grsecurity-3.1-4.7.8-20161016172020161016

13 files changed, 1890 insertions, 3928 deletions

diff --git a/4.7.7/1006_linux-4.7.7.patch b/4.7.7/1006_linux-4.7.7.patch
deleted file mode 100644
index 07e2684..0000000
--- a/4.7.7/1006_linux-4.7.7.patch
+++ /dev/null
@@ -1,3811 +0,0 @@
-diff --git a/Documentation/devicetree/bindings/regulator/qcom,spmi-regulator.txt b/Documentation/devicetree/bindings/regulator/qcom,spmi-regulator.txt
-index 46c6f3e..0fa3b0f 100644
---- a/Documentation/devicetree/bindings/regulator/qcom,spmi-regulator.txt
-+++ b/Documentation/devicetree/bindings/regulator/qcom,spmi-regulator.txt
-@@ -113,9 +113,9 @@ pm8916:
- 	l14, l15, l16, l17, l18
- 
- pm8941:
--	s1, s2, s3, l1, l2, l3, l4, l5, l6, l7, l8, l9, l10, l11, l12, l13, l14,
--	l15, l16, l17, l18, l19, l20, l21, l22, l23, l24, lvs1, lvs2, lvs3,
--	mvs1, mvs2
-+	s1, s2, s3, s4, l1, l2, l3, l4, l5, l6, l7, l8, l9, l10, l11, l12, l13,
-+	l14, l15, l16, l17, l18, l19, l20, l21, l22, l23, l24, lvs1, lvs2, lvs3,
-+	5vs1, 5vs2
- 
- pm8994:
- 	s1, s2, s3, s4, s5, s6, s7, s8, s9, s10, s11, s12, l1, l2, l3, l4, l5,
-diff --git a/Documentation/pinctrl.txt b/Documentation/pinctrl.txt
-index 4976389e..dd15a69 100644
---- a/Documentation/pinctrl.txt
-+++ b/Documentation/pinctrl.txt
-@@ -831,7 +831,7 @@ separate memory range only intended for GPIO driving, and the register
- range dealing with pin config and pin multiplexing get placed into a
- different memory range and a separate section of the data sheet.
- 
--A flag "strict" in struct pinctrl_desc is available to check and deny
-+A flag "strict" in struct pinmux_ops is available to check and deny
- simultaneous access to the same pin from GPIO and pin multiplexing
- consumers on hardware of this type. The pinctrl driver should set this flag
- accordingly.
-diff --git a/Makefile b/Makefile
-index 48b0120..320a930 100644
---- a/Makefile
-+++ b/Makefile
-@@ -1,6 +1,6 @@
- VERSION = 4
- PATCHLEVEL = 7
--SUBLEVEL = 6
-+SUBLEVEL = 7
- EXTRAVERSION =
- NAME = Psychotic Stoned Sheep
- 
-diff --git a/arch/arm/boot/compressed/head.S b/arch/arm/boot/compressed/head.S
-index af11c2f..fc6d541 100644
---- a/arch/arm/boot/compressed/head.S
-+++ b/arch/arm/boot/compressed/head.S
-@@ -779,7 +779,7 @@ __armv7_mmu_cache_on:
- 		orrne	r0, r0, #1		@ MMU enabled
- 		movne	r1, #0xfffffffd		@ domain 0 = client
- 		bic     r6, r6, #1 << 31        @ 32-bit translation system
--		bic     r6, r6, #3 << 0         @ use only ttbr0
-+		bic     r6, r6, #(7 << 0) | (1 << 4)	@ use only ttbr0
- 		mcrne	p15, 0, r3, c2, c0, 0	@ load page table pointer
- 		mcrne	p15, 0, r1, c3, c0, 0	@ load domain access control
- 		mcrne   p15, 0, r6, c2, c0, 2   @ load ttb control
-diff --git a/arch/arm/boot/dts/imx6sx-sabreauto.dts b/arch/arm/boot/dts/imx6sx-sabreauto.dts
-index 96ea936..240a286 100644
---- a/arch/arm/boot/dts/imx6sx-sabreauto.dts
-+++ b/arch/arm/boot/dts/imx6sx-sabreauto.dts
-@@ -64,7 +64,7 @@
- 	cd-gpios = <&gpio7 11 GPIO_ACTIVE_LOW>;
- 	no-1-8-v;
- 	keep-power-in-suspend;
--	enable-sdio-wakup;
-+	wakeup-source;
- 	status = "okay";
- };
- 
-diff --git a/arch/arm/boot/dts/sun5i-a13.dtsi b/arch/arm/boot/dts/sun5i-a13.dtsi
-index 263d46d..2d78eee 100644
---- a/arch/arm/boot/dts/sun5i-a13.dtsi
-+++ b/arch/arm/boot/dts/sun5i-a13.dtsi
-@@ -84,7 +84,7 @@
- 			trips {
- 				cpu_alert0: cpu_alert0 {
- 					/* milliCelsius */
--					temperature = <850000>;
-+					temperature = <85000>;
- 					hysteresis = <2000>;
- 					type = "passive";
- 				};
-diff --git a/arch/arm/common/sa1111.c b/arch/arm/common/sa1111.c
-index fb0a0a4..0e43718 100644
---- a/arch/arm/common/sa1111.c
-+++ b/arch/arm/common/sa1111.c
-@@ -869,9 +869,9 @@ struct sa1111_save_data {
- 
- #ifdef CONFIG_PM
- 
--static int sa1111_suspend(struct platform_device *dev, pm_message_t state)
-+static int sa1111_suspend_noirq(struct device *dev)
- {
--	struct sa1111 *sachip = platform_get_drvdata(dev);
-+	struct sa1111 *sachip = dev_get_drvdata(dev);
- 	struct sa1111_save_data *save;
- 	unsigned long flags;
- 	unsigned int val;
-@@ -934,9 +934,9 @@ static int sa1111_suspend(struct platform_device *dev, pm_message_t state)
-  *	restored by their respective drivers, and must be called
-  *	via LDM after this function.
-  */
--static int sa1111_resume(struct platform_device *dev)
-+static int sa1111_resume_noirq(struct device *dev)
- {
--	struct sa1111 *sachip = platform_get_drvdata(dev);
-+	struct sa1111 *sachip = dev_get_drvdata(dev);
- 	struct sa1111_save_data *save;
- 	unsigned long flags, id;
- 	void __iomem *base;
-@@ -952,7 +952,7 @@ static int sa1111_resume(struct platform_device *dev)
- 	id = sa1111_readl(sachip->base + SA1111_SKID);
- 	if ((id & SKID_ID_MASK) != SKID_SA1111_ID) {
- 		__sa1111_remove(sachip);
--		platform_set_drvdata(dev, NULL);
-+		dev_set_drvdata(dev, NULL);
- 		kfree(save);
- 		return 0;
- 	}
-@@ -1003,8 +1003,8 @@ static int sa1111_resume(struct platform_device *dev)
- }
- 
- #else
--#define sa1111_suspend NULL
--#define sa1111_resume  NULL
-+#define sa1111_suspend_noirq NULL
-+#define sa1111_resume_noirq  NULL
- #endif
- 
- static int sa1111_probe(struct platform_device *pdev)
-@@ -1038,6 +1038,11 @@ static int sa1111_remove(struct platform_device *pdev)
- 	return 0;
- }
- 
-+static struct dev_pm_ops sa1111_pm_ops = {
-+	.suspend_noirq = sa1111_suspend_noirq,
-+	.resume_noirq = sa1111_resume_noirq,
-+};
-+
- /*
-  *	Not sure if this should be on the system bus or not yet.
-  *	We really want some way to register a system device at
-@@ -1050,10 +1055,9 @@ static int sa1111_remove(struct platform_device *pdev)
- static struct platform_driver sa1111_device_driver = {
- 	.probe		= sa1111_probe,
- 	.remove		= sa1111_remove,
--	.suspend	= sa1111_suspend,
--	.resume		= sa1111_resume,
- 	.driver		= {
- 		.name	= "sa1111",
-+		.pm	= &sa1111_pm_ops,
- 	},
- };
- 
-diff --git a/arch/arm/include/asm/dma-mapping.h b/arch/arm/include/asm/dma-mapping.h
-index a83570f..8ec98fc 100644
---- a/arch/arm/include/asm/dma-mapping.h
-+++ b/arch/arm/include/asm/dma-mapping.h
-@@ -112,7 +112,7 @@ static inline dma_addr_t virt_to_dma(struct device *dev, void *addr)
- /* The ARM override for dma_max_pfn() */
- static inline unsigned long dma_max_pfn(struct device *dev)
- {
--	return PHYS_PFN_OFFSET + dma_to_pfn(dev, *dev->dma_mask);
-+	return dma_to_pfn(dev, *dev->dma_mask);
- }
- #define dma_max_pfn(dev) dma_max_pfn(dev)
- 
-diff --git a/arch/arm/kernel/devtree.c b/arch/arm/kernel/devtree.c
-index 2e26016..5204978 100644
---- a/arch/arm/kernel/devtree.c
-+++ b/arch/arm/kernel/devtree.c
-@@ -87,6 +87,8 @@ void __init arm_dt_init_cpu_maps(void)
- 		return;
- 
- 	for_each_child_of_node(cpus, cpu) {
-+		const __be32 *cell;
-+		int prop_bytes;
- 		u32 hwid;
- 
- 		if (of_node_cmp(cpu->type, "cpu"))
-@@ -98,7 +100,8 @@ void __init arm_dt_init_cpu_maps(void)
- 		 * properties is considered invalid to build the
- 		 * cpu_logical_map.
- 		 */
--		if (of_property_read_u32(cpu, "reg", &hwid)) {
-+		cell = of_get_property(cpu, "reg", &prop_bytes);
-+		if (!cell || prop_bytes < sizeof(*cell)) {
- 			pr_debug(" * %s missing reg property\n",
- 				     cpu->full_name);
- 			of_node_put(cpu);
-@@ -106,10 +109,15 @@ void __init arm_dt_init_cpu_maps(void)
- 		}
- 
- 		/*
--		 * 8 MSBs must be set to 0 in the DT since the reg property
-+		 * Bits n:24 must be set to 0 in the DT since the reg property
- 		 * defines the MPIDR[23:0].
- 		 */
--		if (hwid & ~MPIDR_HWID_BITMASK) {
-+		do {
-+			hwid = be32_to_cpu(*cell++);
-+			prop_bytes -= sizeof(*cell);
-+		} while (!hwid && prop_bytes > 0);
-+
-+		if (prop_bytes || (hwid & ~MPIDR_HWID_BITMASK)) {
- 			of_node_put(cpu);
- 			return;
- 		}
-diff --git a/arch/arm/mach-sa1100/clock.c b/arch/arm/mach-sa1100/clock.c
-index cbf53bb..0db4689 100644
---- a/arch/arm/mach-sa1100/clock.c
-+++ b/arch/arm/mach-sa1100/clock.c
-@@ -125,6 +125,8 @@ static unsigned long clk_36864_get_rate(struct clk *clk)
- }
- 
- static struct clkops clk_36864_ops = {
-+	.enable		= clk_cpu_enable,
-+	.disable	= clk_cpu_disable,
- 	.get_rate	= clk_36864_get_rate,
- };
- 
-@@ -140,9 +142,8 @@ static struct clk_lookup sa11xx_clkregs[] = {
- 	CLKDEV_INIT(NULL, "OSTIMER0", &clk_36864),
- };
- 
--static int __init sa11xx_clk_init(void)
-+int __init sa11xx_clk_init(void)
- {
- 	clkdev_add_table(sa11xx_clkregs, ARRAY_SIZE(sa11xx_clkregs));
- 	return 0;
- }
--core_initcall(sa11xx_clk_init);
-diff --git a/arch/arm/mach-sa1100/generic.c b/arch/arm/mach-sa1100/generic.c
-index 345e63f..3e09bed 100644
---- a/arch/arm/mach-sa1100/generic.c
-+++ b/arch/arm/mach-sa1100/generic.c
-@@ -34,6 +34,7 @@
- 
- #include <mach/hardware.h>
- #include <mach/irqs.h>
-+#include <mach/reset.h>
- 
- #include "generic.h"
- #include <clocksource/pxa.h>
-@@ -95,6 +96,8 @@ static void sa1100_power_off(void)
- 
- void sa11x0_restart(enum reboot_mode mode, const char *cmd)
- {
-+	clear_reset_status(RESET_STATUS_ALL);
-+
- 	if (mode == REBOOT_SOFT) {
- 		/* Jump into ROM at address 0 */
- 		soft_restart(0);
-@@ -388,6 +391,7 @@ void __init sa1100_init_irq(void)
- 	sa11x0_init_irq_nodt(IRQ_GPIO0_SC, irq_resource.start);
- 
- 	sa1100_init_gpio();
-+	sa11xx_clk_init();
- }
- 
- /*
-diff --git a/arch/arm/mach-sa1100/generic.h b/arch/arm/mach-sa1100/generic.h
-index 0d92e11..68199b603 100644
---- a/arch/arm/mach-sa1100/generic.h
-+++ b/arch/arm/mach-sa1100/generic.h
-@@ -44,3 +44,5 @@ int sa11x0_pm_init(void);
- #else
- static inline int sa11x0_pm_init(void) { return 0; }
- #endif
-+
-+int sa11xx_clk_init(void);
-diff --git a/arch/arm/mach-shmobile/regulator-quirk-rcar-gen2.c b/arch/arm/mach-shmobile/regulator-quirk-rcar-gen2.c
-index 62437b5..73e3adb 100644
---- a/arch/arm/mach-shmobile/regulator-quirk-rcar-gen2.c
-+++ b/arch/arm/mach-shmobile/regulator-quirk-rcar-gen2.c
-@@ -41,39 +41,26 @@
- 
- #define REGULATOR_IRQ_MASK	BIT(2)	/* IRQ2, active low */
- 
--static void __iomem *irqc;
--
--static const u8 da9063_mask_regs[] = {
--	DA9063_REG_IRQ_MASK_A,
--	DA9063_REG_IRQ_MASK_B,
--	DA9063_REG_IRQ_MASK_C,
--	DA9063_REG_IRQ_MASK_D,
--};
--
--/* DA9210 System Control and Event Registers */
-+/* start of DA9210 System Control and Event Registers */
- #define DA9210_REG_MASK_A		0x54
--#define DA9210_REG_MASK_B		0x55
--
--static const u8 da9210_mask_regs[] = {
--	DA9210_REG_MASK_A,
--	DA9210_REG_MASK_B,
--};
--
--static void da9xxx_mask_irqs(struct i2c_client *client, const u8 regs[],
--			     unsigned int nregs)
--{
--	unsigned int i;
- 
--	dev_info(&client->dev, "Masking %s interrupt sources\n", client->name);
-+static void __iomem *irqc;
- 
--	for (i = 0; i < nregs; i++) {
--		int error = i2c_smbus_write_byte_data(client, regs[i], ~0);
--		if (error) {
--			dev_err(&client->dev, "i2c error %d\n", error);
--			return;
--		}
--	}
--}
-+/* first byte sets the memory pointer, following are consecutive reg values */
-+static u8 da9063_irq_clr[] = { DA9063_REG_IRQ_MASK_A, 0xff, 0xff, 0xff, 0xff };
-+static u8 da9210_irq_clr[] = { DA9210_REG_MASK_A, 0xff, 0xff };
-+
-+static struct i2c_msg da9xxx_msgs[2] = {
-+	{
-+		.addr = 0x58,
-+		.len = ARRAY_SIZE(da9063_irq_clr),
-+		.buf = da9063_irq_clr,
-+	}, {
-+		.addr = 0x68,
-+		.len = ARRAY_SIZE(da9210_irq_clr),
-+		.buf = da9210_irq_clr,
-+	},
-+};
- 
- static int regulator_quirk_notify(struct notifier_block *nb,
- 				  unsigned long action, void *data)
-@@ -93,12 +80,15 @@ static int regulator_quirk_notify(struct notifier_block *nb,
- 	client = to_i2c_client(dev);
- 	dev_dbg(dev, "Detected %s\n", client->name);
- 
--	if ((client->addr == 0x58 && !strcmp(client->name, "da9063")))
--		da9xxx_mask_irqs(client, da9063_mask_regs,
--				 ARRAY_SIZE(da9063_mask_regs));
--	else if (client->addr == 0x68 && !strcmp(client->name, "da9210"))
--		da9xxx_mask_irqs(client, da9210_mask_regs,
--				 ARRAY_SIZE(da9210_mask_regs));
-+	if ((client->addr == 0x58 && !strcmp(client->name, "da9063")) ||
-+	    (client->addr == 0x68 && !strcmp(client->name, "da9210"))) {
-+		int ret;
-+
-+		dev_info(&client->dev, "clearing da9063/da9210 interrupts\n");
-+		ret = i2c_transfer(client->adapter, da9xxx_msgs, ARRAY_SIZE(da9xxx_msgs));
-+		if (ret != ARRAY_SIZE(da9xxx_msgs))
-+			dev_err(&client->dev, "i2c error %d\n", ret);
-+	}
- 
- 	mon = ioread32(irqc + IRQC_MONITOR);
- 	if (mon & REGULATOR_IRQ_MASK)
-diff --git a/arch/arm64/kernel/debug-monitors.c b/arch/arm64/kernel/debug-monitors.c
-index 0800d23..b463607 100644
---- a/arch/arm64/kernel/debug-monitors.c
-+++ b/arch/arm64/kernel/debug-monitors.c
-@@ -417,8 +417,10 @@ int kernel_active_single_step(void)
- /* ptrace API */
- void user_enable_single_step(struct task_struct *task)
- {
--	set_ti_thread_flag(task_thread_info(task), TIF_SINGLESTEP);
--	set_regs_spsr_ss(task_pt_regs(task));
-+	struct thread_info *ti = task_thread_info(task);
-+
-+	if (!test_and_set_ti_thread_flag(ti, TIF_SINGLESTEP))
-+		set_regs_spsr_ss(task_pt_regs(task));
- }
- 
- void user_disable_single_step(struct task_struct *task)
-diff --git a/arch/avr32/mach-at32ap/pio.c b/arch/avr32/mach-at32ap/pio.c
-index 83c2a00..13d3fc4 100644
---- a/arch/avr32/mach-at32ap/pio.c
-+++ b/arch/avr32/mach-at32ap/pio.c
-@@ -435,7 +435,7 @@ void __init at32_init_pio(struct platform_device *pdev)
- 	struct resource *regs;
- 	struct pio_device *pio;
- 
--	if (pdev->id > MAX_NR_PIO_DEVICES) {
-+	if (pdev->id >= MAX_NR_PIO_DEVICES) {
- 		dev_err(&pdev->dev, "only %d PIO devices supported\n",
- 			MAX_NR_PIO_DEVICES);
- 		return;
-diff --git a/arch/mips/include/asm/uprobes.h b/arch/mips/include/asm/uprobes.h
-index 34c325c..70a4a2f 100644
---- a/arch/mips/include/asm/uprobes.h
-+++ b/arch/mips/include/asm/uprobes.h
-@@ -36,7 +36,6 @@ struct arch_uprobe {
- 	unsigned long	resume_epc;
- 	u32	insn[2];
- 	u32	ixol[2];
--	union	mips_instruction orig_inst[MAX_UINSN_BYTES / 4];
- };
- 
- struct arch_uprobe_task {
-diff --git a/arch/mips/kernel/uprobes.c b/arch/mips/kernel/uprobes.c
-index 8452d93..4e7b89f 100644
---- a/arch/mips/kernel/uprobes.c
-+++ b/arch/mips/kernel/uprobes.c
-@@ -157,7 +157,6 @@ bool is_trap_insn(uprobe_opcode_t *insn)
- int arch_uprobe_pre_xol(struct arch_uprobe *aup, struct pt_regs *regs)
- {
- 	struct uprobe_task *utask = current->utask;
--	union mips_instruction insn;
- 
- 	/*
- 	 * Now find the EPC where to resume after the breakpoint has been
-@@ -168,10 +167,10 @@ int arch_uprobe_pre_xol(struct arch_uprobe *aup, struct pt_regs *regs)
- 		unsigned long epc;
- 
- 		epc = regs->cp0_epc;
--		__compute_return_epc_for_insn(regs, insn);
-+		__compute_return_epc_for_insn(regs,
-+			(union mips_instruction) aup->insn[0]);
- 		aup->resume_epc = regs->cp0_epc;
- 	}
--
- 	utask->autask.saved_trap_nr = current->thread.trap_nr;
- 	current->thread.trap_nr = UPROBE_TRAP_NR;
- 	regs->cp0_epc = current->utask->xol_vaddr;
-@@ -257,7 +256,7 @@ unsigned long arch_uretprobe_hijack_return_addr(
- 	ra = regs->regs[31];
- 
- 	/* Replace the return address with the trampoline address */
--	regs->regs[31] = ra;
-+	regs->regs[31] = trampoline_vaddr;
- 
- 	return ra;
- }
-@@ -280,24 +279,6 @@ int __weak set_swbp(struct arch_uprobe *auprobe, struct mm_struct *mm,
- 	return uprobe_write_opcode(mm, vaddr, UPROBE_SWBP_INSN);
- }
- 
--/**
-- * set_orig_insn - Restore the original instruction.
-- * @mm: the probed process address space.
-- * @auprobe: arch specific probepoint information.
-- * @vaddr: the virtual address to insert the opcode.
-- *
-- * For mm @mm, restore the original opcode (opcode) at @vaddr.
-- * Return 0 (success) or a negative errno.
-- *
-- * This overrides the weak version in kernel/events/uprobes.c.
-- */
--int set_orig_insn(struct arch_uprobe *auprobe, struct mm_struct *mm,
--		 unsigned long vaddr)
--{
--	return uprobe_write_opcode(mm, vaddr,
--			*(uprobe_opcode_t *)&auprobe->orig_inst[0].word);
--}
--
- void __weak arch_uprobe_copy_ixol(struct page *page, unsigned long vaddr,
- 				  void *src, unsigned long len)
- {
-diff --git a/arch/mips/mti-malta/malta-setup.c b/arch/mips/mti-malta/malta-setup.c
-index 33d5ff5..18b37a5 100644
---- a/arch/mips/mti-malta/malta-setup.c
-+++ b/arch/mips/mti-malta/malta-setup.c
-@@ -39,6 +39,9 @@
- #include <linux/console.h>
- #endif
- 
-+#define ROCIT_CONFIG_GEN0		0x1f403000
-+#define  ROCIT_CONFIG_GEN0_PCI_IOCU	BIT(7)
-+
- extern void malta_be_init(void);
- extern int malta_be_handler(struct pt_regs *regs, int is_fixup);
- 
-@@ -107,6 +110,8 @@ static void __init fd_activate(void)
- static int __init plat_enable_iocoherency(void)
- {
- 	int supported = 0;
-+	u32 cfg;
-+
- 	if (mips_revision_sconid == MIPS_REVISION_SCON_BONITO) {
- 		if (BONITO_PCICACHECTRL & BONITO_PCICACHECTRL_CPUCOH_PRES) {
- 			BONITO_PCICACHECTRL |= BONITO_PCICACHECTRL_CPUCOH_EN;
-@@ -129,7 +134,8 @@ static int __init plat_enable_iocoherency(void)
- 	} else if (mips_cm_numiocu() != 0) {
- 		/* Nothing special needs to be done to enable coherency */
- 		pr_info("CMP IOCU detected\n");
--		if ((*(unsigned int *)0xbf403000 & 0x81) != 0x81) {
-+		cfg = __raw_readl((u32 *)CKSEG1ADDR(ROCIT_CONFIG_GEN0));
-+		if (!(cfg & ROCIT_CONFIG_GEN0_PCI_IOCU)) {
- 			pr_crit("IOCU OPERATION DISABLED BY SWITCH - DEFAULTING TO SW IO COHERENCY\n");
- 			return 0;
- 		}
-diff --git a/arch/powerpc/kernel/prom_init.c b/arch/powerpc/kernel/prom_init.c
-index 6ee4b72..e97925f 100644
---- a/arch/powerpc/kernel/prom_init.c
-+++ b/arch/powerpc/kernel/prom_init.c
-@@ -695,7 +695,7 @@ unsigned char ibm_architecture_vec[] = {
- 	OV4_MIN_ENT_CAP,		/* minimum VP entitled capacity */
- 
- 	/* option vector 5: PAPR/OF options */
--	VECTOR_LENGTH(18),		/* length */
-+	VECTOR_LENGTH(21),		/* length */
- 	0,				/* don't ignore, don't halt */
- 	OV5_FEAT(OV5_LPAR) | OV5_FEAT(OV5_SPLPAR) | OV5_FEAT(OV5_LARGE_PAGES) |
- 	OV5_FEAT(OV5_DRCONF_MEMORY) | OV5_FEAT(OV5_DONATE_DEDICATE_CPU) |
-@@ -726,8 +726,11 @@ unsigned char ibm_architecture_vec[] = {
- 	0,
- 	0,
- 	OV5_FEAT(OV5_PFO_HW_RNG) | OV5_FEAT(OV5_PFO_HW_ENCR) |
--	OV5_FEAT(OV5_PFO_HW_842),
--	OV5_FEAT(OV5_SUB_PROCESSORS),
-+	OV5_FEAT(OV5_PFO_HW_842),				/* Byte 17 */
-+	0,							/* Byte 18 */
-+	0,							/* Byte 19 */
-+	0,							/* Byte 20 */
-+	OV5_FEAT(OV5_SUB_PROCESSORS),				/* Byte 21 */
- 
- 	/* option vector 6: IBM PAPR hints */
- 	VECTOR_LENGTH(3),		/* length */
-diff --git a/arch/tile/include/asm/elf.h b/arch/tile/include/asm/elf.h
-index c505d77..e9d54a0 100644
---- a/arch/tile/include/asm/elf.h
-+++ b/arch/tile/include/asm/elf.h
-@@ -129,6 +129,7 @@ extern int dump_task_regs(struct task_struct *, elf_gregset_t *);
- struct linux_binprm;
- extern int arch_setup_additional_pages(struct linux_binprm *bprm,
- 				       int executable_stack);
-+/* update AT_VECTOR_SIZE_ARCH if the number of NEW_AUX_ENT entries changes */
- #define ARCH_DLINFO \
- do { \
- 	NEW_AUX_ENT(AT_SYSINFO_EHDR, VDSO_BASE); \
-diff --git a/arch/tile/include/uapi/asm/auxvec.h b/arch/tile/include/uapi/asm/auxvec.h
-index c93e927..f497123 100644
---- a/arch/tile/include/uapi/asm/auxvec.h
-+++ b/arch/tile/include/uapi/asm/auxvec.h
-@@ -18,4 +18,6 @@
- /* The vDSO location. */
- #define AT_SYSINFO_EHDR         33
- 
-+#define AT_VECTOR_SIZE_ARCH 1 /* entries in ARCH_DLINFO */
-+
- #endif /* _ASM_TILE_AUXVEC_H */
-diff --git a/arch/x86/include/asm/tlbflush.h b/arch/x86/include/asm/tlbflush.h
-index 6fa8594..dee8a70 100644
---- a/arch/x86/include/asm/tlbflush.h
-+++ b/arch/x86/include/asm/tlbflush.h
-@@ -81,7 +81,7 @@ DECLARE_PER_CPU_SHARED_ALIGNED(struct tlb_state, cpu_tlbstate);
- /* Initialize cr4 shadow for this CPU. */
- static inline void cr4_init_shadow(void)
- {
--	this_cpu_write(cpu_tlbstate.cr4, __read_cr4());
-+	this_cpu_write(cpu_tlbstate.cr4, __read_cr4_safe());
- }
- 
- /* Set in this cpu's CR4. */
-diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c
-index 0fe6953..41f3f7d 100644
---- a/arch/x86/kernel/cpu/common.c
-+++ b/arch/x86/kernel/cpu/common.c
-@@ -804,21 +804,20 @@ static void __init early_identify_cpu(struct cpuinfo_x86 *c)
- 		identify_cpu_without_cpuid(c);
- 
- 	/* cyrix could have cpuid enabled via c_identify()*/
--	if (!have_cpuid_p())
--		return;
-+	if (have_cpuid_p()) {
-+		cpu_detect(c);
-+		get_cpu_vendor(c);
-+		get_cpu_cap(c);
- 
--	cpu_detect(c);
--	get_cpu_vendor(c);
--	get_cpu_cap(c);
--
--	if (this_cpu->c_early_init)
--		this_cpu->c_early_init(c);
-+		if (this_cpu->c_early_init)
-+			this_cpu->c_early_init(c);
- 
--	c->cpu_index = 0;
--	filter_cpuid_features(c, false);
-+		c->cpu_index = 0;
-+		filter_cpuid_features(c, false);
- 
--	if (this_cpu->c_bsp_init)
--		this_cpu->c_bsp_init(c);
-+		if (this_cpu->c_bsp_init)
-+			this_cpu->c_bsp_init(c);
-+	}
- 
- 	setup_force_cpu_cap(X86_FEATURE_ALWAYS);
- 	fpu__init_system(c);
-diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
-index 8326d68..9ed64d2 100644
---- a/arch/x86/kvm/vmx.c
-+++ b/arch/x86/kvm/vmx.c
-@@ -409,6 +409,7 @@ struct nested_vmx {
- 	struct list_head vmcs02_pool;
- 	int vmcs02_num;
- 	u64 vmcs01_tsc_offset;
-+	bool change_vmcs01_virtual_x2apic_mode;
- 	/* L2 must run next, and mustn't decide to exit to L1. */
- 	bool nested_run_pending;
- 	/*
-@@ -8284,6 +8285,12 @@ static void vmx_set_virtual_x2apic_mode(struct kvm_vcpu *vcpu, bool set)
- {
- 	u32 sec_exec_control;
- 
-+	/* Postpone execution until vmcs01 is the current VMCS. */
-+	if (is_guest_mode(vcpu)) {
-+		to_vmx(vcpu)->nested.change_vmcs01_virtual_x2apic_mode = true;
-+		return;
-+	}
-+
- 	/*
- 	 * There is not point to enable virtualize x2apic without enable
- 	 * apicv
-@@ -10601,6 +10608,12 @@ static void nested_vmx_vmexit(struct kvm_vcpu *vcpu, u32 exit_reason,
- 	/* Update TSC_OFFSET if TSC was changed while L2 ran */
- 	vmcs_write64(TSC_OFFSET, vmx->nested.vmcs01_tsc_offset);
- 
-+	if (vmx->nested.change_vmcs01_virtual_x2apic_mode) {
-+		vmx->nested.change_vmcs01_virtual_x2apic_mode = false;
-+		vmx_set_virtual_x2apic_mode(vcpu,
-+				vcpu->arch.apic_base & X2APIC_ENABLE);
-+	}
-+
- 	/* This is needed for same reason as it was needed in prepare_vmcs02 */
- 	vmx->host_rsp = 0;
- 
-diff --git a/block/blk-mq.c b/block/blk-mq.c
-index f9b9049..27dafb3 100644
---- a/block/blk-mq.c
-+++ b/block/blk-mq.c
-@@ -784,7 +784,7 @@ static void __blk_mq_run_hw_queue(struct blk_mq_hw_ctx *hctx)
- 		switch (ret) {
- 		case BLK_MQ_RQ_QUEUE_OK:
- 			queued++;
--			continue;
-+			break;
- 		case BLK_MQ_RQ_QUEUE_BUSY:
- 			list_add(&rq->queuelist, &rq_list);
- 			__blk_mq_requeue_request(rq);
-diff --git a/drivers/base/regmap/regcache-rbtree.c b/drivers/base/regmap/regcache-rbtree.c
-index aa56af8..b11af3f 100644
---- a/drivers/base/regmap/regcache-rbtree.c
-+++ b/drivers/base/regmap/regcache-rbtree.c
-@@ -404,6 +404,7 @@ static int regcache_rbtree_write(struct regmap *map, unsigned int reg,
- 		unsigned int new_base_reg, new_top_reg;
- 		unsigned int min, max;
- 		unsigned int max_dist;
-+		unsigned int dist, best_dist = UINT_MAX;
- 
- 		max_dist = map->reg_stride * sizeof(*rbnode_tmp) /
- 			map->cache_word_size;
-@@ -423,24 +424,41 @@ static int regcache_rbtree_write(struct regmap *map, unsigned int reg,
- 				&base_reg, &top_reg);
- 
- 			if (base_reg <= max && top_reg >= min) {
--				new_base_reg = min(reg, base_reg);
--				new_top_reg = max(reg, top_reg);
--			} else {
--				if (max < base_reg)
--					node = node->rb_left;
-+				if (reg < base_reg)
-+					dist = base_reg - reg;
-+				else if (reg > top_reg)
-+					dist = reg - top_reg;
- 				else
--					node = node->rb_right;
--
--				continue;
-+					dist = 0;
-+				if (dist < best_dist) {
-+					rbnode = rbnode_tmp;
-+					best_dist = dist;
-+					new_base_reg = min(reg, base_reg);
-+					new_top_reg = max(reg, top_reg);
-+				}
- 			}
- 
--			ret = regcache_rbtree_insert_to_block(map, rbnode_tmp,
-+			/*
-+			 * Keep looking, we want to choose the closest block,
-+			 * otherwise we might end up creating overlapping
-+			 * blocks, which breaks the rbtree.
-+			 */
-+			if (reg < base_reg)
-+				node = node->rb_left;
-+			else if (reg > top_reg)
-+				node = node->rb_right;
-+			else
-+				break;
-+		}
-+
-+		if (rbnode) {
-+			ret = regcache_rbtree_insert_to_block(map, rbnode,
- 							      new_base_reg,
- 							      new_top_reg, reg,
- 							      value);
- 			if (ret)
- 				return ret;
--			rbtree_ctx->cached_rbnode = rbnode_tmp;
-+			rbtree_ctx->cached_rbnode = rbnode;
- 			return 0;
- 		}
- 
-diff --git a/drivers/char/hw_random/omap-rng.c b/drivers/char/hw_random/omap-rng.c
-index 8a1432e..01d4be2 100644
---- a/drivers/char/hw_random/omap-rng.c
-+++ b/drivers/char/hw_random/omap-rng.c
-@@ -384,7 +384,12 @@ static int omap_rng_probe(struct platform_device *pdev)
- 	}
- 
- 	pm_runtime_enable(&pdev->dev);
--	pm_runtime_get_sync(&pdev->dev);
-+	ret = pm_runtime_get_sync(&pdev->dev);
-+	if (ret) {
-+		dev_err(&pdev->dev, "Failed to runtime_get device: %d\n", ret);
-+		pm_runtime_put_noidle(&pdev->dev);
-+		goto err_ioremap;
-+	}
- 
- 	ret = (dev->of_node) ? of_get_omap_rng_device_details(priv, pdev) :
- 				get_omap_rng_device_details(priv);
-@@ -435,8 +440,15 @@ static int __maybe_unused omap_rng_suspend(struct device *dev)
- static int __maybe_unused omap_rng_resume(struct device *dev)
- {
- 	struct omap_rng_dev *priv = dev_get_drvdata(dev);
-+	int ret;
-+
-+	ret = pm_runtime_get_sync(dev);
-+	if (ret) {
-+		dev_err(dev, "Failed to runtime_get device: %d\n", ret);
-+		pm_runtime_put_noidle(dev);
-+		return ret;
-+	}
- 
--	pm_runtime_get_sync(dev);
- 	priv->pdata->init(priv);
- 
- 	return 0;
-diff --git a/drivers/char/tpm/tpm2-cmd.c b/drivers/char/tpm/tpm2-cmd.c
-index b28e4da..ca2d238 100644
---- a/drivers/char/tpm/tpm2-cmd.c
-+++ b/drivers/char/tpm/tpm2-cmd.c
-@@ -703,7 +703,7 @@ ssize_t tpm2_get_tpm_pt(struct tpm_chip *chip, u32 property_id,  u32 *value,
- 
- 	rc = tpm_transmit_cmd(chip, &cmd, sizeof(cmd), desc);
- 	if (!rc)
--		*value = cmd.params.get_tpm_pt_out.value;
-+		*value = be32_to_cpu(cmd.params.get_tpm_pt_out.value);
- 
- 	return rc;
- }
-diff --git a/drivers/char/tpm/tpm_crb.c b/drivers/char/tpm/tpm_crb.c
-index e9fd1d8..0f7ec0d 100644
---- a/drivers/char/tpm/tpm_crb.c
-+++ b/drivers/char/tpm/tpm_crb.c
-@@ -77,7 +77,6 @@ enum crb_flags {
- 
- struct crb_priv {
- 	unsigned int flags;
--	struct resource res;
- 	void __iomem *iobase;
- 	struct crb_control_area __iomem *cca;
- 	u8 __iomem *cmd;
-@@ -224,19 +223,19 @@ static int crb_init(struct acpi_device *device, struct crb_priv *priv)
- 
- static int crb_check_resource(struct acpi_resource *ares, void *data)
- {
--	struct crb_priv *priv = data;
-+	struct resource *io_res = data;
- 	struct resource res;
- 
- 	if (acpi_dev_resource_memory(ares, &res)) {
--		priv->res = res;
--		priv->res.name = NULL;
-+		*io_res = res;
-+		io_res->name = NULL;
- 	}
- 
- 	return 1;
- }
- 
- static void __iomem *crb_map_res(struct device *dev, struct crb_priv *priv,
--				 u64 start, u32 size)
-+				 struct resource *io_res, u64 start, u32 size)
- {
- 	struct resource new_res = {
- 		.start	= start,
-@@ -248,51 +247,72 @@ static void __iomem *crb_map_res(struct device *dev, struct crb_priv *priv,
- 	if (start != new_res.start)
- 		return (void __iomem *) ERR_PTR(-EINVAL);
- 
--	if (!resource_contains(&priv->res, &new_res))
-+	if (!resource_contains(io_res, &new_res))
- 		return devm_ioremap_resource(dev, &new_res);
- 
--	return priv->iobase + (new_res.start - priv->res.start);
-+	return priv->iobase + (new_res.start - io_res->start);
- }
- 
- static int crb_map_io(struct acpi_device *device, struct crb_priv *priv,
- 		      struct acpi_table_tpm2 *buf)
- {
- 	struct list_head resources;
-+	struct resource io_res;
- 	struct device *dev = &device->dev;
--	u64 pa;
-+	u64 cmd_pa;
-+	u32 cmd_size;
-+	u64 rsp_pa;
-+	u32 rsp_size;
- 	int ret;
- 
- 	INIT_LIST_HEAD(&resources);
- 	ret = acpi_dev_get_resources(device, &resources, crb_check_resource,
--				     priv);
-+				     &io_res);
- 	if (ret < 0)
- 		return ret;
- 	acpi_dev_free_resource_list(&resources);
- 
--	if (resource_type(&priv->res) != IORESOURCE_MEM) {
-+	if (resource_type(&io_res) != IORESOURCE_MEM) {
- 		dev_err(dev,
- 			FW_BUG "TPM2 ACPI table does not define a memory resource\n");
- 		return -EINVAL;
- 	}
- 
--	priv->iobase = devm_ioremap_resource(dev, &priv->res);
-+	priv->iobase = devm_ioremap_resource(dev, &io_res);
- 	if (IS_ERR(priv->iobase))
- 		return PTR_ERR(priv->iobase);
- 
--	priv->cca = crb_map_res(dev, priv, buf->control_address, 0x1000);
-+	priv->cca = crb_map_res(dev, priv, &io_res, buf->control_address,
-+				sizeof(struct crb_control_area));
- 	if (IS_ERR(priv->cca))
- 		return PTR_ERR(priv->cca);
- 
--	pa = ((u64) ioread32(&priv->cca->cmd_pa_high) << 32) |
--	      (u64) ioread32(&priv->cca->cmd_pa_low);
--	priv->cmd = crb_map_res(dev, priv, pa, ioread32(&priv->cca->cmd_size));
-+	cmd_pa = ((u64) ioread32(&priv->cca->cmd_pa_high) << 32) |
-+		  (u64) ioread32(&priv->cca->cmd_pa_low);
-+	cmd_size = ioread32(&priv->cca->cmd_size);
-+	priv->cmd = crb_map_res(dev, priv, &io_res, cmd_pa, cmd_size);
- 	if (IS_ERR(priv->cmd))
- 		return PTR_ERR(priv->cmd);
- 
--	memcpy_fromio(&pa, &priv->cca->rsp_pa, 8);
--	pa = le64_to_cpu(pa);
--	priv->rsp = crb_map_res(dev, priv, pa, ioread32(&priv->cca->rsp_size));
--	return PTR_ERR_OR_ZERO(priv->rsp);
-+	memcpy_fromio(&rsp_pa, &priv->cca->rsp_pa, 8);
-+	rsp_pa = le64_to_cpu(rsp_pa);
-+	rsp_size = ioread32(&priv->cca->rsp_size);
-+
-+	if (cmd_pa != rsp_pa) {
-+		priv->rsp = crb_map_res(dev, priv, &io_res, rsp_pa, rsp_size);
-+		return PTR_ERR_OR_ZERO(priv->rsp);
-+	}
-+
-+	/* According to the PTP specification, overlapping command and response
-+	 * buffer sizes must be identical.
-+	 */
-+	if (cmd_size != rsp_size) {
-+		dev_err(dev, FW_BUG "overlapping command and response buffer sizes are not identical");
-+		return -EINVAL;
-+	}
-+
-+	priv->rsp = priv->cmd;
-+	return 0;
- }
- 
- static int crb_acpi_add(struct acpi_device *device)
-diff --git a/drivers/dma/at_xdmac.c b/drivers/dma/at_xdmac.c
-index 75bd662..de9a3d75 100644
---- a/drivers/dma/at_xdmac.c
-+++ b/drivers/dma/at_xdmac.c
-@@ -1195,8 +1195,8 @@ static struct at_xdmac_desc *at_xdmac_memset_create_desc(struct dma_chan *chan,
- 	desc->lld.mbr_cfg = chan_cc;
- 
- 	dev_dbg(chan2dev(chan),
--		"%s: lld: mbr_da=%pad, mbr_ds=%pad, mbr_ubc=0x%08x, mbr_cfg=0x%08x\n",
--		__func__, &desc->lld.mbr_da, &desc->lld.mbr_ds, desc->lld.mbr_ubc,
-+		"%s: lld: mbr_da=%pad, mbr_ds=0x%08x, mbr_ubc=0x%08x, mbr_cfg=0x%08x\n",
-+		__func__, &desc->lld.mbr_da, desc->lld.mbr_ds, desc->lld.mbr_ubc,
- 		desc->lld.mbr_cfg);
- 
- 	return desc;
-@@ -2067,7 +2067,7 @@ err_dma_unregister:
- err_clk_disable:
- 	clk_disable_unprepare(atxdmac->clk);
- err_free_irq:
--	free_irq(atxdmac->irq, atxdmac->dma.dev);
-+	free_irq(atxdmac->irq, atxdmac);
- 	return ret;
- }
- 
-@@ -2081,7 +2081,7 @@ static int at_xdmac_remove(struct platform_device *pdev)
- 	dma_async_device_unregister(&atxdmac->dma);
- 	clk_disable_unprepare(atxdmac->clk);
- 
--	free_irq(atxdmac->irq, atxdmac->dma.dev);
-+	free_irq(atxdmac->irq, atxdmac);
- 
- 	for (i = 0; i < atxdmac->dma.chancnt; i++) {
- 		struct at_xdmac_chan *atchan = &atxdmac->chan[i];
-diff --git a/drivers/dma/bcm2835-dma.c b/drivers/dma/bcm2835-dma.c
-index 6149b27..c8dd5b0 100644
---- a/drivers/dma/bcm2835-dma.c
-+++ b/drivers/dma/bcm2835-dma.c
-@@ -393,11 +393,12 @@ static void bcm2835_dma_fill_cb_chain_with_sg(
- 	unsigned int sg_len)
- {
- 	struct bcm2835_chan *c = to_bcm2835_dma_chan(chan);
--	size_t max_len = bcm2835_dma_max_frame_length(c);
--	unsigned int i, len;
-+	size_t len, max_len;
-+	unsigned int i;
- 	dma_addr_t addr;
- 	struct scatterlist *sgent;
- 
-+	max_len = bcm2835_dma_max_frame_length(c);
- 	for_each_sg(sgl, sgent, sg_len, i) {
- 		for (addr = sg_dma_address(sgent), len = sg_dma_len(sgent);
- 		     len > 0;
-diff --git a/drivers/gpio/gpio-sa1100.c b/drivers/gpio/gpio-sa1100.c
-index 0c99e8f..8d8ee0e 100644
---- a/drivers/gpio/gpio-sa1100.c
-+++ b/drivers/gpio/gpio-sa1100.c
-@@ -155,7 +155,7 @@ static int sa1100_gpio_irqdomain_map(struct irq_domain *d,
- {
- 	irq_set_chip_and_handler(irq, &sa1100_gpio_irq_chip,
- 				 handle_edge_irq);
--	irq_set_noprobe(irq);
-+	irq_set_probe(irq);
- 
- 	return 0;
- }
-diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/fifo/dmanv04.c b/drivers/gpu/drm/nouveau/nvkm/engine/fifo/dmanv04.c
-index edec30f..0a7b6ed 100644
---- a/drivers/gpu/drm/nouveau/nvkm/engine/fifo/dmanv04.c
-+++ b/drivers/gpu/drm/nouveau/nvkm/engine/fifo/dmanv04.c
-@@ -37,7 +37,10 @@ nv04_fifo_dma_object_dtor(struct nvkm_fifo_chan *base, int cookie)
- {
- 	struct nv04_fifo_chan *chan = nv04_fifo_chan(base);
- 	struct nvkm_instmem *imem = chan->fifo->base.engine.subdev.device->imem;
-+
-+	mutex_lock(&chan->fifo->base.engine.subdev.mutex);
- 	nvkm_ramht_remove(imem->ramht, cookie);
-+	mutex_unlock(&chan->fifo->base.engine.subdev.mutex);
- }
- 
- static int
-diff --git a/drivers/gpu/drm/radeon/si_dpm.c b/drivers/gpu/drm/radeon/si_dpm.c
-index e6abc09..1f78ec2 100644
---- a/drivers/gpu/drm/radeon/si_dpm.c
-+++ b/drivers/gpu/drm/radeon/si_dpm.c
-@@ -3015,6 +3015,12 @@ static void si_apply_state_adjust_rules(struct radeon_device *rdev,
- 	if (rdev->pdev->device == 0x6811 &&
- 	    rdev->pdev->revision == 0x81)
- 		max_mclk = 120000;
-+	/* limit sclk/mclk on Jet parts for stability */
-+	if (rdev->pdev->device == 0x6665 &&
-+	    rdev->pdev->revision == 0xc3) {
-+		max_sclk = 75000;
-+		max_mclk = 80000;
-+	}
- 
- 	if (rps->vce_active) {
- 		rps->evclk = rdev->pm.dpm.vce_states[rdev->pm.dpm.vce_level].evclk;
-diff --git a/drivers/gpu/drm/udl/udl_fb.c b/drivers/gpu/drm/udl/udl_fb.c
-index d5df555..cc2daba 100644
---- a/drivers/gpu/drm/udl/udl_fb.c
-+++ b/drivers/gpu/drm/udl/udl_fb.c
-@@ -122,7 +122,7 @@ int udl_handle_damage(struct udl_framebuffer *fb, int x, int y,
- 		return 0;
- 	cmd = urb->transfer_buffer;
- 
--	for (i = y; i < height ; i++) {
-+	for (i = y; i < y + height ; i++) {
- 		const int line_offset = fb->base.pitches[0] * i;
- 		const int byte_offset = line_offset + (x * bpp);
- 		const int dev_byte_offset = (fb->base.width * bpp * i) + (x * bpp);
-diff --git a/drivers/hwmon/adt7411.c b/drivers/hwmon/adt7411.c
-index 827c037..a7f8869 100644
---- a/drivers/hwmon/adt7411.c
-+++ b/drivers/hwmon/adt7411.c
-@@ -30,6 +30,7 @@
- 
