grsecurity-3.1-4.9.24-201704220732HEAD20170422master

14 files changed, 3536 insertions, 1459 deletions

diff --git a/4.9.23/1022_linux-4.9.23.patch b/4.9.23/1022_linux-4.9.23.patch
deleted file mode 100644
index c547029..0000000
--- a/4.9.23/1022_linux-4.9.23.patch
+++ /dev/null
@@ -1,1236 +0,0 @@
-diff --git a/Makefile b/Makefile
-index 4bf4648..0de7597 100644
---- a/Makefile
-+++ b/Makefile
-@@ -1,6 +1,6 @@
- VERSION = 4
- PATCHLEVEL = 9
--SUBLEVEL = 22
-+SUBLEVEL = 23
- EXTRAVERSION =
- NAME = Roaring Lionus
- 
-diff --git a/arch/mips/Kconfig b/arch/mips/Kconfig
-index 9a6e11b6..5a4f2eb 100644
---- a/arch/mips/Kconfig
-+++ b/arch/mips/Kconfig
-@@ -9,6 +9,7 @@ config MIPS
- 	select HAVE_CONTEXT_TRACKING
- 	select HAVE_GENERIC_DMA_COHERENT
- 	select HAVE_IDE
-+	select HAVE_IRQ_EXIT_ON_IRQ_STACK
- 	select HAVE_OPROFILE
- 	select HAVE_PERF_EVENTS
- 	select PERF_USE_VMALLOC
-diff --git a/arch/mips/include/asm/irq.h b/arch/mips/include/asm/irq.h
-index 6bf10e7..956db6e 100644
---- a/arch/mips/include/asm/irq.h
-+++ b/arch/mips/include/asm/irq.h
-@@ -17,6 +17,18 @@
- 
- #include <irq.h>
- 
-+#define IRQ_STACK_SIZE			THREAD_SIZE
-+
-+extern void *irq_stack[NR_CPUS];
-+
-+static inline bool on_irq_stack(int cpu, unsigned long sp)
-+{
-+	unsigned long low = (unsigned long)irq_stack[cpu];
-+	unsigned long high = low + IRQ_STACK_SIZE;
-+
-+	return (low <= sp && sp <= high);
-+}
-+
- #ifdef CONFIG_I8259
- static inline int irq_canonicalize(int irq)
- {
-diff --git a/arch/mips/include/asm/stackframe.h b/arch/mips/include/asm/stackframe.h
-index eebf395..2f182bd 100644
---- a/arch/mips/include/asm/stackframe.h
-+++ b/arch/mips/include/asm/stackframe.h
-@@ -216,12 +216,19 @@
- 		LONG_S	$25, PT_R25(sp)
- 		LONG_S	$28, PT_R28(sp)
- 		LONG_S	$31, PT_R31(sp)
-+
-+		/* Set thread_info if we're coming from user mode */
-+		mfc0	k0, CP0_STATUS
-+		sll	k0, 3		/* extract cu0 bit */
-+		bltz	k0, 9f
-+
- 		ori	$28, sp, _THREAD_MASK
- 		xori	$28, _THREAD_MASK
- #ifdef CONFIG_CPU_CAVIUM_OCTEON
- 		.set    mips64
- 		pref    0, 0($28)       /* Prefetch the current pointer */
- #endif
-+9:
- 		.set	pop
- 		.endm
- 
-diff --git a/arch/mips/kernel/asm-offsets.c b/arch/mips/kernel/asm-offsets.c
-index fae2f94..4be2763 100644
---- a/arch/mips/kernel/asm-offsets.c
-+++ b/arch/mips/kernel/asm-offsets.c
-@@ -102,6 +102,7 @@ void output_thread_info_defines(void)
- 	OFFSET(TI_REGS, thread_info, regs);
- 	DEFINE(_THREAD_SIZE, THREAD_SIZE);
- 	DEFINE(_THREAD_MASK, THREAD_MASK);
-+	DEFINE(_IRQ_STACK_SIZE, IRQ_STACK_SIZE);
- 	BLANK();
- }
- 
-diff --git a/arch/mips/kernel/genex.S b/arch/mips/kernel/genex.S
-index 52a4fdf..2ac6c26 100644
---- a/arch/mips/kernel/genex.S
-+++ b/arch/mips/kernel/genex.S
-@@ -187,9 +187,44 @@ NESTED(handle_int, PT_SIZE, sp)
- 
- 	LONG_L	s0, TI_REGS($28)
- 	LONG_S	sp, TI_REGS($28)
--	PTR_LA	ra, ret_from_irq
--	PTR_LA	v0, plat_irq_dispatch
--	jr	v0
-+
-+	/*
-+	 * SAVE_ALL ensures we are using a valid kernel stack for the thread.
-+	 * Check if we are already using the IRQ stack.
-+	 */
-+	move	s1, sp # Preserve the sp
-+
-+	/* Get IRQ stack for this CPU */
-+	ASM_CPUID_MFC0	k0, ASM_SMP_CPUID_REG
-+#if defined(CONFIG_32BIT) || defined(KBUILD_64BIT_SYM32)
-+	lui	k1, %hi(irq_stack)
-+#else
-+	lui	k1, %highest(irq_stack)
-+	daddiu	k1, %higher(irq_stack)
-+	dsll	k1, 16
-+	daddiu	k1, %hi(irq_stack)
-+	dsll	k1, 16
-+#endif
-+	LONG_SRL	k0, SMP_CPUID_PTRSHIFT
-+	LONG_ADDU	k1, k0
-+	LONG_L	t0, %lo(irq_stack)(k1)
-+
-+	# Check if already on IRQ stack
-+	PTR_LI	t1, ~(_THREAD_SIZE-1)
-+	and	t1, t1, sp
-+	beq	t0, t1, 2f
-+
-+	/* Switch to IRQ stack */
-+	li	t1, _IRQ_STACK_SIZE
-+	PTR_ADD sp, t0, t1
-+
-+2:
-+	jal	plat_irq_dispatch
-+
-+	/* Restore sp */
-+	move	sp, s1
-+
-+	j	ret_from_irq
- #ifdef CONFIG_CPU_MICROMIPS
- 	nop
- #endif
-@@ -262,8 +297,44 @@ NESTED(except_vec_vi_handler, 0, sp)
- 
- 	LONG_L	s0, TI_REGS($28)
- 	LONG_S	sp, TI_REGS($28)
--	PTR_LA	ra, ret_from_irq
--	jr	v0
-+
-+	/*
-+	 * SAVE_ALL ensures we are using a valid kernel stack for the thread.
-+	 * Check if we are already using the IRQ stack.
-+	 */
-+	move	s1, sp # Preserve the sp
-+
-+	/* Get IRQ stack for this CPU */
-+	ASM_CPUID_MFC0	k0, ASM_SMP_CPUID_REG
-+#if defined(CONFIG_32BIT) || defined(KBUILD_64BIT_SYM32)
-+	lui	k1, %hi(irq_stack)
-+#else
-+	lui	k1, %highest(irq_stack)
-+	daddiu	k1, %higher(irq_stack)
-+	dsll	k1, 16
-+	daddiu	k1, %hi(irq_stack)
-+	dsll	k1, 16
-+#endif
-+	LONG_SRL	k0, SMP_CPUID_PTRSHIFT
-+	LONG_ADDU	k1, k0
-+	LONG_L	t0, %lo(irq_stack)(k1)
-+
-+	# Check if already on IRQ stack
-+	PTR_LI	t1, ~(_THREAD_SIZE-1)
-+	and	t1, t1, sp
-+	beq	t0, t1, 2f
-+
-+	/* Switch to IRQ stack */
-+	li	t1, _IRQ_STACK_SIZE
-+	PTR_ADD sp, t0, t1
-+
-+2:
-+	jalr	v0
-+
-+	/* Restore sp */
-+	move	sp, s1
-+
-+	j	ret_from_irq
- 	END(except_vec_vi_handler)
- 
- /*
-diff --git a/arch/mips/kernel/irq.c b/arch/mips/kernel/irq.c
-index f25f7ea..2b0a371 100644
---- a/arch/mips/kernel/irq.c
-+++ b/arch/mips/kernel/irq.c
-@@ -25,6 +25,8 @@
- #include <linux/atomic.h>
- #include <asm/uaccess.h>
- 
-+void *irq_stack[NR_CPUS];
-+
- /*
-  * 'what should we do if we get a hw irq event on an illegal vector'.
-  * each architecture has to answer this themselves.
-@@ -58,6 +60,15 @@ void __init init_IRQ(void)
- 		clear_c0_status(ST0_IM);
- 
- 	arch_init_irq();
-+
-+	for_each_possible_cpu(i) {
-+		int irq_pages = IRQ_STACK_SIZE / PAGE_SIZE;
-+		void *s = (void *)__get_free_pages(GFP_KERNEL, irq_pages);
-+
-+		irq_stack[i] = s;
-+		pr_debug("CPU%d IRQ stack at 0x%p - 0x%p\n", i,
-+			irq_stack[i], irq_stack[i] + IRQ_STACK_SIZE);
-+	}
- }
- 
- #ifdef CONFIG_DEBUG_STACKOVERFLOW
-diff --git a/arch/mips/kernel/process.c b/arch/mips/kernel/process.c
-index 1652f36..fbbf5fc 100644
---- a/arch/mips/kernel/process.c
-+++ b/arch/mips/kernel/process.c
-@@ -33,6 +33,7 @@
- #include <asm/dsemul.h>
- #include <asm/dsp.h>
- #include <asm/fpu.h>
-+#include <asm/irq.h>
- #include <asm/msa.h>
- #include <asm/pgtable.h>
- #include <asm/mipsregs.h>
-@@ -556,7 +557,19 @@ EXPORT_SYMBOL(unwind_stack_by_address);
- unsigned long unwind_stack(struct task_struct *task, unsigned long *sp,
- 			   unsigned long pc, unsigned long *ra)
- {
--	unsigned long stack_page = (unsigned long)task_stack_page(task);
-+	unsigned long stack_page = 0;
-+	int cpu;
-+
-+	for_each_possible_cpu(cpu) {
-+		if (on_irq_stack(cpu, *sp)) {
-+			stack_page = (unsigned long)irq_stack[cpu];
-+			break;
-+		}
-+	}
-+
-+	if (!stack_page)
-+		stack_page = (unsigned long)task_stack_page(task);
-+
- 	return unwind_stack_by_address(stack_page, sp, pc, ra);
- }
- #endif
-diff --git a/block/blk-mq.c b/block/blk-mq.c
-index ee54ad0..7b597ec 100644
---- a/block/blk-mq.c
-+++ b/block/blk-mq.c
-@@ -1474,7 +1474,7 @@ static struct blk_mq_tags *blk_mq_init_rq_map(struct blk_mq_tag_set *set,
- 	INIT_LIST_HEAD(&tags->page_list);
- 
- 	tags->rqs = kzalloc_node(set->queue_depth * sizeof(struct request *),
--				 GFP_KERNEL | __GFP_NOWARN | __GFP_NORETRY,
-+				 GFP_NOIO | __GFP_NOWARN | __GFP_NORETRY,
- 				 set->numa_node);
- 	if (!tags->rqs) {
- 		blk_mq_free_tags(tags);
-@@ -1500,7 +1500,7 @@ static struct blk_mq_tags *blk_mq_init_rq_map(struct blk_mq_tag_set *set,
- 
- 		do {
- 			page = alloc_pages_node(set->numa_node,
--				GFP_KERNEL | __GFP_NOWARN | __GFP_NORETRY | __GFP_ZERO,
-+				GFP_NOIO | __GFP_NOWARN | __GFP_NORETRY | __GFP_ZERO,
- 				this_order);
- 			if (page)
- 				break;
-@@ -1521,7 +1521,7 @@ static struct blk_mq_tags *blk_mq_init_rq_map(struct blk_mq_tag_set *set,
- 		 * Allow kmemleak to scan these pages as they contain pointers
- 		 * to additional allocations like via ops->init_request().
- 		 */
--		kmemleak_alloc(p, order_to_size(this_order), 1, GFP_KERNEL);
-+		kmemleak_alloc(p, order_to_size(this_order), 1, GFP_NOIO);
- 		entries_per_page = order_to_size(this_order) / rq_size;
- 		to_do = min(entries_per_page, set->queue_depth - i);
- 		left -= to_do * rq_size;
-diff --git a/drivers/crypto/caam/caampkc.c b/drivers/crypto/caam/caampkc.c
-index 851015e..354a16a 100644
---- a/drivers/crypto/caam/caampkc.c
-+++ b/drivers/crypto/caam/caampkc.c
-@@ -506,7 +506,7 @@ static int caam_rsa_init_tfm(struct crypto_akcipher *tfm)
- 	ctx->dev = caam_jr_alloc();
- 
- 	if (IS_ERR(ctx->dev)) {
--		dev_err(ctx->dev, "Job Ring Device allocation for transform failed\n");
-+		pr_err("Job Ring Device allocation for transform failed\n");
- 		return PTR_ERR(ctx->dev);
- 	}
- 
-diff --git a/drivers/crypto/caam/ctrl.c b/drivers/crypto/caam/ctrl.c
-index e483b78..98468b9 100644
---- a/drivers/crypto/caam/ctrl.c
-+++ b/drivers/crypto/caam/ctrl.c
-@@ -282,7 +282,8 @@ static int deinstantiate_rng(struct device *ctrldev, int state_handle_mask)
- 			/* Try to run it through DECO0 */
- 			ret = run_descriptor_deco0(ctrldev, desc, &status);
- 
--			if (ret || status) {
-+			if (ret ||
-+			    (status && status != JRSTA_SSRC_JUMP_HALT_CC)) {
- 				dev_err(ctrldev,
- 					"Failed to deinstantiate RNG4 SH%d\n",
- 					sh_idx);
-diff --git a/drivers/dma-buf/dma-buf.c b/drivers/dma-buf/dma-buf.c
-index cf04d24..6b54e02 100644
---- a/drivers/dma-buf/dma-buf.c
-+++ b/drivers/dma-buf/dma-buf.c
-@@ -303,6 +303,9 @@ static const struct file_operations dma_buf_fops = {
- 	.llseek		= dma_buf_llseek,
- 	.poll		= dma_buf_poll,
- 	.unlocked_ioctl	= dma_buf_ioctl,
-+#ifdef CONFIG_COMPAT
-+	.compat_ioctl	= dma_buf_ioctl,
-+#endif
- };
- 
- /*
-diff --git a/drivers/gpu/drm/i915/i915_drv.c b/drivers/gpu/drm/i915/i915_drv.c
-index 670beeb..923150d 100644
---- a/drivers/gpu/drm/i915/i915_drv.c
-+++ b/drivers/gpu/drm/i915/i915_drv.c
-@@ -240,6 +240,7 @@ static int i915_getparam(struct drm_device *dev, void *data,
- 	case I915_PARAM_IRQ_ACTIVE:
- 	case I915_PARAM_ALLOW_BATCHBUFFER:
- 	case I915_PARAM_LAST_DISPATCH:
-+	case I915_PARAM_HAS_EXEC_CONSTANTS:
- 		/* Reject all old ums/dri params. */
- 		return -ENODEV;
- 	case I915_PARAM_CHIPSET_ID:
-@@ -266,9 +267,6 @@ static int i915_getparam(struct drm_device *dev, void *data,
- 	case I915_PARAM_HAS_BSD2:
- 		value = intel_engine_initialized(&dev_priv->engine[VCS2]);
- 		break;
--	case I915_PARAM_HAS_EXEC_CONSTANTS:
--		value = INTEL_GEN(dev_priv) >= 4;
--		break;
- 	case I915_PARAM_HAS_LLC:
- 		value = HAS_LLC(dev_priv);
- 		break;
-diff --git a/drivers/gpu/drm/i915/i915_drv.h b/drivers/gpu/drm/i915/i915_drv.h
-index da832d3..e0d7245 100644
---- a/drivers/gpu/drm/i915/i915_drv.h
-+++ b/drivers/gpu/drm/i915/i915_drv.h
-@@ -1225,7 +1225,7 @@ struct intel_gen6_power_mgmt {
- 	unsigned boosts;
- 
- 	/* manual wa residency calculations */
--	struct intel_rps_ei up_ei, down_ei;
-+	struct intel_rps_ei ei;
- 
- 	/*
- 	 * Protects RPS/RC6 register access and PCU communication.
-@@ -1751,8 +1751,6 @@ struct drm_i915_private {
- 
- 	const struct intel_device_info info;
- 
--	int relative_constants_mode;
--
- 	void __iomem *regs;
- 
- 	struct intel_uncore uncore;
-diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c
-index 00eb481..7b203092 100644
---- a/drivers/gpu/drm/i915/i915_gem.c
-+++ b/drivers/gpu/drm/i915/i915_gem.c
-@@ -4587,8 +4587,6 @@ i915_gem_load_init(struct drm_device *dev)
- 	init_waitqueue_head(&dev_priv->gpu_error.wait_queue);
- 	init_waitqueue_head(&dev_priv->gpu_error.reset_queue);
- 
--	dev_priv->relative_constants_mode = I915_EXEC_CONSTANTS_REL_GENERAL;
--
- 	init_waitqueue_head(&dev_priv->pending_flip_queue);
- 
- 	dev_priv->mm.interruptible = true;
-diff --git a/drivers/gpu/drm/i915/i915_gem_execbuffer.c b/drivers/gpu/drm/i915/i915_gem_execbuffer.c
-index 0c400f8..2117f17 100644
---- a/drivers/gpu/drm/i915/i915_gem_execbuffer.c
-+++ b/drivers/gpu/drm/i915/i915_gem_execbuffer.c
-@@ -1454,10 +1454,7 @@ execbuf_submit(struct i915_execbuffer_params *params,
- 	       struct drm_i915_gem_execbuffer2 *args,
- 	       struct list_head *vmas)
- {
--	struct drm_i915_private *dev_priv = params->request->i915;
- 	u64 exec_start, exec_len;
--	int instp_mode;
--	u32 instp_mask;
- 	int ret;
- 
- 	ret = i915_gem_execbuffer_move_to_gpu(params->request, vmas);
-@@ -1468,56 +1465,11 @@ execbuf_submit(struct i915_execbuffer_params *params,
- 	if (ret)
- 		return ret;
- 
--	instp_mode = args->flags & I915_EXEC_CONSTANTS_MASK;
--	instp_mask = I915_EXEC_CONSTANTS_MASK;
--	switch (instp_mode) {
--	case I915_EXEC_CONSTANTS_REL_GENERAL:
--	case I915_EXEC_CONSTANTS_ABSOLUTE:
--	case I915_EXEC_CONSTANTS_REL_SURFACE:
--		if (instp_mode != 0 && params->engine->id != RCS) {
--			DRM_DEBUG("non-0 rel constants mode on non-RCS\n");
--			return -EINVAL;
--		}
--
--		if (instp_mode != dev_priv->relative_constants_mode) {
--			if (INTEL_INFO(dev_priv)->gen < 4) {
--				DRM_DEBUG("no rel constants on pre-gen4\n");
--				return -EINVAL;
--			}
--
--			if (INTEL_INFO(dev_priv)->gen > 5 &&
--			    instp_mode == I915_EXEC_CONSTANTS_REL_SURFACE) {
--				DRM_DEBUG("rel surface constants mode invalid on gen5+\n");
--				return -EINVAL;
--			}
--
--			/* The HW changed the meaning on this bit on gen6 */
--			if (INTEL_INFO(dev_priv)->gen >= 6)
--				instp_mask &= ~I915_EXEC_CONSTANTS_REL_SURFACE;
--		}
--		break;
--	default:
--		DRM_DEBUG("execbuf with unknown constants: %d\n", instp_mode);
-+	if (args->flags & I915_EXEC_CONSTANTS_MASK) {
-+		DRM_DEBUG("I915_EXEC_CONSTANTS_* unsupported\n");
- 		return -EINVAL;
- 	}
- 
--	if (params->engine->id == RCS &&
--	    instp_mode != dev_priv->relative_constants_mode) {
--		struct intel_ring *ring = params->request->ring;
--
--		ret = intel_ring_begin(params->request, 4);
--		if (ret)
--			return ret;
--
--		intel_ring_emit(ring, MI_NOOP);
--		intel_ring_emit(ring, MI_LOAD_REGISTER_IMM(1));
--		intel_ring_emit_reg(ring, INSTPM);
--		intel_ring_emit(ring, instp_mask << 16 | instp_mode);
--		intel_ring_advance(ring);
--
--		dev_priv->relative_constants_mode = instp_mode;
--	}
--
- 	if (args->flags & I915_EXEC_GEN7_SOL_RESET) {
- 		ret = i915_reset_gen7_sol_offsets(params->request);
- 		if (ret)
-diff --git a/drivers/gpu/drm/i915/i915_gem_shrinker.c b/drivers/gpu/drm/i915/i915_gem_shrinker.c
-index 1c237d0..755d788 100644
---- a/drivers/gpu/drm/i915/i915_gem_shrinker.c
-+++ b/drivers/gpu/drm/i915/i915_gem_shrinker.c
-@@ -233,7 +233,7 @@ unsigned long i915_gem_shrink_all(struct drm_i915_private *dev_priv)
- 				I915_SHRINK_BOUND |
- 				I915_SHRINK_UNBOUND |
- 				I915_SHRINK_ACTIVE);
--	rcu_barrier(); /* wait until our RCU delayed slab frees are completed */
-+	synchronize_rcu(); /* wait for our earlier RCU delayed slab frees */
- 
- 	return freed;
- }
-diff --git a/drivers/gpu/drm/i915/i915_irq.c b/drivers/gpu/drm/i915/i915_irq.c
-index 3fc286c..02908e3 100644
---- a/drivers/gpu/drm/i915/i915_irq.c
-+++ b/drivers/gpu/drm/i915/i915_irq.c
-@@ -990,68 +990,51 @@ static void vlv_c0_read(struct drm_i915_private *dev_priv,
- 	ei->media_c0 = I915_READ(VLV_MEDIA_C0_COUNT);
- }
- 
--static bool vlv_c0_above(struct drm_i915_private *dev_priv,
--			 const struct intel_rps_ei *old,
--			 const struct intel_rps_ei *now,
--			 int threshold)
--{
--	u64 time, c0;
--	unsigned int mul = 100;
--
--	if (old->cz_clock == 0)
--		return false;
--
--	if (I915_READ(VLV_COUNTER_CONTROL) & VLV_COUNT_RANGE_HIGH)
--		mul <<= 8;
--
--	time = now->cz_clock - old->cz_clock;
--	time *= threshold * dev_priv->czclk_freq;
--
--	/* Workload can be split between render + media, e.g. SwapBuffers
--	 * being blitted in X after being rendered in mesa. To account for
--	 * this we need to combine both engines into our activity counter.
--	 */
--	c0 = now->render_c0 - old->render_c0;
--	c0 += now->media_c0 - old->media_c0;
--	c0 *= mul * VLV_CZ_CLOCK_TO_MILLI_SEC;
--
--	return c0 >= time;
--}
--
- void gen6_rps_reset_ei(struct drm_i915_private *dev_priv)
- {
--	vlv_c0_read(dev_priv, &dev_priv->rps.down_ei);
--	dev_priv->rps.up_ei = dev_priv->rps.down_ei;
-+	memset(&dev_priv->rps.ei, 0, sizeof(dev_priv->rps.ei));
- }
- 
- static u32 vlv_wa_c0_ei(struct drm_i915_private *dev_priv, u32 pm_iir)
- {
-+	const struct intel_rps_ei *prev = &dev_priv->rps.ei;
- 	struct intel_rps_ei now;
- 	u32 events = 0;
- 
--	if ((pm_iir & (GEN6_PM_RP_DOWN_EI_EXPIRED | GEN6_PM_RP_UP_EI_EXPIRED)) == 0)
-+	if ((pm_iir & GEN6_PM_RP_UP_EI_EXPIRED) == 0)
- 		return 0;
- 
- 	vlv_c0_read(dev_priv, &now);
- 	if (now.cz_clock == 0)
- 		return 0;
- 
--	if (pm_iir & GEN6_PM_RP_DOWN_EI_EXPIRED) {
--		if (!vlv_c0_above(dev_priv,
--				  &dev_priv->rps.down_ei, &now,
--				  dev_priv->rps.down_threshold))
--			events |= GEN6_PM_RP_DOWN_THRESHOLD;
--		dev_priv->rps.down_ei = now;
--	}
-+	if (prev->cz_clock) {
-+		u64 time, c0;
-+		unsigned int mul;
-+
-+		mul = VLV_CZ_CLOCK_TO_MILLI_SEC * 100; /* scale to threshold% */
-+		if (I915_READ(VLV_COUNTER_CONTROL) & VLV_COUNT_RANGE_HIGH)
-+			mul <<= 8;
- 
--	if (pm_iir & GEN6_PM_RP_UP_EI_EXPIRED) {
--		if (vlv_c0_above(dev_priv,
--				 &dev_priv->rps.up_ei, &now,
--				 dev_priv->rps.up_threshold))
--			events |= GEN6_PM_RP_UP_THRESHOLD;
--		dev_priv->rps.up_ei = now;
-+		time = now.cz_clock - prev->cz_clock;
-+		time *= dev_priv->czclk_freq;
-+
-+		/* Workload can be split between render + media,
-+		 * e.g. SwapBuffers being blitted in X after being rendered in
-+		 * mesa. To account for this we need to combine both engines
-+		 * into our activity counter.
-+		 */
-+		c0 = now.render_c0 - prev->render_c0;
-+		c0 += now.media_c0 - prev->media_c0;
-+		c0 *= mul;
-+
-+		if (c0 > time * dev_priv->rps.up_threshold)
-+			events = GEN6_PM_RP_UP_THRESHOLD;
-+		else if (c0 < time * dev_priv->rps.down_threshold)
-+			events = GEN6_PM_RP_DOWN_THRESHOLD;
- 	}
- 
-+	dev_priv->rps.ei = now;
- 	return events;
- }
- 
-@@ -4490,7 +4473,7 @@ void intel_irq_init(struct drm_i915_private *dev_priv)
- 	/* Let's track the enabled rps events */
- 	if (IS_VALLEYVIEW(dev_priv))
- 		/* WaGsvRC0ResidencyMethod:vlv */
--		dev_priv->pm_rps_events = GEN6_PM_RP_DOWN_EI_EXPIRED | GEN6_PM_RP_UP_EI_EXPIRED;
-+		dev_priv->pm_rps_events = GEN6_PM_RP_UP_EI_EXPIRED;
- 	else
- 		dev_priv->pm_rps_events = GEN6_PM_RPS_EVENTS;
- 
-@@ -4531,6 +4514,16 @@ void intel_irq_init(struct drm_i915_private *dev_priv)
- 	if (!IS_GEN2(dev_priv))
- 		dev->vblank_disable_immediate = true;
- 
-+	/* Most platforms treat the display irq block as an always-on
-+	 * power domain. vlv/chv can disable it at runtime and need
-+	 * special care to avoid writing any of the display block registers
-+	 * outside of the power domain. We defer setting up the display irqs
-+	 * in this case to the runtime pm.
-+	 */
-+	dev_priv->display_irqs_enabled = true;
-+	if (IS_VALLEYVIEW(dev_priv) || IS_CHERRYVIEW(dev_priv))
-+		dev_priv->display_irqs_enabled = false;
-+
- 	dev->driver->get_vblank_timestamp = i915_get_vblank_timestamp;
- 	dev->driver->get_scanout_position = i915_get_crtc_scanoutpos;
- 
-diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
-index b9be8a6..5dc6082 100644
---- a/drivers/gpu/drm/i915/intel_display.c
-+++ b/drivers/gpu/drm/i915/intel_display.c
-@@ -3696,10 +3696,6 @@ static void intel_update_pipe_config(struct intel_crtc *crtc,
- 	/* drm_atomic_helper_update_legacy_modeset_state might not be called. */
- 	crtc->base.mode = crtc->base.state->mode;
- 
--	DRM_DEBUG_KMS("Updating pipe size %ix%i -> %ix%i\n",
--		      old_crtc_state->pipe_src_w, old_crtc_state->pipe_src_h,
--		      pipe_config->pipe_src_w, pipe_config->pipe_src_h);
--
- 	/*
- 	 * Update pipe size and adjust fitter if needed: the reason for this is
- 	 * that in compute_mode_changes we check the native mode (not the pfit
-@@ -4832,23 +4828,17 @@ static void skylake_pfit_enable(struct intel_crtc *crtc)
- 	struct intel_crtc_scaler_state *scaler_state =
- 		&crtc->config->scaler_state;
- 
--	DRM_DEBUG_KMS("for crtc_state = %p\n", crtc->config);
--
- 	if (crtc->config->pch_pfit.enabled) {
- 		int id;
- 
--		if (WARN_ON(crtc->config->scaler_state.scaler_id < 0)) {
--			DRM_ERROR("Requesting pfit without getting a scaler first\n");
-+		if (WARN_ON(crtc->config->scaler_state.scaler_id < 0))
- 			return;
--		}
- 
- 		id = scaler_state->scaler_id;
- 		I915_WRITE(SKL_PS_CTRL(pipe, id), PS_SCALER_EN |
- 			PS_FILTER_MEDIUM | scaler_state->scalers[id].mode);
- 		I915_WRITE(SKL_PS_WIN_POS(pipe, id), crtc->config->pch_pfit.pos);
- 		I915_WRITE(SKL_PS_WIN_SZ(pipe, id), crtc->config->pch_pfit.size);
--
--		DRM_DEBUG_KMS("for crtc_state = %p scaler_id = %d\n", crtc->config, id);
- 	}
- }
- 
-diff --git a/drivers/gpu/drm/i915/intel_hotplug.c b/drivers/gpu/drm/i915/intel_hotplug.c
-index 334d47b..db3afdf 100644
---- a/drivers/gpu/drm/i915/intel_hotplug.c
-+++ b/drivers/gpu/drm/i915/intel_hotplug.c
-@@ -219,7 +219,7 @@ static void intel_hpd_irq_storm_reenable_work(struct work_struct *work)
- 			}
- 		}
- 	}
--	if (dev_priv->display.hpd_irq_setup)
-+	if (dev_priv->display_irqs_enabled && dev_priv->display.hpd_irq_setup)
- 		dev_priv->display.hpd_irq_setup(dev_priv);
- 	spin_unlock_irq(&dev_priv->irq_lock);
- 
-@@ -425,7 +425,7 @@ void intel_hpd_irq_handler(struct drm_i915_private *dev_priv,
- 		}
- 	}
- 
--	if (storm_detected)
-+	if (storm_detected && dev_priv->display_irqs_enabled)
- 		dev_priv->display.hpd_irq_setup(dev_priv);
- 	spin_unlock(&dev_priv->irq_lock);
- 
-@@ -471,10 +471,12 @@ void intel_hpd_init(struct drm_i915_private *dev_priv)
- 	 * Interrupt setup is already guaranteed to be single-threaded, this is
- 	 * just to make the assert_spin_locked checks happy.
- 	 */
--	spin_lock_irq(&dev_priv->irq_lock);
--	if (dev_priv->display.hpd_irq_setup)
--		dev_priv->display.hpd_irq_setup(dev_priv);
--	spin_unlock_irq(&dev_priv->irq_lock);
-+	if (dev_priv->display_irqs_enabled && dev_priv->display.hpd_irq_setup) {
-+		spin_lock_irq(&dev_priv->irq_lock);
-+		if (dev_priv->display_irqs_enabled)
-+			dev_priv->display.hpd_irq_setup(dev_priv);
-+		spin_unlock_irq(&dev_priv->irq_lock);
-+	}
- }
- 
- static void i915_hpd_poll_init_work(struct work_struct *work)
-diff --git a/drivers/gpu/drm/i915/intel_lrc.c b/drivers/gpu/drm/i915/intel_lrc.c
-index 4147e51..67db157 100644
---- a/drivers/gpu/drm/i915/intel_lrc.c
-+++ b/drivers/gpu/drm/i915/intel_lrc.c
-@@ -2152,42 +2152,30 @@ static int execlists_context_deferred_alloc(struct i915_gem_context *ctx,
- 
- void intel_lr_context_resume(struct drm_i915_private *dev_priv)
- {
-+	struct i915_gem_context *ctx = dev_priv->kernel_context;
- 	struct intel_engine_cs *engine;
--	struct i915_gem_context *ctx;
--
--	/* Because we emit WA_TAIL_DWORDS there may be a disparity
--	 * between our bookkeeping in ce->ring->head and ce->ring->tail and
--	 * that stored in context. As we only write new commands from
--	 * ce->ring->tail onwards, everything before that is junk. If the GPU
--	 * starts reading from its RING_HEAD from the context, it may try to
--	 * execute that junk and die.
--	 *
--	 * So to avoid that we reset the context images upon resume. For
--	 * simplicity, we just zero everything out.
--	 */
--	list_for_each_entry(ctx, &dev_priv->context_list, link) {
--		for_each_engine(engine, dev_priv) {
--			struct intel_context *ce = &ctx->engine[engine->id];
--			u32 *reg;
- 
--			if (!ce->state)
--				continue;
-+	for_each_engine(engine, dev_priv) {
-+		struct intel_context *ce = &ctx->engine[engine->id];
-+		void *vaddr;
-+		uint32_t *reg_state;
- 
--			reg = i915_gem_object_pin_map(ce->state->obj,
--						      I915_MAP_WB);
--			if (WARN_ON(IS_ERR(reg)))
--				continue;
-+		if (!ce->state)
-+			continue;
- 
--			reg += LRC_STATE_PN * PAGE_SIZE / sizeof(*reg);
--			reg[CTX_RING_HEAD+1] = 0;
--			reg[CTX_RING_TAIL+1] = 0;
-+		vaddr = i915_gem_object_pin_map(ce->state->obj, I915_MAP_WB);
-+		if (WARN_ON(IS_ERR(vaddr)))
-+			continue;
- 
--			ce->state->obj->dirty = true;
--			i915_gem_object_unpin_map(ce->state->obj);
-+		reg_state = vaddr + LRC_STATE_PN * PAGE_SIZE;
- 
--			ce->ring->head = ce->ring->tail = 0;
--			ce->ring->last_retired_head = -1;
--			intel_ring_update_space(ce->ring);
--		}
-+		reg_state[CTX_RING_HEAD+1] = 0;
-+		reg_state[CTX_RING_TAIL+1] = 0;
-+
-+		ce->state->obj->dirty = true;
-+		i915_gem_object_unpin_map(ce->state->obj);
-+
-+		ce->ring->head = 0;
-+		ce->ring->tail = 0;
- 	}
- }
-diff --git a/drivers/gpu/drm/i915/intel_pm.c b/drivers/gpu/drm/i915/intel_pm.c
-index e559a45..2c6d59d 100644
---- a/drivers/gpu/drm/i915/intel_pm.c
-+++ b/drivers/gpu/drm/i915/intel_pm.c
-@@ -4903,6 +4903,12 @@ static void gen6_set_rps_thresholds(struct drm_i915_private *dev_priv, u8 val)
- 		break;
- 	}
- 
-+	/* When byt can survive without system hang with dynamic
-+	 * sw freq adjustments, this restriction can be lifted.
-+	 */
-+	if (IS_VALLEYVIEW(dev_priv))
-+		goto skip_hw_write;
-+
- 	I915_WRITE(GEN6_RP_UP_EI,
- 		   GT_INTERVAL_FROM_US(dev_priv, ei_up));
- 	I915_WRITE(GEN6_RP_UP_THRESHOLD,
-@@ -4923,6 +4929,7 @@ static void gen6_set_rps_thresholds(struct drm_i915_private *dev_priv, u8 val)
- 		   GEN6_RP_UP_BUSY_AVG |
- 		   GEN6_RP_DOWN_IDLE_AVG);
- 
-+skip_hw_write:
- 	dev_priv->rps.power = new_power;
- 	dev_priv->rps.up_threshold = threshold_up;
- 	dev_priv->rps.down_threshold = threshold_down;
-@@ -4933,8 +4940,9 @@ static u32 gen6_rps_pm_mask(struct drm_i915_private *dev_priv, u8 val)
- {
- 	u32 mask = 0;
- 
-+	/* We use UP_EI_EXPIRED interupts for both up/down in manual mode */
- 	if (val > dev_priv->rps.min_freq_softlimit)
--		mask |= GEN6_PM_RP_DOWN_EI_EXPIRED | GEN6_PM_RP_DOWN_THRESHOLD | GEN6_PM_RP_DOWN_TIMEOUT;
-+		mask |= GEN6_PM_RP_UP_EI_EXPIRED | GEN6_PM_RP_DOWN_THRESHOLD | GEN6_PM_RP_DOWN_TIMEOUT;
- 	if (val < dev_priv->rps.max_freq_softlimit)
- 		mask |= GEN6_PM_RP_UP_EI_EXPIRED | GEN6_PM_RP_UP_THRESHOLD;
- 
-@@ -5034,7 +5042,7 @@ void gen6_rps_busy(struct drm_i915_private *dev_priv)
- {
- 	mutex_lock(&dev_priv->rps.hw_lock);
- 	if (dev_priv->rps.enabled) {
--		if (dev_priv->pm_rps_events & (GEN6_PM_RP_DOWN_EI_EXPIRED | GEN6_PM_RP_UP_EI_EXPIRED))
-+		if (dev_priv->pm_rps_events & GEN6_PM_RP_UP_EI_EXPIRED)
- 			gen6_rps_reset_ei(dev_priv);
- 		I915_WRITE(GEN6_PMINTRMSK,
- 			   gen6_rps_pm_mask(dev_priv, dev_priv->rps.cur_freq));
-@@ -7960,10 +7968,10 @@ static bool skl_pcode_try_request(struct drm_i915_private *dev_priv, u32 mbox,
-  * @timeout_base_ms: timeout for polling with preemption enabled
-  *
-  * Keep resending the @request to @mbox until PCODE acknowledges it, PCODE
-- * reports an error or an overall timeout of @timeout_base_ms+10 ms expires.
-+ * reports an error or an overall timeout of @timeout_base_ms+50 ms expires.
-  * The request is acknowledged once the PCODE reply dword equals @reply after
-  * applying @reply_mask. Polling is first attempted with preemption enabled
-- * for @timeout_base_ms and if this times out for another 10 ms with
-+ * for @timeout_base_ms and if this times out for another 50 ms with
-  * preemption disabled.
-  *
-  * Returns 0 on success, %-ETIMEDOUT in case of a timeout, <0 in case of some
-@@ -7999,14 +8007,15 @@ int skl_pcode_request(struct drm_i915_private *dev_priv, u32 mbox, u32 request,
- 	 * worst case) _and_ PCODE was busy for some reason even after a
- 	 * (queued) request and @timeout_base_ms delay. As a workaround retry
- 	 * the poll with preemption disabled to maximize the number of
--	 * requests. Increase the timeout from @timeout_base_ms to 10ms to
-+	 * requests. Increase the timeout from @timeout_base_ms to 50ms to
- 	 * account for interrupts that could reduce the number of these
--	 * requests.
-+	 * requests, and for any quirks of the PCODE firmware that delays
-+	 * the request completion.
- 	 */
- 	DRM_DEBUG_KMS("PCODE timeout, retrying with preemption disabled\n");
- 	WARN_ON_ONCE(timeout_base_ms > 3);
- 	preempt_disable();
--	ret = wait_for_atomic(COND, 10);
-+	ret = wait_for_atomic(COND, 50);
- 	preempt_enable();
- 
- out:
-diff --git a/drivers/i2c/busses/i2c-bcm2835.c b/drivers/i2c/busses/i2c-bcm2835.c
-index d4f3239..f283b71 100644
---- a/drivers/i2c/busses/i2c-bcm2835.c
-+++ b/drivers/i2c/busses/i2c-bcm2835.c
-@@ -64,6 +64,7 @@ struct bcm2835_i2c_dev {
- 	int irq;
- 	struct i2c_adapter adapter;
- 	struct completion completion;
-+	struct i2c_msg *curr_msg;
- 	u32 msg_err;
- 	u8 *msg_buf;
- 	size_t msg_buf_remaining;
-@@ -126,14 +127,13 @@ static irqreturn_t bcm2835_i2c_isr(int this_irq, void *data)
- 		return IRQ_HANDLED;
- 	}
- 
--	if (val & BCM2835_I2C_S_RXD) {
--		bcm2835_drain_rxfifo(i2c_dev);
--		if (!(val & BCM2835_I2C_S_DONE))
--			return IRQ_HANDLED;
--	}
--
- 	if (val & BCM2835_I2C_S_DONE) {
--		if (i2c_dev->msg_buf_remaining)
-+		if (i2c_dev->curr_msg->flags & I2C_M_RD) {
-+			bcm2835_drain_rxfifo(i2c_dev);
-+			val = bcm2835_i2c_readl(i2c_dev, BCM2835_I2C_S);
-+		}
-+
-+		if ((val & BCM2835_I2C_S_RXD) || i2c_dev->msg_buf_remaining)
- 			i2c_dev->msg_err = BCM2835_I2C_S_LEN;
- 		else
- 			i2c_dev->msg_err = 0;
-@@ -141,11 +141,16 @@ static irqreturn_t bcm2835_i2c_isr(int this_irq, void *data)
- 		return IRQ_HANDLED;
- 	}
- 
--	if (val & BCM2835_I2C_S_TXD) {
-+	if (val & BCM2835_I2C_S_TXW) {
- 		bcm2835_fill_txfifo(i2c_dev);
- 		return IRQ_HANDLED;
- 	}
- 
-+	if (val & BCM2835_I2C_S_RXR) {
-+		bcm2835_drain_rxfifo(i2c_dev);
-+		return IRQ_HANDLED;
-+	}
-+
- 	return IRQ_NONE;
- }
- 
-@@ -155,6 +160,7 @@ static int bcm2835_i2c_xfer_msg(struct bcm2835_i2c_dev *i2c_dev,
- 	u32 c;
- 	unsigned long time_left;
- 
-+	i2c_dev->curr_msg = msg;
- 	i2c_dev->msg_buf = msg->buf;
- 	i2c_dev->msg_buf_remaining = msg->len;
- 	reinit_completion(&i2c_dev->completion);
-diff --git a/drivers/mtd/bcm47xxpart.c b/drivers/mtd/bcm47xxpart.c
-index 3779475..283ff7e 100644
---- a/drivers/mtd/bcm47xxpart.c
-+++ b/drivers/mtd/bcm47xxpart.c
-@@ -229,12 +229,10 @@ static int bcm47xxpart_parse(struct mtd_info *master,
- 
- 			last_trx_part = curr_part - 1;
- 
--			/*
--			 * We have whole TRX scanned, skip to the next part. Use
--			 * roundown (not roundup), as the loop will increase
--			 * offset in next step.
--			 */
--			offset = rounddown(offset + trx->length, blocksize);
-+			/* Jump to the end of TRX */
-+			offset = roundup(offset + trx->length, blocksize);
-+			/* Next loop iteration will increase the offset */
-+			offset -= blocksize;
- 			continue;
- 		}
- 
-diff --git a/drivers/net/ethernet/mellanox/mlx4/cq.c b/drivers/net/ethernet/mellanox/mlx4/cq.c
-index a849da9..6b86353 100644
---- a/drivers/net/ethernet/mellanox/mlx4/cq.c
-+++ b/drivers/net/ethernet/mellanox/mlx4/cq.c
-@@ -101,13 +101,19 @@ void mlx4_cq_completion(struct mlx4_dev *dev, u32 cqn)
- {
- 	struct mlx4_cq *cq;
- 
-+	rcu_read_lock();
- 	cq = radix_tree_lookup(&mlx4_priv(dev)->cq_table.tree,
- 			       cqn & (dev->caps.num_cqs - 1));
-+	rcu_read_unlock();
-+
- 	if (!cq) {
- 		mlx4_dbg(dev, "Completion event for bogus CQ %08x\n", cqn);
- 		return;
- 	}
- 
-+	/* Acessing the CQ outside of rcu_read_lock is safe, because
-+	 * the CQ is freed only after interrupt handling is completed.
-+	 */
- 	++cq->arm_sn;
- 
- 	cq->comp(cq);
-@@ -118,23 +124,19 @@ void mlx4_cq_event(struct mlx4_dev *dev, u32 cqn, int event_type)
- 	struct mlx4_cq_table *cq_table = &mlx4_priv(dev)->cq_table;
- 	struct mlx4_cq *cq;
- 
--	spin_lock(&cq_table->lock);
--
-+	rcu_read_lock();
- 	cq = radix_tree_lookup(&cq_table->tree, cqn & (dev->caps.num_cqs - 1));
--	if (cq)
--		atomic_inc(&cq->refcount);
--
--	spin_unlock(&cq_table->lock);
-+	rcu_read_unlock();
- 
- 	if (!cq) {
--		mlx4_warn(dev, "Async event for bogus CQ %08x\n", cqn);
-+		mlx4_dbg(dev, "Async event for bogus CQ %08x\n", cqn);
- 		return;
- 	}
- 
-+	/* Acessing the CQ outside of rcu_read_lock is safe, because
-+	 * the CQ is freed only after interrupt handling is completed.
-+	 */
- 	cq->event(cq, event_type);
--
--	if (atomic_dec_and_test(&cq->refcount))
--		complete(&cq->free);
- }
- 
- static int mlx4_SW2HW_CQ(struct mlx4_dev *dev, struct mlx4_cmd_mailbox *mailbox,
-@@ -301,9 +303,9 @@ int mlx4_cq_alloc(struct mlx4_dev *dev, int nent,
- 	if (err)
- 		return err;
- 
--	spin_lock_irq(&cq_table->lock);
-+	spin_lock(&cq_table->lock);
- 	err = radix_tree_insert(&cq_table->tree, cq->cqn, cq);
--	spin_unlock_irq(&cq_table->lock);
-+	spin_unlock(&cq_table->lock);
- 	if (err)
- 		goto err_icm;
- 
-@@ -349,9 +351,9 @@ int mlx4_cq_alloc(struct mlx4_dev *dev, int nent,
- 	return 0;
- 
- err_radix:
--	spin_lock_irq(&cq_table->lock);
-+	spin_lock(&cq_table->lock);
- 	radix_tree_delete(&cq_table->tree, cq->cqn);
--	spin_unlock_irq(&cq_table->lock);
-+	spin_unlock(&cq_table->lock);
- 
- err_icm:
- 	mlx4_cq_free_icm(dev, cq->cqn);
-@@ -370,15 +372,15 @@ void mlx4_cq_free(struct mlx4_dev *dev, struct mlx4_cq *cq)
- 	if (err)
- 		mlx4_warn(dev, "HW2SW_CQ failed (%d) for CQN %06x\n", err, cq->cqn);
- 
-+	spin_lock(&cq_table->lock);
-+	radix_tree_delete(&cq_table->tree, cq->cqn);
-+	spin_unlock(&cq_table->lock);
-+
- 	synchronize_irq(priv->eq_table.eq[MLX4_CQ_TO_EQ_VECTOR(cq->vector)].irq);
- 	if (priv->eq_table.eq[MLX4_CQ_TO_EQ_VECTOR(cq->vector)].irq !=
- 	    priv->eq_table.eq[MLX4_EQ_ASYNC].irq)
- 		synchronize_irq(priv->eq_table.eq[MLX4_EQ_ASYNC].irq);
- 
--	spin_lock_irq(&cq_table->lock);
--	radix_tree_delete(&cq_table->tree, cq->cqn);
--	spin_unlock_irq(&cq_table->lock);
--
- 	if (atomic_dec_and_test(&cq->refcount))
- 		complete(&cq->free);
- 	wait_for_completion(&cq->free);
-diff --git a/drivers/net/ethernet/mellanox/mlx4/en_rx.c b/drivers/net/ethernet/mellanox/mlx4/en_rx.c
-index 4d3ddc2..5d48458 100644
---- a/drivers/net/ethernet/mellanox/mlx4/en_rx.c
-+++ b/drivers/net/ethernet/mellanox/mlx4/en_rx.c
-@@ -444,8 +444,14 @@ int mlx4_en_activate_rx_rings(struct mlx4_en_priv *priv)
- 		ring->cqn = priv->rx_cq[ring_ind]->mcq.cqn;
- 
- 		ring->stride = stride;
--		if (ring->stride <= TXBB_SIZE)
-+		if (ring->stride <= TXBB_SIZE) {
-+			/* Stamp first unused send wqe */
-+			__be32 *ptr = (__be32 *)ring->buf;
-+			__be32 stamp = cpu_to_be32(1 << STAMP_SHIFT);
-+			*ptr = stamp;
-+			/* Move pointer to start of rx section */
- 			ring->buf += TXBB_SIZE;
-+		}
- 
- 		ring->log_stride = ffs(ring->stride) - 1;
- 		ring->buf_size = ring->size * ring->stride;
-diff --git a/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c b/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c
-index c548bea..32f76bf 100644
---- a/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c
-+++ b/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c
-@@ -2980,6 +2980,9 @@ int mlx4_RST2INIT_QP_wrapper(struct mlx4_dev *dev, int slave,
- 		put_res(dev, slave, srqn, RES_SRQ);
- 		qp->srq = srq;
- 	}
-+
-+	/* Save param3 for dynamic changes from VST back to VGT */
-+	qp->param3 = qpc->param3;
- 	put_res(dev, slave, rcqn, RES_CQ);
- 	put_res(dev, slave, mtt_base, RES_MTT);
- 	res_end_move(dev, slave, RES_QP, qpn);
-@@ -3772,7 +3775,6 @@ int mlx4_INIT2RTR_QP_wrapper(struct mlx4_dev *dev, int slave,
- 	int qpn = vhcr->in_modifier & 0x7fffff;
- 	struct res_qp *qp;
- 	u8 orig_sched_queue;
--	__be32	orig_param3 = qpc->param3;
- 	u8 orig_vlan_control = qpc->pri_path.vlan_control;
- 	u8 orig_fvl_rx = qpc->pri_path.fvl_rx;
- 	u8 orig_pri_path_fl = qpc->pri_path.fl;
-@@ -3814,7 +3816,6 @@ int mlx4_INIT2RTR_QP_wrapper(struct mlx4_dev *dev, int slave,
- 	 */
- 	if (!err) {
- 		qp->sched_queue = orig_sched_queue;
--		qp->param3	= orig_param3;
- 		qp->vlan_control = orig_vlan_control;
- 		qp->fvl_rx	=  orig_fvl_rx;
- 		qp->pri_path_fl = orig_pri_path_fl;
-diff --git a/drivers/net/wireless/ralink/rt2x00/rt2x00dev.c b/drivers/net/wireless/ralink/rt2x00/rt2x00dev.c
-index 4e0c565..b7273be 100644
---- a/drivers/net/wireless/ralink/rt2x00/rt2x00dev.c
-+++ b/drivers/net/wireless/ralink/rt2x00/rt2x00dev.c
-@@ -1422,7 +1422,7 @@ void rt2x00lib_remove_dev(struct rt2x00_dev *rt2x00dev)
- 	cancel_work_sync(&rt2x00dev->intf_work);
- 	cancel_delayed_work_sync(&rt2x00dev->autowakeup_work);
- 	cancel_work_sync(&rt2x00dev->sleep_work);
--#ifdef CONFIG_RT2X00_LIB_USB
-+#if IS_ENABLED(CONFIG_RT2X00_LIB_USB)
- 	if (rt2x00_is_usb(rt2x00dev)) {
- 		usb_kill_anchored_urbs(rt2x00dev->anchor);
- 		hrtimer_cancel(&rt2x00dev->txstatus_timer);
-diff --git a/drivers/net/wireless/ralink/rt2x00/rt2x00usb.c b/drivers/net/wireless/ralink/rt2x00/rt2x00usb.c
-index 6005e14..662705e 100644
---- a/drivers/net/wireless/ralink/rt2x00/rt2x00usb.c
-+++ b/drivers/net/wireless/ralink/rt2x00/rt2x00usb.c
-@@ -319,10 +319,8 @@ static bool rt2x00usb_kick_tx_entry(struct queue_entry *entry, void *data)
- 			  entry->skb->data, length,
- 			  rt2x00usb_interrupt_txdone, entry);
- 
--	usb_anchor_urb(entry_priv->urb, rt2x00dev->anchor);
- 	status = usb_submit_urb(entry_priv->urb, GFP_ATOMIC);
- 	if (status) {
--		usb_unanchor_urb(entry_priv->urb);
- 		if (status == -ENODEV)
- 			clear_bit(DEVICE_STATE_PRESENT, &rt2x00dev->flags);
- 		set_bit(ENTRY_DATA_IO_FAILED, &entry->flags);
-@@ -410,10 +408,8 @@ static bool rt2x00usb_kick_rx_entry(struct queue_entry *entry, void *data)
- 			  entry->skb->data, entry->skb->len,
- 			  rt2x00usb_interrupt_rxdone, entry);
- 
--	usb_anchor_urb(entry_priv->urb, rt2x00dev->anchor);
- 	status = usb_submit_urb(entry_priv->urb, GFP_ATOMIC);
- 	if (status) {
--		usb_unanchor_urb(entry_priv->urb);
- 		if (status == -ENODEV)
- 			clear_bit(DEVICE_STATE_PRESENT, &rt2x00dev->flags);
- 		set_bit(ENTRY_DATA_IO_FAILED, &entry->flags);
-@@ -824,10 +820,6 @@ int rt2x00usb_probe(struct usb_interface *usb_intf,
- 	if (retval)
- 		goto exit_free_device;
- 
--	retval = rt2x00lib_probe_dev(rt2x00dev);
--	if (retval)
--		goto exit_free_reg;
--
- 	rt2x00dev->anchor = devm_kmalloc(&usb_dev->dev,
- 					sizeof(struct usb_anchor),
- 					GFP_KERNEL);
-@@ -835,10 +827,17 @@ int rt2x00usb_probe(struct usb_interface *usb_intf,
- 		retval = -ENOMEM;
- 		goto exit_free_reg;
- 	}
--
- 	init_usb_anchor(rt2x00dev->anchor);
-+
-+	retval = rt2x00lib_probe_dev(rt2x00dev);
-+	if (retval)
-+		goto exit_free_anchor;
-+
- 	return 0;
- 
-+exit_free_anchor:
-+	usb_kill_anchored_urbs(rt2x00dev->anchor);
-+
- exit_free_reg:
- 	rt2x00usb_free_reg(rt2x00dev);
- 
-diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
-index c28ccf1..35fb2bef 100644
---- a/drivers/usb/core/hub.c
-+++ b/drivers/usb/core/hub.c
-@@ -2650,8 +2650,15 @@ static int hub_port_wait_reset(struct usb_hub *hub, int port1,
- 		if (ret < 0)
- 			return ret;
- 
--		/* The port state is unknown until the reset completes. */
--		if (!(portstatus & USB_PORT_STAT_RESET))
-+		/*
-+		 * The port state is unknown until the reset completes.
-+		 *
-+		 * On top of that, some chips may require additional time
-+		 * to re-establish a connection after the reset is complete,
-+		 * so also wait for the connection to be re-established.
-+		 */
-+		if (!(portstatus & USB_PORT_STAT_RESET) &&
-+		    (portstatus & USB_PORT_STAT_CONNECTION))
- 			break;
- 
- 		/* switch to the long delay after two short delay failures */
-diff --git a/fs/orangefs/devorangefs-req.c b/fs/orangefs/devorangefs-req.c
-index 516ffb4..f419dd9 100644
---- a/fs/orangefs/devorangefs-req.c
-+++ b/fs/orangefs/devorangefs-req.c
-@@ -402,8 +402,9 @@ static ssize_t orangefs_devreq_write_iter(struct kiocb *iocb,
- 	/* remove the op from the in progress hash table */
- 	op = orangefs_devreq_remove_op(head.tag);
- 	if (!op) {
--		gossip_err("WARNING: No one's waiting for tag %llu\n",
--			   llu(head.tag));
-+		gossip_debug(GOSSIP_DEV_DEBUG,
-+			     "%s: No one's waiting for tag %llu\n",
-+			     __func__, llu(head.tag));
- 		return ret;
- 	}
- 
-diff --git a/fs/orangefs/orangefs-debugfs.c b/fs/orangefs/orangefs-debugfs.c
-index 38887cc..0748a26 100644
---- a/fs/orangefs/orangefs-debugfs.c
-+++ b/fs/orangefs/orangefs-debugfs.c
-@@ -671,8 +671,10 @@ int orangefs_prepare_debugfs_help_string(int at_boot)
- 		 */
- 		cdm_element_count =
- 			orangefs_prepare_cdm_array(client_debug_array_string);
--		if (cdm_element_count <= 0)
-+		if (cdm_element_count <= 0) {
-+			kfree(new);
- 			goto out;
-+		}
- 
- 		for (i = 0; i < cdm_element_count; i++) {
- 			strlcat(new, "\t", string_size);
-@@ -963,13 +965,13 @@ int orangefs_debugfs_new_client_string(void __user *arg)
- 	int ret;
- 
- 	ret = copy_from_user(&client_debug_array_string,
--                                     (void __user *)arg,
--                                     ORANGEFS_MAX_DEBUG_STRING_LEN);
-+			     (void __user *)arg,
-+			     ORANGEFS_MAX_DEBUG_STRING_LEN);
- 
- 	if (ret != 0) {
- 		pr_info("%s: CLIENT_STRING: copy_from_user failed\n",
- 			__func__);
--		return -EIO;
-+		return -EFAULT;
- 	}
- 
- 	/*
-@@ -984,17 +986,18 @@ int orangefs_debugfs_new_client_string(void __user *arg)
- 	 */
- 	client_debug_array_string[ORANGEFS_MAX_DEBUG_STRING_LEN - 1] =
- 		'\0';
--	
-+
- 	pr_info("%s: client debug array string has been received.\n",
- 		__func__);
- 
- 	if (!help_string_initialized) {
- 
- 		/* Build a proper debug help string. */
--		if (orangefs_prepare_debugfs_help_string(0)) {
-+		ret = orangefs_prepare_debugfs_help_string(0);
-+		if (ret) {
- 			gossip_err("%s: no debug help string \n",
- 				   __func__);
--			return -EIO;
-+			return ret;
- 		}
- 
- 	}
-@@ -1007,7 +1010,7 @@ int orangefs_debugfs_new_client_string(void __user *arg)
- 
- 	help_string_initialized++;
- 
--	return ret;
-+	return 0;
- }
- 
- int orangefs_debugfs_new_debug(void __user *arg) 
-diff --git a/fs/orangefs/orangefs-dev-proto.h b/fs/orangefs/orangefs-dev-proto.h
-index a3d84ff..f380f9ed 100644
---- a/fs/orangefs/orangefs-dev-proto.h
-+++ b/fs/orangefs/orangefs-dev-proto.h
-@@ -50,8 +50,7 @@
-  * Misc constants. Please retain them as multiples of 8!
-  * Otherwise 32-64 bit interactions will be messed up :)
-  */
--#define ORANGEFS_MAX_DEBUG_STRING_LEN	0x00000400
--#define ORANGEFS_MAX_DEBUG_ARRAY_LEN	0x00000800
-+#define ORANGEFS_MAX_DEBUG_STRING_LEN	0x00000800
- 
- /*
-  * The maximum number of directory entries in a single request is 96.
-diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
-index f2b04a7..8ab0974 100644
---- a/net/packet/af_packet.c
-+++ b/net/packet/af_packet.c
-@@ -4235,8 +4235,8 @@ static int packet_set_ring(struct sock *sk, union tpacket_req_u *req_u,
- 		if (unlikely(!PAGE_ALIGNED(req->tp_block_size)))
- 			goto out;
- 		if (po->tp_version >= TPACKET_V3 &&
--		    (int)(req->tp_block_size -
--			  BLK_PLUS_PRIV(req_u->req3.tp_sizeof_priv)) <= 0)
-+		    req->tp_block_size <=
-+			  BLK_PLUS_PRIV((u64)req_u->req3.tp_sizeof_priv))
- 			goto out;
- 		if (unlikely(req->tp_frame_size < po->tp_hdrlen +
- 					po->tp_reserve))
diff --git a/4.9.23/0000_README b/4.9.24/0000_README
index 7325e48..89862a9 100644
--- a/4.9.23/0000_README
+++ b/4.9.24/0000_README
@@ -2,11 +2,11 @@ README
 -----------------------------------------------------------------------------
 Individual Patch Descriptions:
 -----------------------------------------------------------------------------
-Patch:	1022_linux-4.9.23.patch
+Patch:	1023_linux-4.9.24.patch
 From:	http://www.kernel.org
-Desc:	Linux 4.9.23
+Desc:	Linux 4.9.24
 
