summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorAnthony G. Basile <blueness@gentoo.org>2017-02-18 10:13:12 -0500
committerAnthony G. Basile <blueness@gentoo.org>2017-02-18 10:13:12 -0500
commit8af1219909af5665905a96ba4821d82ca52cb953 (patch)
tree2eb92718fd627a0934f9a4f28abf76538a7178c6
parentgrsecurity-3.1-4.9.9-201702122044 (diff)
downloadhardened-patchset-8af1219909af5665905a96ba4821d82ca52cb953.tar.gz
hardened-patchset-8af1219909af5665905a96ba4821d82ca52cb953.tar.bz2
hardened-patchset-8af1219909af5665905a96ba4821d82ca52cb953.zip
grsecurity-3.1-4.9.10-20170216201620170216
-rw-r--r--4.9.10/0000_README (renamed from 4.9.9/0000_README)10
-rw-r--r--4.9.10/1009_linux-4.9.10.patch2157
-rw-r--r--4.9.10/4420_grsecurity-3.1-4.9.10-201702162016.patch (renamed from 4.9.9/4420_grsecurity-3.1-4.9.9-201702122044.patch)373
-rw-r--r--4.9.10/4425_grsec_remove_EI_PAX.patch (renamed from 4.9.9/4425_grsec_remove_EI_PAX.patch)0
-rw-r--r--4.9.10/4426_default_XATTR_PAX_FLAGS.patch (renamed from 4.9.9/4426_default_XATTR_PAX_FLAGS.patch)0
-rw-r--r--4.9.10/4427_force_XATTR_PAX_tmpfs.patch (renamed from 4.9.9/4427_force_XATTR_PAX_tmpfs.patch)0
-rw-r--r--4.9.10/4430_grsec-remove-localversion-grsec.patch (renamed from 4.9.9/4430_grsec-remove-localversion-grsec.patch)0
-rw-r--r--4.9.10/4435_grsec-mute-warnings.patch (renamed from 4.9.9/4435_grsec-mute-warnings.patch)0
-rw-r--r--4.9.10/4440_grsec-remove-protected-paths.patch (renamed from 4.9.9/4440_grsec-remove-protected-paths.patch)0
-rw-r--r--4.9.10/4450_grsec-kconfig-default-gids.patch (renamed from 4.9.9/4450_grsec-kconfig-default-gids.patch)0
-rw-r--r--4.9.10/4465_selinux-avc_audit-log-curr_ip.patch (renamed from 4.9.9/4465_selinux-avc_audit-log-curr_ip.patch)0
-rw-r--r--4.9.10/4470_disable-compat_vdso.patch (renamed from 4.9.9/4470_disable-compat_vdso.patch)0
-rw-r--r--4.9.10/4475_emutramp_default_on.patch (renamed from 4.9.9/4475_emutramp_default_on.patch)0
-rw-r--r--4.9.9/1007_linux-4.9.8.patch2048
-rw-r--r--4.9.9/1008_linux-4.9.9.patch2333
15 files changed, 2368 insertions, 4553 deletions
diff --git a/4.9.9/0000_README b/4.9.10/0000_README
index e2a9385..3bc6d08 100644
--- a/4.9.9/0000_README
+++ b/4.9.10/0000_README
@@ -2,15 +2,11 @@ README
-----------------------------------------------------------------------------
Individual Patch Descriptions:
-----------------------------------------------------------------------------
-Patch: 1007_linux-4.9.8.patch
+Patch: 1009_linux-4.9.10.patch
From: http://www.kernel.org
-Desc: Linux 4.9.8
+Desc: Linux 4.9.10
-Patch: 1008_linux-4.9.9.patch
-From: http://www.kernel.org
-Desc: Linux 4.9.9
-
-Patch: 4420_grsecurity-3.1-4.9.9-201702122044.patch
+Patch: 4420_grsecurity-3.1-4.9.10-201702162016.patch
From: http://www.grsecurity.net
Desc: hardened-sources base patch from upstream grsecurity
diff --git a/4.9.10/1009_linux-4.9.10.patch b/4.9.10/1009_linux-4.9.10.patch
new file mode 100644
index 0000000..1767b59
--- /dev/null
+++ b/4.9.10/1009_linux-4.9.10.patch
@@ -0,0 +1,2157 @@
+diff --git a/Makefile b/Makefile
+index c0c41c9..d2fe757 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 4
+ PATCHLEVEL = 9
+-SUBLEVEL = 9
++SUBLEVEL = 10
+ EXTRAVERSION =
+ NAME = Roaring Lionus
+
+diff --git a/arch/arc/kernel/unaligned.c b/arch/arc/kernel/unaligned.c
+index 91ebe38..5f69c3b 100644
+--- a/arch/arc/kernel/unaligned.c
++++ b/arch/arc/kernel/unaligned.c
+@@ -243,7 +243,7 @@ int misaligned_fixup(unsigned long address, struct pt_regs *regs,
+
+ /* clear any remanants of delay slot */
+ if (delay_mode(regs)) {
+- regs->ret = regs->bta ~1U;
++ regs->ret = regs->bta & ~1U;
+ regs->status32 &= ~STATUS_DE_MASK;
+ } else {
+ regs->ret += state.instr_len;
+diff --git a/arch/arm/boot/dts/imx6dl.dtsi b/arch/arm/boot/dts/imx6dl.dtsi
+index 1ade195..7aa120f 100644
+--- a/arch/arm/boot/dts/imx6dl.dtsi
++++ b/arch/arm/boot/dts/imx6dl.dtsi
+@@ -137,7 +137,7 @@
+ &gpio4 {
+ gpio-ranges = <&iomuxc 5 136 1>, <&iomuxc 6 145 1>, <&iomuxc 7 150 1>,
+ <&iomuxc 8 146 1>, <&iomuxc 9 151 1>, <&iomuxc 10 147 1>,
+- <&iomuxc 11 151 1>, <&iomuxc 12 148 1>, <&iomuxc 13 153 1>,
++ <&iomuxc 11 152 1>, <&iomuxc 12 148 1>, <&iomuxc 13 153 1>,
+ <&iomuxc 14 149 1>, <&iomuxc 15 154 1>, <&iomuxc 16 39 7>,
+ <&iomuxc 23 56 1>, <&iomuxc 24 61 7>, <&iomuxc 31 46 1>;