- #define ADT7411_REG_CFG1			0x18
- #define ADT7411_CFG1_START_MONITOR		(1 << 0)
-+#define ADT7411_CFG1_RESERVED_BIT3		(1 << 3)
- 
- #define ADT7411_REG_CFG2			0x19
- #define ADT7411_CFG2_DISABLE_AVG		(1 << 5)
-@@ -296,8 +297,10 @@ static int adt7411_probe(struct i2c_client *client,
- 	mutex_init(&data->device_lock);
- 	mutex_init(&data->update_lock);
- 
-+	/* According to the datasheet, we must only write 1 to bit 3 */
- 	ret = adt7411_modify_bit(client, ADT7411_REG_CFG1,
--				 ADT7411_CFG1_START_MONITOR, 1);
-+				 ADT7411_CFG1_RESERVED_BIT3
-+				 | ADT7411_CFG1_START_MONITOR, 1);
- 	if (ret < 0)
- 		return ret;
- 
-diff --git a/drivers/i2c/muxes/i2c-demux-pinctrl.c b/drivers/i2c/muxes/i2c-demux-pinctrl.c
-index 215ac87..e999125 100644
---- a/drivers/i2c/muxes/i2c-demux-pinctrl.c
-+++ b/drivers/i2c/muxes/i2c-demux-pinctrl.c
-@@ -37,8 +37,6 @@ struct i2c_demux_pinctrl_priv {
- 	struct i2c_demux_pinctrl_chan chan[];
- };
- 
--static struct property status_okay = { .name = "status", .length = 3, .value = "ok" };
--
- static int i2c_demux_master_xfer(struct i2c_adapter *adap, struct i2c_msg msgs[], int num)
- {
- 	struct i2c_demux_pinctrl_priv *priv = adap->algo_data;
-@@ -192,6 +190,7 @@ static int i2c_demux_pinctrl_probe(struct platform_device *pdev)
- {
- 	struct device_node *np = pdev->dev.of_node;
- 	struct i2c_demux_pinctrl_priv *priv;
-+	struct property *props;
- 	int num_chan, i, j, err;
- 
- 	num_chan = of_count_phandle_with_args(np, "i2c-parent", NULL);
-@@ -202,7 +201,10 @@ static int i2c_demux_pinctrl_probe(struct platform_device *pdev)
- 
- 	priv = devm_kzalloc(&pdev->dev, sizeof(*priv)
- 			   + num_chan * sizeof(struct i2c_demux_pinctrl_chan), GFP_KERNEL);
--	if (!priv)
-+
-+	props = devm_kcalloc(&pdev->dev, num_chan, sizeof(*props), GFP_KERNEL);
-+
-+	if (!priv || !props)
- 		return -ENOMEM;
- 
- 	err = of_property_read_string(np, "i2c-bus-name", &priv->bus_name);
-@@ -220,8 +222,12 @@ static int i2c_demux_pinctrl_probe(struct platform_device *pdev)
- 		}
- 		priv->chan[i].parent_np = adap_np;
- 
-+		props[i].name = devm_kstrdup(&pdev->dev, "status", GFP_KERNEL);
-+		props[i].value = devm_kstrdup(&pdev->dev, "ok", GFP_KERNEL);
-+		props[i].length = 3;
-+
- 		of_changeset_init(&priv->chan[i].chgset);
--		of_changeset_update_property(&priv->chan[i].chgset, adap_np, &status_okay);
-+		of_changeset_update_property(&priv->chan[i].chgset, adap_np, &props[i]);
- 	}
- 
- 	priv->num_chan = num_chan;
-diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c
-index ad1b1ad..8b5abc4 100644
---- a/drivers/infiniband/core/cma.c
-+++ b/drivers/infiniband/core/cma.c
-@@ -2452,18 +2452,24 @@ static int cma_resolve_iboe_route(struct rdma_id_private *id_priv)
- 
- 	if (addr->dev_addr.bound_dev_if) {
- 		ndev = dev_get_by_index(&init_net, addr->dev_addr.bound_dev_if);
--		if (!ndev)
--			return -ENODEV;
-+		if (!ndev) {
-+			ret = -ENODEV;
-+			goto err2;
-+		}
- 
- 		if (ndev->flags & IFF_LOOPBACK) {
- 			dev_put(ndev);
--			if (!id_priv->id.device->get_netdev)
--				return -EOPNOTSUPP;
-+			if (!id_priv->id.device->get_netdev) {
-+				ret = -EOPNOTSUPP;
-+				goto err2;
-+			}
- 
- 			ndev = id_priv->id.device->get_netdev(id_priv->id.device,
- 							      id_priv->id.port_num);
--			if (!ndev)
--				return -ENODEV;
-+			if (!ndev) {
-+				ret = -ENODEV;
-+				goto err2;
-+			}
- 		}
- 
- 		route->path_rec->net = &init_net;
-diff --git a/drivers/infiniband/core/multicast.c b/drivers/infiniband/core/multicast.c
-index a83ec28..365cb53 100644
---- a/drivers/infiniband/core/multicast.c
-+++ b/drivers/infiniband/core/multicast.c
-@@ -118,7 +118,6 @@ struct mcast_group {
- 	atomic_t		refcount;
- 	enum mcast_group_state	state;
- 	struct ib_sa_query	*query;
--	int			query_id;
- 	u16			pkey_index;
- 	u8			leave_state;
- 	int			retries;
-@@ -352,11 +351,7 @@ static int send_join(struct mcast_group *group, struct mcast_member *member)
- 				       member->multicast.comp_mask,
- 				       3000, GFP_KERNEL, join_handler, group,
- 				       &group->query);
--	if (ret >= 0) {
--		group->query_id = ret;
--		ret = 0;
--	}
--	return ret;
-+	return (ret > 0) ? 0 : ret;
- }
- 
- static int send_leave(struct mcast_group *group, u8 leave_state)
-@@ -376,11 +371,7 @@ static int send_leave(struct mcast_group *group, u8 leave_state)
- 				       IB_SA_MCMEMBER_REC_JOIN_STATE,
- 				       3000, GFP_KERNEL, leave_handler,
- 				       group, &group->query);
--	if (ret >= 0) {
--		group->query_id = ret;
--		ret = 0;
--	}
--	return ret;
-+	return (ret > 0) ? 0 : ret;
- }
- 
- static void join_group(struct mcast_group *group, struct mcast_member *member,
-diff --git a/drivers/infiniband/hw/i40iw/i40iw.h b/drivers/infiniband/hw/i40iw/i40iw.h
-index b738acd..8ec09e4 100644
---- a/drivers/infiniband/hw/i40iw/i40iw.h
-+++ b/drivers/infiniband/hw/i40iw/i40iw.h
-@@ -232,7 +232,7 @@ struct i40iw_device {
- 	struct i40e_client *client;
- 	struct i40iw_hw hw;
- 	struct i40iw_cm_core cm_core;
--	unsigned long *mem_resources;
-+	u8 *mem_resources;
- 	unsigned long *allocated_qps;
- 	unsigned long *allocated_cqs;
- 	unsigned long *allocated_mrs;
-@@ -435,8 +435,8 @@ static inline int i40iw_alloc_resource(struct i40iw_device *iwdev,
- 	*next = resource_num + 1;
- 	if (*next == max_resources)
- 		*next = 0;
--	spin_unlock_irqrestore(&iwdev->resource_lock, flags);
- 	*req_resource_num = resource_num;
-+	spin_unlock_irqrestore(&iwdev->resource_lock, flags);
- 
- 	return 0;
- }
-diff --git a/drivers/infiniband/hw/i40iw/i40iw_cm.c b/drivers/infiniband/hw/i40iw/i40iw_cm.c
-index d2fa725..406a345 100644
---- a/drivers/infiniband/hw/i40iw/i40iw_cm.c
-+++ b/drivers/infiniband/hw/i40iw/i40iw_cm.c
-@@ -535,8 +535,8 @@ static struct i40iw_puda_buf *i40iw_form_cm_frame(struct i40iw_cm_node *cm_node,
- 		buf += hdr_len;
- 	}
- 
--	if (pd_len)
--		memcpy(buf, pdata->addr, pd_len);
-+	if (pdata && pdata->addr)
-+		memcpy(buf, pdata->addr, pdata->size);
- 
- 	atomic_set(&sqbuf->refcount, 1);
- 
-@@ -3347,26 +3347,6 @@ int i40iw_cm_disconn(struct i40iw_qp *iwqp)
- }
- 
- /**
-- * i40iw_loopback_nop - Send a nop
-- * @qp: associated hw qp
-- */
--static void i40iw_loopback_nop(struct i40iw_sc_qp *qp)
--{
--	u64 *wqe;
--	u64 header;
--
--	wqe = qp->qp_uk.sq_base->elem;
--	set_64bit_val(wqe, 0, 0);
--	set_64bit_val(wqe, 8, 0);
--	set_64bit_val(wqe, 16, 0);
--
--	header = LS_64(I40IWQP_OP_NOP, I40IWQPSQ_OPCODE) |
--	    LS_64(0, I40IWQPSQ_SIGCOMPL) |
--	    LS_64(qp->qp_uk.swqe_polarity, I40IWQPSQ_VALID);
--	set_64bit_val(wqe, 24, header);
--}
--
--/**
-  * i40iw_qp_disconnect - free qp and close cm
-  * @iwqp: associate qp for the connection
-  */
-@@ -3638,7 +3618,7 @@ int i40iw_accept(struct iw_cm_id *cm_id, struct iw_cm_conn_param *conn_param)
- 	} else {
- 		if (iwqp->page)
- 			iwqp->sc_qp.qp_uk.sq_base = kmap(iwqp->page);
--		i40iw_loopback_nop(&iwqp->sc_qp);
-+		dev->iw_priv_qp_ops->qp_send_lsmm(&iwqp->sc_qp, NULL, 0, 0);
- 	}
- 
- 	if (iwqp->page)
-diff --git a/drivers/infiniband/hw/i40iw/i40iw_hw.c b/drivers/infiniband/hw/i40iw/i40iw_hw.c
-index 3ee0cad..0c92a40 100644
---- a/drivers/infiniband/hw/i40iw/i40iw_hw.c
-+++ b/drivers/infiniband/hw/i40iw/i40iw_hw.c
-@@ -265,6 +265,7 @@ void i40iw_next_iw_state(struct i40iw_qp *iwqp,
- 		info.dont_send_fin = false;
- 	if (iwqp->sc_qp.term_flags && (state == I40IW_QP_STATE_ERROR))
- 		info.reset_tcp_conn = true;
-+	iwqp->hw_iwarp_state = state;
- 	i40iw_hw_modify_qp(iwqp->iwdev, iwqp, &info, 0);
- }
- 
-diff --git a/drivers/infiniband/hw/i40iw/i40iw_main.c b/drivers/infiniband/hw/i40iw/i40iw_main.c
-index 6e90813..445e230 100644
---- a/drivers/infiniband/hw/i40iw/i40iw_main.c
-+++ b/drivers/infiniband/hw/i40iw/i40iw_main.c
-@@ -100,7 +100,7 @@ static struct notifier_block i40iw_net_notifier = {
- 	.notifier_call = i40iw_net_event
- };
- 
--static int i40iw_notifiers_registered;
-+static atomic_t i40iw_notifiers_registered;
- 
- /**
-  * i40iw_find_i40e_handler - find a handler given a client info
-@@ -1342,12 +1342,11 @@ exit:
-  */
- static void i40iw_register_notifiers(void)
- {
--	if (!i40iw_notifiers_registered) {
-+	if (atomic_inc_return(&i40iw_notifiers_registered) == 1) {
- 		register_inetaddr_notifier(&i40iw_inetaddr_notifier);
- 		register_inet6addr_notifier(&i40iw_inetaddr6_notifier);
- 		register_netevent_notifier(&i40iw_net_notifier);
- 	}
--	i40iw_notifiers_registered++;
- }
- 
- /**
-@@ -1429,8 +1428,7 @@ static void i40iw_deinit_device(struct i40iw_device *iwdev, bool reset, bool del
- 			i40iw_del_macip_entry(iwdev, (u8)iwdev->mac_ip_table_idx);
- 		/* fallthrough */
- 	case INET_NOTIFIER:
--		if (i40iw_notifiers_registered > 0) {
--			i40iw_notifiers_registered--;
-+		if (!atomic_dec_return(&i40iw_notifiers_registered)) {
- 			unregister_netevent_notifier(&i40iw_net_notifier);
- 			unregister_inetaddr_notifier(&i40iw_inetaddr_notifier);
- 			unregister_inet6addr_notifier(&i40iw_inetaddr6_notifier);
-@@ -1558,6 +1556,10 @@ static int i40iw_open(struct i40e_info *ldev, struct i40e_client *client)
- 	enum i40iw_status_code status;
- 	struct i40iw_handler *hdl;
- 
-+	hdl = i40iw_find_netdev(ldev->netdev);
-+	if (hdl)
-+		return 0;
-+
- 	hdl = kzalloc(sizeof(*hdl), GFP_KERNEL);
- 	if (!hdl)
- 		return -ENOMEM;
-diff --git a/drivers/infiniband/hw/i40iw/i40iw_utils.c b/drivers/infiniband/hw/i40iw/i40iw_utils.c
-index 0e8db0a..6fd043b 100644
---- a/drivers/infiniband/hw/i40iw/i40iw_utils.c
-+++ b/drivers/infiniband/hw/i40iw/i40iw_utils.c
-@@ -673,8 +673,11 @@ enum i40iw_status_code i40iw_free_virt_mem(struct i40iw_hw *hw,
- {
- 	if (!mem)
- 		return I40IW_ERR_PARAM;
-+	/*
-+	 * mem->va points to the parent of mem, so both mem and mem->va
-+	 * can not be touched once mem->va is freed
-+	 */
- 	kfree(mem->va);
--	mem->va = NULL;
- 	return 0;
- }
- 
-diff --git a/drivers/infiniband/hw/i40iw/i40iw_verbs.c b/drivers/infiniband/hw/i40iw/i40iw_verbs.c
-index 283b64c..f24bfbd 100644
---- a/drivers/infiniband/hw/i40iw/i40iw_verbs.c
-+++ b/drivers/infiniband/hw/i40iw/i40iw_verbs.c
-@@ -794,7 +794,6 @@ static struct ib_qp *i40iw_create_qp(struct ib_pd *ibpd,
- 	return &iwqp->ibqp;
- error:
- 	i40iw_free_qp_resources(iwdev, iwqp, qp_num);
--	kfree(mem);
- 	return ERR_PTR(err_code);
- }
- 
-@@ -1925,8 +1924,7 @@ static int i40iw_dereg_mr(struct ib_mr *ib_mr)
- 		}
- 		if (iwpbl->pbl_allocated)
- 			i40iw_free_pble(iwdev->pble_rsrc, palloc);
--		kfree(iwpbl->iwmr);
--		iwpbl->iwmr = NULL;
-+		kfree(iwmr);
- 		return 0;
- 	}
- 
-diff --git a/drivers/infiniband/hw/mlx4/mad.c b/drivers/infiniband/hw/mlx4/mad.c
-index 9c2e53d..0f21c3a 100644
---- a/drivers/infiniband/hw/mlx4/mad.c
-+++ b/drivers/infiniband/hw/mlx4/mad.c
-@@ -1128,6 +1128,27 @@ void handle_port_mgmt_change_event(struct work_struct *work)
- 
- 		/* Generate GUID changed event */
- 		if (changed_attr & MLX4_EQ_PORT_INFO_GID_PFX_CHANGE_MASK) {
-+			if (mlx4_is_master(dev->dev)) {
-+				union ib_gid gid;
-+				int err = 0;
-+
-+				if (!eqe->event.port_mgmt_change.params.port_info.gid_prefix)
-+					err = __mlx4_ib_query_gid(&dev->ib_dev, port, 0, &gid, 1);
-+				else
-+					gid.global.subnet_prefix =
-+						eqe->event.port_mgmt_change.params.port_info.gid_prefix;
-+				if (err) {
-+					pr_warn("Could not change QP1 subnet prefix for port %d: query_gid error (%d)\n",
-+						port, err);
-+				} else {
-+					pr_debug("Changing QP1 subnet prefix for port %d. old=0x%llx. new=0x%llx\n",
-+						 port,
-+						 (u64)atomic64_read(&dev->sriov.demux[port - 1].subnet_prefix),
-+						 be64_to_cpu(gid.global.subnet_prefix));
-+					atomic64_set(&dev->sriov.demux[port - 1].subnet_prefix,
-+						     be64_to_cpu(gid.global.subnet_prefix));
-+				}
-+			}
- 			mlx4_ib_dispatch_event(dev, port, IB_EVENT_GID_CHANGE);
- 			/*if master, notify all slaves*/
- 			if (mlx4_is_master(dev->dev))
-@@ -2202,6 +2223,8 @@ int mlx4_ib_init_sriov(struct mlx4_ib_dev *dev)
- 		if (err)
- 			goto demux_err;
- 		dev->sriov.demux[i].guid_cache[0] = gid.global.interface_id;
-+		atomic64_set(&dev->sriov.demux[i].subnet_prefix,
-+			     be64_to_cpu(gid.global.subnet_prefix));
- 		err = alloc_pv_object(dev, mlx4_master_func_num(dev->dev), i + 1,
- 				      &dev->sriov.sqps[i]);
- 		if (err)
-diff --git a/drivers/infiniband/hw/mlx4/mcg.c b/drivers/infiniband/hw/mlx4/mcg.c
-index 8f7ad07..097bfcc 100644
---- a/drivers/infiniband/hw/mlx4/mcg.c
-+++ b/drivers/infiniband/hw/mlx4/mcg.c
-@@ -489,7 +489,7 @@ static u8 get_leave_state(struct mcast_group *group)
- 		if (!group->members[i])
- 			leave_state |= (1 << i);
- 
--	return leave_state & (group->rec.scope_join_state & 7);
-+	return leave_state & (group->rec.scope_join_state & 0xf);
- }
- 
- static int join_group(struct mcast_group *group, int slave, u8 join_mask)
-@@ -564,8 +564,8 @@ static void mlx4_ib_mcg_timeout_handler(struct work_struct *work)
- 		} else
- 			mcg_warn_group(group, "DRIVER BUG\n");
- 	} else if (group->state == MCAST_LEAVE_SENT) {
--		if (group->rec.scope_join_state & 7)
--			group->rec.scope_join_state &= 0xf8;
-+		if (group->rec.scope_join_state & 0xf)
-+			group->rec.scope_join_state &= 0xf0;
- 		group->state = MCAST_IDLE;
- 		mutex_unlock(&group->lock);
- 		if (release_group(group, 1))
-@@ -605,7 +605,7 @@ static int handle_leave_req(struct mcast_group *group, u8 leave_mask,
- static int handle_join_req(struct mcast_group *group, u8 join_mask,
- 			   struct mcast_req *req)
- {
--	u8 group_join_state = group->rec.scope_join_state & 7;
-+	u8 group_join_state = group->rec.scope_join_state & 0xf;
- 	int ref = 0;
- 	u16 status;
- 	struct ib_sa_mcmember_data *sa_data = (struct ib_sa_mcmember_data *)req->sa_mad.data;
-@@ -690,8 +690,8 @@ static void mlx4_ib_mcg_work_handler(struct work_struct *work)
- 			u8 cur_join_state;
- 
- 			resp_join_state = ((struct ib_sa_mcmember_data *)
--						group->response_sa_mad.data)->scope_join_state & 7;
--			cur_join_state = group->rec.scope_join_state & 7;
-+						group->response_sa_mad.data)->scope_join_state & 0xf;
-+			cur_join_state = group->rec.scope_join_state & 0xf;
- 
- 			if (method == IB_MGMT_METHOD_GET_RESP) {
- 				/* successfull join */
-@@ -710,7 +710,7 @@ process_requests:
- 		req = list_first_entry(&group->pending_list, struct mcast_req,
- 				       group_list);
- 		sa_data = (struct ib_sa_mcmember_data *)req->sa_mad.data;
--		req_join_state = sa_data->scope_join_state & 0x7;
-+		req_join_state = sa_data->scope_join_state & 0xf;
- 
- 		/* For a leave request, we will immediately answer the VF, and
- 		 * update our internal counters. The actual leave will be sent
-diff --git a/drivers/infiniband/hw/mlx4/mlx4_ib.h b/drivers/infiniband/hw/mlx4/mlx4_ib.h
-index 29acda2..d4ca381 100644
---- a/drivers/infiniband/hw/mlx4/mlx4_ib.h
-+++ b/drivers/infiniband/hw/mlx4/mlx4_ib.h
-@@ -448,7 +448,7 @@ struct mlx4_ib_demux_ctx {
- 	struct workqueue_struct *wq;
- 	struct workqueue_struct *ud_wq;
- 	spinlock_t ud_lock;
--	__be64 subnet_prefix;
-+	atomic64_t subnet_prefix;
- 	__be64 guid_cache[128];
- 	struct mlx4_ib_dev *dev;
- 	/* the following lock protects both mcg_table and mcg_mgid0_list */
-diff --git a/drivers/infiniband/hw/mlx4/qp.c b/drivers/infiniband/hw/mlx4/qp.c
-index 8db8405..d995222 100644
---- a/drivers/infiniband/hw/mlx4/qp.c
-+++ b/drivers/infiniband/hw/mlx4/qp.c
-@@ -2492,24 +2492,27 @@ static int build_mlx_header(struct mlx4_ib_sqp *sqp, struct ib_ud_wr *wr,
- 		sqp->ud_header.grh.flow_label    =
- 			ah->av.ib.sl_tclass_flowlabel & cpu_to_be32(0xfffff);
- 		sqp->ud_header.grh.hop_limit     = ah->av.ib.hop_limit;
--		if (is_eth)
-+		if (is_eth) {
- 			memcpy(sqp->ud_header.grh.source_gid.raw, sgid.raw, 16);
--		else {
--		if (mlx4_is_mfunc(to_mdev(ib_dev)->dev)) {
--			/* When multi-function is enabled, the ib_core gid
--			 * indexes don't necessarily match the hw ones, so
--			 * we must use our own cache */
--			sqp->ud_header.grh.source_gid.global.subnet_prefix =
--				to_mdev(ib_dev)->sriov.demux[sqp->qp.port - 1].
--						       subnet_prefix;
--			sqp->ud_header.grh.source_gid.global.interface_id =
--				to_mdev(ib_dev)->sriov.demux[sqp->qp.port - 1].
--					       guid_cache[ah->av.ib.gid_index];
--		} else
--			ib_get_cached_gid(ib_dev,
--					  be32_to_cpu(ah->av.ib.port_pd) >> 24,
--					  ah->av.ib.gid_index,
--					  &sqp->ud_header.grh.source_gid, NULL);
-+		} else {
-+			if (mlx4_is_mfunc(to_mdev(ib_dev)->dev)) {
-+				/* When multi-function is enabled, the ib_core gid
-+				 * indexes don't necessarily match the hw ones, so
-+				 * we must use our own cache
-+				 */
-+				sqp->ud_header.grh.source_gid.global.subnet_prefix =
-+					cpu_to_be64(atomic64_read(&(to_mdev(ib_dev)->sriov.
-+								    demux[sqp->qp.port - 1].
-+								    subnet_prefix)));
-+				sqp->ud_header.grh.source_gid.global.interface_id =
-+					to_mdev(ib_dev)->sriov.demux[sqp->qp.port - 1].
-+						       guid_cache[ah->av.ib.gid_index];
-+			} else {
-+				ib_get_cached_gid(ib_dev,
-+						  be32_to_cpu(ah->av.ib.port_pd) >> 24,
-+						  ah->av.ib.gid_index,
-+						  &sqp->ud_header.grh.source_gid, NULL);
-+			}
- 		}
- 		memcpy(sqp->ud_header.grh.destination_gid.raw,
- 		       ah->av.ib.dgid, 16);
-diff --git a/drivers/infiniband/hw/mlx5/main.c b/drivers/infiniband/hw/mlx5/main.c
-index b48ad85..c90f575 100644
---- a/drivers/infiniband/hw/mlx5/main.c
-+++ b/drivers/infiniband/hw/mlx5/main.c
-@@ -287,7 +287,9 @@ __be16 mlx5_get_roce_udp_sport(struct mlx5_ib_dev *dev, u8 port_num,
- 
- static int mlx5_use_mad_ifc(struct mlx5_ib_dev *dev)
- {
--	return !MLX5_CAP_GEN(dev->mdev, ib_virt);
-+	if (MLX5_CAP_GEN(dev->mdev, port_type) == MLX5_CAP_PORT_TYPE_IB)
-+		return !MLX5_CAP_GEN(dev->mdev, ib_virt);
-+	return 0;
- }
- 
- enum {
-@@ -1275,6 +1277,13 @@ static int parse_flow_attr(u32 *match_c, u32 *match_v,
- 					     dmac_47_16),
- 				ib_spec->eth.val.dst_mac);
- 
-+		ether_addr_copy(MLX5_ADDR_OF(fte_match_set_lyr_2_4, outer_headers_c,
-+					     smac_47_16),
-+				ib_spec->eth.mask.src_mac);
-+		ether_addr_copy(MLX5_ADDR_OF(fte_match_set_lyr_2_4, outer_headers_v,
-+					     smac_47_16),
-+				ib_spec->eth.val.src_mac);
-+
- 		if (ib_spec->eth.mask.vlan_tag) {
- 			MLX5_SET(fte_match_set_lyr_2_4, outer_headers_c,
- 				 vlan_tag, 1);
-diff --git a/drivers/infiniband/ulp/ipoib/ipoib.h b/drivers/infiniband/ulp/ipoib/ipoib.h
-index 4f7d9b4..9dbfcc0 100644
---- a/drivers/infiniband/ulp/ipoib/ipoib.h
-+++ b/drivers/infiniband/ulp/ipoib/ipoib.h
-@@ -478,6 +478,7 @@ void ipoib_send(struct net_device *dev, struct sk_buff *skb,
- 		struct ipoib_ah *address, u32 qpn);
- void ipoib_reap_ah(struct work_struct *work);
- 
-+struct ipoib_path *__path_find(struct net_device *dev, void *gid);
- void ipoib_mark_paths_invalid(struct net_device *dev);
- void ipoib_flush_paths(struct net_device *dev);
- int ipoib_check_sm_sendonly_fullmember_support(struct ipoib_dev_priv *priv);
-diff --git a/drivers/infiniband/ulp/ipoib/ipoib_cm.c b/drivers/infiniband/ulp/ipoib/ipoib_cm.c
-index 951d9ab..4ad297d 100644
---- a/drivers/infiniband/ulp/ipoib/ipoib_cm.c
-+++ b/drivers/infiniband/ulp/ipoib/ipoib_cm.c
-@@ -1318,6 +1318,8 @@ void ipoib_cm_destroy_tx(struct ipoib_cm_tx *tx)
- 	}
- }
- 
-+#define QPN_AND_OPTIONS_OFFSET	4
-+
- static void ipoib_cm_tx_start(struct work_struct *work)
- {
- 	struct ipoib_dev_priv *priv = container_of(work, struct ipoib_dev_priv,
-@@ -1326,6 +1328,7 @@ static void ipoib_cm_tx_start(struct work_struct *work)
- 	struct ipoib_neigh *neigh;
- 	struct ipoib_cm_tx *p;
- 	unsigned long flags;
-+	struct ipoib_path *path;
- 	int ret;
- 
- 	struct ib_sa_path_rec pathrec;
-@@ -1338,7 +1341,19 @@ static void ipoib_cm_tx_start(struct work_struct *work)
- 		p = list_entry(priv->cm.start_list.next, typeof(*p), list);
- 		list_del_init(&p->list);
- 		neigh = p->neigh;
-+
- 		qpn = IPOIB_QPN(neigh->daddr);
-+		/*
-+		 * As long as the search is with these 2 locks,
-+		 * path existence indicates its validity.
-+		 */
-+		path = __path_find(dev, neigh->daddr + QPN_AND_OPTIONS_OFFSET);
-+		if (!path) {
-+			pr_info("%s ignore not valid path %pI6\n",
-+				__func__,
-+				neigh->daddr + QPN_AND_OPTIONS_OFFSET);
-+			goto free_neigh;
-+		}
- 		memcpy(&pathrec, &p->path->pathrec, sizeof pathrec);
- 
- 		spin_unlock_irqrestore(&priv->lock, flags);
-@@ -1350,6 +1365,7 @@ static void ipoib_cm_tx_start(struct work_struct *work)
- 		spin_lock_irqsave(&priv->lock, flags);
- 
- 		if (ret) {
-+free_neigh:
- 			neigh = p->neigh;
- 			if (neigh) {
- 				neigh->cm = NULL;
-diff --git a/drivers/infiniband/ulp/ipoib/ipoib_ib.c b/drivers/infiniband/ulp/ipoib/ipoib_ib.c
-index dc6d241..be11d5d 100644
---- a/drivers/infiniband/ulp/ipoib/ipoib_ib.c
-+++ b/drivers/infiniband/ulp/ipoib/ipoib_ib.c
-@@ -1161,8 +1161,17 @@ static void __ipoib_ib_dev_flush(struct ipoib_dev_priv *priv,
- 	}
- 
- 	if (level == IPOIB_FLUSH_LIGHT) {
-+		int oper_up;
- 		ipoib_mark_paths_invalid(dev);
-+		/* Set IPoIB operation as down to prevent races between:
-+		 * the flush flow which leaves MCG and on the fly joins
-+		 * which can happen during that time. mcast restart task
-+		 * should deal with join requests we missed.
-+		 */
-+		oper_up = test_and_clear_bit(IPOIB_FLAG_OPER_UP, &priv->flags);
- 		ipoib_mcast_dev_flush(dev);
-+		if (oper_up)
-+			set_bit(IPOIB_FLAG_OPER_UP, &priv->flags);
- 		ipoib_flush_ah(dev);
- 	}
- 
-diff --git a/drivers/infiniband/ulp/ipoib/ipoib_main.c b/drivers/infiniband/ulp/ipoib/ipoib_main.c
-index 5f58c41..ddebda5 100644
---- a/drivers/infiniband/ulp/ipoib/ipoib_main.c
-+++ b/drivers/infiniband/ulp/ipoib/ipoib_main.c
-@@ -485,7 +485,7 @@ int ipoib_set_mode(struct net_device *dev, const char *buf)
- 	return -EINVAL;
- }
- 
--static struct ipoib_path *__path_find(struct net_device *dev, void *gid)
-+struct ipoib_path *__path_find(struct net_device *dev, void *gid)
- {
- 	struct ipoib_dev_priv *priv = netdev_priv(dev);
- 	struct rb_node *n = priv->path_tree.rb_node;
-diff --git a/drivers/irqchip/irq-gic-v3.c b/drivers/irqchip/irq-gic-v3.c
-index 2c5ba0e..53891c3 100644
---- a/drivers/irqchip/irq-gic-v3.c
-+++ b/drivers/irqchip/irq-gic-v3.c
-@@ -558,7 +558,7 @@ static struct notifier_block gic_cpu_notifier = {
- static u16 gic_compute_target_list(int *base_cpu, const struct cpumask *mask,
- 				   unsigned long cluster_id)
- {
--	int cpu = *base_cpu;
-+	int next_cpu, cpu = *base_cpu;
- 	unsigned long mpidr = cpu_logical_map(cpu);
- 	u16 tlist = 0;
- 
-@@ -572,9 +572,10 @@ static u16 gic_compute_target_list(int *base_cpu, const struct cpumask *mask,
- 
- 		tlist |= 1 << (mpidr & 0xf);
- 
--		cpu = cpumask_next(cpu, mask);
--		if (cpu >= nr_cpu_ids)
-+		next_cpu = cpumask_next(cpu, mask);
-+		if (next_cpu >= nr_cpu_ids)
- 			goto out;
-+		cpu = next_cpu;
- 
- 		mpidr = cpu_logical_map(cpu);
- 
-diff --git a/drivers/mailbox/mailbox-test.c b/drivers/mailbox/mailbox-test.c
-index 58d0472..9ca96e9 100644
---- a/drivers/mailbox/mailbox-test.c
-+++ b/drivers/mailbox/mailbox-test.c
-@@ -133,6 +133,7 @@ static ssize_t mbox_test_message_write(struct file *filp,
- out:
- 	kfree(tdev->signal);
- 	kfree(tdev->message);
-+	tdev->signal = NULL;
- 
- 	return ret < 0 ? ret : count;
- }
-diff --git a/drivers/md/dm-log-writes.c b/drivers/md/dm-log-writes.c
-index d8f8cc8..dd23075 100644
---- a/drivers/md/dm-log-writes.c
-+++ b/drivers/md/dm-log-writes.c
-@@ -259,7 +259,7 @@ static int log_one_block(struct log_writes_c *lc,
- 	sector++;
- 
- 	atomic_inc(&lc->io_blocks);
--	bio = bio_alloc(GFP_KERNEL, block->vec_cnt);
-+	bio = bio_alloc(GFP_KERNEL, min(block->vec_cnt, BIO_MAX_PAGES));
- 	if (!bio) {
- 		DMERR("Couldn't alloc log bio");
- 		goto error;
-@@ -280,7 +280,7 @@ static int log_one_block(struct log_writes_c *lc,
- 		if (ret != block->vecs[i].bv_len) {
- 			atomic_inc(&lc->io_blocks);
- 			submit_bio(WRITE, bio);
--			bio = bio_alloc(GFP_KERNEL, block->vec_cnt - i);
-+			bio = bio_alloc(GFP_KERNEL, min(block->vec_cnt - i, BIO_MAX_PAGES));
- 			if (!bio) {
- 				DMERR("Couldn't alloc log bio");
- 				goto error;
-diff --git a/drivers/media/platform/vsp1/vsp1_pipe.c b/drivers/media/platform/vsp1/vsp1_pipe.c
-index 4f3b4a1..3c8f40b 100644
---- a/drivers/media/platform/vsp1/vsp1_pipe.c
-+++ b/drivers/media/platform/vsp1/vsp1_pipe.c
-@@ -172,13 +172,17 @@ void vsp1_pipeline_reset(struct vsp1_pipeline *pipe)
- 			bru->inputs[i].rpf = NULL;
- 	}
- 
--	for (i = 0; i < pipe->num_inputs; ++i) {
--		pipe->inputs[i]->pipe = NULL;
--		pipe->inputs[i] = NULL;
-+	for (i = 0; i < ARRAY_SIZE(pipe->inputs); ++i) {
-+		if (pipe->inputs[i]) {
-+			pipe->inputs[i]->pipe = NULL;
-+			pipe->inputs[i] = NULL;
-+		}
- 	}
- 
--	pipe->output->pipe = NULL;
--	pipe->output = NULL;
-+	if (pipe->output) {
-+		pipe->output->pipe = NULL;
-+		pipe->output = NULL;
-+	}
- 
- 	INIT_LIST_HEAD(&pipe->entities);
- 	pipe->state = VSP1_PIPELINE_STOPPED;
-diff --git a/drivers/media/usb/em28xx/em28xx-i2c.c b/drivers/media/usb/em28xx/em28xx-i2c.c
-index a19b5c8..1a9e1e5 100644
---- a/drivers/media/usb/em28xx/em28xx-i2c.c
-+++ b/drivers/media/usb/em28xx/em28xx-i2c.c
-@@ -507,9 +507,8 @@ static int em28xx_i2c_xfer(struct i2c_adapter *i2c_adap,
- 	if (dev->disconnected)
- 		return -ENODEV;
- 
--	rc = rt_mutex_trylock(&dev->i2c_bus_lock);
--	if (rc < 0)
--		return rc;
-+	if (!rt_mutex_trylock(&dev->i2c_bus_lock))
-+		return -EAGAIN;
- 
- 	/* Switch I2C bus if needed */
- 	if (bus != dev->cur_i2c_bus &&
-diff --git a/drivers/media/usb/gspca/cpia1.c b/drivers/media/usb/gspca/cpia1.c
-index f23df4a9..52b88e9 100644
---- a/drivers/media/usb/gspca/cpia1.c
-+++ b/drivers/media/usb/gspca/cpia1.c
-@@ -1624,7 +1624,7 @@ static int sd_start(struct gspca_dev *gspca_dev)
- 
- static void sd_stopN(struct gspca_dev *gspca_dev)
- {
--	struct sd *sd = (struct sd *) gspca_dev;
-+	struct sd *sd __maybe_unused = (struct sd *) gspca_dev;
- 
- 	command_pause(gspca_dev);
- 
-diff --git a/drivers/media/usb/gspca/konica.c b/drivers/media/usb/gspca/konica.c
-index 39c96bb..0712b1b 100644
---- a/drivers/media/usb/gspca/konica.c
-+++ b/drivers/media/usb/gspca/konica.c
-@@ -243,7 +243,7 @@ static int sd_start(struct gspca_dev *gspca_dev)
- 
- static void sd_stopN(struct gspca_dev *gspca_dev)
- {
--	struct sd *sd = (struct sd *) gspca_dev;
-+	struct sd *sd __maybe_unused = (struct sd *) gspca_dev;
- 
- 	konica_stream_off(gspca_dev);
- #if IS_ENABLED(CONFIG_INPUT)
-diff --git a/drivers/media/usb/gspca/t613.c b/drivers/media/usb/gspca/t613.c
-index e2cc4e5..bb52fc1 100644
---- a/drivers/media/usb/gspca/t613.c
-+++ b/drivers/media/usb/gspca/t613.c
-@@ -837,7 +837,7 @@ static void sd_pkt_scan(struct gspca_dev *gspca_dev,
- 			u8 *data,			/* isoc packet */
- 			int len)			/* iso packet length */
- {
--	struct sd *sd = (struct sd *) gspca_dev;
-+	struct sd *sd __maybe_unused = (struct sd *) gspca_dev;
- 	int pkt_type;
- 
- 	if (data[0] == 0x5a) {
-diff --git a/drivers/misc/cxl/guest.c b/drivers/misc/cxl/guest.c
-index bc8d0b9..df65193 100644
---- a/drivers/misc/cxl/guest.c
-+++ b/drivers/misc/cxl/guest.c
-@@ -1052,16 +1052,18 @@ static void free_adapter(struct cxl *adapter)
- 	struct irq_avail *cur;
- 	int i;
- 
--	if (adapter->guest->irq_avail) {
--		for (i = 0; i < adapter->guest->irq_nranges; i++) {
--			cur = &adapter->guest->irq_avail[i];
--			kfree(cur->bitmap);
-+	if (adapter->guest) {
-+		if (adapter->guest->irq_avail) {
-+			for (i = 0; i < adapter->guest->irq_nranges; i++) {
-+				cur = &adapter->guest->irq_avail[i];
-+				kfree(cur->bitmap);
-+			}
-+			kfree(adapter->guest->irq_avail);
- 		}
--		kfree(adapter->guest->irq_avail);
-+		kfree(adapter->guest->status);
-+		kfree(adapter->guest);
- 	}
--	kfree(adapter->guest->status);
- 	cxl_remove_adapter_nr(adapter);
--	kfree(adapter->guest);
- 	kfree(adapter);
- }
- 
-diff --git a/drivers/mmc/host/sdhci-tegra.c b/drivers/mmc/host/sdhci-tegra.c
-index bcc0de4..bd11998 100644
---- a/drivers/mmc/host/sdhci-tegra.c
-+++ b/drivers/mmc/host/sdhci-tegra.c
-@@ -148,28 +148,37 @@ static void tegra_sdhci_reset(struct sdhci_host *host, u8 mask)
- 		return;
- 
- 	misc_ctrl = sdhci_readl(host, SDHCI_TEGRA_VENDOR_MISC_CTRL);
--	/* Erratum: Enable SDHCI spec v3.00 support */
--	if (soc_data->nvquirks & NVQUIRK_ENABLE_SDHCI_SPEC_300)
--		misc_ctrl |= SDHCI_MISC_CTRL_ENABLE_SDHCI_SPEC_300;
--	/* Advertise UHS modes as supported by host */
--	if (soc_data->nvquirks & NVQUIRK_ENABLE_SDR50)
--		misc_ctrl |= SDHCI_MISC_CTRL_ENABLE_SDR50;
--	else
--		misc_ctrl &= ~SDHCI_MISC_CTRL_ENABLE_SDR50;
--	if (soc_data->nvquirks & NVQUIRK_ENABLE_DDR50)
--		misc_ctrl |= SDHCI_MISC_CTRL_ENABLE_DDR50;
--	else
--		misc_ctrl &= ~SDHCI_MISC_CTRL_ENABLE_DDR50;
--	if (soc_data->nvquirks & NVQUIRK_ENABLE_SDR104)
--		misc_ctrl |= SDHCI_MISC_CTRL_ENABLE_SDR104;
--	else
--		misc_ctrl &= ~SDHCI_MISC_CTRL_ENABLE_SDR104;
--	sdhci_writel(host, misc_ctrl, SDHCI_TEGRA_VENDOR_MISC_CTRL);
--
- 	clk_ctrl = sdhci_readl(host, SDHCI_TEGRA_VENDOR_CLOCK_CTRL);
-+
-+	misc_ctrl &= ~(SDHCI_MISC_CTRL_ENABLE_SDHCI_SPEC_300 |
-+		       SDHCI_MISC_CTRL_ENABLE_SDR50 |
-+		       SDHCI_MISC_CTRL_ENABLE_DDR50 |
-+		       SDHCI_MISC_CTRL_ENABLE_SDR104);
-+
- 	clk_ctrl &= ~SDHCI_CLOCK_CTRL_SPI_MODE_CLKEN_OVERRIDE;
--	if (soc_data->nvquirks & SDHCI_MISC_CTRL_ENABLE_SDR50)
--		clk_ctrl |= SDHCI_CLOCK_CTRL_SDR50_TUNING_OVERRIDE;
-+
-+	/*
-+	 * If the board does not define a regulator for the SDHCI
-+	 * IO voltage, then don't advertise support for UHS modes
-+	 * even if the device supports it because the IO voltage
-+	 * cannot be configured.
-+	 */
-+	if (!IS_ERR(host->mmc->supply.vqmmc)) {
-+		/* Erratum: Enable SDHCI spec v3.00 support */
-+		if (soc_data->nvquirks & NVQUIRK_ENABLE_SDHCI_SPEC_300)
-+			misc_ctrl |= SDHCI_MISC_CTRL_ENABLE_SDHCI_SPEC_300;
-+		/* Advertise UHS modes as supported by host */
-+		if (soc_data->nvquirks & NVQUIRK_ENABLE_SDR50)
-+			misc_ctrl |= SDHCI_MISC_CTRL_ENABLE_SDR50;
-+		if (soc_data->nvquirks & NVQUIRK_ENABLE_DDR50)
-+			misc_ctrl |= SDHCI_MISC_CTRL_ENABLE_DDR50;
-+		if (soc_data->nvquirks & NVQUIRK_ENABLE_SDR104)
-+			misc_ctrl |= SDHCI_MISC_CTRL_ENABLE_SDR104;
-+		if (soc_data->nvquirks & SDHCI_MISC_CTRL_ENABLE_SDR50)
-+			clk_ctrl |= SDHCI_CLOCK_CTRL_SDR50_TUNING_OVERRIDE;
-+	}
-+
-+	sdhci_writel(host, misc_ctrl, SDHCI_TEGRA_VENDOR_MISC_CTRL);
- 	sdhci_writel(host, clk_ctrl, SDHCI_TEGRA_VENDOR_CLOCK_CTRL);
- 
- 	if (soc_data->nvquirks & NVQUIRK_HAS_PADCALIB)
-diff --git a/drivers/mtd/nand/davinci_nand.c b/drivers/mtd/nand/davinci_nand.c
-index cc07ba0..27fa8b8 100644
---- a/drivers/mtd/nand/davinci_nand.c
-+++ b/drivers/mtd/nand/davinci_nand.c
-@@ -240,6 +240,9 @@ static void nand_davinci_hwctl_4bit(struct mtd_info *mtd, int mode)
- 	unsigned long flags;
- 	u32 val;
- 
-+	/* Reset ECC hardware */
-+	davinci_nand_readl(info, NAND_4BIT_ECC1_OFFSET);
-+
- 	spin_lock_irqsave(&davinci_nand_lock, flags);
- 
- 	/* Start 4-bit ECC calculation for read/write */
-diff --git a/drivers/net/can/dev.c b/drivers/net/can/dev.c
-index ad535a8..eab1327 100644
---- a/drivers/net/can/dev.c
-+++ b/drivers/net/can/dev.c
-@@ -21,6 +21,7 @@
- #include <linux/slab.h>
- #include <linux/netdevice.h>
- #include <linux/if_arp.h>
-+#include <linux/workqueue.h>
- #include <linux/can.h>
- #include <linux/can/dev.h>
- #include <linux/can/skb.h>
-@@ -471,9 +472,8 @@ EXPORT_SYMBOL_GPL(can_free_echo_skb);
- /*
-  * CAN device restart for bus-off recovery
-  */
--static void can_restart(unsigned long data)
-+static void can_restart(struct net_device *dev)
- {
--	struct net_device *dev = (struct net_device *)data;
- 	struct can_priv *priv = netdev_priv(dev);
- 	struct net_device_stats *stats = &dev->stats;
- 	struct sk_buff *skb;
-@@ -513,6 +513,14 @@ restart:
- 		netdev_err(dev, "Error %d during restart", err);
- }
- 
-+static void can_restart_work(struct work_struct *work)
-+{
-+	struct delayed_work *dwork = to_delayed_work(work);
-+	struct can_priv *priv = container_of(dwork, struct can_priv, restart_work);
-+
-+	can_restart(priv->dev);
-+}
-+
- int can_restart_now(struct net_device *dev)
- {
- 	struct can_priv *priv = netdev_priv(dev);
-@@ -526,8 +534,8 @@ int can_restart_now(struct net_device *dev)
- 	if (priv->state != CAN_STATE_BUS_OFF)
- 		return -EBUSY;
- 
--	/* Runs as soon as possible in the timer context */
--	mod_timer(&priv->restart_timer, jiffies);
-+	cancel_delayed_work_sync(&priv->restart_work);
-+	can_restart(dev);
- 
- 	return 0;
- }
-@@ -548,8 +556,8 @@ void can_bus_off(struct net_device *dev)
- 	netif_carrier_off(dev);
- 
- 	if (priv->restart_ms)
--		mod_timer(&priv->restart_timer,
--			  jiffies + (priv->restart_ms * HZ) / 1000);
-+		schedule_delayed_work(&priv->restart_work,
-+				      msecs_to_jiffies(priv->restart_ms));
- }
- EXPORT_SYMBOL_GPL(can_bus_off);
- 
-@@ -658,6 +666,7 @@ struct net_device *alloc_candev(int sizeof_priv, unsigned int echo_skb_max)
- 		return NULL;
- 
- 	priv = netdev_priv(dev);
-+	priv->dev = dev;
- 
- 	if (echo_skb_max) {
- 		priv->echo_skb_max = echo_skb_max;
-@@ -667,7 +676,7 @@ struct net_device *alloc_candev(int sizeof_priv, unsigned int echo_skb_max)
- 
- 	priv->state = CAN_STATE_STOPPED;
- 
--	init_timer(&priv->restart_timer);
-+	INIT_DELAYED_WORK(&priv->restart_work, can_restart_work);
- 
- 	return dev;
- }
-@@ -748,8 +757,6 @@ int open_candev(struct net_device *dev)
- 	if (!netif_carrier_ok(dev))
- 		netif_carrier_on(dev);
- 
--	setup_timer(&priv->restart_timer, can_restart, (unsigned long)dev);
--
- 	return 0;
- }
- EXPORT_SYMBOL_GPL(open_candev);
-@@ -764,7 +771,7 @@ void close_candev(struct net_device *dev)
- {
- 	struct can_priv *priv = netdev_priv(dev);
- 
--	del_timer_sync(&priv->restart_timer);
-+	cancel_delayed_work_sync(&priv->restart_work);
- 	can_flush_echo_skb(dev);
- }
- EXPORT_SYMBOL_GPL(close_candev);
-diff --git a/drivers/net/ethernet/intel/fm10k/fm10k_ethtool.c b/drivers/net/ethernet/intel/fm10k/fm10k_ethtool.c
-index 9c0d875..9b51954 100644
---- a/drivers/net/ethernet/intel/fm10k/fm10k_ethtool.c
-+++ b/drivers/net/ethernet/intel/fm10k/fm10k_ethtool.c
-@@ -983,9 +983,10 @@ void fm10k_write_reta(struct fm10k_intfc *interface, const u32 *indir)
- 		/* generate a new table if we weren't given one */
- 		for (j = 0; j < 4; j++) {
- 			if (indir)
--				n = indir[i + j];
-+				n = indir[4 * i + j];
- 			else
