
--	 */
--	ld	r29, VCPU_DSCR_TM(r4)
--	ld	r30, VCPU_PPR_TM(r4)
--
--	std	r2, PACATMSCRATCH(r13) /* Save TOC */
--
--	/* Clear the MSR RI since r1, r13 are all going to be foobar. */
--	li	r5, 0
--	mtmsrd	r5, 1
--
--	/* Load GPRs r0-r28 */
--	reg = 0
--	.rept	29
--	ld	reg, VCPU_GPRS_TM(reg)(r31)
--	reg = reg + 1
--	.endr
--
--	mtspr	SPRN_DSCR, r29
--	mtspr	SPRN_PPR, r30
--
--	/* Load final GPRs */
--	ld	29, VCPU_GPRS_TM(29)(r31)
--	ld	30, VCPU_GPRS_TM(30)(r31)
--	ld	31, VCPU_GPRS_TM(31)(r31)
--
--	/* TM checkpointed state is now setup.  All GPRs are now volatile. */
--	TRECHKPT
--
--	/* Now let's get back the state we need. */
--	HMT_MEDIUM
--	GET_PACA(r13)
--	ld	r29, HSTATE_DSCR(r13)
--	mtspr	SPRN_DSCR, r29
--	ld	r4, HSTATE_KVM_VCPU(r13)
--	ld	r1, HSTATE_HOST_R1(r13)
--	ld	r2, PACATMSCRATCH(r13)
--
--	/* Set the MSR RI since we have our registers back. */
--	li	r5, MSR_RI
--	mtmsrd	r5, 1
--skip_tm:
-+	bl	kvmppc_restore_tm
-+END_FTR_SECTION_IFSET(CPU_FTR_TM)
- #endif
- 
- 	/* Load guest PMU registers */
-@@ -841,12 +737,6 @@ BEGIN_FTR_SECTION
- 	/* Skip next section on POWER7 */
- 	b	8f
- END_FTR_SECTION_IFCLR(CPU_FTR_ARCH_207S)
--	/* Turn on TM so we can access TFHAR/TFIAR/TEXASR */
--	mfmsr	r8
--	li	r0, 1
--	rldimi	r8, r0, MSR_TM_LG, 63-MSR_TM_LG
--	mtmsrd	r8
--
- 	/* Load up POWER8-specific registers */
- 	ld	r5, VCPU_IAMR(r4)
- 	lwz	r6, VCPU_PSPB(r4)
-@@ -1436,106 +1326,8 @@ END_FTR_SECTION_IFCLR(CPU_FTR_ARCH_207S)
- 
- #ifdef CONFIG_PPC_TRANSACTIONAL_MEM
- BEGIN_FTR_SECTION
--	b	2f
--END_FTR_SECTION_IFCLR(CPU_FTR_TM)
--	/* Turn on TM. */
--	mfmsr	r8
--	li	r0, 1
--	rldimi	r8, r0, MSR_TM_LG, 63-MSR_TM_LG
--	mtmsrd	r8
--
--	ld	r5, VCPU_MSR(r9)
--	rldicl. r5, r5, 64 - MSR_TS_S_LG, 62
--	beq	1f	/* TM not active in guest. */
--
--	li	r3, TM_CAUSE_KVM_RESCHED
--
--	/* Clear the MSR RI since r1, r13 are all going to be foobar. */
--	li	r5, 0
--	mtmsrd	r5, 1
--
--	/* All GPRs are volatile at this point. */
--	TRECLAIM(R3)
--
--	/* Temporarily store r13 and r9 so we have some regs to play with */
--	SET_SCRATCH0(r13)
--	GET_PACA(r13)
--	std	r9, PACATMSCRATCH(r13)
--	ld	r9, HSTATE_KVM_VCPU(r13)
--
--	/* Get a few more GPRs free. */
--	std	r29, VCPU_GPRS_TM(29)(r9)
--	std	r30, VCPU_GPRS_TM(30)(r9)
--	std	r31, VCPU_GPRS_TM(31)(r9)
--
--	/* Save away PPR and DSCR soon so don't run with user values. */
--	mfspr	r31, SPRN_PPR
--	HMT_MEDIUM
--	mfspr	r30, SPRN_DSCR
--	ld	r29, HSTATE_DSCR(r13)
--	mtspr	SPRN_DSCR, r29
--
--	/* Save all but r9, r13 & r29-r31 */
--	reg = 0
--	.rept	29
--	.if (reg != 9) && (reg != 13)
--	std	reg, VCPU_GPRS_TM(reg)(r9)
--	.endif
--	reg = reg + 1
--	.endr
--	/* ... now save r13 */
--	GET_SCRATCH0(r4)
--	std	r4, VCPU_GPRS_TM(13)(r9)
--	/* ... and save r9 */
--	ld	r4, PACATMSCRATCH(r13)
--	std	r4, VCPU_GPRS_TM(9)(r9)
--
--	/* Reload stack pointer and TOC. */
--	ld	r1, HSTATE_HOST_R1(r13)
--	ld	r2, PACATOC(r13)
--
--	/* Set MSR RI now we have r1 and r13 back. */
--	li	r5, MSR_RI
--	mtmsrd	r5, 1
--
--	/* Save away checkpinted SPRs. */
--	std	r31, VCPU_PPR_TM(r9)
--	std	r30, VCPU_DSCR_TM(r9)
--	mflr	r5
--	mfcr	r6
--	mfctr	r7
--	mfspr	r8, SPRN_AMR
--	mfspr	r10, SPRN_TAR
--	std	r5, VCPU_LR_TM(r9)
--	stw	r6, VCPU_CR_TM(r9)
--	std	r7, VCPU_CTR_TM(r9)
--	std	r8, VCPU_AMR_TM(r9)
--	std	r10, VCPU_TAR_TM(r9)
--
--	/* Restore r12 as trap number. */
--	lwz	r12, VCPU_TRAP(r9)
--
--	/* Save FP/VSX. */
--	addi	r3, r9, VCPU_FPRS_TM
--	bl	store_fp_state
--	addi	r3, r9, VCPU_VRS_TM
--	bl	store_vr_state
--	mfspr	r6, SPRN_VRSAVE
--	stw	r6, VCPU_VRSAVE_TM(r9)
--1:
--	/*
--	 * We need to save these SPRs after the treclaim so that the software
--	 * error code is recorded correctly in the TEXASR.  Also the user may
--	 * change these outside of a transaction, so they must always be
--	 * context switched.
--	 */
--	mfspr	r5, SPRN_TFHAR
--	mfspr	r6, SPRN_TFIAR
--	mfspr	r7, SPRN_TEXASR
--	std	r5, VCPU_TFHAR(r9)
--	std	r6, VCPU_TFIAR(r9)
--	std	r7, VCPU_TEXASR(r9)
--2:
-+	bl	kvmppc_save_tm
-+END_FTR_SECTION_IFSET(CPU_FTR_TM)
- #endif
- 
- 	/* Increment yield count if they have a VPA */
-@@ -2245,6 +2037,13 @@ _GLOBAL(kvmppc_h_cede)		/* r3 = vcpu pointer, r11 = msr, r13 = paca */
- 	/* save FP state */
- 	bl	kvmppc_save_fp
- 
-+#ifdef CONFIG_PPC_TRANSACTIONAL_MEM
-+BEGIN_FTR_SECTION
-+	ld	r9, HSTATE_KVM_VCPU(r13)
-+	bl	kvmppc_save_tm
-+END_FTR_SECTION_IFSET(CPU_FTR_TM)
-+#endif
-+
- 	/*
- 	 * Set DEC to the smaller of DEC and HDEC, so that we wake
- 	 * no later than the end of our timeslice (HDEC interrupts
-@@ -2321,6 +2120,12 @@ kvm_end_cede:
- 	bl	kvmhv_accumulate_time
- #endif
- 
-+#ifdef CONFIG_PPC_TRANSACTIONAL_MEM
-+BEGIN_FTR_SECTION
-+	bl	kvmppc_restore_tm
-+END_FTR_SECTION_IFSET(CPU_FTR_TM)
-+#endif
-+
- 	/* load up FP state */
- 	bl	kvmppc_load_fp
- 
-@@ -2631,6 +2436,239 @@ END_FTR_SECTION_IFSET(CPU_FTR_ALTIVEC)
- 	mr	r4,r31
- 	blr
- 
-+#ifdef CONFIG_PPC_TRANSACTIONAL_MEM
-+/*
-+ * Save transactional state and TM-related registers.
-+ * Called with r9 pointing to the vcpu struct.
-+ * This can modify all checkpointed registers, but
-+ * restores r1, r2 and r9 (vcpu pointer) before exit.
-+ */
-+kvmppc_save_tm:
-+	mflr	r0
-+	std	r0, PPC_LR_STKOFF(r1)
-+
-+	/* Turn on TM. */
-+	mfmsr	r8
-+	li	r0, 1
-+	rldimi	r8, r0, MSR_TM_LG, 63-MSR_TM_LG
-+	mtmsrd	r8
-+
-+	ld	r5, VCPU_MSR(r9)
-+	rldicl. r5, r5, 64 - MSR_TS_S_LG, 62
-+	beq	1f	/* TM not active in guest. */
-+
-+	std	r1, HSTATE_HOST_R1(r13)
-+	li	r3, TM_CAUSE_KVM_RESCHED
-+
-+	/* Clear the MSR RI since r1, r13 are all going to be foobar. */
-+	li	r5, 0
-+	mtmsrd	r5, 1
-+
-+	/* All GPRs are volatile at this point. */
-+	TRECLAIM(R3)
-+
-+	/* Temporarily store r13 and r9 so we have some regs to play with */
-+	SET_SCRATCH0(r13)
-+	GET_PACA(r13)
-+	std	r9, PACATMSCRATCH(r13)
-+	ld	r9, HSTATE_KVM_VCPU(r13)
-+
-+	/* Get a few more GPRs free. */
-+	std	r29, VCPU_GPRS_TM(29)(r9)
-+	std	r30, VCPU_GPRS_TM(30)(r9)
-+	std	r31, VCPU_GPRS_TM(31)(r9)
-+
-+	/* Save away PPR and DSCR soon so don't run with user values. */
-+	mfspr	r31, SPRN_PPR
-+	HMT_MEDIUM
-+	mfspr	r30, SPRN_DSCR
-+	ld	r29, HSTATE_DSCR(r13)
-+	mtspr	SPRN_DSCR, r29
-+
-+	/* Save all but r9, r13 & r29-r31 */
-+	reg = 0
-+	.rept	29
-+	.if (reg != 9) && (reg != 13)
-+	std	reg, VCPU_GPRS_TM(reg)(r9)
-+	.endif
-+	reg = reg + 1
-+	.endr
-+	/* ... now save r13 */
-+	GET_SCRATCH0(r4)
-+	std	r4, VCPU_GPRS_TM(13)(r9)
-+	/* ... and save r9 */
-+	ld	r4, PACATMSCRATCH(r13)
-+	std	r4, VCPU_GPRS_TM(9)(r9)
-+
-+	/* Reload stack pointer and TOC. */
-+	ld	r1, HSTATE_HOST_R1(r13)
-+	ld	r2, PACATOC(r13)
-+
-+	/* Set MSR RI now we have r1 and r13 back. */
-+	li	r5, MSR_RI
-+	mtmsrd	r5, 1
-+
-+	/* Save away checkpinted SPRs. */
-+	std	r31, VCPU_PPR_TM(r9)
-+	std	r30, VCPU_DSCR_TM(r9)
-+	mflr	r5
-+	mfcr	r6
-+	mfctr	r7
-+	mfspr	r8, SPRN_AMR
-+	mfspr	r10, SPRN_TAR
-+	std	r5, VCPU_LR_TM(r9)
-+	stw	r6, VCPU_CR_TM(r9)
-+	std	r7, VCPU_CTR_TM(r9)
-+	std	r8, VCPU_AMR_TM(r9)
-+	std	r10, VCPU_TAR_TM(r9)
-+
-+	/* Restore r12 as trap number. */
-+	lwz	r12, VCPU_TRAP(r9)
-+
-+	/* Save FP/VSX. */
-+	addi	r3, r9, VCPU_FPRS_TM
-+	bl	store_fp_state
-+	addi	r3, r9, VCPU_VRS_TM
-+	bl	store_vr_state
-+	mfspr	r6, SPRN_VRSAVE
-+	stw	r6, VCPU_VRSAVE_TM(r9)
-+1:
-+	/*
-+	 * We need to save these SPRs after the treclaim so that the software
-+	 * error code is recorded correctly in the TEXASR.  Also the user may
-+	 * change these outside of a transaction, so they must always be
-+	 * context switched.
-+	 */
-+	mfspr	r5, SPRN_TFHAR
-+	mfspr	r6, SPRN_TFIAR
-+	mfspr	r7, SPRN_TEXASR
-+	std	r5, VCPU_TFHAR(r9)
-+	std	r6, VCPU_TFIAR(r9)
-+	std	r7, VCPU_TEXASR(r9)
-+
-+	ld	r0, PPC_LR_STKOFF(r1)
-+	mtlr	r0
-+	blr
-+
-+/*
-+ * Restore transactional state and TM-related registers.
-+ * Called with r4 pointing to the vcpu struct.
-+ * This potentially modifies all checkpointed registers.
-+ * It restores r1, r2, r4 from the PACA.
-+ */
-+kvmppc_restore_tm:
-+	mflr	r0
-+	std	r0, PPC_LR_STKOFF(r1)
-+
-+	/* Turn on TM/FP/VSX/VMX so we can restore them. */
-+	mfmsr	r5
-+	li	r6, MSR_TM >> 32
-+	sldi	r6, r6, 32
-+	or	r5, r5, r6
-+	ori	r5, r5, MSR_FP
-+	oris	r5, r5, (MSR_VEC | MSR_VSX)@h
-+	mtmsrd	r5
-+
-+	/*
-+	 * The user may change these outside of a transaction, so they must
-+	 * always be context switched.
-+	 */
-+	ld	r5, VCPU_TFHAR(r4)
-+	ld	r6, VCPU_TFIAR(r4)
-+	ld	r7, VCPU_TEXASR(r4)
-+	mtspr	SPRN_TFHAR, r5
-+	mtspr	SPRN_TFIAR, r6
-+	mtspr	SPRN_TEXASR, r7
-+
-+	ld	r5, VCPU_MSR(r4)
-+	rldicl. r5, r5, 64 - MSR_TS_S_LG, 62
-+	beqlr		/* TM not active in guest */
-+	std	r1, HSTATE_HOST_R1(r13)
-+
-+	/* Make sure the failure summary is set, otherwise we'll program check
-+	 * when we trechkpt.  It's possible that this might have been not set
-+	 * on a kvmppc_set_one_reg() call but we shouldn't let this crash the
-+	 * host.
-+	 */
-+	oris	r7, r7, (TEXASR_FS)@h
-+	mtspr	SPRN_TEXASR, r7
-+
-+	/*
-+	 * We need to load up the checkpointed state for the guest.
-+	 * We need to do this early as it will blow away any GPRs, VSRs and
-+	 * some SPRs.
-+	 */
-+
-+	mr	r31, r4
-+	addi	r3, r31, VCPU_FPRS_TM
-+	bl	load_fp_state
-+	addi	r3, r31, VCPU_VRS_TM
-+	bl	load_vr_state
-+	mr	r4, r31
-+	lwz	r7, VCPU_VRSAVE_TM(r4)
-+	mtspr	SPRN_VRSAVE, r7
-+
-+	ld	r5, VCPU_LR_TM(r4)
-+	lwz	r6, VCPU_CR_TM(r4)
-+	ld	r7, VCPU_CTR_TM(r4)
-+	ld	r8, VCPU_AMR_TM(r4)
-+	ld	r9, VCPU_TAR_TM(r4)
-+	mtlr	r5
-+	mtcr	r6
-+	mtctr	r7
-+	mtspr	SPRN_AMR, r8
-+	mtspr	SPRN_TAR, r9
-+
-+	/*
-+	 * Load up PPR and DSCR values but don't put them in the actual SPRs
-+	 * till the last moment to avoid running with userspace PPR and DSCR for
-+	 * too long.
-+	 */
-+	ld	r29, VCPU_DSCR_TM(r4)
-+	ld	r30, VCPU_PPR_TM(r4)
-+
-+	std	r2, PACATMSCRATCH(r13) /* Save TOC */
-+
-+	/* Clear the MSR RI since r1, r13 are all going to be foobar. */
-+	li	r5, 0
-+	mtmsrd	r5, 1
-+
-+	/* Load GPRs r0-r28 */
-+	reg = 0
-+	.rept	29
-+	ld	reg, VCPU_GPRS_TM(reg)(r31)
-+	reg = reg + 1
-+	.endr
-+
-+	mtspr	SPRN_DSCR, r29
-+	mtspr	SPRN_PPR, r30
-+
-+	/* Load final GPRs */
-+	ld	29, VCPU_GPRS_TM(29)(r31)
-+	ld	30, VCPU_GPRS_TM(30)(r31)
-+	ld	31, VCPU_GPRS_TM(31)(r31)
-+
-+	/* TM checkpointed state is now setup.  All GPRs are now volatile. */
-+	TRECHKPT
-+
-+	/* Now let's get back the state we need. */
-+	HMT_MEDIUM
-+	GET_PACA(r13)
-+	ld	r29, HSTATE_DSCR(r13)
-+	mtspr	SPRN_DSCR, r29
-+	ld	r4, HSTATE_KVM_VCPU(r13)
-+	ld	r1, HSTATE_HOST_R1(r13)
-+	ld	r2, PACATMSCRATCH(r13)
-+
-+	/* Set the MSR RI since we have our registers back. */
-+	li	r5, MSR_RI
-+	mtmsrd	r5, 1
-+
-+	ld	r0, PPC_LR_STKOFF(r1)
-+	mtlr	r0
-+	blr
-+#endif
-+
- /*
-  * We come here if we get any exception or interrupt while we are
-  * executing host real mode code while in guest MMU context.
-diff --git a/arch/s390/include/asm/pgtable.h b/arch/s390/include/asm/pgtable.h
-index 18d2beb..42b968a8 100644
---- a/arch/s390/include/asm/pgtable.h
-+++ b/arch/s390/include/asm/pgtable.h
-@@ -893,7 +893,7 @@ void ptep_zap_key(struct mm_struct *mm, unsigned long addr, pte_t *ptep);
- bool test_and_clear_guest_dirty(struct mm_struct *mm, unsigned long address);
- int set_guest_storage_key(struct mm_struct *mm, unsigned long addr,
- 			  unsigned char key, bool nq);
--unsigned char get_guest_storage_key(struct mm_struct *mm, unsigned long addr);
-+unsigned long get_guest_storage_key(struct mm_struct *mm, unsigned long addr);
- 
- /*
-  * Certain architectures need to do special things when PTEs
-diff --git a/arch/s390/include/asm/tlbflush.h b/arch/s390/include/asm/tlbflush.h
-index a2e6ef3..0a20316 100644
---- a/arch/s390/include/asm/tlbflush.h
-+++ b/arch/s390/include/asm/tlbflush.h
-@@ -81,7 +81,8 @@ static inline void __tlb_flush_full(struct mm_struct *mm)
- }
- 
- /*
-- * Flush TLB entries for a specific ASCE on all CPUs.
-+ * Flush TLB entries for a specific ASCE on all CPUs. Should never be used
-+ * when more than one asce (e.g. gmap) ran on this mm.
-  */
- static inline void __tlb_flush_asce(struct mm_struct *mm, unsigned long asce)
- {
-diff --git a/arch/s390/mm/gmap.c b/arch/s390/mm/gmap.c
-index cace818..313c3b8 100644
---- a/arch/s390/mm/gmap.c
-+++ b/arch/s390/mm/gmap.c
-@@ -85,7 +85,7 @@ EXPORT_SYMBOL_GPL(gmap_alloc);
- static void gmap_flush_tlb(struct gmap *gmap)
- {
- 	if (MACHINE_HAS_IDTE)
--		__tlb_flush_asce(gmap->mm, gmap->asce);
-+		__tlb_flush_idte(gmap->asce);
- 	else
- 		__tlb_flush_global();
- }
-@@ -124,7 +124,7 @@ void gmap_free(struct gmap *gmap)
- 
- 	/* Flush tlb. */
- 	if (MACHINE_HAS_IDTE)
--		__tlb_flush_asce(gmap->mm, gmap->asce);
-+		__tlb_flush_idte(gmap->asce);
- 	else
- 		__tlb_flush_global();
- 
-diff --git a/arch/s390/mm/pgtable.c b/arch/s390/mm/pgtable.c
-index 9f0ce0e..ebb4f87 100644
---- a/arch/s390/mm/pgtable.c
-+++ b/arch/s390/mm/pgtable.c
-@@ -543,7 +543,7 @@ int set_guest_storage_key(struct mm_struct *mm, unsigned long addr,
- }
- EXPORT_SYMBOL(set_guest_storage_key);
- 
--unsigned char get_guest_storage_key(struct mm_struct *mm, unsigned long addr)
-+unsigned long get_guest_storage_key(struct mm_struct *mm, unsigned long addr)
- {
- 	unsigned char key;
- 	spinlock_t *ptl;
-diff --git a/arch/um/os-Linux/signal.c b/arch/um/os-Linux/signal.c
-index 8acaf4e..a86d7cc 100644
---- a/arch/um/os-Linux/signal.c
-+++ b/arch/um/os-Linux/signal.c
-@@ -15,6 +15,7 @@
- #include <kern_util.h>
- #include <os.h>
- #include <sysdep/mcontext.h>
-+#include <um_malloc.h>
- 
- void (*sig_info[NSIG])(int, struct siginfo *, struct uml_pt_regs *) = {
- 	[SIGTRAP]	= relay_signal,
-@@ -32,7 +33,7 @@ static void sig_handler_common(int sig, struct siginfo *si, mcontext_t *mc)
- 	struct uml_pt_regs *r;
- 	int save_errno = errno;
- 
--	r = malloc(sizeof(struct uml_pt_regs));
-+	r = uml_kmalloc(sizeof(struct uml_pt_regs), UM_GFP_ATOMIC);
- 	if (!r)
- 		panic("out of memory");
- 
-@@ -91,7 +92,7 @@ static void timer_real_alarm_handler(mcontext_t *mc)
- {
- 	struct uml_pt_regs *regs;
- 
--	regs = malloc(sizeof(struct uml_pt_regs));
-+	regs = uml_kmalloc(sizeof(struct uml_pt_regs), UM_GFP_ATOMIC);
- 	if (!regs)
- 		panic("out of memory");
- 
-diff --git a/arch/unicore32/include/asm/mmu_context.h b/arch/unicore32/include/asm/mmu_context.h
-index e35632e..62dfc64 100644
---- a/arch/unicore32/include/asm/mmu_context.h
-+++ b/arch/unicore32/include/asm/mmu_context.h
-@@ -98,7 +98,7 @@ static inline void arch_bprm_mm_init(struct mm_struct *mm,
- }
- 
- static inline bool arch_vma_access_permitted(struct vm_area_struct *vma,
--		bool write, bool foreign)
-+		bool write, bool execute, bool foreign)
- {
- 	/* by default, allow everything */
- 	return true;
-diff --git a/arch/x86/events/intel/uncore_snbep.c b/arch/x86/events/intel/uncore_snbep.c
-index 874e8bd..bd136ac 100644
---- a/arch/x86/events/intel/uncore_snbep.c
-+++ b/arch/x86/events/intel/uncore_snbep.c
-@@ -2546,7 +2546,7 @@ void hswep_uncore_cpu_init(void)
- 
- static struct intel_uncore_type hswep_uncore_ha = {
- 	.name		= "ha",
--	.num_counters   = 5,
-+	.num_counters   = 4,
- 	.num_boxes	= 2,
- 	.perf_ctr_bits	= 48,
- 	SNBEP_UNCORE_PCI_COMMON_INIT(),
-@@ -2565,7 +2565,7 @@ static struct uncore_event_desc hswep_uncore_imc_events[] = {
- 
- static struct intel_uncore_type hswep_uncore_imc = {
- 	.name		= "imc",
--	.num_counters   = 5,
-+	.num_counters   = 4,
- 	.num_boxes	= 8,
- 	.perf_ctr_bits	= 48,
- 	.fixed_ctr_bits	= 48,
-@@ -2611,7 +2611,7 @@ static struct intel_uncore_type hswep_uncore_irp = {
- 
- static struct intel_uncore_type hswep_uncore_qpi = {
- 	.name			= "qpi",
--	.num_counters		= 5,
-+	.num_counters		= 4,
- 	.num_boxes		= 3,
- 	.perf_ctr_bits		= 48,
- 	.perf_ctr		= SNBEP_PCI_PMON_CTR0,
-@@ -2693,7 +2693,7 @@ static struct event_constraint hswep_uncore_r3qpi_constraints[] = {
- 
- static struct intel_uncore_type hswep_uncore_r3qpi = {
- 	.name		= "r3qpi",
--	.num_counters   = 4,
-+	.num_counters   = 3,
- 	.num_boxes	= 3,
- 	.perf_ctr_bits	= 44,
- 	.constraints	= hswep_uncore_r3qpi_constraints,
-@@ -2892,7 +2892,7 @@ static struct intel_uncore_type bdx_uncore_ha = {
- 
- static struct intel_uncore_type bdx_uncore_imc = {
- 	.name		= "imc",
--	.num_counters   = 5,
-+	.num_counters   = 4,
- 	.num_boxes	= 8,
- 	.perf_ctr_bits	= 48,
- 	.fixed_ctr_bits	= 48,
-diff --git a/arch/x86/kvm/mtrr.c b/arch/x86/kvm/mtrr.c
-index c146f3c..0149ac5 100644
---- a/arch/x86/kvm/mtrr.c
-+++ b/arch/x86/kvm/mtrr.c
-@@ -539,6 +539,7 @@ static void mtrr_lookup_var_start(struct mtrr_iter *iter)
- 
- 	iter->fixed = false;
- 	iter->start_max = iter->start;
-+	iter->range = NULL;
- 	iter->range = list_prepare_entry(iter->range, &mtrr_state->head, node);
- 
- 	__mtrr_lookup_var_next(iter);
-diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
-index 64a79f2..8326d68 100644
---- a/arch/x86/kvm/vmx.c
-+++ b/arch/x86/kvm/vmx.c
-@@ -8224,6 +8224,7 @@ static int vmx_handle_exit(struct kvm_vcpu *vcpu)
- 	if ((vectoring_info & VECTORING_INFO_VALID_MASK) &&
- 			(exit_reason != EXIT_REASON_EXCEPTION_NMI &&
- 			exit_reason != EXIT_REASON_EPT_VIOLATION &&
-+			exit_reason != EXIT_REASON_PML_FULL &&
- 			exit_reason != EXIT_REASON_TASK_SWITCH)) {
- 		vcpu->run->exit_reason = KVM_EXIT_INTERNAL_ERROR;
- 		vcpu->run->internal.suberror = KVM_INTERNAL_ERROR_DELIVERY_EV;
-@@ -8854,6 +8855,22 @@ static void vmx_load_vmcs01(struct kvm_vcpu *vcpu)
- 	put_cpu();
- }
- 
-+/*
-+ * Ensure that the current vmcs of the logical processor is the
-+ * vmcs01 of the vcpu before calling free_nested().
-+ */
-+static void vmx_free_vcpu_nested(struct kvm_vcpu *vcpu)
-+{
-+       struct vcpu_vmx *vmx = to_vmx(vcpu);
-+       int r;
-+
-+       r = vcpu_load(vcpu);
-+       BUG_ON(r);
-+       vmx_load_vmcs01(vcpu);
-+       free_nested(vmx);
-+       vcpu_put(vcpu);
-+}
-+
- static void vmx_free_vcpu(struct kvm_vcpu *vcpu)
- {
- 	struct vcpu_vmx *vmx = to_vmx(vcpu);
-@@ -8862,8 +8879,7 @@ static void vmx_free_vcpu(struct kvm_vcpu *vcpu)
- 		vmx_destroy_pml_buffer(vmx);
- 	free_vpid(vmx->vpid);
- 	leave_guest_mode(vcpu);
--	vmx_load_vmcs01(vcpu);
--	free_nested(vmx);
-+	vmx_free_vcpu_nested(vcpu);
- 	free_loaded_vmcs(vmx->loaded_vmcs);
- 	kfree(vmx->guest_msrs);
- 	kvm_vcpu_uninit(vcpu);
-diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
-index 7da5dd2..fea2c57 100644
---- a/arch/x86/kvm/x86.c
-+++ b/arch/x86/kvm/x86.c
-@@ -91,6 +91,7 @@ static u64 __read_mostly efer_reserved_bits = ~((u64)EFER_SCE);
- 
- static void update_cr8_intercept(struct kvm_vcpu *vcpu);
- static void process_nmi(struct kvm_vcpu *vcpu);
-+static void process_smi(struct kvm_vcpu *vcpu);
- static void __kvm_set_rflags(struct kvm_vcpu *vcpu, unsigned long rflags);
- 
- struct kvm_x86_ops *kvm_x86_ops __read_mostly;
-@@ -5296,13 +5297,8 @@ static void kvm_smm_changed(struct kvm_vcpu *vcpu)
- 		/* This is a good place to trace that we are exiting SMM.  */
- 		trace_kvm_enter_smm(vcpu->vcpu_id, vcpu->arch.smbase, false);
- 
--		if (unlikely(vcpu->arch.smi_pending)) {
--			kvm_make_request(KVM_REQ_SMI, vcpu);
--			vcpu->arch.smi_pending = 0;
--		} else {
--			/* Process a latched INIT, if any.  */
--			kvm_make_request(KVM_REQ_EVENT, vcpu);
--		}
-+		/* Process a latched INIT or SMI, if any.  */
-+		kvm_make_request(KVM_REQ_EVENT, vcpu);
- 	}
- 
- 	kvm_mmu_reset_context(vcpu);
-@@ -6102,7 +6098,10 @@ static int inject_pending_event(struct kvm_vcpu *vcpu, bool req_int_win)
- 	}
- 
- 	/* try to inject new event if pending */
--	if (vcpu->arch.nmi_pending && kvm_x86_ops->nmi_allowed(vcpu)) {
-+	if (vcpu->arch.smi_pending && !is_smm(vcpu)) {
-+		vcpu->arch.smi_pending = false;
-+		process_smi(vcpu);
-+	} else if (vcpu->arch.nmi_pending && kvm_x86_ops->nmi_allowed(vcpu)) {
- 		--vcpu->arch.nmi_pending;
- 		vcpu->arch.nmi_injected = true;
- 		kvm_x86_ops->set_nmi(vcpu);
-@@ -6312,11 +6311,6 @@ static void process_smi(struct kvm_vcpu *vcpu)
- 	char buf[512];
- 	u32 cr0;
- 
--	if (is_smm(vcpu)) {
--		vcpu->arch.smi_pending = true;
--		return;
--	}
--
- 	trace_kvm_enter_smm(vcpu->vcpu_id, vcpu->arch.smbase, true);
- 	vcpu->arch.hflags |= HF_SMM_MASK;
- 	memset(buf, 0, 512);
-@@ -6379,6 +6373,12 @@ static void process_smi(struct kvm_vcpu *vcpu)
- 	kvm_mmu_reset_context(vcpu);
- }
- 
-+static void process_smi_request(struct kvm_vcpu *vcpu)
-+{
-+	vcpu->arch.smi_pending = true;
-+	kvm_make_request(KVM_REQ_EVENT, vcpu);
-+}
-+
- void kvm_make_scan_ioapic_request(struct kvm *kvm)
- {
- 	kvm_make_all_cpus_request(kvm, KVM_REQ_SCAN_IOAPIC);
-@@ -6500,7 +6500,7 @@ static int vcpu_enter_guest(struct kvm_vcpu *vcpu)
- 		if (kvm_check_request(KVM_REQ_STEAL_UPDATE, vcpu))
- 			record_steal_time(vcpu);
- 		if (kvm_check_request(KVM_REQ_SMI, vcpu))
--			process_smi(vcpu);
-+			process_smi_request(vcpu);
- 		if (kvm_check_request(KVM_REQ_NMI, vcpu))
- 			process_nmi(vcpu);
- 		if (kvm_check_request(KVM_REQ_PMU, vcpu))
-@@ -6573,8 +6573,18 @@ static int vcpu_enter_guest(struct kvm_vcpu *vcpu)
- 
- 		if (inject_pending_event(vcpu, req_int_win) != 0)
- 			req_immediate_exit = true;
--		/* enable NMI/IRQ window open exits if needed */
- 		else {
-+			/* Enable NMI/IRQ window open exits if needed.
-+			 *
-+			 * SMIs have two cases: 1) they can be nested, and
-+			 * then there is nothing to do here because RSM will
-+			 * cause a vmexit anyway; 2) or the SMI can be pending
-+			 * because inject_pending_event has completed the
-+			 * injection of an IRQ or NMI from the previous vmexit,
-+			 * and then we request an immediate exit to inject the SMI.
-+			 */
-+			if (vcpu->arch.smi_pending && !is_smm(vcpu))
-+				req_immediate_exit = true;
- 			if (vcpu->arch.nmi_pending)
- 				kvm_x86_ops->enable_nmi_window(vcpu);
- 			if (kvm_cpu_has_injectable_intr(vcpu) || req_int_win)
-@@ -6625,8 +6635,10 @@ static int vcpu_enter_guest(struct kvm_vcpu *vcpu)
- 
- 	kvm_load_guest_xcr0(vcpu);
- 
--	if (req_immediate_exit)
-+	if (req_immediate_exit) {
-+		kvm_make_request(KVM_REQ_EVENT, vcpu);
- 		smp_send_reschedule(vcpu->cpu);
-+	}
- 
- 	trace_kvm_entry(vcpu->vcpu_id);
- 	wait_lapic_expire(vcpu);
-@@ -7427,6 +7439,7 @@ void kvm_vcpu_reset(struct kvm_vcpu *vcpu, bool init_event)
- {
- 	vcpu->arch.hflags = 0;
- 
-+	vcpu->arch.smi_pending = 0;
- 	atomic_set(&vcpu->arch.nmi_queued, 0);
- 	vcpu->arch.nmi_pending = 0;
- 	vcpu->arch.nmi_injected = false;
-diff --git a/arch/x86/pci/intel_mid_pci.c b/arch/x86/pci/intel_mid_pci.c
-index 8b93e63..ae97f24 100644
---- a/arch/x86/pci/intel_mid_pci.c
-+++ b/arch/x86/pci/intel_mid_pci.c
-@@ -37,6 +37,7 @@
- 
- /* Quirks for the listed devices */
- #define PCI_DEVICE_ID_INTEL_MRFL_MMC	0x1190
-+#define PCI_DEVICE_ID_INTEL_MRFL_HSU	0x1191
- 
- /* Fixed BAR fields */
- #define PCIE_VNDR_CAP_ID_FIXED_BAR 0x00	/* Fixed BAR (TBD) */
-@@ -225,13 +226,20 @@ static int intel_mid_pci_irq_enable(struct pci_dev *dev)
- 		/* Special treatment for IRQ0 */
- 		if (dev->irq == 0) {
- 			/*
-+			 * Skip HS UART common registers device since it has
-+			 * IRQ0 assigned and not used by the kernel.
-+			 */
-+			if (dev->device == PCI_DEVICE_ID_INTEL_MRFL_HSU)
-+				return -EBUSY;
-+			/*
- 			 * TNG has IRQ0 assigned to eMMC controller. But there
- 			 * are also other devices with bogus PCI configuration
- 			 * that have IRQ0 assigned. This check ensures that
--			 * eMMC gets it.
-+			 * eMMC gets it. The rest of devices still could be
-+			 * enabled without interrupt line being allocated.
- 			 */
- 			if (dev->device != PCI_DEVICE_ID_INTEL_MRFL_MMC)
--				return -EBUSY;
-+				return 0;
- 		}
- 		break;
- 	default:
-diff --git a/block/bio.c b/block/bio.c
-index 0e4aa42..4623869 100644
---- a/block/bio.c
-+++ b/block/bio.c
-@@ -579,6 +579,8 @@ void __bio_clone_fast(struct bio *bio, struct bio *bio_src)
- 	bio->bi_rw = bio_src->bi_rw;
- 	bio->bi_iter = bio_src->bi_iter;
- 	bio->bi_io_vec = bio_src->bi_io_vec;
-+
-+	bio_clone_blkcg_association(bio, bio_src);
- }
- EXPORT_SYMBOL(__bio_clone_fast);
- 
-@@ -684,6 +686,8 @@ integrity_clone:
- 		}
- 	}
- 
-+	bio_clone_blkcg_association(bio, bio_src);
-+
- 	return bio;
- }
- EXPORT_SYMBOL(bio_clone_bioset);
-@@ -2005,6 +2009,17 @@ void bio_disassociate_task(struct bio *bio)
- 	}
- }
- 
-+/**
-+ * bio_clone_blkcg_association - clone blkcg association from src to dst bio
-+ * @dst: destination bio
-+ * @src: source bio
-+ */
-+void bio_clone_blkcg_association(struct bio *dst, struct bio *src)
-+{
-+	if (src->bi_css)
-+		WARN_ON(bio_associate_blkcg(dst, src->bi_css));
-+}
-+
- #endif /* CONFIG_BLK_CGROUP */
- 
- static void __init biovec_init_slabs(void)
-diff --git a/block/genhd.c b/block/genhd.c
-index 3eebd25..086f1a3 100644
---- a/block/genhd.c
-+++ b/block/genhd.c
-@@ -613,7 +613,7 @@ void add_disk(struct gendisk *disk)
- 
- 	/* Register BDI before referencing it from bdev */
- 	bdi = &disk->queue->backing_dev_info;
--	bdi_register_dev(bdi, disk_devt(disk));
-+	bdi_register_owner(bdi, disk_to_dev(disk));
- 
- 	blk_register_region(disk_devt(disk), disk->minors, NULL,
- 			    exact_match, exact_lock, disk);
-diff --git a/drivers/acpi/ec.c b/drivers/acpi/ec.c
-index 290d6f5..f4218df 100644
---- a/drivers/acpi/ec.c
-+++ b/drivers/acpi/ec.c
-@@ -101,6 +101,7 @@ enum ec_command {
- #define ACPI_EC_UDELAY_POLL	550	/* Wait 1ms for EC transaction polling */
- #define ACPI_EC_CLEAR_MAX	100	/* Maximum number of events to query
- 					 * when trying to clear the EC */
-+#define ACPI_EC_MAX_QUERIES	16	/* Maximum number of parallel queries */
- 
- enum {
- 	EC_FLAGS_QUERY_PENDING,		/* Query is pending */
-@@ -121,6 +122,10 @@ static unsigned int ec_delay __read_mostly = ACPI_EC_DELAY;
- module_param(ec_delay, uint, 0644);
- MODULE_PARM_DESC(ec_delay, "Timeout(ms) waited until an EC command completes");
- 
-+static unsigned int ec_max_queries __read_mostly = ACPI_EC_MAX_QUERIES;
-+module_param(ec_max_queries, uint, 0644);
-+MODULE_PARM_DESC(ec_max_queries, "Maximum parallel _Qxx evaluations");
-+
- static bool ec_busy_polling __read_mostly;
- module_param(ec_busy_polling, bool, 0644);
- MODULE_PARM_DESC(ec_busy_polling, "Use busy polling to advance EC transaction");
-@@ -174,6 +179,7 @@ static void acpi_ec_event_processor(struct work_struct *work);
- 
- struct acpi_ec *boot_ec, *first_ec;
- EXPORT_SYMBOL(first_ec);
-+static struct workqueue_struct *ec_query_wq;
- 
- static int EC_FLAGS_CLEAR_ON_RESUME; /* Needs acpi_ec_clear() on boot/resume */
- static int EC_FLAGS_QUERY_HANDSHAKE; /* Needs QR_EC issued when SCI_EVT set */
-@@ -1098,7 +1104,7 @@ static int acpi_ec_query(struct acpi_ec *ec, u8 *data)
- 	 * work queue execution.
- 	 */
- 	ec_dbg_evt("Query(0x%02x) scheduled", value);
--	if (!schedule_work(&q->work)) {
-+	if (!queue_work(ec_query_wq, &q->work)) {
- 		ec_dbg_evt("Query(0x%02x) overlapped", value);
- 		result = -EBUSY;
- 	}
-@@ -1660,15 +1666,41 @@ static struct acpi_driver acpi_ec_driver = {
- 		},
- };
- 
-+static inline int acpi_ec_query_init(void)
-+{
-+	if (!ec_query_wq) {
-+		ec_query_wq = alloc_workqueue("kec_query", 0,
-+					      ec_max_queries);
-+		if (!ec_query_wq)
-+			return -ENODEV;
-+	}
-+	return 0;
-+}
-+
-+static inline void acpi_ec_query_exit(void)
-+{
-+	if (ec_query_wq) {
-+		destroy_workqueue(ec_query_wq);
-+		ec_query_wq = NULL;
-+	}
-+}
-+
- int __init acpi_ec_init(void)
- {
--	int result = 0;
-+	int result;
- 
-+	/* register workqueue for _Qxx evaluations */
-+	result = acpi_ec_query_init();
-+	if (result)
-+		goto err_exit;
- 	/* Now register the driver for the EC */
- 	result = acpi_bus_register_driver(&acpi_ec_driver);
--	if (result < 0)
--		return -ENODEV;
-+	if (result)
-+		goto err_exit;
- 
-+err_exit:
-+	if (result)
-+		acpi_ec_query_exit();
- 	return result;
- }
- 
-@@ -1678,5 +1710,6 @@ static void __exit acpi_ec_exit(void)
- {
- 
- 	acpi_bus_unregister_driver(&acpi_ec_driver);
-+	acpi_ec_query_exit();
- }
- #endif	/* 0 */
-diff --git a/drivers/bcma/host_pci.c b/drivers/bcma/host_pci.c
-index cae5385..bd46569 100644
---- a/drivers/bcma/host_pci.c
-+++ b/drivers/bcma/host_pci.c
-@@ -295,6 +295,7 @@ static const struct pci_device_id bcma_pci_bridge_tbl[] = {
- 	{ PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x4359) },
- 	{ PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x4360) },
- 	{ PCI_DEVICE_SUB(PCI_VENDOR_ID_BROADCOM, 0x4365, PCI_VENDOR_ID_DELL, 0x0016) },
-+	{ PCI_DEVICE_SUB(PCI_VENDOR_ID_BROADCOM, 0x4365, PCI_VENDOR_ID_FOXCONN, 0xe092) },
- 	{ PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x43a0) },
- 	{ PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x43a9) },
- 	{ PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x43aa) },
-diff --git a/drivers/block/floppy.c b/drivers/block/floppy.c
-index 84708a5..a1dcf12 100644
---- a/drivers/block/floppy.c
-+++ b/drivers/block/floppy.c
-@@ -3663,11 +3663,6 @@ static int floppy_open(struct block_device *bdev, fmode_t mode)
- 
- 	opened_bdev[drive] = bdev;
- 
--	if (!(mode & (FMODE_READ|FMODE_WRITE))) {
--		res = -EINVAL;
--		goto out;
--	}
--
- 	res = -ENXIO;
- 
- 	if (!floppy_track_buffer) {
-@@ -3711,13 +3706,15 @@ static int floppy_open(struct block_device *bdev, fmode_t mode)
- 	if (UFDCS->rawcmd == 1)
- 		UFDCS->rawcmd = 2;
- 
--	UDRS->last_checked = 0;
--	clear_bit(FD_OPEN_SHOULD_FAIL_BIT, &UDRS->flags);
--	check_disk_change(bdev);
--	if (test_bit(FD_DISK_CHANGED_BIT, &UDRS->flags))
--		goto out;
--	if (test_bit(FD_OPEN_SHOULD_FAIL_BIT, &UDRS->flags))
--		goto out;
-+	if (mode & (FMODE_READ|FMODE_WRITE)) {
-+		UDRS->last_checked = 0;
-+		clear_bit(FD_OPEN_SHOULD_FAIL_BIT, &UDRS->flags);
-+		check_disk_change(bdev);
-+		if (test_bit(FD_DISK_CHANGED_BIT, &UDRS->flags))
-+			goto out;
-+		if (test_bit(FD_OPEN_SHOULD_FAIL_BIT, &UDRS->flags))
-+			goto out;
-+	}
- 
- 	res = -EROFS;
- 
-diff --git a/drivers/bluetooth/ath3k.c b/drivers/bluetooth/ath3k.c
-index 2589468..fadba88 100644
---- a/drivers/bluetooth/ath3k.c
-+++ b/drivers/bluetooth/ath3k.c
-@@ -123,6 +123,7 @@ static const struct usb_device_id ath3k_table[] = {
- 	{ USB_DEVICE(0x13d3, 0x3472) },
- 	{ USB_DEVICE(0x13d3, 0x3474) },
- 	{ USB_DEVICE(0x13d3, 0x3487) },
-+	{ USB_DEVICE(0x13d3, 0x3490) },
- 
- 	/* Atheros AR5BBU12 with sflash firmware */
- 	{ USB_DEVICE(0x0489, 0xE02C) },
-@@ -190,6 +191,7 @@ static const struct usb_device_id ath3k_blist_tbl[] = {
- 	{ USB_DEVICE(0x13d3, 0x3472), .driver_info = BTUSB_ATH3012 },
- 	{ USB_DEVICE(0x13d3, 0x3474), .driver_info = BTUSB_ATH3012 },
- 	{ USB_DEVICE(0x13d3, 0x3487), .driver_info = BTUSB_ATH3012 },
-+	{ USB_DEVICE(0x13d3, 0x3490), .driver_info = BTUSB_ATH3012 },
- 
- 	/* Atheros AR5BBU22 with sflash firmware */
- 	{ USB_DEVICE(0x0489, 0xE036), .driver_info = BTUSB_ATH3012 },
-diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
-index a3be65e..9f40c34 100644
---- a/drivers/bluetooth/btusb.c
-+++ b/drivers/bluetooth/btusb.c
-@@ -237,6 +237,7 @@ static const struct usb_device_id blacklist_table[] = {
- 	{ USB_DEVICE(0x13d3, 0x3472), .driver_info = BTUSB_ATH3012 },
- 	{ USB_DEVICE(0x13d3, 0x3474), .driver_info = BTUSB_ATH3012 },
- 	{ USB_DEVICE(0x13d3, 0x3487), .driver_info = BTUSB_ATH3012 },
-+	{ USB_DEVICE(0x13d3, 0x3490), .driver_info = BTUSB_ATH3012 },
- 
- 	/* Atheros AR5BBU12 with sflash firmware */
- 	{ USB_DEVICE(0x0489, 0xe02c), .driver_info = BTUSB_IGNORE },
-diff --git a/drivers/char/random.c b/drivers/char/random.c
-index 87ab9f6..d72c6d1 100644
---- a/drivers/char/random.c
-+++ b/drivers/char/random.c
-@@ -949,6 +949,7 @@ void add_interrupt_randomness(int irq, int irq_flags)
- 	/* award one bit for the contents of the fast pool */
- 	credit_entropy_bits(r, credit + 1);
- }
-+EXPORT_SYMBOL_GPL(add_interrupt_randomness);
- 
- #ifdef CONFIG_BLOCK
- void add_disk_randomness(struct gendisk *disk)
-@@ -1461,12 +1462,16 @@ random_read(struct file *file, char __user *buf, size_t nbytes, loff_t *ppos)
- static ssize_t
- urandom_read(struct file *file, char __user *buf, size_t nbytes, loff_t *ppos)
- {
-+	static int maxwarn = 10;
- 	int ret;
- 
--	if (unlikely(nonblocking_pool.initialized == 0))
--		printk_once(KERN_NOTICE "random: %s urandom read "
--			    "with %d bits of entropy available\n",
--			    current->comm, nonblocking_pool.entropy_total);
-+	if (unlikely(nonblocking_pool.initialized == 0) &&
-+	    maxwarn > 0) {
-+		maxwarn--;
-+		printk(KERN_NOTICE "random: %s: uninitialized urandom read "
-+		       "(%zd bytes read, %d bits of entropy available)\n",
-+		       current->comm, nbytes, nonblocking_pool.entropy_total);
-+	}
- 
- 	nbytes = min_t(size_t, nbytes, INT_MAX >> (ENTROPY_SHIFT + 3));
- 	ret = extract_entropy_user(&nonblocking_pool, buf, nbytes);
-@@ -1774,13 +1779,15 @@ int random_int_secret_init(void)
- 	return 0;
- }
- 
-+static DEFINE_PER_CPU(__u32 [MD5_DIGEST_WORDS], get_random_int_hash)
-+		__aligned(sizeof(unsigned long));
-+
- /*
-  * Get a random word for internal kernel use only. Similar to urandom but
-  * with the goal of minimal entropy pool depletion. As a result, the random
-  * value is not cryptographically secure but for several uses the cost of
-  * depleting entropy is too high
-  */
--static DEFINE_PER_CPU(__u32 [MD5_DIGEST_WORDS], get_random_int_hash);
- unsigned int get_random_int(void)
- {
- 	__u32 *hash;
-@@ -1850,12 +1857,18 @@ void add_hwgenerator_randomness(const char *buffer, size_t count,
- {
- 	struct entropy_store *poolp = &input_pool;
- 
--	/* Suspend writing if we're above the trickle threshold.
--	 * We'll be woken up again once below random_write_wakeup_thresh,
--	 * or when the calling thread is about to terminate.
--	 */
--	wait_event_interruptible(random_write_wait, kthread_should_stop() ||
-+	if (unlikely(nonblocking_pool.initialized == 0))
-+		poolp = &nonblocking_pool;
-+	else {
-+		/* Suspend writing if we're above the trickle
-+		 * threshold.  We'll be woken up again once below
-+		 * random_write_wakeup_thresh, or when the calling
-+		 * thread is about to terminate.
-+		 */
-+		wait_event_interruptible(random_write_wait,
-+					 kthread_should_stop() ||
- 			ENTROPY_BITS(&input_pool) <= random_write_wakeup_bits);
-+	}
- 	mix_pool_bytes(poolp, buffer, count);
- 	credit_entropy_bits(poolp, entropy);
- }
-diff --git a/drivers/char/tpm/tpm_crb.c b/drivers/char/tpm/tpm_crb.c
-index a12b319..e9fd1d8 100644
---- a/drivers/char/tpm/tpm_crb.c
-+++ b/drivers/char/tpm/tpm_crb.c
-@@ -246,7 +246,7 @@ static void __iomem *crb_map_res(struct device *dev, struct crb_priv *priv,
- 
- 	/* Detect a 64 bit address on a 32 bit system */
- 	if (start != new_res.start)
--		return ERR_PTR(-EINVAL);
-+		return (void __iomem *) ERR_PTR(-EINVAL);
- 
- 	if (!resource_contains(&priv->res, &new_res))
- 		return devm_ioremap_resource(dev, &new_res);
-diff --git a/drivers/clk/rockchip/clk-rk3399.c b/drivers/clk/rockchip/clk-rk3399.c
-index 8059a8d..31b77f7 100644
---- a/drivers/clk/rockchip/clk-rk3399.c
-+++ b/drivers/clk/rockchip/clk-rk3399.c
-@@ -586,7 +586,7 @@ static struct rockchip_clk_branch rk3399_clk_branches[] __initdata = {
- 			RK3399_CLKGATE_CON(8), 15, GFLAGS),
- 
- 	COMPOSITE(SCLK_SPDIF_REC_DPTX, "clk_spdif_rec_dptx", mux_pll_src_cpll_gpll_p, 0,
--			RK3399_CLKSEL_CON(32), 15, 1, MFLAGS, 0, 5, DFLAGS,
-+			RK3399_CLKSEL_CON(32), 15, 1, MFLAGS, 8, 5, DFLAGS,
- 			RK3399_CLKGATE_CON(10), 6, GFLAGS),
- 	/* i2s */
- 	COMPOSITE(0, "clk_i2s0_div", mux_pll_src_cpll_gpll_p, 0,
-diff --git a/drivers/cpufreq/intel_pstate.c b/drivers/cpufreq/intel_pstate.c
-index 1fa1a32..1b15917 100644
---- a/drivers/cpufreq/intel_pstate.c
-+++ b/drivers/cpufreq/intel_pstate.c
-@@ -944,7 +944,7 @@ static int core_get_max_pstate(void)
- 			if (err)
- 				goto skip_tar;
- 
--			tdp_msr = MSR_CONFIG_TDP_NOMINAL + tdp_ctrl;
-+			tdp_msr = MSR_CONFIG_TDP_NOMINAL + (tdp_ctrl & 0x3);
- 			err = rdmsrl_safe(tdp_msr, &tdp_ratio);
- 			if (err)
- 				goto skip_tar;
-diff --git a/drivers/edac/edac_mc_sysfs.c b/drivers/edac/edac_mc_sysfs.c
-index 10c305b..4e0f8e7 100644
---- a/drivers/edac/edac_mc_sysfs.c
-+++ b/drivers/edac/edac_mc_sysfs.c
-@@ -313,7 +313,6 @@ static struct device_type csrow_attr_type = {
-  * possible dynamic channel DIMM Label attribute files
-  *
-  */
--
- DEVICE_CHANNEL(ch0_dimm_label, S_IRUGO | S_IWUSR,
- 	channel_dimm_label_show, channel_dimm_label_store, 0);
- DEVICE_CHANNEL(ch1_dimm_label, S_IRUGO | S_IWUSR,
-@@ -326,6 +325,10 @@ DEVICE_CHANNEL(ch4_dimm_label, S_IRUGO | S_IWUSR,
- 	channel_dimm_label_show, channel_dimm_label_store, 4);
- DEVICE_CHANNEL(ch5_dimm_label, S_IRUGO | S_IWUSR,
- 	channel_dimm_label_show, channel_dimm_label_store, 5);
-+DEVICE_CHANNEL(ch6_dimm_label, S_IRUGO | S_IWUSR,
-+	channel_dimm_label_show, channel_dimm_label_store, 6);
-+DEVICE_CHANNEL(ch7_dimm_label, S_IRUGO | S_IWUSR,
-+	channel_dimm_label_show, channel_dimm_label_store, 7);
- 
- /* Total possible dynamic DIMM Label attribute file table */
- static struct attribute *dynamic_csrow_dimm_attr[] = {
-@@ -335,6 +338,8 @@ static struct attribute *dynamic_csrow_dimm_attr[] = {
- 	&dev_attr_legacy_ch3_dimm_label.attr.attr,
- 	&dev_attr_legacy_ch4_dimm_label.attr.attr,
- 	&dev_attr_legacy_ch5_dimm_label.attr.attr,
-+	&dev_attr_legacy_ch6_dimm_label.attr.attr,
-+	&dev_attr_legacy_ch7_dimm_label.attr.attr,
- 	NULL
- };
- 
-@@ -351,6 +356,10 @@ DEVICE_CHANNEL(ch4_ce_count, S_IRUGO,
- 		   channel_ce_count_show, NULL, 4);
- DEVICE_CHANNEL(ch5_ce_count, S_IRUGO,
- 		   channel_ce_count_show, NULL, 5);
-+DEVICE_CHANNEL(ch6_ce_count, S_IRUGO,
-+		   channel_ce_count_show, NULL, 6);
-+DEVICE_CHANNEL(ch7_ce_count, S_IRUGO,
-+		   channel_ce_count_show, NULL, 7);
- 
- /* Total possible dynamic ce_count attribute file table */
- static struct attribute *dynamic_csrow_ce_count_attr[] = {
-@@ -360,6 +369,8 @@ static struct attribute *dynamic_csrow_ce_count_attr[] = {
- 	&dev_attr_legacy_ch3_ce_count.attr.attr,
- 	&dev_attr_legacy_ch4_ce_count.attr.attr,
- 	&dev_attr_legacy_ch5_ce_count.attr.attr,
-+	&dev_attr_legacy_ch6_ce_count.attr.attr,
-+	&dev_attr_legacy_ch7_ce_count.attr.attr,
- 	NULL
- };
- 
-@@ -371,9 +382,16 @@ static umode_t csrow_dev_is_visible(struct kobject *kobj,
- 
- 	if (idx >= csrow->nr_channels)
- 		return 0;
-+
-+	if (idx >= ARRAY_SIZE(dynamic_csrow_ce_count_attr) - 1) {
-+		WARN_ONCE(1, "idx: %d\n", idx);
-+		return 0;
-+	}
-+
- 	/* Only expose populated DIMMs */
- 	if (!csrow->channels[idx]->dimm->nr_pages)
- 		return 0;
-+
- 	return attr->mode;
- }
- 
-diff --git a/drivers/gpio/gpio-intel-mid.c b/drivers/gpio/gpio-intel-mid.c
-index cdaba13..c0f7cce 100644
---- a/drivers/gpio/gpio-intel-mid.c
-+++ b/drivers/gpio/gpio-intel-mid.c
-@@ -17,7 +17,6 @@
-  * Moorestown platform Langwell chip.
-  * Medfield platform Penwell chip.
-  * Clovertrail platform Cloverview chip.
-- * Merrifield platform Tangier chip.
-  */
- 
- #include <linux/module.h>
-@@ -64,10 +63,6 @@ enum GPIO_REG {
- /* intel_mid gpio driver data */
- struct intel_mid_gpio_ddata {
- 	u16 ngpio;		/* number of gpio pins */
--	u32 gplr_offset;	/* offset of first GPLR register from base */
--	u32 flis_base;		/* base address of FLIS registers */
--	u32 flis_len;		/* length of FLIS registers */
--	u32 (*get_flis_offset)(int gpio);
- 	u32 chip_irq_type;	/* chip interrupt type */
- };
- 
-@@ -252,15 +247,6 @@ static const struct intel_mid_gpio_ddata gpio_cloverview_core = {
- 	.chip_irq_type = INTEL_MID_IRQ_TYPE_EDGE,
- };
- 
--static const struct intel_mid_gpio_ddata gpio_tangier = {
--	.ngpio = 192,
--	.gplr_offset = 4,
--	.flis_base = 0xff0c0000,
--	.flis_len = 0x8000,
--	.get_flis_offset = NULL,
--	.chip_irq_type = INTEL_MID_IRQ_TYPE_EDGE,
--};
--
- static const struct pci_device_id intel_gpio_ids[] = {
- 	{
- 		/* Lincroft */
-@@ -287,11 +273,6 @@ static const struct pci_device_id intel_gpio_ids[] = {
- 		PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x08f7),
- 		.driver_data = (kernel_ulong_t)&gpio_cloverview_core,
- 	},
--	{
--		/* Tangier */
--		PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x1199),
--		.driver_data = (kernel_ulong_t)&gpio_tangier,
--	},
- 	{ 0 }
- };
- MODULE_DEVICE_TABLE(pci, intel_gpio_ids);
-@@ -401,7 +382,7 @@ static int intel_gpio_probe(struct pci_dev *pdev,
- 	spin_lock_init(&priv->lock);
- 
- 	pci_set_drvdata(pdev, priv);
--	retval = gpiochip_add_data(&priv->chip, priv);
-+	retval = devm_gpiochip_add_data(&pdev->dev, &priv->chip, priv);
- 	if (retval) {
- 		dev_err(&pdev->dev, "gpiochip_add error %d\n", retval);
- 		return retval;
-diff --git a/drivers/gpio/gpio-pca953x.c b/drivers/gpio/gpio-pca953x.c
-index 5e3be32..3745de6 100644
---- a/drivers/gpio/gpio-pca953x.c
-+++ b/drivers/gpio/gpio-pca953x.c
-@@ -90,7 +90,7 @@ MODULE_DEVICE_TABLE(acpi, pca953x_acpi_ids);
- #define MAX_BANK 5
- #define BANK_SZ 8
- 
--#define NBANK(chip) (chip->gpio_chip.ngpio / BANK_SZ)
-+#define NBANK(chip) DIV_ROUND_UP(chip->gpio_chip.ngpio, BANK_SZ)
- 
- struct pca953x_chip {
- 	unsigned gpio_start;
-diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c
-index 9df1bcb..9831753 100644
---- a/drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c
-+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c
-@@ -551,28 +551,19 @@ int amdgpu_atombios_get_clock_info(struct amdgpu_device *adev)
- 		    le16_to_cpu(firmware_info->info.usReferenceClock);
- 		ppll->reference_div = 0;
- 
--		if (crev < 2)
--			ppll->pll_out_min =
--				le16_to_cpu(firmware_info->info.usMinPixelClockPLL_Output);
--		else
--			ppll->pll_out_min =
--				le32_to_cpu(firmware_info->info_12.ulMinPixelClockPLL_Output);
-+		ppll->pll_out_min =
-+			le32_to_cpu(firmware_info->info_12.ulMinPixelClockPLL_Output);
- 		ppll->pll_out_max =
- 		    le32_to_cpu(firmware_info->info.ulMaxPixelClockPLL_Output);
- 
--		if (crev >= 4) {
--			ppll->lcd_pll_out_min =
--				le16_to_cpu(firmware_info->info_14.usLcdMinPixelClockPLL_Output) * 100;
--			if (ppll->lcd_pll_out_min == 0)
--				ppll->lcd_pll_out_min = ppll->pll_out_min;
--			ppll->lcd_pll_out_max =
--				le16_to_cpu(firmware_info->info_14.usLcdMaxPixelClockPLL_Output) * 100;
--			if (ppll->lcd_pll_out_max == 0)
--				ppll->lcd_pll_out_max = ppll->pll_out_max;
--		} else {
-+		ppll->lcd_pll_out_min =
-+			le16_to_cpu(firmware_info->info_14.usLcdMinPixelClockPLL_Output) * 100;
-+		if (ppll->lcd_pll_out_min == 0)
- 			ppll->lcd_pll_out_min = ppll->pll_out_min;
-+		ppll->lcd_pll_out_max =
-+			le16_to_cpu(firmware_info->info_14.usLcdMaxPixelClockPLL_Output) * 100;
-+		if (ppll->lcd_pll_out_max == 0)
- 			ppll->lcd_pll_out_max = ppll->pll_out_max;
--		}
- 
- 		if (ppll->pll_out_min == 0)
- 			ppll->pll_out_min = 64800;
-diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_atpx_handler.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_atpx_handler.c
-index 35a1248..1b4c069 100644
---- a/drivers/gpu/drm/amd/amdgpu/amdgpu_atpx_handler.c
-+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_atpx_handler.c
-@@ -10,6 +10,7 @@
- #include <linux/slab.h>
- #include <linux/acpi.h>
- #include <linux/pci.h>
-+#include <linux/delay.h>
- 
- #include "amd_acpi.h"
- 
-@@ -259,6 +260,10 @@ static int amdgpu_atpx_set_discrete_state(struct amdgpu_atpx *atpx, u8 state)
- 		if (!info)
- 			return -EIO;
- 		kfree(info);
-+
-+		/* 200ms delay is required after off */
-+		if (state == 0)
-+			msleep(200);
- 	}
- 	return 0;
- }
-diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c
-index cb07da4..ff0b55a 100644
---- a/drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c
-+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c
-@@ -1690,7 +1690,6 @@ amdgpu_connector_add(struct amdgpu_device *adev,
- 						   DRM_MODE_SCALE_NONE);
- 			/* no HPD on analog connectors */
- 			amdgpu_connector->hpd.hpd = AMDGPU_HPD_NONE;
--			connector->polled = DRM_CONNECTOR_POLL_CONNECT;
- 			connector->interlace_allowed = true;
- 			connector->doublescan_allowed = true;
- 			break;
-@@ -1893,8 +1892,10 @@ amdgpu_connector_add(struct amdgpu_device *adev,
- 	}
- 
- 	if (amdgpu_connector->hpd.hpd == AMDGPU_HPD_NONE) {
--		if (i2c_bus->valid)
--			connector->polled = DRM_CONNECTOR_POLL_CONNECT;
-+		if (i2c_bus->valid) {
-+			connector->polled = DRM_CONNECTOR_POLL_CONNECT |
-+			                    DRM_CONNECTOR_POLL_DISCONNECT;
-+		}
- 	} else
- 		connector->polled = DRM_CONNECTOR_POLL_HPD;
- 
-diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
-index 6e92008..b7f5650 100644
---- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
-+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
-@@ -1841,7 +1841,23 @@ int amdgpu_resume_kms(struct drm_device *dev, bool resume, bool fbcon)
- 	}
- 
- 	drm_kms_helper_poll_enable(dev);
-+
-+	/*
-+	 * Most of the connector probing functions try to acquire runtime pm
-+	 * refs to ensure that the GPU is powered on when connector polling is
-+	 * performed. Since we're calling this from a runtime PM callback,
-+	 * trying to acquire rpm refs will cause us to deadlock.
-+	 *
-+	 * Since we're guaranteed to be holding the rpm lock, it's safe to
-+	 * temporarily disable the rpm helpers so this doesn't deadlock us.
-+	 */
-+#ifdef CONFIG_PM
-+	dev->dev->power.disable_depth++;
-+#endif
- 	drm_helper_hpd_irq_event(dev);
-+#ifdef CONFIG_PM
-+	dev->dev->power.disable_depth--;
-+#endif
- 
- 	if (fbcon) {
- 		amdgpu_fbdev_set_suspend(adev, 0);
-diff --git a/drivers/gpu/drm/amd/amdgpu/atombios_encoders.c b/drivers/gpu/drm/amd/amdgpu/atombios_encoders.c
-index 48b6bd6..c32eca2 100644
---- a/drivers/gpu/drm/amd/amdgpu/atombios_encoders.c
-+++ b/drivers/gpu/drm/amd/amdgpu/atombios_encoders.c
-@@ -98,6 +98,7 @@ amdgpu_atombios_encoder_set_backlight_level(struct amdgpu_encoder *amdgpu_encode
- 		case ENCODER_OBJECT_ID_INTERNAL_KLDSCP_LVTMA:
- 		case ENCODER_OBJECT_ID_INTERNAL_UNIPHY1:
- 		case ENCODER_OBJECT_ID_INTERNAL_UNIPHY2:
-+		case ENCODER_OBJECT_ID_INTERNAL_UNIPHY3:
- 			if (dig->backlight_level == 0)
- 				amdgpu_atombios_encoder_setup_dig_transmitter(encoder,
- 								       ATOM_TRANSMITTER_ACTION_LCD_BLOFF, 0, 0);
-diff --git a/drivers/gpu/drm/amd/amdgpu/gmc_v7_0.c b/drivers/gpu/drm/amd/amdgpu/gmc_v7_0.c
-index 1feb643..9269548 100644
---- a/drivers/gpu/drm/amd/amdgpu/gmc_v7_0.c
-+++ b/drivers/gpu/drm/amd/amdgpu/gmc_v7_0.c
-@@ -167,6 +167,7 @@ static int gmc_v7_0_init_microcode(struct amdgpu_device *adev)
- 		break;
- 	case CHIP_KAVERI:
- 	case CHIP_KABINI:
-+	case CHIP_MULLINS:
- 		return 0;
- 	default: BUG();
- 	}
-diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/ppatomctrl.c b/drivers/gpu/drm/amd/powerplay/hwmgr/ppatomctrl.c
-index 90b35c5..ffc7c0d 100644
---- a/drivers/gpu/drm/amd/powerplay/hwmgr/ppatomctrl.c
-+++ b/drivers/gpu/drm/amd/powerplay/hwmgr/ppatomctrl.c
-@@ -592,12 +592,12 @@ bool atomctrl_get_pp_assign_pin(
- 		const uint32_t pinId,
- 		pp_atomctrl_gpio_pin_assignment *gpio_pin_assignment)
- {
--	bool bRet = 0;
-+	bool bRet = false;
- 	ATOM_GPIO_PIN_LUT *gpio_lookup_table =
- 		get_gpio_lookup_table(hwmgr->device);
- 
- 	PP_ASSERT_WITH_CODE((NULL != gpio_lookup_table),
--			"Could not find GPIO lookup Table in BIOS.", return -1);
-+			"Could not find GPIO lookup Table in BIOS.", return false);
- 
- 	bRet = atomctrl_lookup_gpio_pin(gpio_lookup_table, pinId,
- 		gpio_pin_assignment);
-diff --git a/drivers/gpu/drm/drm_cache.c b/drivers/gpu/drm/drm_cache.c
-index 059f7c3..a7916e5 100644
---- a/drivers/gpu/drm/drm_cache.c
-+++ b/drivers/gpu/drm/drm_cache.c
-@@ -136,6 +136,7 @@ drm_clflush_virt_range(void *addr, unsigned long length)
- 		mb();
- 		for (; addr < end; addr += size)
- 			clflushopt(addr);
-+		clflushopt(end - 1); /* force serialisation */
- 		mb();
- 		return;
- 	}
-diff --git a/drivers/gpu/drm/drm_dp_helper.c b/drivers/gpu/drm/drm_dp_helper.c
-index eeaf5a7..67b28f8 100644
---- a/drivers/gpu/drm/drm_dp_helper.c
-+++ b/drivers/gpu/drm/drm_dp_helper.c
-@@ -203,7 +203,7 @@ static int drm_dp_dpcd_access(struct drm_dp_aux *aux, u8 request,
- 
- 		ret = aux->transfer(aux, &msg);
- 
--		if (ret > 0) {
-+		if (ret >= 0) {
- 			native_reply = msg.reply & DP_AUX_NATIVE_REPLY_MASK;
- 			if (native_reply == DP_AUX_NATIVE_REPLY_ACK) {
- 				if (ret == size)
-diff --git a/drivers/gpu/drm/drm_edid.c b/drivers/gpu/drm/drm_edid.c
-index 7df26d4..2cb472b 100644
---- a/drivers/gpu/drm/drm_edid.c
-+++ b/drivers/gpu/drm/drm_edid.c
-@@ -74,6 +74,8 @@
- #define EDID_QUIRK_FORCE_8BPC			(1 << 8)
- /* Force 12bpc */
- #define EDID_QUIRK_FORCE_12BPC			(1 << 9)
-+/* Force 6bpc */
-+#define EDID_QUIRK_FORCE_6BPC			(1 << 10)
- 
- struct detailed_mode_closure {
- 	struct drm_connector *connector;
-@@ -100,6 +102,9 @@ static struct edid_quirk {
- 	/* Unknown Acer */
- 	{ "ACR", 2423, EDID_QUIRK_FIRST_DETAILED_PREFERRED },
- 
-+	/* AEO model 0 reports 8 bpc, but is a 6 bpc panel */
-+	{ "AEO", 0, EDID_QUIRK_FORCE_6BPC },
-+
- 	/* Belinea 10 15 55 */
- 	{ "MAX", 1516, EDID_QUIRK_PREFER_LARGE_60 },
- 	{ "MAX", 0x77e, EDID_QUIRK_PREFER_LARGE_60 },
-@@ -4082,6 +4087,9 @@ int drm_add_edid_modes(struct drm_connector *connector, struct edid *edid)
- 
- 	drm_add_display_info(edid, &connector->display_info, connector);
- 
-+	if (quirks & EDID_QUIRK_FORCE_6BPC)
-+		connector->display_info.bpc = 6;
-+
- 	if (quirks & EDID_QUIRK_FORCE_8BPC)
- 		connector->display_info.bpc = 8;
- 
-diff --git a/drivers/gpu/drm/i915/i915_drv.h b/drivers/gpu/drm/i915/i915_drv.h
-index bc3f2e6..227a63e 100644
---- a/drivers/gpu/drm/i915/i915_drv.h
-+++ b/drivers/gpu/drm/i915/i915_drv.h
-@@ -2591,6 +2591,8 @@ struct drm_i915_cmd_table {
- #define SKL_REVID_D0		0x3
- #define SKL_REVID_E0		0x4
- #define SKL_REVID_F0		0x5
-+#define SKL_REVID_G0		0x6
-+#define SKL_REVID_H0		0x7
- 
- #define IS_SKL_REVID(p, since, until) (IS_SKYLAKE(p) && IS_REVID(p, since, until))
- 
-diff --git a/drivers/gpu/drm/i915/i915_reg.h b/drivers/gpu/drm/i915/i915_reg.h
-index 3fcf7dd..bc3b6dd 100644
---- a/drivers/gpu/drm/i915/i915_reg.h
-+++ b/drivers/gpu/drm/i915/i915_reg.h
-@@ -1672,6 +1672,9 @@ enum skl_disp_power_wells {
- 
- #define GEN7_TLB_RD_ADDR	_MMIO(0x4700)
- 
-+#define GEN9_GAMT_ECO_REG_RW_IA _MMIO(0x4ab0)
-+#define   GAMT_ECO_ENABLE_IN_PLACE_DECOMPRESS	(1<<18)
-+
- #define GAMT_CHKN_BIT_REG	_MMIO(0x4ab8)
- #define   GAMT_CHKN_DISABLE_DYNAMIC_CREDIT_SHARING	(1<<28)
- 
-@@ -7538,6 +7541,8 @@ enum skl_disp_power_wells {
- 
- #define CDCLK_FREQ			_MMIO(0x46200)
- 
-+#define CDCLK_FREQ			_MMIO(0x46200)
-+
- #define _TRANSA_MSA_MISC		0x60410
- #define _TRANSB_MSA_MISC		0x61410
- #define _TRANSC_MSA_MISC		0x62410
-diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
-index 3074c56..3289319 100644
---- a/drivers/gpu/drm/i915/intel_display.c
-+++ b/drivers/gpu/drm/i915/intel_display.c
-@@ -9700,6 +9700,8 @@ static void broadwell_set_cdclk(struct drm_device *dev, int cdclk)
- 
- 	I915_WRITE(CDCLK_FREQ, DIV_ROUND_CLOSEST(cdclk, 1000) - 1);
- 
-+	I915_WRITE(CDCLK_FREQ, DIV_ROUND_CLOSEST(cdclk, 1000) - 1);
-+
- 	intel_update_cdclk(dev);
- 
- 	WARN(cdclk != dev_priv->cdclk_freq,
-@@ -12095,21 +12097,11 @@ connected_sink_compute_bpp(struct intel_connector *connector,
- 		pipe_config->pipe_bpp = connector->base.display_info.bpc*3;
- 	}
- 
--	/* Clamp bpp to default limit on screens without EDID 1.4 */
--	if (connector->base.display_info.bpc == 0) {
--		int type = connector->base.connector_type;
--		int clamp_bpp = 24;
--
--		/* Fall back to 18 bpp when DP sink capability is unknown. */
--		if (type == DRM_MODE_CONNECTOR_DisplayPort ||
--		    type == DRM_MODE_CONNECTOR_eDP)
--			clamp_bpp = 18;
--
--		if (bpp > clamp_bpp) {
--			DRM_DEBUG_KMS("clamping display bpp (was %d) to default limit of %d\n",
--				      bpp, clamp_bpp);
--			pipe_config->pipe_bpp = clamp_bpp;
--		}
-+	/* Clamp bpp to 8 on screens without EDID 1.4 */
-+	if (connector->base.display_info.bpc == 0 && bpp > 24) {
-+		DRM_DEBUG_KMS("clamping display bpp (was %d) to default limit of 24\n",
-+			      bpp);
-+		pipe_config->pipe_bpp = 24;
- 	}
- }
- 
-diff --git a/drivers/gpu/drm/i915/intel_pm.c b/drivers/gpu/drm/i915/intel_pm.c
-index 2863b92..c1ca5a7 100644
---- a/drivers/gpu/drm/i915/intel_pm.c
-+++ b/drivers/gpu/drm/i915/intel_pm.c
-@@ -4563,7 +4563,8 @@ void gen6_rps_idle(struct drm_i915_private *dev_priv)
- 		else
- 			gen6_set_rps(dev_priv->dev, dev_priv->rps.idle_freq);
- 		dev_priv->rps.last_adj = 0;
--		I915_WRITE(GEN6_PMINTRMSK, 0xffffffff);
-+		I915_WRITE(GEN6_PMINTRMSK,
-+			   gen6_sanitize_rps_pm_mask(dev_priv, ~0));
- 	}
- 	mutex_unlock(&dev_priv->rps.hw_lock);
- 
-diff --git a/drivers/gpu/drm/i915/intel_ringbuffer.c b/drivers/gpu/drm/i915/intel_ringbuffer.c
-index 68c5af0..9d778f3 100644
---- a/drivers/gpu/drm/i915/intel_ringbuffer.c
-+++ b/drivers/gpu/drm/i915/intel_ringbuffer.c
-@@ -1135,6 +1135,11 @@ static int skl_init_workarounds(struct intel_engine_cs *engine)
- 	/* WaDisableGafsUnitClkGating:skl */
- 	WA_SET_BIT(GEN7_UCGCTL4, GEN8_EU_GAUNIT_CLOCK_GATE_DISABLE);
- 
-+	/* WaInPlaceDecompressionHang:skl */
-+	if (IS_SKL_REVID(dev_priv, SKL_REVID_H0, REVID_FOREVER))
-+		WA_SET_BIT(GEN9_GAMT_ECO_REG_RW_IA,
-+			   GAMT_ECO_ENABLE_IN_PLACE_DECOMPRESS);
-+
- 	/* WaDisableLSQCROPERFforOCL:skl */
- 	ret = wa_ring_whitelist_reg(engine, GEN8_L3SQCREG4);
- 	if (ret)
-@@ -1194,6 +1199,11 @@ static int bxt_init_workarounds(struct intel_engine_cs *engine)
- 		WA_SET_BIT_MASKED(COMMON_SLICE_CHICKEN2,
- 				  GEN8_SBE_DISABLE_REPLAY_BUF_OPTIMIZATION);
- 
-+	/* WaInPlaceDecompressionHang:bxt */
-+	if (IS_BXT_REVID(dev_priv, BXT_REVID_C0, REVID_FOREVER))
-+		WA_SET_BIT(GEN9_GAMT_ECO_REG_RW_IA,
-+			   GAMT_ECO_ENABLE_IN_PLACE_DECOMPRESS);
-+
- 	return 0;
- }
- 
-@@ -1241,6 +1251,10 @@ static int kbl_init_workarounds(struct intel_engine_cs *engine)
- 		GEN7_HALF_SLICE_CHICKEN1,
- 		GEN7_SBE_SS_CACHE_DISPATCH_PORT_SHARING_DISABLE);
- 
-+	/* WaInPlaceDecompressionHang:kbl */
-+	WA_SET_BIT(GEN9_GAMT_ECO_REG_RW_IA,
-+		   GAMT_ECO_ENABLE_IN_PLACE_DECOMPRESS);
-+
- 	/* WaDisableLSQCROPERFforOCL:kbl */
- 	ret = wa_ring_whitelist_reg(engine, GEN8_L3SQCREG4);
- 	if (ret)
-diff --git a/drivers/gpu/drm/nouveau/nouveau_drm.c b/drivers/gpu/drm/nouveau/nouveau_drm.c
-index 11f8dd9..d6c134b 100644
---- a/drivers/gpu/drm/nouveau/nouveau_drm.c
-+++ b/drivers/gpu/drm/nouveau/nouveau_drm.c
-@@ -324,7 +324,16 @@ static int nouveau_drm_probe(struct pci_dev *pdev,
- 	    !vga_switcheroo_handler_flags())
- 		return -EPROBE_DEFER;
- 
--	/* remove conflicting drivers (vesafb, efifb etc) */
-+	/* We need to check that the chipset is supported before booting
-+	 * fbdev off the hardware, as there's no way to put it back.
-+	 */
-+	ret = nvkm_device_pci_new(pdev, NULL, "error", true, false, 0, &device);
-+	if (ret)
-+		return ret;
-+
-+	nvkm_device_del(&device);
-+
-+	/* Remove conflicting drivers (vesafb, efifb etc). */
- 	aper = alloc_apertures(3);
- 	if (!aper)
- 		return -ENOMEM;
-diff --git a/drivers/gpu/drm/nouveau/nv04_fbcon.c b/drivers/gpu/drm/nouveau/nv04_fbcon.c
-index 7d9248b..da8fd5f 100644
---- a/drivers/gpu/drm/nouveau/nv04_fbcon.c
-+++ b/drivers/gpu/drm/nouveau/nv04_fbcon.c
-@@ -107,11 +107,11 @@ nv04_fbcon_imageblit(struct fb_info *info, const struct fb_image *image)
- 			 ((image->dx + image->width) & 0xffff));
- 	OUT_RING(chan, bg);
- 	OUT_RING(chan, fg);
--	OUT_RING(chan, (image->height << 16) | image->width);
-+	OUT_RING(chan, (image->height << 16) | ALIGN(image->width, 8));
- 	OUT_RING(chan, (image->height << 16) | image->width);
- 	OUT_RING(chan, (image->dy << 16) | (image->dx & 0xffff));
- 
--	dsize = ALIGN(image->width * image->height, 32) >> 5;
-+	dsize = ALIGN(ALIGN(image->width, 8) * image->height, 32) >> 5;
- 	while (dsize) {
- 		int iter_len = dsize > 128 ? 128 : dsize;
- 
-diff --git a/drivers/gpu/drm/nouveau/nv50_fbcon.c b/drivers/gpu/drm/nouveau/nv50_fbcon.c
-index 1aeb698..af3d3c4 100644
---- a/drivers/gpu/drm/nouveau/nv50_fbcon.c
-+++ b/drivers/gpu/drm/nouveau/nv50_fbcon.c
-@@ -125,7 +125,7 @@ nv50_fbcon_imageblit(struct fb_info *info, const struct fb_image *image)
- 	OUT_RING(chan, 0);
- 	OUT_RING(chan, image->dy);
- 
--	dwords = ALIGN(image->width * image->height, 32) >> 5;
-+	dwords = ALIGN(ALIGN(image->width, 8) * image->height, 32) >> 5;
- 	while (dwords) {
- 		int push = dwords > 2047 ? 2047 : dwords;
- 
-diff --git a/drivers/gpu/drm/nouveau/nvc0_fbcon.c b/drivers/gpu/drm/nouveau/nvc0_fbcon.c
-index 839f4c8..054b6a0 100644
---- a/drivers/gpu/drm/nouveau/nvc0_fbcon.c
-+++ b/drivers/gpu/drm/nouveau/nvc0_fbcon.c
-@@ -125,7 +125,7 @@ nvc0_fbcon_imageblit(struct fb_info *info, const struct fb_image *image)
- 	OUT_RING  (chan, 0);
- 	OUT_RING  (chan, image->dy);
- 
--	dwords = ALIGN(image->width * image->height, 32) >> 5;
-+	dwords = ALIGN(ALIGN(image->width, 8) * image->height, 32) >> 5;
- 	while (dwords) {
- 		int push = dwords > 2047 ? 2047 : dwords;
- 
-diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/gr/nv30.c b/drivers/gpu/drm/nouveau/nvkm/engine/gr/nv30.c
-index 69de8c6..f1e15a4 100644
---- a/drivers/gpu/drm/nouveau/nvkm/engine/gr/nv30.c
-+++ b/drivers/gpu/drm/nouveau/nvkm/engine/gr/nv30.c
-@@ -76,8 +76,8 @@ nv30_gr_chan_new(struct nvkm_gr *base, struct nvkm_fifo_chan *fifoch,
- 		nvkm_wo32(chan->inst, i, 0x00040004);
- 	for (i = 0x1f18; i <= 0x3088 ; i += 16) {
- 		nvkm_wo32(chan->inst, i + 0, 0x10700ff9);
--		nvkm_wo32(chan->inst, i + 1, 0x0436086c);
--		nvkm_wo32(chan->inst, i + 2, 0x000c001b);
-+		nvkm_wo32(chan->inst, i + 4, 0x0436086c);
-+		nvkm_wo32(chan->inst, i + 8, 0x000c001b);
- 	}
- 	for (i = 0x30b8; i < 0x30c8; i += 4)
- 		nvkm_wo32(chan->inst, i, 0x0000ffff);
-diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/gr/nv34.c b/drivers/gpu/drm/nouveau/nvkm/engine/gr/nv34.c
-index 2207dac2..300f5ed 100644
---- a/drivers/gpu/drm/nouveau/nvkm/engine/gr/nv34.c
-+++ b/drivers/gpu/drm/nouveau/nvkm/engine/gr/nv34.c
-@@ -75,8 +75,8 @@ nv34_gr_chan_new(struct nvkm_gr *base, struct nvkm_fifo_chan *fifoch,
- 		nvkm_wo32(chan->inst, i, 0x00040004);
- 	for (i = 0x15ac; i <= 0x271c ; i += 16) {
- 		nvkm_wo32(chan->inst, i + 0, 0x10700ff9);
--		nvkm_wo32(chan->inst, i + 1, 0x0436086c);
--		nvkm_wo32(chan->inst, i + 2, 0x000c001b);
-+		nvkm_wo32(chan->inst, i + 4, 0x0436086c);
-+		nvkm_wo32(chan->inst, i + 8, 0x000c001b);
- 	}
- 	for (i = 0x274c; i < 0x275c; i += 4)
- 		nvkm_wo32(chan->inst, i, 0x0000ffff);
-diff --git a/drivers/gpu/drm/radeon/atombios_encoders.c b/drivers/gpu/drm/radeon/atombios_encoders.c
-index 587cae4..56bb758 100644
---- a/drivers/gpu/drm/radeon/atombios_encoders.c
-+++ b/drivers/gpu/drm/radeon/atombios_encoders.c
-@@ -120,6 +120,7 @@ atombios_set_backlight_level(struct radeon_encoder *radeon_encoder, u8 level)
- 		case ENCODER_OBJECT_ID_INTERNAL_KLDSCP_LVTMA:
- 		case ENCODER_OBJECT_ID_INTERNAL_UNIPHY1:
- 		case ENCODER_OBJECT_ID_INTERNAL_UNIPHY2:
-+		case ENCODER_OBJECT_ID_INTERNAL_UNIPHY3:
- 			if (dig->backlight_level == 0)
- 				atombios_dig_transmitter_setup(encoder, ATOM_TRANSMITTER_ACTION_LCD_BLOFF, 0, 0);
- 			else {
-diff --git a/drivers/gpu/drm/radeon/radeon_atombios.c b/drivers/gpu/drm/radeon/radeon_atombios.c
-index f8097a0..5df3ec7 100644
---- a/drivers/gpu/drm/radeon/radeon_atombios.c
-+++ b/drivers/gpu/drm/radeon/radeon_atombios.c
-@@ -1155,7 +1155,7 @@ bool radeon_atom_get_clock_info(struct drm_device *dev)
- 		    le16_to_cpu(firmware_info->info.usReferenceClock);
- 		p1pll->reference_div = 0;
- 
--		if (crev < 2)
-+		if ((frev < 2) && (crev < 2))
- 			p1pll->pll_out_min =
- 				le16_to_cpu(firmware_info->info.usMinPixelClockPLL_Output);
- 		else
-@@ -1164,7 +1164,7 @@ bool radeon_atom_get_clock_info(struct drm_device *dev)
- 		p1pll->pll_out_max =
- 		    le32_to_cpu(firmware_info->info.ulMaxPixelClockPLL_Output);
- 
--		if (crev >= 4) {
-+		if (((frev < 2) && (crev >= 4)) || (frev >= 2)) {
- 			p1pll->lcd_pll_out_min =
- 				le16_to_cpu(firmware_info->info_14.usLcdMinPixelClockPLL_Output) * 100;
- 			if (p1pll->lcd_pll_out_min == 0)
-diff --git a/drivers/gpu/drm/radeon/radeon_atpx_handler.c b/drivers/gpu/drm/radeon/radeon_atpx_handler.c
-index 95f4fea..1b3f4e5 100644
---- a/drivers/gpu/drm/radeon/radeon_atpx_handler.c
-+++ b/drivers/gpu/drm/radeon/radeon_atpx_handler.c
-@@ -10,6 +10,7 @@
- #include <linux/slab.h>
- #include <linux/acpi.h>
- #include <linux/pci.h>
-+#include <linux/delay.h>
- 
- #include "radeon_acpi.h"
- 
-@@ -258,6 +259,10 @@ static int radeon_atpx_set_discrete_state(struct radeon_atpx *atpx, u8 state)
- 		if (!info)
- 			return -EIO;
- 		kfree(info);
-+
-+		/* 200ms delay is required after off */
-+		if (state == 0)
-+			msleep(200);
- 	}
- 	return 0;
- }
-diff --git a/drivers/gpu/drm/radeon/radeon_connectors.c b/drivers/gpu/drm/radeon/radeon_connectors.c
-index 81a63d7..b79f3b0 100644
---- a/drivers/gpu/drm/radeon/radeon_connectors.c
-+++ b/drivers/gpu/drm/radeon/radeon_connectors.c
-@@ -2064,7 +2064,6 @@ radeon_add_atom_connector(struct drm_device *dev,
- 							   RADEON_OUTPUT_CSC_BYPASS);
- 			/* no HPD on analog connectors */
- 			radeon_connector->hpd.hpd = RADEON_HPD_NONE;
--			connector->polled = DRM_CONNECTOR_POLL_CONNECT;
- 			connector->interlace_allowed = true;
- 			connector->doublescan_allowed = true;
- 			break;
-@@ -2314,8 +2313,10 @@ radeon_add_atom_connector(struct drm_device *dev,
- 	}
- 
- 	if (radeon_connector->hpd.hpd == RADEON_HPD_NONE) {
--		if (i2c_bus->valid)
--			connector->polled = DRM_CONNECTOR_POLL_CONNECT;
-+		if (i2c_bus->valid) {
-+			connector->polled = DRM_CONNECTOR_POLL_CONNECT |
-+			                    DRM_CONNECTOR_POLL_DISCONNECT;
-+		}
- 	} else
- 		connector->polled = DRM_CONNECTOR_POLL_HPD;
- 
-@@ -2391,7 +2392,6 @@ radeon_add_legacy_connector(struct drm_device *dev,
- 					      1);
- 		/* no HPD on analog connectors */
- 		radeon_connector->hpd.hpd = RADEON_HPD_NONE;
--		connector->polled = DRM_CONNECTOR_POLL_CONNECT;
- 		connector->interlace_allowed = true;
- 		connector->doublescan_allowed = true;
- 		break;
-@@ -2476,10 +2476,13 @@ radeon_add_legacy_connector(struct drm_device *dev,
- 	}
- 
- 	if (radeon_connector->hpd.hpd == RADEON_HPD_NONE) {
--		if (i2c_bus->valid)
--			connector->polled = DRM_CONNECTOR_POLL_CONNECT;
-+		if (i2c_bus->valid) {
-+			connector->polled = DRM_CONNECTOR_POLL_CONNECT |
-+			                    DRM_CONNECTOR_POLL_DISCONNECT;
-+		}
- 	} else
- 		connector->polled = DRM_CONNECTOR_POLL_HPD;
-+
- 	connector->display_info.subpixel_order = subpixel_order;
- 	drm_connector_register(connector);
- }
-diff --git a/drivers/gpu/drm/rockchip/rockchip_drm_vop.c b/drivers/gpu/drm/rockchip/rockchip_drm_vop.c
-index 1c4d5b5..b167323 100644
---- a/drivers/gpu/drm/rockchip/rockchip_drm_vop.c
-+++ b/drivers/gpu/drm/rockchip/rockchip_drm_vop.c
-@@ -1048,6 +1048,17 @@ static void vop_crtc_destroy(struct drm_crtc *crtc)
- 	drm_crtc_cleanup(crtc);
- }
- 
-+static void vop_crtc_reset(struct drm_crtc *crtc)
-+{
-+	if (crtc->state)
-+		__drm_atomic_helper_crtc_destroy_state(crtc->state);
-+	kfree(crtc->state);
-+
-+	crtc->state = kzalloc(sizeof(struct rockchip_crtc_state), GFP_KERNEL);
-+	if (crtc->state)
-+		crtc->state->crtc = crtc;
-+}
-+
- static struct drm_crtc_state *vop_crtc_duplicate_state(struct drm_crtc *crtc)
- {
- 	struct rockchip_crtc_state *rockchip_state;
-@@ -1073,7 +1084,7 @@ static const struct drm_crtc_funcs vop_crtc_funcs = {
- 	.set_config = drm_atomic_helper_set_config,
- 	.page_flip = drm_atomic_helper_page_flip,
- 	.destroy = vop_crtc_destroy,
--	.reset = drm_atomic_helper_crtc_reset,
-+	.reset = vop_crtc_reset,
- 	.atomic_duplicate_state = vop_crtc_duplicate_state,
- 	.atomic_destroy_state = vop_crtc_destroy_state,
- };
-diff --git a/drivers/hid/uhid.c b/drivers/hid/uhid.c
-index 16b6f11..99ec3ff 100644
---- a/drivers/hid/uhid.c
-+++ b/drivers/hid/uhid.c
-@@ -51,10 +51,26 @@ struct uhid_device {
- 	u32 report_id;
- 	u32 report_type;
- 	struct uhid_event report_buf;
-+	struct work_struct worker;
- };
- 
- static struct miscdevice uhid_misc;
- 
-+static void uhid_device_add_worker(struct work_struct *work)
-+{
-+	struct uhid_device *uhid = container_of(work, struct uhid_device, worker);
-+	int ret;
-+
-+	ret = hid_add_device(uhid->hid);
-+	if (ret) {
-+		hid_err(uhid->hid, "Cannot register HID device: error %d\n", ret);
-+
-+		hid_destroy_device(uhid->hid);
-+		uhid->hid = NULL;
-+		uhid->running = false;
-+	}
-+}
-+
- static void uhid_queue(struct uhid_device *uhid, struct uhid_event *ev)
- {
- 	__u8 newhead;
-@@ -498,18 +514,14 @@ static int uhid_dev_create2(struct uhid_device *uhid,
- 	uhid->hid = hid;
- 	uhid->running = true;
- 
--	ret = hid_add_device(hid);
--	if (ret) {
--		hid_err(hid, "Cannot register HID device\n");
--		goto err_hid;
--	}
-+	/* Adding of a HID device is done through a worker, to allow HID drivers
-+	 * which use feature requests during .probe to work, without they would
-+	 * be blocked on devlock, which is held by uhid_char_write.
-+	 */
-+	schedule_work(&uhid->worker);
- 
- 	return 0;
- 
--err_hid:
--	hid_destroy_device(hid);
--	uhid->hid = NULL;
--	uhid->running = false;
- err_free:
- 	kfree(uhid->rd_data);
- 	uhid->rd_data = NULL;
-@@ -550,6 +562,8 @@ static int uhid_dev_destroy(struct uhid_device *uhid)
- 	uhid->running = false;
- 	wake_up_interruptible(&uhid->report_wait);
- 
-+	cancel_work_sync(&uhid->worker);
-+
- 	hid_destroy_device(uhid->hid);
- 	kfree(uhid->rd_data);
- 
-@@ -612,6 +626,7 @@ static int uhid_char_open(struct inode *inode, struct file *file)
- 	init_waitqueue_head(&uhid->waitq);
- 	init_waitqueue_head(&uhid->report_wait);
- 	uhid->running = false;
-+	INIT_WORK(&uhid->worker, uhid_device_add_worker);
- 
- 	file->private_data = uhid;
- 	nonseekable_open(inode, file);
-diff --git a/drivers/hv/vmbus_drv.c b/drivers/hv/vmbus_drv.c
-index 952f20f..e82f7e1 100644
---- a/drivers/hv/vmbus_drv.c
-+++ b/drivers/hv/vmbus_drv.c
-@@ -42,6 +42,7 @@
- #include <linux/screen_info.h>
- #include <linux/kdebug.h>
- #include <linux/efi.h>
-+#include <linux/random.h>
- #include "hyperv_vmbus.h"
- 
- static struct acpi_device  *hv_acpi_dev;
-@@ -806,6 +807,8 @@ static void vmbus_isr(void)
- 		else
- 			tasklet_schedule(hv_context.msg_dpc[cpu]);
- 	}
-+
-+	add_interrupt_randomness(HYPERVISOR_CALLBACK_VECTOR, 0);
- }
- 
- 
-diff --git a/drivers/i2c/busses/i2c-efm32.c b/drivers/i2c/busses/i2c-efm32.c
-index 8eff627..e253598 100644
---- a/drivers/i2c/busses/i2c-efm32.c
-+++ b/drivers/i2c/busses/i2c-efm32.c
-@@ -433,7 +433,7 @@ static int efm32_i2c_probe(struct platform_device *pdev)
- 	ret = request_irq(ddata->irq, efm32_i2c_irq, 0, DRIVER_NAME, ddata);
- 	if (ret < 0) {
- 		dev_err(&pdev->dev, "failed to request irq (%d)\n", ret);
--		return ret;
-+		goto err_disable_clk;
- 	}
- 
- 	ret = i2c_add_adapter(&ddata->adapter);
-diff --git a/drivers/infiniband/core/rw.c b/drivers/infiniband/core/rw.c
-index 1eb9b12..dbfd854 100644
---- a/drivers/infiniband/core/rw.c
-+++ b/drivers/infiniband/core/rw.c
-@@ -58,19 +58,13 @@ static inline bool rdma_rw_io_needs_mr(struct ib_device *dev, u8 port_num,
- 	return false;
- }
- 
--static inline u32 rdma_rw_max_sge(struct ib_device *dev,
--		enum dma_data_direction dir)
--{
--	return dir == DMA_TO_DEVICE ?
--		dev->attrs.max_sge : dev->attrs.max_sge_rd;
--}
--
- static inline u32 rdma_rw_fr_page_list_len(struct ib_device *dev)
- {
- 	/* arbitrary limit to avoid allocating gigantic resources */
- 	return min_t(u32, dev->attrs.max_fast_reg_page_list_len, 256);
- }
- 
-+/* Caller must have zero-initialized *reg. */
- static int rdma_rw_init_one_mr(struct ib_qp *qp, u8 port_num,
- 		struct rdma_rw_reg_ctx *reg, struct scatterlist *sg,
- 		u32 sg_cnt, u32 offset)
-@@ -114,6 +108,7 @@ static int rdma_rw_init_mr_wrs(struct rdma_rw_ctx *ctx, struct ib_qp *qp,
- 		u8 port_num, struct scatterlist *sg, u32 sg_cnt, u32 offset,
- 		u64 remote_addr, u32 rkey, enum dma_data_direction dir)
- {
-+	struct rdma_rw_reg_ctx *prev = NULL;
- 	u32 pages_per_mr = rdma_rw_fr_page_list_len(qp->pd->device);
- 	int i, j, ret = 0, count = 0;
- 
-@@ -125,7 +120,6 @@ static int rdma_rw_init_mr_wrs(struct rdma_rw_ctx *ctx, struct ib_qp *qp,
- 	}
- 
- 	for (i = 0; i < ctx->nr_ops; i++) {
--		struct rdma_rw_reg_ctx *prev = i ? &ctx->reg[i - 1] : NULL;
- 		struct rdma_rw_reg_ctx *reg = &ctx->reg[i];
- 		u32 nents = min(sg_cnt, pages_per_mr);
- 
-@@ -162,9 +156,13 @@ static int rdma_rw_init_mr_wrs(struct rdma_rw_ctx *ctx, struct ib_qp *qp,
- 		sg_cnt -= nents;
- 		for (j = 0; j < nents; j++)
- 			sg = sg_next(sg);
-+		prev = reg;
- 		offset = 0;
- 	}
- 
-+	if (prev)
-+		prev->wr.wr.next = NULL;
-+
- 	ctx->type = RDMA_RW_MR;
- 	return count;
- 
-@@ -181,7 +179,8 @@ static int rdma_rw_init_map_wrs(struct rdma_rw_ctx *ctx, struct ib_qp *qp,
- 		u64 remote_addr, u32 rkey, enum dma_data_direction dir)
- {
- 	struct ib_device *dev = qp->pd->device;
--	u32 max_sge = rdma_rw_max_sge(dev, dir);
-+	u32 max_sge = dir == DMA_TO_DEVICE ? qp->max_write_sge :
-+		      qp->max_read_sge;
- 	struct ib_sge *sge;
- 	u32 total_len = 0, i, j;
- 
-@@ -205,11 +204,10 @@ static int rdma_rw_init_map_wrs(struct rdma_rw_ctx *ctx, struct ib_qp *qp,
- 			rdma_wr->wr.opcode = IB_WR_RDMA_READ;
- 		rdma_wr->remote_addr = remote_addr + total_len;
- 		rdma_wr->rkey = rkey;
-+		rdma_wr->wr.num_sge = nr_sge;
- 		rdma_wr->wr.sg_list = sge;
- 
- 		for (j = 0; j < nr_sge; j++, sg = sg_next(sg)) {
--			rdma_wr->wr.num_sge++;
--
- 			sge->addr = ib_sg_dma_address(dev, sg) + offset;
- 			sge->length = ib_sg_dma_len(dev, sg) - offset;
- 			sge->lkey = qp->pd->local_dma_lkey;
-@@ -220,8 +218,8 @@ static int rdma_rw_init_map_wrs(struct rdma_rw_ctx *ctx, struct ib_qp *qp,
- 			offset = 0;
- 		}
- 
--		if (i + 1 < ctx->nr_ops)
--			rdma_wr->wr.next = &ctx->map.wrs[i + 1].wr;
-+		rdma_wr->wr.next = i + 1 < ctx->nr_ops ?
-+			&ctx->map.wrs[i + 1].wr : NULL;
- 	}
- 
- 	ctx->type = RDMA_RW_MULTI_WR;
-diff --git a/drivers/infiniband/core/verbs.c b/drivers/infiniband/core/verbs.c
-index 6298f54..e39a0b5 100644
---- a/drivers/infiniband/core/verbs.c
-+++ b/drivers/infiniband/core/verbs.c
-@@ -814,6 +814,15 @@ struct ib_qp *ib_create_qp(struct ib_pd *pd,
- 		}
- 	}
- 
-+	/*
-+	 * Note: all hw drivers guarantee that max_send_sge is lower than
-+	 * the device RDMA WRITE SGE limit but not all hw drivers ensure that
-+	 * max_send_sge <= max_sge_rd.
-+	 */
-+	qp->max_write_sge = qp_init_attr->cap.max_send_sge;
-+	qp->max_read_sge = min_t(u32, qp_init_attr->cap.max_send_sge,
-+				 device->attrs.max_sge_rd);
-+
- 	return qp;
- }
- EXPORT_SYMBOL(ib_create_qp);
-diff --git a/drivers/infiniband/hw/mlx5/gsi.c b/drivers/infiniband/hw/mlx5/gsi.c
-index 53e03c8..79e6309 100644
---- a/drivers/infiniband/hw/mlx5/gsi.c
-+++ b/drivers/infiniband/hw/mlx5/gsi.c
-@@ -69,15 +69,6 @@ static bool mlx5_ib_deth_sqpn_cap(struct mlx5_ib_dev *dev)
- 	return MLX5_CAP_GEN(dev->mdev, set_deth_sqpn);
- }
- 
--static u32 next_outstanding(struct mlx5_ib_gsi_qp *gsi, u32 index)
--{
--	return ++index % gsi->cap.max_send_wr;
--}
--
--#define for_each_outstanding_wr(gsi, index) \
--	for (index = gsi->outstanding_ci; index != gsi->outstanding_pi; \
--	     index = next_outstanding(gsi, index))
--
- /* Call with gsi->lock locked */
- static void generate_completions(struct mlx5_ib_gsi_qp *gsi)
- {
-@@ -85,8 +76,9 @@ static void generate_completions(struct mlx5_ib_gsi_qp *gsi)
- 	struct mlx5_ib_gsi_wr *wr;
- 	u32 index;
- 
--	for_each_outstanding_wr(gsi, index) {
--		wr = &gsi->outstanding_wrs[index];
-+	for (index = gsi->outstanding_ci; index != gsi->outstanding_pi;
-+	     index++) {
-+		wr = &gsi->outstanding_wrs[index % gsi->cap.max_send_wr];
- 
- 		if (!wr->completed)
- 			break;
-@@ -430,8 +422,9 @@ static int mlx5_ib_add_outstanding_wr(struct mlx5_ib_gsi_qp *gsi,
- 		return -ENOMEM;
- 	}
- 
--	gsi_wr = &gsi->outstanding_wrs[gsi->outstanding_pi];
--	gsi->outstanding_pi = next_outstanding(gsi, gsi->outstanding_pi);
-+	gsi_wr = &gsi->outstanding_wrs[gsi->outstanding_pi %
-+				       gsi->cap.max_send_wr];
-+	gsi->outstanding_pi++;
- 
- 	if (!wc) {
- 		memset(&gsi_wr->wc, 0, sizeof(gsi_wr->wc));
-diff --git a/drivers/infiniband/sw/rdmavt/Kconfig b/drivers/infiniband/sw/rdmavt/Kconfig
-index 11aa6a3..1da8d01 100644
---- a/drivers/infiniband/sw/rdmavt/Kconfig
-+++ b/drivers/infiniband/sw/rdmavt/Kconfig
-@@ -1,6 +1,5 @@
- config INFINIBAND_RDMAVT
- 	tristate "RDMA verbs transport library"
- 	depends on 64BIT
--	default m
- 	---help---
- 	This is a common software verbs provider for RDMA networks.
-diff --git a/drivers/infiniband/sw/rdmavt/cq.c b/drivers/infiniband/sw/rdmavt/cq.c
-index 6ca6fa8..f2f229e 100644
---- a/drivers/infiniband/sw/rdmavt/cq.c
-+++ b/drivers/infiniband/sw/rdmavt/cq.c
-@@ -510,6 +510,7 @@ int rvt_driver_cq_init(struct rvt_dev_info *rdi)
- 
- 	if (rdi->worker)
- 		return 0;
-+	spin_lock_init(&rdi->n_cqs_lock);
- 	rdi->worker = kzalloc(sizeof(*rdi->worker), GFP_KERNEL);
- 	if (!rdi->worker)
- 		return -ENOMEM;
-diff --git a/drivers/infiniband/ulp/srpt/ib_srpt.c b/drivers/infiniband/ulp/srpt/ib_srpt.c
-index 4a41556..9a3b954 100644
---- a/drivers/infiniband/ulp/srpt/ib_srpt.c
-+++ b/drivers/infiniband/ulp/srpt/ib_srpt.c
-@@ -1601,6 +1601,7 @@ static int srpt_create_ch_ib(struct srpt_rdma_ch *ch)
- 	struct ib_qp_init_attr *qp_init;
- 	struct srpt_port *sport = ch->sport;
- 	struct srpt_device *sdev = sport->sdev;
-+	const struct ib_device_attr *attrs = &sdev->device->attrs;
- 	u32 srp_sq_size = sport->port_attrib.srp_sq_size;
- 	int ret;
- 
-@@ -1638,7 +1639,7 @@ retry:
- 	 */
- 	qp_init->cap.max_send_wr = srp_sq_size / 2;
- 	qp_init->cap.max_rdma_ctxs = srp_sq_size / 2;
--	qp_init->cap.max_send_sge = SRPT_DEF_SG_PER_WQE;
-+	qp_init->cap.max_send_sge = min(attrs->max_sge, SRPT_MAX_SG_PER_WQE);
- 	qp_init->port_num = ch->sport->port;
- 
- 	ch->qp = ib_create_qp(sdev->pd, qp_init);
-diff --git a/drivers/infiniband/ulp/srpt/ib_srpt.h b/drivers/infiniband/ulp/srpt/ib_srpt.h
-index 3890304..5818787 100644
---- a/drivers/infiniband/ulp/srpt/ib_srpt.h
-+++ b/drivers/infiniband/ulp/srpt/ib_srpt.h
-@@ -106,7 +106,11 @@ enum {
- 	SRP_LOGIN_RSP_MULTICHAN_MAINTAINED = 0x2,
- 
- 	SRPT_DEF_SG_TABLESIZE = 128,
--	SRPT_DEF_SG_PER_WQE = 16,
-+	/*
-+	 * An experimentally determined value that avoids that QP creation
-+	 * fails due to "swiotlb buffer is full" on systems using the swiotlb.
-+	 */
-+	SRPT_MAX_SG_PER_WQE = 16,
- 
- 	MIN_SRPT_SQ_SIZE = 16,
- 	DEF_SRPT_SQ_SIZE = 4096,
-diff --git a/drivers/input/mouse/elan_i2c_core.c b/drivers/input/mouse/elan_i2c_core.c
-index 2f58985..d15b338 100644
---- a/drivers/input/mouse/elan_i2c_core.c
-+++ b/drivers/input/mouse/elan_i2c_core.c
-@@ -4,7 +4,8 @@
-  * Copyright (c) 2013 ELAN Microelectronics Corp.
-  *
-  * Author: 林政維 (Duson Lin) <dusonlin@×××××××.tw>
-- * Version: 1.6.0
-+ * Author: KT Liao <kt.liao@×××××××.tw>
-+ * Version: 1.6.2
-  *
-  * Based on cyapa driver:
-  * copyright (c) 2011-2012 Cypress Semiconductor, Inc.
-@@ -40,7 +41,7 @@
- #include "elan_i2c.h"
- 
- #define DRIVER_NAME		"elan_i2c"
--#define ELAN_DRIVER_VERSION	"1.6.1"
-+#define ELAN_DRIVER_VERSION	"1.6.2"
- #define ELAN_VENDOR_ID		0x04f3
- #define ETP_MAX_PRESSURE	255
- #define ETP_FWIDTH_REDUCE	90
-@@ -199,9 +200,41 @@ static int elan_sleep(struct elan_tp_data *data)
- 	return error;
- }
- 
-+static int elan_query_product(struct elan_tp_data *data)
-+{
-+	int error;
-+
-+	error = data->ops->get_product_id(data->client, &data->product_id);
-+	if (error)
-+		return error;
-+
-+	error = data->ops->get_sm_version(data->client, &data->ic_type,
-+					  &data->sm_version);
-+	if (error)
-+		return error;
-+
-+	return 0;
-+}
-+
-+static int elan_check_ASUS_special_fw(struct elan_tp_data *data)
-+{
-+	if (data->ic_type != 0x0E)
-+		return false;
-+
-+	switch (data->product_id) {
-+	case 0x05 ... 0x07:
-+	case 0x09:
-+	case 0x13:
-+		return true;
-+	default:
-+		return false;
-+	}
-+}
-+
- static int __elan_initialize(struct elan_tp_data *data)
- {
- 	struct i2c_client *client = data->client;
-+	bool woken_up = false;
- 	int error;
- 
- 	error = data->ops->initialize(client);
-@@ -210,6 +243,27 @@ static int __elan_initialize(struct elan_tp_data *data)
- 		return error;
- 	}
- 
-+	error = elan_query_product(data);
-+	if (error)
-+		return error;
-+
-+	/*
-+	 * Some ASUS devices were shipped with firmware that requires
-+	 * touchpads to be woken up first, before attempting to switch
-+	 * them into absolute reporting mode.
-+	 */
-+	if (elan_check_ASUS_special_fw(data)) {
-+		error = data->ops->sleep_control(client, false);
-+		if (error) {
-+			dev_err(&client->dev,
-+				"failed to wake device up: %d\n", error);
-+			return error;
-+		}
-+
-+		msleep(200);
-+		woken_up = true;
-+	}
-+
- 	data->mode |= ETP_ENABLE_ABS;
- 	error = data->ops->set_mode(client, data->mode);
- 	if (error) {
-@@ -218,11 +272,13 @@ static int __elan_initialize(struct elan_tp_data *data)
- 		return error;
- 	}
- 
--	error = data->ops->sleep_control(client, false);
--	if (error) {
--		dev_err(&client->dev,
--			"failed to wake device up: %d\n", error);
--		return error;
-+	if (!woken_up) {
-+		error = data->ops->sleep_control(client, false);
-+		if (error) {
-+			dev_err(&client->dev,
-+				"failed to wake device up: %d\n", error);
-+			return error;
-+		}
- 	}
- 
- 	return 0;
-@@ -248,10 +304,6 @@ static int elan_query_device_info(struct elan_tp_data *data)
- {
- 	int error;
- 
--	error = data->ops->get_product_id(data->client, &data->product_id);
--	if (error)
--		return error;
--
- 	error = data->ops->get_version(data->client, false, &data->fw_version);
- 	if (error)
- 		return error;
-@@ -261,11 +313,6 @@ static int elan_query_device_info(struct elan_tp_data *data)
- 	if (error)
- 		return error;
- 
--	error = data->ops->get_sm_version(data->client, &data->ic_type,
--					  &data->sm_version);
--	if (error)
--		return error;
--
- 	error = data->ops->get_version(data->client, true, &data->iap_version);
- 	if (error)
- 		return error;
-diff --git a/drivers/input/touchscreen/sur40.c b/drivers/input/touchscreen/sur40.c
-index 880c40b..b7e8c11 100644
---- a/drivers/input/touchscreen/sur40.c
-+++ b/drivers/input/touchscreen/sur40.c
-@@ -126,7 +126,7 @@ struct sur40_image_header {
- #define VIDEO_PACKET_SIZE  16384
- 
- /* polling interval (ms) */
--#define POLL_INTERVAL 4
-+#define POLL_INTERVAL 1
- 
- /* maximum number of contacts FIXME: this is a guess? */
- #define MAX_CONTACTS 64
-@@ -448,7 +448,7 @@ static void sur40_process_video(struct sur40_state *sur40)
- 
- 	/* return error if streaming was stopped in the meantime */
- 	if (sur40->sequence == -1)
--		goto err_poll;
-+		return;
- 
- 	/* mark as finished */
- 	new_buf->vb.vb2_buf.timestamp = ktime_get_ns();
-@@ -736,6 +736,7 @@ static int sur40_start_streaming(struct vb2_queue *vq, unsigned int count)
- static void sur40_stop_streaming(struct vb2_queue *vq)
- {
- 	struct sur40_state *sur40 = vb2_get_drv_priv(vq);
-+	vb2_wait_for_all_buffers(vq);
- 	sur40->sequence = -1;
- 
- 	/* Release all active buffers */
-diff --git a/drivers/iommu/amd_iommu.c b/drivers/iommu/amd_iommu.c
-index 634f636..2511c8b 100644
---- a/drivers/iommu/amd_iommu.c
-+++ b/drivers/iommu/amd_iommu.c
-@@ -466,9 +466,11 @@ static void init_iommu_group(struct device *dev)
- 	if (!domain)
- 		goto out;
- 
--	dma_domain = to_pdomain(domain)->priv;
-+	if (to_pdomain(domain)->flags == PD_DMA_OPS_MASK) {
-+		dma_domain = to_pdomain(domain)->priv;
-+		init_unity_mappings_for_device(dev, dma_domain);
-+	}
- 
--	init_unity_mappings_for_device(dev, dma_domain);
- out:
- 	iommu_group_put(group);
- }
-@@ -2512,8 +2514,15 @@ static void update_device_table(struct protection_domain *domain)
- {
- 	struct iommu_dev_data *dev_data;
- 
--	list_for_each_entry(dev_data, &domain->dev_list, list)
-+	list_for_each_entry(dev_data, &domain->dev_list, list) {
- 		set_dte_entry(dev_data->devid, domain, dev_data->ats.enabled);
-+
-+		if (dev_data->devid == dev_data->alias)
-+			continue;
-+
-+		/* There is an alias, update device table entry for it */
-+		set_dte_entry(dev_data->alias, domain, dev_data->ats.enabled);
-+	}
- }
- 
- static void update_domain(struct protection_domain *domain)
-@@ -3103,9 +3112,7 @@ static struct iommu_domain *amd_iommu_domain_alloc(unsigned type)
- static void amd_iommu_domain_free(struct iommu_domain *dom)
- {
- 	struct protection_domain *domain;
--
--	if (!dom)
--		return;
-+	struct dma_ops_domain *dma_dom;
- 
- 	domain = to_pdomain(dom);
- 
-@@ -3114,13 +3121,24 @@ static void amd_iommu_domain_free(struct iommu_domain *dom)
- 
- 	BUG_ON(domain->dev_cnt != 0);
- 
--	if (domain->mode != PAGE_MODE_NONE)
--		free_pagetable(domain);
-+	if (!dom)
-+		return;
-+
-+	switch (dom->type) {
-+	case IOMMU_DOMAIN_DMA:
-+		dma_dom = domain->priv;
-+		dma_ops_domain_free(dma_dom);
-+		break;
-+	default:
-+		if (domain->mode != PAGE_MODE_NONE)
-+			free_pagetable(domain);
- 
--	if (domain->flags & PD_IOMMUV2_MASK)
--		free_gcr3_table(domain);
-+		if (domain->flags & PD_IOMMUV2_MASK)
-+			free_gcr3_table(domain);
- 
--	protection_domain_free(domain);
-+		protection_domain_free(domain);
-+		break;
-+	}
- }
- 
- static void amd_iommu_detach_device(struct iommu_domain *dom,
-diff --git a/drivers/iommu/exynos-iommu.c b/drivers/iommu/exynos-iommu.c
-index 5ecc86c..e27e3b7df 100644
---- a/drivers/iommu/exynos-iommu.c
-+++ b/drivers/iommu/exynos-iommu.c
-@@ -709,6 +709,7 @@ static struct platform_driver exynos_sysmmu_driver __refdata = {
- 		.name		= "exynos-sysmmu",
- 		.of_match_table	= sysmmu_of_match,
- 		.pm		= &sysmmu_pm_ops,
-+		.suppress_bind_attrs = true,
- 	}
- };
- 
-diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c
-index 323dac9..d416242 100644
---- a/drivers/iommu/intel-iommu.c
-+++ b/drivers/iommu/intel-iommu.c
-@@ -2076,7 +2076,7 @@ out_unlock:
- 	spin_unlock(&iommu->lock);
- 	spin_unlock_irqrestore(&device_domain_lock, flags);
- 
--	return 0;
-+	return ret;
- }
- 
- struct domain_context_mapping_data {
-diff --git a/drivers/iommu/io-pgtable-arm.c b/drivers/iommu/io-pgtable-arm.c
-index a1ed1b7..f5c90e1 100644
---- a/drivers/iommu/io-pgtable-arm.c
-+++ b/drivers/iommu/io-pgtable-arm.c
-@@ -576,7 +576,7 @@ static phys_addr_t arm_lpae_iova_to_phys(struct io_pgtable_ops *ops,
- 	return 0;
- 
- found_translation:
--	iova &= (ARM_LPAE_GRANULE(data) - 1);
-+	iova &= (ARM_LPAE_BLOCK_SIZE(lvl, data) - 1);
- 	return ((phys_addr_t)iopte_to_pfn(pte,data) << data->pg_shift) | iova;
- }
- 
-diff --git a/drivers/md/dm-flakey.c b/drivers/md/dm-flakey.c
-index b7341de..4bb49cd 100644
---- a/drivers/md/dm-flakey.c
-+++ b/drivers/md/dm-flakey.c
-@@ -289,10 +289,16 @@ static int flakey_map(struct dm_target *ti, struct bio *bio)
- 		pb->bio_submitted = true;
- 
- 		/*
--		 * Map reads as normal.
-+		 * Map reads as normal only if corrupt_bio_byte set.
- 		 */
--		if (bio_data_dir(bio) == READ)
--			goto map_bio;
-+		if (bio_data_dir(bio) == READ) {
-+			/* If flags were specified, only corrupt those that match. */
-+			if (fc->corrupt_bio_byte && (fc->corrupt_bio_rw == READ) &&
-+			    all_corrupt_bio_flags_match(bio, fc))
-+				goto map_bio;
-+			else
-+				return -EIO;
-+		}
- 
- 		/*
- 		 * Drop writes?
-@@ -330,12 +336,13 @@ static int flakey_end_io(struct dm_target *ti, struct bio *bio, int error)
- 
- 	/*
- 	 * Corrupt successful READs while in down state.
--	 * If flags were specified, only corrupt those that match.
- 	 */
--	if (fc->corrupt_bio_byte && !error && pb->bio_submitted &&
--	    (bio_data_dir(bio) == READ) && (fc->corrupt_bio_rw == READ) &&
--	    all_corrupt_bio_flags_match(bio, fc))
--		corrupt_bio_data(bio, fc);
-+	if (!error && pb->bio_submitted && (bio_data_dir(bio) == READ)) {
-+		if (fc->corrupt_bio_byte)
-+			corrupt_bio_data(bio, fc);
-+		else
-+			return -EIO;
-+	}
- 
- 	return error;
- }
-diff --git a/drivers/md/dm-verity-fec.c b/drivers/md/dm-verity-fec.c
-index 459a9f8..0f0eb8a 100644
---- a/drivers/md/dm-verity-fec.c
-+++ b/drivers/md/dm-verity-fec.c
-@@ -453,9 +453,7 @@ int verity_fec_decode(struct dm_verity *v, struct dm_verity_io *io,
- 	 */
- 
- 	offset = block << v->data_dev_block_bits;
--
--	res = offset;
--	div64_u64(res, v->fec->rounds << v->data_dev_block_bits);
-+	res = div64_u64(offset, v->fec->rounds << v->data_dev_block_bits);
- 
- 	/*
- 	 * The base RS block we can feed to the interleaver to find out all
-diff --git a/drivers/md/dm.c b/drivers/md/dm.c
-index 1b2f962..fd40bcb 100644
---- a/drivers/md/dm.c
-+++ b/drivers/md/dm.c
-@@ -2175,7 +2175,7 @@ static void dm_request_fn(struct request_queue *q)
- 		     md_in_flight(md) && rq->bio && rq->bio->bi_vcnt == 1 &&
- 		     md->last_rq_pos == pos && md->last_rq_rw == rq_data_dir(rq)) ||
- 		    (ti->type->busy && ti->type->busy(ti))) {
--			blk_delay_queue(q, HZ / 100);
-+			blk_delay_queue(q, 10);
- 			return;
- 		}
- 
-@@ -3128,7 +3128,8 @@ static void unlock_fs(struct mapped_device *md)
-  * Caller must hold md->suspend_lock
-  */
- static int __dm_suspend(struct mapped_device *md, struct dm_table *map,
--			unsigned suspend_flags, int interruptible)
-+			unsigned suspend_flags, int interruptible,
-+			int dmf_suspended_flag)
- {
- 	bool do_lockfs = suspend_flags & DM_SUSPEND_LOCKFS_FLAG;
- 	bool noflush = suspend_flags & DM_SUSPEND_NOFLUSH_FLAG;
-@@ -3195,6 +3196,8 @@ static int __dm_suspend(struct mapped_device *md, struct dm_table *map,
- 	 * to finish.
- 	 */
- 	r = dm_wait_for_completion(md, interruptible);
-+	if (!r)
-+		set_bit(dmf_suspended_flag, &md->flags);
- 
- 	if (noflush)
- 		clear_bit(DMF_NOFLUSH_SUSPENDING, &md->flags);
-@@ -3256,12 +3259,10 @@ retry:
- 
- 	map = rcu_dereference_protected(md->map, lockdep_is_held(&md->suspend_lock));
- 
--	r = __dm_suspend(md, map, suspend_flags, TASK_INTERRUPTIBLE);
-+	r = __dm_suspend(md, map, suspend_flags, TASK_INTERRUPTIBLE, DMF_SUSPENDED);
- 	if (r)
- 		goto out_unlock;
- 
--	set_bit(DMF_SUSPENDED, &md->flags);
--
- 	dm_table_postsuspend_targets(map);
- 
- out_unlock:
-@@ -3355,9 +3356,8 @@ static void __dm_internal_suspend(struct mapped_device *md, unsigned suspend_fla
- 	 * would require changing .presuspend to return an error -- avoid this
- 	 * until there is a need for more elaborate variants of internal suspend.
- 	 */
--	(void) __dm_suspend(md, map, suspend_flags, TASK_UNINTERRUPTIBLE);
--
--	set_bit(DMF_SUSPENDED_INTERNALLY, &md->flags);
-+	(void) __dm_suspend(md, map, suspend_flags, TASK_UNINTERRUPTIBLE,
-+			    DMF_SUSPENDED_INTERNALLY);
- 
- 	dm_table_postsuspend_targets(map);
- }
-diff --git a/drivers/media/dvb-core/dvb_ringbuffer.c b/drivers/media/dvb-core/dvb_ringbuffer.c
-index 1100e98..7df7fb3 100644
---- a/drivers/media/dvb-core/dvb_ringbuffer.c
-+++ b/drivers/media/dvb-core/dvb_ringbuffer.c
-@@ -55,7 +55,13 @@ void dvb_ringbuffer_init(struct dvb_ringbuffer *rbuf, void *data, size_t len)
- 
- int dvb_ringbuffer_empty(struct dvb_ringbuffer *rbuf)
- {
--	return (rbuf->pread==rbuf->pwrite);
-+	/* smp_load_acquire() to load write pointer on reader side
-+	 * this pairs with smp_store_release() in dvb_ringbuffer_write(),
-+	 * dvb_ringbuffer_write_user(), or dvb_ringbuffer_reset()
-+	 *
-+	 * for memory barriers also see Documentation/circular-buffers.txt
-+	 */
-+	return (rbuf->pread == smp_load_acquire(&rbuf->pwrite));
- }
- 
- 
-@@ -64,7 +70,12 @@ ssize_t dvb_ringbuffer_free(struct dvb_ringbuffer *rbuf)
- {
- 	ssize_t free;
- 
--	free = rbuf->pread - rbuf->pwrite;
-+	/* ACCESS_ONCE() to load read pointer on writer side
-+	 * this pairs with smp_store_release() in dvb_ringbuffer_read(),
-+	 * dvb_ringbuffer_read_user(), dvb_ringbuffer_flush(),
-+	 * or dvb_ringbuffer_reset()
-+	 */
-+	free = ACCESS_ONCE(rbuf->pread) - rbuf->pwrite;
- 	if (free <= 0)
- 		free += rbuf->size;
- 	return free-1;
-@@ -76,7 +87,11 @@ ssize_t dvb_ringbuffer_avail(struct dvb_ringbuffer *rbuf)
- {
- 	ssize_t avail;
- 
--	avail = rbuf->pwrite - rbuf->pread;
-+	/* smp_load_acquire() to load write pointer on reader side
-+	 * this pairs with smp_store_release() in dvb_ringbuffer_write(),
-+	 * dvb_ringbuffer_write_user(), or dvb_ringbuffer_reset()
-+	 */
-+	avail = smp_load_acquire(&rbuf->pwrite) - rbuf->pread;
- 	if (avail < 0)
- 		avail += rbuf->size;
- 	return avail;
-@@ -86,14 +101,25 @@ ssize_t dvb_ringbuffer_avail(struct dvb_ringbuffer *rbuf)
- 
- void dvb_ringbuffer_flush(struct dvb_ringbuffer *rbuf)
- {
--	rbuf->pread = rbuf->pwrite;
-+	/* dvb_ringbuffer_flush() counts as read operation
-+	 * smp_load_acquire() to load write pointer
-+	 * smp_store_release() to update read pointer, this ensures that the
-+	 * correct pointer is visible for subsequent dvb_ringbuffer_free()
-+	 * calls on other cpu cores
-+	 */
-+	smp_store_release(&rbuf->pread, smp_load_acquire(&rbuf->pwrite));
- 	rbuf->error = 0;
- }
- EXPORT_SYMBOL(dvb_ringbuffer_flush);
- 
- void dvb_ringbuffer_reset(struct dvb_ringbuffer *rbuf)
- {
--	rbuf->pread = rbuf->pwrite = 0;
-+	/* dvb_ringbuffer_reset() counts as read and write operation
-+	 * smp_store_release() to update read pointer
-+	 */
-+	smp_store_release(&rbuf->pread, 0);
-+	/* smp_store_release() to update write pointer */
-+	smp_store_release(&rbuf->pwrite, 0);
- 	rbuf->error = 0;
- }
- 
-@@ -119,12 +145,17 @@ ssize_t dvb_ringbuffer_read_user(struct dvb_ringbuffer *rbuf, u8 __user *buf, si
- 			return -EFAULT;
- 		buf += split;
- 		todo -= split;
--		rbuf->pread = 0;
-+		/* smp_store_release() for read pointer update to ensure
-+		 * that buf is not overwritten until read is complete,
-+		 * this pairs with ACCESS_ONCE() in dvb_ringbuffer_free()
-+		 */
-+		smp_store_release(&rbuf->pread, 0);
- 	}
- 	if (copy_to_user(buf, rbuf->data+rbuf->pread, todo))
- 		return -EFAULT;
- 
--	rbuf->pread = (rbuf->pread + todo) % rbuf->size;
-+	/* smp_store_release() to update read pointer, see above */
-+	smp_store_release(&rbuf->pread, (rbuf->pread + todo) % rbuf->size);
- 
- 	return len;
- }
-@@ -139,11 +170,16 @@ void dvb_ringbuffer_read(struct dvb_ringbuffer *rbuf, u8 *buf, size_t len)
- 		memcpy(buf, rbuf->data+rbuf->pread, split);
- 		buf += split;
- 		todo -= split;
--		rbuf->pread = 0;
-+		/* smp_store_release() for read pointer update to ensure
-+		 * that buf is not overwritten until read is complete,
-+		 * this pairs with ACCESS_ONCE() in dvb_ringbuffer_free()
-+		 */
-+		smp_store_release(&rbuf->pread, 0);
- 	}
- 	memcpy(buf, rbuf->data+rbuf->pread, todo);
- 
--	rbuf->pread = (rbuf->pread + todo) % rbuf->size;
-+	/* smp_store_release() to update read pointer, see above */
-+	smp_store_release(&rbuf->pread, (rbuf->pread + todo) % rbuf->size);
- }
- 
- 
-@@ -158,10 +194,16 @@ ssize_t dvb_ringbuffer_write(struct dvb_ringbuffer *rbuf, const u8 *buf, size_t
- 		memcpy(rbuf->data+rbuf->pwrite, buf, split);
- 		buf += split;
- 		todo -= split;
--		rbuf->pwrite = 0;
-+		/* smp_store_release() for write pointer update to ensure that
-+		 * written data is visible on other cpu cores before the pointer
-+		 * update, this pairs with smp_load_acquire() in
-+		 * dvb_ringbuffer_empty() or dvb_ringbuffer_avail()
-+		 */
-+		smp_store_release(&rbuf->pwrite, 0);
- 	}
- 	memcpy(rbuf->data+rbuf->pwrite, buf, todo);
--	rbuf->pwrite = (rbuf->pwrite + todo) % rbuf->size;
-+	/* smp_store_release() for write pointer update, see above */
-+	smp_store_release(&rbuf->pwrite, (rbuf->pwrite + todo) % rbuf->size);
- 
- 	return len;
- }
-@@ -181,12 +223,18 @@ ssize_t dvb_ringbuffer_write_user(struct dvb_ringbuffer *rbuf,
- 			return len - todo;
- 		buf += split;
- 		todo -= split;
--		rbuf->pwrite = 0;
-+		/* smp_store_release() for write pointer update to ensure that
-+		 * written data is visible on other cpu cores before the pointer
-+		 * update, this pairs with smp_load_acquire() in
-+		 * dvb_ringbuffer_empty() or dvb_ringbuffer_avail()
-+		 */
-+		smp_store_release(&rbuf->pwrite, 0);
- 	}
- 	status = copy_from_user(rbuf->data+rbuf->pwrite, buf, todo);
- 	if (status)
- 		return len - todo;
--	rbuf->pwrite = (rbuf->pwrite + todo) % rbuf->size;
-+	/* smp_store_release() for write pointer update, see above */
-+	smp_store_release(&rbuf->pwrite, (rbuf->pwrite + todo) % rbuf->size);
- 
- 	return len;
- }
-diff --git a/drivers/media/platform/s5p-mfc/s5p_mfc.c b/drivers/media/platform/s5p-mfc/s5p_mfc.c
-index b16466f..beb4fd5 100644
---- a/drivers/media/platform/s5p-mfc/s5p_mfc.c
-+++ b/drivers/media/platform/s5p-mfc/s5p_mfc.c
-@@ -1050,6 +1050,11 @@ static int match_child(struct device *dev, void *data)
- 	return !strcmp(dev_name(dev), (char *)data);
- }
- 
-+static void s5p_mfc_memdev_release(struct device *dev)
-+{
-+	dma_release_declared_memory(dev);
-+}
-+
- static void *mfc_get_drv_data(struct platform_device *pdev);
- 
- static int s5p_mfc_alloc_memdevs(struct s5p_mfc_dev *dev)
-@@ -1062,6 +1067,9 @@ static int s5p_mfc_alloc_memdevs(struct s5p_mfc_dev *dev)
- 		mfc_err("Not enough memory\n");
- 		return -ENOMEM;
- 	}
-+
-+	dev_set_name(dev->mem_dev_l, "%s", "s5p-mfc-l");
-+	dev->mem_dev_l->release = s5p_mfc_memdev_release;
- 	device_initialize(dev->mem_dev_l);
- 	of_property_read_u32_array(dev->plat_dev->dev.of_node,
- 			"samsung,mfc-l", mem_info, 2);
-@@ -1079,6 +1087,9 @@ static int s5p_mfc_alloc_memdevs(struct s5p_mfc_dev *dev)
- 		mfc_err("Not enough memory\n");
- 		return -ENOMEM;
- 	}
-+
-+	dev_set_name(dev->mem_dev_r, "%s", "s5p-mfc-r");
-+	dev->mem_dev_r->release = s5p_mfc_memdev_release;
- 	device_initialize(dev->mem_dev_r);
- 	of_property_read_u32_array(dev->plat_dev->dev.of_node,
- 			"samsung,mfc-r", mem_info, 2);
-diff --git a/drivers/media/rc/ir-rc5-decoder.c b/drivers/media/rc/ir-rc5-decoder.c
-index 6ffe776..a0fd4e6 100644
---- a/drivers/media/rc/ir-rc5-decoder.c
-+++ b/drivers/media/rc/ir-rc5-decoder.c
-@@ -29,7 +29,7 @@
- #define RC5_BIT_START		(1 * RC5_UNIT)
- #define RC5_BIT_END		(1 * RC5_UNIT)
- #define RC5X_SPACE		(4 * RC5_UNIT)
--#define RC5_TRAILER		(10 * RC5_UNIT) /* In reality, approx 100 */
-+#define RC5_TRAILER		(6 * RC5_UNIT) /* In reality, approx 100 */
- 
- enum rc5_state {
- 	STATE_INACTIVE,
-diff --git a/drivers/media/rc/nuvoton-cir.c b/drivers/media/rc/nuvoton-cir.c
-index 99b303b..e8ceb0e 100644
---- a/drivers/media/rc/nuvoton-cir.c
-+++ b/drivers/media/rc/nuvoton-cir.c
-@@ -401,6 +401,7 @@ static int nvt_hw_detect(struct nvt_dev *nvt)
- 	/* Check if we're wired for the alternate EFER setup */
- 	nvt->chip_major = nvt_cr_read(nvt, CR_CHIP_ID_HI);
- 	if (nvt->chip_major == 0xff) {
-+		nvt_efm_disable(nvt);
- 		nvt->cr_efir = CR_EFIR2;
- 		nvt->cr_efdr = CR_EFDR2;
- 		nvt_efm_enable(nvt);
-diff --git a/drivers/media/usb/usbtv/usbtv-audio.c b/drivers/media/usb/usbtv/usbtv-audio.c
-index 78c12d2..5dab024 100644
---- a/drivers/media/usb/usbtv/usbtv-audio.c
-+++ b/drivers/media/usb/usbtv/usbtv-audio.c
-@@ -278,6 +278,9 @@ static void snd_usbtv_trigger(struct work_struct *work)
- {
- 	struct usbtv *chip = container_of(work, struct usbtv, snd_trigger);
- 
-+	if (!chip->snd)
-+		return;
-+
- 	if (atomic_read(&chip->snd_stream))
- 		usbtv_audio_start(chip);
- 	else
-@@ -378,6 +381,8 @@ err:
- 
- void usbtv_audio_free(struct usbtv *usbtv)
- {
-+	cancel_work_sync(&usbtv->snd_trigger);
-+
- 	if (usbtv->snd && usbtv->udev) {
- 		snd_card_free(usbtv->snd);
- 		usbtv->snd = NULL;
-diff --git a/drivers/media/v4l2-core/videobuf2-core.c b/drivers/media/v4l2-core/videobuf2-core.c
-index 9fbcb67..633fc1a 100644
---- a/drivers/media/v4l2-core/videobuf2-core.c
-+++ b/drivers/media/v4l2-core/videobuf2-core.c
-@@ -1648,7 +1648,7 @@ static int __vb2_get_done_vb(struct vb2_queue *q, struct vb2_buffer **vb,
- 			     void *pb, int nonblocking)
- {
- 	unsigned long flags;
--	int ret;
-+	int ret = 0;
- 
- 	/*
- 	 * Wait for at least one buffer to become available on the done_list.
-@@ -1664,10 +1664,12 @@ static int __vb2_get_done_vb(struct vb2_queue *q, struct vb2_buffer **vb,
- 	spin_lock_irqsave(&q->done_lock, flags);
- 	*vb = list_first_entry(&q->done_list, struct vb2_buffer, done_entry);
- 	/*
--	 * Only remove the buffer from done_list if v4l2_buffer can handle all
--	 * the planes.
-+	 * Only remove the buffer from done_list if all planes can be
-+	 * handled. Some cases such as V4L2 file I/O and DVB have pb
-+	 * == NULL; skip the check then as there's nothing to verify.
- 	 */
--	ret = call_bufop(q, verify_planes_array, *vb, pb);
-+	if (pb)
-+		ret = call_bufop(q, verify_planes_array, *vb, pb);
- 	if (!ret)
- 		list_del(&(*vb)->done_entry);
- 	spin_unlock_irqrestore(&q->done_lock, flags);
-diff --git a/drivers/media/v4l2-core/videobuf2-v4l2.c b/drivers/media/v4l2-core/videobuf2-v4l2.c
-index 0b1b8c7..7f366f1 100644
---- a/drivers/media/v4l2-core/videobuf2-v4l2.c
-+++ b/drivers/media/v4l2-core/videobuf2-v4l2.c
-@@ -74,6 +74,11 @@ static int __verify_planes_array(struct vb2_buffer *vb, const struct v4l2_buffer
- 	return 0;
- }
- 
-+static int __verify_planes_array_core(struct vb2_buffer *vb, const void *pb)
-+{
-+	return __verify_planes_array(vb, pb);
-+}
-+
- /**
-  * __verify_length() - Verify that the bytesused value for each plane fits in
-  * the plane length and that the data offset doesn't exceed the bytesused value.
-@@ -437,6 +442,7 @@ static int __fill_vb2_buffer(struct vb2_buffer *vb,
- }
- 
- static const struct vb2_buf_ops v4l2_buf_ops = {
-+	.verify_planes_array	= __verify_planes_array_core,
- 	.fill_user_buffer	= __fill_v4l2_buffer,
- 	.fill_vb2_buffer	= __fill_vb2_buffer,
- 	.copy_timestamp		= __copy_timestamp,
-diff --git a/drivers/mfd/qcom_rpm.c b/drivers/mfd/qcom_rpm.c
-index 1be47ad..880d469 100644
---- a/drivers/mfd/qcom_rpm.c
-+++ b/drivers/mfd/qcom_rpm.c
-@@ -34,7 +34,13 @@ struct qcom_rpm_resource {
- struct qcom_rpm_data {
- 	u32 version;
- 	const struct qcom_rpm_resource *resource_table;
--	unsigned n_resources;
-+	unsigned int n_resources;
-+	unsigned int req_ctx_off;
-+	unsigned int req_sel_off;
-+	unsigned int ack_ctx_off;
-+	unsigned int ack_sel_off;
-+	unsigned int req_sel_size;
-+	unsigned int ack_sel_size;
- };
- 
- struct qcom_rpm {
-@@ -61,11 +67,7 @@ struct qcom_rpm {
- 
- #define RPM_REQUEST_TIMEOUT	(5 * HZ)
- 
--#define RPM_REQUEST_CONTEXT	3
--#define RPM_REQ_SELECT		11
--#define RPM_ACK_CONTEXT		15
--#define RPM_ACK_SELECTOR	23
--#define RPM_SELECT_SIZE		7
-+#define RPM_MAX_SEL_SIZE	7
- 
- #define RPM_NOTIFICATION	BIT(30)
- #define RPM_REJECTED		BIT(31)
-@@ -157,6 +159,12 @@ static const struct qcom_rpm_data apq8064_template = {
- 	.version = 3,
- 	.resource_table = apq8064_rpm_resource_table,
- 	.n_resources = ARRAY_SIZE(apq8064_rpm_resource_table),
-+	.req_ctx_off = 3,
-+	.req_sel_off = 11,
-+	.ack_ctx_off = 15,
-+	.ack_sel_off = 23,
-+	.req_sel_size = 4,
-+	.ack_sel_size = 7,
- };
- 
- static const struct qcom_rpm_resource msm8660_rpm_resource_table[] = {
-@@ -240,6 +248,12 @@ static const struct qcom_rpm_data msm8660_template = {
- 	.version = 2,
- 	.resource_table = msm8660_rpm_resource_table,
- 	.n_resources = ARRAY_SIZE(msm8660_rpm_resource_table),
-+	.req_ctx_off = 3,
-+	.req_sel_off = 11,
-+	.ack_ctx_off = 19,
-+	.ack_sel_off = 27,
-+	.req_sel_size = 7,
-+	.ack_sel_size = 7,
- };
- 
- static const struct qcom_rpm_resource msm8960_rpm_resource_table[] = {
-@@ -322,6 +336,12 @@ static const struct qcom_rpm_data msm8960_template = {
- 	.version = 3,
- 	.resource_table = msm8960_rpm_resource_table,
- 	.n_resources = ARRAY_SIZE(msm8960_rpm_resource_table),
-+	.req_ctx_off = 3,
-+	.req_sel_off = 11,
-+	.ack_ctx_off = 15,
-+	.ack_sel_off = 23,
-+	.req_sel_size = 4,
-+	.ack_sel_size = 7,
- };
- 
- static const struct qcom_rpm_resource ipq806x_rpm_resource_table[] = {
-@@ -362,6 +382,12 @@ static const struct qcom_rpm_data ipq806x_template = {
- 	.version = 3,
- 	.resource_table = ipq806x_rpm_resource_table,
- 	.n_resources = ARRAY_SIZE(ipq806x_rpm_resource_table),
-+	.req_ctx_off = 3,
-+	.req_sel_off = 11,
-+	.ack_ctx_off = 15,
-+	.ack_sel_off = 23,
-+	.req_sel_size = 4,
-+	.ack_sel_size = 7,
- };
- 
- static const struct of_device_id qcom_rpm_of_match[] = {
-@@ -380,7 +406,7 @@ int qcom_rpm_write(struct qcom_rpm *rpm,
- {
- 	const struct qcom_rpm_resource *res;
- 	const struct qcom_rpm_data *data = rpm->data;
--	u32 sel_mask[RPM_SELECT_SIZE] = { 0 };
-+	u32 sel_mask[RPM_MAX_SEL_SIZE] = { 0 };
- 	int left;
- 	int ret = 0;
- 	int i;
-@@ -398,12 +424,12 @@ int qcom_rpm_write(struct qcom_rpm *rpm,
- 		writel_relaxed(buf[i], RPM_REQ_REG(rpm, res->target_id + i));
- 
- 	bitmap_set((unsigned long *)sel_mask, res->select_id, 1);
--	for (i = 0; i < ARRAY_SIZE(sel_mask); i++) {
-+	for (i = 0; i < rpm->data->req_sel_size; i++) {
- 		writel_relaxed(sel_mask[i],
--			       RPM_CTRL_REG(rpm, RPM_REQ_SELECT + i));
-+			       RPM_CTRL_REG(rpm, rpm->data->req_sel_off + i));
- 	}
- 
--	writel_relaxed(BIT(state), RPM_CTRL_REG(rpm, RPM_REQUEST_CONTEXT));
-+	writel_relaxed(BIT(state), RPM_CTRL_REG(rpm, rpm->data->req_ctx_off));
- 
- 	reinit_completion(&rpm->ack);
- 	regmap_write(rpm->ipc_regmap, rpm->ipc_offset, BIT(rpm->ipc_bit));
-@@ -426,10 +452,11 @@ static irqreturn_t qcom_rpm_ack_interrupt(int irq, void *dev)
- 	u32 ack;
- 	int i;
- 
--	ack = readl_relaxed(RPM_CTRL_REG(rpm, RPM_ACK_CONTEXT));
--	for (i = 0; i < RPM_SELECT_SIZE; i++)
--		writel_relaxed(0, RPM_CTRL_REG(rpm, RPM_ACK_SELECTOR + i));
--	writel(0, RPM_CTRL_REG(rpm, RPM_ACK_CONTEXT));
-+	ack = readl_relaxed(RPM_CTRL_REG(rpm, rpm->data->ack_ctx_off));
-+	for (i = 0; i < rpm->data->ack_sel_size; i++)
-+		writel_relaxed(0,
-+			RPM_CTRL_REG(rpm, rpm->data->ack_sel_off + i));
-+	writel(0, RPM_CTRL_REG(rpm, rpm->data->ack_ctx_off));
- 
- 	if (ack & RPM_NOTIFICATION) {
- 		dev_warn(rpm->dev, "ignoring notification!\n");
-diff --git a/drivers/mtd/nand/nand_base.c b/drivers/mtd/nand/nand_base.c
-index 0b0dc29..77533f7 100644
---- a/drivers/mtd/nand/nand_base.c
-+++ b/drivers/mtd/nand/nand_base.c
-@@ -2610,7 +2610,7 @@ static int nand_do_write_ops(struct mtd_info *mtd, loff_t to,
- 		int cached = writelen > bytes && page != blockmask;
- 		uint8_t *wbuf = buf;
- 		int use_bufpoi;
--		int part_pagewr = (column || writelen < (mtd->writesize - 1));
-+		int part_pagewr = (column || writelen < mtd->writesize);
- 
- 		if (part_pagewr)
- 			use_bufpoi = 1;
-diff --git a/drivers/mtd/ubi/build.c b/drivers/mtd/ubi/build.c
-index ef36182..0680516 100644
---- a/drivers/mtd/ubi/build.c
-+++ b/drivers/mtd/ubi/build.c
-@@ -874,7 +874,7 @@ int ubi_attach_mtd_dev(struct mtd_info *mtd, int ubi_num,
- 	for (i = 0; i < UBI_MAX_DEVICES; i++) {
- 		ubi = ubi_devices[i];
- 		if (ubi && mtd->index == ubi->mtd->index) {
--			ubi_err(ubi, "mtd%d is already attached to ubi%d",
-+			pr_err("ubi: mtd%d is already attached to ubi%d",
- 				mtd->index, i);
- 			return -EEXIST;
- 		}
-@@ -889,7 +889,7 @@ int ubi_attach_mtd_dev(struct mtd_info *mtd, int ubi_num,
- 	 * no sense to attach emulated MTD devices, so we prohibit this.
- 	 */
- 	if (mtd->type == MTD_UBIVOLUME) {
--		ubi_err(ubi, "refuse attaching mtd%d - it is already emulated on top of UBI",
-+		pr_err("ubi: refuse attaching mtd%d - it is already emulated on top of UBI",
- 			mtd->index);
- 		return -EINVAL;
- 	}
-@@ -900,7 +900,7 @@ int ubi_attach_mtd_dev(struct mtd_info *mtd, int ubi_num,
- 			if (!ubi_devices[ubi_num])
- 				break;
- 		if (ubi_num == UBI_MAX_DEVICES) {
--			ubi_err(ubi, "only %d UBI devices may be created",
-+			pr_err("ubi: only %d UBI devices may be created",
- 				UBI_MAX_DEVICES);
- 			return -ENFILE;
- 		}
-@@ -910,7 +910,7 @@ int ubi_attach_mtd_dev(struct mtd_info *mtd, int ubi_num,
- 
- 		/* Make sure ubi_num is not busy */
- 		if (ubi_devices[ubi_num]) {
--			ubi_err(ubi, "already exists");
-+			pr_err("ubi: ubi%i already exists", ubi_num);
- 			return -EEXIST;
- 		}
- 	}
-@@ -992,6 +992,9 @@ int ubi_attach_mtd_dev(struct mtd_info *mtd, int ubi_num,
- 			goto out_detach;
- 	}
- 
-+	/* Make device "available" before it becomes accessible via sysfs */
-+	ubi_devices[ubi_num] = ubi;
-+
- 	err = uif_init(ubi, &ref);
- 	if (err)
- 		goto out_detach;
-@@ -1036,7 +1039,6 @@ int ubi_attach_mtd_dev(struct mtd_info *mtd, int ubi_num,
- 	wake_up_process(ubi->bgt_thread);
- 	spin_unlock(&ubi->wl_lock);
- 
--	ubi_devices[ubi_num] = ubi;
- 	ubi_notify_all(ubi, UBI_VOLUME_ADDED, NULL);
- 	return ubi_num;
- 
-@@ -1047,6 +1049,7 @@ out_uif:
- 	ubi_assert(ref);
- 	uif_close(ubi);
- out_detach:
-+	ubi_devices[ubi_num] = NULL;
- 	ubi_wl_close(ubi);
- 	ubi_free_internal_volumes(ubi);
- 	vfree(ubi->vtbl);
-diff --git a/drivers/mtd/ubi/vmt.c b/drivers/mtd/ubi/vmt.c
-index 10059df..0138f52 100644
---- a/drivers/mtd/ubi/vmt.c
-+++ b/drivers/mtd/ubi/vmt.c
-@@ -488,13 +488,6 @@ int ubi_resize_volume(struct ubi_volume_desc *desc, int reserved_pebs)
- 		spin_unlock(&ubi->volumes_lock);
- 	}
- 
--	/* Change volume table record */
--	vtbl_rec = ubi->vtbl[vol_id];
--	vtbl_rec.reserved_pebs = cpu_to_be32(reserved_pebs);
--	err = ubi_change_vtbl_record(ubi, vol_id, &vtbl_rec);
--	if (err)
--		goto out_acc;
--
- 	if (pebs < 0) {
- 		for (i = 0; i < -pebs; i++) {
- 			err = ubi_eba_unmap_leb(ubi, vol, reserved_pebs + i);
-@@ -512,6 +505,24 @@ int ubi_resize_volume(struct ubi_volume_desc *desc, int reserved_pebs)
- 		spin_unlock(&ubi->volumes_lock);
- 	}
- 
-+	/*
-+	 * When we shrink a volume we have to flush all pending (erase) work.
-+	 * Otherwise it can happen that upon next attach UBI finds a LEB with
-+	 * lnum > highest_lnum and refuses to attach.
-+	 */
-+	if (pebs < 0) {
-+		err = ubi_wl_flush(ubi, vol_id, UBI_ALL);
-+		if (err)
-+			goto out_acc;
-+	}
-+
-+	/* Change volume table record */
-+	vtbl_rec = ubi->vtbl[vol_id];
-+	vtbl_rec.reserved_pebs = cpu_to_be32(reserved_pebs);
-+	err = ubi_change_vtbl_record(ubi, vol_id, &vtbl_rec);
-+	if (err)
-+		goto out_acc;
-+
- 	vol->reserved_pebs = reserved_pebs;
- 	if (vol->vol_type == UBI_DYNAMIC_VOLUME) {
- 		vol->used_ebs = reserved_pebs;
-diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.c
-index 5b30922..2ce3199 100644
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.c
-@@ -2469,10 +2469,22 @@ void brcmf_fws_bustxfail(struct brcmf_fws_info *fws, struct sk_buff *skb)
- void brcmf_fws_bus_blocked(struct brcmf_pub *drvr, bool flow_blocked)
- {
- 	struct brcmf_fws_info *fws = drvr->fws;
-+	struct brcmf_if *ifp;
-+	int i;
- 
--	fws->bus_flow_blocked = flow_blocked;
--	if (!flow_blocked)
--		brcmf_fws_schedule_deq(fws);
--	else
--		fws->stats.bus_flow_block++;
-+	if (fws->avoid_queueing) {
-+		for (i = 0; i < BRCMF_MAX_IFS; i++) {
-+			ifp = drvr->iflist[i];
-+			if (!ifp || !ifp->ndev)
-+				continue;
-+			brcmf_txflowblock_if(ifp, BRCMF_NETIF_STOP_REASON_FLOW,
-+					     flow_blocked);
-+		}
-+	} else {
-+		fws->bus_flow_blocked = flow_blocked;
-+		if (!flow_blocked)
-+			brcmf_fws_schedule_deq(fws);
-+		else
-+			fws->stats.bus_flow_block++;
-+	}
- }
-diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/drv.c b/drivers/net/wireless/intel/iwlwifi/pcie/drv.c
-index a588b05..6f020e4 100644
---- a/drivers/net/wireless/intel/iwlwifi/pcie/drv.c
-+++ b/drivers/net/wireless/intel/iwlwifi/pcie/drv.c
-@@ -433,6 +433,7 @@ static const struct pci_device_id iwl_hw_card_ids[] = {
- /* 8000 Series */
- 	{IWL_PCI_DEVICE(0x24F3, 0x0010, iwl8260_2ac_cfg)},
- 	{IWL_PCI_DEVICE(0x24F3, 0x1010, iwl8260_2ac_cfg)},
-+	{IWL_PCI_DEVICE(0x24F3, 0x10B0, iwl8260_2ac_cfg)},
- 	{IWL_PCI_DEVICE(0x24F3, 0x0130, iwl8260_2ac_cfg)},
- 	{IWL_PCI_DEVICE(0x24F3, 0x1130, iwl8260_2ac_cfg)},
- 	{IWL_PCI_DEVICE(0x24F3, 0x0132, iwl8260_2ac_cfg)},
-@@ -454,6 +455,8 @@ static const struct pci_device_id iwl_hw_card_ids[] = {
- 	{IWL_PCI_DEVICE(0x24F3, 0xD010, iwl8260_2ac_cfg)},
- 	{IWL_PCI_DEVICE(0x24F3, 0xC050, iwl8260_2ac_cfg)},
- 	{IWL_PCI_DEVICE(0x24F3, 0xD050, iwl8260_2ac_cfg)},
-+	{IWL_PCI_DEVICE(0x24F3, 0xD0B0, iwl8260_2ac_cfg)},
-+	{IWL_PCI_DEVICE(0x24F3, 0xB0B0, iwl8260_2ac_cfg)},
- 	{IWL_PCI_DEVICE(0x24F3, 0x8010, iwl8260_2ac_cfg)},
- 	{IWL_PCI_DEVICE(0x24F3, 0x8110, iwl8260_2ac_cfg)},
- 	{IWL_PCI_DEVICE(0x24F3, 0x9010, iwl8260_2ac_cfg)},
-@@ -481,6 +484,8 @@ static const struct pci_device_id iwl_hw_card_ids[] = {
- 	{IWL_PCI_DEVICE(0x24FD, 0x0010, iwl8265_2ac_cfg)},
- 	{IWL_PCI_DEVICE(0x24FD, 0x0110, iwl8265_2ac_cfg)},
- 	{IWL_PCI_DEVICE(0x24FD, 0x1110, iwl8265_2ac_cfg)},
-+	{IWL_PCI_DEVICE(0x24FD, 0x1130, iwl8265_2ac_cfg)},
-+	{IWL_PCI_DEVICE(0x24FD, 0x0130, iwl8265_2ac_cfg)},
- 	{IWL_PCI_DEVICE(0x24FD, 0x1010, iwl8265_2ac_cfg)},
- 	{IWL_PCI_DEVICE(0x24FD, 0x0050, iwl8265_2ac_cfg)},
- 	{IWL_PCI_DEVICE(0x24FD, 0x0150, iwl8265_2ac_cfg)},
-@@ -491,6 +496,10 @@ static const struct pci_device_id iwl_hw_card_ids[] = {
- 	{IWL_PCI_DEVICE(0x24FD, 0x0810, iwl8265_2ac_cfg)},
- 	{IWL_PCI_DEVICE(0x24FD, 0x9110, iwl8265_2ac_cfg)},
- 	{IWL_PCI_DEVICE(0x24FD, 0x8130, iwl8265_2ac_cfg)},
-+	{IWL_PCI_DEVICE(0x24FD, 0x0910, iwl8265_2ac_cfg)},
-+	{IWL_PCI_DEVICE(0x24FD, 0x0930, iwl8265_2ac_cfg)},
-+	{IWL_PCI_DEVICE(0x24FD, 0x0950, iwl8265_2ac_cfg)},
-+	{IWL_PCI_DEVICE(0x24FD, 0x0850, iwl8265_2ac_cfg)},
- 
- /* 9000 Series */
- 	{IWL_PCI_DEVICE(0x2526, 0x0000, iwl9260_2ac_cfg)},
-diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/internal.h b/drivers/net/wireless/intel/iwlwifi/pcie/internal.h
-index de6974f..2d8cce2 100644
---- a/drivers/net/wireless/intel/iwlwifi/pcie/internal.h
-+++ b/drivers/net/wireless/intel/iwlwifi/pcie/internal.h
-@@ -496,7 +496,7 @@ void iwl_pcie_dump_csr(struct iwl_trans *trans);
- /*****************************************************
- * Helpers
- ******************************************************/
--static inline void iwl_disable_interrupts(struct iwl_trans *trans)
-+static inline void _iwl_disable_interrupts(struct iwl_trans *trans)
- {
- 	struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
- 
-@@ -519,7 +519,16 @@ static inline void iwl_disable_interrupts(struct iwl_trans *trans)
- 	IWL_DEBUG_ISR(trans, "Disabled interrupts\n");
- }
- 
--static inline void iwl_enable_interrupts(struct iwl_trans *trans)
-+static inline void iwl_disable_interrupts(struct iwl_trans *trans)
-+{
-+	struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
-+
-+	spin_lock(&trans_pcie->irq_lock);
-+	_iwl_disable_interrupts(trans);
-+	spin_unlock(&trans_pcie->irq_lock);
-+}
-+
-+static inline void _iwl_enable_interrupts(struct iwl_trans *trans)
- {
- 	struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
- 
-@@ -542,6 +551,14 @@ static inline void iwl_enable_interrupts(struct iwl_trans *trans)
- 	}
- }
- 
-+static inline void iwl_enable_interrupts(struct iwl_trans *trans)
-+{
-+	struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
-+
-+	spin_lock(&trans_pcie->irq_lock);
-+	_iwl_enable_interrupts(trans);
-+	spin_unlock(&trans_pcie->irq_lock);
-+}
- static inline void iwl_enable_hw_int_msk_msix(struct iwl_trans *trans, u32 msk)
- {
- 	struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
-diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/rx.c b/drivers/net/wireless/intel/iwlwifi/pcie/rx.c
-index 0a4a3c5..aaaf2ad 100644
---- a/drivers/net/wireless/intel/iwlwifi/pcie/rx.c
-+++ b/drivers/net/wireless/intel/iwlwifi/pcie/rx.c
-@@ -1507,7 +1507,7 @@ irqreturn_t iwl_pcie_irq_handler(int irq, void *dev_id)
- 		 * have anything to service
- 		 */
- 		if (test_bit(STATUS_INT_ENABLED, &trans->status))
--			iwl_enable_interrupts(trans);
-+			_iwl_enable_interrupts(trans);