+ };
+diff --git a/arch/arm/kernel/ptrace.c b/arch/arm/kernel/ptrace.c
+index ce131ed..ae738a6 100644
+--- a/arch/arm/kernel/ptrace.c
++++ b/arch/arm/kernel/ptrace.c
+@@ -600,7 +600,7 @@ static int gpr_set(struct task_struct *target,
+ const void *kbuf, const void __user *ubuf)
+ {
+ int ret;
+- struct pt_regs newregs;
++ struct pt_regs newregs = *task_pt_regs(target);
+
+ ret = user_regset_copyin(&pos, &count, &kbuf, &ubuf,
+ &newregs,
+diff --git a/arch/arm/mm/fault.c b/arch/arm/mm/fault.c
+index 3a2e678..0122ad1 100644
+--- a/arch/arm/mm/fault.c
++++ b/arch/arm/mm/fault.c
+@@ -610,9 +610,9 @@ static int __init early_abort_handler(unsigned long addr, unsigned int fsr,
+
+ void __init early_abt_enable(void)
+ {
+- fsr_info[22].fn = early_abort_handler;
++ fsr_info[FSR_FS_AEA].fn = early_abort_handler;
+ local_abt_enable();
+- fsr_info[22].fn = do_bad;
++ fsr_info[FSR_FS_AEA].fn = do_bad;
+ }
+
+ #ifndef CONFIG_ARM_LPAE
+diff --git a/arch/arm/mm/fault.h b/arch/arm/mm/fault.h
+index 67532f2..afc1f84 100644
+--- a/arch/arm/mm/fault.h
++++ b/arch/arm/mm/fault.h
+@@ -11,11 +11,15 @@
+ #define FSR_FS5_0 (0x3f)
+
+ #ifdef CONFIG_ARM_LPAE
++#define FSR_FS_AEA 17
++
+ static inline int fsr_fs(unsigned int fsr)
+ {
+ return fsr & FSR_FS5_0;
+ }
+ #else
++#define FSR_FS_AEA 22
++
+ static inline int fsr_fs(unsigned int fsr)
+ {
+ return (fsr & FSR_FS3_0) | (fsr & FSR_FS4) >> 6;
+diff --git a/arch/powerpc/include/asm/reg.h b/arch/powerpc/include/asm/reg.h
+index 9e1499f..13f5fad 100644
+--- a/arch/powerpc/include/asm/reg.h
++++ b/arch/powerpc/include/asm/reg.h
+@@ -641,9 +641,10 @@
+ #define SRR1_ISI_N_OR_G 0x10000000 /* ISI: Access is no-exec or G */
+ #define SRR1_ISI_PROT 0x08000000 /* ISI: Other protection fault */
+ #define SRR1_WAKEMASK 0x00380000 /* reason for wakeup */
+-#define SRR1_WAKEMASK_P8 0x003c0000 /* reason for wakeup on POWER8 */
++#define SRR1_WAKEMASK_P8 0x003c0000 /* reason for wakeup on POWER8 and 9 */
+ #define SRR1_WAKESYSERR 0x00300000 /* System error */
+ #define SRR1_WAKEEE 0x00200000 /* External interrupt */
++#define SRR1_WAKEHVI 0x00240000 /* Hypervisor Virtualization Interrupt (P9) */
+ #define SRR1_WAKEMT 0x00280000 /* mtctrl */
+ #define SRR1_WAKEHMI 0x00280000 /* Hypervisor maintenance */
+ #define SRR1_WAKEDEC 0x00180000 /* Decrementer interrupt */
+diff --git a/arch/powerpc/include/asm/xics.h b/arch/powerpc/include/asm/xics.h
+index f0b2385..e0b9e57 100644
+--- a/arch/powerpc/include/asm/xics.h
++++ b/arch/powerpc/include/asm/xics.h
+@@ -44,6 +44,7 @@ static inline int icp_hv_init(void) { return -ENODEV; }
+
+ #ifdef CONFIG_PPC_POWERNV
+ extern int icp_opal_init(void);
++extern void icp_opal_flush_interrupt(void);
+ #else
+ static inline int icp_opal_init(void) { return -ENODEV; }
+ #endif
+diff --git a/arch/powerpc/mm/tlb-radix.c b/arch/powerpc/mm/tlb-radix.c
+index 3493cf4..71697ff 100644
+--- a/arch/powerpc/mm/tlb-radix.c
++++ b/arch/powerpc/mm/tlb-radix.c
+@@ -50,9 +50,7 @@ static inline void _tlbiel_pid(unsigned long pid, unsigned long ric)
+ for (set = 0; set < POWER9_TLB_SETS_RADIX ; set++) {
+ __tlbiel_pid(pid, set, ric);
+ }
+- if (cpu_has_feature(CPU_FTR_POWER9_DD1))
+- asm volatile(PPC_INVALIDATE_ERAT : : :"memory");
+- return;
++ asm volatile(PPC_INVALIDATE_ERAT "; isync" : : :"memory");
+ }
+
+ static inline void _tlbie_pid(unsigned long pid, unsigned long ric)
+@@ -85,8 +83,6 @@ static inline void _tlbiel_va(unsigned long va, unsigned long pid,
+ asm volatile(PPC_TLBIEL(%0, %4, %3, %2, %1)
+ : : "r"(rb), "i"(r), "i"(prs), "i"(ric), "r"(rs) : "memory");
+ asm volatile("ptesync": : :"memory");
+- if (cpu_has_feature(CPU_FTR_POWER9_DD1))
+- asm volatile(PPC_INVALIDATE_ERAT : : :"memory");
+ }
+
+ static inline void _tlbie_va(unsigned long va, unsigned long pid,
+diff --git a/arch/powerpc/platforms/powernv/smp.c b/arch/powerpc/platforms/powernv/smp.c
+index c789258..eec0e8d 100644
+--- a/arch/powerpc/platforms/powernv/smp.c
++++ b/arch/powerpc/platforms/powernv/smp.c
+@@ -155,8 +155,10 @@ static void pnv_smp_cpu_kill_self(void)
+ wmask = SRR1_WAKEMASK_P8;
+
+ idle_states = pnv_get_supported_cpuidle_states();
++
+ /* We don't want to take decrementer interrupts while we are offline,
+- * so clear LPCR:PECE1. We keep PECE2 enabled.