--				n = ethtool_rxfh_indir_default(i + j, rss_i);
-+				n = ethtool_rxfh_indir_default(4 * i + j,
-+							       rss_i);
- 
- 			table[j] = n;
- 		}
-diff --git a/drivers/net/ethernet/intel/i40e/i40e_common.c b/drivers/net/ethernet/intel/i40e/i40e_common.c
-index 422b41d..d5cb570 100644
---- a/drivers/net/ethernet/intel/i40e/i40e_common.c
-+++ b/drivers/net/ethernet/intel/i40e/i40e_common.c
-@@ -297,13 +297,15 @@ void i40e_debug_aq(struct i40e_hw *hw, enum i40e_debug_mask mask, void *desc,
- 		   void *buffer, u16 buf_len)
- {
- 	struct i40e_aq_desc *aq_desc = (struct i40e_aq_desc *)desc;
--	u16 len = le16_to_cpu(aq_desc->datalen);
-+	u16 len;
- 	u8 *buf = (u8 *)buffer;
- 	u16 i = 0;
- 
- 	if ((!(mask & hw->debug_mask)) || (desc == NULL))
- 		return;
- 
-+	len = le16_to_cpu(aq_desc->datalen);
-+
- 	i40e_debug(hw, mask,
- 		   "AQ CMD: opcode 0x%04X, flags 0x%04X, datalen 0x%04X, retval 0x%04X\n",
- 		   le16_to_cpu(aq_desc->opcode),
-diff --git a/drivers/net/wireless/ath/ath10k/htt_rx.c b/drivers/net/wireless/ath/ath10k/htt_rx.c
-index 813cdd2..d3f8b9f 100644
---- a/drivers/net/wireless/ath/ath10k/htt_rx.c
-+++ b/drivers/net/wireless/ath/ath10k/htt_rx.c
-@@ -1524,7 +1524,7 @@ static void ath10k_htt_rx_h_filter(struct ath10k *ar,
- static int ath10k_htt_rx_handle_amsdu(struct ath10k_htt *htt)
- {
- 	struct ath10k *ar = htt->ar;
--	static struct ieee80211_rx_status rx_status;
-+	struct ieee80211_rx_status *rx_status = &htt->rx_status;
- 	struct sk_buff_head amsdu;
- 	int ret;
- 
-@@ -1548,11 +1548,11 @@ static int ath10k_htt_rx_handle_amsdu(struct ath10k_htt *htt)
- 		return ret;
- 	}
- 
--	ath10k_htt_rx_h_ppdu(ar, &amsdu, &rx_status, 0xffff);
-+	ath10k_htt_rx_h_ppdu(ar, &amsdu, rx_status, 0xffff);
- 	ath10k_htt_rx_h_unchain(ar, &amsdu, ret > 0);
--	ath10k_htt_rx_h_filter(ar, &amsdu, &rx_status);
--	ath10k_htt_rx_h_mpdu(ar, &amsdu, &rx_status);
--	ath10k_htt_rx_h_deliver(ar, &amsdu, &rx_status);
-+	ath10k_htt_rx_h_filter(ar, &amsdu, rx_status);
-+	ath10k_htt_rx_h_mpdu(ar, &amsdu, rx_status);
-+	ath10k_htt_rx_h_deliver(ar, &amsdu, rx_status);
- 
- 	return 0;
- }
-diff --git a/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c b/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
-index dec1a31..e2083f4 100644
---- a/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
-+++ b/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
-@@ -4176,7 +4176,7 @@ static void ath9k_hw_ar9300_set_board_values(struct ath_hw *ah,
- 	if (!AR_SREV_9330(ah) && !AR_SREV_9340(ah) && !AR_SREV_9531(ah))
- 		ar9003_hw_internal_regulator_apply(ah);
- 	ar9003_hw_apply_tuning_caps(ah);
--	ar9003_hw_apply_minccapwr_thresh(ah, chan);
-+	ar9003_hw_apply_minccapwr_thresh(ah, is2ghz);
- 	ar9003_hw_txend_to_xpa_off_apply(ah, is2ghz);
- 	ar9003_hw_thermometer_apply(ah);
- 	ar9003_hw_thermo_cal_apply(ah);
-diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
-index c7550da..570c80a 100644
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
-@@ -722,8 +722,10 @@ int brcmf_sdiod_recv_chain(struct brcmf_sdio_dev *sdiodev,
- 			return -ENOMEM;
- 		err = brcmf_sdiod_buffrw(sdiodev, SDIO_FUNC_2, false, addr,
- 					 glom_skb);
--		if (err)
-+		if (err) {
-+			brcmu_pkt_buf_free_skb(glom_skb);
- 			goto done;
-+		}
- 
- 		skb_queue_walk(pktq, skb) {
- 			memcpy(skb->data, glom_skb->data, skb->len);
-diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmsmac/dma.c b/drivers/net/wireless/broadcom/brcm80211/brcmsmac/dma.c
-index 796f5f9..b7df576 100644
---- a/drivers/net/wireless/broadcom/brcm80211/brcmsmac/dma.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmsmac/dma.c
-@@ -1079,8 +1079,10 @@ bool dma_rxfill(struct dma_pub *pub)
- 
- 		pa = dma_map_single(di->dmadev, p->data, di->rxbufsize,
- 				    DMA_FROM_DEVICE);
--		if (dma_mapping_error(di->dmadev, pa))
-+		if (dma_mapping_error(di->dmadev, pa)) {
-+			brcmu_pkt_buf_free_skb(p);
- 			return false;
-+		}
- 
- 		/* save the free packet pointer */
- 		di->rxp[rxout] = p;
-diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmsmac/stf.c b/drivers/net/wireless/broadcom/brcm80211/brcmsmac/stf.c
-index dd91627..0ab865d 100644
---- a/drivers/net/wireless/broadcom/brcm80211/brcmsmac/stf.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmsmac/stf.c
-@@ -87,7 +87,7 @@ void
- brcms_c_stf_ss_algo_channel_get(struct brcms_c_info *wlc, u16 *ss_algo_channel,
- 			    u16 chanspec)
- {
--	struct tx_power power;
-+	struct tx_power power = { };
- 	u8 siso_mcs_id, cdd_mcs_id, stbc_mcs_id;
- 
- 	/* Clear previous settings */
-diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/fw-dbg.c b/drivers/net/wireless/intel/iwlwifi/mvm/fw-dbg.c
-index e1b6b2c..46b52bf 100644
---- a/drivers/net/wireless/intel/iwlwifi/mvm/fw-dbg.c
-+++ b/drivers/net/wireless/intel/iwlwifi/mvm/fw-dbg.c
-@@ -288,7 +288,8 @@ static void iwl_mvm_dump_fifos(struct iwl_mvm *mvm,
- 			fifo_hdr->fifo_num = cpu_to_le32(i);
- 
- 			/* Mark the number of TXF we're pulling now */
--			iwl_trans_write_prph(mvm->trans, TXF_CPU2_NUM, i);
-+			iwl_trans_write_prph(mvm->trans, TXF_CPU2_NUM, i +
-+				ARRAY_SIZE(mvm->shared_mem_cfg.txfifo_size));
- 
- 			fifo_hdr->available_bytes =
- 				cpu_to_le32(iwl_trans_read_prph(mvm->trans,
-@@ -959,5 +960,6 @@ int iwl_mvm_start_fw_dbg_conf(struct iwl_mvm *mvm, u8 conf_id)
- 	}
- 
- 	mvm->fw_dbg_conf = conf_id;
--	return ret;
-+
-+	return 0;
- }
-diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/fw.c b/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
-index 7057f35..fb71cf6 100644
---- a/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
-+++ b/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
-@@ -139,17 +139,21 @@ void iwl_free_fw_paging(struct iwl_mvm *mvm)
- 		return;
- 
- 	for (i = 0; i < NUM_OF_FW_PAGING_BLOCKS; i++) {
--		if (!mvm->fw_paging_db[i].fw_paging_block) {
-+		struct iwl_fw_paging *paging = &mvm->fw_paging_db[i];
-+
-+		if (!paging->fw_paging_block) {
- 			IWL_DEBUG_FW(mvm,
- 				     "Paging: block %d already freed, continue to next page\n",
- 				     i);
- 
- 			continue;
- 		}
-+		dma_unmap_page(mvm->trans->dev, paging->fw_paging_phys,
-+			       paging->fw_paging_size, DMA_BIDIRECTIONAL);
- 
--		__free_pages(mvm->fw_paging_db[i].fw_paging_block,
--			     get_order(mvm->fw_paging_db[i].fw_paging_size));
--		mvm->fw_paging_db[i].fw_paging_block = NULL;
-+		__free_pages(paging->fw_paging_block,
-+			     get_order(paging->fw_paging_size));
-+		paging->fw_paging_block = NULL;
- 	}
- 	kfree(mvm->trans->paging_download_buf);
- 	mvm->trans->paging_download_buf = NULL;
-diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/nvm.c b/drivers/net/wireless/intel/iwlwifi/mvm/nvm.c
-index 25a9840..0551a4b 100644
---- a/drivers/net/wireless/intel/iwlwifi/mvm/nvm.c
-+++ b/drivers/net/wireless/intel/iwlwifi/mvm/nvm.c
-@@ -667,8 +667,7 @@ iwl_mvm_update_mcc(struct iwl_mvm *mvm, const char *alpha2,
- 		.mcc = cpu_to_le16(alpha2[0] << 8 | alpha2[1]),
- 		.source_id = (u8)src_id,
- 	};
--	struct iwl_mcc_update_resp *mcc_resp, *resp_cp = NULL;
--	struct iwl_mcc_update_resp_v1 *mcc_resp_v1 = NULL;
-+	struct iwl_mcc_update_resp *resp_cp;
- 	struct iwl_rx_packet *pkt;
- 	struct iwl_host_cmd cmd = {
- 		.id = MCC_UPDATE_CMD,
-@@ -701,34 +700,36 @@ iwl_mvm_update_mcc(struct iwl_mvm *mvm, const char *alpha2,
- 
- 	/* Extract MCC response */
- 	if (resp_v2) {
--		mcc_resp = (void *)pkt->data;
-+		struct iwl_mcc_update_resp *mcc_resp = (void *)pkt->data;
-+
- 		n_channels =  __le32_to_cpu(mcc_resp->n_channels);
-+		resp_len = sizeof(struct iwl_mcc_update_resp) +
-+			   n_channels * sizeof(__le32);
-+		resp_cp = kmemdup(mcc_resp, resp_len, GFP_KERNEL);
- 	} else {
--		mcc_resp_v1 = (void *)pkt->data;
-+		struct iwl_mcc_update_resp_v1 *mcc_resp_v1 = (void *)pkt->data;
-+
- 		n_channels =  __le32_to_cpu(mcc_resp_v1->n_channels);
-+		resp_len = sizeof(struct iwl_mcc_update_resp) +
-+			   n_channels * sizeof(__le32);
-+		resp_cp = kzalloc(resp_len, GFP_KERNEL);
-+
-+		if (resp_cp) {
-+			resp_cp->status = mcc_resp_v1->status;
-+			resp_cp->mcc = mcc_resp_v1->mcc;
-+			resp_cp->cap = mcc_resp_v1->cap;
-+			resp_cp->source_id = mcc_resp_v1->source_id;
-+			resp_cp->n_channels = mcc_resp_v1->n_channels;
-+			memcpy(resp_cp->channels, mcc_resp_v1->channels,
-+			       n_channels * sizeof(__le32));
-+		}
- 	}
- 
--	resp_len = sizeof(struct iwl_mcc_update_resp) + n_channels *
--		sizeof(__le32);
--
--	resp_cp = kzalloc(resp_len, GFP_KERNEL);
- 	if (!resp_cp) {
- 		ret = -ENOMEM;
- 		goto exit;
- 	}
- 
--	if (resp_v2) {
--		memcpy(resp_cp, mcc_resp, resp_len);
--	} else {
--		resp_cp->status = mcc_resp_v1->status;
--		resp_cp->mcc = mcc_resp_v1->mcc;
--		resp_cp->cap = mcc_resp_v1->cap;
--		resp_cp->source_id = mcc_resp_v1->source_id;
--		resp_cp->n_channels = mcc_resp_v1->n_channels;
--		memcpy(resp_cp->channels, mcc_resp_v1->channels,
--		       n_channels * sizeof(__le32));
--	}
--
- 	status = le32_to_cpu(resp_cp->status);
- 
- 	mcc = le16_to_cpu(resp_cp->mcc);
-diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/sf.c b/drivers/net/wireless/intel/iwlwifi/mvm/sf.c
-index 443a428..101fb04 100644
---- a/drivers/net/wireless/intel/iwlwifi/mvm/sf.c
-+++ b/drivers/net/wireless/intel/iwlwifi/mvm/sf.c
-@@ -215,7 +215,7 @@ static int iwl_mvm_sf_config(struct iwl_mvm *mvm, u8 sta_id,
- 			     enum iwl_sf_state new_state)
- {
- 	struct iwl_sf_cfg_cmd sf_cmd = {
--		.state = cpu_to_le32(SF_FULL_ON),
-+		.state = cpu_to_le32(new_state),
- 	};
- 	struct ieee80211_sta *sta;
- 	int ret = 0;
-diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/sta.c b/drivers/net/wireless/intel/iwlwifi/mvm/sta.c
-index b23ab4a..1822ad3 100644
---- a/drivers/net/wireless/intel/iwlwifi/mvm/sta.c
-+++ b/drivers/net/wireless/intel/iwlwifi/mvm/sta.c
-@@ -1374,11 +1374,12 @@ int iwl_mvm_sta_rx_agg(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
- 		 */
- 		WARN_ON(rcu_access_pointer(mvm->baid_map[baid]));
- 		rcu_assign_pointer(mvm->baid_map[baid], baid_data);
--	} else if (mvm->rx_ba_sessions > 0) {
-+	} else  {
- 		u8 baid = mvm_sta->tid_to_baid[tid];
- 
--		/* check that restart flow didn't zero the counter */
--		mvm->rx_ba_sessions--;
-+		if (mvm->rx_ba_sessions > 0)
-+			/* check that restart flow didn't zero the counter */
-+			mvm->rx_ba_sessions--;
- 		if (!iwl_mvm_has_new_rx_api(mvm))
- 			return 0;
- 
-diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/tx.c b/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
-index b92b75f..6b8d9a5 100644
---- a/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
-+++ b/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
-@@ -138,28 +138,19 @@ static void iwl_mvm_tx_csum(struct iwl_mvm *mvm, struct sk_buff *skb,
- 
- 		protocol = ipv6h->nexthdr;
- 		while (protocol != NEXTHDR_NONE && ipv6_ext_hdr(protocol)) {
-+			struct ipv6_opt_hdr *hp;
-+
- 			/* only supported extension headers */
- 			if (protocol != NEXTHDR_ROUTING &&
- 			    protocol != NEXTHDR_HOP &&
--			    protocol != NEXTHDR_DEST &&
--			    protocol != NEXTHDR_FRAGMENT) {
-+			    protocol != NEXTHDR_DEST) {
- 				skb_checksum_help(skb);
- 				return;
- 			}
- 
--			if (protocol == NEXTHDR_FRAGMENT) {
--				struct frag_hdr *hp =
--					OPT_HDR(struct frag_hdr, skb, off);
--
--				protocol = hp->nexthdr;
--				off += sizeof(struct frag_hdr);
--			} else {
--				struct ipv6_opt_hdr *hp =
--					OPT_HDR(struct ipv6_opt_hdr, skb, off);
--
--				protocol = hp->nexthdr;
--				off += ipv6_optlen(hp);
--			}
-+			hp = OPT_HDR(struct ipv6_opt_hdr, skb, off);
-+			protocol = hp->nexthdr;
-+			off += ipv6_optlen(hp);
- 		}
- 		/* if we get here - protocol now should be TCP/UDP */
- #endif
-@@ -1312,7 +1303,15 @@ static void iwl_mvm_rx_tx_cmd_single(struct iwl_mvm *mvm,
- 			bool send_eosp_ndp = false;
- 
- 			spin_lock_bh(&mvmsta->lock);
--			txq_agg = (mvmsta->tid_data[tid].state == IWL_AGG_ON);
-+			if (iwl_mvm_is_dqa_supported(mvm)) {
-+				enum iwl_mvm_agg_state state;
-+
-+				state = mvmsta->tid_data[tid].state;
-+				txq_agg = (state == IWL_AGG_ON ||
-+					state == IWL_EMPTYING_HW_QUEUE_DELBA);
-+			} else {
-+				txq_agg = txq_id >= mvm->first_agg_queue;
-+			}
- 
- 			if (!is_ndp) {
- 				tid_data->next_reclaimed = next_reclaimed;
-diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/tx.c b/drivers/net/wireless/intel/iwlwifi/pcie/tx.c
-index d6beac9..dec63a0 100644
---- a/drivers/net/wireless/intel/iwlwifi/pcie/tx.c
-+++ b/drivers/net/wireless/intel/iwlwifi/pcie/tx.c
-@@ -1595,9 +1595,9 @@ static int iwl_pcie_enqueue_hcmd(struct iwl_trans *trans,
- 
- 	/* start the TFD with the scratchbuf */
- 	scratch_size = min_t(int, copy_size, IWL_HCMD_SCRATCHBUF_SIZE);
--	memcpy(&txq->scratchbufs[q->write_ptr], &out_cmd->hdr, scratch_size);
-+	memcpy(&txq->scratchbufs[idx], &out_cmd->hdr, scratch_size);
- 	iwl_pcie_txq_build_tfd(trans, txq,
--			       iwl_pcie_get_scratchbuf_dma(txq, q->write_ptr),
-+			       iwl_pcie_get_scratchbuf_dma(txq, idx),
- 			       scratch_size, true);
- 
- 	/* map first command fragment, if any remains */
-diff --git a/drivers/net/wireless/marvell/mwifiex/uap_txrx.c b/drivers/net/wireless/marvell/mwifiex/uap_txrx.c
-index 666e91a..bf5660e 100644
---- a/drivers/net/wireless/marvell/mwifiex/uap_txrx.c
-+++ b/drivers/net/wireless/marvell/mwifiex/uap_txrx.c
-@@ -272,7 +272,7 @@ int mwifiex_handle_uap_rx_forward(struct mwifiex_private *priv,
- int mwifiex_uap_recv_packet(struct mwifiex_private *priv,
- 			    struct sk_buff *skb)
- {
--	struct mwifiex_adapter *adapter = adapter;
-+	struct mwifiex_adapter *adapter = priv->adapter;
- 	struct mwifiex_sta_node *src_node;
- 	struct ethhdr *p_ethhdr;
- 	struct sk_buff *skb_uap;
-diff --git a/drivers/nfc/fdp/fdp.c b/drivers/nfc/fdp/fdp.c
-index e44a7a2..1642742 100644
---- a/drivers/nfc/fdp/fdp.c
-+++ b/drivers/nfc/fdp/fdp.c
-@@ -353,7 +353,7 @@ static int fdp_nci_patch_otp(struct nci_dev *ndev)
- {
- 	struct fdp_nci_info *info = nci_get_drvdata(ndev);
- 	struct device *dev = &info->phy->i2c_dev->dev;
--	u8 conn_id;
-+	int conn_id;
- 	int r = 0;
- 
- 	if (info->otp_version >= info->otp_patch_version)
-@@ -424,7 +424,7 @@ static int fdp_nci_patch_ram(struct nci_dev *ndev)
- {
- 	struct fdp_nci_info *info = nci_get_drvdata(ndev);
- 	struct device *dev = &info->phy->i2c_dev->dev;
--	u8 conn_id;
-+	int conn_id;
- 	int r = 0;
- 
- 	if (info->ram_version >= info->ram_patch_version)
-diff --git a/drivers/pcmcia/ds.c b/drivers/pcmcia/ds.c
-index 489ea10..69b5e81 100644
---- a/drivers/pcmcia/ds.c
-+++ b/drivers/pcmcia/ds.c
-@@ -977,7 +977,7 @@ static int pcmcia_bus_uevent(struct device *dev, struct kobj_uevent_env *env)
- 
- /************************ runtime PM support ***************************/
- 
--static int pcmcia_dev_suspend(struct device *dev, pm_message_t state);
-+static int pcmcia_dev_suspend(struct device *dev);
- static int pcmcia_dev_resume(struct device *dev);
- 
- static int runtime_suspend(struct device *dev)
-@@ -985,7 +985,7 @@ static int runtime_suspend(struct device *dev)
- 	int rc;
- 
- 	device_lock(dev);
--	rc = pcmcia_dev_suspend(dev, PMSG_SUSPEND);
-+	rc = pcmcia_dev_suspend(dev);
- 	device_unlock(dev);
- 	return rc;
- }
-@@ -1135,7 +1135,7 @@ ATTRIBUTE_GROUPS(pcmcia_dev);
- 
- /* PM support, also needed for reset */
- 
--static int pcmcia_dev_suspend(struct device *dev, pm_message_t state)
-+static int pcmcia_dev_suspend(struct device *dev)
- {
- 	struct pcmcia_device *p_dev = to_pcmcia_dev(dev);
- 	struct pcmcia_driver *p_drv = NULL;
-@@ -1410,6 +1410,9 @@ static struct class_interface pcmcia_bus_interface __refdata = {
- 	.remove_dev = &pcmcia_bus_remove_socket,
- };
- 
-+static const struct dev_pm_ops pcmcia_bus_pm_ops = {
-+	SET_SYSTEM_SLEEP_PM_OPS(pcmcia_dev_suspend, pcmcia_dev_resume)
-+};
- 
- struct bus_type pcmcia_bus_type = {
- 	.name = "pcmcia",
-@@ -1418,8 +1421,7 @@ struct bus_type pcmcia_bus_type = {
- 	.dev_groups = pcmcia_dev_groups,
- 	.probe = pcmcia_device_probe,
- 	.remove = pcmcia_device_remove,
--	.suspend = pcmcia_dev_suspend,
--	.resume = pcmcia_dev_resume,
-+	.pm = &pcmcia_bus_pm_ops,
- };
- 
- 
-diff --git a/drivers/perf/arm_pmu.c b/drivers/perf/arm_pmu.c
-index 140436a..5824045 100644
---- a/drivers/perf/arm_pmu.c
-+++ b/drivers/perf/arm_pmu.c
-@@ -921,6 +921,7 @@ static int of_pmu_irq_cfg(struct arm_pmu *pmu)
- 			if (i > 0 && spi != using_spi) {
- 				pr_err("PPI/SPI IRQ type mismatch for %s!\n",
- 					dn->name);
-+				of_node_put(dn);
- 				kfree(irqs);
- 				return -EINVAL;
- 			}
-diff --git a/drivers/pinctrl/uniphier/pinctrl-uniphier-core.c b/drivers/pinctrl/uniphier/pinctrl-uniphier-core.c
-index 9674009..5d08de0 100644
---- a/drivers/pinctrl/uniphier/pinctrl-uniphier-core.c
-+++ b/drivers/pinctrl/uniphier/pinctrl-uniphier-core.c
-@@ -73,6 +73,12 @@ static void uniphier_pctl_pin_dbg_show(struct pinctrl_dev *pctldev,
- 	case UNIPHIER_PIN_PULL_DOWN:
- 		pull_dir = "DOWN";
- 		break;
-+	case UNIPHIER_PIN_PULL_UP_FIXED:
-+		pull_dir = "UP(FIXED)";
-+		break;
-+	case UNIPHIER_PIN_PULL_DOWN_FIXED:
-+		pull_dir = "DOWN(FIXED)";
-+		break;
- 	case UNIPHIER_PIN_PULL_NONE:
- 		pull_dir = "NONE";
- 		break;
-diff --git a/drivers/regulator/pwm-regulator.c b/drivers/regulator/pwm-regulator.c
-index fafa348..36e0c93 100644
---- a/drivers/regulator/pwm-regulator.c
-+++ b/drivers/regulator/pwm-regulator.c
-@@ -132,6 +132,7 @@ static int pwm_regulator_set_voltage(struct regulator_dev *rdev,
- 	unsigned int duty_pulse;
- 	u64 req_period;
- 	u32 rem;
-+	int old_uV = pwm_regulator_get_voltage(rdev);
- 	int ret;
- 
- 	pwm_get_args(drvdata->pwm, &pargs);
-@@ -166,8 +167,12 @@ static int pwm_regulator_set_voltage(struct regulator_dev *rdev,
- 	}
- 	drvdata->volt_uV = min_uV;
- 
--	/* Delay required by PWM regulator to settle to the new voltage */
--	usleep_range(ramp_delay, ramp_delay + 1000);
-+	if ((ramp_delay == 0) || !pwm_regulator_is_enabled(rdev))
-+		return 0;
-+
-+	/* Ramp delay is in uV/uS. Adjust to uS and delay */
-+	ramp_delay = DIV_ROUND_UP(abs(min_uV - old_uV), ramp_delay);
-+	usleep_range(ramp_delay, ramp_delay + DIV_ROUND_UP(ramp_delay, 10));
- 
- 	return 0;
- }
-diff --git a/drivers/regulator/qcom_smd-regulator.c b/drivers/regulator/qcom_smd-regulator.c
-index 6c7fe477..891ae44 100644
---- a/drivers/regulator/qcom_smd-regulator.c
-+++ b/drivers/regulator/qcom_smd-regulator.c
-@@ -178,20 +178,21 @@ static const struct regulator_desc pma8084_hfsmps = {
- static const struct regulator_desc pma8084_ftsmps = {
- 	.linear_ranges = (struct regulator_linear_range[]) {
- 		REGULATOR_LINEAR_RANGE(350000,  0, 184, 5000),
--		REGULATOR_LINEAR_RANGE(700000, 185, 339, 10000),
-+		REGULATOR_LINEAR_RANGE(1280000, 185, 261, 10000),
- 	},
- 	.n_linear_ranges = 2,
--	.n_voltages = 340,
-+	.n_voltages = 262,
- 	.ops = &rpm_smps_ldo_ops,
- };
- 
- static const struct regulator_desc pma8084_pldo = {
- 	.linear_ranges = (struct regulator_linear_range[]) {
--		REGULATOR_LINEAR_RANGE(750000,  0,  30, 25000),
--		REGULATOR_LINEAR_RANGE(1500000, 31, 99, 50000),
-+		REGULATOR_LINEAR_RANGE( 750000,  0,  63, 12500),
-+		REGULATOR_LINEAR_RANGE(1550000, 64, 126, 25000),
-+		REGULATOR_LINEAR_RANGE(3100000, 127, 163, 50000),
- 	},
--	.n_linear_ranges = 2,
--	.n_voltages = 100,
-+	.n_linear_ranges = 3,
-+	.n_voltages = 164,
- 	.ops = &rpm_smps_ldo_ops,
- };
- 
-@@ -221,29 +222,30 @@ static const struct regulator_desc pm8x41_hfsmps = {
- static const struct regulator_desc pm8841_ftsmps = {
- 	.linear_ranges = (struct regulator_linear_range[]) {
- 		REGULATOR_LINEAR_RANGE(350000,  0, 184, 5000),
--		REGULATOR_LINEAR_RANGE(700000, 185, 339, 10000),
-+		REGULATOR_LINEAR_RANGE(1280000, 185, 261, 10000),
- 	},
- 	.n_linear_ranges = 2,
--	.n_voltages = 340,
-+	.n_voltages = 262,
- 	.ops = &rpm_smps_ldo_ops,
- };
- 
- static const struct regulator_desc pm8941_boost = {
- 	.linear_ranges = (struct regulator_linear_range[]) {
--		REGULATOR_LINEAR_RANGE(4000000, 0, 15, 100000),
-+		REGULATOR_LINEAR_RANGE(4000000, 0, 30, 50000),
- 	},
- 	.n_linear_ranges = 1,
--	.n_voltages = 16,
-+	.n_voltages = 31,
- 	.ops = &rpm_smps_ldo_ops,
- };
- 
- static const struct regulator_desc pm8941_pldo = {
- 	.linear_ranges = (struct regulator_linear_range[]) {
--		REGULATOR_LINEAR_RANGE( 750000,  0,  30, 25000),
--		REGULATOR_LINEAR_RANGE(1500000, 31, 99, 50000),
-+		REGULATOR_LINEAR_RANGE( 750000,  0,  63, 12500),
-+		REGULATOR_LINEAR_RANGE(1550000, 64, 126, 25000),
-+		REGULATOR_LINEAR_RANGE(3100000, 127, 163, 50000),
- 	},
--	.n_linear_ranges = 2,
--	.n_voltages = 100,
-+	.n_linear_ranges = 3,
-+	.n_voltages = 164,
- 	.ops = &rpm_smps_ldo_ops,
- };
- 
-diff --git a/drivers/regulator/qcom_spmi-regulator.c b/drivers/regulator/qcom_spmi-regulator.c
-index 84cce21..16c5f84 100644
---- a/drivers/regulator/qcom_spmi-regulator.c
-+++ b/drivers/regulator/qcom_spmi-regulator.c
-@@ -1085,6 +1085,8 @@ static struct regulator_ops spmi_vs_ops = {
- 	.set_pull_down		= spmi_regulator_common_set_pull_down,
- 	.set_soft_start		= spmi_regulator_common_set_soft_start,
- 	.set_over_current_protection = spmi_regulator_vs_ocp,
-+	.set_mode		= spmi_regulator_common_set_mode,
-+	.get_mode		= spmi_regulator_common_get_mode,
- };
- 
- static struct regulator_ops spmi_boost_ops = {
-@@ -1496,6 +1498,7 @@ static const struct spmi_regulator_data pm8941_regulators[] = {
- 	{ "s1", 0x1400, "vdd_s1", },
- 	{ "s2", 0x1700, "vdd_s2", },
- 	{ "s3", 0x1a00, "vdd_s3", },
-+	{ "s4", 0xa000, },
- 	{ "l1", 0x4000, "vdd_l1_l3", },
- 	{ "l2", 0x4100, "vdd_l2_lvs_1_2_3", },
- 	{ "l3", 0x4200, "vdd_l1_l3", },
-@@ -1523,8 +1526,8 @@ static const struct spmi_regulator_data pm8941_regulators[] = {
- 	{ "lvs1", 0x8000, "vdd_l2_lvs_1_2_3", },
- 	{ "lvs2", 0x8100, "vdd_l2_lvs_1_2_3", },
- 	{ "lvs3", 0x8200, "vdd_l2_lvs_1_2_3", },
--	{ "mvs1", 0x8300, "vin_5vs", },
--	{ "mvs2", 0x8400, "vin_5vs", },
-+	{ "5vs1", 0x8300, "vin_5vs", "ocp-5vs1", },
-+	{ "5vs2", 0x8400, "vin_5vs", "ocp-5vs2", },
- 	{ }
- };
- 
-diff --git a/drivers/scsi/fnic/fnic_fcs.c b/drivers/scsi/fnic/fnic_fcs.c
-index 67669a9..f3a3331 100644
---- a/drivers/scsi/fnic/fnic_fcs.c
-+++ b/drivers/scsi/fnic/fnic_fcs.c
-@@ -954,8 +954,8 @@ int fnic_alloc_rq_frame(struct vnic_rq *rq)
- 	skb_put(skb, len);
- 	pa = pci_map_single(fnic->pdev, skb->data, len, PCI_DMA_FROMDEVICE);
- 
--	r = pci_dma_mapping_error(fnic->pdev, pa);
--	if (r) {
-+	if (pci_dma_mapping_error(fnic->pdev, pa)) {
-+		r = -ENOMEM;
- 		printk(KERN_ERR "PCI mapping failed with error %d\n", r);
- 		goto free_skb;
- 	}
-@@ -1093,8 +1093,8 @@ static int fnic_send_frame(struct fnic *fnic, struct fc_frame *fp)
- 
- 	pa = pci_map_single(fnic->pdev, eth_hdr, tot_len, PCI_DMA_TODEVICE);
- 
--	ret = pci_dma_mapping_error(fnic->pdev, pa);
--	if (ret) {
-+	if (pci_dma_mapping_error(fnic->pdev, pa)) {
-+		ret = -ENOMEM;
- 		printk(KERN_ERR "DMA map failed with error %d\n", ret);
- 		goto free_skb_on_err;
- 	}
-diff --git a/drivers/scsi/qla2xxx/qla_fw.h b/drivers/scsi/qla2xxx/qla_fw.h
-index 4c0f3a7..8a2368b 100644
---- a/drivers/scsi/qla2xxx/qla_fw.h
-+++ b/drivers/scsi/qla2xxx/qla_fw.h
-@@ -1288,7 +1288,7 @@ struct vp_rpt_id_entry_24xx {
- 
- 	uint8_t vp_idx_map[16];
- 
--	uint8_t reserved_4[28];
-+	uint8_t reserved_4[24];
- 	uint16_t bbcr;
- 	uint8_t reserved_5[6];
- };
-diff --git a/drivers/scsi/ses.c b/drivers/scsi/ses.c
-index 53ef1cb..1d82053 100644
---- a/drivers/scsi/ses.c
-+++ b/drivers/scsi/ses.c
-@@ -587,7 +587,7 @@ static void ses_match_to_enclosure(struct enclosure_device *edev,
- 
- 	ses_enclosure_data_process(edev, to_scsi_device(edev->edev.parent), 0);
- 
--	if (is_sas_attached(sdev))
-+	if (scsi_is_sas_rphy(&sdev->sdev_gendev))
- 		efd.addr = sas_get_address(sdev);
- 
- 	if (efd.addr) {
-diff --git a/drivers/spi/spi-sh-msiof.c b/drivers/spi/spi-sh-msiof.c
-index a7934ab..d22de4c 100644
---- a/drivers/spi/spi-sh-msiof.c
-+++ b/drivers/spi/spi-sh-msiof.c
-@@ -263,6 +263,9 @@ static void sh_msiof_spi_set_clk_regs(struct sh_msiof_spi_priv *p,
- 
- 	for (k = 0; k < ARRAY_SIZE(sh_msiof_spi_div_table); k++) {
- 		brps = DIV_ROUND_UP(div, sh_msiof_spi_div_table[k].div);
-+		/* SCR_BRDV_DIV_1 is valid only if BRPS is x 1/1 or x 1/2 */
-+		if (sh_msiof_spi_div_table[k].div == 1 && brps > 2)
-+			continue;
- 		if (brps <= 32) /* max of brdv is 32 */
- 			break;
- 	}
-diff --git a/drivers/staging/comedi/drivers/adv_pci1760.c b/drivers/staging/comedi/drivers/adv_pci1760.c
-index d7dd1e5..9f525ff 100644
---- a/drivers/staging/comedi/drivers/adv_pci1760.c
-+++ b/drivers/staging/comedi/drivers/adv_pci1760.c
-@@ -196,6 +196,7 @@ static int pci1760_pwm_ns_to_div(unsigned int flags, unsigned int ns)
- 		break;
- 	case CMDF_ROUND_DOWN:
- 		divisor = ns / PCI1760_PWM_TIMEBASE;
-+		break;
- 	default:
- 		return -EINVAL;
- 	}
-diff --git a/drivers/staging/fbtft/fbtft-core.c b/drivers/staging/fbtft/fbtft-core.c
-index 0c1a77c..4c281df 100644
---- a/drivers/staging/fbtft/fbtft-core.c
-+++ b/drivers/staging/fbtft/fbtft-core.c
-@@ -391,11 +391,11 @@ static void fbtft_update_display(struct fbtft_par *par, unsigned start_line,
- 
- 	if (unlikely(timeit)) {
- 		ts_end = ktime_get();
--		if (ktime_to_ns(par->update_time))
-+		if (!ktime_to_ns(par->update_time))
- 			par->update_time = ts_start;
- 
--		par->update_time = ts_start;
- 		fps = ktime_us_delta(ts_start, par->update_time);
-+		par->update_time = ts_start;
- 		fps = fps ? 1000000 / fps : 0;
- 
- 		throughput = ktime_us_delta(ts_end, ts_start);
-diff --git a/drivers/usb/class/usbtmc.c b/drivers/usb/class/usbtmc.c
-index 917a55c..ffe9f88 100644
---- a/drivers/usb/class/usbtmc.c
-+++ b/drivers/usb/class/usbtmc.c
-@@ -141,6 +141,7 @@ static void usbtmc_delete(struct kref *kref)
- 	struct usbtmc_device_data *data = to_usbtmc_data(kref);
- 
- 	usb_put_dev(data->usb_dev);
-+	kfree(data);
- }
- 
- static int usbtmc_open(struct inode *inode, struct file *filp)
-@@ -1379,7 +1380,7 @@ static int usbtmc_probe(struct usb_interface *intf,
- 
- 	dev_dbg(&intf->dev, "%s called\n", __func__);
- 
--	data = devm_kzalloc(&intf->dev, sizeof(*data), GFP_KERNEL);
-+	data = kmalloc(sizeof(*data), GFP_KERNEL);
- 	if (!data)
- 		return -ENOMEM;
- 
-diff --git a/drivers/usb/gadget/udc/fsl_qe_udc.c b/drivers/usb/gadget/udc/fsl_qe_udc.c
-index cf8819a..8bb011e 100644
---- a/drivers/usb/gadget/udc/fsl_qe_udc.c
-+++ b/drivers/usb/gadget/udc/fsl_qe_udc.c
-@@ -1878,11 +1878,8 @@ static int qe_get_frame(struct usb_gadget *gadget)
- 
- 	tmp = in_be16(&udc->usb_param->frame_n);
- 	if (tmp & 0x8000)
--		tmp = tmp & 0x07ff;
--	else
--		tmp = -EINVAL;
--
--	return (int)tmp;
-+		return tmp & 0x07ff;
-+	return -EINVAL;
- }
- 
- static int fsl_qe_start(struct usb_gadget *gadget,
-diff --git a/drivers/usb/misc/legousbtower.c b/drivers/usb/misc/legousbtower.c
-index 7771be3..4dd531a 100644
---- a/drivers/usb/misc/legousbtower.c
-+++ b/drivers/usb/misc/legousbtower.c
-@@ -898,24 +898,6 @@ static int tower_probe (struct usb_interface *interface, const struct usb_device
- 	dev->interrupt_in_interval = interrupt_in_interval ? interrupt_in_interval : dev->interrupt_in_endpoint->bInterval;
- 	dev->interrupt_out_interval = interrupt_out_interval ? interrupt_out_interval : dev->interrupt_out_endpoint->bInterval;
- 
--	/* we can register the device now, as it is ready */
--	usb_set_intfdata (interface, dev);
--
--	retval = usb_register_dev (interface, &tower_class);
--
--	if (retval) {
--		/* something prevented us from registering this driver */
--		dev_err(idev, "Not able to get a minor for this device.\n");
--		usb_set_intfdata (interface, NULL);
--		goto error;
--	}
--	dev->minor = interface->minor;
--
--	/* let the user know what node this device is now attached to */
--	dev_info(&interface->dev, "LEGO USB Tower #%d now attached to major "
--		 "%d minor %d\n", (dev->minor - LEGO_USB_TOWER_MINOR_BASE),
--		 USB_MAJOR, dev->minor);
--
- 	/* get the firmware version and log it */
- 	result = usb_control_msg (udev,
- 				  usb_rcvctrlpipe(udev, 0),
-@@ -936,6 +918,23 @@ static int tower_probe (struct usb_interface *interface, const struct usb_device
- 		 get_version_reply.minor,
- 		 le16_to_cpu(get_version_reply.build_no));
- 
-+	/* we can register the device now, as it is ready */
-+	usb_set_intfdata (interface, dev);
-+
-+	retval = usb_register_dev (interface, &tower_class);
-+
-+	if (retval) {
-+		/* something prevented us from registering this driver */
-+		dev_err(idev, "Not able to get a minor for this device.\n");
-+		usb_set_intfdata (interface, NULL);
-+		goto error;
-+	}
-+	dev->minor = interface->minor;
-+
-+	/* let the user know what node this device is now attached to */
-+	dev_info(&interface->dev, "LEGO USB Tower #%d now attached to major "
-+		 "%d minor %d\n", (dev->minor - LEGO_USB_TOWER_MINOR_BASE),
-+		 USB_MAJOR, dev->minor);
- 
- exit:
- 	return retval;
-diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c
-index 96a7078..7e91ee2 100644
---- a/drivers/usb/serial/cp210x.c
-+++ b/drivers/usb/serial/cp210x.c
-@@ -118,6 +118,7 @@ static const struct usb_device_id id_table[] = {
- 	{ USB_DEVICE(0x10C4, 0x8411) }, /* Kyocera GPS Module */
- 	{ USB_DEVICE(0x10C4, 0x8418) }, /* IRZ Automation Teleport SG-10 GSM/GPRS Modem */
- 	{ USB_DEVICE(0x10C4, 0x846E) }, /* BEI USB Sensor Interface (VCP) */
-+	{ USB_DEVICE(0x10C4, 0x8470) }, /* Juniper Networks BX Series System Console */
- 	{ USB_DEVICE(0x10C4, 0x8477) }, /* Balluff RFID */
- 	{ USB_DEVICE(0x10C4, 0x84B6) }, /* Starizona Hyperion */
- 	{ USB_DEVICE(0x10C4, 0x85EA) }, /* AC-Services IBUS-IF */
-diff --git a/drivers/usb/usbip/vudc_rx.c b/drivers/usb/usbip/vudc_rx.c
-index 344bd94..e429b59 100644
---- a/drivers/usb/usbip/vudc_rx.c
-+++ b/drivers/usb/usbip/vudc_rx.c
-@@ -142,7 +142,7 @@ static int v_recv_cmd_submit(struct vudc *udc,
- 	urb_p->urb->status = -EINPROGRESS;
- 
- 	/* FIXME: more pipe setup to please usbip_common */
--	urb_p->urb->pipe &= ~(11 << 30);
-+	urb_p->urb->pipe &= ~(3 << 30);
- 	switch (urb_p->ep->type) {
- 	case USB_ENDPOINT_XFER_BULK:
- 		urb_p->urb->pipe |= (PIPE_BULK << 30);
-diff --git a/drivers/watchdog/watchdog_dev.c b/drivers/watchdog/watchdog_dev.c
-index 3595cff..cff8a65 100644
---- a/drivers/watchdog/watchdog_dev.c
-+++ b/drivers/watchdog/watchdog_dev.c
-@@ -258,10 +258,12 @@ static int watchdog_stop(struct watchdog_device *wdd)
- 		return -EBUSY;
- 	}
- 
--	if (wdd->ops->stop)
-+	if (wdd->ops->stop) {
-+		clear_bit(WDOG_HW_RUNNING, &wdd->status);
- 		err = wdd->ops->stop(wdd);
--	else
-+	} else {
- 		set_bit(WDOG_HW_RUNNING, &wdd->status);
-+	}
- 
- 	if (err == 0) {
- 		clear_bit(WDOG_ACTIVE, &wdd->status);
-diff --git a/fs/aio.c b/fs/aio.c
-index fb8e45b..4fe81d1 100644
---- a/fs/aio.c
-+++ b/fs/aio.c
-@@ -239,7 +239,12 @@ static struct dentry *aio_mount(struct file_system_type *fs_type,
- 	static const struct dentry_operations ops = {
- 		.d_dname	= simple_dname,
- 	};
--	return mount_pseudo(fs_type, "aio:", NULL, &ops, AIO_RING_MAGIC);
-+	struct dentry *root = mount_pseudo(fs_type, "aio:", NULL, &ops,
-+					   AIO_RING_MAGIC);
-+
-+	if (!IS_ERR(root))
-+		root->d_sb->s_iflags |= SB_I_NOEXEC;
-+	return root;
- }
- 
- /* aio_setup
-diff --git a/fs/ceph/dir.c b/fs/ceph/dir.c
-index 6e0fedf..cf22f1e 100644
---- a/fs/ceph/dir.c
-+++ b/fs/ceph/dir.c
-@@ -597,7 +597,7 @@ static bool need_reset_readdir(struct ceph_file_info *fi, loff_t new_pos)
- 	if (is_hash_order(new_pos)) {
- 		/* no need to reset last_name for a forward seek when
- 		 * dentries are sotred in hash order */
--	} else if (fi->frag |= fpos_frag(new_pos)) {
-+	} else if (fi->frag != fpos_frag(new_pos)) {
- 		return true;
- 	}
- 	rinfo = fi->last_readdir ? &fi->last_readdir->r_reply_info : NULL;
-diff --git a/fs/nfs/callback_xdr.c b/fs/nfs/callback_xdr.c
-index d81f96a..656f68f 100644
---- a/fs/nfs/callback_xdr.c
-+++ b/fs/nfs/callback_xdr.c
-@@ -925,7 +925,7 @@ static __be32 nfs4_callback_compound(struct svc_rqst *rqstp, void *argp, void *r
- 	if (hdr_arg.minorversion == 0) {
- 		cps.clp = nfs4_find_client_ident(SVC_NET(rqstp), hdr_arg.cb_ident);
- 		if (!cps.clp || !check_gss_callback_principal(cps.clp, rqstp))
--			return rpc_drop_reply;
-+			goto out_invalidcred;
- 	}
- 
- 	cps.minorversion = hdr_arg.minorversion;
-@@ -953,6 +953,10 @@ static __be32 nfs4_callback_compound(struct svc_rqst *rqstp, void *argp, void *r
- 	nfs_put_client(cps.clp);
- 	dprintk("%s: done, status = %u\n", __func__, ntohl(status));
- 	return rpc_success;
-+
-+out_invalidcred:
-+	pr_warn_ratelimited("NFS: NFSv4 callback contains invalid cred\n");
-+	return rpc_autherr_badcred;
- }
- 
- /*
-diff --git a/fs/nfs/filelayout/filelayout.c b/fs/nfs/filelayout/filelayout.c
-index aa59757..b4c1407 100644
---- a/fs/nfs/filelayout/filelayout.c
-+++ b/fs/nfs/filelayout/filelayout.c
-@@ -375,8 +375,7 @@ static int filelayout_commit_done_cb(struct rpc_task *task,
- 		return -EAGAIN;
- 	}
- 
--	if (data->verf.committed == NFS_UNSTABLE)
--		pnfs_set_layoutcommit(data->inode, data->lseg, data->lwb);
-+	pnfs_set_layoutcommit(data->inode, data->lseg, data->lwb);
- 
- 	return 0;
- }
-diff --git a/fs/nfs/flexfilelayout/flexfilelayout.c b/fs/nfs/flexfilelayout/flexfilelayout.c
-index 6da14ae..1c15966 100644
---- a/fs/nfs/flexfilelayout/flexfilelayout.c
-+++ b/fs/nfs/flexfilelayout/flexfilelayout.c
-@@ -37,6 +37,7 @@ ff_layout_alloc_layout_hdr(struct inode *inode, gfp_t gfp_flags)
- 	if (ffl) {
- 		INIT_LIST_HEAD(&ffl->error_list);
- 		INIT_LIST_HEAD(&ffl->mirrors);
-+		ffl->last_report_time = ktime_get();
- 		return &ffl->generic_hdr;
- 	} else
- 		return NULL;
-@@ -640,19 +641,18 @@ nfs4_ff_layoutstat_start_io(struct nfs4_ff_layout_mirror *mirror,
- {
- 	static const ktime_t notime = {0};
- 	s64 report_interval = FF_LAYOUTSTATS_REPORT_INTERVAL;
-+	struct nfs4_flexfile_layout *ffl = FF_LAYOUT_FROM_HDR(mirror->layout);
- 
- 	nfs4_ff_start_busy_timer(&layoutstat->busy_timer, now);
- 	if (ktime_equal(mirror->start_time, notime))
- 		mirror->start_time = now;
--	if (ktime_equal(mirror->last_report_time, notime))
--		mirror->last_report_time = now;
- 	if (mirror->report_interval != 0)
- 		report_interval = (s64)mirror->report_interval * 1000LL;
- 	else if (layoutstats_timer != 0)
- 		report_interval = (s64)layoutstats_timer * 1000LL;