-Patch:	4420_grsecurity-3.1-4.9.23-201704181901.patch
+Patch:	4420_grsecurity-3.1-4.9.24-201704220732.patch
 From:	http://www.grsecurity.net
 Desc:	hardened-sources base patch from upstream grsecurity
 
diff --git a/4.9.24/1023_linux-4.9.24.patch b/4.9.24/1023_linux-4.9.24.patch
new file mode 100644
index 0000000..0ffd31b
--- /dev/null
+++ b/4.9.24/1023_linux-4.9.24.patch
@@ -0,0 +1,3261 @@
+diff --git a/Makefile b/Makefile
+index 0de7597..50436f5 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 4
+ PATCHLEVEL = 9
+-SUBLEVEL = 23
++SUBLEVEL = 24
+ EXTRAVERSION =
+ NAME = Roaring Lionus
+ 
+diff --git a/arch/mips/lantiq/irq.c b/arch/mips/lantiq/irq.c
+index 0ddf369..8ac0e59 100644
+--- a/arch/mips/lantiq/irq.c
++++ b/arch/mips/lantiq/irq.c
+@@ -269,11 +269,6 @@ static void ltq_hw5_irqdispatch(void)
+ DEFINE_HWx_IRQDISPATCH(5)
+ #endif
+ 
+-static void ltq_hw_irq_handler(struct irq_desc *desc)
+-{
+-	ltq_hw_irqdispatch(irq_desc_get_irq(desc) - 2);
+-}
+-
+ #ifdef CONFIG_MIPS_MT_SMP
+ void __init arch_init_ipiirq(int irq, struct irqaction *action)
+ {
+@@ -318,19 +313,23 @@ static struct irqaction irq_call = {
+ asmlinkage void plat_irq_dispatch(void)
+ {
+ 	unsigned int pending = read_c0_status() & read_c0_cause() & ST0_IM;
+-	int irq;
+-
+-	if (!pending) {
+-		spurious_interrupt();
+-		return;
++	unsigned int i;
++
++	if ((MIPS_CPU_TIMER_IRQ == 7) && (pending & CAUSEF_IP7)) {
++		do_IRQ(MIPS_CPU_TIMER_IRQ);
++		goto out;
++	} else {
++		for (i = 0; i < MAX_IM; i++) {
++			if (pending & (CAUSEF_IP2 << i)) {
++				ltq_hw_irqdispatch(i);
++				goto out;
++			}
++		}
+ 	}
++	pr_alert("Spurious IRQ: CAUSE=0x%08x\n", read_c0_status());
+ 
+-	pending >>= CAUSEB_IP;
+-	while (pending) {
+-		irq = fls(pending) - 1;
+-		do_IRQ(MIPS_CPU_IRQ_BASE + irq);
+-		pending &= ~BIT(irq);
+-	}
++out:
++	return;
+ }
+ 
+ static int icu_map(struct irq_domain *d, unsigned int irq, irq_hw_number_t hw)
+@@ -355,6 +354,11 @@ static const struct irq_domain_ops irq_domain_ops = {
+ 	.map = icu_map,
+ };
+ 
++static struct irqaction cascade = {
++	.handler = no_action,
++	.name = "cascade",
++};
++
+ int __init icu_of_init(struct device_node *node, struct device_node *parent)
+ {
+ 	struct device_node *eiu_node;
+@@ -386,7 +390,7 @@ int __init icu_of_init(struct device_node *node, struct device_node *parent)
+ 	mips_cpu_irq_init();
+ 
+ 	for (i = 0; i < MAX_IM; i++)
+-		irq_set_chained_handler(i + 2, ltq_hw_irq_handler);
++		setup_irq(i + 2, &cascade);
+ 
+ 	if (cpu_has_vint) {
+ 		pr_info("Setting up vectored interrupts\n");
+diff --git a/arch/parisc/include/asm/uaccess.h b/arch/parisc/include/asm/uaccess.h
+index 7fcf512..0497cec 100644
+--- a/arch/parisc/include/asm/uaccess.h
++++ b/arch/parisc/include/asm/uaccess.h
+@@ -42,10 +42,10 @@ static inline long access_ok(int type, const void __user * addr,
+ #define get_user __get_user
+ 
+ #if !defined(CONFIG_64BIT)
+-#define LDD_USER(ptr)		__get_user_asm64(ptr)
++#define LDD_USER(val, ptr)	__get_user_asm64(val, ptr)
+ #define STD_USER(x, ptr)	__put_user_asm64(x, ptr)
+ #else
+-#define LDD_USER(ptr)		__get_user_asm("ldd", ptr)
++#define LDD_USER(val, ptr)	__get_user_asm(val, "ldd", ptr)
+ #define STD_USER(x, ptr)	__put_user_asm("std", x, ptr)
+ #endif
+ 
+@@ -100,63 +100,87 @@ struct exception_data {
+ 		" mtsp %0,%%sr2\n\t"		\
+ 		: : "r"(get_fs()) : )
+ 
+-#define __get_user(x, ptr)                               \
+-({                                                       \
+-	register long __gu_err __asm__ ("r8") = 0;       \
+-	register long __gu_val;				 \
+-							 \
+-	load_sr2();					 \
+-	switch (sizeof(*(ptr))) {			 \
+-	    case 1: __get_user_asm("ldb", ptr); break;   \
+-	    case 2: __get_user_asm("ldh", ptr); break;   \
+-	    case 4: __get_user_asm("ldw", ptr); break;   \
+-	    case 8: LDD_USER(ptr);  break;		 \
+-	    default: BUILD_BUG(); break;		 \
+-	}                                                \
+-							 \
+-	(x) = (__force __typeof__(*(ptr))) __gu_val;	 \
+-	__gu_err;                                        \
++#define __get_user_internal(val, ptr)			\
++({							\
++	register long __gu_err __asm__ ("r8") = 0;	\
++							\
++	switch (sizeof(*(ptr))) {			\
++	case 1: __get_user_asm(val, "ldb", ptr); break;	\
++	case 2: __get_user_asm(val, "ldh", ptr); break; \
++	case 4: __get_user_asm(val, "ldw", ptr); break; \
++	case 8: LDD_USER(val, ptr); break;		\
++	default: BUILD_BUG();				\
++	}						\
++							\
++	__gu_err;					\
+ })
+ 
+-#define __get_user_asm(ldx, ptr)                        \
++#define __get_user(val, ptr)				\
++({							\
++	load_sr2();					\
++	__get_user_internal(val, ptr);			\
++})
++
++#define __get_user_asm(val, ldx, ptr)			\
++{							\
++	register long __gu_val;				\
++							\
+ 	__asm__("1: " ldx " 0(%%sr2,%2),%0\n"		\
+ 		"9:\n"					\
+ 		ASM_EXCEPTIONTABLE_ENTRY_EFAULT(1b, 9b)	\
+ 		: "=r"(__gu_val), "=r"(__gu_err)        \
+-		: "r"(ptr), "1"(__gu_err));
++		: "r"(ptr), "1"(__gu_err));		\
++							\
++	(val) = (__force __typeof__(*(ptr))) __gu_val;	\
++}
+ 
+ #if !defined(CONFIG_64BIT)
+ 
+-#define __get_user_asm64(ptr) 				\
++#define __get_user_asm64(val, ptr)			\
++{							\
++	union {						\
++		unsigned long long	l;		\
++		__typeof__(*(ptr))	t;		\
++	} __gu_tmp;					\
++							\
+ 	__asm__("   copy %%r0,%R0\n"			\
+ 		"1: ldw 0(%%sr2,%2),%0\n"		\
+ 		"2: ldw 4(%%sr2,%2),%R0\n"		\
+ 		"9:\n"					\
+ 		ASM_EXCEPTIONTABLE_ENTRY_EFAULT(1b, 9b)	\
+ 		ASM_EXCEPTIONTABLE_ENTRY_EFAULT(2b, 9b)	\
+-		: "=r"(__gu_val), "=r"(__gu_err)	\
+-		: "r"(ptr), "1"(__gu_err));
++		: "=&r"(__gu_tmp.l), "=r"(__gu_err)	\
++		: "r"(ptr), "1"(__gu_err));		\
++							\
++	(val) = __gu_tmp.t;				\
++}
+ 
+ #endif /* !defined(CONFIG_64BIT) */
+ 
+ 
+-#define __put_user(x, ptr)                                      \
++#define __put_user_internal(x, ptr)				\
+ ({								\
+ 	register long __pu_err __asm__ ("r8") = 0;      	\
+         __typeof__(*(ptr)) __x = (__typeof__(*(ptr)))(x);	\
+ 								\
+-	load_sr2();						\
+ 	switch (sizeof(*(ptr))) {				\
+-	    case 1: __put_user_asm("stb", __x, ptr); break;     \
+-	    case 2: __put_user_asm("sth", __x, ptr); break;     \
+-	    case 4: __put_user_asm("stw", __x, ptr); break;     \
+-	    case 8: STD_USER(__x, ptr); break;			\
+-	    default: BUILD_BUG(); break;			\
+-	}                                                       \
++	case 1: __put_user_asm("stb", __x, ptr); break;		\
++	case 2: __put_user_asm("sth", __x, ptr); break;		\
++	case 4: __put_user_asm("stw", __x, ptr); break;		\
++	case 8: STD_USER(__x, ptr); break;			\
++	default: BUILD_BUG();					\
++	}							\
+ 								\
+ 	__pu_err;						\
+ })
+ 
++#define __put_user(x, ptr)					\
++({								\
++	load_sr2();						\
++	__put_user_internal(x, ptr);				\
++})
++
++
+ /*
+  * The "__put_user/kernel_asm()" macros tell gcc they read from memory
+  * instead of writing. This is because they do not write to any memory
+diff --git a/arch/parisc/lib/lusercopy.S b/arch/parisc/lib/lusercopy.S
+index f01188c..85c28bb 100644
+--- a/arch/parisc/lib/lusercopy.S
++++ b/arch/parisc/lib/lusercopy.S
+@@ -201,7 +201,7 @@ ENTRY_CFI(pa_memcpy)
+ 	add	dst,len,end
+ 
+ 	/* short copy with less than 16 bytes? */
+-	cmpib,>>=,n 15,len,.Lbyte_loop
++	cmpib,COND(>>=),n 15,len,.Lbyte_loop
+ 
+ 	/* same alignment? */
+ 	xor	src,dst,t0
+@@ -216,7 +216,7 @@ ENTRY_CFI(pa_memcpy)
+ 	/* loop until we are 64-bit aligned */
+ .Lalign_loop64:
+ 	extru	dst,31,3,t1
+-	cmpib,=,n	0,t1,.Lcopy_loop_16
++	cmpib,=,n	0,t1,.Lcopy_loop_16_start
+ 20:	ldb,ma	1(srcspc,src),t1
+ 21:	stb,ma	t1,1(dstspc,dst)
+ 	b	.Lalign_loop64
+@@ -225,6 +225,7 @@ ENTRY_CFI(pa_memcpy)
+ 	ASM_EXCEPTIONTABLE_ENTRY(20b,.Lcopy_done)
+ 	ASM_EXCEPTIONTABLE_ENTRY(21b,.Lcopy_done)
+ 
++.Lcopy_loop_16_start:
+ 	ldi	31,t0
+ .Lcopy_loop_16:
+ 	cmpb,COND(>>=),n t0,len,.Lword_loop
+@@ -267,7 +268,7 @@ ENTRY_CFI(pa_memcpy)
+ 	/* loop until we are 32-bit aligned */
+ .Lalign_loop32:
+ 	extru	dst,31,2,t1
+-	cmpib,=,n	0,t1,.Lcopy_loop_4
++	cmpib,=,n	0,t1,.Lcopy_loop_8
+ 20:	ldb,ma	1(srcspc,src),t1
+ 21:	stb,ma	t1,1(dstspc,dst)
+ 	b	.Lalign_loop32
+@@ -277,7 +278,7 @@ ENTRY_CFI(pa_memcpy)
+ 	ASM_EXCEPTIONTABLE_ENTRY(21b,.Lcopy_done)
+ 
+ 
+-.Lcopy_loop_4:
++.Lcopy_loop_8:
+ 	cmpib,COND(>>=),n 15,len,.Lbyte_loop
+ 
+ 10:	ldw	0(srcspc,src),t1
+@@ -299,7 +300,7 @@ ENTRY_CFI(pa_memcpy)
+ 	ASM_EXCEPTIONTABLE_ENTRY(16b,.Lcopy_done)
+ 	ASM_EXCEPTIONTABLE_ENTRY(17b,.Lcopy_done)
+ 
+-	b	.Lcopy_loop_4
++	b	.Lcopy_loop_8
+ 	ldo	-16(len),len
+ 
+ .Lbyte_loop:
+@@ -324,7 +325,7 @@ ENTRY_CFI(pa_memcpy)
+ .Lunaligned_copy:
+ 	/* align until dst is 32bit-word-aligned */
+ 	extru	dst,31,2,t1
+-	cmpib,COND(=),n	0,t1,.Lcopy_dstaligned
++	cmpib,=,n	0,t1,.Lcopy_dstaligned
+ 20:	ldb	0(srcspc,src),t1
+ 	ldo	1(src),src
+ 21:	stb,ma	t1,1(dstspc,dst)
+@@ -362,7 +363,7 @@ ENTRY_CFI(pa_memcpy)
+ 	cmpiclr,<> 1,t0,%r0
+ 	b,n .Lcase1
+ .Lcase0:
+-	cmpb,= %r0,len,.Lcda_finish
++	cmpb,COND(=) %r0,len,.Lcda_finish
+ 	nop
+ 
+ 1:	ldw,ma 4(srcspc,src), a3
+@@ -376,7 +377,7 @@ ENTRY_CFI(pa_memcpy)
+ 1:	ldw,ma 4(srcspc,src), a3
+ 	ASM_EXCEPTIONTABLE_ENTRY(1b,.Lcda_rdfault)
+ 	ldo -1(len),len
+-	cmpb,=,n %r0,len,.Ldo0
++	cmpb,COND(=),n %r0,len,.Ldo0
+ .Ldo4:
+ 1:	ldw,ma 4(srcspc,src), a0
+ 	ASM_EXCEPTIONTABLE_ENTRY(1b,.Lcda_rdfault)
+@@ -402,7 +403,7 @@ ENTRY_CFI(pa_memcpy)
+ 1:	stw,ma t0, 4(dstspc,dst)
+ 	ASM_EXCEPTIONTABLE_ENTRY(1b,.Lcopy_done)
+ 	ldo -4(len),len
+-	cmpb,<> %r0,len,.Ldo4
++	cmpb,COND(<>) %r0,len,.Ldo4
+ 	nop
+ .Ldo0:
+ 	shrpw a2, a3, %sar, t0
+@@ -436,14 +437,14 @@ ENTRY_CFI(pa_memcpy)
+ 	/* fault exception fixup handlers: */
+ #ifdef CONFIG_64BIT
+ .Lcopy16_fault:
+-10:	b	.Lcopy_done
+-	std,ma	t1,8(dstspc,dst)
++	b	.Lcopy_done
++10:	std,ma	t1,8(dstspc,dst)
+ 	ASM_EXCEPTIONTABLE_ENTRY(10b,.Lcopy_done)
+ #endif
+ 
+ .Lcopy8_fault:
+-10:	b	.Lcopy_done
+-	stw,ma	t1,4(dstspc,dst)
++	b	.Lcopy_done
++10:	stw,ma	t1,4(dstspc,dst)
+ 	ASM_EXCEPTIONTABLE_ENTRY(10b,.Lcopy_done)
+ 
+ 	.exit
+diff --git a/arch/x86/entry/vdso/vdso32-setup.c b/arch/x86/entry/vdso/vdso32-setup.c
+index 7853b53..3f9d1a8 100644
+--- a/arch/x86/entry/vdso/vdso32-setup.c
++++ b/arch/x86/entry/vdso/vdso32-setup.c
+@@ -30,8 +30,10 @@ static int __init vdso32_setup(char *s)
+ {
+ 	vdso32_enabled = simple_strtoul(s, NULL, 0);
+ 
+-	if (vdso32_enabled > 1)
++	if (vdso32_enabled > 1) {
+ 		pr_warn("vdso32 values other than 0 and 1 are no longer allowed; vdso disabled\n");
++		vdso32_enabled = 0;
++	}
+ 
+ 	return 1;
+ }
+@@ -62,13 +64,18 @@ subsys_initcall(sysenter_setup);
+ /* Register vsyscall32 into the ABI table */
+ #include <linux/sysctl.h>
+ 
++static const int zero;
++static const int one = 1;
++
+ static struct ctl_table abi_table2[] = {
+ 	{
+ 		.procname	= "vsyscall32",
+ 		.data		= &vdso32_enabled,
+ 		.maxlen		= sizeof(int),
+ 		.mode		= 0644,
+-		.proc_handler	= proc_dointvec
++		.proc_handler	= proc_dointvec_minmax,
++		.extra1		= (int *)&zero,
++		.extra2		= (int *)&one,
+ 	},
+ 	{}
+ };
+diff --git a/arch/x86/events/intel/lbr.c b/arch/x86/events/intel/lbr.c
+index 81b321a..f924629 100644
+--- a/arch/x86/events/intel/lbr.c
++++ b/arch/x86/events/intel/lbr.c
+@@ -507,6 +507,9 @@ static void intel_pmu_lbr_read_32(struct cpu_hw_events *cpuc)
+ 		cpuc->lbr_entries[i].to		= msr_lastbranch.to;
+ 		cpuc->lbr_entries[i].mispred	= 0;
+ 		cpuc->lbr_entries[i].predicted	= 0;
++		cpuc->lbr_entries[i].in_tx	= 0;
++		cpuc->lbr_entries[i].abort	= 0;
++		cpuc->lbr_entries[i].cycles	= 0;
+ 		cpuc->lbr_entries[i].reserved	= 0;
+ 	}
+ 	cpuc->lbr_stack.nr = i;
+diff --git a/arch/x86/include/asm/elf.h b/arch/x86/include/asm/elf.h
+index e7f155c..94aad63 100644
+--- a/arch/x86/include/asm/elf.h
++++ b/arch/x86/include/asm/elf.h
+@@ -278,7 +278,7 @@ struct task_struct;
+ 
+ #define	ARCH_DLINFO_IA32						\
+ do {									\
+-	if (vdso32_enabled) {						\
++	if (VDSO_CURRENT_BASE) {					\
+ 		NEW_AUX_ENT(AT_SYSINFO,	VDSO_ENTRY);			\
+ 		NEW_AUX_ENT(AT_SYSINFO_EHDR, VDSO_CURRENT_BASE);	\
+ 	}								\
+diff --git a/arch/x86/include/asm/pmem.h b/arch/x86/include/asm/pmem.h
+index 2c1ebeb..529bb4a 100644
+--- a/arch/x86/include/asm/pmem.h
++++ b/arch/x86/include/asm/pmem.h
+@@ -55,7 +55,8 @@ static inline int arch_memcpy_from_pmem(void *dst, const void *src, size_t n)
+  * @size:	number of bytes to write back
+  *
+  * Write back a cache range using the CLWB (cache line write back)
+- * instruction.
++ * instruction. Note that @size is internally rounded up to be cache
++ * line size aligned.
+  */
+ static inline void arch_wb_cache_pmem(void *addr, size_t size)
+ {
+@@ -69,15 +70,6 @@ static inline void arch_wb_cache_pmem(void *addr, size_t size)
+ 		clwb(p);
+ }
+ 
+-/*
+- * copy_from_iter_nocache() on x86 only uses non-temporal stores for iovec
+- * iterators, so for other types (bvec & kvec) we must do a cache write-back.
+- */
+-static inline bool __iter_needs_pmem_wb(struct iov_iter *i)
+-{
+-	return iter_is_iovec(i) == false;
+-}
+-
+ /**
+  * arch_copy_from_iter_pmem - copy data from an iterator to PMEM
+  * @addr:	PMEM destination address
+@@ -94,7 +86,35 @@ static inline size_t arch_copy_from_iter_pmem(void *addr, size_t bytes,
+ 	/* TODO: skip the write-back by always using non-temporal stores */
+ 	len = copy_from_iter_nocache(addr, bytes, i);
+ 
+-	if (__iter_needs_pmem_wb(i))
++	/*
++	 * In the iovec case on x86_64 copy_from_iter_nocache() uses
++	 * non-temporal stores for the bulk of the transfer, but we need
++	 * to manually flush if the transfer is unaligned. A cached
++	 * memory copy is used when destination or size is not naturally
++	 * aligned. That is:
++	 *   - Require 8-byte alignment when size is 8 bytes or larger.
++	 *   - Require 4-byte alignment when size is 4 bytes.
++	 *
++	 * In the non-iovec case the entire destination needs to be
++	 * flushed.
++	 */
++	if (iter_is_iovec(i)) {
++		unsigned long flushed, dest = (unsigned long) addr;
++
++		if (bytes < 8) {
++			if (!IS_ALIGNED(dest, 4) || (bytes != 4))
++				arch_wb_cache_pmem(addr, 1);
++		} else {
++			if (!IS_ALIGNED(dest, 8)) {
++				dest = ALIGN(dest, boot_cpu_data.x86_clflush_size);
++				arch_wb_cache_pmem(addr, 1);
++			}
++
++			flushed = dest - (unsigned long) addr;
++			if (bytes > flushed && !IS_ALIGNED(bytes - flushed, 8))
++				arch_wb_cache_pmem(addr + bytes - 1, 1);
++		}
++	} else
+ 		arch_wb_cache_pmem(addr, bytes);
+ 
+ 	return len;
+diff --git a/arch/x86/kernel/signal_compat.c b/arch/x86/kernel/signal_compat.c
+index ec1f756..71beb28 100644
+--- a/arch/x86/kernel/signal_compat.c
++++ b/arch/x86/kernel/signal_compat.c
+@@ -151,8 +151,8 @@ int __copy_siginfo_to_user32(compat_siginfo_t __user *to, const siginfo_t *from,
+ 
+ 				if (from->si_signo == SIGSEGV) {
+ 					if (from->si_code == SEGV_BNDERR) {
+-						compat_uptr_t lower = (unsigned long)&to->si_lower;
+-						compat_uptr_t upper = (unsigned long)&to->si_upper;
++						compat_uptr_t lower = (unsigned long)from->si_lower;
++						compat_uptr_t upper = (unsigned long)from->si_upper;
+ 						put_user_ex(lower, &to->si_lower);
+ 						put_user_ex(upper, &to->si_upper);
+ 					}
+diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
+index 69b8f8a..43b55ef 100644
+--- a/arch/x86/kvm/vmx.c
++++ b/arch/x86/kvm/vmx.c
+@@ -6925,14 +6925,20 @@ static int nested_vmx_check_vmptr(struct kvm_vcpu *vcpu, int exit_reason,
+ 		}
+ 
+ 		page = nested_get_page(vcpu, vmptr);
+-		if (page == NULL ||
+-		    *(u32 *)kmap(page) != VMCS12_REVISION) {
++		if (page == NULL) {
+ 			nested_vmx_failInvalid(vcpu);
++			skip_emulated_instruction(vcpu);
++			return 1;
++		}
++		if (*(u32 *)kmap(page) != VMCS12_REVISION) {
+ 			kunmap(page);
++			nested_release_page_clean(page);
++			nested_vmx_failInvalid(vcpu);
+ 			skip_emulated_instruction(vcpu);
+ 			return 1;
+ 		}
+ 		kunmap(page);
++		nested_release_page_clean(page);
+ 		vmx->nested.vmxon_ptr = vmptr;
+ 		break;
+ 	case EXIT_REASON_VMCLEAR:
+diff --git a/arch/x86/mm/init.c b/arch/x86/mm/init.c
+index 22af912..889e761 100644
+--- a/arch/x86/mm/init.c
++++ b/arch/x86/mm/init.c
+@@ -643,21 +643,40 @@ void __init init_mem_mapping(void)
+  * devmem_is_allowed() checks to see if /dev/mem access to a certain address
+  * is valid. The argument is a physical page number.
+  *
+- *
+- * On x86, access has to be given to the first megabyte of ram because that area
+- * contains BIOS code and data regions used by X and dosemu and similar apps.
+- * Access has to be given to non-kernel-ram areas as well, these contain the PCI
+- * mmio resources as well as potential bios/acpi data regions.
++ * On x86, access has to be given to the first megabyte of RAM because that
++ * area traditionally contains BIOS code and data regions used by X, dosemu,
++ * and similar apps. Since they map the entire memory range, the whole range
++ * must be allowed (for mapping), but any areas that would otherwise be
++ * disallowed are flagged as being "zero filled" instead of rejected.
++ * Access has to be given to non-kernel-ram areas as well, these contain the
++ * PCI mmio resources as well as potential bios/acpi data regions.
+  */
+ int devmem_is_allowed(unsigned long pagenr)
+ {
+-	if (pagenr < 256)
+-		return 1;
+-	if (iomem_is_exclusive(pagenr << PAGE_SHIFT))
++	if (page_is_ram(pagenr)) {
++		/*
++		 * For disallowed memory regions in the low 1MB range,
++		 * request that the page be shown as all zeros.
++		 */
++		if (pagenr < 256)
++			return 2;
++
++		return 0;
++	}
++
++	/*
++	 * This must follow RAM test, since System RAM is considered a
++	 * restricted resource under CONFIG_STRICT_IOMEM.
++	 */
++	if (iomem_is_exclusive(pagenr << PAGE_SHIFT)) {
++		/* Low 1MB bypasses iomem restrictions. */
++		if (pagenr < 256)
++			return 1;
++
+ 		return 0;
+-	if (!page_is_ram(pagenr))
+-		return 1;
+-	return 0;
++	}
++
++	return 1;
+ }
+ 
+ void free_init_pages(char *what, unsigned long begin, unsigned long end)
+diff --git a/arch/x86/platform/efi/quirks.c b/arch/x86/platform/efi/quirks.c
+index 30031d5..cdfe8c6 100644
+--- a/arch/x86/platform/efi/quirks.c
++++ b/arch/x86/platform/efi/quirks.c
+@@ -201,6 +201,10 @@ void __init efi_arch_mem_reserve(phys_addr_t addr, u64 size)
+ 		return;
+ 	}
+ 
++	/* No need to reserve regions that will never be freed. */
++	if (md.attribute & EFI_MEMORY_RUNTIME)
++		return;
++
+ 	size += addr % EFI_PAGE_SIZE;
+ 	size = round_up(size, EFI_PAGE_SIZE);
+ 	addr = round_down(addr, EFI_PAGE_SIZE);
+diff --git a/arch/x86/xen/apic.c b/arch/x86/xen/apic.c
+index 44c88ad..bcea81f 100644
+--- a/arch/x86/xen/apic.c
++++ b/arch/x86/xen/apic.c
+@@ -145,7 +145,7 @@ static void xen_silent_inquire(int apicid)
+ static int xen_cpu_present_to_apicid(int cpu)
+ {
+ 	if (cpu_present(cpu))
+-		return xen_get_apic_id(xen_apic_read(APIC_ID));
++		return cpu_data(cpu).apicid;
+ 	else
+ 		return BAD_APICID;
+ }
+diff --git a/crypto/ahash.c b/crypto/ahash.c
+index 2ce8bcb..cce0268 100644
+--- a/crypto/ahash.c
++++ b/crypto/ahash.c
+@@ -31,6 +31,7 @@ struct ahash_request_priv {
+ 	crypto_completion_t complete;
+ 	void *data;
+ 	u8 *result;
++	u32 flags;
+ 	void *ubuf[] CRYPTO_MINALIGN_ATTR;
+ };
+ 
+@@ -252,6 +253,8 @@ static int ahash_save_req(struct ahash_request *req, crypto_completion_t cplt)
+ 	priv->result = req->result;
+ 	priv->complete = req->base.complete;
+ 	priv->data = req->base.data;
++	priv->flags = req->base.flags;
++
+ 	/*
+ 	 * WARNING: We do not backup req->priv here! The req->priv
+ 	 *          is for internal use of the Crypto API and the
+@@ -266,38 +269,44 @@ static int ahash_save_req(struct ahash_request *req, crypto_completion_t cplt)
+ 	return 0;
+ }
+ 
+-static void ahash_restore_req(struct ahash_request *req)
++static void ahash_restore_req(struct ahash_request *req, int err)
+ {
+ 	struct ahash_request_priv *priv = req->priv;
+ 
++	if (!err)
++		memcpy(priv->result, req->result,
++		       crypto_ahash_digestsize(crypto_ahash_reqtfm(req)));
++
+ 	/* Restore the original crypto request. */
+ 	req->result = priv->result;
+-	req->base.complete = priv->complete;
+-	req->base.data = priv->data;
++
++	ahash_request_set_callback(req, priv->flags,
++				   priv->complete, priv->data);
+ 	req->priv = NULL;
+ 
+ 	/* Free the req->priv.priv from the ADJUSTED request. */
+ 	kzfree(priv);
+ }
+ 
+-static void ahash_op_unaligned_finish(struct ahash_request *req, int err)
++static void ahash_notify_einprogress(struct ahash_request *req)
+ {
+ 	struct ahash_request_priv *priv = req->priv;
++	struct crypto_async_request oreq;
+ 
+-	if (err == -EINPROGRESS)
+-		return;
+-
+-	if (!err)
+-		memcpy(priv->result, req->result,
+-		       crypto_ahash_digestsize(crypto_ahash_reqtfm(req)));
++	oreq.data = priv->data;
+ 
+-	ahash_restore_req(req);
++	priv->complete(&oreq, -EINPROGRESS);
+ }
+ 
+ static void ahash_op_unaligned_done(struct crypto_async_request *req, int err)
+ {
+ 	struct ahash_request *areq = req->data;
+ 
++	if (err == -EINPROGRESS) {
++		ahash_notify_einprogress(areq);
++		return;
++	}
++
+ 	/*
+ 	 * Restore the original request, see ahash_op_unaligned() for what
+ 	 * goes where.
+@@ -308,7 +317,7 @@ static void ahash_op_unaligned_done(struct crypto_async_request *req, int err)
+ 	 */
+ 
+ 	/* First copy req->result into req->priv.result */
+-	ahash_op_unaligned_finish(areq, err);
++	ahash_restore_req(areq, err);
+ 
+ 	/* Complete the ORIGINAL request. */
+ 	areq->base.complete(&areq->base, err);
+@@ -324,7 +333,12 @@ static int ahash_op_unaligned(struct ahash_request *req,
+ 		return err;
+ 
+ 	err = op(req);
+-	ahash_op_unaligned_finish(req, err);
++	if (err == -EINPROGRESS ||
++	    (err == -EBUSY && (ahash_request_flags(req) &
++			       CRYPTO_TFM_REQ_MAY_BACKLOG)))
++		return err;
++
++	ahash_restore_req(req, err);
+ 
+ 	return err;
+ }
+@@ -359,25 +373,14 @@ int crypto_ahash_digest(struct ahash_request *req)
+ }
+ EXPORT_SYMBOL_GPL(crypto_ahash_digest);
+ 
+-static void ahash_def_finup_finish2(struct ahash_request *req, int err)
++static void ahash_def_finup_done2(struct crypto_async_request *req, int err)
+ {
+-	struct ahash_request_priv *priv = req->priv;
++	struct ahash_request *areq = req->data;
+ 
+ 	if (err == -EINPROGRESS)
+ 		return;
+ 
+-	if (!err)
+-		memcpy(priv->result, req->result,
+-		       crypto_ahash_digestsize(crypto_ahash_reqtfm(req)));
+-
+-	ahash_restore_req(req);
+-}
+-
+-static void ahash_def_finup_done2(struct crypto_async_request *req, int err)
+-{
+-	struct ahash_request *areq = req->data;
+-
+-	ahash_def_finup_finish2(areq, err);
++	ahash_restore_req(areq, err);
+ 
+ 	areq->base.complete(&areq->base, err);
+ }
+@@ -388,11 +391,15 @@ static int ahash_def_finup_finish1(struct ahash_request *req, int err)
+ 		goto out;
+ 
+ 	req->base.complete = ahash_def_finup_done2;
+-	req->base.flags &= ~CRYPTO_TFM_REQ_MAY_SLEEP;
++
+ 	err = crypto_ahash_reqtfm(req)->final(req);
++	if (err == -EINPROGRESS ||
++	    (err == -EBUSY && (ahash_request_flags(req) &
++			       CRYPTO_TFM_REQ_MAY_BACKLOG)))
++		return err;
+ 
+ out:
+-	ahash_def_finup_finish2(req, err);
++	ahash_restore_req(req, err);
+ 	return err;
+ }
+ 
+@@ -400,7 +407,16 @@ static void ahash_def_finup_done1(struct crypto_async_request *req, int err)
+ {
+ 	struct ahash_request *areq = req->data;
+ 
++	if (err == -EINPROGRESS) {
++		ahash_notify_einprogress(areq);
++		return;
++	}
++
++	areq->base.flags &= ~CRYPTO_TFM_REQ_MAY_SLEEP;
++
+ 	err = ahash_def_finup_finish1(areq, err);
++	if (areq->priv)
++		return;
+ 
+ 	areq->base.complete(&areq->base, err);
+ }
+@@ -415,6 +431,11 @@ static int ahash_def_finup(struct ahash_request *req)
+ 		return err;
+ 
+ 	err = tfm->update(req);
++	if (err == -EINPROGRESS ||
++	    (err == -EBUSY && (ahash_request_flags(req) &
++			       CRYPTO_TFM_REQ_MAY_BACKLOG)))
++		return err;
++
+ 	return ahash_def_finup_finish1(req, err);
+ }
+ 
+diff --git a/crypto/algif_aead.c b/crypto/algif_aead.c
+index e8817e2..fde8d88 100644
+--- a/crypto/algif_aead.c
++++ b/crypto/algif_aead.c
+@@ -39,6 +39,7 @@ struct aead_async_req {
+ 	struct aead_async_rsgl first_rsgl;
+ 	struct list_head list;
+ 	struct kiocb *iocb;
++	struct sock *sk;
+ 	unsigned int tsgls;
+ 	char iv[];
+ };
+@@ -379,12 +380,10 @@ static ssize_t aead_sendpage(struct socket *sock, struct page *page,
+ 
+ static void aead_async_cb(struct crypto_async_request *_req, int err)
+ {
+-	struct sock *sk = _req->data;
+-	struct alg_sock *ask = alg_sk(sk);
+-	struct aead_ctx *ctx = ask->private;
+-	struct crypto_aead *tfm = crypto_aead_reqtfm(&ctx->aead_req);
+-	struct aead_request *req = aead_request_cast(_req);
++	struct aead_request *req = _req->data;
++	struct crypto_aead *tfm = crypto_aead_reqtfm(req);
+ 	struct aead_async_req *areq = GET_ASYM_REQ(req, tfm);
++	struct sock *sk = areq->sk;
+ 	struct scatterlist *sg = areq->tsgl;
+ 	struct aead_async_rsgl *rsgl;
+ 	struct kiocb *iocb = areq->iocb;
+@@ -447,11 +446,12 @@ static int aead_recvmsg_async(struct socket *sock, struct msghdr *msg,
+ 	memset(&areq->first_rsgl, '\0', sizeof(areq->first_rsgl));
+ 	INIT_LIST_HEAD(&areq->list);
+ 	areq->iocb = msg->msg_iocb;
++	areq->sk = sk;
+ 	memcpy(areq->iv, ctx->iv, crypto_aead_ivsize(tfm));
+ 	aead_request_set_tfm(req, tfm);
+ 	aead_request_set_ad(req, ctx->aead_assoclen);
+ 	aead_request_set_callback(req, CRYPTO_TFM_REQ_MAY_BACKLOG,
+-				  aead_async_cb, sk);
++				  aead_async_cb, req);
+ 	used -= ctx->aead_assoclen;
+ 
+ 	/* take over all tx sgls from ctx */
+diff --git a/drivers/acpi/ec.c b/drivers/acpi/ec.c
+index 48e19d0..22ca892 100644
+--- a/drivers/acpi/ec.c
++++ b/drivers/acpi/ec.c
+@@ -729,12 +729,12 @@ static void start_transaction(struct acpi_ec *ec)
+ 
+ static int ec_guard(struct acpi_ec *ec)
+ {
+-	unsigned long guard = usecs_to_jiffies(ec_polling_guard);
++	unsigned long guard = usecs_to_jiffies(ec->polling_guard);
+ 	unsigned long timeout = ec->timestamp + guard;
+ 
+ 	/* Ensure guarding period before polling EC status */
+ 	do {
+-		if (ec_busy_polling) {
++		if (ec->busy_polling) {
+ 			/* Perform busy polling */
+ 			if (ec_transaction_completed(ec))
+ 				return 0;
+@@ -998,6 +998,28 @@ static void acpi_ec_stop(struct acpi_ec *ec, bool suspending)
+ 	spin_unlock_irqrestore(&ec->lock, flags);
+ }
+ 
++static void acpi_ec_enter_noirq(struct acpi_ec *ec)
++{
++	unsigned long flags;
++
++	spin_lock_irqsave(&ec->lock, flags);
++	ec->busy_polling = true;
++	ec->polling_guard = 0;
++	ec_log_drv("interrupt blocked");
++	spin_unlock_irqrestore(&ec->lock, flags);
++}
++
++static void acpi_ec_leave_noirq(struct acpi_ec *ec)
++{
++	unsigned long flags;
++
++	spin_lock_irqsave(&ec->lock, flags);
++	ec->busy_polling = ec_busy_polling;
++	ec->polling_guard = ec_polling_guard;
++	ec_log_drv("interrupt unblocked");
++	spin_unlock_irqrestore(&ec->lock, flags);
++}
++
+ void acpi_ec_block_transactions(void)
+ {
+ 	struct acpi_ec *ec = first_ec;
+@@ -1278,7 +1300,7 @@ acpi_ec_space_handler(u32 function, acpi_physical_address address,
+ 	if (function != ACPI_READ && function != ACPI_WRITE)
+ 		return AE_BAD_PARAMETER;
+ 
+-	if (ec_busy_polling || bits > 8)
++	if (ec->busy_polling || bits > 8)
+ 		acpi_ec_burst_enable(ec);
+ 
+ 	for (i = 0; i < bytes; ++i, ++address, ++value)
+@@ -1286,7 +1308,7 @@ acpi_ec_space_handler(u32 function, acpi_physical_address address,
+ 			acpi_ec_read(ec, address, value) :
+ 			acpi_ec_write(ec, address, *value);
+ 
+-	if (ec_busy_polling || bits > 8)
++	if (ec->busy_polling || bits > 8)
+ 		acpi_ec_burst_disable(ec);
+ 
+ 	switch (result) {
+@@ -1329,6 +1351,8 @@ static struct acpi_ec *acpi_ec_alloc(void)
+ 	spin_lock_init(&ec->lock);
+ 	INIT_WORK(&ec->work, acpi_ec_event_handler);
+ 	ec->timestamp = jiffies;
++	ec->busy_polling = true;
++	ec->polling_guard = 0;
+ 	return ec;
+ }
+ 
+@@ -1390,6 +1414,7 @@ static int ec_install_handlers(struct acpi_ec *ec, bool handle_events)
+ 	acpi_ec_start(ec, false);
+ 
+ 	if (!test_bit(EC_FLAGS_EC_HANDLER_INSTALLED, &ec->flags)) {
++		acpi_ec_enter_noirq(ec);
+ 		status = acpi_install_address_space_handler(ec->handle,
+ 							    ACPI_ADR_SPACE_EC,
+ 							    &acpi_ec_space_handler,
+@@ -1429,6 +1454,7 @@ static int ec_install_handlers(struct acpi_ec *ec, bool handle_events)
+ 		/* This is not fatal as we can poll EC events */
+ 		if (ACPI_SUCCESS(status)) {
+ 			set_bit(EC_FLAGS_GPE_HANDLER_INSTALLED, &ec->flags);
++			acpi_ec_leave_noirq(ec);
+ 			if (test_bit(EC_FLAGS_STARTED, &ec->flags) &&
+ 			    ec->reference_count >= 1)
+ 				acpi_ec_enable_gpe(ec, true);
+@@ -1839,34 +1865,6 @@ int __init acpi_ec_ecdt_probe(void)
+ }
+ 
+ #ifdef CONFIG_PM_SLEEP
+-static void acpi_ec_enter_noirq(struct acpi_ec *ec)
+-{
+-	unsigned long flags;
+-
+-	if (ec == first_ec) {
+-		spin_lock_irqsave(&ec->lock, flags);
+-		ec->saved_busy_polling = ec_busy_polling;
+-		ec->saved_polling_guard = ec_polling_guard;
+-		ec_busy_polling = true;
+-		ec_polling_guard = 0;
+-		ec_log_drv("interrupt blocked");
+-		spin_unlock_irqrestore(&ec->lock, flags);
+-	}
+-}
+-
+-static void acpi_ec_leave_noirq(struct acpi_ec *ec)
+-{
+-	unsigned long flags;
+-
+-	if (ec == first_ec) {
+-		spin_lock_irqsave(&ec->lock, flags);
+-		ec_busy_polling = ec->saved_busy_polling;
+-		ec_polling_guard = ec->saved_polling_guard;
+-		ec_log_drv("interrupt unblocked");
+-		spin_unlock_irqrestore(&ec->lock, flags);
+-	}
+-}
+-
+ static int acpi_ec_suspend_noirq(struct device *dev)
+ {
+ 	struct acpi_ec *ec =
+diff --git a/drivers/acpi/internal.h b/drivers/acpi/internal.h
+index 0c45226..219b90b 100644
+--- a/drivers/acpi/internal.h
++++ b/drivers/acpi/internal.h
+@@ -172,8 +172,8 @@ struct acpi_ec {
+ 	struct work_struct work;
+ 	unsigned long timestamp;
+ 	unsigned long nr_pending_queries;
+-	bool saved_busy_polling;
+-	unsigned int saved_polling_guard;
++	bool busy_polling;
++	unsigned int polling_guard;
+ };
+ 
+ extern struct acpi_ec *first_ec;
+diff --git a/drivers/acpi/nfit/core.c b/drivers/acpi/nfit/core.c
+index d1664df..9ef3941 100644
+--- a/drivers/acpi/nfit/core.c
++++ b/drivers/acpi/nfit/core.c
+@@ -1617,7 +1617,11 @@ static int cmp_map(const void *m0, const void *m1)
+ 	const struct nfit_set_info_map *map0 = m0;
+ 	const struct nfit_set_info_map *map1 = m1;
+ 
+-	return map0->region_offset - map1->region_offset;
++	if (map0->region_offset < map1->region_offset)
++		return -1;
++	else if (map0->region_offset > map1->region_offset)
++		return 1;
++	return 0;
+ }
+ 
+ /* Retrieve the nth entry referencing this spa */
+diff --git a/drivers/acpi/scan.c b/drivers/acpi/scan.c
+index 5a2fdf1..dd3786a 100644
+--- a/drivers/acpi/scan.c
++++ b/drivers/acpi/scan.c
+@@ -1827,15 +1827,20 @@ static void acpi_bus_attach(struct acpi_device *device)
+ 		return;
+ 
+ 	device->flags.match_driver = true;
+-	if (!ret) {
+-		ret = device_attach(&device->dev);
+-		if (ret < 0)
+-			return;
+-
+-		if (!ret && device->pnp.type.platform_id)
+-			acpi_default_enumeration(device);
++	if (ret > 0) {
++		acpi_device_set_enumerated(device);
++		goto ok;
+ 	}
+ 
++	ret = device_attach(&device->dev);
++	if (ret < 0)
++		return;
++
++	if (ret > 0 || !device->pnp.type.platform_id)
++		acpi_device_set_enumerated(device);
++	else
++		acpi_default_enumeration(device);
++
+  ok:
+ 	list_for_each_entry(child, &device->children, node)
+ 		acpi_bus_attach(child);
+diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c
+index 7a10487..c9441f9 100644
+--- a/drivers/block/nbd.c
++++ b/drivers/block/nbd.c
+@@ -54,7 +54,7 @@ struct nbd_device {
+ 
+ 	struct mutex tx_lock;
+ 	struct gendisk *disk;
+-	int blksize;
++	loff_t blksize;
+ 	loff_t bytesize;
+ 
+ 	/* protects initialization and shutdown of the socket */
+@@ -126,7 +126,7 @@ static void nbd_size_update(struct nbd_device *nbd, struct block_device *bdev)
+ }
+ 
+ static int nbd_size_set(struct nbd_device *nbd, struct block_device *bdev,
+-			int blocksize, int nr_blocks)
++			loff_t blocksize, loff_t nr_blocks)
+ {
+ 	int ret;
+ 
+@@ -135,7 +135,7 @@ static int nbd_size_set(struct nbd_device *nbd, struct block_device *bdev,
+ 		return ret;
+ 
+ 	nbd->blksize = blocksize;
+-	nbd->bytesize = (loff_t)blocksize * (loff_t)nr_blocks;
++	nbd->bytesize = blocksize * nr_blocks;
+ 
+ 	nbd_size_update(nbd, bdev);
+ 
+@@ -648,7 +648,7 @@ static int __nbd_ioctl(struct block_device *bdev, struct nbd_device *nbd,
+ 
+ 	case NBD_SET_SIZE:
+ 		return nbd_size_set(nbd, bdev, nbd->blksize,
+-				    arg / nbd->blksize);
++					div_s64(arg, nbd->blksize));
+ 
+ 	case NBD_SET_SIZE_BLOCKS:
+ 		return nbd_size_set(nbd, bdev, nbd->blksize, arg);
+@@ -817,7 +817,7 @@ static int nbd_dev_dbg_init(struct nbd_device *nbd)
+ 	debugfs_create_file("tasks", 0444, dir, nbd, &nbd_dbg_tasks_ops);
+ 	debugfs_create_u64("size_bytes", 0444, dir, &nbd->bytesize);
+ 	debugfs_create_u32("timeout", 0444, dir, &nbd->tag_set.timeout);
+-	debugfs_create_u32("blocksize", 0444, dir, &nbd->blksize);
++	debugfs_create_u64("blocksize", 0444, dir, &nbd->blksize);
+ 	debugfs_create_file("flags", 0444, dir, nbd, &nbd_dbg_flags_ops);
+ 
+ 	return 0;
+diff --git a/drivers/block/zram/zram_drv.c b/drivers/block/zram/zram_drv.c
+index d2ef51c..c9914d6 100644
+--- a/drivers/block/zram/zram_drv.c
++++ b/drivers/block/zram/zram_drv.c
+@@ -582,13 +582,13 @@ static int zram_decompress_page(struct zram *zram, char *mem, u32 index)
+ 
+ 	if (!handle || zram_test_flag(meta, index, ZRAM_ZERO)) {
+ 		bit_spin_unlock(ZRAM_ACCESS, &meta->table[index].value);
+-		clear_page(mem);
++		memset(mem, 0, PAGE_SIZE);
+ 		return 0;
+ 	}
+ 
+ 	cmem = zs_map_object(meta->mem_pool, handle, ZS_MM_RO);
+ 	if (size == PAGE_SIZE) {
+-		copy_page(mem, cmem);
++		memcpy(mem, cmem, PAGE_SIZE);
+ 	} else {
+ 		struct zcomp_strm *zstrm = zcomp_stream_get(zram->comp);
+ 
+@@ -780,7 +780,7 @@ static int zram_bvec_write(struct zram *zram, struct bio_vec *bvec, u32 index,
+ 
+ 	if ((clen == PAGE_SIZE) && !is_partial_io(bvec)) {
+ 		src = kmap_atomic(page);
+-		copy_page(cmem, src);
++		memcpy(cmem, src, PAGE_SIZE);
+ 		kunmap_atomic(src);
+ 	} else {
+ 		memcpy(cmem, src, clen);
+diff --git a/drivers/char/Kconfig b/drivers/char/Kconfig
+index dcc0973..8453a49 100644
+--- a/drivers/char/Kconfig
++++ b/drivers/char/Kconfig
+@@ -571,9 +571,12 @@ config TELCLOCK
+ 	  controlling the behavior of this hardware.
+ 
+ config DEVPORT
+-	bool
++	bool "/dev/port character device"
+ 	depends on ISA || PCI
+ 	default y
++	help
++	  Say Y here if you want to support the /dev/port device. The /dev/port
++	  device is similar to /dev/mem, but for I/O ports.
+ 
+ source "drivers/s390/char/Kconfig"
+ 
+diff --git a/drivers/char/mem.c b/drivers/char/mem.c
+index 6d9cc2d..7e4a9d1 100644
+--- a/drivers/char/mem.c
++++ b/drivers/char/mem.c
+@@ -60,6 +60,10 @@ static inline int valid_mmap_phys_addr_range(unsigned long pfn, size_t size)
+ #endif
+ 
+ #ifdef CONFIG_STRICT_DEVMEM
++static inline int page_is_allowed(unsigned long pfn)
++{
++	return devmem_is_allowed(pfn);
++}
+ static inline int range_is_allowed(unsigned long pfn, unsigned long size)
+ {
+ 	u64 from = ((u64)pfn) << PAGE_SHIFT;
+@@ -75,6 +79,10 @@ static inline int range_is_allowed(unsigned long pfn, unsigned long size)
+ 	return 1;
+ }
+ #else
++static inline int page_is_allowed(unsigned long pfn)
++{
++	return 1;
++}
+ static inline int range_is_allowed(unsigned long pfn, unsigned long size)
+ {
+ 	return 1;
+@@ -122,23 +130,31 @@ static ssize_t read_mem(struct file *file, char __user *buf,
+ 
+ 	while (count > 0) {