- 		spin_unlock(&trans_pcie->irq_lock);
- 		lock_map_release(&trans->sync_cmd_lockdep_map);
- 		return IRQ_NONE;
-@@ -1699,15 +1699,17 @@ irqreturn_t iwl_pcie_irq_handler(int irq, void *dev_id)
- 			 inta & ~trans_pcie->inta_mask);
- 	}
- 
-+	spin_lock(&trans_pcie->irq_lock);
-+	/* only Re-enable all interrupt if disabled by irq */
-+	if (test_bit(STATUS_INT_ENABLED, &trans->status))
-+		_iwl_enable_interrupts(trans);
- 	/* we are loading the firmware, enable FH_TX interrupt only */
--	if (handled & CSR_INT_BIT_FH_TX)
-+	else if (handled & CSR_INT_BIT_FH_TX)
- 		iwl_enable_fw_load_int(trans);
--	/* only Re-enable all interrupt if disabled by irq */
--	else if (test_bit(STATUS_INT_ENABLED, &trans->status))
--		iwl_enable_interrupts(trans);
- 	/* Re-enable RF_KILL if it occurred */
- 	else if (handled & CSR_INT_BIT_RF_KILL)
- 		iwl_enable_rfkill_int(trans);
-+	spin_unlock(&trans_pcie->irq_lock);
- 
- out:
- 	lock_map_release(&trans->sync_cmd_lockdep_map);
-@@ -1771,7 +1773,7 @@ void iwl_pcie_reset_ict(struct iwl_trans *trans)
- 		return;
- 
- 	spin_lock(&trans_pcie->irq_lock);
--	iwl_disable_interrupts(trans);
-+	_iwl_disable_interrupts(trans);
- 
- 	memset(trans_pcie->ict_tbl, 0, ICT_SIZE);
- 
-@@ -1787,7 +1789,7 @@ void iwl_pcie_reset_ict(struct iwl_trans *trans)
- 	trans_pcie->use_ict = true;
- 	trans_pcie->ict_index = 0;
- 	iwl_write32(trans, CSR_INT, trans_pcie->inta_mask);
--	iwl_enable_interrupts(trans);
-+	_iwl_enable_interrupts(trans);
- 	spin_unlock(&trans_pcie->irq_lock);
- }
- 
-diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/trans.c b/drivers/net/wireless/intel/iwlwifi/pcie/trans.c
-index f603d78..d9f1394 100644
---- a/drivers/net/wireless/intel/iwlwifi/pcie/trans.c
-+++ b/drivers/net/wireless/intel/iwlwifi/pcie/trans.c
-@@ -801,6 +801,8 @@ static int iwl_pcie_load_cpu_sections_8000(struct iwl_trans *trans,
- 
- 	*first_ucode_section = last_read_idx;
- 
-+	iwl_enable_interrupts(trans);
-+
- 	if (cpu == 1)
- 		iwl_write_direct32(trans, FH_UCODE_LOAD_STATUS, 0xFFFF);
- 	else
-@@ -980,6 +982,8 @@ static int iwl_pcie_load_given_ucode(struct iwl_trans *trans,
- 		iwl_pcie_apply_destination(trans);
- 	}
- 
-+	iwl_enable_interrupts(trans);
-+
- 	/* release CPU reset */
- 	iwl_write32(trans, CSR_RESET, 0);
- 
-@@ -1033,9 +1037,7 @@ static void _iwl_trans_pcie_stop_device(struct iwl_trans *trans, bool low_power)
- 	was_hw_rfkill = iwl_is_rfkill_set(trans);
- 
- 	/* tell the device to stop sending interrupts */
--	spin_lock(&trans_pcie->irq_lock);
- 	iwl_disable_interrupts(trans);
--	spin_unlock(&trans_pcie->irq_lock);
- 
- 	/* device going down, Stop using ICT table */
- 	iwl_pcie_disable_ict(trans);
-@@ -1079,9 +1081,7 @@ static void _iwl_trans_pcie_stop_device(struct iwl_trans *trans, bool low_power)
- 	 * the time, unless the interrupt is ACKed even if the interrupt
- 	 * should be masked. Re-ACK all the interrupts here.
- 	 */
--	spin_lock(&trans_pcie->irq_lock);
- 	iwl_disable_interrupts(trans);
--	spin_unlock(&trans_pcie->irq_lock);
- 
- 	/* clear all status bits */
- 	clear_bit(STATUS_SYNC_HCMD_ACTIVE, &trans->status);
-@@ -1215,7 +1215,6 @@ static int iwl_trans_pcie_start_fw(struct iwl_trans *trans,
- 		ret = iwl_pcie_load_given_ucode_8000(trans, fw);
- 	else
- 		ret = iwl_pcie_load_given_ucode(trans, fw);
--	iwl_enable_interrupts(trans);
- 
- 	/* re-check RF-Kill state since we may have missed the interrupt */
- 	hw_rfkill = iwl_is_rfkill_set(trans);
-@@ -1567,15 +1566,11 @@ static void iwl_trans_pcie_op_mode_leave(struct iwl_trans *trans)
- 	mutex_lock(&trans_pcie->mutex);
- 
- 	/* disable interrupts - don't enable HW RF kill interrupt */
--	spin_lock(&trans_pcie->irq_lock);
- 	iwl_disable_interrupts(trans);
--	spin_unlock(&trans_pcie->irq_lock);
- 
- 	iwl_pcie_apm_stop(trans, true);
- 
--	spin_lock(&trans_pcie->irq_lock);
- 	iwl_disable_interrupts(trans);
--	spin_unlock(&trans_pcie->irq_lock);
- 
- 	iwl_pcie_disable_ict(trans);
- 
-diff --git a/drivers/of/base.c b/drivers/of/base.c
-index ebf84e3..8bb3d1a 100644
---- a/drivers/of/base.c
-+++ b/drivers/of/base.c
-@@ -112,6 +112,7 @@ static ssize_t of_node_property_read(struct file *filp, struct kobject *kobj,
- 	return memory_read_from_buffer(buf, count, &offset, pp->value, pp->length);
- }
- 
-+/* always return newly allocated name, caller must free after use */
- static const char *safe_name(struct kobject *kobj, const char *orig_name)
- {
- 	const char *name = orig_name;
-@@ -126,9 +127,12 @@ static const char *safe_name(struct kobject *kobj, const char *orig_name)
- 		name = kasprintf(GFP_KERNEL, "%s#%i", orig_name, ++i);
- 	}
- 
--	if (name != orig_name)
-+	if (name == orig_name) {
-+		name = kstrdup(orig_name, GFP_KERNEL);
-+	} else {
- 		pr_warn("device-tree: Duplicate name in %s, renamed to \"%s\"\n",
- 			kobject_name(kobj), name);
-+	}
- 	return name;
- }
- 
-@@ -159,6 +163,7 @@ int __of_add_property_sysfs(struct device_node *np, struct property *pp)
- int __of_attach_node_sysfs(struct device_node *np)
- {
- 	const char *name;
-+	struct kobject *parent;
- 	struct property *pp;
- 	int rc;
- 
-@@ -171,15 +176,16 @@ int __of_attach_node_sysfs(struct device_node *np)
- 	np->kobj.kset = of_kset;
- 	if (!np->parent) {
- 		/* Nodes without parents are new top level trees */
--		rc = kobject_add(&np->kobj, NULL, "%s",
--				 safe_name(&of_kset->kobj, "base"));
-+		name = safe_name(&of_kset->kobj, "base");
-+		parent = NULL;
- 	} else {
- 		name = safe_name(&np->parent->kobj, kbasename(np->full_name));
--		if (!name || !name[0])
--			return -EINVAL;
--
--		rc = kobject_add(&np->kobj, &np->parent->kobj, "%s", name);
-+		parent = &np->parent->kobj;
- 	}
-+	if (!name)
-+		return -ENOMEM;
-+	rc = kobject_add(&np->kobj, parent, "%s", name);
-+	kfree(name);
- 	if (rc)
- 		return rc;
- 
-@@ -1815,6 +1821,12 @@ int __of_remove_property(struct device_node *np, struct property *prop)
- 	return 0;
- }
- 
-+void __of_sysfs_remove_bin_file(struct device_node *np, struct property *prop)
-+{
-+	sysfs_remove_bin_file(&np->kobj, &prop->attr);
-+	kfree(prop->attr.attr.name);
-+}
-+
- void __of_remove_property_sysfs(struct device_node *np, struct property *prop)
- {
- 	if (!IS_ENABLED(CONFIG_SYSFS))
-@@ -1822,7 +1834,7 @@ void __of_remove_property_sysfs(struct device_node *np, struct property *prop)
- 
- 	/* at early boot, bail here and defer setup to of_init() */
- 	if (of_kset && of_node_is_attached(np))
--		sysfs_remove_bin_file(&np->kobj, &prop->attr);
-+		__of_sysfs_remove_bin_file(np, prop);
- }
- 
- /**
-@@ -1895,7 +1907,7 @@ void __of_update_property_sysfs(struct device_node *np, struct property *newprop
- 		return;
- 
- 	if (oldprop)
--		sysfs_remove_bin_file(&np->kobj, &oldprop->attr);
-+		__of_sysfs_remove_bin_file(np, oldprop);
- 	__of_add_property_sysfs(np, newprop);
- }
- 
-diff --git a/drivers/of/dynamic.c b/drivers/of/dynamic.c
-index 3033fa3..a201559 100644
---- a/drivers/of/dynamic.c
-+++ b/drivers/of/dynamic.c
-@@ -55,7 +55,7 @@ void __of_detach_node_sysfs(struct device_node *np)
- 	/* only remove properties if on sysfs */
- 	if (of_node_is_attached(np)) {
- 		for_each_property_of_node(np, pp)
--			sysfs_remove_bin_file(&np->kobj, &pp->attr);
-+			__of_sysfs_remove_bin_file(np, pp);
- 		kobject_del(&np->kobj);
- 	}
- 
-diff --git a/drivers/of/of_private.h b/drivers/of/of_private.h
-index 829469f..18bbb451 100644
---- a/drivers/of/of_private.h
-+++ b/drivers/of/of_private.h
-@@ -83,6 +83,9 @@ extern int __of_attach_node_sysfs(struct device_node *np);
- extern void __of_detach_node(struct device_node *np);
- extern void __of_detach_node_sysfs(struct device_node *np);
- 
-+extern void __of_sysfs_remove_bin_file(struct device_node *np,
-+				       struct property *prop);
-+
- /* iterators for transactions, used for overlays */
- /* forward iterator */
- #define for_each_transaction_entry(_oft, _te) \
-diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
-index ee72ebe..7902fbf 100644
---- a/drivers/pci/quirks.c
-+++ b/drivers/pci/quirks.c
-@@ -3189,13 +3189,15 @@ static void quirk_no_bus_reset(struct pci_dev *dev)
- }
- 
- /*
-- * Atheros AR93xx chips do not behave after a bus reset.  The device will
-- * throw a Link Down error on AER-capable systems and regardless of AER,
-- * config space of the device is never accessible again and typically
-- * causes the system to hang or reset when access is attempted.
-+ * Some Atheros AR9xxx and QCA988x chips do not behave after a bus reset.
-+ * The device will throw a Link Down error on AER-capable systems and
-+ * regardless of AER, config space of the device is never accessible again
-+ * and typically causes the system to hang or reset when access is attempted.
-  * http://www.spinics.net/lists/linux-pci/msg34797.html
-  */
- DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_ATHEROS, 0x0030, quirk_no_bus_reset);
-+DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_ATHEROS, 0x0032, quirk_no_bus_reset);
-+DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_ATHEROS, 0x003c, quirk_no_bus_reset);
- 
- static void quirk_no_pm_reset(struct pci_dev *dev)
- {
-diff --git a/drivers/phy/phy-rcar-gen3-usb2.c b/drivers/phy/phy-rcar-gen3-usb2.c
-index 4be3f5d..31156c9 100644
---- a/drivers/phy/phy-rcar-gen3-usb2.c
-+++ b/drivers/phy/phy-rcar-gen3-usb2.c
-@@ -21,6 +21,7 @@
- #include <linux/phy/phy.h>
- #include <linux/platform_device.h>
- #include <linux/regulator/consumer.h>
-+#include <linux/workqueue.h>
- 
- /******* USB2.0 Host registers (original offset is +0x200) *******/
- #define USB2_INT_ENABLE		0x000
-@@ -81,9 +82,25 @@ struct rcar_gen3_chan {
- 	struct extcon_dev *extcon;
- 	struct phy *phy;
- 	struct regulator *vbus;
-+	struct work_struct work;
-+	bool extcon_host;
- 	bool has_otg;
- };
- 
-+static void rcar_gen3_phy_usb2_work(struct work_struct *work)
-+{
-+	struct rcar_gen3_chan *ch = container_of(work, struct rcar_gen3_chan,
-+						 work);
-+
-+	if (ch->extcon_host) {
-+		extcon_set_cable_state_(ch->extcon, EXTCON_USB_HOST, true);
-+		extcon_set_cable_state_(ch->extcon, EXTCON_USB, false);
-+	} else {
-+		extcon_set_cable_state_(ch->extcon, EXTCON_USB_HOST, false);
-+		extcon_set_cable_state_(ch->extcon, EXTCON_USB, true);
-+	}
-+}
-+
- static void rcar_gen3_set_host_mode(struct rcar_gen3_chan *ch, int host)
- {
- 	void __iomem *usb2_base = ch->base;
-@@ -130,8 +147,8 @@ static void rcar_gen3_init_for_host(struct rcar_gen3_chan *ch)
- 	rcar_gen3_set_host_mode(ch, 1);
- 	rcar_gen3_enable_vbus_ctrl(ch, 1);
- 
--	extcon_set_cable_state_(ch->extcon, EXTCON_USB_HOST, true);
--	extcon_set_cable_state_(ch->extcon, EXTCON_USB, false);
-+	ch->extcon_host = true;
-+	schedule_work(&ch->work);
- }
- 
- static void rcar_gen3_init_for_peri(struct rcar_gen3_chan *ch)
-@@ -140,8 +157,8 @@ static void rcar_gen3_init_for_peri(struct rcar_gen3_chan *ch)
- 	rcar_gen3_set_host_mode(ch, 0);
- 	rcar_gen3_enable_vbus_ctrl(ch, 0);
- 
--	extcon_set_cable_state_(ch->extcon, EXTCON_USB_HOST, false);
--	extcon_set_cable_state_(ch->extcon, EXTCON_USB, true);
-+	ch->extcon_host = false;
-+	schedule_work(&ch->work);
- }
- 
- static bool rcar_gen3_check_id(struct rcar_gen3_chan *ch)
-@@ -301,6 +318,7 @@ static int rcar_gen3_phy_usb2_probe(struct platform_device *pdev)
- 	if (irq >= 0) {
- 		int ret;
- 
-+		INIT_WORK(&channel->work, rcar_gen3_phy_usb2_work);
- 		irq = devm_request_irq(dev, irq, rcar_gen3_phy_usb2_irq,
- 				       IRQF_SHARED, dev_name(dev), channel);
- 		if (irq < 0)
-diff --git a/drivers/pinctrl/intel/pinctrl-cherryview.c b/drivers/pinctrl/intel/pinctrl-cherryview.c
-index ac4f564..bf65c94 100644
---- a/drivers/pinctrl/intel/pinctrl-cherryview.c
-+++ b/drivers/pinctrl/intel/pinctrl-cherryview.c
-@@ -160,7 +160,6 @@ struct chv_pin_context {
-  * @pctldev: Pointer to the pin controller device
-  * @chip: GPIO chip in this pin controller
-  * @regs: MMIO registers
-- * @lock: Lock to serialize register accesses
-  * @intr_lines: Stores mapping between 16 HW interrupt wires and GPIO
-  *		offset (in GPIO number space)
-  * @community: Community this pinctrl instance represents
-@@ -174,7 +173,6 @@ struct chv_pinctrl {
- 	struct pinctrl_dev *pctldev;
- 	struct gpio_chip chip;
- 	void __iomem *regs;
--	raw_spinlock_t lock;
- 	unsigned intr_lines[16];
- 	const struct chv_community *community;
- 	u32 saved_intmask;
-@@ -657,6 +655,17 @@ static const struct chv_community *chv_communities[] = {
- 	&southeast_community,
- };
- 
-+/*
-+ * Lock to serialize register accesses
-+ *
-+ * Due to a silicon issue, a shared lock must be used to prevent
-+ * concurrent accesses across the 4 GPIO controllers.
-+ *
-+ * See Intel Atom Z8000 Processor Series Specification Update (Rev. 005),
-+ * errata #CHT34, for further information.
-+ */
-+static DEFINE_RAW_SPINLOCK(chv_lock);
-+
- static void __iomem *chv_padreg(struct chv_pinctrl *pctrl, unsigned offset,
- 				unsigned reg)
- {
-@@ -718,13 +727,13 @@ static void chv_pin_dbg_show(struct pinctrl_dev *pctldev, struct seq_file *s,
- 	u32 ctrl0, ctrl1;
- 	bool locked;
- 
--	raw_spin_lock_irqsave(&pctrl->lock, flags);
-+	raw_spin_lock_irqsave(&chv_lock, flags);
- 
- 	ctrl0 = readl(chv_padreg(pctrl, offset, CHV_PADCTRL0));
- 	ctrl1 = readl(chv_padreg(pctrl, offset, CHV_PADCTRL1));
- 	locked = chv_pad_locked(pctrl, offset);
- 
--	raw_spin_unlock_irqrestore(&pctrl->lock, flags);
-+	raw_spin_unlock_irqrestore(&chv_lock, flags);
- 
- 	if (ctrl0 & CHV_PADCTRL0_GPIOEN) {
- 		seq_puts(s, "GPIO ");
-@@ -787,14 +796,14 @@ static int chv_pinmux_set_mux(struct pinctrl_dev *pctldev, unsigned function,
- 
- 	grp = &pctrl->community->groups[group];
- 
--	raw_spin_lock_irqsave(&pctrl->lock, flags);
-+	raw_spin_lock_irqsave(&chv_lock, flags);
- 
- 	/* Check first that the pad is not locked */
- 	for (i = 0; i < grp->npins; i++) {
- 		if (chv_pad_locked(pctrl, grp->pins[i])) {
- 			dev_warn(pctrl->dev, "unable to set mode for locked pin %u\n",
- 				 grp->pins[i]);
--			raw_spin_unlock_irqrestore(&pctrl->lock, flags);
-+			raw_spin_unlock_irqrestore(&chv_lock, flags);
- 			return -EBUSY;
- 		}
- 	}
-@@ -837,7 +846,7 @@ static int chv_pinmux_set_mux(struct pinctrl_dev *pctldev, unsigned function,
- 			pin, altfunc->mode, altfunc->invert_oe ? "" : "not ");
- 	}
- 
--	raw_spin_unlock_irqrestore(&pctrl->lock, flags);
-+	raw_spin_unlock_irqrestore(&chv_lock, flags);
- 
- 	return 0;
- }
-@@ -851,13 +860,13 @@ static int chv_gpio_request_enable(struct pinctrl_dev *pctldev,
- 	void __iomem *reg;
- 	u32 value;
- 
--	raw_spin_lock_irqsave(&pctrl->lock, flags);
-+	raw_spin_lock_irqsave(&chv_lock, flags);
- 
- 	if (chv_pad_locked(pctrl, offset)) {
- 		value = readl(chv_padreg(pctrl, offset, CHV_PADCTRL0));
- 		if (!(value & CHV_PADCTRL0_GPIOEN)) {
- 			/* Locked so cannot enable */
--			raw_spin_unlock_irqrestore(&pctrl->lock, flags);
-+			raw_spin_unlock_irqrestore(&chv_lock, flags);
- 			return -EBUSY;
- 		}
- 	} else {
-@@ -897,7 +906,7 @@ static int chv_gpio_request_enable(struct pinctrl_dev *pctldev,
- 		chv_writel(value, reg);
- 	}
- 
--	raw_spin_unlock_irqrestore(&pctrl->lock, flags);
-+	raw_spin_unlock_irqrestore(&chv_lock, flags);
- 
- 	return 0;
- }
-@@ -911,13 +920,13 @@ static void chv_gpio_disable_free(struct pinctrl_dev *pctldev,
- 	void __iomem *reg;
- 	u32 value;
- 
--	raw_spin_lock_irqsave(&pctrl->lock, flags);
-+	raw_spin_lock_irqsave(&chv_lock, flags);
- 
- 	reg = chv_padreg(pctrl, offset, CHV_PADCTRL0);
- 	value = readl(reg) & ~CHV_PADCTRL0_GPIOEN;
- 	chv_writel(value, reg);
- 
--	raw_spin_unlock_irqrestore(&pctrl->lock, flags);
-+	raw_spin_unlock_irqrestore(&chv_lock, flags);
- }
- 
- static int chv_gpio_set_direction(struct pinctrl_dev *pctldev,
-@@ -929,7 +938,7 @@ static int chv_gpio_set_direction(struct pinctrl_dev *pctldev,
- 	unsigned long flags;
- 	u32 ctrl0;
- 
--	raw_spin_lock_irqsave(&pctrl->lock, flags);
-+	raw_spin_lock_irqsave(&chv_lock, flags);
- 
- 	ctrl0 = readl(reg) & ~CHV_PADCTRL0_GPIOCFG_MASK;
- 	if (input)
-@@ -938,7 +947,7 @@ static int chv_gpio_set_direction(struct pinctrl_dev *pctldev,
- 		ctrl0 |= CHV_PADCTRL0_GPIOCFG_GPO << CHV_PADCTRL0_GPIOCFG_SHIFT;
- 	chv_writel(ctrl0, reg);
- 
--	raw_spin_unlock_irqrestore(&pctrl->lock, flags);
-+	raw_spin_unlock_irqrestore(&chv_lock, flags);
- 
- 	return 0;
- }
-@@ -963,10 +972,10 @@ static int chv_config_get(struct pinctrl_dev *pctldev, unsigned pin,
- 	u16 arg = 0;
- 	u32 term;
- 
--	raw_spin_lock_irqsave(&pctrl->lock, flags);
-+	raw_spin_lock_irqsave(&chv_lock, flags);
- 	ctrl0 = readl(chv_padreg(pctrl, pin, CHV_PADCTRL0));
- 	ctrl1 = readl(chv_padreg(pctrl, pin, CHV_PADCTRL1));
--	raw_spin_unlock_irqrestore(&pctrl->lock, flags);
-+	raw_spin_unlock_irqrestore(&chv_lock, flags);
- 
- 	term = (ctrl0 & CHV_PADCTRL0_TERM_MASK) >> CHV_PADCTRL0_TERM_SHIFT;
- 
-@@ -1040,7 +1049,7 @@ static int chv_config_set_pull(struct chv_pinctrl *pctrl, unsigned pin,
- 	unsigned long flags;
- 	u32 ctrl0, pull;
- 
--	raw_spin_lock_irqsave(&pctrl->lock, flags);
-+	raw_spin_lock_irqsave(&chv_lock, flags);
- 	ctrl0 = readl(reg);
- 
- 	switch (param) {
-@@ -1063,7 +1072,7 @@ static int chv_config_set_pull(struct chv_pinctrl *pctrl, unsigned pin,
- 			pull = CHV_PADCTRL0_TERM_20K << CHV_PADCTRL0_TERM_SHIFT;
- 			break;
- 		default:
--			raw_spin_unlock_irqrestore(&pctrl->lock, flags);
-+			raw_spin_unlock_irqrestore(&chv_lock, flags);
- 			return -EINVAL;
- 		}
- 
-@@ -1081,7 +1090,7 @@ static int chv_config_set_pull(struct chv_pinctrl *pctrl, unsigned pin,
- 			pull = CHV_PADCTRL0_TERM_20K << CHV_PADCTRL0_TERM_SHIFT;
- 			break;
- 		default:
--			raw_spin_unlock_irqrestore(&pctrl->lock, flags);
-+			raw_spin_unlock_irqrestore(&chv_lock, flags);
- 			return -EINVAL;
- 		}
- 
-@@ -1089,12 +1098,12 @@ static int chv_config_set_pull(struct chv_pinctrl *pctrl, unsigned pin,
- 		break;
- 
- 	default:
--		raw_spin_unlock_irqrestore(&pctrl->lock, flags);
-+		raw_spin_unlock_irqrestore(&chv_lock, flags);
- 		return -EINVAL;
- 	}
- 
- 	chv_writel(ctrl0, reg);
--	raw_spin_unlock_irqrestore(&pctrl->lock, flags);
-+	raw_spin_unlock_irqrestore(&chv_lock, flags);
- 
- 	return 0;
- }
-@@ -1160,9 +1169,9 @@ static int chv_gpio_get(struct gpio_chip *chip, unsigned offset)
- 	unsigned long flags;
- 	u32 ctrl0, cfg;
- 
--	raw_spin_lock_irqsave(&pctrl->lock, flags);
-+	raw_spin_lock_irqsave(&chv_lock, flags);
- 	ctrl0 = readl(chv_padreg(pctrl, pin, CHV_PADCTRL0));
--	raw_spin_unlock_irqrestore(&pctrl->lock, flags);
-+	raw_spin_unlock_irqrestore(&chv_lock, flags);
- 
- 	cfg = ctrl0 & CHV_PADCTRL0_GPIOCFG_MASK;
- 	cfg >>= CHV_PADCTRL0_GPIOCFG_SHIFT;
-@@ -1180,7 +1189,7 @@ static void chv_gpio_set(struct gpio_chip *chip, unsigned offset, int value)
- 	void __iomem *reg;
- 	u32 ctrl0;
- 
--	raw_spin_lock_irqsave(&pctrl->lock, flags);
-+	raw_spin_lock_irqsave(&chv_lock, flags);
- 
- 	reg = chv_padreg(pctrl, pin, CHV_PADCTRL0);
- 	ctrl0 = readl(reg);
-@@ -1192,7 +1201,7 @@ static void chv_gpio_set(struct gpio_chip *chip, unsigned offset, int value)
- 
- 	chv_writel(ctrl0, reg);
- 
--	raw_spin_unlock_irqrestore(&pctrl->lock, flags);
-+	raw_spin_unlock_irqrestore(&chv_lock, flags);
- }
- 
- static int chv_gpio_get_direction(struct gpio_chip *chip, unsigned offset)
-@@ -1202,9 +1211,9 @@ static int chv_gpio_get_direction(struct gpio_chip *chip, unsigned offset)
- 	u32 ctrl0, direction;
- 	unsigned long flags;
- 
--	raw_spin_lock_irqsave(&pctrl->lock, flags);
-+	raw_spin_lock_irqsave(&chv_lock, flags);
- 	ctrl0 = readl(chv_padreg(pctrl, pin, CHV_PADCTRL0));
--	raw_spin_unlock_irqrestore(&pctrl->lock, flags);
-+	raw_spin_unlock_irqrestore(&chv_lock, flags);
- 
- 	direction = ctrl0 & CHV_PADCTRL0_GPIOCFG_MASK;
- 	direction >>= CHV_PADCTRL0_GPIOCFG_SHIFT;
-@@ -1242,14 +1251,14 @@ static void chv_gpio_irq_ack(struct irq_data *d)
- 	int pin = chv_gpio_offset_to_pin(pctrl, irqd_to_hwirq(d));
- 	u32 intr_line;
- 
--	raw_spin_lock(&pctrl->lock);
-+	raw_spin_lock(&chv_lock);
- 
- 	intr_line = readl(chv_padreg(pctrl, pin, CHV_PADCTRL0));
- 	intr_line &= CHV_PADCTRL0_INTSEL_MASK;
- 	intr_line >>= CHV_PADCTRL0_INTSEL_SHIFT;
- 	chv_writel(BIT(intr_line), pctrl->regs + CHV_INTSTAT);
- 
--	raw_spin_unlock(&pctrl->lock);
-+	raw_spin_unlock(&chv_lock);
- }
- 
- static void chv_gpio_irq_mask_unmask(struct irq_data *d, bool mask)
-@@ -1260,7 +1269,7 @@ static void chv_gpio_irq_mask_unmask(struct irq_data *d, bool mask)
- 	u32 value, intr_line;
- 	unsigned long flags;
- 
--	raw_spin_lock_irqsave(&pctrl->lock, flags);
-+	raw_spin_lock_irqsave(&chv_lock, flags);
- 
- 	intr_line = readl(chv_padreg(pctrl, pin, CHV_PADCTRL0));
- 	intr_line &= CHV_PADCTRL0_INTSEL_MASK;
-@@ -1273,7 +1282,7 @@ static void chv_gpio_irq_mask_unmask(struct irq_data *d, bool mask)
- 		value |= BIT(intr_line);
- 	chv_writel(value, pctrl->regs + CHV_INTMASK);
- 
--	raw_spin_unlock_irqrestore(&pctrl->lock, flags);
-+	raw_spin_unlock_irqrestore(&chv_lock, flags);
- }
- 
- static void chv_gpio_irq_mask(struct irq_data *d)
-@@ -1307,7 +1316,7 @@ static unsigned chv_gpio_irq_startup(struct irq_data *d)
- 		unsigned long flags;
- 		u32 intsel, value;
- 
--		raw_spin_lock_irqsave(&pctrl->lock, flags);
-+		raw_spin_lock_irqsave(&chv_lock, flags);
- 		intsel = readl(chv_padreg(pctrl, pin, CHV_PADCTRL0));
- 		intsel &= CHV_PADCTRL0_INTSEL_MASK;
- 		intsel >>= CHV_PADCTRL0_INTSEL_SHIFT;
-@@ -1322,7 +1331,7 @@ static unsigned chv_gpio_irq_startup(struct irq_data *d)
- 			irq_set_handler_locked(d, handler);
- 			pctrl->intr_lines[intsel] = offset;
- 		}
--		raw_spin_unlock_irqrestore(&pctrl->lock, flags);
-+		raw_spin_unlock_irqrestore(&chv_lock, flags);
- 	}
- 
- 	chv_gpio_irq_unmask(d);
-@@ -1338,7 +1347,7 @@ static int chv_gpio_irq_type(struct irq_data *d, unsigned type)
- 	unsigned long flags;
- 	u32 value;
- 
--	raw_spin_lock_irqsave(&pctrl->lock, flags);
-+	raw_spin_lock_irqsave(&chv_lock, flags);
- 
- 	/*
- 	 * Pins which can be used as shared interrupt are configured in
-@@ -1387,7 +1396,7 @@ static int chv_gpio_irq_type(struct irq_data *d, unsigned type)
- 	else if (type & IRQ_TYPE_LEVEL_MASK)
- 		irq_set_handler_locked(d, handle_level_irq);
- 
--	raw_spin_unlock_irqrestore(&pctrl->lock, flags);
-+	raw_spin_unlock_irqrestore(&chv_lock, flags);
- 
- 	return 0;
- }
-@@ -1499,7 +1508,6 @@ static int chv_pinctrl_probe(struct platform_device *pdev)
- 	if (i == ARRAY_SIZE(chv_communities))
- 		return -ENODEV;
- 
--	raw_spin_lock_init(&pctrl->lock);
- 	pctrl->dev = &pdev->dev;
- 
- #ifdef CONFIG_PM_SLEEP
-diff --git a/drivers/platform/x86/hp-wmi.c b/drivers/platform/x86/hp-wmi.c
-index 6f145f2..96ffda4 100644
---- a/drivers/platform/x86/hp-wmi.c
-+++ b/drivers/platform/x86/hp-wmi.c
-@@ -718,6 +718,11 @@ static int __init hp_wmi_rfkill_setup(struct platform_device *device)
- 	if (err)
- 		return err;
- 
-+	err = hp_wmi_perform_query(HPWMI_WIRELESS_QUERY, 1, &wireless,
-+				   sizeof(wireless), 0);
-+	if (err)
-+		return err;
-+
- 	if (wireless & 0x1) {
- 		wifi_rfkill = rfkill_alloc("hp-wifi", &device->dev,
- 					   RFKILL_TYPE_WLAN,
-@@ -882,7 +887,7 @@ static int __init hp_wmi_bios_setup(struct platform_device *device)
- 	wwan_rfkill = NULL;
- 	rfkill2_count = 0;
- 
--	if (hp_wmi_bios_2009_later() || hp_wmi_rfkill_setup(device))
-+	if (hp_wmi_rfkill_setup(device))
- 		hp_wmi_rfkill2_setup(device);
- 
- 	err = device_create_file(&device->dev, &dev_attr_display);
-diff --git a/drivers/regulator/s2mps11.c b/drivers/regulator/s2mps11.c
-index 02fb6b4..d838e77 100644
---- a/drivers/regulator/s2mps11.c
-+++ b/drivers/regulator/s2mps11.c
-@@ -750,7 +750,7 @@ static const struct regulator_linear_range s2mps15_ldo_voltage_ranges3[] = {
- 
- /* voltage range for s2mps15 LDO 7, 8, 9 and 10 */
- static const struct regulator_linear_range s2mps15_ldo_voltage_ranges4[] = {
--	REGULATOR_LINEAR_RANGE(700000, 0xc, 0x18, 25000),
-+	REGULATOR_LINEAR_RANGE(700000, 0x10, 0x20, 25000),
- };
- 
- /* voltage range for s2mps15 LDO 1 */
-@@ -760,12 +760,12 @@ static const struct regulator_linear_range s2mps15_ldo_voltage_ranges5[] = {
- 
- /* voltage range for s2mps15 BUCK 1, 2, 3, 4, 5, 6 and 7 */
- static const struct regulator_linear_range s2mps15_buck_voltage_ranges1[] = {
--	REGULATOR_LINEAR_RANGE(500000, 0x20, 0xb0, 6250),
-+	REGULATOR_LINEAR_RANGE(500000, 0x20, 0xc0, 6250),
- };
- 
- /* voltage range for s2mps15 BUCK 8, 9 and 10 */
- static const struct regulator_linear_range s2mps15_buck_voltage_ranges2[] = {
--	REGULATOR_LINEAR_RANGE(1000000, 0x20, 0xc0, 12500),
-+	REGULATOR_LINEAR_RANGE(1000000, 0x20, 0x78, 12500),
- };
- 
- static const struct regulator_desc s2mps15_regulators[] = {
-diff --git a/drivers/remoteproc/remoteproc_core.c b/drivers/remoteproc/remoteproc_core.c
-index db3958b..fe0539e 100644
---- a/drivers/remoteproc/remoteproc_core.c
-+++ b/drivers/remoteproc/remoteproc_core.c
-@@ -1264,11 +1264,6 @@ int rproc_add(struct rproc *rproc)
- 	if (ret < 0)
- 		return ret;
- 
--	/* expose to rproc_get_by_phandle users */
--	mutex_lock(&rproc_list_mutex);
--	list_add(&rproc->node, &rproc_list);
--	mutex_unlock(&rproc_list_mutex);
--
- 	dev_info(dev, "%s is available\n", rproc->name);
- 
- 	dev_info(dev, "Note: remoteproc is still under development and considered experimental.\n");
-@@ -1276,8 +1271,16 @@ int rproc_add(struct rproc *rproc)
- 
- 	/* create debugfs entries */
- 	rproc_create_debug_dir(rproc);
-+	ret = rproc_add_virtio_devices(rproc);
-+	if (ret < 0)
-+		return ret;
- 
--	return rproc_add_virtio_devices(rproc);
-+	/* expose to rproc_get_by_phandle users */
-+	mutex_lock(&rproc_list_mutex);
-+	list_add(&rproc->node, &rproc_list);
-+	mutex_unlock(&rproc_list_mutex);
-+
-+	return 0;
- }
- EXPORT_SYMBOL(rproc_add);
- 
-diff --git a/drivers/rtc/rtc-s3c.c b/drivers/rtc/rtc-s3c.c
-index d01ad7e..4e823c4 100644
---- a/drivers/rtc/rtc-s3c.c
-+++ b/drivers/rtc/rtc-s3c.c
-@@ -149,12 +149,14 @@ static int s3c_rtc_setfreq(struct s3c_rtc *info, int freq)
- 	if (!is_power_of_2(freq))
- 		return -EINVAL;
- 
-+	s3c_rtc_enable_clk(info);
- 	spin_lock_irq(&info->pie_lock);
- 
- 	if (info->data->set_freq)
- 		info->data->set_freq(info, freq);
- 
- 	spin_unlock_irq(&info->pie_lock);
-+	s3c_rtc_disable_clk(info);
- 
- 	return 0;
- }
-diff --git a/drivers/s390/cio/cmf.c b/drivers/s390/cio/cmf.c
-index b2afad5..2a34eb5 100644
---- a/drivers/s390/cio/cmf.c
-+++ b/drivers/s390/cio/cmf.c
-@@ -753,6 +753,17 @@ static void reset_cmb(struct ccw_device *cdev)
- 	cmf_generic_reset(cdev);
- }
- 
-+static int cmf_enabled(struct ccw_device *cdev)
-+{
-+	int enabled;
-+
-+	spin_lock_irq(cdev->ccwlock);
-+	enabled = !!cdev->private->cmb;
-+	spin_unlock_irq(cdev->ccwlock);
-+
-+	return enabled;
-+}
-+
- static struct attribute_group cmf_attr_group;
- 
- static struct cmb_operations cmbops_basic = {
-@@ -1153,13 +1164,8 @@ static ssize_t cmb_enable_show(struct device *dev,
- 			       char *buf)
- {
- 	struct ccw_device *cdev = to_ccwdev(dev);
--	int enabled;
- 
--	spin_lock_irq(cdev->ccwlock);
--	enabled = !!cdev->private->cmb;
--	spin_unlock_irq(cdev->ccwlock);
--
--	return sprintf(buf, "%d\n", enabled);
-+	return sprintf(buf, "%d\n", cmf_enabled(cdev));
- }
- 
- static ssize_t cmb_enable_store(struct device *dev,
-@@ -1199,15 +1205,20 @@ int ccw_set_cmf(struct ccw_device *cdev, int enable)
-  *  @cdev:	The ccw device to be enabled
-  *
-  *  Returns %0 for success or a negative error value.
-- *
-+ *  Note: If this is called on a device for which channel measurement is already
-+ *	  enabled a reset of the measurement data is triggered.
-  *  Context:
-  *    non-atomic
-  */
- int enable_cmf(struct ccw_device *cdev)
- {
--	int ret;
-+	int ret = 0;
- 
- 	device_lock(&cdev->dev);
-+	if (cmf_enabled(cdev)) {
-+		cmbops->reset(cdev);
-+		goto out_unlock;
-+	}
- 	get_device(&cdev->dev);
- 	ret = cmbops->alloc(cdev);
- 	if (ret)
-@@ -1226,7 +1237,7 @@ int enable_cmf(struct ccw_device *cdev)
- out:
- 	if (ret)
- 		put_device(&cdev->dev);
--
-+out_unlock:
- 	device_unlock(&cdev->dev);
- 	return ret;
- }
-diff --git a/drivers/scsi/lpfc/lpfc_scsi.c b/drivers/scsi/lpfc/lpfc_scsi.c
-index 3bd0be6..c7e5695 100644
---- a/drivers/scsi/lpfc/lpfc_scsi.c
-+++ b/drivers/scsi/lpfc/lpfc_scsi.c
-@@ -3874,7 +3874,7 @@ int lpfc_sli4_scmd_to_wqidx_distr(struct lpfc_hba *phba,
- 	uint32_t tag;
- 	uint16_t hwq;
- 
--	if (shost_use_blk_mq(cmnd->device->host)) {
-+	if (cmnd && shost_use_blk_mq(cmnd->device->host)) {
- 		tag = blk_mq_unique_tag(cmnd->request);
- 		hwq = blk_mq_unique_tag_to_hwq(tag);
- 
-diff --git a/drivers/scsi/megaraid/megaraid_sas_base.c b/drivers/scsi/megaraid/megaraid_sas_base.c
-index f4b0690..2dab3dc 100644
---- a/drivers/scsi/megaraid/megaraid_sas_base.c
-+++ b/drivers/scsi/megaraid/megaraid_sas_base.c
-@@ -4079,6 +4079,12 @@ megasas_get_pd_list(struct megasas_instance *instance)
- 	struct MR_PD_ADDRESS *pd_addr;
- 	dma_addr_t ci_h = 0;
- 
-+	if (instance->pd_list_not_supported) {
-+		dev_info(&instance->pdev->dev, "MR_DCMD_PD_LIST_QUERY "
-+		"not supported by firmware\n");
-+		return ret;
-+	}
-+
- 	cmd = megasas_get_cmd(instance);
- 
- 	if (!cmd) {
-diff --git a/drivers/soc/qcom/smp2p.c b/drivers/soc/qcom/smp2p.c
-index f1eed7f..9c2788b 100644
---- a/drivers/soc/qcom/smp2p.c
-+++ b/drivers/soc/qcom/smp2p.c
-@@ -344,11 +344,12 @@ static int qcom_smp2p_outbound_entry(struct qcom_smp2p *smp2p,
- 	/* Allocate an entry from the smem item */
- 	strlcpy(buf, entry->name, SMP2P_MAX_ENTRY_NAME);
- 	memcpy_toio(out->entries[out->valid_entries].name, buf, SMP2P_MAX_ENTRY_NAME);
--	out->valid_entries++;
- 
- 	/* Make the logical entry reference the physical value */
- 	entry->value = &out->entries[out->valid_entries].value;
- 
-+	out->valid_entries++;
-+
- 	entry->state = qcom_smem_state_register(node, &smp2p_state_ops, entry);
- 	if (IS_ERR(entry->state)) {
- 		dev_err(smp2p->dev, "failed to register qcom_smem_state\n");
-diff --git a/drivers/spi/spi-pxa2xx.c b/drivers/spi/spi-pxa2xx.c
-index fe07c05..daf2844 100644
---- a/drivers/spi/spi-pxa2xx.c
-+++ b/drivers/spi/spi-pxa2xx.c
-@@ -585,7 +585,14 @@ static void reset_sccr1(struct driver_data *drv_data)
- 	u32 sccr1_reg;
- 
- 	sccr1_reg = pxa2xx_spi_read(drv_data, SSCR1) & ~drv_data->int_cr1;
--	sccr1_reg &= ~SSCR1_RFT;
-+	switch (drv_data->ssp_type) {
-+	case QUARK_X1000_SSP:
-+		sccr1_reg &= ~QUARK_X1000_SSCR1_RFT;
-+		break;
-+	default:
-+		sccr1_reg &= ~SSCR1_RFT;
-+		break;
-+	}
- 	sccr1_reg |= chip->threshold;
- 	pxa2xx_spi_write(drv_data, SSCR1, sccr1_reg);
- }
-diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c
-index 50f3d3a..39b928c 100644
---- a/drivers/target/iscsi/iscsi_target.c
-+++ b/drivers/target/iscsi/iscsi_target.c
-@@ -492,7 +492,8 @@ void iscsit_aborted_task(struct iscsi_conn *conn, struct iscsi_cmd *cmd)
- 	bool scsi_cmd = (cmd->iscsi_opcode == ISCSI_OP_SCSI_CMD);
- 
- 	spin_lock_bh(&conn->cmd_lock);
--	if (!list_empty(&cmd->i_conn_node))
-+	if (!list_empty(&cmd->i_conn_node) &&
-+	    !(cmd->se_cmd.transport_state & CMD_T_FABRIC_STOP))
- 		list_del_init(&cmd->i_conn_node);
- 	spin_unlock_bh(&conn->cmd_lock);
- 
-@@ -4034,6 +4035,7 @@ int iscsi_target_rx_thread(void *arg)
- 
- static void iscsit_release_commands_from_conn(struct iscsi_conn *conn)
- {
-+	LIST_HEAD(tmp_list);
- 	struct iscsi_cmd *cmd = NULL, *cmd_tmp = NULL;
- 	struct iscsi_session *sess = conn->sess;
- 	/*
-@@ -4042,18 +4044,26 @@ static void iscsit_release_commands_from_conn(struct iscsi_conn *conn)
- 	 * has been reset -> returned sleeping pre-handler state.
- 	 */
- 	spin_lock_bh(&conn->cmd_lock);
--	list_for_each_entry_safe(cmd, cmd_tmp, &conn->conn_cmd_list, i_conn_node) {
-+	list_splice_init(&conn->conn_cmd_list, &tmp_list);
- 
-+	list_for_each_entry(cmd, &tmp_list, i_conn_node) {
-+		struct se_cmd *se_cmd = &cmd->se_cmd;
-+
-+		if (se_cmd->se_tfo != NULL) {
-+			spin_lock(&se_cmd->t_state_lock);
-+			se_cmd->transport_state |= CMD_T_FABRIC_STOP;
-+			spin_unlock(&se_cmd->t_state_lock);
-+		}
-+	}
-+	spin_unlock_bh(&conn->cmd_lock);
-+
-+	list_for_each_entry_safe(cmd, cmd_tmp, &tmp_list, i_conn_node) {
- 		list_del_init(&cmd->i_conn_node);
--		spin_unlock_bh(&conn->cmd_lock);
- 
- 		iscsit_increment_maxcmdsn(cmd, sess);
--
- 		iscsit_free_cmd(cmd, true);
- 
--		spin_lock_bh(&conn->cmd_lock);
- 	}
--	spin_unlock_bh(&conn->cmd_lock);
- }
- 
- static void iscsit_stop_timers_for_cmds(
-diff --git a/drivers/target/iscsi/iscsi_target_login.c b/drivers/target/iscsi/iscsi_target_login.c
-index b5212f0..adf419f 100644
---- a/drivers/target/iscsi/iscsi_target_login.c
-+++ b/drivers/target/iscsi/iscsi_target_login.c
-@@ -1371,8 +1371,9 @@ static int __iscsi_target_login_thread(struct iscsi_np *np)
- 	}
- 	login->zero_tsih = zero_tsih;
- 
--	conn->sess->se_sess->sup_prot_ops =
--		conn->conn_transport->iscsit_get_sup_prot_ops(conn);
-+	if (conn->sess)
-+		conn->sess->se_sess->sup_prot_ops =
-+			conn->conn_transport->iscsit_get_sup_prot_ops(conn);
- 
- 	tpg = conn->tpg;
- 	if (!tpg) {
-diff --git a/drivers/target/target_core_device.c b/drivers/target/target_core_device.c
-index a4046ca..6b42348 100644
---- a/drivers/target/target_core_device.c
-+++ b/drivers/target/target_core_device.c
-@@ -821,13 +821,15 @@ struct se_device *target_alloc_device(struct se_hba *hba, const char *name)
-  * in ATA and we need to set TPE=1
-  */
- bool target_configure_unmap_from_queue(struct se_dev_attrib *attrib,
--				       struct request_queue *q, int block_size)
-+				       struct request_queue *q)
- {
-+	int block_size = queue_logical_block_size(q);
-+
- 	if (!blk_queue_discard(q))
- 		return false;
- 
--	attrib->max_unmap_lba_count = (q->limits.max_discard_sectors << 9) /
--								block_size;
-+	attrib->max_unmap_lba_count =
-+		q->limits.max_discard_sectors >> (ilog2(block_size) - 9);
- 	/*
- 	 * Currently hardcoded to 1 in Linux/SCSI code..
- 	 */
-diff --git a/drivers/target/target_core_file.c b/drivers/target/target_core_file.c
-index 75f0f08..7929186 100644
---- a/drivers/target/target_core_file.c
-+++ b/drivers/target/target_core_file.c
-@@ -161,8 +161,7 @@ static int fd_configure_device(struct se_device *dev)
- 			dev_size, div_u64(dev_size, fd_dev->fd_block_size),
- 			fd_dev->fd_block_size);
- 
--		if (target_configure_unmap_from_queue(&dev->dev_attrib, q,
--						      fd_dev->fd_block_size))
-+		if (target_configure_unmap_from_queue(&dev->dev_attrib, q))
- 			pr_debug("IFILE: BLOCK Discard support available,"
- 				 " disabled by default\n");
- 		/*
-diff --git a/drivers/target/target_core_iblock.c b/drivers/target/target_core_iblock.c
-index 7c4efb4..2077bc2 100644
---- a/drivers/target/target_core_iblock.c
-+++ b/drivers/target/target_core_iblock.c
-@@ -121,8 +121,7 @@ static int iblock_configure_device(struct se_device *dev)
- 	dev->dev_attrib.hw_max_sectors = queue_max_hw_sectors(q);
- 	dev->dev_attrib.hw_queue_depth = q->nr_requests;
- 
--	if (target_configure_unmap_from_queue(&dev->dev_attrib, q,
--					      dev->dev_attrib.hw_block_size))
-+	if (target_configure_unmap_from_queue(&dev->dev_attrib, q))
- 		pr_debug("IBLOCK: BLOCK Discard support available,"
- 			 " disabled by default\n");
- 
-diff --git a/drivers/target/target_core_internal.h b/drivers/target/target_core_internal.h
-index fc91e85..e2c970a 100644
---- a/drivers/target/target_core_internal.h
-+++ b/drivers/target/target_core_internal.h
-@@ -146,6 +146,7 @@ sense_reason_t	target_cmd_size_check(struct se_cmd *cmd, unsigned int size);
- void	target_qf_do_work(struct work_struct *work);
- bool	target_check_wce(struct se_device *dev);
- bool	target_check_fua(struct se_device *dev);
-+void	__target_execute_cmd(struct se_cmd *, bool);
- 
- /* target_core_stat.c */
- void	target_stat_setup_dev_default_groups(struct se_device *);
-diff --git a/drivers/target/target_core_sbc.c b/drivers/target/target_core_sbc.c
-index a9057aa..04f616b 100644
---- a/drivers/target/target_core_sbc.c
-+++ b/drivers/target/target_core_sbc.c
-@@ -602,7 +602,7 @@ static sense_reason_t compare_and_write_callback(struct se_cmd *cmd, bool succes
- 	cmd->transport_state |= CMD_T_ACTIVE|CMD_T_BUSY|CMD_T_SENT;
- 	spin_unlock_irq(&cmd->t_state_lock);
- 
--	__target_execute_cmd(cmd);
-+	__target_execute_cmd(cmd, false);
- 
- 	kfree(buf);
- 	return ret;
-diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c
-index 5ab3967..42c2a44 100644
---- a/drivers/target/target_core_transport.c
-+++ b/drivers/target/target_core_transport.c
-@@ -1303,23 +1303,6 @@ target_setup_cmd_from_cdb(struct se_cmd *cmd, unsigned char *cdb)
- 
- 	trace_target_sequencer_start(cmd);
- 
--	/*
--	 * Check for an existing UNIT ATTENTION condition
--	 */
--	ret = target_scsi3_ua_check(cmd);
--	if (ret)
--		return ret;
--
--	ret = target_alua_state_check(cmd);
--	if (ret)
--		return ret;
--
--	ret = target_check_reservation(cmd);
--	if (ret) {
--		cmd->scsi_status = SAM_STAT_RESERVATION_CONFLICT;
--		return ret;
--	}
--
- 	ret = dev->transport->parse_cdb(cmd);
- 	if (ret == TCM_UNSUPPORTED_SCSI_OPCODE)
- 		pr_warn_ratelimited("%s/%s: Unsupported SCSI Opcode 0x%02x, sending CHECK_CONDITION.\n",
-@@ -1761,20 +1744,45 @@ queue_full:
- }
- EXPORT_SYMBOL(transport_generic_request_failure);
- 
--void __target_execute_cmd(struct se_cmd *cmd)
-+void __target_execute_cmd(struct se_cmd *cmd, bool do_checks)
- {
- 	sense_reason_t ret;
- 
--	if (cmd->execute_cmd) {
--		ret = cmd->execute_cmd(cmd);
--		if (ret) {
--			spin_lock_irq(&cmd->t_state_lock);
--			cmd->transport_state &= ~(CMD_T_BUSY|CMD_T_SENT);
--			spin_unlock_irq(&cmd->t_state_lock);
-+	if (!cmd->execute_cmd) {
-+		ret = TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE;
-+		goto err;
-+	}
-+	if (do_checks) {
-+		/*
-+		 * Check for an existing UNIT ATTENTION condition after
-+		 * target_handle_task_attr() has done SAM task attr
-+		 * checking, and possibly have already defered execution
-+		 * out to target_restart_delayed_cmds() context.
-+		 */
-+		ret = target_scsi3_ua_check(cmd);
-+		if (ret)
-+			goto err;
-+
-+		ret = target_alua_state_check(cmd);
-+		if (ret)
-+			goto err;
- 
--			transport_generic_request_failure(cmd, ret);
-+		ret = target_check_reservation(cmd);
-+		if (ret) {
-+			cmd->scsi_status = SAM_STAT_RESERVATION_CONFLICT;
-+			goto err;
- 		}
- 	}
-+
-+	ret = cmd->execute_cmd(cmd);
-+	if (!ret)
-+		return;
-+err:
-+	spin_lock_irq(&cmd->t_state_lock);
-+	cmd->transport_state &= ~(CMD_T_BUSY|CMD_T_SENT);
-+	spin_unlock_irq(&cmd->t_state_lock);
-+
-+	transport_generic_request_failure(cmd, ret);
- }
- 
- static int target_write_prot_action(struct se_cmd *cmd)
-@@ -1819,6 +1827,8 @@ static bool target_handle_task_attr(struct se_cmd *cmd)
- 	if (dev->transport->transport_flags & TRANSPORT_FLAG_PASSTHROUGH)
- 		return false;
- 
-+	cmd->se_cmd_flags |= SCF_TASK_ATTR_SET;
-+
- 	/*
- 	 * Check for the existence of HEAD_OF_QUEUE, and if true return 1
- 	 * to allow the passed struct se_cmd list of tasks to the front of the list.
-@@ -1899,7 +1909,7 @@ void target_execute_cmd(struct se_cmd *cmd)
- 		return;
- 	}
- 
--	__target_execute_cmd(cmd);
-+	__target_execute_cmd(cmd, true);
- }
- EXPORT_SYMBOL(target_execute_cmd);
- 
-@@ -1923,7 +1933,7 @@ static void target_restart_delayed_cmds(struct se_device *dev)
- 		list_del(&cmd->se_delayed_node);
- 		spin_unlock(&dev->delayed_cmd_lock);
- 
--		__target_execute_cmd(cmd);
-+		__target_execute_cmd(cmd, true);
- 
- 		if (cmd->sam_task_attr == TCM_ORDERED_TAG)
- 			break;
-@@ -1941,6 +1951,9 @@ static void transport_complete_task_attr(struct se_cmd *cmd)
- 	if (dev->transport->transport_flags & TRANSPORT_FLAG_PASSTHROUGH)
- 		return;
- 
-+	if (!(cmd->se_cmd_flags & SCF_TASK_ATTR_SET))
-+		goto restart;
-+
- 	if (cmd->sam_task_attr == TCM_SIMPLE_TAG) {
- 		atomic_dec_mb(&dev->simple_cmds);
- 		dev->dev_cur_ordered_id++;
-@@ -1957,7 +1970,7 @@ static void transport_complete_task_attr(struct se_cmd *cmd)
- 		pr_debug("Incremented dev_cur_ordered_id: %u for ORDERED\n",
- 			 dev->dev_cur_ordered_id);
- 	}
--
-+restart:
- 	target_restart_delayed_cmds(dev);
- }
- 
-@@ -2557,15 +2570,10 @@ static void target_release_cmd_kref(struct kref *kref)
- 	bool fabric_stop;
- 
- 	spin_lock_irqsave(&se_sess->sess_cmd_lock, flags);
--	if (list_empty(&se_cmd->se_cmd_list)) {
--		spin_unlock_irqrestore(&se_sess->sess_cmd_lock, flags);
--		target_free_cmd_mem(se_cmd);
--		se_cmd->se_tfo->release_cmd(se_cmd);
--		return;
--	}
- 
- 	spin_lock(&se_cmd->t_state_lock);
--	fabric_stop = (se_cmd->transport_state & CMD_T_FABRIC_STOP);
-+	fabric_stop = (se_cmd->transport_state & CMD_T_FABRIC_STOP) &&
-+		      (se_cmd->transport_state & CMD_T_ABORTED);
- 	spin_unlock(&se_cmd->t_state_lock);
- 
- 	if (se_cmd->cmd_wait_set || fabric_stop) {
-diff --git a/drivers/tty/serial/atmel_serial.c b/drivers/tty/serial/atmel_serial.c
-index 954941d..f9c798c 100644
---- a/drivers/tty/serial/atmel_serial.c
-+++ b/drivers/tty/serial/atmel_serial.c
-@@ -482,19 +482,21 @@ static void atmel_start_tx(struct uart_port *port)
- {
- 	struct atmel_uart_port *atmel_port = to_atmel_uart_port(port);
- 
--	if (atmel_use_pdc_tx(port)) {
--		if (atmel_uart_readl(port, ATMEL_PDC_PTSR) & ATMEL_PDC_TXTEN)
--			/* The transmitter is already running.  Yes, we
--			   really need this.*/
--			return;
-+	if (atmel_use_pdc_tx(port) && (atmel_uart_readl(port, ATMEL_PDC_PTSR)
-+				       & ATMEL_PDC_TXTEN))
-+		/* The transmitter is already running.  Yes, we
-+		   really need this.*/
-+		return;
- 
-+	if (atmel_use_pdc_tx(port) || atmel_use_dma_tx(port))
- 		if ((port->rs485.flags & SER_RS485_ENABLED) &&
- 		    !(port->rs485.flags & SER_RS485_RX_DURING_TX))
- 			atmel_stop_rx(port);
- 
-+	if (atmel_use_pdc_tx(port))
- 		/* re-enable PDC transmit */
- 		atmel_uart_writel(port, ATMEL_PDC_PTCR, ATMEL_PDC_TXTEN);
--	}
-+
- 	/* Enable interrupts */
- 	atmel_uart_writel(port, ATMEL_US_IER, atmel_port->tx_done_mask);
- }
-diff --git a/drivers/tty/serial/msm_serial.c b/drivers/tty/serial/msm_serial.c
-index b7d80bd..7d62610 100644
---- a/drivers/tty/serial/msm_serial.c
-+++ b/drivers/tty/serial/msm_serial.c
-@@ -726,7 +726,7 @@ static void msm_handle_tx(struct uart_port *port)
- 		return;
- 	}
- 
--	pio_count = CIRC_CNT(xmit->head, xmit->tail, UART_XMIT_SIZE);
-+	pio_count = CIRC_CNT_TO_END(xmit->head, xmit->tail, UART_XMIT_SIZE);
- 	dma_count = CIRC_CNT_TO_END(xmit->head, xmit->tail, UART_XMIT_SIZE);
- 
- 	dma_min = 1;	/* Always DMA */
-diff --git a/drivers/tty/serial/samsung.c b/drivers/tty/serial/samsung.c
-index 99bb231..f0bd2ec 100644
---- a/drivers/tty/serial/samsung.c
-+++ b/drivers/tty/serial/samsung.c
-@@ -1684,7 +1684,7 @@ static int s3c24xx_serial_init_port(struct s3c24xx_uart_port *ourport,
- 		return -ENODEV;
- 
- 	if (port->mapbase != 0)
--		return 0;
-+		return -EINVAL;
- 
- 	/* setup info for port */
- 	port->dev	= &platdev->dev;
-@@ -1738,22 +1738,25 @@ static int s3c24xx_serial_init_port(struct s3c24xx_uart_port *ourport,
- 		ourport->dma = devm_kzalloc(port->dev,
- 					    sizeof(*ourport->dma),
- 					    GFP_KERNEL);
--		if (!ourport->dma)
--			return -ENOMEM;
-+		if (!ourport->dma) {
-+			ret = -ENOMEM;
-+			goto err;
-+		}
- 	}
- 
- 	ourport->clk	= clk_get(&platdev->dev, "uart");
- 	if (IS_ERR(ourport->clk)) {
- 		pr_err("%s: Controller clock not found\n",
- 				dev_name(&platdev->dev));
--		return PTR_ERR(ourport->clk);
-+		ret = PTR_ERR(ourport->clk);
-+		goto err;
- 	}
- 
- 	ret = clk_prepare_enable(ourport->clk);
- 	if (ret) {
- 		pr_err("uart: clock failed to prepare+enable: %d\n", ret);
- 		clk_put(ourport->clk);
--		return ret;
-+		goto err;
- 	}
- 
- 	/* Keep all interrupts masked and cleared */
-@@ -1769,7 +1772,12 @@ static int s3c24xx_serial_init_port(struct s3c24xx_uart_port *ourport,
- 
- 	/* reset the fifos (and setup the uart) */
- 	s3c24xx_serial_resetport(port, cfg);
-+
- 	return 0;
-+
-+err:
-+	port->mapbase = 0;
-+	return ret;
- }
- 
- /* Device driver serial port probe */
-diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c
-index 944a6dc..d2e50a2 100644
---- a/drivers/usb/core/quirks.c
-+++ b/drivers/usb/core/quirks.c
-@@ -128,6 +128,9 @@ static const struct usb_device_id usb_quirk_list[] = {
- 	{ USB_DEVICE(0x04f3, 0x016f), .driver_info =
- 			USB_QUIRK_DEVICE_QUALIFIER },
- 
-+	{ USB_DEVICE(0x04f3, 0x0381), .driver_info =
-+			USB_QUIRK_NO_LPM },
-+
- 	{ USB_DEVICE(0x04f3, 0x21b8), .driver_info =
- 			USB_QUIRK_DEVICE_QUALIFIER },
- 
-diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
-index 07248ff..716f4f0 100644
---- a/drivers/usb/dwc3/gadget.c
-+++ b/drivers/usb/dwc3/gadget.c
-@@ -258,11 +258,13 @@ int dwc3_send_gadget_ep_cmd(struct dwc3 *dwc, unsigned ep,
- 	 * We will also set SUSPHY bit to what it was before returning as stated
- 	 * by the same section on Synopsys databook.
- 	 */
--	reg = dwc3_readl(dwc->regs, DWC3_GUSB2PHYCFG(0));
--	if (unlikely(reg & DWC3_GUSB2PHYCFG_SUSPHY)) {
--		susphy = true;
--		reg &= ~DWC3_GUSB2PHYCFG_SUSPHY;
--		dwc3_writel(dwc->regs, DWC3_GUSB2PHYCFG(0), reg);
-+	if (dwc->gadget.speed <= USB_SPEED_HIGH) {
-+		reg = dwc3_readl(dwc->regs, DWC3_GUSB2PHYCFG(0));
-+		if (unlikely(reg & DWC3_GUSB2PHYCFG_SUSPHY)) {
-+			susphy = true;
-+			reg &= ~DWC3_GUSB2PHYCFG_SUSPHY;
-+			dwc3_writel(dwc->regs, DWC3_GUSB2PHYCFG(0), reg);
-+		}
- 	}
- 
- 	if (cmd == DWC3_DEPCMD_STARTTRANSFER) {
-@@ -2023,6 +2025,10 @@ static int dwc3_cleanup_done_reqs(struct dwc3 *dwc, struct dwc3_ep *dep,
- 		return 1;
- 	}
- 
-+	if (usb_endpoint_xfer_isoc(dep->endpoint.desc))
-+		if ((event->status & DEPEVT_STATUS_IOC) &&
-+				(trb->ctrl & DWC3_TRB_CTRL_IOC))
-+			return 0;
- 	return 1;
- }
- 
-diff --git a/drivers/usb/gadget/udc/atmel_usba_udc.c b/drivers/usb/gadget/udc/atmel_usba_udc.c
-index 18569de..bb1f6c8 100644
---- a/drivers/usb/gadget/udc/atmel_usba_udc.c
-+++ b/drivers/usb/gadget/udc/atmel_usba_udc.c
-@@ -1920,6 +1920,8 @@ static struct usba_ep * atmel_udc_of_init(struct platform_device *pdev,
- 
- 	udc->errata = match->data;
- 	udc->pmc = syscon_regmap_lookup_by_compatible("atmel,at91sam9g45-pmc");
-+	if (IS_ERR(udc->pmc))
-+		udc->pmc = syscon_regmap_lookup_by_compatible("atmel,at91sam9x5-pmc");
- 	if (udc->errata && IS_ERR(udc->pmc))
- 		return ERR_CAST(udc->pmc);
- 
-diff --git a/drivers/usb/gadget/udc/pch_udc.c b/drivers/usb/gadget/udc/pch_udc.c
-index ebc51ec..7175142 100644
---- a/drivers/usb/gadget/udc/pch_udc.c
-+++ b/drivers/usb/gadget/udc/pch_udc.c
-@@ -1477,11 +1477,11 @@ static void complete_req(struct pch_udc_ep *ep, struct pch_udc_request *req,
- 		req->dma_mapped = 0;
- 	}
- 	ep->halted = 1;
--	spin_lock(&dev->lock);
-+	spin_unlock(&dev->lock);
- 	if (!ep->in)
- 		pch_udc_ep_clear_rrdy(ep);
- 	usb_gadget_giveback_request(&ep->ep, &req->req);
--	spin_unlock(&dev->lock);
-+	spin_lock(&dev->lock);
- 	ep->halted = halted;
- }
- 
-@@ -2573,9 +2573,9 @@ static void pch_udc_svc_ur_interrupt(struct pch_udc_dev *dev)
- 		empty_req_queue(ep);
- 	}
- 	if (dev->driver) {
--		spin_lock(&dev->lock);
--		usb_gadget_udc_reset(&dev->gadget, dev->driver);
- 		spin_unlock(&dev->lock);
-+		usb_gadget_udc_reset(&dev->gadget, dev->driver);
-+		spin_lock(&dev->lock);
- 	}
- }
- 
-@@ -2654,9 +2654,9 @@ static void pch_udc_svc_intf_interrupt(struct pch_udc_dev *dev)
- 		dev->ep[i].halted = 0;
- 	}
- 	dev->stall = 0;
--	spin_lock(&dev->lock);
--	dev->driver->setup(&dev->gadget, &dev->setup_data);
- 	spin_unlock(&dev->lock);
-+	dev->driver->setup(&dev->gadget, &dev->setup_data);
-+	spin_lock(&dev->lock);
- }
- 
- /**
-@@ -2691,9 +2691,9 @@ static void pch_udc_svc_cfg_interrupt(struct pch_udc_dev *dev)
- 	dev->stall = 0;
- 
- 	/* call gadget zero with setup data received */
--	spin_lock(&dev->lock);
--	dev->driver->setup(&dev->gadget, &dev->setup_data);
- 	spin_unlock(&dev->lock);
-+	dev->driver->setup(&dev->gadget, &dev->setup_data);
-+	spin_lock(&dev->lock);
- }
- 
- /**
-diff --git a/drivers/usb/renesas_usbhs/fifo.c b/drivers/usb/renesas_usbhs/fifo.c
-index 7be4e7d..280ed5f 100644
---- a/drivers/usb/renesas_usbhs/fifo.c
-+++ b/drivers/usb/renesas_usbhs/fifo.c
-@@ -810,20 +810,27 @@ static void xfer_work(struct work_struct *work)
- {
- 	struct usbhs_pkt *pkt = container_of(work, struct usbhs_pkt, work);
- 	struct usbhs_pipe *pipe = pkt->pipe;
--	struct usbhs_fifo *fifo = usbhs_pipe_to_fifo(pipe);
-+	struct usbhs_fifo *fifo;
- 	struct usbhs_priv *priv = usbhs_pipe_to_priv(pipe);
- 	struct dma_async_tx_descriptor *desc;
--	struct dma_chan *chan = usbhsf_dma_chan_get(fifo, pkt);
-+	struct dma_chan *chan;
- 	struct device *dev = usbhs_priv_to_dev(priv);
- 	enum dma_transfer_direction dir;
-+	unsigned long flags;
- 
-+	usbhs_lock(priv, flags);
-+	fifo = usbhs_pipe_to_fifo(pipe);
-+	if (!fifo)
-+		goto xfer_work_end;
-+
-+	chan = usbhsf_dma_chan_get(fifo, pkt);
- 	dir = usbhs_pipe_is_dir_in(pipe) ? DMA_DEV_TO_MEM : DMA_MEM_TO_DEV;
- 
- 	desc = dmaengine_prep_slave_single(chan, pkt->dma + pkt->actual,
- 					pkt->trans, dir,
- 					DMA_PREP_INTERRUPT | DMA_CTRL_ACK);
- 	if (!desc)
--		return;
-+		goto xfer_work_end;
- 
- 	desc->callback		= usbhsf_dma_complete;
- 	desc->callback_param	= pipe;
-@@ -831,7 +838,7 @@ static void xfer_work(struct work_struct *work)
- 	pkt->cookie = dmaengine_submit(desc);
- 	if (pkt->cookie < 0) {
- 		dev_err(dev, "Failed to submit dma descriptor\n");
--		return;
-+		goto xfer_work_end;
- 	}
- 
- 	dev_dbg(dev, "  %s %d (%d/ %d)\n",
-@@ -842,6 +849,9 @@ static void xfer_work(struct work_struct *work)
- 	usbhs_pipe_set_trans_count_if_bulk(pipe, pkt->trans);
- 	dma_async_issue_pending(chan);
- 	usbhs_pipe_enable(pipe);
-+
-+xfer_work_end:
-+	usbhs_unlock(priv, flags);
- }
- 
- /*
-diff --git a/drivers/usb/renesas_usbhs/mod_gadget.c b/drivers/usb/renesas_usbhs/mod_gadget.c
-index 30345c2..50f3363 100644
---- a/drivers/usb/renesas_usbhs/mod_gadget.c
-+++ b/drivers/usb/renesas_usbhs/mod_gadget.c
-@@ -585,6 +585,9 @@ static int usbhsg_ep_enable(struct usb_ep *ep,
- 	struct usbhs_priv *priv = usbhsg_gpriv_to_priv(gpriv);
- 	struct usbhs_pipe *pipe;
- 	int ret = -EIO;
-+	unsigned long flags;
-+
-+	usbhs_lock(priv, flags);
- 
- 	/*
- 	 * if it already have pipe,
-@@ -593,7 +596,8 @@ static int usbhsg_ep_enable(struct usb_ep *ep,
- 	if (uep->pipe) {
- 		usbhs_pipe_clear(uep->pipe);
- 		usbhs_pipe_sequence_data0(uep->pipe);
--		return 0;
-+		ret = 0;
-+		goto usbhsg_ep_enable_end;
- 	}
- 
- 	pipe = usbhs_pipe_malloc(priv,
-@@ -621,6 +625,9 @@ static int usbhsg_ep_enable(struct usb_ep *ep,
- 		ret = 0;
- 	}
- 
-+usbhsg_ep_enable_end:
-+	usbhs_unlock(priv, flags);
-+
- 	return ret;
- }
- 
-diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
-index d96d423..8e07536 100644
---- a/drivers/usb/serial/option.c
-+++ b/drivers/usb/serial/option.c
-@@ -273,6 +273,7 @@ static void option_instat_callback(struct urb *urb);
- #define TELIT_PRODUCT_LE922_USBCFG5		0x1045
- #define TELIT_PRODUCT_LE920			0x1200
- #define TELIT_PRODUCT_LE910			0x1201
-+#define TELIT_PRODUCT_LE910_USBCFG4		0x1206
- 
- /* ZTE PRODUCTS */
- #define ZTE_VENDOR_ID				0x19d2
-@@ -1198,6 +1199,8 @@ static const struct usb_device_id option_ids[] = {
- 		.driver_info = (kernel_ulong_t)&telit_le922_blacklist_usbcfg0 },
- 	{ USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE910),
- 		.driver_info = (kernel_ulong_t)&telit_le910_blacklist },
-+	{ USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE910_USBCFG4),
-+		.driver_info = (kernel_ulong_t)&telit_le922_blacklist_usbcfg3 },
- 	{ USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE920),
- 		.driver_info = (kernel_ulong_t)&telit_le920_blacklist },
- 	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_MF622, 0xff, 0xff, 0xff) }, /* ZTE WCDMA products */
-diff --git a/drivers/virtio/virtio_balloon.c b/drivers/virtio/virtio_balloon.c
-index 476c0e3..f6ea8f4 100644
---- a/drivers/virtio/virtio_balloon.c
-+++ b/drivers/virtio/virtio_balloon.c
-@@ -202,6 +202,8 @@ static unsigned leak_balloon(struct virtio_balloon *vb, size_t num)
- 	num = min(num, ARRAY_SIZE(vb->pfns));
- 
- 	mutex_lock(&vb->balloon_lock);
-+	/* We can't release more pages than taken */
-+	num = min(num, (size_t)vb->num_pages);
- 	for (vb->num_pfns = 0; vb->num_pfns < num;
- 	     vb->num_pfns += VIRTIO_BALLOON_PAGES_PER_PAGE) {
- 		page = balloon_page_dequeue(vb_dev_info);
-diff --git a/drivers/w1/masters/omap_hdq.c b/drivers/w1/masters/omap_hdq.c
-index a2eec97..bb09de6 100644
---- a/drivers/w1/masters/omap_hdq.c
-+++ b/drivers/w1/masters/omap_hdq.c
-@@ -390,8 +390,6 @@ static int hdq_read_byte(struct hdq_data *hdq_data, u8 *val)
- 		goto out;
- 	}
- 
--	hdq_data->hdq_irqstatus = 0;
--
- 	if (!(hdq_data->hdq_irqstatus & OMAP_HDQ_INT_STATUS_RXCOMPLETE)) {
- 		hdq_reg_merge(hdq_data, OMAP_HDQ_CTRL_STATUS,
- 			OMAP_HDQ_CTRL_STATUS_DIR | OMAP_HDQ_CTRL_STATUS_GO,
-diff --git a/fs/btrfs/extent_io.c b/fs/btrfs/extent_io.c
-index 75533ad..92fe3f8 100644
---- a/fs/btrfs/extent_io.c
-+++ b/fs/btrfs/extent_io.c
-@@ -2696,12 +2696,6 @@ struct bio *btrfs_bio_clone(struct bio *bio, gfp_t gfp_mask)
- 		btrfs_bio->csum = NULL;
- 		btrfs_bio->csum_allocated = NULL;
- 		btrfs_bio->end_io = NULL;
--
--#ifdef CONFIG_BLK_CGROUP
--		/* FIXME, put this into bio_clone_bioset */
--		if (bio->bi_css)
--			bio_associate_blkcg(new, bio->bi_css);
--#endif
- 	}
- 	return new;
- }
-diff --git a/fs/btrfs/file.c b/fs/btrfs/file.c
-index 2234e88..b56887b 100644
---- a/fs/btrfs/file.c
-+++ b/fs/btrfs/file.c
-@@ -1629,13 +1629,11 @@ again:
- 		 * managed to copy.
- 		 */
- 		if (num_sectors > dirty_sectors) {
--			/*
--			 * we round down because we don't want to count
--			 * any partial blocks actually sent through the
--			 * IO machines
--			 */
--			release_bytes = round_down(release_bytes - copied,
--				      root->sectorsize);
-+
-+			/* release everything except the sectors we dirtied */
-+			release_bytes -= dirty_sectors <<
-+				root->fs_info->sb->s_blocksize_bits;
-+
- 			if (copied > 0) {
- 				spin_lock(&BTRFS_I(inode)->lock);
- 				BTRFS_I(inode)->outstanding_extents++;
-diff --git a/fs/cachefiles/namei.c b/fs/cachefiles/namei.c
-index 4ae7500..3f7c2cd 100644
---- a/fs/cachefiles/namei.c
-+++ b/fs/cachefiles/namei.c
-@@ -263,6 +263,8 @@ requeue:
- void cachefiles_mark_object_inactive(struct cachefiles_cache *cache,
- 				     struct cachefiles_object *object)
- {
-+	blkcnt_t i_blocks = d_backing_inode(object->dentry)->i_blocks;
-+
- 	write_lock(&cache->active_lock);
- 	rb_erase(&object->active_node, &cache->active_nodes);
- 	clear_bit(CACHEFILES_OBJECT_ACTIVE, &object->flags);
-@@ -273,8 +275,7 @@ void cachefiles_mark_object_inactive(struct cachefiles_cache *cache,
- 	/* This object can now be culled, so we need to let the daemon know
- 	 * that there is something it can remove if it needs to.
- 	 */
--	atomic_long_add(d_backing_inode(object->dentry)->i_blocks,
--			&cache->b_released);
-+	atomic_long_add(i_blocks, &cache->b_released);
- 	if (atomic_inc_return(&cache->f_released))
- 		cachefiles_state_changed(cache);
- }
-diff --git a/fs/cifs/cifs_fs_sb.h b/fs/cifs/cifs_fs_sb.h
-index 3182273..1418daa 100644
---- a/fs/cifs/cifs_fs_sb.h
-+++ b/fs/cifs/cifs_fs_sb.h
-@@ -46,6 +46,9 @@
- #define CIFS_MOUNT_CIFS_BACKUPUID 0x200000 /* backup intent bit for a user */
- #define CIFS_MOUNT_CIFS_BACKUPGID 0x400000 /* backup intent bit for a group */
- #define CIFS_MOUNT_MAP_SFM_CHR	0x800000 /* SFM/MAC mapping for illegal chars */
-+#define CIFS_MOUNT_USE_PREFIX_PATH 0x1000000 /* make subpath with unaccessible
-+					      * root mountable
-+					      */
- 
- struct cifs_sb_info {
- 	struct rb_root tlink_tree;
-@@ -67,5 +70,6 @@ struct cifs_sb_info {
- 	struct backing_dev_info bdi;
- 	struct delayed_work prune_tlinks;
- 	struct rcu_head rcu;
-+	char *prepath;
- };
- #endif				/* _CIFS_FS_SB_H */
-diff --git a/fs/cifs/cifsencrypt.c b/fs/cifs/cifsencrypt.c
-index 6aeb8d4..8347c90 100644
---- a/fs/cifs/cifsencrypt.c
-+++ b/fs/cifs/cifsencrypt.c
-@@ -743,24 +743,26 @@ setup_ntlmv2_rsp(struct cifs_ses *ses, const struct nls_table *nls_cp)
- 
- 	memcpy(ses->auth_key.response + baselen, tiblob, tilen);
- 
-+	mutex_lock(&ses->server->srv_mutex);
-+
- 	rc = crypto_hmacmd5_alloc(ses->server);
- 	if (rc) {
- 		cifs_dbg(VFS, "could not crypto alloc hmacmd5 rc %d\n", rc);
--		goto setup_ntlmv2_rsp_ret;
-+		goto unlock;
- 	}
- 
- 	/* calculate ntlmv2_hash */
- 	rc = calc_ntlmv2_hash(ses, ntlmv2_hash, nls_cp);
- 	if (rc) {
- 		cifs_dbg(VFS, "could not get v2 hash rc %d\n", rc);
--		goto setup_ntlmv2_rsp_ret;
-+		goto unlock;
- 	}
- 
- 	/* calculate first part of the client response (CR1) */
- 	rc = CalcNTLMv2_response(ses, ntlmv2_hash);
- 	if (rc) {
- 		cifs_dbg(VFS, "Could not calculate CR1 rc: %d\n", rc);
--		goto setup_ntlmv2_rsp_ret;
-+		goto unlock;
- 	}
- 
- 	/* now calculate the session key for NTLMv2 */
-@@ -769,13 +771,13 @@ setup_ntlmv2_rsp(struct cifs_ses *ses, const struct nls_table *nls_cp)
- 	if (rc) {
- 		cifs_dbg(VFS, "%s: Could not set NTLMV2 Hash as a key\n",
- 			 __func__);
--		goto setup_ntlmv2_rsp_ret;
-+		goto unlock;
- 	}
- 
- 	rc = crypto_shash_init(&ses->server->secmech.sdeschmacmd5->shash);
- 	if (rc) {
- 		cifs_dbg(VFS, "%s: Could not init hmacmd5\n", __func__);
--		goto setup_ntlmv2_rsp_ret;
-+		goto unlock;
- 	}
- 
- 	rc = crypto_shash_update(&ses->server->secmech.sdeschmacmd5->shash,
-@@ -783,7 +785,7 @@ setup_ntlmv2_rsp(struct cifs_ses *ses, const struct nls_table *nls_cp)
- 		CIFS_HMAC_MD5_HASH_SIZE);
- 	if (rc) {
- 		cifs_dbg(VFS, "%s: Could not update with response\n", __func__);
--		goto setup_ntlmv2_rsp_ret;
-+		goto unlock;
- 	}
- 
- 	rc = crypto_shash_final(&ses->server->secmech.sdeschmacmd5->shash,
-@@ -791,6 +793,8 @@ setup_ntlmv2_rsp(struct cifs_ses *ses, const struct nls_table *nls_cp)
- 	if (rc)
- 		cifs_dbg(VFS, "%s: Could not generate md5 hash\n", __func__);
- 
-+unlock:
-+	mutex_unlock(&ses->server->srv_mutex);
- setup_ntlmv2_rsp_ret:
- 	kfree(tiblob);
- 
-diff --git a/fs/cifs/cifsfs.c b/fs/cifs/cifsfs.c
-index 5d841f3..6bbec5e 100644
---- a/fs/cifs/cifsfs.c
-+++ b/fs/cifs/cifsfs.c
-@@ -689,6 +689,14 @@ cifs_do_mount(struct file_system_type *fs_type,
- 		goto out_cifs_sb;
- 	}
- 
-+	if (volume_info->prepath) {
-+		cifs_sb->prepath = kstrdup(volume_info->prepath, GFP_KERNEL);
-+		if (cifs_sb->prepath == NULL) {
-+			root = ERR_PTR(-ENOMEM);
-+			goto out_cifs_sb;
-+		}
-+	}
-+
- 	cifs_setup_cifs_sb(volume_info, cifs_sb);
- 
- 	rc = cifs_mount(cifs_sb, volume_info);
-@@ -727,7 +735,11 @@ cifs_do_mount(struct file_system_type *fs_type,
- 		sb->s_flags |= MS_ACTIVE;
- 	}
- 
--	root = cifs_get_root(volume_info, sb);
-+	if (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_USE_PREFIX_PATH)
-+		root = dget(sb->s_root);
-+	else
-+		root = cifs_get_root(volume_info, sb);
-+
- 	if (IS_ERR(root))
- 		goto out_super;
- 
-diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
-index 7d2b15c..7ae0328 100644
---- a/fs/cifs/connect.c
-+++ b/fs/cifs/connect.c
-@@ -1228,6 +1228,8 @@ cifs_parse_mount_options(const char *mountdata, const char *devname,
- 	vol->ops = &smb1_operations;
- 	vol->vals = &smb1_values;
- 
-+	vol->echo_interval = SMB_ECHO_INTERVAL_DEFAULT;
-+
- 	if (!mountdata)
- 		goto cifs_parse_mount_err;
- 
-@@ -2049,7 +2051,7 @@ static int match_server(struct TCP_Server_Info *server, struct smb_vol *vol)
- 	if (!match_security(server, vol))
- 		return 0;
- 
--	if (server->echo_interval != vol->echo_interval)
-+	if (server->echo_interval != vol->echo_interval * HZ)
- 		return 0;
- 
- 	return 1;
-@@ -3483,6 +3485,44 @@ cifs_get_volume_info(char *mount_data, const char *devname)
- 	return volume_info;
- }
- 
-+static int
-+cifs_are_all_path_components_accessible(struct TCP_Server_Info *server,
-+					unsigned int xid,
-+					struct cifs_tcon *tcon,
-+					struct cifs_sb_info *cifs_sb,
-+					char *full_path)
-+{
-+	int rc;
-+	char *s;
-+	char sep, tmp;
-+
-+	sep = CIFS_DIR_SEP(cifs_sb);
-+	s = full_path;
-+
-+	rc = server->ops->is_path_accessible(xid, tcon, cifs_sb, "");
-+	while (rc == 0) {
-+		/* skip separators */
-+		while (*s == sep)
-+			s++;
-+		if (!*s)
-+			break;
-+		/* next separator */
-+		while (*s && *s != sep)
-+			s++;
-+
-+		/*
-+		 * temporarily null-terminate the path at the end of
-+		 * the current component
-+		 */
-+		tmp = *s;
-+		*s = 0;
-+		rc = server->ops->is_path_accessible(xid, tcon, cifs_sb,
-+						     full_path);
-+		*s = tmp;
-+	}
-+	return rc;
-+}
-+
- int
- cifs_mount(struct cifs_sb_info *cifs_sb, struct smb_vol *volume_info)
- {
-@@ -3620,6 +3660,16 @@ remote_path_check:
- 			kfree(full_path);
- 			goto mount_fail_check;
- 		}
-+
-+		rc = cifs_are_all_path_components_accessible(server,
-+							     xid, tcon, cifs_sb,
-+							     full_path);
-+		if (rc != 0) {
-+			cifs_dbg(VFS, "cannot query dirs between root and final path, "
-+				 "enabling CIFS_MOUNT_USE_PREFIX_PATH\n");
-+			cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_USE_PREFIX_PATH;
-+			rc = 0;
-+		}
- 		kfree(full_path);
- 	}
- 
-@@ -3889,6 +3939,7 @@ cifs_umount(struct cifs_sb_info *cifs_sb)
- 
- 	bdi_destroy(&cifs_sb->bdi);
- 	kfree(cifs_sb->mountdata);
-+	kfree(cifs_sb->prepath);
- 	call_rcu(&cifs_sb->rcu, delayed_free);
- }
- 
-diff --git a/fs/cifs/dir.c b/fs/cifs/dir.c
-index fb0903f..6f7333d 100644
---- a/fs/cifs/dir.c
-+++ b/fs/cifs/dir.c
-@@ -84,6 +84,7 @@ build_path_from_dentry(struct dentry *direntry)
- 	struct dentry *temp;
- 	int namelen;
- 	int dfsplen;
-+	int pplen = 0;
- 	char *full_path;
- 	char dirsep;
- 	struct cifs_sb_info *cifs_sb = CIFS_SB(direntry->d_sb);
-@@ -95,8 +96,12 @@ build_path_from_dentry(struct dentry *direntry)
- 		dfsplen = strnlen(tcon->treeName, MAX_TREE_SIZE + 1);
- 	else
- 		dfsplen = 0;
-+
-+	if (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_USE_PREFIX_PATH)
-+		pplen = cifs_sb->prepath ? strlen(cifs_sb->prepath) + 1 : 0;
-+
- cifs_bp_rename_retry:
--	namelen = dfsplen;
-+	namelen = dfsplen + pplen;
- 	seq = read_seqbegin(&rename_lock);
- 	rcu_read_lock();
- 	for (temp = direntry; !IS_ROOT(temp);) {
-@@ -137,7 +142,7 @@ cifs_bp_rename_retry:
- 		}
- 	}
- 	rcu_read_unlock();
--	if (namelen != dfsplen || read_seqretry(&rename_lock, seq)) {
-+	if (namelen != dfsplen + pplen || read_seqretry(&rename_lock, seq)) {
- 		cifs_dbg(FYI, "did not end path lookup where expected. namelen=%ddfsplen=%d\n",
- 			 namelen, dfsplen);
- 		/* presumably this is only possible if racing with a rename
-@@ -153,6 +158,17 @@ cifs_bp_rename_retry:
- 	   those safely to '/' if any are found in the middle of the prepath */
- 	/* BB test paths to Windows with '/' in the midst of prepath */
- 
-+	if (pplen) {
-+		int i;
-+
-+		cifs_dbg(FYI, "using cifs_sb prepath <%s>\n", cifs_sb->prepath);
-+		memcpy(full_path+dfsplen+1, cifs_sb->prepath, pplen-1);
-+		full_path[dfsplen] = '\\';
-+		for (i = 0; i < pplen-1; i++)
-+			if (full_path[dfsplen+1+i] == '/')
-+				full_path[dfsplen+1+i] = CIFS_DIR_SEP(cifs_sb);
-+	}
-+
- 	if (dfsplen) {
- 		strncpy(full_path, tcon->treeName, dfsplen);
- 		if (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_POSIX_PATHS) {
-@@ -229,6 +245,13 @@ cifs_do_create(struct inode *inode, struct dentry *direntry, unsigned int xid,
- 				goto cifs_create_get_file_info;
- 			}
- 
-+			if (S_ISDIR(newinode->i_mode)) {
-+				CIFSSMBClose(xid, tcon, fid->netfid);
-+				iput(newinode);
-+				rc = -EISDIR;
-+				goto out;
-+			}
-+
- 			if (!S_ISREG(newinode->i_mode)) {
- 				/*
- 				 * The server may allow us to open things like
-@@ -399,10 +422,14 @@ cifs_create_set_dentry:
- 	if (rc != 0) {
- 		cifs_dbg(FYI, "Create worked, get_inode_info failed rc = %d\n",
- 			 rc);
--		if (server->ops->close)
--			server->ops->close(xid, tcon, fid);
--		goto out;
-+		goto out_err;
- 	}
-+
-+	if (S_ISDIR(newinode->i_mode)) {
-+		rc = -EISDIR;
-+		goto out_err;
-+	}
-+
- 	d_drop(direntry);
- 	d_add(direntry, newinode);
- 
-@@ -410,6 +437,13 @@ out:
- 	kfree(buf);
- 	kfree(full_path);
- 	return rc;
-+
-+out_err:
-+	if (server->ops->close)
-+		server->ops->close(xid, tcon, fid);
-+	if (newinode)
-+		iput(newinode);
-+	goto out;
- }
- 
- int
-diff --git a/fs/cifs/inode.c b/fs/cifs/inode.c
-index 514dadb..b87efd0 100644
---- a/fs/cifs/inode.c
-+++ b/fs/cifs/inode.c
-@@ -1002,10 +1002,26 @@ struct inode *cifs_root_iget(struct super_block *sb)
- 	struct inode *inode = NULL;
- 	long rc;
- 	struct cifs_tcon *tcon = cifs_sb_master_tcon(cifs_sb);
-+	char *path = NULL;
-+	int len;
-+
-+	if ((cifs_sb->mnt_cifs_flags & CIFS_MOUNT_USE_PREFIX_PATH)
-+	    && cifs_sb->prepath) {
-+		len = strlen(cifs_sb->prepath);
-+		path = kzalloc(len + 2 /* leading sep + null */, GFP_KERNEL);
-+		if (path == NULL)
-+			return ERR_PTR(-ENOMEM);
-+		path[0] = '/';
-+		memcpy(path+1, cifs_sb->prepath, len);
-+	} else {
-+		path = kstrdup("", GFP_KERNEL);
-+		if (path == NULL)
-+			return ERR_PTR(-ENOMEM);
-+	}
- 
- 	xid = get_xid();
- 	if (tcon->unix_ext) {
--		rc = cifs_get_inode_info_unix(&inode, "", sb, xid);
-+		rc = cifs_get_inode_info_unix(&inode, path, sb, xid);
- 		/* some servers mistakenly claim POSIX support */
- 		if (rc != -EOPNOTSUPP)
- 			goto iget_no_retry;
-@@ -1013,7 +1029,8 @@ struct inode *cifs_root_iget(struct super_block *sb)
- 		tcon->unix_ext = false;
- 	}
- 
--	rc = cifs_get_inode_info(&inode, "", NULL, sb, xid, NULL);
-+	convert_delimiter(path, CIFS_DIR_SEP(cifs_sb));
-+	rc = cifs_get_inode_info(&inode, path, NULL, sb, xid, NULL);
- 
- iget_no_retry:
- 	if (!inode) {
-@@ -1042,6 +1059,7 @@ iget_no_retry:
- 	}
- 
- out:
-+	kfree(path);
- 	/* can not call macro free_xid here since in a void func
- 	 * TODO: This is no longer true
- 	 */
-diff --git a/fs/cifs/smb2ops.c b/fs/cifs/smb2ops.c
-index 3525ed7..505e6d6 100644
---- a/fs/cifs/smb2ops.c
-+++ b/fs/cifs/smb2ops.c
-@@ -1044,6 +1044,9 @@ smb2_new_lease_key(struct cifs_fid *fid)
- 	get_random_bytes(fid->lease_key, SMB2_LEASE_KEY_SIZE);
- }
- 
-+#define SMB2_SYMLINK_STRUCT_SIZE \
-+	(sizeof(struct smb2_err_rsp) - 1 + sizeof(struct smb2_symlink_err_rsp))
-+
- static int
- smb2_query_symlink(const unsigned int xid, struct cifs_tcon *tcon,
- 		   const char *full_path, char **target_path,
-@@ -1056,7 +1059,10 @@ smb2_query_symlink(const unsigned int xid, struct cifs_tcon *tcon,
- 	struct cifs_fid fid;
- 	struct smb2_err_rsp *err_buf = NULL;
- 	struct smb2_symlink_err_rsp *symlink;
--	unsigned int sub_len, sub_offset;
-+	unsigned int sub_len;
-+	unsigned int sub_offset;
-+	unsigned int print_len;
-+	unsigned int print_offset;
- 
- 	cifs_dbg(FYI, "%s: path: %s\n", __func__, full_path);
- 
-@@ -1077,11 +1083,33 @@ smb2_query_symlink(const unsigned int xid, struct cifs_tcon *tcon,
- 		kfree(utf16_path);
- 		return -ENOENT;
- 	}
-+
-+	if (le32_to_cpu(err_buf->ByteCount) < sizeof(struct smb2_symlink_err_rsp) ||
-+	    get_rfc1002_length(err_buf) + 4 < SMB2_SYMLINK_STRUCT_SIZE) {
-+		kfree(utf16_path);
-+		return -ENOENT;
-+	}
-+
- 	/* open must fail on symlink - reset rc */
- 	rc = 0;
- 	symlink = (struct smb2_symlink_err_rsp *)err_buf->ErrorData;
- 	sub_len = le16_to_cpu(symlink->SubstituteNameLength);
- 	sub_offset = le16_to_cpu(symlink->SubstituteNameOffset);
-+	print_len = le16_to_cpu(symlink->PrintNameLength);
-+	print_offset = le16_to_cpu(symlink->PrintNameOffset);
-+
-+	if (get_rfc1002_length(err_buf) + 4 <
-+			SMB2_SYMLINK_STRUCT_SIZE + sub_offset + sub_len) {
-+		kfree(utf16_path);
-+		return -ENOENT;
-+	}
-+
-+	if (get_rfc1002_length(err_buf) + 4 <
-+			SMB2_SYMLINK_STRUCT_SIZE + print_offset + print_len) {
-+		kfree(utf16_path);
-+		return -ENOENT;
-+	}
-+
- 	*target_path = cifs_strndup_from_utf16(
- 				(char *)symlink->PathBuffer + sub_offset,
- 				sub_len, true, cifs_sb->local_nls);
-diff --git a/fs/jbd2/commit.c b/fs/jbd2/commit.c
-index 7007809..78313ad 100644
---- a/fs/jbd2/commit.c
-+++ b/fs/jbd2/commit.c
-@@ -124,7 +124,7 @@ static int journal_submit_commit_record(journal_t *journal,
- 	struct commit_header *tmp;
- 	struct buffer_head *bh;
- 	int ret;
--	struct timespec now = current_kernel_time();
-+	struct timespec64 now = current_kernel_time64();
- 
- 	*cbh = NULL;
- 
-diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
-index ff416d0..7796bea 100644
---- a/fs/nfs/nfs4proc.c
-+++ b/fs/nfs/nfs4proc.c
-@@ -427,6 +427,7 @@ static int nfs4_do_handle_exception(struct nfs_server *server,
- 		case -NFS4ERR_DELAY:
- 			nfs_inc_server_stats(server, NFSIOS_DELAY);
- 		case -NFS4ERR_GRACE:
-+		case -NFS4ERR_LAYOUTTRYLATER:
- 		case -NFS4ERR_RECALLCONFLICT:
- 			exception->delay = 1;
- 			return 0;
-@@ -7869,11 +7870,13 @@ nfs4_layoutget_handle_exception(struct rpc_task *task,
- 	struct inode *inode = lgp->args.inode;
- 	struct nfs_server *server = NFS_SERVER(inode);
- 	struct pnfs_layout_hdr *lo;
--	int status = task->tk_status;
-+	int nfs4err = task->tk_status;
-+	int err, status = 0;
-+	LIST_HEAD(head);
- 
- 	dprintk("--> %s tk_status => %d\n", __func__, -task->tk_status);
- 
--	switch (status) {
-+	switch (nfs4err) {
- 	case 0:
- 		goto out;
- 
-@@ -7905,45 +7908,43 @@ nfs4_layoutget_handle_exception(struct rpc_task *task,
- 			status = -EOVERFLOW;
- 			goto out;
- 		}
--		/* Fallthrough */
-+		status = -EBUSY;
-+		break;
- 	case -NFS4ERR_RECALLCONFLICT:
--		nfs4_handle_exception(server, -NFS4ERR_RECALLCONFLICT,
--					exception);
- 		status = -ERECALLCONFLICT;
--		goto out;
-+		break;
- 	case -NFS4ERR_EXPIRED:
- 	case -NFS4ERR_BAD_STATEID:
- 		exception->timeout = 0;
- 		spin_lock(&inode->i_lock);
--		if (nfs4_stateid_match(&lgp->args.stateid,
-+		lo = NFS_I(inode)->layout;
-+		/* If the open stateid was bad, then recover it. */
-+		if (!lo || test_bit(NFS_LAYOUT_INVALID_STID, &lo->plh_flags) ||
-+		    nfs4_stateid_match_other(&lgp->args.stateid,
- 					&lgp->args.ctx->state->stateid)) {
- 			spin_unlock(&inode->i_lock);
--			/* If the open stateid was bad, then recover it. */
- 			exception->state = lgp->args.ctx->state;
- 			break;
- 		}
--		lo = NFS_I(inode)->layout;
--		if (lo && !test_bit(NFS_LAYOUT_INVALID_STID, &lo->plh_flags) &&
--		    nfs4_stateid_match_other(&lgp->args.stateid, &lo->plh_stateid)) {
--			LIST_HEAD(head);
--
--			/*
--			 * Mark the bad layout state as invalid, then retry
--			 * with the current stateid.
--			 */
--			set_bit(NFS_LAYOUT_INVALID_STID, &lo->plh_flags);
--			pnfs_mark_matching_lsegs_invalid(lo, &head, NULL, 0);
--			spin_unlock(&inode->i_lock);
--			pnfs_free_lseg_list(&head);
--			status = -EAGAIN;
--			goto out;
--		} else
--			spin_unlock(&inode->i_lock);
--	}
- 
--	status = nfs4_handle_exception(server, status, exception);
--	if (exception->retry)
-+		/*
-+		 * Mark the bad layout state as invalid, then retry
-+		 */
-+		set_bit(NFS_LAYOUT_INVALID_STID, &lo->plh_flags);
-+		pnfs_mark_matching_lsegs_invalid(lo, &head, NULL, 0);
-+		spin_unlock(&inode->i_lock);
-+		pnfs_free_lseg_list(&head);
- 		status = -EAGAIN;
-+		goto out;
-+	}
-+
-+	err = nfs4_handle_exception(server, nfs4err, exception);
-+	if (!status) {
-+		if (exception->retry)
-+			status = -EAGAIN;
-+		else
-+			status = err;
-+	}
- out:
- 	dprintk("<-- %s\n", __func__);
- 	return status;
-diff --git a/fs/nfs/pnfs.c b/fs/nfs/pnfs.c
-index 0fbe734..7d99236 100644
---- a/fs/nfs/pnfs.c
-+++ b/fs/nfs/pnfs.c
-@@ -1505,7 +1505,7 @@ pnfs_update_layout(struct inode *ino,
- 	struct pnfs_layout_segment *lseg = NULL;
- 	nfs4_stateid stateid;
- 	long timeout = 0;
--	unsigned long giveup = jiffies + rpc_get_timeout(server->client);
-+	unsigned long giveup = jiffies + (clp->cl_lease_time << 1);
- 	bool first;
- 
- 	if (!pnfs_enabled_sb(NFS_SERVER(ino))) {
-@@ -1645,33 +1645,44 @@ lookup_again:
- 	lseg = send_layoutget(lo, ctx, &stateid, &arg, &timeout, gfp_flags);
- 	trace_pnfs_update_layout(ino, pos, count, iomode, lo, lseg,
- 				 PNFS_UPDATE_LAYOUT_SEND_LAYOUTGET);
-+	atomic_dec(&lo->plh_outstanding);
- 	if (IS_ERR(lseg)) {
- 		switch(PTR_ERR(lseg)) {
--		case -ERECALLCONFLICT:
-+		case -EBUSY:
- 			if (time_after(jiffies, giveup))
- 				lseg = NULL;
--			/* Fallthrough */
--		case -EAGAIN:
--			pnfs_put_layout_hdr(lo);
--			if (first)
--				pnfs_clear_first_layoutget(lo);
--			if (lseg) {
--				trace_pnfs_update_layout(ino, pos, count,
--					iomode, lo, lseg, PNFS_UPDATE_LAYOUT_RETRY);
--				goto lookup_again;
-+			break;
-+		case -ERECALLCONFLICT:
-+			/* Huh? We hold no layouts, how is there a recall? */
-+			if (first) {
-+				lseg = NULL;
-+				break;
- 			}
-+			/* Destroy the existing layout and start over */
-+			if (time_after(jiffies, giveup))
-+				pnfs_destroy_layout(NFS_I(ino));
- 			/* Fallthrough */
-+		case -EAGAIN:
-+			break;
- 		default:
- 			if (!nfs_error_is_fatal(PTR_ERR(lseg))) {
- 				pnfs_layout_clear_fail_bit(lo, pnfs_iomode_to_fail_bit(iomode));
- 				lseg = NULL;
- 			}
-+			goto out_put_layout_hdr;
-+		}
-+		if (lseg) {
-+			if (first)
-+				pnfs_clear_first_layoutget(lo);
-+			trace_pnfs_update_layout(ino, pos, count,
-+				iomode, lo, lseg, PNFS_UPDATE_LAYOUT_RETRY);
-+			pnfs_put_layout_hdr(lo);
-+			goto lookup_again;
- 		}
- 	} else {
- 		pnfs_layout_clear_fail_bit(lo, pnfs_iomode_to_fail_bit(iomode));
- 	}
- 
--	atomic_dec(&lo->plh_outstanding);
- out_put_layout_hdr:
- 	if (first)
- 		pnfs_clear_first_layoutget(lo);
-diff --git a/fs/nfs/write.c b/fs/nfs/write.c
-index e1c74d3..649fa5e 100644
---- a/fs/nfs/write.c
-+++ b/fs/nfs/write.c
-@@ -1289,6 +1289,9 @@ int nfs_updatepage(struct file *file, struct page *page,
- 	dprintk("NFS:       nfs_updatepage(%pD2 %d@%lld)\n",
- 		file, count, (long long)(page_file_offset(page) + offset));
- 
-+	if (!count)
-+		goto out;
-+
- 	if (nfs_can_extend_write(file, page, inode)) {
- 		count = max(count + offset, nfs_page_length(page));
- 		offset = 0;
-@@ -1299,7 +1302,7 @@ int nfs_updatepage(struct file *file, struct page *page,
- 		nfs_set_pageerror(page);
- 	else
- 		__set_page_dirty_nobuffers(page);
--
-+out:
- 	dprintk("NFS:       nfs_updatepage returns %d (isize %lld)\n",
- 			status, (long long)i_size_read(inode));
- 	return status;
-diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c
-index 70d0b9b..806eda1 100644
---- a/fs/nfsd/nfs4state.c
-+++ b/fs/nfsd/nfs4state.c
-@@ -4906,6 +4906,32 @@ nfsd4_test_stateid(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
- 	return nfs_ok;
- }
- 
-+static __be32
-+nfsd4_free_lock_stateid(stateid_t *stateid, struct nfs4_stid *s)
-+{
-+	struct nfs4_ol_stateid *stp = openlockstateid(s);
-+	__be32 ret;
-+
-+	mutex_lock(&stp->st_mutex);
-+
-+	ret = check_stateid_generation(stateid, &s->sc_stateid, 1);
-+	if (ret)
-+		goto out;
-+
-+	ret = nfserr_locks_held;
-+	if (check_for_locks(stp->st_stid.sc_file,
-+			    lockowner(stp->st_stateowner)))
-+		goto out;
-+
-+	release_lock_stateid(stp);
-+	ret = nfs_ok;
-+
-+out:
-+	mutex_unlock(&stp->st_mutex);
-+	nfs4_put_stid(s);
-+	return ret;
-+}
-+
- __be32
- nfsd4_free_stateid(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
- 		   struct nfsd4_free_stateid *free_stateid)
-@@ -4913,7 +4939,6 @@ nfsd4_free_stateid(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
- 	stateid_t *stateid = &free_stateid->fr_stateid;
- 	struct nfs4_stid *s;
- 	struct nfs4_delegation *dp;
--	struct nfs4_ol_stateid *stp;
- 	struct nfs4_client *cl = cstate->session->se_client;
- 	__be32 ret = nfserr_bad_stateid;
- 
-@@ -4932,18 +4957,9 @@ nfsd4_free_stateid(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
- 		ret = nfserr_locks_held;
- 		break;
- 	case NFS4_LOCK_STID:
--		ret = check_stateid_generation(stateid, &s->sc_stateid, 1);
--		if (ret)
--			break;
--		stp = openlockstateid(s);
--		ret = nfserr_locks_held;
--		if (check_for_locks(stp->st_stid.sc_file,
--				    lockowner(stp->st_stateowner)))
--			break;
--		WARN_ON(!unhash_lock_stateid(stp));
-+		atomic_inc(&s->sc_count);
- 		spin_unlock(&cl->cl_lock);
--		nfs4_put_stid(s);
--		ret = nfs_ok;
-+		ret = nfsd4_free_lock_stateid(stateid, s);
- 		goto out;
- 	case NFS4_REVOKED_DELEG_STID:
- 		dp = delegstateid(s);
-@@ -5510,7 +5526,7 @@ static __be32
- lookup_or_create_lock_state(struct nfsd4_compound_state *cstate,
- 			    struct nfs4_ol_stateid *ost,
- 			    struct nfsd4_lock *lock,
--			    struct nfs4_ol_stateid **lst, bool *new)
-+			    struct nfs4_ol_stateid **plst, bool *new)
- {
- 	__be32 status;
- 	struct nfs4_file *fi = ost->st_stid.sc_file;
-@@ -5518,7 +5534,9 @@ lookup_or_create_lock_state(struct nfsd4_compound_state *cstate,
- 	struct nfs4_client *cl = oo->oo_owner.so_client;
- 	struct inode *inode = d_inode(cstate->current_fh.fh_dentry);
- 	struct nfs4_lockowner *lo;
-+	struct nfs4_ol_stateid *lst;
- 	unsigned int strhashval;
-+	bool hashed;
- 
- 	lo = find_lockowner_str(cl, &lock->lk_new_owner);
- 	if (!lo) {
-@@ -5534,12 +5552,27 @@ lookup_or_create_lock_state(struct nfsd4_compound_state *cstate,
- 			goto out;
- 	}
- 
--	*lst = find_or_create_lock_stateid(lo, fi, inode, ost, new);
--	if (*lst == NULL) {
-+retry:
-+	lst = find_or_create_lock_stateid(lo, fi, inode, ost, new);
-+	if (lst == NULL) {
- 		status = nfserr_jukebox;
- 		goto out;
- 	}
-+
-+	mutex_lock(&lst->st_mutex);
-+
-+	/* See if it's still hashed to avoid race with FREE_STATEID */
-+	spin_lock(&cl->cl_lock);
-+	hashed = !list_empty(&lst->st_perfile);
-+	spin_unlock(&cl->cl_lock);
-+
-+	if (!hashed) {
-+		mutex_unlock(&lst->st_mutex);
-+		nfs4_put_stid(&lst->st_stid);
-+		goto retry;
-+	}
- 	status = nfs_ok;
-+	*plst = lst;
- out:
- 	nfs4_put_stateowner(&lo->lo_owner);
- 	return status;
-@@ -5606,8 +5639,6 @@ nfsd4_lock(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
- 			goto out;
- 		status = lookup_or_create_lock_state(cstate, open_stp, lock,
- 							&lock_stp, &new);
--		if (status == nfs_ok)
--			mutex_lock(&lock_stp->st_mutex);
- 	} else {
- 		status = nfs4_preprocess_seqid_op(cstate,
- 				       lock->lk_old_lock_seqid,
-diff --git a/fs/overlayfs/super.c b/fs/overlayfs/super.c
-index 9a7693d..6db75cb 100644
---- a/fs/overlayfs/super.c
-+++ b/fs/overlayfs/super.c
-@@ -404,7 +404,8 @@ static struct ovl_entry *ovl_alloc_entry(unsigned int numlower)
- static bool ovl_dentry_remote(struct dentry *dentry)
- {
- 	return dentry->d_flags &
--		(DCACHE_OP_REVALIDATE | DCACHE_OP_WEAK_REVALIDATE);
-+		(DCACHE_OP_REVALIDATE | DCACHE_OP_WEAK_REVALIDATE |
-+		 DCACHE_OP_REAL);
- }
- 
- static bool ovl_dentry_weird(struct dentry *dentry)
-diff --git a/fs/xfs/xfs_aops.c b/fs/xfs/xfs_aops.c
-index 4c463b9..a36a5a4 100644
---- a/fs/xfs/xfs_aops.c
-+++ b/fs/xfs/xfs_aops.c
-@@ -87,6 +87,12 @@ xfs_find_bdev_for_inode(
-  * We're now finished for good with this page.  Update the page state via the
-  * associated buffer_heads, paying attention to the start and end offsets that
-  * we need to process on the page.
-+ *
-+ * Landmine Warning: bh->b_end_io() will call end_page_writeback() on the last
-+ * buffer in the IO. Once it does this, it is unsafe to access the bufferhead or
-+ * the page at all, as we may be racing with memory reclaim and it can free both
-+ * the bufferhead chain and the page as it will see the page as clean and
-+ * unused.
-  */
- static void
- xfs_finish_page_writeback(
-@@ -95,8 +101,9 @@ xfs_finish_page_writeback(
- 	int			error)
- {
- 	unsigned int		end = bvec->bv_offset + bvec->bv_len - 1;
--	struct buffer_head	*head, *bh;
-+	struct buffer_head	*head, *bh, *next;
- 	unsigned int		off = 0;
-+	unsigned int		bsize;
- 
- 	ASSERT(bvec->bv_offset < PAGE_SIZE);
- 	ASSERT((bvec->bv_offset & ((1 << inode->i_blkbits) - 1)) == 0);
-@@ -105,15 +112,17 @@ xfs_finish_page_writeback(
- 
- 	bh = head = page_buffers(bvec->bv_page);
- 
-+	bsize = bh->b_size;
- 	do {
-+		next = bh->b_this_page;
- 		if (off < bvec->bv_offset)
- 			goto next_bh;
- 		if (off > end)
- 			break;
- 		bh->b_end_io(bh, !error);
- next_bh:
--		off += bh->b_size;
--	} while ((bh = bh->b_this_page) != head);
-+		off += bsize;
-+	} while ((bh = next) != head);
- }
- 
- /*
-diff --git a/include/linux/backing-dev-defs.h b/include/linux/backing-dev-defs.h
-index 3f10307..c357f27 100644
---- a/include/linux/backing-dev-defs.h
-+++ b/include/linux/backing-dev-defs.h
-@@ -163,6 +163,7 @@ struct backing_dev_info {
- 	wait_queue_head_t wb_waitq;
- 
- 	struct device *dev;
-+	struct device *owner;
- 
- 	struct timer_list laptop_mode_wb_timer;
- 
-diff --git a/include/linux/backing-dev.h b/include/linux/backing-dev.h
-index c82794f..89d3de3 100644
---- a/include/linux/backing-dev.h
-+++ b/include/linux/backing-dev.h
-@@ -24,6 +24,7 @@ __printf(3, 4)
- int bdi_register(struct backing_dev_info *bdi, struct device *parent,
- 		const char *fmt, ...);
- int bdi_register_dev(struct backing_dev_info *bdi, dev_t dev);
-+int bdi_register_owner(struct backing_dev_info *bdi, struct device *owner);
- void bdi_unregister(struct backing_dev_info *bdi);
- 
- int __must_check bdi_setup_and_register(struct backing_dev_info *, char *);
-diff --git a/include/linux/bio.h b/include/linux/bio.h
-index 9faebf7..75fadd2 100644
---- a/include/linux/bio.h
-+++ b/include/linux/bio.h
-@@ -527,11 +527,14 @@ extern unsigned int bvec_nr_vecs(unsigned short idx);
- int bio_associate_blkcg(struct bio *bio, struct cgroup_subsys_state *blkcg_css);
- int bio_associate_current(struct bio *bio);
- void bio_disassociate_task(struct bio *bio);
-+void bio_clone_blkcg_association(struct bio *dst, struct bio *src);
- #else	/* CONFIG_BLK_CGROUP */
- static inline int bio_associate_blkcg(struct bio *bio,
- 			struct cgroup_subsys_state *blkcg_css) { return 0; }
- static inline int bio_associate_current(struct bio *bio) { return -ENOENT; }
- static inline void bio_disassociate_task(struct bio *bio) { }
-+static inline void bio_clone_blkcg_association(struct bio *dst,
-+			struct bio *src) { }
- #endif	/* CONFIG_BLK_CGROUP */
- 
- #ifdef CONFIG_HIGHMEM
-diff --git a/include/linux/mlx5/qp.h b/include/linux/mlx5/qp.h
-index ab31081..7879bf4 100644
---- a/include/linux/mlx5/qp.h
-+++ b/include/linux/mlx5/qp.h
-@@ -556,9 +556,9 @@ struct mlx5_destroy_qp_mbox_out {
- struct mlx5_modify_qp_mbox_in {
- 	struct mlx5_inbox_hdr	hdr;
- 	__be32			qpn;
--	u8			rsvd1[4];
--	__be32			optparam;
- 	u8			rsvd0[4];
-+	__be32			optparam;
-+	u8			rsvd1[4];
- 	struct mlx5_qp_context	ctx;
- 	u8			rsvd2[16];
- };
-diff --git a/include/rdma/ib_verbs.h b/include/rdma/ib_verbs.h
-index 7e440d4..e694f02 100644
---- a/include/rdma/ib_verbs.h
-+++ b/include/rdma/ib_verbs.h
-@@ -1428,6 +1428,10 @@ struct ib_srq {
- 	} ext;
- };
- 
-+/*
-+ * @max_write_sge: Maximum SGE elements per RDMA WRITE request.
-+ * @max_read_sge:  Maximum SGE elements per RDMA READ request.
-+ */
- struct ib_qp {
- 	struct ib_device       *device;
- 	struct ib_pd	       *pd;
-@@ -1449,6 +1453,8 @@ struct ib_qp {
- 	void                  (*event_handler)(struct ib_event *, void *);
- 	void		       *qp_context;
- 	u32			qp_num;
-+	u32			max_write_sge;
-+	u32			max_read_sge;
- 	enum ib_qp_type		qp_type;
- };
- 
-diff --git a/include/target/target_core_backend.h b/include/target/target_core_backend.h
-index d8ab510..f6f3bc5 100644
---- a/include/target/target_core_backend.h
-+++ b/include/target/target_core_backend.h
-@@ -95,6 +95,6 @@ sense_reason_t passthrough_parse_cdb(struct se_cmd *cmd,
- bool target_sense_desc_format(struct se_device *dev);
- sector_t target_to_linux_sector(struct se_device *dev, sector_t lb);
- bool target_configure_unmap_from_queue(struct se_dev_attrib *attrib,
--				       struct request_queue *q, int block_size);
-+				       struct request_queue *q);
- 
- #endif /* TARGET_CORE_BACKEND_H */
-diff --git a/include/target/target_core_base.h b/include/target/target_core_base.h
-index b316b44..fb8e3b6 100644
---- a/include/target/target_core_base.h
-+++ b/include/target/target_core_base.h
-@@ -142,6 +142,7 @@ enum se_cmd_flags_table {
- 	SCF_PASSTHROUGH_PROT_SG_TO_MEM_NOALLOC = 0x00200000,
- 	SCF_ACK_KREF			= 0x00400000,
- 	SCF_USE_CPUID			= 0x00800000,
-+	SCF_TASK_ATTR_SET		= 0x01000000,
- };
- 
- /*
-diff --git a/include/target/target_core_fabric.h b/include/target/target_core_fabric.h
-index de44462..5cd6faa 100644
---- a/include/target/target_core_fabric.h
-+++ b/include/target/target_core_fabric.h
-@@ -163,7 +163,6 @@ int	core_tmr_alloc_req(struct se_cmd *, void *, u8, gfp_t);
- void	core_tmr_release_req(struct se_tmr_req *);
- int	transport_generic_handle_tmr(struct se_cmd *);
- void	transport_generic_request_failure(struct se_cmd *, sense_reason_t);
--void	__target_execute_cmd(struct se_cmd *);
- int	transport_lookup_tmr_lun(struct se_cmd *, u64);
- void	core_allocate_nexus_loss_ua(struct se_node_acl *acl);
- 
-diff --git a/include/trace/events/sunrpc.h b/include/trace/events/sunrpc.h
-index 003dca9..5664ca0 100644
---- a/include/trace/events/sunrpc.h
-+++ b/include/trace/events/sunrpc.h
-@@ -529,20 +529,27 @@ TRACE_EVENT(svc_xprt_do_enqueue,
- 
- 	TP_STRUCT__entry(
- 		__field(struct svc_xprt *, xprt)
--		__field_struct(struct sockaddr_storage, ss)
- 		__field(int, pid)
- 		__field(unsigned long, flags)
-+		__dynamic_array(unsigned char, addr, xprt != NULL ?
-+			xprt->xpt_remotelen : 0)
- 	),
- 
- 	TP_fast_assign(
- 		__entry->xprt = xprt;
--		xprt ? memcpy(&__entry->ss, &xprt->xpt_remote, sizeof(__entry->ss)) : memset(&__entry->ss, 0, sizeof(__entry->ss));
- 		__entry->pid = rqst? rqst->rq_task->pid : 0;
--		__entry->flags = xprt ? xprt->xpt_flags : 0;
-+		if (xprt) {
-+			memcpy(__get_dynamic_array(addr),
-+				&xprt->xpt_remote,
-+				xprt->xpt_remotelen);
-+			__entry->flags = xprt->xpt_flags;
-+		} else
-+			__entry->flags = 0;
- 	),
- 
- 	TP_printk("xprt=0x%p addr=%pIScp pid=%d flags=%s", __entry->xprt,
--		(struct sockaddr *)&__entry->ss,
-+		__get_dynamic_array_len(addr) != 0 ?
-+			(struct sockaddr *)__get_dynamic_array(addr) : NULL,
- 		__entry->pid, show_svc_xprt_flags(__entry->flags))
- );
- 
-@@ -553,18 +560,25 @@ TRACE_EVENT(svc_xprt_dequeue,
- 
- 	TP_STRUCT__entry(
- 		__field(struct svc_xprt *, xprt)
--		__field_struct(struct sockaddr_storage, ss)
- 		__field(unsigned long, flags)
-+		__dynamic_array(unsigned char, addr, xprt != NULL ?
-+			xprt->xpt_remotelen : 0)
- 	),
- 
- 	TP_fast_assign(
--		__entry->xprt = xprt,
--		xprt ? memcpy(&__entry->ss, &xprt->xpt_remote, sizeof(__entry->ss)) : memset(&__entry->ss, 0, sizeof(__entry->ss));
--		__entry->flags = xprt ? xprt->xpt_flags : 0;
-+		__entry->xprt = xprt;
-+		if (xprt) {
-+			memcpy(__get_dynamic_array(addr),
-+					&xprt->xpt_remote,
-+					xprt->xpt_remotelen);
-+			__entry->flags = xprt->xpt_flags;
-+		} else
-+			__entry->flags = 0;
- 	),
- 
- 	TP_printk("xprt=0x%p addr=%pIScp flags=%s", __entry->xprt,
--		(struct sockaddr *)&__entry->ss,
-+		__get_dynamic_array_len(addr) != 0 ?
-+			(struct sockaddr *)__get_dynamic_array(addr) : NULL,
- 		show_svc_xprt_flags(__entry->flags))
- );
- 
-@@ -592,19 +606,26 @@ TRACE_EVENT(svc_handle_xprt,
- 	TP_STRUCT__entry(
- 		__field(struct svc_xprt *, xprt)
- 		__field(int, len)
--		__field_struct(struct sockaddr_storage, ss)
- 		__field(unsigned long, flags)
-+		__dynamic_array(unsigned char, addr, xprt != NULL ?
-+			xprt->xpt_remotelen : 0)
- 	),
- 
- 	TP_fast_assign(
- 		__entry->xprt = xprt;
--		xprt ? memcpy(&__entry->ss, &xprt->xpt_remote, sizeof(__entry->ss)) : memset(&__entry->ss, 0, sizeof(__entry->ss));
- 		__entry->len = len;
--		__entry->flags = xprt ? xprt->xpt_flags : 0;
-+		if (xprt) {
-+			memcpy(__get_dynamic_array(addr),
-+					&xprt->xpt_remote,
-+					xprt->xpt_remotelen);
-+			__entry->flags = xprt->xpt_flags;
-+		} else
-+			__entry->flags = 0;
- 	),
- 
- 	TP_printk("xprt=0x%p addr=%pIScp len=%d flags=%s", __entry->xprt,
--		(struct sockaddr *)&__entry->ss,
-+		__get_dynamic_array_len(addr) != 0 ?
-+			(struct sockaddr *)__get_dynamic_array(addr) : NULL,
- 		__entry->len, show_svc_xprt_flags(__entry->flags))
- );
- #endif /* _TRACE_SUNRPC_H */
-diff --git a/kernel/auditsc.c b/kernel/auditsc.c
-index 2672d10..b334128 100644
---- a/kernel/auditsc.c
-+++ b/kernel/auditsc.c
-@@ -72,6 +72,7 @@
- #include <linux/compat.h>
- #include <linux/ctype.h>
- #include <linux/string.h>
-+#include <linux/uaccess.h>
- #include <uapi/linux/limits.h>
- 
- #include "audit.h"
-@@ -81,7 +82,8 @@
- #define AUDITSC_SUCCESS 1
- #define AUDITSC_FAILURE 2
- 
--/* no execve audit message should be longer than this (userspace limits) */
-+/* no execve audit message should be longer than this (userspace limits),
-+ * see the note near the top of audit_log_execve_info() about this value */
- #define MAX_EXECVE_AUDIT_LEN 7500
- 
- /* max length to print of cmdline/proctitle value during audit */
-@@ -987,184 +989,178 @@ static int audit_log_pid_context(struct audit_context *context, pid_t pid,
- 	return rc;
- }
- 
--/*
-- * to_send and len_sent accounting are very loose estimates.  We aren't
-- * really worried about a hard cap to MAX_EXECVE_AUDIT_LEN so much as being
-- * within about 500 bytes (next page boundary)
-- *
-- * why snprintf?  an int is up to 12 digits long.  if we just assumed when
-- * logging that a[%d]= was going to be 16 characters long we would be wasting
-- * space in every audit message.  In one 7500 byte message we can log up to
-- * about 1000 min size arguments.  That comes down to about 50% waste of space
-- * if we didn't do the snprintf to find out how long arg_num_len was.
-- */
--static int audit_log_single_execve_arg(struct audit_context *context,
--					struct audit_buffer **ab,
--					int arg_num,
--					size_t *len_sent,
--					const char __user *p,
--					char *buf)
-+static void audit_log_execve_info(struct audit_context *context,
-+				  struct audit_buffer **ab)
- {
--	char arg_num_len_buf[12];
--	const char __user *tmp_p = p;
--	/* how many digits are in arg_num? 5 is the length of ' a=""' */
--	size_t arg_num_len = snprintf(arg_num_len_buf, 12, "%d", arg_num) + 5;
--	size_t len, len_left, to_send;
--	size_t max_execve_audit_len = MAX_EXECVE_AUDIT_LEN;
--	unsigned int i, has_cntl = 0, too_long = 0;
--	int ret;
--
--	/* strnlen_user includes the null we don't want to send */
--	len_left = len = strnlen_user(p, MAX_ARG_STRLEN) - 1;
--
--	/*
--	 * We just created this mm, if we can't find the strings
--	 * we just copied into it something is _very_ wrong. Similar
--	 * for strings that are too long, we should not have created
--	 * any.
--	 */
--	if (WARN_ON_ONCE(len < 0 || len > MAX_ARG_STRLEN - 1)) {
--		send_sig(SIGKILL, current, 0);
--		return -1;
-+	long len_max;
-+	long len_rem;
-+	long len_full;
-+	long len_buf;
-+	long len_abuf;
-+	long len_tmp;
-+	bool require_data;
-+	bool encode;
-+	unsigned int iter;
-+	unsigned int arg;
-+	char *buf_head;
-+	char *buf;
-+	const char __user *p = (const char __user *)current->mm->arg_start;
-+
-+	/* NOTE: this buffer needs to be large enough to hold all the non-arg
-+	 *       data we put in the audit record for this argument (see the
-+	 *       code below) ... at this point in time 96 is plenty */
-+	char abuf[96];
-+
-+	/* NOTE: we set MAX_EXECVE_AUDIT_LEN to a rather arbitrary limit, the
-+	 *       current value of 7500 is not as important as the fact that it
-+	 *       is less than 8k, a setting of 7500 gives us plenty of wiggle
-+	 *       room if we go over a little bit in the logging below */
-+	WARN_ON_ONCE(MAX_EXECVE_AUDIT_LEN > 7500);
-+	len_max = MAX_EXECVE_AUDIT_LEN;
-+
-+	/* scratch buffer to hold the userspace args */
-+	buf_head = kmalloc(MAX_EXECVE_AUDIT_LEN + 1, GFP_KERNEL);
-+	if (!buf_head) {
-+		audit_panic("out of memory for argv string");
-+		return;
- 	}
-+	buf = buf_head;
- 
--	/* walk the whole argument looking for non-ascii chars */
-+	audit_log_format(*ab, "argc=%d", context->execve.argc);
-+
-+	len_rem = len_max;
-+	len_buf = 0;
-+	len_full = 0;
-+	require_data = true;
-+	encode = false;
-+	iter = 0;
-+	arg = 0;
- 	do {
--		if (len_left > MAX_EXECVE_AUDIT_LEN)
--			to_send = MAX_EXECVE_AUDIT_LEN;
--		else
--			to_send = len_left;
--		ret = copy_from_user(buf, tmp_p, to_send);
--		/*
--		 * There is no reason for this copy to be short. We just
--		 * copied them here, and the mm hasn't been exposed to user-
--		 * space yet.
--		 */
--		if (ret) {
--			WARN_ON(1);
--			send_sig(SIGKILL, current, 0);
--			return -1;
--		}
--		buf[to_send] = '\0';
--		has_cntl = audit_string_contains_control(buf, to_send);
--		if (has_cntl) {
--			/*
--			 * hex messages get logged as 2 bytes, so we can only
--			 * send half as much in each message
--			 */
--			max_execve_audit_len = MAX_EXECVE_AUDIT_LEN / 2;
--			break;
--		}
--		len_left -= to_send;
--		tmp_p += to_send;
--	} while (len_left > 0);
--
--	len_left = len;
--
--	if (len > max_execve_audit_len)
--		too_long = 1;
--
--	/* rewalk the argument actually logging the message */
--	for (i = 0; len_left > 0; i++) {
--		int room_left;
--
--		if (len_left > max_execve_audit_len)
--			to_send = max_execve_audit_len;
--		else
--			to_send = len_left;
--
--		/* do we have space left to send this argument in this ab? */
--		room_left = MAX_EXECVE_AUDIT_LEN - arg_num_len - *len_sent;
--		if (has_cntl)
--			room_left -= (to_send * 2);
--		else
--			room_left -= to_send;
--		if (room_left < 0) {
--			*len_sent = 0;
--			audit_log_end(*ab);
--			*ab = audit_log_start(context, GFP_KERNEL, AUDIT_EXECVE);
--			if (!*ab)
--				return 0;
--		}
-+		/* NOTE: we don't ever want to trust this value for anything
-+		 *       serious, but the audit record format insists we
-+		 *       provide an argument length for really long arguments,
-+		 *       e.g. > MAX_EXECVE_AUDIT_LEN, so we have no choice but
-+		 *       to use strncpy_from_user() to obtain this value for
-+		 *       recording in the log, although we don't use it
-+		 *       anywhere here to avoid a double-fetch problem */
-+		if (len_full == 0)
-+			len_full = strnlen_user(p, MAX_ARG_STRLEN) - 1;
-+
-+		/* read more data from userspace */
-+		if (require_data) {
-+			/* can we make more room in the buffer? */
-+			if (buf != buf_head) {
-+				memmove(buf_head, buf, len_buf);
-+				buf = buf_head;
-+			}
-+
-+			/* fetch as much as we can of the argument */
-+			len_tmp = strncpy_from_user(&buf_head[len_buf], p,
-+						    len_max - len_buf);
-+			if (len_tmp == -EFAULT) {
-+				/* unable to copy from userspace */
-+				send_sig(SIGKILL, current, 0);
-+				goto out;
-+			} else if (len_tmp == (len_max - len_buf)) {
-+				/* buffer is not large enough */
-+				require_data = true;
-+				/* NOTE: if we are going to span multiple
-+				 *       buffers force the encoding so we stand
-+				 *       a chance at a sane len_full value and
-+				 *       consistent record encoding */
-+				encode = true;
-+				len_full = len_full * 2;
-+				p += len_tmp;
-+			} else {
-+				require_data = false;
-+				if (!encode)
-+					encode = audit_string_contains_control(
-+								buf, len_tmp);
-+				/* try to use a trusted value for len_full */
-+				if (len_full < len_max)
-+					len_full = (encode ?
-+						    len_tmp * 2 : len_tmp);
-+				p += len_tmp + 1;
-+			}
-+			len_buf += len_tmp;
-+			buf_head[len_buf] = '\0';
- 
--		/*
--		 * first record needs to say how long the original string was
--		 * so we can be sure nothing was lost.
--		 */
--		if ((i == 0) && (too_long))
--			audit_log_format(*ab, " a%d_len=%zu", arg_num,
--					 has_cntl ? 2*len : len);
--
--		/*
--		 * normally arguments are small enough to fit and we already
--		 * filled buf above when we checked for control characters
--		 * so don't bother with another copy_from_user
--		 */
--		if (len >= max_execve_audit_len)
--			ret = copy_from_user(buf, p, to_send);
--		else
--			ret = 0;
--		if (ret) {
--			WARN_ON(1);
--			send_sig(SIGKILL, current, 0);
--			return -1;
-+			/* length of the buffer in the audit record? */
-+			len_abuf = (encode ? len_buf * 2 : len_buf + 2);
- 		}
--		buf[to_send] = '\0';
--
--		/* actually log it */
--		audit_log_format(*ab, " a%d", arg_num);
--		if (too_long)
--			audit_log_format(*ab, "[%d]", i);
--		audit_log_format(*ab, "=");
--		if (has_cntl)
--			audit_log_n_hex(*ab, buf, to_send);
--		else
--			audit_log_string(*ab, buf);
--
--		p += to_send;
--		len_left -= to_send;
--		*len_sent += arg_num_len;
--		if (has_cntl)
--			*len_sent += to_send * 2;
--		else
--			*len_sent += to_send;
--	}
--	/* include the null we didn't log */
--	return len + 1;
--}
- 
--static void audit_log_execve_info(struct audit_context *context,
--				  struct audit_buffer **ab)
--{
--	int i, len;
--	size_t len_sent = 0;
--	const char __user *p;
--	char *buf;
-+		/* write as much as we can to the audit log */
-+		if (len_buf > 0) {
-+			/* NOTE: some magic numbers here - basically if we
-+			 *       can't fit a reasonable amount of data into the
-+			 *       existing audit buffer, flush it and start with
-+			 *       a new buffer */
-+			if ((sizeof(abuf) + 8) > len_rem) {
-+				len_rem = len_max;
-+				audit_log_end(*ab);
-+				*ab = audit_log_start(context,
-+						      GFP_KERNEL, AUDIT_EXECVE);
-+				if (!*ab)
-+					goto out;
-+			}
- 
--	p = (const char __user *)current->mm->arg_start;
-+			/* create the non-arg portion of the arg record */
-+			len_tmp = 0;
-+			if (require_data || (iter > 0) ||
-+			    ((len_abuf + sizeof(abuf)) > len_rem)) {
-+				if (iter == 0) {
-+					len_tmp += snprintf(&abuf[len_tmp],
-+							sizeof(abuf) - len_tmp,
-+							" a%d_len=%lu",
-+							arg, len_full);
-+				}
-+				len_tmp += snprintf(&abuf[len_tmp],
-+						    sizeof(abuf) - len_tmp,
-+						    " a%d[%d]=", arg, iter++);
-+			} else
-+				len_tmp += snprintf(&abuf[len_tmp],
-+						    sizeof(abuf) - len_tmp,
-+						    " a%d=", arg);
-+			WARN_ON(len_tmp >= sizeof(abuf));
-+			abuf[sizeof(abuf) - 1] = '\0';
-+
-+			/* log the arg in the audit record */
-+			audit_log_format(*ab, "%s", abuf);
-+			len_rem -= len_tmp;
-+			len_tmp = len_buf;
-+			if (encode) {
-+				if (len_abuf > len_rem)
-+					len_tmp = len_rem / 2; /* encoding */
-+				audit_log_n_hex(*ab, buf, len_tmp);
-+				len_rem -= len_tmp * 2;
-+				len_abuf -= len_tmp * 2;
-+			} else {
-+				if (len_abuf > len_rem)
-+					len_tmp = len_rem - 2; /* quotes */
-+				audit_log_n_string(*ab, buf, len_tmp);
-+				len_rem -= len_tmp + 2;
-+				/* don't subtract the "2" because we still need
-+				 * to add quotes to the remaining string */
-+				len_abuf -= len_tmp;
-+			}
-+			len_buf -= len_tmp;
-+			buf += len_tmp;
-+		}
- 
--	audit_log_format(*ab, "argc=%d", context->execve.argc);
-+		/* ready to move to the next argument? */
-+		if ((len_buf == 0) && !require_data) {
-+			arg++;
-+			iter = 0;
-+			len_full = 0;
-+			require_data = true;
-+			encode = false;
-+		}
-+	} while (arg < context->execve.argc);
- 
--	/*
--	 * we need some kernel buffer to hold the userspace args.  Just
--	 * allocate one big one rather than allocating one of the right size
--	 * for every single argument inside audit_log_single_execve_arg()
--	 * should be <8k allocation so should be pretty safe.
--	 */
--	buf = kmalloc(MAX_EXECVE_AUDIT_LEN + 1, GFP_KERNEL);
--	if (!buf) {
--		audit_panic("out of memory for argv string");
--		return;
--	}
-+	/* NOTE: the caller handles the final audit_log_end() call */
- 
--	for (i = 0; i < context->execve.argc; i++) {
--		len = audit_log_single_execve_arg(context, ab, i,
--						  &len_sent, p, buf);
--		if (len <= 0)
--			break;
--		p += len;
--	}
--	kfree(buf);
-+out:
-+	kfree(buf_head);
- }
- 
- static void show_special(struct audit_context *context, int *call_panic)
-diff --git a/kernel/cgroup.c b/kernel/cgroup.c
-index 75c0ff0..e0be49f 100644
---- a/kernel/cgroup.c
-+++ b/kernel/cgroup.c
-@@ -2215,12 +2215,8 @@ static struct dentry *cgroup_mount(struct file_system_type *fs_type,
- 		goto out_unlock;
- 	}
- 
--	/*
--	 * We know this subsystem has not yet been bound.  Users in a non-init
--	 * user namespace may only mount hierarchies with no bound subsystems,
--	 * i.e. 'none,name=user1'
--	 */
--	if (!opts.none && !capable(CAP_SYS_ADMIN)) {
-+	/* Hierarchies may only be created in the initial cgroup namespace. */
-+	if (ns != &init_cgroup_ns) {
- 		ret = -EPERM;
- 		goto out_unlock;
- 	}
-@@ -2962,6 +2958,7 @@ int cgroup_attach_task_all(struct task_struct *from, struct task_struct *tsk)
- 	int retval = 0;
- 
- 	mutex_lock(&cgroup_mutex);
-+	percpu_down_write(&cgroup_threadgroup_rwsem);
- 	for_each_root(root) {
- 		struct cgroup *from_cgrp;
- 
-@@ -2976,6 +2973,7 @@ int cgroup_attach_task_all(struct task_struct *from, struct task_struct *tsk)
- 		if (retval)
- 			break;
- 	}
-+	percpu_up_write(&cgroup_threadgroup_rwsem);
- 	mutex_unlock(&cgroup_mutex);
- 
- 	return retval;
-@@ -4343,6 +4341,8 @@ int cgroup_transfer_tasks(struct cgroup *to, struct cgroup *from)
- 
- 	mutex_lock(&cgroup_mutex);
- 
-+	percpu_down_write(&cgroup_threadgroup_rwsem);
-+
- 	/* all tasks in @from are being moved, all csets are source */
- 	spin_lock_irq(&css_set_lock);
- 	list_for_each_entry(link, &from->cset_links, cset_link)
-@@ -4371,6 +4371,7 @@ int cgroup_transfer_tasks(struct cgroup *to, struct cgroup *from)
- 	} while (task && !ret);
- out_err:
- 	cgroup_migrate_finish(&preloaded_csets);
-+	percpu_up_write(&cgroup_threadgroup_rwsem);
- 	mutex_unlock(&cgroup_mutex);
- 	return ret;
- }
-@@ -6309,14 +6310,11 @@ struct cgroup_namespace *copy_cgroup_ns(unsigned long flags,
- 	if (!ns_capable(user_ns, CAP_SYS_ADMIN))
- 		return ERR_PTR(-EPERM);
- 
--	mutex_lock(&cgroup_mutex);
-+	/* It is not safe to take cgroup_mutex here */
- 	spin_lock_irq(&css_set_lock);
--
- 	cset = task_css_set(current);
- 	get_css_set(cset);
--
- 	spin_unlock_irq(&css_set_lock);
--	mutex_unlock(&cgroup_mutex);
- 
- 	new_ns = alloc_cgroup_ns();
- 	if (IS_ERR(new_ns)) {
-diff --git a/kernel/module.c b/kernel/module.c
-index 5f71aa6..6458a2f 100644
---- a/kernel/module.c
-+++ b/kernel/module.c
-@@ -2687,13 +2687,18 @@ static inline void kmemleak_load_module(const struct module *mod,
- #endif
- 
- #ifdef CONFIG_MODULE_SIG
--static int module_sig_check(struct load_info *info)
-+static int module_sig_check(struct load_info *info, int flags)
- {
- 	int err = -ENOKEY;
- 	const unsigned long markerlen = sizeof(MODULE_SIG_STRING) - 1;
- 	const void *mod = info->hdr;
- 
--	if (info->len > markerlen &&
-+	/*
-+	 * Require flags == 0, as a module with version information
-+	 * removed is no longer the module that was signed
-+	 */
-+	if (flags == 0 &&
-+	    info->len > markerlen &&
- 	    memcmp(mod + info->len - markerlen, MODULE_SIG_STRING, markerlen) == 0) {
- 		/* We truncate the module to discard the signature */
- 		info->len -= markerlen;
-@@ -2712,7 +2717,7 @@ static int module_sig_check(struct load_info *info)
- 	return err;
- }
- #else /* !CONFIG_MODULE_SIG */
--static int module_sig_check(struct load_info *info)
-+static int module_sig_check(struct load_info *info, int flags)
- {
- 	return 0;
- }
-@@ -3498,7 +3503,7 @@ static int load_module(struct load_info *info, const char __user *uargs,
- 	long err;
- 	char *after_dashes;
- 
--	err = module_sig_check(info);
-+	err = module_sig_check(info, flags);
- 	if (err)
- 		goto free_copy;
- 
-diff --git a/mm/backing-dev.c b/mm/backing-dev.c
-index ed173b8..9269911 100644
---- a/mm/backing-dev.c
-+++ b/mm/backing-dev.c
-@@ -825,6 +825,20 @@ int bdi_register_dev(struct backing_dev_info *bdi, dev_t dev)
- }
- EXPORT_SYMBOL(bdi_register_dev);
- 
-+int bdi_register_owner(struct backing_dev_info *bdi, struct device *owner)
-+{
-+	int rc;
-+
-+	rc = bdi_register(bdi, NULL, "%u:%u", MAJOR(owner->devt),
-+			MINOR(owner->devt));
-+	if (rc)
-+		return rc;
-+	bdi->owner = owner;
-+	get_device(owner);
-+	return 0;
-+}
-+EXPORT_SYMBOL(bdi_register_owner);
-+
- /*
-  * Remove bdi from bdi_list, and ensure that it is no longer visible
-  */
-@@ -849,6 +863,11 @@ void bdi_unregister(struct backing_dev_info *bdi)
- 		device_unregister(bdi->dev);
- 		bdi->dev = NULL;
- 	}
-+
-+	if (bdi->owner) {
-+		put_device(bdi->owner);
-+		bdi->owner = NULL;
-+	}
- }
- 
- void bdi_exit(struct backing_dev_info *bdi)
-diff --git a/mm/hugetlb.c b/mm/hugetlb.c
-index addfe4ac..d9ec1a5 100644
---- a/mm/hugetlb.c
-+++ b/mm/hugetlb.c
-@@ -2214,6 +2214,10 @@ static unsigned long set_max_huge_pages(struct hstate *h, unsigned long count,
- 		 * and reducing the surplus.
- 		 */
- 		spin_unlock(&hugetlb_lock);
-+
-+		/* yield cpu to avoid soft lockup */
-+		cond_resched();
-+
- 		if (hstate_is_gigantic(h))
- 			ret = alloc_fresh_gigantic_page(h, nodes_allowed);
- 		else
-diff --git a/net/bluetooth/l2cap_sock.c b/net/bluetooth/l2cap_sock.c
-index 388ee8b..1842141 100644
---- a/net/bluetooth/l2cap_sock.c
-+++ b/net/bluetooth/l2cap_sock.c
-@@ -927,7 +927,7 @@ static int l2cap_sock_setsockopt(struct socket *sock, int level, int optname,
- 			break;
- 		}
- 
--		if (get_user(opt, (u32 __user *) optval)) {
-+		if (get_user(opt, (u16 __user *) optval)) {
- 			err = -EFAULT;
- 			break;
- 		}
-diff --git a/net/netlabel/netlabel_kapi.c b/net/netlabel/netlabel_kapi.c
-index 1325776..bd007a9 100644
---- a/net/netlabel/netlabel_kapi.c
-+++ b/net/netlabel/netlabel_kapi.c
-@@ -824,7 +824,11 @@ socket_setattr_return:
-  */
- void netlbl_sock_delattr(struct sock *sk)
- {
--	cipso_v4_sock_delattr(sk);
-+	switch (sk->sk_family) {
-+	case AF_INET:
-+		cipso_v4_sock_delattr(sk);
-+		break;
-+	}
- }
- 
- /**
-@@ -987,7 +991,11 @@ req_setattr_return:
- */
- void netlbl_req_delattr(struct request_sock *req)
- {
--	cipso_v4_req_delattr(req);
-+	switch (req->rsk_ops->family) {
-+	case AF_INET:
-+		cipso_v4_req_delattr(req);
-+		break;
-+	}
- }
- 
- /**
-diff --git a/scripts/recordmcount.c b/scripts/recordmcount.c
-index e1675927..42396a7 100644
---- a/scripts/recordmcount.c
-+++ b/scripts/recordmcount.c
-@@ -33,10 +33,17 @@
- #include <string.h>
- #include <unistd.h>
- 
-+/*
-+ * glibc synced up and added the metag number but didn't add the relocations.
-+ * Work around this in a crude manner for now.
-+ */
- #ifndef EM_METAG
--/* Remove this when these make it to the standard system elf.h. */
- #define EM_METAG      174
-+#endif
-+#ifndef R_METAG_ADDR32
- #define R_METAG_ADDR32                   2
-+#endif
-+#ifndef R_METAG_NONE
- #define R_METAG_NONE                     3
- #endif
- 
-diff --git a/sound/hda/array.c b/sound/hda/array.c
-index 516795b..5dfa610 100644
---- a/sound/hda/array.c
-+++ b/sound/hda/array.c
-@@ -21,13 +21,15 @@ void *snd_array_new(struct snd_array *array)
- 		return NULL;
- 	if (array->used >= array->alloced) {
- 		int num = array->alloced + array->alloc_align;
-+		int oldsize = array->alloced * array->elem_size;
- 		int size = (num + 1) * array->elem_size;
- 		void *nlist;
- 		if (snd_BUG_ON(num >= 4096))
- 			return NULL;
--		nlist = krealloc(array->list, size, GFP_KERNEL | __GFP_ZERO);
-+		nlist = krealloc(array->list, size, GFP_KERNEL);
- 		if (!nlist)
- 			return NULL;
-+		memset(nlist + oldsize, 0, size - oldsize);
- 		array->list = nlist;
- 		array->alloced = num;
- 	}
-diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
-index 6f8ea13..89dacf9 100644
---- a/sound/pci/hda/hda_intel.c
-+++ b/sound/pci/hda/hda_intel.c
-@@ -2265,6 +2265,8 @@ static const struct pci_device_id azx_ids[] = {
- 	{ PCI_DEVICE(0x1022, 0x780d),
- 	  .driver_data = AZX_DRIVER_GENERIC | AZX_DCAPS_PRESET_ATI_SB },
- 	/* ATI HDMI */
-+	{ PCI_DEVICE(0x1002, 0x0002),
-+	  .driver_data = AZX_DRIVER_ATIHDMI_NS | AZX_DCAPS_PRESET_ATI_HDMI_NS },
- 	{ PCI_DEVICE(0x1002, 0x1308),
- 	  .driver_data = AZX_DRIVER_ATIHDMI_NS | AZX_DCAPS_PRESET_ATI_HDMI_NS },
- 	{ PCI_DEVICE(0x1002, 0x157a),
-diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
-index abcb5a6..f25479b 100644
---- a/sound/pci/hda/patch_realtek.c
-+++ b/sound/pci/hda/patch_realtek.c
-@@ -4674,6 +4674,22 @@ static void alc290_fixup_mono_speakers(struct hda_codec *codec,
- 	}
- }
- 
-+static void alc298_fixup_speaker_volume(struct hda_codec *codec,
-+					const struct hda_fixup *fix, int action)
-+{
-+	if (action == HDA_FIXUP_ACT_PRE_PROBE) {
-+		/* The speaker is routed to the Node 0x06 by a mistake, as a result
-+		   we can't adjust the speaker's volume since this node does not has
-+		   Amp-out capability. we change the speaker's route to:
-+		   Node 0x02 (Audio Output) -> Node 0x0c (Audio Mixer) -> Node 0x17 (
-+		   Pin Complex), since Node 0x02 has Amp-out caps, we can adjust
-+		   speaker's volume now. */
-+
-+		hda_nid_t conn1[1] = { 0x0c };
-+		snd_hda_override_conn_list(codec, 0x17, 1, conn1);
-+	}
-+}
-+
- /* Hook to update amp GPIO4 for automute */
- static void alc280_hp_gpio4_automute_hook(struct hda_codec *codec,
- 					  struct hda_jack_callback *jack)
-@@ -4823,6 +4839,7 @@ enum {
- 	ALC280_FIXUP_HP_HEADSET_MIC,
- 	ALC221_FIXUP_HP_FRONT_MIC,
- 	ALC292_FIXUP_TPT460,
-+	ALC298_FIXUP_SPK_VOLUME,
- };
- 
- static const struct hda_fixup alc269_fixups[] = {
-@@ -5478,6 +5495,12 @@ static const struct hda_fixup alc269_fixups[] = {
- 		.chained = true,
- 		.chain_id = ALC293_FIXUP_LENOVO_SPK_NOISE,
- 	},
-+	[ALC298_FIXUP_SPK_VOLUME] = {
-+		.type = HDA_FIXUP_FUNC,
-+		.v.func = alc298_fixup_speaker_volume,
-+		.chained = true,
-+		.chain_id = ALC298_FIXUP_DELL1_MIC_NO_PRESENCE,
-+	},
- };
- 
- static const struct snd_pci_quirk alc269_fixup_tbl[] = {
-@@ -5524,6 +5547,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
- 	SND_PCI_QUIRK(0x1028, 0x0704, "Dell XPS 13 9350", ALC256_FIXUP_DELL_XPS_13_HEADPHONE_NOISE),
- 	SND_PCI_QUIRK(0x1028, 0x0725, "Dell Inspiron 3162", ALC255_FIXUP_DELL_SPK_NOISE),
- 	SND_PCI_QUIRK(0x1028, 0x075b, "Dell XPS 13 9360", ALC256_FIXUP_DELL_XPS_13_HEADPHONE_NOISE),
-+	SND_PCI_QUIRK(0x1028, 0x075d, "Dell AIO", ALC298_FIXUP_SPK_VOLUME),
- 	SND_PCI_QUIRK(0x1028, 0x164a, "Dell", ALC293_FIXUP_DELL1_MIC_NO_PRESENCE),
- 	SND_PCI_QUIRK(0x1028, 0x164b, "Dell", ALC293_FIXUP_DELL1_MIC_NO_PRESENCE),
- 	SND_PCI_QUIRK(0x103c, 0x1586, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC2),
-@@ -5799,6 +5823,10 @@ static const struct snd_hda_pin_quirk alc269_pin_fixup_tbl[] = {
- 		{0x1b, 0x01014020},
- 		{0x21, 0x0221103f}),
- 	SND_HDA_PIN_QUIRK(0x10ec0255, 0x1028, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE,
-+		{0x14, 0x90170130},
-+		{0x1b, 0x02011020},
-+		{0x21, 0x0221103f}),
-+	SND_HDA_PIN_QUIRK(0x10ec0255, 0x1028, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE,
- 		{0x14, 0x90170150},
- 		{0x1b, 0x02011020},
- 		{0x21, 0x0221105f}),
-diff --git a/tools/objtool/.gitignore b/tools/objtool/.gitignore
-index a0b3128..d3102c8 100644
---- a/tools/objtool/.gitignore
-+++ b/tools/objtool/.gitignore
-@@ -1,2 +1,3 @@
- arch/x86/insn/inat-tables.c
- objtool
-+fixdep
-diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
-index 48bd520..dd25346 100644
---- a/virt/kvm/kvm_main.c
-+++ b/virt/kvm/kvm_main.c
-@@ -148,6 +148,7 @@ int vcpu_load(struct kvm_vcpu *vcpu)
- 	put_cpu();
- 	return 0;
- }
-+EXPORT_SYMBOL_GPL(vcpu_load);
- 
- void vcpu_put(struct kvm_vcpu *vcpu)
- {
-@@ -157,6 +158,7 @@ void vcpu_put(struct kvm_vcpu *vcpu)
- 	preempt_enable();
- 	mutex_unlock(&vcpu->mutex);
- }
-+EXPORT_SYMBOL_GPL(vcpu_put);
- 
- static void ack_flush(void *_completed)
- {