--	if (ktime_to_ms(ktime_sub(now, mirror->last_report_time)) >=
-+	if (ktime_to_ms(ktime_sub(now, ffl->last_report_time)) >=
- 			report_interval) {
--		mirror->last_report_time = now;
-+		ffl->last_report_time = now;
- 		return true;
- 	}
- 
-@@ -1529,8 +1529,7 @@ static int ff_layout_commit_done_cb(struct rpc_task *task,
- 		return -EAGAIN;
- 	}
- 
--	if (data->verf.committed == NFS_UNSTABLE
--	    && ff_layout_need_layoutcommit(data->lseg))
-+	if (ff_layout_need_layoutcommit(data->lseg))
- 		pnfs_set_layoutcommit(data->inode, data->lseg, data->lwb);
- 
- 	return 0;
-diff --git a/fs/nfs/flexfilelayout/flexfilelayout.h b/fs/nfs/flexfilelayout/flexfilelayout.h
-index 1bcdb15..3ee0c9f 100644
---- a/fs/nfs/flexfilelayout/flexfilelayout.h
-+++ b/fs/nfs/flexfilelayout/flexfilelayout.h
-@@ -84,7 +84,6 @@ struct nfs4_ff_layout_mirror {
- 	struct nfs4_ff_layoutstat	read_stat;
- 	struct nfs4_ff_layoutstat	write_stat;
- 	ktime_t				start_time;
--	ktime_t				last_report_time;
- 	u32				report_interval;
- };
- 
-@@ -101,6 +100,7 @@ struct nfs4_flexfile_layout {
- 	struct pnfs_ds_commit_info commit_info;
- 	struct list_head	mirrors;
- 	struct list_head	error_list; /* nfs4_ff_layout_ds_err */
-+	ktime_t			last_report_time; /* Layoutstat report times */
- };
- 
- static inline struct nfs4_flexfile_layout *
-diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
-index e2320c6..00fd0c7 100644
---- a/fs/nfs/nfs4proc.c
-+++ b/fs/nfs/nfs4proc.c
-@@ -4393,7 +4393,8 @@ static void nfs4_proc_read_setup(struct nfs_pgio_header *hdr,
- 				 struct rpc_message *msg)
- {
- 	hdr->timestamp   = jiffies;
--	hdr->pgio_done_cb = nfs4_read_done_cb;
-+	if (!hdr->pgio_done_cb)
-+		hdr->pgio_done_cb = nfs4_read_done_cb;
- 	msg->rpc_proc = &nfs4_procedures[NFSPROC4_CLNT_READ];
- 	nfs4_init_sequence(&hdr->args.seq_args, &hdr->res.seq_res, 0);
- }
-diff --git a/fs/pstore/inode.c b/fs/pstore/inode.c
-index 45d6110..ec9ddef 100644
---- a/fs/pstore/inode.c
-+++ b/fs/pstore/inode.c
-@@ -178,7 +178,6 @@ static loff_t pstore_file_llseek(struct file *file, loff_t off, int whence)
- }
- 
- static const struct file_operations pstore_file_operations = {
--	.owner		= THIS_MODULE,
- 	.open		= pstore_file_open,
- 	.read		= pstore_file_read,
- 	.llseek		= pstore_file_llseek,
-diff --git a/include/linux/can/dev.h b/include/linux/can/dev.h
-index 5261751..5f527094 100644
---- a/include/linux/can/dev.h
-+++ b/include/linux/can/dev.h
-@@ -32,6 +32,7 @@ enum can_mode {
-  * CAN common private data
-  */
- struct can_priv {
-+	struct net_device *dev;
- 	struct can_device_stats can_stats;
- 
- 	struct can_bittiming bittiming, data_bittiming;
-@@ -47,7 +48,7 @@ struct can_priv {
- 	u32 ctrlmode_static;	/* static enabled options for driver/hardware */
- 
- 	int restart_ms;
--	struct timer_list restart_timer;
-+	struct delayed_work restart_work;
- 
- 	int (*do_set_bittiming)(struct net_device *dev);
- 	int (*do_set_data_bittiming)(struct net_device *dev);
-diff --git a/include/linux/nvmem-consumer.h b/include/linux/nvmem-consumer.h
-index 9bb77d3..c2256d7 100644
---- a/include/linux/nvmem-consumer.h
-+++ b/include/linux/nvmem-consumer.h
-@@ -74,7 +74,7 @@ static inline void nvmem_cell_put(struct nvmem_cell *cell)
- {
- }
- 
--static inline char *nvmem_cell_read(struct nvmem_cell *cell, size_t *len)
-+static inline void *nvmem_cell_read(struct nvmem_cell *cell, size_t *len)
- {
- 	return ERR_PTR(-ENOSYS);
- }
-diff --git a/include/linux/slub_def.h b/include/linux/slub_def.h
-index d1faa01..b71b258 100644
---- a/include/linux/slub_def.h
-+++ b/include/linux/slub_def.h
-@@ -114,15 +114,17 @@ static inline void sysfs_slab_remove(struct kmem_cache *s)
- void object_err(struct kmem_cache *s, struct page *page,
- 		u8 *object, char *reason);
- 
-+void *fixup_red_left(struct kmem_cache *s, void *p);
-+
- static inline void *nearest_obj(struct kmem_cache *cache, struct page *page,
- 				void *x) {
- 	void *object = x - (x - page_address(page)) % cache->size;
- 	void *last_object = page_address(page) +
- 		(page->objects - 1) * cache->size;
--	if (unlikely(object > last_object))
--		return last_object;
--	else
--		return object;
-+	void *result = (unlikely(object > last_object)) ? last_object : object;
-+
-+	result = fixup_red_left(cache, result);
-+	return result;
- }
- 
- #endif /* _LINUX_SLUB_DEF_H */
-diff --git a/include/linux/sysctl.h b/include/linux/sysctl.h
-index fa7bc29..ef17db6c 100644
---- a/include/linux/sysctl.h
-+++ b/include/linux/sysctl.h
-@@ -41,6 +41,8 @@ extern int proc_dostring(struct ctl_table *, int,
- 			 void __user *, size_t *, loff_t *);
- extern int proc_dointvec(struct ctl_table *, int,
- 			 void __user *, size_t *, loff_t *);
-+extern int proc_douintvec(struct ctl_table *, int,
-+			 void __user *, size_t *, loff_t *);
- extern int proc_dointvec_minmax(struct ctl_table *, int,
- 				void __user *, size_t *, loff_t *);
- extern int proc_dointvec_jiffies(struct ctl_table *, int,
-diff --git a/include/scsi/scsi_transport_sas.h b/include/scsi/scsi_transport_sas.h
-index 13c0b2b..31ae074 100644
---- a/include/scsi/scsi_transport_sas.h
-+++ b/include/scsi/scsi_transport_sas.h
-@@ -15,8 +15,14 @@ static inline int is_sas_attached(struct scsi_device *sdev)
- {
- 	return 0;
- }
-+
-+static inline int scsi_is_sas_rphy(const struct device *sdev)
-+{
-+	return 0;
-+}
- #else
- extern int is_sas_attached(struct scsi_device *sdev);
-+extern int scsi_is_sas_rphy(const struct device *);
- #endif
- 
- static inline int sas_protocol_ata(enum sas_protocol proto)
-@@ -202,7 +208,6 @@ extern int sas_rphy_add(struct sas_rphy *);
- extern void sas_rphy_remove(struct sas_rphy *);
- extern void sas_rphy_delete(struct sas_rphy *);
- extern void sas_rphy_unlink(struct sas_rphy *);
--extern int scsi_is_sas_rphy(const struct device *);
- 
- struct sas_port *sas_port_alloc(struct device *, int);
- struct sas_port *sas_port_alloc_num(struct device *);
-diff --git a/kernel/cgroup.c b/kernel/cgroup.c
-index 129a7ca..b1e0cbb 100644
---- a/kernel/cgroup.c
-+++ b/kernel/cgroup.c
-@@ -3452,9 +3452,28 @@ static ssize_t cgroup_subtree_control_write(struct kernfs_open_file *of,
- 	 * Except for the root, subtree_control must be zero for a cgroup
- 	 * with tasks so that child cgroups don't compete against tasks.
- 	 */
--	if (enable && cgroup_parent(cgrp) && !list_empty(&cgrp->cset_links)) {
--		ret = -EBUSY;
--		goto out_unlock;
-+	if (enable && cgroup_parent(cgrp)) {
-+		struct cgrp_cset_link *link;
-+
-+		/*
-+		 * Because namespaces pin csets too, @cgrp->cset_links
-+		 * might not be empty even when @cgrp is empty.  Walk and
-+		 * verify each cset.
-+		 */
-+		spin_lock_irq(&css_set_lock);
-+
-+		ret = 0;
-+		list_for_each_entry(link, &cgrp->cset_links, cset_link) {
-+			if (css_set_populated(link->cset)) {
-+				ret = -EBUSY;
-+				break;
-+			}
-+		}
-+
-+		spin_unlock_irq(&css_set_lock);
-+
-+		if (ret)
-+			goto out_unlock;
- 	}
- 
- 	/* save and update control masks and prepare csses */
-@@ -3905,7 +3924,9 @@ void cgroup_file_notify(struct cgroup_file *cfile)
-  * cgroup_task_count - count the number of tasks in a cgroup.
-  * @cgrp: the cgroup in question
-  *
-- * Return the number of tasks in the cgroup.
-+ * Return the number of tasks in the cgroup.  The returned number can be
-+ * higher than the actual number of tasks due to css_set references from
-+ * namespace roots and temporary usages.
-  */
- static int cgroup_task_count(const struct cgroup *cgrp)
- {
-diff --git a/kernel/cpuset.c b/kernel/cpuset.c
-index 40b6ed5..8cee962 100644
---- a/kernel/cpuset.c
-+++ b/kernel/cpuset.c
-@@ -325,8 +325,7 @@ static struct file_system_type cpuset_fs_type = {
- /*
-  * Return in pmask the portion of a cpusets's cpus_allowed that
-  * are online.  If none are online, walk up the cpuset hierarchy
-- * until we find one that does have some online cpus.  The top
-- * cpuset always has some cpus online.
-+ * until we find one that does have some online cpus.
-  *
-  * One way or another, we guarantee to return some non-empty subset
-  * of cpu_online_mask.
-@@ -335,8 +334,20 @@ static struct file_system_type cpuset_fs_type = {
-  */
- static void guarantee_online_cpus(struct cpuset *cs, struct cpumask *pmask)
- {
--	while (!cpumask_intersects(cs->effective_cpus, cpu_online_mask))
-+	while (!cpumask_intersects(cs->effective_cpus, cpu_online_mask)) {
- 		cs = parent_cs(cs);
-+		if (unlikely(!cs)) {
-+			/*
-+			 * The top cpuset doesn't have any online cpu as a
-+			 * consequence of a race between cpuset_hotplug_work
-+			 * and cpu hotplug notifier.  But we know the top
-+			 * cpuset's effective_cpus is on its way to to be
-+			 * identical to cpu_online_mask.
-+			 */
-+			cpumask_copy(pmask, cpu_online_mask);
-+			return;
-+		}
-+	}
- 	cpumask_and(pmask, cs->effective_cpus, cpu_online_mask);
- }
- 
-diff --git a/kernel/events/core.c b/kernel/events/core.c
-index e68c0a7..31c1520 100644
---- a/kernel/events/core.c
-+++ b/kernel/events/core.c
-@@ -6064,7 +6064,7 @@ static int __perf_pmu_output_stop(void *info)
- {
- 	struct perf_event *event = info;
- 	struct pmu *pmu = event->pmu;
--	struct perf_cpu_context *cpuctx = get_cpu_ptr(pmu->pmu_cpu_context);
-+	struct perf_cpu_context *cpuctx = this_cpu_ptr(pmu->pmu_cpu_context);
- 	struct remote_output ro = {
- 		.rb	= event->rb,
- 	};
-diff --git a/kernel/fork.c b/kernel/fork.c
-index 74fd390..d6404ed 100644
---- a/kernel/fork.c
-+++ b/kernel/fork.c
-@@ -938,14 +938,12 @@ void mm_release(struct task_struct *tsk, struct mm_struct *mm)
- 	deactivate_mm(tsk, mm);
- 
- 	/*
--	 * If we're exiting normally, clear a user-space tid field if
--	 * requested.  We leave this alone when dying by signal, to leave
--	 * the value intact in a core dump, and to save the unnecessary
--	 * trouble, say, a killed vfork parent shouldn't touch this mm.
--	 * Userland only wants this done for a sys_exit.
-+	 * Signal userspace if we're not exiting with a core dump
-+	 * because we want to leave the value intact for debugging
-+	 * purposes.
- 	 */
- 	if (tsk->clear_child_tid) {
--		if (!(tsk->flags & PF_SIGNALED) &&
-+		if (!(tsk->signal->flags & SIGNAL_GROUP_COREDUMP) &&
- 		    atomic_read(&mm->mm_users) > 1) {
- 			/*
- 			 * We don't check the error code - if userspace has
-diff --git a/kernel/printk/braille.c b/kernel/printk/braille.c
-index 276762f..d5760c4 100644
---- a/kernel/printk/braille.c
-+++ b/kernel/printk/braille.c
-@@ -9,10 +9,10 @@
- 
- char *_braille_console_setup(char **str, char **brl_options)
- {
--	if (!memcmp(*str, "brl,", 4)) {
-+	if (!strncmp(*str, "brl,", 4)) {
- 		*brl_options = "";
- 		*str += 4;
--	} else if (!memcmp(str, "brl=", 4)) {
-+	} else if (!strncmp(*str, "brl=", 4)) {
- 		*brl_options = *str + 4;
- 		*str = strchr(*brl_options, ',');
- 		if (!*str)
-diff --git a/kernel/rcu/rcuperf.c b/kernel/rcu/rcuperf.c
-index 3cee0d8..8ce4eec 100644
---- a/kernel/rcu/rcuperf.c
-+++ b/kernel/rcu/rcuperf.c
-@@ -58,7 +58,7 @@ MODULE_AUTHOR("Paul E. McKenney <paulmck@linux.vnet.ibm.com>");
- #define VERBOSE_PERFOUT_ERRSTRING(s) \
- 	do { if (verbose) pr_alert("%s" PERF_FLAG "!!! %s\n", perf_type, s); } while (0)
- 
--torture_param(bool, gp_exp, true, "Use expedited GP wait primitives");
-+torture_param(bool, gp_exp, false, "Use expedited GP wait primitives");
- torture_param(int, holdoff, 10, "Holdoff time before test start (s)");
- torture_param(int, nreaders, -1, "Number of RCU reader threads");
- torture_param(int, nwriters, -1, "Number of RCU updater threads");
-@@ -363,8 +363,6 @@ rcu_perf_writer(void *arg)
- 	u64 *wdpp = writer_durations[me];
- 
- 	VERBOSE_PERFOUT_STRING("rcu_perf_writer task started");
--	WARN_ON(rcu_gp_is_expedited() && !rcu_gp_is_normal() && !gp_exp);
--	WARN_ON(rcu_gp_is_normal() && gp_exp);
- 	WARN_ON(!wdpp);
- 	set_cpus_allowed_ptr(current, cpumask_of(me % nr_cpu_ids));
- 	sp.sched_priority = 1;
-@@ -631,6 +629,16 @@ rcu_perf_init(void)
- 		firsterr = -ENOMEM;
- 		goto unwind;
- 	}
-+	if (rcu_gp_is_expedited() && !rcu_gp_is_normal() && !gp_exp) {
-+		VERBOSE_PERFOUT_ERRSTRING("All grace periods expedited, no normal ones to measure!");
-+		firsterr = -EINVAL;
-+		goto unwind;
-+	}
-+	if (rcu_gp_is_normal() && gp_exp) {
-+		VERBOSE_PERFOUT_ERRSTRING("All grace periods normal, no expedited ones to measure!");
-+		firsterr = -EINVAL;
-+		goto unwind;
-+	}
- 	for (i = 0; i < nrealwriters; i++) {
- 		writer_durations[i] =
- 			kcalloc(MAX_MEAS, sizeof(*writer_durations[i]),
-diff --git a/kernel/sched/core.c b/kernel/sched/core.c
-index 38eacc3..e1422c1 100644
---- a/kernel/sched/core.c
-+++ b/kernel/sched/core.c
-@@ -7255,7 +7255,6 @@ static void sched_rq_cpu_starting(unsigned int cpu)
- 	struct rq *rq = cpu_rq(cpu);
- 
- 	rq->calc_load_update = calc_load_update;
--	account_reset_rq(rq);
- 	update_max_interval();
- }
- 
-diff --git a/kernel/sched/sched.h b/kernel/sched/sched.h
-index 898c0d2..b4f3edf 100644
---- a/kernel/sched/sched.h
-+++ b/kernel/sched/sched.h
-@@ -1809,16 +1809,3 @@ static inline void cpufreq_trigger_update(u64 time) {}
- #else /* arch_scale_freq_capacity */
- #define arch_scale_freq_invariant()	(false)
- #endif
--
--static inline void account_reset_rq(struct rq *rq)
--{
--#ifdef CONFIG_IRQ_TIME_ACCOUNTING
--	rq->prev_irq_time = 0;
--#endif
--#ifdef CONFIG_PARAVIRT
--	rq->prev_steal_time = 0;
--#endif
--#ifdef CONFIG_PARAVIRT_TIME_ACCOUNTING
--	rq->prev_steal_time_rq = 0;
--#endif
--}
-diff --git a/kernel/sysctl.c b/kernel/sysctl.c
-index 87b2fc3..b58e447 100644
---- a/kernel/sysctl.c
-+++ b/kernel/sysctl.c
-@@ -2122,6 +2122,21 @@ static int do_proc_dointvec_conv(bool *negp, unsigned long *lvalp,
- 	return 0;
- }
- 
-+static int do_proc_douintvec_conv(bool *negp, unsigned long *lvalp,
-+				 int *valp,
-+				 int write, void *data)
-+{
-+	if (write) {
-+		if (*negp)
-+			return -EINVAL;
-+		*valp = *lvalp;
-+	} else {
-+		unsigned int val = *valp;
-+		*lvalp = (unsigned long)val;
-+	}
-+	return 0;
-+}
-+
- static const char proc_wspace_sep[] = { ' ', '\t', '\n' };
- 
- static int __do_proc_dointvec(void *tbl_data, struct ctl_table *table,
-@@ -2241,8 +2256,27 @@ static int do_proc_dointvec(struct ctl_table *table, int write,
- int proc_dointvec(struct ctl_table *table, int write,
- 		     void __user *buffer, size_t *lenp, loff_t *ppos)
- {
--    return do_proc_dointvec(table,write,buffer,lenp,ppos,
--		    	    NULL,NULL);
-+	return do_proc_dointvec(table, write, buffer, lenp, ppos, NULL, NULL);
-+}
-+
-+/**
-+ * proc_douintvec - read a vector of unsigned integers
-+ * @table: the sysctl table
-+ * @write: %TRUE if this is a write to the sysctl file
-+ * @buffer: the user buffer
-+ * @lenp: the size of the user buffer
-+ * @ppos: file position
-+ *
-+ * Reads/writes up to table->maxlen/sizeof(unsigned int) unsigned integer
-+ * values from/to the user buffer, treated as an ASCII string.
-+ *
-+ * Returns 0 on success.
-+ */
-+int proc_douintvec(struct ctl_table *table, int write,
-+		     void __user *buffer, size_t *lenp, loff_t *ppos)
-+{
-+	return do_proc_dointvec(table, write, buffer, lenp, ppos,
-+				do_proc_douintvec_conv, NULL);
- }
- 
- /*
-@@ -2840,6 +2874,12 @@ int proc_dointvec(struct ctl_table *table, int write,
- 	return -ENOSYS;
- }
- 
-+int proc_douintvec(struct ctl_table *table, int write,
-+		  void __user *buffer, size_t *lenp, loff_t *ppos)
-+{
-+	return -ENOSYS;
-+}
-+
- int proc_dointvec_minmax(struct ctl_table *table, int write,
- 		    void __user *buffer, size_t *lenp, loff_t *ppos)
- {
-@@ -2885,6 +2925,7 @@ int proc_doulongvec_ms_jiffies_minmax(struct ctl_table *table, int write,
-  * exception granted :-)
-  */
- EXPORT_SYMBOL(proc_dointvec);
-+EXPORT_SYMBOL(proc_douintvec);
- EXPORT_SYMBOL(proc_dointvec_jiffies);
- EXPORT_SYMBOL(proc_dointvec_minmax);
- EXPORT_SYMBOL(proc_dointvec_userhz_jiffies);
-diff --git a/kernel/trace/Kconfig b/kernel/trace/Kconfig
-index fafeaf8..f4b86e8 100644
---- a/kernel/trace/Kconfig
-+++ b/kernel/trace/Kconfig
-@@ -542,6 +542,7 @@ config HIST_TRIGGERS
- 	bool "Histogram triggers"
- 	depends on ARCH_HAVE_NMI_SAFE_CMPXCHG
- 	select TRACING_MAP
-+	select TRACING
- 	default n
- 	help
- 	  Hist triggers allow one or more arbitrary trace event fields
-diff --git a/lib/test_hash.c b/lib/test_hash.c
-index c9549c8..a06ac37 100644
---- a/lib/test_hash.c
-+++ b/lib/test_hash.c
-@@ -143,7 +143,7 @@ static int __init
- test_hash_init(void)
- {
- 	char buf[SIZE+1];
--	u32 string_or = 0, hash_or[2][33] = { 0 };
-+	u32 string_or = 0, hash_or[2][33] = { { 0, } };
- 	unsigned tests = 0;
- 	unsigned long long h64 = 0;
- 	int i, j;
-@@ -219,21 +219,27 @@ test_hash_init(void)
- 	}
- 
- 	/* Issue notices about skipped tests. */
--#ifndef HAVE_ARCH__HASH_32
--	pr_info("__hash_32() has no arch implementation to test.");
--#elif HAVE_ARCH__HASH_32 != 1
-+#ifdef HAVE_ARCH__HASH_32
-+#if HAVE_ARCH__HASH_32 != 1
- 	pr_info("__hash_32() is arch-specific; not compared to generic.");
- #endif
--#ifndef HAVE_ARCH_HASH_32
--	pr_info("hash_32() has no arch implementation to test.");
--#elif HAVE_ARCH_HASH_32 != 1
-+#else
-+	pr_info("__hash_32() has no arch implementation to test.");
-+#endif
-+#ifdef HAVE_ARCH_HASH_32
-+#if HAVE_ARCH_HASH_32 != 1
- 	pr_info("hash_32() is arch-specific; not compared to generic.");
- #endif
--#ifndef HAVE_ARCH_HASH_64
--	pr_info("hash_64() has no arch implementation to test.");
--#elif HAVE_ARCH_HASH_64 != 1
-+#else
-+	pr_info("hash_32() has no arch implementation to test.");
-+#endif
-+#ifdef HAVE_ARCH_HASH_64
-+#if HAVE_ARCH_HASH_64 != 1
- 	pr_info("hash_64() is arch-specific; not compared to generic.");
- #endif
-+#else
-+	pr_info("hash_64() has no arch implementation to test.");
-+#endif
- 
- 	pr_notice("%u tests passed.", tests);
- 
-diff --git a/mm/ksm.c b/mm/ksm.c
-index 4786b41..443bac3 100644
---- a/mm/ksm.c
-+++ b/mm/ksm.c
-@@ -283,7 +283,8 @@ static inline struct rmap_item *alloc_rmap_item(void)
- {
- 	struct rmap_item *rmap_item;
- 
--	rmap_item = kmem_cache_zalloc(rmap_item_cache, GFP_KERNEL);
-+	rmap_item = kmem_cache_zalloc(rmap_item_cache, GFP_KERNEL |
-+						__GFP_NORETRY | __GFP_NOWARN);
- 	if (rmap_item)
- 		ksm_rmap_items++;
- 	return rmap_item;
-diff --git a/mm/slub.c b/mm/slub.c
-index 7a6d268..b94fb36 100644
---- a/mm/slub.c
-+++ b/mm/slub.c
-@@ -124,7 +124,7 @@ static inline int kmem_cache_debug(struct kmem_cache *s)
- #endif
- }
- 
--static inline void *fixup_red_left(struct kmem_cache *s, void *p)
-+inline void *fixup_red_left(struct kmem_cache *s, void *p)
- {
- 	if (kmem_cache_debug(s) && s->flags & SLAB_RED_ZONE)
- 		p += s->red_left_pad;
-diff --git a/net/batman-adv/bat_v_elp.c b/net/batman-adv/bat_v_elp.c
-index df42eb1..63762b3 100644
---- a/net/batman-adv/bat_v_elp.c
-+++ b/net/batman-adv/bat_v_elp.c
-@@ -334,7 +334,7 @@ int batadv_v_elp_iface_enable(struct batadv_hard_iface *hard_iface)
- 		goto out;
- 
- 	skb_reserve(hard_iface->bat_v.elp_skb, ETH_HLEN + NET_IP_ALIGN);
--	elp_buff = skb_push(hard_iface->bat_v.elp_skb, BATADV_ELP_HLEN);
-+	elp_buff = skb_put(hard_iface->bat_v.elp_skb, BATADV_ELP_HLEN);
- 	elp_packet = (struct batadv_elp_packet *)elp_buff;
- 	memset(elp_packet, 0, BATADV_ELP_HLEN);
- 
-diff --git a/net/batman-adv/originator.c b/net/batman-adv/originator.c
-index ab8c4f9..1da7bfc 100644
---- a/net/batman-adv/originator.c
-+++ b/net/batman-adv/originator.c
-@@ -251,10 +251,8 @@ static void batadv_neigh_node_release(struct kref *ref)
- 	struct hlist_node *node_tmp;
- 	struct batadv_neigh_node *neigh_node;
- 	struct batadv_neigh_ifinfo *neigh_ifinfo;
--	struct batadv_algo_ops *bao;
- 
- 	neigh_node = container_of(ref, struct batadv_neigh_node, refcount);
--	bao = neigh_node->orig_node->bat_priv->bat_algo_ops;
- 
- 	hlist_for_each_entry_safe(neigh_ifinfo, node_tmp,
- 				  &neigh_node->ifinfo_list, list) {
-@@ -263,9 +261,6 @@ static void batadv_neigh_node_release(struct kref *ref)
- 
- 	batadv_hardif_neigh_put(neigh_node->hardif_neigh);
- 
--	if (bao->bat_neigh_free)
--		bao->bat_neigh_free(neigh_node);
--
- 	batadv_hardif_put(neigh_node->if_incoming);
- 
- 	kfree_rcu(neigh_node, rcu);
-diff --git a/net/batman-adv/routing.c b/net/batman-adv/routing.c
-index bfac086..69d425d 100644
---- a/net/batman-adv/routing.c
-+++ b/net/batman-adv/routing.c
-@@ -456,6 +456,29 @@ static int batadv_check_unicast_packet(struct batadv_priv *bat_priv,
- }
- 
- /**
-+ * batadv_last_bonding_get - Get last_bonding_candidate of orig_node
-+ * @orig_node: originator node whose last bonding candidate should be retrieved
-+ *
-+ * Return: last bonding candidate of router or NULL if not found
-+ *
-+ * The object is returned with refcounter increased by 1.
-+ */
-+static struct batadv_orig_ifinfo *
-+batadv_last_bonding_get(struct batadv_orig_node *orig_node)
-+{
-+	struct batadv_orig_ifinfo *last_bonding_candidate;
-+
-+	spin_lock_bh(&orig_node->neigh_list_lock);
-+	last_bonding_candidate = orig_node->last_bonding_candidate;
-+
-+	if (last_bonding_candidate)
-+		kref_get(&last_bonding_candidate->refcount);
-+	spin_unlock_bh(&orig_node->neigh_list_lock);
-+
-+	return last_bonding_candidate;
-+}
-+
-+/**
-  * batadv_last_bonding_replace - Replace last_bonding_candidate of orig_node
-  * @orig_node: originator node whose bonding candidates should be replaced
-  * @new_candidate: new bonding candidate or NULL
-@@ -525,7 +548,7 @@ batadv_find_router(struct batadv_priv *bat_priv,
- 	 * router - obviously there are no other candidates.
- 	 */
- 	rcu_read_lock();
--	last_candidate = orig_node->last_bonding_candidate;
-+	last_candidate = batadv_last_bonding_get(orig_node);
- 	if (last_candidate)
- 		last_cand_router = rcu_dereference(last_candidate->router);
- 
-@@ -617,6 +640,9 @@ next:
- 		batadv_orig_ifinfo_put(next_candidate);
- 	}
- 
-+	if (last_candidate)
-+		batadv_orig_ifinfo_put(last_candidate);
-+
- 	return router;
- }
- 
-diff --git a/net/batman-adv/types.h b/net/batman-adv/types.h
-index 74d865a..40aed16 100644
---- a/net/batman-adv/types.h
-+++ b/net/batman-adv/types.h
-@@ -1284,8 +1284,6 @@ struct batadv_forw_packet {
-  *  better than neigh2 for their respective outgoing interface from the metric
-  *  prospective
-  * @bat_neigh_print: print the single hop neighbor list (optional)
-- * @bat_neigh_free: free the resources allocated by the routing algorithm for a
-- *  neigh_node object
-  * @bat_orig_print: print the originator table (optional)
-  * @bat_orig_free: free the resources allocated by the routing algorithm for an
-  *  orig_node object
-@@ -1316,7 +1314,6 @@ struct batadv_algo_ops {
- 		 struct batadv_neigh_node *neigh2,
- 		 struct batadv_hard_iface *if_outgoing2);
- 	void (*bat_neigh_print)(struct batadv_priv *priv, struct seq_file *seq);
--	void (*bat_neigh_free)(struct batadv_neigh_node *neigh);
- 	/* orig_node handling API */
- 	void (*bat_orig_print)(struct batadv_priv *priv, struct seq_file *seq,
- 			       struct batadv_hard_iface *hard_iface);
-diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
-index eb4f5f2..106643e 100644
---- a/net/bluetooth/l2cap_core.c
-+++ b/net/bluetooth/l2cap_core.c
-@@ -32,6 +32,7 @@
- 
- #include <linux/debugfs.h>
- #include <linux/crc16.h>
-+#include <linux/filter.h>
- 
- #include <net/bluetooth/bluetooth.h>
- #include <net/bluetooth/hci_core.h>
-@@ -5835,6 +5836,9 @@ static int l2cap_reassemble_sdu(struct l2cap_chan *chan, struct sk_buff *skb,
- 		if (chan->sdu)
- 			break;
- 
-+		if (!pskb_may_pull(skb, L2CAP_SDULEN_SIZE))
-+			break;
-+
- 		chan->sdu_len = get_unaligned_le16(skb->data);
- 		skb_pull(skb, L2CAP_SDULEN_SIZE);
- 
-@@ -6610,6 +6614,10 @@ static int l2cap_data_rcv(struct l2cap_chan *chan, struct sk_buff *skb)
- 		goto drop;
- 	}
- 
-+	if ((chan->mode == L2CAP_MODE_ERTM ||
-+	     chan->mode == L2CAP_MODE_STREAMING) && sk_filter(chan->data, skb))
-+		goto drop;
-+
- 	if (!control->sframe) {
- 		int err;
- 
-diff --git a/net/bluetooth/l2cap_sock.c b/net/bluetooth/l2cap_sock.c
-index 1842141..a8ba752 100644
---- a/net/bluetooth/l2cap_sock.c
-+++ b/net/bluetooth/l2cap_sock.c
-@@ -1019,7 +1019,7 @@ static int l2cap_sock_recvmsg(struct socket *sock, struct msghdr *msg,
- 		goto done;
- 
- 	if (pi->rx_busy_skb) {
--		if (!sock_queue_rcv_skb(sk, pi->rx_busy_skb))
-+		if (!__sock_queue_rcv_skb(sk, pi->rx_busy_skb))
- 			pi->rx_busy_skb = NULL;
- 		else
- 			goto done;
-@@ -1270,7 +1270,17 @@ static int l2cap_sock_recv_cb(struct l2cap_chan *chan, struct sk_buff *skb)
- 		goto done;
- 	}
- 
--	err = sock_queue_rcv_skb(sk, skb);
-+	if (chan->mode != L2CAP_MODE_ERTM &&
-+	    chan->mode != L2CAP_MODE_STREAMING) {
-+		/* Even if no filter is attached, we could potentially
-+		 * get errors from security modules, etc.
-+		 */
-+		err = sk_filter(sk, skb);
-+		if (err)
-+			goto done;
-+	}
-+
-+	err = __sock_queue_rcv_skb(sk, skb);
- 
- 	/* For ERTM, handle one skb that doesn't fit into the recv
- 	 * buffer.  This is important to do because the data frames
-diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
-index 8bad2ad..5f0ed8c 100644
---- a/net/mac80211/tx.c
-+++ b/net/mac80211/tx.c
-@@ -1330,8 +1330,12 @@ out:
- 	spin_unlock_bh(&txqi->queue.lock);
- 
- 	if (skb && skb_has_frag_list(skb) &&
--	    !ieee80211_hw_check(&local->hw, TX_FRAG_LIST))
--		skb_linearize(skb);
-+	    !ieee80211_hw_check(&local->hw, TX_FRAG_LIST)) {
-+		if (skb_linearize(skb)) {
-+			ieee80211_free_txskb(&local->hw, skb);
-+			return NULL;
-+		}
-+	}
- 
- 	return skb;
- }
-diff --git a/net/sunrpc/clnt.c b/net/sunrpc/clnt.c
-index 2808d55..0294ada 100644
---- a/net/sunrpc/clnt.c
-+++ b/net/sunrpc/clnt.c
-@@ -453,7 +453,7 @@ static struct rpc_clnt *rpc_create_xprt(struct rpc_create_args *args,
- 	struct rpc_xprt_switch *xps;
- 
- 	if (args->bc_xprt && args->bc_xprt->xpt_bc_xps) {
--		WARN_ON(args->protocol != XPRT_TRANSPORT_BC_TCP);
-+		WARN_ON_ONCE(!(args->protocol & XPRT_TRANSPORT_BC));
- 		xps = args->bc_xprt->xpt_bc_xps;
- 		xprt_switch_get(xps);
- 	} else {
-@@ -520,7 +520,7 @@ struct rpc_clnt *rpc_create(struct rpc_create_args *args)
- 	char servername[48];
- 
- 	if (args->bc_xprt) {
--		WARN_ON(args->protocol != XPRT_TRANSPORT_BC_TCP);
-+		WARN_ON_ONCE(!(args->protocol & XPRT_TRANSPORT_BC));
- 		xprt = args->bc_xprt->xpt_bc_xprt;
- 		if (xprt) {
- 			xprt_get(xprt);
-diff --git a/net/sunrpc/svc.c b/net/sunrpc/svc.c
-index cc98528..c5b0cb4 100644
---- a/net/sunrpc/svc.c
-+++ b/net/sunrpc/svc.c
-@@ -1188,11 +1188,17 @@ svc_process_common(struct svc_rqst *rqstp, struct kvec *argv, struct kvec *resv)
- 		*statp = procp->pc_func(rqstp, rqstp->rq_argp, rqstp->rq_resp);
- 
- 		/* Encode reply */
--		if (test_bit(RQ_DROPME, &rqstp->rq_flags)) {
-+		if (*statp == rpc_drop_reply ||
-+		    test_bit(RQ_DROPME, &rqstp->rq_flags)) {
- 			if (procp->pc_release)
- 				procp->pc_release(rqstp, NULL, rqstp->rq_resp);
- 			goto dropit;
- 		}
-+		if (*statp == rpc_autherr_badcred) {
-+			if (procp->pc_release)
-+				procp->pc_release(rqstp, NULL, rqstp->rq_resp);
-+			goto err_bad_auth;
-+		}
- 		if (*statp == rpc_success &&
- 		    (xdr = procp->pc_encode) &&
- 		    !xdr(rqstp, resv->iov_base+resv->iov_len, rqstp->rq_resp)) {
-diff --git a/net/sunrpc/xprtrdma/fmr_ops.c b/net/sunrpc/xprtrdma/fmr_ops.c
-index 6326ebe..c748ff6 100644
---- a/net/sunrpc/xprtrdma/fmr_ops.c
-+++ b/net/sunrpc/xprtrdma/fmr_ops.c
-@@ -63,9 +63,12 @@ static int
- __fmr_unmap(struct rpcrdma_mw *mw)
- {
- 	LIST_HEAD(l);
-+	int rc;
- 
- 	list_add(&mw->fmr.fmr->list, &l);
--	return ib_unmap_fmr(&l);
-+	rc = ib_unmap_fmr(&l);
-+	list_del_init(&mw->fmr.fmr->list);
-+	return rc;
- }
- 
- /* Deferred reset of a single FMR. Generate a fresh rkey by
-@@ -267,7 +270,7 @@ fmr_op_unmap_sync(struct rpcrdma_xprt *r_xprt, struct rpcrdma_req *req)
- 		seg = &req->rl_segments[i];
- 		mw = seg->rl_mw;
- 
--		list_add(&mw->fmr.fmr->list, &unmap_list);
-+		list_add_tail(&mw->fmr.fmr->list, &unmap_list);
- 
- 		i += seg->mr_nsegs;
- 	}
-@@ -280,7 +283,9 @@ fmr_op_unmap_sync(struct rpcrdma_xprt *r_xprt, struct rpcrdma_req *req)
- 	 */
- 	for (i = 0, nchunks = req->rl_nchunks; nchunks; nchunks--) {
- 		seg = &req->rl_segments[i];
-+		mw = seg->rl_mw;
- 
-+		list_del_init(&mw->fmr.fmr->list);
- 		__fmr_dma_unmap(r_xprt, seg);
- 		rpcrdma_put_mw(r_xprt, seg->rl_mw);
- 
-diff --git a/scripts/recordmcount.c b/scripts/recordmcount.c
-index 42396a7..a68f031 100644
---- a/scripts/recordmcount.c
-+++ b/scripts/recordmcount.c
-@@ -363,6 +363,7 @@ is_mcounted_section_name(char const *const txtname)
- 		strcmp(".sched.text",    txtname) == 0 ||
- 		strcmp(".spinlock.text", txtname) == 0 ||
- 		strcmp(".irqentry.text", txtname) == 0 ||
-+		strcmp(".softirqentry.text", txtname) == 0 ||
- 		strcmp(".kprobes.text", txtname) == 0 ||
- 		strcmp(".text.unlikely", txtname) == 0;
- }
-diff --git a/scripts/recordmcount.pl b/scripts/recordmcount.pl
-index 96e2486..2d48011 100755
---- a/scripts/recordmcount.pl
-+++ b/scripts/recordmcount.pl
-@@ -134,6 +134,7 @@ my %text_sections = (
-      ".sched.text" => 1,
-      ".spinlock.text" => 1,
-      ".irqentry.text" => 1,
-+     ".softirqentry.text" => 1,
-      ".kprobes.text" => 1,
-      ".text.unlikely" => 1,
- );
-diff --git a/sound/pci/hda/patch_conexant.c b/sound/pci/hda/patch_conexant.c
-index 56fefbd..ed62748 100644
---- a/sound/pci/hda/patch_conexant.c
-+++ b/sound/pci/hda/patch_conexant.c
-@@ -261,6 +261,7 @@ enum {
- 	CXT_FIXUP_HP_530,
- 	CXT_FIXUP_CAP_MIX_AMP_5047,
- 	CXT_FIXUP_MUTE_LED_EAPD,
-+	CXT_FIXUP_HP_SPECTRE,
- };
- 
- /* for hda_fixup_thinkpad_acpi() */
-@@ -765,6 +766,14 @@ static const struct hda_fixup cxt_fixups[] = {
- 		.type = HDA_FIXUP_FUNC,
- 		.v.func = cxt_fixup_mute_led_eapd,
- 	},
-+	[CXT_FIXUP_HP_SPECTRE] = {
-+		.type = HDA_FIXUP_PINS,
-+		.v.pins = (const struct hda_pintbl[]) {
-+			/* enable NID 0x1d for the speaker on top */
-+			{ 0x1d, 0x91170111 },
-+			{ }
-+		}
-+	},
- };
- 
- static const struct snd_pci_quirk cxt5045_fixups[] = {
-@@ -814,6 +823,7 @@ static const struct snd_pci_quirk cxt5066_fixups[] = {
- 	SND_PCI_QUIRK(0x1025, 0x0543, "Acer Aspire One 522", CXT_FIXUP_STEREO_DMIC),
- 	SND_PCI_QUIRK(0x1025, 0x054c, "Acer Aspire 3830TG", CXT_FIXUP_ASPIRE_DMIC),
- 	SND_PCI_QUIRK(0x1025, 0x054f, "Acer Aspire 4830T", CXT_FIXUP_ASPIRE_DMIC),
-+	SND_PCI_QUIRK(0x103c, 0x8174, "HP Spectre x360", CXT_FIXUP_HP_SPECTRE),
- 	SND_PCI_QUIRK(0x1043, 0x138d, "Asus", CXT_FIXUP_HEADPHONE_MIC_PIN),
- 	SND_PCI_QUIRK(0x152d, 0x0833, "OLPC XO-1.5", CXT_FIXUP_OLPC_XO),
- 	SND_PCI_QUIRK(0x17aa, 0x20f2, "Lenovo T400", CXT_PINCFG_LENOVO_TP410),
-diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
-index eaee626..b1fa50a 100644
---- a/sound/pci/hda/patch_realtek.c
-+++ b/sound/pci/hda/patch_realtek.c
-@@ -5790,6 +5790,13 @@ static const struct hda_model_fixup alc269_fixup_models[] = {
- 	{0x14, 0x90170110}, \
- 	{0x15, 0x0221401f}
- 
-+#define ALC295_STANDARD_PINS \
-+	{0x12, 0xb7a60130}, \
-+	{0x14, 0x90170110}, \
-+	{0x17, 0x21014020}, \
-+	{0x18, 0x21a19030}, \
-+	{0x21, 0x04211020}
-+
- #define ALC298_STANDARD_PINS \
- 	{0x12, 0x90a60130}, \
- 	{0x21, 0x03211020}
-@@ -5830,6 +5837,10 @@ static const struct snd_hda_pin_quirk alc269_pin_fixup_tbl[] = {
- 		{0x14, 0x90170120},
- 		{0x21, 0x02211030}),
- 	SND_HDA_PIN_QUIRK(0x10ec0255, 0x1028, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE,
-+		{0x14, 0x90170110},
-+		{0x1b, 0x02011020},
-+		{0x21, 0x0221101f}),
-+	SND_HDA_PIN_QUIRK(0x10ec0255, 0x1028, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE,
- 		{0x14, 0x90170130},
- 		{0x1b, 0x01014020},
- 		{0x21, 0x0221103f}),
-@@ -5895,6 +5906,10 @@ static const struct snd_hda_pin_quirk alc269_pin_fixup_tbl[] = {
- 		{0x14, 0x90170120},
- 		{0x21, 0x02211030}),
- 	SND_HDA_PIN_QUIRK(0x10ec0256, 0x1028, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE,
-+		{0x12, 0xb7a60130},
-+		{0x14, 0x90170110},
-+		{0x21, 0x02211020}),
-+	SND_HDA_PIN_QUIRK(0x10ec0256, 0x1028, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE,
- 		ALC256_STANDARD_PINS),
- 	SND_HDA_PIN_QUIRK(0x10ec0280, 0x103c, "HP", ALC280_FIXUP_HP_GPIO4,
- 		{0x12, 0x90a60130},
-@@ -6005,6 +6020,8 @@ static const struct snd_hda_pin_quirk alc269_pin_fixup_tbl[] = {
- 	SND_HDA_PIN_QUIRK(0x10ec0293, 0x1028, "Dell", ALC293_FIXUP_DELL1_MIC_NO_PRESENCE,
- 		ALC292_STANDARD_PINS,
- 		{0x13, 0x90a60140}),
-+	SND_HDA_PIN_QUIRK(0x10ec0295, 0x1028, "Dell", ALC269_FIXUP_DELL1_MIC_NO_PRESENCE,
-+		ALC295_STANDARD_PINS),
- 	SND_HDA_PIN_QUIRK(0x10ec0298, 0x1028, "Dell", ALC298_FIXUP_DELL1_MIC_NO_PRESENCE,
- 		ALC298_STANDARD_PINS,
- 		{0x17, 0x90170110}),
-diff --git a/sound/soc/intel/skylake/skl.c b/sound/soc/intel/skylake/skl.c
-index 06d8c26..d5a0327 100644
---- a/sound/soc/intel/skylake/skl.c
-+++ b/sound/soc/intel/skylake/skl.c
-@@ -659,8 +659,10 @@ static int skl_probe(struct pci_dev *pci,
- 
- 	skl->nhlt = skl_nhlt_init(bus->dev);
- 
--	if (skl->nhlt == NULL)
-+	if (skl->nhlt == NULL) {
-+		err = -ENODEV;
- 		goto out_free;
-+	}
- 
- 	skl_nhlt_update_topology_bin(skl);
- 
-diff --git a/sound/soc/omap/omap-mcpdm.c b/sound/soc/omap/omap-mcpdm.c
-index b837265..8d0d45d 100644
---- a/sound/soc/omap/omap-mcpdm.c
-+++ b/sound/soc/omap/omap-mcpdm.c
-@@ -390,8 +390,8 @@ static int omap_mcpdm_probe(struct snd_soc_dai *dai)
- 	pm_runtime_get_sync(mcpdm->dev);
- 	omap_mcpdm_write(mcpdm, MCPDM_REG_CTRL, 0x00);
- 
--	ret = devm_request_irq(mcpdm->dev, mcpdm->irq, omap_mcpdm_irq_handler,
--				0, "McPDM", (void *)mcpdm);
-+	ret = request_irq(mcpdm->irq, omap_mcpdm_irq_handler, 0, "McPDM",
-+			  (void *)mcpdm);
- 
- 	pm_runtime_put_sync(mcpdm->dev);
- 
-@@ -416,6 +416,7 @@ static int omap_mcpdm_remove(struct snd_soc_dai *dai)
- {
- 	struct omap_mcpdm *mcpdm = snd_soc_dai_get_drvdata(dai);
- 
-+	free_irq(mcpdm->irq, (void *)mcpdm);
- 	pm_runtime_disable(mcpdm->dev);
- 
- 	return 0;
diff --git a/4.7.7/0000_README b/4.7.8/0000_README
index 4e38593..de4b64f 100644
--- a/4.7.7/0000_README
+++ b/4.7.8/0000_README
@@ -2,11 +2,11 @@ README
 -----------------------------------------------------------------------------
 Individual Patch Descriptions:
 -----------------------------------------------------------------------------
-Patch:	1006_linux-4.7.7.patch 
+Patch:	1007_linux-4.7.8.patch 
 From:	http://www.kernel.org
-Desc:	Linux 4.7.7
+Desc:	Linux 4.7.8
 