+ 		unsigned long remaining;
++		int allowed;
+ 
+ 		sz = size_inside_page(p, count);
+ 
+-		if (!range_is_allowed(p >> PAGE_SHIFT, count))
++		allowed = page_is_allowed(p >> PAGE_SHIFT);
++		if (!allowed)
+ 			return -EPERM;
++		if (allowed == 2) {
++			/* Show zeros for restricted memory. */
++			remaining = clear_user(buf, sz);
++		} else {
++			/*
++			 * On ia64 if a page has been mapped somewhere as
++			 * uncached, then it must also be accessed uncached
++			 * by the kernel or data corruption may occur.
++			 */
++			ptr = xlate_dev_mem_ptr(p);
++			if (!ptr)
++				return -EFAULT;
+ 
+-		/*
+-		 * On ia64 if a page has been mapped somewhere as uncached, then
+-		 * it must also be accessed uncached by the kernel or data
+-		 * corruption may occur.
+-		 */
+-		ptr = xlate_dev_mem_ptr(p);
+-		if (!ptr)
+-			return -EFAULT;
++			remaining = copy_to_user(buf, ptr, sz);
++
++			unxlate_dev_mem_ptr(p, ptr);
++		}
+ 
+-		remaining = copy_to_user(buf, ptr, sz);
+-		unxlate_dev_mem_ptr(p, ptr);
+ 		if (remaining)
+ 			return -EFAULT;
+ 
+@@ -181,30 +197,36 @@ static ssize_t write_mem(struct file *file, const char __user *buf,
+ #endif
+ 
+ 	while (count > 0) {
++		int allowed;
++
+ 		sz = size_inside_page(p, count);
+ 
+-		if (!range_is_allowed(p >> PAGE_SHIFT, sz))
++		allowed = page_is_allowed(p >> PAGE_SHIFT);
++		if (!allowed)
+ 			return -EPERM;
+ 
+-		/*
+-		 * On ia64 if a page has been mapped somewhere as uncached, then
+-		 * it must also be accessed uncached by the kernel or data
+-		 * corruption may occur.
+-		 */
+-		ptr = xlate_dev_mem_ptr(p);
+-		if (!ptr) {
+-			if (written)
+-				break;
+-			return -EFAULT;
+-		}
++		/* Skip actual writing when a page is marked as restricted. */
++		if (allowed == 1) {
++			/*
++			 * On ia64 if a page has been mapped somewhere as
++			 * uncached, then it must also be accessed uncached
++			 * by the kernel or data corruption may occur.
++			 */
++			ptr = xlate_dev_mem_ptr(p);
++			if (!ptr) {
++				if (written)
++					break;
++				return -EFAULT;
++			}
+ 
+-		copied = copy_from_user(ptr, buf, sz);
+-		unxlate_dev_mem_ptr(p, ptr);
+-		if (copied) {
+-			written += sz - copied;
+-			if (written)
+-				break;
+-			return -EFAULT;
++			copied = copy_from_user(ptr, buf, sz);
++			unxlate_dev_mem_ptr(p, ptr);
++			if (copied) {
++				written += sz - copied;
++				if (written)
++					break;
++				return -EFAULT;
++			}
+ 		}
+ 
+ 		buf += sz;
+diff --git a/drivers/char/virtio_console.c b/drivers/char/virtio_console.c
+index 5649234..471a301 100644
+--- a/drivers/char/virtio_console.c
++++ b/drivers/char/virtio_console.c
+@@ -1136,6 +1136,8 @@ static int put_chars(u32 vtermno, const char *buf, int count)
+ {
+ 	struct port *port;
+ 	struct scatterlist sg[1];
++	void *data;
++	int ret;
+ 
+ 	if (unlikely(early_put_chars))
+ 		return early_put_chars(vtermno, buf, count);
+@@ -1144,8 +1146,14 @@ static int put_chars(u32 vtermno, const char *buf, int count)
+ 	if (!port)
+ 		return -EPIPE;
+ 
+-	sg_init_one(sg, buf, count);
+-	return __send_to_port(port, sg, 1, count, (void *)buf, false);
++	data = kmemdup(buf, count, GFP_ATOMIC);
++	if (!data)
++		return -ENOMEM;
++
++	sg_init_one(sg, data, count);
++	ret = __send_to_port(port, sg, 1, count, data, false);
++	kfree(data);
++	return ret;
+ }
+ 
+ /*
+diff --git a/drivers/cpufreq/cpufreq.c b/drivers/cpufreq/cpufreq.c
+index cac4a92..6153b66 100644
+--- a/drivers/cpufreq/cpufreq.c
++++ b/drivers/cpufreq/cpufreq.c
+@@ -2404,6 +2404,20 @@ EXPORT_SYMBOL_GPL(cpufreq_boost_enabled);
+  *********************************************************************/
+ static enum cpuhp_state hp_online;
+ 
++static int cpuhp_cpufreq_online(unsigned int cpu)
++{
++	cpufreq_online(cpu);
++
++	return 0;
++}
++
++static int cpuhp_cpufreq_offline(unsigned int cpu)
++{
++	cpufreq_offline(cpu);
++
++	return 0;
++}
++
+ /**
+  * cpufreq_register_driver - register a CPU Frequency driver
+  * @driver_data: A struct cpufreq_driver containing the values#
+@@ -2466,8 +2480,8 @@ int cpufreq_register_driver(struct cpufreq_driver *driver_data)
+ 	}
+ 
+ 	ret = cpuhp_setup_state_nocalls(CPUHP_AP_ONLINE_DYN, "cpufreq:online",
+-					cpufreq_online,
+-					cpufreq_offline);
++					cpuhp_cpufreq_online,
++					cpuhp_cpufreq_offline);
+ 	if (ret < 0)
+ 		goto err_if_unreg;
+ 	hp_online = ret;
+diff --git a/drivers/firmware/efi/libstub/gop.c b/drivers/firmware/efi/libstub/gop.c
+index 932742e..24c461d 100644
+--- a/drivers/firmware/efi/libstub/gop.c
++++ b/drivers/firmware/efi/libstub/gop.c
+@@ -149,7 +149,8 @@ setup_gop32(efi_system_table_t *sys_table_arg, struct screen_info *si,
+ 
+ 		status = __gop_query32(sys_table_arg, gop32, &info, &size,
+ 				       &current_fb_base);
+-		if (status == EFI_SUCCESS && (!first_gop || conout_found)) {
++		if (status == EFI_SUCCESS && (!first_gop || conout_found) &&
++		    info->pixel_format != PIXEL_BLT_ONLY) {
+ 			/*
+ 			 * Systems that use the UEFI Console Splitter may
+ 			 * provide multiple GOP devices, not all of which are
+@@ -266,7 +267,8 @@ setup_gop64(efi_system_table_t *sys_table_arg, struct screen_info *si,
+ 
+ 		status = __gop_query64(sys_table_arg, gop64, &info, &size,
+ 				       &current_fb_base);
+-		if (status == EFI_SUCCESS && (!first_gop || conout_found)) {
++		if (status == EFI_SUCCESS && (!first_gop || conout_found) &&
++		    info->pixel_format != PIXEL_BLT_ONLY) {
+ 			/*
+ 			 * Systems that use the UEFI Console Splitter may
+ 			 * provide multiple GOP devices, not all of which are
+diff --git a/drivers/gpu/drm/etnaviv/etnaviv_gpu.c b/drivers/gpu/drm/etnaviv/etnaviv_gpu.c
+index b87d278..a336754 100644
+--- a/drivers/gpu/drm/etnaviv/etnaviv_gpu.c
++++ b/drivers/gpu/drm/etnaviv/etnaviv_gpu.c
+@@ -1305,7 +1305,7 @@ int etnaviv_gpu_submit(struct etnaviv_gpu *gpu,
+ 	if (!fence) {
+ 		event_free(gpu, event);
+ 		ret = -ENOMEM;
+-		goto out_pm_put;
++		goto out_unlock;
+ 	}
+ 
+ 	gpu->event[event].fence = fence;
+@@ -1345,6 +1345,7 @@ int etnaviv_gpu_submit(struct etnaviv_gpu *gpu,
+ 	hangcheck_timer_reset(gpu);
+ 	ret = 0;
+ 
++out_unlock:
+ 	mutex_unlock(&gpu->lock);
+ 
+ out_pm_put:
+diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/device/base.c b/drivers/gpu/drm/nouveau/nvkm/engine/device/base.c
+index e0d7f84..d741ff8 100644
+--- a/drivers/gpu/drm/nouveau/nvkm/engine/device/base.c
++++ b/drivers/gpu/drm/nouveau/nvkm/engine/device/base.c
+@@ -714,7 +714,7 @@ nv4a_chipset = {
+ 	.i2c = nv04_i2c_new,
+ 	.imem = nv40_instmem_new,
+ 	.mc = nv44_mc_new,
+-	.mmu = nv44_mmu_new,
++	.mmu = nv04_mmu_new,
+ 	.pci = nv40_pci_new,
+ 	.therm = nv40_therm_new,
+ 	.timer = nv41_timer_new,
+diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/disp/nv50.c b/drivers/gpu/drm/nouveau/nvkm/engine/disp/nv50.c
+index fbb8c7d..0d65e7f 100644
+--- a/drivers/gpu/drm/nouveau/nvkm/engine/disp/nv50.c
++++ b/drivers/gpu/drm/nouveau/nvkm/engine/disp/nv50.c
+@@ -433,8 +433,6 @@ nv50_disp_dptmds_war(struct nvkm_device *device)
+ 	case 0x94:
+ 	case 0x96:
+ 	case 0x98:
+-	case 0xaa:
+-	case 0xac:
+ 		return true;
+ 	default:
+ 		break;
+diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/mpeg/nv31.c b/drivers/gpu/drm/nouveau/nvkm/engine/mpeg/nv31.c
+index 003ac91..8a88952 100644
+--- a/drivers/gpu/drm/nouveau/nvkm/engine/mpeg/nv31.c
++++ b/drivers/gpu/drm/nouveau/nvkm/engine/mpeg/nv31.c
+@@ -198,7 +198,7 @@ nv31_mpeg_intr(struct nvkm_engine *engine)
+ 		}
+ 
+ 		if (type == 0x00000010) {
+-			if (!nv31_mpeg_mthd(mpeg, mthd, data))
++			if (nv31_mpeg_mthd(mpeg, mthd, data))
+ 				show &= ~0x01000000;
+ 		}
+ 	}
+diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/mpeg/nv44.c b/drivers/gpu/drm/nouveau/nvkm/engine/mpeg/nv44.c
+index e536f37..c3cf02e 100644
+--- a/drivers/gpu/drm/nouveau/nvkm/engine/mpeg/nv44.c
++++ b/drivers/gpu/drm/nouveau/nvkm/engine/mpeg/nv44.c
+@@ -172,7 +172,7 @@ nv44_mpeg_intr(struct nvkm_engine *engine)
+ 		}
+ 
+ 		if (type == 0x00000010) {
+-			if (!nv44_mpeg_mthd(subdev->device, mthd, data))
++			if (nv44_mpeg_mthd(subdev->device, mthd, data))
+ 				show &= ~0x01000000;
+ 		}
+ 	}
+diff --git a/drivers/input/joystick/xpad.c b/drivers/input/joystick/xpad.c
+index bbe1524..f397a5b 100644
+--- a/drivers/input/joystick/xpad.c
++++ b/drivers/input/joystick/xpad.c
+@@ -201,6 +201,7 @@ static const struct xpad_device {
+ 	{ 0x1430, 0x8888, "TX6500+ Dance Pad (first generation)", MAP_DPAD_TO_BUTTONS, XTYPE_XBOX },
+ 	{ 0x146b, 0x0601, "BigBen Interactive XBOX 360 Controller", 0, XTYPE_XBOX360 },
+ 	{ 0x1532, 0x0037, "Razer Sabertooth", 0, XTYPE_XBOX360 },
++	{ 0x1532, 0x0a03, "Razer Wildcat", 0, XTYPE_XBOXONE },
+ 	{ 0x15e4, 0x3f00, "Power A Mini Pro Elite", 0, XTYPE_XBOX360 },
+ 	{ 0x15e4, 0x3f0a, "Xbox Airflo wired controller", 0, XTYPE_XBOX360 },
+ 	{ 0x15e4, 0x3f10, "Batarang Xbox 360 controller", 0, XTYPE_XBOX360 },
+@@ -329,6 +330,7 @@ static struct usb_device_id xpad_table[] = {
+ 	XPAD_XBOX360_VENDOR(0x24c6),		/* PowerA Controllers */
+ 	XPAD_XBOXONE_VENDOR(0x24c6),		/* PowerA Controllers */
+ 	XPAD_XBOX360_VENDOR(0x1532),		/* Razer Sabertooth */
++	XPAD_XBOXONE_VENDOR(0x1532),		/* Razer Wildcat */
+ 	XPAD_XBOX360_VENDOR(0x15e4),		/* Numark X-Box 360 controllers */
+ 	XPAD_XBOX360_VENDOR(0x162e),		/* Joytech X-Box 360 controllers */
+ 	{ }
+diff --git a/drivers/irqchip/irq-imx-gpcv2.c b/drivers/irqchip/irq-imx-gpcv2.c
+index 15af9a9..2d203b4 100644
+--- a/drivers/irqchip/irq-imx-gpcv2.c
++++ b/drivers/irqchip/irq-imx-gpcv2.c
+@@ -230,6 +230,8 @@ static int __init imx_gpcv2_irqchip_init(struct device_node *node,
+ 		return -ENOMEM;
+ 	}
+ 
++	raw_spin_lock_init(&cd->rlock);
++
+ 	cd->gpc_base = of_iomap(node, 0);
+ 	if (!cd->gpc_base) {
+ 		pr_err("fsl-gpcv2: unable to map gpc registers\n");
+diff --git a/drivers/media/usb/dvb-usb-v2/dvb_usb_core.c b/drivers/media/usb/dvb-usb-v2/dvb_usb_core.c
+index a8e6624..a9bb2dd 100644
+--- a/drivers/media/usb/dvb-usb-v2/dvb_usb_core.c
++++ b/drivers/media/usb/dvb-usb-v2/dvb_usb_core.c
+@@ -1013,8 +1013,8 @@ EXPORT_SYMBOL(dvb_usbv2_probe);
+ void dvb_usbv2_disconnect(struct usb_interface *intf)
+ {
+ 	struct dvb_usb_device *d = usb_get_intfdata(intf);
+-	const char *name = d->name;
+-	struct device dev = d->udev->dev;
++	const char *devname = kstrdup(dev_name(&d->udev->dev), GFP_KERNEL);
++	const char *drvname = d->name;
+ 
+ 	dev_dbg(&d->udev->dev, "%s: bInterfaceNumber=%d\n", __func__,
+ 			intf->cur_altsetting->desc.bInterfaceNumber);
+@@ -1024,8 +1024,9 @@ void dvb_usbv2_disconnect(struct usb_interface *intf)
+ 
+ 	dvb_usbv2_exit(d);
+ 
+-	dev_info(&dev, "%s: '%s' successfully deinitialized and disconnected\n",
+-			KBUILD_MODNAME, name);
++	pr_info("%s: '%s:%s' successfully deinitialized and disconnected\n",
++		KBUILD_MODNAME, drvname, devname);
++	kfree(devname);
+ }
+ EXPORT_SYMBOL(dvb_usbv2_disconnect);
+ 
+diff --git a/drivers/media/usb/dvb-usb/cxusb.c b/drivers/media/usb/dvb-usb/cxusb.c
+index 2434030..9fd43a3 100644
+--- a/drivers/media/usb/dvb-usb/cxusb.c
++++ b/drivers/media/usb/dvb-usb/cxusb.c
+@@ -59,23 +59,24 @@ static int cxusb_ctrl_msg(struct dvb_usb_device *d,
+ 			  u8 cmd, u8 *wbuf, int wlen, u8 *rbuf, int rlen)
+ {
+ 	struct cxusb_state *st = d->priv;
+-	int ret, wo;
++	int ret;
+ 
+ 	if (1 + wlen > MAX_XFER_SIZE) {
+ 		warn("i2c wr: len=%d is too big!\n", wlen);
+ 		return -EOPNOTSUPP;
+ 	}
+ 
+-	wo = (rbuf == NULL || rlen == 0); /* write-only */
++	if (rlen > MAX_XFER_SIZE) {
++		warn("i2c rd: len=%d is too big!\n", rlen);
++		return -EOPNOTSUPP;
++	}
+ 
+ 	mutex_lock(&d->data_mutex);
+ 	st->data[0] = cmd;
+ 	memcpy(&st->data[1], wbuf, wlen);
+-	if (wo)
+-		ret = dvb_usb_generic_write(d, st->data, 1 + wlen);
+-	else
+-		ret = dvb_usb_generic_rw(d, st->data, 1 + wlen,
+-					 rbuf, rlen, 0);
++	ret = dvb_usb_generic_rw(d, st->data, 1 + wlen, st->data, rlen, 0);
++	if (!ret && rbuf && rlen)
++		memcpy(rbuf, st->data, rlen);
+ 
+ 	mutex_unlock(&d->data_mutex);
+ 	return ret;
+diff --git a/drivers/media/usb/dvb-usb/dvb-usb-firmware.c b/drivers/media/usb/dvb-usb/dvb-usb-firmware.c
+index dd048a7..b8d2ac5 100644
+--- a/drivers/media/usb/dvb-usb/dvb-usb-firmware.c
++++ b/drivers/media/usb/dvb-usb/dvb-usb-firmware.c
+@@ -35,42 +35,51 @@ static int usb_cypress_writemem(struct usb_device *udev,u16 addr,u8 *data, u8 le
+ 
+ int usb_cypress_load_firmware(struct usb_device *udev, const struct firmware *fw, int type)
+ {
+-	struct hexline hx;
+-	u8 reset;
+-	int ret,pos=0;
++	struct hexline *hx;
++	u8 *buf;
++	int ret, pos = 0;
++	u16 cpu_cs_register = cypress[type].cpu_cs_register;
++
++	buf = kmalloc(sizeof(*hx), GFP_KERNEL);
++	if (!buf)
++		return -ENOMEM;
++	hx = (struct hexline *)buf;
+ 
+ 	/* stop the CPU */
+-	reset = 1;
+-	if ((ret = usb_cypress_writemem(udev,cypress[type].cpu_cs_register,&reset,1)) != 1)
++	buf[0] = 1;
++	if (usb_cypress_writemem(udev, cpu_cs_register, buf, 1) != 1)
+ 		err("could not stop the USB controller CPU.");
+ 
+-	while ((ret = dvb_usb_get_hexline(fw,&hx,&pos)) > 0) {
+-		deb_fw("writing to address 0x%04x (buffer: 0x%02x %02x)\n",hx.addr,hx.len,hx.chk);
+-		ret = usb_cypress_writemem(udev,hx.addr,hx.data,hx.len);
++	while ((ret = dvb_usb_get_hexline(fw, hx, &pos)) > 0) {
++		deb_fw("writing to address 0x%04x (buffer: 0x%02x %02x)\n", hx->addr, hx->len, hx->chk);
++		ret = usb_cypress_writemem(udev, hx->addr, hx->data, hx->len);
+ 
+-		if (ret != hx.len) {
++		if (ret != hx->len) {
+ 			err("error while transferring firmware "
+ 				"(transferred size: %d, block size: %d)",
+-				ret,hx.len);
++				ret, hx->len);
+ 			ret = -EINVAL;
+ 			break;
+ 		}
+ 	}
+ 	if (ret < 0) {
+ 		err("firmware download failed at %d with %d",pos,ret);
++		kfree(buf);
+ 		return ret;
+ 	}
+ 
+ 	if (ret == 0) {
+ 		/* restart the CPU */
+-		reset = 0;
+-		if (ret || usb_cypress_writemem(udev,cypress[type].cpu_cs_register,&reset,1) != 1) {
++		buf[0] = 0;
++		if (usb_cypress_writemem(udev, cpu_cs_register, buf, 1) != 1) {
+ 			err("could not restart the USB controller CPU.");
+ 			ret = -EINVAL;
+ 		}
+ 	} else
+ 		ret = -EIO;
+ 
++	kfree(buf);
++
+ 	return ret;
+ }
+ EXPORT_SYMBOL(usb_cypress_load_firmware);
+diff --git a/drivers/net/can/ifi_canfd/ifi_canfd.c b/drivers/net/can/ifi_canfd/ifi_canfd.c
+index 368bb07..481895b 100644
+--- a/drivers/net/can/ifi_canfd/ifi_canfd.c
++++ b/drivers/net/can/ifi_canfd/ifi_canfd.c
+@@ -557,7 +557,7 @@ static int ifi_canfd_poll(struct napi_struct *napi, int quota)
+ 	int work_done = 0;
+ 
+ 	u32 stcmd = readl(priv->base + IFI_CANFD_STCMD);
+-	u32 rxstcmd = readl(priv->base + IFI_CANFD_STCMD);
++	u32 rxstcmd = readl(priv->base + IFI_CANFD_RXSTCMD);
+ 	u32 errctr = readl(priv->base + IFI_CANFD_ERROR_CTR);
+ 
+ 	/* Handle bus state changes */
+diff --git a/drivers/net/wireless/ath/ath9k/common-spectral.c b/drivers/net/wireless/ath/ath9k/common-spectral.c
+index e2512d5..eedf86b 100644
+--- a/drivers/net/wireless/ath/ath9k/common-spectral.c
++++ b/drivers/net/wireless/ath/ath9k/common-spectral.c
+@@ -528,6 +528,9 @@ int ath_cmn_process_fft(struct ath_spec_scan_priv *spec_priv, struct ieee80211_h
+ 	if (!(radar_info->pulse_bw_info & SPECTRAL_SCAN_BITMASK))
+ 		return 0;
+ 
++	if (!spec_priv->rfs_chan_spec_scan)
++		return 1;
++
+ 	/* Output buffers are full, no need to process anything
+ 	 * since there is no space to put the result anyway
+ 	 */
+@@ -1072,7 +1075,7 @@ static struct rchan_callbacks rfs_spec_scan_cb = {
+ 
+ void ath9k_cmn_spectral_deinit_debug(struct ath_spec_scan_priv *spec_priv)
+ {
+-	if (IS_ENABLED(CONFIG_ATH9K_DEBUGFS)) {
++	if (IS_ENABLED(CONFIG_ATH9K_DEBUGFS) && spec_priv->rfs_chan_spec_scan) {
+ 		relay_close(spec_priv->rfs_chan_spec_scan);
+ 		spec_priv->rfs_chan_spec_scan = NULL;
+ 	}
+@@ -1086,6 +1089,9 @@ void ath9k_cmn_spectral_init_debug(struct ath_spec_scan_priv *spec_priv,
+ 					    debugfs_phy,
+ 					    1024, 256, &rfs_spec_scan_cb,
+ 					    NULL);
++	if (!spec_priv->rfs_chan_spec_scan)
++		return;
++
+ 	debugfs_create_file("spectral_scan_ctl",
+ 			    S_IRUSR | S_IWUSR,
+ 			    debugfs_phy, spec_priv,
+diff --git a/drivers/nvdimm/bus.c b/drivers/nvdimm/bus.c
+index 23d4a17..351bac8 100644
+--- a/drivers/nvdimm/bus.c
++++ b/drivers/nvdimm/bus.c
+@@ -934,8 +934,14 @@ static int __nd_ioctl(struct nvdimm_bus *nvdimm_bus, struct nvdimm *nvdimm,
+ 	rc = nd_desc->ndctl(nd_desc, nvdimm, cmd, buf, buf_len, NULL);
+ 	if (rc < 0)
+ 		goto out_unlock;
++	nvdimm_bus_unlock(&nvdimm_bus->dev);
++
+ 	if (copy_to_user(p, buf, buf_len))
+ 		rc = -EFAULT;
++
++	vfree(buf);
++	return rc;
++
+  out_unlock:
+ 	nvdimm_bus_unlock(&nvdimm_bus->dev);
+  out:
+diff --git a/drivers/nvdimm/dimm_devs.c b/drivers/nvdimm/dimm_devs.c
+index d614493..dcb32f3 100644
+--- a/drivers/nvdimm/dimm_devs.c
++++ b/drivers/nvdimm/dimm_devs.c
+@@ -388,7 +388,7 @@ EXPORT_SYMBOL_GPL(nvdimm_create);
+ 
+ int alias_dpa_busy(struct device *dev, void *data)
+ {
+-	resource_size_t map_end, blk_start, new, busy;
++	resource_size_t map_end, blk_start, new;
+ 	struct blk_alloc_info *info = data;
+ 	struct nd_mapping *nd_mapping;
+ 	struct nd_region *nd_region;
+@@ -429,29 +429,19 @@ int alias_dpa_busy(struct device *dev, void *data)
+  retry:
+ 	/*
+ 	 * Find the free dpa from the end of the last pmem allocation to
+-	 * the end of the interleave-set mapping that is not already
+-	 * covered by a blk allocation.
++	 * the end of the interleave-set mapping.
+ 	 */
+-	busy = 0;
+ 	for_each_dpa_resource(ndd, res) {
++		if (strncmp(res->name, "pmem", 4) != 0)
++			continue;
+ 		if ((res->start >= blk_start && res->start < map_end)
+ 				|| (res->end >= blk_start
+ 					&& res->end <= map_end)) {
+-			if (strncmp(res->name, "pmem", 4) == 0) {
+-				new = max(blk_start, min(map_end + 1,
+-							res->end + 1));
+-				if (new != blk_start) {
+-					blk_start = new;
+-					goto retry;
+-				}
+-			} else
+-				busy += min(map_end, res->end)
+-					- max(nd_mapping->start, res->start) + 1;
+-		} else if (nd_mapping->start > res->start
+-				&& map_end < res->end) {
+-			/* total eclipse of the PMEM region mapping */
+-			busy += nd_mapping->size;
+-			break;
++			new = max(blk_start, min(map_end + 1, res->end + 1));
++			if (new != blk_start) {
++				blk_start = new;
++				goto retry;
++			}
+ 		}
+ 	}
+ 
+@@ -463,52 +453,11 @@ int alias_dpa_busy(struct device *dev, void *data)
+ 		return 1;
+ 	}
+ 
+-	info->available -= blk_start - nd_mapping->start + busy;
++	info->available -= blk_start - nd_mapping->start;
+ 
+ 	return 0;
+ }
+ 
+-static int blk_dpa_busy(struct device *dev, void *data)
+-{
+-	struct blk_alloc_info *info = data;
+-	struct nd_mapping *nd_mapping;
+-	struct nd_region *nd_region;
+-	resource_size_t map_end;
+-	int i;
+-
+-	if (!is_nd_pmem(dev))
+-		return 0;
+-
+-	nd_region = to_nd_region(dev);
+-	for (i = 0; i < nd_region->ndr_mappings; i++) {
+-		nd_mapping  = &nd_region->mapping[i];
+-		if (nd_mapping->nvdimm == info->nd_mapping->nvdimm)
+-			break;
+-	}
+-
+-	if (i >= nd_region->ndr_mappings)
+-		return 0;
+-
+-	map_end = nd_mapping->start + nd_mapping->size - 1;
+-	if (info->res->start >= nd_mapping->start
+-			&& info->res->start < map_end) {
+-		if (info->res->end <= map_end) {
+-			info->busy = 0;
+-			return 1;
+-		} else {
+-			info->busy -= info->res->end - map_end;
+-			return 0;
+-		}
+-	} else if (info->res->end >= nd_mapping->start
+-			&& info->res->end <= map_end) {
+-		info->busy -= nd_mapping->start - info->res->start;
+-		return 0;
+-	} else {
+-		info->busy -= nd_mapping->size;
+-		return 0;
+-	}
+-}
+-
+ /**
+  * nd_blk_available_dpa - account the unused dpa of BLK region
+  * @nd_mapping: container of dpa-resource-root + labels
+@@ -538,11 +487,7 @@ resource_size_t nd_blk_available_dpa(struct nd_region *nd_region)
+ 	for_each_dpa_resource(ndd, res) {
+ 		if (strncmp(res->name, "blk", 3) != 0)
+ 			continue;
+-
+-		info.res = res;
+-		info.busy = resource_size(res);
+-		device_for_each_child(&nvdimm_bus->dev, &info, blk_dpa_busy);
+-		info.available -= info.busy;
++		info.available -= resource_size(res);
+ 	}
+ 
+ 	return info.available;
+diff --git a/drivers/platform/x86/acer-wmi.c b/drivers/platform/x86/acer-wmi.c
+index a66192f..c29b9b6 100644
+--- a/drivers/platform/x86/acer-wmi.c
++++ b/drivers/platform/x86/acer-wmi.c
+@@ -1846,11 +1846,24 @@ static int __init acer_wmi_enable_lm(void)
+ 	return status;
+ }
+ 
++#define ACER_WMID_ACCEL_HID	"BST0001"
++
+ static acpi_status __init acer_wmi_get_handle_cb(acpi_handle ah, u32 level,
+ 						void *ctx, void **retval)
+ {
++	struct acpi_device *dev;
++
++	if (!strcmp(ctx, "SENR")) {
++		if (acpi_bus_get_device(ah, &dev))
++			return AE_OK;
++		if (!strcmp(ACER_WMID_ACCEL_HID, acpi_device_hid(dev)))
++			return AE_OK;
++	} else
++		return AE_OK;
++
+ 	*(acpi_handle *)retval = ah;
+-	return AE_OK;
++
++	return AE_CTRL_TERMINATE;
+ }
+ 
+ static int __init acer_wmi_get_handle(const char *name, const char *prop,
+@@ -1877,7 +1890,7 @@ static int __init acer_wmi_accel_setup(void)
+ {
+ 	int err;
+ 
+-	err = acer_wmi_get_handle("SENR", "BST0001", &gsensor_handle);
++	err = acer_wmi_get_handle("SENR", ACER_WMID_ACCEL_HID, &gsensor_handle);
+ 	if (err)
+ 		return err;
+ 
+@@ -2233,10 +2246,11 @@ static int __init acer_wmi_init(void)
+ 		err = acer_wmi_input_setup();
+ 		if (err)
+ 			return err;
++		err = acer_wmi_accel_setup();
++		if (err)
++			return err;
+ 	}
+ 
+-	acer_wmi_accel_setup();
+-
+ 	err = platform_driver_register(&acer_platform_driver);
+ 	if (err) {
+ 		pr_err("Unable to register platform driver\n");
+diff --git a/drivers/pwm/pwm-rockchip.c b/drivers/pwm/pwm-rockchip.c
+index ef89df1..744d561 100644
+--- a/drivers/pwm/pwm-rockchip.c
++++ b/drivers/pwm/pwm-rockchip.c
+@@ -191,6 +191,28 @@ static int rockchip_pwm_config(struct pwm_chip *chip, struct pwm_device *pwm,
+ 	return 0;
+ }
+ 
++static int rockchip_pwm_enable(struct pwm_chip *chip,
++			 struct pwm_device *pwm,
++			 bool enable,
++			 enum pwm_polarity polarity)
++{
++	struct rockchip_pwm_chip *pc = to_rockchip_pwm_chip(chip);
++	int ret;
++
++	if (enable) {
++		ret = clk_enable(pc->clk);
++		if (ret)
++			return ret;
++	}
++
++	pc->data->set_enable(chip, pwm, enable, polarity);
++
++	if (!enable)
++		clk_disable(pc->clk);
++
++	return 0;
++}
++
+ static int rockchip_pwm_apply(struct pwm_chip *chip, struct pwm_device *pwm,
+ 			      struct pwm_state *state)
+ {
+@@ -207,22 +229,26 @@ static int rockchip_pwm_apply(struct pwm_chip *chip, struct pwm_device *pwm,
+ 		return ret;
+ 
+ 	if (state->polarity != curstate.polarity && enabled) {
+-		pc->data->set_enable(chip, pwm, false, state->polarity);
++		ret = rockchip_pwm_enable(chip, pwm, false, state->polarity);
++		if (ret)
++			goto out;
+ 		enabled = false;
+ 	}
+ 
+ 	ret = rockchip_pwm_config(chip, pwm, state->duty_cycle, state->period);
+ 	if (ret) {
+ 		if (enabled != curstate.enabled)
+-			pc->data->set_enable(chip, pwm, !enabled,
+-					     state->polarity);
+-
++			rockchip_pwm_enable(chip, pwm, !enabled,
++				      state->polarity);
+ 		goto out;
+ 	}
+ 
+-	if (state->enabled != enabled)
+-		pc->data->set_enable(chip, pwm, state->enabled,
+-				     state->polarity);
++	if (state->enabled != enabled) {
++		ret = rockchip_pwm_enable(chip, pwm, state->enabled,
++				    state->polarity);
++		if (ret)
++			goto out;
++	}
+ 
+ 	/*
+ 	 * Update the state with the real hardware, which can differ a bit
+diff --git a/drivers/rtc/rtc-tegra.c b/drivers/rtc/rtc-tegra.c
+index 3853ba9..19e03d0 100644
+--- a/drivers/rtc/rtc-tegra.c
++++ b/drivers/rtc/rtc-tegra.c
+@@ -18,6 +18,7 @@
+  * 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+  */
+ #include <linux/kernel.h>
++#include <linux/clk.h>
+ #include <linux/init.h>
+ #include <linux/module.h>
+ #include <linux/slab.h>
+@@ -59,6 +60,7 @@ struct tegra_rtc_info {
+ 	struct platform_device	*pdev;
+ 	struct rtc_device	*rtc_dev;
+ 	void __iomem		*rtc_base; /* NULL if not initialized. */
++	struct clk		*clk;
+ 	int			tegra_rtc_irq; /* alarm and periodic irq */
+ 	spinlock_t		tegra_rtc_lock;
+ };
+@@ -326,6 +328,14 @@ static int __init tegra_rtc_probe(struct platform_device *pdev)
+ 	if (info->tegra_rtc_irq <= 0)
+ 		return -EBUSY;
+ 
++	info->clk = devm_clk_get(&pdev->dev, NULL);
++	if (IS_ERR(info->clk))
++		return PTR_ERR(info->clk);
++
++	ret = clk_prepare_enable(info->clk);
++	if (ret < 0)
++		return ret;
++
+ 	/* set context info. */
+ 	info->pdev = pdev;
+ 	spin_lock_init(&info->tegra_rtc_lock);
+@@ -346,7 +356,7 @@ static int __init tegra_rtc_probe(struct platform_device *pdev)
+ 		ret = PTR_ERR(info->rtc_dev);
+ 		dev_err(&pdev->dev, "Unable to register device (err=%d).\n",
+ 			ret);
+-		return ret;
++		goto disable_clk;
+ 	}
+ 
+ 	ret = devm_request_irq(&pdev->dev, info->tegra_rtc_irq,
+@@ -356,12 +366,25 @@ static int __init tegra_rtc_probe(struct platform_device *pdev)
+ 		dev_err(&pdev->dev,
+ 			"Unable to request interrupt for device (err=%d).\n",
+ 			ret);
+-		return ret;
++		goto disable_clk;
+ 	}
+ 
+ 	dev_notice(&pdev->dev, "Tegra internal Real Time Clock\n");
+ 
+ 	return 0;
++
++disable_clk:
++	clk_disable_unprepare(info->clk);
++	return ret;
++}
++
++static int tegra_rtc_remove(struct platform_device *pdev)
++{
++	struct tegra_rtc_info *info = platform_get_drvdata(pdev);
++
++	clk_disable_unprepare(info->clk);
++
++	return 0;
+ }
+ 
+ #ifdef CONFIG_PM_SLEEP
+@@ -413,6 +436,7 @@ static void tegra_rtc_shutdown(struct platform_device *pdev)
+ 
+ MODULE_ALIAS("platform:tegra_rtc");
+ static struct platform_driver tegra_rtc_driver = {
++	.remove		= tegra_rtc_remove,
+ 	.shutdown	= tegra_rtc_shutdown,
+ 	.driver		= {
+ 		.name	= "tegra_rtc",
+diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c
+index 4f361d8..734e592 100644
+--- a/drivers/scsi/qla2xxx/qla_os.c
++++ b/drivers/scsi/qla2xxx/qla_os.c
+@@ -968,8 +968,13 @@ static inline
+ uint32_t qla2x00_isp_reg_stat(struct qla_hw_data *ha)
+ {
+ 	struct device_reg_24xx __iomem *reg = &ha->iobase->isp24;
++	struct device_reg_82xx __iomem *reg82 = &ha->iobase->isp82;
+ 
+-	return ((RD_REG_DWORD(&reg->host_status)) == ISP_REG_DISCONNECT);
++	if (IS_P3P_TYPE(ha))
++		return ((RD_REG_DWORD(&reg82->host_int)) == ISP_REG_DISCONNECT);
++	else
++		return ((RD_REG_DWORD(&reg->host_status)) ==
++			ISP_REG_DISCONNECT);
+ }
+ 
+ /**************************************************************************
+diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c
+index 51e5629..931af07 100644
+--- a/drivers/scsi/sd.c
++++ b/drivers/scsi/sd.c
+@@ -2057,6 +2057,22 @@ static void read_capacity_error(struct scsi_disk *sdkp, struct scsi_device *sdp,
+ 
+ #define READ_CAPACITY_RETRIES_ON_RESET	10
+ 
++/*
++ * Ensure that we don't overflow sector_t when CONFIG_LBDAF is not set
++ * and the reported logical block size is bigger than 512 bytes. Note
++ * that last_sector is a u64 and therefore logical_to_sectors() is not
++ * applicable.
++ */
++static bool sd_addressable_capacity(u64 lba, unsigned int sector_size)
++{
++	u64 last_sector = (lba + 1ULL) << (ilog2(sector_size) - 9);
++
++	if (sizeof(sector_t) == 4 && last_sector > U32_MAX)
++		return false;
++
++	return true;
++}
++
+ static int read_capacity_16(struct scsi_disk *sdkp, struct scsi_device *sdp,
+ 						unsigned char *buffer)
+ {
+@@ -2122,7 +2138,7 @@ static int read_capacity_16(struct scsi_disk *sdkp, struct scsi_device *sdp,
+ 		return -ENODEV;
+ 	}
+ 
+-	if ((sizeof(sdkp->capacity) == 4) && (lba >= 0xffffffffULL)) {
++	if (!sd_addressable_capacity(lba, sector_size)) {
+ 		sd_printk(KERN_ERR, sdkp, "Too big for this kernel. Use a "
+ 			"kernel compiled with support for large block "
+ 			"devices.\n");
+@@ -2208,7 +2224,7 @@ static int read_capacity_10(struct scsi_disk *sdkp, struct scsi_device *sdp,
+ 		return sector_size;
+ 	}
+ 
+-	if ((sizeof(sdkp->capacity) == 4) && (lba == 0xffffffff)) {
++	if (!sd_addressable_capacity(lba, sector_size)) {
+ 		sd_printk(KERN_ERR, sdkp, "Too big for this kernel. Use a "
+ 			"kernel compiled with support for large block "
+ 			"devices.\n");
+@@ -2877,7 +2893,8 @@ static int sd_revalidate_disk(struct gendisk *disk)
+ 		q->limits.io_opt = logical_to_bytes(sdp, sdkp->opt_xfer_blocks);
+ 		rw_max = logical_to_sectors(sdp, sdkp->opt_xfer_blocks);
+ 	} else
+-		rw_max = BLK_DEF_MAX_SECTORS;
++		rw_max = min_not_zero(logical_to_sectors(sdp, dev_max),
++				      (sector_t)BLK_DEF_MAX_SECTORS);
+ 
+ 	/* Combine with controller limits */
+ 	q->limits.max_sectors = min(rw_max, queue_max_hw_sectors(q));
+diff --git a/drivers/scsi/sr.c b/drivers/scsi/sr.c
+index bed2bbd..e635973 100644
+--- a/drivers/scsi/sr.c
++++ b/drivers/scsi/sr.c
+@@ -833,6 +833,7 @@ static void get_capabilities(struct scsi_cd *cd)
+ 	unsigned char *buffer;
+ 	struct scsi_mode_data data;
+ 	struct scsi_sense_hdr sshdr;
++	unsigned int ms_len = 128;
+ 	int rc, n;
+ 
+ 	static const char *loadmech[] =
+@@ -859,10 +860,11 @@ static void get_capabilities(struct scsi_cd *cd)
+ 	scsi_test_unit_ready(cd->device, SR_TIMEOUT, MAX_RETRIES, &sshdr);
+ 
+ 	/* ask for mode page 0x2a */
+-	rc = scsi_mode_sense(cd->device, 0, 0x2a, buffer, 128,
++	rc = scsi_mode_sense(cd->device, 0, 0x2a, buffer, ms_len,
+ 			     SR_TIMEOUT, 3, &data, NULL);
+ 
+-	if (!scsi_status_is_good(rc)) {
++	if (!scsi_status_is_good(rc) || data.length > ms_len ||
++	    data.header_length + data.block_descriptor_length > data.length) {
+ 		/* failed, drive doesn't have capabilities mode page */
+ 		cd->cdi.speed = 1;
+ 		cd->cdi.mask |= (CDC_CD_R | CDC_CD_RW | CDC_DVD_R |
+diff --git a/drivers/target/iscsi/iscsi_target_parameters.c b/drivers/target/iscsi/iscsi_target_parameters.c
+index 0efa80b..4a073339a 100644
+--- a/drivers/target/iscsi/iscsi_target_parameters.c
++++ b/drivers/target/iscsi/iscsi_target_parameters.c
+@@ -782,22 +782,6 @@ static void iscsi_check_proposer_for_optional_reply(struct iscsi_param *param)
+ 		if (!strcmp(param->name, MAXRECVDATASEGMENTLENGTH))
+ 			SET_PSTATE_REPLY_OPTIONAL(param);
+ 		/*
+-		 * The GlobalSAN iSCSI Initiator for MacOSX does
+-		 * not respond to MaxBurstLength, FirstBurstLength,
+-		 * DefaultTime2Wait or DefaultTime2Retain parameter keys.
+-		 * So, we set them to 'reply optional' here, and assume the
+-		 * the defaults from iscsi_parameters.h if the initiator
+-		 * is not RFC compliant and the keys are not negotiated.
+-		 */
+-		if (!strcmp(param->name, MAXBURSTLENGTH))
+-			SET_PSTATE_REPLY_OPTIONAL(param);
+-		if (!strcmp(param->name, FIRSTBURSTLENGTH))
+-			SET_PSTATE_REPLY_OPTIONAL(param);
+-		if (!strcmp(param->name, DEFAULTTIME2WAIT))
+-			SET_PSTATE_REPLY_OPTIONAL(param);
+-		if (!strcmp(param->name, DEFAULTTIME2RETAIN))
+-			SET_PSTATE_REPLY_OPTIONAL(param);
+-		/*
+ 		 * Required for gPXE iSCSI boot client
+ 		 */
+ 		if (!strcmp(param->name, MAXCONNECTIONS))
+diff --git a/drivers/target/iscsi/iscsi_target_util.c b/drivers/target/iscsi/iscsi_target_util.c
+index 1f38177..da5a5fc 100644
+--- a/drivers/target/iscsi/iscsi_target_util.c
++++ b/drivers/target/iscsi/iscsi_target_util.c
+@@ -735,21 +735,23 @@ void iscsit_free_cmd(struct iscsi_cmd *cmd, bool shutdown)
+ {
+ 	struct se_cmd *se_cmd = NULL;
+ 	int rc;
++	bool op_scsi = false;
+ 	/*
+ 	 * Determine if a struct se_cmd is associated with
+ 	 * this struct iscsi_cmd.
+ 	 */
+ 	switch (cmd->iscsi_opcode) {
+ 	case ISCSI_OP_SCSI_CMD:
+-		se_cmd = &cmd->se_cmd;
+-		__iscsit_free_cmd(cmd, true, shutdown);
++		op_scsi = true;
+ 		/*
+ 		 * Fallthrough
+ 		 */
+ 	case ISCSI_OP_SCSI_TMFUNC:
+-		rc = transport_generic_free_cmd(&cmd->se_cmd, shutdown);
+-		if (!rc && shutdown && se_cmd && se_cmd->se_sess) {
+-			__iscsit_free_cmd(cmd, true, shutdown);
++		se_cmd = &cmd->se_cmd;
++		__iscsit_free_cmd(cmd, op_scsi, shutdown);
++		rc = transport_generic_free_cmd(se_cmd, shutdown);
++		if (!rc && shutdown && se_cmd->se_sess) {
++			__iscsit_free_cmd(cmd, op_scsi, shutdown);
+ 			target_put_sess_cmd(se_cmd);
+ 		}
+ 		break;
+diff --git a/drivers/target/target_core_fabric_configfs.c b/drivers/target/target_core_fabric_configfs.c
+index 31a096a..6e456de 100644
+--- a/drivers/target/target_core_fabric_configfs.c
++++ b/drivers/target/target_core_fabric_configfs.c
+@@ -92,6 +92,11 @@ static int target_fabric_mappedlun_link(
+ 		pr_err("Source se_lun->lun_se_dev does not exist\n");
+ 		return -EINVAL;
+ 	}
++	if (lun->lun_shutdown) {
++		pr_err("Unable to create mappedlun symlink because"
++			" lun->lun_shutdown=true\n");
++		return -EINVAL;
++	}
+ 	se_tpg = lun->lun_tpg;
+ 
+ 	nacl_ci = &lun_acl_ci->ci_parent->ci_group->cg_item;
+diff --git a/drivers/target/target_core_tpg.c b/drivers/target/target_core_tpg.c
+index 2744251..1949f50 100644
+--- a/drivers/target/target_core_tpg.c
++++ b/drivers/target/target_core_tpg.c
+@@ -640,6 +640,8 @@ void core_tpg_remove_lun(
+ 	 */
+ 	struct se_device *dev = rcu_dereference_raw(lun->lun_se_dev);
+ 
++	lun->lun_shutdown = true;
++
+ 	core_clear_lun_from_tpg(lun, tpg);
+ 	/*
+ 	 * Wait for any active I/O references to percpu se_lun->lun_ref to
+@@ -661,6 +663,8 @@ void core_tpg_remove_lun(
+ 	}
+ 	if (!(dev->se_hba->hba_flags & HBA_FLAGS_INTERNAL_USE))
+ 		hlist_del_rcu(&lun->link);
++
++	lun->lun_shutdown = false;
+ 	mutex_unlock(&tpg->tpg_lun_mutex);
+ 
+ 	percpu_ref_exit(&lun->lun_ref);
+diff --git a/drivers/target/target_core_user.c b/drivers/target/target_core_user.c
+index 70c143a..1a83456 100644
+--- a/drivers/target/target_core_user.c
++++ b/drivers/target/target_core_user.c
+@@ -306,24 +306,50 @@ static void free_data_area(struct tcmu_dev *udev, struct tcmu_cmd *cmd)
+ 		   DATA_BLOCK_BITS);
+ }
+ 
+-static void gather_data_area(struct tcmu_dev *udev, unsigned long *cmd_bitmap,
+-		struct scatterlist *data_sg, unsigned int data_nents)
++static void gather_data_area(struct tcmu_dev *udev, struct tcmu_cmd *cmd,
++			     bool bidi)
+ {
++	struct se_cmd *se_cmd = cmd->se_cmd;
+ 	int i, block;
+ 	int block_remaining = 0;
+ 	void *from, *to;
+ 	size_t copy_bytes, from_offset;
+-	struct scatterlist *sg;
++	struct scatterlist *sg, *data_sg;
++	unsigned int data_nents;
++	DECLARE_BITMAP(bitmap, DATA_BLOCK_BITS);
++
++	bitmap_copy(bitmap, cmd->data_bitmap, DATA_BLOCK_BITS);
++
++	if (!bidi) {
++		data_sg = se_cmd->t_data_sg;
++		data_nents = se_cmd->t_data_nents;
++	} else {
++		uint32_t count;
++
++		/*
++		 * For bidi case, the first count blocks are for Data-Out
++		 * buffer blocks, and before gathering the Data-In buffer
++		 * the Data-Out buffer blocks should be discarded.
++		 */
++		count = DIV_ROUND_UP(se_cmd->data_length, DATA_BLOCK_SIZE);
++		while (count--) {
++			block = find_first_bit(bitmap, DATA_BLOCK_BITS);
++			clear_bit(block, bitmap);
++		}
++
++		data_sg = se_cmd->t_bidi_data_sg;
++		data_nents = se_cmd->t_bidi_data_nents;
++	}
+ 
+ 	for_each_sg(data_sg, sg, data_nents, i) {
+ 		int sg_remaining = sg->length;
+ 		to = kmap_atomic(sg_page(sg)) + sg->offset;
+ 		while (sg_remaining > 0) {
+ 			if (block_remaining == 0) {
+-				block = find_first_bit(cmd_bitmap,
++				block = find_first_bit(bitmap,
+ 						DATA_BLOCK_BITS);
+ 				block_remaining = DATA_BLOCK_SIZE;
+-				clear_bit(block, cmd_bitmap);
++				clear_bit(block, bitmap);
+ 			}
+ 			copy_bytes = min_t(size_t, sg_remaining,
+ 					block_remaining);
+@@ -389,6 +415,27 @@ static bool is_ring_space_avail(struct tcmu_dev *udev, size_t cmd_size, size_t d
+ 	return true;
+ }
+ 
++static inline size_t tcmu_cmd_get_data_length(struct tcmu_cmd *tcmu_cmd)