++ * so clear LPCR:PECE1. We keep PECE2 (and LPCR_PECE_HVEE on P9)
++ * enabled as to let IPIs in.
+ */
+ mtspr(SPRN_LPCR, mfspr(SPRN_LPCR) & ~(u64)LPCR_PECE1);
+
+@@ -206,8 +208,12 @@ static void pnv_smp_cpu_kill_self(void)
+ * contains 0.
+ */
+ if (((srr1 & wmask) == SRR1_WAKEEE) ||
++ ((srr1 & wmask) == SRR1_WAKEHVI) ||
+ (local_paca->irq_happened & PACA_IRQ_EE)) {
+- icp_native_flush_interrupt();
++ if (cpu_has_feature(CPU_FTR_ARCH_300))
++ icp_opal_flush_interrupt();
++ else
++ icp_native_flush_interrupt();
+ } else if ((srr1 & wmask) == SRR1_WAKEHDBELL) {
+ unsigned long msg = PPC_DBELL_TYPE(PPC_DBELL_SERVER);
+ asm volatile(PPC_MSGCLR(%0) : : "r" (msg));
+@@ -221,6 +227,8 @@ static void pnv_smp_cpu_kill_self(void)
+ if (srr1 && !generic_check_cpu_restart(cpu))
+ DBG("CPU%d Unexpected exit while offline !\n", cpu);
+ }
++
++ /* Re-enable decrementer interrupts */
+ mtspr(SPRN_LPCR, mfspr(SPRN_LPCR) | LPCR_PECE1);
+ DBG("CPU%d coming online...\n", cpu);
+ }
+diff --git a/arch/powerpc/sysdev/xics/icp-opal.c b/arch/powerpc/sysdev/xics/icp-opal.c
+index 60c5765..c96c0cb 100644
+--- a/arch/powerpc/sysdev/xics/icp-opal.c
++++ b/arch/powerpc/sysdev/xics/icp-opal.c
+@@ -132,6 +132,35 @@ static irqreturn_t icp_opal_ipi_action(int irq, void *dev_id)
+ return smp_ipi_demux();
+ }
+
++/*
++ * Called when an interrupt is received on an off-line CPU to
++ * clear the interrupt, so that the CPU can go back to nap mode.
++ */
++void icp_opal_flush_interrupt(void)
++{
++ unsigned int xirr;
++ unsigned int vec;
++
++ do {
++ xirr = icp_opal_get_xirr();
++ vec = xirr & 0x00ffffff;
++ if (vec == XICS_IRQ_SPURIOUS)
++ break;
++ if (vec == XICS_IPI) {
++ /* Clear pending IPI */
++ int cpu = smp_processor_id();
++ kvmppc_set_host_ipi(cpu, 0);
++ opal_int_set_mfrr(get_hard_smp_processor_id(cpu), 0xff);
++ } else {
++ pr_err("XICS: hw interrupt 0x%x to offline cpu, "
++ "disabling\n", vec);
++ xics_mask_unknown_vec(vec);
++ }
++
++ /* EOI the interrupt */
++ } while (opal_int_eoi(xirr) > 0);
++}
++
+ #endif /* CONFIG_SMP */
+
+ static const struct icp_ops icp_opal_ops = {
+diff --git a/arch/x86/include/asm/processor.h b/arch/x86/include/asm/processor.h
+index 984a7bf..83db0ea 100644
+--- a/arch/x86/include/asm/processor.h
++++ b/arch/x86/include/asm/processor.h
+@@ -104,6 +104,7 @@ struct cpuinfo_x86 {
+ __u8 x86_phys_bits;
+ /* CPUID returned core id bits: */
+ __u8 x86_coreid_bits;
++ __u8 cu_id;
+ /* Max extended CPUID function supported: */
+ __u32 extended_cpuid_level;
+ /* Maximum supported CPUID level, -1=no CPUID: */
+diff --git a/arch/x86/kernel/apic/io_apic.c b/arch/x86/kernel/apic/io_apic.c
+index 7249f15..d1e2556 100644
+--- a/arch/x86/kernel/apic/io_apic.c
++++ b/arch/x86/kernel/apic/io_apic.c
+@@ -1876,7 +1876,6 @@ static struct irq_chip ioapic_chip __read_mostly = {
+ .irq_ack = irq_chip_ack_parent,
+ .irq_eoi = ioapic_ack_level,
+ .irq_set_affinity = ioapic_set_affinity,
+- .irq_retrigger = irq_chip_retrigger_hierarchy,
+ .flags = IRQCHIP_SKIP_SET_WAKE,
+ };
+
+@@ -1888,7 +1887,6 @@ static struct irq_chip ioapic_ir_chip __read_mostly = {
+ .irq_ack = irq_chip_ack_parent,
+ .irq_eoi = ioapic_ir_ack_level,
+ .irq_set_affinity = ioapic_set_affinity,
+- .irq_retrigger = irq_chip_retrigger_hierarchy,
+ .flags = IRQCHIP_SKIP_SET_WAKE,
+ };
+
+diff --git a/arch/x86/kernel/cpu/amd.c b/arch/x86/kernel/cpu/amd.c
+index 1d31672..2b4cf04 100644
+--- a/arch/x86/kernel/cpu/amd.c
++++ b/arch/x86/kernel/cpu/amd.c
+@@ -309,8 +309,22 @@ static void amd_get_topology(struct cpuinfo_x86 *c)
+
+ /* get information required for multi-node processors */
+ if (boot_cpu_has(X86_FEATURE_TOPOEXT)) {
++ u32 eax, ebx, ecx, edx;
+