-Patch:	4420_grsecurity-3.1-4.7.7-201610101902.patch
+Patch:	4420_grsecurity-3.1-4.7.8-201610161720.patch
 From:	http://www.grsecurity.net
 Desc:	hardened-sources base patch from upstream grsecurity
 
diff --git a/4.7.8/1007_linux-4.7.8.patch b/4.7.8/1007_linux-4.7.8.patch
new file mode 100644
index 0000000..dd5c7d8
--- /dev/null
+++ b/4.7.8/1007_linux-4.7.8.patch
@@ -0,0 +1,1626 @@
+diff --git a/Documentation/virtual/kvm/devices/vcpu.txt b/Documentation/virtual/kvm/devices/vcpu.txt
+index c041658..02f5068 100644
+--- a/Documentation/virtual/kvm/devices/vcpu.txt
++++ b/Documentation/virtual/kvm/devices/vcpu.txt
+@@ -30,4 +30,6 @@ Returns: -ENODEV: PMUv3 not supported
+                  attribute
+          -EBUSY: PMUv3 already initialized
+ 
+-Request the initialization of the PMUv3.
++Request the initialization of the PMUv3.  This must be done after creating the
++in-kernel irqchip.  Creating a PMU with a userspace irqchip is currently not
++supported.
+diff --git a/Makefile b/Makefile
+index 320a930..4e17baa 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 4
+ PATCHLEVEL = 7
+-SUBLEVEL = 7
++SUBLEVEL = 8
+ EXTRAVERSION =
+ NAME = Psychotic Stoned Sheep
+ 
+diff --git a/arch/arm/boot/dts/armada-390.dtsi b/arch/arm/boot/dts/armada-390.dtsi
+index 094e39c..6cd18d8 100644
+--- a/arch/arm/boot/dts/armada-390.dtsi
++++ b/arch/arm/boot/dts/armada-390.dtsi
+@@ -47,6 +47,8 @@
+ #include "armada-39x.dtsi"
+ 
+ / {
++	compatible = "marvell,armada390";
++
+ 	soc {
+ 		internal-regs {
+ 			pinctrl@18000 {
+@@ -54,4 +56,5 @@
+ 				reg = <0x18000 0x20>;
+ 			};
+ 		};
++	};
+ };
+diff --git a/arch/arm/boot/dts/qcom-apq8064.dtsi b/arch/arm/boot/dts/qcom-apq8064.dtsi
+index df96ccd..779f844 100644
+--- a/arch/arm/boot/dts/qcom-apq8064.dtsi
++++ b/arch/arm/boot/dts/qcom-apq8064.dtsi
+@@ -5,6 +5,7 @@
+ #include <dt-bindings/reset/qcom,gcc-msm8960.h>
+ #include <dt-bindings/clock/qcom,mmcc-msm8960.h>
+ #include <dt-bindings/soc/qcom,gsbi.h>
++#include <dt-bindings/interrupt-controller/irq.h>
+ #include <dt-bindings/interrupt-controller/arm-gic.h>
+ / {
+ 	model = "Qualcomm APQ8064";
+@@ -552,22 +553,50 @@
+ 					compatible = "qcom,pm8921-gpio",
+ 						     "qcom,ssbi-gpio";
+ 					reg = <0x150>;
+-					interrupts = <192 1>, <193 1>, <194 1>,
+-						     <195 1>, <196 1>, <197 1>,
+-						     <198 1>, <199 1>, <200 1>,
+-						     <201 1>, <202 1>, <203 1>,
+-						     <204 1>, <205 1>, <206 1>,
+-						     <207 1>, <208 1>, <209 1>,
+-						     <210 1>, <211 1>, <212 1>,
+-						     <213 1>, <214 1>, <215 1>,
+-						     <216 1>, <217 1>, <218 1>,
+-						     <219 1>, <220 1>, <221 1>,
+-						     <222 1>, <223 1>, <224 1>,
+-						     <225 1>, <226 1>, <227 1>,
+-						     <228 1>, <229 1>, <230 1>,
+-						     <231 1>, <232 1>, <233 1>,
+-						     <234 1>, <235 1>;
+-
++					interrupts = <192 IRQ_TYPE_NONE>,
++						     <193 IRQ_TYPE_NONE>,
++						     <194 IRQ_TYPE_NONE>,
++						     <195 IRQ_TYPE_NONE>,
++						     <196 IRQ_TYPE_NONE>,
++						     <197 IRQ_TYPE_NONE>,
++						     <198 IRQ_TYPE_NONE>,
++						     <199 IRQ_TYPE_NONE>,
++						     <200 IRQ_TYPE_NONE>,
++						     <201 IRQ_TYPE_NONE>,
++						     <202 IRQ_TYPE_NONE>,
++						     <203 IRQ_TYPE_NONE>,
++						     <204 IRQ_TYPE_NONE>,
++						     <205 IRQ_TYPE_NONE>,
++						     <206 IRQ_TYPE_NONE>,
++						     <207 IRQ_TYPE_NONE>,
++						     <208 IRQ_TYPE_NONE>,
++						     <209 IRQ_TYPE_NONE>,
++						     <210 IRQ_TYPE_NONE>,
++						     <211 IRQ_TYPE_NONE>,
++						     <212 IRQ_TYPE_NONE>,
++						     <213 IRQ_TYPE_NONE>,
++						     <214 IRQ_TYPE_NONE>,
++						     <215 IRQ_TYPE_NONE>,
++						     <216 IRQ_TYPE_NONE>,
++						     <217 IRQ_TYPE_NONE>,
++						     <218 IRQ_TYPE_NONE>,
++						     <219 IRQ_TYPE_NONE>,
++						     <220 IRQ_TYPE_NONE>,
++						     <221 IRQ_TYPE_NONE>,
++						     <222 IRQ_TYPE_NONE>,
++						     <223 IRQ_TYPE_NONE>,
++						     <224 IRQ_TYPE_NONE>,
++						     <225 IRQ_TYPE_NONE>,
++						     <226 IRQ_TYPE_NONE>,
++						     <227 IRQ_TYPE_NONE>,
++						     <228 IRQ_TYPE_NONE>,
++						     <229 IRQ_TYPE_NONE>,
++						     <230 IRQ_TYPE_NONE>,
++						     <231 IRQ_TYPE_NONE>,
++						     <232 IRQ_TYPE_NONE>,
++						     <233 IRQ_TYPE_NONE>,
++						     <234 IRQ_TYPE_NONE>,
++						     <235 IRQ_TYPE_NONE>;
+ 					gpio-controller;
+ 					#gpio-cells = <2>;
+ 
+@@ -580,9 +609,18 @@
+ 					gpio-controller;
+ 					#gpio-cells = <2>;
+ 					interrupts =
+-					<128 1>, <129 1>, <130 1>, <131 1>,
+-					<132 1>, <133 1>, <134 1>, <135 1>,
+-					<136 1>, <137 1>, <138 1>, <139 1>;
++					<128 IRQ_TYPE_NONE>,
++					<129 IRQ_TYPE_NONE>,
++					<130 IRQ_TYPE_NONE>,
++					<131 IRQ_TYPE_NONE>,
++					<132 IRQ_TYPE_NONE>,
++					<133 IRQ_TYPE_NONE>,
++					<134 IRQ_TYPE_NONE>,
++					<135 IRQ_TYPE_NONE>,
++					<136 IRQ_TYPE_NONE>,
++					<137 IRQ_TYPE_NONE>,
++					<138 IRQ_TYPE_NONE>,
++					<139 IRQ_TYPE_NONE>;
+ 				};
+ 
+ 				rtc@11d {
+diff --git a/arch/arm64/kernel/stacktrace.c b/arch/arm64/kernel/stacktrace.c
+index d9751a4..d34fd72 100644
+--- a/arch/arm64/kernel/stacktrace.c
++++ b/arch/arm64/kernel/stacktrace.c
+@@ -43,6 +43,9 @@ int notrace unwind_frame(struct task_struct *tsk, struct stackframe *frame)
+ 	unsigned long fp = frame->fp;
+ 	unsigned long irq_stack_ptr;
+ 
++	if (!tsk)
++		tsk = current;
++
+ 	/*
+ 	 * Switching between stacks is valid when tracing current and in
+ 	 * non-preemptible context.
+@@ -67,7 +70,7 @@ int notrace unwind_frame(struct task_struct *tsk, struct stackframe *frame)
+ 	frame->pc = READ_ONCE_NOCHECK(*(unsigned long *)(fp + 8));
+ 
+ #ifdef CONFIG_FUNCTION_GRAPH_TRACER
+-	if (tsk && tsk->ret_stack &&
++	if (tsk->ret_stack &&
+ 			(frame->pc == (unsigned long)return_to_handler)) {
+ 		/*
+ 		 * This is a case where function graph tracer has
+diff --git a/arch/arm64/kernel/traps.c b/arch/arm64/kernel/traps.c
+index 2a43012..f014df9 100644
+--- a/arch/arm64/kernel/traps.c
++++ b/arch/arm64/kernel/traps.c
+@@ -149,6 +149,11 @@ static void dump_backtrace(struct pt_regs *regs, struct task_struct *tsk)
+ 	unsigned long irq_stack_ptr;
+ 	int skip;
+ 
++	pr_debug("%s(regs = %p tsk = %p)\n", __func__, regs, tsk);
++
++	if (!tsk)
++		tsk = current;
++
+ 	/*
+ 	 * Switching between stacks is valid when tracing current and in
+ 	 * non-preemptible context.
+@@ -158,11 +163,6 @@ static void dump_backtrace(struct pt_regs *regs, struct task_struct *tsk)
+ 	else
+ 		irq_stack_ptr = 0;
+ 
+-	pr_debug("%s(regs = %p tsk = %p)\n", __func__, regs, tsk);
+-
+-	if (!tsk)
+-		tsk = current;
+-
+ 	if (tsk == current) {
+ 		frame.fp = (unsigned long)__builtin_frame_address(0);
+ 		frame.sp = current_stack_pointer;
+diff --git a/arch/mips/kvm/emulate.c b/arch/mips/kvm/emulate.c
+index 2b42a74..efa592f 100644
+--- a/arch/mips/kvm/emulate.c
++++ b/arch/mips/kvm/emulate.c
+@@ -807,6 +807,47 @@ enum emulation_result kvm_mips_emul_tlbr(struct kvm_vcpu *vcpu)
+ 	return EMULATE_FAIL;
+ }
+ 
++/**
++ * kvm_mips_invalidate_guest_tlb() - Indicates a change in guest MMU map.
++ * @vcpu:	VCPU with changed mappings.
++ * @tlb:	TLB entry being removed.
++ *
++ * This is called to indicate a single change in guest MMU mappings, so that we
++ * can arrange TLB flushes on this and other CPUs.
++ */
++static void kvm_mips_invalidate_guest_tlb(struct kvm_vcpu *vcpu,
++					  struct kvm_mips_tlb *tlb)
++{
++	int cpu, i;
++	bool user;
++
++	/* No need to flush for entries which are already invalid */
++	if (!((tlb->tlb_lo[0] | tlb->tlb_lo[1]) & ENTRYLO_V))
++		return;
++	/* User address space doesn't need flushing for KSeg2/3 changes */
++	user = tlb->tlb_hi < KVM_GUEST_KSEG0;
++
++	preempt_disable();
++
++	/*
++	 * Probe the shadow host TLB for the entry being overwritten, if one
++	 * matches, invalidate it
++	 */
++	kvm_mips_host_tlb_inv(vcpu, tlb->tlb_hi);
++
++	/* Invalidate the whole ASID on other CPUs */
++	cpu = smp_processor_id();
++	for_each_possible_cpu(i) {
++		if (i == cpu)
++			continue;
++		if (user)
++			vcpu->arch.guest_user_asid[i] = 0;
++		vcpu->arch.guest_kernel_asid[i] = 0;
++	}
++
++	preempt_enable();
++}
++
+ /* Write Guest TLB Entry @ Index */
+ enum emulation_result kvm_mips_emul_tlbwi(struct kvm_vcpu *vcpu)
+ {
+@@ -826,11 +867,8 @@ enum emulation_result kvm_mips_emul_tlbwi(struct kvm_vcpu *vcpu)
+ 	}
+ 
+ 	tlb = &vcpu->arch.guest_tlb[index];
+-	/*
+-	 * Probe the shadow host TLB for the entry being overwritten, if one
+-	 * matches, invalidate it
+-	 */
+-	kvm_mips_host_tlb_inv(vcpu, tlb->tlb_hi);
++
++	kvm_mips_invalidate_guest_tlb(vcpu, tlb);
+ 
+ 	tlb->tlb_mask = kvm_read_c0_guest_pagemask(cop0);
+ 	tlb->tlb_hi = kvm_read_c0_guest_entryhi(cop0);
+@@ -859,11 +897,7 @@ enum emulation_result kvm_mips_emul_tlbwr(struct kvm_vcpu *vcpu)
+ 
+ 	tlb = &vcpu->arch.guest_tlb[index];
+ 
+-	/*
+-	 * Probe the shadow host TLB for the entry being overwritten, if one
+-	 * matches, invalidate it
+-	 */
+-	kvm_mips_host_tlb_inv(vcpu, tlb->tlb_hi);
++	kvm_mips_invalidate_guest_tlb(vcpu, tlb);
+ 
+ 	tlb->tlb_mask = kvm_read_c0_guest_pagemask(cop0);
+ 	tlb->tlb_hi = kvm_read_c0_guest_entryhi(cop0);
+@@ -982,6 +1016,7 @@ enum emulation_result kvm_mips_emulate_CP0(uint32_t inst, uint32_t *opc,
+ 	int32_t rt, rd, copz, sel, co_bit, op;
+ 	uint32_t pc = vcpu->arch.pc;
+ 	unsigned long curr_pc;
++	int cpu, i;
+ 
+ 	/*
+ 	 * Update PC and hold onto current PC in case there is
+@@ -1089,8 +1124,16 @@ enum emulation_result kvm_mips_emulate_CP0(uint32_t inst, uint32_t *opc,
+ 						vcpu->arch.gprs[rt]
+ 						& KVM_ENTRYHI_ASID);
+ 
++					preempt_disable();
+ 					/* Blow away the shadow host TLBs */
+ 					kvm_mips_flush_host_tlb(1);
++					cpu = smp_processor_id();
++					for_each_possible_cpu(i)
++						if (i != cpu) {
++							vcpu->arch.guest_user_asid[i] = 0;
++							vcpu->arch.guest_kernel_asid[i] = 0;
++						}
++					preempt_enable();
+ 				}
+ 				kvm_write_c0_guest_entryhi(cop0,
+ 							   vcpu->arch.gprs[rt]);
+diff --git a/arch/powerpc/include/asm/pci-bridge.h b/arch/powerpc/include/asm/pci-bridge.h
+index 467c0b0..9e9d38a 100644
+--- a/arch/powerpc/include/asm/pci-bridge.h
++++ b/arch/powerpc/include/asm/pci-bridge.h
+@@ -299,6 +299,7 @@ extern void pci_process_bridge_OF_ranges(struct pci_controller *hose,
+ /* Allocate & free a PCI host bridge structure */
+ extern struct pci_controller *pcibios_alloc_controller(struct device_node *dev);
+ extern void pcibios_free_controller(struct pci_controller *phb);
++extern void pcibios_free_controller_deferred(struct pci_host_bridge *bridge);
+ 
+ #ifdef CONFIG_PCI
+ extern int pcibios_vaddr_is_ioport(void __iomem *address);
+diff --git a/arch/powerpc/include/asm/reg.h b/arch/powerpc/include/asm/reg.h
+index a0948f4..145e5b7 100644
+--- a/arch/powerpc/include/asm/reg.h
++++ b/arch/powerpc/include/asm/reg.h
+@@ -718,6 +718,7 @@
+ #define   MMCR0_FCHV	0x00000001UL /* freeze conditions in hypervisor mode */
+ #define SPRN_MMCR1	798
+ #define SPRN_MMCR2	785
++#define SPRN_UMMCR2	769
+ #define SPRN_MMCRA	0x312
+ #define   MMCRA_SDSYNC	0x80000000UL /* SDAR synced with SIAR */
+ #define   MMCRA_SDAR_DCACHE_MISS 0x40000000UL
+diff --git a/arch/powerpc/kernel/pci-common.c b/arch/powerpc/kernel/pci-common.c
+index 0f7a60f..14af45c 100644
+--- a/arch/powerpc/kernel/pci-common.c
++++ b/arch/powerpc/kernel/pci-common.c
+@@ -103,6 +103,42 @@ void pcibios_free_controller(struct pci_controller *phb)
+ EXPORT_SYMBOL_GPL(pcibios_free_controller);
+ 
+ /*
++ * This function is used to call pcibios_free_controller()
++ * in a deferred manner: a callback from the PCI subsystem.
++ *
++ * _*DO NOT*_ call pcibios_free_controller() explicitly if
++ * this is used (or it may access an invalid *phb pointer).
++ *
++ * The callback occurs when all references to the root bus
++ * are dropped (e.g., child buses/devices and their users).
++ *
++ * It's called as .release_fn() of 'struct pci_host_bridge'
++ * which is associated with the 'struct pci_controller.bus'
++ * (root bus) - it expects .release_data to hold a pointer
++ * to 'struct pci_controller'.
++ *
++ * In order to use it, register .release_fn()/release_data
++ * like this:
++ *
++ * pci_set_host_bridge_release(bridge,
++ *                             pcibios_free_controller_deferred
++ *                             (void *) phb);
++ *
++ * e.g. in the pcibios_root_bridge_prepare() callback from
++ * pci_create_root_bus().
++ */
++void pcibios_free_controller_deferred(struct pci_host_bridge *bridge)
++{
++	struct pci_controller *phb = (struct pci_controller *)
++					 bridge->release_data;
++
++	pr_debug("domain %d, dynamic %d\n", phb->global_number, phb->is_dynamic);
++
++	pcibios_free_controller(phb);
++}
++EXPORT_SYMBOL_GPL(pcibios_free_controller_deferred);
++
++/*
+  * The function is used to return the minimal alignment
+  * for memory or I/O windows of the associated P2P bridge.
+  * By default, 4KiB alignment for I/O windows and 1MiB for
+diff --git a/arch/powerpc/kvm/book3s_emulate.c b/arch/powerpc/kvm/book3s_emulate.c
+index 2afdb9c..729f8fa 100644
+--- a/arch/powerpc/kvm/book3s_emulate.c
++++ b/arch/powerpc/kvm/book3s_emulate.c
+@@ -498,6 +498,7 @@ int kvmppc_core_emulate_mtspr_pr(struct kvm_vcpu *vcpu, int sprn, ulong spr_val)
+ 	case SPRN_MMCR0:
+ 	case SPRN_MMCR1:
+ 	case SPRN_MMCR2:
++	case SPRN_UMMCR2:
+ #endif
+ 		break;
+ unprivileged:
+@@ -640,6 +641,7 @@ int kvmppc_core_emulate_mfspr_pr(struct kvm_vcpu *vcpu, int sprn, ulong *spr_val
+ 	case SPRN_MMCR0:
+ 	case SPRN_MMCR1:
+ 	case SPRN_MMCR2:
++	case SPRN_UMMCR2:
+ 	case SPRN_TIR:
+ #endif
+ 		*spr_val = 0;
+diff --git a/arch/powerpc/kvm/booke.c b/arch/powerpc/kvm/booke.c
+index 4afae69..eb283c5 100644
+--- a/arch/powerpc/kvm/booke.c
++++ b/arch/powerpc/kvm/booke.c
+@@ -2038,7 +2038,7 @@ int kvm_arch_vcpu_ioctl_set_guest_debug(struct kvm_vcpu *vcpu,
+ 		if (type == KVMPPC_DEBUG_NONE)
+ 			continue;
+ 
+-		if (type & !(KVMPPC_DEBUG_WATCH_READ |
++		if (type & ~(KVMPPC_DEBUG_WATCH_READ |
+ 			     KVMPPC_DEBUG_WATCH_WRITE |
+ 			     KVMPPC_DEBUG_BREAKPOINT))
+ 			return -EINVAL;
+diff --git a/arch/powerpc/platforms/pseries/pci.c b/arch/powerpc/platforms/pseries/pci.c
+index fe16a50..09eba5a 100644
+--- a/arch/powerpc/platforms/pseries/pci.c
++++ b/arch/powerpc/platforms/pseries/pci.c
+@@ -119,6 +119,10 @@ int pseries_root_bridge_prepare(struct pci_host_bridge *bridge)
+ 
+ 	bus = bridge->bus;
+ 
++	/* Rely on the pcibios_free_controller_deferred() callback. */
++	pci_set_host_bridge_release(bridge, pcibios_free_controller_deferred,
++					(void *) pci_bus_to_host(bus));
++
+ 	dn = pcibios_get_phb_of_node(bus);
+ 	if (!dn)
+ 		return 0;
+diff --git a/arch/powerpc/platforms/pseries/pci_dlpar.c b/arch/powerpc/platforms/pseries/pci_dlpar.c
+index 906dbaa..547fd13 100644
+--- a/arch/powerpc/platforms/pseries/pci_dlpar.c
++++ b/arch/powerpc/platforms/pseries/pci_dlpar.c
+@@ -106,8 +106,11 @@ int remove_phb_dynamic(struct pci_controller *phb)
+ 		release_resource(res);
+ 	}
+ 
+-	/* Free pci_controller data structure */
+-	pcibios_free_controller(phb);
++	/*
++	 * The pci_controller data structure is freed by
++	 * the pcibios_free_controller_deferred() callback;
++	 * see pseries_root_bridge_prepare().
++	 */
+ 
+ 	return 0;
+ }
+diff --git a/arch/x86/include/asm/fpu/xstate.h b/arch/x86/include/asm/fpu/xstate.h
+index 38951b0..993a072 100644
+--- a/arch/x86/include/asm/fpu/xstate.h
++++ b/arch/x86/include/asm/fpu/xstate.h
+@@ -24,11 +24,12 @@
+ 				 XFEATURE_MASK_YMM | \
+ 				 XFEATURE_MASK_OPMASK | \
+ 				 XFEATURE_MASK_ZMM_Hi256 | \
+-				 XFEATURE_MASK_Hi16_ZMM	 | \
+-				 XFEATURE_MASK_PKRU)
++				 XFEATURE_MASK_Hi16_ZMM)
+ 
+ /* Supported features which require eager state saving */
+-#define XFEATURE_MASK_EAGER	(XFEATURE_MASK_BNDREGS | XFEATURE_MASK_BNDCSR)
++#define XFEATURE_MASK_EAGER	(XFEATURE_MASK_BNDREGS | \
++				 XFEATURE_MASK_BNDCSR | \
++				 XFEATURE_MASK_PKRU)
+ 
+ /* All currently supported features */
+ #define XCNTXT_MASK	(XFEATURE_MASK_LAZY | XFEATURE_MASK_EAGER)
+diff --git a/arch/x86/include/asm/mpspec.h b/arch/x86/include/asm/mpspec.h
+index b07233b..c2f94dc 100644
+--- a/arch/x86/include/asm/mpspec.h
++++ b/arch/x86/include/asm/mpspec.h
+@@ -6,7 +6,6 @@
+ #include <asm/x86_init.h>
+ #include <asm/apicdef.h>
+ 
+-extern int apic_version[];
+ extern int pic_mode;
+ 
+ #ifdef CONFIG_X86_32
+@@ -40,6 +39,7 @@ extern int mp_bus_id_to_type[MAX_MP_BUSSES];
+ extern DECLARE_BITMAP(mp_bus_not_pci, MAX_MP_BUSSES);
+ 
+ extern unsigned int boot_cpu_physical_apicid;
++extern u8 boot_cpu_apic_version;
+ extern unsigned long mp_lapic_addr;
+ 
+ #ifdef CONFIG_X86_LOCAL_APIC
+diff --git a/arch/x86/kernel/acpi/boot.c b/arch/x86/kernel/acpi/boot.c
+index 9414f84..8e6e8bc 100644
+--- a/arch/x86/kernel/acpi/boot.c
++++ b/arch/x86/kernel/acpi/boot.c
+@@ -180,7 +180,7 @@ static int acpi_register_lapic(int id, u8 enabled)
+ 	}
+ 
+ 	if (boot_cpu_physical_apicid != -1U)
+-		ver = apic_version[boot_cpu_physical_apicid];
++		ver = boot_cpu_apic_version;
+ 
+ 	return generic_processor_info(id, ver);
+ }
+diff --git a/arch/x86/kernel/apic/apic.c b/arch/x86/kernel/apic/apic.c
+index b15e1c1..cc7bc8b 100644
+--- a/arch/x86/kernel/apic/apic.c
++++ b/arch/x86/kernel/apic/apic.c
+@@ -64,6 +64,8 @@ unsigned disabled_cpus;
+ unsigned int boot_cpu_physical_apicid = -1U;
+ EXPORT_SYMBOL_GPL(boot_cpu_physical_apicid);
+ 
++u8 boot_cpu_apic_version;
++
+ /*
+  * The highest APIC ID seen during enumeration.
+  */
+@@ -1790,8 +1792,7 @@ void __init init_apic_mappings(void)
+ 		 * since smp_sanity_check is prepared for such a case
+ 		 * and disable smp mode
+ 		 */
+-		apic_version[new_apicid] =
+-			 GET_APIC_VERSION(apic_read(APIC_LVR));
++		boot_cpu_apic_version = GET_APIC_VERSION(apic_read(APIC_LVR));
+ 	}
+ }
+ 
+@@ -1806,13 +1807,10 @@ void __init register_lapic_address(unsigned long address)
+ 	}
+ 	if (boot_cpu_physical_apicid == -1U) {
+ 		boot_cpu_physical_apicid  = read_apic_id();
+-		apic_version[boot_cpu_physical_apicid] =
+-			 GET_APIC_VERSION(apic_read(APIC_LVR));
++		boot_cpu_apic_version = GET_APIC_VERSION(apic_read(APIC_LVR));
+ 	}
+ }
+ 
+-int apic_version[MAX_LOCAL_APIC];
+-
+ /*
+  * Local APIC interrupts
+  */
+@@ -2102,11 +2100,10 @@ int generic_processor_info(int apicid, int version)
+ 			   cpu, apicid);
+ 		version = 0x10;
+ 	}
+-	apic_version[apicid] = version;
+ 
+-	if (version != apic_version[boot_cpu_physical_apicid]) {
++	if (version != boot_cpu_apic_version) {
+ 		pr_warning("BIOS bug: APIC version mismatch, boot CPU: %x, CPU %d: version %x\n",
+-			apic_version[boot_cpu_physical_apicid], cpu, version);
++			boot_cpu_apic_version, cpu, version);
+ 	}
+ 
+ 	physid_set(apicid, phys_cpu_present_map);
+@@ -2249,7 +2246,7 @@ int __init APIC_init_uniprocessor(void)
+ 	 * Complain if the BIOS pretends there is one.
+ 	 */
+ 	if (!boot_cpu_has(X86_FEATURE_APIC) &&
+-	    APIC_INTEGRATED(apic_version[boot_cpu_physical_apicid])) {
++	    APIC_INTEGRATED(boot_cpu_apic_version)) {
+ 		pr_err("BIOS bug, local APIC 0x%x not detected!...\n",
+ 			boot_cpu_physical_apicid);
+ 		return -1;
+diff --git a/arch/x86/kernel/apic/io_apic.c b/arch/x86/kernel/apic/io_apic.c
+index 446702e..fbfb244 100644
+--- a/arch/x86/kernel/apic/io_apic.c
++++ b/arch/x86/kernel/apic/io_apic.c
+@@ -1592,7 +1592,7 @@ void __init setup_ioapic_ids_from_mpc(void)
+ 	 * no meaning without the serial APIC bus.
+ 	 */
+ 	if (!(boot_cpu_data.x86_vendor == X86_VENDOR_INTEL)
+-		|| APIC_XAPIC(apic_version[boot_cpu_physical_apicid]))
++		|| APIC_XAPIC(boot_cpu_apic_version))
+ 		return;
+ 	setup_ioapic_ids_from_mpc_nocheck();
+ }
+@@ -2422,7 +2422,7 @@ static int io_apic_get_unique_id(int ioapic, int apic_id)
+ static u8 io_apic_unique_id(int idx, u8 id)
+ {
+ 	if ((boot_cpu_data.x86_vendor == X86_VENDOR_INTEL) &&
+-	    !APIC_XAPIC(apic_version[boot_cpu_physical_apicid]))
++	    !APIC_XAPIC(boot_cpu_apic_version))
+ 		return io_apic_get_unique_id(idx, id);
+ 	else
+ 		return id;
+diff --git a/arch/x86/kernel/apic/probe_32.c b/arch/x86/kernel/apic/probe_32.c
+index f316e34..49da80cf 100644
+--- a/arch/x86/kernel/apic/probe_32.c
++++ b/arch/x86/kernel/apic/probe_32.c
+@@ -153,7 +153,7 @@ early_param("apic", parse_apic);
+ 
+ void __init default_setup_apic_routing(void)
+ {
+-	int version = apic_version[boot_cpu_physical_apicid];
++	int version = boot_cpu_apic_version;
+ 
+ 	if (num_possible_cpus() > 8) {
+ 		switch (boot_cpu_data.x86_vendor) {
+diff --git a/arch/x86/kernel/apic/vector.c b/arch/x86/kernel/apic/vector.c
+index a5e400a..84eced5 100644
+--- a/arch/x86/kernel/apic/vector.c
++++ b/arch/x86/kernel/apic/vector.c
+@@ -661,11 +661,28 @@ void irq_complete_move(struct irq_cfg *cfg)
+  */
+ void irq_force_complete_move(struct irq_desc *desc)
+ {
+-	struct irq_data *irqdata = irq_desc_get_irq_data(desc);
+-	struct apic_chip_data *data = apic_chip_data(irqdata);
+-	struct irq_cfg *cfg = data ? &data->cfg : NULL;
++	struct irq_data *irqdata;
++	struct apic_chip_data *data;
++	struct irq_cfg *cfg;
+ 	unsigned int cpu;
+ 
++	/*
++	 * The function is called for all descriptors regardless of which
++	 * irqdomain they belong to. For example if an IRQ is provided by
++	 * an irq_chip as part of a GPIO driver, the chip data for that
++	 * descriptor is specific to the irq_chip in question.
++	 *
++	 * Check first that the chip_data is what we expect
++	 * (apic_chip_data) before touching it any further.
++	 */
++	irqdata = irq_domain_get_irq_data(x86_vector_domain,
++					  irq_desc_get_irq(desc));
++	if (!irqdata)
++		return;
++
++	data = apic_chip_data(irqdata);
++	cfg = data ? &data->cfg : NULL;
++
+ 	if (!cfg)
+ 		return;
+ 
+diff --git a/arch/x86/kernel/e820.c b/arch/x86/kernel/e820.c
+index 621b501..8a90f15 100644
+--- a/arch/x86/kernel/e820.c
++++ b/arch/x86/kernel/e820.c
+@@ -348,7 +348,7 @@ int __init sanitize_e820_map(struct e820entry *biosmap, int max_nr_map,
+ 		 * continue building up new bios map based on this
+ 		 * information
+ 		 */
+-		if (current_type != last_type || current_type == E820_PRAM) {
++		if (current_type != last_type) {
+ 			if (last_type != 0)	 {
+ 				new_bios[new_bios_entry].size =
+ 					change_point[chgidx]->addr - last_addr;
+@@ -754,7 +754,7 @@ u64 __init early_reserve_e820(u64 size, u64 align)
+ /*
+  * Find the highest page frame number we have available
+  */
+-static unsigned long __init e820_end_pfn(unsigned long limit_pfn)
++static unsigned long __init e820_end_pfn(unsigned long limit_pfn, unsigned type)
+ {
+ 	int i;
+ 	unsigned long last_pfn = 0;
+@@ -765,11 +765,7 @@ static unsigned long __init e820_end_pfn(unsigned long limit_pfn)
+ 		unsigned long start_pfn;
+ 		unsigned long end_pfn;
+ 
+-		/*
+-		 * Persistent memory is accounted as ram for purposes of
+-		 * establishing max_pfn and mem_map.
+-		 */
+-		if (ei->type != E820_RAM && ei->type != E820_PRAM)
++		if (ei->type != type)
+ 			continue;
+ 
+ 		start_pfn = ei->addr >> PAGE_SHIFT;
+@@ -794,12 +790,12 @@ static unsigned long __init e820_end_pfn(unsigned long limit_pfn)
+ }
+ unsigned long __init e820_end_of_ram_pfn(void)
+ {
+-	return e820_end_pfn(MAX_ARCH_PFN);
++	return e820_end_pfn(MAX_ARCH_PFN, E820_RAM);
+ }
+ 
+ unsigned long __init e820_end_of_low_ram_pfn(void)
+ {
+-	return e820_end_pfn(1UL << (32-PAGE_SHIFT));
++	return e820_end_pfn(1UL << (32 - PAGE_SHIFT), E820_RAM);
+ }
+ 
+ static void early_panic(char *msg)
+diff --git a/arch/x86/kernel/process_64.c b/arch/x86/kernel/process_64.c
+index 6e789ca..5dc86d2 100644
+--- a/arch/x86/kernel/process_64.c
++++ b/arch/x86/kernel/process_64.c
+@@ -110,12 +110,13 @@ void __show_regs(struct pt_regs *regs, int all)
+ 	get_debugreg(d7, 7);
+ 
+ 	/* Only print out debug registers if they are in their non-default state. */
+-	if ((d0 == 0) && (d1 == 0) && (d2 == 0) && (d3 == 0) &&
+-	    (d6 == DR6_RESERVED) && (d7 == 0x400))
+-		return;
+-
+-	printk(KERN_DEFAULT "DR0: %016lx DR1: %016lx DR2: %016lx\n", d0, d1, d2);
+-	printk(KERN_DEFAULT "DR3: %016lx DR6: %016lx DR7: %016lx\n", d3, d6, d7);
++	if (!((d0 == 0) && (d1 == 0) && (d2 == 0) && (d3 == 0) &&
++	    (d6 == DR6_RESERVED) && (d7 == 0x400))) {
++		printk(KERN_DEFAULT "DR0: %016lx DR1: %016lx DR2: %016lx\n",
++		       d0, d1, d2);
++		printk(KERN_DEFAULT "DR3: %016lx DR6: %016lx DR7: %016lx\n",
++		       d3, d6, d7);
++	}
+ 
+ 	if (boot_cpu_has(X86_FEATURE_OSPKE))
+ 		printk(KERN_DEFAULT "PKRU: %08x\n", read_pkru());
+diff --git a/arch/x86/kernel/ptrace.c b/arch/x86/kernel/ptrace.c
+index 600edd2..67ed18e 100644
+--- a/arch/x86/kernel/ptrace.c
++++ b/arch/x86/kernel/ptrace.c
+@@ -173,8 +173,8 @@ unsigned long kernel_stack_pointer(struct pt_regs *regs)
+ 		return sp;
+ 
+ 	prev_esp = (u32 *)(context);
+-	if (prev_esp)
+-		return (unsigned long)prev_esp;
++	if (*prev_esp)
++		return (unsigned long)*prev_esp;
+ 
+ 	return (unsigned long)regs;
+ }
+diff --git a/arch/x86/kernel/smpboot.c b/arch/x86/kernel/smpboot.c
+index fafe8b9..694c529 100644
+--- a/arch/x86/kernel/smpboot.c
++++ b/arch/x86/kernel/smpboot.c
+@@ -676,7 +676,7 @@ wakeup_secondary_cpu_via_nmi(int apicid, unsigned long start_eip)
+ 	 * Give the other CPU some time to accept the IPI.
+ 	 */
+ 	udelay(200);
+-	if (APIC_INTEGRATED(apic_version[boot_cpu_physical_apicid])) {
++	if (APIC_INTEGRATED(boot_cpu_apic_version)) {
+ 		maxlvt = lapic_get_maxlvt();
+ 		if (maxlvt > 3)			/* Due to the Pentium erratum 3AP.  */
+ 			apic_write(APIC_ESR, 0);
+@@ -703,7 +703,7 @@ wakeup_secondary_cpu_via_init(int phys_apicid, unsigned long start_eip)
+ 	/*
+ 	 * Be paranoid about clearing APIC errors.
+ 	 */
+-	if (APIC_INTEGRATED(apic_version[phys_apicid])) {
++	if (APIC_INTEGRATED(boot_cpu_apic_version)) {
+ 		if (maxlvt > 3)		/* Due to the Pentium erratum 3AP.  */
+ 			apic_write(APIC_ESR, 0);
+ 		apic_read(APIC_ESR);
+@@ -742,7 +742,7 @@ wakeup_secondary_cpu_via_init(int phys_apicid, unsigned long start_eip)
+ 	 * Determine this based on the APIC version.
+ 	 * If we don't have an integrated APIC, don't send the STARTUP IPIs.
+ 	 */
+-	if (APIC_INTEGRATED(apic_version[phys_apicid]))
++	if (APIC_INTEGRATED(boot_cpu_apic_version))
+ 		num_starts = 2;
+ 	else
+ 		num_starts = 0;
+@@ -980,7 +980,7 @@ static int do_boot_cpu(int apicid, int cpu, struct task_struct *idle)
+ 		/*
+ 		 * Be paranoid about clearing APIC errors.
+ 		*/
+-		if (APIC_INTEGRATED(apic_version[boot_cpu_physical_apicid])) {
++		if (APIC_INTEGRATED(boot_cpu_apic_version)) {
+ 			apic_write(APIC_ESR, 0);
+ 			apic_read(APIC_ESR);
+ 		}
+@@ -1235,7 +1235,7 @@ static int __init smp_sanity_check(unsigned max_cpus)
+ 	/*
+ 	 * If we couldn't find a local APIC, then get out of here now!
+ 	 */
+-	if (APIC_INTEGRATED(apic_version[boot_cpu_physical_apicid]) &&
++	if (APIC_INTEGRATED(boot_cpu_apic_version) &&
+ 	    !boot_cpu_has(X86_FEATURE_APIC)) {
+ 		if (!disable_apic) {
+ 			pr_err("BIOS bug, local APIC #%d not detected!...\n",
+@@ -1393,9 +1393,21 @@ __init void prefill_possible_map(void)
+ {
+ 	int i, possible;
+ 
+-	/* no processor from mptable or madt */
+-	if (!num_processors)
+-		num_processors = 1;
++	/* No boot processor was found in mptable or ACPI MADT */
++	if (!num_processors) {
++		int apicid = boot_cpu_physical_apicid;
++		int cpu = hard_smp_processor_id();
++
++		pr_warn("Boot CPU (id %d) not listed by BIOS\n", cpu);
++
++		/* Make sure boot cpu is enumerated */
++		if (apic->cpu_present_to_apicid(0) == BAD_APICID &&
++		    apic->apic_id_valid(apicid))
++			generic_processor_info(apicid, boot_cpu_apic_version);
++
++		if (!num_processors)
++			num_processors = 1;
++	}
+ 
+ 	i = setup_max_cpus ?: 1;
+ 	if (setup_possible_cpus == -1) {
+diff --git a/arch/x86/xen/smp.c b/arch/x86/xen/smp.c
+index 719cf29..40c3aab9 100644
+--- a/arch/x86/xen/smp.c
++++ b/arch/x86/xen/smp.c
+@@ -87,6 +87,12 @@ static void cpu_bringup(void)
+ 	cpu_data(cpu).x86_max_cores = 1;
+ 	set_cpu_sibling_map(cpu);
+ 
++	/*
++	 * identify_cpu() may have set logical_pkg_id to -1 due
++	 * to incorrect phys_proc_id. Let's re-comupte it.
++	 */
++	topology_update_package_map(apic->cpu_present_to_apicid(cpu), cpu);
++
+ 	xen_setup_cpu_clockevents();
+ 
+ 	notify_cpu_starting(cpu);
+diff --git a/drivers/char/tpm/tpm-dev.c b/drivers/char/tpm/tpm-dev.c
+index de0337e..4f3137d 100644
+--- a/drivers/char/tpm/tpm-dev.c
++++ b/drivers/char/tpm/tpm-dev.c
+@@ -139,7 +139,7 @@ static ssize_t tpm_write(struct file *file, const char __user *buf,
+ 
+ 	/* atomic tpm command send and result receive */
+ 	out_size = tpm_transmit(priv->chip, priv->data_buffer,
+-				sizeof(priv->data_buffer));
++				sizeof(priv->data_buffer), 0);
+ 	if (out_size < 0) {
+ 		mutex_unlock(&priv->buffer_mutex);
+ 		return out_size;
+diff --git a/drivers/char/tpm/tpm-interface.c b/drivers/char/tpm/tpm-interface.c
+index e2fa89c..9ba86eb3 100644
+--- a/drivers/char/tpm/tpm-interface.c
++++ b/drivers/char/tpm/tpm-interface.c
+@@ -330,8 +330,8 @@ EXPORT_SYMBOL_GPL(tpm_calc_ordinal_duration);
+ /*
+  * Internal kernel interface to transmit TPM commands
+  */
+-ssize_t tpm_transmit(struct tpm_chip *chip, const char *buf,
+-		     size_t bufsiz)
++ssize_t tpm_transmit(struct tpm_chip *chip, const u8 *buf, size_t bufsiz,
++		     unsigned int flags)
+ {
+ 	ssize_t rc;
+ 	u32 count, ordinal;
+@@ -350,7 +350,8 @@ ssize_t tpm_transmit(struct tpm_chip *chip, const char *buf,
+ 		return -E2BIG;
+ 	}
+ 
+-	mutex_lock(&chip->tpm_mutex);
++	if (!(flags & TPM_TRANSMIT_UNLOCKED))
++		mutex_lock(&chip->tpm_mutex);
+ 
+ 	rc = chip->ops->send(chip, (u8 *) buf, count);
+ 	if (rc < 0) {
+@@ -393,20 +394,21 @@ ssize_t tpm_transmit(struct tpm_chip *chip, const char *buf,
+ 		dev_err(chip->pdev,
+ 			"tpm_transmit: tpm_recv: error %zd\n", rc);
+ out:
+-	mutex_unlock(&chip->tpm_mutex);
++	if (!(flags & TPM_TRANSMIT_UNLOCKED))
++		mutex_unlock(&chip->tpm_mutex);
+ 	return rc;
+ }
+ 
+ #define TPM_DIGEST_SIZE 20
+ #define TPM_RET_CODE_IDX 6