++{
++	struct se_cmd *se_cmd = tcmu_cmd->se_cmd;
++	size_t data_length = round_up(se_cmd->data_length, DATA_BLOCK_SIZE);
++
++	if (se_cmd->se_cmd_flags & SCF_BIDI) {
++		BUG_ON(!(se_cmd->t_bidi_data_sg && se_cmd->t_bidi_data_nents));
++		data_length += round_up(se_cmd->t_bidi_data_sg->length,
++				DATA_BLOCK_SIZE);
++	}
++
++	return data_length;
++}
++
++static inline uint32_t tcmu_cmd_get_block_cnt(struct tcmu_cmd *tcmu_cmd)
++{
++	size_t data_length = tcmu_cmd_get_data_length(tcmu_cmd);
++
++	return data_length / DATA_BLOCK_SIZE;
++}
++
+ static sense_reason_t
+ tcmu_queue_cmd_ring(struct tcmu_cmd *tcmu_cmd)
+ {
+@@ -402,7 +449,7 @@ tcmu_queue_cmd_ring(struct tcmu_cmd *tcmu_cmd)
+ 	uint32_t cmd_head;
+ 	uint64_t cdb_off;
+ 	bool copy_to_data_area;
+-	size_t data_length;
++	size_t data_length = tcmu_cmd_get_data_length(tcmu_cmd);
+ 	DECLARE_BITMAP(old_bitmap, DATA_BLOCK_BITS);
+ 
+ 	if (test_bit(TCMU_DEV_BIT_BROKEN, &udev->flags))
+@@ -416,8 +463,7 @@ tcmu_queue_cmd_ring(struct tcmu_cmd *tcmu_cmd)
+ 	 * expensive to tell how many regions are freed in the bitmap
+ 	*/
+ 	base_command_size = max(offsetof(struct tcmu_cmd_entry,
+-				req.iov[se_cmd->t_bidi_data_nents +
+-					se_cmd->t_data_nents]),
++				req.iov[tcmu_cmd_get_block_cnt(tcmu_cmd)]),
+ 				sizeof(struct tcmu_cmd_entry));
+ 	command_size = base_command_size
+ 		+ round_up(scsi_command_size(se_cmd->t_task_cdb), TCMU_OP_ALIGN_SIZE);
+@@ -428,11 +474,6 @@ tcmu_queue_cmd_ring(struct tcmu_cmd *tcmu_cmd)
+ 
+ 	mb = udev->mb_addr;
+ 	cmd_head = mb->cmd_head % udev->cmdr_size; /* UAM */
+-	data_length = se_cmd->data_length;
+-	if (se_cmd->se_cmd_flags & SCF_BIDI) {
+-		BUG_ON(!(se_cmd->t_bidi_data_sg && se_cmd->t_bidi_data_nents));
+-		data_length += se_cmd->t_bidi_data_sg->length;
+-	}
+ 	if ((command_size > (udev->cmdr_size / 2)) ||
+ 	    data_length > udev->data_size) {
+ 		pr_warn("TCMU: Request of size %zu/%zu is too big for %u/%zu "
+@@ -502,11 +543,14 @@ tcmu_queue_cmd_ring(struct tcmu_cmd *tcmu_cmd)
+ 	entry->req.iov_dif_cnt = 0;
+ 
+ 	/* Handle BIDI commands */
+-	iov_cnt = 0;
+-	alloc_and_scatter_data_area(udev, se_cmd->t_bidi_data_sg,
+-		se_cmd->t_bidi_data_nents, &iov, &iov_cnt, false);
+-	entry->req.iov_bidi_cnt = iov_cnt;
+-
++	if (se_cmd->se_cmd_flags & SCF_BIDI) {
++		iov_cnt = 0;
++		iov++;
++		alloc_and_scatter_data_area(udev, se_cmd->t_bidi_data_sg,
++				se_cmd->t_bidi_data_nents, &iov, &iov_cnt,
++				false);
++		entry->req.iov_bidi_cnt = iov_cnt;
++	}
+ 	/* cmd's data_bitmap is what changed in process */
+ 	bitmap_xor(tcmu_cmd->data_bitmap, old_bitmap, udev->data_bitmap,
+ 			DATA_BLOCK_BITS);
+@@ -582,19 +626,11 @@ static void tcmu_handle_completion(struct tcmu_cmd *cmd, struct tcmu_cmd_entry *
+ 			       se_cmd->scsi_sense_length);
+ 		free_data_area(udev, cmd);
+ 	} else if (se_cmd->se_cmd_flags & SCF_BIDI) {
+-		DECLARE_BITMAP(bitmap, DATA_BLOCK_BITS);
+-
+ 		/* Get Data-In buffer before clean up */
+-		bitmap_copy(bitmap, cmd->data_bitmap, DATA_BLOCK_BITS);
+-		gather_data_area(udev, bitmap,
+-			se_cmd->t_bidi_data_sg, se_cmd->t_bidi_data_nents);
++		gather_data_area(udev, cmd, true);
+ 		free_data_area(udev, cmd);
+ 	} else if (se_cmd->data_direction == DMA_FROM_DEVICE) {
+-		DECLARE_BITMAP(bitmap, DATA_BLOCK_BITS);
+-
+-		bitmap_copy(bitmap, cmd->data_bitmap, DATA_BLOCK_BITS);
+-		gather_data_area(udev, bitmap,
+-			se_cmd->t_data_sg, se_cmd->t_data_nents);
++		gather_data_area(udev, cmd, false);
+ 		free_data_area(udev, cmd);
+ 	} else if (se_cmd->data_direction == DMA_TO_DEVICE) {
+ 		free_data_area(udev, cmd);
+diff --git a/drivers/video/fbdev/efifb.c b/drivers/video/fbdev/efifb.c
+index 37a37c4..6f2e729 100644
+--- a/drivers/video/fbdev/efifb.c
++++ b/drivers/video/fbdev/efifb.c
+@@ -10,6 +10,7 @@
+ #include <linux/efi.h>
+ #include <linux/errno.h>
+ #include <linux/fb.h>
++#include <linux/pci.h>
+ #include <linux/platform_device.h>
+ #include <linux/screen_info.h>
+ #include <video/vga.h>
+@@ -118,6 +119,8 @@ static inline bool fb_base_is_valid(void)
+ 	return false;
+ }
+ 
++static bool pci_dev_disabled;	/* FB base matches BAR of a disabled device */
++
+ static int efifb_probe(struct platform_device *dev)
+ {
+ 	struct fb_info *info;
+@@ -127,7 +130,7 @@ static int efifb_probe(struct platform_device *dev)
+ 	unsigned int size_total;
+ 	char *option = NULL;
+ 
+-	if (screen_info.orig_video_isVGA != VIDEO_TYPE_EFI)
++	if (screen_info.orig_video_isVGA != VIDEO_TYPE_EFI || pci_dev_disabled)
+ 		return -ENODEV;
+ 
+ 	if (fb_get_options("efifb", &option))
+@@ -327,3 +330,64 @@ static struct platform_driver efifb_driver = {
+ };
+ 
+ builtin_platform_driver(efifb_driver);
++
++#if defined(CONFIG_PCI) && !defined(CONFIG_X86)
++
++static bool pci_bar_found;	/* did we find a BAR matching the efifb base? */
++
++static void claim_efifb_bar(struct pci_dev *dev, int idx)
++{
++	u16 word;
++
++	pci_bar_found = true;
++
++	pci_read_config_word(dev, PCI_COMMAND, &word);
++	if (!(word & PCI_COMMAND_MEMORY)) {
++		pci_dev_disabled = true;
++		dev_err(&dev->dev,
++			"BAR %d: assigned to efifb but device is disabled!\n",
++			idx);
++		return;
++	}
++
++	if (pci_claim_resource(dev, idx)) {
++		pci_dev_disabled = true;
++		dev_err(&dev->dev,
++			"BAR %d: failed to claim resource for efifb!\n", idx);
++		return;
++	}
++
++	dev_info(&dev->dev, "BAR %d: assigned to efifb\n", idx);
++}
++
++static void efifb_fixup_resources(struct pci_dev *dev)
++{
++	u64 base = screen_info.lfb_base;
++	u64 size = screen_info.lfb_size;
++	int i;
++
++	if (pci_bar_found || screen_info.orig_video_isVGA != VIDEO_TYPE_EFI)
++		return;
++
++	if (screen_info.capabilities & VIDEO_CAPABILITY_64BIT_BASE)
++		base |= (u64)screen_info.ext_lfb_base << 32;
++
++	if (!base)
++		return;
++
++	for (i = 0; i < PCI_STD_RESOURCE_END; i++) {
++		struct resource *res = &dev->resource[i];
++
++		if (!(res->flags & IORESOURCE_MEM))
++			continue;
++
++		if (res->start <= base && res->end >= base + size - 1) {
++			claim_efifb_bar(dev, i);
++			break;
++		}
++	}
++}
++DECLARE_PCI_FIXUP_CLASS_HEADER(PCI_ANY_ID, PCI_ANY_ID, PCI_BASE_CLASS_DISPLAY,
++			       16, efifb_fixup_resources);
++
++#endif
+diff --git a/drivers/video/fbdev/xen-fbfront.c b/drivers/video/fbdev/xen-fbfront.c
+index 0567d51..ea2f19f 100644
+--- a/drivers/video/fbdev/xen-fbfront.c
++++ b/drivers/video/fbdev/xen-fbfront.c
+@@ -644,7 +644,6 @@ static void xenfb_backend_changed(struct xenbus_device *dev,
+ 		break;
+ 
+ 	case XenbusStateInitWait:
+-InitWait:
+ 		xenbus_switch_state(dev, XenbusStateConnected);
+ 		break;
+ 
+@@ -655,7 +654,8 @@ static void xenfb_backend_changed(struct xenbus_device *dev,
+ 		 * get Connected twice here.
+ 		 */
+ 		if (dev->state != XenbusStateConnected)
+-			goto InitWait; /* no InitWait seen yet, fudge it */
++			/* no InitWait seen yet, fudge it */
++			xenbus_switch_state(dev, XenbusStateConnected);
+ 
+ 		if (xenbus_scanf(XBT_NIL, info->xbdev->otherend,
+ 				 "request-update", "%d", &val) < 0)
+diff --git a/fs/cifs/file.c b/fs/cifs/file.c
+index 1cd0e2e..3925758 100644
+--- a/fs/cifs/file.c
++++ b/fs/cifs/file.c
+@@ -2597,7 +2597,7 @@ cifs_write_from_iter(loff_t offset, size_t len, struct iov_iter *from,
+ 		wdata->credits = credits;
+ 
+ 		if (!wdata->cfile->invalidHandle ||
+-		    !cifs_reopen_file(wdata->cfile, false))
++		    !(rc = cifs_reopen_file(wdata->cfile, false)))
+ 			rc = server->ops->async_writev(wdata,
+ 					cifs_uncached_writedata_release);
+ 		if (rc) {
+@@ -3002,7 +3002,7 @@ cifs_send_async_read(loff_t offset, size_t len, struct cifsFileInfo *open_file,
+ 		rdata->credits = credits;
+ 
+ 		if (!rdata->cfile->invalidHandle ||
+-		    !cifs_reopen_file(rdata->cfile, true))
++		    !(rc = cifs_reopen_file(rdata->cfile, true)))
+ 			rc = server->ops->async_readv(rdata);
+ error:
+ 		if (rc) {
+@@ -3577,7 +3577,7 @@ static int cifs_readpages(struct file *file, struct address_space *mapping,
+ 		}
+ 
+ 		if (!rdata->cfile->invalidHandle ||
+-		    !cifs_reopen_file(rdata->cfile, true))
++		    !(rc = cifs_reopen_file(rdata->cfile, true)))
+ 			rc = server->ops->async_readv(rdata);
+ 		if (rc) {
+ 			add_credits_and_wake_if(server, rdata->credits, 0);
+diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c
+index bdd3292..7080dac 100644
+--- a/fs/cifs/smb2pdu.c
++++ b/fs/cifs/smb2pdu.c
+@@ -1987,6 +1987,9 @@ void smb2_reconnect_server(struct work_struct *work)
+ 	struct cifs_tcon *tcon, *tcon2;
+ 	struct list_head tmp_list;
+ 	int tcon_exist = false;
++	int rc;
++	int resched = false;
++
+ 
+ 	/* Prevent simultaneous reconnects that can corrupt tcon->rlist list */
+ 	mutex_lock(&server->reconnect_mutex);
+@@ -2014,13 +2017,18 @@ void smb2_reconnect_server(struct work_struct *work)
+ 	spin_unlock(&cifs_tcp_ses_lock);
+ 
+ 	list_for_each_entry_safe(tcon, tcon2, &tmp_list, rlist) {
+-		if (!smb2_reconnect(SMB2_INTERNAL_CMD, tcon))
++		rc = smb2_reconnect(SMB2_INTERNAL_CMD, tcon);
++		if (!rc)
+ 			cifs_reopen_persistent_handles(tcon);
++		else
++			resched = true;
+ 		list_del_init(&tcon->rlist);
+ 		cifs_put_tcon(tcon);
+ 	}
+ 
+ 	cifs_dbg(FYI, "Reconnecting tcons finished\n");
++	if (resched)
++		queue_delayed_work(cifsiod_wq, &server->reconnect, 2 * HZ);
+ 	mutex_unlock(&server->reconnect_mutex);
+ 
+ 	/* now we can safely release srv struct */
+diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
+index dc9d64a..c78fce4 100644
+--- a/fs/ext4/inode.c
++++ b/fs/ext4/inode.c
+@@ -71,10 +71,9 @@ static __u32 ext4_inode_csum(struct inode *inode, struct ext4_inode *raw,
+ 			csum = ext4_chksum(sbi, csum, (__u8 *)&dummy_csum,
+ 					   csum_size);
+ 			offset += csum_size;
+-			csum = ext4_chksum(sbi, csum, (__u8 *)raw + offset,
+-					   EXT4_INODE_SIZE(inode->i_sb) -
+-					   offset);
+ 		}
++		csum = ext4_chksum(sbi, csum, (__u8 *)raw + offset,
++				   EXT4_INODE_SIZE(inode->i_sb) - offset);
+ 	}
+ 
+ 	return csum;
+diff --git a/fs/orangefs/devorangefs-req.c b/fs/orangefs/devorangefs-req.c
+index f419dd9..fe2cbeb 100644
+--- a/fs/orangefs/devorangefs-req.c
++++ b/fs/orangefs/devorangefs-req.c
+@@ -208,14 +208,19 @@ static ssize_t orangefs_devreq_read(struct file *file,
+ 				continue;
+ 			/*
+ 			 * Skip ops whose filesystem we don't know about unless
+-			 * it is being mounted.
++			 * it is being mounted or unmounted.  It is possible for
++			 * a filesystem we don't know about to be unmounted if
++			 * it fails to mount in the kernel after userspace has
++			 * been sent the mount request.
+ 			 */
+ 			/* XXX: is there a better way to detect this? */
+ 			} else if (ret == -1 &&
+ 				   !(op->upcall.type ==
+ 					ORANGEFS_VFS_OP_FS_MOUNT ||
+ 				     op->upcall.type ==
+-					ORANGEFS_VFS_OP_GETATTR)) {
++					ORANGEFS_VFS_OP_GETATTR ||
++				     op->upcall.type ==
++					ORANGEFS_VFS_OP_FS_UMOUNT)) {
+ 				gossip_debug(GOSSIP_DEV_DEBUG,
+ 				    "orangefs: skipping op tag %llu %s\n",
+ 				    llu(op->tag), get_opname_string(op));
+diff --git a/fs/orangefs/orangefs-kernel.h b/fs/orangefs/orangefs-kernel.h
+index 3bf803d..45dd8f2 100644
+--- a/fs/orangefs/orangefs-kernel.h
++++ b/fs/orangefs/orangefs-kernel.h
+@@ -249,6 +249,7 @@ struct orangefs_sb_info_s {
+ 	char devname[ORANGEFS_MAX_SERVER_ADDR_LEN];
+ 	struct super_block *sb;
+ 	int mount_pending;
++	int no_list;
+ 	struct list_head list;
+ };
+ 
+diff --git a/fs/orangefs/super.c b/fs/orangefs/super.c
+index cd261c8..629d8c9 100644
+--- a/fs/orangefs/super.c
++++ b/fs/orangefs/super.c
+@@ -493,7 +493,7 @@ struct dentry *orangefs_mount(struct file_system_type *fst,
+ 
+ 	if (ret) {
+ 		d = ERR_PTR(ret);
+-		goto free_op;
++		goto free_sb_and_op;
+ 	}
+ 
+ 	/*
+@@ -519,6 +519,9 @@ struct dentry *orangefs_mount(struct file_system_type *fst,
+ 	spin_unlock(&orangefs_superblocks_lock);
+ 	op_release(new_op);
+ 
++	/* Must be removed from the list now. */
++	ORANGEFS_SB(sb)->no_list = 0;
++
+ 	if (orangefs_userspace_version >= 20906) {
+ 		new_op = op_alloc(ORANGEFS_VFS_OP_FEATURES);
+ 		if (!new_op)
+@@ -533,6 +536,10 @@ struct dentry *orangefs_mount(struct file_system_type *fst,
+ 
+ 	return dget(sb->s_root);
+ 
++free_sb_and_op:
++	/* Will call orangefs_kill_sb with sb not in list. */
++	ORANGEFS_SB(sb)->no_list = 1;
++	deactivate_locked_super(sb);
+ free_op:
+ 	gossip_err("orangefs_mount: mount request failed with %d\n", ret);
+ 	if (ret == -EINVAL) {
+@@ -558,12 +565,14 @@ void orangefs_kill_sb(struct super_block *sb)
+ 	 */
+ 	 orangefs_unmount_sb(sb);
+ 
+-	/* remove the sb from our list of orangefs specific sb's */
+-
+-	spin_lock(&orangefs_superblocks_lock);
+-	__list_del_entry(&ORANGEFS_SB(sb)->list);	/* not list_del_init */
+-	ORANGEFS_SB(sb)->list.prev = NULL;
+-	spin_unlock(&orangefs_superblocks_lock);
++	if (!ORANGEFS_SB(sb)->no_list) {
++		/* remove the sb from our list of orangefs specific sb's */
++		spin_lock(&orangefs_superblocks_lock);
++		/* not list_del_init */
++		__list_del_entry(&ORANGEFS_SB(sb)->list);
++		ORANGEFS_SB(sb)->list.prev = NULL;
++		spin_unlock(&orangefs_superblocks_lock);
++	}
+ 
+ 	/*
+ 	 * make sure that ORANGEFS_DEV_REMOUNT_ALL loop that might've seen us
+diff --git a/fs/proc/task_mmu.c b/fs/proc/task_mmu.c
+index 35b92d8..b1517b6 100644
+--- a/fs/proc/task_mmu.c
++++ b/fs/proc/task_mmu.c
+@@ -899,7 +899,14 @@ static inline void clear_soft_dirty(struct vm_area_struct *vma,
+ static inline void clear_soft_dirty_pmd(struct vm_area_struct *vma,
+ 		unsigned long addr, pmd_t *pmdp)
+ {
+-	pmd_t pmd = pmdp_huge_get_and_clear(vma->vm_mm, addr, pmdp);
++	pmd_t pmd = *pmdp;
++
++	/* See comment in change_huge_pmd() */
++	pmdp_invalidate(vma, addr, pmdp);
++	if (pmd_dirty(*pmdp))
++		pmd = pmd_mkdirty(pmd);
++	if (pmd_young(*pmdp))
++		pmd = pmd_mkyoung(pmd);
+ 
+ 	pmd = pmd_wrprotect(pmd);
+ 	pmd = pmd_clear_soft_dirty(pmd);
+diff --git a/include/crypto/internal/hash.h b/include/crypto/internal/hash.h
+index 1d4f365..f6d9af3e 100644
+--- a/include/crypto/internal/hash.h
++++ b/include/crypto/internal/hash.h
+@@ -166,6 +166,16 @@ static inline struct ahash_instance *ahash_alloc_instance(
+ 	return crypto_alloc_instance2(name, alg, ahash_instance_headroom());
+ }
+ 
++static inline void ahash_request_complete(struct ahash_request *req, int err)
++{
++	req->base.complete(&req->base, err);
++}
++
++static inline u32 ahash_request_flags(struct ahash_request *req)
++{
++	return req->base.flags;
++}
++
+ static inline struct crypto_ahash *crypto_spawn_ahash(
+ 	struct crypto_ahash_spawn *spawn)
+ {
+diff --git a/include/linux/cgroup.h b/include/linux/cgroup.h
+index c83c23f..307ae63 100644
+--- a/include/linux/cgroup.h
++++ b/include/linux/cgroup.h
+@@ -570,6 +570,25 @@ static inline void pr_cont_cgroup_path(struct cgroup *cgrp)
+ 	pr_cont_kernfs_path(cgrp->kn);
+ }
+ 
++static inline void cgroup_init_kthreadd(void)
++{
++	/*
++	 * kthreadd is inherited by all kthreads, keep it in the root so
++	 * that the new kthreads are guaranteed to stay in the root until
++	 * initialization is finished.
++	 */
++	current->no_cgroup_migration = 1;
++}
++
++static inline void cgroup_kthread_ready(void)
++{
++	/*
++	 * This kthread finished initialization.  The creator should have
++	 * set PF_NO_SETAFFINITY if this kthread should stay in the root.
++	 */
++	current->no_cgroup_migration = 0;
++}
++
+ #else /* !CONFIG_CGROUPS */
+ 
+ struct cgroup_subsys_state;
+@@ -590,6 +609,8 @@ static inline void cgroup_free(struct task_struct *p) {}
+ 
+ static inline int cgroup_init_early(void) { return 0; }
+ static inline int cgroup_init(void) { return 0; }
++static inline void cgroup_init_kthreadd(void) {}
++static inline void cgroup_kthread_ready(void) {}
+ 
+ static inline bool task_under_cgroup_hierarchy(struct task_struct *task,
+ 					       struct cgroup *ancestor)
+diff --git a/include/linux/sched.h b/include/linux/sched.h
+index 75d9a57..f425eb3 100644
+--- a/include/linux/sched.h
++++ b/include/linux/sched.h
+@@ -1584,6 +1584,10 @@ struct task_struct {
+ #ifdef CONFIG_COMPAT_BRK
+ 	unsigned brk_randomized:1;
+ #endif
++#ifdef CONFIG_CGROUPS
++	/* disallow userland-initiated cgroup migration */
++	unsigned no_cgroup_migration:1;
++#endif
+ 
+ 	unsigned long atomic_flags; /* Flags needing atomic access. */
+ 
+diff --git a/include/linux/uio.h b/include/linux/uio.h
+index 6e22b54..c146ebc 100644
+--- a/include/linux/uio.h
++++ b/include/linux/uio.h
+@@ -39,7 +39,10 @@ struct iov_iter {
+ 	};
+ 	union {
+ 		unsigned long nr_segs;
+-		int idx;
++		struct {
++			int idx;
++			int start_idx;
++		};
+ 	};
+ };
+ 
+@@ -81,6 +84,7 @@ unsigned long iov_shorten(struct iovec *iov, unsigned long nr_segs, size_t to);
+ size_t iov_iter_copy_from_user_atomic(struct page *page,
+ 		struct iov_iter *i, unsigned long offset, size_t bytes);
+ void iov_iter_advance(struct iov_iter *i, size_t bytes);
++void iov_iter_revert(struct iov_iter *i, size_t bytes);
+ int iov_iter_fault_in_readable(struct iov_iter *i, size_t bytes);
+ size_t iov_iter_single_seg_count(const struct iov_iter *i);
+ size_t copy_page_to_iter(struct page *page, size_t offset, size_t bytes,
+diff --git a/include/target/target_core_base.h b/include/target/target_core_base.h
+index 6233e8f..0383c60 100644
+--- a/include/target/target_core_base.h
++++ b/include/target/target_core_base.h
+@@ -705,6 +705,7 @@ struct se_lun {
+ 	u64			unpacked_lun;
+ #define SE_LUN_LINK_MAGIC			0xffff7771
+ 	u32			lun_link_magic;
++	bool			lun_shutdown;
+ 	bool			lun_access_ro;
+ 	u32			lun_index;
+ 
+diff --git a/kernel/cgroup.c b/kernel/cgroup.c
+index 4e2f3de..a3d2aad 100644
+--- a/kernel/cgroup.c
++++ b/kernel/cgroup.c
+@@ -2920,11 +2920,12 @@ static ssize_t __cgroup_procs_write(struct kernfs_open_file *of, char *buf,
+ 		tsk = tsk->group_leader;
+ 
+ 	/*
+-	 * Workqueue threads may acquire PF_NO_SETAFFINITY and become
+-	 * trapped in a cpuset, or RT worker may be born in a cgroup
+-	 * with no rt_runtime allocated.  Just say no.
++	 * kthreads may acquire PF_NO_SETAFFINITY during initialization.
++	 * If userland migrates such a kthread to a non-root cgroup, it can
++	 * become trapped in a cpuset, or RT kthread may be born in a
++	 * cgroup with no rt_runtime allocated.  Just say no.
+ 	 */
+-	if (tsk == kthreadd_task || (tsk->flags & PF_NO_SETAFFINITY)) {
++	if (tsk->no_cgroup_migration || (tsk->flags & PF_NO_SETAFFINITY)) {
+ 		ret = -EINVAL;
+ 		goto out_unlock_rcu;
+ 	}
+diff --git a/kernel/kthread.c b/kernel/kthread.c
+index be2cc1f..c2c911a 100644
+--- a/kernel/kthread.c
++++ b/kernel/kthread.c
+@@ -18,6 +18,7 @@
+ #include <linux/freezer.h>
+ #include <linux/ptrace.h>
+ #include <linux/uaccess.h>
++#include <linux/cgroup.h>
+ #include <trace/events/sched.h>
+ 
+ static DEFINE_SPINLOCK(kthread_create_lock);
+@@ -205,6 +206,7 @@ static int kthread(void *_create)
+ 	ret = -EINTR;
+ 
+ 	if (!test_bit(KTHREAD_SHOULD_STOP, &self.flags)) {
++		cgroup_kthread_ready();
+ 		__kthread_parkme(&self);
+ 		ret = threadfn(data);
+ 	}
+@@ -530,6 +532,7 @@ int kthreadd(void *unused)
+ 	set_mems_allowed(node_states[N_MEMORY]);
+ 
+ 	current->flags |= PF_NOFREEZE;
++	cgroup_init_kthreadd();
+ 
+ 	for (;;) {
+ 		set_current_state(TASK_INTERRUPTIBLE);
+diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
+index da87b3c..221eb59 100644
+--- a/kernel/trace/ftrace.c
++++ b/kernel/trace/ftrace.c
+@@ -3736,23 +3736,24 @@ static void __enable_ftrace_function_probe(struct ftrace_ops_hash *old_hash)
+ 	ftrace_probe_registered = 1;
+ }
+ 
+-static void __disable_ftrace_function_probe(void)
++static bool __disable_ftrace_function_probe(void)
+ {
+ 	int i;
+ 
+ 	if (!ftrace_probe_registered)
+-		return;
++		return false;
+ 
+ 	for (i = 0; i < FTRACE_FUNC_HASHSIZE; i++) {
+ 		struct hlist_head *hhd = &ftrace_func_hash[i];
+ 		if (hhd->first)
+-			return;
++			return false;
+ 	}
+ 
+ 	/* no more funcs left */
+ 	ftrace_shutdown(&trace_probe_ops, 0);
+ 
+ 	ftrace_probe_registered = 0;
++	return true;
+ }
+ 
+ 
+@@ -3882,6 +3883,7 @@ static void
+ __unregister_ftrace_function_probe(char *glob, struct ftrace_probe_ops *ops,
+ 				  void *data, int flags)
+ {
++	struct ftrace_ops_hash old_hash_ops;
+ 	struct ftrace_func_entry *rec_entry;
+ 	struct ftrace_func_probe *entry;
+ 	struct ftrace_func_probe *p;
+@@ -3893,6 +3895,7 @@ __unregister_ftrace_function_probe(char *glob, struct ftrace_probe_ops *ops,
+ 	struct hlist_node *tmp;
+ 	char str[KSYM_SYMBOL_LEN];
+ 	int i, ret;
++	bool disabled;
+ 
+ 	if (glob && (strcmp(glob, "*") == 0 || !strlen(glob)))
+ 		func_g.search = NULL;
+@@ -3911,6 +3914,10 @@ __unregister_ftrace_function_probe(char *glob, struct ftrace_probe_ops *ops,
+ 
+ 	mutex_lock(&trace_probe_ops.func_hash->regex_lock);
+ 
++	old_hash_ops.filter_hash = old_hash;
++	/* Probes only have filters */
++	old_hash_ops.notrace_hash = NULL;
++
+ 	hash = alloc_and_copy_ftrace_hash(FTRACE_HASH_DEFAULT_BITS, *orig_hash);
+ 	if (!hash)
+ 		/* Hmm, should report this somehow */
+@@ -3948,12 +3955,17 @@ __unregister_ftrace_function_probe(char *glob, struct ftrace_probe_ops *ops,
+ 		}
+ 	}
+ 	mutex_lock(&ftrace_lock);
+-	__disable_ftrace_function_probe();
++	disabled = __disable_ftrace_function_probe();
+ 	/*
+ 	 * Remove after the disable is called. Otherwise, if the last
+ 	 * probe is removed, a null hash means *all enabled*.
+ 	 */
+ 	ret = ftrace_hash_move(&trace_probe_ops, 1, orig_hash, hash);
++
++	/* still need to update the function call sites */
++	if (ftrace_enabled && !disabled)
++		ftrace_run_modify_code(&trace_probe_ops, FTRACE_UPDATE_CALLS,
++				       &old_hash_ops);
+ 	synchronize_sched();
+ 	if (!ret)
+ 		free_ftrace_hash_rcu(old_hash);
+@@ -5389,6 +5401,15 @@ static void clear_ftrace_pids(struct trace_array *tr)
+ 	trace_free_pid_list(pid_list);
+ }
+ 
++void ftrace_clear_pids(struct trace_array *tr)
++{
++	mutex_lock(&ftrace_lock);
++
++	clear_ftrace_pids(tr);
++
++	mutex_unlock(&ftrace_lock);
++}
++
+ static void ftrace_pid_reset(struct trace_array *tr)
+ {
+ 	mutex_lock(&ftrace_lock);
+diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
+index 90b66ed..862bc88 100644
+--- a/kernel/trace/trace.c
++++ b/kernel/trace/trace.c
+@@ -7150,6 +7150,7 @@ static int instance_rmdir(const char *name)
+ 
+ 	tracing_set_nop(tr);
+ 	event_trace_del_tracer(tr);
++	ftrace_clear_pids(tr);
+ 	ftrace_destroy_function_files(tr);
+ 	tracefs_remove_recursive(tr->dir);
+ 	free_trace_buffers(tr);
+diff --git a/kernel/trace/trace.h b/kernel/trace/trace.h
+index fd24b1f..b0d8576 100644
+--- a/kernel/trace/trace.h
++++ b/kernel/trace/trace.h
+@@ -870,6 +870,7 @@ int using_ftrace_ops_list_func(void);
+ void ftrace_init_tracefs(struct trace_array *tr, struct dentry *d_tracer);
+ void ftrace_init_tracefs_toplevel(struct trace_array *tr,
+ 				  struct dentry *d_tracer);
++void ftrace_clear_pids(struct trace_array *tr);
+ #else
+ static inline int ftrace_trace_task(struct trace_array *tr)
+ {
+@@ -888,6 +889,7 @@ ftrace_init_global_array_ops(struct trace_array *tr) { }
+ static inline void ftrace_reset_array_ops(struct trace_array *tr) { }
+ static inline void ftrace_init_tracefs(struct trace_array *tr, struct dentry *d) { }
+ static inline void ftrace_init_tracefs_toplevel(struct trace_array *tr, struct dentry *d) { }
++static inline void ftrace_clear_pids(struct trace_array *tr) { }
+ /* ftace_func_t type is not defined, use macro instead of static inline */
+ #define ftrace_init_array_ops(tr, func) do { } while (0)
+ #endif /* CONFIG_FUNCTION_TRACER */
+diff --git a/lib/iov_iter.c b/lib/iov_iter.c
+index efb0b4d..a75ea63 100644
+--- a/lib/iov_iter.c
++++ b/lib/iov_iter.c
+@@ -734,6 +734,68 @@ void iov_iter_advance(struct iov_iter *i, size_t size)
+ }
+ EXPORT_SYMBOL(iov_iter_advance);
+ 
++void iov_iter_revert(struct iov_iter *i, size_t unroll)
++{
++	if (!unroll)
++		return;
++	i->count += unroll;
++	if (unlikely(i->type & ITER_PIPE)) {
++		struct pipe_inode_info *pipe = i->pipe;
++		int idx = i->idx;
++		size_t off = i->iov_offset;
++		while (1) {
++			size_t n = off - pipe->bufs[idx].offset;
++			if (unroll < n) {
++				off -= (n - unroll);
++				break;
++			}
++			unroll -= n;
++			if (!unroll && idx == i->start_idx) {
++				off = 0;
++				break;
++			}
++			if (!idx--)
++				idx = pipe->buffers - 1;
++			off = pipe->bufs[idx].offset + pipe->bufs[idx].len;
++		}
++		i->iov_offset = off;
++		i->idx = idx;
++		pipe_truncate(i);
++		return;
++	}
++	if (unroll <= i->iov_offset) {
++		i->iov_offset -= unroll;
++		return;
++	}
++	unroll -= i->iov_offset;
++	if (i->type & ITER_BVEC) {
++		const struct bio_vec *bvec = i->bvec;
++		while (1) {
++			size_t n = (--bvec)->bv_len;
++			i->nr_segs++;
++			if (unroll <= n) {
++				i->bvec = bvec;
++				i->iov_offset = n - unroll;
++				return;
++			}
++			unroll -= n;
++		}
++	} else { /* same logics for iovec and kvec */
++		const struct iovec *iov = i->iov;
++		while (1) {
++			size_t n = (--iov)->iov_len;
++			i->nr_segs++;
++			if (unroll <= n) {
++				i->iov = iov;
++				i->iov_offset = n - unroll;
++				return;
++			}
++			unroll -= n;
++		}
++	}
++}
++EXPORT_SYMBOL(iov_iter_revert);
++
+ /*
+  * Return the count of just the current iov_iter segment.
+  */
+@@ -787,6 +849,7 @@ void iov_iter_pipe(struct iov_iter *i, int direction,
+ 	i->idx = (pipe->curbuf + pipe->nrbufs) & (pipe->buffers - 1);
+ 	i->iov_offset = 0;
+ 	i->count = count;
++	i->start_idx = i->idx;
+ }
+ EXPORT_SYMBOL(iov_iter_pipe);
+ 
+diff --git a/mm/huge_memory.c b/mm/huge_memory.c
+index 917555c..d5b2b75 100644
+--- a/mm/huge_memory.c
++++ b/mm/huge_memory.c
+@@ -1380,8 +1380,7 @@ bool madvise_free_huge_pmd(struct mmu_gather *tlb, struct vm_area_struct *vma,
+ 		deactivate_page(page);
+ 
+ 	if (pmd_young(orig_pmd) || pmd_dirty(orig_pmd)) {
+-		orig_pmd = pmdp_huge_get_and_clear_full(tlb->mm, addr, pmd,
+-			tlb->fullmm);
++		pmdp_invalidate(vma, addr, pmd);
+ 		orig_pmd = pmd_mkold(orig_pmd);
+ 		orig_pmd = pmd_mkclean(orig_pmd);
+ 
+diff --git a/mm/memcontrol.c b/mm/memcontrol.c
+index 0de2669..47559cc 100644
+--- a/mm/memcontrol.c
++++ b/mm/memcontrol.c
+@@ -2152,6 +2152,8 @@ struct memcg_kmem_cache_create_work {
+ 	struct work_struct work;
+ };
+ 
++static struct workqueue_struct *memcg_kmem_cache_create_wq;
++
+ static void memcg_kmem_cache_create_func(struct work_struct *w)
+ {
+ 	struct memcg_kmem_cache_create_work *cw =
+@@ -2183,7 +2185,7 @@ static void __memcg_schedule_kmem_cache_create(struct mem_cgroup *memcg,
+ 	cw->cachep = cachep;
+ 	INIT_WORK(&cw->work, memcg_kmem_cache_create_func);
+ 
+-	schedule_work(&cw->work);
++	queue_work(memcg_kmem_cache_create_wq, &cw->work);
+ }
+ 
+ static void memcg_schedule_kmem_cache_create(struct mem_cgroup *memcg,
+@@ -5786,6 +5788,17 @@ static int __init mem_cgroup_init(void)
+ {
+ 	int cpu, node;
+ 
++#ifndef CONFIG_SLOB
++	/*
++	 * Kmem cache creation is mostly done with the slab_mutex held,
++	 * so use a special workqueue to avoid stalling all worker
++	 * threads in case lots of cgroups are created simultaneously.
++	 */
++	memcg_kmem_cache_create_wq =
++		alloc_ordered_workqueue("memcg_kmem_cache_create", 0);
++	BUG_ON(!memcg_kmem_cache_create_wq);
++#endif
++
+ 	hotcpu_notifier(memcg_cpu_hotplug_callback, 0);
+ 
+ 	for_each_possible_cpu(cpu)
+diff --git a/mm/zsmalloc.c b/mm/zsmalloc.c
+index b0bc023..1689bb5 100644
+--- a/mm/zsmalloc.c
++++ b/mm/zsmalloc.c
+@@ -280,7 +280,7 @@ struct zs_pool {
+ struct zspage {
+ 	struct {
+ 		unsigned int fullness:FULLNESS_BITS;
+-		unsigned int class:CLASS_BITS;
++		unsigned int class:CLASS_BITS + 1;
+ 		unsigned int isolated:ISOLATED_BITS;
+ 		unsigned int magic:MAGIC_VAL_BITS;
+ 	};
+diff --git a/net/core/datagram.c b/net/core/datagram.c
+index b7de71f..963732e 100644
+--- a/net/core/datagram.c
++++ b/net/core/datagram.c
+@@ -378,7 +378,7 @@ int skb_copy_datagram_iter(const struct sk_buff *skb, int offset,
+ 			   struct iov_iter *to, int len)
+ {
+ 	int start = skb_headlen(skb);
+-	int i, copy = start - offset;
++	int i, copy = start - offset, start_off = offset, n;
+ 	struct sk_buff *frag_iter;
+ 
+ 	trace_skb_copy_datagram_iovec(skb, len);
+@@ -387,11 +387,12 @@ int skb_copy_datagram_iter(const struct sk_buff *skb, int offset,
+ 	if (copy > 0) {
+ 		if (copy > len)
+ 			copy = len;
+-		if (copy_to_iter(skb->data + offset, copy, to) != copy)
++		n = copy_to_iter(skb->data + offset, copy, to);
++		offset += n;
++		if (n != copy)
+ 			goto short_copy;
+ 		if ((len -= copy) == 0)
+ 			return 0;
+-		offset += copy;
+ 	}
+ 
+ 	/* Copy paged appendix. Hmm... why does this look so complicated? */
+@@ -405,13 +406,14 @@ int skb_copy_datagram_iter(const struct sk_buff *skb, int offset,
+ 		if ((copy = end - offset) > 0) {
+ 			if (copy > len)
+ 				copy = len;
+-			if (copy_page_to_iter(skb_frag_page(frag),
++			n = copy_page_to_iter(skb_frag_page(frag),
+ 					      frag->page_offset + offset -
+-					      start, copy, to) != copy)
++					      start, copy, to);
++			offset += n;
++			if (n != copy)
+ 				goto short_copy;
+ 			if (!(len -= copy))
+ 				return 0;
+-			offset += copy;
+ 		}
+ 		start = end;
+ 	}
+@@ -443,6 +445,7 @@ int skb_copy_datagram_iter(const struct sk_buff *skb, int offset,
+ 	 */
+ 
+ fault:
++	iov_iter_revert(to, offset - start_off);
+ 	return -EFAULT;
+ 
+ short_copy:
+@@ -593,7 +596,7 @@ static int skb_copy_and_csum_datagram(const struct sk_buff *skb, int offset,
+ 				      __wsum *csump)
+ {
+ 	int start = skb_headlen(skb);
+-	int i, copy = start - offset;
++	int i, copy = start - offset, start_off = offset;
+ 	struct sk_buff *frag_iter;
+ 	int pos = 0;
+ 	int n;
+@@ -603,11 +606,11 @@ static int skb_copy_and_csum_datagram(const struct sk_buff *skb, int offset,
+ 		if (copy > len)
+ 			copy = len;
+ 		n = csum_and_copy_to_iter(skb->data + offset, copy, csump, to);
++		offset += n;
+ 		if (n != copy)
+ 			goto fault;
+ 		if ((len -= copy) == 0)
+ 			return 0;
+-		offset += copy;
+ 		pos = copy;
+ 	}
+ 
+@@ -629,12 +632,12 @@ static int skb_copy_and_csum_datagram(const struct sk_buff *skb, int offset,
+ 						  offset - start, copy,
+ 						  &csum2, to);
+ 			kunmap(page);
++			offset += n;
+ 			if (n != copy)
+ 				goto fault;
+ 			*csump = csum_block_add(*csump, csum2, pos);
+ 			if (!(len -= copy))
+ 				return 0;
+-			offset += copy;
+ 			pos += copy;
+ 		}
+ 		start = end;
+@@ -667,6 +670,7 @@ static int skb_copy_and_csum_datagram(const struct sk_buff *skb, int offset,
+ 		return 0;
+ 
+ fault:
++	iov_iter_revert(to, offset - start_off);
+ 	return -EFAULT;
+ }
+ 
+@@ -751,6 +755,7 @@ int skb_copy_and_csum_datagram_msg(struct sk_buff *skb,
+ 	}
+ 	return 0;
+ csum_error:
++	iov_iter_revert(&msg->msg_iter, chunk);
+ 	return -EINVAL;
+ fault:
+ 	return -EFAULT;
+diff --git a/net/ipv6/route.c b/net/ipv6/route.c
+index bff4460..8d6c09f 100644
+--- a/net/ipv6/route.c
++++ b/net/ipv6/route.c
+@@ -2166,6 +2166,8 @@ static int ip6_route_del(struct fib6_config *cfg)
+ 				continue;
+ 			if (cfg->fc_metric && cfg->fc_metric != rt->rt6i_metric)
+ 				continue;
++			if (cfg->fc_protocol && cfg->fc_protocol != rt->rt6i_protocol)
++				continue;
+ 			dst_hold(&rt->dst);
+ 			read_unlock_bh(&table->tb6_lock);
+ 
+diff --git a/net/sctp/socket.c b/net/sctp/socket.c
+index 6cbe5bd..6734420 100644
+--- a/net/sctp/socket.c
++++ b/net/sctp/socket.c
+@@ -4735,6 +4735,12 @@ int sctp_do_peeloff(struct sock *sk, sctp_assoc_t id, struct socket **sockp)
+ 	if (!asoc)
+ 		return -EINVAL;
+ 
++	/* If there is a thread waiting on more sndbuf space for
++	 * sending on this asoc, it cannot be peeled.
++	 */
++	if (waitqueue_active(&asoc->wait))
++		return -EBUSY;
++
+ 	/* An association cannot be branched off from an already peeled-off
+ 	 * socket, nor is this supported for tcp style sockets.
+ 	 */
+@@ -7427,8 +7433,6 @@ static int sctp_wait_for_sndbuf(struct sctp_association *asoc, long *timeo_p,
+ 		 */
+ 		release_sock(sk);
+ 		current_timeo = schedule_timeout(current_timeo);
+-		if (sk != asoc->base.sk)
+-			goto do_error;
+ 		lock_sock(sk);
+ 
+ 		*timeo_p = current_timeo;
+diff --git a/sound/soc/intel/Kconfig b/sound/soc/intel/Kconfig
+index fd5d1e0..e18fe9d 100644
+--- a/sound/soc/intel/Kconfig
++++ b/sound/soc/intel/Kconfig
+@@ -33,11 +33,9 @@ config SND_SOC_INTEL_SST
+ 	select SND_SOC_INTEL_SST_MATCH if ACPI
+ 	depends on (X86 || COMPILE_TEST)
+ 
+-# firmware stuff depends DW_DMAC_CORE; since there is no depends-on from
+-# the reverse selection, each machine driver needs to select
+-# SND_SOC_INTEL_SST_FIRMWARE carefully depending on DW_DMAC_CORE
+ config SND_SOC_INTEL_SST_FIRMWARE
+ 	tristate
++	select DW_DMAC_CORE
+ 
+ config SND_SOC_INTEL_SST_ACPI
+ 	tristate
+@@ -47,16 +45,18 @@ config SND_SOC_INTEL_SST_MATCH
+ 
+ config SND_SOC_INTEL_HASWELL
+ 	tristate
++	select SND_SOC_INTEL_SST
+ 	select SND_SOC_INTEL_SST_FIRMWARE
+ 
+ config SND_SOC_INTEL_BAYTRAIL
+ 	tristate
++	select SND_SOC_INTEL_SST
++	select SND_SOC_INTEL_SST_FIRMWARE
+ 
+ config SND_SOC_INTEL_HASWELL_MACH
+ 	tristate "ASoC Audio DSP support for Intel Haswell Lynxpoint"
+ 	depends on X86_INTEL_LPSS && I2C && I2C_DESIGNWARE_PLATFORM
+-	depends on DW_DMAC_CORE
+-	select SND_SOC_INTEL_SST
++	depends on DMADEVICES
+ 	select SND_SOC_INTEL_HASWELL
+ 	select SND_SOC_RT5640
+ 	help
+@@ -99,9 +99,8 @@ config SND_SOC_INTEL_BXT_RT298_MACH
+ config SND_SOC_INTEL_BYT_RT5640_MACH
+ 	tristate "ASoC Audio driver for Intel Baytrail with RT5640 codec"
+ 	depends on X86_INTEL_LPSS && I2C
+-	depends on DW_DMAC_CORE && (SND_SST_IPC_ACPI = n)
+-	select SND_SOC_INTEL_SST
+-	select SND_SOC_INTEL_SST_FIRMWARE
++	depends on DMADEVICES
++	depends on SND_SST_IPC_ACPI = n
+ 	select SND_SOC_INTEL_BAYTRAIL
+ 	select SND_SOC_RT5640
+ 	help
+@@ -112,9 +111,8 @@ config SND_SOC_INTEL_BYT_RT5640_MACH
+ config SND_SOC_INTEL_BYT_MAX98090_MACH
+ 	tristate "ASoC Audio driver for Intel Baytrail with MAX98090 codec"
+ 	depends on X86_INTEL_LPSS && I2C
+-	depends on DW_DMAC_CORE && (SND_SST_IPC_ACPI = n)
+-	select SND_SOC_INTEL_SST
+-	select SND_SOC_INTEL_SST_FIRMWARE
++	depends on DMADEVICES
++	depends on SND_SST_IPC_ACPI = n
+ 	select SND_SOC_INTEL_BAYTRAIL
+ 	select SND_SOC_MAX98090
+ 	help
+@@ -123,9 +121,8 @@ config SND_SOC_INTEL_BYT_MAX98090_MACH
+ 
+ config SND_SOC_INTEL_BDW_RT5677_MACH
+ 	tristate "ASoC Audio driver for Intel Broadwell with RT5677 codec"
+-	depends on X86_INTEL_LPSS && GPIOLIB && I2C && DW_DMAC
+-	depends on DW_DMAC_CORE=y
+-	select SND_SOC_INTEL_SST
++	depends on X86_INTEL_LPSS && GPIOLIB && I2C
++	depends on DMADEVICES
+ 	select SND_SOC_INTEL_HASWELL
+ 	select SND_SOC_RT5677
+ 	help
+@@ -134,10 +131,8 @@ config SND_SOC_INTEL_BDW_RT5677_MACH
+ 
+ config SND_SOC_INTEL_BROADWELL_MACH
+ 	tristate "ASoC Audio DSP support for Intel Broadwell Wildcatpoint"
+-	depends on X86_INTEL_LPSS && I2C && DW_DMAC && \
+-		   I2C_DESIGNWARE_PLATFORM
+-	depends on DW_DMAC_CORE
+-	select SND_SOC_INTEL_SST
++	depends on X86_INTEL_LPSS && I2C && I2C_DESIGNWARE_PLATFORM
++	depends on DMADEVICES
+ 	select SND_SOC_INTEL_HASWELL
+ 	select SND_SOC_RT286
+ 	help
diff --git a/4.9.23/4420_grsecurity-3.1-4.9.23-201704181901.patch b/4.9.24/4420_grsecurity-3.1-4.9.24-201704220732.patch
index 5c38b38..8f3058d 100644
--- a/4.9.23/4420_grsecurity-3.1-4.9.23-201704181901.patch
+++ b/4.9.24/4420_grsecurity-3.1-4.9.24-201704220732.patch
@@ -419,7 +419,7 @@ index 3d0ae15..84e5412 100644
        cmd_syscalls = $(CONFIG_SHELL) $< $(CC) $(c_flags) $(missing_syscalls_flags)
  