diff --git a/4.7.4/1002_linux-4.7.3.patch b/4.7.4/1002_linux-4.7.3.patch
deleted file mode 100644
index caac684..0000000
--- a/4.7.4/1002_linux-4.7.3.patch
+++ /dev/null
@@ -1,4418 +0,0 @@
-diff --git a/Makefile b/Makefile
-index bb98f1c..4afff18 100644
---- a/Makefile
-+++ b/Makefile
-@@ -1,6 +1,6 @@
- VERSION = 4
- PATCHLEVEL = 7
--SUBLEVEL = 2
-+SUBLEVEL = 3
- EXTRAVERSION =
- NAME = Psychotic Stoned Sheep
- 
-diff --git a/arch/arc/include/asm/entry.h b/arch/arc/include/asm/entry.h
-index ad7860c..51597f3 100644
---- a/arch/arc/include/asm/entry.h
-+++ b/arch/arc/include/asm/entry.h
-@@ -142,7 +142,7 @@
- 
- #ifdef CONFIG_ARC_CURR_IN_REG
- 	; Retrieve orig r25 and save it with rest of callee_regs
--	ld.as   r12, [r12, PT_user_r25]
-+	ld	r12, [r12, PT_user_r25]
- 	PUSH	r12
- #else
- 	PUSH	r25
-@@ -198,7 +198,7 @@
- 
- 	; SP is back to start of pt_regs
- #ifdef CONFIG_ARC_CURR_IN_REG
--	st.as   r12, [sp, PT_user_r25]
-+	st	r12, [sp, PT_user_r25]
- #endif
- .endm
- 
-diff --git a/arch/arc/include/asm/irqflags-compact.h b/arch/arc/include/asm/irqflags-compact.h
-index c1d3645..4c6eed8 100644
---- a/arch/arc/include/asm/irqflags-compact.h
-+++ b/arch/arc/include/asm/irqflags-compact.h
-@@ -188,10 +188,10 @@ static inline int arch_irqs_disabled(void)
- .endm
- 
- .macro IRQ_ENABLE  scratch
-+	TRACE_ASM_IRQ_ENABLE
- 	lr	\scratch, [status32]
- 	or	\scratch, \scratch, (STATUS_E1_MASK | STATUS_E2_MASK)
- 	flag	\scratch
--	TRACE_ASM_IRQ_ENABLE
- .endm
- 
- #endif	/* __ASSEMBLY__ */
-diff --git a/arch/arc/include/asm/pgtable.h b/arch/arc/include/asm/pgtable.h
-index 0f92d97..89eeb37 100644
---- a/arch/arc/include/asm/pgtable.h
-+++ b/arch/arc/include/asm/pgtable.h
-@@ -280,7 +280,7 @@ static inline void pmd_set(pmd_t *pmdp, pte_t *ptep)
- 
- #define pte_page(pte)		pfn_to_page(pte_pfn(pte))
- #define mk_pte(page, prot)	pfn_pte(page_to_pfn(page), prot)
--#define pfn_pte(pfn, prot)	(__pte(((pte_t)(pfn) << PAGE_SHIFT) | pgprot_val(prot)))
-+#define pfn_pte(pfn, prot)	__pte(((pfn) << PAGE_SHIFT) | pgprot_val(prot))
- 
- /* Don't use virt_to_pfn for macros below: could cause truncations for PAE40*/
- #define pte_pfn(pte)		(pte_val(pte) >> PAGE_SHIFT)
-diff --git a/arch/arc/mm/cache.c b/arch/arc/mm/cache.c
-index 5a294b2..0b10efe 100644
---- a/arch/arc/mm/cache.c
-+++ b/arch/arc/mm/cache.c
-@@ -921,6 +921,15 @@ void arc_cache_init(void)
- 
- 	printk(arc_cache_mumbojumbo(0, str, sizeof(str)));
- 
-+	/*
-+	 * Only master CPU needs to execute rest of function:
-+	 *  - Assume SMP so all cores will have same cache config so
-+	 *    any geomtry checks will be same for all
-+	 *  - IOC setup / dma callbacks only need to be setup once
-+	 */
-+	if (cpu)
-+		return;
-+
- 	if (IS_ENABLED(CONFIG_ARC_HAS_ICACHE)) {
- 		struct cpuinfo_arc_cache *ic = &cpuinfo_arc700[cpu].icache;
- 
-diff --git a/arch/arm64/boot/dts/rockchip/rk3368.dtsi b/arch/arm64/boot/dts/rockchip/rk3368.dtsi
-index 080203e..dc7f3bc 100644
---- a/arch/arm64/boot/dts/rockchip/rk3368.dtsi
-+++ b/arch/arm64/boot/dts/rockchip/rk3368.dtsi
-@@ -270,6 +270,8 @@
- 		#io-channel-cells = <1>;
- 		clocks = <&cru SCLK_SARADC>, <&cru PCLK_SARADC>;
- 		clock-names = "saradc", "apb_pclk";
-+		resets = <&cru SRST_SARADC>;
-+		reset-names = "saradc-apb";
- 		status = "disabled";
- 	};
- 
-diff --git a/arch/arm64/include/asm/elf.h b/arch/arm64/include/asm/elf.h
-index 579b6e6..a55384f 100644
---- a/arch/arm64/include/asm/elf.h
-+++ b/arch/arm64/include/asm/elf.h
-@@ -140,6 +140,7 @@ typedef struct user_fpsimd_state elf_fpregset_t;
- 
- #define SET_PERSONALITY(ex)		clear_thread_flag(TIF_32BIT);
- 
-+/* update AT_VECTOR_SIZE_ARCH if the number of NEW_AUX_ENT entries changes */
- #define ARCH_DLINFO							\
- do {									\
- 	NEW_AUX_ENT(AT_SYSINFO_EHDR,					\
-diff --git a/arch/arm64/include/uapi/asm/auxvec.h b/arch/arm64/include/uapi/asm/auxvec.h
-index 22d6d88..4cf0c17 100644
---- a/arch/arm64/include/uapi/asm/auxvec.h
-+++ b/arch/arm64/include/uapi/asm/auxvec.h
-@@ -19,4 +19,6 @@
- /* vDSO location */
- #define AT_SYSINFO_EHDR	33
- 
-+#define AT_VECTOR_SIZE_ARCH 1 /* entries in ARCH_DLINFO */
-+
- #endif
-diff --git a/arch/arm64/kernel/head.S b/arch/arm64/kernel/head.S
-index 2c6e598..aa68aad 100644
---- a/arch/arm64/kernel/head.S
-+++ b/arch/arm64/kernel/head.S
-@@ -757,6 +757,9 @@ ENTRY(__enable_mmu)
- 	isb
- 	bl	__create_page_tables		// recreate kernel mapping
- 
-+	tlbi	vmalle1				// Remove any stale TLB entries
-+	dsb	nsh
-+
- 	msr	sctlr_el1, x19			// re-enable the MMU
- 	isb
- 	ic	iallu				// flush instructions fetched
-diff --git a/arch/arm64/kernel/sleep.S b/arch/arm64/kernel/sleep.S
-index 9a3aec9..ccf79d8 100644
---- a/arch/arm64/kernel/sleep.S
-+++ b/arch/arm64/kernel/sleep.S
-@@ -101,12 +101,20 @@ ENTRY(cpu_resume)
- 	bl	el2_setup		// if in EL2 drop to EL1 cleanly
- 	/* enable the MMU early - so we can access sleep_save_stash by va */
- 	adr_l	lr, __enable_mmu	/* __cpu_setup will return here */
--	ldr	x27, =_cpu_resume	/* __enable_mmu will branch here */
-+	adr_l	x27, _resume_switched	/* __enable_mmu will branch here */
- 	adrp	x25, idmap_pg_dir
- 	adrp	x26, swapper_pg_dir
- 	b	__cpu_setup
- ENDPROC(cpu_resume)
- 
-+	.pushsection	".idmap.text", "ax"
-+_resume_switched:
-+	ldr	x8, =_cpu_resume
-+	br	x8
-+ENDPROC(_resume_switched)
-+	.ltorg
-+	.popsection
-+
- ENTRY(_cpu_resume)
- 	mrs	x1, mpidr_el1
- 	adrp	x8, mpidr_hash
-diff --git a/arch/arm64/mm/proc.S b/arch/arm64/mm/proc.S
-index 5bb61de..9d37e96 100644
---- a/arch/arm64/mm/proc.S
-+++ b/arch/arm64/mm/proc.S
-@@ -100,7 +100,16 @@ ENTRY(cpu_do_resume)
- 
- 	msr	tcr_el1, x8
- 	msr	vbar_el1, x9
-+
-+	/*
-+	 * __cpu_setup() cleared MDSCR_EL1.MDE and friends, before unmasking
-+	 * debug exceptions. By restoring MDSCR_EL1 here, we may take a debug
-+	 * exception. Mask them until local_dbg_restore() in cpu_suspend()
-+	 * resets them.
-+	 */
-+	disable_dbg
- 	msr	mdscr_el1, x10
-+
- 	msr	sctlr_el1, x12
- 	/*
- 	 * Restore oslsr_el1 by writing oslar_el1
-diff --git a/arch/parisc/include/uapi/asm/errno.h b/arch/parisc/include/uapi/asm/errno.h
-index c0ae625..274d5bc 100644
---- a/arch/parisc/include/uapi/asm/errno.h
-+++ b/arch/parisc/include/uapi/asm/errno.h
-@@ -97,10 +97,10 @@
- #define	ENOTCONN	235	/* Transport endpoint is not connected */
- #define	ESHUTDOWN	236	/* Cannot send after transport endpoint shutdown */
- #define	ETOOMANYREFS	237	/* Too many references: cannot splice */
--#define EREFUSED	ECONNREFUSED	/* for HP's NFS apparently */
- #define	ETIMEDOUT	238	/* Connection timed out */
- #define	ECONNREFUSED	239	/* Connection refused */
--#define EREMOTERELEASE	240	/* Remote peer released connection */
-+#define	EREFUSED	ECONNREFUSED	/* for HP's NFS apparently */
-+#define	EREMOTERELEASE	240	/* Remote peer released connection */
- #define	EHOSTDOWN	241	/* Host is down */
- #define	EHOSTUNREACH	242	/* No route to host */
- 
-diff --git a/arch/parisc/kernel/processor.c b/arch/parisc/kernel/processor.c
-index 5adc339..0c2a94a 100644
---- a/arch/parisc/kernel/processor.c
-+++ b/arch/parisc/kernel/processor.c
-@@ -51,8 +51,6 @@ EXPORT_SYMBOL(_parisc_requires_coherency);
- 
- DEFINE_PER_CPU(struct cpuinfo_parisc, cpu_data);
- 
--extern int update_cr16_clocksource(void);	/* from time.c */
--
- /*
- **  	PARISC CPU driver - claim "device" and initialize CPU data structures.
- **
-@@ -228,12 +226,6 @@ static int processor_probe(struct parisc_device *dev)
- 	}
- #endif
- 
--	/* If we've registered more than one cpu,
--	 * we'll use the jiffies clocksource since cr16
--	 * is not synchronized between CPUs.
--	 */
--	update_cr16_clocksource();
--
- 	return 0;
- }
- 
-diff --git a/arch/parisc/kernel/time.c b/arch/parisc/kernel/time.c
-index 31ec99a..5eea7dc 100644
---- a/arch/parisc/kernel/time.c
-+++ b/arch/parisc/kernel/time.c
-@@ -220,18 +220,6 @@ static struct clocksource clocksource_cr16 = {
- 	.flags			= CLOCK_SOURCE_IS_CONTINUOUS,
- };
- 
--int update_cr16_clocksource(void)
--{
--	/* since the cr16 cycle counters are not synchronized across CPUs,
--	   we'll check if we should switch to a safe clocksource: */
--	if (clocksource_cr16.rating != 0 && num_online_cpus() > 1) {
--		clocksource_change_rating(&clocksource_cr16, 0);
--		return 1;
--	}
--
--	return 0;
--}
--
- void __init start_cpu_itimer(void)
- {
- 	unsigned int cpu = smp_processor_id();
-diff --git a/arch/um/include/asm/common.lds.S b/arch/um/include/asm/common.lds.S
-index 1dd5bd8..1330553 100644
---- a/arch/um/include/asm/common.lds.S
-+++ b/arch/um/include/asm/common.lds.S
-@@ -81,7 +81,7 @@
-   .altinstr_replacement : { *(.altinstr_replacement) }
-   /* .exit.text is discard at runtime, not link time, to deal with references
-      from .altinstructions and .eh_frame */
--  .exit.text : { *(.exit.text) }
-+  .exit.text : { EXIT_TEXT }
-   .exit.data : { *(.exit.data) }
- 
-   .preinit_array : {
-diff --git a/arch/x86/include/asm/tlbflush.h b/arch/x86/include/asm/tlbflush.h
-index 4e5be94..6fa8594 100644
---- a/arch/x86/include/asm/tlbflush.h
-+++ b/arch/x86/include/asm/tlbflush.h
-@@ -135,7 +135,14 @@ static inline void cr4_set_bits_and_update_boot(unsigned long mask)
- 
- static inline void __native_flush_tlb(void)
- {
-+	/*
-+	 * If current->mm == NULL then we borrow a mm which may change during a
-+	 * task switch and therefore we must not be preempted while we write CR3
-+	 * back:
-+	 */
-+	preempt_disable();
- 	native_write_cr3(native_read_cr3());
-+	preempt_enable();
- }
- 
- static inline void __native_flush_tlb_global_irq_disabled(void)
-diff --git a/arch/x86/kernel/uprobes.c b/arch/x86/kernel/uprobes.c
-index 6c1ff31..495c776 100644
---- a/arch/x86/kernel/uprobes.c
-+++ b/arch/x86/kernel/uprobes.c
-@@ -357,20 +357,22 @@ static void riprel_analyze(struct arch_uprobe *auprobe, struct insn *insn)
- 		*cursor &= 0xfe;
- 	}
- 	/*
--	 * Similar treatment for VEX3 prefix.
--	 * TODO: add XOP/EVEX treatment when insn decoder supports them
-+	 * Similar treatment for VEX3/EVEX prefix.
-+	 * TODO: add XOP treatment when insn decoder supports them
- 	 */
--	if (insn->vex_prefix.nbytes == 3) {
-+	if (insn->vex_prefix.nbytes >= 3) {
- 		/*
- 		 * vex2:     c5    rvvvvLpp   (has no b bit)
- 		 * vex3/xop: c4/8f rxbmmmmm wvvvvLpp
- 		 * evex:     62    rxbR00mm wvvvv1pp zllBVaaa
--		 *   (evex will need setting of both b and x since
--		 *   in non-sib encoding evex.x is 4th bit of MODRM.rm)
--		 * Setting VEX3.b (setting because it has inverted meaning):
-+		 * Setting VEX3.b (setting because it has inverted meaning).
-+		 * Setting EVEX.x since (in non-SIB encoding) EVEX.x
-+		 * is the 4th bit of MODRM.rm, and needs the same treatment.
-+		 * For VEX3-encoded insns, VEX3.x value has no effect in
-+		 * non-SIB encoding, the change is superfluous but harmless.
- 		 */
- 		cursor = auprobe->insn + insn_offset_vex_prefix(insn) + 1;
--		*cursor |= 0x20;
-+		*cursor |= 0x60;
- 	}
- 
- 	/*
-@@ -415,12 +417,10 @@ static void riprel_analyze(struct arch_uprobe *auprobe, struct insn *insn)
- 
- 	reg = MODRM_REG(insn);	/* Fetch modrm.reg */
- 	reg2 = 0xff;		/* Fetch vex.vvvv */
--	if (insn->vex_prefix.nbytes == 2)
--		reg2 = insn->vex_prefix.bytes[1];
--	else if (insn->vex_prefix.nbytes == 3)
-+	if (insn->vex_prefix.nbytes)
- 		reg2 = insn->vex_prefix.bytes[2];
- 	/*
--	 * TODO: add XOP, EXEV vvvv reading.
-+	 * TODO: add XOP vvvv reading.
- 	 *
- 	 * vex.vvvv field is in bits 6-3, bits are inverted.
- 	 * But in 32-bit mode, high-order bit may be ignored.
-diff --git a/arch/x86/platform/uv/bios_uv.c b/arch/x86/platform/uv/bios_uv.c
-index 815fec6..17943a8 100644
---- a/arch/x86/platform/uv/bios_uv.c
-+++ b/arch/x86/platform/uv/bios_uv.c
-@@ -188,7 +188,8 @@ EXPORT_SYMBOL_GPL(uv_bios_set_legacy_vga_target);
- void uv_bios_init(void)
- {
- 	uv_systab = NULL;
--	if ((efi.uv_systab == EFI_INVALID_TABLE_ADDR) || !efi.uv_systab) {
-+	if ((efi.uv_systab == EFI_INVALID_TABLE_ADDR) ||
-+	    !efi.uv_systab || efi_runtime_disabled()) {
- 		pr_crit("UV: UVsystab: missing\n");
- 		return;
- 	}
-diff --git a/drivers/acpi/cppc_acpi.c b/drivers/acpi/cppc_acpi.c
-index 8adac69..2e98173 100644
---- a/drivers/acpi/cppc_acpi.c
-+++ b/drivers/acpi/cppc_acpi.c
-@@ -299,8 +299,10 @@ int acpi_get_psd_map(struct cpudata **all_cpu_data)
- 			continue;
- 
- 		cpc_ptr = per_cpu(cpc_desc_ptr, i);
--		if (!cpc_ptr)
--			continue;
-+		if (!cpc_ptr) {
-+			retval = -EFAULT;
-+			goto err_ret;
-+		}
- 
- 		pdomain = &(cpc_ptr->domain_info);
- 		cpumask_set_cpu(i, pr->shared_cpu_map);
-@@ -322,8 +324,10 @@ int acpi_get_psd_map(struct cpudata **all_cpu_data)
- 				continue;
- 
- 			match_cpc_ptr = per_cpu(cpc_desc_ptr, j);
--			if (!match_cpc_ptr)
--				continue;
-+			if (!match_cpc_ptr) {
-+				retval = -EFAULT;
-+				goto err_ret;
-+			}
- 
- 			match_pdomain = &(match_cpc_ptr->domain_info);
- 			if (match_pdomain->domain != pdomain->domain)
-@@ -353,8 +357,10 @@ int acpi_get_psd_map(struct cpudata **all_cpu_data)
- 				continue;
- 
- 			match_cpc_ptr = per_cpu(cpc_desc_ptr, j);
--			if (!match_cpc_ptr)
--				continue;
-+			if (!match_cpc_ptr) {
-+				retval = -EFAULT;
-+				goto err_ret;
-+			}
- 
- 			match_pdomain = &(match_cpc_ptr->domain_info);
- 			if (match_pdomain->domain != pdomain->domain)
-@@ -595,9 +601,6 @@ int acpi_cppc_processor_probe(struct acpi_processor *pr)
- 	/* Store CPU Logical ID */
- 	cpc_ptr->cpu_id = pr->id;
- 
--	/* Plug it into this CPUs CPC descriptor. */
--	per_cpu(cpc_desc_ptr, pr->id) = cpc_ptr;
--
- 	/* Parse PSD data for this CPU */
- 	ret = acpi_get_psd(cpc_ptr, handle);
- 	if (ret)
-@@ -610,6 +613,9 @@ int acpi_cppc_processor_probe(struct acpi_processor *pr)
- 			goto out_free;
- 	}
- 
-+	/* Plug PSD data into this CPUs CPC descriptor. */
-+	per_cpu(cpc_desc_ptr, pr->id) = cpc_ptr;
-+
- 	/* Everything looks okay */
- 	pr_debug("Parsed CPC struct for CPU: %d\n", pr->id);
- 
-diff --git a/drivers/acpi/nfit.c b/drivers/acpi/nfit.c
-index 1f0e060..375c10f 100644
---- a/drivers/acpi/nfit.c
-+++ b/drivers/acpi/nfit.c
-@@ -1396,11 +1396,12 @@ static u32 read_blk_stat(struct nfit_blk *nfit_blk, unsigned int bw)
- {
- 	struct nfit_blk_mmio *mmio = &nfit_blk->mmio[DCR];
- 	u64 offset = nfit_blk->stat_offset + mmio->size * bw;
-+	const u32 STATUS_MASK = 0x80000037;
- 
- 	if (mmio->num_lines)
- 		offset = to_interleave_offset(offset, mmio);
- 
--	return readl(mmio->addr.base + offset);
-+	return readl(mmio->addr.base + offset) & STATUS_MASK;
- }
- 
- static void write_blk_ctl(struct nfit_blk *nfit_blk, unsigned int bw,
-diff --git a/drivers/acpi/scan.c b/drivers/acpi/scan.c
-index 5f28cf7..f3c0222 100644
---- a/drivers/acpi/scan.c
-+++ b/drivers/acpi/scan.c
-@@ -1967,7 +1967,7 @@ int __init acpi_scan_init(void)
- 
- static struct acpi_probe_entry *ape;
- static int acpi_probe_count;
--static DEFINE_SPINLOCK(acpi_probe_lock);
-+static DEFINE_MUTEX(acpi_probe_mutex);
- 
- static int __init acpi_match_madt(struct acpi_subtable_header *header,
- 				  const unsigned long end)
-@@ -1986,7 +1986,7 @@ int __init __acpi_probe_device_table(struct acpi_probe_entry *ap_head, int nr)
- 	if (acpi_disabled)
- 		return 0;
- 
--	spin_lock(&acpi_probe_lock);
-+	mutex_lock(&acpi_probe_mutex);
- 	for (ape = ap_head; nr; ape++, nr--) {
- 		if (ACPI_COMPARE_NAME(ACPI_SIG_MADT, ape->id)) {
- 			acpi_probe_count = 0;
-@@ -1999,7 +1999,7 @@ int __init __acpi_probe_device_table(struct acpi_probe_entry *ap_head, int nr)
- 				count++;
- 		}
- 	}
--	spin_unlock(&acpi_probe_lock);
-+	mutex_unlock(&acpi_probe_mutex);
- 
- 	return count;
- }
-diff --git a/drivers/block/floppy.c b/drivers/block/floppy.c
-index a1dcf12..84708a5 100644
---- a/drivers/block/floppy.c
-+++ b/drivers/block/floppy.c
-@@ -3663,6 +3663,11 @@ static int floppy_open(struct block_device *bdev, fmode_t mode)
- 
- 	opened_bdev[drive] = bdev;
- 
-+	if (!(mode & (FMODE_READ|FMODE_WRITE))) {
-+		res = -EINVAL;
-+		goto out;
-+	}
-+
- 	res = -ENXIO;
- 
- 	if (!floppy_track_buffer) {
-@@ -3706,15 +3711,13 @@ static int floppy_open(struct block_device *bdev, fmode_t mode)
- 	if (UFDCS->rawcmd == 1)
- 		UFDCS->rawcmd = 2;
- 
--	if (mode & (FMODE_READ|FMODE_WRITE)) {
--		UDRS->last_checked = 0;
--		clear_bit(FD_OPEN_SHOULD_FAIL_BIT, &UDRS->flags);
--		check_disk_change(bdev);
--		if (test_bit(FD_DISK_CHANGED_BIT, &UDRS->flags))
--			goto out;
--		if (test_bit(FD_OPEN_SHOULD_FAIL_BIT, &UDRS->flags))
--			goto out;
--	}
-+	UDRS->last_checked = 0;
-+	clear_bit(FD_OPEN_SHOULD_FAIL_BIT, &UDRS->flags);
-+	check_disk_change(bdev);
-+	if (test_bit(FD_DISK_CHANGED_BIT, &UDRS->flags))
-+		goto out;
-+	if (test_bit(FD_OPEN_SHOULD_FAIL_BIT, &UDRS->flags))
-+		goto out;
- 
- 	res = -EROFS;
- 
-diff --git a/drivers/clk/renesas/r8a7795-cpg-mssr.c b/drivers/clk/renesas/r8a7795-cpg-mssr.c
-index ca5519c..e7b98c4 100644
---- a/drivers/clk/renesas/r8a7795-cpg-mssr.c
-+++ b/drivers/clk/renesas/r8a7795-cpg-mssr.c
-@@ -91,6 +91,7 @@ static const struct cpg_core_clk r8a7795_core_clks[] __initconst = {
- 	DEF_FIXED(".s1",        CLK_S1,            CLK_PLL1_DIV2,  3, 1),
- 	DEF_FIXED(".s2",        CLK_S2,            CLK_PLL1_DIV2,  4, 1),
- 	DEF_FIXED(".s3",        CLK_S3,            CLK_PLL1_DIV2,  6, 1),
-+	DEF_FIXED(".sdsrc",     CLK_SDSRC,         CLK_PLL1_DIV2,  2, 1),
- 
- 	/* Core Clock Outputs */
- 	DEF_FIXED("ztr",        R8A7795_CLK_ZTR,   CLK_PLL1_DIV2,  6, 1),
-@@ -109,10 +110,10 @@ static const struct cpg_core_clk r8a7795_core_clks[] __initconst = {
- 	DEF_FIXED("s3d2",       R8A7795_CLK_S3D2,  CLK_S3,         2, 1),
- 	DEF_FIXED("s3d4",       R8A7795_CLK_S3D4,  CLK_S3,         4, 1),
- 
--	DEF_GEN3_SD("sd0",      R8A7795_CLK_SD0,   CLK_PLL1_DIV2, 0x0074),
--	DEF_GEN3_SD("sd1",      R8A7795_CLK_SD1,   CLK_PLL1_DIV2, 0x0078),
--	DEF_GEN3_SD("sd2",      R8A7795_CLK_SD2,   CLK_PLL1_DIV2, 0x0268),
--	DEF_GEN3_SD("sd3",      R8A7795_CLK_SD3,   CLK_PLL1_DIV2, 0x026c),
-+	DEF_GEN3_SD("sd0",      R8A7795_CLK_SD0,   CLK_SDSRC,     0x0074),
-+	DEF_GEN3_SD("sd1",      R8A7795_CLK_SD1,   CLK_SDSRC,     0x0078),
-+	DEF_GEN3_SD("sd2",      R8A7795_CLK_SD2,   CLK_SDSRC,     0x0268),
-+	DEF_GEN3_SD("sd3",      R8A7795_CLK_SD3,   CLK_SDSRC,     0x026c),
- 
- 	DEF_FIXED("cl",         R8A7795_CLK_CL,    CLK_PLL1_DIV2, 48, 1),
- 	DEF_FIXED("cp",         R8A7795_CLK_CP,    CLK_EXTAL,      2, 1),
-diff --git a/drivers/crypto/caam/caamalg.c b/drivers/crypto/caam/caamalg.c
-index ea8189f..6dc5971 100644
---- a/drivers/crypto/caam/caamalg.c
-+++ b/drivers/crypto/caam/caamalg.c
-@@ -441,6 +441,9 @@ static int aead_set_sh_desc(struct crypto_aead *aead)
- 			       OP_ALG_AAI_CTR_MOD128);
- 	const bool is_rfc3686 = alg->caam.rfc3686;
- 
-+	if (!ctx->authsize)
-+		return 0;
-+
- 	/* NULL encryption / decryption */
- 	if (!ctx->enckeylen)
- 		return aead_null_set_sh_desc(aead);
-@@ -614,7 +617,7 @@ skip_enc:
- 		keys_fit_inline = true;
- 
- 	/* aead_givencrypt shared descriptor */
--	desc = ctx->sh_desc_givenc;
-+	desc = ctx->sh_desc_enc;
- 
- 	/* Note: Context registers are saved. */
- 	init_sh_desc_key_aead(desc, ctx, keys_fit_inline, is_rfc3686);
-@@ -645,13 +648,13 @@ copy_iv:
- 	append_operation(desc, ctx->class2_alg_type |
- 			 OP_ALG_AS_INITFINAL | OP_ALG_ENCRYPT);
- 
--	/* ivsize + cryptlen = seqoutlen - authsize */
--	append_math_sub_imm_u32(desc, REG3, SEQOUTLEN, IMM, ctx->authsize);
--
- 	/* Read and write assoclen bytes */
- 	append_math_add(desc, VARSEQINLEN, ZERO, REG3, CAAM_CMD_SZ);
- 	append_math_add(desc, VARSEQOUTLEN, ZERO, REG3, CAAM_CMD_SZ);
- 
-+	/* ivsize + cryptlen = seqoutlen - authsize */
-+	append_math_sub_imm_u32(desc, REG3, SEQOUTLEN, IMM, ctx->authsize);
-+
- 	/* Skip assoc data */
- 	append_seq_fifo_store(desc, 0, FIFOST_TYPE_SKIP | FIFOLDST_VLF);
- 
-@@ -697,7 +700,7 @@ copy_iv:
- 	ctx->sh_desc_enc_dma = dma_map_single(jrdev, desc,
- 					      desc_bytes(desc),
- 					      DMA_TO_DEVICE);
--	if (dma_mapping_error(jrdev, ctx->sh_desc_givenc_dma)) {
-+	if (dma_mapping_error(jrdev, ctx->sh_desc_enc_dma)) {
- 		dev_err(jrdev, "unable to map shared descriptor\n");
- 		return -ENOMEM;
- 	}
-diff --git a/drivers/crypto/caam/caamhash.c b/drivers/crypto/caam/caamhash.c
-index 5845d4a..e9703f9 100644
---- a/drivers/crypto/caam/caamhash.c
-+++ b/drivers/crypto/caam/caamhash.c
-@@ -1897,6 +1897,7 @@ caam_hash_alloc(struct caam_hash_template *template,
- 			 template->name);
- 		snprintf(alg->cra_driver_name, CRYPTO_MAX_ALG_NAME, "%s",
- 			 template->driver_name);
-+		t_alg->ahash_alg.setkey = NULL;
- 	}
- 	alg->cra_module = THIS_MODULE;
- 	alg->cra_init = caam_hash_cra_init;
-diff --git a/drivers/crypto/nx/nx.c b/drivers/crypto/nx/nx.c
-index 0794f1c..42f0f22 100644
---- a/drivers/crypto/nx/nx.c
-+++ b/drivers/crypto/nx/nx.c
-@@ -392,7 +392,7 @@ static void nx_of_update_msc(struct device   *dev,
- 		     ((bytes_so_far + sizeof(struct msc_triplet)) <= lenp) &&
- 		     i < msc->triplets;
- 		     i++) {
--			if (msc->fc > NX_MAX_FC || msc->mode > NX_MAX_MODE) {
-+			if (msc->fc >= NX_MAX_FC || msc->mode >= NX_MAX_MODE) {
- 				dev_err(dev, "unknown function code/mode "
- 					"combo: %d/%d (ignored)\n", msc->fc,
- 					msc->mode);
-diff --git a/drivers/crypto/qat/qat_common/qat_algs.c b/drivers/crypto/qat/qat_common/qat_algs.c
-index 1e8852a8..4c9deef 100644
---- a/drivers/crypto/qat/qat_common/qat_algs.c
-+++ b/drivers/crypto/qat/qat_common/qat_algs.c
-@@ -1260,8 +1260,8 @@ static struct crypto_alg qat_algs[] = { {
- 			.setkey = qat_alg_ablkcipher_xts_setkey,
- 			.decrypt = qat_alg_ablkcipher_decrypt,
- 			.encrypt = qat_alg_ablkcipher_encrypt,
--			.min_keysize = AES_MIN_KEY_SIZE,
--			.max_keysize = AES_MAX_KEY_SIZE,
-+			.min_keysize = 2 * AES_MIN_KEY_SIZE,
-+			.max_keysize = 2 * AES_MAX_KEY_SIZE,
- 			.ivsize = AES_BLOCK_SIZE,
- 		},
- 	},
-diff --git a/drivers/dax/pmem.c b/drivers/dax/pmem.c
-index 55d510e..82e6743 100644
---- a/drivers/dax/pmem.c
-+++ b/drivers/dax/pmem.c
-@@ -118,6 +118,9 @@ static int dax_pmem_probe(struct device *dev)
- 		return rc;
- 	}
- 
-+	/* adjust the dax_region resource to the start of data */
-+	res.start += le64_to_cpu(pfn_sb->dataoff);
-+
- 	nd_region = to_nd_region(dev->parent);
- 	dax_region = alloc_dax_region(dev, nd_region->id, &res,
- 			le32_to_cpu(pfn_sb->align), addr, PFN_DEV|PFN_MAP);
-diff --git a/drivers/dma/sh/usb-dmac.c b/drivers/dma/sh/usb-dmac.c
-index 749f1bd..06ecdc3 100644
---- a/drivers/dma/sh/usb-dmac.c
-+++ b/drivers/dma/sh/usb-dmac.c
-@@ -600,27 +600,30 @@ static irqreturn_t usb_dmac_isr_channel(int irq, void *dev)
- {
- 	struct usb_dmac_chan *chan = dev;
- 	irqreturn_t ret = IRQ_NONE;
--	u32 mask = USB_DMACHCR_TE;
--	u32 check_bits = USB_DMACHCR_TE | USB_DMACHCR_SP;
-+	u32 mask = 0;
- 	u32 chcr;
-+	bool xfer_end = false;
- 
- 	spin_lock(&chan->vc.lock);
- 
- 	chcr = usb_dmac_chan_read(chan, USB_DMACHCR);
--	if (chcr & check_bits)
--		mask |= USB_DMACHCR_DE | check_bits;
-+	if (chcr & (USB_DMACHCR_TE | USB_DMACHCR_SP)) {
-+		mask |= USB_DMACHCR_DE | USB_DMACHCR_TE | USB_DMACHCR_SP;
-+		if (chcr & USB_DMACHCR_DE)
-+			xfer_end = true;
-+		ret |= IRQ_HANDLED;
-+	}
- 	if (chcr & USB_DMACHCR_NULL) {
- 		/* An interruption of TE will happen after we set FTE */
- 		mask |= USB_DMACHCR_NULL;
- 		chcr |= USB_DMACHCR_FTE;
- 		ret |= IRQ_HANDLED;
- 	}
--	usb_dmac_chan_write(chan, USB_DMACHCR, chcr & ~mask);
-+	if (mask)
-+		usb_dmac_chan_write(chan, USB_DMACHCR, chcr & ~mask);
- 
--	if (chcr & check_bits) {
-+	if (xfer_end)
- 		usb_dmac_isr_transfer_end(chan);
--		ret |= IRQ_HANDLED;
--	}
- 
- 	spin_unlock(&chan->vc.lock);
- 
-diff --git a/drivers/edac/sb_edac.c b/drivers/edac/sb_edac.c
-index 4fb2eb7..ce0067b 100644
---- a/drivers/edac/sb_edac.c
-+++ b/drivers/edac/sb_edac.c
-@@ -552,9 +552,9 @@ static const struct pci_id_table pci_dev_descr_haswell_table[] = {
- /* Knight's Landing Support */
- /*
-  * KNL's memory channels are swizzled between memory controllers.
-- * MC0 is mapped to CH3,5,6 and MC1 is mapped to CH0,1,2
-+ * MC0 is mapped to CH3,4,5 and MC1 is mapped to CH0,1,2
-  */
--#define knl_channel_remap(channel) ((channel + 3) % 6)
-+#define knl_channel_remap(mc, chan) ((mc) ? (chan) : (chan) + 3)
- 
- /* Memory controller, TAD tables, error injection - 2-8-0, 2-9-0 (2 of these) */
- #define PCI_DEVICE_ID_INTEL_KNL_IMC_MC       0x7840
-@@ -1286,7 +1286,7 @@ static u32 knl_get_mc_route(int entry, u32 reg)
- 	mc = GET_BITFIELD(reg, entry*3, (entry*3)+2);
- 	chan = GET_BITFIELD(reg, (entry*2) + 18, (entry*2) + 18 + 1);
- 
--	return knl_channel_remap(mc*3 + chan);
-+	return knl_channel_remap(mc, chan);
- }
- 
- /*
-@@ -2997,8 +2997,15 @@ static void sbridge_mce_output_error(struct mem_ctl_info *mci,
- 		} else {
- 			char A = *("A");
- 
--			channel = knl_channel_remap(channel);
-+			/*
-+			 * Reported channel is in range 0-2, so we can't map it
-+			 * back to mc. To figure out mc we check machine check
-+			 * bank register that reported this error.
-+			 * bank15 means mc0 and bank16 means mc1.
-+			 */
-+			channel = knl_channel_remap(m->bank == 16, channel);
- 			channel_mask = 1 << channel;
-+
- 			snprintf(msg, sizeof(msg),
- 				"%s%s err_code:%04x:%04x channel:%d (DIMM_%c)",
- 				overflow ? " OVERFLOW" : "",
-diff --git a/drivers/firmware/efi/capsule-loader.c b/drivers/firmware/efi/capsule-loader.c
-index c99c24b..9ae6c11 100644
---- a/drivers/firmware/efi/capsule-loader.c
-+++ b/drivers/firmware/efi/capsule-loader.c
-@@ -16,6 +16,7 @@
- #include <linux/slab.h>
- #include <linux/mutex.h>
- #include <linux/efi.h>
-+#include <linux/vmalloc.h>
- 
- #define NO_FURTHER_WRITE_ACTION -1
- 
-@@ -108,14 +109,15 @@ static ssize_t efi_capsule_submit_update(struct capsule_info *cap_info)
- 	int ret;
- 	void *cap_hdr_temp;
- 
--	cap_hdr_temp = kmap(cap_info->pages[0]);
-+	cap_hdr_temp = vmap(cap_info->pages, cap_info->index,
-+			VM_MAP, PAGE_KERNEL);
- 	if (!cap_hdr_temp) {
--		pr_debug("%s: kmap() failed\n", __func__);
-+		pr_debug("%s: vmap() failed\n", __func__);
- 		return -EFAULT;
- 	}
- 
- 	ret = efi_capsule_update(cap_hdr_temp, cap_info->pages);
--	kunmap(cap_info->pages[0]);
-+	vunmap(cap_hdr_temp);
- 	if (ret) {
- 		pr_err("%s: efi_capsule_update() failed\n", __func__);
- 		return ret;
-diff --git a/drivers/firmware/efi/capsule.c b/drivers/firmware/efi/capsule.c
-index 53b9fd2..6eedff4 100644
---- a/drivers/firmware/efi/capsule.c
-+++ b/drivers/firmware/efi/capsule.c
-@@ -190,9 +190,9 @@ efi_capsule_update_locked(efi_capsule_header_t *capsule,
-  * map the capsule described by @capsule with its data in @pages and
-  * send it to the firmware via the UpdateCapsule() runtime service.
-  *
-- * @capsule must be a virtual mapping of the first page in @pages
-- * (@pages[0]) in the kernel address space. That is, a
-- * capsule_header_t that describes the entire contents of the capsule
-+ * @capsule must be a virtual mapping of the complete capsule update in the
-+ * kernel address space, as the capsule can be consumed immediately.
-+ * A capsule_header_t that describes the entire contents of the capsule
-  * must be at the start of the first data page.
-  *
-  * Even though this function will validate that the firmware supports
-diff --git a/drivers/gpio/Kconfig b/drivers/gpio/Kconfig
-index d786061..5d457ff 100644
---- a/drivers/gpio/Kconfig
-+++ b/drivers/gpio/Kconfig
-@@ -50,6 +50,7 @@ config GPIO_DEVRES
- config OF_GPIO
- 	def_bool y
- 	depends on OF
-+	depends on HAS_IOMEM
- 
- config GPIO_ACPI
- 	def_bool y
-diff --git a/drivers/gpio/gpio-max730x.c b/drivers/gpio/gpio-max730x.c
-index 0880736..946d091 100644
---- a/drivers/gpio/gpio-max730x.c
-+++ b/drivers/gpio/gpio-max730x.c
-@@ -192,6 +192,10 @@ int __max730x_probe(struct max7301 *ts)
- 	ts->chip.parent = dev;
- 	ts->chip.owner = THIS_MODULE;
- 
-+	ret = gpiochip_add_data(&ts->chip, ts);
-+	if (ret)
-+		goto exit_destroy;
-+
- 	/*
- 	 * initialize pullups according to platform data and cache the
- 	 * register values for later use.
-@@ -213,10 +217,6 @@ int __max730x_probe(struct max7301 *ts)
- 		}
- 	}
- 
--	ret = gpiochip_add_data(&ts->chip, ts);
--	if (ret)
--		goto exit_destroy;
--
- 	return ret;
- 
- exit_destroy:
-diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu.h b/drivers/gpu/drm/amd/amdgpu/amdgpu.h
-index e055d5be..56475b1 100644
---- a/drivers/gpu/drm/amd/amdgpu/amdgpu.h
-+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu.h
-@@ -415,6 +415,8 @@ struct amdgpu_mman {
- 
- 	/* custom LRU management */
- 	struct amdgpu_mman_lru			log2_size[AMDGPU_TTM_LRU_SIZE];
-+	/* guard for log2_size array, don't add anything in between */
-+	struct amdgpu_mman_lru			guard;
- };
- 
- int amdgpu_copy_buffer(struct amdgpu_ring *ring,
-@@ -637,9 +639,9 @@ int amdgpu_gart_table_vram_pin(struct amdgpu_device *adev);
- void amdgpu_gart_table_vram_unpin(struct amdgpu_device *adev);
- int amdgpu_gart_init(struct amdgpu_device *adev);
- void amdgpu_gart_fini(struct amdgpu_device *adev);
--void amdgpu_gart_unbind(struct amdgpu_device *adev, unsigned offset,
-+void amdgpu_gart_unbind(struct amdgpu_device *adev, uint64_t offset,
- 			int pages);
--int amdgpu_gart_bind(struct amdgpu_device *adev, unsigned offset,
-+int amdgpu_gart_bind(struct amdgpu_device *adev, uint64_t offset,
- 		     int pages, struct page **pagelist,
- 		     dma_addr_t *dma_addr, uint32_t flags);
- 
-diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c
-index 9831753..fe872b8 100644
---- a/drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c
-+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c
-@@ -321,6 +321,19 @@ bool amdgpu_atombios_get_connector_info_from_object_table(struct amdgpu_device *
- 			    (le16_to_cpu(path->usConnObjectId) &
- 			     OBJECT_TYPE_MASK) >> OBJECT_TYPE_SHIFT;
- 
-+			/* Skip TV/CV support */
-+			if ((le16_to_cpu(path->usDeviceTag) ==
-+			     ATOM_DEVICE_TV1_SUPPORT) ||
-+			    (le16_to_cpu(path->usDeviceTag) ==
-+			     ATOM_DEVICE_CV_SUPPORT))
-+				continue;
-+
-+			if (con_obj_id >= ARRAY_SIZE(object_connector_convert)) {
-+				DRM_ERROR("invalid con_obj_id %d for device tag 0x%04x\n",
-+					  con_obj_id, le16_to_cpu(path->usDeviceTag));
-+				continue;
-+			}
-+
- 			connector_type =
- 				object_connector_convert[con_obj_id];
- 			connector_object_id = con_obj_id;
-diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_gart.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_gart.c
-index 921bce2..0feea34 100644
---- a/drivers/gpu/drm/amd/amdgpu/amdgpu_gart.c
-+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_gart.c
-@@ -221,7 +221,7 @@ void amdgpu_gart_table_vram_free(struct amdgpu_device *adev)
-  * Unbinds the requested pages from the gart page table and
-  * replaces them with the dummy page (all asics).
-  */
--void amdgpu_gart_unbind(struct amdgpu_device *adev, unsigned offset,
-+void amdgpu_gart_unbind(struct amdgpu_device *adev, uint64_t offset,
- 			int pages)
- {
- 	unsigned t;
-@@ -268,7 +268,7 @@ void amdgpu_gart_unbind(struct amdgpu_device *adev, unsigned offset,
-  * (all asics).
-  * Returns 0 for success, -EINVAL for failure.
-  */
--int amdgpu_gart_bind(struct amdgpu_device *adev, unsigned offset,
-+int amdgpu_gart_bind(struct amdgpu_device *adev, uint64_t offset,
- 		     int pages, struct page **pagelist, dma_addr_t *dma_addr,
- 		     uint32_t flags)
- {
-diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ib.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ib.c
-index 34e3542..194cfc1 100644
---- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ib.c
-+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ib.c
-@@ -288,7 +288,7 @@ void amdgpu_ib_pool_fini(struct amdgpu_device *adev)
- int amdgpu_ib_ring_tests(struct amdgpu_device *adev)
- {
- 	unsigned i;
--	int r;
-+	int r, ret = 0;
- 
- 	for (i = 0; i < AMDGPU_MAX_RINGS; ++i) {
- 		struct amdgpu_ring *ring = adev->rings[i];
-@@ -309,10 +309,11 @@ int amdgpu_ib_ring_tests(struct amdgpu_device *adev)
- 			} else {
- 				/* still not good, but we can live with it */
- 				DRM_ERROR("amdgpu: failed testing IB on ring %d (%d).\n", i, r);
-+				ret = r;
- 			}
- 		}
- 	}
--	return 0;
-+	return ret;
- }
- 
- /*
-diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c
-index 3b9053a..46c5297 100644
---- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c
-+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c
-@@ -251,8 +251,8 @@ static int amdgpu_move_blit(struct ttm_buffer_object *bo,
- 
- 	adev = amdgpu_get_adev(bo->bdev);
- 	ring = adev->mman.buffer_funcs_ring;
--	old_start = old_mem->start << PAGE_SHIFT;
--	new_start = new_mem->start << PAGE_SHIFT;
-+	old_start = (u64)old_mem->start << PAGE_SHIFT;
-+	new_start = (u64)new_mem->start << PAGE_SHIFT;
- 
- 	switch (old_mem->mem_type) {
- 	case TTM_PL_VRAM:
-@@ -943,6 +943,8 @@ static struct list_head *amdgpu_ttm_lru_tail(struct ttm_buffer_object *tbo)
- 	struct list_head *res = lru->lru[tbo->mem.mem_type];
- 
- 	lru->lru[tbo->mem.mem_type] = &tbo->lru;
-+	while ((++lru)->lru[tbo->mem.mem_type] == res)
-+		lru->lru[tbo->mem.mem_type] = &tbo->lru;
- 
- 	return res;
- }
-@@ -953,6 +955,8 @@ static struct list_head *amdgpu_ttm_swap_lru_tail(struct ttm_buffer_object *tbo)
- 	struct list_head *res = lru->swap_lru;
- 
- 	lru->swap_lru = &tbo->swap;
-+	while ((++lru)->swap_lru == res)
-+		lru->swap_lru = &tbo->swap;
- 
- 	return res;
- }
-@@ -1004,6 +1008,10 @@ int amdgpu_ttm_init(struct amdgpu_device *adev)
- 		lru->swap_lru = &adev->mman.bdev.glob->swap_lru;
- 	}
- 
-+	for (j = 0; j < TTM_NUM_MEM_TYPES; ++j)
-+		adev->mman.guard.lru[j] = NULL;
-+	adev->mman.guard.swap_lru = NULL;
-+
- 	adev->mman.initialized = true;
- 	r = ttm_bo_init_mm(&adev->mman.bdev, TTM_PL_VRAM,
- 				adev->mc.real_vram_size >> PAGE_SHIFT);
-diff --git a/drivers/gpu/drm/amd/amdgpu/cik_sdma.c b/drivers/gpu/drm/amd/amdgpu/cik_sdma.c
-index 9dc4e24..3a1bbe2 100644
---- a/drivers/gpu/drm/amd/amdgpu/cik_sdma.c
-+++ b/drivers/gpu/drm/amd/amdgpu/cik_sdma.c
-@@ -52,6 +52,7 @@ static void cik_sdma_set_ring_funcs(struct amdgpu_device *adev);
- static void cik_sdma_set_irq_funcs(struct amdgpu_device *adev);
- static void cik_sdma_set_buffer_funcs(struct amdgpu_device *adev);
- static void cik_sdma_set_vm_pte_funcs(struct amdgpu_device *adev);
-+static int cik_sdma_soft_reset(void *handle);
- 
- MODULE_FIRMWARE("radeon/bonaire_sdma.bin");
- MODULE_FIRMWARE("radeon/bonaire_sdma1.bin");
-@@ -1051,6 +1052,8 @@ static int cik_sdma_resume(void *handle)
- {
- 	struct amdgpu_device *adev = (struct amdgpu_device *)handle;
- 
-+	cik_sdma_soft_reset(handle);
-+
- 	return cik_sdma_hw_init(adev);
- }
- 
-diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v7_0.c b/drivers/gpu/drm/amd/amdgpu/gfx_v7_0.c
-index fc8ff4d..6b40809 100644
---- a/drivers/gpu/drm/amd/amdgpu/gfx_v7_0.c
-+++ b/drivers/gpu/drm/amd/amdgpu/gfx_v7_0.c
-@@ -2777,8 +2777,7 @@ static int gfx_v7_0_cp_compute_resume(struct amdgpu_device *adev)
- 	u64 wb_gpu_addr;
- 	u32 *buf;
- 	struct bonaire_mqd *mqd;
--
--	gfx_v7_0_cp_compute_enable(adev, true);
-+	struct amdgpu_ring *ring;
- 
- 	/* fix up chicken bits */
- 	tmp = RREG32(mmCP_CPF_DEBUG);
-@@ -2813,7 +2812,7 @@ static int gfx_v7_0_cp_compute_resume(struct amdgpu_device *adev)
- 
- 	/* init the queues.  Just two for now. */
- 	for (i = 0; i < adev->gfx.num_compute_rings; i++) {
--		struct amdgpu_ring *ring = &adev->gfx.compute_ring[i];
-+		ring = &adev->gfx.compute_ring[i];
- 
- 		if (ring->mqd_obj == NULL) {
- 			r = amdgpu_bo_create(adev,
-@@ -2992,6 +2991,13 @@ static int gfx_v7_0_cp_compute_resume(struct amdgpu_device *adev)
- 		amdgpu_bo_unreserve(ring->mqd_obj);
- 
- 		ring->ready = true;
-+	}
-+
-+	gfx_v7_0_cp_compute_enable(adev, true);
-+
-+	for (i = 0; i < adev->gfx.num_compute_rings; i++) {
-+		ring = &adev->gfx.compute_ring[i];
-+
- 		r = amdgpu_ring_test_ring(ring);
- 		if (r)
- 			ring->ready = false;
-diff --git a/drivers/gpu/drm/i915/i915_drv.c b/drivers/gpu/drm/i915/i915_drv.c
-index 85c4deb..fd3553b 100644
---- a/drivers/gpu/drm/i915/i915_drv.c
-+++ b/drivers/gpu/drm/i915/i915_drv.c
-@@ -1578,6 +1578,9 @@ static int intel_runtime_suspend(struct device *device)
- 
- 	assert_forcewakes_inactive(dev_priv);
- 
-+	if (!IS_VALLEYVIEW(dev_priv) || !IS_CHERRYVIEW(dev_priv))
-+		intel_hpd_poll_init(dev_priv);
-+
- 	DRM_DEBUG_KMS("Device suspended\n");
- 	return 0;
- }
-diff --git a/drivers/gpu/drm/i915/i915_drv.h b/drivers/gpu/drm/i915/i915_drv.h
-index 227a63e..0ed5fd3 100644
---- a/drivers/gpu/drm/i915/i915_drv.h
-+++ b/drivers/gpu/drm/i915/i915_drv.h
-@@ -281,6 +281,9 @@ struct i915_hotplug {
- 	u32 short_port_mask;
- 	struct work_struct dig_port_work;
- 
-+	struct work_struct poll_init_work;
-+	bool poll_enabled;
-+
- 	/*
- 	 * if we get a HPD irq from DP and a HPD irq from non-DP
- 	 * the non-DP HPD could block the workqueue on a mode config
-@@ -2791,6 +2794,8 @@ void intel_hpd_init(struct drm_i915_private *dev_priv);
- void intel_hpd_init_work(struct drm_i915_private *dev_priv);
- void intel_hpd_cancel_work(struct drm_i915_private *dev_priv);
- bool intel_hpd_pin_to_port(enum hpd_pin pin, enum port *port);
-+bool intel_hpd_disable(struct drm_i915_private *dev_priv, enum hpd_pin pin);
-+void intel_hpd_enable(struct drm_i915_private *dev_priv, enum hpd_pin pin);
- 
- /* i915_irq.c */
- void i915_queue_hangcheck(struct drm_device *dev);
-diff --git a/drivers/gpu/drm/i915/i915_gem_gtt.c b/drivers/gpu/drm/i915/i915_gem_gtt.c
-index 92acdff..e856f79 100644
---- a/drivers/gpu/drm/i915/i915_gem_gtt.c
-+++ b/drivers/gpu/drm/i915/i915_gem_gtt.c
-@@ -2826,6 +2826,7 @@ void i915_ggtt_cleanup_hw(struct drm_device *dev)
- 		struct i915_hw_ppgtt *ppgtt = dev_priv->mm.aliasing_ppgtt;
- 
- 		ppgtt->base.cleanup(&ppgtt->base);
-+		kfree(ppgtt);
- 	}
- 
- 	i915_gem_cleanup_stolen(dev);
-diff --git a/drivers/gpu/drm/i915/i915_reg.h b/drivers/gpu/drm/i915/i915_reg.h
-index bc3b6dd..5369a6d 100644
---- a/drivers/gpu/drm/i915/i915_reg.h
-+++ b/drivers/gpu/drm/i915/i915_reg.h
-@@ -1522,6 +1522,7 @@ enum skl_disp_power_wells {
- #define BALANCE_LEG_MASK(port)		(7<<(8+3*(port)))
- /* Balance leg disable bits */
- #define BALANCE_LEG_DISABLE_SHIFT	23
-+#define BALANCE_LEG_DISABLE(port)	(1 << (23 + (port)))
- 
- /*
-  * Fence registers
-diff --git a/drivers/gpu/drm/i915/intel_audio.c b/drivers/gpu/drm/i915/intel_audio.c
-index 02a7527..74eca43 100644
---- a/drivers/gpu/drm/i915/intel_audio.c
-+++ b/drivers/gpu/drm/i915/intel_audio.c
-@@ -600,6 +600,8 @@ static void i915_audio_component_codec_wake_override(struct device *dev,
- 	if (!IS_SKYLAKE(dev_priv) && !IS_KABYLAKE(dev_priv))
- 		return;
- 
-+	i915_audio_component_get_power(dev);
-+
- 	/*
- 	 * Enable/disable generating the codec wake signal, overriding the
- 	 * internal logic to generate the codec wake to controller.
-@@ -615,6 +617,8 @@ static void i915_audio_component_codec_wake_override(struct device *dev,
- 		I915_WRITE(HSW_AUD_CHICKENBIT, tmp);
- 		usleep_range(1000, 1500);
- 	}
-+
-+	i915_audio_component_put_power(dev);
- }
- 
- /* Get CDCLK in kHz  */
-@@ -654,6 +658,7 @@ static int i915_audio_component_sync_audio_rate(struct device *dev,
- 	    !IS_HASWELL(dev_priv))
- 		return 0;
- 
-+	i915_audio_component_get_power(dev);
- 	mutex_lock(&dev_priv->av_mutex);
- 	/* 1. get the pipe */
- 	intel_encoder = dev_priv->dig_port_map[port];
-@@ -704,6 +709,7 @@ static int i915_audio_component_sync_audio_rate(struct device *dev,
- 
-  unlock:
- 	mutex_unlock(&dev_priv->av_mutex);
-+	i915_audio_component_put_power(dev);
- 	return err;
- }
- 
-diff --git a/drivers/gpu/drm/i915/intel_crt.c b/drivers/gpu/drm/i915/intel_crt.c
-index 3fbb6fc..a3f87d6 100644
---- a/drivers/gpu/drm/i915/intel_crt.c
-+++ b/drivers/gpu/drm/i915/intel_crt.c
-@@ -327,10 +327,25 @@ static bool valleyview_crt_detect_hotplug(struct drm_connector *connector)
- 	struct drm_device *dev = connector->dev;
- 	struct intel_crt *crt = intel_attached_crt(connector);
- 	struct drm_i915_private *dev_priv = dev->dev_private;
-+	bool reenable_hpd;
- 	u32 adpa;
- 	bool ret;
- 	u32 save_adpa;
- 
-+	/*
-+	 * Doing a force trigger causes a hpd interrupt to get sent, which can
-+	 * get us stuck in a loop if we're polling:
-+	 *  - We enable power wells and reset the ADPA
-+	 *  - output_poll_exec does force probe on VGA, triggering a hpd
-+	 *  - HPD handler waits for poll to unlock dev->mode_config.mutex
-+	 *  - output_poll_exec shuts off the ADPA, unlocks
-+	 *    dev->mode_config.mutex
-+	 *  - HPD handler runs, resets ADPA and brings us back to the start
-+	 *
-+	 * Just disable HPD interrupts here to prevent this
-+	 */
-+	reenable_hpd = intel_hpd_disable(dev_priv, crt->base.hpd_pin);
-+
- 	save_adpa = adpa = I915_READ(crt->adpa_reg);
- 	DRM_DEBUG_KMS("trigger hotplug detect cycle: adpa=0x%x\n", adpa);
- 
-@@ -353,6 +368,9 @@ static bool valleyview_crt_detect_hotplug(struct drm_connector *connector)
- 
- 	DRM_DEBUG_KMS("valleyview hotplug adpa=0x%x, result %d\n", adpa, ret);
- 
-+	if (reenable_hpd)
-+		intel_hpd_enable(dev_priv, crt->base.hpd_pin);
-+
- 	return ret;
- }
- 
-@@ -713,11 +731,11 @@ static int intel_crt_set_property(struct drm_connector *connector,
- 	return 0;
- }
- 
--static void intel_crt_reset(struct drm_connector *connector)
-+void intel_crt_reset(struct drm_encoder *encoder)
- {
--	struct drm_device *dev = connector->dev;
-+	struct drm_device *dev = encoder->dev;
- 	struct drm_i915_private *dev_priv = dev->dev_private;
--	struct intel_crt *crt = intel_attached_crt(connector);
-+	struct intel_crt *crt = intel_encoder_to_crt(to_intel_encoder(encoder));
- 
- 	if (INTEL_INFO(dev)->gen >= 5) {
- 		u32 adpa;
-@@ -739,7 +757,6 @@ static void intel_crt_reset(struct drm_connector *connector)
-  */
- 
- static const struct drm_connector_funcs intel_crt_connector_funcs = {
--	.reset = intel_crt_reset,
- 	.dpms = drm_atomic_helper_connector_dpms,
- 	.detect = intel_crt_detect,
- 	.fill_modes = drm_helper_probe_single_connector_modes,
-@@ -757,6 +774,7 @@ static const struct drm_connector_helper_funcs intel_crt_connector_helper_funcs
- };
- 
- static const struct drm_encoder_funcs intel_crt_enc_funcs = {
-+	.reset = intel_crt_reset,
- 	.destroy = intel_encoder_destroy,
- };
- 
-@@ -902,5 +920,5 @@ void intel_crt_init(struct drm_device *dev)
- 		dev_priv->fdi_rx_config = I915_READ(FDI_RX_CTL(PIPE_A)) & fdi_config;
- 	}
- 
--	intel_crt_reset(connector);
-+	intel_crt_reset(&crt->base.base);
- }
-diff --git a/drivers/gpu/drm/i915/intel_ddi.c b/drivers/gpu/drm/i915/intel_ddi.c
-index 01e523d..12c4f43 100644
---- a/drivers/gpu/drm/i915/intel_ddi.c
-+++ b/drivers/gpu/drm/i915/intel_ddi.c
-@@ -145,7 +145,7 @@ static const struct ddi_buf_trans skl_ddi_translations_dp[] = {
- static const struct ddi_buf_trans skl_u_ddi_translations_dp[] = {
- 	{ 0x0000201B, 0x000000A2, 0x0 },
- 	{ 0x00005012, 0x00000088, 0x0 },
--	{ 0x80007011, 0x000000CD, 0x0 },
-+	{ 0x80007011, 0x000000CD, 0x1 },
- 	{ 0x80009010, 0x000000C0, 0x1 },
- 	{ 0x0000201B, 0x0000009D, 0x0 },
- 	{ 0x80005012, 0x000000C0, 0x1 },
-@@ -158,7 +158,7 @@ static const struct ddi_buf_trans skl_u_ddi_translations_dp[] = {
- static const struct ddi_buf_trans skl_y_ddi_translations_dp[] = {
- 	{ 0x00000018, 0x000000A2, 0x0 },
- 	{ 0x00005012, 0x00000088, 0x0 },
--	{ 0x80007011, 0x000000CD, 0x0 },
-+	{ 0x80007011, 0x000000CD, 0x3 },
- 	{ 0x80009010, 0x000000C0, 0x3 },
- 	{ 0x00000018, 0x0000009D, 0x0 },
- 	{ 0x80005012, 0x000000C0, 0x3 },
-@@ -388,6 +388,40 @@ skl_get_buf_trans_hdmi(struct drm_i915_private *dev_priv, int *n_entries)
- 	}
- }
- 
-+static int intel_ddi_hdmi_level(struct drm_i915_private *dev_priv, enum port port)
-+{
-+	int n_hdmi_entries;
-+	int hdmi_level;
-+	int hdmi_default_entry;
-+
-+	hdmi_level = dev_priv->vbt.ddi_port_info[port].hdmi_level_shift;
-+
-+	if (IS_BROXTON(dev_priv))
-+		return hdmi_level;
-+
-+	if (IS_SKYLAKE(dev_priv) || IS_KABYLAKE(dev_priv)) {
-+		skl_get_buf_trans_hdmi(dev_priv, &n_hdmi_entries);
-+		hdmi_default_entry = 8;
-+	} else if (IS_BROADWELL(dev_priv)) {
-+		n_hdmi_entries = ARRAY_SIZE(bdw_ddi_translations_hdmi);
-+		hdmi_default_entry = 7;
-+	} else if (IS_HASWELL(dev_priv)) {
-+		n_hdmi_entries = ARRAY_SIZE(hsw_ddi_translations_hdmi);
-+		hdmi_default_entry = 6;
-+	} else {
-+		WARN(1, "ddi translation table missing\n");
-+		n_hdmi_entries = ARRAY_SIZE(bdw_ddi_translations_hdmi);
-+		hdmi_default_entry = 7;
-+	}
-+
-+	/* Choose a good default if VBT is badly populated */
-+	if (hdmi_level == HDMI_LEVEL_SHIFT_UNKNOWN ||
-+	    hdmi_level >= n_hdmi_entries)
-+		hdmi_level = hdmi_default_entry;
-+
-+	return hdmi_level;
-+}
-+
- /*
-  * Starting with Haswell, DDI port buffers must be programmed with correct
-  * values in advance. The buffer values are different for FDI and DP modes,
-@@ -399,7 +433,7 @@ void intel_prepare_ddi_buffer(struct intel_encoder *encoder)
- {
- 	struct drm_i915_private *dev_priv = to_i915(encoder->base.dev);
- 	u32 iboost_bit = 0;
--	int i, n_hdmi_entries, n_dp_entries, n_edp_entries, hdmi_default_entry,
-+	int i, n_hdmi_entries, n_dp_entries, n_edp_entries,
- 	    size;
- 	int hdmi_level;
- 	enum port port;
-@@ -410,7 +444,7 @@ void intel_prepare_ddi_buffer(struct intel_encoder *encoder)
- 	const struct ddi_buf_trans *ddi_translations;
- 
- 	port = intel_ddi_get_encoder_port(encoder);
--	hdmi_level = dev_priv->vbt.ddi_port_info[port].hdmi_level_shift;
-+	hdmi_level = intel_ddi_hdmi_level(dev_priv, port);
- 
- 	if (IS_BROXTON(dev_priv)) {
- 		if (encoder->type != INTEL_OUTPUT_HDMI)
-@@ -430,7 +464,6 @@ void intel_prepare_ddi_buffer(struct intel_encoder *encoder)
- 				skl_get_buf_trans_edp(dev_priv, &n_edp_entries);
- 		ddi_translations_hdmi =
- 				skl_get_buf_trans_hdmi(dev_priv, &n_hdmi_entries);
--		hdmi_default_entry = 8;
- 		/* If we're boosting the current, set bit 31 of trans1 */
- 		if (dev_priv->vbt.ddi_port_info[port].hdmi_boost_level ||
- 		    dev_priv->vbt.ddi_port_info[port].dp_boost_level)
-@@ -456,7 +489,6 @@ void intel_prepare_ddi_buffer(struct intel_encoder *encoder)
- 
- 		n_dp_entries = ARRAY_SIZE(bdw_ddi_translations_dp);
- 		n_hdmi_entries = ARRAY_SIZE(bdw_ddi_translations_hdmi);
--		hdmi_default_entry = 7;
- 	} else if (IS_HASWELL(dev_priv)) {
- 		ddi_translations_fdi = hsw_ddi_translations_fdi;
- 		ddi_translations_dp = hsw_ddi_translations_dp;
-@@ -464,7 +496,6 @@ void intel_prepare_ddi_buffer(struct intel_encoder *encoder)
- 		ddi_translations_hdmi = hsw_ddi_translations_hdmi;
- 		n_dp_entries = n_edp_entries = ARRAY_SIZE(hsw_ddi_translations_dp);
- 		n_hdmi_entries = ARRAY_SIZE(hsw_ddi_translations_hdmi);
--		hdmi_default_entry = 6;
- 	} else {
- 		WARN(1, "ddi translation table missing\n");
- 		ddi_translations_edp = bdw_ddi_translations_dp;
-@@ -474,7 +505,6 @@ void intel_prepare_ddi_buffer(struct intel_encoder *encoder)
- 		n_edp_entries = ARRAY_SIZE(bdw_ddi_translations_edp);
- 		n_dp_entries = ARRAY_SIZE(bdw_ddi_translations_dp);
- 		n_hdmi_entries = ARRAY_SIZE(bdw_ddi_translations_hdmi);
--		hdmi_default_entry = 7;
- 	}
- 
- 	switch (encoder->type) {
-@@ -505,11 +535,6 @@ void intel_prepare_ddi_buffer(struct intel_encoder *encoder)
- 	if (encoder->type != INTEL_OUTPUT_HDMI)
- 		return;
- 
--	/* Choose a good default if VBT is badly populated */
--	if (hdmi_level == HDMI_LEVEL_SHIFT_UNKNOWN ||
--	    hdmi_level >= n_hdmi_entries)
--		hdmi_level = hdmi_default_entry;
--
- 	/* Entry 9 is for HDMI: */
- 	I915_WRITE(DDI_BUF_TRANS_LO(port, i),
- 		   ddi_translations_hdmi[hdmi_level].trans1 | iboost_bit);
-@@ -1371,14 +1396,30 @@ void intel_ddi_disable_pipe_clock(struct intel_crtc *intel_crtc)
- 			   TRANS_CLK_SEL_DISABLED);
- }
- 
--static void skl_ddi_set_iboost(struct drm_i915_private *dev_priv,
--			       u32 level, enum port port, int type)
-+static void _skl_ddi_set_iboost(struct drm_i915_private *dev_priv,
-+				enum port port, uint8_t iboost)
- {
-+	u32 tmp;
-+
-+	tmp = I915_READ(DISPIO_CR_TX_BMU_CR0);
-+	tmp &= ~(BALANCE_LEG_MASK(port) | BALANCE_LEG_DISABLE(port));
-+	if (iboost)
-+		tmp |= iboost << BALANCE_LEG_SHIFT(port);
-+	else
-+		tmp |= BALANCE_LEG_DISABLE(port);
-+	I915_WRITE(DISPIO_CR_TX_BMU_CR0, tmp);
-+}
-+
-+static void skl_ddi_set_iboost(struct intel_encoder *encoder, u32 level)
-+{
-+	struct intel_digital_port *intel_dig_port = enc_to_dig_port(&encoder->base);
-+	struct drm_i915_private *dev_priv = to_i915(intel_dig_port->base.base.dev);
-+	enum port port = intel_dig_port->port;
-+	int type = encoder->type;
- 	const struct ddi_buf_trans *ddi_translations;
- 	uint8_t iboost;
- 	uint8_t dp_iboost, hdmi_iboost;
- 	int n_entries;
--	u32 reg;
- 
- 	/* VBT may override standard boost values */
- 	dp_iboost = dev_priv->vbt.ddi_port_info[port].dp_boost_level;
-@@ -1420,16 +1461,10 @@ static void skl_ddi_set_iboost(struct drm_i915_private *dev_priv,
- 		return;
- 	}
- 
--	reg = I915_READ(DISPIO_CR_TX_BMU_CR0);
--	reg &= ~BALANCE_LEG_MASK(port);
--	reg &= ~(1 << (BALANCE_LEG_DISABLE_SHIFT + port));
--
--	if (iboost)
--		reg |= iboost << BALANCE_LEG_SHIFT(port);
--	else
--		reg |= 1 << (BALANCE_LEG_DISABLE_SHIFT + port);
-+	_skl_ddi_set_iboost(dev_priv, port, iboost);
- 
--	I915_WRITE(DISPIO_CR_TX_BMU_CR0, reg);
-+	if (port == PORT_A && intel_dig_port->max_lanes == 4)
-+		_skl_ddi_set_iboost(dev_priv, PORT_E, iboost);
- }
- 
- static void bxt_ddi_vswing_sequence(struct drm_i915_private *dev_priv,
-@@ -1560,7 +1595,7 @@ uint32_t ddi_signal_levels(struct intel_dp *intel_dp)
- 	level = translate_signal_level(signal_levels);
- 
- 	if (IS_SKYLAKE(dev_priv) || IS_KABYLAKE(dev_priv))
--		skl_ddi_set_iboost(dev_priv, level, port, encoder->type);
-+		skl_ddi_set_iboost(encoder, level);
- 	else if (IS_BROXTON(dev_priv))
- 		bxt_ddi_vswing_sequence(dev_priv, level, port, encoder->type);
- 
-@@ -1629,6 +1664,10 @@ static void intel_ddi_pre_enable(struct intel_encoder *intel_encoder)
- 			intel_dp_stop_link_train(intel_dp);
- 	} else if (type == INTEL_OUTPUT_HDMI) {
- 		struct intel_hdmi *intel_hdmi = enc_to_intel_hdmi(encoder);
-+		int level = intel_ddi_hdmi_level(dev_priv, port);
-+
-+		if (IS_SKYLAKE(dev_priv) || IS_KABYLAKE(dev_priv))
-+			skl_ddi_set_iboost(intel_encoder, level);
- 
- 		intel_hdmi->set_infoframes(encoder,
- 					   crtc->config->has_hdmi_sink,
-diff --git a/drivers/gpu/drm/i915/intel_drv.h b/drivers/gpu/drm/i915/intel_drv.h
-index f7f0f01..94144a7 100644
---- a/drivers/gpu/drm/i915/intel_drv.h
-+++ b/drivers/gpu/drm/i915/intel_drv.h
-@@ -1052,7 +1052,7 @@ void gen8_irq_power_well_pre_disable(struct drm_i915_private *dev_priv,
- 
- /* intel_crt.c */
- void intel_crt_init(struct drm_device *dev);
--
-+void intel_crt_reset(struct drm_encoder *encoder);
- 
- /* intel_ddi.c */
- void intel_ddi_clk_select(struct intel_encoder *encoder,
-@@ -1346,6 +1346,8 @@ void intel_dsi_init(struct drm_device *dev);
- 
- /* intel_dvo.c */
- void intel_dvo_init(struct drm_device *dev);
-+/* intel_hotplug.c */
-+void intel_hpd_poll_init(struct drm_i915_private *dev_priv);
- 
- 
- /* legacy fbdev emulation in intel_fbdev.c */
-diff --git a/drivers/gpu/drm/i915/intel_hotplug.c b/drivers/gpu/drm/i915/intel_hotplug.c
-index bee6730..2c49458 100644
---- a/drivers/gpu/drm/i915/intel_hotplug.c
-+++ b/drivers/gpu/drm/i915/intel_hotplug.c
-@@ -453,20 +453,47 @@ void intel_hpd_irq_handler(struct drm_device *dev,
-  *
-  * This is a separate step from interrupt enabling to simplify the locking rules
-  * in the driver load and resume code.
-+ *
-+ * Also see: intel_hpd_poll_init(), which enables connector polling
-  */
- void intel_hpd_init(struct drm_i915_private *dev_priv)
- {
--	struct drm_device *dev = dev_priv->dev;
--	struct drm_mode_config *mode_config = &dev->mode_config;
--	struct drm_connector *connector;
- 	int i;
- 
- 	for_each_hpd_pin(i) {
- 		dev_priv->hotplug.stats[i].count = 0;
- 		dev_priv->hotplug.stats[i].state = HPD_ENABLED;
- 	}
-+
-+	WRITE_ONCE(dev_priv->hotplug.poll_enabled, false);
-+	schedule_work(&dev_priv->hotplug.poll_init_work);
-+
-+	/*
-+	 * Interrupt setup is already guaranteed to be single-threaded, this is
-+	 * just to make the assert_spin_locked checks happy.
-+	 */
-+	spin_lock_irq(&dev_priv->irq_lock);
-+	if (dev_priv->display.hpd_irq_setup)
-+		dev_priv->display.hpd_irq_setup(dev_priv->dev);
-+	spin_unlock_irq(&dev_priv->irq_lock);
-+}
-+
-+void i915_hpd_poll_init_work(struct work_struct *work) {
-+	struct drm_i915_private *dev_priv =
-+		container_of(work, struct drm_i915_private,
-+			     hotplug.poll_init_work);
-+	struct drm_device *dev = dev_priv->dev;
-+	struct drm_mode_config *mode_config = &dev->mode_config;
-+	struct drm_connector *connector;
-+	bool enabled;
-+
-+	mutex_lock(&dev->mode_config.mutex);
-+
-+	enabled = READ_ONCE(dev_priv->hotplug.poll_enabled);
-+
- 	list_for_each_entry(connector, &mode_config->connector_list, head) {
--		struct intel_connector *intel_connector = to_intel_connector(connector);
-+		struct intel_connector *intel_connector =
-+			to_intel_connector(connector);
- 		connector->polled = intel_connector->polled;
- 
- 		/* MST has a dynamic intel_connector->encoder and it's reprobing
-@@ -475,24 +502,62 @@ void intel_hpd_init(struct drm_i915_private *dev_priv)
- 			continue;
- 
- 		if (!connector->polled && I915_HAS_HOTPLUG(dev) &&
--		    intel_connector->encoder->hpd_pin > HPD_NONE)
--			connector->polled = DRM_CONNECTOR_POLL_HPD;
-+		    intel_connector->encoder->hpd_pin > HPD_NONE) {
-+			connector->polled = enabled ?
-+				DRM_CONNECTOR_POLL_CONNECT |
-+				DRM_CONNECTOR_POLL_DISCONNECT :
-+				DRM_CONNECTOR_POLL_HPD;
-+		}
- 	}
- 
-+	if (enabled)
-+		drm_kms_helper_poll_enable_locked(dev);
-+
-+	mutex_unlock(&dev->mode_config.mutex);
-+
- 	/*
--	 * Interrupt setup is already guaranteed to be single-threaded, this is
--	 * just to make the assert_spin_locked checks happy.
-+	 * We might have missed any hotplugs that happened while we were
-+	 * in the middle of disabling polling
- 	 */
--	spin_lock_irq(&dev_priv->irq_lock);
--	if (dev_priv->display.hpd_irq_setup)
--		dev_priv->display.hpd_irq_setup(dev);
--	spin_unlock_irq(&dev_priv->irq_lock);
-+	if (!enabled)
-+		drm_helper_hpd_irq_event(dev);
-+}
-+
-+/**
-+ * intel_hpd_poll_init - enables/disables polling for connectors with hpd
-+ * @dev_priv: i915 device instance
-+ * @enabled: Whether to enable or disable polling
-+ *
-+ * This function enables polling for all connectors, regardless of whether or
-+ * not they support hotplug detection. Under certain conditions HPD may not be
-+ * functional. On most Intel GPUs, this happens when we enter runtime suspend.
-+ * On Valleyview and Cherryview systems, this also happens when we shut off all
-+ * of the powerwells.
-+ *
-+ * Since this function can get called in contexts where we're already holding
-+ * dev->mode_config.mutex, we do the actual hotplug enabling in a seperate
-+ * worker.
-+ *
-+ * Also see: intel_hpd_init(), which restores hpd handling.
-+ */
-+void intel_hpd_poll_init(struct drm_i915_private *dev_priv)
-+{
-+	WRITE_ONCE(dev_priv->hotplug.poll_enabled, true);
-+
-+	/*
-+	 * We might already be holding dev->mode_config.mutex, so do this in a
-+	 * seperate worker
-+	 * As well, there's no issue if we race here since we always reschedule
-+	 * this worker anyway
-+	 */
-+	schedule_work(&dev_priv->hotplug.poll_init_work);
- }
- 
- void intel_hpd_init_work(struct drm_i915_private *dev_priv)
- {
- 	INIT_WORK(&dev_priv->hotplug.hotplug_work, i915_hotplug_work_func);
- 	INIT_WORK(&dev_priv->hotplug.dig_port_work, i915_digport_work_func);
-+	INIT_WORK(&dev_priv->hotplug.poll_init_work, i915_hpd_poll_init_work);
- 	INIT_DELAYED_WORK(&dev_priv->hotplug.reenable_work,
- 			  intel_hpd_irq_storm_reenable_work);
- }
-@@ -509,5 +574,33 @@ void intel_hpd_cancel_work(struct drm_i915_private *dev_priv)
- 
- 	cancel_work_sync(&dev_priv->hotplug.dig_port_work);
- 	cancel_work_sync(&dev_priv->hotplug.hotplug_work);
-+	cancel_work_sync(&dev_priv->hotplug.poll_init_work);
- 	cancel_delayed_work_sync(&dev_priv->hotplug.reenable_work);
- }
-+
-+bool intel_hpd_disable(struct drm_i915_private *dev_priv, enum hpd_pin pin)
-+{
-+	bool ret = false;
-+
-+	if (pin == HPD_NONE)
-+		return false;
-+
-+	spin_lock_irq(&dev_priv->irq_lock);
-+	if (dev_priv->hotplug.stats[pin].state == HPD_ENABLED) {
-+		dev_priv->hotplug.stats[pin].state = HPD_DISABLED;
-+		ret = true;
-+	}
-+	spin_unlock_irq(&dev_priv->irq_lock);
-+
-+	return ret;
-+}
-+
-+void intel_hpd_enable(struct drm_i915_private *dev_priv, enum hpd_pin pin)
-+{
-+	if (pin == HPD_NONE)
-+		return;
-+
-+	spin_lock_irq(&dev_priv->irq_lock);
-+	dev_priv->hotplug.stats[pin].state = HPD_ENABLED;
-+	spin_unlock_irq(&dev_priv->irq_lock);
-+}
-diff --git a/drivers/gpu/drm/i915/intel_runtime_pm.c b/drivers/gpu/drm/i915/intel_runtime_pm.c
-index 7fb1da4..2592b39 100644
---- a/drivers/gpu/drm/i915/intel_runtime_pm.c
-+++ b/drivers/gpu/drm/i915/intel_runtime_pm.c
-@@ -952,6 +952,7 @@ static void vlv_init_display_clock_gating(struct drm_i915_private *dev_priv)
- 
- static void vlv_display_power_well_init(struct drm_i915_private *dev_priv)
- {
-+	struct intel_encoder *encoder;
- 	enum pipe pipe;
- 
- 	/*
-@@ -987,6 +988,12 @@ static void vlv_display_power_well_init(struct drm_i915_private *dev_priv)
- 
- 	intel_hpd_init(dev_priv);
- 
-+	/* Re-enable the ADPA, if we have one */
-+	for_each_intel_encoder(dev_priv->dev, encoder) {
-+		if (encoder->type == INTEL_OUTPUT_ANALOG)
-+			intel_crt_reset(&encoder->base);
-+	}
-+
- 	i915_redisable_vga_power_on(dev_priv->dev);
- }
- 
-@@ -1000,6 +1007,8 @@ static void vlv_display_power_well_deinit(struct drm_i915_private *dev_priv)
- 	synchronize_irq(dev_priv->dev->irq);
- 
- 	vlv_power_sequencer_reset(dev_priv);
-+
-+	intel_hpd_poll_init(dev_priv);
- }
- 
- static void vlv_display_power_well_enable(struct drm_i915_private *dev_priv,
-diff --git a/drivers/hwmon/iio_hwmon.c b/drivers/hwmon/iio_hwmon.c
-index b550ba5..8944987 100644
---- a/drivers/hwmon/iio_hwmon.c
-+++ b/drivers/hwmon/iio_hwmon.c
-@@ -110,24 +110,24 @@ static int iio_hwmon_probe(struct platform_device *pdev)
- 
- 		switch (type) {
- 		case IIO_VOLTAGE:
--			a->dev_attr.attr.name = kasprintf(GFP_KERNEL,
--							  "in%d_input",
--							  in_i++);
-+			a->dev_attr.attr.name = devm_kasprintf(dev, GFP_KERNEL,
-+							       "in%d_input",
-+							       in_i++);
- 			break;
- 		case IIO_TEMP:
--			a->dev_attr.attr.name = kasprintf(GFP_KERNEL,
--							  "temp%d_input",
--							  temp_i++);
-+			a->dev_attr.attr.name = devm_kasprintf(dev, GFP_KERNEL,
-+							       "temp%d_input",
-+							       temp_i++);
- 			break;
- 		case IIO_CURRENT:
--			a->dev_attr.attr.name = kasprintf(GFP_KERNEL,
--							  "curr%d_input",
--							  curr_i++);
-+			a->dev_attr.attr.name = devm_kasprintf(dev, GFP_KERNEL,
-+							       "curr%d_input",
-+							       curr_i++);
- 			break;
- 		case IIO_HUMIDITYRELATIVE:
--			a->dev_attr.attr.name = kasprintf(GFP_KERNEL,
--							  "humidity%d_input",
--							  humidity_i++);
-+			a->dev_attr.attr.name = devm_kasprintf(dev, GFP_KERNEL,
-+							       "humidity%d_input",
-+							       humidity_i++);
- 			break;
- 		default:
- 			ret = -EINVAL;
-diff --git a/drivers/hwmon/it87.c b/drivers/hwmon/it87.c
-index 730d840..55bf479 100644
---- a/drivers/hwmon/it87.c
-+++ b/drivers/hwmon/it87.c
-@@ -2015,6 +2015,7 @@ static struct attribute *it87_attributes_in[] = {
- 	&sensor_dev_attr_in10_input.dev_attr.attr,	/* 41 */
- 	&sensor_dev_attr_in11_input.dev_attr.attr,	/* 41 */
- 	&sensor_dev_attr_in12_input.dev_attr.attr,	/* 41 */
-+	NULL
- };
- 
- static const struct attribute_group it87_group_in = {
-diff --git a/drivers/i2c/busses/i2c-cros-ec-tunnel.c b/drivers/i2c/busses/i2c-cros-ec-tunnel.c
-index a0d95ff..2d5ff863 100644
---- a/drivers/i2c/busses/i2c-cros-ec-tunnel.c
-+++ b/drivers/i2c/busses/i2c-cros-ec-tunnel.c
-@@ -215,7 +215,7 @@ static int ec_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg i2c_msgs[],
- 	msg->outsize = request_len;
- 	msg->insize = response_len;
- 
--	result = cros_ec_cmd_xfer(bus->ec, msg);
-+	result = cros_ec_cmd_xfer_status(bus->ec, msg);
- 	if (result < 0) {
- 		dev_err(dev, "Error transferring EC i2c message %d\n", result);
- 		goto exit;
-diff --git a/drivers/i2c/muxes/i2c-demux-pinctrl.c b/drivers/i2c/muxes/i2c-demux-pinctrl.c
-index 8de073a..215ac87 100644
---- a/drivers/i2c/muxes/i2c-demux-pinctrl.c
-+++ b/drivers/i2c/muxes/i2c-demux-pinctrl.c
-@@ -68,7 +68,7 @@ static int i2c_demux_activate_master(struct i2c_demux_pinctrl_priv *priv, u32 ne
- 	adap = of_find_i2c_adapter_by_node(priv->chan[new_chan].parent_np);
- 	if (!adap) {
- 		ret = -ENODEV;
--		goto err;
-+		goto err_with_revert;
- 	}
- 
- 	p = devm_pinctrl_get_select(adap->dev.parent, priv->bus_name);
-@@ -103,6 +103,8 @@ static int i2c_demux_activate_master(struct i2c_demux_pinctrl_priv *priv, u32 ne
- 
-  err_with_put:
- 	i2c_put_adapter(adap);
-+ err_with_revert:
-+	of_changeset_revert(&priv->chan[new_chan].chgset);
-  err:
- 	dev_err(priv->dev, "failed to setup demux-adapter %d (%d)\n", new_chan, ret);
- 	return ret;
-diff --git a/drivers/iio/industrialio-buffer.c b/drivers/iio/industrialio-buffer.c
-index 90462fc..49bf9c5 100644
---- a/drivers/iio/industrialio-buffer.c
-+++ b/drivers/iio/industrialio-buffer.c
-@@ -107,6 +107,7 @@ ssize_t iio_buffer_read_first_n_outer(struct file *filp, char __user *buf,
- {
- 	struct iio_dev *indio_dev = filp->private_data;
- 	struct iio_buffer *rb = indio_dev->buffer;
-+	DEFINE_WAIT_FUNC(wait, woken_wake_function);
- 	size_t datum_size;
- 	size_t to_wait;
- 	int ret;
-@@ -131,19 +132,29 @@ ssize_t iio_buffer_read_first_n_outer(struct file *filp, char __user *buf,
- 	else
- 		to_wait = min_t(size_t, n / datum_size, rb->watermark);
- 
-+	add_wait_queue(&rb->pollq, &wait);
- 	do {
--		ret = wait_event_interruptible(rb->pollq,
--		      iio_buffer_ready(indio_dev, rb, to_wait, n / datum_size));
--		if (ret)
--			return ret;
-+		if (!indio_dev->info) {
-+			ret = -ENODEV;
-+			break;
-+		}
- 
--		if (!indio_dev->info)
--			return -ENODEV;
-+		if (!iio_buffer_ready(indio_dev, rb, to_wait, n / datum_size)) {
-+			if (signal_pending(current)) {
-+				ret = -ERESTARTSYS;
-+				break;
-+			}
-+
-+			wait_woken(&wait, TASK_INTERRUPTIBLE,
-+				   MAX_SCHEDULE_TIMEOUT);
-+			continue;
-+		}
- 
- 		ret = rb->access->read_first_n(rb, n, buf);
- 		if (ret == 0 && (filp->f_flags & O_NONBLOCK))
- 			ret = -EAGAIN;
- 	 } while (ret == 0);
-+	remove_wait_queue(&rb->pollq, &wait);
- 
- 	return ret;
- }
-diff --git a/drivers/input/keyboard/tegra-kbc.c b/drivers/input/keyboard/tegra-kbc.c
-index acc5394..29485bc 100644
---- a/drivers/input/keyboard/tegra-kbc.c
-+++ b/drivers/input/keyboard/tegra-kbc.c
-@@ -376,7 +376,7 @@ static int tegra_kbc_start(struct tegra_kbc *kbc)
- 	/* Reset the KBC controller to clear all previous status.*/
- 	reset_control_assert(kbc->rst);
- 	udelay(100);
--	reset_control_assert(kbc->rst);
-+	reset_control_deassert(kbc->rst);
- 	udelay(100);
- 
- 	tegra_kbc_config_pins(kbc);
-diff --git a/drivers/input/rmi4/rmi_driver.c b/drivers/input/rmi4/rmi_driver.c
-index faa295e..c83bce8 100644
---- a/drivers/input/rmi4/rmi_driver.c
-+++ b/drivers/input/rmi4/rmi_driver.c
-@@ -553,7 +553,6 @@ int rmi_read_register_desc(struct rmi_device *d, u16 addr,
- 		goto free_struct_buff;
- 
- 	reg = find_first_bit(rdesc->presense_map, RMI_REG_DESC_PRESENSE_BITS);
--	map_offset = 0;
- 	for (i = 0; i < rdesc->num_registers; i++) {
- 		struct rmi_register_desc_item *item = &rdesc->registers[i];
- 		int reg_size = struct_buf[offset];
-@@ -576,6 +575,8 @@ int rmi_read_register_desc(struct rmi_device *d, u16 addr,
- 		item->reg = reg;
- 		item->reg_size = reg_size;
- 
-+		map_offset = 0;
-+
- 		do {
- 			for (b = 0; b < 7; b++) {
- 				if (struct_buf[offset] & (0x1 << b))
-diff --git a/drivers/input/serio/i8042.c b/drivers/input/serio/i8042.c
-index 4541957..405252a 100644
---- a/drivers/input/serio/i8042.c
-+++ b/drivers/input/serio/i8042.c
-@@ -1277,6 +1277,7 @@ static int __init i8042_create_kbd_port(void)
- 	serio->start		= i8042_start;
- 	serio->stop		= i8042_stop;
- 	serio->close		= i8042_port_close;
-+	serio->ps2_cmd_mutex	= &i8042_mutex;
- 	serio->port_data	= port;
- 	serio->dev.parent	= &i8042_platform_device->dev;
- 	strlcpy(serio->name, "i8042 KBD port", sizeof(serio->name));
-@@ -1304,6 +1305,7 @@ static int __init i8042_create_aux_port(int idx)
- 	serio->write		= i8042_aux_write;
- 	serio->start		= i8042_start;
- 	serio->stop		= i8042_stop;
-+	serio->ps2_cmd_mutex	= &i8042_mutex;
- 	serio->port_data	= port;
- 	serio->dev.parent	= &i8042_platform_device->dev;
- 	if (idx < 0) {
-@@ -1373,21 +1375,6 @@ static void i8042_unregister_ports(void)
- 	}
- }
- 
--/*
-- * Checks whether port belongs to i8042 controller.
-- */
--bool i8042_check_port_owner(const struct serio *port)
--{
--	int i;
--
--	for (i = 0; i < I8042_NUM_PORTS; i++)
--		if (i8042_ports[i].serio == port)
--			return true;
--
--	return false;
--}
--EXPORT_SYMBOL(i8042_check_port_owner);
--
- static void i8042_free_irqs(void)
- {
- 	if (i8042_aux_irq_registered)
-diff --git a/drivers/input/serio/libps2.c b/drivers/input/serio/libps2.c
-index 316f2c8..83e9c66 100644
---- a/drivers/input/serio/libps2.c
-+++ b/drivers/input/serio/libps2.c
-@@ -56,19 +56,17 @@ EXPORT_SYMBOL(ps2_sendbyte);
- 
- void ps2_begin_command(struct ps2dev *ps2dev)
- {
--	mutex_lock(&ps2dev->cmd_mutex);
-+	struct mutex *m = ps2dev->serio->ps2_cmd_mutex ?: &ps2dev->cmd_mutex;
- 
--	if (i8042_check_port_owner(ps2dev->serio))
--		i8042_lock_chip();
-+	mutex_lock(m);
- }
- EXPORT_SYMBOL(ps2_begin_command);
- 
- void ps2_end_command(struct ps2dev *ps2dev)
- {
--	if (i8042_check_port_owner(ps2dev->serio))
--		i8042_unlock_chip();
-+	struct mutex *m = ps2dev->serio->ps2_cmd_mutex ?: &ps2dev->cmd_mutex;
- 
--	mutex_unlock(&ps2dev->cmd_mutex);
-+	mutex_unlock(m);
- }
- EXPORT_SYMBOL(ps2_end_command);
- 
-diff --git a/drivers/iommu/arm-smmu-v3.c b/drivers/iommu/arm-smmu-v3.c
-index 5f6b3bc..46ba2b6 100644
---- a/drivers/iommu/arm-smmu-v3.c
-+++ b/drivers/iommu/arm-smmu-v3.c
-@@ -879,7 +879,7 @@ static void arm_smmu_cmdq_skip_err(struct arm_smmu_device *smmu)
- 	 * We may have concurrent producers, so we need to be careful
- 	 * not to touch any of the shadow cmdq state.
- 	 */
--	queue_read(cmd, Q_ENT(q, idx), q->ent_dwords);
-+	queue_read(cmd, Q_ENT(q, cons), q->ent_dwords);
- 	dev_err(smmu->dev, "skipping command in error state:\n");
- 	for (i = 0; i < ARRAY_SIZE(cmd); ++i)
- 		dev_err(smmu->dev, "\t0x%016llx\n", (unsigned long long)cmd[i]);
-@@ -890,7 +890,7 @@ static void arm_smmu_cmdq_skip_err(struct arm_smmu_device *smmu)
- 		return;
- 	}
- 
--	queue_write(cmd, Q_ENT(q, idx), q->ent_dwords);
-+	queue_write(Q_ENT(q, cons), cmd, q->ent_dwords);
- }
- 
- static void arm_smmu_cmdq_issue_cmd(struct arm_smmu_device *smmu,
-@@ -1034,6 +1034,9 @@ static void arm_smmu_write_strtab_ent(struct arm_smmu_device *smmu, u32 sid,
- 		case STRTAB_STE_0_CFG_S2_TRANS:
- 			ste_live = true;
- 			break;
-+		case STRTAB_STE_0_CFG_ABORT:
-+			if (disable_bypass)
-+				break;
- 		default:
- 			BUG(); /* STE corruption */
- 		}
-diff --git a/drivers/iommu/arm-smmu.c b/drivers/iommu/arm-smmu.c
-index 9345a3f..31422d4 100644
---- a/drivers/iommu/arm-smmu.c
-+++ b/drivers/iommu/arm-smmu.c
-@@ -686,8 +686,7 @@ static struct iommu_gather_ops arm_smmu_gather_ops = {
- 
- static irqreturn_t arm_smmu_context_fault(int irq, void *dev)
- {
--	int flags, ret;
--	u32 fsr, fsynr, resume;
-+	u32 fsr, fsynr;
- 	unsigned long iova;
- 	struct iommu_domain *domain = dev;
- 	struct arm_smmu_domain *smmu_domain = to_smmu_domain(domain);
-@@ -701,34 +700,15 @@ static irqreturn_t arm_smmu_context_fault(int irq, void *dev)
- 	if (!(fsr & FSR_FAULT))
- 		return IRQ_NONE;
- 
--	if (fsr & FSR_IGN)
--		dev_err_ratelimited(smmu->dev,
--				    "Unexpected context fault (fsr 0x%x)\n",
--				    fsr);
--
- 	fsynr = readl_relaxed(cb_base + ARM_SMMU_CB_FSYNR0);
--	flags = fsynr & FSYNR0_WNR ? IOMMU_FAULT_WRITE : IOMMU_FAULT_READ;
--
- 	iova = readq_relaxed(cb_base + ARM_SMMU_CB_FAR);
--	if (!report_iommu_fault(domain, smmu->dev, iova, flags)) {
--		ret = IRQ_HANDLED;
--		resume = RESUME_RETRY;
--	} else {
--		dev_err_ratelimited(smmu->dev,
--		    "Unhandled context fault: iova=0x%08lx, fsynr=0x%x, cb=%d\n",
--		    iova, fsynr, cfg->cbndx);
--		ret = IRQ_NONE;
--		resume = RESUME_TERMINATE;
--	}
--
--	/* Clear the faulting FSR */
--	writel(fsr, cb_base + ARM_SMMU_CB_FSR);
- 
--	/* Retry or terminate any stalled transactions */
--	if (fsr & FSR_SS)
--		writel_relaxed(resume, cb_base + ARM_SMMU_CB_RESUME);
-+	dev_err_ratelimited(smmu->dev,
-+	"Unhandled context fault: fsr=0x%x, iova=0x%08lx, fsynr=0x%x, cb=%d\n",
-+			    fsr, iova, fsynr, cfg->cbndx);
- 
--	return ret;
-+	writel(fsr, cb_base + ARM_SMMU_CB_FSR);
-+	return IRQ_HANDLED;
- }
- 
- static irqreturn_t arm_smmu_global_fault(int irq, void *dev)
-@@ -837,7 +817,7 @@ static void arm_smmu_init_context_bank(struct arm_smmu_domain *smmu_domain,
- 	}
- 
- 	/* SCTLR */
--	reg = SCTLR_CFCFG | SCTLR_CFIE | SCTLR_CFRE | SCTLR_M | SCTLR_EAE_SBOP;
-+	reg = SCTLR_CFIE | SCTLR_CFRE | SCTLR_M | SCTLR_EAE_SBOP;
- 	if (stage1)
- 		reg |= SCTLR_S1_ASIDPNE;
- #ifdef __BIG_ENDIAN
-diff --git a/drivers/iommu/dma-iommu.c b/drivers/iommu/dma-iommu.c
-index ea5a9eb..97a2308 100644
---- a/drivers/iommu/dma-iommu.c
-+++ b/drivers/iommu/dma-iommu.c
-@@ -68,7 +68,8 @@ void iommu_put_dma_cookie(struct iommu_domain *domain)
- 	if (!iovad)
- 		return;
- 
--	put_iova_domain(iovad);
-+	if (iovad->granule)
-+		put_iova_domain(iovad);
- 	kfree(iovad);
- 	domain->iova_cookie = NULL;
- }
-diff --git a/drivers/iommu/io-pgtable-arm-v7s.c b/drivers/iommu/io-pgtable-arm-v7s.c
-index 8c61399..def8ca1 100644
---- a/drivers/iommu/io-pgtable-arm-v7s.c
-+++ b/drivers/iommu/io-pgtable-arm-v7s.c
-@@ -286,12 +286,14 @@ static int arm_v7s_pte_to_prot(arm_v7s_iopte pte, int lvl)
- 	int prot = IOMMU_READ;
- 	arm_v7s_iopte attr = pte >> ARM_V7S_ATTR_SHIFT(lvl);
- 
--	if (attr & ARM_V7S_PTE_AP_RDONLY)
-+	if (!(attr & ARM_V7S_PTE_AP_RDONLY))
- 		prot |= IOMMU_WRITE;
- 	if ((attr & (ARM_V7S_TEX_MASK << ARM_V7S_TEX_SHIFT)) == 0)
- 		prot |= IOMMU_MMIO;
- 	else if (pte & ARM_V7S_ATTR_C)
- 		prot |= IOMMU_CACHE;
-+	if (pte & ARM_V7S_ATTR_XN(lvl))
-+		prot |= IOMMU_NOEXEC;
- 
- 	return prot;
- }
-diff --git a/drivers/md/dm-round-robin.c b/drivers/md/dm-round-robin.c
-index 4ace1da..6c25213 100644
---- a/drivers/md/dm-round-robin.c
-+++ b/drivers/md/dm-round-robin.c
-@@ -210,14 +210,17 @@ static struct dm_path *rr_select_path(struct path_selector *ps, size_t nr_bytes)
- 	struct path_info *pi = NULL;
- 	struct dm_path *current_path = NULL;
- 
-+	local_irq_save(flags);
- 	current_path = *this_cpu_ptr(s->current_path);
- 	if (current_path) {
- 		percpu_counter_dec(&s->repeat_count);
--		if (percpu_counter_read_positive(&s->repeat_count) > 0)
-+		if (percpu_counter_read_positive(&s->repeat_count) > 0) {
-+			local_irq_restore(flags);
- 			return current_path;
-+		}
- 	}
- 
--	spin_lock_irqsave(&s->lock, flags);
-+	spin_lock(&s->lock);
- 	if (!list_empty(&s->valid_paths)) {
- 		pi = list_entry(s->valid_paths.next, struct path_info, list);
- 		list_move_tail(&pi->list, &s->valid_paths);
-diff --git a/drivers/of/base.c b/drivers/of/base.c
-index 8bb3d1a..c6a8f47 100644
---- a/drivers/of/base.c
-+++ b/drivers/of/base.c
-@@ -2318,20 +2318,13 @@ struct device_node *of_graph_get_endpoint_by_regs(
- 	const struct device_node *parent, int port_reg, int reg)
- {
- 	struct of_endpoint endpoint;
--	struct device_node *node, *prev_node = NULL;
--
--	while (1) {
--		node = of_graph_get_next_endpoint(parent, prev_node);
--		of_node_put(prev_node);
--		if (!node)
--			break;
-+	struct device_node *node = NULL;
- 
-+	for_each_endpoint_of_node(parent, node) {
- 		of_graph_parse_endpoint(node, &endpoint);
- 		if (((port_reg == -1) || (endpoint.port == port_reg)) &&
- 			((reg == -1) || (endpoint.id == reg)))
- 			return node;
--
--		prev_node = node;
- 	}
- 
- 	return NULL;
-diff --git a/drivers/pci/msi.c b/drivers/pci/msi.c
-index a080f44..565e2a4 100644
---- a/drivers/pci/msi.c
-+++ b/drivers/pci/msi.c
-@@ -1277,6 +1277,8 @@ struct irq_domain *pci_msi_create_irq_domain(struct fwnode_handle *fwnode,
- 	if (info->flags & MSI_FLAG_USE_DEF_CHIP_OPS)
- 		pci_msi_domain_update_chip_ops(info);
- 
-+	info->flags |= MSI_FLAG_ACTIVATE_EARLY;
-+
- 	domain = msi_create_irq_domain(fwnode, info, parent);
- 	if (!domain)
- 		return NULL;
-diff --git a/drivers/pinctrl/meson/pinctrl-meson.c b/drivers/pinctrl/meson/pinctrl-meson.c
-index 11623c6..44e69c9 100644
---- a/drivers/pinctrl/meson/pinctrl-meson.c
-+++ b/drivers/pinctrl/meson/pinctrl-meson.c
-@@ -727,13 +727,7 @@ static int meson_pinctrl_probe(struct platform_device *pdev)
- 		return PTR_ERR(pc->pcdev);
- 	}
- 
--	ret = meson_gpiolib_register(pc);
--	if (ret) {
--		pinctrl_unregister(pc->pcdev);
--		return ret;
--	}
--
--	return 0;
-+	return meson_gpiolib_register(pc);
- }
- 
- static struct platform_driver meson_pinctrl_driver = {
-diff --git a/drivers/pinctrl/pinctrl-amd.c b/drivers/pinctrl/pinctrl-amd.c
-index 634b4d3..b3e7723 100644
---- a/drivers/pinctrl/pinctrl-amd.c
-+++ b/drivers/pinctrl/pinctrl-amd.c
-@@ -43,17 +43,6 @@ static int amd_gpio_direction_input(struct gpio_chip *gc, unsigned offset)
- 
- 	spin_lock_irqsave(&gpio_dev->lock, flags);
- 	pin_reg = readl(gpio_dev->base + offset * 4);
--	/*
--	 * Suppose BIOS or Bootloader sets specific debounce for the
--	 * GPIO. if not, set debounce to be  2.75ms and remove glitch.
--	*/
--	if ((pin_reg & DB_TMR_OUT_MASK) == 0) {
--		pin_reg |= 0xf;
--		pin_reg |= BIT(DB_TMR_OUT_UNIT_OFF);
--		pin_reg |= DB_TYPE_REMOVE_GLITCH << DB_CNTRL_OFF;
--		pin_reg &= ~BIT(DB_TMR_LARGE_OFF);
--	}
--
- 	pin_reg &= ~BIT(OUTPUT_ENABLE_OFF);
- 	writel(pin_reg, gpio_dev->base + offset * 4);
- 	spin_unlock_irqrestore(&gpio_dev->lock, flags);
-@@ -326,15 +315,6 @@ static void amd_gpio_irq_enable(struct irq_data *d)
- 
- 	spin_lock_irqsave(&gpio_dev->lock, flags);
- 	pin_reg = readl(gpio_dev->base + (d->hwirq)*4);
--	/*
--		Suppose BIOS or Bootloader sets specific debounce for the
--		GPIO. if not, set debounce to be  2.75ms.
--	*/
--	if ((pin_reg & DB_TMR_OUT_MASK) == 0) {
--		pin_reg |= 0xf;
--		pin_reg |= BIT(DB_TMR_OUT_UNIT_OFF);
--		pin_reg &= ~BIT(DB_TMR_LARGE_OFF);
--	}
- 	pin_reg |= BIT(INTERRUPT_ENABLE_OFF);
- 	pin_reg |= BIT(INTERRUPT_MASK_OFF);
- 	writel(pin_reg, gpio_dev->base + (d->hwirq)*4);
-diff --git a/drivers/platform/chrome/cros_ec_proto.c b/drivers/platform/chrome/cros_ec_proto.c
-index b6e161f..6c084b2 100644
---- a/drivers/platform/chrome/cros_ec_proto.c
-+++ b/drivers/platform/chrome/cros_ec_proto.c
-@@ -380,3 +380,20 @@ int cros_ec_cmd_xfer(struct cros_ec_device *ec_dev,
- 	return ret;
- }
- EXPORT_SYMBOL(cros_ec_cmd_xfer);
-+
-+int cros_ec_cmd_xfer_status(struct cros_ec_device *ec_dev,
-+			    struct cros_ec_command *msg)
-+{
-+	int ret;
-+
-+	ret = cros_ec_cmd_xfer(ec_dev, msg);
-+	if (ret < 0) {
-+		dev_err(ec_dev->dev, "Command xfer error (err:%d)\n", ret);
-+	} else if (msg->result != EC_RES_SUCCESS) {
-+		dev_dbg(ec_dev->dev, "Command result (err: %d)\n", msg->result);
-+		return -EPROTO;
-+	}
-+
-+	return ret;
-+}
-+EXPORT_SYMBOL(cros_ec_cmd_xfer_status);
-diff --git a/drivers/s390/block/dasd.c b/drivers/s390/block/dasd.c
-index 8973d34..fb1b56a 100644
---- a/drivers/s390/block/dasd.c
-+++ b/drivers/s390/block/dasd.c
-@@ -1643,9 +1643,18 @@ void dasd_int_handler(struct ccw_device *cdev, unsigned long intparm,
- 	u8 *sense = NULL;
- 	int expires;
- 
-+	cqr = (struct dasd_ccw_req *) intparm;
- 	if (IS_ERR(irb)) {
- 		switch (PTR_ERR(irb)) {
- 		case -EIO:
-+			if (cqr && cqr->status == DASD_CQR_CLEAR_PENDING) {
-+				device = (struct dasd_device *) cqr->startdev;
-+				cqr->status = DASD_CQR_CLEARED;
-+				dasd_device_clear_timer(device);
-+				wake_up(&dasd_flush_wq);
-+				dasd_schedule_device_bh(device);
-+				return;
-+			}
- 			break;
- 		case -ETIMEDOUT:
- 			DBF_EVENT_DEVID(DBF_WARNING, cdev, "%s: "
-@@ -1661,7 +1670,6 @@ void dasd_int_handler(struct ccw_device *cdev, unsigned long intparm,
- 	}
- 
- 	now = get_tod_clock();
--	cqr = (struct dasd_ccw_req *) intparm;
- 	/* check for conditions that should be handled immediately */
- 	if (!cqr ||
- 	    !(scsw_dstat(&irb->scsw) == (DEV_STAT_CHN_END | DEV_STAT_DEV_END) &&
-diff --git a/drivers/scsi/aacraid/commctrl.c b/drivers/scsi/aacraid/commctrl.c
-index 4b3bb52..c424e8b 100644
---- a/drivers/scsi/aacraid/commctrl.c
-+++ b/drivers/scsi/aacraid/commctrl.c
-@@ -63,7 +63,7 @@ static int ioctl_send_fib(struct aac_dev * dev, void __user *arg)
- 	struct fib *fibptr;
- 	struct hw_fib * hw_fib = (struct hw_fib *)0;
- 	dma_addr_t hw_fib_pa = (dma_addr_t)0LL;
--	unsigned size;
-+	unsigned int size, osize;
- 	int retval;
- 
- 	if (dev->in_reset) {
-@@ -87,7 +87,8 @@ static int ioctl_send_fib(struct aac_dev * dev, void __user *arg)
- 	 *	will not overrun the buffer when we copy the memory. Return
- 	 *	an error if we would.
- 	 */
--	size = le16_to_cpu(kfib->header.Size) + sizeof(struct aac_fibhdr);
-+	osize = size = le16_to_cpu(kfib->header.Size) +
-+		sizeof(struct aac_fibhdr);
- 	if (size < le16_to_cpu(kfib->header.SenderSize))
- 		size = le16_to_cpu(kfib->header.SenderSize);
- 	if (size > dev->max_fib_size) {
-@@ -118,6 +119,14 @@ static int ioctl_send_fib(struct aac_dev * dev, void __user *arg)
- 		goto cleanup;
- 	}
- 
-+	/* Sanity check the second copy */
-+	if ((osize != le16_to_cpu(kfib->header.Size) +
-+		sizeof(struct aac_fibhdr))
-+		|| (size < le16_to_cpu(kfib->header.SenderSize))) {
-+		retval = -EINVAL;
-+		goto cleanup;
-+	}
-+
- 	if (kfib->header.Command == cpu_to_le16(TakeABreakPt)) {
- 		aac_adapter_interrupt(dev);
- 		/*
-diff --git a/drivers/scsi/megaraid/megaraid_sas_base.c b/drivers/scsi/megaraid/megaraid_sas_base.c
-index 2dab3dc..c1ed25a 100644
---- a/drivers/scsi/megaraid/megaraid_sas_base.c
-+++ b/drivers/scsi/megaraid/megaraid_sas_base.c
-@@ -5037,7 +5037,7 @@ static int megasas_init_fw(struct megasas_instance *instance)
- 	/* Find first memory bar */
- 	bar_list = pci_select_bars(instance->pdev, IORESOURCE_MEM);
- 	instance->bar = find_first_bit(&bar_list, sizeof(unsigned long));
--	if (pci_request_selected_regions(instance->pdev, instance->bar,
-+	if (pci_request_selected_regions(instance->pdev, 1<<instance->bar,
- 					 "megasas: LSI")) {
- 		dev_printk(KERN_DEBUG, &instance->pdev->dev, "IO memory region busy!\n");
- 		return -EBUSY;
-@@ -5339,7 +5339,7 @@ fail_ready_state:
- 	iounmap(instance->reg_set);
- 
-       fail_ioremap:
--	pci_release_selected_regions(instance->pdev, instance->bar);
-+	pci_release_selected_regions(instance->pdev, 1<<instance->bar);
- 
- 	return -EINVAL;
- }
-@@ -5360,7 +5360,7 @@ static void megasas_release_mfi(struct megasas_instance *instance)
- 
- 	iounmap(instance->reg_set);
- 
--	pci_release_selected_regions(instance->pdev, instance->bar);
-+	pci_release_selected_regions(instance->pdev, 1<<instance->bar);
- }
- 
- /**
-diff --git a/drivers/scsi/megaraid/megaraid_sas_fusion.c b/drivers/scsi/megaraid/megaraid_sas_fusion.c
-index ec83754..52d8bbf 100644
---- a/drivers/scsi/megaraid/megaraid_sas_fusion.c
-+++ b/drivers/scsi/megaraid/megaraid_sas_fusion.c
-@@ -2603,7 +2603,7 @@ megasas_release_fusion(struct megasas_instance *instance)
- 
- 	iounmap(instance->reg_set);
- 
--	pci_release_selected_regions(instance->pdev, instance->bar);
-+	pci_release_selected_regions(instance->pdev, 1<<instance->bar);
- }
- 
- /**
-diff --git a/drivers/scsi/mpt3sas/mpt3sas_base.c b/drivers/scsi/mpt3sas/mpt3sas_base.c
-index 751f13e..750f82c 100644
---- a/drivers/scsi/mpt3sas/mpt3sas_base.c
-+++ b/drivers/scsi/mpt3sas/mpt3sas_base.c
-@@ -2188,6 +2188,17 @@ mpt3sas_base_map_resources(struct MPT3SAS_ADAPTER *ioc)
- 	} else
- 		ioc->msix96_vector = 0;
- 
-+	if (ioc->is_warpdrive) {
-+		ioc->reply_post_host_index[0] = (resource_size_t __iomem *)
-+		    &ioc->chip->ReplyPostHostIndex;
-+
-+		for (i = 1; i < ioc->cpu_msix_table_sz; i++)
-+			ioc->reply_post_host_index[i] =
-+			(resource_size_t __iomem *)
-+			((u8 __iomem *)&ioc->chip->Doorbell + (0x4000 + ((i - 1)
-+			* 4)));
-+	}
-+
- 	list_for_each_entry(reply_q, &ioc->reply_queue_list, list)
- 		pr_info(MPT3SAS_FMT "%s: IRQ %d\n",
- 		    reply_q->name,  ((ioc->msix_enable) ? "PCI-MSI-X enabled" :
-@@ -5280,17 +5291,6 @@ mpt3sas_base_attach(struct MPT3SAS_ADAPTER *ioc)
- 	if (r)
- 		goto out_free_resources;
- 
--	if (ioc->is_warpdrive) {
--		ioc->reply_post_host_index[0] = (resource_size_t __iomem *)
--		    &ioc->chip->ReplyPostHostIndex;
--
--		for (i = 1; i < ioc->cpu_msix_table_sz; i++)
--			ioc->reply_post_host_index[i] =
--			(resource_size_t __iomem *)
--			((u8 __iomem *)&ioc->chip->Doorbell + (0x4000 + ((i - 1)
--			* 4)));
--	}
--
- 	pci_set_drvdata(ioc->pdev, ioc->shost);
- 	r = _base_get_ioc_facts(ioc, CAN_SLEEP);
- 	if (r)
-diff --git a/drivers/staging/comedi/drivers/comedi_test.c b/drivers/staging/comedi/drivers/comedi_test.c
-index 4ab1866..ec5b9a2 100644
---- a/drivers/staging/comedi/drivers/comedi_test.c
-+++ b/drivers/staging/comedi/drivers/comedi_test.c
-@@ -56,11 +56,6 @@
- 
- #define N_CHANS 8
- 
--enum waveform_state_bits {
--	WAVEFORM_AI_RUNNING,
--	WAVEFORM_AO_RUNNING
--};
--
- /* Data unique to this driver */
- struct waveform_private {
- 	struct timer_list ai_timer;	/* timer for AI commands */
-@@ -68,7 +63,6 @@ struct waveform_private {
- 	unsigned int wf_amplitude;	/* waveform amplitude in microvolts */
- 	unsigned int wf_period;		/* waveform period in microseconds */
- 	unsigned int wf_current;	/* current time in waveform period */
--	unsigned long state_bits;
- 	unsigned int ai_scan_period;	/* AI scan period in usec */
- 	unsigned int ai_convert_period;	/* AI conversion period in usec */
- 	struct timer_list ao_timer;	/* timer for AO commands */
-@@ -191,10 +185,6 @@ static void waveform_ai_timer(unsigned long arg)
- 	unsigned int nsamples;
- 	unsigned int time_increment;
- 
--	/* check command is still active */
--	if (!test_bit(WAVEFORM_AI_RUNNING, &devpriv->state_bits))
--		return;
--
- 	now = ktime_to_us(ktime_get());
- 	nsamples = comedi_nsamples_left(s, UINT_MAX);
- 
-@@ -386,11 +376,6 @@ static int waveform_ai_cmd(struct comedi_device *dev,
- 	 */
- 	devpriv->ai_timer.expires =
- 		jiffies + usecs_to_jiffies(devpriv->ai_convert_period) + 1;
--
--	/* mark command as active */
--	smp_mb__before_atomic();
--	set_bit(WAVEFORM_AI_RUNNING, &devpriv->state_bits);
--	smp_mb__after_atomic();
- 	add_timer(&devpriv->ai_timer);
- 	return 0;
- }
-@@ -400,11 +385,12 @@ static int waveform_ai_cancel(struct comedi_device *dev,
- {
- 	struct waveform_private *devpriv = dev->private;
- 
--	/* mark command as no longer active */
--	clear_bit(WAVEFORM_AI_RUNNING, &devpriv->state_bits);
--	smp_mb__after_atomic();
--	/* cannot call del_timer_sync() as may be called from timer routine */
--	del_timer(&devpriv->ai_timer);
-+	if (in_softirq()) {
-+		/* Assume we were called from the timer routine itself. */
-+		del_timer(&devpriv->ai_timer);
-+	} else {
-+		del_timer_sync(&devpriv->ai_timer);
-+	}
- 	return 0;
- }
- 
-@@ -436,10 +422,6 @@ static void waveform_ao_timer(unsigned long arg)
- 	u64 scans_since;
- 	unsigned int scans_avail = 0;
- 
--	/* check command is still active */
--	if (!test_bit(WAVEFORM_AO_RUNNING, &devpriv->state_bits))
--		return;
--
- 	/* determine number of scan periods since last time */
- 	now = ktime_to_us(ktime_get());
- 	scans_since = now - devpriv->ao_last_scan_time;
-@@ -518,11 +500,6 @@ static int waveform_ao_inttrig_start(struct comedi_device *dev,
- 	devpriv->ao_last_scan_time = ktime_to_us(ktime_get());
- 	devpriv->ao_timer.expires =
- 		jiffies + usecs_to_jiffies(devpriv->ao_scan_period);
--
--	/* mark command as active */
--	smp_mb__before_atomic();
--	set_bit(WAVEFORM_AO_RUNNING, &devpriv->state_bits);
--	smp_mb__after_atomic();
- 	add_timer(&devpriv->ao_timer);
- 
- 	return 1;
-@@ -608,11 +585,12 @@ static int waveform_ao_cancel(struct comedi_device *dev,
- 	struct waveform_private *devpriv = dev->private;
- 
- 	s->async->inttrig = NULL;
--	/* mark command as no longer active */
--	clear_bit(WAVEFORM_AO_RUNNING, &devpriv->state_bits);
--	smp_mb__after_atomic();
--	/* cannot call del_timer_sync() as may be called from timer routine */
--	del_timer(&devpriv->ao_timer);
-+	if (in_softirq()) {
-+		/* Assume we were called from the timer routine itself. */
-+		del_timer(&devpriv->ao_timer);
-+	} else {
-+		del_timer_sync(&devpriv->ao_timer);
-+	}
- 	return 0;
- }
- 
-diff --git a/drivers/staging/comedi/drivers/daqboard2000.c b/drivers/staging/comedi/drivers/daqboard2000.c
-index a536a15..a91ea02 100644
---- a/drivers/staging/comedi/drivers/daqboard2000.c
-+++ b/drivers/staging/comedi/drivers/daqboard2000.c
-@@ -636,7 +636,7 @@ static const void *daqboard2000_find_boardinfo(struct comedi_device *dev,
- 	const struct daq200_boardtype *board;
- 	int i;
- 
--	if (pcidev->subsystem_device != PCI_VENDOR_ID_IOTECH)
-+	if (pcidev->subsystem_vendor != PCI_VENDOR_ID_IOTECH)
- 		return NULL;
- 
- 	for (i = 0; i < ARRAY_SIZE(boardtypes); i++) {
-diff --git a/drivers/staging/comedi/drivers/ni_mio_common.c b/drivers/staging/comedi/drivers/ni_mio_common.c
-index 8dabb19..0f97d7b 100644
---- a/drivers/staging/comedi/drivers/ni_mio_common.c
-+++ b/drivers/staging/comedi/drivers/ni_mio_common.c
-@@ -2772,7 +2772,15 @@ static int ni_ao_inttrig(struct comedi_device *dev,
- 	int i;
- 	static const int timeout = 1000;
- 
--	if (trig_num != cmd->start_arg)
-+	/*
-+	 * Require trig_num == cmd->start_arg when cmd->start_src == TRIG_INT.
-+	 * For backwards compatibility, also allow trig_num == 0 when
-+	 * cmd->start_src != TRIG_INT (i.e. when cmd->start_src == TRIG_EXT);
-+	 * in that case, the internal trigger is being used as a pre-trigger
-+	 * before the external trigger.
-+	 */
-+	if (!(trig_num == cmd->start_arg ||
-+	      (trig_num == 0 && cmd->start_src != TRIG_INT)))
- 		return -EINVAL;
- 
- 	/*
-@@ -5480,7 +5488,7 @@ static int ni_E_init(struct comedi_device *dev,
- 		s->maxdata	= (devpriv->is_m_series) ? 0xffffffff
- 							 : 0x00ffffff;
- 		s->insn_read	= ni_tio_insn_read;
--		s->insn_write	= ni_tio_insn_read;
-+		s->insn_write	= ni_tio_insn_write;
- 		s->insn_config	= ni_tio_insn_config;
- #ifdef PCIDMA
- 		if (dev->irq && devpriv->mite) {
-diff --git a/drivers/staging/lustre/lustre/llite/namei.c b/drivers/staging/lustre/lustre/llite/namei.c
-index 5eba0eb..86e40ce 100644
---- a/drivers/staging/lustre/lustre/llite/namei.c
-+++ b/drivers/staging/lustre/lustre/llite/namei.c
-@@ -391,6 +391,7 @@ static int ll_lookup_it_finish(struct ptlrpc_request *request,
- 	struct inode *inode = NULL;
- 	__u64 bits = 0;
- 	int rc = 0;
-+	struct dentry *alias;
- 
- 	/* NB 1 request reference will be taken away by ll_intent_lock()
- 	 * when I return
-@@ -415,26 +416,12 @@ static int ll_lookup_it_finish(struct ptlrpc_request *request,
- 		 */
- 	}
- 
--	/* Only hash *de if it is unhashed (new dentry).
--	 * Atoimc_open may passing hashed dentries for open.
--	 */
--	if (d_unhashed(*de)) {
--		struct dentry *alias;
--
--		alias = ll_splice_alias(inode, *de);
--		if (IS_ERR(alias)) {
--			rc = PTR_ERR(alias);
--			goto out;
--		}
--		*de = alias;
--	} else if (!it_disposition(it, DISP_LOOKUP_NEG)  &&
--		   !it_disposition(it, DISP_OPEN_CREATE)) {
--		/* With DISP_OPEN_CREATE dentry will be
--		 * instantiated in ll_create_it.
--		 */
--		LASSERT(!d_inode(*de));
--		d_instantiate(*de, inode);
-+	alias = ll_splice_alias(inode, *de);
-+	if (IS_ERR(alias)) {
-+		rc = PTR_ERR(alias);
-+		goto out;
- 	}
-+	*de = alias;
- 
- 	if (!it_disposition(it, DISP_LOOKUP_NEG)) {
- 		/* we have lookup look - unhide dentry */
-@@ -590,6 +577,24 @@ static int ll_atomic_open(struct inode *dir, struct dentry *dentry,
- 	       dentry, PFID(ll_inode2fid(dir)), dir, file, open_flags, mode,
- 	       *opened);
- 
-+	/* Only negative dentries enter here */
-+	LASSERT(!d_inode(dentry));
-+
-+	if (!d_in_lookup(dentry)) {
-+		/* A valid negative dentry that just passed revalidation,
-+		 * there's little point to try and open it server-side,
-+		 * even though there's a minuscle chance it might succeed.
-+		 * Either way it's a valid race to just return -ENOENT here.
-+		 */
-+		if (!(open_flags & O_CREAT))
-+			return -ENOENT;
-+
-+		/* Otherwise we just unhash it to be rehashed afresh via
-+		 * lookup if necessary
-+		 */
-+		d_drop(dentry);
-+	}
-+
- 	it = kzalloc(sizeof(*it), GFP_NOFS);
- 	if (!it)
- 		return -ENOMEM;
-diff --git a/drivers/usb/chipidea/udc.c b/drivers/usb/chipidea/udc.c
-index 065f5d9..dfec5a1 100644
---- a/drivers/usb/chipidea/udc.c
-+++ b/drivers/usb/chipidea/udc.c
-@@ -1596,8 +1596,11 @@ static int ci_udc_pullup(struct usb_gadget *_gadget, int is_on)
- {
- 	struct ci_hdrc *ci = container_of(_gadget, struct ci_hdrc, gadget);
- 
--	/* Data+ pullup controlled by OTG state machine in OTG fsm mode */
--	if (ci_otg_is_fsm_mode(ci))
-+	/*
-+	 * Data+ pullup controlled by OTG state machine in OTG fsm mode;
-+	 * and don't touch Data+ in host mode for dual role config.
-+	 */
-+	if (ci_otg_is_fsm_mode(ci) || ci->role == CI_ROLE_HOST)
- 		return 0;
- 
- 	pm_runtime_get_sync(&ci->gadget.dev);
-diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
-index 94a14f5..0a4d54a 100644
---- a/drivers/usb/class/cdc-acm.c
-+++ b/drivers/usb/class/cdc-acm.c
-@@ -1405,7 +1405,6 @@ made_compressed_probe:
- 	spin_lock_init(&acm->write_lock);
- 	spin_lock_init(&acm->read_lock);
- 	mutex_init(&acm->mutex);
--	acm->rx_endpoint = usb_rcvbulkpipe(usb_dev, epread->bEndpointAddress);
- 	acm->is_int_ep = usb_endpoint_xfer_int(epread);
- 	if (acm->is_int_ep)
- 		acm->bInterval = epread->bInterval;
-@@ -1445,14 +1444,14 @@ made_compressed_probe:
- 		urb->transfer_dma = rb->dma;
- 		if (acm->is_int_ep) {
- 			usb_fill_int_urb(urb, acm->dev,
--					 acm->rx_endpoint,
-+					 usb_rcvintpipe(usb_dev, epread->bEndpointAddress),
- 					 rb->base,
- 					 acm->readsize,
- 					 acm_read_bulk_callback, rb,
- 					 acm->bInterval);
- 		} else {
- 			usb_fill_bulk_urb(urb, acm->dev,
--					  acm->rx_endpoint,
-+					  usb_rcvbulkpipe(usb_dev, epread->bEndpointAddress),
- 					  rb->base,
- 					  acm->readsize,
- 					  acm_read_bulk_callback, rb);
-diff --git a/drivers/usb/class/cdc-acm.h b/drivers/usb/class/cdc-acm.h
-index 05ce308..1f1eabf 100644
---- a/drivers/usb/class/cdc-acm.h
-+++ b/drivers/usb/class/cdc-acm.h
-@@ -96,7 +96,6 @@ struct acm {
- 	struct acm_rb read_buffers[ACM_NR];
- 	struct acm_wb *putbuffer;			/* for acm_tty_put_char() */
- 	int rx_buflimit;
--	int rx_endpoint;
- 	spinlock_t read_lock;
- 	int write_used;					/* number of non-empty write buffers */
- 	int transmitting;
-diff --git a/drivers/usb/core/config.c b/drivers/usb/core/config.c
-index 31ccdcc..15ce4ab 100644
---- a/drivers/usb/core/config.c
-+++ b/drivers/usb/core/config.c
-@@ -171,6 +171,31 @@ static void usb_parse_ss_endpoint_companion(struct device *ddev, int cfgno,
- 							ep, buffer, size);
- }
- 
-+static const unsigned short low_speed_maxpacket_maxes[4] = {
-+	[USB_ENDPOINT_XFER_CONTROL] = 8,
-+	[USB_ENDPOINT_XFER_ISOC] = 0,
-+	[USB_ENDPOINT_XFER_BULK] = 0,
-+	[USB_ENDPOINT_XFER_INT] = 8,
-+};
-+static const unsigned short full_speed_maxpacket_maxes[4] = {
-+	[USB_ENDPOINT_XFER_CONTROL] = 64,
-+	[USB_ENDPOINT_XFER_ISOC] = 1023,
-+	[USB_ENDPOINT_XFER_BULK] = 64,
-+	[USB_ENDPOINT_XFER_INT] = 64,
-+};
-+static const unsigned short high_speed_maxpacket_maxes[4] = {
-+	[USB_ENDPOINT_XFER_CONTROL] = 64,
-+	[USB_ENDPOINT_XFER_ISOC] = 1024,
-+	[USB_ENDPOINT_XFER_BULK] = 512,
-+	[USB_ENDPOINT_XFER_INT] = 1024,
-+};
-+static const unsigned short super_speed_maxpacket_maxes[4] = {
-+	[USB_ENDPOINT_XFER_CONTROL] = 512,
-+	[USB_ENDPOINT_XFER_ISOC] = 1024,
-+	[USB_ENDPOINT_XFER_BULK] = 1024,
-+	[USB_ENDPOINT_XFER_INT] = 1024,
-+};
-+
- static int usb_parse_endpoint(struct device *ddev, int cfgno, int inum,
-     int asnum, struct usb_host_interface *ifp, int num_ep,
-     unsigned char *buffer, int size)
-@@ -179,6 +204,8 @@ static int usb_parse_endpoint(struct device *ddev, int cfgno, int inum,
- 	struct usb_endpoint_descriptor *d;
- 	struct usb_host_endpoint *endpoint;
- 	int n, i, j, retval;
-+	unsigned int maxp;
-+	const unsigned short *maxpacket_maxes;
- 
- 	d = (struct usb_endpoint_descriptor *) buffer;
- 	buffer += d->bLength;
-@@ -286,6 +313,42 @@ static int usb_parse_endpoint(struct device *ddev, int cfgno, int inum,
- 			endpoint->desc.wMaxPacketSize = cpu_to_le16(8);
- 	}
- 
-+	/* Validate the wMaxPacketSize field */
-+	maxp = usb_endpoint_maxp(&endpoint->desc);
-+
-+	/* Find the highest legal maxpacket size for this endpoint */
-+	i = 0;		/* additional transactions per microframe */
-+	switch (to_usb_device(ddev)->speed) {
-+	case USB_SPEED_LOW:
-+		maxpacket_maxes = low_speed_maxpacket_maxes;
-+		break;
-+	case USB_SPEED_FULL:
-+		maxpacket_maxes = full_speed_maxpacket_maxes;
-+		break;
-+	case USB_SPEED_HIGH:
-+		/* Bits 12..11 are allowed only for HS periodic endpoints */
-+		if (usb_endpoint_xfer_int(d) || usb_endpoint_xfer_isoc(d)) {
-+			i = maxp & (BIT(12) | BIT(11));
-+			maxp &= ~i;
-+		}
-+		/* fallthrough */
-+	default:
-+		maxpacket_maxes = high_speed_maxpacket_maxes;
-+		break;
-+	case USB_SPEED_SUPER:
-+	case USB_SPEED_SUPER_PLUS:
-+		maxpacket_maxes = super_speed_maxpacket_maxes;
-+		break;
-+	}
-+	j = maxpacket_maxes[usb_endpoint_type(&endpoint->desc)];
-+
-+	if (maxp > j) {
-+		dev_warn(ddev, "config %d interface %d altsetting %d endpoint 0x%X has invalid maxpacket %d, setting to %d\n",
-+		    cfgno, inum, asnum, d->bEndpointAddress, maxp, j);
-+		maxp = j;
-+		endpoint->desc.wMaxPacketSize = cpu_to_le16(i | maxp);
-+	}
-+
- 	/*
- 	 * Some buggy high speed devices have bulk endpoints using
- 	 * maxpacket sizes other than 512.  High speed HCDs may not
-@@ -293,9 +356,6 @@ static int usb_parse_endpoint(struct device *ddev, int cfgno, int inum,
- 	 */
- 	if (to_usb_device(ddev)->speed == USB_SPEED_HIGH
- 			&& usb_endpoint_xfer_bulk(d)) {
--		unsigned maxp;
--
--		maxp = usb_endpoint_maxp(&endpoint->desc) & 0x07ff;
- 		if (maxp != 512)
- 			dev_warn(ddev, "config %d interface %d altsetting %d "
- 				"bulk endpoint 0x%X has invalid maxpacket %d\n",
-diff --git a/drivers/usb/core/devio.c b/drivers/usb/core/devio.c
-index e9f5043..50b6baa 100644
---- a/drivers/usb/core/devio.c
-+++ b/drivers/usb/core/devio.c
-@@ -241,7 +241,8 @@ static int usbdev_mmap(struct file *file, struct vm_area_struct *vma)
- 		goto error_decrease_mem;
- 	}
- 
--	mem = usb_alloc_coherent(ps->dev, size, GFP_USER, &dma_handle);
-+	mem = usb_alloc_coherent(ps->dev, size, GFP_USER | __GFP_NOWARN,
-+			&dma_handle);
- 	if (!mem) {
- 		ret = -ENOMEM;
- 		goto error_free_usbm;
-@@ -1708,11 +1709,17 @@ static int proc_do_submiturb(struct usb_dev_state *ps, struct usbdevfs_urb *uurb
- 	as->urb->start_frame = uurb->start_frame;
- 	as->urb->number_of_packets = number_of_packets;
- 	as->urb->stream_id = stream_id;
--	if (uurb->type == USBDEVFS_URB_TYPE_ISO ||
--			ps->dev->speed == USB_SPEED_HIGH)
--		as->urb->interval = 1 << min(15, ep->desc.bInterval - 1);
--	else
--		as->urb->interval = ep->desc.bInterval;
-+
-+	if (ep->desc.bInterval) {
-+		if (uurb->type == USBDEVFS_URB_TYPE_ISO ||
-+				ps->dev->speed == USB_SPEED_HIGH ||
-+				ps->dev->speed >= USB_SPEED_SUPER)
-+			as->urb->interval = 1 <<
-+					min(15, ep->desc.bInterval - 1);
-+		else
-+			as->urb->interval = ep->desc.bInterval;
-+	}
-+
- 	as->urb->context = as;
- 	as->urb->complete = async_completed;
- 	for (totlen = u = 0; u < number_of_packets; u++) {
-diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
-index bee1351..1d5fc32 100644
---- a/drivers/usb/core/hub.c
-+++ b/drivers/usb/core/hub.c
-@@ -1052,14 +1052,11 @@ static void hub_activate(struct usb_hub *hub, enum hub_activation_type type)
- 
- 	/* Continue a partial initialization */
- 	if (type == HUB_INIT2 || type == HUB_INIT3) {
--		device_lock(hub->intfdev);
-+		device_lock(&hdev->dev);
- 
- 		/* Was the hub disconnected while we were waiting? */
--		if (hub->disconnected) {
--			device_unlock(hub->intfdev);
--			kref_put(&hub->kref, hub_release);
--			return;
--		}
-+		if (hub->disconnected)
-+			goto disconnected;
- 		if (type == HUB_INIT2)
- 			goto init2;
- 		goto init3;
-@@ -1262,7 +1259,7 @@ static void hub_activate(struct usb_hub *hub, enum hub_activation_type type)
- 			queue_delayed_work(system_power_efficient_wq,
- 					&hub->init_work,
- 					msecs_to_jiffies(delay));
--			device_unlock(hub->intfdev);
-+			device_unlock(&hdev->dev);
- 			return;		/* Continues at init3: below */
- 		} else {
- 			msleep(delay);
-@@ -1281,12 +1278,12 @@ static void hub_activate(struct usb_hub *hub, enum hub_activation_type type)
- 	/* Scan all ports that need attention */
- 	kick_hub_wq(hub);
- 
--	/* Allow autosuspend if it was suppressed */
--	if (type <= HUB_INIT3)
-+	if (type == HUB_INIT2 || type == HUB_INIT3) {
-+		/* Allow autosuspend if it was suppressed */
-+ disconnected:
- 		usb_autopm_put_interface_async(to_usb_interface(hub->intfdev));
--
--	if (type == HUB_INIT2 || type == HUB_INIT3)
--		device_unlock(hub->intfdev);
-+		device_unlock(&hdev->dev);
-+	}
- 
- 	kref_put(&hub->kref, hub_release);
- }
-@@ -1315,8 +1312,6 @@ static void hub_quiesce(struct usb_hub *hub, enum hub_quiescing_type type)
- 	struct usb_device *hdev = hub->hdev;
- 	int i;
- 
--	cancel_delayed_work_sync(&hub->init_work);
--
- 	/* hub_wq and related activity won't re-trigger */
- 	hub->quiescing = 1;
- 
-diff --git a/drivers/usb/dwc3/dwc3-pci.c b/drivers/usb/dwc3/dwc3-pci.c
-index 14196cd..2fd5057 100644
---- a/drivers/usb/dwc3/dwc3-pci.c
-+++ b/drivers/usb/dwc3/dwc3-pci.c
-@@ -37,6 +37,7 @@
- #define PCI_DEVICE_ID_INTEL_BXT			0x0aaa
- #define PCI_DEVICE_ID_INTEL_BXT_M		0x1aaa
- #define PCI_DEVICE_ID_INTEL_APL			0x5aaa
-+#define PCI_DEVICE_ID_INTEL_KBP			0xa2b0
- 
- static const struct acpi_gpio_params reset_gpios = { 0, 0, false };
- static const struct acpi_gpio_params cs_gpios = { 1, 0, false };
-@@ -214,6 +215,7 @@ static const struct pci_device_id dwc3_pci_id_table[] = {
- 	{ PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_BXT), },
- 	{ PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_BXT_M), },
- 	{ PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_APL), },
-+	{ PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_KBP), },
- 	{ PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_NL_USB), },
- 	{  }	/* Terminating Entry */
- };
-diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
-index 716f4f0..05a5300 100644
---- a/drivers/usb/dwc3/gadget.c
-+++ b/drivers/usb/dwc3/gadget.c
-@@ -1897,7 +1897,8 @@ static void dwc3_gadget_free_endpoints(struct dwc3 *dwc)
- 
- static int __dwc3_cleanup_done_trbs(struct dwc3 *dwc, struct dwc3_ep *dep,
- 		struct dwc3_request *req, struct dwc3_trb *trb,
--		const struct dwc3_event_depevt *event, int status)
-+		const struct dwc3_event_depevt *event, int status,
-+		int chain)
- {
- 	unsigned int		count;
- 	unsigned int		s_pkt = 0;
-@@ -1905,6 +1906,19 @@ static int __dwc3_cleanup_done_trbs(struct dwc3 *dwc, struct dwc3_ep *dep,
- 
- 	trace_dwc3_complete_trb(dep, trb);
- 
-+	/*
-+	 * If we're in the middle of series of chained TRBs and we
-+	 * receive a short transfer along the way, DWC3 will skip
-+	 * through all TRBs including the last TRB in the chain (the
-+	 * where CHN bit is zero. DWC3 will also avoid clearing HWO
-+	 * bit and SW has to do it manually.
-+	 *
-+	 * We're going to do that here to avoid problems of HW trying
-+	 * to use bogus TRBs for transfers.
-+	 */
-+	if (chain && (trb->ctrl & DWC3_TRB_CTRL_HWO))
-+		trb->ctrl &= ~DWC3_TRB_CTRL_HWO;
-+
- 	if ((trb->ctrl & DWC3_TRB_CTRL_HWO) && status != -ESHUTDOWN)
- 		/*
- 		 * We continue despite the error. There is not much we
-@@ -1916,6 +1930,7 @@ static int __dwc3_cleanup_done_trbs(struct dwc3 *dwc, struct dwc3_ep *dep,
- 		 */
- 		dev_err(dwc->dev, "%s's TRB (%p) still owned by HW\n",
- 				dep->name, trb);
-+
- 	count = trb->size & DWC3_TRB_SIZE_MASK;
- 
- 	if (dep->direction) {
-@@ -1954,15 +1969,7 @@ static int __dwc3_cleanup_done_trbs(struct dwc3 *dwc, struct dwc3_ep *dep,
- 			s_pkt = 1;
- 	}
- 
--	/*
--	 * We assume here we will always receive the entire data block
--	 * which we should receive. Meaning, if we program RX to
--	 * receive 4K but we receive only 2K, we assume that's all we
--	 * should receive and we simply bounce the request back to the
--	 * gadget driver for further processing.
--	 */
--	req->request.actual += req->request.length - count;
--	if (s_pkt)
-+	if (s_pkt && !chain)
- 		return 1;
- 	if ((event->status & DEPEVT_STATUS_LST) &&
- 			(trb->ctrl & (DWC3_TRB_CTRL_LST |
-@@ -1981,13 +1988,17 @@ static int dwc3_cleanup_done_reqs(struct dwc3 *dwc, struct dwc3_ep *dep,
- 	struct dwc3_trb		*trb;
- 	unsigned int		slot;
- 	unsigned int		i;
-+	int			count = 0;
- 	int			ret;
- 
- 	do {
-+		int chain;
-+
- 		req = next_request(&dep->started_list);
- 		if (WARN_ON_ONCE(!req))
- 			return 1;
- 
-+		chain = req->request.num_mapped_sgs > 0;
- 		i = 0;
- 		do {
- 			slot = req->first_trb_index + i;
-@@ -1995,13 +2006,22 @@ static int dwc3_cleanup_done_reqs(struct dwc3 *dwc, struct dwc3_ep *dep,
- 				slot++;
- 			slot %= DWC3_TRB_NUM;
- 			trb = &dep->trb_pool[slot];
-+			count += trb->size & DWC3_TRB_SIZE_MASK;
- 
- 			ret = __dwc3_cleanup_done_trbs(dwc, dep, req, trb,
--					event, status);
-+					event, status, chain);
- 			if (ret)
- 				break;
- 		} while (++i < req->request.num_mapped_sgs);
- 
-+		/*
-+		 * We assume here we will always receive the entire data block
-+		 * which we should receive. Meaning, if we program RX to
-+		 * receive 4K but we receive only 2K, we assume that's all we
-+		 * should receive and we simply bounce the request back to the
-+		 * gadget driver for further processing.
-+		 */
-+		req->request.actual += req->request.length - count;
- 		dwc3_gadget_giveback(dep, req, status);
- 
- 		if (ret)
-diff --git a/drivers/usb/gadget/legacy/inode.c b/drivers/usb/gadget/legacy/inode.c
-index aa3707b..be64798 100644
---- a/drivers/usb/gadget/legacy/inode.c
-+++ b/drivers/usb/gadget/legacy/inode.c
-@@ -542,7 +542,7 @@ static ssize_t ep_aio(struct kiocb *iocb,
- 	 */
- 	spin_lock_irq(&epdata->dev->lock);
- 	value = -ENODEV;
--	if (unlikely(epdata->ep))
-+	if (unlikely(epdata->ep == NULL))
- 		goto fail;
- 
- 	req = usb_ep_alloc_request(epdata->ep, GFP_ATOMIC);
-diff --git a/drivers/usb/gadget/udc/fsl_qe_udc.c b/drivers/usb/gadget/udc/fsl_qe_udc.c
-index 93d28cb..cf8819a 100644
---- a/drivers/usb/gadget/udc/fsl_qe_udc.c
-+++ b/drivers/usb/gadget/udc/fsl_qe_udc.c
-@@ -2053,7 +2053,7 @@ static void setup_received_handle(struct qe_udc *udc,
- 			struct qe_ep *ep;
- 
- 			if (wValue != 0 || wLength != 0
--				|| pipe > USB_MAX_ENDPOINTS)
-+				|| pipe >= USB_MAX_ENDPOINTS)
- 				break;
- 			ep = &udc->eps[pipe];
- 
-diff --git a/drivers/usb/gadget/udc/udc-core.c b/drivers/usb/gadget/udc/udc-core.c
-index e1b2dce..bd46950 100644
---- a/drivers/usb/gadget/udc/udc-core.c
-+++ b/drivers/usb/gadget/udc/udc-core.c
-@@ -106,7 +106,7 @@ void usb_gadget_unmap_request_by_dev(struct device *dev,
- 		return;
- 
- 	if (req->num_mapped_sgs) {
--		dma_unmap_sg(dev, req->sg, req->num_mapped_sgs,
-+		dma_unmap_sg(dev, req->sg, req->num_sgs,
- 				is_in ? DMA_TO_DEVICE : DMA_FROM_DEVICE);
- 
- 		req->num_mapped_sgs = 0;
-diff --git a/drivers/usb/host/ehci-hcd.c b/drivers/usb/host/ehci-hcd.c
-index a962b89..1e5f529 100644
---- a/drivers/usb/host/ehci-hcd.c
-+++ b/drivers/usb/host/ehci-hcd.c
-@@ -332,11 +332,11 @@ static void ehci_turn_off_all_ports(struct ehci_hcd *ehci)
- 	int	port = HCS_N_PORTS(ehci->hcs_params);
- 
- 	while (port--) {
--		ehci_writel(ehci, PORT_RWC_BITS,
--				&ehci->regs->port_status[port]);
- 		spin_unlock_irq(&ehci->lock);
- 		ehci_port_power(ehci, port, false);
- 		spin_lock_irq(&ehci->lock);
-+		ehci_writel(ehci, PORT_RWC_BITS,
-+				&ehci->regs->port_status[port]);
- 	}
- }
- 
-diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c
-index d61fcc4..730b9fd 100644
---- a/drivers/usb/host/xhci-hub.c
-+++ b/drivers/usb/host/xhci-hub.c
-@@ -386,6 +386,9 @@ static int xhci_stop_device(struct xhci_hcd *xhci, int slot_id, int suspend)
- 
- 	ret = 0;
- 	virt_dev = xhci->devs[slot_id];
-+	if (!virt_dev)
-+		return -ENODEV;
-+
- 	cmd = xhci_alloc_command(xhci, false, true, GFP_NOIO);
- 	if (!cmd) {
- 		xhci_dbg(xhci, "Couldn't allocate command structure.\n");
-diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c
-index c10972f..69f7fab 100644
---- a/drivers/usb/host/xhci-pci.c
-+++ b/drivers/usb/host/xhci-pci.c
-@@ -314,11 +314,12 @@ static void xhci_pci_remove(struct pci_dev *dev)
- 		usb_remove_hcd(xhci->shared_hcd);
- 		usb_put_hcd(xhci->shared_hcd);
- 	}
--	usb_hcd_pci_remove(dev);
- 
- 	/* Workaround for spurious wakeups at shutdown with HSW */
- 	if (xhci->quirks & XHCI_SPURIOUS_WAKEUP)
- 		pci_set_power_state(dev, PCI_D3hot);
-+
-+	usb_hcd_pci_remove(dev);
- }
- 
- #ifdef CONFIG_PM
-diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
-index d7d5025..bc17bcf 100644
---- a/drivers/usb/host/xhci-ring.c
-+++ b/drivers/usb/host/xhci-ring.c
-@@ -1325,12 +1325,6 @@ static void handle_cmd_completion(struct xhci_hcd *xhci,
- 
- 	cmd = list_entry(xhci->cmd_list.next, struct xhci_command, cmd_list);
- 
--	if (cmd->command_trb != xhci->cmd_ring->dequeue) {
--		xhci_err(xhci,
--			 "Command completion event does not match command\n");
--		return;
--	}
--
- 	del_timer(&xhci->cmd_timer);
- 
- 	trace_xhci_cmd_completion(cmd_trb, (struct xhci_generic_trb *) event);
-@@ -1342,6 +1336,13 @@ static void handle_cmd_completion(struct xhci_hcd *xhci,
- 		xhci_handle_stopped_cmd_ring(xhci, cmd);
- 		return;
- 	}
-+
-+	if (cmd->command_trb != xhci->cmd_ring->dequeue) {
-+		xhci_err(xhci,
-+			 "Command completion event does not match command\n");
-+		return;
-+	}
-+
- 	/*
- 	 * Host aborted the command ring, check if the current command was
- 	 * supposed to be aborted, otherwise continue normally.
-diff --git a/drivers/usb/misc/usbtest.c b/drivers/usb/misc/usbtest.c
-index 6b978f0..5c8210d 100644
---- a/drivers/usb/misc/usbtest.c
-+++ b/drivers/usb/misc/usbtest.c
-@@ -585,7 +585,6 @@ static void sg_timeout(unsigned long _req)
- {
- 	struct usb_sg_request	*req = (struct usb_sg_request *) _req;
- 
--	req->status = -ETIMEDOUT;
- 	usb_sg_cancel(req);
- }
- 
-@@ -616,8 +615,10 @@ static int perform_sglist(
- 		mod_timer(&sg_timer, jiffies +
- 				msecs_to_jiffies(SIMPLE_IO_TIMEOUT));
- 		usb_sg_wait(req);
--		del_timer_sync(&sg_timer);
--		retval = req->status;
-+		if (!del_timer_sync(&sg_timer))
-+			retval = -ETIMEDOUT;
-+		else
-+			retval = req->status;
- 
- 		/* FIXME check resulting data pattern */
- 
-@@ -2602,7 +2603,7 @@ usbtest_ioctl(struct usb_interface *intf, unsigned int code, void *buf)
- 	ktime_get_ts64(&start);
- 
- 	retval = usbtest_do_ioctl(intf, param_32);
--	if (retval)
-+	if (retval < 0)
- 		goto free_mutex;
- 
- 	ktime_get_ts64(&end);
-diff --git a/drivers/usb/renesas_usbhs/common.c b/drivers/usb/renesas_usbhs/common.c
-index baeb7d2..8c81aac 100644
---- a/drivers/usb/renesas_usbhs/common.c
-+++ b/drivers/usb/renesas_usbhs/common.c
-@@ -514,7 +514,8 @@ static struct renesas_usbhs_platform_info *usbhs_parse_dt(struct device *dev)
- 	if (gpio > 0)
- 		dparam->enable_gpio = gpio;
- 
--	if (dparam->type == USBHS_TYPE_RCAR_GEN2)
-+	if (dparam->type == USBHS_TYPE_RCAR_GEN2 ||
-+	    dparam->type == USBHS_TYPE_RCAR_GEN3)
- 		dparam->has_usb_dmac = 1;
- 
- 	return info;
-diff --git a/drivers/usb/renesas_usbhs/fifo.c b/drivers/usb/renesas_usbhs/fifo.c
-index 280ed5f..857e783 100644
---- a/drivers/usb/renesas_usbhs/fifo.c
-+++ b/drivers/usb/renesas_usbhs/fifo.c
-@@ -871,7 +871,7 @@ static int usbhsf_dma_prepare_push(struct usbhs_pkt *pkt, int *is_done)
- 
- 	/* use PIO if packet is less than pio_dma_border or pipe is DCP */
- 	if ((len < usbhs_get_dparam(priv, pio_dma_border)) ||
--	    usbhs_pipe_is_dcp(pipe))
-+	    usbhs_pipe_type_is(pipe, USB_ENDPOINT_XFER_ISOC))
- 		goto usbhsf_pio_prepare_push;
- 
- 	/* check data length if this driver don't use USB-DMAC */
-@@ -976,7 +976,7 @@ static int usbhsf_dma_prepare_pop_with_usb_dmac(struct usbhs_pkt *pkt,
- 
- 	/* use PIO if packet is less than pio_dma_border or pipe is DCP */
- 	if ((pkt->length < usbhs_get_dparam(priv, pio_dma_border)) ||
--	    usbhs_pipe_is_dcp(pipe))
-+	    usbhs_pipe_type_is(pipe, USB_ENDPOINT_XFER_ISOC))
- 		goto usbhsf_pio_prepare_pop;
- 
- 	fifo = usbhsf_get_dma_fifo(priv, pkt);
-diff --git a/drivers/usb/renesas_usbhs/mod_gadget.c b/drivers/usb/renesas_usbhs/mod_gadget.c
-index 50f3363..c4c6474 100644
---- a/drivers/usb/renesas_usbhs/mod_gadget.c
-+++ b/drivers/usb/renesas_usbhs/mod_gadget.c
-@@ -617,10 +617,13 @@ static int usbhsg_ep_enable(struct usb_ep *ep,
- 		 * use dmaengine if possible.
- 		 * It will use pio handler if impossible.
- 		 */
--		if (usb_endpoint_dir_in(desc))
-+		if (usb_endpoint_dir_in(desc)) {
- 			pipe->handler = &usbhs_fifo_dma_push_handler;
--		else
-+		} else {
- 			pipe->handler = &usbhs_fifo_dma_pop_handler;
-+			usbhs_xxxsts_clear(priv, BRDYSTS,
-+					   usbhs_pipe_number(pipe));
-+		}
- 
- 		ret = 0;
- 	}
-@@ -1073,7 +1076,7 @@ int usbhs_mod_gadget_probe(struct usbhs_priv *priv)
- 
- 	gpriv->transceiver = usb_get_phy(USB_PHY_TYPE_UNDEFINED);
- 	dev_info(dev, "%stransceiver found\n",
--		 gpriv->transceiver ? "" : "no ");
-+		 !IS_ERR(gpriv->transceiver) ? "" : "no ");
- 
- 	/*
- 	 * CAUTION
-diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
-index 0082080..b2d767e 100644
---- a/drivers/usb/serial/ftdi_sio.c
-+++ b/drivers/usb/serial/ftdi_sio.c
-@@ -648,6 +648,8 @@ static const struct usb_device_id id_table_combined[] = {
- 	{ USB_DEVICE(FTDI_VID, FTDI_ELV_TFD128_PID) },
- 	{ USB_DEVICE(FTDI_VID, FTDI_ELV_FM3RX_PID) },
- 	{ USB_DEVICE(FTDI_VID, FTDI_ELV_WS777_PID) },
-+	{ USB_DEVICE(FTDI_VID, FTDI_PALMSENS_PID) },
-+	{ USB_DEVICE(FTDI_VID, FTDI_IVIUM_XSTAT_PID) },
- 	{ USB_DEVICE(FTDI_VID, LINX_SDMUSBQSS_PID) },
- 	{ USB_DEVICE(FTDI_VID, LINX_MASTERDEVEL2_PID) },
- 	{ USB_DEVICE(FTDI_VID, LINX_FUTURE_0_PID) },
-@@ -1008,6 +1010,7 @@ static const struct usb_device_id id_table_combined[] = {
- 	{ USB_DEVICE(ICPDAS_VID, ICPDAS_I7560U_PID) },
- 	{ USB_DEVICE(ICPDAS_VID, ICPDAS_I7561U_PID) },
- 	{ USB_DEVICE(ICPDAS_VID, ICPDAS_I7563U_PID) },
-+	{ USB_DEVICE(WICED_VID, WICED_USB20706V2_PID) },
- 	{ }					/* Terminating entry */
- };
- 
-diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h
-index c5d6c1e..f87a938 100644
---- a/drivers/usb/serial/ftdi_sio_ids.h
-+++ b/drivers/usb/serial/ftdi_sio_ids.h
-@@ -406,6 +406,12 @@
- #define FTDI_4N_GALAXY_DE_3_PID	0xF3C2
- 
- /*
-+ * Ivium Technologies product IDs
-+ */
-+#define FTDI_PALMSENS_PID	0xf440
-+#define FTDI_IVIUM_XSTAT_PID	0xf441
-+
-+/*
-  * Linx Technologies product ids
-  */
- #define LINX_SDMUSBQSS_PID	0xF448	/* Linx SDM-USB-QS-S */
-@@ -673,6 +679,12 @@
- #define INTREPID_NEOVI_PID	0x0701
- 
- /*
-+ * WICED USB UART
-+ */
-+#define WICED_VID		0x0A5C
-+#define WICED_USB20706V2_PID	0x6422
-+
-+/*
-  * Definitions for ID TECH (www.idt-net.com) devices
-  */
- #define IDTECH_VID		0x0ACD	/* ID TECH Vendor ID */
-diff --git a/drivers/usb/serial/mos7720.c b/drivers/usb/serial/mos7720.c
-index 5608af4..de9992b 100644
---- a/drivers/usb/serial/mos7720.c
-+++ b/drivers/usb/serial/mos7720.c
-@@ -1252,7 +1252,7 @@ static int mos7720_write(struct tty_struct *tty, struct usb_serial_port *port,
- 
- 	if (urb->transfer_buffer == NULL) {
- 		urb->transfer_buffer = kmalloc(URB_TRANSFER_BUFFER_SIZE,
--					       GFP_KERNEL);
-+					       GFP_ATOMIC);
- 		if (!urb->transfer_buffer)
- 			goto exit;
- 	}
-diff --git a/drivers/usb/serial/mos7840.c b/drivers/usb/serial/mos7840.c
-index ed378fb..57426d7 100644
---- a/drivers/usb/serial/mos7840.c
-+++ b/drivers/usb/serial/mos7840.c
-@@ -1340,8 +1340,8 @@ static int mos7840_write(struct tty_struct *tty, struct usb_serial_port *port,
- 	}
- 
- 	if (urb->transfer_buffer == NULL) {
--		urb->transfer_buffer =
--		    kmalloc(URB_TRANSFER_BUFFER_SIZE, GFP_KERNEL);
-+		urb->transfer_buffer = kmalloc(URB_TRANSFER_BUFFER_SIZE,
-+					       GFP_ATOMIC);
- 		if (!urb->transfer_buffer)
- 			goto exit;
- 	}
-diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
-index 8e07536..9894e34 100644
---- a/drivers/usb/serial/option.c
-+++ b/drivers/usb/serial/option.c
-@@ -274,6 +274,12 @@ static void option_instat_callback(struct urb *urb);
- #define TELIT_PRODUCT_LE920			0x1200
- #define TELIT_PRODUCT_LE910			0x1201
- #define TELIT_PRODUCT_LE910_USBCFG4		0x1206
-+#define TELIT_PRODUCT_LE920A4_1207		0x1207
-+#define TELIT_PRODUCT_LE920A4_1208		0x1208
-+#define TELIT_PRODUCT_LE920A4_1211		0x1211
-+#define TELIT_PRODUCT_LE920A4_1212		0x1212
-+#define TELIT_PRODUCT_LE920A4_1213		0x1213
-+#define TELIT_PRODUCT_LE920A4_1214		0x1214
- 
- /* ZTE PRODUCTS */
- #define ZTE_VENDOR_ID				0x19d2
-@@ -519,6 +525,12 @@ static void option_instat_callback(struct urb *urb);
- #define VIATELECOM_VENDOR_ID			0x15eb
- #define VIATELECOM_PRODUCT_CDS7			0x0001
- 
-+/* WeTelecom products */
-+#define WETELECOM_VENDOR_ID			0x22de
-+#define WETELECOM_PRODUCT_WMD200		0x6801
-+#define WETELECOM_PRODUCT_6802			0x6802
-+#define WETELECOM_PRODUCT_WMD300		0x6803
-+
- struct option_blacklist_info {
- 	/* bitmask of interface numbers blacklisted for send_setup */
- 	const unsigned long sendsetup;
-@@ -628,6 +640,11 @@ static const struct option_blacklist_info telit_le920_blacklist = {
- 	.reserved = BIT(1) | BIT(5),
- };
- 
-+static const struct option_blacklist_info telit_le920a4_blacklist_1 = {
-+	.sendsetup = BIT(0),
-+	.reserved = BIT(1),
-+};
-+
- static const struct option_blacklist_info telit_le922_blacklist_usbcfg0 = {
- 	.sendsetup = BIT(2),
- 	.reserved = BIT(0) | BIT(1) | BIT(3),
-@@ -1203,6 +1220,16 @@ static const struct usb_device_id option_ids[] = {
- 		.driver_info = (kernel_ulong_t)&telit_le922_blacklist_usbcfg3 },
- 	{ USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE920),
- 		.driver_info = (kernel_ulong_t)&telit_le920_blacklist },
-+	{ USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE920A4_1207) },
-+	{ USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE920A4_1208),
-+		.driver_info = (kernel_ulong_t)&telit_le920a4_blacklist_1 },
-+	{ USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE920A4_1211),
-+		.driver_info = (kernel_ulong_t)&telit_le922_blacklist_usbcfg3 },
-+	{ USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE920A4_1212),
-+		.driver_info = (kernel_ulong_t)&telit_le920a4_blacklist_1 },
-+	{ USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, TELIT_PRODUCT_LE920A4_1213, 0xff) },
-+	{ USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE920A4_1214),
-+		.driver_info = (kernel_ulong_t)&telit_le922_blacklist_usbcfg3 },
- 	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_MF622, 0xff, 0xff, 0xff) }, /* ZTE WCDMA products */
- 	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0002, 0xff, 0xff, 0xff),
- 		.driver_info = (kernel_ulong_t)&net_intf1_blacklist },
-@@ -1966,9 +1993,13 @@ static const struct usb_device_id option_ids[] = {
- 	  .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
- 	{ USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e01, 0xff, 0xff, 0xff) }, /* D-Link DWM-152/C1 */
- 	{ USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e02, 0xff, 0xff, 0xff) }, /* D-Link DWM-156/C1 */
-+	{ USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x7e11, 0xff, 0xff, 0xff) }, /* D-Link DWM-156/A3 */
- 	{ USB_DEVICE_INTERFACE_CLASS(0x2020, 0x4000, 0xff) },                /* OLICARD300 - MT6225 */
- 	{ USB_DEVICE(INOVIA_VENDOR_ID, INOVIA_SEW858) },
- 	{ USB_DEVICE(VIATELECOM_VENDOR_ID, VIATELECOM_PRODUCT_CDS7) },
-+	{ USB_DEVICE_AND_INTERFACE_INFO(WETELECOM_VENDOR_ID, WETELECOM_PRODUCT_WMD200, 0xff, 0xff, 0xff) },
-+	{ USB_DEVICE_AND_INTERFACE_INFO(WETELECOM_VENDOR_ID, WETELECOM_PRODUCT_6802, 0xff, 0xff, 0xff) },
-+	{ USB_DEVICE_AND_INTERFACE_INFO(WETELECOM_VENDOR_ID, WETELECOM_PRODUCT_WMD300, 0xff, 0xff, 0xff) },
- 	{ } /* Terminating entry */
- };
- MODULE_DEVICE_TABLE(usb, option_ids);
-diff --git a/drivers/usb/serial/usb-serial.c b/drivers/usb/serial/usb-serial.c
-index b1b9bac..d213cf4 100644
---- a/drivers/usb/serial/usb-serial.c
-+++ b/drivers/usb/serial/usb-serial.c
-@@ -1433,7 +1433,7 @@ int usb_serial_register_drivers(struct usb_serial_driver *const serial_drivers[]
- 
- 	rc = usb_register(udriver);
- 	if (rc)
--		return rc;
-+		goto failed_usb_register;
- 
- 	for (sd = serial_drivers; *sd; ++sd) {
- 		(*sd)->usb_driver = udriver;
-@@ -1451,6 +1451,8 @@ int usb_serial_register_drivers(struct usb_serial_driver *const serial_drivers[]
- 	while (sd-- > serial_drivers)
- 		usb_serial_deregister(*sd);
- 	usb_deregister(udriver);
-+failed_usb_register:
-+	kfree(udriver);
- 	return rc;
- }
- EXPORT_SYMBOL_GPL(usb_serial_register_drivers);
-diff --git a/drivers/vfio/pci/vfio_pci_intrs.c b/drivers/vfio/pci/vfio_pci_intrs.c
-index 15ecfc9..152b438 100644
---- a/drivers/vfio/pci/vfio_pci_intrs.c
-+++ b/drivers/vfio/pci/vfio_pci_intrs.c
-@@ -564,67 +564,80 @@ static int vfio_pci_set_msi_trigger(struct vfio_pci_device *vdev,
- }
- 
- static int vfio_pci_set_ctx_trigger_single(struct eventfd_ctx **ctx,
--					   uint32_t flags, void *data)
-+					   unsigned int count, uint32_t flags,
-+					   void *data)
- {
--	int32_t fd = *(int32_t *)data;
--
--	if (!(flags & VFIO_IRQ_SET_DATA_TYPE_MASK))
--		return -EINVAL;
--
- 	/* DATA_NONE/DATA_BOOL enables loopback testing */
- 	if (flags & VFIO_IRQ_SET_DATA_NONE) {
--		if (*ctx)
--			eventfd_signal(*ctx, 1);
--		return 0;
-+		if (*ctx) {
-+			if (count) {
-+				eventfd_signal(*ctx, 1);
-+			} else {
-+				eventfd_ctx_put(*ctx);
-+				*ctx = NULL;
-+			}
-+			return 0;
-+		}
- 	} else if (flags & VFIO_IRQ_SET_DATA_BOOL) {
--		uint8_t trigger = *(uint8_t *)data;
-+		uint8_t trigger;
-+
-+		if (!count)
-+			return -EINVAL;
-+
-+		trigger = *(uint8_t *)data;
- 		if (trigger && *ctx)
- 			eventfd_signal(*ctx, 1);
--		return 0;
--	}
- 
--	/* Handle SET_DATA_EVENTFD */
--	if (fd == -1) {
--		if (*ctx)
--			eventfd_ctx_put(*ctx);
--		*ctx = NULL;
- 		return 0;
--	} else if (fd >= 0) {
--		struct eventfd_ctx *efdctx;
--		efdctx = eventfd_ctx_fdget(fd);
--		if (IS_ERR(efdctx))
--			return PTR_ERR(efdctx);
--		if (*ctx)
--			eventfd_ctx_put(*ctx);
--		*ctx = efdctx;
-+	} else if (flags & VFIO_IRQ_SET_DATA_EVENTFD) {
-+		int32_t fd;
-+
-+		if (!count)
-+			return -EINVAL;
-+
-+		fd = *(int32_t *)data;
-+		if (fd == -1) {
-+			if (*ctx)
-+				eventfd_ctx_put(*ctx);
-+			*ctx = NULL;
-+		} else if (fd >= 0) {
-+			struct eventfd_ctx *efdctx;
-+
-+			efdctx = eventfd_ctx_fdget(fd);
-+			if (IS_ERR(efdctx))
-+				return PTR_ERR(efdctx);
-+
-+			if (*ctx)
-+				eventfd_ctx_put(*ctx);
-+
-+			*ctx = efdctx;
-+		}
- 		return 0;
--	} else
--		return -EINVAL;
-+	}
-+
-+	return -EINVAL;
- }
- 
- static int vfio_pci_set_err_trigger(struct vfio_pci_device *vdev,
- 				    unsigned index, unsigned start,
- 				    unsigned count, uint32_t flags, void *data)
- {
--	if (index != VFIO_PCI_ERR_IRQ_INDEX)
-+	if (index != VFIO_PCI_ERR_IRQ_INDEX || start != 0 || count > 1)
- 		return -EINVAL;
- 
--	/*
--	 * We should sanitize start & count, but that wasn't caught
--	 * originally, so this IRQ index must forever ignore them :-(
--	 */
--
--	return vfio_pci_set_ctx_trigger_single(&vdev->err_trigger, flags, data);
-+	return vfio_pci_set_ctx_trigger_single(&vdev->err_trigger,
-+					       count, flags, data);
- }
- 
- static int vfio_pci_set_req_trigger(struct vfio_pci_device *vdev,
- 				    unsigned index, unsigned start,
- 				    unsigned count, uint32_t flags, void *data)
- {
--	if (index != VFIO_PCI_REQ_IRQ_INDEX || start != 0 || count != 1)
-+	if (index != VFIO_PCI_REQ_IRQ_INDEX || start != 0 || count > 1)
- 		return -EINVAL;
- 
--	return vfio_pci_set_ctx_trigger_single(&vdev->req_trigger, flags, data);
-+	return vfio_pci_set_ctx_trigger_single(&vdev->req_trigger,
-+					       count, flags, data);
- }
- 
- int vfio_pci_set_irqs_ioctl(struct vfio_pci_device *vdev, uint32_t flags,
-diff --git a/drivers/virtio/virtio_ring.c b/drivers/virtio/virtio_ring.c
-index ca6bfdd..2ebf30e 100644
---- a/drivers/virtio/virtio_ring.c
-+++ b/drivers/virtio/virtio_ring.c
-@@ -316,6 +316,8 @@ static inline int virtqueue_add(struct virtqueue *_vq,
- 		 * host should service the ring ASAP. */
- 		if (out_sgs)
- 			vq->notify(&vq->vq);
-+		if (indirect)
-+			kfree(desc);
- 		END_USE(vq);
- 		return -ENOSPC;
- 	}
-diff --git a/fs/btrfs/ctree.h b/fs/btrfs/ctree.h
-index 4274a7b..72f5048 100644
---- a/fs/btrfs/ctree.h
-+++ b/fs/btrfs/ctree.h
-@@ -1040,6 +1040,7 @@ struct btrfs_fs_info {
- 	struct btrfs_workqueue *qgroup_rescan_workers;
- 	struct completion qgroup_rescan_completion;
- 	struct btrfs_work qgroup_rescan_work;
-+	bool qgroup_rescan_running;	/* protected by qgroup_rescan_lock */
- 
- 	/* filesystem state */
- 	unsigned long fs_state;
-diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c
-index 60ce119..864cf3b 100644
---- a/fs/btrfs/disk-io.c
-+++ b/fs/btrfs/disk-io.c
-@@ -1626,8 +1626,8 @@ fail:
- 	return ret;
- }
- 
--static struct btrfs_root *btrfs_lookup_fs_root(struct btrfs_fs_info *fs_info,
--					       u64 root_id)
-+struct btrfs_root *btrfs_lookup_fs_root(struct btrfs_fs_info *fs_info,
-+					u64 root_id)
- {
- 	struct btrfs_root *root;
- 
-@@ -2306,6 +2306,7 @@ static void btrfs_init_qgroup(struct btrfs_fs_info *fs_info)
- 	fs_info->quota_enabled = 0;
- 	fs_info->pending_quota_state = 0;
- 	fs_info->qgroup_ulist = NULL;
-+	fs_info->qgroup_rescan_running = false;
- 	mutex_init(&fs_info->qgroup_rescan_lock);
- }
- 
-@@ -3849,7 +3850,7 @@ void close_ctree(struct btrfs_root *root)
- 	smp_mb();
- 
- 	/* wait for the qgroup rescan worker to stop */
--	btrfs_qgroup_wait_for_completion(fs_info);
-+	btrfs_qgroup_wait_for_completion(fs_info, false);
- 
- 	/* wait for the uuid_scan task to finish */
- 	down(&fs_info->uuid_tree_rescan_sem);
-diff --git a/fs/btrfs/disk-io.h b/fs/btrfs/disk-io.h
-index acba821..355e31f 100644
---- a/fs/btrfs/disk-io.h
-+++ b/fs/btrfs/disk-io.h
-@@ -68,6 +68,8 @@ struct extent_buffer *btrfs_find_tree_block(struct btrfs_fs_info *fs_info,
- struct btrfs_root *btrfs_read_fs_root(struct btrfs_root *tree_root,
- 				      struct btrfs_key *location);
- int btrfs_init_fs_root(struct btrfs_root *root);
-+struct btrfs_root *btrfs_lookup_fs_root(struct btrfs_fs_info *fs_info,
-+					u64 root_id);
- int btrfs_insert_fs_root(struct btrfs_fs_info *fs_info,
- 			 struct btrfs_root *root);
- void btrfs_free_fs_roots(struct btrfs_fs_info *fs_info);
-diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
-index 0517356..3722a1f 100644
---- a/fs/btrfs/ioctl.c
-+++ b/fs/btrfs/ioctl.c
-@@ -5088,7 +5088,7 @@ static long btrfs_ioctl_quota_rescan_wait(struct file *file, void __user *arg)
- 	if (!capable(CAP_SYS_ADMIN))
- 		return -EPERM;
- 
--	return btrfs_qgroup_wait_for_completion(root->fs_info);
-+	return btrfs_qgroup_wait_for_completion(root->fs_info, true);
- }
- 
- static long _btrfs_ioctl_set_received_subvol(struct file *file,
-diff --git a/fs/btrfs/qgroup.c b/fs/btrfs/qgroup.c
-index 9d4c05b..4904ebe 100644
---- a/fs/btrfs/qgroup.c
-+++ b/fs/btrfs/qgroup.c
-@@ -995,7 +995,7 @@ int btrfs_quota_disable(struct btrfs_trans_handle *trans,
- 		goto out;
- 	fs_info->quota_enabled = 0;
- 	fs_info->pending_quota_state = 0;
--	btrfs_qgroup_wait_for_completion(fs_info);
-+	btrfs_qgroup_wait_for_completion(fs_info, false);
- 	spin_lock(&fs_info->qgroup_lock);
- 	quota_root = fs_info->quota_root;
- 	fs_info->quota_root = NULL;
-@@ -2302,6 +2302,10 @@ static void btrfs_qgroup_rescan_worker(struct btrfs_work *work)
- 	int err = -ENOMEM;
- 	int ret = 0;
- 
-+	mutex_lock(&fs_info->qgroup_rescan_lock);
-+	fs_info->qgroup_rescan_running = true;
-+	mutex_unlock(&fs_info->qgroup_rescan_lock);
-+
- 	path = btrfs_alloc_path();
- 	if (!path)
- 		goto out;
-@@ -2368,6 +2372,9 @@ out:
- 	}
- 
- done:
-+	mutex_lock(&fs_info->qgroup_rescan_lock);
-+	fs_info->qgroup_rescan_running = false;
-+	mutex_unlock(&fs_info->qgroup_rescan_lock);
- 	complete_all(&fs_info->qgroup_rescan_completion);
- }
- 
-@@ -2486,20 +2493,26 @@ btrfs_qgroup_rescan(struct btrfs_fs_info *fs_info)
- 	return 0;
- }
- 
--int btrfs_qgroup_wait_for_completion(struct btrfs_fs_info *fs_info)
-+int btrfs_qgroup_wait_for_completion(struct btrfs_fs_info *fs_info,
-+				     bool interruptible)
- {
- 	int running;
- 	int ret = 0;
- 
- 	mutex_lock(&fs_info->qgroup_rescan_lock);
- 	spin_lock(&fs_info->qgroup_lock);
--	running = fs_info->qgroup_flags & BTRFS_QGROUP_STATUS_FLAG_RESCAN;
-+	running = fs_info->qgroup_rescan_running;
- 	spin_unlock(&fs_info->qgroup_lock);
- 	mutex_unlock(&fs_info->qgroup_rescan_lock);
- 
--	if (running)
-+	if (!running)
-+		return 0;
-+
-+	if (interruptible)
- 		ret = wait_for_completion_interruptible(
- 					&fs_info->qgroup_rescan_completion);
-+	else
-+		wait_for_completion(&fs_info->qgroup_rescan_completion);
- 
- 	return ret;
- }
-diff --git a/fs/btrfs/qgroup.h b/fs/btrfs/qgroup.h
-index ecb2c14..3d73e4c 100644
---- a/fs/btrfs/qgroup.h
-+++ b/fs/btrfs/qgroup.h
-@@ -46,7 +46,8 @@ int btrfs_quota_disable(struct btrfs_trans_handle *trans,
- 			struct btrfs_fs_info *fs_info);
- int btrfs_qgroup_rescan(struct btrfs_fs_info *fs_info);
- void btrfs_qgroup_rescan_resume(struct btrfs_fs_info *fs_info);
--int btrfs_qgroup_wait_for_completion(struct btrfs_fs_info *fs_info);
-+int btrfs_qgroup_wait_for_completion(struct btrfs_fs_info *fs_info,
-+				     bool interruptible);
- int btrfs_add_qgroup_relation(struct btrfs_trans_handle *trans,
- 			      struct btrfs_fs_info *fs_info, u64 src, u64 dst);
- int btrfs_del_qgroup_relation(struct btrfs_trans_handle *trans,
-diff --git a/fs/btrfs/root-tree.c b/fs/btrfs/root-tree.c
-index f1c3086..3454aa4 100644
---- a/fs/btrfs/root-tree.c
-+++ b/fs/btrfs/root-tree.c
-@@ -272,6 +272,23 @@ int btrfs_find_orphan_roots(struct btrfs_root *tree_root)
- 		root_key.objectid = key.offset;
- 		key.offset++;
- 
-+		/*
-+		 * The root might have been inserted already, as before we look
-+		 * for orphan roots, log replay might have happened, which
-+		 * triggers a transaction commit and qgroup accounting, which
-+		 * in turn reads and inserts fs roots while doing backref
-+		 * walking.
-+		 */
-+		root = btrfs_lookup_fs_root(tree_root->fs_info,
-+					    root_key.objectid);
-+		if (root) {
-+			WARN_ON(!test_bit(BTRFS_ROOT_ORPHAN_ITEM_INSERTED,
-+					  &root->state));
-+			if (btrfs_root_refs(&root->root_item) == 0)
-+				btrfs_add_dead_root(root);
-+			continue;
-+		}
-+
- 		root = btrfs_read_fs_root(tree_root, &root_key);
- 		err = PTR_ERR_OR_ZERO(root);
- 		if (err && err != -ENOENT) {
-@@ -310,16 +327,8 @@ int btrfs_find_orphan_roots(struct btrfs_root *tree_root)
- 		set_bit(BTRFS_ROOT_ORPHAN_ITEM_INSERTED, &root->state);
- 
- 		err = btrfs_insert_fs_root(root->fs_info, root);
--		/*
--		 * The root might have been inserted already, as before we look
--		 * for orphan roots, log replay might have happened, which
--		 * triggers a transaction commit and qgroup accounting, which
--		 * in turn reads and inserts fs roots while doing backref
--		 * walking.
--		 */
--		if (err == -EEXIST)
--			err = 0;
- 		if (err) {
-+			BUG_ON(err == -EEXIST);
- 			btrfs_free_fs_root(root);
- 			break;
- 		}
-diff --git a/fs/seq_file.c b/fs/seq_file.c
-index 19f532e..6dc4296 100644
---- a/fs/seq_file.c
-+++ b/fs/seq_file.c
-@@ -223,8 +223,10 @@ ssize_t seq_read(struct file *file, char __user *buf, size_t size, loff_t *ppos)
- 		size -= n;
- 		buf += n;
- 		copied += n;
--		if (!m->count)
-+		if (!m->count) {
-+			m->from = 0;
- 			m->index++;
-+		}
- 		if (!size)
- 			goto Done;
- 	}
-diff --git a/fs/sysfs/file.c b/fs/sysfs/file.c
-index f35523d..b803213 100644
---- a/fs/sysfs/file.c
-+++ b/fs/sysfs/file.c
-@@ -114,9 +114,15 @@ static ssize_t sysfs_kf_read(struct kernfs_open_file *of, char *buf,
- 	 * If buf != of->prealloc_buf, we don't know how
- 	 * large it is, so cannot safely pass it to ->show
- 	 */
--	if (pos || WARN_ON_ONCE(buf != of->prealloc_buf))
-+	if (WARN_ON_ONCE(buf != of->prealloc_buf))
- 		return 0;
- 	len = ops->show(kobj, of->kn->priv, buf);
-+	if (pos) {
-+		if (len <= pos)
-+			return 0;
-+		len -= pos;
-+		memmove(buf, buf + pos, len);
-+	}
- 	return min(count, len);
- }
- 
-diff --git a/include/linux/acpi.h b/include/linux/acpi.h
-index 288fac5..47f95085 100644
---- a/include/linux/acpi.h
-+++ b/include/linux/acpi.h
-@@ -985,7 +985,7 @@ static inline struct fwnode_handle *acpi_get_next_subnode(struct device *dev,
- 	return NULL;
- }
- 
--#define ACPI_DECLARE_PROBE_ENTRY(table, name, table_id, subtable, validate, data, fn) \
-+#define ACPI_DECLARE_PROBE_ENTRY(table, name, table_id, subtable, valid, data, fn) \
- 	static const void * __acpi_table_##name[]			\
- 		__attribute__((unused))					\
- 		 = { (void *) table_id,					\
-diff --git a/include/linux/i8042.h b/include/linux/i8042.h
-index 0f9bafa..d98780c 100644
---- a/include/linux/i8042.h
-+++ b/include/linux/i8042.h
-@@ -62,7 +62,6 @@ struct serio;
- void i8042_lock_chip(void);
- void i8042_unlock_chip(void);
- int i8042_command(unsigned char *param, int command);
--bool i8042_check_port_owner(const struct serio *);
- int i8042_install_filter(bool (*filter)(unsigned char data, unsigned char str,
- 					struct serio *serio));
- int i8042_remove_filter(bool (*filter)(unsigned char data, unsigned char str,
-@@ -83,11 +82,6 @@ static inline int i8042_command(unsigned char *param, int command)
- 	return -ENODEV;
- }
- 
--static inline bool i8042_check_port_owner(const struct serio *serio)
--{
--	return false;
--}
--
- static inline int i8042_install_filter(bool (*filter)(unsigned char data, unsigned char str,
- 					struct serio *serio))
- {
-diff --git a/include/linux/mfd/cros_ec.h b/include/linux/mfd/cros_ec.h
-index 64184d2..d641a18 100644
---- a/include/linux/mfd/cros_ec.h
-+++ b/include/linux/mfd/cros_ec.h
-@@ -226,6 +226,21 @@ int cros_ec_cmd_xfer(struct cros_ec_device *ec_dev,
- 		     struct cros_ec_command *msg);
- 
- /**
-+ * cros_ec_cmd_xfer_status - Send a command to the ChromeOS EC
-+ *
-+ * This function is identical to cros_ec_cmd_xfer, except it returns success
-+ * status only if both the command was transmitted successfully and the EC
-+ * replied with success status. It's not necessary to check msg->result when
-+ * using this function.
-+ *
-+ * @ec_dev: EC device
-+ * @msg: Message to write
-+ * @return: Num. of bytes transferred on success, <0 on failure
-+ */
-+int cros_ec_cmd_xfer_status(struct cros_ec_device *ec_dev,
-+			    struct cros_ec_command *msg);
-+
-+/**
-  * cros_ec_remove - Remove a ChromeOS EC
-  *
-  * Call this to deregister a ChromeOS EC, then clean up any private data.
-diff --git a/include/linux/msi.h b/include/linux/msi.h
-index 8b425c6..ec39a08 100644
---- a/include/linux/msi.h
-+++ b/include/linux/msi.h
-@@ -264,12 +264,12 @@ enum {
- 	 * callbacks.
- 	 */
- 	MSI_FLAG_USE_DEF_CHIP_OPS	= (1 << 1),
--	/* Build identity map between hwirq and irq */
--	MSI_FLAG_IDENTITY_MAP		= (1 << 2),
- 	/* Support multiple PCI MSI interrupts */
--	MSI_FLAG_MULTI_PCI_MSI		= (1 << 3),
-+	MSI_FLAG_MULTI_PCI_MSI		= (1 << 2),
- 	/* Support PCI MSIX interrupts */
--	MSI_FLAG_PCI_MSIX		= (1 << 4),
-+	MSI_FLAG_PCI_MSIX		= (1 << 3),
-+	/* Needs early activate, required for PCI */
-+	MSI_FLAG_ACTIVATE_EARLY		= (1 << 4),
- };
- 
- int msi_domain_set_affinity(struct irq_data *data, const struct cpumask *mask,
-diff --git a/include/linux/serio.h b/include/linux/serio.h
-index df4ab5d..c733cff 100644
---- a/include/linux/serio.h
-+++ b/include/linux/serio.h
-@@ -31,7 +31,8 @@ struct serio {
- 
- 	struct serio_device_id id;
- 
--	spinlock_t lock;		/* protects critical sections from port's interrupt handler */
-+	/* Protects critical sections from port's interrupt handler */
-+	spinlock_t lock;
- 
- 	int (*write)(struct serio *, unsigned char);
- 	int (*open)(struct serio *);
-@@ -40,16 +41,29 @@ struct serio {
- 	void (*stop)(struct serio *);
- 
- 	struct serio *parent;
--	struct list_head child_node;	/* Entry in parent->children list */
-+	/* Entry in parent->children list */
-+	struct list_head child_node;
- 	struct list_head children;
--	unsigned int depth;		/* level of nesting in serio hierarchy */
-+	/* Level of nesting in serio hierarchy */
-+	unsigned int depth;
- 
--	struct serio_driver *drv;	/* accessed from interrupt, must be protected by serio->lock and serio->sem */
--	struct mutex drv_mutex;		/* protects serio->drv so attributes can pin driver */
-+	/*
-+	 * serio->drv is accessed from interrupt handlers; when modifying
-+	 * caller should acquire serio->drv_mutex and serio->lock.
-+	 */
-+	struct serio_driver *drv;
-+	/* Protects serio->drv so attributes can pin current driver */
-+	struct mutex drv_mutex;
- 
- 	struct device dev;
- 
- 	struct list_head node;
-+
-+	/*
-+	 * For use by PS/2 layer when several ports share hardware and
-+	 * may get indigestion when exposed to concurrent access (i8042).
-+	 */
-+	struct mutex *ps2_cmd_mutex;
- };
- #define to_serio_port(d)	container_of(d, struct serio, dev)
- 
-diff --git a/include/trace/events/timer.h b/include/trace/events/timer.h
-index 5144013..28c5da6 100644
---- a/include/trace/events/timer.h
-+++ b/include/trace/events/timer.h
-@@ -330,24 +330,32 @@ TRACE_EVENT(itimer_expire,
- #ifdef CONFIG_NO_HZ_COMMON
- 
- #define TICK_DEP_NAMES					\
--		tick_dep_name(NONE)			\
-+		tick_dep_mask_name(NONE)		\
- 		tick_dep_name(POSIX_TIMER)		\
- 		tick_dep_name(PERF_EVENTS)		\
- 		tick_dep_name(SCHED)			\
- 		tick_dep_name_end(CLOCK_UNSTABLE)
- 
- #undef tick_dep_name
-+#undef tick_dep_mask_name
- #undef tick_dep_name_end
- 
--#define tick_dep_name(sdep) TRACE_DEFINE_ENUM(TICK_DEP_MASK_##sdep);
--#define tick_dep_name_end(sdep)  TRACE_DEFINE_ENUM(TICK_DEP_MASK_##sdep);
-+/* The MASK will convert to their bits and they need to be processed too */
-+#define tick_dep_name(sdep) TRACE_DEFINE_ENUM(TICK_DEP_BIT_##sdep); \
-+	TRACE_DEFINE_ENUM(TICK_DEP_MASK_##sdep);
-+#define tick_dep_name_end(sdep)  TRACE_DEFINE_ENUM(TICK_DEP_BIT_##sdep); \
-+	TRACE_DEFINE_ENUM(TICK_DEP_MASK_##sdep);
-+/* NONE only has a mask defined for it */
-+#define tick_dep_mask_name(sdep) TRACE_DEFINE_ENUM(TICK_DEP_MASK_##sdep);
- 
- TICK_DEP_NAMES
- 
- #undef tick_dep_name
-+#undef tick_dep_mask_name
- #undef tick_dep_name_end
- 
- #define tick_dep_name(sdep) { TICK_DEP_MASK_##sdep, #sdep },
-+#define tick_dep_mask_name(sdep) { TICK_DEP_MASK_##sdep, #sdep },
- #define tick_dep_name_end(sdep) { TICK_DEP_MASK_##sdep, #sdep }
- 
- #define show_tick_dep_name(val)				\
-diff --git a/kernel/events/core.c b/kernel/events/core.c
-index 43d43a2d..e68c0a7 100644
---- a/kernel/events/core.c
-+++ b/kernel/events/core.c
-@@ -242,18 +242,6 @@ unlock:
- 	return ret;
- }
- 
--static void event_function_local(struct perf_event *event, event_f func, void *data)
--{
--	struct event_function_struct efs = {
--		.event = event,
--		.func = func,
--		.data = data,
--	};
--
--	int ret = event_function(&efs);
--	WARN_ON_ONCE(ret);
--}
--
- static void event_function_call(struct perf_event *event, event_f func, void *data)
- {
- 	struct perf_event_context *ctx = event->ctx;
-@@ -303,6 +291,54 @@ again:
- 	raw_spin_unlock_irq(&ctx->lock);
- }
- 
-+/*
-+ * Similar to event_function_call() + event_function(), but hard assumes IRQs
-+ * are already disabled and we're on the right CPU.
-+ */
-+static void event_function_local(struct perf_event *event, event_f func, void *data)
-+{
-+	struct perf_event_context *ctx = event->ctx;
-+	struct perf_cpu_context *cpuctx = __get_cpu_context(ctx);
-+	struct task_struct *task = READ_ONCE(ctx->task);
-+	struct perf_event_context *task_ctx = NULL;
-+
-+	WARN_ON_ONCE(!irqs_disabled());
-+
-+	if (task) {
-+		if (task == TASK_TOMBSTONE)
-+			return;
-+
-+		task_ctx = ctx;
-+	}
-+
-+	perf_ctx_lock(cpuctx, task_ctx);
-+
-+	task = ctx->task;
-+	if (task == TASK_TOMBSTONE)
-+		goto unlock;
-+
-+	if (task) {
-+		/*
-+		 * We must be either inactive or active and the right task,
-+		 * otherwise we're screwed, since we cannot IPI to somewhere
-+		 * else.
-+		 */
-+		if (ctx->is_active) {
-+			if (WARN_ON_ONCE(task != current))
-+				goto unlock;
-+
-+			if (WARN_ON_ONCE(cpuctx->task_ctx != ctx))
-+				goto unlock;
-+		}
-+	} else {
-+		WARN_ON_ONCE(&cpuctx->ctx != ctx);
-+	}
-+
-+	func(event, cpuctx, ctx, data);
-+unlock:
-+	perf_ctx_unlock(cpuctx, task_ctx);
-+}
-+
- #define PERF_FLAG_ALL (PERF_FLAG_FD_NO_GROUP |\
- 		       PERF_FLAG_FD_OUTPUT  |\
- 		       PERF_FLAG_PID_CGROUP |\
-diff --git a/kernel/events/uprobes.c b/kernel/events/uprobes.c
-index b7a525a..8c50276 100644
---- a/kernel/events/uprobes.c
-+++ b/kernel/events/uprobes.c
-@@ -172,8 +172,10 @@ static int __replace_page(struct vm_area_struct *vma, unsigned long addr,
- 	mmu_notifier_invalidate_range_start(mm, mmun_start, mmun_end);
- 	err = -EAGAIN;
- 	ptep = page_check_address(page, mm, addr, &ptl, 0);
--	if (!ptep)
-+	if (!ptep) {
-+		mem_cgroup_cancel_charge(kpage, memcg, false);
- 		goto unlock;
-+	}
- 
- 	get_page(kpage);
- 	page_add_new_anon_rmap(kpage, vma, addr, false);
-@@ -200,7 +202,6 @@ static int __replace_page(struct vm_area_struct *vma, unsigned long addr,
- 
- 	err = 0;
-  unlock:
--	mem_cgroup_cancel_charge(kpage, memcg, false);
- 	mmu_notifier_invalidate_range_end(mm, mmun_start, mmun_end);
- 	unlock_page(page);
- 	return err;
-diff --git a/kernel/irq/msi.c b/kernel/irq/msi.c
-index 38e89ce..0afe671 100644
---- a/kernel/irq/msi.c
-+++ b/kernel/irq/msi.c
-@@ -324,7 +324,7 @@ int msi_domain_alloc_irqs(struct irq_domain *domain, struct device *dev,
- 	struct msi_domain_ops *ops = info->ops;
- 	msi_alloc_info_t arg;
- 	struct msi_desc *desc;
--	int i, ret, virq = -1;
-+	int i, ret, virq;
- 
- 	ret = msi_domain_prepare_irqs(domain, dev, nvec, &arg);
- 	if (ret)
-@@ -332,12 +332,8 @@ int msi_domain_alloc_irqs(struct irq_domain *domain, struct device *dev,
- 
- 	for_each_msi_entry(desc, dev) {
- 		ops->set_desc(&arg, desc);
--		if (info->flags & MSI_FLAG_IDENTITY_MAP)
--			virq = (int)ops->get_hwirq(info, &arg);
--		else
--			virq = -1;
- 
--		virq = __irq_domain_alloc_irqs(domain, virq, desc->nvec_used,
-+		virq = __irq_domain_alloc_irqs(domain, -1, desc->nvec_used,
- 					       dev_to_node(dev), &arg, false);
- 		if (virq < 0) {
- 			ret = -ENOSPC;
-@@ -361,6 +357,17 @@ int msi_domain_alloc_irqs(struct irq_domain *domain, struct device *dev,
- 		else
- 			dev_dbg(dev, "irq [%d-%d] for MSI\n",
- 				virq, virq + desc->nvec_used - 1);
-+		/*
-+		 * This flag is set by the PCI layer as we need to activate
-+		 * the MSI entries before the PCI layer enables MSI in the
-+		 * card. Otherwise the card latches a random msi message.
-+		 */
-+		if (info->flags & MSI_FLAG_ACTIVATE_EARLY) {
-+			struct irq_data *irq_data;
-+
-+			irq_data = irq_domain_get_irq_data(domain, desc->irq);
-+			irq_domain_activate_irq(irq_data);
-+		}
- 	}
- 
- 	return 0;
-diff --git a/kernel/sched/cputime.c b/kernel/sched/cputime.c
-index 75f98c5..a24cfb4 100644
---- a/kernel/sched/cputime.c
-+++ b/kernel/sched/cputime.c
-@@ -603,19 +603,25 @@ static void cputime_adjust(struct task_cputime *curr,
- 	stime = curr->stime;
- 	utime = curr->utime;
- 
--	if (utime == 0) {
--		stime = rtime;
-+	/*
-+	 * If either stime or both stime and utime are 0, assume all runtime is
-+	 * userspace. Once a task gets some ticks, the monotonicy code at
-+	 * 'update' will ensure things converge to the observed ratio.
-+	 */
-+	if (stime == 0) {
-+		utime = rtime;
- 		goto update;
- 	}
- 
--	if (stime == 0) {
--		utime = rtime;
-+	if (utime == 0) {
-+		stime = rtime;
- 		goto update;
- 	}
- 
- 	stime = scale_stime((__force u64)stime, (__force u64)rtime,
- 			    (__force u64)(stime + utime));
- 
-+update:
- 	/*
- 	 * Make sure stime doesn't go backwards; this preserves monotonicity
- 	 * for utime because rtime is monotonic.
-@@ -638,7 +644,6 @@ static void cputime_adjust(struct task_cputime *curr,
- 		stime = rtime - utime;
- 	}
- 
--update:
- 	prev->stime = stime;
- 	prev->utime = utime;
- out:
-diff --git a/mm/huge_memory.c b/mm/huge_memory.c
-index 343a2b7..07f2825 100644
---- a/mm/huge_memory.c
-+++ b/mm/huge_memory.c
-@@ -2872,7 +2872,7 @@ static void __split_huge_pmd_locked(struct vm_area_struct *vma, pmd_t *pmd,
- 	struct page *page;
- 	pgtable_t pgtable;
- 	pmd_t _pmd;
--	bool young, write, dirty;
-+	bool young, write, dirty, soft_dirty;
- 	unsigned long addr;
- 	int i;
- 
-@@ -2898,6 +2898,7 @@ static void __split_huge_pmd_locked(struct vm_area_struct *vma, pmd_t *pmd,
- 	write = pmd_write(*pmd);
- 	young = pmd_young(*pmd);
- 	dirty = pmd_dirty(*pmd);
-+	soft_dirty = pmd_soft_dirty(*pmd);
- 
- 	pmdp_huge_split_prepare(vma, haddr, pmd);
- 	pgtable = pgtable_trans_huge_withdraw(mm, pmd);
-@@ -2914,6 +2915,8 @@ static void __split_huge_pmd_locked(struct vm_area_struct *vma, pmd_t *pmd,
- 			swp_entry_t swp_entry;
- 			swp_entry = make_migration_entry(page + i, write);
- 			entry = swp_entry_to_pte(swp_entry);
-+			if (soft_dirty)
-+				entry = pte_swp_mksoft_dirty(entry);
- 		} else {
- 			entry = mk_pte(page + i, vma->vm_page_prot);
- 			entry = maybe_mkwrite(entry, vma);
-@@ -2921,6 +2924,8 @@ static void __split_huge_pmd_locked(struct vm_area_struct *vma, pmd_t *pmd,
- 				entry = pte_wrprotect(entry);
- 			if (!young)
- 				entry = pte_mkold(entry);
-+			if (soft_dirty)
-+				entry = pte_mksoft_dirty(entry);
- 		}
- 		if (dirty)
- 			SetPageDirty(page + i);
-diff --git a/mm/readahead.c b/mm/readahead.c
-index 40be3ae..7f9f8c3 100644
---- a/mm/readahead.c
-+++ b/mm/readahead.c
-@@ -8,6 +8,7 @@
-  */
- 
- #include <linux/kernel.h>
-+#include <linux/dax.h>
- #include <linux/gfp.h>
- #include <linux/export.h>
- #include <linux/blkdev.h>
-@@ -545,6 +546,14 @@ do_readahead(struct address_space *mapping, struct file *filp,
- 	if (!mapping || !mapping->a_ops)
- 		return -EINVAL;
- 
-+	/*
-+	 * Readahead doesn't make sense for DAX inodes, but we don't want it
-+	 * to report a failure either.  Instead, we just return success and
-+	 * don't do any work.
-+	 */
-+	if (dax_mapping(mapping))
-+		return 0;
-+
- 	return force_page_cache_readahead(mapping, filp, index, nr);
- }
- 
-diff --git a/mm/slub.c b/mm/slub.c
-index 825ff45..7a6d268 100644
---- a/mm/slub.c
-+++ b/mm/slub.c
-@@ -3479,6 +3479,7 @@ static void list_slab_objects(struct kmem_cache *s, struct page *page,
-  */
- static void free_partial(struct kmem_cache *s, struct kmem_cache_node *n)
- {
-+	LIST_HEAD(discard);
- 	struct page *page, *h;
- 
- 	BUG_ON(irqs_disabled());
-@@ -3486,13 +3487,16 @@ static void free_partial(struct kmem_cache *s, struct kmem_cache_node *n)
- 	list_for_each_entry_safe(page, h, &n->partial, lru) {
- 		if (!page->inuse) {
- 			remove_partial(n, page);
--			discard_slab(s, page);
-+			list_add(&page->lru, &discard);
- 		} else {
- 			list_slab_objects(s, page,
- 			"Objects remaining in %s on __kmem_cache_shutdown()");
- 		}
- 	}
- 	spin_unlock_irq(&n->list_lock);
-+
-+	list_for_each_entry_safe(page, h, &discard, lru)
-+		discard_slab(s, page);
- }
- 
- /*
-diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
-index 0c12e40..8cc49c0 100644
---- a/net/mac80211/cfg.c
-+++ b/net/mac80211/cfg.c
-@@ -869,7 +869,7 @@ static int ieee80211_stop_ap(struct wiphy *wiphy, struct net_device *dev)
- 
- 	/* free all potentially still buffered bcast frames */
- 	local->total_ps_buffered -= skb_queue_len(&sdata->u.ap.ps.bc_buf);
--	skb_queue_purge(&sdata->u.ap.ps.bc_buf);
-+	ieee80211_purge_tx_queue(&local->hw, &sdata->u.ap.ps.bc_buf);
- 
- 	mutex_lock(&local->mtx);
- 	ieee80211_vif_copy_chanctx_to_vlans(sdata, true);
-diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
-index 2030443..8bad2ad 100644
---- a/net/mac80211/tx.c
-+++ b/net/mac80211/tx.c
-@@ -365,7 +365,7 @@ static void purge_old_ps_buffers(struct ieee80211_local *local)
- 		skb = skb_dequeue(&ps->bc_buf);
- 		if (skb) {
- 			purged++;
--			dev_kfree_skb(skb);
-+			ieee80211_free_txskb(&local->hw, skb);
- 		}
- 		total += skb_queue_len(&ps->bc_buf);
- 	}
-@@ -448,7 +448,7 @@ ieee80211_tx_h_multicast_ps_buf(struct ieee80211_tx_data *tx)
- 	if (skb_queue_len(&ps->bc_buf) >= AP_MAX_BC_BUFFER) {
- 		ps_dbg(tx->sdata,
- 		       "BC TX buffer full - dropping the oldest frame\n");
--		dev_kfree_skb(skb_dequeue(&ps->bc_buf));
-+		ieee80211_free_txskb(&tx->local->hw, skb_dequeue(&ps->bc_buf));
- 	} else
- 		tx->local->total_ps_buffered++;
- 
-@@ -4055,7 +4055,7 @@ ieee80211_get_buffered_bc(struct ieee80211_hw *hw,
- 			sdata = IEEE80211_DEV_TO_SUB_IF(skb->dev);
- 		if (!ieee80211_tx_prepare(sdata, &tx, NULL, skb))
- 			break;
--		dev_kfree_skb_any(skb);
-+		ieee80211_free_txskb(hw, skb);
- 	}
- 
- 	info = IEEE80211_SKB_CB(skb);
-diff --git a/net/sunrpc/auth_gss/auth_gss.c b/net/sunrpc/auth_gss/auth_gss.c
-index e64ae93..bf4b0e9 100644
---- a/net/sunrpc/auth_gss/auth_gss.c
-+++ b/net/sunrpc/auth_gss/auth_gss.c
-@@ -340,12 +340,14 @@ gss_release_msg(struct gss_upcall_msg *gss_msg)
- }
- 
- static struct gss_upcall_msg *
--__gss_find_upcall(struct rpc_pipe *pipe, kuid_t uid)
-+__gss_find_upcall(struct rpc_pipe *pipe, kuid_t uid, const struct gss_auth *auth)
- {
- 	struct gss_upcall_msg *pos;
- 	list_for_each_entry(pos, &pipe->in_downcall, list) {
- 		if (!uid_eq(pos->uid, uid))
- 			continue;
-+		if (auth && pos->auth->service != auth->service)
-+			continue;
- 		atomic_inc(&pos->count);
- 		dprintk("RPC:       %s found msg %p\n", __func__, pos);
- 		return pos;
-@@ -365,7 +367,7 @@ gss_add_msg(struct gss_upcall_msg *gss_msg)
- 	struct gss_upcall_msg *old;
- 
- 	spin_lock(&pipe->lock);
--	old = __gss_find_upcall(pipe, gss_msg->uid);
-+	old = __gss_find_upcall(pipe, gss_msg->uid, gss_msg->auth);
- 	if (old == NULL) {
- 		atomic_inc(&gss_msg->count);
- 		list_add(&gss_msg->list, &pipe->in_downcall);
-@@ -714,7 +716,7 @@ gss_pipe_downcall(struct file *filp, const char __user *src, size_t mlen)
- 	err = -ENOENT;
- 	/* Find a matching upcall */
- 	spin_lock(&pipe->lock);
--	gss_msg = __gss_find_upcall(pipe, uid);
-+	gss_msg = __gss_find_upcall(pipe, uid, NULL);
- 	if (gss_msg == NULL) {
- 		spin_unlock(&pipe->lock);
- 		goto err_put_ctx;
-diff --git a/net/sunrpc/xprtmultipath.c b/net/sunrpc/xprtmultipath.c
-index e7fd769..66c9d63 100644
---- a/net/sunrpc/xprtmultipath.c
-+++ b/net/sunrpc/xprtmultipath.c
-@@ -271,14 +271,12 @@ struct rpc_xprt *xprt_iter_next_entry_multiple(struct rpc_xprt_iter *xpi,
- 		xprt_switch_find_xprt_t find_next)
- {
- 	struct rpc_xprt_switch *xps = rcu_dereference(xpi->xpi_xpswitch);
--	struct list_head *head;
- 
- 	if (xps == NULL)
- 		return NULL;
--	head = &xps->xps_xprt_list;
--	if (xps->xps_nxprts < 2)
--		return xprt_switch_find_first_entry(head);
--	return xprt_switch_set_next_cursor(head, &xpi->xpi_cursor, find_next);
-+	return xprt_switch_set_next_cursor(&xps->xps_xprt_list,
-+			&xpi->xpi_cursor,
-+			find_next);
- }
- 
- static
-diff --git a/net/sunrpc/xprtsock.c b/net/sunrpc/xprtsock.c
-index 7e2b2fa..167cf59 100644
---- a/net/sunrpc/xprtsock.c
-+++ b/net/sunrpc/xprtsock.c
-@@ -2278,6 +2278,10 @@ static int xs_tcp_finish_connecting(struct rpc_xprt *xprt, struct socket *sock)
- 		/* SYN_SENT! */
- 		if (xprt->reestablish_timeout < XS_TCP_INIT_REEST_TO)
- 			xprt->reestablish_timeout = XS_TCP_INIT_REEST_TO;
-+		break;
-+	case -EADDRNOTAVAIL:
-+		/* Source port number is unavailable. Try a new one! */
-+		transport->srcport = 0;
- 	}
- out:
- 	return ret;
-diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
-index 89dacf9..160c7f7 100644
---- a/sound/pci/hda/hda_intel.c
-+++ b/sound/pci/hda/hda_intel.c
-@@ -906,20 +906,23 @@ static int azx_resume(struct device *dev)
- 	struct snd_card *card = dev_get_drvdata(dev);
- 	struct azx *chip;
- 	struct hda_intel *hda;
-+	struct hdac_bus *bus;
- 
- 	if (!card)
- 		return 0;
- 
- 	chip = card->private_data;
- 	hda = container_of(chip, struct hda_intel, chip);
-+	bus = azx_bus(chip);
- 	if (chip->disabled || hda->init_failed || !chip->running)
- 		return 0;
- 
--	if (chip->driver_caps & AZX_DCAPS_I915_POWERWELL
--		&& hda->need_i915_power) {
--		snd_hdac_display_power(azx_bus(chip), true);
--		snd_hdac_i915_set_bclk(azx_bus(chip));
-+	if (chip->driver_caps & AZX_DCAPS_I915_POWERWELL) {
-+		snd_hdac_display_power(bus, true);
-+		if (hda->need_i915_power)
-+			snd_hdac_i915_set_bclk(bus);
- 	}
-+
- 	if (chip->msi)
- 		if (pci_enable_msi(pci) < 0)
- 			chip->msi = 0;
-@@ -929,6 +932,11 @@ static int azx_resume(struct device *dev)
- 
- 	hda_intel_init_chip(chip, true);
- 
-+	/* power down again for link-controlled chips */
-+	if ((chip->driver_caps & AZX_DCAPS_I915_POWERWELL) &&
-+	    !hda->need_i915_power)
-+		snd_hdac_display_power(bus, false);
-+
- 	snd_power_change_state(card, SNDRV_CTL_POWER_D0);
- 
- 	trace_azx_resume(chip);
-@@ -1008,6 +1016,7 @@ static int azx_runtime_resume(struct device *dev)
- 
- 	chip = card->private_data;
- 	hda = container_of(chip, struct hda_intel, chip);
-+	bus = azx_bus(chip);
- 	if (chip->disabled || hda->init_failed)
- 		return 0;
- 
-@@ -1015,15 +1024,9 @@ static int azx_runtime_resume(struct device *dev)
- 		return 0;
- 
- 	if (chip->driver_caps & AZX_DCAPS_I915_POWERWELL) {
--		bus = azx_bus(chip);
--		if (hda->need_i915_power) {
--			snd_hdac_display_power(bus, true);
-+		snd_hdac_display_power(bus, true);
-+		if (hda->need_i915_power)
- 			snd_hdac_i915_set_bclk(bus);
--		} else {
--			/* toggle codec wakeup bit for STATESTS read */
--			snd_hdac_set_codec_wakeup(bus, true);
--			snd_hdac_set_codec_wakeup(bus, false);
--		}
- 	}
- 
- 	/* Read STATESTS before controller reset */
-@@ -1043,6 +1046,11 @@ static int azx_runtime_resume(struct device *dev)
- 	azx_writew(chip, WAKEEN, azx_readw(chip, WAKEEN) &
- 			~STATESTS_INT_MASK);
- 
-+	/* power down again for link-controlled chips */
-+	if ((chip->driver_caps & AZX_DCAPS_I915_POWERWELL) &&
-+	    !hda->need_i915_power)
-+		snd_hdac_display_power(bus, false);
-+
- 	trace_azx_runtime_resume(chip);
- 	return 0;
- }
-diff --git a/sound/usb/line6/pcm.c b/sound/usb/line6/pcm.c
-index 204cc07..41aa335 100644
---- a/sound/usb/line6/pcm.c
-+++ b/sound/usb/line6/pcm.c
-@@ -55,7 +55,6 @@ static int snd_line6_impulse_volume_put(struct snd_kcontrol *kcontrol,
- 		err = line6_pcm_acquire(line6pcm, LINE6_STREAM_IMPULSE);
- 		if (err < 0) {
- 			line6pcm->impulse_volume = 0;
--			line6_pcm_release(line6pcm, LINE6_STREAM_IMPULSE);
- 			return err;
- 		}
- 	} else {
-@@ -211,7 +210,9 @@ static void line6_stream_stop(struct snd_line6_pcm *line6pcm, int direction,
- 	spin_lock_irqsave(&pstr->lock, flags);
- 	clear_bit(type, &pstr->running);
- 	if (!pstr->running) {
-+		spin_unlock_irqrestore(&pstr->lock, flags);
- 		line6_unlink_audio_urbs(line6pcm, pstr);
-+		spin_lock_irqsave(&pstr->lock, flags);
- 		if (direction == SNDRV_PCM_STREAM_CAPTURE) {
- 			line6pcm->prev_fbuf = NULL;
- 			line6pcm->prev_fsize = 0;
-diff --git a/sound/usb/line6/pod.c b/sound/usb/line6/pod.c
-index daf81d1..45dd348 100644
---- a/sound/usb/line6/pod.c
-+++ b/sound/usb/line6/pod.c
-@@ -244,8 +244,8 @@ static int pod_set_system_param_int(struct usb_line6_pod *pod, int value,
- static ssize_t serial_number_show(struct device *dev,
- 				  struct device_attribute *attr, char *buf)
- {
--	struct usb_interface *interface = to_usb_interface(dev);
--	struct usb_line6_pod *pod = usb_get_intfdata(interface);
-+	struct snd_card *card = dev_to_snd_card(dev);
-+	struct usb_line6_pod *pod = card->private_data;
- 
- 	return sprintf(buf, "%u\n", pod->serial_number);
- }
-@@ -256,8 +256,8 @@ static ssize_t serial_number_show(struct device *dev,
- static ssize_t firmware_version_show(struct device *dev,
- 				     struct device_attribute *attr, char *buf)
- {
--	struct usb_interface *interface = to_usb_interface(dev);
--	struct usb_line6_pod *pod = usb_get_intfdata(interface);
-+	struct snd_card *card = dev_to_snd_card(dev);
-+	struct usb_line6_pod *pod = card->private_data;
- 
- 	return sprintf(buf, "%d.%02d\n", pod->firmware_version / 100,
- 		       pod->firmware_version % 100);
-@@ -269,8 +269,8 @@ static ssize_t firmware_version_show(struct device *dev,
- static ssize_t device_id_show(struct device *dev,
- 			      struct device_attribute *attr, char *buf)
- {
--	struct usb_interface *interface = to_usb_interface(dev);
--	struct usb_line6_pod *pod = usb_get_intfdata(interface);
-+	struct snd_card *card = dev_to_snd_card(dev);
-+	struct usb_line6_pod *pod = card->private_data;
- 
- 	return sprintf(buf, "%d\n", pod->device_id);
- }
-diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c
-index 6adde45..6cf1f35 100644
---- a/sound/usb/quirks.c
-+++ b/sound/usb/quirks.c
-@@ -1128,6 +1128,7 @@ bool snd_usb_get_sample_rate_quirk(struct snd_usb_audio *chip)
- {
- 	/* devices which do not support reading the sample rate. */
- 	switch (chip->usb_id) {
-+	case USB_ID(0x041E, 0x4080): /* Creative Live Cam VF0610 */
- 	case USB_ID(0x045E, 0x075D): /* MS Lifecam Cinema  */
- 	case USB_ID(0x045E, 0x076D): /* MS Lifecam HD-5000 */
- 	case USB_ID(0x045E, 0x076E): /* MS Lifecam HD-5001 */
-@@ -1138,6 +1139,7 @@ bool snd_usb_get_sample_rate_quirk(struct snd_usb_audio *chip)
- 	case USB_ID(0x047F, 0xAA05): /* Plantronics DA45 */
- 	case USB_ID(0x04D8, 0xFEEA): /* Benchmark DAC1 Pre */
- 	case USB_ID(0x0556, 0x0014): /* Phoenix Audio TMX320VC */
-+	case USB_ID(0x05A3, 0x9420): /* ELP HD USB Camera */
- 	case USB_ID(0x074D, 0x3553): /* Outlaw RR2150 (Micronas UAC3553B) */
- 	case USB_ID(0x1de7, 0x0013): /* Phoenix Audio MT202exe */
- 	case USB_ID(0x1de7, 0x0014): /* Phoenix Audio TMX320 */
-diff --git a/tools/perf/arch/x86/util/intel-pt.c b/tools/perf/arch/x86/util/intel-pt.c
-index a07b960..853b26d 100644
---- a/tools/perf/arch/x86/util/intel-pt.c
-+++ b/tools/perf/arch/x86/util/intel-pt.c
-@@ -501,7 +501,7 @@ static int intel_pt_recording_options(struct auxtrace_record *itr,
- 	struct intel_pt_recording *ptr =
- 			container_of(itr, struct intel_pt_recording, itr);
- 	struct perf_pmu *intel_pt_pmu = ptr->intel_pt_pmu;
--	bool have_timing_info;
-+	bool have_timing_info, need_immediate = false;
- 	struct perf_evsel *evsel, *intel_pt_evsel = NULL;
- 	const struct cpu_map *cpus = evlist->cpus;
- 	bool privileged = geteuid() == 0 || perf_event_paranoid() < 0;
-@@ -655,6 +655,7 @@ static int intel_pt_recording_options(struct auxtrace_record *itr,
- 				ptr->have_sched_switch = 3;
- 			} else {
- 				opts->record_switch_events = true;
-+				need_immediate = true;
- 				if (cpu_wide)
- 					ptr->have_sched_switch = 3;
- 				else
-@@ -700,6 +701,9 @@ static int intel_pt_recording_options(struct auxtrace_record *itr,
- 		tracking_evsel->attr.freq = 0;
- 		tracking_evsel->attr.sample_period = 1;
- 
-+		if (need_immediate)
-+			tracking_evsel->immediate = true;
-+
- 		/* In per-cpu case, always need the time of mmap events etc */
- 		if (!cpu_map__empty(cpus)) {
- 			perf_evsel__set_sample_bit(tracking_evsel, TIME);
-diff --git a/tools/perf/builtin-mem.c b/tools/perf/builtin-mem.c
-index 1dc140c..3f02bea10 100644
---- a/tools/perf/builtin-mem.c
-+++ b/tools/perf/builtin-mem.c
-@@ -87,6 +87,9 @@ static int __cmd_record(int argc, const char **argv, struct perf_mem *mem)
- 	if (mem->operation & MEM_OPERATION_LOAD)
- 		perf_mem_events[PERF_MEM_EVENTS__LOAD].record = true;
- 
-+	if (mem->operation & MEM_OPERATION_STORE)
-+		perf_mem_events[PERF_MEM_EVENTS__STORE].record = true;
-+
- 	if (perf_mem_events[PERF_MEM_EVENTS__LOAD].record)
- 		rec_argv[i++] = "-W";
- 
-diff --git a/tools/perf/util/symbol-elf.c b/tools/perf/util/symbol-elf.c
-index 87a297d..c33efb9 100644
---- a/tools/perf/util/symbol-elf.c
-+++ b/tools/perf/util/symbol-elf.c
-@@ -827,7 +827,8 @@ int dso__load_sym(struct dso *dso, struct map *map,
- 	sec = syms_ss->symtab;
- 	shdr = syms_ss->symshdr;
- 
--	if (elf_section_by_name(elf, &ehdr, &tshdr, ".text", NULL))
-+	if (elf_section_by_name(runtime_ss->elf, &runtime_ss->ehdr, &tshdr,
-+				".text", NULL))
- 		dso->text_offset = tshdr.sh_addr - tshdr.sh_offset;
- 
- 	if (runtime_ss->opdsec)
-diff --git a/tools/testing/nvdimm/test/nfit.c b/tools/testing/nvdimm/test/nfit.c
-index c919866..1bfacc8 100644
---- a/tools/testing/nvdimm/test/nfit.c
-+++ b/tools/testing/nvdimm/test/nfit.c
-@@ -13,6 +13,7 @@
- #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
- #include <linux/platform_device.h>
- #include <linux/dma-mapping.h>
-+#include <linux/workqueue.h>
- #include <linux/libnvdimm.h>
- #include <linux/vmalloc.h>
- #include <linux/device.h>
-@@ -1480,6 +1481,7 @@ static int nfit_test_probe(struct platform_device *pdev)
- 	if (nfit_test->setup != nfit_test0_setup)
- 		return 0;
- 
-+	flush_work(&acpi_desc->work);
- 	nfit_test->setup_hotplug = 1;
- 	nfit_test->setup(nfit_test);
- 