+- node_id = cpuid_ecx(0x8000001e) & 7;
++ cpuid(0x8000001e, &eax, &ebx, &ecx, &edx);
++
++ node_id = ecx & 0xff;
++ smp_num_siblings = ((ebx >> 8) & 0xff) + 1;
++
++ if (c->x86 == 0x15)
++ c->cu_id = ebx & 0xff;
++
++ if (c->x86 >= 0x17) {
++ c->cpu_core_id = ebx & 0xff;
++
++ if (smp_num_siblings > 1)
++ c->x86_max_cores /= smp_num_siblings;
++ }
+
+ /*
+ * We may have multiple LLCs if L3 caches exist, so check if we
+diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c
+index 023c7bf..4eece91 100644
+--- a/arch/x86/kernel/cpu/common.c
++++ b/arch/x86/kernel/cpu/common.c
+@@ -1015,6 +1015,7 @@ static void identify_cpu(struct cpuinfo_x86 *c)
+ c->x86_model_id[0] = '\0'; /* Unset */
+ c->x86_max_cores = 1;
+ c->x86_coreid_bits = 0;
++ c->cu_id = 0xff;
+ #ifdef CONFIG_X86_64
+ c->x86_clflush_size = 64;
+ c->x86_phys_bits = 36;
+diff --git a/arch/x86/kernel/smpboot.c b/arch/x86/kernel/smpboot.c
+index e9bbe02..36171bc 100644
+--- a/arch/x86/kernel/smpboot.c
++++ b/arch/x86/kernel/smpboot.c
+@@ -423,9 +423,15 @@ static bool match_smt(struct cpuinfo_x86 *c, struct cpuinfo_x86 *o)
+ int cpu1 = c->cpu_index, cpu2 = o->cpu_index;
+
+ if (c->phys_proc_id == o->phys_proc_id &&
+- per_cpu(cpu_llc_id, cpu1) == per_cpu(cpu_llc_id, cpu2) &&
+- c->cpu_core_id == o->cpu_core_id)
+- return topology_sane(c, o, "smt");
++ per_cpu(cpu_llc_id, cpu1) == per_cpu(cpu_llc_id, cpu2)) {
++ if (c->cpu_core_id == o->cpu_core_id)
++ return topology_sane(c, o, "smt");
++
++ if ((c->cu_id != 0xff) &&
++ (o->cu_id != 0xff) &&
++ (c->cu_id == o->cu_id))
++ return topology_sane(c, o, "smt");
++ }
+
+ } else if (c->phys_proc_id == o->phys_proc_id &&
+ c->cpu_core_id == o->cpu_core_id) {
+diff --git a/arch/x86/mm/dump_pagetables.c b/arch/x86/mm/dump_pagetables.c
+index ea9c49a..8aa6bea 100644
+--- a/arch/x86/mm/dump_pagetables.c
++++ b/arch/x86/mm/dump_pagetables.c
+@@ -15,6 +15,7 @@
+ #include <linux/debugfs.h>
+ #include <linux/mm.h>
+ #include <linux/init.h>
++#include <linux/sched.h>
+ #include <linux/seq_file.h>
+
+ #include <asm/pgtable.h>
+@@ -406,6 +407,7 @@ static void ptdump_walk_pgd_level_core(struct seq_file *m, pgd_t *pgd,
+ } else
+ note_page(m, &st, __pgprot(0), 1);
+
++ cond_resched();
+ start++;
+ }
+
+diff --git a/crypto/algif_aead.c b/crypto/algif_aead.c
+index e9c0993..e8817e2 100644
+--- a/crypto/algif_aead.c
++++ b/crypto/algif_aead.c
+@@ -671,9 +671,9 @@ static int aead_recvmsg_sync(struct socket *sock, struct msghdr *msg, int flags)
+ unlock:
+ list_for_each_entry_safe(rsgl, tmp, &ctx->list, list) {
+ af_alg_free_sg(&rsgl->sgl);
++ list_del(&rsgl->list);
+ if (rsgl != &ctx->first_rsgl)
+ sock_kfree_s(sk, rsgl, sizeof(*rsgl));
+- list_del(&rsgl->list);
+ }
+ INIT_LIST_HEAD(&ctx->list);
+ aead_wmem_wakeup(sk);
+diff --git a/drivers/acpi/nfit/core.c b/drivers/acpi/nfit/core.c
+index 312c4b4..6eb6733 100644
+--- a/drivers/acpi/nfit/core.c
++++ b/drivers/acpi/nfit/core.c
+@@ -2704,6 +2704,7 @@ static int acpi_nfit_flush_probe(struct nvdimm_bus_descriptor *nd_desc)
+ struct acpi_nfit_desc *acpi_desc = to_acpi_nfit_desc(nd_desc);
+ struct device *dev = acpi_desc->dev;
+ struct acpi_nfit_flush_work flush;
++ int rc;
+
+ /* bounce the device lock to flush acpi_nfit_add / acpi_nfit_notify */
+ device_lock(dev);
+@@ -2716,7 +2717,10 @@ static int acpi_nfit_flush_probe(struct nvdimm_bus_descriptor *nd_desc)
+ INIT_WORK_ONSTACK(&flush.work, flush_probe);
+ COMPLETION_INITIALIZER_ONSTACK(flush.cmp);
+ queue_work(nfit_wq, &flush.work);
+- return wait_for_completion_interruptible(&flush.cmp);
++
++ rc = wait_for_completion_interruptible(&flush.cmp);
++ cancel_work_sync(&flush.work);
++ return rc;
+ }
+
+ static int acpi_nfit_clear_to_send(struct nvdimm_bus_descriptor *nd_desc,