 diff --git a/Makefile b/Makefile
-index 0de7597..ada2dd2 100644
+index 50436f5..435d355 100644
 --- a/Makefile
 +++ b/Makefile
 @@ -302,7 +302,9 @@ CONFIG_SHELL := $(shell if [ -x "$$BASH" ]; then echo $$BASH; \
@@ -7972,10 +7972,10 @@ index 3a4ed9f..29b7218 100644
  #define PAGE_KERNEL_EXEC	__pgprot(_PAGE_KERNEL_EXEC)
  #define PAGE_KERNEL_RWX	__pgprot(_PAGE_KERNEL_RWX)
 diff --git a/arch/parisc/include/asm/uaccess.h b/arch/parisc/include/asm/uaccess.h
-index 7fcf512..37391e8 100644
+index 0497cec..58b097a 100644
 --- a/arch/parisc/include/asm/uaccess.h
 +++ b/arch/parisc/include/asm/uaccess.h
-@@ -232,10 +232,10 @@ static inline void copy_user_overflow(int size, unsigned long count)
+@@ -256,10 +256,10 @@ static inline void copy_user_overflow(int size, unsigned long count)
  static __always_inline unsigned long __must_check
  copy_from_user(void *to, const void __user *from, unsigned long n)
  {
@@ -7988,7 +7988,7 @@ index 7fcf512..37391e8 100644
  		check_object_size(to, n, false);
  		ret = __copy_from_user(to, from, n);
  	} else if (!__builtin_constant_p(n))
-@@ -243,7 +243,7 @@ copy_from_user(void *to, const void __user *from, unsigned long n)
+@@ -267,7 +267,7 @@ copy_from_user(void *to, const void __user *from, unsigned long n)
  	else
  		__bad_copy_user();
  