diff --git a/4.7.4/1003_linux-4.7.4.patch b/4.7.4/1003_linux-4.7.4.patch
deleted file mode 100644
index af6c1d4..0000000
--- a/4.7.4/1003_linux-4.7.4.patch
+++ /dev/null
@@ -1,2424 +0,0 @@
-diff --git a/Makefile b/Makefile
-index 4afff18..ec3bd11 100644
---- a/Makefile
-+++ b/Makefile
-@@ -1,6 +1,6 @@
- VERSION = 4
- PATCHLEVEL = 7
--SUBLEVEL = 3
-+SUBLEVEL = 4
- EXTRAVERSION =
- NAME = Psychotic Stoned Sheep
- 
-diff --git a/arch/x86/kernel/apic/apic.c b/arch/x86/kernel/apic/apic.c
-index 60078a6..b15e1c1 100644
---- a/arch/x86/kernel/apic/apic.c
-+++ b/arch/x86/kernel/apic/apic.c
-@@ -1597,6 +1597,9 @@ void __init enable_IR_x2apic(void)
- 	unsigned long flags;
- 	int ret, ir_stat;
- 
-+	if (skip_ioapic_setup)
-+		return;
-+
- 	ir_stat = irq_remapping_prepare();
- 	if (ir_stat < 0 && !x2apic_supported())
- 		return;
-diff --git a/block/blk-core.c b/block/blk-core.c
-index 2475b1c7..b993f88 100644
---- a/block/blk-core.c
-+++ b/block/blk-core.c
-@@ -515,7 +515,9 @@ EXPORT_SYMBOL_GPL(blk_queue_bypass_end);
- 
- void blk_set_queue_dying(struct request_queue *q)
- {
--	queue_flag_set_unlocked(QUEUE_FLAG_DYING, q);
-+	spin_lock_irq(q->queue_lock);
-+	queue_flag_set(QUEUE_FLAG_DYING, q);
-+	spin_unlock_irq(q->queue_lock);
- 
- 	if (q->mq_ops)
- 		blk_mq_wake_waiters(q);
-diff --git a/block/blk-merge.c b/block/blk-merge.c
-index 2613531..bea9344 100644
---- a/block/blk-merge.c
-+++ b/block/blk-merge.c
-@@ -94,9 +94,31 @@ static struct bio *blk_bio_segment_split(struct request_queue *q,
- 	bool do_split = true;
- 	struct bio *new = NULL;
- 	const unsigned max_sectors = get_max_io_size(q, bio);
-+	unsigned bvecs = 0;
- 
- 	bio_for_each_segment(bv, bio, iter) {
- 		/*
-+		 * With arbitrary bio size, the incoming bio may be very
-+		 * big. We have to split the bio into small bios so that
-+		 * each holds at most BIO_MAX_PAGES bvecs because
-+		 * bio_clone() can fail to allocate big bvecs.
-+		 *
-+		 * It should have been better to apply the limit per
-+		 * request queue in which bio_clone() is involved,
-+		 * instead of globally. The biggest blocker is the
-+		 * bio_clone() in bio bounce.
-+		 *
-+		 * If bio is splitted by this reason, we should have
-+		 * allowed to continue bios merging, but don't do
-+		 * that now for making the change simple.
-+		 *
-+		 * TODO: deal with bio bounce's bio_clone() gracefully
-+		 * and convert the global limit into per-queue limit.
-+		 */
-+		if (bvecs++ >= BIO_MAX_PAGES)
-+			goto split;
-+
-+		/*
- 		 * If the queue doesn't support SG gaps and adding this
- 		 * offset would create a gap, disallow it.
- 		 */
-diff --git a/drivers/block/floppy.c b/drivers/block/floppy.c
-index 84708a5..b206115 100644
---- a/drivers/block/floppy.c
-+++ b/drivers/block/floppy.c
-@@ -3663,11 +3663,6 @@ static int floppy_open(struct block_device *bdev, fmode_t mode)
- 
- 	opened_bdev[drive] = bdev;
- 
--	if (!(mode & (FMODE_READ|FMODE_WRITE))) {
--		res = -EINVAL;
--		goto out;
--	}
--
- 	res = -ENXIO;
- 
- 	if (!floppy_track_buffer) {
-@@ -3711,20 +3706,21 @@ static int floppy_open(struct block_device *bdev, fmode_t mode)
- 	if (UFDCS->rawcmd == 1)
- 		UFDCS->rawcmd = 2;
- 
--	UDRS->last_checked = 0;
--	clear_bit(FD_OPEN_SHOULD_FAIL_BIT, &UDRS->flags);
--	check_disk_change(bdev);
--	if (test_bit(FD_DISK_CHANGED_BIT, &UDRS->flags))
--		goto out;
--	if (test_bit(FD_OPEN_SHOULD_FAIL_BIT, &UDRS->flags))
--		goto out;
--
--	res = -EROFS;
--
--	if ((mode & FMODE_WRITE) &&
--			!test_bit(FD_DISK_WRITABLE_BIT, &UDRS->flags))
--		goto out;
--
-+	if (!(mode & FMODE_NDELAY)) {
-+		if (mode & (FMODE_READ|FMODE_WRITE)) {
-+			UDRS->last_checked = 0;
-+			clear_bit(FD_OPEN_SHOULD_FAIL_BIT, &UDRS->flags);
-+			check_disk_change(bdev);
-+			if (test_bit(FD_DISK_CHANGED_BIT, &UDRS->flags))
-+				goto out;
-+			if (test_bit(FD_OPEN_SHOULD_FAIL_BIT, &UDRS->flags))
-+				goto out;
-+		}
-+		res = -EROFS;
-+		if ((mode & FMODE_WRITE) &&
-+		    !test_bit(FD_DISK_WRITABLE_BIT, &UDRS->flags))
-+			goto out;
-+	}
- 	mutex_unlock(&open_lock);
- 	mutex_unlock(&floppy_mutex);
- 	return 0;
-diff --git a/drivers/cpufreq/cpufreq-dt-platdev.c b/drivers/cpufreq/cpufreq-dt-platdev.c
-index 0bb44d5..2ee40fd 100644
---- a/drivers/cpufreq/cpufreq-dt-platdev.c
-+++ b/drivers/cpufreq/cpufreq-dt-platdev.c
-@@ -74,6 +74,8 @@ static const struct of_device_id machines[] __initconst = {
- 	{ .compatible = "ti,omap5", },
- 
- 	{ .compatible = "xlnx,zynq-7000", },
-+
-+	{ }
- };
- 
- static int __init cpufreq_dt_platdev_init(void)
-diff --git a/drivers/crypto/caam/caamalg.c b/drivers/crypto/caam/caamalg.c
-index 6dc5971..b304421 100644
---- a/drivers/crypto/caam/caamalg.c
-+++ b/drivers/crypto/caam/caamalg.c
-@@ -556,7 +556,10 @@ skip_enc:
- 
- 	/* Read and write assoclen bytes */
- 	append_math_add(desc, VARSEQINLEN, ZERO, REG3, CAAM_CMD_SZ);
--	append_math_add(desc, VARSEQOUTLEN, ZERO, REG3, CAAM_CMD_SZ);
-+	if (alg->caam.geniv)
-+		append_math_add_imm_u32(desc, VARSEQOUTLEN, REG3, IMM, ivsize);
-+	else
-+		append_math_add(desc, VARSEQOUTLEN, ZERO, REG3, CAAM_CMD_SZ);
- 
- 	/* Skip assoc data */
- 	append_seq_fifo_store(desc, 0, FIFOST_TYPE_SKIP | FIFOLDST_VLF);
-@@ -565,6 +568,14 @@ skip_enc:
- 	append_seq_fifo_load(desc, 0, FIFOLD_CLASS_CLASS2 | FIFOLD_TYPE_MSG |
- 			     KEY_VLF);
- 
-+	if (alg->caam.geniv) {
-+		append_seq_load(desc, ivsize, LDST_CLASS_1_CCB |
-+				LDST_SRCDST_BYTE_CONTEXT |
-+				(ctx1_iv_off << LDST_OFFSET_SHIFT));
-+		append_move(desc, MOVE_SRC_CLASS1CTX | MOVE_DEST_CLASS2INFIFO |
-+			    (ctx1_iv_off << MOVE_OFFSET_SHIFT) | ivsize);
-+	}
-+
- 	/* Load Counter into CONTEXT1 reg */
- 	if (is_rfc3686)
- 		append_load_imm_u32(desc, be32_to_cpu(1), LDST_IMM |
-@@ -2150,7 +2161,7 @@ static void init_authenc_job(struct aead_request *req,
- 
- 	init_aead_job(req, edesc, all_contig, encrypt);
- 
--	if (ivsize && (is_rfc3686 || !(alg->caam.geniv && encrypt)))
-+	if (ivsize && ((is_rfc3686 && encrypt) || !alg->caam.geniv))
- 		append_load_as_imm(desc, req->iv, ivsize,
- 				   LDST_CLASS_1_CCB |
- 				   LDST_SRCDST_BYTE_CONTEXT |
-@@ -2537,20 +2548,6 @@ static int aead_decrypt(struct aead_request *req)
- 	return ret;
- }
- 
--static int aead_givdecrypt(struct aead_request *req)
--{
--	struct crypto_aead *aead = crypto_aead_reqtfm(req);
--	unsigned int ivsize = crypto_aead_ivsize(aead);
--
--	if (req->cryptlen < ivsize)
--		return -EINVAL;
--
--	req->cryptlen -= ivsize;
--	req->assoclen += ivsize;
--
--	return aead_decrypt(req);
--}
--
- /*
-  * allocate and map the ablkcipher extended descriptor for ablkcipher
-  */
-@@ -3210,7 +3207,7 @@ static struct caam_aead_alg driver_aeads[] = {
- 			.setkey = aead_setkey,
- 			.setauthsize = aead_setauthsize,
- 			.encrypt = aead_encrypt,
--			.decrypt = aead_givdecrypt,
-+			.decrypt = aead_decrypt,
- 			.ivsize = AES_BLOCK_SIZE,
- 			.maxauthsize = MD5_DIGEST_SIZE,
- 		},
-@@ -3256,7 +3253,7 @@ static struct caam_aead_alg driver_aeads[] = {
- 			.setkey = aead_setkey,
- 			.setauthsize = aead_setauthsize,
- 			.encrypt = aead_encrypt,
--			.decrypt = aead_givdecrypt,
-+			.decrypt = aead_decrypt,
- 			.ivsize = AES_BLOCK_SIZE,
- 			.maxauthsize = SHA1_DIGEST_SIZE,
- 		},
-@@ -3302,7 +3299,7 @@ static struct caam_aead_alg driver_aeads[] = {
- 			.setkey = aead_setkey,
- 			.setauthsize = aead_setauthsize,
- 			.encrypt = aead_encrypt,
--			.decrypt = aead_givdecrypt,
-+			.decrypt = aead_decrypt,
- 			.ivsize = AES_BLOCK_SIZE,
- 			.maxauthsize = SHA224_DIGEST_SIZE,
- 		},
-@@ -3348,7 +3345,7 @@ static struct caam_aead_alg driver_aeads[] = {
- 			.setkey = aead_setkey,
- 			.setauthsize = aead_setauthsize,
- 			.encrypt = aead_encrypt,
--			.decrypt = aead_givdecrypt,
-+			.decrypt = aead_decrypt,
- 			.ivsize = AES_BLOCK_SIZE,
- 			.maxauthsize = SHA256_DIGEST_SIZE,
- 		},
-@@ -3394,7 +3391,7 @@ static struct caam_aead_alg driver_aeads[] = {
- 			.setkey = aead_setkey,
- 			.setauthsize = aead_setauthsize,
- 			.encrypt = aead_encrypt,
--			.decrypt = aead_givdecrypt,
-+			.decrypt = aead_decrypt,
- 			.ivsize = AES_BLOCK_SIZE,
- 			.maxauthsize = SHA384_DIGEST_SIZE,
- 		},
-@@ -3440,7 +3437,7 @@ static struct caam_aead_alg driver_aeads[] = {
- 			.setkey = aead_setkey,
- 			.setauthsize = aead_setauthsize,
- 			.encrypt = aead_encrypt,
--			.decrypt = aead_givdecrypt,
-+			.decrypt = aead_decrypt,
- 			.ivsize = AES_BLOCK_SIZE,
- 			.maxauthsize = SHA512_DIGEST_SIZE,
- 		},
-@@ -3486,7 +3483,7 @@ static struct caam_aead_alg driver_aeads[] = {
- 			.setkey = aead_setkey,
- 			.setauthsize = aead_setauthsize,
- 			.encrypt = aead_encrypt,
--			.decrypt = aead_givdecrypt,
-+			.decrypt = aead_decrypt,
- 			.ivsize = DES3_EDE_BLOCK_SIZE,
- 			.maxauthsize = MD5_DIGEST_SIZE,
- 		},
-@@ -3534,7 +3531,7 @@ static struct caam_aead_alg driver_aeads[] = {
- 			.setkey = aead_setkey,
- 			.setauthsize = aead_setauthsize,
- 			.encrypt = aead_encrypt,
--			.decrypt = aead_givdecrypt,
-+			.decrypt = aead_decrypt,
- 			.ivsize = DES3_EDE_BLOCK_SIZE,
- 			.maxauthsize = SHA1_DIGEST_SIZE,
- 		},
-@@ -3582,7 +3579,7 @@ static struct caam_aead_alg driver_aeads[] = {
- 			.setkey = aead_setkey,
- 			.setauthsize = aead_setauthsize,
- 			.encrypt = aead_encrypt,
--			.decrypt = aead_givdecrypt,
-+			.decrypt = aead_decrypt,
- 			.ivsize = DES3_EDE_BLOCK_SIZE,
- 			.maxauthsize = SHA224_DIGEST_SIZE,
- 		},
-@@ -3630,7 +3627,7 @@ static struct caam_aead_alg driver_aeads[] = {
- 			.setkey = aead_setkey,
- 			.setauthsize = aead_setauthsize,
- 			.encrypt = aead_encrypt,
--			.decrypt = aead_givdecrypt,
-+			.decrypt = aead_decrypt,
- 			.ivsize = DES3_EDE_BLOCK_SIZE,
- 			.maxauthsize = SHA256_DIGEST_SIZE,
- 		},
-@@ -3678,7 +3675,7 @@ static struct caam_aead_alg driver_aeads[] = {
- 			.setkey = aead_setkey,
- 			.setauthsize = aead_setauthsize,
- 			.encrypt = aead_encrypt,
--			.decrypt = aead_givdecrypt,
-+			.decrypt = aead_decrypt,
- 			.ivsize = DES3_EDE_BLOCK_SIZE,
- 			.maxauthsize = SHA384_DIGEST_SIZE,
- 		},
-@@ -3726,7 +3723,7 @@ static struct caam_aead_alg driver_aeads[] = {
- 			.setkey = aead_setkey,
- 			.setauthsize = aead_setauthsize,
- 			.encrypt = aead_encrypt,
--			.decrypt = aead_givdecrypt,
-+			.decrypt = aead_decrypt,
- 			.ivsize = DES3_EDE_BLOCK_SIZE,
- 			.maxauthsize = SHA512_DIGEST_SIZE,
- 		},
-@@ -3772,7 +3769,7 @@ static struct caam_aead_alg driver_aeads[] = {
- 			.setkey = aead_setkey,
- 			.setauthsize = aead_setauthsize,
- 			.encrypt = aead_encrypt,
--			.decrypt = aead_givdecrypt,
-+			.decrypt = aead_decrypt,
- 			.ivsize = DES_BLOCK_SIZE,
- 			.maxauthsize = MD5_DIGEST_SIZE,
- 		},
-@@ -3818,7 +3815,7 @@ static struct caam_aead_alg driver_aeads[] = {
- 			.setkey = aead_setkey,
- 			.setauthsize = aead_setauthsize,
- 			.encrypt = aead_encrypt,
--			.decrypt = aead_givdecrypt,
-+			.decrypt = aead_decrypt,
- 			.ivsize = DES_BLOCK_SIZE,
- 			.maxauthsize = SHA1_DIGEST_SIZE,
- 		},
-@@ -3864,7 +3861,7 @@ static struct caam_aead_alg driver_aeads[] = {
- 			.setkey = aead_setkey,
- 			.setauthsize = aead_setauthsize,
- 			.encrypt = aead_encrypt,
--			.decrypt = aead_givdecrypt,
-+			.decrypt = aead_decrypt,
- 			.ivsize = DES_BLOCK_SIZE,
- 			.maxauthsize = SHA224_DIGEST_SIZE,
- 		},
-@@ -3910,7 +3907,7 @@ static struct caam_aead_alg driver_aeads[] = {
- 			.setkey = aead_setkey,
- 			.setauthsize = aead_setauthsize,
- 			.encrypt = aead_encrypt,
--			.decrypt = aead_givdecrypt,
-+			.decrypt = aead_decrypt,
- 			.ivsize = DES_BLOCK_SIZE,
- 			.maxauthsize = SHA256_DIGEST_SIZE,
- 		},
-@@ -3956,7 +3953,7 @@ static struct caam_aead_alg driver_aeads[] = {
- 			.setkey = aead_setkey,
- 			.setauthsize = aead_setauthsize,
- 			.encrypt = aead_encrypt,
--			.decrypt = aead_givdecrypt,
-+			.decrypt = aead_decrypt,
- 			.ivsize = DES_BLOCK_SIZE,
- 			.maxauthsize = SHA384_DIGEST_SIZE,
- 		},
-@@ -4002,7 +3999,7 @@ static struct caam_aead_alg driver_aeads[] = {
- 			.setkey = aead_setkey,
- 			.setauthsize = aead_setauthsize,
- 			.encrypt = aead_encrypt,
--			.decrypt = aead_givdecrypt,
-+			.decrypt = aead_decrypt,
- 			.ivsize = DES_BLOCK_SIZE,
- 			.maxauthsize = SHA512_DIGEST_SIZE,
- 		},
-@@ -4051,7 +4048,7 @@ static struct caam_aead_alg driver_aeads[] = {
- 			.setkey = aead_setkey,
- 			.setauthsize = aead_setauthsize,
- 			.encrypt = aead_encrypt,
--			.decrypt = aead_givdecrypt,
-+			.decrypt = aead_decrypt,
- 			.ivsize = CTR_RFC3686_IV_SIZE,
- 			.maxauthsize = MD5_DIGEST_SIZE,
- 		},
-@@ -4102,7 +4099,7 @@ static struct caam_aead_alg driver_aeads[] = {
- 			.setkey = aead_setkey,
- 			.setauthsize = aead_setauthsize,
- 			.encrypt = aead_encrypt,
--			.decrypt = aead_givdecrypt,
-+			.decrypt = aead_decrypt,
- 			.ivsize = CTR_RFC3686_IV_SIZE,
- 			.maxauthsize = SHA1_DIGEST_SIZE,
- 		},
-@@ -4153,7 +4150,7 @@ static struct caam_aead_alg driver_aeads[] = {
- 			.setkey = aead_setkey,
- 			.setauthsize = aead_setauthsize,
- 			.encrypt = aead_encrypt,
--			.decrypt = aead_givdecrypt,
-+			.decrypt = aead_decrypt,
- 			.ivsize = CTR_RFC3686_IV_SIZE,
- 			.maxauthsize = SHA224_DIGEST_SIZE,
- 		},
-@@ -4204,7 +4201,7 @@ static struct caam_aead_alg driver_aeads[] = {
- 			.setkey = aead_setkey,
- 			.setauthsize = aead_setauthsize,
- 			.encrypt = aead_encrypt,
--			.decrypt = aead_givdecrypt,
-+			.decrypt = aead_decrypt,
- 			.ivsize = CTR_RFC3686_IV_SIZE,
- 			.maxauthsize = SHA256_DIGEST_SIZE,
- 		},
-@@ -4255,7 +4252,7 @@ static struct caam_aead_alg driver_aeads[] = {
- 			.setkey = aead_setkey,
- 			.setauthsize = aead_setauthsize,
- 			.encrypt = aead_encrypt,
--			.decrypt = aead_givdecrypt,
-+			.decrypt = aead_decrypt,
- 			.ivsize = CTR_RFC3686_IV_SIZE,
- 			.maxauthsize = SHA384_DIGEST_SIZE,
- 		},
-@@ -4306,7 +4303,7 @@ static struct caam_aead_alg driver_aeads[] = {
- 			.setkey = aead_setkey,
- 			.setauthsize = aead_setauthsize,
- 			.encrypt = aead_encrypt,
--			.decrypt = aead_givdecrypt,
-+			.decrypt = aead_decrypt,
- 			.ivsize = CTR_RFC3686_IV_SIZE,
- 			.maxauthsize = SHA512_DIGEST_SIZE,
- 		},
-diff --git a/drivers/gpu/drm/drm_atomic.c b/drivers/gpu/drm/drm_atomic.c
-index 9bb99e2..79a05a3 100644
---- a/drivers/gpu/drm/drm_atomic.c
-+++ b/drivers/gpu/drm/drm_atomic.c
-@@ -465,7 +465,7 @@ int drm_atomic_crtc_set_property(struct drm_crtc *crtc,
- 					val,
- 					-1,
- 					&replaced);
--		state->color_mgmt_changed = replaced;
-+		state->color_mgmt_changed |= replaced;
- 		return ret;
- 	} else if (property == config->ctm_property) {
- 		ret = drm_atomic_replace_property_blob_from_id(crtc,
-@@ -473,7 +473,7 @@ int drm_atomic_crtc_set_property(struct drm_crtc *crtc,
- 					val,
- 					sizeof(struct drm_color_ctm),
- 					&replaced);
--		state->color_mgmt_changed = replaced;
-+		state->color_mgmt_changed |= replaced;
- 		return ret;
- 	} else if (property == config->gamma_lut_property) {
- 		ret = drm_atomic_replace_property_blob_from_id(crtc,
-@@ -481,7 +481,7 @@ int drm_atomic_crtc_set_property(struct drm_crtc *crtc,
- 					val,
- 					-1,
- 					&replaced);
--		state->color_mgmt_changed = replaced;
-+		state->color_mgmt_changed |= replaced;
- 		return ret;
- 	} else if (crtc->funcs->atomic_set_property)
- 		return crtc->funcs->atomic_set_property(crtc, state, property, val);
-diff --git a/drivers/gpu/drm/drm_crtc.c b/drivers/gpu/drm/drm_crtc.c
-index 0e3cc66..a5cae1b 100644
---- a/drivers/gpu/drm/drm_crtc.c
-+++ b/drivers/gpu/drm/drm_crtc.c
-@@ -5312,6 +5312,9 @@ int drm_mode_page_flip_ioctl(struct drm_device *dev,
- 	struct drm_pending_vblank_event *e = NULL;
- 	int ret = -EINVAL;
- 
-+	if (!drm_core_check_feature(dev, DRIVER_MODESET))
-+		return -EINVAL;
-+
- 	if (page_flip->flags & ~DRM_MODE_PAGE_FLIP_FLAGS ||
- 	    page_flip->reserved != 0)
- 		return -EINVAL;
-diff --git a/drivers/gpu/drm/msm/msm_gem_submit.c b/drivers/gpu/drm/msm/msm_gem_submit.c
-index eb4bb8b..eb515f0 100644
---- a/drivers/gpu/drm/msm/msm_gem_submit.c
-+++ b/drivers/gpu/drm/msm/msm_gem_submit.c
-@@ -62,6 +62,14 @@ void msm_gem_submit_free(struct msm_gem_submit *submit)
- 	kfree(submit);
- }
- 
-+static inline unsigned long __must_check
-+copy_from_user_inatomic(void *to, const void __user *from, unsigned long n)
-+{
-+	if (access_ok(VERIFY_READ, from, n))
-+		return __copy_from_user_inatomic(to, from, n);
-+	return -EFAULT;
-+}
-+
- static int submit_lookup_objects(struct msm_gem_submit *submit,
- 		struct drm_msm_gem_submit *args, struct drm_file *file)
- {
-@@ -69,6 +77,7 @@ static int submit_lookup_objects(struct msm_gem_submit *submit,
- 	int ret = 0;
- 
- 	spin_lock(&file->table_lock);
-+	pagefault_disable();
- 
- 	for (i = 0; i < args->nr_bos; i++) {
- 		struct drm_msm_gem_submit_bo submit_bo;
-@@ -82,10 +91,15 @@ static int submit_lookup_objects(struct msm_gem_submit *submit,
- 		 */
- 		submit->bos[i].flags = 0;
- 
--		ret = copy_from_user(&submit_bo, userptr, sizeof(submit_bo));
--		if (ret) {
--			ret = -EFAULT;
--			goto out_unlock;
-+		ret = copy_from_user_inatomic(&submit_bo, userptr, sizeof(submit_bo));
-+		if (unlikely(ret)) {
-+			pagefault_enable();
-+			spin_unlock(&file->table_lock);
-+			ret = copy_from_user(&submit_bo, userptr, sizeof(submit_bo));
-+			if (ret)
-+				goto out;
-+			spin_lock(&file->table_lock);
-+			pagefault_disable();
- 		}
- 
- 		if (submit_bo.flags & ~MSM_SUBMIT_BO_FLAGS) {
-@@ -125,9 +139,12 @@ static int submit_lookup_objects(struct msm_gem_submit *submit,
- 	}
- 
- out_unlock:
--	submit->nr_bos = i;
-+	pagefault_enable();
- 	spin_unlock(&file->table_lock);
- 
-+out:
-+	submit->nr_bos = i;
-+
- 	return ret;
- }
- 
-diff --git a/drivers/gpu/drm/radeon/atombios_crtc.c b/drivers/gpu/drm/radeon/atombios_crtc.c
-index 259cd6e..17e3454 100644
---- a/drivers/gpu/drm/radeon/atombios_crtc.c
-+++ b/drivers/gpu/drm/radeon/atombios_crtc.c
-@@ -627,7 +627,9 @@ static u32 atombios_adjust_pll(struct drm_crtc *crtc,
- 			if (radeon_crtc->ss.refdiv) {
- 				radeon_crtc->pll_flags |= RADEON_PLL_USE_REF_DIV;
- 				radeon_crtc->pll_reference_div = radeon_crtc->ss.refdiv;
--				if (rdev->family >= CHIP_RV770)
-+				if (ASIC_IS_AVIVO(rdev) &&
-+				    rdev->family != CHIP_RS780 &&
-+				    rdev->family != CHIP_RS880)
- 					radeon_crtc->pll_flags |= RADEON_PLL_USE_FRAC_FB_DIV;
- 			}
- 		}
-diff --git a/drivers/gpu/drm/radeon/radeon_ttm.c b/drivers/gpu/drm/radeon/radeon_ttm.c
-index 590b037..0ab76dd 100644
---- a/drivers/gpu/drm/radeon/radeon_ttm.c
-+++ b/drivers/gpu/drm/radeon/radeon_ttm.c
-@@ -263,8 +263,8 @@ static int radeon_move_blit(struct ttm_buffer_object *bo,
- 
- 	rdev = radeon_get_rdev(bo->bdev);
- 	ridx = radeon_copy_ring_index(rdev);
--	old_start = old_mem->start << PAGE_SHIFT;
--	new_start = new_mem->start << PAGE_SHIFT;
-+	old_start = (u64)old_mem->start << PAGE_SHIFT;
-+	new_start = (u64)new_mem->start << PAGE_SHIFT;
- 
- 	switch (old_mem->mem_type) {
- 	case TTM_PL_VRAM:
-diff --git a/drivers/gpu/drm/vc4/vc4_drv.h b/drivers/gpu/drm/vc4/vc4_drv.h
-index 37cac59..2e24616 100644
---- a/drivers/gpu/drm/vc4/vc4_drv.h
-+++ b/drivers/gpu/drm/vc4/vc4_drv.h
-@@ -321,6 +321,15 @@ vc4_first_render_job(struct vc4_dev *vc4)
- 				struct vc4_exec_info, head);
- }
- 
-+static inline struct vc4_exec_info *
-+vc4_last_render_job(struct vc4_dev *vc4)
-+{
-+	if (list_empty(&vc4->render_job_list))
-+		return NULL;
-+	return list_last_entry(&vc4->render_job_list,
-+			       struct vc4_exec_info, head);
-+}
-+
- /**
-  * struct vc4_texture_sample_info - saves the offsets into the UBO for texture
-  * setup parameters.
-diff --git a/drivers/gpu/drm/vc4/vc4_gem.c b/drivers/gpu/drm/vc4/vc4_gem.c
-index 46899d6..78ab08e 100644
---- a/drivers/gpu/drm/vc4/vc4_gem.c
-+++ b/drivers/gpu/drm/vc4/vc4_gem.c
-@@ -574,8 +574,8 @@ vc4_cl_lookup_bos(struct drm_device *dev,
- 	spin_unlock(&file_priv->table_lock);
- 
- fail:
--	kfree(handles);
--	return 0;
-+	drm_free_large(handles);
-+	return ret;
- }
- 
- static int
-diff --git a/drivers/gpu/drm/vc4/vc4_irq.c b/drivers/gpu/drm/vc4/vc4_irq.c
-index b0104a34..094bc6a 100644
---- a/drivers/gpu/drm/vc4/vc4_irq.c
-+++ b/drivers/gpu/drm/vc4/vc4_irq.c
-@@ -83,8 +83,10 @@ vc4_overflow_mem_work(struct work_struct *work)
- 
- 		spin_lock_irqsave(&vc4->job_lock, irqflags);
- 		current_exec = vc4_first_bin_job(vc4);
-+		if (!current_exec)
-+			current_exec = vc4_last_render_job(vc4);
- 		if (current_exec) {
--			vc4->overflow_mem->seqno = vc4->finished_seqno + 1;
-+			vc4->overflow_mem->seqno = current_exec->seqno;
- 			list_add_tail(&vc4->overflow_mem->unref_head,
- 				      &current_exec->unref_list);
- 			vc4->overflow_mem = NULL;
-diff --git a/drivers/irqchip/irq-mips-gic.c b/drivers/irqchip/irq-mips-gic.c
-index 70ed1d0..d3ef0fc 100644
---- a/drivers/irqchip/irq-mips-gic.c
-+++ b/drivers/irqchip/irq-mips-gic.c
-@@ -713,9 +713,6 @@ static int gic_shared_irq_domain_map(struct irq_domain *d, unsigned int virq,
- 	unsigned long flags;
- 	int i;
- 
--	irq_set_chip_and_handler(virq, &gic_level_irq_controller,
--				 handle_level_irq);
--
- 	spin_lock_irqsave(&gic_lock, flags);
- 	gic_map_to_pin(intr, gic_cpu_pin);
- 	gic_map_to_vpe(intr, mips_cm_vp_id(vpe));
-@@ -732,6 +729,10 @@ static int gic_irq_domain_map(struct irq_domain *d, unsigned int virq,
- {
- 	if (GIC_HWIRQ_TO_LOCAL(hw) < GIC_NUM_LOCAL_INTRS)
- 		return gic_local_irq_domain_map(d, virq, hw);
-+
-+	irq_set_chip_and_handler(virq, &gic_level_irq_controller,
-+				 handle_level_irq);
-+
- 	return gic_shared_irq_domain_map(d, virq, hw, 0);
- }
- 
-@@ -771,11 +772,13 @@ static int gic_irq_domain_alloc(struct irq_domain *d, unsigned int virq,
- 			hwirq = GIC_SHARED_TO_HWIRQ(base_hwirq + i);
- 
- 			ret = irq_domain_set_hwirq_and_chip(d, virq + i, hwirq,
--							    &gic_edge_irq_controller,
-+							    &gic_level_irq_controller,
- 							    NULL);
- 			if (ret)
- 				goto error;
- 
-+			irq_set_handler(virq + i, handle_level_irq);
-+
- 			ret = gic_shared_irq_domain_map(d, virq + i, hwirq, cpu);
- 			if (ret)
- 				goto error;
-@@ -890,10 +893,17 @@ void gic_dev_domain_free(struct irq_domain *d, unsigned int virq,
- 	return;
- }
- 
-+static void gic_dev_domain_activate(struct irq_domain *domain,
-+				    struct irq_data *d)
-+{
-+	gic_shared_irq_domain_map(domain, d->irq, d->hwirq, 0);
-+}
-+
- static struct irq_domain_ops gic_dev_domain_ops = {
- 	.xlate = gic_dev_domain_xlate,
- 	.alloc = gic_dev_domain_alloc,
- 	.free = gic_dev_domain_free,
-+	.activate = gic_dev_domain_activate,
- };
- 
- static int gic_ipi_domain_xlate(struct irq_domain *d, struct device_node *ctrlr,
-diff --git a/drivers/md/bcache/super.c b/drivers/md/bcache/super.c
-index f5dbb4e..5d3b231 100644
---- a/drivers/md/bcache/super.c
-+++ b/drivers/md/bcache/super.c
-@@ -1818,7 +1818,7 @@ static int cache_alloc(struct cache_sb *sb, struct cache *ca)
- 	free = roundup_pow_of_two(ca->sb.nbuckets) >> 10;
- 
- 	if (!init_fifo(&ca->free[RESERVE_BTREE], 8, GFP_KERNEL) ||
--	    !init_fifo(&ca->free[RESERVE_PRIO], prio_buckets(ca), GFP_KERNEL) ||
-+	    !init_fifo_exact(&ca->free[RESERVE_PRIO], prio_buckets(ca), GFP_KERNEL) ||
- 	    !init_fifo(&ca->free[RESERVE_MOVINGGC], free, GFP_KERNEL) ||
- 	    !init_fifo(&ca->free[RESERVE_NONE], free, GFP_KERNEL) ||
- 	    !init_fifo(&ca->free_inc,	free << 2, GFP_KERNEL) ||
-diff --git a/drivers/misc/mei/hw-me.c b/drivers/misc/mei/hw-me.c
-index e2fb44c..dc3a854 100644
---- a/drivers/misc/mei/hw-me.c
-+++ b/drivers/misc/mei/hw-me.c
-@@ -1263,8 +1263,14 @@ static bool mei_me_fw_type_nm(struct pci_dev *pdev)
- static bool mei_me_fw_type_sps(struct pci_dev *pdev)
- {
- 	u32 reg;
--	/* Read ME FW Status check for SPS Firmware */
--	pci_read_config_dword(pdev, PCI_CFG_HFS_1, &reg);
-+	unsigned int devfn;
-+
-+	/*
-+	 * Read ME FW Status register to check for SPS Firmware
-+	 * The SPS FW is only signaled in pci function 0
-+	 */
-+	devfn = PCI_DEVFN(PCI_SLOT(pdev->devfn), 0);
-+	pci_bus_read_config_dword(pdev->bus, devfn, PCI_CFG_HFS_1, &reg);
- 	trace_mei_pci_cfg_read(&pdev->dev, "PCI_CFG_HFS_1", PCI_CFG_HFS_1, reg);
- 	/* if bits [19:16] = 15, running SPS Firmware */
- 	return (reg & 0xf0000) == 0xf0000;
-diff --git a/drivers/misc/mei/pci-me.c b/drivers/misc/mei/pci-me.c
-index 64e64da..71cea9b 100644
---- a/drivers/misc/mei/pci-me.c
-+++ b/drivers/misc/mei/pci-me.c
-@@ -85,8 +85,8 @@ static const struct pci_device_id mei_me_pci_tbl[] = {
- 
- 	{MEI_PCI_DEVICE(MEI_DEV_ID_SPT, mei_me_pch8_cfg)},
- 	{MEI_PCI_DEVICE(MEI_DEV_ID_SPT_2, mei_me_pch8_cfg)},
--	{MEI_PCI_DEVICE(MEI_DEV_ID_SPT_H, mei_me_pch8_cfg)},
--	{MEI_PCI_DEVICE(MEI_DEV_ID_SPT_H_2, mei_me_pch8_cfg)},
-+	{MEI_PCI_DEVICE(MEI_DEV_ID_SPT_H, mei_me_pch8_sps_cfg)},
-+	{MEI_PCI_DEVICE(MEI_DEV_ID_SPT_H_2, mei_me_pch8_sps_cfg)},
- 
- 	{MEI_PCI_DEVICE(MEI_DEV_ID_BXT_M, mei_me_pch8_cfg)},
- 	{MEI_PCI_DEVICE(MEI_DEV_ID_APL_I, mei_me_pch8_cfg)},
-diff --git a/drivers/scsi/constants.c b/drivers/scsi/constants.c
-index 83458f7..6dc96c8 100644
---- a/drivers/scsi/constants.c
-+++ b/drivers/scsi/constants.c
-@@ -361,8 +361,9 @@ static const char * const snstext[] = {
- 
- /* Get sense key string or NULL if not available */
- const char *
--scsi_sense_key_string(unsigned char key) {
--	if (key <= 0xE)
-+scsi_sense_key_string(unsigned char key)
-+{
-+	if (key < ARRAY_SIZE(snstext))
- 		return snstext[key];
- 	return NULL;
- }
-diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
-index 0a4d54a..591e520 100644
---- a/drivers/usb/class/cdc-acm.c
-+++ b/drivers/usb/class/cdc-acm.c
-@@ -1196,6 +1196,8 @@ static int acm_probe(struct usb_interface *intf,
- 	}
- 
- 	if (!buflen) {
-+		if (!intf->cur_altsetting || !intf->cur_altsetting->endpoint)
-+			return -EINVAL;
- 		if (intf->cur_altsetting->endpoint &&
- 				intf->cur_altsetting->endpoint->extralen &&
- 				intf->cur_altsetting->endpoint->extra) {
-@@ -1276,6 +1278,8 @@ next_desc:
- 				data_interface = usb_ifnum_to_if(usb_dev, (data_interface_num = call_interface_num));
- 			control_interface = intf;
- 		} else {
-+			if (!intf->cur_altsetting)
-+				return -ENODEV;
- 			if (intf->cur_altsetting->desc.bNumEndpoints != 3) {
- 				dev_dbg(&intf->dev,"No union descriptor, giving up\n");
- 				return -ENODEV;
-@@ -1305,15 +1309,22 @@ next_desc:
- 		combined_interfaces = 1;
- 		/* a popular other OS doesn't use it */
- 		quirks |= NO_CAP_LINE;
-+		if (!data_interface->cur_altsetting)
-+			return -EINVAL;
- 		if (data_interface->cur_altsetting->desc.bNumEndpoints != 3) {
- 			dev_err(&intf->dev, "This needs exactly 3 endpoints\n");
- 			return -EINVAL;
- 		}
- look_for_collapsed_interface:
-+		if (!data_interface->cur_altsetting)
-+			return -EINVAL;
- 		for (i = 0; i < 3; i++) {
- 			struct usb_endpoint_descriptor *ep;
- 			ep = &data_interface->cur_altsetting->endpoint[i].desc;
- 
-+			if (!ep)
-+				return -ENODEV;
-+
- 			if (usb_endpoint_is_int_in(ep))
- 				epctrl = ep;
- 			else if (usb_endpoint_is_bulk_out(ep))
-@@ -1332,8 +1343,12 @@ look_for_collapsed_interface:
- skip_normal_probe:
- 
- 	/*workaround for switched interfaces */
-+	if (!data_interface->cur_altsetting)
-+		return -EINVAL;
- 	if (data_interface->cur_altsetting->desc.bInterfaceClass
- 						!= CDC_DATA_INTERFACE_TYPE) {
-+		if (!control_interface->cur_altsetting)
-+			return -EINVAL;
- 		if (control_interface->cur_altsetting->desc.bInterfaceClass
- 						== CDC_DATA_INTERFACE_TYPE) {
- 			dev_dbg(&intf->dev,
-@@ -1356,6 +1371,7 @@ skip_normal_probe:
- 
- 
- 	if (data_interface->cur_altsetting->desc.bNumEndpoints < 2 ||
-+	    !control_interface->cur_altsetting ||
- 	    control_interface->cur_altsetting->desc.bNumEndpoints == 0)
- 		return -EINVAL;
- 
-@@ -1363,6 +1379,8 @@ skip_normal_probe:
- 	epread = &data_interface->cur_altsetting->endpoint[0].desc;
- 	epwrite = &data_interface->cur_altsetting->endpoint[1].desc;
- 
-+	if (!epctrl || !epread || !epwrite)
-+		return -ENODEV;
- 
- 	/* workaround for switched endpoints */
- 	if (!usb_endpoint_dir_in(epread)) {
-diff --git a/drivers/vhost/scsi.c b/drivers/vhost/scsi.c
-index 9d6320e..6e29d05 100644
---- a/drivers/vhost/scsi.c
-+++ b/drivers/vhost/scsi.c
-@@ -88,7 +88,7 @@ struct vhost_scsi_cmd {
- 	struct scatterlist *tvc_prot_sgl;
- 	struct page **tvc_upages;
- 	/* Pointer to response header iovec */
--	struct iovec *tvc_resp_iov;
-+	struct iovec tvc_resp_iov;
- 	/* Pointer to vhost_scsi for our device */
- 	struct vhost_scsi *tvc_vhost;
- 	/* Pointer to vhost_virtqueue for the cmd */
-@@ -547,7 +547,7 @@ static void vhost_scsi_complete_cmd_work(struct vhost_work *work)
- 		memcpy(v_rsp.sense, cmd->tvc_sense_buf,
- 		       se_cmd->scsi_sense_length);
- 
--		iov_iter_init(&iov_iter, READ, cmd->tvc_resp_iov,
-+		iov_iter_init(&iov_iter, READ, &cmd->tvc_resp_iov,
- 			      cmd->tvc_in_iovs, sizeof(v_rsp));
- 		ret = copy_to_iter(&v_rsp, sizeof(v_rsp), &iov_iter);
- 		if (likely(ret == sizeof(v_rsp))) {
-@@ -1044,7 +1044,7 @@ vhost_scsi_handle_vq(struct vhost_scsi *vs, struct vhost_virtqueue *vq)
- 		}
- 		cmd->tvc_vhost = vs;
- 		cmd->tvc_vq = vq;
--		cmd->tvc_resp_iov = &vq->iov[out];
-+		cmd->tvc_resp_iov = vq->iov[out];
- 		cmd->tvc_in_iovs = in;
- 
- 		pr_debug("vhost_scsi got command opcode: %#02x, lun: %d\n",
-diff --git a/drivers/xen/xenbus/xenbus_dev_frontend.c b/drivers/xen/xenbus/xenbus_dev_frontend.c
-index 7487971..c1010f01 100644
---- a/drivers/xen/xenbus/xenbus_dev_frontend.c
-+++ b/drivers/xen/xenbus/xenbus_dev_frontend.c
-@@ -316,7 +316,7 @@ static int xenbus_write_transaction(unsigned msg_type,
- 			rc = -ENOMEM;
- 			goto out;
- 		}
--	} else {
-+	} else if (msg_type == XS_TRANSACTION_END) {
- 		list_for_each_entry(trans, &u->transactions, list)
- 			if (trans->handle.id == u->u.msg.tx_id)
- 				break;
-diff --git a/fs/block_dev.c b/fs/block_dev.c
-index 71ccab1..b1495fa 100644
---- a/fs/block_dev.c
-+++ b/fs/block_dev.c
-@@ -659,7 +659,7 @@ static struct dentry *bd_mount(struct file_system_type *fs_type,
- {
- 	struct dentry *dent;
- 	dent = mount_pseudo(fs_type, "bdev:", &bdev_sops, NULL, BDEVFS_MAGIC);
--	if (dent)
-+	if (!IS_ERR(dent))
- 		dent->d_sb->s_iflags |= SB_I_CGROUPWB;
- 	return dent;
- }
-diff --git a/fs/crypto/policy.c b/fs/crypto/policy.c
-index 0f9961e..f96547f 100644
---- a/fs/crypto/policy.c
-+++ b/fs/crypto/policy.c
-@@ -95,10 +95,15 @@ static int create_encryption_context_from_policy(struct inode *inode,
- int fscrypt_process_policy(struct inode *inode,
- 				const struct fscrypt_policy *policy)
- {
-+	if (!inode_owner_or_capable(inode))
-+		return -EACCES;
-+
- 	if (policy->version != 0)
- 		return -EINVAL;
- 
- 	if (!inode_has_encryption_context(inode)) {
-+		if (!S_ISDIR(inode->i_mode))
-+			return -EINVAL;
- 		if (!inode->i_sb->s_cop->empty_dir)
- 			return -EOPNOTSUPP;
- 		if (!inode->i_sb->s_cop->empty_dir(inode))
-diff --git a/fs/ext4/crypto_policy.c b/fs/ext4/crypto_policy.c
-index ad05069..8a9feb3 100644
---- a/fs/ext4/crypto_policy.c
-+++ b/fs/ext4/crypto_policy.c
-@@ -102,6 +102,9 @@ static int ext4_create_encryption_context_from_policy(
- int ext4_process_policy(const struct ext4_encryption_policy *policy,
- 			struct inode *inode)
- {
-+	if (!inode_owner_or_capable(inode))
-+		return -EACCES;
-+
- 	if (policy->version != 0)
- 		return -EINVAL;
- 
-diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
-index b747ec0..ea628af 100644
---- a/fs/ext4/inode.c
-+++ b/fs/ext4/inode.c
-@@ -51,25 +51,31 @@ static __u32 ext4_inode_csum(struct inode *inode, struct ext4_inode *raw,
- 			      struct ext4_inode_info *ei)
- {
- 	struct ext4_sb_info *sbi = EXT4_SB(inode->i_sb);
--	__u16 csum_lo;
--	__u16 csum_hi = 0;
- 	__u32 csum;
-+	__u16 dummy_csum = 0;
-+	int offset = offsetof(struct ext4_inode, i_checksum_lo);
-+	unsigned int csum_size = sizeof(dummy_csum);
- 
--	csum_lo = le16_to_cpu(raw->i_checksum_lo);
--	raw->i_checksum_lo = 0;
--	if (EXT4_INODE_SIZE(inode->i_sb) > EXT4_GOOD_OLD_INODE_SIZE &&
--	    EXT4_FITS_IN_INODE(raw, ei, i_checksum_hi)) {
--		csum_hi = le16_to_cpu(raw->i_checksum_hi);
--		raw->i_checksum_hi = 0;
--	}
-+	csum = ext4_chksum(sbi, ei->i_csum_seed, (__u8 *)raw, offset);
-+	csum = ext4_chksum(sbi, csum, (__u8 *)&dummy_csum, csum_size);
-+	offset += csum_size;
-+	csum = ext4_chksum(sbi, csum, (__u8 *)raw + offset,
-+			   EXT4_GOOD_OLD_INODE_SIZE - offset);
- 
--	csum = ext4_chksum(sbi, ei->i_csum_seed, (__u8 *)raw,
--			   EXT4_INODE_SIZE(inode->i_sb));
--
--	raw->i_checksum_lo = cpu_to_le16(csum_lo);
--	if (EXT4_INODE_SIZE(inode->i_sb) > EXT4_GOOD_OLD_INODE_SIZE &&
--	    EXT4_FITS_IN_INODE(raw, ei, i_checksum_hi))
--		raw->i_checksum_hi = cpu_to_le16(csum_hi);
-+	if (EXT4_INODE_SIZE(inode->i_sb) > EXT4_GOOD_OLD_INODE_SIZE) {
-+		offset = offsetof(struct ext4_inode, i_checksum_hi);
-+		csum = ext4_chksum(sbi, csum, (__u8 *)raw +
-+				   EXT4_GOOD_OLD_INODE_SIZE,
-+				   offset - EXT4_GOOD_OLD_INODE_SIZE);
-+		if (EXT4_FITS_IN_INODE(raw, ei, i_checksum_hi)) {
-+			csum = ext4_chksum(sbi, csum, (__u8 *)&dummy_csum,
-+					   csum_size);
-+			offset += csum_size;
-+			csum = ext4_chksum(sbi, csum, (__u8 *)raw + offset,
-+					   EXT4_INODE_SIZE(inode->i_sb) -
-+					   offset);
-+		}
-+	}
- 
- 	return csum;
- }
-@@ -5460,8 +5466,6 @@ int ext4_mark_inode_dirty(handle_t *handle, struct inode *inode)
- 						      sbi->s_want_extra_isize,
- 						      iloc, handle);
- 			if (ret) {
--				ext4_set_inode_state(inode,
--						     EXT4_STATE_NO_EXPAND);
- 				if (mnt_count !=
- 					le16_to_cpu(sbi->s_es->s_mnt_count)) {
- 					ext4_warning(inode->i_sb,
-diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c
-index ec4c399..5bb46b6 100644
---- a/fs/ext4/namei.c
-+++ b/fs/ext4/namei.c
-@@ -420,15 +420,14 @@ static __le32 ext4_dx_csum(struct inode *inode, struct ext4_dir_entry *dirent,
- 	struct ext4_sb_info *sbi = EXT4_SB(inode->i_sb);
- 	struct ext4_inode_info *ei = EXT4_I(inode);
- 	__u32 csum;
--	__le32 save_csum;
- 	int size;
-+	__u32 dummy_csum = 0;
-+	int offset = offsetof(struct dx_tail, dt_checksum);
- 
- 	size = count_offset + (count * sizeof(struct dx_entry));
--	save_csum = t->dt_checksum;
--	t->dt_checksum = 0;
- 	csum = ext4_chksum(sbi, ei->i_csum_seed, (__u8 *)dirent, size);
--	csum = ext4_chksum(sbi, csum, (__u8 *)t, sizeof(struct dx_tail));
--	t->dt_checksum = save_csum;
-+	csum = ext4_chksum(sbi, csum, (__u8 *)t, offset);
-+	csum = ext4_chksum(sbi, csum, (__u8 *)&dummy_csum, sizeof(dummy_csum));
- 
- 	return cpu_to_le32(csum);
- }
-diff --git a/fs/ext4/super.c b/fs/ext4/super.c
-index 639bd756..d4505f8 100644
---- a/fs/ext4/super.c
-+++ b/fs/ext4/super.c
-@@ -2068,23 +2068,25 @@ failed:
- static __le16 ext4_group_desc_csum(struct super_block *sb, __u32 block_group,
- 				   struct ext4_group_desc *gdp)
- {
--	int offset;
-+	int offset = offsetof(struct ext4_group_desc, bg_checksum);
- 	__u16 crc = 0;
- 	__le32 le_group = cpu_to_le32(block_group);
- 	struct ext4_sb_info *sbi = EXT4_SB(sb);
- 
- 	if (ext4_has_metadata_csum(sbi->s_sb)) {
- 		/* Use new metadata_csum algorithm */
--		__le16 save_csum;
- 		__u32 csum32;
-+		__u16 dummy_csum = 0;
- 
--		save_csum = gdp->bg_checksum;
--		gdp->bg_checksum = 0;
- 		csum32 = ext4_chksum(sbi, sbi->s_csum_seed, (__u8 *)&le_group,
- 				     sizeof(le_group));
--		csum32 = ext4_chksum(sbi, csum32, (__u8 *)gdp,
--				     sbi->s_desc_size);
--		gdp->bg_checksum = save_csum;
-+		csum32 = ext4_chksum(sbi, csum32, (__u8 *)gdp, offset);
-+		csum32 = ext4_chksum(sbi, csum32, (__u8 *)&dummy_csum,
-+				     sizeof(dummy_csum));
-+		offset += sizeof(dummy_csum);
-+		if (offset < sbi->s_desc_size)
-+			csum32 = ext4_chksum(sbi, csum32, (__u8 *)gdp + offset,
-+					     sbi->s_desc_size - offset);
- 
- 		crc = csum32 & 0xFFFF;
- 		goto out;
-@@ -2094,8 +2096,6 @@ static __le16 ext4_group_desc_csum(struct super_block *sb, __u32 block_group,
- 	if (!ext4_has_feature_gdt_csum(sb))
- 		return 0;
- 
--	offset = offsetof(struct ext4_group_desc, bg_checksum);
--
- 	crc = crc16(~0, sbi->s_es->s_uuid, sizeof(sbi->s_es->s_uuid));
- 	crc = crc16(crc, (__u8 *)&le_group, sizeof(le_group));
- 	crc = crc16(crc, (__u8 *)gdp, offset);
-@@ -2131,6 +2131,7 @@ void ext4_group_desc_csum_set(struct super_block *sb, __u32 block_group,
- 
- /* Called at mount-time, super-block is locked */
- static int ext4_check_descriptors(struct super_block *sb,
-+				  ext4_fsblk_t sb_block,
- 				  ext4_group_t *first_not_zeroed)
- {
- 	struct ext4_sb_info *sbi = EXT4_SB(sb);
-@@ -2161,6 +2162,11 @@ static int ext4_check_descriptors(struct super_block *sb,
- 			grp = i;
- 
- 		block_bitmap = ext4_block_bitmap(sb, gdp);
-+		if (block_bitmap == sb_block) {
-+			ext4_msg(sb, KERN_ERR, "ext4_check_descriptors: "
-+				 "Block bitmap for group %u overlaps "
-+				 "superblock", i);
-+		}
- 		if (block_bitmap < first_block || block_bitmap > last_block) {
- 			ext4_msg(sb, KERN_ERR, "ext4_check_descriptors: "
- 			       "Block bitmap for group %u not in group "
-@@ -2168,6 +2174,11 @@ static int ext4_check_descriptors(struct super_block *sb,
- 			return 0;
- 		}
- 		inode_bitmap = ext4_inode_bitmap(sb, gdp);
-+		if (inode_bitmap == sb_block) {
-+			ext4_msg(sb, KERN_ERR, "ext4_check_descriptors: "
-+				 "Inode bitmap for group %u overlaps "
-+				 "superblock", i);
-+		}
- 		if (inode_bitmap < first_block || inode_bitmap > last_block) {
- 			ext4_msg(sb, KERN_ERR, "ext4_check_descriptors: "
- 			       "Inode bitmap for group %u not in group "
-@@ -2175,6 +2186,11 @@ static int ext4_check_descriptors(struct super_block *sb,
- 			return 0;
- 		}
- 		inode_table = ext4_inode_table(sb, gdp);
-+		if (inode_table == sb_block) {
-+			ext4_msg(sb, KERN_ERR, "ext4_check_descriptors: "
-+				 "Inode table for group %u overlaps "
-+				 "superblock", i);
-+		}
- 		if (inode_table < first_block ||
- 		    inode_table + sbi->s_itb_per_group - 1 > last_block) {
- 			ext4_msg(sb, KERN_ERR, "ext4_check_descriptors: "
-@@ -3677,7 +3693,7 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent)
- 			goto failed_mount2;
- 		}
- 	}
--	if (!ext4_check_descriptors(sb, &first_not_zeroed)) {
-+	if (!ext4_check_descriptors(sb, logical_sb_block, &first_not_zeroed)) {
- 		ext4_msg(sb, KERN_ERR, "group descriptors corrupted!");
- 		ret = -EFSCORRUPTED;
- 		goto failed_mount2;
-diff --git a/fs/ext4/xattr.c b/fs/ext4/xattr.c
-index e79bd32..2eb935c 100644
---- a/fs/ext4/xattr.c
-+++ b/fs/ext4/xattr.c
-@@ -121,17 +121,18 @@ static __le32 ext4_xattr_block_csum(struct inode *inode,
- {
- 	struct ext4_sb_info *sbi = EXT4_SB(inode->i_sb);
- 	__u32 csum;
--	__le32 save_csum;
- 	__le64 dsk_block_nr = cpu_to_le64(block_nr);
-+	__u32 dummy_csum = 0;
-+	int offset = offsetof(struct ext4_xattr_header, h_checksum);
- 
--	save_csum = hdr->h_checksum;
--	hdr->h_checksum = 0;
- 	csum = ext4_chksum(sbi, sbi->s_csum_seed, (__u8 *)&dsk_block_nr,
- 			   sizeof(dsk_block_nr));
--	csum = ext4_chksum(sbi, csum, (__u8 *)hdr,
--			   EXT4_BLOCK_SIZE(inode->i_sb));
-+	csum = ext4_chksum(sbi, csum, (__u8 *)hdr, offset);
-+	csum = ext4_chksum(sbi, csum, (__u8 *)&dummy_csum, sizeof(dummy_csum));
-+	offset += sizeof(dummy_csum);
-+	csum = ext4_chksum(sbi, csum, (__u8 *)hdr + offset,
-+			   EXT4_BLOCK_SIZE(inode->i_sb) - offset);
- 
--	hdr->h_checksum = save_csum;
- 	return cpu_to_le32(csum);
- }
- 
-@@ -1352,15 +1353,19 @@ int ext4_expand_extra_isize_ea(struct inode *inode, int new_extra_isize,
- 	size_t min_offs, free;
- 	int total_ino;
- 	void *base, *start, *end;
--	int extra_isize = 0, error = 0, tried_min_extra_isize = 0;
-+	int error = 0, tried_min_extra_isize = 0;
- 	int s_min_extra_isize = le16_to_cpu(EXT4_SB(inode->i_sb)->s_es->s_min_extra_isize);
-+	int isize_diff;	/* How much do we need to grow i_extra_isize */
- 
- 	down_write(&EXT4_I(inode)->xattr_sem);
-+	/*
-+	 * Set EXT4_STATE_NO_EXPAND to avoid recursion when marking inode dirty
-+	 */
-+	ext4_set_inode_state(inode, EXT4_STATE_NO_EXPAND);
- retry:
--	if (EXT4_I(inode)->i_extra_isize >= new_extra_isize) {
--		up_write(&EXT4_I(inode)->xattr_sem);
--		return 0;
--	}
-+	isize_diff = new_extra_isize - EXT4_I(inode)->i_extra_isize;
-+	if (EXT4_I(inode)->i_extra_isize >= new_extra_isize)
-+		goto out;
- 
- 	header = IHDR(inode, raw_inode);
- 	entry = IFIRST(header);
-@@ -1381,7 +1386,7 @@ retry:
- 		goto cleanup;
- 
- 	free = ext4_xattr_free_space(last, &min_offs, base, &total_ino);
--	if (free >= new_extra_isize) {
-+	if (free >= isize_diff) {
- 		entry = IFIRST(header);
- 		ext4_xattr_shift_entries(entry,	EXT4_I(inode)->i_extra_isize
- 				- new_extra_isize, (void *)raw_inode +
-@@ -1389,8 +1394,7 @@ retry:
- 				(void *)header, total_ino,
- 				inode->i_sb->s_blocksize);
- 		EXT4_I(inode)->i_extra_isize = new_extra_isize;
--		error = 0;
--		goto cleanup;
-+		goto out;
- 	}
- 
- 	/*
-@@ -1413,7 +1417,7 @@ retry:
- 		end = bh->b_data + bh->b_size;
- 		min_offs = end - base;
- 		free = ext4_xattr_free_space(first, &min_offs, base, NULL);
--		if (free < new_extra_isize) {
-+		if (free < isize_diff) {
- 			if (!tried_min_extra_isize && s_min_extra_isize) {
- 				tried_min_extra_isize++;
- 				new_extra_isize = s_min_extra_isize;
-@@ -1427,7 +1431,7 @@ retry:
- 		free = inode->i_sb->s_blocksize;
- 	}
- 
--	while (new_extra_isize > 0) {
-+	while (isize_diff > 0) {
- 		size_t offs, size, entry_size;
- 		struct ext4_xattr_entry *small_entry = NULL;
- 		struct ext4_xattr_info i = {
-@@ -1458,7 +1462,7 @@ retry:
- 			EXT4_XATTR_SIZE(le32_to_cpu(last->e_value_size)) +
- 					EXT4_XATTR_LEN(last->e_name_len);
- 			if (total_size <= free && total_size < min_total_size) {
--				if (total_size < new_extra_isize) {
-+				if (total_size < isize_diff) {
- 					small_entry = last;
- 				} else {
- 					entry = last;
-@@ -1513,22 +1517,22 @@ retry:
- 		error = ext4_xattr_ibody_set(handle, inode, &i, is);
- 		if (error)
- 			goto cleanup;
-+		total_ino -= entry_size;
- 
- 		entry = IFIRST(header);
--		if (entry_size + EXT4_XATTR_SIZE(size) >= new_extra_isize)
--			shift_bytes = new_extra_isize;
-+		if (entry_size + EXT4_XATTR_SIZE(size) >= isize_diff)
-+			shift_bytes = isize_diff;
- 		else
--			shift_bytes = entry_size + size;
-+			shift_bytes = entry_size + EXT4_XATTR_SIZE(size);
- 		/* Adjust the offsets and shift the remaining entries ahead */
--		ext4_xattr_shift_entries(entry, EXT4_I(inode)->i_extra_isize -
--			shift_bytes, (void *)raw_inode +
--			EXT4_GOOD_OLD_INODE_SIZE + extra_isize + shift_bytes,
--			(void *)header, total_ino - entry_size,
--			inode->i_sb->s_blocksize);
-+		ext4_xattr_shift_entries(entry, -shift_bytes,
-+			(void *)raw_inode + EXT4_GOOD_OLD_INODE_SIZE +
-+			EXT4_I(inode)->i_extra_isize + shift_bytes,
-+			(void *)header, total_ino, inode->i_sb->s_blocksize);
- 
--		extra_isize += shift_bytes;
--		new_extra_isize -= shift_bytes;
--		EXT4_I(inode)->i_extra_isize = extra_isize;
-+		isize_diff -= shift_bytes;
-+		EXT4_I(inode)->i_extra_isize += shift_bytes;
-+		header = IHDR(inode, raw_inode);
- 
- 		i.name = b_entry_name;
- 		i.value = buffer;
-@@ -1550,6 +1554,8 @@ retry:
- 		kfree(bs);
- 	}
- 	brelse(bh);
-+out:
-+	ext4_clear_inode_state(inode, EXT4_STATE_NO_EXPAND);
- 	up_write(&EXT4_I(inode)->xattr_sem);
- 	return 0;
- 
-@@ -1561,6 +1567,10 @@ cleanup:
- 	kfree(is);
- 	kfree(bs);
- 	brelse(bh);
-+	/*
-+	 * We deliberately leave EXT4_STATE_NO_EXPAND set here since inode
-+	 * size expansion failed.
-+	 */
- 	up_write(&EXT4_I(inode)->xattr_sem);
- 	return error;
- }
-diff --git a/fs/namei.c b/fs/namei.c
-index 70580ab..9281b2b 100644
---- a/fs/namei.c
-+++ b/fs/namei.c
-@@ -901,6 +901,7 @@ static inline int may_follow_link(struct nameidata *nd)
- {
- 	const struct inode *inode;
- 	const struct inode *parent;
-+	kuid_t puid;
- 
- 	if (!sysctl_protected_symlinks)
- 		return 0;
-@@ -916,7 +917,8 @@ static inline int may_follow_link(struct nameidata *nd)
- 		return 0;
- 
- 	/* Allowed if parent directory and link owner match. */
--	if (uid_eq(parent->i_uid, inode->i_uid))
-+	puid = parent->i_uid;
-+	if (uid_valid(puid) && uid_eq(puid, inode->i_uid))
- 		return 0;
- 
- 	if (nd->flags & LOOKUP_RCU)
-diff --git a/fs/overlayfs/copy_up.c b/fs/overlayfs/copy_up.c
-index 80aa6f1..4133aa7 100644
---- a/fs/overlayfs/copy_up.c
-+++ b/fs/overlayfs/copy_up.c
-@@ -80,6 +80,8 @@ int ovl_copy_xattr(struct dentry *old, struct dentry *new)
- 	}
- 
- 	for (name = buf; name < (buf + list_size); name += strlen(name) + 1) {
-+		if (ovl_is_private_xattr(name))
-+			continue;
- retry:
- 		size = vfs_getxattr(old, name, value, value_size);
- 		if (size == -ERANGE)
-diff --git a/fs/overlayfs/inode.c b/fs/overlayfs/inode.c
-index d1cdc60..ac98a71 100644
---- a/fs/overlayfs/inode.c
-+++ b/fs/overlayfs/inode.c
-@@ -231,7 +231,7 @@ static int ovl_readlink(struct dentry *dentry, char __user *buf, int bufsiz)
- }
- 
- 
--static bool ovl_is_private_xattr(const char *name)
-+bool ovl_is_private_xattr(const char *name)
- {
- 	return strncmp(name, OVL_XATTR_PRE_NAME, OVL_XATTR_PRE_LEN) == 0;
- }
-@@ -279,24 +279,27 @@ ssize_t ovl_listxattr(struct dentry *dentry, char *list, size_t size)
- {
- 	struct dentry *realdentry = ovl_dentry_real(dentry);
- 	ssize_t res;
--	int off;
-+	size_t len;
-+	char *s;
- 
- 	res = vfs_listxattr(realdentry, list, size);
- 	if (res <= 0 || size == 0)
- 		return res;
- 
- 	/* filter out private xattrs */
--	for (off = 0; off < res;) {
--		char *s = list + off;
--		size_t slen = strlen(s) + 1;
-+	for (s = list, len = res; len;) {
-+		size_t slen = strnlen(s, len) + 1;
- 
--		BUG_ON(off + slen > res);
-+		/* underlying fs providing us with an broken xattr list? */
-+		if (WARN_ON(slen > len))
-+			return -EIO;
- 
-+		len -= slen;
- 		if (ovl_is_private_xattr(s)) {
- 			res -= slen;
--			memmove(s, s + slen, res - off);
-+			memmove(s, s + slen, len);
- 		} else {
--			off += slen;
-+			s += slen;
- 		}
- 	}
- 
-diff --git a/fs/overlayfs/overlayfs.h b/fs/overlayfs/overlayfs.h
-index cfbca53..d8ddc31 100644
---- a/fs/overlayfs/overlayfs.h
-+++ b/fs/overlayfs/overlayfs.h
-@@ -168,6 +168,8 @@ int ovl_check_empty_dir(struct dentry *dentry, struct list_head *list);
- void ovl_cleanup_whiteouts(struct dentry *upper, struct list_head *list);
- void ovl_cache_free(struct list_head *list);
- int ovl_check_d_type_supported(struct path *realpath);
-+void ovl_workdir_cleanup(struct inode *dir, struct vfsmount *mnt,
-+			 struct dentry *dentry, int level);
- 
- /* inode.c */
- int ovl_setattr(struct dentry *dentry, struct iattr *attr);
-@@ -180,6 +182,7 @@ ssize_t ovl_getxattr(struct dentry *dentry, struct inode *inode,
- ssize_t ovl_listxattr(struct dentry *dentry, char *list, size_t size);
- int ovl_removexattr(struct dentry *dentry, const char *name);
- struct inode *ovl_d_select_inode(struct dentry *dentry, unsigned file_flags);
-+bool ovl_is_private_xattr(const char *name);
- 
- struct inode *ovl_new_inode(struct super_block *sb, umode_t mode,
- 			    struct ovl_entry *oe);
-diff --git a/fs/overlayfs/readdir.c b/fs/overlayfs/readdir.c
-index cf37fc7..f241b4e 100644
---- a/fs/overlayfs/readdir.c
-+++ b/fs/overlayfs/readdir.c
-@@ -248,7 +248,7 @@ static inline int ovl_dir_read(struct path *realpath,
- 			err = rdd->err;
- 	} while (!err && rdd->count);
- 
--	if (!err && rdd->first_maybe_whiteout)
-+	if (!err && rdd->first_maybe_whiteout && rdd->dentry)
- 		err = ovl_check_whiteouts(realpath->dentry, rdd);
- 
- 	fput(realfile);
-@@ -606,3 +606,64 @@ int ovl_check_d_type_supported(struct path *realpath)
- 
- 	return rdd.d_type_supported;
- }
-+
-+static void ovl_workdir_cleanup_recurse(struct path *path, int level)
-+{
-+	int err;
-+	struct inode *dir = path->dentry->d_inode;
-+	LIST_HEAD(list);
-+	struct ovl_cache_entry *p;
-+	struct ovl_readdir_data rdd = {
-+		.ctx.actor = ovl_fill_merge,
-+		.dentry = NULL,
-+		.list = &list,
-+		.root = RB_ROOT,
-+		.is_lowest = false,
-+	};
-+
-+	err = ovl_dir_read(path, &rdd);
-+	if (err)
-+		goto out;
-+
-+	inode_lock_nested(dir, I_MUTEX_PARENT);
-+	list_for_each_entry(p, &list, l_node) {
-+		struct dentry *dentry;
-+
-+		if (p->name[0] == '.') {
-+			if (p->len == 1)
-+				continue;
-+			if (p->len == 2 && p->name[1] == '.')
-+				continue;
-+		}
-+		dentry = lookup_one_len(p->name, path->dentry, p->len);
-+		if (IS_ERR(dentry))
-+			continue;
-+		if (dentry->d_inode)
-+			ovl_workdir_cleanup(dir, path->mnt, dentry, level);
-+		dput(dentry);
-+	}
-+	inode_unlock(dir);
-+out:
-+	ovl_cache_free(&list);
-+}
-+
-+void ovl_workdir_cleanup(struct inode *dir, struct vfsmount *mnt,
-+			 struct dentry *dentry, int level)
-+{
-+	int err;
-+
-+	if (!d_is_dir(dentry) || level > 1) {
-+		ovl_cleanup(dir, dentry);
-+		return;
-+	}
-+
-+	err = ovl_do_rmdir(dir, dentry);
-+	if (err) {
-+		struct path path = { .mnt = mnt, .dentry = dentry };
-+
-+		inode_unlock(dir);
-+		ovl_workdir_cleanup_recurse(&path, level + 1);
-+		inode_lock_nested(dir, I_MUTEX_PARENT);
-+		ovl_cleanup(dir, dentry);
-+	}
-+}
-diff --git a/fs/overlayfs/super.c b/fs/overlayfs/super.c
-index 6db75cb..86f2025 100644
---- a/fs/overlayfs/super.c
-+++ b/fs/overlayfs/super.c
-@@ -798,6 +798,10 @@ retry:
- 		struct kstat stat = {
- 			.mode = S_IFDIR | 0,
- 		};
-+		struct iattr attr = {
-+			.ia_valid = ATTR_MODE,
-+			.ia_mode = stat.mode,
-+		};
- 
- 		if (work->d_inode) {
- 			err = -EEXIST;
-@@ -805,7 +809,7 @@ retry:
- 				goto out_dput;
- 
- 			retried = true;
--			ovl_cleanup(dir, work);
-+			ovl_workdir_cleanup(dir, mnt, work, 0);
- 			dput(work);
- 			goto retry;
- 		}
-@@ -813,6 +817,21 @@ retry:
- 		err = ovl_create_real(dir, work, &stat, NULL, NULL, true);
- 		if (err)
- 			goto out_dput;
-+
-+		err = vfs_removexattr(work, XATTR_NAME_POSIX_ACL_DEFAULT);
-+		if (err && err != -ENODATA && err != -EOPNOTSUPP)
-+			goto out_dput;
-+
-+		err = vfs_removexattr(work, XATTR_NAME_POSIX_ACL_ACCESS);
-+		if (err && err != -ENODATA && err != -EOPNOTSUPP)
-+			goto out_dput;
-+
-+		/* Clear any inherited mode bits */
-+		inode_lock(work->d_inode);
-+		err = notify_change(work, &attr, NULL);
-+		inode_unlock(work->d_inode);
-+		if (err)
-+			goto out_dput;
- 	}
- out_unlock:
- 	inode_unlock(dir);
-diff --git a/fs/ubifs/tnc_commit.c b/fs/ubifs/tnc_commit.c
-index b45345d..51157da 100644
---- a/fs/ubifs/tnc_commit.c
-+++ b/fs/ubifs/tnc_commit.c
-@@ -370,7 +370,7 @@ static int layout_in_gaps(struct ubifs_info *c, int cnt)
- 
- 	p = c->gap_lebs;
- 	do {
--		ubifs_assert(p < c->gap_lebs + sizeof(int) * c->lst.idx_lebs);
-+		ubifs_assert(p < c->gap_lebs + c->lst.idx_lebs);
- 		written = layout_leb_in_gaps(c, p);
- 		if (written < 0) {
- 			err = written;
-diff --git a/fs/ubifs/xattr.c b/fs/ubifs/xattr.c
-index b5fc279..c63710f 100644
---- a/fs/ubifs/xattr.c
-+++ b/fs/ubifs/xattr.c
-@@ -575,7 +575,8 @@ static int ubifs_xattr_get(const struct xattr_handler *handler,
- 	dbg_gen("xattr '%s', ino %lu ('%pd'), buf size %zd", name,
- 		inode->i_ino, dentry, size);
- 
--	return  __ubifs_getxattr(inode, name, buffer, size);
-+	name = xattr_full_name(handler, name);
-+	return __ubifs_getxattr(inode, name, buffer, size);
- }
- 
- static int ubifs_xattr_set(const struct xattr_handler *handler,
-@@ -586,6 +587,8 @@ static int ubifs_xattr_set(const struct xattr_handler *handler,
- 	dbg_gen("xattr '%s', host ino %lu ('%pd'), size %zd",
- 		name, inode->i_ino, dentry, size);
- 
-+	name = xattr_full_name(handler, name);
-+
- 	if (value)
- 		return __ubifs_setxattr(inode, name, value, size, flags);
- 	else
-diff --git a/fs/xfs/libxfs/xfs_sb.c b/fs/xfs/libxfs/xfs_sb.c
-index 12ca867..85bdf3d 100644
---- a/fs/xfs/libxfs/xfs_sb.c
-+++ b/fs/xfs/libxfs/xfs_sb.c
-@@ -581,7 +581,8 @@ xfs_sb_verify(
- 	 * Only check the in progress field for the primary superblock as
- 	 * mkfs.xfs doesn't clear it from secondary superblocks.
- 	 */
--	return xfs_mount_validate_sb(mp, &sb, bp->b_bn == XFS_SB_DADDR,
-+	return xfs_mount_validate_sb(mp, &sb,
-+				     bp->b_maps[0].bm_bn == XFS_SB_DADDR,
- 				     check_version);
- }
- 
-diff --git a/include/linux/capability.h b/include/linux/capability.h
-index 00690ff..5f3c63d 100644
---- a/include/linux/capability.h
-+++ b/include/linux/capability.h
-@@ -206,6 +206,7 @@ extern bool has_ns_capability_noaudit(struct task_struct *t,
- 				      struct user_namespace *ns, int cap);
- extern bool capable(int cap);
- extern bool ns_capable(struct user_namespace *ns, int cap);
-+extern bool ns_capable_noaudit(struct user_namespace *ns, int cap);
- #else
- static inline bool has_capability(struct task_struct *t, int cap)
- {
-@@ -233,6 +234,10 @@ static inline bool ns_capable(struct user_namespace *ns, int cap)
- {
- 	return true;
- }
-+static inline bool ns_capable_noaudit(struct user_namespace *ns, int cap)
-+{
-+	return true;
-+}
- #endif /* CONFIG_MULTIUSER */
- extern bool capable_wrt_inode_uidgid(const struct inode *inode, int cap);
- extern bool file_ns_capable(const struct file *file, struct user_namespace *ns, int cap);
-diff --git a/kernel/capability.c b/kernel/capability.c
-index 45432b5..00411c8 100644
---- a/kernel/capability.c
-+++ b/kernel/capability.c
-@@ -361,6 +361,24 @@ bool has_capability_noaudit(struct task_struct *t, int cap)
- 	return has_ns_capability_noaudit(t, &init_user_ns, cap);
- }
- 
-+static bool ns_capable_common(struct user_namespace *ns, int cap, bool audit)
-+{
-+	int capable;
-+
-+	if (unlikely(!cap_valid(cap))) {
-+		pr_crit("capable() called with invalid cap=%u\n", cap);
-+		BUG();
-+	}
-+
-+	capable = audit ? security_capable(current_cred(), ns, cap) :
-+			  security_capable_noaudit(current_cred(), ns, cap);
-+	if (capable == 0) {
-+		current->flags |= PF_SUPERPRIV;
-+		return true;
-+	}
-+	return false;
-+}
-+
- /**
-  * ns_capable - Determine if the current task has a superior capability in effect
-  * @ns:  The usernamespace we want the capability in
-@@ -374,19 +392,27 @@ bool has_capability_noaudit(struct task_struct *t, int cap)
-  */
- bool ns_capable(struct user_namespace *ns, int cap)
- {
--	if (unlikely(!cap_valid(cap))) {
--		pr_crit("capable() called with invalid cap=%u\n", cap);
--		BUG();
--	}
--
--	if (security_capable(current_cred(), ns, cap) == 0) {
--		current->flags |= PF_SUPERPRIV;
--		return true;
--	}
--	return false;
-+	return ns_capable_common(ns, cap, true);
- }
- EXPORT_SYMBOL(ns_capable);
- 
-+/**
-+ * ns_capable_noaudit - Determine if the current task has a superior capability
-+ * (unaudited) in effect
-+ * @ns:  The usernamespace we want the capability in
-+ * @cap: The capability to be tested for
-+ *
-+ * Return true if the current task has the given superior capability currently
-+ * available for use, false if not.
-+ *
-+ * This sets PF_SUPERPRIV on the task if the capability is available on the
-+ * assumption that it's about to be used.
-+ */
-+bool ns_capable_noaudit(struct user_namespace *ns, int cap)
-+{
-+	return ns_capable_common(ns, cap, false);
-+}
-+EXPORT_SYMBOL(ns_capable_noaudit);
- 
- /**
-  * capable - Determine if the current task has a superior capability in effect
-diff --git a/kernel/cred.c b/kernel/cred.c
-index 0c0cd8a..5f264fb 100644
---- a/kernel/cred.c
-+++ b/kernel/cred.c
-@@ -689,6 +689,8 @@ EXPORT_SYMBOL(set_security_override_from_ctx);
-  */
- int set_create_files_as(struct cred *new, struct inode *inode)
- {
-+	if (!uid_valid(inode->i_uid) || !gid_valid(inode->i_gid))
-+		return -EINVAL;
- 	new->fsuid = inode->i_uid;
- 	new->fsgid = inode->i_gid;
- 	return security_kernel_create_files_as(new, inode);
-diff --git a/kernel/fork.c b/kernel/fork.c
-index 4a7ec0c..aea4f4d 100644
---- a/kernel/fork.c
-+++ b/kernel/fork.c
-@@ -1406,7 +1406,6 @@ static struct task_struct *copy_process(unsigned long clone_flags,
- 	p->real_start_time = ktime_get_boot_ns();
- 	p->io_context = NULL;
- 	p->audit_context = NULL;
--	threadgroup_change_begin(current);
- 	cgroup_fork(p);
- #ifdef CONFIG_NUMA
- 	p->mempolicy = mpol_dup(p->mempolicy);
-@@ -1558,6 +1557,7 @@ static struct task_struct *copy_process(unsigned long clone_flags,
- 	INIT_LIST_HEAD(&p->thread_group);
- 	p->task_works = NULL;
- 
-+	threadgroup_change_begin(current);
- 	/*
- 	 * Ensure that the cgroup subsystem policies allow the new process to be
- 	 * forked. It should be noted the the new process's css_set can be changed
-@@ -1658,6 +1658,7 @@ static struct task_struct *copy_process(unsigned long clone_flags,
- bad_fork_cancel_cgroup:
- 	cgroup_cancel_fork(p);
- bad_fork_free_pid:
-+	threadgroup_change_end(current);
- 	if (pid != &init_struct_pid)
- 		free_pid(pid);
- bad_fork_cleanup_thread:
-@@ -1690,7 +1691,6 @@ bad_fork_cleanup_policy:
- 	mpol_put(p->mempolicy);
- bad_fork_cleanup_threadgroup_lock:
- #endif
--	threadgroup_change_end(current);
- 	delayacct_tsk_free(p);
- bad_fork_cleanup_count:
- 	atomic_dec(&p->cred->user->processes);
-diff --git a/kernel/time/timekeeping.c b/kernel/time/timekeeping.c
-index 479d25c..b6c3945 100644
---- a/kernel/time/timekeeping.c
-+++ b/kernel/time/timekeeping.c
-@@ -401,7 +401,10 @@ static __always_inline u64 __ktime_get_fast_ns(struct tk_fast *tkf)
- 	do {
- 		seq = raw_read_seqcount_latch(&tkf->seq);
- 		tkr = tkf->base + (seq & 0x01);
--		now = ktime_to_ns(tkr->base) + timekeeping_get_ns(tkr);
-+		now = ktime_to_ns(tkr->base);
-+
-+		now += clocksource_delta(tkr->read(tkr->clock),
-+					 tkr->cycle_last, tkr->mask);
- 	} while (read_seqcount_retry(&tkf->seq, seq));
- 
- 	return now;
-diff --git a/kernel/time/timekeeping_debug.c b/kernel/time/timekeeping_debug.c
-index f6bd652..107310a 100644
---- a/kernel/time/timekeeping_debug.c
-+++ b/kernel/time/timekeeping_debug.c
-@@ -23,7 +23,9 @@
- 
- #include "timekeeping_internal.h"
- 
--static unsigned int sleep_time_bin[32] = {0};
-+#define NUM_BINS 32
-+
-+static unsigned int sleep_time_bin[NUM_BINS] = {0};
- 
- static int tk_debug_show_sleep_time(struct seq_file *s, void *data)
- {
-@@ -69,6 +71,9 @@ late_initcall(tk_debug_sleep_time_init);
- 
- void tk_debug_account_sleep_time(struct timespec64 *t)
- {
--	sleep_time_bin[fls(t->tv_sec)]++;
-+	/* Cap bin index so we don't overflow the array */
-+	int bin = min(fls(t->tv_sec), NUM_BINS-1);
-+
-+	sleep_time_bin[bin]++;
- }
- 
-diff --git a/net/sunrpc/xprtrdma/frwr_ops.c b/net/sunrpc/xprtrdma/frwr_ops.c
-index c094754..f02ab80 100644
---- a/net/sunrpc/xprtrdma/frwr_ops.c
-+++ b/net/sunrpc/xprtrdma/frwr_ops.c
-@@ -125,17 +125,16 @@ __frwr_reset_mr(struct rpcrdma_ia *ia, struct rpcrdma_mw *r)
- }
- 
- static void
--__frwr_reset_and_unmap(struct rpcrdma_xprt *r_xprt, struct rpcrdma_mw *mw)
-+__frwr_reset_and_unmap(struct rpcrdma_mw *mw)
- {
-+	struct rpcrdma_xprt *r_xprt = mw->mw_xprt;
- 	struct rpcrdma_ia *ia = &r_xprt->rx_ia;
--	struct rpcrdma_frmr *f = &mw->frmr;
- 	int rc;
- 
- 	rc = __frwr_reset_mr(ia, mw);
--	ib_dma_unmap_sg(ia->ri_device, f->fr_sg, f->fr_nents, f->fr_dir);
-+	ib_dma_unmap_sg(ia->ri_device, mw->mw_sg, mw->mw_nents, mw->mw_dir);
- 	if (rc)
- 		return;
--
- 	rpcrdma_put_mw(r_xprt, mw);
- }
- 
-@@ -152,8 +151,7 @@ __frwr_recovery_worker(struct work_struct *work)
- 	struct rpcrdma_mw *r = container_of(work, struct rpcrdma_mw,
- 					    mw_work);
- 
--	__frwr_reset_and_unmap(r->mw_xprt, r);
--	return;
-+	__frwr_reset_and_unmap(r);
- }
- 
- /* A broken MR was discovered in a context that can't sleep.
-@@ -167,8 +165,7 @@ __frwr_queue_recovery(struct rpcrdma_mw *r)
- }
- 
- static int
--__frwr_init(struct rpcrdma_mw *r, struct ib_pd *pd, struct ib_device *device,
--	    unsigned int depth)
-+__frwr_init(struct rpcrdma_mw *r, struct ib_pd *pd, unsigned int depth)
- {
- 	struct rpcrdma_frmr *f = &r->frmr;
- 	int rc;
-@@ -177,11 +174,11 @@ __frwr_init(struct rpcrdma_mw *r, struct ib_pd *pd, struct ib_device *device,
- 	if (IS_ERR(f->fr_mr))
- 		goto out_mr_err;
- 
--	f->fr_sg = kcalloc(depth, sizeof(*f->fr_sg), GFP_KERNEL);
--	if (!f->fr_sg)
-+	r->mw_sg = kcalloc(depth, sizeof(*r->mw_sg), GFP_KERNEL);
-+	if (!r->mw_sg)
- 		goto out_list_err;
- 
--	sg_init_table(f->fr_sg, depth);
-+	sg_init_table(r->mw_sg, depth);
- 
- 	init_completion(&f->fr_linv_done);
- 
-@@ -210,7 +207,7 @@ __frwr_release(struct rpcrdma_mw *r)
- 	if (rc)
- 		dprintk("RPC:       %s: ib_dereg_mr status %i\n",
- 			__func__, rc);
--	kfree(r->frmr.fr_sg);
-+	kfree(r->mw_sg);
- }
- 
- static int
-@@ -350,7 +347,6 @@ static int
- frwr_op_init(struct rpcrdma_xprt *r_xprt)
- {
- 	struct rpcrdma_buffer *buf = &r_xprt->rx_buf;
--	struct ib_device *device = r_xprt->rx_ia.ri_device;
- 	unsigned int depth = r_xprt->rx_ia.ri_max_frmr_depth;
- 	struct ib_pd *pd = r_xprt->rx_ia.ri_pd;
- 	int i;
-@@ -372,7 +368,7 @@ frwr_op_init(struct rpcrdma_xprt *r_xprt)
- 		if (!r)
- 			return -ENOMEM;
- 
--		rc = __frwr_init(r, pd, device, depth);
-+		rc = __frwr_init(r, pd, depth);
- 		if (rc) {
- 			kfree(r);
- 			return rc;
-@@ -386,7 +382,7 @@ frwr_op_init(struct rpcrdma_xprt *r_xprt)
- 	return 0;
- }
- 
--/* Post a FAST_REG Work Request to register a memory region
-+/* Post a REG_MR Work Request to register a memory region
-  * for remote access via RDMA READ or RDMA WRITE.
-  */
- static int
-@@ -394,8 +390,6 @@ frwr_op_map(struct rpcrdma_xprt *r_xprt, struct rpcrdma_mr_seg *seg,
- 	    int nsegs, bool writing)
- {
- 	struct rpcrdma_ia *ia = &r_xprt->rx_ia;
--	struct ib_device *device = ia->ri_device;
--	enum dma_data_direction direction = rpcrdma_data_dir(writing);
- 	struct rpcrdma_mr_seg *seg1 = seg;
- 	struct rpcrdma_mw *mw;
- 	struct rpcrdma_frmr *frmr;
-@@ -421,15 +415,14 @@ frwr_op_map(struct rpcrdma_xprt *r_xprt, struct rpcrdma_mr_seg *seg,
- 
- 	if (nsegs > ia->ri_max_frmr_depth)
- 		nsegs = ia->ri_max_frmr_depth;
--
- 	for (i = 0; i < nsegs;) {
- 		if (seg->mr_page)
--			sg_set_page(&frmr->fr_sg[i],
-+			sg_set_page(&mw->mw_sg[i],
- 				    seg->mr_page,
- 				    seg->mr_len,
- 				    offset_in_page(seg->mr_offset));
- 		else
--			sg_set_buf(&frmr->fr_sg[i], seg->mr_offset,
-+			sg_set_buf(&mw->mw_sg[i], seg->mr_offset,
- 				   seg->mr_len);
- 
- 		++seg;
-@@ -440,26 +433,20 @@ frwr_op_map(struct rpcrdma_xprt *r_xprt, struct rpcrdma_mr_seg *seg,
- 		    offset_in_page((seg-1)->mr_offset + (seg-1)->mr_len))
- 			break;
- 	}
--	frmr->fr_nents = i;
--	frmr->fr_dir = direction;
--
--	dma_nents = ib_dma_map_sg(device, frmr->fr_sg, frmr->fr_nents, direction);
--	if (!dma_nents) {
--		pr_err("RPC:       %s: failed to dma map sg %p sg_nents %u\n",
--		       __func__, frmr->fr_sg, frmr->fr_nents);
--		return -ENOMEM;
--	}
-+	mw->mw_nents = i;
-+	mw->mw_dir = rpcrdma_data_dir(writing);
- 
--	n = ib_map_mr_sg(mr, frmr->fr_sg, frmr->fr_nents, NULL, PAGE_SIZE);
--	if (unlikely(n != frmr->fr_nents)) {
--		pr_err("RPC:       %s: failed to map mr %p (%u/%u)\n",
--		       __func__, frmr->fr_mr, n, frmr->fr_nents);
--		rc = n < 0 ? n : -EINVAL;
--		goto out_senderr;
--	}
-+	dma_nents = ib_dma_map_sg(ia->ri_device,
-+				  mw->mw_sg, mw->mw_nents, mw->mw_dir);
-+	if (!dma_nents)
-+		goto out_dmamap_err;
-+
-+	n = ib_map_mr_sg(mr, mw->mw_sg, mw->mw_nents, NULL, PAGE_SIZE);
-+	if (unlikely(n != mw->mw_nents))
-+		goto out_mapmr_err;
- 
- 	dprintk("RPC:       %s: Using frmr %p to map %u segments (%u bytes)\n",
--		__func__, mw, frmr->fr_nents, mr->length);
-+		__func__, mw, mw->mw_nents, mr->length);
- 
- 	key = (u8)(mr->rkey & 0x000000FF);
- 	ib_update_fast_reg_key(mr, ++key);
-@@ -484,13 +471,25 @@ frwr_op_map(struct rpcrdma_xprt *r_xprt, struct rpcrdma_mr_seg *seg,
- 	seg1->rl_mw = mw;
- 	seg1->mr_rkey = mr->rkey;
- 	seg1->mr_base = mr->iova;
--	seg1->mr_nsegs = frmr->fr_nents;
-+	seg1->mr_nsegs = mw->mw_nents;
- 	seg1->mr_len = mr->length;
- 
--	return frmr->fr_nents;
-+	return mw->mw_nents;
-+
-+out_dmamap_err:
-+	pr_err("rpcrdma: failed to dma map sg %p sg_nents %u\n",
-+	       mw->mw_sg, mw->mw_nents);
-+	return -ENOMEM;
-+
-+out_mapmr_err:
-+	pr_err("rpcrdma: failed to map mr %p (%u/%u)\n",
-+	       frmr->fr_mr, n, mw->mw_nents);
-+	rc = n < 0 ? n : -EIO;
-+	__frwr_queue_recovery(mw);
-+	return rc;
- 
- out_senderr:
--	dprintk("RPC:       %s: ib_post_send status %i\n", __func__, rc);
-+	pr_err("rpcrdma: ib_post_send status %i\n", rc);
- 	__frwr_queue_recovery(mw);
- 	return rc;
- }
-@@ -582,8 +581,8 @@ unmap:
- 		mw = seg->rl_mw;
- 		seg->rl_mw = NULL;
- 
--		ib_dma_unmap_sg(ia->ri_device, f->fr_sg, f->fr_nents,
--				f->fr_dir);
-+		ib_dma_unmap_sg(ia->ri_device,
-+				mw->mw_sg, mw->mw_nents, mw->mw_dir);
- 		rpcrdma_put_mw(r_xprt, mw);
- 
- 		i += seg->mr_nsegs;
-@@ -630,7 +629,7 @@ frwr_op_unmap_safe(struct rpcrdma_xprt *r_xprt, struct rpcrdma_req *req,
- 		mw = seg->rl_mw;
- 
- 		if (sync)
--			__frwr_reset_and_unmap(r_xprt, mw);
-+			__frwr_reset_and_unmap(mw);
- 		else
- 			__frwr_queue_recovery(mw);
- 
-diff --git a/net/sunrpc/xprtrdma/xprt_rdma.h b/net/sunrpc/xprtrdma/xprt_rdma.h
-index 95cdc66..c53abd1 100644
---- a/net/sunrpc/xprtrdma/xprt_rdma.h
-+++ b/net/sunrpc/xprtrdma/xprt_rdma.h
-@@ -221,9 +221,6 @@ enum rpcrdma_frmr_state {
- };
- 
- struct rpcrdma_frmr {
--	struct scatterlist		*fr_sg;
--	int				fr_nents;
--	enum dma_data_direction		fr_dir;
- 	struct ib_mr			*fr_mr;
- 	struct ib_cqe			fr_cqe;
- 	enum rpcrdma_frmr_state		fr_state;
-@@ -240,13 +237,16 @@ struct rpcrdma_fmr {
- };
- 
- struct rpcrdma_mw {
-+	struct list_head	mw_list;
-+	struct scatterlist	*mw_sg;
-+	int			mw_nents;
-+	enum dma_data_direction	mw_dir;
- 	union {
- 		struct rpcrdma_fmr	fmr;
- 		struct rpcrdma_frmr	frmr;
- 	};
- 	struct work_struct	mw_work;
- 	struct rpcrdma_xprt	*mw_xprt;
--	struct list_head	mw_list;
- 	struct list_head	mw_all;
- };
- 
-diff --git a/net/sysctl_net.c b/net/sysctl_net.c
-index ed98c1f..46a71c7 100644
---- a/net/sysctl_net.c
-+++ b/net/sysctl_net.c
-@@ -46,7 +46,7 @@ static int net_ctl_permissions(struct ctl_table_header *head,
- 	kgid_t root_gid = make_kgid(net->user_ns, 0);
- 
- 	/* Allow network administrator to have same access as root. */
--	if (ns_capable(net->user_ns, CAP_NET_ADMIN) ||
-+	if (ns_capable_noaudit(net->user_ns, CAP_NET_ADMIN) ||
- 	    uid_eq(root_uid, current_euid())) {
- 		int mode = (table->mode >> 6) & 7;
- 		return (mode << 6) | (mode << 3) | mode;
-diff --git a/security/apparmor/policy.c b/security/apparmor/policy.c
-index 705c287..7347fcc 100644
---- a/security/apparmor/policy.c
-+++ b/security/apparmor/policy.c
-@@ -766,7 +766,9 @@ struct aa_profile *aa_find_child(struct aa_profile *parent, const char *name)
- 	struct aa_profile *profile;
- 
- 	rcu_read_lock();
--	profile = aa_get_profile(__find_child(&parent->base.profiles, name));
-+	do {
-+		profile = __find_child(&parent->base.profiles, name);
-+	} while (profile && !aa_get_profile_not0(profile));
- 	rcu_read_unlock();
- 
- 	/* refcount released by caller */
-diff --git a/sound/core/rawmidi.c b/sound/core/rawmidi.c
-index 795437b..b450a27 100644
---- a/sound/core/rawmidi.c
-+++ b/sound/core/rawmidi.c
-@@ -1633,11 +1633,13 @@ static int snd_rawmidi_dev_register(struct snd_device *device)
- 		return -EBUSY;
- 	}
- 	list_add_tail(&rmidi->list, &snd_rawmidi_devices);
-+	mutex_unlock(&register_mutex);
- 	err = snd_register_device(SNDRV_DEVICE_TYPE_RAWMIDI,
- 				  rmidi->card, rmidi->device,
- 				  &snd_rawmidi_f_ops, rmidi, &rmidi->dev);
- 	if (err < 0) {
- 		rmidi_err(rmidi, "unable to register\n");
-+		mutex_lock(&register_mutex);
- 		list_del(&rmidi->list);
- 		mutex_unlock(&register_mutex);
- 		return err;
-@@ -1645,6 +1647,7 @@ static int snd_rawmidi_dev_register(struct snd_device *device)
- 	if (rmidi->ops && rmidi->ops->dev_register &&
- 	    (err = rmidi->ops->dev_register(rmidi)) < 0) {
- 		snd_unregister_device(&rmidi->dev);
-+		mutex_lock(&register_mutex);
- 		list_del(&rmidi->list);
- 		mutex_unlock(&register_mutex);
- 		return err;
-@@ -1677,7 +1680,6 @@ static int snd_rawmidi_dev_register(struct snd_device *device)
- 		}
- 	}
- #endif /* CONFIG_SND_OSSEMUL */
--	mutex_unlock(&register_mutex);
- 	sprintf(name, "midi%d", rmidi->device);
- 	entry = snd_info_create_card_entry(rmidi->card, name, rmidi->card->proc_root);
- 	if (entry) {
-diff --git a/sound/core/timer.c b/sound/core/timer.c
-index 9a6157e..fc144f4 100644
---- a/sound/core/timer.c
-+++ b/sound/core/timer.c
-@@ -35,6 +35,9 @@
- #include <sound/initval.h>
- #include <linux/kmod.h>
- 
-+/* internal flags */
-+#define SNDRV_TIMER_IFLG_PAUSED		0x00010000
-+
- #if IS_ENABLED(CONFIG_SND_HRTIMER)
- #define DEFAULT_TIMER_LIMIT 4
- #else
-@@ -294,8 +297,21 @@ int snd_timer_open(struct snd_timer_instance **ti,
- 		get_device(&timer->card->card_dev);
- 	timeri->slave_class = tid->dev_sclass;
- 	timeri->slave_id = slave_id;
--	if (list_empty(&timer->open_list_head) && timer->hw.open)
--		timer->hw.open(timer);
-+
-+	if (list_empty(&timer->open_list_head) && timer->hw.open) {
-+		int err = timer->hw.open(timer);
-+		if (err) {
-+			kfree(timeri->owner);
-+			kfree(timeri);
-+
-+			if (timer->card)
-+				put_device(&timer->card->card_dev);
-+			module_put(timer->module);
-+			mutex_unlock(&register_mutex);
-+			return err;
-+		}
-+	}
-+
- 	list_add_tail(&timeri->open_list, &timer->open_list_head);
- 	snd_timer_check_master(timeri);
- 	mutex_unlock(&register_mutex);
-@@ -526,6 +542,10 @@ static int snd_timer_stop1(struct snd_timer_instance *timeri, bool stop)
- 		}
- 	}
- 	timeri->flags &= ~(SNDRV_TIMER_IFLG_RUNNING | SNDRV_TIMER_IFLG_START);
-+	if (stop)
-+		timeri->flags &= ~SNDRV_TIMER_IFLG_PAUSED;
-+	else
-+		timeri->flags |= SNDRV_TIMER_IFLG_PAUSED;
- 	snd_timer_notify1(timeri, stop ? SNDRV_TIMER_EVENT_STOP :
- 			  SNDRV_TIMER_EVENT_CONTINUE);
-  unlock:
-@@ -587,6 +607,10 @@ int snd_timer_stop(struct snd_timer_instance *timeri)
-  */
- int snd_timer_continue(struct snd_timer_instance *timeri)
- {
-+	/* timer can continue only after pause */
-+	if (!(timeri->flags & SNDRV_TIMER_IFLG_PAUSED))
-+		return -EINVAL;
-+
- 	if (timeri->flags & SNDRV_TIMER_IFLG_SLAVE)
- 		return snd_timer_start_slave(timeri, false);
- 	else
-@@ -813,6 +837,7 @@ int snd_timer_new(struct snd_card *card, char *id, struct snd_timer_id *tid,
- 	timer->tmr_subdevice = tid->subdevice;
- 	if (id)
- 		strlcpy(timer->id, id, sizeof(timer->id));
-+	timer->sticks = 1;
- 	INIT_LIST_HEAD(&timer->device_list);
- 	INIT_LIST_HEAD(&timer->open_list_head);
- 	INIT_LIST_HEAD(&timer->active_list_head);
-@@ -1817,6 +1842,9 @@ static int snd_timer_user_continue(struct file *file)
- 	tu = file->private_data;
- 	if (!tu->timeri)
- 		return -EBADFD;
-+	/* start timer instead of continue if it's not used before */
-+	if (!(tu->timeri->flags & SNDRV_TIMER_IFLG_PAUSED))
-+		return snd_timer_user_start(file);
- 	tu->timeri->lost = 0;
- 	return (err = snd_timer_continue(tu->timeri)) < 0 ? err : 0;
- }
-@@ -1958,6 +1986,7 @@ static ssize_t snd_timer_user_read(struct file *file, char __user *buffer,
- 		tu->qused--;
- 		spin_unlock_irq(&tu->qlock);
- 
-+		mutex_lock(&tu->ioctl_lock);
- 		if (tu->tread) {
- 			if (copy_to_user(buffer, &tu->tqueue[qhead],
- 					 sizeof(struct snd_timer_tread)))
-@@ -1967,6 +1996,7 @@ static ssize_t snd_timer_user_read(struct file *file, char __user *buffer,
- 					 sizeof(struct snd_timer_read)))
- 				err = -EFAULT;
- 		}
-+		mutex_unlock(&tu->ioctl_lock);
- 
- 		spin_lock_irq(&tu->qlock);
- 		if (err < 0)
-diff --git a/sound/firewire/fireworks/fireworks.h b/sound/firewire/fireworks/fireworks.h
-index 03ed352..d73c12b 100644
---- a/sound/firewire/fireworks/fireworks.h
-+++ b/sound/firewire/fireworks/fireworks.h
-@@ -108,7 +108,6 @@ struct snd_efw {
- 	u8 *resp_buf;
- 	u8 *pull_ptr;
- 	u8 *push_ptr;
--	unsigned int resp_queues;
- };
- 
- int snd_efw_transaction_cmd(struct fw_unit *unit,
-diff --git a/sound/firewire/fireworks/fireworks_hwdep.c b/sound/firewire/fireworks/fireworks_hwdep.c
-index 33df865..2e1d9a2 100644
---- a/sound/firewire/fireworks/fireworks_hwdep.c
-+++ b/sound/firewire/fireworks/fireworks_hwdep.c
-@@ -25,6 +25,7 @@ hwdep_read_resp_buf(struct snd_efw *efw, char __user *buf, long remained,
- {
- 	unsigned int length, till_end, type;
- 	struct snd_efw_transaction *t;
-+	u8 *pull_ptr;
- 	long count = 0;
- 
- 	if (remained < sizeof(type) + sizeof(struct snd_efw_transaction))
-@@ -38,8 +39,17 @@ hwdep_read_resp_buf(struct snd_efw *efw, char __user *buf, long remained,
- 	buf += sizeof(type);
- 
- 	/* write into buffer as many responses as possible */
--	while (efw->resp_queues > 0) {
--		t = (struct snd_efw_transaction *)(efw->pull_ptr);
-+	spin_lock_irq(&efw->lock);
-+
-+	/*
-+	 * When another task reaches here during this task's access to user
-+	 * space, it picks up current position in buffer and can read the same
-+	 * series of responses.
-+	 */
-+	pull_ptr = efw->pull_ptr;
-+
-+	while (efw->push_ptr != pull_ptr) {
-+		t = (struct snd_efw_transaction *)(pull_ptr);
- 		length = be32_to_cpu(t->length) * sizeof(__be32);
- 
- 		/* confirm enough space for this response */
-@@ -49,26 +59,39 @@ hwdep_read_resp_buf(struct snd_efw *efw, char __user *buf, long remained,
- 		/* copy from ring buffer to user buffer */
- 		while (length > 0) {
- 			till_end = snd_efw_resp_buf_size -
--				(unsigned int)(efw->pull_ptr - efw->resp_buf);
-+				(unsigned int)(pull_ptr - efw->resp_buf);
- 			till_end = min_t(unsigned int, length, till_end);
- 
--			if (copy_to_user(buf, efw->pull_ptr, till_end))
-+			spin_unlock_irq(&efw->lock);
-+
-+			if (copy_to_user(buf, pull_ptr, till_end))
- 				return -EFAULT;
- 
--			efw->pull_ptr += till_end;
--			if (efw->pull_ptr >= efw->resp_buf +
--					     snd_efw_resp_buf_size)
--				efw->pull_ptr -= snd_efw_resp_buf_size;
-+			spin_lock_irq(&efw->lock);
-+
-+			pull_ptr += till_end;
-+			if (pull_ptr >= efw->resp_buf + snd_efw_resp_buf_size)
-+				pull_ptr -= snd_efw_resp_buf_size;
- 
- 			length -= till_end;
- 			buf += till_end;
- 			count += till_end;
- 			remained -= till_end;
- 		}
--
--		efw->resp_queues--;
- 	}
- 
-+	/*
-+	 * All of tasks can read from the buffer nearly simultaneously, but the
-+	 * last position for each task is different depending on the length of
-+	 * given buffer. Here, for simplicity, a position of buffer is set by
-+	 * the latest task. It's better for a listening application to allow one
-+	 * thread to read from the buffer. Unless, each task can read different
-+	 * sequence of responses depending on variation of buffer length.
-+	 */
-+	efw->pull_ptr = pull_ptr;
-+
-+	spin_unlock_irq(&efw->lock);
-+
- 	return count;
- }
- 
-@@ -76,14 +99,17 @@ static long
- hwdep_read_locked(struct snd_efw *efw, char __user *buf, long count,
- 		  loff_t *offset)
- {
--	union snd_firewire_event event;
-+	union snd_firewire_event event = {
-+		.lock_status.type = SNDRV_FIREWIRE_EVENT_LOCK_STATUS,
-+	};
- 
--	memset(&event, 0, sizeof(event));
-+	spin_lock_irq(&efw->lock);
- 
--	event.lock_status.type = SNDRV_FIREWIRE_EVENT_LOCK_STATUS;
- 	event.lock_status.status = (efw->dev_lock_count > 0);
- 	efw->dev_lock_changed = false;
- 
-+	spin_unlock_irq(&efw->lock);
-+
- 	count = min_t(long, count, sizeof(event.lock_status));
- 
- 	if (copy_to_user(buf, &event, count))
-@@ -98,10 +124,15 @@ hwdep_read(struct snd_hwdep *hwdep, char __user *buf, long count,
- {
- 	struct snd_efw *efw = hwdep->private_data;
- 	DEFINE_WAIT(wait);
-+	bool dev_lock_changed;
-+	bool queued;
- 
- 	spin_lock_irq(&efw->lock);
- 
--	while ((!efw->dev_lock_changed) && (efw->resp_queues == 0)) {
-+	dev_lock_changed = efw->dev_lock_changed;
-+	queued = efw->push_ptr != efw->pull_ptr;
-+
-+	while (!dev_lock_changed && !queued) {
- 		prepare_to_wait(&efw->hwdep_wait, &wait, TASK_INTERRUPTIBLE);
- 		spin_unlock_irq(&efw->lock);
- 		schedule();
-@@ -109,15 +140,17 @@ hwdep_read(struct snd_hwdep *hwdep, char __user *buf, long count,
- 		if (signal_pending(current))
- 			return -ERESTARTSYS;
- 		spin_lock_irq(&efw->lock);
-+		dev_lock_changed = efw->dev_lock_changed;
-+		queued = efw->push_ptr != efw->pull_ptr;
- 	}
- 
--	if (efw->dev_lock_changed)
-+	spin_unlock_irq(&efw->lock);
-+
-+	if (dev_lock_changed)
- 		count = hwdep_read_locked(efw, buf, count, offset);
--	else if (efw->resp_queues > 0)
-+	else if (queued)
- 		count = hwdep_read_resp_buf(efw, buf, count, offset);
- 
--	spin_unlock_irq(&efw->lock);
--
- 	return count;
- }
- 
-@@ -160,7 +193,7 @@ hwdep_poll(struct snd_hwdep *hwdep, struct file *file, poll_table *wait)
- 	poll_wait(file, &efw->hwdep_wait, wait);
- 
- 	spin_lock_irq(&efw->lock);
--	if (efw->dev_lock_changed || (efw->resp_queues > 0))
-+	if (efw->dev_lock_changed || efw->pull_ptr != efw->push_ptr)
- 		events = POLLIN | POLLRDNORM;
- 	else
- 		events = 0;
-diff --git a/sound/firewire/fireworks/fireworks_proc.c b/sound/firewire/fireworks/fireworks_proc.c
-index 0639dcb..beb0a0f 100644
---- a/sound/firewire/fireworks/fireworks_proc.c
-+++ b/sound/firewire/fireworks/fireworks_proc.c
-@@ -188,8 +188,8 @@ proc_read_queues_state(struct snd_info_entry *entry,
- 	else
- 		consumed = (unsigned int)(efw->push_ptr - efw->pull_ptr);
- 
--	snd_iprintf(buffer, "%d %d/%d\n",
--		    efw->resp_queues, consumed, snd_efw_resp_buf_size);
-+	snd_iprintf(buffer, "%d/%d\n",
-+		    consumed, snd_efw_resp_buf_size);
- }
- 
- static void
-diff --git a/sound/firewire/fireworks/fireworks_transaction.c b/sound/firewire/fireworks/fireworks_transaction.c
-index f550808..36a08ba 100644
---- a/sound/firewire/fireworks/fireworks_transaction.c
-+++ b/sound/firewire/fireworks/fireworks_transaction.c
-@@ -121,11 +121,11 @@ copy_resp_to_buf(struct snd_efw *efw, void *data, size_t length, int *rcode)
- 	size_t capacity, till_end;
- 	struct snd_efw_transaction *t;
- 
--	spin_lock_irq(&efw->lock);
--
- 	t = (struct snd_efw_transaction *)data;
- 	length = min_t(size_t, be32_to_cpu(t->length) * sizeof(u32), length);
- 
-+	spin_lock_irq(&efw->lock);
-+
- 	if (efw->push_ptr < efw->pull_ptr)
- 		capacity = (unsigned int)(efw->pull_ptr - efw->push_ptr);
- 	else
-@@ -155,7 +155,6 @@ copy_resp_to_buf(struct snd_efw *efw, void *data, size_t length, int *rcode)
- 	}
- 
- 	/* for hwdep */
--	efw->resp_queues++;
- 	wake_up(&efw->hwdep_wait);
- 
- 	*rcode = RCODE_COMPLETE;
-diff --git a/sound/firewire/tascam/tascam-hwdep.c b/sound/firewire/tascam/tascam-hwdep.c
-index 131267c..106406c 100644
---- a/sound/firewire/tascam/tascam-hwdep.c
-+++ b/sound/firewire/tascam/tascam-hwdep.c
-@@ -16,31 +16,14 @@
- 
- #include "tascam.h"
- 
--static long hwdep_read_locked(struct snd_tscm *tscm, char __user *buf,
--			      long count)
--{
--	union snd_firewire_event event;
--
--	memset(&event, 0, sizeof(event));
--
--	event.lock_status.type = SNDRV_FIREWIRE_EVENT_LOCK_STATUS;
--	event.lock_status.status = (tscm->dev_lock_count > 0);
--	tscm->dev_lock_changed = false;
--
--	count = min_t(long, count, sizeof(event.lock_status));
--
--	if (copy_to_user(buf, &event, count))
--		return -EFAULT;
--
--	return count;
--}
--
- static long hwdep_read(struct snd_hwdep *hwdep, char __user *buf, long count,
- 		       loff_t *offset)
- {
- 	struct snd_tscm *tscm = hwdep->private_data;
- 	DEFINE_WAIT(wait);
--	union snd_firewire_event event;
-+	union snd_firewire_event event = {
-+		.lock_status.type = SNDRV_FIREWIRE_EVENT_LOCK_STATUS,
-+	};
- 
- 	spin_lock_irq(&tscm->lock);
- 
-@@ -54,10 +37,16 @@ static long hwdep_read(struct snd_hwdep *hwdep, char __user *buf, long count,
- 		spin_lock_irq(&tscm->lock);
- 	}
- 
--	memset(&event, 0, sizeof(event));
--	count = hwdep_read_locked(tscm, buf, count);
-+	event.lock_status.status = (tscm->dev_lock_count > 0);
-+	tscm->dev_lock_changed = false;
-+
- 	spin_unlock_irq(&tscm->lock);
- 
-+	count = min_t(long, count, sizeof(event.lock_status));
-+
-+	if (copy_to_user(buf, &event, count))
-+		return -EFAULT;
-+
- 	return count;
- }
- 
-diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
-index f25479b..eaee626 100644
---- a/sound/pci/hda/patch_realtek.c
-+++ b/sound/pci/hda/patch_realtek.c
-@@ -4840,6 +4840,7 @@ enum {
- 	ALC221_FIXUP_HP_FRONT_MIC,
- 	ALC292_FIXUP_TPT460,
- 	ALC298_FIXUP_SPK_VOLUME,
-+	ALC256_FIXUP_DELL_INSPIRON_7559_SUBWOOFER,
- };
- 
- static const struct hda_fixup alc269_fixups[] = {
-@@ -5501,6 +5502,15 @@ static const struct hda_fixup alc269_fixups[] = {
- 		.chained = true,
- 		.chain_id = ALC298_FIXUP_DELL1_MIC_NO_PRESENCE,
- 	},
-+	[ALC256_FIXUP_DELL_INSPIRON_7559_SUBWOOFER] = {
-+		.type = HDA_FIXUP_PINS,
-+		.v.pins = (const struct hda_pintbl[]) {
-+			{ 0x1b, 0x90170151 },
-+			{ }
-+		},
-+		.chained = true,
-+		.chain_id = ALC255_FIXUP_DELL1_MIC_NO_PRESENCE
-+	},
- };
- 
- static const struct snd_pci_quirk alc269_fixup_tbl[] = {
-@@ -5545,6 +5555,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
- 	SND_PCI_QUIRK(0x1028, 0x06df, "Dell", ALC293_FIXUP_DISABLE_AAMIX_MULTIJACK),
- 	SND_PCI_QUIRK(0x1028, 0x06e0, "Dell", ALC293_FIXUP_DISABLE_AAMIX_MULTIJACK),
- 	SND_PCI_QUIRK(0x1028, 0x0704, "Dell XPS 13 9350", ALC256_FIXUP_DELL_XPS_13_HEADPHONE_NOISE),
-+	SND_PCI_QUIRK(0x1028, 0x0706, "Dell Inspiron 7559", ALC256_FIXUP_DELL_INSPIRON_7559_SUBWOOFER),
- 	SND_PCI_QUIRK(0x1028, 0x0725, "Dell Inspiron 3162", ALC255_FIXUP_DELL_SPK_NOISE),
- 	SND_PCI_QUIRK(0x1028, 0x075b, "Dell XPS 13 9360", ALC256_FIXUP_DELL_XPS_13_HEADPHONE_NOISE),
- 	SND_PCI_QUIRK(0x1028, 0x075d, "Dell AIO", ALC298_FIXUP_SPK_VOLUME),
-@@ -5879,6 +5890,10 @@ static const struct snd_hda_pin_quirk alc269_pin_fixup_tbl[] = {
- 		{0x12, 0x90a60170},
- 		{0x14, 0x90170120},
- 		{0x21, 0x02211030}),
-+	SND_HDA_PIN_QUIRK(0x10ec0256, 0x1028, "Dell Inspiron 5468", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE,
-+		{0x12, 0x90a60180},
-+		{0x14, 0x90170120},
-+		{0x21, 0x02211030}),
- 	SND_HDA_PIN_QUIRK(0x10ec0256, 0x1028, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE,
- 		ALC256_STANDARD_PINS),
- 	SND_HDA_PIN_QUIRK(0x10ec0280, 0x103c, "HP", ALC280_FIXUP_HP_GPIO4,
-diff --git a/sound/soc/atmel/atmel_ssc_dai.c b/sound/soc/atmel/atmel_ssc_dai.c
-index 1267e1a..633d54ca 100644
---- a/sound/soc/atmel/atmel_ssc_dai.c
-+++ b/sound/soc/atmel/atmel_ssc_dai.c
-@@ -299,8 +299,9 @@ static int atmel_ssc_startup(struct snd_pcm_substream *substream,
- 	clk_enable(ssc_p->ssc->clk);
- 	ssc_p->mck_rate = clk_get_rate(ssc_p->ssc->clk);
- 
--	/* Reset the SSC to keep it at a clean status */
--	ssc_writel(ssc_p->ssc->regs, CR, SSC_BIT(CR_SWRST));
-+	/* Reset the SSC unless initialized to keep it in a clean state */
-+	if (!ssc_p->initialized)
-+		ssc_writel(ssc_p->ssc->regs, CR, SSC_BIT(CR_SWRST));
- 
- 	if (substream->stream == SNDRV_PCM_STREAM_PLAYBACK) {
- 		dir = 0;
-diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c
-index 6cf1f35..152292e 100644
---- a/sound/usb/quirks.c
-+++ b/sound/usb/quirks.c
-@@ -1141,6 +1141,7 @@ bool snd_usb_get_sample_rate_quirk(struct snd_usb_audio *chip)
- 	case USB_ID(0x0556, 0x0014): /* Phoenix Audio TMX320VC */
- 	case USB_ID(0x05A3, 0x9420): /* ELP HD USB Camera */
- 	case USB_ID(0x074D, 0x3553): /* Outlaw RR2150 (Micronas UAC3553B) */
-+	case USB_ID(0x1901, 0x0191): /* GE B850V3 CP2114 audio interface */
- 	case USB_ID(0x1de7, 0x0013): /* Phoenix Audio MT202exe */
- 	case USB_ID(0x1de7, 0x0014): /* Phoenix Audio TMX320 */
- 	case USB_ID(0x1de7, 0x0114): /* Phoenix Audio MT202pcs */