+ 
+-ssize_t tpm_transmit_cmd(struct tpm_chip *chip, void *cmd,
+-			 int len, const char *desc)
++ssize_t tpm_transmit_cmd(struct tpm_chip *chip, const void *cmd,
++			 int len, unsigned int flags, const char *desc)
+ {
+-	struct tpm_output_header *header;
++	const struct tpm_output_header *header;
+ 	int err;
+ 
+-	len = tpm_transmit(chip, (u8 *) cmd, len);
++	len = tpm_transmit(chip, (const u8 *)cmd, len, flags);
+ 	if (len <  0)
+ 		return len;
+ 	else if (len < TPM_HEADER_SIZE)
+@@ -454,7 +456,8 @@ ssize_t tpm_getcap(struct device *dev, __be32 subcap_id, cap_t *cap,
+ 		tpm_cmd.params.getcap_in.subcap_size = cpu_to_be32(4);
+ 		tpm_cmd.params.getcap_in.subcap = subcap_id;
+ 	}
+-	rc = tpm_transmit_cmd(chip, &tpm_cmd, TPM_INTERNAL_RESULT_SIZE, desc);
++	rc = tpm_transmit_cmd(chip, &tpm_cmd, TPM_INTERNAL_RESULT_SIZE, 0,
++			      desc);
+ 	if (!rc)
+ 		*cap = tpm_cmd.params.getcap_out.cap;
+ 	return rc;
+@@ -470,7 +473,7 @@ void tpm_gen_interrupt(struct tpm_chip *chip)
+ 	tpm_cmd.params.getcap_in.subcap_size = cpu_to_be32(4);
+ 	tpm_cmd.params.getcap_in.subcap = TPM_CAP_PROP_TIS_TIMEOUT;
+ 
+-	rc = tpm_transmit_cmd(chip, &tpm_cmd, TPM_INTERNAL_RESULT_SIZE,
++	rc = tpm_transmit_cmd(chip, &tpm_cmd, TPM_INTERNAL_RESULT_SIZE, 0,
+ 			      "attempting to determine the timeouts");
+ }
+ EXPORT_SYMBOL_GPL(tpm_gen_interrupt);
+@@ -491,7 +494,7 @@ static int tpm_startup(struct tpm_chip *chip, __be16 startup_type)
+ 	start_cmd.header.in = tpm_startup_header;
+ 
+ 	start_cmd.params.startup_in.startup_type = startup_type;
+-	return tpm_transmit_cmd(chip, &start_cmd, TPM_INTERNAL_RESULT_SIZE,
++	return tpm_transmit_cmd(chip, &start_cmd, TPM_INTERNAL_RESULT_SIZE, 0,
+ 				"attempting to start the TPM");
+ }
+ 
+@@ -522,7 +525,8 @@ int tpm_get_timeouts(struct tpm_chip *chip)
+ 	tpm_cmd.params.getcap_in.cap = TPM_CAP_PROP;
+ 	tpm_cmd.params.getcap_in.subcap_size = cpu_to_be32(4);
+ 	tpm_cmd.params.getcap_in.subcap = TPM_CAP_PROP_TIS_TIMEOUT;
+-	rc = tpm_transmit_cmd(chip, &tpm_cmd, TPM_INTERNAL_RESULT_SIZE, NULL);
++	rc = tpm_transmit_cmd(chip, &tpm_cmd, TPM_INTERNAL_RESULT_SIZE, 0,
++			      NULL);
+ 
+ 	if (rc == TPM_ERR_INVALID_POSTINIT) {
+ 		/* The TPM is not started, we are the first to talk to it.
+@@ -536,7 +540,7 @@ int tpm_get_timeouts(struct tpm_chip *chip)
+ 		tpm_cmd.params.getcap_in.subcap_size = cpu_to_be32(4);
+ 		tpm_cmd.params.getcap_in.subcap = TPM_CAP_PROP_TIS_TIMEOUT;
+ 		rc = tpm_transmit_cmd(chip, &tpm_cmd, TPM_INTERNAL_RESULT_SIZE,
+-				  NULL);
++				      0, NULL);
+ 	}
+ 	if (rc) {
+ 		dev_err(chip->pdev,
+@@ -597,7 +601,7 @@ int tpm_get_timeouts(struct tpm_chip *chip)
+ 	tpm_cmd.params.getcap_in.subcap_size = cpu_to_be32(4);
+ 	tpm_cmd.params.getcap_in.subcap = TPM_CAP_PROP_TIS_DURATION;
+ 
+-	rc = tpm_transmit_cmd(chip, &tpm_cmd, TPM_INTERNAL_RESULT_SIZE,
++	rc = tpm_transmit_cmd(chip, &tpm_cmd, TPM_INTERNAL_RESULT_SIZE, 0,
+ 			      "attempting to determine the durations");
+ 	if (rc)
+ 		return rc;
+@@ -653,7 +657,7 @@ static int tpm_continue_selftest(struct tpm_chip *chip)
+ 	struct tpm_cmd_t cmd;
+ 
+ 	cmd.header.in = continue_selftest_header;
+-	rc = tpm_transmit_cmd(chip, &cmd, CONTINUE_SELFTEST_RESULT_SIZE,
++	rc = tpm_transmit_cmd(chip, &cmd, CONTINUE_SELFTEST_RESULT_SIZE, 0,
+ 			      "continue selftest");
+ 	return rc;
+ }
+@@ -673,7 +677,7 @@ int tpm_pcr_read_dev(struct tpm_chip *chip, int pcr_idx, u8 *res_buf)
+ 
+ 	cmd.header.in = pcrread_header;
+ 	cmd.params.pcrread_in.pcr_idx = cpu_to_be32(pcr_idx);
+-	rc = tpm_transmit_cmd(chip, &cmd, READ_PCR_RESULT_SIZE,
++	rc = tpm_transmit_cmd(chip, &cmd, READ_PCR_RESULT_SIZE, 0,
+ 			      "attempting to read a pcr value");
+ 
+ 	if (rc == 0)
+@@ -771,7 +775,7 @@ int tpm_pcr_extend(u32 chip_num, int pcr_idx, const u8 *hash)
+ 	cmd.header.in = pcrextend_header;
+ 	cmd.params.pcrextend_in.pcr_idx = cpu_to_be32(pcr_idx);
+ 	memcpy(cmd.params.pcrextend_in.hash, hash, TPM_DIGEST_SIZE);
+-	rc = tpm_transmit_cmd(chip, &cmd, EXTEND_PCR_RESULT_SIZE,
++	rc = tpm_transmit_cmd(chip, &cmd, EXTEND_PCR_RESULT_SIZE, 0,
+ 			      "attempting extend a PCR value");
+ 
+ 	tpm_chip_put(chip);
+@@ -810,7 +814,7 @@ int tpm_do_selftest(struct tpm_chip *chip)
+ 		/* Attempt to read a PCR value */
+ 		cmd.header.in = pcrread_header;
+ 		cmd.params.pcrread_in.pcr_idx = cpu_to_be32(0);
+-		rc = tpm_transmit(chip, (u8 *) &cmd, READ_PCR_RESULT_SIZE);
++		rc = tpm_transmit(chip, (u8 *) &cmd, READ_PCR_RESULT_SIZE, 0);
+ 		/* Some buggy TPMs will not respond to tpm_tis_ready() for
+ 		 * around 300ms while the self test is ongoing, keep trying
+ 		 * until the self test duration expires. */
+@@ -851,7 +855,7 @@ int tpm_send(u32 chip_num, void *cmd, size_t buflen)
+ 	if (chip == NULL)
+ 		return -ENODEV;
+ 
+-	rc = tpm_transmit_cmd(chip, cmd, buflen, "attempting tpm_cmd");
++	rc = tpm_transmit_cmd(chip, cmd, buflen, 0, "attempting tpm_cmd");
+ 
+ 	tpm_chip_put(chip);
+ 	return rc;
+@@ -953,14 +957,15 @@ int tpm_pm_suspend(struct device *dev)
+ 		cmd.params.pcrextend_in.pcr_idx = cpu_to_be32(tpm_suspend_pcr);
+ 		memcpy(cmd.params.pcrextend_in.hash, dummy_hash,
+ 		       TPM_DIGEST_SIZE);
+-		rc = tpm_transmit_cmd(chip, &cmd, EXTEND_PCR_RESULT_SIZE,
++		rc = tpm_transmit_cmd(chip, &cmd, EXTEND_PCR_RESULT_SIZE, 0,
+ 				      "extending dummy pcr before suspend");
+ 	}
+ 
+ 	/* now do the actual savestate */
+ 	for (try = 0; try < TPM_RETRY; try++) {
+ 		cmd.header.in = savestate_header;
+-		rc = tpm_transmit_cmd(chip, &cmd, SAVESTATE_RESULT_SIZE, NULL);
++		rc = tpm_transmit_cmd(chip, &cmd, SAVESTATE_RESULT_SIZE, 0,
++				      NULL);
+ 
+ 		/*
+ 		 * If the TPM indicates that it is too busy to respond to
+@@ -1044,8 +1049,8 @@ int tpm_get_random(u32 chip_num, u8 *out, size_t max)
+ 		tpm_cmd.params.getrandom_in.num_bytes = cpu_to_be32(num_bytes);
+ 
+ 		err = tpm_transmit_cmd(chip, &tpm_cmd,
+-				   TPM_GETRANDOM_RESULT_SIZE + num_bytes,
+-				   "attempting get random");
++				       TPM_GETRANDOM_RESULT_SIZE + num_bytes,
++				       0, "attempting get random");
+ 		if (err)
+ 			break;
+ 
+diff --git a/drivers/char/tpm/tpm-sysfs.c b/drivers/char/tpm/tpm-sysfs.c
+index ee66fd4..f880856 100644
+--- a/drivers/char/tpm/tpm-sysfs.c
++++ b/drivers/char/tpm/tpm-sysfs.c
+@@ -39,7 +39,7 @@ static ssize_t pubek_show(struct device *dev, struct device_attribute *attr,
+ 	struct tpm_chip *chip = dev_get_drvdata(dev);
+ 
+ 	tpm_cmd.header.in = tpm_readpubek_header;
+-	err = tpm_transmit_cmd(chip, &tpm_cmd, READ_PUBEK_RESULT_SIZE,
++	err = tpm_transmit_cmd(chip, &tpm_cmd, READ_PUBEK_RESULT_SIZE, 0,
+ 			       "attempting to read the PUBEK");
+ 	if (err)
+ 		goto out;
+diff --git a/drivers/char/tpm/tpm.h b/drivers/char/tpm/tpm.h
+index 28b477e..f475b74 100644
+--- a/drivers/char/tpm/tpm.h
++++ b/drivers/char/tpm/tpm.h
+@@ -494,11 +494,15 @@ extern struct class *tpm_class;
+ extern dev_t tpm_devt;
+ extern const struct file_operations tpm_fops;
+ 
++enum tpm_transmit_flags {
++	TPM_TRANSMIT_UNLOCKED	= BIT(0),
++};
++
++ssize_t tpm_transmit(struct tpm_chip *chip, const u8 *buf, size_t bufsiz,
++		     unsigned int flags);
++ssize_t tpm_transmit_cmd(struct tpm_chip *chip, const void *cmd, int len,
++			 unsigned int flags, const char *desc);
+ ssize_t	tpm_getcap(struct device *, __be32, cap_t *, const char *);
+-ssize_t tpm_transmit(struct tpm_chip *chip, const char *buf,
+-		     size_t bufsiz);
+-ssize_t tpm_transmit_cmd(struct tpm_chip *chip, void *cmd, int len,
+-			 const char *desc);
+ extern int tpm_get_timeouts(struct tpm_chip *);
+ extern void tpm_gen_interrupt(struct tpm_chip *);
+ extern int tpm_do_selftest(struct tpm_chip *);
+diff --git a/drivers/char/tpm/tpm2-cmd.c b/drivers/char/tpm/tpm2-cmd.c
+index ca2d238..19f14dc 100644
+--- a/drivers/char/tpm/tpm2-cmd.c
++++ b/drivers/char/tpm/tpm2-cmd.c
+@@ -282,7 +282,7 @@ int tpm2_pcr_read(struct tpm_chip *chip, int pcr_idx, u8 *res_buf)
+ 	       sizeof(cmd.params.pcrread_in.pcr_select));
+ 	cmd.params.pcrread_in.pcr_select[pcr_idx >> 3] = 1 << (pcr_idx & 0x7);
+ 
+-	rc = tpm_transmit_cmd(chip, &cmd, sizeof(cmd),
++	rc = tpm_transmit_cmd(chip, &cmd, sizeof(cmd), 0,
+ 			      "attempting to read a pcr value");
+ 	if (rc == 0) {
+ 		buf = cmd.params.pcrread_out.digest;
+@@ -330,7 +330,7 @@ int tpm2_pcr_extend(struct tpm_chip *chip, int pcr_idx, const u8 *hash)
+ 	cmd.params.pcrextend_in.hash_alg = cpu_to_be16(TPM2_ALG_SHA1);
+ 	memcpy(cmd.params.pcrextend_in.digest, hash, TPM_DIGEST_SIZE);
+ 
+-	rc = tpm_transmit_cmd(chip, &cmd, sizeof(cmd),
++	rc = tpm_transmit_cmd(chip, &cmd, sizeof(cmd), 0,
+ 			      "attempting extend a PCR value");
+ 
+ 	return rc;
+@@ -376,7 +376,7 @@ int tpm2_get_random(struct tpm_chip *chip, u8 *out, size_t max)
+ 		cmd.header.in = tpm2_getrandom_header;
+ 		cmd.params.getrandom_in.size = cpu_to_be16(num_bytes);
+ 
+-		err = tpm_transmit_cmd(chip, &cmd, sizeof(cmd),
++		err = tpm_transmit_cmd(chip, &cmd, sizeof(cmd), 0,
+ 				       "attempting get random");
+ 		if (err)
+ 			break;
+@@ -434,12 +434,12 @@ static void tpm2_buf_append_auth(struct tpm_buf *buf, u32 session_handle,
+ }
+ 
+ /**
+- * tpm2_seal_trusted() - seal a trusted key
+- * @chip_num: A specific chip number for the request or TPM_ANY_NUM
+- * @options: authentication values and other options
++ * tpm2_seal_trusted() - seal the payload of a trusted key
++ * @chip_num: TPM chip to use
+  * @payload: the key data in clear and encrypted form
++ * @options: authentication values and other options
+  *
+- * Returns < 0 on error and 0 on success.
++ * Return: < 0 on error and 0 on success.
+  */
+ int tpm2_seal_trusted(struct tpm_chip *chip,
+ 		      struct trusted_key_payload *payload,
+@@ -512,7 +512,7 @@ int tpm2_seal_trusted(struct tpm_chip *chip,
+ 		goto out;
+ 	}
+ 
+-	rc = tpm_transmit_cmd(chip, buf.data, PAGE_SIZE, "sealing data");
++	rc = tpm_transmit_cmd(chip, buf.data, PAGE_SIZE, 0, "sealing data");
+ 	if (rc)
+ 		goto out;
+ 
+@@ -538,10 +538,18 @@ int tpm2_seal_trusted(struct tpm_chip *chip,
+ 	return rc;
+ }
+ 
+-static int tpm2_load(struct tpm_chip *chip,
+-		     struct trusted_key_payload *payload,
+-		     struct trusted_key_options *options,
+-		     u32 *blob_handle)
++/**
++ * tpm2_load_cmd() - execute a TPM2_Load command
++ * @chip_num: TPM chip to use
++ * @payload: the key data in clear and encrypted form
++ * @options: authentication values and other options
++ *
++ * Return: same as with tpm_transmit_cmd
++ */
++static int tpm2_load_cmd(struct tpm_chip *chip,
++			 struct trusted_key_payload *payload,
++			 struct trusted_key_options *options,
++			 u32 *blob_handle, unsigned int flags)
+ {
+ 	struct tpm_buf buf;
+ 	unsigned int private_len;
+@@ -576,7 +584,7 @@ static int tpm2_load(struct tpm_chip *chip,
+ 		goto out;
+ 	}
+ 
+-	rc = tpm_transmit_cmd(chip, buf.data, PAGE_SIZE, "loading blob");
++	rc = tpm_transmit_cmd(chip, buf.data, PAGE_SIZE, flags, "loading blob");
+ 	if (!rc)
+ 		*blob_handle = be32_to_cpup(
+ 			(__be32 *) &buf.data[TPM_HEADER_SIZE]);
+@@ -590,7 +598,16 @@ static int tpm2_load(struct tpm_chip *chip,
+ 	return rc;
+ }
+ 
+-static void tpm2_flush_context(struct tpm_chip *chip, u32 handle)
++/**
++ * tpm2_flush_context_cmd() - execute a TPM2_FlushContext command
++ * @chip_num: TPM chip to use
++ * @payload: the key data in clear and encrypted form
++ * @options: authentication values and other options
++ *
++ * Return: same as with tpm_transmit_cmd
++ */
++static void tpm2_flush_context_cmd(struct tpm_chip *chip, u32 handle,
++				   unsigned int flags)
+ {
+ 	struct tpm_buf buf;
+ 	int rc;
+@@ -604,7 +621,8 @@ static void tpm2_flush_context(struct tpm_chip *chip, u32 handle)
+ 
+ 	tpm_buf_append_u32(&buf, handle);
+ 
+-	rc = tpm_transmit_cmd(chip, buf.data, PAGE_SIZE, "flushing context");
++	rc = tpm_transmit_cmd(chip, buf.data, PAGE_SIZE, flags,
++			      "flushing context");
+ 	if (rc)
+ 		dev_warn(chip->pdev, "0x%08x was not flushed, rc=%d\n", handle,
+ 			 rc);
+@@ -612,10 +630,18 @@ static void tpm2_flush_context(struct tpm_chip *chip, u32 handle)
+ 	tpm_buf_destroy(&buf);
+ }
+ 
+-static int tpm2_unseal(struct tpm_chip *chip,
+-		       struct trusted_key_payload *payload,
+-		       struct trusted_key_options *options,
+-		       u32 blob_handle)
++/**
++ * tpm2_unseal_cmd() - execute a TPM2_Unload command
++ * @chip_num: TPM chip to use
++ * @payload: the key data in clear and encrypted form
++ * @options: authentication values and other options
++ *
++ * Return: same as with tpm_transmit_cmd
++ */
++static int tpm2_unseal_cmd(struct tpm_chip *chip,
++			   struct trusted_key_payload *payload,
++			   struct trusted_key_options *options,
++			   u32 blob_handle, unsigned int flags)
+ {
+ 	struct tpm_buf buf;
+ 	u16 data_len;
+@@ -635,7 +661,7 @@ static int tpm2_unseal(struct tpm_chip *chip,
+ 			     options->blobauth /* hmac */,
+ 			     TPM_DIGEST_SIZE);
+ 
+-	rc = tpm_transmit_cmd(chip, buf.data, PAGE_SIZE, "unsealing");
++	rc = tpm_transmit_cmd(chip, buf.data, PAGE_SIZE, flags, "unsealing");
+ 	if (rc > 0)
+ 		rc = -EPERM;
+ 
+@@ -654,12 +680,12 @@ static int tpm2_unseal(struct tpm_chip *chip,
+ }
+ 
+ /**
+- * tpm_unseal_trusted() - unseal a trusted key
+- * @chip_num: A specific chip number for the request or TPM_ANY_NUM
+- * @options: authentication values and other options
++ * tpm_unseal_trusted() - unseal the payload of a trusted key
++ * @chip_num: TPM chip to use
+  * @payload: the key data in clear and encrypted form
++ * @options: authentication values and other options
+  *
+- * Returns < 0 on error and 0 on success.
++ * Return: < 0 on error and 0 on success.
+  */
+ int tpm2_unseal_trusted(struct tpm_chip *chip,
+ 			struct trusted_key_payload *payload,
+@@ -668,14 +694,17 @@ int tpm2_unseal_trusted(struct tpm_chip *chip,
+ 	u32 blob_handle;
+ 	int rc;
+ 
+-	rc = tpm2_load(chip, payload, options, &blob_handle);
++	mutex_lock(&chip->tpm_mutex);
++	rc = tpm2_load_cmd(chip, payload, options, &blob_handle,
++			   TPM_TRANSMIT_UNLOCKED);
+ 	if (rc)
+-		return rc;
+-
+-	rc = tpm2_unseal(chip, payload, options, blob_handle);
+-
+-	tpm2_flush_context(chip, blob_handle);
++		goto out;
+ 
++	rc = tpm2_unseal_cmd(chip, payload, options, blob_handle,
++			     TPM_TRANSMIT_UNLOCKED);
++	tpm2_flush_context_cmd(chip, blob_handle, TPM_TRANSMIT_UNLOCKED);
++out:
++	mutex_unlock(&chip->tpm_mutex);
+ 	return rc;
+ }
+ 
+@@ -701,7 +730,7 @@ ssize_t tpm2_get_tpm_pt(struct tpm_chip *chip, u32 property_id,  u32 *value,
+ 	cmd.params.get_tpm_pt_in.property_id = cpu_to_be32(property_id);
+ 	cmd.params.get_tpm_pt_in.property_cnt = cpu_to_be32(1);
+ 
+-	rc = tpm_transmit_cmd(chip, &cmd, sizeof(cmd), desc);
++	rc = tpm_transmit_cmd(chip, &cmd, sizeof(cmd), 0, desc);
+ 	if (!rc)
+ 		*value = be32_to_cpu(cmd.params.get_tpm_pt_out.value);
+ 
+@@ -735,7 +764,7 @@ int tpm2_startup(struct tpm_chip *chip, u16 startup_type)
+ 	cmd.header.in = tpm2_startup_header;
+ 
+ 	cmd.params.startup_in.startup_type = cpu_to_be16(startup_type);
+-	return tpm_transmit_cmd(chip, &cmd, sizeof(cmd),
++	return tpm_transmit_cmd(chip, &cmd, sizeof(cmd), 0,
+ 				"attempting to start the TPM");
+ }
+ EXPORT_SYMBOL_GPL(tpm2_startup);
+@@ -764,7 +793,7 @@ void tpm2_shutdown(struct tpm_chip *chip, u16 shutdown_type)
+ 	cmd.header.in = tpm2_shutdown_header;
+ 	cmd.params.startup_in.startup_type = cpu_to_be16(shutdown_type);
+ 
+-	rc = tpm_transmit_cmd(chip, &cmd, sizeof(cmd), "stopping the TPM");
++	rc = tpm_transmit_cmd(chip, &cmd, sizeof(cmd), 0, "stopping the TPM");
+ 
+ 	/* In places where shutdown command is sent there's no much we can do
+ 	 * except print the error code on a system failure.
+@@ -830,7 +859,7 @@ static int tpm2_start_selftest(struct tpm_chip *chip, bool full)
+ 	cmd.header.in = tpm2_selftest_header;
+ 	cmd.params.selftest_in.full_test = full;
+ 
+-	rc = tpm_transmit_cmd(chip, &cmd, TPM2_SELF_TEST_IN_SIZE,
++	rc = tpm_transmit_cmd(chip, &cmd, TPM2_SELF_TEST_IN_SIZE, 0,
+ 			      "continue selftest");
+ 
+ 	/* At least some prototype chips seem to give RC_TESTING error
+@@ -882,7 +911,7 @@ int tpm2_do_selftest(struct tpm_chip *chip)
+ 		cmd.params.pcrread_in.pcr_select[1] = 0x00;
+ 		cmd.params.pcrread_in.pcr_select[2] = 0x00;
+ 
+-		rc = tpm_transmit_cmd(chip, (u8 *) &cmd, sizeof(cmd), NULL);
++		rc = tpm_transmit_cmd(chip, &cmd, sizeof(cmd), 0, NULL);
+ 		if (rc < 0)
+ 			break;
+ 
+@@ -931,7 +960,7 @@ int tpm2_probe(struct tpm_chip *chip)
+ 	cmd.params.get_tpm_pt_in.property_id = cpu_to_be32(0x100);
+ 	cmd.params.get_tpm_pt_in.property_cnt = cpu_to_be32(1);
+ 
+-	rc = tpm_transmit(chip, (const char *) &cmd, sizeof(cmd));
++	rc = tpm_transmit(chip, (const u8 *)&cmd, sizeof(cmd), 0);
+ 	if (rc <  0)
+ 		return rc;
+ 	else if (rc < TPM_HEADER_SIZE)
+diff --git a/drivers/char/tpm/tpm_crb.c b/drivers/char/tpm/tpm_crb.c
+index 0f7ec0d..ee300bd 100644
+--- a/drivers/char/tpm/tpm_crb.c
++++ b/drivers/char/tpm/tpm_crb.c
+@@ -142,6 +142,11 @@ static int crb_send(struct tpm_chip *chip, u8 *buf, size_t len)
+ 	struct crb_priv *priv = chip->vendor.priv;
+ 	int rc = 0;
+ 
++	/* Zero the cancel register so that the next command will not get
++	 * canceled.
++	 */
++	iowrite32(0, &priv->cca->cancel);
++
+ 	if (len > ioread32(&priv->cca->cmd_size)) {
+ 		dev_err(&chip->dev,
+ 			"invalid command count value %x %zx\n",
+@@ -175,8 +180,6 @@ static void crb_cancel(struct tpm_chip *chip)
+ 
+ 	if ((priv->flags & CRB_FL_ACPI_START) && crb_do_acpi_start(chip))
+ 		dev_err(&chip->dev, "ACPI Start failed\n");
+-
+-	iowrite32(0, &priv->cca->cancel);
+ }
+ 
+ static bool crb_req_canceled(struct tpm_chip *chip, u8 status)
+diff --git a/drivers/cpuidle/cpuidle-arm.c b/drivers/cpuidle/cpuidle-arm.c
+index e342565e..1855b9e 100644
+--- a/drivers/cpuidle/cpuidle-arm.c
++++ b/drivers/cpuidle/cpuidle-arm.c
+@@ -135,6 +135,7 @@ static int __init arm_idle_init(void)
+ 		dev = kzalloc(sizeof(*dev), GFP_KERNEL);
+ 		if (!dev) {
+ 			pr_err("Failed to allocate cpuidle device\n");
++			ret = -ENOMEM;
+ 			goto out_fail;
+ 		}
+ 		dev->cpu = cpu;
+diff --git a/drivers/mfd/Kconfig b/drivers/mfd/Kconfig
+index 1bcf601..26c084d 100644
+--- a/drivers/mfd/Kconfig
++++ b/drivers/mfd/Kconfig
+@@ -1535,6 +1535,7 @@ config MFD_WM8350
+ config MFD_WM8350_I2C
+ 	bool "Wolfson Microelectronics WM8350 with I2C"
+ 	select MFD_WM8350
++	select REGMAP_I2C
+ 	depends on I2C=y
+ 	help
+ 	  The WM8350 is an integrated audio and power management
+diff --git a/drivers/mfd/atmel-hlcdc.c b/drivers/mfd/atmel-hlcdc.c
+index eca7ea6..4b15b08 100644
+--- a/drivers/mfd/atmel-hlcdc.c
++++ b/drivers/mfd/atmel-hlcdc.c
+@@ -50,8 +50,9 @@ static int regmap_atmel_hlcdc_reg_write(void *context, unsigned int reg,
+ 	if (reg <= ATMEL_HLCDC_DIS) {
+ 		u32 status;
+ 
+-		readl_poll_timeout(hregmap->regs + ATMEL_HLCDC_SR, status,
+-				   !(status & ATMEL_HLCDC_SIP), 1, 100);
++		readl_poll_timeout_atomic(hregmap->regs + ATMEL_HLCDC_SR,
++					  status, !(status & ATMEL_HLCDC_SIP),
++					  1, 100);
+ 	}
+ 
+ 	writel(val, hregmap->regs + reg);
+diff --git a/drivers/mfd/rtsx_usb.c b/drivers/mfd/rtsx_usb.c
+index dbd907d..691dab7 100644
+--- a/drivers/mfd/rtsx_usb.c
++++ b/drivers/mfd/rtsx_usb.c
+@@ -46,9 +46,6 @@ static void rtsx_usb_sg_timed_out(unsigned long data)
+ 
+ 	dev_dbg(&ucr->pusb_intf->dev, "%s: sg transfer timed out", __func__);
+ 	usb_sg_cancel(&ucr->current_sg);
+-
+-	/* we know the cancellation is caused by time-out */
+-	ucr->current_sg.status = -ETIMEDOUT;
+ }
+ 
+ static int rtsx_usb_bulk_transfer_sglist(struct rtsx_ucr *ucr,
+@@ -67,12 +64,15 @@ static int rtsx_usb_bulk_transfer_sglist(struct rtsx_ucr *ucr,
+ 	ucr->sg_timer.expires = jiffies + msecs_to_jiffies(timeout);
+ 	add_timer(&ucr->sg_timer);
+ 	usb_sg_wait(&ucr->current_sg);
+-	del_timer_sync(&ucr->sg_timer);
++	if (!del_timer_sync(&ucr->sg_timer))
++		ret = -ETIMEDOUT;
++	else
++		ret = ucr->current_sg.status;
+ 
+ 	if (act_len)
+ 		*act_len = ucr->current_sg.bytes;
+ 
+-	return ucr->current_sg.status;
++	return ret;
+ }
+ 
+ int rtsx_usb_transfer_data(struct rtsx_ucr *ucr, unsigned int pipe,
+diff --git a/drivers/misc/cxl/vphb.c b/drivers/misc/cxl/vphb.c
+index cdc7723..bec6c22 100644
+--- a/drivers/misc/cxl/vphb.c
++++ b/drivers/misc/cxl/vphb.c
+@@ -243,6 +243,11 @@ int cxl_pci_vphb_add(struct cxl_afu *afu)
+ 	if (phb->bus == NULL)
+ 		return -ENXIO;
+ 
++	/* Set release hook on root bus */
++	pci_set_host_bridge_release(to_pci_host_bridge(phb->bus->bridge),
++				    pcibios_free_controller_deferred,
++				    (void *) phb);
++
+ 	/* Claim resources. This might need some rework as well depending
+ 	 * whether we are doing probe-only or not, like assigning unassigned
+ 	 * resources etc...
+@@ -269,7 +274,10 @@ void cxl_pci_vphb_remove(struct cxl_afu *afu)
+ 	afu->phb = NULL;
+ 
+ 	pci_remove_root_bus(phb->bus);
+-	pcibios_free_controller(phb);
++	/*
++	 * We don't free phb here - that's handled by
++	 * pcibios_free_controller_deferred()
++	 */
+ }
+ 
+ bool cxl_pci_is_vphb_device(struct pci_dev *dev)
+diff --git a/drivers/pci/host-bridge.c b/drivers/pci/host-bridge.c
+index 5f4a2e0..add6623 100644
+--- a/drivers/pci/host-bridge.c
++++ b/drivers/pci/host-bridge.c
+@@ -44,6 +44,7 @@ void pci_set_host_bridge_release(struct pci_host_bridge *bridge,
+ 	bridge->release_fn = release_fn;
+ 	bridge->release_data = release_data;
+ }
++EXPORT_SYMBOL_GPL(pci_set_host_bridge_release);
+ 
+ void pcibios_resource_to_bus(struct pci_bus *bus, struct pci_bus_region *region,
+ 			     struct resource *res)
+diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
+index 05a5300..b16813c 100644
+--- a/drivers/usb/dwc3/gadget.c
++++ b/drivers/usb/dwc3/gadget.c
+@@ -363,7 +363,8 @@ static int dwc3_send_clear_stall_ep_cmd(struct dwc3_ep *dep)
+ 	 * IN transfers due to a mishandled error condition. Synopsys
+ 	 * STAR 9000614252.
+ 	 */
+-	if (dep->direction && (dwc->revision >= DWC3_REVISION_260A))
++	if (dep->direction && (dwc->revision >= DWC3_REVISION_260A) &&
++	    (dwc->gadget.speed >= USB_SPEED_SUPER))
+ 		cmd |= DWC3_DEPCMD_CLEARPENDIN;
+ 
+ 	memset(&params, 0, sizeof(params));
+diff --git a/include/linux/mfd/88pm80x.h b/include/linux/mfd/88pm80x.h
+index d409ceb..c118a7e 100644
+--- a/include/linux/mfd/88pm80x.h
++++ b/include/linux/mfd/88pm80x.h
+@@ -350,7 +350,7 @@ static inline int pm80x_dev_suspend(struct device *dev)
+ 	int irq = platform_get_irq(pdev, 0);
+ 
+ 	if (device_may_wakeup(dev))
+-		set_bit((1 << irq), &chip->wu_flag);
++		set_bit(irq, &chip->wu_flag);
+ 
+ 	return 0;
+ }
+@@ -362,7 +362,7 @@ static inline int pm80x_dev_resume(struct device *dev)
+ 	int irq = platform_get_irq(pdev, 0);
+ 
+ 	if (device_may_wakeup(dev))
+-		clear_bit((1 << irq), &chip->wu_flag);
++		clear_bit(irq, &chip->wu_flag);
+ 
+ 	return 0;
+ }
+diff --git a/kernel/time/timekeeping.c b/kernel/time/timekeeping.c
+index b6c3945..1b72b17 100644
+--- a/kernel/time/timekeeping.c
++++ b/kernel/time/timekeeping.c
+@@ -403,8 +403,11 @@ static __always_inline u64 __ktime_get_fast_ns(struct tk_fast *tkf)
+ 		tkr = tkf->base + (seq & 0x01);
+ 		now = ktime_to_ns(tkr->base);
+ 
+-		now += clocksource_delta(tkr->read(tkr->clock),
+-					 tkr->cycle_last, tkr->mask);
++		now += timekeeping_delta_to_ns(tkr,
++				clocksource_delta(
++					tkr->read(tkr->clock),
++					tkr->cycle_last,
++					tkr->mask));
+ 	} while (read_seqcount_retry(&tkf->seq, seq));
+ 
+ 	return now;
+diff --git a/security/integrity/ima/ima_appraise.c b/security/integrity/ima/ima_appraise.c
+index 1bcbc12..b5b932c 100644
+--- a/security/integrity/ima/ima_appraise.c
++++ b/security/integrity/ima/ima_appraise.c
+@@ -190,7 +190,7 @@ int ima_appraise_measurement(enum ima_hooks func,
+ {
+ 	static const char op[] = "appraise_data";
+ 	char *cause = "unknown";
+-	struct dentry *dentry = file->f_path.dentry;
++	struct dentry *dentry = file_dentry(file);
+ 	struct inode *inode = d_backing_inode(dentry);
+ 	enum integrity_status status = INTEGRITY_UNKNOWN;
+ 	int rc = xattr_len, hash_start = 0;
+@@ -295,7 +295,7 @@ int ima_appraise_measurement(enum ima_hooks func,
+  */
+ void ima_update_xattr(struct integrity_iint_cache *iint, struct file *file)
+ {
+-	struct dentry *dentry = file->f_path.dentry;
++	struct dentry *dentry = file_dentry(file);
+ 	int rc = 0;
+ 
+ 	/* do not collect and update hash for digital signatures */
+diff --git a/security/integrity/ima/ima_main.c b/security/integrity/ima/ima_main.c
+index 68b26c3..60ac3ae 100644
+--- a/security/integrity/ima/ima_main.c
++++ b/security/integrity/ima/ima_main.c
+@@ -222,7 +222,7 @@ static int process_measurement(struct file *file, char *buf, loff_t size,
+ 	if ((action & IMA_APPRAISE_SUBMASK) ||
+ 		    strcmp(template_desc->name, IMA_TEMPLATE_IMA_NAME) != 0)
+ 		/* read 'security.ima' */
+-		xattr_len = ima_read_xattr(file->f_path.dentry, &xattr_value);
++		xattr_len = ima_read_xattr(file_dentry(file), &xattr_value);
+ 
+ 	hash_algo = ima_get_hash_algo(xattr_value, xattr_len);
+ 
+diff --git a/sound/pci/ali5451/ali5451.c b/sound/pci/ali5451/ali5451.c
+index 36470af..92b819e 100644
+--- a/sound/pci/ali5451/ali5451.c
++++ b/sound/pci/ali5451/ali5451.c
+@@ -1408,6 +1408,7 @@ snd_ali_playback_pointer(struct snd_pcm_substream *substream)
+ 	spin_unlock(&codec->reg_lock);
+ 	dev_dbg(codec->card->dev, "playback pointer returned cso=%xh.\n", cso);
+ 
++	cso %= runtime->buffer_size;
+ 	return cso;
+ }
+ 
+@@ -1428,6 +1429,7 @@ static snd_pcm_uframes_t snd_ali_pointer(struct snd_pcm_substream *substream)
+ 	cso = inw(ALI_REG(codec, ALI_CSO_ALPHA_FMS + 2));
+ 	spin_unlock(&codec->reg_lock);
+ 
++	cso %= runtime->buffer_size;
+ 	return cso;
+ }
+ 
+diff --git a/sound/usb/line6/driver.c b/sound/usb/line6/driver.c
+index 81b7da8..183311c 100644
+--- a/sound/usb/line6/driver.c
++++ b/sound/usb/line6/driver.c
+@@ -29,7 +29,7 @@
+ /*
+ 	This is Line 6's MIDI manufacturer ID.
+ */
+-const unsigned char line6_midi_id[] = {
++const unsigned char line6_midi_id[3] = {
+ 	0x00, 0x01, 0x0c
+ };
+ EXPORT_SYMBOL_GPL(line6_midi_id);
+diff --git a/sound/usb/mixer_quirks.c b/sound/usb/mixer_quirks.c
+index f6c3bf7..04991b0 100644
+--- a/sound/usb/mixer_quirks.c
++++ b/sound/usb/mixer_quirks.c
+@@ -1831,6 +1831,7 @@ void snd_usb_mixer_rc_memory_change(struct usb_mixer_interface *mixer,
+ }
+ 
+ static void snd_dragonfly_quirk_db_scale(struct usb_mixer_interface *mixer,
++					 struct usb_mixer_elem_info *cval,
+ 					 struct snd_kcontrol *kctl)
+ {
+ 	/* Approximation using 10 ranges based on output measurement on hw v1.2.
+@@ -1848,10 +1849,19 @@ static void snd_dragonfly_quirk_db_scale(struct usb_mixer_interface *mixer,
+ 		41, 50, TLV_DB_MINMAX_ITEM(-441, 0),
+ 	);
+ 
+-	usb_audio_info(mixer->chip, "applying DragonFly dB scale quirk\n");
+-	kctl->tlv.p = scale;
+-	kctl->vd[0].access |= SNDRV_CTL_ELEM_ACCESS_TLV_READ;
+-	kctl->vd[0].access &= ~SNDRV_CTL_ELEM_ACCESS_TLV_CALLBACK;
++	if (cval->min == 0 && cval->max == 50) {
++		usb_audio_info(mixer->chip, "applying DragonFly dB scale quirk (0-50 variant)\n");
++		kctl->tlv.p = scale;
++		kctl->vd[0].access |= SNDRV_CTL_ELEM_ACCESS_TLV_READ;
++		kctl->vd[0].access &= ~SNDRV_CTL_ELEM_ACCESS_TLV_CALLBACK;
++
++	} else if (cval->min == 0 && cval->max <= 1000) {
++		/* Some other clearly broken DragonFly variant.
++		 * At least a 0..53 variant (hw v1.0) exists.
++		 */
++		usb_audio_info(mixer->chip, "ignoring too narrow dB range on a DragonFly device");
++		kctl->vd[0].access &= ~SNDRV_CTL_ELEM_ACCESS_TLV_CALLBACK;
++	}
+ }
+ 
+ void snd_usb_mixer_fu_apply_quirk(struct usb_mixer_interface *mixer,
+@@ -1860,8 +1870,8 @@ void snd_usb_mixer_fu_apply_quirk(struct usb_mixer_interface *mixer,
+ {
+ 	switch (mixer->chip->usb_id) {
+ 	case USB_ID(0x21b4, 0x0081): /* AudioQuest DragonFly */
+-		if (unitid == 7 && cval->min == 0 && cval->max == 50)
+-			snd_dragonfly_quirk_db_scale(mixer, kctl);
++		if (unitid == 7 && cval->control == UAC_FU_VOLUME)
++			snd_dragonfly_quirk_db_scale(mixer, cval, kctl);
+ 		break;
+ 	}
+ }
+diff --git a/virt/kvm/arm/pmu.c b/virt/kvm/arm/pmu.c
+index a027569..6e9c40e 100644
+--- a/virt/kvm/arm/pmu.c
++++ b/virt/kvm/arm/pmu.c
+@@ -423,6 +423,14 @@ static int kvm_arm_pmu_v3_init(struct kvm_vcpu *vcpu)
+ 	if (!kvm_arm_support_pmu_v3())
+ 		return -ENODEV;
+ 
++	/*
++	 * We currently require an in-kernel VGIC to use the PMU emulation,
++	 * because we do not support forwarding PMU overflow interrupts to
++	 * userspace yet.
++	 */
++	if (!irqchip_in_kernel(vcpu->kvm) || !vgic_initialized(vcpu->kvm))
++		return -ENODEV;
++
+ 	if (!test_bit(KVM_ARM_VCPU_PMU_V3, vcpu->arch.features) ||
+ 	    !kvm_arm_pmu_irq_initialized(vcpu))
+ 		return -ENXIO;
+diff --git a/virt/kvm/arm/vgic/vgic.c b/virt/kvm/arm/vgic/vgic.c
+index 69b61ab..7ea7911 100644
+--- a/virt/kvm/arm/vgic/vgic.c
++++ b/virt/kvm/arm/vgic/vgic.c
+@@ -553,6 +553,9 @@ static void vgic_flush_lr_state(struct kvm_vcpu *vcpu)
+ /* Sync back the hardware VGIC state into our emulation after a guest's run. */
+ void kvm_vgic_sync_hwstate(struct kvm_vcpu *vcpu)
+ {
++	if (unlikely(!vgic_initialized(vcpu->kvm)))
++		return;
++
+ 	vgic_process_maintenance_interrupt(vcpu);
+ 	vgic_fold_lr_state(vcpu);
+ 	vgic_prune_ap_list(vcpu);
+@@ -561,6 +564,9 @@ void kvm_vgic_sync_hwstate(struct kvm_vcpu *vcpu)
+ /* Flush our emulation state into the GIC hardware before entering the guest. */
+ void kvm_vgic_flush_hwstate(struct kvm_vcpu *vcpu)
+ {
++	if (unlikely(!vgic_initialized(vcpu->kvm)))
++		return;
++
+ 	spin_lock(&vcpu->arch.vgic_cpu.ap_list_lock);
+ 	vgic_flush_lr_state(vcpu);
+ 	spin_unlock(&vcpu->arch.vgic_cpu.ap_list_lock);
diff --git a/4.7.7/4420_grsecurity-3.1-4.7.7-201610101902.patch b/4.7.8/4420_grsecurity-3.1-4.7.8-201610161720.patch
index a850d0e..8bfeed3 100644
--- a/4.7.7/4420_grsecurity-3.1-4.7.7-201610101902.patch
+++ b/4.7.8/4420_grsecurity-3.1-4.7.8-201610161720.patch
@@ -425,7 +425,7 @@ index a3683ce..5ec8bf4 100644
  