@@ -7997,7 +7997,7 @@ index 7fcf512..37391e8 100644
  		memset(to + (n - ret), 0, ret);
  
  	return ret;
-@@ -252,9 +252,9 @@ copy_from_user(void *to, const void __user *from, unsigned long n)
+@@ -276,9 +276,9 @@ copy_from_user(void *to, const void __user *from, unsigned long n)
  static __always_inline unsigned long __must_check
  copy_to_user(void __user *to, const void *from, unsigned long n)
  {
@@ -21420,10 +21420,10 @@ index be20239..99d75dd 100644
  	} else if (event->attr.precise_ip > 1 && intel_pmu_pebs_fixup_ip(regs))
  		regs->flags |= PERF_EFLAGS_EXACT;
 diff --git a/arch/x86/events/intel/lbr.c b/arch/x86/events/intel/lbr.c
-index 81b321a..ef54593 100644
+index f924629..bb99e36 100644
 --- a/arch/x86/events/intel/lbr.c
 +++ b/arch/x86/events/intel/lbr.c
-@@ -805,7 +805,7 @@ static int branch_type(unsigned long from, unsigned long to, int abort)
+@@ -808,7 +808,7 @@ static int branch_type(unsigned long from, unsigned long to, int abort)
  		 * Ensure we don't blindy read any address by validating it is
  		 * a known text address.
  		 */
@@ -21432,7 +21432,7 @@ index 81b321a..ef54593 100644
  			addr = (void *)from;
  			/*
  			 * Assume we can get the maximum possible size
-@@ -827,7 +827,7 @@ static int branch_type(unsigned long from, unsigned long to, int abort)
+@@ -830,7 +830,7 @@ static int branch_type(unsigned long from, unsigned long to, int abort)
  #ifdef CONFIG_X86_64
  	is64 = kernel_ip((unsigned long)addr) || !test_thread_flag(TIF_IA32);
  #endif
@@ -24008,7 +24008,7 @@ index 389d700..fa51266 100644
  		return true;
  
 diff --git a/arch/x86/include/asm/elf.h b/arch/x86/include/asm/elf.h
-index e7f155c..8611814 100644
+index 94aad63..7d9c5cc 100644
 --- a/arch/x86/include/asm/elf.h
 +++ b/arch/x86/include/asm/elf.h
 @@ -75,9 +75,6 @@ typedef struct user_fxsr_struct elf_fpxregset_t;
@@ -26400,7 +26400,7 @@ index 8b4de22..eaf50b8 100644
  #define pgprot_writecombine	pgprot_writecombine
  extern pgprot_t pgprot_writecombine(pgprot_t prot);
 diff --git a/arch/x86/include/asm/pmem.h b/arch/x86/include/asm/pmem.h
-index 2c1ebeb..69c4605 100644
+index 529bb4a..2e9cae3 100644
 --- a/arch/x86/include/asm/pmem.h
 +++ b/arch/x86/include/asm/pmem.h
 @@ -38,7 +38,7 @@ static inline void arch_memcpy_to_pmem(void *dst, const void *src, size_t n)
@@ -35063,7 +35063,7 @@ index 1c113db..287b42e 100644
  static int trace_irq_vector_refcount;
  static DEFINE_MUTEX(irq_vector_mutex);
 diff --git a/arch/x86/kernel/traps.c b/arch/x86/kernel/traps.c
-index bd4e3d4..3e938e3 100644
+index bd4e3d4..3089938 100644
 --- a/arch/x86/kernel/traps.c
 +++ b/arch/x86/kernel/traps.c
 @@ -71,7 +71,7 @@
@@ -35093,7 +35093,7 @@ index bd4e3d4..3e938e3 100644
  		  struct pt_regs *regs,	long error_code)
  {
  	if (v8086_mode(regs)) {
-@@ -189,8 +189,32 @@ do_trap_no_signal(struct task_struct *tsk, int trapnr, char *str,
+@@ -189,8 +189,31 @@ do_trap_no_signal(struct task_struct *tsk, int trapnr, char *str,
  		if (!fixup_exception(regs, trapnr)) {
  			tsk->thread.error_code = error_code;
  			tsk->thread.trap_nr = trapnr;
@@ -35118,7 +35118,6 @@ index bd4e3d4..3e938e3 100644
 +
 +#ifdef CONFIG_PAX_REFCOUNT
 +		if (trapnr == X86_REFCOUNT_VECTOR) {
-+			regs->ip -= 2; // sizeof int $xx
 +			pax_report_refcount_error(regs, str);
 +		}
 +#endif
@@ -35126,7 +35125,7 @@ index bd4e3d4..3e938e3 100644
  		return 0;
  	}
  