diff --git a/4.7.4/0000_README b/4.7.5/0000_README
similarity index 81%
rename from 4.7.4/0000_README
rename to 4.7.5/0000_README
index a9515bb..9104194 100644
--- a/4.7.4/0000_README
+++ b/4.7.5/0000_README
@@ -2,23 +2,7 @@ README
 -----------------------------------------------------------------------------
 Individual Patch Descriptions:
 -----------------------------------------------------------------------------
-Patch:	1000_linux-4.7.1.patch
-From:	http://www.kernel.org
-Desc:	Linux 4.7.1
-
-Patch:	1001_linux-4.7.2.patch
-From:	http://www.kernel.org
-Desc:	Linux 4.7.2
-
-Patch:	1002_linux-4.7.3.patch
-From:	http://www.kernel.org
-Desc:	Linux 4.7.3
-
-Patch:	1003_linux-4.7.4.patch
-From:	http://www.kernel.org
-Desc:	Linux 4.7.4
-
-Patch:	4420_grsecurity-3.1-4.7.4-201609211951.patch
+Patch:	4420_grsecurity-3.1-4.7.5-201609261522.patch
 From:	http://www.grsecurity.net
 Desc:	hardened-sources base patch from upstream grsecurity
 

diff --git a/4.7.4/4420_grsecurity-3.1-4.7.4-201609211951.patch b/4.7.5/4420_grsecurity-3.1-4.7.5-201609261522.patch
similarity index 99%
rename from 4.7.4/4420_grsecurity-3.1-4.7.4-201609211951.patch
rename to 4.7.5/4420_grsecurity-3.1-4.7.5-201609261522.patch
index 5bddf8c..9169f89 100644
--- a/4.7.4/4420_grsecurity-3.1-4.7.4-201609211951.patch
+++ b/4.7.5/4420_grsecurity-3.1-4.7.5-201609261522.patch
@@ -420,7 +420,7 @@ index a3683ce..5ec8bf4 100644
  