  A toggle value indicating if modules are allowed to be loaded
 diff --git a/Makefile b/Makefile
-index 320a930..a552059 100644
+index 4e17baa..27b3224 100644
 --- a/Makefile
 +++ b/Makefile
 @@ -302,7 +302,9 @@ CONFIG_SHELL := $(shell if [ -x "$$BASH" ]; then echo $$BASH; \
@@ -5065,10 +5065,10 @@ index 6cd2612..56d72e5c 100644
  	/* Disable interrupts first */
  	local_irq_disable();
 diff --git a/arch/arm64/kernel/stacktrace.c b/arch/arm64/kernel/stacktrace.c
-index d9751a4..aeda309 100644
+index d34fd72..8b6faee 100644
 --- a/arch/arm64/kernel/stacktrace.c
 +++ b/arch/arm64/kernel/stacktrace.c
-@@ -92,8 +92,8 @@ int notrace unwind_frame(struct task_struct *tsk, struct stackframe *frame)
+@@ -95,8 +95,8 @@ int notrace unwind_frame(struct task_struct *tsk, struct stackframe *frame)
  		struct pt_regs *irq_args;
  		unsigned long orig_sp = IRQ_STACK_TO_TASK_STACK(irq_stack_ptr);
  
@@ -5080,7 +5080,7 @@ index d9751a4..aeda309 100644
  
  			/* orig_sp is the saved pt_regs, find the elr */
 diff --git a/arch/arm64/kernel/traps.c b/arch/arm64/kernel/traps.c
-index 2a43012..3409956 100644
+index f014df9..c4892f7 100644
 --- a/arch/arm64/kernel/traps.c
 +++ b/arch/arm64/kernel/traps.c
 @@ -420,7 +420,7 @@ asmlinkage long do_ni_syscall(struct pt_regs *regs)
@@ -8810,7 +8810,7 @@ index 2eeaf80..c75d4fb 100644
  #define PAGE_KERNEL_RO	__pgprot(_PAGE_BASE | _PAGE_KERNEL_RO)
  #define PAGE_KERNEL_ROX	__pgprot(_PAGE_BASE | _PAGE_KERNEL_ROX)
 diff --git a/arch/powerpc/include/asm/reg.h b/arch/powerpc/include/asm/reg.h
-index a0948f4..ddcf6be 100644
+index 145e5b7..b559373 100644
 --- a/arch/powerpc/include/asm/reg.h
 +++ b/arch/powerpc/include/asm/reg.h
 @@ -261,6 +261,7 @@
@@ -17158,7 +17158,7 @@ index 983e5d3..d660273 100644
 +ENDPROC(async_page_fault)
  #endif
 diff --git a/arch/x86/entry/entry_64.S b/arch/x86/entry/entry_64.S
-index 9ee0da1..2421755 100644
+index 9ee0da1..2e3dd57 100644
 --- a/arch/x86/entry/entry_64.S
 +++ b/arch/x86/entry/entry_64.S
 @@ -36,6 +36,8 @@
@@ -17624,7 +17624,27 @@ index 9ee0da1..2421755 100644
  	RESTORE_EXTRA_REGS
  	TRACE_IRQS_IRETQ		/* we're about to change IF */
  
-@@ -322,7 +731,7 @@ syscall_return_via_sysret:
+@@ -272,13 +681,12 @@ return_from_SYSCALL_64:
+ 	.error "virtual address width changed -- SYSRET checks need update"
+ 	.endif
+ 
+-	/* Change top 16 bits to be the sign-extension of 47th bit */
+-	shl	$(64 - (__VIRTUAL_MASK_SHIFT+1)), %rcx
+-	sar	$(64 - (__VIRTUAL_MASK_SHIFT+1)), %rcx
+-
+-	/* If this changed %rcx, it was not canonical */
+-	cmpq	%rcx, %r11
+-	jne	opportunistic_sysret_failed
++	/*
++	 * If the top 17 bits are not 0 then RIP isn't a userland address,
++	 * it may not even be canonical, fall back to iret
++	 */
++	shr	$(__VIRTUAL_MASK_SHIFT), %r11
++	jnz	opportunistic_sysret_failed
+ 
+ 	cmpq	$__USER_CS, CS(%rsp)		/* CS must match SYSRET */
+ 	jne	opportunistic_sysret_failed
+@@ -322,7 +730,7 @@ syscall_return_via_sysret:
  opportunistic_sysret_failed:
  	SWAPGS
  	jmp	restore_c_regs_and_iret
@@ -17633,7 +17653,7 @@ index 9ee0da1..2421755 100644
  
  ENTRY(stub_ptregs_64)
  	/*
-@@ -349,13 +758,13 @@ ENTRY(stub_ptregs_64)
+@@ -349,13 +757,13 @@ ENTRY(stub_ptregs_64)
  1:
  	/* Called from C */
  	jmp	*%rax				/* called from C */
@@ -17649,7 +17669,7 @@ index 9ee0da1..2421755 100644
  .endm
  
  /* Instantiate ptregs_stub for each ptregs-using syscall */
-@@ -397,10 +806,12 @@ ENTRY(ret_from_fork)
+@@ -397,10 +805,12 @@ ENTRY(ret_from_fork)
  1:
  	movq	%rsp, %rdi
  	call	syscall_return_slowpath	/* returns with IRQs disabled */
@@ -17663,7 +17683,7 @@ index 9ee0da1..2421755 100644
  
  /*
   * Build the entry stubs with some assembler magic.
-@@ -415,7 +826,7 @@ ENTRY(irq_entries_start)
+@@ -415,7 +825,7 @@ ENTRY(irq_entries_start)
  	jmp	common_interrupt
  	.align	8
      .endr
@@ -17672,7 +17692,7 @@ index 9ee0da1..2421755 100644
  
  /*
   * Interrupt entry/exit.
-@@ -441,6 +852,12 @@ END(irq_entries_start)
+@@ -441,6 +851,12 @@ END(irq_entries_start)
  	 */
  	SWAPGS
  
@@ -17685,7 +17705,7 @@ index 9ee0da1..2421755 100644
  	/*
  	 * We need to tell lockdep that IRQs are off.  We can't do this until
  	 * we fix gsbase, and we should do it before enter_from_user_mode
-@@ -453,7 +870,9 @@ END(irq_entries_start)
+@@ -453,7 +869,9 @@ END(irq_entries_start)
  
  	CALL_enter_from_user_mode
  
@@ -17696,7 +17716,7 @@ index 9ee0da1..2421755 100644
  	/*
  	 * Save previous stack pointer, optionally switch to interrupt stack.
  	 * irq_count is used to check if a CPU is already on an interrupt stack
-@@ -465,6 +884,7 @@ END(irq_entries_start)
+@@ -465,6 +883,7 @@ END(irq_entries_start)
  	incl	PER_CPU_VAR(irq_count)
  	cmovzq	PER_CPU_VAR(irq_stack_ptr), %rsp
  	pushq	%rdi
@@ -17704,7 +17724,7 @@ index 9ee0da1..2421755 100644
  	/* We entered an interrupt context - irqs are off: */
  	TRACE_IRQS_OFF
  
-@@ -496,6 +916,8 @@ ret_from_intr:
+@@ -496,6 +915,8 @@ ret_from_intr:
  GLOBAL(retint_user)
  	mov	%rsp,%rdi
  	call	prepare_exit_to_usermode
@@ -17713,7 +17733,7 @@ index 9ee0da1..2421755 100644
  	TRACE_IRQS_IRETQ
  	SWAPGS
  	jmp	restore_regs_and_iret
-@@ -513,6 +935,21 @@ retint_kernel:
+@@ -513,6 +934,21 @@ retint_kernel:
  	jmp	0b
  1:
  #endif
@@ -17735,7 +17755,7 @@ index 9ee0da1..2421755 100644
  	/*
  	 * The iretq could re-enable interrupts:
  	 */
-@@ -556,15 +993,15 @@ native_irq_return_ldt:
+@@ -556,15 +992,15 @@ native_irq_return_ldt:
  	SWAPGS
  	movq	PER_CPU_VAR(espfix_waddr), %rdi
  	movq	%rax, (0*8)(%rdi)		/* RAX */
@@ -17756,7 +17776,7 @@ index 9ee0da1..2421755 100644
  	movq	%rax, (4*8)(%rdi)
  	andl	$0xffff0000, %eax
  	popq	%rdi
-@@ -574,7 +1011,7 @@ native_irq_return_ldt:
+@@ -574,7 +1010,7 @@ native_irq_return_ldt:
  	popq	%rax
  	jmp	native_irq_return_iret
  #endif
@@ -17765,7 +17785,7 @@ index 9ee0da1..2421755 100644
  
  /*
   * APIC interrupts.
-@@ -586,7 +1023,7 @@ ENTRY(\sym)
+@@ -586,7 +1022,7 @@ ENTRY(\sym)
  .Lcommon_\sym:
  	interrupt \do_sym
  	jmp	ret_from_intr
@@ -17774,7 +17794,7 @@ index 9ee0da1..2421755 100644
  .endm
  
  #ifdef CONFIG_TRACING
-@@ -651,7 +1088,7 @@ apicinterrupt IRQ_WORK_VECTOR			irq_work_interrupt		smp_irq_work_interrupt
+@@ -651,7 +1087,7 @@ apicinterrupt IRQ_WORK_VECTOR			irq_work_interrupt		smp_irq_work_interrupt
  /*
   * Exception entry points.
   */
@@ -17783,7 +17803,7 @@ index 9ee0da1..2421755 100644
  
  .macro idtentry sym do_sym has_error_code:req paranoid=0 shift_ist=-1
  ENTRY(\sym)
-@@ -698,6 +1135,12 @@ ENTRY(\sym)
+@@ -698,6 +1134,12 @@ ENTRY(\sym)
  	.endif
  
  	.if \shift_ist != -1
@@ -17796,7 +17816,7 @@ index 9ee0da1..2421755 100644
  	subq	$EXCEPTION_STKSZ, CPU_TSS_IST(\shift_ist)
  	.endif
  
-@@ -741,7 +1184,7 @@ ENTRY(\sym)
+@@ -741,7 +1183,7 @@ ENTRY(\sym)
  
  	jmp	error_exit			/* %ebx: no swapgs flag */
  	.endif
@@ -17805,7 +17825,7 @@ index 9ee0da1..2421755 100644
  .endm
  
  #ifdef CONFIG_TRACING
-@@ -783,8 +1226,9 @@ ENTRY(native_load_gs_index)
+@@ -783,8 +1225,9 @@ ENTRY(native_load_gs_index)
  2:	ALTERNATIVE "", "mfence", X86_BUG_SWAPGS_FENCE
  	SWAPGS
  	popfq
@@ -17816,7 +17836,7 @@ index 9ee0da1..2421755 100644
  
  	_ASM_EXTABLE(.Lgs_change, bad_gs)
  	.section .fixup, "ax"
-@@ -812,8 +1256,9 @@ ENTRY(do_softirq_own_stack)
+@@ -812,8 +1255,9 @@ ENTRY(do_softirq_own_stack)
  	call	__do_softirq
  	leaveq
  	decl	PER_CPU_VAR(irq_count)
@@ -17827,7 +17847,7 @@ index 9ee0da1..2421755 100644
  
  #ifdef CONFIG_XEN
  idtentry xen_hypervisor_callback xen_do_hypervisor_callback has_error_code=0
-@@ -849,7 +1294,7 @@ ENTRY(xen_do_hypervisor_callback)		/* do_hypervisor_callback(struct *pt_regs) */
+@@ -849,7 +1293,7 @@ ENTRY(xen_do_hypervisor_callback)		/* do_hypervisor_callback(struct *pt_regs) */
  	call	xen_maybe_preempt_hcall
  #endif
  	jmp	error_exit
@@ -17836,7 +17856,7 @@ index 9ee0da1..2421755 100644
  
  /*
   * Hypervisor uses this for application faults while it executes.
-@@ -894,7 +1339,7 @@ ENTRY(xen_failsafe_callback)
+@@ -894,7 +1338,7 @@ ENTRY(xen_failsafe_callback)
  	SAVE_C_REGS
  	SAVE_EXTRA_REGS
  	jmp	error_exit
@@ -17845,7 +17865,7 @@ index 9ee0da1..2421755 100644
  
  apicinterrupt3 HYPERVISOR_CALLBACK_VECTOR \
  	xen_hvm_callback_vector xen_evtchn_do_upcall
-@@ -906,7 +1351,7 @@ apicinterrupt3 HYPERVISOR_CALLBACK_VECTOR \
+@@ -906,7 +1350,7 @@ apicinterrupt3 HYPERVISOR_CALLBACK_VECTOR \
  	hyperv_callback_vector hyperv_vector_handler
  #endif /* CONFIG_HYPERV */
  
@@ -17854,7 +17874,7 @@ index 9ee0da1..2421755 100644
  idtentry int3			do_int3			has_error_code=0	paranoid=1 shift_ist=DEBUG_STACK
  idtentry stack_segment		do_stack_segment	has_error_code=1
  
-@@ -943,8 +1388,34 @@ ENTRY(paranoid_entry)
+@@ -943,8 +1387,34 @@ ENTRY(paranoid_entry)
  	js	1f				/* negative -> in kernel */
  	SWAPGS
  	xorl	%ebx, %ebx
@@ -17891,7 +17911,7 @@ index 9ee0da1..2421755 100644
  
  /*
   * "Paranoid" exit path from exception stack.  This is invoked
-@@ -961,19 +1432,26 @@ END(paranoid_entry)
+@@ -961,19 +1431,26 @@ END(paranoid_entry)
  ENTRY(paranoid_exit)
  	DISABLE_INTERRUPTS(CLBR_NONE)
  	TRACE_IRQS_OFF_DEBUG
@@ -17920,7 +17940,7 @@ index 9ee0da1..2421755 100644
  
  /*
   * Save all registers in pt_regs, and switch gs if needed.
-@@ -987,13 +1465,18 @@ ENTRY(error_entry)
+@@ -987,13 +1464,18 @@ ENTRY(error_entry)
  	testb	$3, CS+8(%rsp)
  	jz	.Lerror_kernelspace
  
@@ -17940,7 +17960,7 @@ index 9ee0da1..2421755 100644
  .Lerror_entry_from_usermode_after_swapgs:
  	/*
  	 * We need to tell lockdep that IRQs are off.  We can't do this until
-@@ -1002,10 +1485,12 @@ ENTRY(error_entry)
+@@ -1002,10 +1484,12 @@ ENTRY(error_entry)
  	 */
  	TRACE_IRQS_OFF
  	CALL_enter_from_user_mode
@@ -17953,7 +17973,7 @@ index 9ee0da1..2421755 100644
  	ret
  
  	/*
-@@ -1023,14 +1508,16 @@ ENTRY(error_entry)
+@@ -1023,14 +1507,16 @@ ENTRY(error_entry)
  	cmpq	%rax, RIP+8(%rsp)
  	je	.Lbstep_iret
  	cmpq	$.Lgs_change, RIP+8(%rsp)
@@ -17972,7 +17992,7 @@ index 9ee0da1..2421755 100644
  
  .Lbstep_iret:
  	/* Fix truncated RIP */
-@@ -1044,6 +1531,12 @@ ENTRY(error_entry)
+@@ -1044,6 +1530,12 @@ ENTRY(error_entry)
  	 */
  	SWAPGS
  
@@ -17985,7 +18005,7 @@ index 9ee0da1..2421755 100644
  	/*
  	 * Pretend that the exception came from user mode: set up pt_regs
  	 * as if we faulted immediately after IRET and clear EBX so that
-@@ -1054,11 +1547,11 @@ ENTRY(error_entry)
+@@ -1054,11 +1546,11 @@ ENTRY(error_entry)
  	mov	%rax, %rsp
  	decl	%ebx
  	jmp	.Lerror_entry_from_usermode_after_swapgs
@@ -17999,7 +18019,7 @@ index 9ee0da1..2421755 100644
   *   1: already in kernel mode, don't need SWAPGS
   *   0: user gsbase is loaded, we need SWAPGS and standard preparation for return to usermode
   */
-@@ -1066,10 +1559,10 @@ ENTRY(error_exit)
+@@ -1066,10 +1558,10 @@ ENTRY(error_exit)
  	movl	%ebx, %eax
  	DISABLE_INTERRUPTS(CLBR_NONE)
  	TRACE_IRQS_OFF
@@ -18012,7 +18032,7 @@ index 9ee0da1..2421755 100644
  
  /* Runs on exception stack */
  ENTRY(nmi)
-@@ -1123,6 +1616,8 @@ ENTRY(nmi)
+@@ -1123,6 +1615,8 @@ ENTRY(nmi)
  	 * other IST entries.
  	 */
  
@@ -18021,7 +18041,7 @@ index 9ee0da1..2421755 100644
  	/* Use %rdx as our temp variable throughout */
  	pushq	%rdx
  
-@@ -1166,6 +1661,12 @@ ENTRY(nmi)
+@@ -1166,6 +1660,12 @@ ENTRY(nmi)
  	pushq	%r14		/* pt_regs->r14 */
  	pushq	%r15		/* pt_regs->r15 */
  
@@ -18034,7 +18054,7 @@ index 9ee0da1..2421755 100644
  	/*
  	 * At this point we no longer need to worry about stack damage
  	 * due to nesting -- we're on the normal thread stack and we're
-@@ -1176,12 +1677,19 @@ ENTRY(nmi)
+@@ -1176,12 +1676,19 @@ ENTRY(nmi)
  	movq	$-1, %rsi
  	call	do_nmi
  
@@ -18054,7 +18074,7 @@ index 9ee0da1..2421755 100644
  	jmp	restore_c_regs_and_iret
  
  .Lnmi_from_kernel:
-@@ -1303,6 +1811,7 @@ nested_nmi_out:
+@@ -1303,6 +1810,7 @@ nested_nmi_out:
  	popq	%rdx
  
  	/* We are returning to kernel mode, so this cannot result in a fault. */
@@ -18062,7 +18082,7 @@ index 9ee0da1..2421755 100644
  	INTERRUPT_RETURN
  
  first_nmi:
-@@ -1331,7 +1840,7 @@ first_nmi:
+@@ -1331,7 +1839,7 @@ first_nmi:
  	pushq	%rsp		/* RSP (minus 8 because of the previous push) */
  	addq	$8, (%rsp)	/* Fix up RSP */
  	pushfq			/* RFLAGS */
@@ -18071,7 +18091,7 @@ index 9ee0da1..2421755 100644
  	pushq	$1f		/* RIP */
  	INTERRUPT_RETURN	/* continues at repeat_nmi below */
  1:
-@@ -1376,20 +1885,22 @@ end_repeat_nmi:
+@@ -1376,20 +1884,22 @@ end_repeat_nmi:
  	ALLOC_PT_GPREGS_ON_STACK
  
  	/*
@@ -18097,7 +18117,7 @@ index 9ee0da1..2421755 100644
  	jnz	nmi_restore
  nmi_swapgs:
  	SWAPGS_UNSAFE_STACK
-@@ -1400,6 +1911,8 @@ nmi_restore:
+@@ -1400,6 +1910,8 @@ nmi_restore:
  	/* Point RSP at the "iret" frame. */
  	REMOVE_PT_GPREGS_FROM_STACK 6*8
  
@@ -18106,7 +18126,7 @@ index 9ee0da1..2421755 100644
  	/*
  	 * Clear "NMI executing".  Set DF first so that we can easily
  	 * distinguish the remaining code between here and IRET from
-@@ -1417,9 +1930,9 @@ nmi_restore:
+@@ -1417,9 +1929,9 @@ nmi_restore:
  	 * mode, so this cannot result in a fault.
  	 */
  	INTERRUPT_RETURN
@@ -19761,16 +19781,20 @@ index 3e86742..1b19554 100644
   * @v: pointer to type int
   *
 diff --git a/arch/x86/include/asm/atomic64_32.h b/arch/x86/include/asm/atomic64_32.h
-index a984111..7a258c7 100644
+index a984111..e08276c 100644
 --- a/arch/x86/include/asm/atomic64_32.h
 +++ b/arch/x86/include/asm/atomic64_32.h
-@@ -11,6 +11,14 @@ typedef struct {
- 	u64 __aligned(8) counter;
+@@ -8,9 +8,17 @@
+ /* An 64bit atomic type */
+ 
+ typedef struct {
+-	u64 __aligned(8) counter;
++	s64 __aligned(8) counter;
  } atomic64_t;
  
 +#ifdef CONFIG_PAX_REFCOUNT
 +typedef struct {
-+	u64 __aligned(8) counter;
++	s64 __aligned(8) counter;
 +} atomic64_unchecked_t;
 +#else
 +typedef atomic64_t atomic64_unchecked_t;
@@ -25178,7 +25202,7 @@ index 0503f5b..f00b6e8 100644
  obj-$(CONFIG_X86_64)	+= mcount_64.o
  obj-$(CONFIG_X86_ESPFIX64)	+= espfix_64.o
 diff --git a/arch/x86/kernel/acpi/boot.c b/arch/x86/kernel/acpi/boot.c
-index 9414f84..724b296 100644
+index 8e6e8bc..0b4f76f 100644
 --- a/arch/x86/kernel/acpi/boot.c
 +++ b/arch/x86/kernel/acpi/boot.c
 @@ -1349,7 +1349,7 @@ static void __init acpi_reduced_hw_init(void)
@@ -25490,10 +25514,10 @@ index 5cb272a..2bcff83 100644
  	bp_int3_handler = handler;
  	bp_int3_addr = (u8 *)addr + sizeof(int3);
 diff --git a/arch/x86/kernel/apic/apic.c b/arch/x86/kernel/apic/apic.c
-index b15e1c1..42cf1f5 100644
+index cc7bc8b..7b5e6a7 100644
 --- a/arch/x86/kernel/apic/apic.c
 +++ b/arch/x86/kernel/apic/apic.c
-@@ -177,7 +177,7 @@ int first_system_vector = FIRST_SYSTEM_VECTOR;
+@@ -179,7 +179,7 @@ int first_system_vector = FIRST_SYSTEM_VECTOR;
  /*
   * Debug level, exported for io_apic.c
   */
@@ -25502,7 +25526,7 @@ index b15e1c1..42cf1f5 100644
  
  int pic_mode;
  