-@@ -229,7 +253,7 @@ static siginfo_t *fill_trap_info(struct pt_regs *regs, int signr, int trapnr,
+@@ -229,7 +252,7 @@ static siginfo_t *fill_trap_info(struct pt_regs *regs, int signr, int trapnr,
  }
  
  static void
@@ -35135,7 +35134,7 @@ index bd4e3d4..3e938e3 100644
  	long error_code, siginfo_t *info)
  {
  	struct task_struct *tsk = current;
-@@ -252,7 +276,7 @@ do_trap(int trapnr, int signr, char *str, struct pt_regs *regs,
+@@ -252,7 +275,7 @@ do_trap(int trapnr, int signr, char *str, struct pt_regs *regs,
  	if (show_unhandled_signals && unhandled_signal(tsk, signr) &&
  	    printk_ratelimit()) {
  		pr_info("%s[%d] trap %s ip:%lx sp:%lx error:%lx",
@@ -35144,7 +35143,7 @@ index bd4e3d4..3e938e3 100644
  			regs->ip, regs->sp, error_code);
  		print_vma_addr(" in ", regs->ip);
  		pr_cont("\n");
-@@ -262,7 +286,7 @@ do_trap(int trapnr, int signr, char *str, struct pt_regs *regs,
+@@ -262,7 +285,7 @@ do_trap(int trapnr, int signr, char *str, struct pt_regs *regs,
  }
  NOKPROBE_SYMBOL(do_trap);
  
@@ -35153,7 +35152,7 @@ index bd4e3d4..3e938e3 100644
  			  unsigned long trapnr, int signr)
  {
  	siginfo_t info;
-@@ -292,7 +316,7 @@ DO_ERROR(X86_TRAP_NP,     SIGBUS,  "segment not present",	segment_not_present)
+@@ -292,7 +315,7 @@ DO_ERROR(X86_TRAP_NP,     SIGBUS,  "segment not present",	segment_not_present)
  DO_ERROR(X86_TRAP_SS,     SIGBUS,  "stack segment",		stack_segment)
  DO_ERROR(X86_TRAP_AC,     SIGBUS,  "alignment check",		alignment_check)
  
@@ -35162,7 +35161,7 @@ index bd4e3d4..3e938e3 100644
  __visible void __noreturn handle_stack_overflow(const char *message,
  						struct pt_regs *regs,
  						unsigned long fault_address)
-@@ -307,13 +331,49 @@ __visible void __noreturn handle_stack_overflow(const char *message,
+@@ -307,13 +330,49 @@ __visible void __noreturn handle_stack_overflow(const char *message,
  }
  #endif
  
@@ -35213,7 +35212,7 @@ index bd4e3d4..3e938e3 100644
  	unsigned long cr2;
  #endif
  
-@@ -350,7 +410,7 @@ dotraplinkage void do_double_fault(struct pt_regs *regs, long error_code)
+@@ -350,7 +409,7 @@ dotraplinkage void do_double_fault(struct pt_regs *regs, long error_code)
  	tsk->thread.error_code = error_code;
  	tsk->thread.trap_nr = X86_TRAP_DF;
  
@@ -35222,7 +35221,7 @@ index bd4e3d4..3e938e3 100644
  	/*
  	 * If we overflow the stack into a guard page, the CPU will fail
  	 * to deliver #PF and will send #DF instead.  Similarly, if we
-@@ -390,8 +450,12 @@ dotraplinkage void do_double_fault(struct pt_regs *regs, long error_code)
+@@ -390,8 +449,12 @@ dotraplinkage void do_double_fault(struct pt_regs *regs, long error_code)
  	 */
  	cr2 = read_cr2();
  	if ((unsigned long)task_stack_page(tsk) - 1 - cr2 < PAGE_SIZE)
@@ -35235,7 +35234,7 @@ index bd4e3d4..3e938e3 100644
  
  #ifdef CONFIG_DOUBLEFAULT
  	df_debug(regs, error_code);
-@@ -505,11 +569,35 @@ do_general_protection(struct pt_regs *regs, long error_code)
+@@ -505,11 +568,35 @@ do_general_protection(struct pt_regs *regs, long error_code)
  		tsk->thread.error_code = error_code;
  		tsk->thread.trap_nr = X86_TRAP_GP;
  		if (notify_die(DIE_GPF, "general protection fault", regs, error_code,
@@ -35272,7 +35271,7 @@ index bd4e3d4..3e938e3 100644
  	tsk->thread.error_code = error_code;
  	tsk->thread.trap_nr = X86_TRAP_GP;
  
-@@ -607,6 +695,9 @@ struct bad_iret_stack *fixup_bad_iret(struct bad_iret_stack *s)
+@@ -607,6 +694,9 @@ struct bad_iret_stack *fixup_bad_iret(struct bad_iret_stack *s)
  		container_of(task_pt_regs(current),
  			     struct bad_iret_stack, regs);
  
@@ -35282,7 +35281,7 @@ index bd4e3d4..3e938e3 100644
  	/* Copy the IRET target to the new stack. */
  	memmove(&new_stack->regs.ip, (void *)s->regs.sp, 5*8);
  
-@@ -778,7 +869,7 @@ dotraplinkage void do_debug(struct pt_regs *regs, long error_code)
+@@ -778,7 +868,7 @@ dotraplinkage void do_debug(struct pt_regs *regs, long error_code)
  	 * This is the most likely code path that involves non-trivial use
  	 * of the SYSENTER stack.  Check that we haven't overrun it.
  	 */
@@ -35291,7 +35290,7 @@ index bd4e3d4..3e938e3 100644
  	     "Overran or corrupted SYSENTER stack\n");
  #endif
  	ist_exit(regs);
-@@ -908,7 +999,7 @@ void __init early_trap_init(void)
+@@ -908,7 +998,7 @@ void __init early_trap_init(void)
  	 * since we don't have trace_debug and it will be reset to
  	 * 'debug' in trap_init() by set_intr_gate_ist().
  	 */
@@ -35300,7 +35299,7 @@ index bd4e3d4..3e938e3 100644
  	/* int3 can be called from all */
  	set_system_intr_gate(X86_TRAP_BP, &int3);
  #ifdef CONFIG_X86_32
-@@ -975,6 +1066,19 @@ void __init trap_init(void)
+@@ -975,6 +1065,19 @@ void __init trap_init(void)
  	set_bit(IA32_SYSCALL_VECTOR, used_vectors);
  #endif
  
@@ -35320,7 +35319,7 @@ index bd4e3d4..3e938e3 100644
  	/*
  	 * Set the IDT descriptor to a fixed read-only location, so that the
  	 * "sidt" instruction will not leak the location of the kernel, and
-@@ -993,7 +1097,7 @@ void __init trap_init(void)
+@@ -993,7 +1096,7 @@ void __init trap_init(void)
  	 * in early_trap_init(). However, ITS works only after
  	 * cpu_init() loads TSS. See comments in early_trap_init().
  	 */
@@ -35329,7 +35328,7 @@ index bd4e3d4..3e938e3 100644
  	/* int3 can be called from all */
  	set_system_intr_gate_ist(X86_TRAP_BP, &int3, DEBUG_STACK);
  
-@@ -1001,7 +1105,7 @@ void __init trap_init(void)
+@@ -1001,7 +1104,7 @@ void __init trap_init(void)
  
  #ifdef CONFIG_X86_64
  	memcpy(&debug_idt_table, &idt_table, IDT_ENTRIES * 16);
@@ -36116,7 +36115,7 @@ index 8ca1eca..fff3699b 100644
  
  	local_irq_disable();
 diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
-index 69b8f8a..0cf39f5 100644
+index 43b55ef..b88294e 100644
 --- a/arch/x86/kvm/vmx.c
 +++ b/arch/x86/kvm/vmx.c
 @@ -1675,14 +1675,14 @@ static __always_inline void vmcs_writel(unsigned long field, unsigned long value
@@ -36221,7 +36220,7 @@ index 69b8f8a..0cf39f5 100644
  	}
  
  	if (cpu_has_vmx_preemption_timer() && enable_preemption_timer) {
-@@ -8928,6 +8947,12 @@ static void __noclone vmx_vcpu_run(struct kvm_vcpu *vcpu)
+@@ -8934,6 +8953,12 @@ static void __noclone vmx_vcpu_run(struct kvm_vcpu *vcpu)
  		"jmp 2f \n\t"
  		"1: " __ex(ASM_VMX_VMRESUME) "\n\t"
  		"2: "
@@ -36234,7 +36233,7 @@ index 69b8f8a..0cf39f5 100644
  		/* Save guest registers, load host registers, keep flags */
  		"mov %0, %c[wordsize](%%" _ASM_SP ") \n\t"
  		"pop %0 \n\t"
-@@ -8980,6 +9005,11 @@ static void __noclone vmx_vcpu_run(struct kvm_vcpu *vcpu)
+@@ -8986,6 +9011,11 @@ static void __noclone vmx_vcpu_run(struct kvm_vcpu *vcpu)
  #endif
  		[cr2]"i"(offsetof(struct vcpu_vmx, vcpu.arch.cr2)),
  		[wordsize]"i"(sizeof(ulong))
@@ -36246,7 +36245,7 @@ index 69b8f8a..0cf39f5 100644
  	      : "cc", "memory"
  #ifdef CONFIG_X86_64
  		, "rax", "rbx", "rdi", "rsi"
-@@ -8993,7 +9023,7 @@ static void __noclone vmx_vcpu_run(struct kvm_vcpu *vcpu)
+@@ -8999,7 +9029,7 @@ static void __noclone vmx_vcpu_run(struct kvm_vcpu *vcpu)
  	if (debugctlmsr)
  		update_debugctlmsr(debugctlmsr);
  
@@ -36255,7 +36254,7 @@ index 69b8f8a..0cf39f5 100644
  	/*
  	 * The sysexit path does not restore ds/es, so we must set them to
  	 * a reasonable value ourselves.
-@@ -9002,8 +9032,18 @@ static void __noclone vmx_vcpu_run(struct kvm_vcpu *vcpu)
+@@ -9008,8 +9038,18 @@ static void __noclone vmx_vcpu_run(struct kvm_vcpu *vcpu)
  	 * may be executed in interrupt context, which saves and restore segments
  	 * around it, nullifying its effect.
  	 */
@@ -41054,7 +41053,7 @@ index 2ae8584..e8f8f29 100644
  #endif /* CONFIG_HUGETLB_PAGE */
  
 diff --git a/arch/x86/mm/init.c b/arch/x86/mm/init.c
-index 22af912..ac95bc1 100644
+index 889e761..ac95bc1 100644
 --- a/arch/x86/mm/init.c
 +++ b/arch/x86/mm/init.c
 @@ -4,6 +4,7 @@
@@ -41092,9 +41091,22 @@ index 22af912..ac95bc1 100644
  	__flush_tlb_all();
  
  	early_memtest(0, max_pfn_mapped << PAGE_SHIFT);
-@@ -649,10 +662,34 @@ void __init init_mem_mapping(void)
-  * Access has to be given to non-kernel-ram areas as well, these contain the PCI
-  * mmio resources as well as potential bios/acpi data regions.
+@@ -643,40 +656,45 @@ void __init init_mem_mapping(void)
+  * devmem_is_allowed() checks to see if /dev/mem access to a certain address
+  * is valid. The argument is a physical page number.
+  *
+- * On x86, access has to be given to the first megabyte of RAM because that
+- * area traditionally contains BIOS code and data regions used by X, dosemu,
+- * and similar apps. Since they map the entire memory range, the whole range
+- * must be allowed (for mapping), but any areas that would otherwise be
+- * disallowed are flagged as being "zero filled" instead of rejected.
+- * Access has to be given to non-kernel-ram areas as well, these contain the
+- * PCI mmio resources as well as potential bios/acpi data regions.
++ *
++ * On x86, access has to be given to the first megabyte of ram because that area
++ * contains BIOS code and data regions used by X and dosemu and similar apps.
++ * Access has to be given to non-kernel-ram areas as well, these contain the PCI
++ * mmio resources as well as potential bios/acpi data regions.
   */
 +
 +#ifdef CONFIG_GRKERNSEC_KMEM
@@ -41104,6 +41116,14 @@ index 22af912..ac95bc1 100644
 +
  int devmem_is_allowed(unsigned long pagenr)
  {
+-	if (page_is_ram(pagenr)) {
+-		/*
+-		 * For disallowed memory regions in the low 1MB range,
+-		 * request that the page be shown as all zeros.
+-		 */
+-		if (pagenr < 256)
+-			return 2;
+-
 +#ifdef CONFIG_GRKERNSEC_KMEM
 +	/* allow BDA */
 +	if (!pagenr)
@@ -41118,16 +41138,34 @@ index 22af912..ac95bc1 100644
 +		return 1;
 +	/* throw out everything else below 1MB */
 +	if (pagenr <= 256)
-+		return 0;
+ 		return 0;
+-	}
+-
+-	/*
+-	 * This must follow RAM test, since System RAM is considered a
+-	 * restricted resource under CONFIG_STRICT_IOMEM.
+-	 */
+-	if (iomem_is_exclusive(pagenr << PAGE_SHIFT)) {
+-		/* Low 1MB bypasses iomem restrictions. */
+-		if (pagenr < 256)
+-			return 1;
 +#else
- 	if (pagenr < 256)
- 		return 1;
++	if (pagenr < 256)
++		return 1;
 +#endif
-+
- 	if (iomem_is_exclusive(pagenr << PAGE_SHIFT))
+ 
++	if (iomem_is_exclusive(pagenr << PAGE_SHIFT))
  		return 0;
- 	if (!page_is_ram(pagenr))
-@@ -699,8 +736,33 @@ void free_init_pages(char *what, unsigned long begin, unsigned long end)
+-	}
+-
+-	return 1;
++	if (!page_is_ram(pagenr))
++		return 1;
++	return 0;
+ }
+ 
+ void free_init_pages(char *what, unsigned long begin, unsigned long end)
+@@ -718,8 +736,33 @@ void free_init_pages(char *what, unsigned long begin, unsigned long end)
  	}
  }
  
@@ -46242,10 +46280,10 @@ index 993fd31..cc15d14 100644
  }
  EXPORT_SYMBOL_GPL(acpi_dev_pm_attach);
 diff --git a/drivers/acpi/ec.c b/drivers/acpi/ec.c
-index 48e19d0..b08e802 100644
+index 22ca892..3bcf391 100644
 --- a/drivers/acpi/ec.c
 +++ b/drivers/acpi/ec.c
-@@ -1777,7 +1777,7 @@ static int ec_correct_ecdt(const struct dmi_system_id *id)
+@@ -1803,7 +1803,7 @@ static int ec_correct_ecdt(const struct dmi_system_id *id)
  	return 0;
  }
  
@@ -46254,7 +46292,7 @@ index 48e19d0..b08e802 100644
  	{
  	ec_correct_ecdt, "MSI MS-171F", {
  	DMI_MATCH(DMI_SYS_VENDOR, "Micro-Star"),
-@@ -1910,7 +1910,7 @@ static const struct dev_pm_ops acpi_ec_pm = {
+@@ -1908,7 +1908,7 @@ static const struct dev_pm_ops acpi_ec_pm = {
  	SET_SYSTEM_SLEEP_PM_OPS(acpi_ec_suspend, acpi_ec_resume)
  };
  
@@ -46263,7 +46301,7 @@ index 48e19d0..b08e802 100644
  {
  	int result = 0;
  
-@@ -1928,7 +1928,7 @@ static int param_set_event_clearing(const char *val, struct kernel_param *kp)
+@@ -1926,7 +1926,7 @@ static int param_set_event_clearing(const char *val, struct kernel_param *kp)
  	return result;
  }
  
@@ -48826,7 +48864,7 @@ index 584bc31..e64a12c 100644
  
  static int gdrom_bdops_open(struct block_device *bdev, fmode_t mode)
 diff --git a/drivers/char/Kconfig b/drivers/char/Kconfig
-index dcc0973..8d34c88 100644
+index 8453a49..aaea2ac 100644
 --- a/drivers/char/Kconfig
 +++ b/drivers/char/Kconfig
 @@ -17,7 +17,8 @@ config DEVMEM
@@ -48841,12 +48879,12 @@ index dcc0973..8d34c88 100644
  	  /dev/kmem device is rarely used, but can be used for certain
 @@ -573,6 +574,7 @@ config TELCLOCK
  config DEVPORT
- 	bool
+ 	bool "/dev/port character device"
  	depends on ISA || PCI
 +	depends on !GRKERNSEC_KMEM
  	default y
- 
- source "drivers/s390/char/Kconfig"
+ 	help
+ 	  Say Y here if you want to support the /dev/port device. The /dev/port
 diff --git a/drivers/char/agp/compat_ioctl.c b/drivers/char/agp/compat_ioctl.c
 index a48e05b..6bac831 100644
 --- a/drivers/char/agp/compat_ioctl.c
@@ -49054,7 +49092,7 @@ index 5673fff..3ab2908 100644
  	if (ssif_info->supports_pec)
  		ssif_info->client->flags |= I2C_CLIENT_PEC;
 diff --git a/drivers/char/mem.c b/drivers/char/mem.c
-index 6d9cc2d..8bf97d6 100644
+index 7e4a9d1..8bf97d6 100644
 --- a/drivers/char/mem.c
 +++ b/drivers/char/mem.c
 @@ -18,6 +18,7 @@
@@ -49076,7 +49114,18 @@ index 6d9cc2d..8bf97d6 100644
  static inline unsigned long size_inside_page(unsigned long start,
  					     unsigned long size)
  {
-@@ -67,13 +72,22 @@ static inline int range_is_allowed(unsigned long pfn, unsigned long size)
+@@ -60,10 +65,6 @@ static inline int valid_mmap_phys_addr_range(unsigned long pfn, size_t size)
+ #endif
+ 
+ #ifdef CONFIG_STRICT_DEVMEM
+-static inline int page_is_allowed(unsigned long pfn)
+-{
+-	return devmem_is_allowed(pfn);
+-}
+ static inline int range_is_allowed(unsigned long pfn, unsigned long size)
+ {
+ 	u64 from = ((u64)pfn) << PAGE_SHIFT;
+@@ -71,18 +72,23 @@ static inline int range_is_allowed(unsigned long pfn, unsigned long size)
  	u64 cursor = from;
  
  	while (cursor < to) {
@@ -49092,15 +49141,19 @@ index 6d9cc2d..8bf97d6 100644
  	}
  	return 1;
  }
+-#else
+-static inline int page_is_allowed(unsigned long pfn)
 +#elif defined(CONFIG_GRKERNSEC_KMEM)
 +static inline int range_is_allowed(unsigned long pfn, unsigned long size)
-+{
+ {
+-	return 1;
 +	return 0;
-+}
- #else
+ }
++#else
  static inline int range_is_allowed(unsigned long pfn, unsigned long size)
  {
-@@ -98,6 +112,7 @@ static ssize_t read_mem(struct file *file, char __user *buf,
+ 	return 1;
+@@ -106,6 +112,7 @@ static ssize_t read_mem(struct file *file, char __user *buf,
  	phys_addr_t p = *ppos;
  	ssize_t read, sz;
  	void *ptr;
@@ -49108,7 +49161,7 @@ index 6d9cc2d..8bf97d6 100644
  
  	if (p != *ppos)
  		return 0;
-@@ -120,13 +135,19 @@ static ssize_t read_mem(struct file *file, char __user *buf,
+@@ -128,35 +135,37 @@ static ssize_t read_mem(struct file *file, char __user *buf,
  	}
  #endif
  
@@ -49118,31 +49171,46 @@ index 6d9cc2d..8bf97d6 100644
 +
  	while (count > 0) {
  		unsigned long remaining;
+-		int allowed;
  
  		sz = size_inside_page(p, count);
  
--		if (!range_is_allowed(p >> PAGE_SHIFT, count))
+-		allowed = page_is_allowed(p >> PAGE_SHIFT);
+-		if (!allowed)
 +		if (!range_is_allowed(p >> PAGE_SHIFT, count)) {
 +			kfree(temp);
  			return -EPERM;
+-		if (allowed == 2) {
+-			/* Show zeros for restricted memory. */
+-			remaining = clear_user(buf, sz);
+-		} else {
+-			/*
+-			 * On ia64 if a page has been mapped somewhere as
+-			 * uncached, then it must also be accessed uncached
+-			 * by the kernel or data corruption may occur.
+-			 */
+-			ptr = xlate_dev_mem_ptr(p);
+-			if (!ptr)
+-				return -EFAULT;
+-
+-			remaining = copy_to_user(buf, ptr, sz);
 +		}
  
- 		/*
- 		 * On ia64 if a page has been mapped somewhere as uncached, then
-@@ -134,13 +155,17 @@ static ssize_t read_mem(struct file *file, char __user *buf,
- 		 * corruption may occur.
- 		 */
- 		ptr = xlate_dev_mem_ptr(p);
--		if (!ptr)
+-			unxlate_dev_mem_ptr(p, ptr);
++		/*
++		 * On ia64 if a page has been mapped somewhere as uncached, then
++		 * it must also be accessed uncached by the kernel or data
++		 * corruption may occur.
++		 */
++		ptr = xlate_dev_mem_ptr(p);
 +		if (!ptr || probe_kernel_read(temp, ptr, sz)) {
 +			kfree(temp);
- 			return -EFAULT;
-+		}
++			return -EFAULT;
+ 		}
  
--		remaining = copy_to_user(buf, ptr, sz);
-+		remaining = copy_to_user(buf, temp, sz);
- 		unxlate_dev_mem_ptr(p, ptr);
 -		if (remaining)
++		remaining = copy_to_user(buf, temp, sz);
++		unxlate_dev_mem_ptr(p, ptr);
 +		if (remaining) {
 +			kfree(temp);
  			return -EFAULT;
@@ -49150,7 +49218,7 @@ index 6d9cc2d..8bf97d6 100644
  
  		buf += sz;
  		p += sz;
-@@ -148,6 +173,8 @@ static ssize_t read_mem(struct file *file, char __user *buf,
+@@ -164,6 +173,8 @@ static ssize_t read_mem(struct file *file, char __user *buf,
  		read += sz;
  	}
  
@@ -49159,7 +49227,63 @@ index 6d9cc2d..8bf97d6 100644
  	*ppos += read;
  	return read;
  }
-@@ -383,6 +410,8 @@ static ssize_t read_kmem(struct file *file, char __user *buf,
+@@ -197,36 +208,30 @@ static ssize_t write_mem(struct file *file, const char __user *buf,
+ #endif
+ 
+ 	while (count > 0) {
+-		int allowed;
+-
+ 		sz = size_inside_page(p, count);
+ 
+-		allowed = page_is_allowed(p >> PAGE_SHIFT);
+-		if (!allowed)
++		if (!range_is_allowed(p >> PAGE_SHIFT, sz))
+ 			return -EPERM;
+ 
+-		/* Skip actual writing when a page is marked as restricted. */
+-		if (allowed == 1) {
+-			/*
+-			 * On ia64 if a page has been mapped somewhere as
+-			 * uncached, then it must also be accessed uncached
+-			 * by the kernel or data corruption may occur.
+-			 */
+-			ptr = xlate_dev_mem_ptr(p);
+-			if (!ptr) {
+-				if (written)
+-					break;
+-				return -EFAULT;
+-			}
++		/*
++		 * On ia64 if a page has been mapped somewhere as uncached, then
++		 * it must also be accessed uncached by the kernel or data
++		 * corruption may occur.
++		 */
++		ptr = xlate_dev_mem_ptr(p);
++		if (!ptr) {
++			if (written)
++				break;
++			return -EFAULT;
++		}
+ 
+-			copied = copy_from_user(ptr, buf, sz);
+-			unxlate_dev_mem_ptr(p, ptr);
+-			if (copied) {
+-				written += sz - copied;
+-				if (written)
+-					break;
+-				return -EFAULT;
+-			}
++		copied = copy_from_user(ptr, buf, sz);
++		unxlate_dev_mem_ptr(p, ptr);
++		if (copied) {
++			written += sz - copied;
++			if (written)
++				break;
++			return -EFAULT;
+ 		}
+ 
+ 		buf += sz;
+@@ -405,6 +410,8 @@ static ssize_t read_kmem(struct file *file, char __user *buf,
  
  	read = 0;
  	if (p < (unsigned long) high_memory) {
@@ -49168,7 +49292,7 @@ index 6d9cc2d..8bf97d6 100644
  		low_count = count;
  		if (count > (unsigned long)high_memory - p)
  			low_count = (unsigned long)high_memory - p;
-@@ -400,6 +429,11 @@ static ssize_t read_kmem(struct file *file, char __user *buf,
+@@ -422,6 +429,11 @@ static ssize_t read_kmem(struct file *file, char __user *buf,
  			count -= sz;
  		}
  #endif
@@ -49180,7 +49304,7 @@ index 6d9cc2d..8bf97d6 100644
  		while (low_count > 0) {
  			sz = size_inside_page(p, low_count);
  
-@@ -412,14 +446,18 @@ static ssize_t read_kmem(struct file *file, char __user *buf,
+@@ -434,14 +446,18 @@ static ssize_t read_kmem(struct file *file, char __user *buf,
  			if (!virt_addr_valid(kbuf))
  				return -ENXIO;
  
@@ -49200,7 +49324,7 @@ index 6d9cc2d..8bf97d6 100644
  	}
  
  	if (count > 0) {
-@@ -826,6 +864,9 @@ static const struct memdev {
+@@ -848,6 +864,9 @@ static const struct memdev {
  #ifdef CONFIG_PRINTK
  	[11] = { "kmsg", 0644, &kmsg_fops, 0 },
  #endif
@@ -49210,7 +49334,7 @@ index 6d9cc2d..8bf97d6 100644
  };
  
  static int memory_open(struct inode *inode, struct file *filp)
-@@ -887,7 +928,7 @@ static int __init chr_dev_init(void)
+@@ -909,7 +928,7 @@ static int __init chr_dev_init(void)
  			continue;
  
  		device_create(mem_class, NULL, MKDEV(MEM_MAJOR, minor),
@@ -49474,7 +49598,7 @@ index e722886..78a48b9 100644
  
  	(*pos)++;
 diff --git a/drivers/char/virtio_console.c b/drivers/char/virtio_console.c
-index 5649234..34b55b7 100644
+index 471a301..b250231 100644
 --- a/drivers/char/virtio_console.c
 +++ b/drivers/char/virtio_console.c
 @@ -691,11 +691,11 @@ static ssize_t fill_readbuf(struct port *port, char __user *out_buf,
@@ -49491,7 +49615,7 @@ index 5649234..34b55b7 100644
  		       out_count);
  	}
  
-@@ -1170,7 +1170,7 @@ static int get_chars(u32 vtermno, char *buf, int count)
+@@ -1178,7 +1178,7 @@ static int get_chars(u32 vtermno, char *buf, int count)
  	/* If we don't have an input queue yet, we can't get input. */
  	BUG_ON(!port->in_vq);
  
@@ -49817,7 +49941,7 @@ index 4d3ec92..cf501fc 100644
  	ret = cpufreq_register_driver(&dt_cpufreq_driver);
  	if (ret)
 diff --git a/drivers/cpufreq/cpufreq.c b/drivers/cpufreq/cpufreq.c
-index cac4a92..93c0aed 100644
+index 6153b66..d3d0871 100644
 --- a/drivers/cpufreq/cpufreq.c
 +++ b/drivers/cpufreq/cpufreq.c
 @@ -528,12 +528,12 @@ EXPORT_SYMBOL_GPL(cpufreq_driver_resolve_freq);
@@ -49875,7 +49999,7 @@ index cac4a92..93c0aed 100644
  
  	/* This will get removed on driver unregister */
  	return create_boost_sysfs_file();
-@@ -2444,8 +2450,11 @@ int cpufreq_register_driver(struct cpufreq_driver *driver_data)
+@@ -2458,8 +2464,11 @@ int cpufreq_register_driver(struct cpufreq_driver *driver_data)
  	cpufreq_driver = driver_data;
  	write_unlock_irqrestore(&cpufreq_driver_lock, flags);
  
@@ -63289,79 +63413,6 @@ index 642b89c..5e92dc3 100644
  module_param(radio_nr, int, 0444);
  MODULE_PARM_DESC(radio_nr, "Radio Nr");
  