  A toggle value indicating if modules are allowed to be loaded
 diff --git a/Makefile b/Makefile
-index ec3bd11..35d4d88 100644
+index dd755d19..b480d63 100644
 --- a/Makefile
 +++ b/Makefile
 @@ -302,7 +302,9 @@ CONFIG_SHELL := $(shell if [ -x "$$BASH" ]; then echo $$BASH; \
@@ -3219,7 +3219,7 @@ index e2c6da0..6155a88 100644
  	. = ALIGN(1<<SECTION_SHIFT);
  #else
 diff --git a/arch/arm/kvm/arm.c b/arch/arm/kvm/arm.c
-index f1bde7c..6dc92ba 100644
+index 4e1b22a..10ef049 100644
 --- a/arch/arm/kvm/arm.c
 +++ b/arch/arm/kvm/arm.c
 @@ -58,7 +58,7 @@ static unsigned long hyp_default_vectors;
@@ -3231,7 +3231,7 @@ index f1bde7c..6dc92ba 100644
  static u32 kvm_next_vmid;
  static unsigned int kvm_vmid_bits __read_mostly;
  static DEFINE_SPINLOCK(kvm_vmid_lock);
-@@ -389,7 +389,7 @@ void force_vm_exit(const cpumask_t *mask)
+@@ -387,7 +387,7 @@ void force_vm_exit(const cpumask_t *mask)
   */
  static bool need_new_vmid_gen(struct kvm *kvm)
  {
@@ -3240,7 +3240,7 @@ index f1bde7c..6dc92ba 100644
  }
  