+diff --git a/drivers/cpufreq/intel_pstate.c b/drivers/cpufreq/intel_pstate.c
+index 4737520..80fa656 100644
+--- a/drivers/cpufreq/intel_pstate.c
++++ b/drivers/cpufreq/intel_pstate.c
+@@ -820,6 +820,25 @@ static void intel_pstate_hwp_enable(struct cpudata *cpudata)
+ wrmsrl_on_cpu(cpudata->cpu, MSR_PM_ENABLE, 0x1);
+ }
+
++#define MSR_IA32_POWER_CTL_BIT_EE 19
++
++/* Disable energy efficiency optimization */
++static void intel_pstate_disable_ee(int cpu)
++{
++ u64 power_ctl;
++ int ret;
++
++ ret = rdmsrl_on_cpu(cpu, MSR_IA32_POWER_CTL, &power_ctl);
++ if (ret)
++ return;
++
++ if (!(power_ctl & BIT(MSR_IA32_POWER_CTL_BIT_EE))) {
++ pr_info("Disabling energy efficiency optimization\n");
++ power_ctl |= BIT(MSR_IA32_POWER_CTL_BIT_EE);
++ wrmsrl_on_cpu(cpu, MSR_IA32_POWER_CTL, power_ctl);
++ }
++}
++
+ static int atom_get_min_pstate(void)
+ {
+ u64 value;
+@@ -1420,6 +1439,11 @@ static const struct x86_cpu_id intel_pstate_cpu_oob_ids[] __initconst = {
+ {}
+ };
+
++static const struct x86_cpu_id intel_pstate_cpu_ee_disable_ids[] = {
++ ICPU(INTEL_FAM6_KABYLAKE_DESKTOP, core_params),
++ {}
++};
++
+ static int intel_pstate_init_cpu(unsigned int cpunum)
+ {
+ struct cpudata *cpu;
+@@ -1435,6 +1459,12 @@ static int intel_pstate_init_cpu(unsigned int cpunum)
+ cpu->cpu = cpunum;
+
+ if (hwp_active) {
++ const struct x86_cpu_id *id;
++
++ id = x86_match_cpu(intel_pstate_cpu_ee_disable_ids);
++ if (id)
++ intel_pstate_disable_ee(cpunum);
++
+ intel_pstate_hwp_enable(cpu);
+ pid_params.sample_rate_ms = 50;
+ pid_params.sample_rate_ns = 50 * NSEC_PER_MSEC;
+diff --git a/drivers/crypto/ccp/ccp-dev-v5.c b/drivers/crypto/ccp/ccp-dev-v5.c
+index faf3cb3..a388bf2 100644
+--- a/drivers/crypto/ccp/ccp-dev-v5.c
++++ b/drivers/crypto/ccp/ccp-dev-v5.c
+@@ -955,7 +955,7 @@ static irqreturn_t ccp5_irq_handler(int irq, void *data)
+ static void ccp5_config(struct ccp_device *ccp)
+ {
+ /* Public side */
+- iowrite32(0x00001249, ccp->io_regs + CMD5_REQID_CONFIG_OFFSET);
++ iowrite32(0x0, ccp->io_regs + CMD5_REQID_CONFIG_OFFSET);
+ }
+
+ static void ccp5other_config(struct ccp_device *ccp)
+diff --git a/drivers/crypto/ccp/ccp-dev.h b/drivers/crypto/ccp/ccp-dev.h
+index da5f4a6..340aef1 100644
+--- a/drivers/crypto/ccp/ccp-dev.h
++++ b/drivers/crypto/ccp/ccp-dev.h
+@@ -238,6 +238,7 @@ struct ccp_dma_chan {
+ struct ccp_device *ccp;
+
+ spinlock_t lock;
++ struct list_head created;
+ struct list_head pending;
+ struct list_head active;
+ struct list_head complete;
+diff --git a/drivers/crypto/ccp/ccp-dmaengine.c b/drivers/crypto/ccp/ccp-dmaengine.c
+index 6553912..e5d9278 100644
+--- a/drivers/crypto/ccp/ccp-dmaengine.c
++++ b/drivers/crypto/ccp/ccp-dmaengine.c
+@@ -63,6 +63,7 @@ static void ccp_free_chan_resources(struct dma_chan *dma_chan)
+ ccp_free_desc_resources(chan->ccp, &chan->complete);
+ ccp_free_desc_resources(chan->ccp, &chan->active);
+ ccp_free_desc_resources(chan->ccp, &chan->pending);
++ ccp_free_desc_resources(chan->ccp, &chan->created);
+
+ spin_unlock_irqrestore(&chan->lock, flags);
+ }
+@@ -273,6 +274,7 @@ static dma_cookie_t ccp_tx_submit(struct dma_async_tx_descriptor *tx_desc)
+ spin_lock_irqsave(&chan->lock, flags);
+
+ cookie = dma_cookie_assign(tx_desc);
++ list_del(&desc->entry);
+ list_add_tail(&desc->entry, &chan->pending);
+
+ spin_unlock_irqrestore(&chan->lock, flags);
+@@ -426,7 +428,7 @@ static struct ccp_dma_desc *ccp_create_desc(struct dma_chan *dma_chan,
+
+ spin_lock_irqsave(&chan->lock, sflags);
+
+- list_add_tail(&desc->entry, &chan->pending);
++ list_add_tail(&desc->entry, &chan->created);
+
+ spin_unlock_irqrestore(&chan->lock, sflags);
+