-diff --git a/drivers/media/usb/dvb-usb/dvb-usb-firmware.c b/drivers/media/usb/dvb-usb/dvb-usb-firmware.c
-index dd048a7..717a7b2 100644
---- a/drivers/media/usb/dvb-usb/dvb-usb-firmware.c
-+++ b/drivers/media/usb/dvb-usb/dvb-usb-firmware.c
-@@ -35,42 +35,57 @@ static int usb_cypress_writemem(struct usb_device *udev,u16 addr,u8 *data, u8 le
- 
- int usb_cypress_load_firmware(struct usb_device *udev, const struct firmware *fw, int type)
- {
--	struct hexline hx;
--	u8 reset;
-+	struct hexline *hx;
-+	u8 *reset;
- 	int ret,pos=0;
- 
-+	reset = kmalloc(1, GFP_KERNEL);
-+	if (reset == NULL)
-+		return -ENOMEM;
-+
-+	hx = kmalloc(sizeof(struct hexline), GFP_KERNEL);
-+	if (hx == NULL) {
-+		kfree(reset);
-+		return -ENOMEM;
-+	}
-+
- 	/* stop the CPU */
--	reset = 1;
--	if ((ret = usb_cypress_writemem(udev,cypress[type].cpu_cs_register,&reset,1)) != 1)
-+	reset[0] = 1;
-+	if ((ret = usb_cypress_writemem(udev,cypress[type].cpu_cs_register,reset,1)) != 1)
- 		err("could not stop the USB controller CPU.");
- 
--	while ((ret = dvb_usb_get_hexline(fw,&hx,&pos)) > 0) {
--		deb_fw("writing to address 0x%04x (buffer: 0x%02x %02x)\n",hx.addr,hx.len,hx.chk);
--		ret = usb_cypress_writemem(udev,hx.addr,hx.data,hx.len);
-+	while ((ret = dvb_usb_get_hexline(fw,hx,&pos)) > 0) {
-+		deb_fw("writing to address 0x%04x (buffer: 0x%02x %02x)\n",hx->addr,hx->len,hx->chk);
-+		ret = usb_cypress_writemem(udev,hx->addr,hx->data,hx->len);
- 
--		if (ret != hx.len) {
-+		if (ret != hx->len) {
- 			err("error while transferring firmware "
- 				"(transferred size: %d, block size: %d)",
--				ret,hx.len);
-+				ret,hx->len);
- 			ret = -EINVAL;
- 			break;
- 		}
- 	}
- 	if (ret < 0) {
- 		err("firmware download failed at %d with %d",pos,ret);
-+		kfree(reset);
-+		kfree(hx);
- 		return ret;
- 	}
- 
- 	if (ret == 0) {
- 		/* restart the CPU */
--		reset = 0;
--		if (ret || usb_cypress_writemem(udev,cypress[type].cpu_cs_register,&reset,1) != 1) {
-+		reset[0] = 0;
-+		if (ret || usb_cypress_writemem(udev,cypress[type].cpu_cs_register,reset,1) != 1) {
- 			err("could not restart the USB controller CPU.");
- 			ret = -EINVAL;
- 		}
- 	} else
- 		ret = -EIO;
- 
-+	kfree(reset);
-+	kfree(hx);
-+
- 	return ret;
- }
- EXPORT_SYMBOL(usb_cypress_load_firmware);
 diff --git a/drivers/media/usb/dvb-usb/technisat-usb2.c b/drivers/media/usb/dvb-usb/technisat-usb2.c
 index 4706628..14d602fb 100644
 --- a/drivers/media/usb/dvb-usb/technisat-usb2.c
@@ -79479,7 +79530,7 @@ index 6ca0081..fbb9efd 100644
  extern void qla2x00_free_sysfs_attr(scsi_qla_host_t *, bool);
  extern void qla2x00_init_host_attr(scsi_qla_host_t *);
 diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c
-index 4f361d8..64d9741 100644
+index 734e592..97c7fb4 100644
 --- a/drivers/scsi/qla2xxx/qla_os.c
 +++ b/drivers/scsi/qla2xxx/qla_os.c
 @@ -301,12 +301,12 @@ struct scsi_transport_template *qla2xxx_transport_vport_template = NULL;
@@ -79497,7 +79548,7 @@ index 4f361d8..64d9741 100644
  	add_timer(&vha->timer);
  	vha->timer_active = 1;
  }
-@@ -1529,8 +1529,10 @@ qla2x00_config_dma_addressing(struct qla_hw_data *ha)
+@@ -1534,8 +1534,10 @@ qla2x00_config_dma_addressing(struct qla_hw_data *ha)
  		    !pci_set_consistent_dma_mask(ha->pdev, DMA_BIT_MASK(64))) {
  			/* Ok, a 64bit DMA mask is applicable. */
  			ha->flags.enable_64bit_addressing = 1;
@@ -79510,7 +79561,7 @@ index 4f361d8..64d9741 100644
  			return;
  		}
  	}
-@@ -5411,8 +5413,9 @@ qla2x00_rst_aen(scsi_qla_host_t *vha)
+@@ -5416,8 +5418,9 @@ qla2x00_rst_aen(scsi_qla_host_t *vha)
  * Context: Interrupt
  ***************************************************************************/
  void
@@ -79521,7 +79572,7 @@ index 4f361d8..64d9741 100644
  	unsigned long	cpu_flags = 0;
  	int		start_dpc = 0;
  	int		index;
-@@ -5674,7 +5677,7 @@ qla2x00_release_firmware(void)
+@@ -5679,7 +5682,7 @@ qla2x00_release_firmware(void)
  }
  
  static pci_ers_result_t
@@ -79981,7 +80032,7 @@ index e3cd3ec..97ab643 100644
  
  	transport_setup_device(&rport->dev);
 diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c
-index 51e5629..caef5f7 100644
+index 931af07..8998d44 100644
 --- a/drivers/scsi/sd.c
 +++ b/drivers/scsi/sd.c
 @@ -113,7 +113,7 @@ static int sd_resume(struct device *);
@@ -80002,7 +80053,7 @@ index 51e5629..caef5f7 100644
  {
  	int result = SCpnt->result;
  	unsigned int good_bytes = result ? 0 : scsi_bufflen(SCpnt);
-@@ -3081,7 +3081,7 @@ static int sd_probe(struct device *dev)
+@@ -3098,7 +3098,7 @@ static int sd_probe(struct device *dev)
  	sdkp->disk = gd;
  	sdkp->index = index;
  	atomic_set(&sdkp->openers, 0);
@@ -80078,7 +80129,7 @@ index a535b26..d62e7f1 100644
  	INIT_DELAYED_WORK(&ctrl_info->rescan_work, pqi_rescan_worker);
  	INIT_DELAYED_WORK(&ctrl_info->update_time_work, pqi_update_time_worker);
 diff --git a/drivers/scsi/sr.c b/drivers/scsi/sr.c
-index bed2bbd..3abf75c 100644
+index e635973..93f218e 100644
 --- a/drivers/scsi/sr.c
 +++ b/drivers/scsi/sr.c
 @@ -80,7 +80,7 @@ static DEFINE_MUTEX(sr_mutex);
@@ -105588,7 +105639,7 @@ index 203287f..f1b702c 100644
  GLOBAL_EXTERN atomic_t smBufAllocCount;
  GLOBAL_EXTERN atomic_t midCount;
 diff --git a/fs/cifs/file.c b/fs/cifs/file.c
-index 1cd0e2e..50411b0 100644
+index 3925758..f2e78fa 100644
 --- a/fs/cifs/file.c
 +++ b/fs/cifs/file.c
 @@ -1431,7 +1431,7 @@ cifs_free_llist(struct list_head *llist)
@@ -105880,10 +105931,10 @@ index 5d456eb..6b33055 100644
  }
  
 diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c
-index bdd3292..eed47d8 100644
+index 7080dac..28a6a3048 100644
 --- a/fs/cifs/smb2pdu.c
 +++ b/fs/cifs/smb2pdu.c
-@@ -2617,8 +2617,7 @@ SMB2_query_directory(const unsigned int xid, struct cifs_tcon *tcon,
+@@ -2625,8 +2625,7 @@ SMB2_query_directory(const unsigned int xid, struct cifs_tcon *tcon,
  	default:
  		cifs_dbg(VFS, "info level %u isn't supported\n",
  			 srch_inf->info_level);
@@ -120913,10 +120964,10 @@ index d3ed817..d6038021 100644
  	}
  	putname(tmp);
 diff --git a/fs/orangefs/super.c b/fs/orangefs/super.c
-index cd261c8..7a1c069 100644
+index 629d8c9..2edba1f 100644
 --- a/fs/orangefs/super.c
 +++ b/fs/orangefs/super.c
-@@ -578,10 +578,12 @@ void orangefs_kill_sb(struct super_block *sb)
+@@ -587,10 +587,12 @@ void orangefs_kill_sb(struct super_block *sb)
  
  int orangefs_inode_cache_initialize(void)
  {
@@ -122943,7 +122994,7 @@ index d700c42..f711c86 100644
  	seq_put_decimal_ull(p, "softirq ", (unsigned long long)sum_softirq);
  
 diff --git a/fs/proc/task_mmu.c b/fs/proc/task_mmu.c
-index 35b92d8..eb959b5 100644
+index b1517b6..b1aa804 100644
 --- a/fs/proc/task_mmu.c
 +++ b/fs/proc/task_mmu.c
 @@ -15,12 +15,19 @@
@@ -123142,7 +123193,7 @@ index 35b92d8..eb959b5 100644
  		   mss.resident >> 10,
  		   (unsigned long)(mss.pss >> (10 + PSS_SHIFT)),
  		   mss.shared_clean  >> 10,
-@@ -1436,7 +1488,7 @@ static int pagemap_open(struct inode *inode, struct file *file)
+@@ -1443,7 +1495,7 @@ static int pagemap_open(struct inode *inode, struct file *file)
  {
  	struct mm_struct *mm;
  
@@ -123151,7 +123202,7 @@ index 35b92d8..eb959b5 100644
  	if (IS_ERR(mm))
  		return PTR_ERR(mm);
  	file->private_data = mm;
-@@ -1639,6 +1691,13 @@ static int show_numa_map(struct seq_file *m, void *v, int is_pid)
+@@ -1646,6 +1698,13 @@ static int show_numa_map(struct seq_file *m, void *v, int is_pid)
  	char buffer[64];
  	int nid;
  
@@ -123165,7 +123216,7 @@ index 35b92d8..eb959b5 100644
  	if (!mm)
  		return 0;
  
-@@ -1653,11 +1712,15 @@ static int show_numa_map(struct seq_file *m, void *v, int is_pid)
+@@ -1660,11 +1719,15 @@ static int show_numa_map(struct seq_file *m, void *v, int is_pid)
  		mpol_to_str(buffer, sizeof(buffer), proc_priv->task_mempolicy);
  	}
  
@@ -142897,7 +142948,7 @@ index cb3c8fe..a001ef9 100644
  
  /*
 diff --git a/include/linux/sched.h b/include/linux/sched.h
-index 75d9a57..3370513 100644
+index f425eb3..2b11430 100644
 --- a/include/linux/sched.h
 +++ b/include/linux/sched.h
 @@ -7,7 +7,7 @@
@@ -142997,7 +143048,7 @@ index 75d9a57..3370513 100644
  	atomic_t usage;
  	unsigned int flags;	/* per process flags, defined below */
  	unsigned int ptrace;
-@@ -1610,6 +1645,8 @@ struct task_struct {
+@@ -1614,6 +1649,8 @@ struct task_struct {
  	struct list_head sibling;	/* linkage in my parent's children list */
  	struct task_struct *group_leader;	/* threadgroup leader */
  
@@ -143006,7 +143057,7 @@ index 75d9a57..3370513 100644
  	/*
  	 * ptraced is the list of tasks this task is using ptrace on.
  	 * This includes both natural children and PTRACE_ATTACH targets.
-@@ -1624,8 +1661,8 @@ struct task_struct {
+@@ -1628,8 +1665,8 @@ struct task_struct {
  	struct list_head thread_node;
  
  	struct completion *vfork_done;		/* for vfork() */
@@ -143017,7 +143068,7 @@ index 75d9a57..3370513 100644
  
  	cputime_t utime, stime, utimescaled, stimescaled;
  	cputime_t gtime;
-@@ -1655,12 +1692,6 @@ struct task_struct {
+@@ -1659,12 +1696,6 @@ struct task_struct {
  	struct task_cputime cputime_expires;
  	struct list_head cpu_timers[3];
  
@@ -143030,7 +143081,7 @@ index 75d9a57..3370513 100644
  	char comm[TASK_COMM_LEN]; /* executable name excluding path
  				     - access with [gs]et_task_comm (which lock
  				       it with task_lock())
-@@ -1676,6 +1707,8 @@ struct task_struct {
+@@ -1680,6 +1711,8 @@ struct task_struct {
  /* hung task detection */
  	unsigned long last_switch_count;
  #endif
@@ -143039,7 +143090,7 @@ index 75d9a57..3370513 100644
  /* filesystem information */
  	struct fs_struct *fs;
  /* open file information */
-@@ -1686,8 +1719,11 @@ struct task_struct {
+@@ -1690,8 +1723,11 @@ struct task_struct {
  	struct signal_struct *signal;
  	struct sighand_struct *sighand;
  
@@ -143053,7 +143104,7 @@ index 75d9a57..3370513 100644
  	struct sigpending pending;
  
  	unsigned long sas_ss_sp;
-@@ -1754,6 +1790,10 @@ struct task_struct {
+@@ -1758,6 +1794,10 @@ struct task_struct {
  	unsigned int in_ubsan;
  #endif
  
@@ -143064,7 +143115,7 @@ index 75d9a57..3370513 100644
  /* journalling filesystem info */
  	void *journal_info;
  
-@@ -1792,6 +1832,10 @@ struct task_struct {
+@@ -1796,6 +1836,10 @@ struct task_struct {
  	/* cg_list protected by css_set_lock and tsk->alloc_lock */
  	struct list_head cg_list;
  #endif
@@ -143075,7 +143126,7 @@ index 75d9a57..3370513 100644
  #ifdef CONFIG_FUTEX
  	struct robust_list_head __user *robust_list;
  #ifdef CONFIG_COMPAT
-@@ -1907,7 +1951,7 @@ struct task_struct {
+@@ -1911,7 +1955,7 @@ struct task_struct {
  	 * Number of functions that haven't been traced
  	 * because of depth overrun.
  	 */
@@ -143084,7 +143135,7 @@ index 75d9a57..3370513 100644
  	/* Pause for the tracing */
  	atomic_t tracing_graph_pause;
  #endif
-@@ -1955,23 +1999,101 @@ struct task_struct {
+@@ -1959,23 +2003,101 @@ struct task_struct {
  #ifdef CONFIG_THREAD_INFO_IN_TASK
  	/* A live task holds one reference. */
  	atomic_t stack_refcount;
@@ -143196,7 +143247,7 @@ index 75d9a57..3370513 100644
  #ifdef CONFIG_VMAP_STACK
  static inline struct vm_struct *task_stack_vm_area(const struct task_struct *t)
  {
-@@ -2096,7 +2218,7 @@ struct pid_namespace;
+@@ -2100,7 +2222,7 @@ struct pid_namespace;
  pid_t __task_pid_nr_ns(struct task_struct *task, enum pid_type type,
  			struct pid_namespace *ns);
  
@@ -143205,7 +143256,7 @@ index 75d9a57..3370513 100644
  {
  	return tsk->pid;
  }
-@@ -2463,6 +2585,50 @@ extern u64 sched_clock_cpu(int cpu);
+@@ -2467,6 +2589,50 @@ extern u64 sched_clock_cpu(int cpu);
  
  extern void sched_clock_init(void);
  
@@ -143256,7 +143307,7 @@ index 75d9a57..3370513 100644
  #ifndef CONFIG_HAVE_UNSTABLE_SCHED_CLOCK
  static inline void sched_clock_tick(void)
  {
-@@ -2655,6 +2821,7 @@ extern struct pid_namespace init_pid_ns;
+@@ -2659,6 +2825,7 @@ extern struct pid_namespace init_pid_ns;
   */
  
  extern struct task_struct *find_task_by_vpid(pid_t nr);
@@ -143264,7 +143315,7 @@ index 75d9a57..3370513 100644
  extern struct task_struct *find_task_by_pid_ns(pid_t nr,
  		struct pid_namespace *ns);
  
-@@ -2686,7 +2853,7 @@ extern void proc_caches_init(void);
+@@ -2690,7 +2857,7 @@ extern void proc_caches_init(void);
  extern void flush_signals(struct task_struct *);
  extern void ignore_signals(struct task_struct *);
  extern void flush_signal_handlers(struct task_struct *, int force_default);
@@ -143273,7 +143324,7 @@ index 75d9a57..3370513 100644
  
  static inline int kernel_dequeue_signal(siginfo_t *info)
  {
-@@ -2952,7 +3119,7 @@ extern void __cleanup_sighand(struct sighand_struct *);
+@@ -2956,7 +3123,7 @@ extern void __cleanup_sighand(struct sighand_struct *);
  extern void exit_itimers(struct signal_struct *);
  extern void flush_itimer_signals(void);
  
@@ -143282,7 +143333,7 @@ index 75d9a57..3370513 100644
  
  extern int do_execve(struct filename *,
  		     const char __user * const __user *,
-@@ -3067,11 +3234,13 @@ static inline int thread_group_empty(struct task_struct *p)
+@@ -3071,11 +3238,13 @@ static inline int thread_group_empty(struct task_struct *p)
   * It must not be nested with write_lock_irq(&tasklist_lock),
   * neither inside nor outside.
   */
@@ -143296,7 +143347,7 @@ index 75d9a57..3370513 100644
  static inline void task_unlock(struct task_struct *p)
  {
  	spin_unlock(&p->alloc_lock);
-@@ -3145,7 +3314,7 @@ static inline void *task_stack_page(const struct task_struct *task)
+@@ -3149,7 +3318,7 @@ static inline void *task_stack_page(const struct task_struct *task)
  
  static inline unsigned long *end_of_stack(const struct task_struct *task)
  {
@@ -143305,7 +143356,7 @@ index 75d9a57..3370513 100644
  }
  
  #elif !defined(__HAVE_THREAD_FUNCTIONS)
-@@ -3199,13 +3368,24 @@ static inline void put_task_stack(struct task_struct *tsk) {}
+@@ -3203,13 +3372,24 @@ static inline void put_task_stack(struct task_struct *tsk) {}
  #define task_stack_end_corrupted(task) \
  		(*(end_of_stack(task)) != STACK_END_MAGIC)
  
@@ -143332,7 +143383,7 @@ index 75d9a57..3370513 100644
  extern void thread_stack_cache_init(void);
  
  #ifdef CONFIG_DEBUG_STACK_USAGE
-@@ -3600,7 +3780,7 @@ static inline unsigned long rlimit_max(unsigned int limit)
+@@ -3604,7 +3784,7 @@ static inline unsigned long rlimit_max(unsigned int limit)
  #ifdef CONFIG_CPU_FREQ
  struct update_util_data {
         void (*func)(struct update_util_data *data, u64 time, unsigned int flags);
@@ -148159,10 +148210,10 @@ index 4984e1f..a5bf6f5 100644
   * ptracer_capable - Determine if the ptracer holds CAP_SYS_PTRACE in the namespace
   * @tsk: The task that may be ptraced
 diff --git a/kernel/cgroup.c b/kernel/cgroup.c
-index 4e2f3de..d50672d 100644
+index a3d2aad..5c0c12d 100644
 --- a/kernel/cgroup.c
 +++ b/kernel/cgroup.c
-@@ -3656,7 +3656,7 @@ static int cgroup_add_file(struct cgroup_subsys_state *css, struct cgroup *cgrp,
+@@ -3657,7 +3657,7 @@ static int cgroup_add_file(struct cgroup_subsys_state *css, struct cgroup *cgrp,
  	key = &cft->lockdep_key;
  #endif
  	kn = __kernfs_create_file(cgrp->kn, cgroup_file_name(cgrp, cft, name),
@@ -148171,7 +148222,7 @@ index 4e2f3de..d50672d 100644
  				  NULL, key);
  	if (IS_ERR(kn))
  		return PTR_ERR(kn);
-@@ -3760,11 +3760,14 @@ static void cgroup_exit_cftypes(struct cftype *cfts)
+@@ -3761,11 +3761,14 @@ static void cgroup_exit_cftypes(struct cftype *cfts)
  		/* free copy for custom atomic_write_len, see init_cftypes() */
  		if (cft->max_write_len && cft->max_write_len != PAGE_SIZE)
  			kfree(cft->kf_ops);
@@ -148189,7 +148240,7 @@ index 4e2f3de..d50672d 100644
  	}
  }
  
-@@ -3795,8 +3798,10 @@ static int cgroup_init_cftypes(struct cgroup_subsys *ss, struct cftype *cfts)
+@@ -3796,8 +3799,10 @@ static int cgroup_init_cftypes(struct cgroup_subsys *ss, struct cftype *cfts)
  			kf_ops->atomic_write_len = cft->max_write_len;
  		}
  
@@ -148202,7 +148253,7 @@ index 4e2f3de..d50672d 100644
  	}
  
  	return 0;
-@@ -3809,7 +3814,7 @@ static int cgroup_rm_cftypes_locked(struct cftype *cfts)
+@@ -3810,7 +3815,7 @@ static int cgroup_rm_cftypes_locked(struct cftype *cfts)
  	if (!cfts || !cfts[0].ss)
  		return -ENOENT;
  
@@ -148211,7 +148262,7 @@ index 4e2f3de..d50672d 100644
  	cgroup_apply_cftypes(cfts, false);
  	cgroup_exit_cftypes(cfts);
  	return 0;
-@@ -3866,7 +3871,7 @@ static int cgroup_add_cftypes(struct cgroup_subsys *ss, struct cftype *cfts)
+@@ -3867,7 +3872,7 @@ static int cgroup_add_cftypes(struct cgroup_subsys *ss, struct cftype *cfts)
  
  	mutex_lock(&cgroup_mutex);
  
@@ -148220,7 +148271,7 @@ index 4e2f3de..d50672d 100644
  	ret = cgroup_apply_cftypes(cfts, true);
  	if (ret)
  		cgroup_rm_cftypes_locked(cfts);
-@@ -3887,8 +3892,10 @@ int cgroup_add_dfl_cftypes(struct cgroup_subsys *ss, struct cftype *cfts)
+@@ -3888,8 +3893,10 @@ int cgroup_add_dfl_cftypes(struct cgroup_subsys *ss, struct cftype *cfts)
  {
  	struct cftype *cft;
  
@@ -148232,7 +148283,7 @@ index 4e2f3de..d50672d 100644
  	return cgroup_add_cftypes(ss, cfts);
  }
  
-@@ -3904,8 +3911,10 @@ int cgroup_add_legacy_cftypes(struct cgroup_subsys *ss, struct cftype *cfts)
+@@ -3905,8 +3912,10 @@ int cgroup_add_legacy_cftypes(struct cgroup_subsys *ss, struct cftype *cfts)
  {
  	struct cftype *cft;
  
@@ -148244,7 +148295,7 @@ index 4e2f3de..d50672d 100644
  	return cgroup_add_cftypes(ss, cfts);
  }
  
-@@ -6090,6 +6099,9 @@ static void cgroup_release_agent(struct work_struct *work)
+@@ -6091,6 +6100,9 @@ static void cgroup_release_agent(struct work_struct *work)
  	if (!pathbuf || !agentbuf)
  		goto out;
  
@@ -148254,7 +148305,7 @@ index 4e2f3de..d50672d 100644
  	spin_lock_irq(&css_set_lock);
  	ret = cgroup_path_ns_locked(cgrp, pathbuf, PATH_MAX, &init_cgroup_ns);
  	spin_unlock_irq(&css_set_lock);
-@@ -6570,7 +6582,7 @@ static int cgroup_css_links_read(struct seq_file *seq, void *v)
+@@ -6571,7 +6583,7 @@ static int cgroup_css_links_read(struct seq_file *seq, void *v)
  		struct task_struct *task;
  		int count = 0;
  
@@ -154474,7 +154525,7 @@ index dbafc5d..819bd5d 100644
  
  	ret = -EIO;
 diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
-index da87b3c..2f63cc9 100644
+index 221eb59..055ddca 100644
 --- a/kernel/trace/ftrace.c
 +++ b/kernel/trace/ftrace.c
 @@ -120,8 +120,9 @@ static void ftrace_ops_list_func(unsigned long ip, unsigned long parent_ip,
@@ -154510,7 +154561,7 @@ index da87b3c..2f63cc9 100644
  }
  
  /*
-@@ -4878,8 +4884,10 @@ static int ftrace_process_locs(struct module *mod,
+@@ -4890,8 +4896,10 @@ static int ftrace_process_locs(struct module *mod,
  	if (!count)
  		return 0;
  
@@ -154521,7 +154572,7 @@ index da87b3c..2f63cc9 100644
  
  	start_pg = ftrace_allocate_pages(count);
  	if (!start_pg)
-@@ -5295,7 +5303,8 @@ static void ftrace_ops_list_func(unsigned long ip, unsigned long parent_ip,
+@@ -5307,7 +5315,8 @@ static void ftrace_ops_list_func(unsigned long ip, unsigned long parent_ip,
  	__ftrace_ops_list_func(ip, parent_ip, NULL, regs);
  }
  #else
@@ -154531,7 +154582,7 @@ index da87b3c..2f63cc9 100644
  {
  	__ftrace_ops_list_func(ip, parent_ip, NULL, NULL);
  }
-@@ -5718,8 +5727,12 @@ int ftrace_graph_entry_stub(struct ftrace_graph_ent *trace)
+@@ -5739,8 +5748,12 @@ int ftrace_graph_entry_stub(struct ftrace_graph_ent *trace)
  }
  
  /* The callbacks that hook a function */
@@ -154546,7 +154597,7 @@ index da87b3c..2f63cc9 100644
  trace_func_graph_ent_t ftrace_graph_entry = ftrace_graph_entry_stub;
  static trace_func_graph_ent_t __ftrace_graph_entry = ftrace_graph_entry_stub;
  
-@@ -5752,7 +5765,7 @@ static int alloc_retstack_tasklist(struct ftrace_ret_stack **ret_stack_list)
+@@ -5773,7 +5786,7 @@ static int alloc_retstack_tasklist(struct ftrace_ret_stack **ret_stack_list)
  
  		if (t->ret_stack == NULL) {
  			atomic_set(&t->tracing_graph_pause, 0);
@@ -154555,7 +154606,7 @@ index da87b3c..2f63cc9 100644
  			t->curr_ret_stack = -1;
  			/* Make sure the tasks see the -1 first: */
  			smp_wmb();
-@@ -5947,7 +5960,7 @@ void unregister_ftrace_graph(void)
+@@ -5968,7 +5981,7 @@ void unregister_ftrace_graph(void)
  		goto out;
  
  	ftrace_graph_active--;
@@ -154564,7 +154615,7 @@ index da87b3c..2f63cc9 100644
  	ftrace_graph_entry = ftrace_graph_entry_stub;
  	__ftrace_graph_entry = ftrace_graph_entry_stub;
  	ftrace_shutdown(&graph_ops, FTRACE_STOP_FUNC_RET);
-@@ -5975,7 +5988,7 @@ static void
+@@ -5996,7 +6009,7 @@ static void
  graph_init_task(struct task_struct *t, struct ftrace_ret_stack *ret_stack)
  {
  	atomic_set(&t->tracing_graph_pause, 0);
@@ -154917,7 +154968,7 @@ index f30847a..9e62b08 100644
  		*data_page = bpage;
  
 diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
-index 90b66ed..c34206c 100644
+index 862bc88..27ebd55 100644
 --- a/kernel/trace/trace.c
 +++ b/kernel/trace/trace.c
 @@ -3883,7 +3883,7 @@ int trace_keep_overwrite(struct tracer *tracer, u32 mask, int set)
@@ -154930,10 +154981,10 @@ index 90b66ed..c34206c 100644
  	/* do nothing if flag is already set */
  	if (!!(tr->trace_flags & mask) == !!enabled)
 diff --git a/kernel/trace/trace.h b/kernel/trace/trace.h
-index fd24b1f..bdbb85b 100644
+index b0d8576..6284224 100644
 --- a/kernel/trace/trace.h
 +++ b/kernel/trace/trace.h
-@@ -1615,7 +1615,7 @@ void trace_printk_control(bool enabled);
+@@ -1617,7 +1617,7 @@ void trace_printk_control(bool enabled);
  void trace_printk_init_buffers(void);
  void trace_printk_start_comm(void);
  int trace_keep_overwrite(struct tracer *tracer, u32 mask, int set);
@@ -157365,7 +157416,7 @@ index 93fb63e..0aa6448 100644
  	if (end == start)
  		return error;
 diff --git a/mm/memcontrol.c b/mm/memcontrol.c
-index 0de2669..1489e01 100644
+index 47559cc..3c43108 100644
 --- a/mm/memcontrol.c
 +++ b/mm/memcontrol.c
 @@ -701,7 +701,7 @@ static void memcg_check_events(struct mem_cgroup *memcg, struct page *page)
@@ -163975,7 +164026,7 @@ index 1cd2ec0..2650ce6 100644
  	a0 = a[0];
  	a1 = a[1];
 diff --git a/net/core/datagram.c b/net/core/datagram.c
-index b7de71f..808387d 100644
+index 963732e..999ed39 100644
 --- a/net/core/datagram.c
 +++ b/net/core/datagram.c
 @@ -360,7 +360,7 @@ int skb_kill_datagram(struct sock *sk, struct sk_buff *skb, unsigned int flags)
@@ -167277,10 +167328,10 @@ index 3815e85..f6cb55b 100644
  	return -ENOMEM;
  }
 diff --git a/net/ipv6/route.c b/net/ipv6/route.c
-index bff4460..4551e9a 100644
+index 8d6c09f..685bdcf 100644
 --- a/net/ipv6/route.c
 +++ b/net/ipv6/route.c
-@@ -3625,7 +3625,7 @@ struct ctl_table ipv6_route_table_template[] = {
+@@ -3627,7 +3627,7 @@ struct ctl_table ipv6_route_table_template[] = {
  
  struct ctl_table * __net_init ipv6_route_sysctl_init(struct net *net)
  {
@@ -170649,7 +170700,7 @@ index c345bf1..41a50e5 100644
  		NULL, sctp_cname, sctp_tname, sctp_oname, sctp_pname,
  	};
 diff --git a/net/sctp/socket.c b/net/sctp/socket.c
-index 6cbe5bd..04c4e00 100644
+index 6734420..aa1101c 100644
 --- a/net/sctp/socket.c
 +++ b/net/sctp/socket.c
 @@ -4719,7 +4719,7 @@ static int sctp_getsockopt_autoclose(struct sock *sk, int len, char __user *optv
@@ -170661,7 +170712,7 @@ index 6cbe5bd..04c4e00 100644
  		return -EFAULT;
  	return 0;
  }
-@@ -5139,6 +5139,8 @@ static int sctp_getsockopt_peer_addrs(struct sock *sk, int len,
+@@ -5145,6 +5145,8 @@ static int sctp_getsockopt_peer_addrs(struct sock *sk, int len,
  			      ->addr_to_user(sp, &temp);
  		if (space_left < addrlen)
  			return -ENOMEM;
@@ -170670,7 +170721,7 @@ index 6cbe5bd..04c4e00 100644
  		if (copy_to_user(to, &temp, addrlen))
  			return -EFAULT;
  		to += addrlen;
-@@ -7855,6 +7857,10 @@ struct proto sctp_prot = {
+@@ -7859,6 +7861,10 @@ struct proto sctp_prot = {
  	.unhash      =	sctp_unhash,
  	.get_port    =	sctp_get_port,
  	.obj_size    =  sizeof(struct sctp_sock),
@@ -180580,10 +180631,10 @@ index 0000000..a8039b2
 +clean-files += *.so
 diff --git a/scripts/gcc-plugins/size_overflow_plugin/disable.data b/scripts/gcc-plugins/size_overflow_plugin/disable.data
 new file mode 100644
-index 0000000..83975f2
+index 0000000..2bb03a6
 --- /dev/null
 +++ b/scripts/gcc-plugins/size_overflow_plugin/disable.data
-@@ -0,0 +1,12472 @@
+@@ -0,0 +1,12473 @@
 +disable_so_interrupt_pnode_gru_message_queue_desc_4 interrupt_pnode gru_message_queue_desc 0 4 NULL
 +disable_so_bch_btree_insert_fndecl_12 bch_btree_insert fndecl 0 12 NULL
 +disable_so_macvlan_sync_address_fndecl_22 macvlan_sync_address fndecl 0 22 NULL nohasharray
@@ -193056,6 +193107,7 @@ index 0000000..83975f2
 +btrfs_get_token_16_fndecl_46639_fns btrfs_get_token_16 fndecl 0 46639 NULL
 +btrfs_get_token_64_fndecl_54223_fns btrfs_get_token_64 fndecl 0 54223 NULL
 +qdisc_tree_reduce_backlog_fndecl_3865_fields qdisc_tree_reduce_backlog fndecl 2 3865 NULL
++user_buffer_offset_binder_proc_17508_fields user_buffer_offset binder_proc 0 17508 NULL
 diff --git a/scripts/gcc-plugins/size_overflow_plugin/e_aux.data b/scripts/gcc-plugins/size_overflow_plugin/e_aux.data
 new file mode 100644
 index 0000000..74e91b2
@@ -193161,7 +193213,7 @@ index 0000000..74e91b2
 +enable_so_zpios_read_fndecl_64734 zpios_read fndecl 3 64734 NULL
 diff --git a/scripts/gcc-plugins/size_overflow_plugin/e_fields.data b/scripts/gcc-plugins/size_overflow_plugin/e_fields.data
 new file mode 100644
-index 0000000..0928e48
+index 0000000..bf44c70
 --- /dev/null
 +++ b/scripts/gcc-plugins/size_overflow_plugin/e_fields.data
 @@ -0,0 +1,16326 @@
@@ -197522,7 +197574,6 @@ index 0000000..0928e48
 +len_tmc_drvdata_17487_fields len tmc_drvdata 0 17487 NULL
 +mlx4_ib_reg_user_mr_fndecl_17492_fields mlx4_ib_reg_user_mr fndecl 3-2 17492 NULL
 +qp_memcpy_from_queue_fndecl_17500_fields qp_memcpy_from_queue fndecl 5-4 17500 NULL
-+user_buffer_offset_binder_proc_17508_fields user_buffer_offset binder_proc 0 17508 NULL
 +invalidate_fndecl_17509_fields invalidate fndecl 4-3 17509 NULL
 +brcmf_fil_iovar_data_set_fndecl_17512_fields brcmf_fil_iovar_data_set fndecl 4 17512 NULL
 +npages_free_dma_pool_17513_fields npages_free dma_pool 0 17513 NULL nohasharray
@@ -198830,6 +198881,7 @@ index 0000000..0928e48
 +xprt_alloc_fndecl_22736_fields xprt_alloc fndecl 4-3 22736 NULL
 +num_fcoe_qps_i40e_pf_22740_fields num_fcoe_qps i40e_pf 0 22740 NULL
 +iwlagn_pass_packet_to_mac80211_fndecl_22746_fields iwlagn_pass_packet_to_mac80211 fndecl 3 22746 NULL
++iov_iter_revert_fndecl_22771_fields iov_iter_revert fndecl 2 22771 NULL
 +rambase_brcmf_chip_22773_fields rambase brcmf_chip 0 22773 NULL
 +efi_memmap_alloc_fndecl_22776_fields efi_memmap_alloc fndecl 1-0 22776 NULL
 +ndr_mappings_nd_region_22782_fields ndr_mappings nd_region 0 22782 NULL
diff --git a/4.9.23/4425_grsec_remove_EI_PAX.patch b/4.9.24/4425_grsec_remove_EI_PAX.patch
index 594598a..594598a 100644
--- a/4.9.23/4425_grsec_remove_EI_PAX.patch
+++ b/4.9.24/4425_grsec_remove_EI_PAX.patch
diff --git a/4.9.23/4426_default_XATTR_PAX_FLAGS.patch b/4.9.24/4426_default_XATTR_PAX_FLAGS.patch
index f7e97b5..f7e97b5 100644
--- a/4.9.23/4426_default_XATTR_PAX_FLAGS.patch
+++ b/4.9.24/4426_default_XATTR_PAX_FLAGS.patch
diff --git a/4.9.23/4427_force_XATTR_PAX_tmpfs.patch b/4.9.24/4427_force_XATTR_PAX_tmpfs.patch
index 3871139..3871139 100644
--- a/4.9.23/4427_force_XATTR_PAX_tmpfs.patch
+++ b/4.9.24/4427_force_XATTR_PAX_tmpfs.patch
diff --git a/4.9.23/4430_grsec-remove-localversion-grsec.patch b/4.9.24/4430_grsec-remove-localversion-grsec.patch
index 31cf878..31cf878 100644
--- a/4.9.23/4430_grsec-remove-localversion-grsec.patch
+++ b/4.9.24/4430_grsec-remove-localversion-grsec.patch
diff --git a/4.9.23/4435_grsec-mute-warnings.patch b/4.9.24/4435_grsec-mute-warnings.patch
index 8929222..8929222 100644
--- a/4.9.23/4435_grsec-mute-warnings.patch
+++ b/4.9.24/4435_grsec-mute-warnings.patch
diff --git a/4.9.23/4440_grsec-remove-protected-paths.patch b/4.9.24/4440_grsec-remove-protected-paths.patch
index 741546d..741546d 100644
--- a/4.9.23/4440_grsec-remove-protected-paths.patch
+++ b/4.9.24/4440_grsec-remove-protected-paths.patch
diff --git a/4.9.23/4450_grsec-kconfig-default-gids.patch b/4.9.24/4450_grsec-kconfig-default-gids.patch
index cee6e27..cee6e27 100644
--- a/4.9.23/4450_grsec-kconfig-default-gids.patch
+++ b/4.9.24/4450_grsec-kconfig-default-gids.patch
diff --git a/4.9.23/4465_selinux-avc_audit-log-curr_ip.patch b/4.9.24/4465_selinux-avc_audit-log-curr_ip.patch
index 06a5294..06a5294 100644
--- a/4.9.23/4465_selinux-avc_audit-log-curr_ip.patch
+++ b/4.9.24/4465_selinux-avc_audit-log-curr_ip.patch
diff --git a/4.9.23/4470_disable-compat_vdso.patch b/4.9.24/4470_disable-compat_vdso.patch
index a1401d8..a1401d8 100644
--- a/4.9.23/4470_disable-compat_vdso.patch
+++ b/4.9.24/4470_disable-compat_vdso.patch
diff --git a/4.9.23/4475_emutramp_default_on.patch b/4.9.24/4475_emutramp_default_on.patch
index feb8c7b..feb8c7b 100644
--- a/4.9.23/4475_emutramp_default_on.patch
+++ b/4.9.24/4475_emutramp_default_on.patch