  /**
-@@ -422,7 +422,7 @@ static void update_vttbr(struct kvm *kvm)
+@@ -420,7 +420,7 @@ static void update_vttbr(struct kvm *kvm)
  
  	/* First user of a new VMID generation? */
  	if (unlikely(kvm_next_vmid == 0)) {
@@ -3249,7 +3249,7 @@ index f1bde7c..6dc92ba 100644
  		kvm_next_vmid = 1;
  
  		/*
-@@ -439,7 +439,7 @@ static void update_vttbr(struct kvm *kvm)
+@@ -437,7 +437,7 @@ static void update_vttbr(struct kvm *kvm)
  		kvm_call_hyp(__kvm_flush_vm_context);
  	}
  
@@ -5435,7 +5435,7 @@ index 45698cd..e8e2dbc 100644
  
  static __always_inline void __ticket_spin_unlock_wait(arch_spinlock_t *lock)
 diff --git a/arch/ia64/include/asm/uaccess.h b/arch/ia64/include/asm/uaccess.h
-index 2189d5d..420134b 100644
+index ebcd8a1..dfa2f7a 100644
 --- a/arch/ia64/include/asm/uaccess.h
 +++ b/arch/ia64/include/asm/uaccess.h
 @@ -70,6 +70,7 @@
@@ -5471,7 +5471,7 @@ index 2189d5d..420134b 100644
  	return __copy_user((__force void __user *) to, from, count);
  }
  
-@@ -256,10 +269,13 @@ __copy_from_user (void *to, const void __user *from, unsigned long count)
+@@ -256,19 +269,22 @@ __copy_from_user (void *to, const void __user *from, unsigned long count)
  ({											\
  	void __user *__cu_to = (to);							\
  	const void *__cu_from = (from);							\
@@ -5480,30 +5480,42 @@ index 2189d5d..420134b 100644
  											\
 -	if (__access_ok(__cu_to, __cu_len, get_fs()))					\
 +	if (__cu_len <= INT_MAX && __access_ok(__cu_to, __cu_len, get_fs())) {		\
-+		if (!__builtin_constant_p(n))						\
-+			check_object_size(__cu_from, __cu_len, true);			\
++		check_object_size(__cu_from, __cu_len, true);				\
  		__cu_len = __copy_user(__cu_to, (__force void __user *) __cu_from, __cu_len);	\
 +	}										\
  	__cu_len;									\
  })
  
-@@ -267,11 +283,14 @@ __copy_from_user (void *to, const void __user *from, unsigned long count)
- ({											\
- 	void *__cu_to = (to);								\
- 	const void __user *__cu_from = (from);						\
--	long __cu_len = (n);								\
-+	unsigned long __cu_len = (n);							\
- 											\
- 	__chk_user_ptr(__cu_from);							\
--	if (__access_ok(__cu_from, __cu_len, get_fs()))					\
-+	if (__cu_len <= INT_MAX  && __access_ok(__cu_from, __cu_len, get_fs())) {	\
-+		if (!__builtin_constant_p(n))						\
-+			check_object_size(__cu_to, __cu_len, false);			\
- 		__cu_len = __copy_user((__force void __user *) __cu_to, __cu_from, __cu_len);	\
-+	}										\
- 	__cu_len;									\
+ static inline unsigned long
+ copy_from_user(void *to, const void __user *from, unsigned long n)
+ {
+-	if (likely(__access_ok(from, n, get_fs())))
+-		n = __copy_user((__force void __user *) to, from, n);
+-	else
++	if (likely(__access_ok(from, n, get_fs()))) {
++		check_object_size(to, n, false);
++		n = __copy_user((void __force_user *) to, from, n);
++	} else if ((long)n > 0)
+ 		memset(to, 0, n);
+ 	return n;
+ }
+@@ -339,11 +355,13 @@ extern unsigned long __strnlen_user (const char __user *, long);
+ 	__su_ret;						\
  })
  
+-#define ARCH_HAS_RELATIVE_EXTABLE
++/* Generic code can't deal with the location-relative format that we use for compactness.  */
++#define ARCH_HAS_SORT_EXTABLE
++#define ARCH_HAS_SEARCH_EXTABLE
+ 
+ struct exception_table_entry {
+-	int insn;	/* location-relative address of insn this fixup is for */
+-	int fixup;	/* location-relative continuation addr.; if bit 2 is set, r9 is set to 0 */
++	int addr;	/* location-relative address of insn this fixup is for */
++	int cont;	/* location-relative continuation addr.; if bit 2 is set, r9 is set to 0 */
+ };
+ 
+ extern void ia64_handle_exception (struct pt_regs *regs, const struct exception_table_entry *e);
 diff --git a/arch/ia64/kernel/module.c b/arch/ia64/kernel/module.c
 index 6ab0ae7..88f1b60 100644
 --- a/arch/ia64/kernel/module.c
@@ -6711,10 +6723,10 @@ index e309d8f..20eefec 100644
  /*
   * We stash processor id into a COP0 register to retrieve it fast
 diff --git a/arch/mips/include/asm/uaccess.h b/arch/mips/include/asm/uaccess.h
-index 7f109d4..40b1195 100644
+index b6e20f3..afabc54 100644
 --- a/arch/mips/include/asm/uaccess.h
 +++ b/arch/mips/include/asm/uaccess.h
-@@ -146,6 +146,7 @@ static inline bool eva_kernel_access(void)
+@@ -147,6 +147,7 @@ static inline bool eva_kernel_access(void)
  	__ok == 0;							\
  })
  
@@ -7469,22 +7481,217 @@ index 291cee2..2ac33db 100644
  #define PAGE_KERNEL_EXEC	__pgprot(_PAGE_KERNEL_EXEC)
  #define PAGE_KERNEL_RWX	__pgprot(_PAGE_KERNEL_RWX)
 diff --git a/arch/parisc/include/asm/uaccess.h b/arch/parisc/include/asm/uaccess.h
-index 0f59fd9..c502784 100644
+index 37a1bee..a3916f9 100644
 --- a/arch/parisc/include/asm/uaccess.h
 +++ b/arch/parisc/include/asm/uaccess.h
-@@ -220,10 +220,10 @@ static inline unsigned long __must_check copy_from_user(void *to,
+@@ -41,29 +41,34 @@ static inline long access_ok(int type, const void __user * addr,
+ #define get_user __get_user
+ 
+ #if !defined(CONFIG_64BIT)
+-#define LDD_USER(ptr)		__get_user_asm64(ptr)
++#define LDD_KERNEL(ptr)		BUILD_BUG()
++#define LDD_USER(ptr)		BUILD_BUG()
++#define STD_KERNEL(x, ptr)	__put_kernel_asm64(x, ptr)
+ #define STD_USER(x, ptr)	__put_user_asm64(x, ptr)
++#define ASM_WORD_INSN		".word\t"
+ #else
++#define LDD_KERNEL(ptr)		__get_kernel_asm("ldd", ptr)
+ #define LDD_USER(ptr)		__get_user_asm("ldd", ptr)
++#define STD_KERNEL(x, ptr)	__put_kernel_asm("std", x, ptr)
+ #define STD_USER(x, ptr)	__put_user_asm("std", x, ptr)
++#define ASM_WORD_INSN		".dword\t"
+ #endif
+ 
+ /*
+- * The exception table contains two values: the first is the relative offset to
+- * the address of the instruction that is allowed to fault, and the second is
+- * the relative offset to the address of the fixup routine. Since relative
+- * addresses are used, 32bit values are sufficient even on 64bit kernel.
++ * The exception table contains two values: the first is an address
++ * for an instruction that is allowed to fault, and the second is
++ * the address to the fixup routine. Even on a 64bit kernel we could
++ * use a 32bit (unsigned int) address here.
+  */
+ 
+-#define ARCH_HAS_RELATIVE_EXTABLE
+ struct exception_table_entry {
+-	int insn;	/* relative address of insn that is allowed to fault. */
+-	int fixup;	/* relative address of fixup routine */
++	unsigned long insn;	/* address of insn that is allowed to fault. */
++	unsigned long fixup;	/* fixup routine */
+ };
+ 
+ #define ASM_EXCEPTIONTABLE_ENTRY( fault_addr, except_addr )\
+ 	".section __ex_table,\"aw\"\n"			   \
+-	".word (" #fault_addr " - .), (" #except_addr " - .)\n\t" \
++	ASM_WORD_INSN #fault_addr ", " #except_addr "\n\t" \
+ 	".previous\n"
+ 
+ /*
+@@ -77,70 +82,70 @@ struct exception_data {
+ 	unsigned long fault_addr;
+ };
+ 
+-/*
+- * load_sr2() preloads the space register %%sr2 - based on the value of
+- * get_fs() - with either a value of 0 to access kernel space (KERNEL_DS which
+- * is 0), or with the current value of %%sr3 to access user space (USER_DS)
+- * memory. The following __get_user_asm() and __put_user_asm() functions have
+- * %%sr2 hard-coded to access the requested memory.
+- */
+-#define load_sr2() \
+-	__asm__(" or,=  %0,%%r0,%%r0\n\t"	\
+-		" mfsp %%sr3,%0\n\t"		\
+-		" mtsp %0,%%sr2\n\t"		\
+-		: : "r"(get_fs()) : )
+-
+ #define __get_user(x, ptr)                               \
+ ({                                                       \
+ 	register long __gu_err __asm__ ("r8") = 0;       \
+ 	register long __gu_val __asm__ ("r9") = 0;       \
+ 							 \
+-	load_sr2();					 \
+-	switch (sizeof(*(ptr))) {			 \
++	if (segment_eq(get_fs(), KERNEL_DS)) {           \
++	    switch (sizeof(*(ptr))) {                    \
++	    case 1: __get_kernel_asm("ldb", ptr); break; \
++	    case 2: __get_kernel_asm("ldh", ptr); break; \
++	    case 4: __get_kernel_asm("ldw", ptr); break; \
++	    case 8: LDD_KERNEL(ptr); break;		 \
++	    default: BUILD_BUG(); break;		 \
++	    }                                            \
++	}                                                \
++	else {                                           \
++	    switch (sizeof(*(ptr))) {                    \
+ 	    case 1: __get_user_asm("ldb", ptr); break;   \
+ 	    case 2: __get_user_asm("ldh", ptr); break;   \
+ 	    case 4: __get_user_asm("ldw", ptr); break;   \
+ 	    case 8: LDD_USER(ptr);  break;		 \
+ 	    default: BUILD_BUG(); break;		 \
++	    }                                            \
+ 	}                                                \
+ 							 \
+ 	(x) = (__force __typeof__(*(ptr))) __gu_val;	 \
+ 	__gu_err;                                        \
+ })
+ 
++#define __get_kernel_asm(ldx, ptr)                      \
++	__asm__("\n1:\t" ldx "\t0(%2),%0\n\t"		\
++		ASM_EXCEPTIONTABLE_ENTRY(1b, fixup_get_user_skip_1)\
++		: "=r"(__gu_val), "=r"(__gu_err)        \
++		: "r"(ptr), "1"(__gu_err)		\
++		: "r1");
++
+ #define __get_user_asm(ldx, ptr)                        \
+-	__asm__("\n1:\t" ldx "\t0(%%sr2,%2),%0\n\t"	\
++	__asm__("\n1:\t" ldx "\t0(%%sr3,%2),%0\n\t"	\
+ 		ASM_EXCEPTIONTABLE_ENTRY(1b, fixup_get_user_skip_1)\
+ 		: "=r"(__gu_val), "=r"(__gu_err)        \
+ 		: "r"(ptr), "1"(__gu_err)		\
+ 		: "r1");
+ 
+-#if !defined(CONFIG_64BIT)
+-
+-#define __get_user_asm64(ptr) 				\
+-	__asm__("\n1:\tldw 0(%%sr2,%2),%0"		\
+-		"\n2:\tldw 4(%%sr2,%2),%R0\n\t"		\
+-		ASM_EXCEPTIONTABLE_ENTRY(1b, fixup_get_user_skip_2)\
+-		ASM_EXCEPTIONTABLE_ENTRY(2b, fixup_get_user_skip_1)\
+-		: "=r"(__gu_val), "=r"(__gu_err)	\
+-		: "r"(ptr), "1"(__gu_err)		\
+-		: "r1");
+-
+-#endif /* !defined(CONFIG_64BIT) */
+-
+-
+ #define __put_user(x, ptr)                                      \
+ ({								\
+ 	register long __pu_err __asm__ ("r8") = 0;      	\
+         __typeof__(*(ptr)) __x = (__typeof__(*(ptr)))(x);	\
+ 								\
+-	load_sr2();						\
+-	switch (sizeof(*(ptr))) {				\
++	if (segment_eq(get_fs(), KERNEL_DS)) {                  \
++	    switch (sizeof(*(ptr))) {                           \
++	    case 1: __put_kernel_asm("stb", __x, ptr); break;   \
++	    case 2: __put_kernel_asm("sth", __x, ptr); break;   \
++	    case 4: __put_kernel_asm("stw", __x, ptr); break;   \
++	    case 8: STD_KERNEL(__x, ptr); break;		\
++	    default: BUILD_BUG(); break;			\
++	    }                                                   \
++	}                                                       \
++	else {                                                  \
++	    switch (sizeof(*(ptr))) {                           \
+ 	    case 1: __put_user_asm("stb", __x, ptr); break;     \
+ 	    case 2: __put_user_asm("sth", __x, ptr); break;     \
+ 	    case 4: __put_user_asm("stw", __x, ptr); break;     \
+ 	    case 8: STD_USER(__x, ptr); break;			\
+ 	    default: BUILD_BUG(); break;			\
++	    }                                                   \
+ 	}                                                       \
+ 								\
+ 	__pu_err;						\
+@@ -156,9 +161,17 @@ struct exception_data {
+  * r8/r9 are already listed as err/val.
+  */
+ 
++#define __put_kernel_asm(stx, x, ptr)                       \
++	__asm__ __volatile__ (                              \
++		"\n1:\t" stx "\t%2,0(%1)\n\t"		    \
++		ASM_EXCEPTIONTABLE_ENTRY(1b, fixup_put_user_skip_1)\
++		: "=r"(__pu_err)                            \
++		: "r"(ptr), "r"(x), "0"(__pu_err)	    \
++	    	: "r1")
++
+ #define __put_user_asm(stx, x, ptr)                         \
+ 	__asm__ __volatile__ (                              \
+-		"\n1:\t" stx "\t%2,0(%%sr2,%1)\n\t"	    \
++		"\n1:\t" stx "\t%2,0(%%sr3,%1)\n\t"	    \
+ 		ASM_EXCEPTIONTABLE_ENTRY(1b, fixup_put_user_skip_1)\
+ 		: "=r"(__pu_err)                            \
+ 		: "r"(ptr), "r"(x), "0"(__pu_err)	    \
+@@ -167,10 +180,21 @@ struct exception_data {
+ 
+ #if !defined(CONFIG_64BIT)
+ 
++#define __put_kernel_asm64(__val, ptr) do {		    \
++	__asm__ __volatile__ (				    \
++		"\n1:\tstw %2,0(%1)"			    \
++		"\n2:\tstw %R2,4(%1)\n\t"		    \
++		ASM_EXCEPTIONTABLE_ENTRY(1b, fixup_put_user_skip_2)\
++		ASM_EXCEPTIONTABLE_ENTRY(2b, fixup_put_user_skip_1)\
++		: "=r"(__pu_err)                            \
++		: "r"(ptr), "r"(__val), "0"(__pu_err) \
++		: "r1");				    \
++} while (0)
++
+ #define __put_user_asm64(__val, ptr) do {	    	    \
+ 	__asm__ __volatile__ (				    \
+-		"\n1:\tstw %2,0(%%sr2,%1)"		    \
+-		"\n2:\tstw %R2,4(%%sr2,%1)\n\t"		    \
++		"\n1:\tstw %2,0(%%sr3,%1)"		    \
++		"\n2:\tstw %R2,4(%%sr3,%1)\n\t"		    \
+ 		ASM_EXCEPTIONTABLE_ENTRY(1b, fixup_put_user_skip_2)\
+ 		ASM_EXCEPTIONTABLE_ENTRY(2b, fixup_put_user_skip_1)\
+ 		: "=r"(__pu_err)                            \
+@@ -221,14 +245,14 @@ static inline unsigned long __must_check copy_from_user(void *to,
                                            const void __user *from,
                                            unsigned long n)
  {
 -        int sz = __compiletime_object_size(to);
 +        size_t sz = __compiletime_object_size(to);
-         int ret = -EFAULT;
+         unsigned long ret = n;
  
 -        if (likely(sz == -1 || !__builtin_constant_p(n) || sz >= n))
 +        if (likely(sz == (size_t)-1 || !__builtin_constant_p(n) || sz >= n))
                  ret = __copy_from_user(to, from, n);
          else
                  copy_from_user_overflow();
+-	if (unlikely(ret))
++	if (unlikely(ret && (long)ret > 0))
+ 		memset(to + (n - ret), 0, ret);
+         return ret;
+ }
 diff --git a/arch/parisc/kernel/module.c b/arch/parisc/kernel/module.c
 index a0ecdb4a..71d2069 100644
 --- a/arch/parisc/kernel/module.c
@@ -8884,7 +9091,7 @@ index 8febc3f..a4614f3 100644
  #define _TIF_USER_WORK_MASK	(_TIF_SIGPENDING | _TIF_NEED_RESCHED | \
  				 _TIF_NOTIFY_RESUME | _TIF_UPROBE | \
 diff --git a/arch/powerpc/include/asm/uaccess.h b/arch/powerpc/include/asm/uaccess.h
-index b7c20f0..4adc0f1 100644
+index 43888c8..e231600 100644
 --- a/arch/powerpc/include/asm/uaccess.h
 +++ b/arch/powerpc/include/asm/uaccess.h
 @@ -58,6 +58,7 @@
@@ -8895,7 +9102,29 @@ index b7c20f0..4adc0f1 100644
  #define access_ok(type, addr, size)		\
  	(__chk_user_ptr(addr),			\
  	 __access_ok((__force unsigned long)(addr), (size), get_fs()))
-@@ -303,52 +304,6 @@ do {								\
+@@ -274,6 +275,21 @@ do {								\
+ 	__gu_err;						\
+ })
+ 
++#ifndef __powerpc64__
++#define __get_user64_nocheck(x, ptr, size)			\
++({								\
++	long __gu_err;						\
++	long long __gu_val;					\
++	__typeof__(*(ptr)) __user *__gu_addr = (ptr);	\
++	__chk_user_ptr(ptr);					\
++	if (!is_kernel_addr((unsigned long)__gu_addr))		\
++		might_fault();					\
++	__get_user_size(__gu_val, __gu_addr, (size), __gu_err);	\
++	(x) = (__force __typeof__(*(ptr)))__gu_val;			\
++	__gu_err;						\
++})
++#endif /* __powerpc64__ */
++
+ #define __get_user_check(x, ptr, size)					\
+ ({									\
+ 	long __gu_err = -EFAULT;					\
+@@ -303,39 +319,6 @@ do {								\
  extern unsigned long __copy_tofrom_user(void __user *to,
  		const void __user *from, unsigned long size);
  
@@ -8904,30 +9133,17 @@ index b7c20f0..4adc0f1 100644
 -static inline unsigned long copy_from_user(void *to,
 -		const void __user *from, unsigned long n)
 -{
--	unsigned long over;
--
--	if (access_ok(VERIFY_READ, from, n))
+-	if (likely(access_ok(VERIFY_READ, from, n)))
 -		return __copy_tofrom_user((__force void __user *)to, from, n);
--	if ((unsigned long)from < TASK_SIZE) {
--		over = (unsigned long)from + n - TASK_SIZE;
--		return __copy_tofrom_user((__force void __user *)to, from,
--				n - over) + over;
--	}
+-	memset(to, 0, n);
 -	return n;
 -}
 -
 -static inline unsigned long copy_to_user(void __user *to,
 -		const void *from, unsigned long n)
 -{
--	unsigned long over;
--
 -	if (access_ok(VERIFY_WRITE, to, n))
 -		return __copy_tofrom_user(to, (__force void __user *)from, n);
--	if ((unsigned long)to < TASK_SIZE) {
--		over = (unsigned long)to + n - TASK_SIZE;
--		return __copy_tofrom_user(to, (__force void __user *)from,
--				n - over) + over;
--	}
 -	return n;
 -}
 -
@@ -8948,29 +9164,27 @@ index b7c20f0..4adc0f1 100644
  static inline unsigned long __copy_from_user_inatomic(void *to,
  		const void __user *from, unsigned long n)
  {
-@@ -372,6 +327,10 @@ static inline unsigned long __copy_from_user_inatomic(void *to,
+@@ -359,6 +342,9 @@ static inline unsigned long __copy_from_user_inatomic(void *to,
  		if (ret == 0)
  			return 0;
  	}
 +
-+	if (!__builtin_constant_p(n))
-+		check_object_size(to, n, false);
++	check_object_size(to, n, false);
 +
  	return __copy_tofrom_user((__force void __user *)to, from, n);
  }
  
-@@ -398,6 +357,10 @@ static inline unsigned long __copy_to_user_inatomic(void __user *to,
+@@ -385,6 +371,9 @@ static inline unsigned long __copy_to_user_inatomic(void __user *to,
  		if (ret == 0)
  			return 0;
  	}
 +
-+	if (!__builtin_constant_p(n))
-+		check_object_size(from, n, true);
++	check_object_size(from, n, true);
 +
  	return __copy_tofrom_user(to, (__force const void __user *)from, n);
  }
  
-@@ -415,6 +378,92 @@ static inline unsigned long __copy_to_user(void __user *to,
+@@ -402,6 +391,70 @@ static inline unsigned long __copy_to_user(void __user *to,
  	return __copy_to_user_inatomic(to, from, size);
  }
  
@@ -8979,45 +9193,26 @@ index b7c20f0..4adc0f1 100644
 +static inline unsigned long __must_check copy_from_user(void *to,
 +		const void __user *from, unsigned long n)
 +{
-+	unsigned long over;
-+
 +	if ((long)n < 0)
 +		return n;
 +
-+	if (access_ok(VERIFY_READ, from, n)) {
-+		if (!__builtin_constant_p(n))
-+			check_object_size(to, n, false);
-+		return __copy_tofrom_user((__force void __user *)to, from, n);
-+	}
-+	if ((unsigned long)from < TASK_SIZE) {
-+		over = (unsigned long)from + n - TASK_SIZE;
-+		if (!__builtin_constant_p(n - over))
-+			check_object_size(to, n - over, false);
-+		return __copy_tofrom_user((__force void __user *)to, from,
-+				n - over) + over;
++	if (likely(access_ok(VERIFY_READ, from, n))) {
++		check_object_size(to, n, false);
++		return __copy_tofrom_user((void __force_user *)to, from, n);
 +	}
++	memset(to, 0, n);
 +	return n;
 +}
 +
 +static inline unsigned long __must_check copy_to_user(void __user *to,
 +		const void *from, unsigned long n)
 +{
-+	unsigned long over;
-+
 +	if ((long)n < 0)
 +		return n;
 +
-+	if (access_ok(VERIFY_WRITE, to, n)) {
-+		if (!__builtin_constant_p(n))
-+			check_object_size(from, n, true);
-+		return __copy_tofrom_user(to, (__force void __user *)from, n);
-+	}
-+	if ((unsigned long)to < TASK_SIZE) {
-+		over = (unsigned long)to + n - TASK_SIZE;
-+		if (!__builtin_constant_p(n))
-+			check_object_size(from, n - over, true);
-+		return __copy_tofrom_user(to, (__force void __user *)from,
-+				n - over) + over;
++	if (likely(access_ok(VERIFY_WRITE, to, n))) {
++		check_object_size(from, n, true);
++		return __copy_tofrom_user(to, (void __force_user *)from, n);
 +	}
 +	return n;
 +}
@@ -9032,12 +9227,10 @@ index b7c20f0..4adc0f1 100644
 +	if ((long)n < 0 || n > INT_MAX)
 +		return n;
 +
-+	if (!__builtin_constant_p(n))
++	if (likely(access_ok(VERIFY_READ, from, n))) {
 +		check_object_size(to, n, false);
-+
-+	if (likely(access_ok(VERIFY_READ, from, n)))
 +		n = __copy_from_user(to, from, n);
-+	else
++	} else
 +		memset(to, 0, n);
 +	return n;
 +}
@@ -9048,8 +9241,7 @@ index b7c20f0..4adc0f1 100644
 +		return n;
 +
 +	if (likely(access_ok(VERIFY_WRITE, to, n))) {
-+		if (!__builtin_constant_p(n))
-+			check_object_size(from, n, true);
++		check_object_size(from, n, true);
 +		n = __copy_to_user(to, from, n);
 +	}
 +	return n;
@@ -9712,7 +9904,7 @@ index c4a93d6..4d2a9b4 100644
  
  #endif /* __ASM_EXEC_H */
 diff --git a/arch/s390/include/asm/uaccess.h b/arch/s390/include/asm/uaccess.h
-index e0900dd..72d683d 100644
+index 666fd8b..778a9b9 100644
 --- a/arch/s390/include/asm/uaccess.h
 +++ b/arch/s390/include/asm/uaccess.h
 @@ -59,6 +59,7 @@ static inline int __range_ok(unsigned long addr, unsigned long size)
@@ -10591,7 +10783,7 @@ index bd56c28..4b63d83 100644
  #include <asm/uaccess_64.h>
  #else
 diff --git a/arch/sparc/include/asm/uaccess_32.h b/arch/sparc/include/asm/uaccess_32.h
-index 57aca27..a87e6eb 100644
+index 3e8de69..d3d89a0 100644
 --- a/arch/sparc/include/asm/uaccess_32.h
 +++ b/arch/sparc/include/asm/uaccess_32.h
 @@ -47,6 +47,7 @@
@@ -10602,7 +10794,92 @@ index 57aca27..a87e6eb 100644
  #define access_ok(type, addr, size) \
  	({ (void)(type); __access_ok((unsigned long)(addr), size); })
  
-@@ -248,27 +249,46 @@ unsigned long __copy_user(void __user *to, const void __user *from, unsigned lon
+@@ -205,6 +206,31 @@ int __put_user_bad(void);
+ 	__gu_ret; \
+ })
+ 
++#define __get_user_check_ret(x, addr, size, type, retval) ({ \
++	register unsigned long __gu_val __asm__ ("l1"); \
++	if (__access_ok(addr, size)) { \
++		switch (size) { \
++		case 1: \
++			__get_user_asm_ret(__gu_val, ub, addr, retval); \
++			break; \
++		case 2: \
++			__get_user_asm_ret(__gu_val, uh, addr, retval); \
++			break; \
++		case 4: \
++			__get_user_asm_ret(__gu_val, , addr, retval); \
++			break; \
++		case 8: \
++			__get_user_asm_ret(__gu_val, d, addr, retval); \
++			break; \
++		default: \
++			if (__get_user_bad()) \
++				return retval; \
++		} \
++		x = (__force type) __gu_val; \
++	} else \
++		return retval; \
++})
++
+ #define __get_user_nocheck(x, addr, size, type) ({			\
+ 	register int __gu_ret;						\
+ 	register unsigned long __gu_val;				\
+@@ -222,6 +248,20 @@ int __put_user_bad(void);
+ 	__gu_ret;							\
+ })
+ 
++#define __get_user_nocheck_ret(x, addr, size, type, retval) ({		\
++	register unsigned long __gu_val __asm__ ("l1");			\
++	switch (size) {							\
++	case 1: __get_user_asm_ret(__gu_val, ub, addr, retval); break;	\
++	case 2: __get_user_asm_ret(__gu_val, uh, addr, retval); break;	\
++	case 4: __get_user_asm_ret(__gu_val, , addr, retval);  break;	\
++	case 8: __get_user_asm_ret(__gu_val, d, addr, retval); break;	\
++	default:							\
++		if (__get_user_bad())					\
++			return retval;					\
++	}								\
++	x = (__force type) __gu_val;					\
++})
++
+ #define __get_user_asm(x, size, addr, ret)				\
+ __asm__ __volatile__(							\
+ 		"/* Get user asm, inline. */\n"				\
+@@ -242,28 +282,70 @@ __asm__ __volatile__(							\
+ 	       : "=&r" (ret), "=&r" (x) : "m" (*__m(addr)),		\
+ 		 "i" (-EFAULT))
+ 
++#define __get_user_asm_ret(x, size, addr, retval)			\
++if (__builtin_constant_p(retval) && retval == -EFAULT)			\
++	__asm__ __volatile__(						\
++			"/* Get user asm ret, inline. */\n"		\
++		"1:\t"	"ld"#size " %1, %0\n\n\t"			\
++			".section __ex_table,#alloc\n\t"		\
++			".align	4\n\t"					\
++			".word	1b,__ret_efault\n\n\t"			\
++			".previous\n\t"					\
++		       : "=&r" (x) : "m" (*__m(addr)));			\
++else									\
++	__asm__ __volatile__(						\
++			"/* Get user asm ret, inline. */\n"		\
++		"1:\t"	"ld"#size " %1, %0\n\n\t"			\
++			".section .fixup,#alloc,#execinstr\n\t"		\
++			".align	4\n"					\
++		"3:\n\t"						\
++			"ret\n\t"					\
++			" restore %%g0, %2, %%o0\n\n\t"			\
++			".previous\n\t"					\
++			".section __ex_table,#alloc\n\t"		\
++			".align	4\n\t"					\
++			".word	1b, 3b\n\n\t"				\
++			".previous\n\t"					\
++		       : "=&r" (x) : "m" (*__m(addr)), "i" (retval))
++
+ int __get_user_bad(void);
+ 
+ unsigned long __copy_user(void __user *to, const void __user *from, unsigned long size);
  
  static inline unsigned long copy_to_user(void __user *to, const void *from, unsigned long n)
  {
@@ -10640,10 +10917,12 @@ index 57aca27..a87e6eb 100644
 +		if (!__builtin_constant_p(n))
 +			check_object_size(to, n, false);
  		return __copy_user((__force void __user *) to, from, n);
--	else
-+	} else
+-	else {
++	} else {
+ 		memset(to, 0, n);
  		return n;
- }
+ 	}
+@@ -271,6 +353,9 @@ static inline unsigned long copy_from_user(void *to, const void __user *from, un
  
  static inline unsigned long __copy_from_user(void *to, const void __user *from, unsigned long n)
  {
@@ -18725,10 +19004,10 @@ index 9b4f9d3..ce64392 100644
  
  	intel_ds_init();
 diff --git a/arch/x86/events/intel/cqm.c b/arch/x86/events/intel/cqm.c
-index 7b5fd81..3ca58b5 100644
+index 4ff41ae..9303030 100644
 --- a/arch/x86/events/intel/cqm.c
 +++ b/arch/x86/events/intel/cqm.c
-@@ -1479,7 +1479,7 @@ static struct attribute *intel_cmt_mbm_events_attr[] = {
+@@ -1488,7 +1488,7 @@ static struct attribute *intel_cmt_mbm_events_attr[] = {
  	NULL,
  };
  
@@ -18737,7 +19016,7 @@ index 7b5fd81..3ca58b5 100644
  	.name = "events",
  	.attrs = NULL,
  };
-@@ -1737,7 +1737,9 @@ static int __init intel_cqm_init(void)
+@@ -1746,7 +1746,9 @@ static int __init intel_cqm_init(void)
  		goto out;
  	}
  
@@ -18748,7 +19027,7 @@ index 7b5fd81..3ca58b5 100644
  
  	ret = intel_cqm_setup_rmid_cache();
  	if (ret)
-@@ -1753,12 +1755,14 @@ static int __init intel_cqm_init(void)
+@@ -1762,12 +1764,14 @@ static int __init intel_cqm_init(void)
  	if (ret && !cqm_enabled)
  		goto out;
  
@@ -18789,7 +19068,7 @@ index 9ba4e41..f931fb9 100644
  
  static ssize_t cstate_get_attr_cpumask(struct device *dev,
 diff --git a/arch/x86/events/intel/ds.c b/arch/x86/events/intel/ds.c
-index 7ce9f3f..dc9146c 100644
+index 9b983a4..b31c136 100644
 --- a/arch/x86/events/intel/ds.c
 +++ b/arch/x86/events/intel/ds.c
 @@ -601,7 +601,7 @@ unlock:
@@ -18850,7 +19129,7 @@ index 9e2b40c..a9013c2 100644
  	if (!insn.opcode.got)
  		return X86_BR_ABORT;
 diff --git a/arch/x86/events/intel/pt.c b/arch/x86/events/intel/pt.c
-index 04bb5fb..69cbd32 100644
+index 861a7d9..2ff89b2 100644
 --- a/arch/x86/events/intel/pt.c
 +++ b/arch/x86/events/intel/pt.c
 @@ -172,11 +172,9 @@ static const struct attribute_group *pt_attr_groups[] = {
@@ -24045,7 +24324,7 @@ index c3496619..3f3a7dc 100644
  asmlinkage void smp_deferred_error_interrupt(void);
  #endif
 diff --git a/arch/x86/include/asm/uaccess.h b/arch/x86/include/asm/uaccess.h
-index 2982387..35d07f4 100644
+index 0328c2cc..35d07f4 100644
 --- a/arch/x86/include/asm/uaccess.h
 +++ b/arch/x86/include/asm/uaccess.h
 @@ -8,6 +8,7 @@
@@ -24248,23 +24527,20 @@ index 2982387..35d07f4 100644
  		break;							\
  	case 4:								\
  		__get_user_asm_ex(x, ptr, "l", "k", "=r");		\
-@@ -412,9 +464,13 @@ do {									\
+@@ -412,10 +464,10 @@ do {									\
  } while (0)
  
  #define __get_user_asm_ex(x, addr, itype, rtype, ltype)			\
 -	asm volatile("1:	mov"itype" %1,%"rtype"0\n"		\
 +	asm volatile("1:	"__copyuser_seg"mov"itype" %1,%"rtype"0\n"\
  		     "2:\n"						\
--		     _ASM_EXTABLE_EX(1b, 2b)				\
-+		     ".section .fixup,\"ax\"\n"				\
+ 		     ".section .fixup,\"ax\"\n"				\
+-                     "3:xor"itype" %"rtype"0,%"rtype"0\n"		\
 +                     "3:xorl %k0,%k0\n"					\
-+		     "  jmp 2b\n"					\
-+		     ".previous\n"					\
-+		     _ASM_EXTABLE_EX(1b, 3b)				\
- 		     : ltype(x) : "m" (__m(addr)))
- 
- #define __put_user_nocheck(x, ptr, size)			\
-@@ -433,13 +489,24 @@ do {									\
+ 		     "  jmp 2b\n"					\
+ 		     ".previous\n"					\
+ 		     _ASM_EXTABLE_EX(1b, 3b)				\
+@@ -437,13 +489,24 @@ do {									\
  	__uaccess_begin();						\
  	__get_user_size(__gu_val, (ptr), (size), __gu_err, -EFAULT);	\
  	__uaccess_end();						\
@@ -24291,7 +24567,7 @@ index 2982387..35d07f4 100644
  
  /*
   * Tell gcc we read from memory instead of writing: this is because
-@@ -447,8 +514,10 @@ struct __large_struct { unsigned long buf[100]; };
+@@ -451,8 +514,10 @@ struct __large_struct { unsigned long buf[100]; };
   * aliasing issues.
   */
  #define __put_user_asm(x, addr, err, itype, rtype, ltype, errret)	\
@@ -24303,7 +24579,7 @@ index 2982387..35d07f4 100644
  		     "2:\n"						\
  		     ".section .fixup,\"ax\"\n"				\
  		     "3:	mov %3,%0\n"				\
-@@ -456,10 +525,12 @@ struct __large_struct { unsigned long buf[100]; };
+@@ -460,10 +525,12 @@ struct __large_struct { unsigned long buf[100]; };
  		     ".previous\n"					\
  		     _ASM_EXTABLE(1b, 3b)				\
  		     : "=r"(err)					\
@@ -24318,7 +24594,7 @@ index 2982387..35d07f4 100644
  		     "2:\n"						\
  		     _ASM_EXTABLE_EX(1b, 2b)				\
  		     : : ltype(x), "m" (__m(addr)))
-@@ -469,11 +540,13 @@ struct __large_struct { unsigned long buf[100]; };
+@@ -473,11 +540,13 @@ struct __large_struct { unsigned long buf[100]; };
   */
  #define uaccess_try	do {						\
  	current_thread_info()->uaccess_err = 0;				\
@@ -24332,7 +24608,7 @@ index 2982387..35d07f4 100644
  	(err) |= (current_thread_info()->uaccess_err ? -EFAULT : 0);	\
  } while (0)
  
-@@ -499,8 +572,12 @@ struct __large_struct { unsigned long buf[100]; };
+@@ -503,8 +572,12 @@ struct __large_struct { unsigned long buf[100]; };
   * On error, the variable @x is set to zero.
   */
  
@@ -24345,7 +24621,7 @@ index 2982387..35d07f4 100644
  
  /**
   * __put_user: - Write a simple value into user space, with less checking.
-@@ -523,8 +600,12 @@ struct __large_struct { unsigned long buf[100]; };
+@@ -527,8 +600,12 @@ struct __large_struct { unsigned long buf[100]; };
   * Returns zero on success, or -EFAULT on error.
   */
  
@@ -24358,7 +24634,7 @@ index 2982387..35d07f4 100644
  
  #define __get_user_unaligned __get_user
  #define __put_user_unaligned __put_user
-@@ -542,7 +623,7 @@ struct __large_struct { unsigned long buf[100]; };
+@@ -546,7 +623,7 @@ struct __large_struct { unsigned long buf[100]; };
  #define get_user_ex(x, ptr)	do {					\
  	unsigned long __gue_val;					\
  	__get_user_size_ex((__gue_val), (ptr), (sizeof(*(ptr))));	\
@@ -24367,7 +24643,7 @@ index 2982387..35d07f4 100644
  } while (0)
  
  #define put_user_try		uaccess_try
-@@ -560,7 +641,7 @@ extern __must_check long strlen_user(const char __user *str);
+@@ -564,7 +641,7 @@ extern __must_check long strlen_user(const char __user *str);
  extern __must_check long strnlen_user(const char __user *str, long n);
  
  unsigned long __must_check clear_user(void __user *mem, unsigned long len);
@@ -24376,7 +24652,7 @@ index 2982387..35d07f4 100644
  
  extern void __cmpxchg_wrong_size(void)
  	__compiletime_error("Bad argument size for cmpxchg");
-@@ -568,22 +649,23 @@ extern void __cmpxchg_wrong_size(void)
+@@ -572,22 +649,23 @@ extern void __cmpxchg_wrong_size(void)
  #define __user_atomic_cmpxchg_inatomic(uval, ptr, old, new, size)	\
  ({									\
  	int __ret = 0;							\
@@ -24405,7 +24681,7 @@ index 2982387..35d07f4 100644
  			: "i" (-EFAULT), "q" (__new), "1" (__old)	\
  			: "memory"					\
  		);							\
-@@ -592,14 +674,14 @@ extern void __cmpxchg_wrong_size(void)
+@@ -596,14 +674,14 @@ extern void __cmpxchg_wrong_size(void)
  	case 2:								\
  	{								\
  		asm volatile("\n"					\
@@ -24422,7 +24698,7 @@ index 2982387..35d07f4 100644
  			: "i" (-EFAULT), "r" (__new), "1" (__old)	\
  			: "memory"					\
  		);							\
-@@ -608,14 +690,14 @@ extern void __cmpxchg_wrong_size(void)
+@@ -612,14 +690,14 @@ extern void __cmpxchg_wrong_size(void)
  	case 4:								\
  	{								\
  		asm volatile("\n"					\
@@ -24439,7 +24715,7 @@ index 2982387..35d07f4 100644
  			: "i" (-EFAULT), "r" (__new), "1" (__old)	\
  			: "memory"					\
  		);							\
-@@ -627,14 +709,14 @@ extern void __cmpxchg_wrong_size(void)
+@@ -631,14 +709,14 @@ extern void __cmpxchg_wrong_size(void)
  			__cmpxchg_wrong_size();				\
  									\
  		asm volatile("\n"					\
@@ -24456,7 +24732,7 @@ index 2982387..35d07f4 100644
  			: "i" (-EFAULT), "r" (__new), "1" (__old)	\
  			: "memory"					\
  		);							\
-@@ -644,6 +726,7 @@ extern void __cmpxchg_wrong_size(void)
+@@ -648,6 +726,7 @@ extern void __cmpxchg_wrong_size(void)
  		__cmpxchg_wrong_size();					\
  	}								\
  	__uaccess_end();						\
@@ -24464,7 +24740,7 @@ index 2982387..35d07f4 100644
  	*__uval = __old;						\
  	__ret;								\
  })
-@@ -667,17 +750,6 @@ extern struct movsl_mask {
+@@ -671,17 +750,6 @@ extern struct movsl_mask {
  
  #define ARCH_HAS_NOCACHE_UACCESS 1
  
@@ -24482,7 +24758,7 @@ index 2982387..35d07f4 100644
  #ifdef CONFIG_DEBUG_STRICT_USER_COPY_CHECKS
  # define copy_user_diag __compiletime_error
  #else
-@@ -687,7 +759,7 @@ unsigned long __must_check _copy_to_user(void __user *to, const void *from,
+@@ -691,7 +759,7 @@ unsigned long __must_check _copy_to_user(void __user *to, const void *from,
  extern void copy_user_diag("copy_from_user() buffer size is too small")
  copy_from_user_overflow(void);
  extern void copy_user_diag("copy_to_user() buffer size is too small")
@@ -24491,7 +24767,7 @@ index 2982387..35d07f4 100644
  
  #undef copy_user_diag
  
-@@ -700,7 +772,7 @@ __copy_from_user_overflow(void) __asm__("copy_from_user_overflow");
+@@ -704,7 +772,7 @@ __copy_from_user_overflow(void) __asm__("copy_from_user_overflow");
  
  extern void
  __compiletime_warning("copy_to_user() buffer size is not provably correct")
@@ -24500,7 +24776,7 @@ index 2982387..35d07f4 100644
  #define __copy_to_user_overflow(size, count) __copy_to_user_overflow()
  
  #else
-@@ -715,10 +787,16 @@ __copy_from_user_overflow(int size, unsigned long count)
+@@ -719,10 +787,16 @@ __copy_from_user_overflow(int size, unsigned long count)
  
  #endif
  
@@ -24518,7 +24794,7 @@ index 2982387..35d07f4 100644
  
  	might_fault();
  
-@@ -742,12 +820,15 @@ copy_from_user(void *to, const void __user *from, unsigned long n)
+@@ -746,12 +820,15 @@ copy_from_user(void *to, const void __user *from, unsigned long n)
  	 * case, and do only runtime checking for non-constant sizes.
  	 */
  
@@ -24540,7 +24816,7 @@ index 2982387..35d07f4 100644
  
  	return n;
  }
-@@ -755,19 +836,20 @@ copy_from_user(void *to, const void __user *from, unsigned long n)
+@@ -759,19 +836,20 @@ copy_from_user(void *to, const void __user *from, unsigned long n)
  static inline unsigned long __must_check
  copy_to_user(void __user *to, const void *from, unsigned long n)
  {
@@ -25776,10 +26052,10 @@ index 4a8697f..8a13428 100644
  obj-y			+= common.o
  obj-y			+= rdrand.o
 diff --git a/arch/x86/kernel/cpu/amd.c b/arch/x86/kernel/cpu/amd.c
-index f5c69d8..5eecf58 100644
+index b81fe2d..fa46eca 100644
 --- a/arch/x86/kernel/cpu/amd.c
 +++ b/arch/x86/kernel/cpu/amd.c
-@@ -780,7 +780,7 @@ static void init_amd(struct cpuinfo_x86 *c)
+@@ -792,7 +792,7 @@ static void init_amd(struct cpuinfo_x86 *c)
  static unsigned int amd_size_cache(struct cpuinfo_x86 *c, unsigned int size)
  {
  	/* AMD errata T13 (order #21922) */
@@ -29478,10 +29754,10 @@ index 33ee3e0..6d23e5c 100644
  #endif /* SMP */
  };
 diff --git a/arch/x86/kernel/paravirt.c b/arch/x86/kernel/paravirt.c
-index 7b3b3f2..68b5f72 100644
+index 078c933..c5d51dc 100644
 --- a/arch/x86/kernel/paravirt.c
 +++ b/arch/x86/kernel/paravirt.c
-@@ -64,6 +64,9 @@ u64 _paravirt_ident_64(u64 x)
+@@ -64,6 +64,9 @@ u64 notrace _paravirt_ident_64(u64 x)
  {
  	return x;
  }
@@ -31985,10 +32261,10 @@ index 7cc2360..6ae1236 100644
  {
  	struct kvm_kpic_state *s = opaque;
 diff --git a/arch/x86/kvm/ioapic.c b/arch/x86/kvm/ioapic.c
-index 5f42d03..052f8a4 100644
+index c7220ba..4d0a181 100644
 --- a/arch/x86/kvm/ioapic.c
 +++ b/arch/x86/kvm/ioapic.c
-@@ -413,6 +413,8 @@ static void kvm_ioapic_eoi_inject_work(struct work_struct *work)
+@@ -415,6 +415,8 @@ static void kvm_ioapic_eoi_inject_work(struct work_struct *work)
  #define IOAPIC_SUCCESSIVE_IRQ_MAX_COUNT 10000
  
  static void __kvm_ioapic_update_eoi(struct kvm_vcpu *vcpu,
@@ -37189,7 +37465,7 @@ index 7a1f7bb..5b4b5cc 100644
  	while (numpages) {
  		/*
 diff --git a/arch/x86/mm/pat.c b/arch/x86/mm/pat.c
-index fb0604f..b9e0399 100644
+index 5431a32..137f092 100644
 --- a/arch/x86/mm/pat.c
 +++ b/arch/x86/mm/pat.c
 @@ -633,7 +633,7 @@ int free_memtype(u64 start, u64 end)
@@ -40002,7 +40278,7 @@ index 058c8d7..55229dd 100644
  	__be32 *dst = (__be32 *)outbuf;
  	u32 block[4];
 diff --git a/crypto/cryptd.c b/crypto/cryptd.c
-index 7921251..ba86330 100644
+index 90fefae..1a7cd2e 100644
 --- a/crypto/cryptd.c
 +++ b/crypto/cryptd.c
 @@ -63,7 +63,7 @@ struct cryptd_blkcipher_ctx {
@@ -46652,7 +46928,7 @@ index 5d469b2..2a576b2 100644
  		else
  			type = types[map->type];
 diff --git a/drivers/gpu/drm/drm_ioc32.c b/drivers/gpu/drm/drm_ioc32.c
-index 57676f8..020e7ca 100644
+index a628975..98c84f7 100644
 --- a/drivers/gpu/drm/drm_ioc32.c
 +++ b/drivers/gpu/drm/drm_ioc32.c
 @@ -458,7 +458,7 @@ static int compat_drm_infobufs(struct file *file, unsigned int cmd,
@@ -46673,16 +46949,16 @@ index 57676f8..020e7ca 100644
  
  	if (__put_user(count, &request->count)
  	    || __put_user(list, &request->list))
-@@ -1072,7 +1072,7 @@ static int compat_drm_mode_addfb2(struct file *file, unsigned int cmd,
- 	return 0;
+@@ -1074,7 +1074,7 @@ static int compat_drm_mode_addfb2(struct file *file, unsigned int cmd,
  }
+ #endif
  
 -static drm_ioctl_compat_t *drm_compat_ioctls[] = {
 +static drm_ioctl_compat_t drm_compat_ioctls[] = {
  	[DRM_IOCTL_NR(DRM_IOCTL_VERSION32)] = compat_drm_version,
  	[DRM_IOCTL_NR(DRM_IOCTL_GET_UNIQUE32)] = compat_drm_getunique,
  	[DRM_IOCTL_NR(DRM_IOCTL_GET_MAP32)] = compat_drm_getmap,
-@@ -1119,7 +1119,6 @@ static drm_ioctl_compat_t *drm_compat_ioctls[] = {
+@@ -1123,7 +1123,6 @@ static drm_ioctl_compat_t *drm_compat_ioctls[] = {
  long drm_compat_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
  {
  	unsigned int nr = DRM_IOCTL_NR(cmd);
@@ -46690,7 +46966,7 @@ index 57676f8..020e7ca 100644
  	int ret;
  
  	/* Assume that ioctls without an explicit compat routine will just
-@@ -1129,10 +1128,8 @@ long drm_compat_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
+@@ -1133,10 +1132,8 @@ long drm_compat_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
  	if (nr >= ARRAY_SIZE(drm_compat_ioctls))
  		return drm_ioctl(filp, cmd, arg);
  
@@ -50151,10 +50427,10 @@ index c966492..4e66371 100644
  /*
   * intel_idle_state_table_update()
 diff --git a/drivers/iio/industrialio-core.c b/drivers/iio/industrialio-core.c
-index e6319a9..9e14f05 100644
+index 2e6a427..8b6cf88 100644
 --- a/drivers/iio/industrialio-core.c
 +++ b/drivers/iio/industrialio-core.c
-@@ -689,7 +689,7 @@ static ssize_t iio_write_channel_info(struct device *dev,
+@@ -688,7 +688,7 @@ static ssize_t iio_write_channel_info(struct device *dev,
  }
  
  static
@@ -56024,7 +56300,7 @@ index fd40bcb..13b3f293 100644
  
  void dm_uevent_add(struct mapped_device *md, struct list_head *elist)
 diff --git a/drivers/md/md.c b/drivers/md/md.c
-index 866825f..0c08c28 100644
+index 0678a0a..90c7246 100644
 --- a/drivers/md/md.c
 +++ b/drivers/md/md.c
 @@ -198,10 +198,10 @@ EXPORT_SYMBOL_GPL(bio_clone_mddev);
@@ -56154,7 +56430,7 @@ index 866825f..0c08c28 100644
  		mask |= POLLERR | POLLPRI;
  	return mask;
  }
-@@ -7637,7 +7638,7 @@ static int is_mddev_idle(struct mddev *mddev, int init)
+@@ -7633,7 +7634,7 @@ static int is_mddev_idle(struct mddev *mddev, int init)
  		struct gendisk *disk = rdev->bdev->bd_contains->bd_disk;
  		curr_events = (int)part_stat_read(&disk->part0, sectors[0]) +
  			      (int)part_stat_read(&disk->part0, sectors[1]) -
@@ -56163,7 +56439,7 @@ index 866825f..0c08c28 100644
  		/* sync IO will cause sync_io to increase before the disk_stats
  		 * as sync_io is counted when a request starts, and
  		 * disk_stats is counted when it completes.
-@@ -7901,7 +7902,7 @@ void md_do_sync(struct md_thread *thread)
+@@ -7897,7 +7898,7 @@ void md_do_sync(struct md_thread *thread)
  		 * which defaults to physical size, but can be virtual size
  		 */
  		max_sectors = mddev->resync_max_sectors;
@@ -56172,7 +56448,7 @@ index 866825f..0c08c28 100644
  		/* we don't use the checkpoint if there's a bitmap */
  		if (test_bit(MD_RECOVERY_REQUESTED, &mddev->recovery))
  			j = mddev->resync_min;
-@@ -8895,11 +8896,11 @@ static __exit void md_exit(void)
+@@ -8891,11 +8892,11 @@ static __exit void md_exit(void)
  subsys_initcall(md_init);
  module_exit(md_exit)
  