+@@ -610,6 +612,7 @@ static int ccp_terminate_all(struct dma_chan *dma_chan)
+ /*TODO: Purge the complete list? */
+ ccp_free_desc_resources(chan->ccp, &chan->active);
+ ccp_free_desc_resources(chan->ccp, &chan->pending);
++ ccp_free_desc_resources(chan->ccp, &chan->created);
+
+ spin_unlock_irqrestore(&chan->lock, flags);
+
+@@ -679,6 +682,7 @@ int ccp_dmaengine_register(struct ccp_device *ccp)
+ chan->ccp = ccp;
+
+ spin_lock_init(&chan->lock);
++ INIT_LIST_HEAD(&chan->created);
+ INIT_LIST_HEAD(&chan->pending);
+ INIT_LIST_HEAD(&chan->active);
+ INIT_LIST_HEAD(&chan->complete);
+diff --git a/drivers/crypto/chelsio/chcr_core.c b/drivers/crypto/chelsio/chcr_core.c
+index fb5f9bb..6aece3f 100644
+--- a/drivers/crypto/chelsio/chcr_core.c
++++ b/drivers/crypto/chelsio/chcr_core.c
+@@ -51,6 +51,7 @@ static struct cxgb4_uld_info chcr_uld_info = {
+ int assign_chcr_device(struct chcr_dev **dev)
+ {
+ struct uld_ctx *u_ctx;
++ int ret = -ENXIO;
+
+ /*
+ * Which device to use if multiple devices are available TODO
+@@ -58,15 +59,14 @@ int assign_chcr_device(struct chcr_dev **dev)
+ * must go to the same device to maintain the ordering.
+ */
+ mutex_lock(&dev_mutex); /* TODO ? */
+- u_ctx = list_first_entry(&uld_ctx_list, struct uld_ctx, entry);
+- if (!u_ctx) {
+- mutex_unlock(&dev_mutex);
+- return -ENXIO;
++ list_for_each_entry(u_ctx, &uld_ctx_list, entry)
++ if (u_ctx && u_ctx->dev) {
++ *dev = u_ctx->dev;
++ ret = 0;
++ break;
+ }
+-
+- *dev = u_ctx->dev;
+ mutex_unlock(&dev_mutex);
+- return 0;
++ return ret;
+ }
+
+ static int chcr_dev_add(struct uld_ctx *u_ctx)
+@@ -203,10 +203,8 @@ static int chcr_uld_state_change(void *handle, enum cxgb4_state state)
+
+ static int __init chcr_crypto_init(void)
+ {
+- if (cxgb4_register_uld(CXGB4_ULD_CRYPTO, &chcr_uld_info)) {
++ if (cxgb4_register_uld(CXGB4_ULD_CRYPTO, &chcr_uld_info))
+ pr_err("ULD register fail: No chcr crypto support in cxgb4");
+- return -1;
+- }
+
+ return 0;
+ }
+diff --git a/drivers/crypto/qat/qat_c62x/adf_drv.c b/drivers/crypto/qat/qat_c62x/adf_drv.c
+index bc5cbc1..5b2d78a 100644
+--- a/drivers/crypto/qat/qat_c62x/adf_drv.c
++++ b/drivers/crypto/qat/qat_c62x/adf_drv.c
+@@ -233,7 +233,7 @@ static int adf_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
+ &hw_data->accel_capabilities_mask);
+
+ /* Find and map all the device's BARS */
+- i = 0;
++ i = (hw_data->fuses & ADF_DEVICE_FUSECTL_MASK) ? 1 : 0;
+ bar_mask = pci_select_bars(pdev, IORESOURCE_MEM);
+ for_each_set_bit(bar_nr, (const unsigned long *)&bar_mask,
+ ADF_PCI_MAX_BARS * 2) {
+diff --git a/drivers/crypto/qat/qat_common/adf_accel_devices.h b/drivers/crypto/qat/qat_common/adf_accel_devices.h
+index e882253..33f0a62 100644
+--- a/drivers/crypto/qat/qat_common/adf_accel_devices.h
++++ b/drivers/crypto/qat/qat_common/adf_accel_devices.h
+@@ -69,6 +69,7 @@
+ #define ADF_ERRSOU5 (0x3A000 + 0xD8)
+ #define ADF_DEVICE_FUSECTL_OFFSET 0x40
+ #define ADF_DEVICE_LEGFUSE_OFFSET 0x4C
++#define ADF_DEVICE_FUSECTL_MASK 0x80000000
+ #define ADF_PCI_MAX_BARS 3
+ #define ADF_DEVICE_NAME_LENGTH 32
+ #define ADF_ETR_MAX_RINGS_PER_BANK 16
+diff --git a/drivers/crypto/qat/qat_common/qat_hal.c b/drivers/crypto/qat/qat_common/qat_hal.c
+index 1e480f1..8c4fd25 100644
+--- a/drivers/crypto/qat/qat_common/qat_hal.c
++++ b/drivers/crypto/qat/qat_common/qat_hal.c
+@@ -456,7 +456,7 @@ static int qat_hal_init_esram(struct icp_qat_fw_loader_handle *handle)
+ unsigned int csr_val;
+ int times = 30;
+
+- if (handle->pci_dev->device == ADF_C3XXX_PCI_DEVICE_ID)
++ if (handle->pci_dev->device != ADF_DH895XCC_PCI_DEVICE_ID)
+ return 0;
+
+ csr_val = ADF_CSR_RD(csr_addr, 0);
+@@ -716,7 +716,7 @@ int qat_hal_init(struct adf_accel_dev *accel_dev)