-@@ -1881,7 +1881,7 @@ static void __smp_error_interrupt(struct pt_regs *regs)
+@@ -1879,7 +1879,7 @@ static void __smp_error_interrupt(struct pt_regs *regs)
  		apic_write(APIC_ESR, 0);
  	v = apic_read(APIC_ESR);
  	ack_APIC_irq();
@@ -25569,7 +25593,7 @@ index cf9bd89..75fcb85 100644
  	.name				= "bigsmp",
  	.probe				= probe_bigsmp,
 diff --git a/arch/x86/kernel/apic/io_apic.c b/arch/x86/kernel/apic/io_apic.c
-index 446702e..ed37083 100644
+index fbfb244..a5266c0 100644
 --- a/arch/x86/kernel/apic/io_apic.c
 +++ b/arch/x86/kernel/apic/io_apic.c
 @@ -1682,7 +1682,7 @@ static unsigned int startup_ioapic_irq(struct irq_data *data)
@@ -25631,7 +25655,7 @@ index ade2532..5fc7f4f9 100644
  	.irq_unmask = hpet_msi_unmask,
  	.irq_mask = hpet_msi_mask,
 diff --git a/arch/x86/kernel/apic/probe_32.c b/arch/x86/kernel/apic/probe_32.c
-index f316e34..48c21c5 100644
+index 49da80cf..02565a9 100644
 --- a/arch/x86/kernel/apic/probe_32.c
 +++ b/arch/x86/kernel/apic/probe_32.c
 @@ -72,7 +72,7 @@ static int probe_default(void)
@@ -25653,7 +25677,7 @@ index f316e34..48c21c5 100644
  
  static int cmdline_apic __initdata;
 diff --git a/arch/x86/kernel/apic/vector.c b/arch/x86/kernel/apic/vector.c
-index a5e400a..d070a03 100644
+index 84eced5..7e23073 100644
 --- a/arch/x86/kernel/apic/vector.c
 +++ b/arch/x86/kernel/apic/vector.c
 @@ -37,6 +37,7 @@ static struct irq_chip lapic_controller;
@@ -26889,10 +26913,10 @@ index d558a8a..c30e5a9 100644
 +EXPORT_SYMBOL(pax_check_alloca);
 +#endif
 diff --git a/arch/x86/kernel/e820.c b/arch/x86/kernel/e820.c
-index 621b501..9e7da88 100644
+index 8a90f15..de6e2f8 100644
 --- a/arch/x86/kernel/e820.c
 +++ b/arch/x86/kernel/e820.c
-@@ -804,8 +804,8 @@ unsigned long __init e820_end_of_low_ram_pfn(void)
+@@ -800,8 +800,8 @@ unsigned long __init e820_end_of_low_ram_pfn(void)
  
  static void early_panic(char *msg)
  {
@@ -30156,10 +30180,10 @@ index 9f95091..6885108 100644
  	return prev_p;
  }
 diff --git a/arch/x86/kernel/process_64.c b/arch/x86/kernel/process_64.c
-index 6e789ca..7c4bae4 100644
+index 5dc86d2..3099034 100644
 --- a/arch/x86/kernel/process_64.c
 +++ b/arch/x86/kernel/process_64.c
-@@ -143,9 +143,10 @@ int copy_thread_tls(unsigned long clone_flags, unsigned long sp,
+@@ -144,9 +144,10 @@ int copy_thread_tls(unsigned long clone_flags, unsigned long sp,
  	struct pt_regs *childregs;
  	struct task_struct *me = current;
  
@@ -30171,7 +30195,7 @@ index 6e789ca..7c4bae4 100644
  	set_tsk_thread_flag(p, TIF_FORK);
  	p->thread.io_bitmap_ptr = NULL;
  
-@@ -155,6 +156,8 @@ int copy_thread_tls(unsigned long clone_flags, unsigned long sp,
+@@ -156,6 +157,8 @@ int copy_thread_tls(unsigned long clone_flags, unsigned long sp,
  	p->thread.fsbase = p->thread.fsindex ? 0 : me->thread.fsbase;
  	savesegment(es, p->thread.es);
  	savesegment(ds, p->thread.ds);
@@ -30180,7 +30204,7 @@ index 6e789ca..7c4bae4 100644
  	memset(p->thread.ptrace_bps, 0, sizeof(p->thread.ptrace_bps));
  
  	if (unlikely(p->flags & PF_KTHREAD)) {
-@@ -262,7 +265,7 @@ __switch_to(struct task_struct *prev_p, struct task_struct *next_p)
+@@ -263,7 +266,7 @@ __switch_to(struct task_struct *prev_p, struct task_struct *next_p)
  	struct fpu *prev_fpu = &prev->fpu;
  	struct fpu *next_fpu = &next->fpu;
  	int cpu = smp_processor_id();
@@ -30189,7 +30213,7 @@ index 6e789ca..7c4bae4 100644
  	unsigned prev_fsindex, prev_gsindex;
  	fpu_switch_t fpu_switch;
  
-@@ -313,6 +316,10 @@ __switch_to(struct task_struct *prev_p, struct task_struct *next_p)
+@@ -314,6 +317,10 @@ __switch_to(struct task_struct *prev_p, struct task_struct *next_p)
  	if (unlikely(next->ds | prev->ds))
  		loadsegment(ds, next->ds);
  
@@ -30200,7 +30224,7 @@ index 6e789ca..7c4bae4 100644
  	/*
  	 * Switch FS and GS.
  	 *
-@@ -422,10 +429,13 @@ __switch_to(struct task_struct *prev_p, struct task_struct *next_p)
+@@ -423,10 +430,13 @@ __switch_to(struct task_struct *prev_p, struct task_struct *next_p)
  	 * Switch the PDA and FPU contexts.
  	 */
  	this_cpu_write(current_task, next_p);
@@ -30215,10 +30239,10 @@ index 6e789ca..7c4bae4 100644
  	 * Now maybe reload the debug registers and handle I/O bitmaps
  	 */
 diff --git a/arch/x86/kernel/ptrace.c b/arch/x86/kernel/ptrace.c
-index 600edd2..d514c66 100644
+index 67ed18e..748ef59 100644
 --- a/arch/x86/kernel/ptrace.c
 +++ b/arch/x86/kernel/ptrace.c
-@@ -169,10 +169,10 @@ unsigned long kernel_stack_pointer(struct pt_regs *regs)
+@@ -169,7 +169,7 @@ unsigned long kernel_stack_pointer(struct pt_regs *regs)
  	unsigned long sp = (unsigned long)&regs->sp;
  	u32 *prev_esp;
  
@@ -30226,11 +30250,7 @@ index 600edd2..d514c66 100644
 +	if (context == ((sp + 8) & ~(THREAD_SIZE - 1)))
  		return sp;
  
--	prev_esp = (u32 *)(context);
-+	prev_esp = *(u32 **)(context);
- 	if (prev_esp)
- 		return (unsigned long)prev_esp;
- 
+ 	prev_esp = (u32 *)(context);
 @@ -411,6 +411,20 @@ static int putreg(struct task_struct *child,
  		if (child->thread.gsbase != value)
  			return do_arch_prctl(child, ARCH_SET_GS, value);
@@ -30743,7 +30763,7 @@ index 658777c..6285f88 100644
  	.smp_prepare_cpus	= native_smp_prepare_cpus,
  	.smp_cpus_done		= native_smp_cpus_done,
 diff --git a/arch/x86/kernel/smpboot.c b/arch/x86/kernel/smpboot.c
-index fafe8b9..d6ee9af 100644
+index 694c529..70796b5 100644
 --- a/arch/x86/kernel/smpboot.c
 +++ b/arch/x86/kernel/smpboot.c
 @@ -221,14 +221,17 @@ static void notrace start_secondary(void *unused)
@@ -39644,10 +39664,10 @@ index 9466354..b33bb13 100644
  }
  
 diff --git a/arch/x86/xen/smp.c b/arch/x86/xen/smp.c
-index 719cf29..8a13fd8 100644
+index 40c3aab9..8d796b1 100644
 --- a/arch/x86/xen/smp.c
 +++ b/arch/x86/xen/smp.c
-@@ -306,17 +306,13 @@ static void __init xen_smp_prepare_boot_cpu(void)
+@@ -312,17 +312,13 @@ static void __init xen_smp_prepare_boot_cpu(void)
  
  	if (xen_pv_domain()) {
  		if (!xen_feature(XENFEAT_writable_page_tables))
@@ -39667,7 +39687,7 @@ index 719cf29..8a13fd8 100644
  #endif
  
  		xen_filter_cpu_maps();
-@@ -399,7 +395,7 @@ cpu_initialize_context(unsigned int cpu, struct task_struct *idle)
+@@ -405,7 +401,7 @@ cpu_initialize_context(unsigned int cpu, struct task_struct *idle)
  #ifdef CONFIG_X86_32
  	/* Note: PVH is not yet supported on x86_32. */
  	ctxt->user_regs.fs = __KERNEL_PERCPU;
@@ -39676,7 +39696,7 @@ index 719cf29..8a13fd8 100644
  #endif
  	memset(&ctxt->fpu_ctxt, 0, sizeof(ctxt->fpu_ctxt));
  
-@@ -407,8 +403,8 @@ cpu_initialize_context(unsigned int cpu, struct task_struct *idle)
+@@ -413,8 +409,8 @@ cpu_initialize_context(unsigned int cpu, struct task_struct *idle)
  		ctxt->user_regs.eip = (unsigned long)cpu_bringup_and_idle;
  		ctxt->flags = VGCF_IN_KERNEL;
  		ctxt->user_regs.eflags = 0x1000; /* IOPL_RING1 */
@@ -39687,7 +39707,7 @@ index 719cf29..8a13fd8 100644
  		ctxt->user_regs.ss = __KERNEL_DS;
  
  		xen_copy_trap_info(ctxt->trap_ctxt);
-@@ -749,7 +745,7 @@ static const struct smp_ops xen_smp_ops __initconst = {
+@@ -755,7 +751,7 @@ static const struct smp_ops xen_smp_ops __initconst = {
  
  void __init xen_smp_init(void)
  {
@@ -39784,7 +39804,7 @@ index 2f33760..835e50a 100644
  #define XCHAL_ICACHE_SIZE		8192	/* I-cache size in bytes or 0 */
  #define XCHAL_DCACHE_SIZE		8192	/* D-cache size in bytes or 0 */
 diff --git a/block/bio.c b/block/bio.c
-index 4623869..7acfd5c 100644
+index 4623869..74c7286 100644
 --- a/block/bio.c
 +++ b/block/bio.c
 @@ -1142,7 +1142,7 @@ struct bio *bio_copy_user_iov(struct request_queue *q,
@@ -39805,6 +39825,15 @@ index 4623869..7acfd5c 100644
  			return ERR_PTR(-EINVAL);
  
  		nr_pages += end - start;
+@@ -1777,7 +1777,7 @@ EXPORT_SYMBOL(bio_endio);
+  * to @bio's bi_io_vec; it is the caller's responsibility to ensure that
+  * @bio is not freed before the split.
+  */
+-struct bio *bio_split(struct bio *bio, int sectors,
++struct bio *bio_split(struct bio *bio, unsigned int sectors,
+ 		      gfp_t gfp, struct bio_set *bs)
+ {
+ 	struct bio *split = NULL;
 diff --git a/block/blk-cgroup.c b/block/blk-cgroup.c
 index 66e6f1a..8fb30f4 100644
 --- a/block/blk-cgroup.c
@@ -42323,7 +42352,7 @@ index a7b4679..d302490 100644
  
  static DEVICE_ATTR(runtime_status, 0444, rtpm_status_show, NULL);
 diff --git a/drivers/base/power/wakeup.c b/drivers/base/power/wakeup.c
-index 5fb7718..b4b79fb 100644
+index 5fb7718..b4b79fb1 100644
 --- a/drivers/base/power/wakeup.c
 +++ b/drivers/base/power/wakeup.c
 @@ -36,14 +36,14 @@ static bool pm_abort_suspend __read_mostly;
@@ -56688,7 +56717,7 @@ index c7c8cde..913b672 100644
  					       "md/raid1:%s: read error corrected "
  					       "(%d sectors at %llu on %s)\n",
 diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
-index c7de2a5..b476a79 100644
+index c7de2a5..3a2fe4b 100644
 --- a/drivers/md/raid10.c
 +++ b/drivers/md/raid10.c
 @@ -1068,7 +1068,7 @@ static void __make_request(struct mddev *mddev, struct bio *bio)
@@ -56700,6 +56729,15 @@ index c7de2a5..b476a79 100644
  	int max_sectors;
  	int sectors;
  
+@@ -1446,7 +1446,7 @@ static void raid10_make_request(struct mddev *mddev, struct bio *bio)
+ {
+ 	struct r10conf *conf = mddev->private;
+ 	sector_t chunk_mask = (conf->geo.chunk_mask & conf->prev.chunk_mask);
+-	int chunk_sects = chunk_mask + 1;
++	sector_t chunk_sects = chunk_mask + 1;
+ 
+ 	struct bio *split;
+ 
 @@ -1829,7 +1829,7 @@ static void end_sync_read(struct bio *bio)
  		/* The write handler will notice the lack of
  		 * R10BIO_Uptodate and record any errors etc
@@ -56768,6 +56806,24 @@ index c7de2a5..b476a79 100644
  			}
  
  			rdev_dec_pending(rdev, mddev);
+@@ -3153,6 +3153,7 @@ static sector_t raid10_sync_request(struct mddev *mddev, sector_t sector_nr,
+ 	} else {
+ 		/* resync. Schedule a read for every block at this virt offset */
+ 		int count = 0;
++		sector_t sectors;
+ 
+ 		bitmap_cond_end_sync(mddev->bitmap, sector_nr, 0);
+ 
+@@ -3178,7 +3179,8 @@ static sector_t raid10_sync_request(struct mddev *mddev, sector_t sector_nr,
+ 		r10_bio->sector = sector_nr;
+ 		set_bit(R10BIO_IsSync, &r10_bio->state);
+ 		raid10_find_phys(conf, r10_bio);
+-		r10_bio->sectors = (sector_nr | chunk_mask) - sector_nr + 1;
++		sectors = (sector_nr | chunk_mask) - sector_nr + 1;
++		r10_bio->sectors = sectors;
+ 
+ 		for (i = 0; i < conf->copies; i++) {
+ 			int d = r10_bio->devs[i].devnum;
 diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
 index 8959e6d..b90f4e1 100644
 --- a/drivers/md/raid5.c
@@ -80032,6 +80088,19 @@ index 5b5462e..fac23a0 100644
  			out += sprintf(out, "%s", dev_name(&vdev->udev->dev));
  
  		} else {
+diff --git a/drivers/usb/usbip/vudc_rx.c b/drivers/usb/usbip/vudc_rx.c
+index e429b59..e0840c6 100644
+--- a/drivers/usb/usbip/vudc_rx.c
++++ b/drivers/usb/usbip/vudc_rx.c
+@@ -142,7 +142,7 @@ static int v_recv_cmd_submit(struct vudc *udc,
+ 	urb_p->urb->status = -EINPROGRESS;
+ 
+ 	/* FIXME: more pipe setup to please usbip_common */
+-	urb_p->urb->pipe &= ~(3 << 30);
++	urb_p->urb->pipe &= ~(3U << 30);
+ 	switch (urb_p->ep->type) {
+ 	case USB_ENDPOINT_XFER_BULK:
+ 		urb_p->urb->pipe |= (PIPE_BULK << 30);
 diff --git a/drivers/usb/wusbcore/wa-hc.h b/drivers/usb/wusbcore/wa-hc.h
 index edc7267..9f65ce2 100644
 --- a/drivers/usb/wusbcore/wa-hc.h
@@ -99743,7 +99812,7 @@ index e4141f2..d8263e8 100644
  		i += packet_length_size;
  		if (copy_to_user(&buf[i], msg_ctx->msg, msg_ctx->msg_size))
 diff --git a/fs/exec.c b/fs/exec.c
-index 887c1c9..ee86e3c 100644
+index 887c1c9..c633c80 100644
 --- a/fs/exec.c
 +++ b/fs/exec.c
 @@ -57,8 +57,20 @@
@@ -100261,7 +100330,7 @@ index 887c1c9..ee86e3c 100644
  out:
  	if (bprm->mm) {
  		acct_arg_size(bprm, 0);
-@@ -1862,3 +2043,315 @@ COMPAT_SYSCALL_DEFINE5(execveat, int, fd,
+@@ -1862,3 +2043,322 @@ COMPAT_SYSCALL_DEFINE5(execveat, int, fd,
  				  argv, envp, flags);
  }
  #endif
@@ -100460,8 +100529,13 @@ index 887c1c9..ee86e3c 100644
 +#endif
 +}
 +
++static DEFINE_RATELIMIT_STATE(usercopy_ratelimit, 15 * HZ, 3);
++
 +static __noreturn void pax_report_usercopy(const void *ptr, unsigned long len, bool to_user, const char *type)
 +{
++	if (!__ratelimit(&usercopy_ratelimit))
++		goto kill;
++
 +	if (current->signal->curr_ip)
 +		printk(KERN_EMERG "PAX: From %pI4: kernel memory %s attempt detected %s %p (%s) (%lu bytes)\n",
 +			&current->signal->curr_ip, to_user ? "leak" : "overwrite", to_user ? "from" : "to", ptr, type ? : "unknown", len);
@@ -100469,6 +100543,8 @@ index 887c1c9..ee86e3c 100644
 +		printk(KERN_EMERG "PAX: kernel memory %s attempt detected %s %p (%s) (%lu bytes)\n",
 +			to_user ? "leak" : "overwrite", to_user ? "from" : "to", ptr, type ? : "unknown", len);
 +	dump_stack();
++
++kill:
 +	gr_handle_kernel_exploit();
 +	do_group_exit(SIGKILL);
 +}
@@ -115377,7 +115453,7 @@ index a352d57..cb94a5c 100644
  }
  fs_initcall(proc_interrupts_init);
 diff --git a/fs/proc/kcore.c b/fs/proc/kcore.c
-index a939f5e..0de6e70 100644
+index a939f5e..1749d06 100644
 --- a/fs/proc/kcore.c
 +++ b/fs/proc/kcore.c
 @@ -316,7 +316,7 @@ static char *storenote(struct memelfnote *men, char *bufp)
@@ -115389,7 +115465,15 @@ index a939f5e..0de6e70 100644
  {
  	struct elf_prstatus prstatus;	/* NT_PRSTATUS */
  	struct elf_prpsinfo prpsinfo;	/* NT_PRPSINFO */
-@@ -483,9 +483,10 @@ read_kcore(struct file *file, char __user *buffer, size_t buflen, loff_t *fpos)
+@@ -430,6 +430,7 @@ static void elf_kcore_store_hdr(char *bufp, int nphdr, int dataoff)
+ static ssize_t
+ read_kcore(struct file *file, char __user *buffer, size_t buflen, loff_t *fpos)
+ {
++	char *buf = file->private_data;
+ 	ssize_t acc = 0;
+ 	size_t size, tsz;
+ 	size_t elf_buflen;
+@@ -483,9 +484,10 @@ read_kcore(struct file *file, char __user *buffer, size_t buflen, loff_t *fpos)
  	 * the addresses in the elf_phdr on our list.
  	 */
  	start = kc_offset_to_vaddr(*fpos - elf_buflen);
@@ -115402,40 +115486,57 @@ index a939f5e..0de6e70 100644
  	while (buflen) {
  		struct kcore_list *m;
  
-@@ -515,19 +516,20 @@ read_kcore(struct file *file, char __user *buffer, size_t buflen, loff_t *fpos)
+@@ -500,34 +502,29 @@ read_kcore(struct file *file, char __user *buffer, size_t buflen, loff_t *fpos)
+ 			if (clear_user(buffer, tsz))
+ 				return -EFAULT;
+ 		} else if (is_vmalloc_or_module_addr((void *)start)) {
+-			char * elf_buf;
+-
+-			elf_buf = kzalloc(tsz, GFP_KERNEL);
+-			if (!elf_buf)
+-				return -ENOMEM;
+-			vread(elf_buf, (char *)start, tsz);
++			vread(buf, (char *)start, tsz);
+ 			/* we have to zero-fill user buffer even if no read */
+-			if (copy_to_user(buffer, elf_buf, tsz)) {
+-				kfree(elf_buf);
++			if (copy_to_user(buffer, buf, tsz))
+ 				return -EFAULT;
+-			}
+-			kfree(elf_buf);
  		} else {
  			if (kern_addr_valid(start)) {
  				unsigned long n;
-+				char *elf_buf;
 +				mm_segment_t oldfs;
  
 -				n = copy_to_user(buffer, (char *)start, tsz);
--				/*
+ 				/*
 -				 * We cannot distinguish between fault on source
 -				 * and fault on destination. When this happens
 -				 * we clear too and hope it will trigger the
 -				 * EFAULT again.
--				 */
++				 * Using bounce buffer to bypass the
++				 * hardened user copy kernel text checks.
+ 				 */
 -				if (n) { 
 -					if (clear_user(buffer + tsz - n,
 -								n))
 -						return -EFAULT;
 -				}
-+				elf_buf = kzalloc(tsz, GFP_KERNEL);
-+				if (!elf_buf)
-+					return -ENOMEM;
 +				oldfs = get_fs();
 +				set_fs(KERNEL_DS);
-+				n = __copy_from_user(elf_buf, (const void __user *)start, tsz);
++				n = __copy_from_user(buf, (const void __user *)start, tsz);
 +				set_fs(oldfs);
-+				n = copy_to_user(buffer, elf_buf, tsz);
-+				kfree(elf_buf);
++				if (n)
++					n = clear_user(buffer, tsz);
++				else
++					n = copy_to_user(buffer, buf, tsz);
 +				if (n)
 +					return -EFAULT;
  			} else {
  				if (clear_user(buffer, tsz))
  					return -EFAULT;
-@@ -547,6 +549,9 @@ read_kcore(struct file *file, char __user *buffer, size_t buflen, loff_t *fpos)
+@@ -547,8 +544,16 @@ read_kcore(struct file *file, char __user *buffer, size_t buflen, loff_t *fpos)
  
  static int open_kcore(struct inode *inode, struct file *filp)
  {
@@ -115444,8 +115545,32 @@ index a939f5e..0de6e70 100644
 +#endif
  	if (!capable(CAP_SYS_RAWIO))
  		return -EPERM;
++
++	filp->private_data = kmalloc(PAGE_SIZE, GFP_KERNEL|GFP_USERCOPY);
++	if (!filp->private_data)
++		return -ENOMEM;
++
  	if (kcore_need_update)
-@@ -580,7 +585,7 @@ static int __meminit kcore_callback(struct notifier_block *self,
+ 		kcore_update_ram();
+ 	if (i_size_read(inode) != proc_root_kcore->size) {
+@@ -559,10 +564,16 @@ static int open_kcore(struct inode *inode, struct file *filp)
+ 	return 0;
+ }
+ 
++static int release_kcore(struct inode *inode, struct file *file)
++{
++	kfree(file->private_data);
++	return 0;
++}
+ 
+ static const struct file_operations proc_kcore_operations = {
+ 	.read		= read_kcore,
+ 	.open		= open_kcore,
++	.release	= release_kcore,
+ 	.llseek		= default_llseek,
+ };
+ 
+@@ -580,7 +591,7 @@ static int __meminit kcore_callback(struct notifier_block *self,
  	return NOTIFY_OK;
  }
  
@@ -117052,7 +117177,7 @@ index 6c21228..9afd5fe 100644
  	if (sbi->s_bytesex == BYTESEX_PDP)
  		return PDP_swab((__force __u32)n);
 diff --git a/fs/tracefs/inode.c b/fs/tracefs/inode.c
-index 4a0e48f..d3e1fbf 100644
+index 4a0e48f92..d3e1fbf 100644
 --- a/fs/tracefs/inode.c
 +++ b/fs/tracefs/inode.c
 @@ -53,7 +53,7 @@ static const struct file_operations tracefs_file_operations = {
@@ -130054,6 +130179,28 @@ index 314b3ca..81ca9c4 100644
  
  extern void __register_binfmt(struct linux_binfmt *fmt, int insert);
  
+diff --git a/include/linux/bio.h b/include/linux/bio.h
+index 75fadd2..28398b2 100644
+--- a/include/linux/bio.h
++++ b/include/linux/bio.h
+@@ -405,7 +405,7 @@ static inline void bip_set_seed(struct bio_integrity_payload *bip,
+ #endif /* CONFIG_BLK_DEV_INTEGRITY */
+ 
+ extern void bio_trim(struct bio *bio, int offset, int size);
+-extern struct bio *bio_split(struct bio *bio, int sectors,
++extern struct bio *bio_split(struct bio *bio, unsigned int sectors,
+ 			     gfp_t gfp, struct bio_set *bs);
+ 
+ /**
+@@ -418,7 +418,7 @@ extern struct bio *bio_split(struct bio *bio, int sectors,
+  * Returns a bio representing the next @sectors of @bio - if the bio is smaller
+  * than @sectors, returns the original bio unchanged.
+  */
+-static inline struct bio *bio_next_split(struct bio *bio, int sectors,
++static inline struct bio *bio_next_split(struct bio *bio, unsigned int sectors,
+ 					 gfp_t gfp, struct bio_set *bs)
+ {
+ 	if (sectors >= bio_sectors(bio))
 diff --git a/include/linux/bitmap.h b/include/linux/bitmap.h
 index e9b0b9a..4fc3241 100644
 --- a/include/linux/bitmap.h
@@ -146232,7 +146379,7 @@ index 667b933..1668952 100644
  		update_vsyscall_tz();
  		if (firsttime) {
 diff --git a/kernel/time/timekeeping.c b/kernel/time/timekeeping.c
-index b6c3945..373f21e 100644
+index 1b72b17..5083d44 100644
 --- a/kernel/time/timekeeping.c
 +++ b/kernel/time/timekeeping.c
 @@ -15,6 +15,7 @@
@@ -146243,7 +146390,7 @@ index b6c3945..373f21e 100644
  #include <linux/syscore_ops.h>
  #include <linux/clocksource.h>
  #include <linux/jiffies.h>
-@@ -1167,6 +1168,8 @@ int do_settimeofday64(const struct timespec64 *ts)
+@@ -1170,6 +1171,8 @@ int do_settimeofday64(const struct timespec64 *ts)
  	if (!timespec64_valid_strict(ts))
  		return -EINVAL;
  
@@ -172991,10 +173138,10 @@ index 0000000..4363d14
 +clean-files += *.so
 diff --git a/scripts/gcc-plugins/size_overflow_plugin/disable.data b/scripts/gcc-plugins/size_overflow_plugin/disable.data
 new file mode 100644
-index 0000000..88f524c
+index 0000000..2554418
 --- /dev/null
 +++ b/scripts/gcc-plugins/size_overflow_plugin/disable.data
-@@ -0,0 +1,12453 @@
+@@ -0,0 +1,12463 @@
 +disable_so_interrupt_pnode_gru_message_queue_desc_4 interrupt_pnode gru_message_queue_desc 0 4 NULL
 +disable_so_bch_btree_insert_fndecl_12 bch_btree_insert fndecl 0 12 NULL
 +disable_so_macvlan_sync_address_fndecl_22 macvlan_sync_address fndecl 0 22 NULL nohasharray
@@ -184820,7 +184967,8 @@ index 0000000..88f524c
 +disable_so_decrypt_crypto_aead_62305 decrypt crypto_aead 0 62305 NULL
 +disable_so_paddr_mmd_fw_ldst_mdio_62306 paddr_mmd fw_ldst_mdio 0 62306 NULL
 +disable_so_start_address___osdv1_cdb_addr_len_62309 start_address __osdv1_cdb_addr_len 0 62309 NULL
-+disable_so_freq_as10x_tune_args_62312 freq as10x_tune_args 0 62312 NULL
++disable_so_freq_as10x_tune_args_62312 freq as10x_tune_args 0 62312 NULL nohasharray
++e_rtt_min_westwood_62312 rtt_min westwood 0 62312 &disable_so_freq_as10x_tune_args_62312
 +disable_so_timestamp_low_rtl_stats_62314 timestamp_low rtl_stats 0 62314 NULL
 +disable_so_uid_fuse_in_header_62319 uid fuse_in_header 0 62319 NULL
 +disable_so_bfa_fcs_rport_del_timeout_vardecl_bfa_fcs_rport_c_62320 bfa_fcs_rport_del_timeout vardecl_bfa_fcs_rport.c 0 62320 NULL nohasharray
@@ -185448,6 +185596,15 @@ index 0000000..88f524c
 +e_tcp_cwnd_bictcp_64346 tcp_cwnd bictcp 0 64346 NULL
 +e_bic_origin_point_bictcp_64414 bic_origin_point bictcp 0 64414 NULL
 +e_srtt_us_tcp_sock_62907 srtt_us tcp_sock 0 62907 NULL
++e_tcp_rtt_estimator_fndecl_7853 tcp_rtt_estimator fndecl 2 7853 NULL
++e_tcp_ack_update_rtt_fndecl_26581 tcp_ack_update_rtt fndecl 4-3 26581 NULL
++e_rtt_westwood_52592 rtt westwood 0 52592 NULL
++e_minRTT_vegas_62707 minRTT vegas 0 62707 NULL
++e_tcp_westwood_bw_rttmin_fndecl_63713 tcp_westwood_bw_rttmin fndecl 0 63713 NULL
++e_cube_rtt_scale_vardecl_tcp_cubic_c_2638 cube_rtt_scale vardecl_tcp_cubic.c 0 2638 NULL
++e_rtt0_vardecl_tcp_hybla_c_51134 rtt0 vardecl_tcp_hybla.c 0 51134 NULL
++e_rtt_win_sx_westwood_41723 rtt_win_sx westwood 0 41723 NULL
++e_baseRTT_vegas_18174 baseRTT vegas 0 18174 NULL
 diff --git a/scripts/gcc-plugins/size_overflow_plugin/e_aux.data b/scripts/gcc-plugins/size_overflow_plugin/e_aux.data
 new file mode 100644
 index 0000000..74e91b2
@@ -185553,10 +185710,10 @@ index 0000000..74e91b2
 +enable_so_zpios_read_fndecl_64734 zpios_read fndecl 3 64734 NULL
 diff --git a/scripts/gcc-plugins/size_overflow_plugin/e_fields.data b/scripts/gcc-plugins/size_overflow_plugin/e_fields.data
 new file mode 100644
-index 0000000..2813470
+index 0000000..6006250
 --- /dev/null
 +++ b/scripts/gcc-plugins/size_overflow_plugin/e_fields.data
-@@ -0,0 +1,18898 @@
+@@ -0,0 +1,18888 @@
 +e_recv_ctrl_pipe_us_data_0 recv_ctrl_pipe us_data 0 0 NULL
 +e_size_ttm_mem_reg_8 size ttm_mem_reg 0 8 NULL
 +e_char2uni_nls_table_12 char2uni nls_table 0 12 NULL
@@ -186302,7 +186459,6 @@ index 0000000..2813470
 +e_total_vm_mm_struct_2630 total_vm mm_struct 0 2630 &e_snd_soc_params_to_frame_size_fndecl_2630
 +e_radeon_vram_location_fndecl_2634 radeon_vram_location fndecl 3 2634 NULL
 +e_bop_lookup_contig_nilfs_bmap_operations_2637 bop_lookup_contig nilfs_bmap_operations 0 2637 NULL
-+e_cube_rtt_scale_vardecl_tcp_cubic_c_2638 cube_rtt_scale vardecl_tcp_cubic.c 0 2638 NULL
 +e_regmap_spi_gather_write_fndecl_2639 regmap_spi_gather_write fndecl 3-5 2639 NULL
 +e_rx_bufshift_rtl_stats_2641 rx_bufshift rtl_stats 0 2641 NULL
 +e_sys_read_fndecl_2644 sys_read fndecl 3 2644 NULL
@@ -187807,7 +187963,6 @@ index 0000000..2813470
 +e_nonstatic_find_mem_region_fndecl_7838 nonstatic_find_mem_region fndecl 1-2 7838 NULL
 +e_sys_truncate_fndecl_7846 sys_truncate fndecl 2 7846 NULL
 +e_SYSC_pread64_fndecl_7850 SYSC_pread64 fndecl 3 7850 NULL
-+e_tcp_rtt_estimator_fndecl_7853 tcp_rtt_estimator fndecl 2 7853 NULL
 +e_pcf2123_write_fndecl_7856 pcf2123_write fndecl 3 7856 NULL
 +e_sl_datalen_nfsd4_slot_7859 sl_datalen nfsd4_slot 0 7859 NULL
 +e_wqe_shift_mlx4_ib_wq_7860 wqe_shift mlx4_ib_wq 0 7860 NULL
@@ -190803,7 +190958,6 @@ index 0000000..2813470
 +e_cxgbi_ppm_ppods_reserve_fndecl_18157 cxgbi_ppm_ppods_reserve fndecl 0-2 18157 NULL
 +e_qlcnic_enable_msix_fndecl_18171 qlcnic_enable_msix fndecl 2 18171 NULL
 +e_iscsi_sw_tcp_pdu_init_fndecl_18173 iscsi_sw_tcp_pdu_init fndecl 3-2 18173 NULL
-+e_baseRTT_vegas_18174 baseRTT vegas 0 18174 NULL
 +e_num_gpu_pages_radeon_gart_18177 num_gpu_pages radeon_gart 0 18177 NULL
 +e_ide_read_error_fndecl_18180 ide_read_error fndecl 0 18180 NULL nohasharray
 +e_ocfs2_test_suballoc_bit_fndecl_18180 ocfs2_test_suballoc_bit fndecl 6-5-4 18180 &e_ide_read_error_fndecl_18180 nohasharray
@@ -193268,7 +193422,6 @@ index 0000000..2813470
 +e_ra_tid_iwl_mvm_tx_resp_26576 ra_tid iwl_mvm_tx_resp 0 26576 NULL
 +e_sd_log_flush_head_gfs2_sbd_26577 sd_log_flush_head gfs2_sbd 0 26577 NULL
 +e_smbios_entry_point_size_vardecl_dmi_scan_c_26579 smbios_entry_point_size vardecl_dmi_scan.c 0 26579 NULL
-+e_tcp_ack_update_rtt_fndecl_26581 tcp_ack_update_rtt fndecl 4-3 26581 NULL
 +e_layout_mdp_superblock_1_26582 layout mdp_superblock_1 0 26582 NULL
 +e_read_tree_block_fndecl_26587 read_tree_block fndecl 2 26587 NULL nohasharray
 +e_initial_ssthresh_vardecl_tcp_cubic_c_26587 initial_ssthresh vardecl_tcp_cubic.c 0 26587 &e_read_tree_block_fndecl_26587
@@ -197622,7 +197775,6 @@ index 0000000..2813470
 +e_l_curr_block_xlog_41718 l_curr_block xlog 0 41718 NULL
 +e_strstart_deflate_state_41719 strstart deflate_state 0 41719 NULL
 +e_hlen_ip_tunnel_41720 hlen ip_tunnel 0 41720 NULL
-+e_rtt_win_sx_westwood_41723 rtt_win_sx westwood 0 41723 NULL
 +e_dax_zero_page_range_fndecl_41725 dax_zero_page_range fndecl 0-2-3 41725 NULL
 +e_width_tw68_dev_41726 width tw68_dev 0 41726 NULL
 +e_pci_enable_msi_range_fndecl_41728 pci_enable_msi_range fndecl 3 41728 NULL
@@ -200351,7 +200503,6 @@ index 0000000..2813470
 +e_new_read_fndecl_51123 new_read fndecl 2 51123 NULL
 +e_igb_pci_enable_sriov_fndecl_51131 igb_pci_enable_sriov fndecl 2 51131 NULL
 +e_max_write_sge_ib_qp_51132 max_write_sge ib_qp 0 51132 NULL
-+e_rtt0_vardecl_tcp_hybla_c_51134 rtt0 vardecl_tcp_hybla.c 0 51134 NULL
 +e_wqe_cnt_mlx4_ib_wq_51135 wqe_cnt mlx4_ib_wq 0 51135 NULL
 +e_cachelsz_ath_common_51138 cachelsz ath_common 0 51138 NULL
 +e_length_sky2_status_le_51139 length sky2_status_le 0 51139 NULL
@@ -200768,7 +200919,6 @@ index 0000000..2813470
 +e_end_logsuper_52574 end logsuper 0 52574 NULL
 +e_amdgpu_ttm_tt_set_userptr_fndecl_52575 amdgpu_ttm_tt_set_userptr fndecl 2 52575 NULL
 +e_btrfs_extent_data_ref_root_fndecl_52585 btrfs_extent_data_ref_root fndecl 0 52585 NULL
-+e_rtt_westwood_52592 rtt westwood 0 52592 NULL
 +e___mincore_unmapped_range_fndecl_52595 __mincore_unmapped_range fndecl 1 52595 NULL
 +e_xfs_shift_file_space_fndecl_52596 xfs_shift_file_space fndecl 2-3 52596 NULL
 +e___allocate_data_block_fndecl_52597 __allocate_data_block fndecl 0 52597 NULL
@@ -203522,8 +203672,7 @@ index 0000000..2813470
 +e_rtl2832_sdr_convert_stream_fndecl_62308 rtl2832_sdr_convert_stream fndecl 0-4 62308 NULL
 +e_ircomm_tty_connect_confirm_fndecl_62310 ircomm_tty_connect_confirm fndecl 4 62310 NULL nohasharray
 +e_iov_data_count_iscsi_cmd_62310 iov_data_count iscsi_cmd 0 62310 &e_ircomm_tty_connect_confirm_fndecl_62310
-+e_map_extent_mft_record_fndecl_62312 map_extent_mft_record fndecl 2 62312 NULL nohasharray
-+e_rtt_min_westwood_62312 rtt_min westwood 0 62312 &e_map_extent_mft_record_fndecl_62312
++e_map_extent_mft_record_fndecl_62312 map_extent_mft_record fndecl 2 62312 NULL
 +e_ss_channels_snd_rme9652_62315 ss_channels snd_rme9652 0 62315 NULL
 +e_ext2_new_block_fndecl_62326 ext2_new_block fndecl 2-0 62326 NULL
 +e_tcp_vegas_cong_avoid_fndecl_62332 tcp_vegas_cong_avoid fndecl 3 62332 NULL
@@ -203630,7 +203779,6 @@ index 0000000..2813470
 +e_num_vsis_i40e_hw_capabilities_62685 num_vsis i40e_hw_capabilities 0 62685 NULL
 +e_start_ttm_mem_reg_62688 start ttm_mem_reg 0 62688 NULL
 +e_vmemdup_fndecl_62706 vmemdup fndecl 2 62706 NULL
-+e_minRTT_vegas_62707 minRTT vegas 0 62707 NULL
 +e_line6_midibuf_bytes_free_fndecl_62709 line6_midibuf_bytes_free fndecl 0 62709 NULL
 +e_curwidth_usb_usbvision_62710 curwidth usb_usbvision 0 62710 NULL
 +e_mtu_ring_info_62721 mtu ring_info 0 62721 NULL
@@ -203938,8 +204086,7 @@ index 0000000..2813470
 +e_owner_snd_ctl_elem_info_63711 owner snd_ctl_elem_info 0 63711 NULL
 +e_index_dtsplit_63712 index dtsplit 0 63712 NULL nohasharray
 +e_xfs_alloc_compute_aligned_fndecl_63712 xfs_alloc_compute_aligned fndecl 3-2 63712 &e_index_dtsplit_63712
-+e_kernel_recvmsg_fndecl_63713 kernel_recvmsg fndecl 0-5-4 63713 NULL nohasharray
-+e_tcp_westwood_bw_rttmin_fndecl_63713 tcp_westwood_bw_rttmin fndecl 0 63713 &e_kernel_recvmsg_fndecl_63713
++e_kernel_recvmsg_fndecl_63713 kernel_recvmsg fndecl 0-5-4 63713 NULL
 +e_omfs_readpages_fndecl_63721 omfs_readpages fndecl 4 63721 NULL
 +e_dccp_v6_init_sequence_fndecl_63732 dccp_v6_init_sequence fndecl 0 63732 NULL
 +e_osd_vis_h_yuv_playback_info_63734 osd_vis_h yuv_playback_info 0 63734 NULL
@@ -220110,7 +220257,7 @@ index a020920..55579f6 100644
  
  
 diff --git a/sound/usb/line6/driver.c b/sound/usb/line6/driver.c
-index 81b7da8..bb2676f 100644
+index 183311c..760f13f 100644
 --- a/sound/usb/line6/driver.c
 +++ b/sound/usb/line6/driver.c
 @@ -307,7 +307,7 @@ int line6_read_data(struct usb_line6 *line6, unsigned address, void *data,
diff --git a/4.7.7/4425_grsec_remove_EI_PAX.patch b/4.7.8/4425_grsec_remove_EI_PAX.patch
index ba92792..ba92792 100644
--- a/4.7.7/4425_grsec_remove_EI_PAX.patch
+++ b/4.7.8/4425_grsec_remove_EI_PAX.patch
diff --git a/4.7.7/4427_force_XATTR_PAX_tmpfs.patch b/4.7.8/4427_force_XATTR_PAX_tmpfs.patch
index b4714fc..b4714fc 100644
--- a/4.7.7/4427_force_XATTR_PAX_tmpfs.patch
+++ b/4.7.8/4427_force_XATTR_PAX_tmpfs.patch
diff --git a/4.7.7/4430_grsec-remove-localversion-grsec.patch b/4.7.8/4430_grsec-remove-localversion-grsec.patch
index 31cf878..31cf878 100644
--- a/4.7.7/4430_grsec-remove-localversion-grsec.patch
+++ b/4.7.8/4430_grsec-remove-localversion-grsec.patch
diff --git a/4.7.7/4435_grsec-mute-warnings.patch b/4.7.8/4435_grsec-mute-warnings.patch
index 8929222..8929222 100644
--- a/4.7.7/4435_grsec-mute-warnings.patch
+++ b/4.7.8/4435_grsec-mute-warnings.patch
diff --git a/4.7.7/4440_grsec-remove-protected-paths.patch b/4.7.8/4440_grsec-remove-protected-paths.patch
index 741546d..741546d 100644
--- a/4.7.7/4440_grsec-remove-protected-paths.patch
+++ b/4.7.8/4440_grsec-remove-protected-paths.patch
diff --git a/4.7.7/4450_grsec-kconfig-default-gids.patch b/4.7.8/4450_grsec-kconfig-default-gids.patch
index e892c8a..e892c8a 100644
--- a/4.7.7/4450_grsec-kconfig-default-gids.patch
+++ b/4.7.8/4450_grsec-kconfig-default-gids.patch
diff --git a/4.7.7/4465_selinux-avc_audit-log-curr_ip.patch b/4.7.8/4465_selinux-avc_audit-log-curr_ip.patch
index 7248385..7248385 100644
--- a/4.7.7/4465_selinux-avc_audit-log-curr_ip.patch
+++ b/4.7.8/4465_selinux-avc_audit-log-curr_ip.patch
diff --git a/4.7.7/4470_disable-compat_vdso.patch b/4.7.8/4470_disable-compat_vdso.patch
index 0f82d7e..0f82d7e 100644
--- a/4.7.7/4470_disable-compat_vdso.patch
+++ b/4.7.8/4470_disable-compat_vdso.patch
diff --git a/4.7.7/4475_emutramp_default_on.patch b/4.7.8/4475_emutramp_default_on.patch
index 2db58ab..2db58ab 100644
--- a/4.7.7/4475_emutramp_default_on.patch
+++ b/4.7.8/4475_emutramp_default_on.patch