@@ -58406,7 +58682,7 @@ index 528390f..cacc274 100644
  			err = -EFAULT;
  		goto out_array_args;
 diff --git a/drivers/memory/omap-gpmc.c b/drivers/memory/omap-gpmc.c
-index 15508df..5f0ee4e 100644
+index 73ec320..a3ed597 100644
 --- a/drivers/memory/omap-gpmc.c
 +++ b/drivers/memory/omap-gpmc.c
 @@ -234,7 +234,7 @@ struct omap3_gpmc_regs {
@@ -61675,7 +61951,7 @@ index 4048fc5..333809f 100644
  /**
   * bnx2x_config_rx_mode - Send and RX_MODE ramrod according to the provided parameters.
 diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
-index c777cde..7fa85f9 100644
+index e655b76..313a56d 100644
 --- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
 +++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
 @@ -6421,7 +6421,7 @@ init_err_free:
@@ -62735,7 +63011,7 @@ index 546fab0..8eeb822 100644
  	struct mlx4_dev_persistent *persist = pci_get_drvdata(pdev);
  
 diff --git a/drivers/net/ethernet/mellanox/mlx5/core/main.c b/drivers/net/ethernet/mellanox/mlx5/core/main.c
-index 6695893..6abc392 100644
+index e782d0f..6591e56 100644
 --- a/drivers/net/ethernet/mellanox/mlx5/core/main.c
 +++ b/drivers/net/ethernet/mellanox/mlx5/core/main.c
 @@ -1384,7 +1384,7 @@ static void remove_one(struct pci_dev *pdev)
@@ -63239,7 +63515,7 @@ index cb49c96..c1498cc 100644
  	struct smc911x_local *lp = netdev_priv(dev);
  	unsigned int free;
 diff --git a/drivers/net/ethernet/smsc/smc91x.c b/drivers/net/ethernet/smsc/smc91x.c
-index 18ac52d..5fd8ce3 100644
+index b69d0e1..718a393 100644
 --- a/drivers/net/ethernet/smsc/smc91x.c
 +++ b/drivers/net/ethernet/smsc/smc91x.c
 @@ -637,7 +637,7 @@ done:	if (!THROTTLE_TX_PKTS)
@@ -63994,10 +64270,10 @@ index fdee772..6c3ba123 100644
  };
  
 diff --git a/drivers/net/tun.c b/drivers/net/tun.c
-index e16487c..c0987f1 100644
+index 34259bd..60c2692 100644
 --- a/drivers/net/tun.c
 +++ b/drivers/net/tun.c
-@@ -960,7 +960,7 @@ static void tun_set_headroom(struct net_device *dev, int new_hr)
+@@ -956,7 +956,7 @@ static void tun_set_headroom(struct net_device *dev, int new_hr)
  {
  	struct tun_struct *tun = netdev_priv(dev);
  
@@ -64006,7 +64282,7 @@ index e16487c..c0987f1 100644
  		new_hr = NET_SKB_PAD;
  
  	tun->align = new_hr;
-@@ -1558,7 +1558,7 @@ static int tun_validate(struct nlattr *tb[], struct nlattr *data[])
+@@ -1554,7 +1554,7 @@ static int tun_validate(struct nlattr *tb[], struct nlattr *data[])
  	return -EINVAL;
  }
  
@@ -64015,7 +64291,7 @@ index e16487c..c0987f1 100644
  	.kind		= DRV_NAME,
  	.priv_size	= sizeof(struct tun_struct),
  	.setup		= tun_setup,
-@@ -1970,7 +1970,7 @@ unlock:
+@@ -1966,7 +1966,7 @@ unlock:
  }
  
  static long __tun_chr_ioctl(struct file *file, unsigned int cmd,
@@ -64024,7 +64300,7 @@ index e16487c..c0987f1 100644
  {
  	struct tun_file *tfile = file->private_data;
  	struct tun_struct *tun;
-@@ -1984,6 +1984,9 @@ static long __tun_chr_ioctl(struct file *file, unsigned int cmd,
+@@ -1980,6 +1980,9 @@ static long __tun_chr_ioctl(struct file *file, unsigned int cmd,
  	int le;
  	int ret;
  
@@ -64757,10 +65033,10 @@ index 9cbca12..eae7c79 100644
  struct ath_nf_limits {
  	s16 max;
 diff --git a/drivers/net/wireless/ath/ath9k/main.c b/drivers/net/wireless/ath/ath9k/main.c
-index 8b63988..2fd4697 100644
+index 4b59a4c..14eb96d 100644
 --- a/drivers/net/wireless/ath/ath9k/main.c
 +++ b/drivers/net/wireless/ath/ath9k/main.c
-@@ -2589,16 +2589,18 @@ void ath9k_fill_chanctx_ops(void)
+@@ -2594,16 +2594,18 @@ void ath9k_fill_chanctx_ops(void)
  	if (!ath9k_is_chanctx_enabled())
  		return;
  
@@ -65413,7 +65689,7 @@ index 83770d2..3ec8a40 100644
  	if (modparam_pio)
  		wldev->__using_pio = true;
 diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
-index 62f475e..c5c90d3 100644
+index 121baba..80f9d55 100644
 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
 +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
 @@ -5077,6 +5077,50 @@ static struct cfg80211_ops brcmf_cfg80211_ops = {
@@ -77655,10 +77931,10 @@ index 0fbd7c0..66c6010 100644
  	if (share_irqs)
  		irqflag = IRQF_SHARED;
 diff --git a/drivers/tty/serial/8250/8250_pci.c b/drivers/tty/serial/8250/8250_pci.c
-index 8dd250f..84599cb 100644
+index e67a463..c568cf1 100644
 --- a/drivers/tty/serial/8250/8250_pci.c
 +++ b/drivers/tty/serial/8250/8250_pci.c
-@@ -5632,7 +5632,7 @@ static struct pci_device_id serial_pci_tbl[] = {
+@@ -5771,7 +5771,7 @@ static struct pci_device_id serial_pci_tbl[] = {
  };
  
  static pci_ers_result_t serial8250_io_error_detected(struct pci_dev *dev,
@@ -79182,10 +79458,10 @@ index 69f7fab..05c4ff5 100644
  /* Device for a quirk */
  #define PCI_VENDOR_ID_FRESCO_LOGIC	0x1b73
 diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
-index bc17bcf..4480e4a 100644
+index e262ccc..43da57e 100644
 --- a/drivers/usb/host/xhci-ring.c
 +++ b/drivers/usb/host/xhci-ring.c
-@@ -1872,9 +1872,9 @@ td_cleanup:
+@@ -1876,9 +1876,9 @@ td_cleanup:
  	 * unsigned).  Play it safe and say we didn't transfer anything.
  	 */
  	if (urb->actual_length > urb->transfer_buffer_length) {
@@ -79197,7 +79473,7 @@ index bc17bcf..4480e4a 100644
  		urb->actual_length = 0;
  		if (td->urb->transfer_flags & URB_SHORT_NOT_OK)
  			*status = -EREMOTEIO;
-@@ -1953,10 +1953,15 @@ static int process_ctrl_td(struct xhci_hcd *xhci, struct xhci_td *td,
+@@ -1957,10 +1957,15 @@ static int process_ctrl_td(struct xhci_hcd *xhci, struct xhci_td *td,
  		return finish_td(xhci, td, event_trb, event, ep, status, false);
  	case COMP_STOP:
  		/* Did we stop at data stage? */
@@ -79217,7 +79493,7 @@ index bc17bcf..4480e4a 100644
  		/* fall through */
  	case COMP_STOP_INVAL:
  		return finish_td(xhci, td, event_trb, event, ep, status, false);
-@@ -1970,12 +1975,15 @@ static int process_ctrl_td(struct xhci_hcd *xhci, struct xhci_td *td,
+@@ -1974,12 +1979,15 @@ static int process_ctrl_td(struct xhci_hcd *xhci, struct xhci_td *td,
  		/* else fall through */
  	case COMP_STALL:
  		/* Did we transfer part of the data (middle) phase? */
@@ -79239,7 +79515,7 @@ index bc17bcf..4480e4a 100644
  			td->urb->actual_length = 0;
  
  		return finish_td(xhci, td, event_trb, event, ep, status, false);
-@@ -2008,9 +2016,12 @@ static int process_ctrl_td(struct xhci_hcd *xhci, struct xhci_td *td,
+@@ -2012,9 +2020,12 @@ static int process_ctrl_td(struct xhci_hcd *xhci, struct xhci_td *td,
  			 * the last TRB.
  			 */
  			td->urb_length_set = true;
@@ -79255,7 +79531,7 @@ index bc17bcf..4480e4a 100644
  			xhci_dbg(xhci, "Waiting for status "
  					"stage event\n");
  			return 0;
-@@ -2205,11 +2216,7 @@ static int process_bulk_intr_td(struct xhci_hcd *xhci, struct xhci_td *td,
+@@ -2209,11 +2220,7 @@ static int process_bulk_intr_td(struct xhci_hcd *xhci, struct xhci_td *td,
  	/* Fast path - was this the last TRB in the TD for this URB? */
  	} else if (event_trb == td->last_trb) {
  		if (EVENT_TRB_LEN(le32_to_cpu(event->transfer_len)) != 0) {
@@ -79268,7 +79544,7 @@ index bc17bcf..4480e4a 100644
  				xhci_warn(xhci, "HC gave bad length "
  						"of %d bytes left\n",
  					  EVENT_TRB_LEN(le32_to_cpu(event->transfer_len)));
-@@ -2218,7 +2225,10 @@ static int process_bulk_intr_td(struct xhci_hcd *xhci, struct xhci_td *td,
+@@ -2222,7 +2229,10 @@ static int process_bulk_intr_td(struct xhci_hcd *xhci, struct xhci_td *td,
  					*status = -EREMOTEIO;
  				else
  					*status = 0;
@@ -97635,7 +97911,7 @@ index 948aa18..ae3bc17 100644
  	spin_lock_init(&cur_trans->delayed_refs.lock);
  
 diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c
-index c05f69a..2469b31 100644
+index 542379f..054af97 100644
 --- a/fs/btrfs/tree-log.c
 +++ b/fs/btrfs/tree-log.c
 @@ -173,7 +173,7 @@ static int start_log_trans(struct btrfs_trans_handle *trans,
@@ -102351,7 +102627,7 @@ index cbece12..9b01171 100644
  	}
  
 diff --git a/fs/fuse/file.c b/fs/fuse/file.c
-index 6cac3dc..e3ad955 100644
+index 76962a3..b0bdc86 100644
 --- a/fs/fuse/file.c
 +++ b/fs/fuse/file.c
 @@ -849,9 +849,9 @@ struct fuse_fill_data {
@@ -102776,7 +103052,7 @@ index 8a65240..59ccf62 100644
  }
  
 diff --git a/fs/kernfs/file.c b/fs/kernfs/file.c
-index e157400..1b16643 100644
+index 2bcb86e..b9fad5d 100644
 --- a/fs/kernfs/file.c
 +++ b/fs/kernfs/file.c
 @@ -34,7 +34,7 @@ static DEFINE_MUTEX(kernfs_open_file_mutex);
@@ -104991,7 +105267,7 @@ index 5fe1cec..d0f4ac0 100644
  #if IS_ENABLED(CONFIG_NFS_V4)
  extern int nfs_callback_up(u32 minorversion, struct rpc_xprt *xprt);
 diff --git a/fs/nfs/callback_proc.c b/fs/nfs/callback_proc.c
-index aaa2e8d..deb6e76 100644
+index 8cfa21f..fc50292 100644
 --- a/fs/nfs/callback_proc.c
 +++ b/fs/nfs/callback_proc.c
 @@ -19,10 +19,12 @@
@@ -105042,7 +105318,7 @@ index aaa2e8d..deb6e76 100644
  	int i;
  	__be32 res = 0;
  	struct nfs_client *clp = cps->clp;
-@@ -444,10 +448,12 @@ out:
+@@ -441,10 +445,12 @@ out:
  	return status;
  }
  
@@ -105057,7 +105333,7 @@ index aaa2e8d..deb6e76 100644
  	struct nfs4_slot_table *tbl;
  	struct nfs4_slot *slot;
  	struct nfs_client *clp;
-@@ -549,9 +555,10 @@ validate_bitmap_values(unsigned long mask)
+@@ -546,9 +552,10 @@ validate_bitmap_values(unsigned long mask)
  	return (mask & ~RCA4_TYPE_MASK_ALL) == 0;
  }
  
@@ -105069,7 +105345,7 @@ index aaa2e8d..deb6e76 100644
  	__be32 status;
  	fmode_t flags = 0;
  
-@@ -584,9 +591,10 @@ out:
+@@ -581,9 +588,10 @@ out:
  }
  
  /* Reduce the fore channel's max_slots to the target value */
@@ -110132,10 +110408,10 @@ index de1ff1d..bd4c347 100644
  		.pc_ressize = sizeof(struct nfsd4_compoundres),
  		.pc_release = nfsd4_release_compoundargs,
 diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c
-index 806eda1..125792c 100644
+index 6a23098..69c65ea 100644
 --- a/fs/nfsd/nfs4state.c
 +++ b/fs/nfsd/nfs4state.c
-@@ -2362,8 +2362,9 @@ static bool client_has_state(struct nfs4_client *clp)
+@@ -2341,8 +2341,9 @@ static bool client_has_state(struct nfs4_client *clp)
  __be32
  nfsd4_exchange_id(struct svc_rqst *rqstp,
  		  struct nfsd4_compound_state *cstate,
@@ -110146,7 +110422,7 @@ index 806eda1..125792c 100644
  	struct nfs4_client *conf, *new;
  	struct nfs4_client *unconf = NULL;
  	__be32 status;
-@@ -2639,8 +2640,9 @@ static __be32 nfsd4_check_cb_sec(struct nfsd4_cb_sec *cbs)
+@@ -2618,8 +2619,9 @@ static __be32 nfsd4_check_cb_sec(struct nfsd4_cb_sec *cbs)
  __be32
  nfsd4_create_session(struct svc_rqst *rqstp,
  		     struct nfsd4_compound_state *cstate,
@@ -110157,7 +110433,7 @@ index 806eda1..125792c 100644
  	struct sockaddr *sa = svc_addr(rqstp);
  	struct nfs4_client *conf, *unconf;
  	struct nfs4_client *old = NULL;
-@@ -2764,8 +2766,9 @@ static __be32 nfsd4_map_bcts_dir(u32 *dir)
+@@ -2743,8 +2745,9 @@ static __be32 nfsd4_map_bcts_dir(u32 *dir)
  	return nfserr_inval;
  }
  
@@ -110168,7 +110444,7 @@ index 806eda1..125792c 100644
  	struct nfsd4_session *session = cstate->session;
  	struct nfsd_net *nn = net_generic(SVC_NET(rqstp), nfsd_net_id);
  	__be32 status;
-@@ -2785,8 +2788,9 @@ __be32 nfsd4_backchannel_ctl(struct svc_rqst *rqstp, struct nfsd4_compound_state
+@@ -2764,8 +2767,9 @@ __be32 nfsd4_backchannel_ctl(struct svc_rqst *rqstp, struct nfsd4_compound_state
  
  __be32 nfsd4_bind_conn_to_session(struct svc_rqst *rqstp,
  		     struct nfsd4_compound_state *cstate,
@@ -110179,7 +110455,7 @@ index 806eda1..125792c 100644
  	__be32 status;
  	struct nfsd4_conn *conn;
  	struct nfsd4_session *session;
-@@ -2828,8 +2832,9 @@ static bool nfsd4_compound_in_session(struct nfsd4_session *session, struct nfs4
+@@ -2807,8 +2811,9 @@ static bool nfsd4_compound_in_session(struct nfsd4_session *session, struct nfs4
  __be32
  nfsd4_destroy_session(struct svc_rqst *r,
  		      struct nfsd4_compound_state *cstate,
@@ -110190,7 +110466,7 @@ index 806eda1..125792c 100644
  	struct nfsd4_session *ses;
  	__be32 status;
  	int ref_held_by_me = 0;
-@@ -2925,8 +2930,9 @@ static bool nfsd4_request_too_big(struct svc_rqst *rqstp,
+@@ -2904,8 +2909,9 @@ static bool nfsd4_request_too_big(struct svc_rqst *rqstp,
  __be32
  nfsd4_sequence(struct svc_rqst *rqstp,
  	       struct nfsd4_compound_state *cstate,
@@ -110201,7 +110477,7 @@ index 806eda1..125792c 100644
  	struct nfsd4_compoundres *resp = rqstp->rq_resp;
  	struct xdr_stream *xdr = &resp->xdr;
  	struct nfsd4_session *session;
-@@ -3060,8 +3066,9 @@ nfsd4_sequence_done(struct nfsd4_compoundres *resp)
+@@ -3039,8 +3045,9 @@ nfsd4_sequence_done(struct nfsd4_compoundres *resp)
  }
  
  __be32
@@ -110212,7 +110488,7 @@ index 806eda1..125792c 100644
  	struct nfs4_client *conf, *unconf;
  	struct nfs4_client *clp = NULL;
  	__be32 status = 0;
-@@ -3101,8 +3108,9 @@ out:
+@@ -3080,8 +3087,9 @@ out:
  }
  
  __be32
@@ -110223,7 +110499,7 @@ index 806eda1..125792c 100644
  	__be32 status = 0;
  
  	if (rc->rca_one_fs) {
-@@ -3139,8 +3147,9 @@ out:
+@@ -3118,8 +3126,9 @@ out:
  
  __be32
  nfsd4_setclientid(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
@@ -110234,7 +110510,7 @@ index 806eda1..125792c 100644
  	struct xdr_netobj 	clname = setclid->se_name;
  	nfs4_verifier		clverifier = setclid->se_verf;
  	struct nfs4_client	*conf, *new;
-@@ -3198,8 +3207,9 @@ out:
+@@ -3177,8 +3186,9 @@ out:
  __be32
  nfsd4_setclientid_confirm(struct svc_rqst *rqstp,
  			 struct nfsd4_compound_state *cstate,
@@ -110245,7 +110521,7 @@ index 806eda1..125792c 100644
  	struct nfs4_client *conf, *unconf;
  	struct nfs4_client *old = NULL;
  	nfs4_verifier confirm = setclientid_confirm->sc_confirm; 
-@@ -4443,8 +4453,9 @@ void nfsd4_cleanup_open_state(struct nfsd4_compound_state *cstate,
+@@ -4422,8 +4432,9 @@ void nfsd4_cleanup_open_state(struct nfsd4_compound_state *cstate,
  
  __be32
  nfsd4_renew(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
@@ -110256,7 +110532,7 @@ index 806eda1..125792c 100644
  	struct nfs4_client *clp;
  	__be32 status;
  	struct nfsd_net *nn = net_generic(SVC_NET(rqstp), nfsd_net_id);
-@@ -4894,8 +4905,9 @@ out:
+@@ -4873,8 +4884,9 @@ out:
   */
  __be32
  nfsd4_test_stateid(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
@@ -110267,7 +110543,7 @@ index 806eda1..125792c 100644
  	struct nfsd4_test_stateid_id *stateid;
  	struct nfs4_client *cl = cstate->session->se_client;
  
-@@ -4934,8 +4946,9 @@ out:
+@@ -4913,8 +4925,9 @@ out:
  
  __be32
  nfsd4_free_stateid(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
@@ -110278,7 +110554,7 @@ index 806eda1..125792c 100644
  	stateid_t *stateid = &free_stateid->fr_stateid;
  	struct nfs4_stid *s;
  	struct nfs4_delegation *dp;
-@@ -5063,8 +5076,9 @@ static __be32 nfs4_preprocess_confirmed_seqid_op(struct nfsd4_compound_state *cs
+@@ -5042,8 +5055,9 @@ static __be32 nfs4_preprocess_confirmed_seqid_op(struct nfsd4_compound_state *cs
  
  __be32
  nfsd4_open_confirm(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
@@ -110289,7 +110565,7 @@ index 806eda1..125792c 100644
  	__be32 status;
  	struct nfs4_openowner *oo;
  	struct nfs4_ol_stateid *stp;
-@@ -5132,8 +5146,9 @@ static inline void nfs4_stateid_downgrade(struct nfs4_ol_stateid *stp, u32 to_ac
+@@ -5111,8 +5125,9 @@ static inline void nfs4_stateid_downgrade(struct nfs4_ol_stateid *stp, u32 to_ac
  __be32
  nfsd4_open_downgrade(struct svc_rqst *rqstp,
  		     struct nfsd4_compound_state *cstate,
@@ -110300,7 +110576,7 @@ index 806eda1..125792c 100644
  	__be32 status;
  	struct nfs4_ol_stateid *stp;
  	struct nfsd_net *nn = net_generic(SVC_NET(rqstp), nfsd_net_id);
-@@ -5201,8 +5216,9 @@ static void nfsd4_close_open_stateid(struct nfs4_ol_stateid *s)
+@@ -5180,8 +5195,9 @@ static void nfsd4_close_open_stateid(struct nfs4_ol_stateid *s)
   */
  __be32
  nfsd4_close(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
@@ -110311,7 +110587,7 @@ index 806eda1..125792c 100644
  	__be32 status;
  	struct nfs4_ol_stateid *stp;
  	struct net *net = SVC_NET(rqstp);
-@@ -5231,8 +5247,9 @@ out:
+@@ -5210,8 +5226,9 @@ out:
  
  __be32
  nfsd4_delegreturn(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
@@ -110322,7 +110598,7 @@ index 806eda1..125792c 100644
  	struct nfs4_delegation *dp;
  	stateid_t *stateid = &dr->dr_stateid;
  	struct nfs4_stid *s;
-@@ -5583,8 +5600,9 @@ out:
+@@ -5562,8 +5579,9 @@ out:
   */
  __be32
  nfsd4_lock(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
@@ -110333,7 +110609,7 @@ index 806eda1..125792c 100644
  	struct nfs4_openowner *open_sop = NULL;
  	struct nfs4_lockowner *lock_sop = NULL;
  	struct nfs4_ol_stateid *lock_stp = NULL;
-@@ -5785,8 +5803,9 @@ static __be32 nfsd_test_lock(struct svc_rqst *rqstp, struct svc_fh *fhp, struct
+@@ -5764,8 +5782,9 @@ static __be32 nfsd_test_lock(struct svc_rqst *rqstp, struct svc_fh *fhp, struct
   */
  __be32
  nfsd4_lockt(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
@@ -110344,7 +110620,7 @@ index 806eda1..125792c 100644
  	struct file_lock *file_lock = NULL;
  	struct nfs4_lockowner *lo = NULL;
  	__be32 status;
-@@ -5858,8 +5877,9 @@ out:
+@@ -5837,8 +5856,9 @@ out:
  
  __be32
  nfsd4_locku(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
@@ -110355,7 +110631,7 @@ index 806eda1..125792c 100644
  	struct nfs4_ol_stateid *stp;
  	struct file *filp = NULL;
  	struct file_lock *file_lock = NULL;
-@@ -5965,8 +5985,9 @@ check_for_locks(struct nfs4_file *fp, struct nfs4_lockowner *lowner)
+@@ -5944,8 +5964,9 @@ check_for_locks(struct nfs4_file *fp, struct nfs4_lockowner *lowner)
  __be32
  nfsd4_release_lockowner(struct svc_rqst *rqstp,
  			struct nfsd4_compound_state *cstate,
@@ -110366,7 +110642,7 @@ index 806eda1..125792c 100644
  	clientid_t *clid = &rlockowner->rl_clientid;
  	struct nfs4_stateowner *sop;
  	struct nfs4_lockowner *lo = NULL;
-@@ -6910,26 +6931,34 @@ clear_current_stateid(struct nfsd4_compound_state *cstate)
+@@ -6904,26 +6925,34 @@ clear_current_stateid(struct nfsd4_compound_state *cstate)
   * functions to set current state id
   */
  void
@@ -110405,7 +110681,7 @@ index 806eda1..125792c 100644
  	put_stateid(cstate, &lock->lk_resp_stateid);
  }
  
-@@ -6938,49 +6967,65 @@ nfsd4_set_lockstateid(struct nfsd4_compound_state *cstate, struct nfsd4_lock *lo
+@@ -6932,49 +6961,65 @@ nfsd4_set_lockstateid(struct nfsd4_compound_state *cstate, struct nfsd4_lock *lo
   */
  
  void
@@ -114098,7 +114374,7 @@ index 88c7de1..3e4b510 100644
  static struct pid *
  get_children_pid(struct inode *inode, struct pid *pid_prev, loff_t pos)
 diff --git a/fs/proc/base.c b/fs/proc/base.c
-index a11eb71..d48ca0e 100644
+index 7583df7..d0091f3 100644
 --- a/fs/proc/base.c
 +++ b/fs/proc/base.c
 @@ -113,6 +113,14 @@ struct pid_entry {
@@ -114368,7 +114644,7 @@ index a11eb71..d48ca0e 100644
  
  		if (src >= (env_end - env_start))
  			break;
-@@ -1584,7 +1690,7 @@ static const char *proc_pid_get_link(struct dentry *dentry,
+@@ -1579,7 +1685,7 @@ static const char *proc_pid_get_link(struct dentry *dentry,
  		return ERR_PTR(-ECHILD);
  
  	/* Are we allowed to snoop on the tasks file descriptors? */
@@ -114377,7 +114653,7 @@ index a11eb71..d48ca0e 100644
  		goto out;
  
  	error = PROC_I(inode)->op.proc_get_link(dentry, &path);
-@@ -1628,8 +1734,18 @@ static int proc_pid_readlink(struct dentry * dentry, char __user * buffer, int b
+@@ -1623,8 +1729,18 @@ static int proc_pid_readlink(struct dentry * dentry, char __user * buffer, int b
  	struct path path;
  
  	/* Are we allowed to snoop on the tasks file descriptors? */
@@ -114398,7 +114674,7 @@ index a11eb71..d48ca0e 100644
  
  	error = PROC_I(inode)->op.proc_get_link(dentry, &path);
  	if (error)
-@@ -1679,7 +1795,11 @@ struct inode *proc_pid_make_inode(struct super_block * sb, struct task_struct *t
+@@ -1674,7 +1790,11 @@ struct inode *proc_pid_make_inode(struct super_block * sb, struct task_struct *t
  		rcu_read_lock();
  		cred = __task_cred(task);
  		inode->i_uid = cred->euid;
@@ -114410,7 +114686,7 @@ index a11eb71..d48ca0e 100644
  		rcu_read_unlock();
  	}
  	security_task_to_inode(task, inode);
-@@ -1715,10 +1835,19 @@ int pid_getattr(struct vfsmount *mnt, struct dentry *dentry, struct kstat *stat)
+@@ -1710,10 +1830,19 @@ int pid_getattr(struct vfsmount *mnt, struct dentry *dentry, struct kstat *stat)
  			return -ENOENT;
  		}
  		if ((inode->i_mode == (S_IFDIR|S_IRUGO|S_IXUGO)) ||
@@ -114430,7 +114706,7 @@ index a11eb71..d48ca0e 100644
  		}
  	}
  	rcu_read_unlock();
-@@ -1756,11 +1885,20 @@ int pid_revalidate(struct dentry *dentry, unsigned int flags)
+@@ -1751,11 +1880,20 @@ int pid_revalidate(struct dentry *dentry, unsigned int flags)
  
  	if (task) {
  		if ((inode->i_mode == (S_IFDIR|S_IRUGO|S_IXUGO)) ||
@@ -114451,7 +114727,7 @@ index a11eb71..d48ca0e 100644
  			rcu_read_unlock();
  		} else {
  			inode->i_uid = GLOBAL_ROOT_UID;
-@@ -2374,6 +2512,9 @@ static struct dentry *proc_pident_lookup(struct inode *dir,
+@@ -2369,6 +2507,9 @@ static struct dentry *proc_pident_lookup(struct inode *dir,
  	if (!task)
  		goto out_no_task;
  
@@ -114461,7 +114737,7 @@ index a11eb71..d48ca0e 100644
  	/*
  	 * Yes, it does not scale. And it should not. Don't add
  	 * new entries into /proc/<tgid>/ without very good reasons.
-@@ -2404,6 +2545,9 @@ static int proc_pident_readdir(struct file *file, struct dir_context *ctx,
+@@ -2399,6 +2540,9 @@ static int proc_pident_readdir(struct file *file, struct dir_context *ctx,
  	if (!task)
  		return -ENOENT;
  
@@ -114471,7 +114747,7 @@ index a11eb71..d48ca0e 100644
  	if (!dir_emit_dots(file, ctx))
  		goto out;
  
-@@ -2816,7 +2960,9 @@ static const struct inode_operations proc_task_inode_operations;
+@@ -2811,7 +2955,9 @@ static const struct inode_operations proc_task_inode_operations;
  static const struct pid_entry tgid_base_stuff[] = {
  	DIR("task",       S_IRUGO|S_IXUGO, proc_task_inode_operations, proc_task_operations),
  	DIR("fd",         S_IRUSR|S_IXUSR, proc_fd_inode_operations, proc_fd_operations),
@@ -114481,7 +114757,7 @@ index a11eb71..d48ca0e 100644
  	DIR("fdinfo",     S_IRUSR|S_IXUSR, proc_fdinfo_inode_operations, proc_fdinfo_operations),
  	DIR("ns",	  S_IRUSR|S_IXUGO, proc_ns_dir_inode_operations, proc_ns_dir_operations),
  #ifdef CONFIG_NET
-@@ -2834,7 +2980,7 @@ static const struct pid_entry tgid_base_stuff[] = {
+@@ -2829,7 +2975,7 @@ static const struct pid_entry tgid_base_stuff[] = {
  	REG("autogroup",  S_IRUGO|S_IWUSR, proc_pid_sched_autogroup_operations),
  #endif
  	REG("comm",      S_IRUGO|S_IWUSR, proc_pid_set_comm_operations),
@@ -114490,7 +114766,7 @@ index a11eb71..d48ca0e 100644
  	ONE("syscall",    S_IRUSR, proc_pid_syscall),
  #endif
  	REG("cmdline",    S_IRUGO, proc_pid_cmdline_ops),
-@@ -2859,10 +3005,10 @@ static const struct pid_entry tgid_base_stuff[] = {
+@@ -2854,10 +3000,10 @@ static const struct pid_entry tgid_base_stuff[] = {
  #ifdef CONFIG_SECURITY
  	DIR("attr",       S_IRUGO|S_IXUGO, proc_attr_dir_inode_operations, proc_attr_dir_operations),
  #endif
@@ -114503,7 +114779,7 @@ index a11eb71..d48ca0e 100644
  	ONE("stack",      S_IRUSR, proc_pid_stack),
  #endif
  #ifdef CONFIG_SCHED_INFO
-@@ -2896,6 +3042,9 @@ static const struct pid_entry tgid_base_stuff[] = {
+@@ -2891,6 +3037,9 @@ static const struct pid_entry tgid_base_stuff[] = {
  #ifdef CONFIG_HARDWALL
  	ONE("hardwall",   S_IRUGO, proc_pid_hardwall),
  #endif
@@ -114513,7 +114789,7 @@ index a11eb71..d48ca0e 100644
  #ifdef CONFIG_USER_NS
  	REG("uid_map",    S_IRUGO|S_IWUSR, proc_uid_map_operations),
  	REG("gid_map",    S_IRUGO|S_IWUSR, proc_gid_map_operations),
-@@ -3029,7 +3178,14 @@ static int proc_pid_instantiate(struct inode *dir,
+@@ -3024,7 +3173,14 @@ static int proc_pid_instantiate(struct inode *dir,
  	if (!inode)
  		goto out;
  
@@ -114528,7 +114804,7 @@ index a11eb71..d48ca0e 100644
  	inode->i_op = &proc_tgid_base_inode_operations;
  	inode->i_fop = &proc_tgid_base_operations;
  	inode->i_flags|=S_IMMUTABLE;
-@@ -3067,7 +3223,11 @@ struct dentry *proc_pid_lookup(struct inode *dir, struct dentry * dentry, unsign
+@@ -3062,7 +3218,11 @@ struct dentry *proc_pid_lookup(struct inode *dir, struct dentry * dentry, unsign
  	if (!task)
  		goto out;
  
@@ -114540,7 +114816,7 @@ index a11eb71..d48ca0e 100644
  	put_task_struct(task);
  out:
  	return ERR_PTR(result);
-@@ -3221,7 +3381,7 @@ static const struct pid_entry tid_base_stuff[] = {
+@@ -3216,7 +3376,7 @@ static const struct pid_entry tid_base_stuff[] = {
  	NOD("comm",      S_IFREG|S_IRUGO|S_IWUSR,
  			 &proc_tid_comm_inode_operations,
  			 &proc_pid_set_comm_operations, {}),
@@ -114549,7 +114825,7 @@ index a11eb71..d48ca0e 100644
  	ONE("syscall",   S_IRUSR, proc_pid_syscall),
  #endif
  	REG("cmdline",   S_IRUGO, proc_pid_cmdline_ops),
-@@ -3248,10 +3408,10 @@ static const struct pid_entry tid_base_stuff[] = {
+@@ -3243,10 +3403,10 @@ static const struct pid_entry tid_base_stuff[] = {
  #ifdef CONFIG_SECURITY
  	DIR("attr",      S_IRUGO|S_IXUGO, proc_attr_dir_inode_operations, proc_attr_dir_operations),
  #endif
@@ -128944,10 +129220,10 @@ index af0254c..a4e4da3 100644
  extern char __per_cpu_load[], __per_cpu_start[], __per_cpu_end[];
  extern char __kprobes_text_start[], __kprobes_text_end[];
 diff --git a/include/asm-generic/uaccess.h b/include/asm-generic/uaccess.h
-index 1bfa602..aab89b1 100644
+index 32901d1..5fa5a13 100644
 --- a/include/asm-generic/uaccess.h
 +++ b/include/asm-generic/uaccess.h
-@@ -345,4 +345,20 @@ clear_user(void __user *to, unsigned long n)
+@@ -351,4 +351,20 @@ clear_user(void __user *to, unsigned long n)
  	return __clear_user(to, n);
  }
  
@@ -130502,10 +130778,10 @@ index 71c1b21..529a781 100644
  extern struct dma_map_ops dma_noop_ops;
  
 diff --git a/include/linux/efi.h b/include/linux/efi.h
-index f196dd0..bbcc416 100644
+index 17fd2c5..a48e2bb 100644
 --- a/include/linux/efi.h
 +++ b/include/linux/efi.h
-@@ -1184,6 +1184,7 @@ struct efivar_operations {
+@@ -1193,6 +1193,7 @@ struct efivar_operations {
  	efi_set_variable_t *set_variable_nonblocking;
  	efi_query_variable_store_t *query_variable_store;
  };
@@ -132479,7 +132755,7 @@ index 1eee6bc..9cf4912 100644
  extern struct ipc_namespace init_ipc_ns;
  extern atomic_t nr_ipc_ns;
 diff --git a/include/linux/irq.h b/include/linux/irq.h
-index 4d758a7..f6ce482 100644
+index cbb5a2c..276804f 100644
 --- a/include/linux/irq.h
 +++ b/include/linux/irq.h
 @@ -399,7 +399,10 @@ struct irq_chip {
@@ -133198,7 +133474,7 @@ index 093607f..9717227 100644
  	register_memory_notifier(&fn##_mem_nb);			\
  })
 diff --git a/include/linux/mempolicy.h b/include/linux/mempolicy.h
-index 4429d25..ae5ab54 100644
+index 5e5b296..629113f 100644
 --- a/include/linux/mempolicy.h
 +++ b/include/linux/mempolicy.h
 @@ -91,6 +91,10 @@ static inline struct mempolicy *mpol_dup(struct mempolicy *pol)
@@ -133212,7 +133488,7 @@ index 4429d25..ae5ab54 100644
  
  static inline void mpol_get(struct mempolicy *pol)
  {
-@@ -235,6 +239,9 @@ mpol_shared_policy_lookup(struct shared_policy *sp, unsigned long idx)
+@@ -236,6 +240,9 @@ mpol_shared_policy_lookup(struct shared_policy *sp, unsigned long idx)
  }
  
  #define vma_policy(vma) NULL
@@ -133223,7 +133499,7 @@ index 4429d25..ae5ab54 100644
  static inline int
  vma_dup_policy(struct vm_area_struct *src, struct vm_area_struct *dst)
 diff --git a/include/linux/mm.h b/include/linux/mm.h
-index ece042d..8115afb 100644
+index 317564b..3e200b9 100644
 --- a/include/linux/mm.h
 +++ b/include/linux/mm.h
 @@ -107,6 +107,7 @@ extern int mmap_rnd_compat_bits __read_mostly;
@@ -133416,7 +133692,7 @@ index ece042d..8115afb 100644
  	if (rlim < RLIM_INFINITY) {
  		if (((new - start) + (end_data - start_data)) > rlim)
  			return -ENOSPC;
-@@ -1996,6 +2012,7 @@ extern unsigned long do_mmap(struct file *file, unsigned long addr,
+@@ -1997,6 +2013,7 @@ extern unsigned long do_mmap(struct file *file, unsigned long addr,
  	unsigned long len, unsigned long prot, unsigned long flags,
  	vm_flags_t vm_flags, unsigned long pgoff, unsigned long *populate);
  extern int do_munmap(struct mm_struct *, unsigned long, size_t);
@@ -133424,7 +133700,7 @@ index ece042d..8115afb 100644
  
  static inline unsigned long
  do_mmap_pgoff(struct file *file, unsigned long addr,
-@@ -2032,10 +2049,11 @@ struct vm_unmapped_area_info {
+@@ -2033,10 +2050,11 @@ struct vm_unmapped_area_info {
  	unsigned long high_limit;
  	unsigned long align_mask;
  	unsigned long align_offset;
@@ -133438,7 +133714,7 @@ index ece042d..8115afb 100644
  
  /*
   * Search for an unmapped address range.
-@@ -2047,7 +2065,7 @@ extern unsigned long unmapped_area_topdown(struct vm_unmapped_area_info *info);
+@@ -2048,7 +2066,7 @@ extern unsigned long unmapped_area_topdown(struct vm_unmapped_area_info *info);
   * - satisfies (begin_addr & align_mask) == (align_offset & align_mask)
   */
  static inline unsigned long
@@ -133447,7 +133723,7 @@ index ece042d..8115afb 100644
  {
  	if (info->flags & VM_UNMAPPED_AREA_TOPDOWN)
  		return unmapped_area_topdown(info);
-@@ -2107,6 +2125,10 @@ extern struct vm_area_struct * find_vma(struct mm_struct * mm, unsigned long add
+@@ -2108,6 +2126,10 @@ extern struct vm_area_struct * find_vma(struct mm_struct * mm, unsigned long add
  extern struct vm_area_struct * find_vma_prev(struct mm_struct * mm, unsigned long addr,
  					     struct vm_area_struct **pprev);
  
@@ -133458,7 +133734,7 @@ index ece042d..8115afb 100644
  /* Look up the first VMA which intersects the interval start_addr..end_addr-1,
     NULL if none.  Assume start_addr < end_addr. */
  static inline struct vm_area_struct * find_vma_intersection(struct mm_struct * mm, unsigned long start_addr, unsigned long end_addr)
-@@ -2136,10 +2158,10 @@ static inline struct vm_area_struct *find_exact_vma(struct mm_struct *mm,
+@@ -2137,10 +2159,10 @@ static inline struct vm_area_struct *find_exact_vma(struct mm_struct *mm,
  }
  
  #ifdef CONFIG_MMU
@@ -133471,7 +133747,7 @@ index ece042d..8115afb 100644
  {
  	return __pgprot(0);
  }
-@@ -2322,7 +2344,7 @@ extern int get_hwpoison_page(struct page *page);
+@@ -2323,7 +2345,7 @@ extern int get_hwpoison_page(struct page *page);
  extern int sysctl_memory_failure_early_kill;
  extern int sysctl_memory_failure_recovery;
  extern void shake_page(struct page *p, int access);
@@ -133480,7 +133756,7 @@ index ece042d..8115afb 100644
  extern int soft_offline_page(struct page *page, int flags);
  
  
-@@ -2410,5 +2432,11 @@ void __init setup_nr_node_ids(void);
+@@ -2411,5 +2433,11 @@ void __init setup_nr_node_ids(void);
  static inline void setup_nr_node_ids(void) {}
  #endif
  
@@ -133870,7 +134146,7 @@ index 25aa03b..9817031 100644
  struct iovec;
  struct kvec;
 diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
-index da4b33b..0ae34af 100644
+index 4f0e6fb..2f980dd 100644
 --- a/include/linux/netdevice.h
 +++ b/include/linux/netdevice.h
 @@ -1290,6 +1290,7 @@ struct net_device_ops {
@@ -133903,7 +134179,7 @@ index da4b33b..0ae34af 100644
  
  #ifdef CONFIG_WIRELESS_EXT
  	const struct iw_handler_def *wireless_handlers;
-@@ -4152,7 +4153,7 @@ static inline bool netif_reduces_vlan_mtu(struct net_device *dev)
+@@ -4153,7 +4154,7 @@ static inline bool netif_reduces_vlan_mtu(struct net_device *dev)
  	return dev->priv_flags & IFF_MACSEC;
  }
  
@@ -137045,7 +137321,7 @@ index 5122b5e..598b440 100644
  void v9fs_register_trans(struct p9_trans_module *m);
  void v9fs_unregister_trans(struct p9_trans_module *m);
 diff --git a/include/net/af_unix.h b/include/net/af_unix.h
-index 9b4c418..f3ff431 100644
+index fd60ecc..64e2a1e 100644
 --- a/include/net/af_unix.h
 +++ b/include/net/af_unix.h
 @@ -36,7 +36,7 @@ struct unix_skb_parms {
@@ -137951,7 +138227,7 @@ index ff5be7e..598bf64 100644
  
  void __sock_recv_timestamp(struct msghdr *msg, struct sock *sk,
 diff --git a/include/net/tcp.h b/include/net/tcp.h
-index 0bcc70f..5c46882 100644
+index 7254051..1f9ddac 100644
 --- a/include/net/tcp.h
 +++ b/include/net/tcp.h
 @@ -543,7 +543,7 @@ void tcp_retransmit_timer(struct sock *sk);
@@ -137983,7 +138259,7 @@ index 0bcc70f..5c46882 100644
  	union {
  		struct {
  			/* There is space for up to 20 bytes */
-@@ -1869,7 +1869,7 @@ static inline void tcp_segs_in(struct tcp_sock *tp, const struct sk_buff *skb)
+@@ -1871,7 +1871,7 @@ static inline void tcp_segs_in(struct tcp_sock *tp, const struct sk_buff *skb)
   */
  static inline void tcp_listendrop(const struct sock *sk)
  {
@@ -140505,7 +140781,7 @@ index 8c50276..457c599 100644
  	pagefault_disable();
  	result = __get_user(opcode, (uprobe_opcode_t __user *)vaddr);
 diff --git a/kernel/exit.c b/kernel/exit.c
-index 9e6e135..4af378d 100644
+index 26a766a..b802979 100644
 --- a/kernel/exit.c
 +++ b/kernel/exit.c
 @@ -170,6 +170,10 @@ void release_task(struct task_struct *p)
@@ -140566,7 +140842,7 @@ index 9e6e135..4af378d 100644
  	exit_mm(tsk);
  
  	if (group_dead)
-@@ -851,7 +860,7 @@ SYSCALL_DEFINE1(exit, int, error_code)
+@@ -846,7 +855,7 @@ SYSCALL_DEFINE1(exit, int, error_code)
   * Take down every thread in the group.  This is called by fatal signals
   * as well as by sys_exit_group (below).
   */
@@ -140575,7 +140851,7 @@ index 9e6e135..4af378d 100644
  do_group_exit(int exit_code)
  {
  	struct signal_struct *sig = current->signal;
-@@ -979,6 +988,7 @@ static int wait_noreap_copyout(struct wait_opts *wo, struct task_struct *p,
+@@ -974,6 +983,7 @@ static int wait_noreap_copyout(struct wait_opts *wo, struct task_struct *p,
   * the lock and this task is uninteresting.  If we return nonzero, we have
   * released the lock and the system call should return.
   */
@@ -140583,7 +140859,7 @@ index 9e6e135..4af378d 100644
  static int wait_task_zombie(struct wait_opts *wo, struct task_struct *p)
  {
  	int state, retval, status;
-@@ -995,6 +1005,7 @@ static int wait_task_zombie(struct wait_opts *wo, struct task_struct *p)
+@@ -990,6 +1000,7 @@ static int wait_task_zombie(struct wait_opts *wo, struct task_struct *p)
  
  		get_task_struct(p);
  		read_unlock(&tasklist_lock);
@@ -140591,7 +140867,7 @@ index 9e6e135..4af378d 100644
  		sched_annotate_sleep();
  
  		if ((exit_code & 0x7f) == 0) {
-@@ -1017,6 +1028,7 @@ static int wait_task_zombie(struct wait_opts *wo, struct task_struct *p)
+@@ -1012,6 +1023,7 @@ static int wait_task_zombie(struct wait_opts *wo, struct task_struct *p)
  	 * We own this thread, nobody else can reap it.
  	 */
  	read_unlock(&tasklist_lock);
@@ -140599,7 +140875,7 @@ index 9e6e135..4af378d 100644
  	sched_annotate_sleep();
  
  	/*
-@@ -1159,6 +1171,8 @@ static int *task_stopped_code(struct task_struct *p, bool ptrace)
+@@ -1154,6 +1166,8 @@ static int *task_stopped_code(struct task_struct *p, bool ptrace)
   * search should terminate.
   */
  static int wait_task_stopped(struct wait_opts *wo,
@@ -140608,7 +140884,7 @@ index 9e6e135..4af378d 100644
  				int ptrace, struct task_struct *p)
  {
  	struct siginfo __user *infop;
-@@ -1206,6 +1220,7 @@ unlock_sig:
+@@ -1201,6 +1215,7 @@ unlock_sig:
  	pid = task_pid_vnr(p);
  	why = ptrace ? CLD_TRAPPED : CLD_STOPPED;
  	read_unlock(&tasklist_lock);
@@ -140616,7 +140892,7 @@ index 9e6e135..4af378d 100644
  	sched_annotate_sleep();
  
  	if (unlikely(wo->wo_flags & WNOWAIT))
-@@ -1243,6 +1258,7 @@ unlock_sig:
+@@ -1238,6 +1253,7 @@ unlock_sig:
   * the lock and this task is uninteresting.  If we return nonzero, we have
   * released the lock and the system call should return.
   */
@@ -140624,7 +140900,7 @@ index 9e6e135..4af378d 100644
  static int wait_task_continued(struct wait_opts *wo, struct task_struct *p)
  {
  	int retval;
-@@ -1269,6 +1285,7 @@ static int wait_task_continued(struct wait_opts *wo, struct task_struct *p)
+@@ -1264,6 +1280,7 @@ static int wait_task_continued(struct wait_opts *wo, struct task_struct *p)
  	pid = task_pid_vnr(p);
  	get_task_struct(p);
  	read_unlock(&tasklist_lock);
@@ -140632,7 +140908,7 @@ index 9e6e135..4af378d 100644
  	sched_annotate_sleep();
  
  	if (!wo->wo_info) {
-@@ -1298,6 +1315,8 @@ static int wait_task_continued(struct wait_opts *wo, struct task_struct *p)
+@@ -1293,6 +1310,8 @@ static int wait_task_continued(struct wait_opts *wo, struct task_struct *p)
   * or another error from security_task_wait(), or still -ECHILD.
   */
  static int wait_consider_task(struct wait_opts *wo, int ptrace,
@@ -140641,7 +140917,7 @@ index 9e6e135..4af378d 100644
  				struct task_struct *p)
  {
  	/*
-@@ -1423,6 +1442,7 @@ static int wait_consider_task(struct wait_opts *wo, int ptrace,
+@@ -1418,6 +1437,7 @@ static int wait_consider_task(struct wait_opts *wo, int ptrace,
   * ->notask_error is 0 if there were any eligible children,
   * or another error from security_task_wait(), or still -ECHILD.
   */
@@ -140649,7 +140925,7 @@ index 9e6e135..4af378d 100644
  static int do_wait_thread(struct wait_opts *wo, struct task_struct *tsk)
  {
  	struct task_struct *p;
-@@ -1437,6 +1457,7 @@ static int do_wait_thread(struct wait_opts *wo, struct task_struct *tsk)
+@@ -1432,6 +1452,7 @@ static int do_wait_thread(struct wait_opts *wo, struct task_struct *tsk)
  	return 0;
  }
  
@@ -140657,7 +140933,7 @@ index 9e6e135..4af378d 100644
  static int ptrace_do_wait(struct wait_opts *wo, struct task_struct *tsk)
  {
  	struct task_struct *p;
-@@ -1500,12 +1521,16 @@ repeat:
+@@ -1495,12 +1516,16 @@ repeat:
  	tsk = current;
  	do {
  		retval = do_wait_thread(wo, tsk);
@@ -140714,7 +140990,7 @@ index e820cce..72195de 100644
  
  /* Given an address, look for it in the exception tables. */
 diff --git a/kernel/fork.c b/kernel/fork.c
-index aea4f4d..59d599e 100644
+index 74fd390..597bfcb 100644
 --- a/kernel/fork.c
 +++ b/kernel/fork.c
 @@ -197,12 +197,55 @@ static void free_thread_stack(unsigned long *stack)
@@ -141054,7 +141330,7 @@ index aea4f4d..59d599e 100644
  }
  
  static inline int mm_alloc_pgd(struct mm_struct *mm)
-@@ -836,8 +940,8 @@ struct mm_struct *mm_access(struct task_struct *task, unsigned int mode)
+@@ -859,8 +963,8 @@ struct mm_struct *mm_access(struct task_struct *task, unsigned int mode)
  		return ERR_PTR(err);
  
  	mm = get_task_mm(task);
@@ -141065,7 +141341,7 @@ index aea4f4d..59d599e 100644
  		mmput(mm);
  		mm = ERR_PTR(-EACCES);
  	}
-@@ -1038,13 +1142,20 @@ static int copy_fs(unsigned long clone_flags, struct task_struct *tsk)
+@@ -1061,13 +1165,20 @@ static int copy_fs(unsigned long clone_flags, struct task_struct *tsk)
  			spin_unlock(&fs->lock);
  			return -EAGAIN;
  		}
@@ -141087,7 +141363,7 @@ index aea4f4d..59d599e 100644
  	return 0;
  }
  
-@@ -1277,7 +1388,7 @@ init_task_pid(struct task_struct *task, enum pid_type type, struct pid *pid)
+@@ -1300,7 +1411,7 @@ init_task_pid(struct task_struct *task, enum pid_type type, struct pid *pid)
   * parts of the process environment (as per the clone
   * flags). The actual kick-off is left to the caller.
   */
@@ -141096,7 +141372,7 @@ index aea4f4d..59d599e 100644
  					unsigned long stack_start,
  					unsigned long stack_size,
  					int __user *child_tidptr,
-@@ -1349,6 +1460,9 @@ static struct task_struct *copy_process(unsigned long clone_flags,
+@@ -1372,6 +1483,9 @@ static struct task_struct *copy_process(unsigned long clone_flags,
  	DEBUG_LOCKS_WARN_ON(!p->softirqs_enabled);
  #endif
  	retval = -EAGAIN;
@@ -141106,7 +141382,7 @@ index aea4f4d..59d599e 100644
  	if (atomic_read(&p->real_cred->user->processes) >=
  			task_rlimit(p, RLIMIT_NPROC)) {
  		if (p->real_cred->user != INIT_USER &&
-@@ -1607,6 +1721,16 @@ static struct task_struct *copy_process(unsigned long clone_flags,
+@@ -1630,6 +1744,16 @@ static struct task_struct *copy_process(unsigned long clone_flags,
  		goto bad_fork_cancel_cgroup;
  	}
  
@@ -141123,7 +141399,7 @@ index aea4f4d..59d599e 100644
  	if (likely(p->pid)) {
  		ptrace_init_task(p, (clone_flags & CLONE_PTRACE) || trace);
  
-@@ -1698,6 +1822,8 @@ bad_fork_cleanup_count:
+@@ -1721,6 +1845,8 @@ bad_fork_cleanup_count:
  bad_fork_free:
  	free_task(p);
  fork_out:
@@ -141132,7 +141408,7 @@ index aea4f4d..59d599e 100644
  	return ERR_PTR(retval);
  }
  
-@@ -1761,6 +1887,7 @@ long _do_fork(unsigned long clone_flags,
+@@ -1784,6 +1910,7 @@ long _do_fork(unsigned long clone_flags,
  
  	p = copy_process(clone_flags, stack_start, stack_size,
  			 child_tidptr, NULL, trace, tls, NUMA_NO_NODE);
@@ -141140,7 +141416,7 @@ index aea4f4d..59d599e 100644
  	/*
  	 * Do this prior waking up the new thread - the thread pointer
  	 * might get invalid after that point, if the thread exits quickly.
-@@ -1777,6 +1904,8 @@ long _do_fork(unsigned long clone_flags,
+@@ -1800,6 +1927,8 @@ long _do_fork(unsigned long clone_flags,
  		if (clone_flags & CLONE_PARENT_SETTID)
  			put_user(nr, parent_tidptr);
  
@@ -141149,7 +141425,7 @@ index aea4f4d..59d599e 100644
  		if (clone_flags & CLONE_VFORK) {
  			p->vfork_done = &vfork;
  			init_completion(&vfork);
-@@ -1913,7 +2042,7 @@ void __init proc_caches_init(void)
+@@ -1936,7 +2065,7 @@ void __init proc_caches_init(void)
  			sizeof(struct mm_struct), ARCH_MIN_MMSTRUCT_ALIGN,
  			SLAB_HWCACHE_ALIGN|SLAB_PANIC|SLAB_NOTRACK|SLAB_ACCOUNT,
  			NULL);
@@ -141158,7 +141434,7 @@ index aea4f4d..59d599e 100644
  	mmap_init();
  	nsproxy_cache_init();
  }
-@@ -1961,7 +2090,7 @@ static int unshare_fs(unsigned long unshare_flags, struct fs_struct **new_fsp)
+@@ -1984,7 +2113,7 @@ static int unshare_fs(unsigned long unshare_flags, struct fs_struct **new_fsp)
  		return 0;
  
  	/* don't need lock here; in the worst case we'll do useless copy */
@@ -141167,7 +141443,7 @@ index aea4f4d..59d599e 100644
  		return 0;
  
  	*new_fsp = copy_fs_struct(fs);
-@@ -2074,7 +2203,8 @@ SYSCALL_DEFINE1(unshare, unsigned long, unshare_flags)
+@@ -2097,7 +2226,8 @@ SYSCALL_DEFINE1(unshare, unsigned long, unshare_flags)
  			fs = current->fs;
  			spin_lock(&fs->lock);
  			current->fs = new_fs;
@@ -141177,7 +141453,7 @@ index aea4f4d..59d599e 100644
  				new_fs = NULL;
  			else
  				new_fs = fs;
-@@ -2138,7 +2268,7 @@ int unshare_files(struct files_struct **displaced)
+@@ -2161,7 +2291,7 @@ int unshare_files(struct files_struct **displaced)
  int sysctl_max_threads(struct ctl_table *table, int write,
  		       void __user *buffer, size_t *lenp, loff_t *ppos)
  {
@@ -141267,7 +141543,7 @@ index ef0bc02..2c983f5 100644
  			irq_wake_secondary(desc, action);
  
 diff --git a/kernel/irq/msi.c b/kernel/irq/msi.c
-index 0afe671..244f89c 100644
+index 6143b2f..87ffe77 100644
 --- a/kernel/irq/msi.c
 +++ b/kernel/irq/msi.c
 @@ -214,16 +214,18 @@ static void msi_domain_update_dom_ops(struct msi_domain_info *info)
@@ -143098,18 +143374,46 @@ index a65ba13..f600dbb 100644
  	if (write && !ns_capable(pid_ns->user_ns, CAP_SYS_ADMIN))
  		return -EPERM;
 diff --git a/kernel/power/Kconfig b/kernel/power/Kconfig
-index 68d3ebc..82bb833 100644
+index 68d3ebc..554935d 100644
 --- a/kernel/power/Kconfig
 +++ b/kernel/power/Kconfig
-@@ -34,6 +34,8 @@ config HIBERNATE_CALLBACKS
+@@ -34,6 +34,7 @@ config HIBERNATE_CALLBACKS
  config HIBERNATION
  	bool "Hibernation (aka 'suspend to disk')"
  	depends on SWAP && ARCH_HIBERNATION_POSSIBLE
 +	depends on !GRKERNSEC_KMEM
-+	depends on !PAX_MEMORY_SANITIZE
  	select HIBERNATE_CALLBACKS
  	select LZO_COMPRESS
  	select LZO_DECOMPRESS
+diff --git a/kernel/power/hibernate.c b/kernel/power/hibernate.c
+index fca9254..a40591f 100644
+--- a/kernel/power/hibernate.c
++++ b/kernel/power/hibernate.c
+@@ -305,8 +305,10 @@ static int create_image(int platform_mode)
+ 			error);
+ 	/* Restore control flow magically appears here */
+ 	restore_processor_state();
+-	if (!in_suspend)
++	if (!in_suspend) {
+ 		events_check_enabled = false;
++		clear_free_pages();
++	}
+ 
+ 	platform_leave(platform_mode);
+ 
+diff --git a/kernel/power/power.h b/kernel/power/power.h
+index efe1b3b..cd674b2 100644
+--- a/kernel/power/power.h
++++ b/kernel/power/power.h
+@@ -101,6 +101,8 @@ extern int create_basic_memory_bitmaps(void);
+ extern void free_basic_memory_bitmaps(void);
+ extern int hibernate_preallocate_memory(void);
+ 
++extern void clear_free_pages(void);
++
+ /**
+  *	Auxiliary structure used for reading the snapshot image data and
+  *	metadata from and writing them to the list of page backup entries
 diff --git a/kernel/power/process.c b/kernel/power/process.c
 index 0c2ee97..63229a6 100644
 --- a/kernel/power/process.c
@@ -143153,6 +143457,37 @@ index 0c2ee97..63229a6 100644
  			break;
  
  		if (pm_wakeup_pending()) {
+diff --git a/kernel/power/snapshot.c b/kernel/power/snapshot.c
+index 3a97060..12c1d4e 100644
+--- a/kernel/power/snapshot.c
++++ b/kernel/power/snapshot.c
+@@ -1032,6 +1032,26 @@ void free_basic_memory_bitmaps(void)
+ 	pr_debug("PM: Basic memory bitmaps freed\n");
+ }
+ 
++void clear_free_pages(void)
++{
++	struct memory_bitmap *bm = free_pages_map;
++	unsigned long pfn;
++
++	if (WARN_ON(!(free_pages_map)))
++		return;
++
++	memory_bm_position_reset(bm);
++	pfn = memory_bm_next_pfn(bm);
++	while (pfn != BM_END_OF_MAP) {
++		if (pfn_valid(pfn))
++			clear_highpage(pfn_to_page(pfn));
++
++		pfn = memory_bm_next_pfn(bm);
++	}
++	memory_bm_position_reset(bm);
++	pr_info("PM: free pages cleared after restore\n");
++}
++
+ /**
+  *	snapshot_additional_pages - estimate the number of additional pages
+  *	be needed for setting up the suspend image data structures for given
 diff --git a/kernel/printk/printk.c b/kernel/printk/printk.c
 index 60cdf63..eab5721 100644
 --- a/kernel/printk/printk.c
@@ -143956,10 +144291,10 @@ index a5d966c..9c2d28b 100644
  #ifdef CONFIG_RT_GROUP_SCHED
  	/*
 diff --git a/kernel/sched/core.c b/kernel/sched/core.c
-index 97ee9ac..f8349adf 100644
+index 38eacc3..9f35d87 100644
 --- a/kernel/sched/core.c
 +++ b/kernel/sched/core.c
-@@ -2236,7 +2236,7 @@ void set_numabalancing_state(bool enabled)
+@@ -2258,7 +2258,7 @@ void set_numabalancing_state(bool enabled)
  int sysctl_numa_balancing(struct ctl_table *table, int write,
  			 void __user *buffer, size_t *lenp, loff_t *ppos)
  {
@@ -143968,7 +144303,7 @@ index 97ee9ac..f8349adf 100644
  	int err;
  	int state = static_branch_likely(&sched_numa_balancing);
  
-@@ -2311,7 +2311,7 @@ static void __init init_schedstats(void)
+@@ -2333,7 +2333,7 @@ static void __init init_schedstats(void)
  int sysctl_schedstats(struct ctl_table *table, int write,
  			 void __user *buffer, size_t *lenp, loff_t *ppos)
  {
@@ -143977,7 +144312,7 @@ index 97ee9ac..f8349adf 100644
  	int err;
  	int state = static_branch_likely(&sched_schedstats);
  
-@@ -2754,7 +2754,7 @@ static struct rq *finish_task_switch(struct task_struct *prev)
+@@ -2776,7 +2776,7 @@ static struct rq *finish_task_switch(struct task_struct *prev)
  /* rq->lock is NOT held, but preemption is disabled */
  static void __balance_callback(struct rq *rq)
  {
@@ -143986,7 +144321,7 @@ index 97ee9ac..f8349adf 100644
  	void (*func)(struct rq *rq);
  	unsigned long flags;
  
-@@ -2762,7 +2762,7 @@ static void __balance_callback(struct rq *rq)
+@@ -2784,7 +2784,7 @@ static void __balance_callback(struct rq *rq)
  	head = rq->balance_callback;
  	rq->balance_callback = NULL;
  	while (head) {
@@ -143995,7 +144330,7 @@ index 97ee9ac..f8349adf 100644
  		next = head->next;
  		head->next = NULL;
  		head = next;
-@@ -3708,6 +3708,8 @@ int can_nice(const struct task_struct *p, const int nice)
+@@ -3730,6 +3730,8 @@ int can_nice(const struct task_struct *p, const int nice)
  	/* convert nice value [19,-20] to rlimit style value [1,40] */
  	int nice_rlim = nice_to_rlimit(nice);
  
@@ -144004,7 +144339,7 @@ index 97ee9ac..f8349adf 100644
  	return (nice_rlim <= task_rlimit(p, RLIMIT_NICE) ||
  		capable(CAP_SYS_NICE));
  }
-@@ -3734,7 +3736,8 @@ SYSCALL_DEFINE1(nice, int, increment)
+@@ -3756,7 +3758,8 @@ SYSCALL_DEFINE1(nice, int, increment)
  	nice = task_nice(current) + increment;
  
  	nice = clamp_val(nice, MIN_NICE, MAX_NICE);
@@ -144014,7 +144349,7 @@ index 97ee9ac..f8349adf 100644
  		return -EPERM;
  
  	retval = security_task_setnice(current, nice);
-@@ -4044,6 +4047,7 @@ recheck:
+@@ -4066,6 +4069,7 @@ recheck:
  			if (policy != p->policy && !rlim_rtprio)
  				return -EPERM;
  
@@ -144022,7 +144357,7 @@ index 97ee9ac..f8349adf 100644
  			/* can't increase priority */
  			if (attr->sched_priority > p->rt_priority &&
  			    attr->sched_priority > rlim_rtprio)
-@@ -7529,7 +7533,7 @@ void __might_sleep(const char *file, int line, int preempt_offset)
+@@ -7551,7 +7555,7 @@ void __might_sleep(const char *file, int line, int preempt_offset)
  	 */
  	WARN_ONCE(current->state != TASK_RUNNING && current->task_state_change,
  			"do not call blocking ops when !TASK_RUNNING; "
@@ -149153,7 +149488,7 @@ index 9e04681..30759a2 100644
  	mm = get_task_mm(tsk);
  	if (!mm)
 diff --git a/mm/mempolicy.c b/mm/mempolicy.c
-index 297d685..388696f 100644
+index e682861..c92d0a8 100644
 --- a/mm/mempolicy.c
 +++ b/mm/mempolicy.c
 @@ -730,6 +730,10 @@ static int mbind_range(struct mm_struct *mm, unsigned long start,
@@ -150992,7 +151327,7 @@ index e248194..ff005a8 100644
  	struct bdi_writeback *wb = dtc->wb;
  	unsigned long write_bw = wb->avg_write_bandwidth;
 diff --git a/mm/page_alloc.c b/mm/page_alloc.c
-index 8b3e134..d47200a 100644
+index 6e35419..3ebe533 100644
 --- a/mm/page_alloc.c
 +++ b/mm/page_alloc.c
 @@ -63,6 +63,7 @@
@@ -151150,7 +151485,7 @@ index 8b3e134..d47200a 100644
  		clear_bit(ZONE_FAIR_DEPLETED, &zone->flags);
  	} while (zone++ != preferred_zone);
  }
-@@ -6858,7 +6901,7 @@ static void __setup_per_zone_wmarks(void)
+@@ -6812,7 +6855,7 @@ static void __setup_per_zone_wmarks(void)
  
  		__mod_zone_page_state(zone, NR_ALLOC_BATCH,
  			high_wmark_pages(zone) - low_wmark_pages(zone) -
@@ -154582,7 +154917,7 @@ index b7de71f..808387d 100644
  
  	return err;
 diff --git a/net/core/dev.c b/net/core/dev.c
-index 904ff43..050ec70 100644
+index 97fb3da..be181d7 100644
 --- a/net/core/dev.c
 +++ b/net/core/dev.c
 @@ -1766,7 +1766,7 @@ int __dev_forward_skb(struct net_device *dev, struct sk_buff *skb)
@@ -154630,7 +154965,7 @@ index 904ff43..050ec70 100644
  {
  	struct softnet_data *sd = this_cpu_ptr(&softnet_data);
  
-@@ -4206,9 +4206,9 @@ ncls:
+@@ -4222,9 +4222,9 @@ ncls:
  	} else {
  drop:
  		if (!deliver_exact)
@@ -154642,7 +154977,7 @@ index 904ff43..050ec70 100644
  		kfree_skb(skb);
  		/* Jamal, now you will not able to escape explaining
  		 * me how you were going to use this. :-)
-@@ -5175,7 +5175,7 @@ out_unlock:
+@@ -5191,7 +5191,7 @@ out_unlock:
  	return work;
  }
  
@@ -154651,7 +154986,7 @@ index 904ff43..050ec70 100644
  {
  	struct softnet_data *sd = this_cpu_ptr(&softnet_data);
  	unsigned long time_limit = jiffies + 2;
-@@ -7390,9 +7390,9 @@ struct rtnl_link_stats64 *dev_get_stats(struct net_device *dev,
+@@ -7406,9 +7406,9 @@ struct rtnl_link_stats64 *dev_get_stats(struct net_device *dev,
  	} else {
  		netdev_stats_to_stats64(storage, &dev->stats);
  	}
@@ -154664,7 +154999,7 @@ index 904ff43..050ec70 100644
  	return storage;
  }
  EXPORT_SYMBOL(dev_get_stats);
-@@ -8014,7 +8014,7 @@ static void __net_exit netdev_exit(struct net *net)
+@@ -8030,7 +8030,7 @@ static void __net_exit netdev_exit(struct net *net)
  	kfree(net->dev_index_head);
  }
  
@@ -154673,7 +155008,7 @@ index 904ff43..050ec70 100644
  	.init = netdev_init,
  	.exit = netdev_exit,
  };
-@@ -8114,7 +8114,7 @@ static void __net_exit default_device_exit_batch(struct list_head *net_list)
+@@ -8130,7 +8130,7 @@ static void __net_exit default_device_exit_batch(struct list_head *net_list)
  	rtnl_unlock();
  }
  
@@ -154702,7 +155037,7 @@ index b94b1d2..da3ed7c 100644
  EXPORT_SYMBOL(dev_load);
  
 diff --git a/net/core/filter.c b/net/core/filter.c
-index e759d90..daa69dc 100644
+index bca32d6..5a27650 100644
 --- a/net/core/filter.c
 +++ b/net/core/filter.c
 @@ -590,7 +590,11 @@ do_pass:
@@ -156128,7 +156463,7 @@ index 71a52f4d..2bab905 100644
  		msg.msg_flags = flags;
  
 diff --git a/net/ipv4/ip_vti.c b/net/ipv4/ip_vti.c
-index a917903..b0bdff6 100644
+index cc701fa..473bb8c 100644
 --- a/net/ipv4/ip_vti.c
 +++ b/net/ipv4/ip_vti.c
 @@ -44,7 +44,7 @@
@@ -156149,6 +156484,15 @@ index a917903..b0bdff6 100644
  	.kind		= "vti",
  	.maxtype	= IFLA_VTI_MAX,
  	.policy		= vti_policy,
+@@ -580,7 +580,7 @@ static int vti_device_event(struct notifier_block *unused,
+ 	return NOTIFY_DONE;
+ }
+ 
+-static struct notifier_block vti_notifier_block __read_mostly = {
++static notifier_block_no_const vti_notifier_block __read_only = {
+ 	.notifier_call = vti_device_event,
+ };
+ 
 diff --git a/net/ipv4/ipconfig.c b/net/ipv4/ipconfig.c
 index 1d71c40..3f8a6fa 100644
 --- a/net/ipv4/ipconfig.c
@@ -156807,7 +157151,7 @@ index 42bf89a..adc7e6d 100644
  		write_pnet(&ireq->ireq_net, sock_net(sk_listener));
  		ireq->ireq_family = sk_listener->sk_family;
 diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
-index 3708de2..2b40e93 100644
+index ba7ce3f..b106df6 100644
 --- a/net/ipv4/tcp_ipv4.c
 +++ b/net/ipv4/tcp_ipv4.c
 @@ -88,6 +88,10 @@ int sysctl_tcp_tw_reuse __read_mostly;
@@ -156821,7 +157165,7 @@ index 3708de2..2b40e93 100644
  #ifdef CONFIG_TCP_MD5SIG
  static int tcp_v4_md5_hash_hdr(char *md5_hash, const struct tcp_md5sig_key *key,
  			       __be32 daddr, __be32 saddr, const struct tcphdr *th);
-@@ -1425,6 +1429,9 @@ int tcp_v4_do_rcv(struct sock *sk, struct sk_buff *skb)
+@@ -1431,6 +1435,9 @@ int tcp_v4_do_rcv(struct sock *sk, struct sk_buff *skb)
  	return 0;
  
  reset:
@@ -156831,7 +157175,7 @@ index 3708de2..2b40e93 100644
  	tcp_v4_send_reset(rsk, skb);
  discard:
  	kfree_skb(skb);
-@@ -1592,12 +1599,19 @@ int tcp_v4_rcv(struct sk_buff *skb)
+@@ -1598,12 +1605,19 @@ int tcp_v4_rcv(struct sk_buff *skb)
  lookup:
  	sk = __inet_lookup_skb(&tcp_hashinfo, skb, __tcp_hdrlen(th), th->source,
  			       th->dest, &refcounted);
@@ -156854,7 +157198,7 @@ index 3708de2..2b40e93 100644
  
  	if (sk->sk_state == TCP_NEW_SYN_RECV) {
  		struct request_sock *req = inet_reqsk(sk);
-@@ -1687,6 +1701,10 @@ csum_error:
+@@ -1693,6 +1707,10 @@ csum_error:
  bad_packet:
  		__TCP_INC_STATS(net, TCP_MIB_INERRS);
  	} else {
@@ -156865,7 +157209,7 @@ index 3708de2..2b40e93 100644
  		tcp_v4_send_reset(NULL, skb);
  	}
  
-@@ -2425,7 +2443,7 @@ static void __net_exit tcp_sk_exit_batch(struct list_head *net_exit_list)
+@@ -2431,7 +2449,7 @@ static void __net_exit tcp_sk_exit_batch(struct list_head *net_exit_list)
  	inet_twsk_purge(&tcp_hashinfo, &tcp_death_row, AF_INET);
  }
  
@@ -156957,7 +157301,7 @@ index debdd8b..7bcef89 100644
  				  syn_set ? 0 : icsk->icsk_user_timeout, syn_set)) {
  		/* Has it gone just too far? */
 diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
-index e61f7cd..8206e7a 100644
+index 00d18c5..3e65784 100644
 --- a/net/ipv4/udp.c
 +++ b/net/ipv4/udp.c
 @@ -87,6 +87,7 @@
@@ -157008,7 +157352,7 @@ index e61f7cd..8206e7a 100644
  		daddr = inet->inet_daddr;
  		dport = inet->inet_dport;
  		/* Open fast path for connected socket.
-@@ -1199,7 +1216,7 @@ static unsigned int first_packet_length(struct sock *sk)
+@@ -1199,7 +1216,7 @@ static int first_packet_length(struct sock *sk)
  				IS_UDPLITE(sk));
  		__UDP_INC_STATS(sock_net(sk), UDP_MIB_INERRORS,
  				IS_UDPLITE(sk));
@@ -157180,7 +157524,7 @@ index 542074c..648df74 100644
  	       sizeof(XFRM_MODE_SKB_CB(skb)->flow_lbl));
  
 diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
-index 047c75a..bc3f19c 100644
+index 82e367b..1b4ae5e 100644
 --- a/net/ipv6/addrconf.c
 +++ b/net/ipv6/addrconf.c
 @@ -179,7 +179,7 @@ static struct ipv6_devconf ipv6_devconf __read_mostly = {
@@ -157210,7 +157554,7 @@ index 047c75a..bc3f19c 100644
  			  net->dev_base_seq;
  		hlist_for_each_entry_rcu(dev, head, index_hlist) {
  			if (idx < s_idx)
-@@ -2596,7 +2596,7 @@ int addrconf_set_dstaddr(struct net *net, void __user *arg)
+@@ -2597,7 +2597,7 @@ int addrconf_set_dstaddr(struct net *net, void __user *arg)
  		p.iph.ihl = 5;
  		p.iph.protocol = IPPROTO_IPV6;
  		p.iph.ttl = 64;
@@ -157219,7 +157563,7 @@ index 047c75a..bc3f19c 100644
  
  		if (ops->ndo_do_ioctl) {
  			mm_segment_t oldfs = get_fs();
-@@ -4029,16 +4029,23 @@ static const struct file_operations if6_fops = {
+@@ -4031,16 +4031,23 @@ static const struct file_operations if6_fops = {
  	.release	= seq_release_net,
  };
  
@@ -157244,7 +157588,7 @@ index 047c75a..bc3f19c 100644
  }
  
  static struct pernet_operations if6_proc_net_ops = {
-@@ -4657,7 +4664,7 @@ static int inet6_dump_addr(struct sk_buff *skb, struct netlink_callback *cb,
+@@ -4659,7 +4666,7 @@ static int inet6_dump_addr(struct sk_buff *skb, struct netlink_callback *cb,
  	s_ip_idx = ip_idx = cb->args[2];
  
  	rcu_read_lock();
@@ -157253,7 +157597,7 @@ index 047c75a..bc3f19c 100644
  	for (h = s_h; h < NETDEV_HASHENTRIES; h++, s_idx = 0) {
  		idx = 0;
  		head = &net->dev_index_head[h];
-@@ -4870,7 +4877,7 @@ static inline size_t inet6_if_nlmsg_size(void)
+@@ -4872,7 +4879,7 @@ static inline size_t inet6_if_nlmsg_size(void)
  	       + nla_total_size(inet6_ifla6_size()); /* IFLA_PROTINFO */
  }
  
@@ -157262,7 +157606,7 @@ index 047c75a..bc3f19c 100644
  				      int items, int bytes)
  {
  	int i;
-@@ -4880,7 +4887,7 @@ static inline void __snmp6_fill_statsdev(u64 *stats, atomic_long_t *mib,
+@@ -4882,7 +4889,7 @@ static inline void __snmp6_fill_statsdev(u64 *stats, atomic_long_t *mib,
  	/* Use put_unaligned() because stats may not be aligned for u64. */
  	put_unaligned(items, &stats[0]);
  	for (i = 1; i < items; i++)
@@ -157271,7 +157615,7 @@ index 047c75a..bc3f19c 100644
  
  	memset(&stats[items], 0, pad);
  }
-@@ -5337,7 +5344,7 @@ static void __ipv6_ifa_notify(int event, struct inet6_ifaddr *ifp)
+@@ -5339,7 +5346,7 @@ static void __ipv6_ifa_notify(int event, struct inet6_ifaddr *ifp)
  		rt_genid_bump_ipv6(net);
  		break;
  	}
@@ -157280,7 +157624,7 @@ index 047c75a..bc3f19c 100644
  }
  
  static void ipv6_ifa_notify(int event, struct inet6_ifaddr *ifp)
-@@ -5357,7 +5364,7 @@ int addrconf_sysctl_forward(struct ctl_table *ctl, int write,
+@@ -5359,7 +5366,7 @@ int addrconf_sysctl_forward(struct ctl_table *ctl, int write,
  	int *valp = ctl->data;
  	int val = *valp;
  	loff_t pos = *ppos;
@@ -157289,7 +157633,7 @@ index 047c75a..bc3f19c 100644
  	int ret;
  
  	/*
-@@ -5380,7 +5387,7 @@ static
+@@ -5382,7 +5389,7 @@ static
  int addrconf_sysctl_hop_limit(struct ctl_table *ctl, int write,
                                void __user *buffer, size_t *lenp, loff_t *ppos)
  {
@@ -157298,7 +157642,7 @@ index 047c75a..bc3f19c 100644
  	int min_hl = 1, max_hl = 255;
  
  	lctl = *ctl;
-@@ -5396,7 +5403,7 @@ int addrconf_sysctl_mtu(struct ctl_table *ctl, int write,
+@@ -5398,7 +5405,7 @@ int addrconf_sysctl_mtu(struct ctl_table *ctl, int write,
  {
  	struct inet6_dev *idev = ctl->extra1;
  	int min_mtu = IPV6_MIN_MTU;
@@ -157307,7 +157651,7 @@ index 047c75a..bc3f19c 100644
  
  	lctl = *ctl;
  	lctl.extra1 = &min_mtu;
-@@ -5471,7 +5478,7 @@ int addrconf_sysctl_disable(struct ctl_table *ctl, int write,
+@@ -5473,7 +5480,7 @@ int addrconf_sysctl_disable(struct ctl_table *ctl, int write,
  	int *valp = ctl->data;
  	int val = *valp;
  	loff_t pos = *ppos;
@@ -157316,7 +157660,7 @@ index 047c75a..bc3f19c 100644
  	int ret;
  
  	/*
-@@ -5536,7 +5543,7 @@ static int addrconf_sysctl_stable_secret(struct ctl_table *ctl, int write,
+@@ -5538,7 +5545,7 @@ static int addrconf_sysctl_stable_secret(struct ctl_table *ctl, int write,
  	int err;
  	struct in6_addr addr;
  	char str[IPV6_MAX_STRLEN];
@@ -157325,7 +157669,7 @@ index 047c75a..bc3f19c 100644
  	struct net *net = ctl->extra2;
  	struct ipv6_stable_secret *secret = ctl->data;
  
-@@ -5605,7 +5612,7 @@ int addrconf_sysctl_ignore_routes_with_linkdown(struct ctl_table *ctl,
+@@ -5607,7 +5614,7 @@ int addrconf_sysctl_ignore_routes_with_linkdown(struct ctl_table *ctl,
  	int *valp = ctl->data;
  	int val = *valp;
  	loff_t pos = *ppos;
@@ -157334,7 +157678,7 @@ index 047c75a..bc3f19c 100644
  	int ret;
  
  	/* ctl->data points to idev->cnf.ignore_routes_when_linkdown
-@@ -5945,7 +5952,7 @@ static int __addrconf_sysctl_register(struct net *net, char *dev_name,
+@@ -5947,7 +5954,7 @@ static int __addrconf_sysctl_register(struct net *net, char *dev_name,
  		struct inet6_dev *idev, struct ipv6_devconf *p)
  {
  	int i;
@@ -157452,7 +157796,7 @@ index 776d145..69772ae 100644
  	.maxtype	= IFLA_GRE_MAX,
  	.policy		= ip6gre_policy,
 diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c
-index 7b0481e..cd77386 100644
+index 888543d..bcc126c 100644
 --- a/net/ipv6/ip6_tunnel.c
 +++ b/net/ipv6/ip6_tunnel.c
 @@ -80,7 +80,7 @@ static u32 HASH(const struct in6_addr *addr1, const struct in6_addr *addr2)
@@ -157464,7 +157808,7 @@ index 7b0481e..cd77386 100644
  
  static int ip6_tnl_net_id __read_mostly;
  struct ip6_tnl_net {
-@@ -1992,7 +1992,7 @@ static const struct nla_policy ip6_tnl_policy[IFLA_IPTUN_MAX + 1] = {
+@@ -1994,7 +1994,7 @@ static const struct nla_policy ip6_tnl_policy[IFLA_IPTUN_MAX + 1] = {
  	[IFLA_IPTUN_ENCAP_DPORT]	= { .type = NLA_U16 },
  };
  
@@ -157611,10 +157955,10 @@ index e4347ae..c7654e7 100644
  	return -ENOMEM;
  }
 diff --git a/net/ipv6/ping.c b/net/ipv6/ping.c
-index 3ee3e44..2f70cc3 100644
+index 4086604..7a868ec 100644
 --- a/net/ipv6/ping.c
 +++ b/net/ipv6/ping.c
-@@ -242,6 +242,24 @@ static struct pernet_operations ping_v6_net_ops = {
+@@ -247,6 +247,24 @@ static struct pernet_operations ping_v6_net_ops = {
  };
  #endif
  
@@ -157639,7 +157983,7 @@ index 3ee3e44..2f70cc3 100644
  int __init pingv6_init(void)
  {
  #ifdef CONFIG_PROC_FS
-@@ -249,13 +267,7 @@ int __init pingv6_init(void)
+@@ -254,13 +272,7 @@ int __init pingv6_init(void)
  	if (ret)
  		return ret;
  #endif
@@ -157654,7 +157998,7 @@ index 3ee3e44..2f70cc3 100644
  	return inet6_register_protosw(&pingv6_protosw);
  }
  
-@@ -264,14 +276,9 @@ int __init pingv6_init(void)
+@@ -269,14 +281,9 @@ int __init pingv6_init(void)
   */
  void pingv6_exit(void)
  {
@@ -157893,7 +158237,7 @@ index 45243bb..cdb398e 100644
  	struct ctl_table *ipv6_icmp_table;
  	int err;
 diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
-index 2255d2b..b1c03a4 100644
+index 889acc4..c4a32ab 100644
 --- a/net/ipv6/tcp_ipv6.c
 +++ b/net/ipv6/tcp_ipv6.c
 @@ -101,6 +101,10 @@ static void inet6_sk_rx_dst_set(struct sock *sk, const struct sk_buff *skb)
@@ -157907,7 +158251,7 @@ index 2255d2b..b1c03a4 100644
  static __u32 tcp_v6_init_sequence(const struct sk_buff *skb)
  {
  	return secure_tcpv6_sequence_number(ipv6_hdr(skb)->daddr.s6_addr32,
-@@ -1274,6 +1278,9 @@ static int tcp_v6_do_rcv(struct sock *sk, struct sk_buff *skb)
+@@ -1280,6 +1284,9 @@ static int tcp_v6_do_rcv(struct sock *sk, struct sk_buff *skb)
  	return 0;
  
  reset:
@@ -157917,7 +158261,7 @@ index 2255d2b..b1c03a4 100644
  	tcp_v6_send_reset(sk, skb);
  discard:
  	if (opt_skb)
-@@ -1386,12 +1393,20 @@ lookup:
+@@ -1392,12 +1399,20 @@ lookup:
  	sk = __inet6_lookup_skb(&tcp_hashinfo, skb, __tcp_hdrlen(th),
  				th->source, th->dest, inet6_iif(skb),
  				&refcounted);
@@ -157940,7 +158284,7 @@ index 2255d2b..b1c03a4 100644
  
  	if (sk->sk_state == TCP_NEW_SYN_RECV) {
  		struct request_sock *req = inet_reqsk(sk);
-@@ -1481,6 +1496,10 @@ csum_error:
+@@ -1487,6 +1502,10 @@ csum_error:
  bad_packet:
  		__TCP_INC_STATS(net, TCP_MIB_INERRS);
  	} else {
@@ -158333,7 +158677,7 @@ index 8567366..7c8aa51 100644
  	irda_task_kick(task);
  }
 diff --git a/net/irda/iriap.c b/net/irda/iriap.c
-index 4a7ae32a..bfe8e78 100644
+index 1138eaf..cb1900c 100644
 --- a/net/irda/iriap.c
 +++ b/net/irda/iriap.c
 @@ -61,7 +61,7 @@ static const char *const ias_charset_types[] __maybe_unused = {
@@ -158365,7 +158709,7 @@ index 4a7ae32a..bfe8e78 100644
  }
  
  /*
-@@ -215,8 +215,10 @@ EXPORT_SYMBOL(iriap_open);
+@@ -219,8 +219,10 @@ EXPORT_SYMBOL(iriap_open);
   *    Removes (deallocates) the IrIAP instance
   *
   */
@@ -158377,7 +158721,7 @@ index 4a7ae32a..bfe8e78 100644
  	IRDA_ASSERT(self != NULL, return;);
  	IRDA_ASSERT(self->magic == IAS_MAGIC, return;);
  
-@@ -942,7 +944,7 @@ void iriap_call_indication(struct iriap_cb *self, struct sk_buff *skb)
+@@ -946,7 +948,7 @@ void iriap_call_indication(struct iriap_cb *self, struct sk_buff *skb)
   *    Query has taken too long time, so abort
   *
   */
@@ -158800,27 +159144,6 @@ index 7eaa000..2fa7f35 100644
  	.notifier_call = iucv_cpu_notify,
  };
  
-diff --git a/net/kcm/kcmsock.c b/net/kcm/kcmsock.c
-index 0b68ba7..48613f5 100644
---- a/net/kcm/kcmsock.c
-+++ b/net/kcm/kcmsock.c
-@@ -13,6 +13,7 @@
- #include <linux/socket.h>
- #include <linux/uaccess.h>
- #include <linux/workqueue.h>
-+#include <linux/syscalls.h>
- #include <net/kcm.h>
- #include <net/netns/generic.h>
- #include <net/sock.h>
-@@ -2035,7 +2036,7 @@ static int kcm_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
- 			if (copy_to_user((void __user *)arg, &info,
- 					 sizeof(info))) {
- 				err = -EFAULT;
--				sock_release(newsock);
-+				sys_close(info.fd);
- 			}
- 		}
- 
 diff --git a/net/key/af_key.c b/net/key/af_key.c
 index f9c9ecb..060751e 100644
 --- a/net/key/af_key.c
@@ -161297,7 +161620,7 @@ index d3d50da..55e871e 100644
  
  static int sctp_v4_protosw_init(void)
 diff --git a/net/sctp/sctp_diag.c b/net/sctp/sctp_diag.c
-index f69edcf..f015617 100644
+index 10bae22..1d96d9d 100644
 --- a/net/sctp/sctp_diag.c
 +++ b/net/sctp/sctp_diag.c
 @@ -150,7 +150,7 @@ static int inet_sctp_diag_fill(struct sock *sk, struct sctp_association *asoc,
@@ -161820,23 +162143,10 @@ index 9d88c62..53396b6 100644
  #define gssx_dec_release_handle NULL
  #define gssx_enc_get_mic NULL
 diff --git a/net/sunrpc/auth_gss/svcauth_gss.c b/net/sunrpc/auth_gss/svcauth_gss.c
-index e085f5a..c947fa5 100644
+index 4605dc7..c947fa5 100644
 --- a/net/sunrpc/auth_gss/svcauth_gss.c
 +++ b/net/sunrpc/auth_gss/svcauth_gss.c
-@@ -569,9 +569,10 @@ gss_svc_searchbyctx(struct cache_detail *cd, struct xdr_netobj *handle)
- 	struct rsc *found;
- 
- 	memset(&rsci, 0, sizeof(rsci));
--	rsci.handle.data = handle->data;
--	rsci.handle.len = handle->len;
-+	if (dup_to_netobj(&rsci.handle, handle->data, handle->len))
-+		return NULL;
- 	found = rsc_lookup(cd, &rsci);
-+	rsc_free(&rsci);
- 	if (!found)
- 		return NULL;
- 	if (cache_check(cd, &found->h, NULL))
-@@ -1141,7 +1142,7 @@ static int gss_proxy_save_rsc(struct cache_detail *cd,
+@@ -1142,7 +1142,7 @@ static int gss_proxy_save_rsc(struct cache_detail *cd,
  				uint64_t *handle)
  {
  	struct rsc rsci, *rscp = NULL;
@@ -161845,7 +162155,7 @@ index e085f5a..c947fa5 100644
  	long long ctxh;
  	struct gss_api_mech *gm = NULL;
  	time_t expiry;
-@@ -1152,7 +1153,7 @@ static int gss_proxy_save_rsc(struct cache_detail *cd,
+@@ -1153,7 +1153,7 @@ static int gss_proxy_save_rsc(struct cache_detail *cd,
  	status = -ENOMEM;
  	/* the handle needs to be just a unique id,
  	 * use a static counter */
@@ -162384,10 +162694,10 @@ index 0dd0224..36a22a0 100644
  	sub->evt.event = htohl(event, sub->swap);
  	sub->evt.found_lower = htohl(found_lower, sub->swap);
 diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
-index 735362c..49c97c7 100644
+index e444fa4..1e5a065 100644
 --- a/net/unix/af_unix.c
 +++ b/net/unix/af_unix.c
-@@ -919,6 +919,12 @@ static struct sock *unix_find_other(struct net *net,
+@@ -920,6 +920,12 @@ static struct sock *unix_find_other(struct net *net,
  		err = -ECONNREFUSED;
  		if (!S_ISSOCK(inode->i_mode))
  			goto put_fail;
@@ -162400,7 +162710,7 @@ index 735362c..49c97c7 100644
  		u = unix_find_socket_byinode(inode);
  		if (!u)
  			goto put_fail;
-@@ -939,6 +945,13 @@ static struct sock *unix_find_other(struct net *net,
+@@ -940,6 +946,13 @@ static struct sock *unix_find_other(struct net *net,
  		if (u) {
  			struct dentry *dentry;
  			dentry = unix_sk(u)->path.dentry;
@@ -162414,27 +162724,27 @@ index 735362c..49c97c7 100644
  			if (dentry)
  				touch_atime(&unix_sk(u)->path);
  		} else
-@@ -960,13 +973,19 @@ static int unix_mknod(struct dentry *dentry, const struct path *path, umode_t mo
- 
- 	err = security_path_mknod(path, dentry, mode, 0);
+@@ -973,12 +986,19 @@ static int unix_mknod(const char *sun_path, umode_t mode, struct path *res)
+ 	 */
+ 	err = security_path_mknod(&path, dentry, mode, 0);
  	if (!err) {
-+		if (!gr_acl_handle_mknod(dentry, path->dentry, path->mnt, mode)) {
++		if (!gr_acl_handle_mknod(dentry, path.dentry, path.mnt, mode)) {
 +			err = -EACCES;
 +			goto out;
 +		}
- 		err = vfs_mknod(d_inode(path->dentry), dentry, mode, 0);
+ 		err = vfs_mknod(d_inode(path.dentry), dentry, mode, 0);
  		if (!err) {
- 			res->mnt = mntget(path->mnt);
+ 			res->mnt = mntget(path.mnt);
  			res->dentry = dget(dentry);
-+			gr_handle_create(dentry, path->mnt);
++			gr_handle_create(dentry, path.mnt);
  		}
  	}
- 
++
 +out:
+ 	done_path_create(&path, dentry);
  	return err;
  }
- 
-@@ -2811,9 +2830,13 @@ static int unix_seq_show(struct seq_file *seq, void *v)
+@@ -2798,9 +2818,13 @@ static int unix_seq_show(struct seq_file *seq, void *v)
  		seq_puts(seq, "Num       RefCount Protocol Flags    Type St "
  			 "Inode Path\n");
  	else {
@@ -162449,7 +162759,7 @@ index 735362c..49c97c7 100644
  
  		seq_printf(seq, "%pK: %08X %08X %08X %04X %02X %5lu",
  			s,
-@@ -2838,10 +2861,29 @@ static int unix_seq_show(struct seq_file *seq, void *v)
+@@ -2825,10 +2849,29 @@ static int unix_seq_show(struct seq_file *seq, void *v)
  				seq_putc(seq, '@');
  				i++;
  			}
@@ -162995,7 +163305,7 @@ index 94c7405..499cca4 100644
  
  int cfg80211_wext_freq(struct iw_freq *freq);
 diff --git a/net/wireless/wext-core.c b/net/wireless/wext-core.c
-index dbb2738e..6a52210 100644
+index 6250b1c..91c4bc4 100644
 --- a/net/wireless/wext-core.c
 +++ b/net/wireless/wext-core.c
 @@ -781,8 +781,7 @@ static int ioctl_standard_iw_point(struct iw_point *iwp, unsigned int cmd,
@@ -214594,6 +214904,56 @@ index 552705d..9920f4fb 100644
  	key = ima_hash_key(entry->digest);
  	hlist_add_head_rcu(&qe->hnext, &ima_htable.queue[key]);
  	return 0;
+diff --git a/security/keys/encrypted-keys/encrypted.c b/security/keys/encrypted-keys/encrypted.c
+index 5adbfc3..17a0610 100644
+--- a/security/keys/encrypted-keys/encrypted.c
++++ b/security/keys/encrypted-keys/encrypted.c
+@@ -29,6 +29,7 @@
+ #include <linux/rcupdate.h>
+ #include <linux/scatterlist.h>
+ #include <linux/ctype.h>
++#include <crypto/aes.h>
+ #include <crypto/hash.h>
+ #include <crypto/sha.h>
+ #include <crypto/skcipher.h>
+@@ -478,6 +479,7 @@ static int derived_key_encrypt(struct encrypted_key_payload *epayload,
+ 	struct crypto_skcipher *tfm;
+ 	struct skcipher_request *req;
+ 	unsigned int encrypted_datalen;
++	u8 iv[AES_BLOCK_SIZE];
+ 	unsigned int padlen;
+ 	char pad[16];
+ 	int ret;
+@@ -500,8 +502,8 @@ static int derived_key_encrypt(struct encrypted_key_payload *epayload,
+ 	sg_init_table(sg_out, 1);
+ 	sg_set_buf(sg_out, epayload->encrypted_data, encrypted_datalen);
+ 
+-	skcipher_request_set_crypt(req, sg_in, sg_out, encrypted_datalen,
+-				   epayload->iv);
++	memcpy(iv, epayload->iv, sizeof(iv));
++	skcipher_request_set_crypt(req, sg_in, sg_out, encrypted_datalen, iv);
+ 	ret = crypto_skcipher_encrypt(req);
+ 	tfm = crypto_skcipher_reqtfm(req);
+ 	skcipher_request_free(req);
+@@ -581,6 +583,7 @@ static int derived_key_decrypt(struct encrypted_key_payload *epayload,
+ 	struct crypto_skcipher *tfm;
+ 	struct skcipher_request *req;
+ 	unsigned int encrypted_datalen;
++	u8 iv[AES_BLOCK_SIZE];
+ 	char pad[16];
+ 	int ret;
+ 
+@@ -599,8 +602,8 @@ static int derived_key_decrypt(struct encrypted_key_payload *epayload,
+ 		   epayload->decrypted_datalen);
+ 	sg_set_buf(&sg_out[1], pad, sizeof pad);
+ 
+-	skcipher_request_set_crypt(req, sg_in, sg_out, encrypted_datalen,
+-				   epayload->iv);
++	memcpy(iv, epayload->iv, sizeof(iv));
++	skcipher_request_set_crypt(req, sg_in, sg_out, encrypted_datalen, iv);
+ 	ret = crypto_skcipher_decrypt(req);
+ 	tfm = crypto_skcipher_reqtfm(req);
+ 	skcipher_request_free(req);
 diff --git a/security/keys/internal.h b/security/keys/internal.h
 index a705a7d..898c675 100644
 --- a/security/keys/internal.h

diff --git a/4.7.4/4425_grsec_remove_EI_PAX.patch b/4.7.5/4425_grsec_remove_EI_PAX.patch
similarity index 100%
rename from 4.7.4/4425_grsec_remove_EI_PAX.patch
rename to 4.7.5/4425_grsec_remove_EI_PAX.patch

diff --git a/4.7.4/4427_force_XATTR_PAX_tmpfs.patch b/4.7.5/4427_force_XATTR_PAX_tmpfs.patch
similarity index 100%
rename from 4.7.4/4427_force_XATTR_PAX_tmpfs.patch
rename to 4.7.5/4427_force_XATTR_PAX_tmpfs.patch

diff --git a/4.7.4/4430_grsec-remove-localversion-grsec.patch b/4.7.5/4430_grsec-remove-localversion-grsec.patch
similarity index 100%
rename from 4.7.4/4430_grsec-remove-localversion-grsec.patch
rename to 4.7.5/4430_grsec-remove-localversion-grsec.patch

diff --git a/4.7.4/4435_grsec-mute-warnings.patch b/4.7.5/4435_grsec-mute-warnings.patch
similarity index 100%
rename from 4.7.4/4435_grsec-mute-warnings.patch
rename to 4.7.5/4435_grsec-mute-warnings.patch

diff --git a/4.7.4/4440_grsec-remove-protected-paths.patch b/4.7.5/4440_grsec-remove-protected-paths.patch
similarity index 100%
rename from 4.7.4/4440_grsec-remove-protected-paths.patch
rename to 4.7.5/4440_grsec-remove-protected-paths.patch

diff --git a/4.7.4/4450_grsec-kconfig-default-gids.patch b/4.7.5/4450_grsec-kconfig-default-gids.patch
similarity index 100%
rename from 4.7.4/4450_grsec-kconfig-default-gids.patch
rename to 4.7.5/4450_grsec-kconfig-default-gids.patch

diff --git a/4.7.4/4465_selinux-avc_audit-log-curr_ip.patch b/4.7.5/4465_selinux-avc_audit-log-curr_ip.patch
similarity index 100%
rename from 4.7.4/4465_selinux-avc_audit-log-curr_ip.patch
rename to 4.7.5/4465_selinux-avc_audit-log-curr_ip.patch

diff --git a/4.7.4/4470_disable-compat_vdso.patch b/4.7.5/4470_disable-compat_vdso.patch
similarity index 100%
rename from 4.7.4/4470_disable-compat_vdso.patch
rename to 4.7.5/4470_disable-compat_vdso.patch

diff --git a/4.7.4/4475_emutramp_default_on.patch b/4.7.5/4475_emutramp_default_on.patch
similarity index 100%
rename from 4.7.4/4475_emutramp_default_on.patch
rename to 4.7.5/4475_emutramp_default_on.patch