+ (void __iomem *)((uintptr_t)handle->hal_cap_ae_xfer_csr_addr_v +
+ LOCAL_TO_XFER_REG_OFFSET);
+ handle->pci_dev = pci_info->pci_dev;
+- if (handle->pci_dev->device != ADF_C3XXX_PCI_DEVICE_ID) {
++ if (handle->pci_dev->device == ADF_DH895XCC_PCI_DEVICE_ID) {
+ sram_bar =
+ &pci_info->pci_bars[hw_data->get_sram_bar_id(hw_data)];
+ handle->hal_sram_addr_v = sram_bar->virt_addr;
+diff --git a/drivers/gpu/drm/drm_atomic.c b/drivers/gpu/drm/drm_atomic.c
+index e6862a7..4e19bde 100644
+--- a/drivers/gpu/drm/drm_atomic.c
++++ b/drivers/gpu/drm/drm_atomic.c
+@@ -1759,16 +1759,16 @@ int drm_mode_atomic_ioctl(struct drm_device *dev,
+
+ if (ret && arg->flags & DRM_MODE_PAGE_FLIP_EVENT) {
+ /*
+- * TEST_ONLY and PAGE_FLIP_EVENT are mutually exclusive,
+- * if they weren't, this code should be called on success
+- * for TEST_ONLY too.
++ * Free the allocated event. drm_atomic_helper_setup_commit
++ * can allocate an event too, so only free it if it's ours
++ * to prevent a double free in drm_atomic_state_clear.
+ */
+-
+ for_each_crtc_in_state(state, crtc, crtc_state, i) {
+- if (!crtc_state->event)
+- continue;
+-
+- drm_event_cancel_free(dev, &crtc_state->event->base);
++ struct drm_pending_vblank_event *event = crtc_state->event;
++ if (event && (event->base.fence || event->base.file_priv)) {
++ drm_event_cancel_free(dev, &event->base);
++ crtc_state->event = NULL;
++ }
+ }
+ }
+
+diff --git a/drivers/gpu/drm/i915/i915_gem_execbuffer.c b/drivers/gpu/drm/i915/i915_gem_execbuffer.c
+index a218c2e..0c400f8 100644
+--- a/drivers/gpu/drm/i915/i915_gem_execbuffer.c
++++ b/drivers/gpu/drm/i915/i915_gem_execbuffer.c
+@@ -1215,14 +1215,14 @@ validate_exec_list(struct drm_device *dev,
+ if (exec[i].offset !=
+ gen8_canonical_addr(exec[i].offset & PAGE_MASK))
+ return -EINVAL;
+-
+- /* From drm_mm perspective address space is continuous,
+- * so from this point we're always using non-canonical
+- * form internally.
+- */
+- exec[i].offset = gen8_noncanonical_addr(exec[i].offset);
+ }
+
++ /* From drm_mm perspective address space is continuous,
++ * so from this point we're always using non-canonical
++ * form internally.
++ */
++ exec[i].offset = gen8_noncanonical_addr(exec[i].offset);
++
+ if (exec[i].alignment && !is_power_of_2(exec[i].alignment))
+ return -EINVAL;
+
+diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
+index 8079e5b..b9be8a6 100644
+--- a/drivers/gpu/drm/i915/intel_display.c
++++ b/drivers/gpu/drm/i915/intel_display.c
+@@ -4280,10 +4280,10 @@ static void page_flip_completed(struct intel_crtc *intel_crtc)
+ drm_crtc_vblank_put(&intel_crtc->base);
+
+ wake_up_all(&dev_priv->pending_flip_queue);
+- queue_work(dev_priv->wq, &work->unpin_work);
+-
+ trace_i915_flip_complete(intel_crtc->plane,
+ work->pending_flip_obj);
++
++ queue_work(dev_priv->wq, &work->unpin_work);
+ }
+
+ static int intel_crtc_wait_for_pending_flips(struct drm_crtc *crtc)
+diff --git a/drivers/gpu/drm/i915/intel_dpll_mgr.c b/drivers/gpu/drm/i915/intel_dpll_mgr.c
+index 1c59ca5..cae27c5 100644
+--- a/drivers/gpu/drm/i915/intel_dpll_mgr.c
++++ b/drivers/gpu/drm/i915/intel_dpll_mgr.c
+@@ -1723,7 +1723,8 @@ bxt_get_dpll(struct intel_crtc *crtc,
+ return NULL;
+
+ if ((encoder->type == INTEL_OUTPUT_DP ||
+- encoder->type == INTEL_OUTPUT_EDP) &&
++ encoder->type == INTEL_OUTPUT_EDP ||
++ encoder->type == INTEL_OUTPUT_DP_MST) &&
+ !bxt_ddi_dp_set_dpll_hw_state(clock, &dpll_hw_state))
+ return NULL;
+
+diff --git a/drivers/hv/channel.c b/drivers/hv/channel.c
+index 16f91c8..5fb4c6d 100644
+--- a/drivers/hv/channel.c
++++ b/drivers/hv/channel.c
+@@ -39,7 +39,7 @@
+ * vmbus_setevent- Trigger an event notification on the specified
+ * channel.
+ */
+-static void vmbus_setevent(struct vmbus_channel *channel)
++void vmbus_setevent(struct vmbus_channel *channel)
+ {
+ struct hv_monitor_page *monitorpage;
+
+@@ -65,6 +65,7 @@ static void vmbus_setevent(struct vmbus_channel *channel)
+ vmbus_set_event(channel);
+ }
+ }
++EXPORT_SYMBOL_GPL(vmbus_setevent);
+
+ /*
+ * vmbus_open - Open the specified channel.
+@@ -635,8 +636,6 @@ int vmbus_sendpacket_ctl(struct vmbus_channel *channel, void *buffer,
+ u32 packetlen_aligned = ALIGN(packetlen, sizeof(u64));
+ struct kvec bufferlist[3];
+ u64 aligned_data = 0;
+- int ret;
+- bool signal = false;
+ bool lock = channel->acquire_ring_lock;
+ int num_vecs = ((bufferlen != 0) ? 3 : 1);
+
+@@ -656,33 +655,9 @@ int vmbus_sendpacket_ctl(struct vmbus_channel *channel, void *buffer,
+ bufferlist[2].iov_base = &aligned_data;
+ bufferlist[2].iov_len = (packetlen_aligned - packetlen);
+
+- ret = hv_ringbuffer_write(&channel->outbound, bufferlist, num_vecs,
+- &signal, lock, channel->signal_policy);
+-
+- /*
+- * Signalling the host is conditional on many factors:
+- * 1. The ring state changed from being empty to non-empty.
+- * This is tracked by the variable "signal".
+- * 2. The variable kick_q tracks if more data will be placed
+- * on the ring. We will not signal if more data is
+- * to be placed.
+- *
+- * Based on the channel signal state, we will decide
+- * which signaling policy will be applied.
+- *
+- * If we cannot write to the ring-buffer; signal the host
+- * even if we may not have written anything. This is a rare
+- * enough condition that it should not matter.
+- * NOTE: in this case, the hvsock channel is an exception, because
+- * it looks the host side's hvsock implementation has a throttling
+- * mechanism which can hurt the performance otherwise.
+- */
+-
+- if (((ret == 0) && kick_q && signal) ||
+- (ret && !is_hvsock_channel(channel)))
+- vmbus_setevent(channel);
++ return hv_ringbuffer_write(channel, bufferlist, num_vecs,
++ lock, kick_q);
+
+- return ret;
+ }
+ EXPORT_SYMBOL(vmbus_sendpacket_ctl);
+
+@@ -723,7 +698,6 @@ int vmbus_sendpacket_pagebuffer_ctl(struct vmbus_channel *channel,
+ u32 flags,
+ bool kick_q)
+ {
+- int ret;
+ int i;
+ struct vmbus_channel_packet_page_buffer desc;
+ u32 descsize;
+@@ -731,7 +705,6 @@ int vmbus_sendpacket_pagebuffer_ctl(struct vmbus_channel *channel,
+ u32 packetlen_aligned;
+ struct kvec bufferlist[3];
+ u64 aligned_data = 0;
+- bool signal = false;
+ bool lock = channel->acquire_ring_lock;
+
+ if (pagecount > MAX_PAGE_BUFFER_COUNT)
+@@ -769,29 +742,8 @@ int vmbus_sendpacket_pagebuffer_ctl(struct vmbus_channel *channel,
+ bufferlist[2].iov_base = &aligned_data;
+ bufferlist[2].iov_len = (packetlen_aligned - packetlen);
+
+- ret = hv_ringbuffer_write(&channel->outbound, bufferlist, 3,
+- &signal, lock, channel->signal_policy);
+-
+- /*
+- * Signalling the host is conditional on many factors:
+- * 1. The ring state changed from being empty to non-empty.
+- * This is tracked by the variable "signal".
+- * 2. The variable kick_q tracks if more data will be placed
+- * on the ring. We will not signal if more data is
+- * to be placed.
+- *
+- * Based on the channel signal state, we will decide
+- * which signaling policy will be applied.
+- *
+- * If we cannot write to the ring-buffer; signal the host
+- * even if we may not have written anything. This is a rare
+- * enough condition that it should not matter.
+- */
+-
+- if (((ret == 0) && kick_q && signal) || (ret))
+- vmbus_setevent(channel);
+-
+- return ret;
++ return hv_ringbuffer_write(channel, bufferlist, 3,
++ lock, kick_q);
+ }
+ EXPORT_SYMBOL_GPL(vmbus_sendpacket_pagebuffer_ctl);
+
+@@ -822,12 +774,10 @@ int vmbus_sendpacket_mpb_desc(struct vmbus_channel *channel,
+ u32 desc_size,
+ void *buffer, u32 bufferlen, u64 requestid)
+ {
+- int ret;
+ u32 packetlen;
+ u32 packetlen_aligned;
+ struct kvec bufferlist[3];
+ u64 aligned_data = 0;
+- bool signal = false;
+ bool lock = channel->acquire_ring_lock;
+
+ packetlen = desc_size + bufferlen;
+@@ -848,13 +798,8 @@ int vmbus_sendpacket_mpb_desc(struct vmbus_channel *channel,
+ bufferlist[2].iov_base = &aligned_data;
+ bufferlist[2].iov_len = (packetlen_aligned - packetlen);
+
+- ret = hv_ringbuffer_write(&channel->outbound, bufferlist, 3,
+- &signal, lock, channel->signal_policy);
+-
+- if (ret == 0 && signal)
+- vmbus_setevent(channel);
+-
+- return ret;
++ return hv_ringbuffer_write(channel, bufferlist, 3,
++ lock, true);
+ }
+ EXPORT_SYMBOL_GPL(vmbus_sendpacket_mpb_desc);
+
+@@ -866,14 +811,12 @@ int vmbus_sendpacket_multipagebuffer(struct vmbus_channel *channel,
+ struct hv_multipage_buffer *multi_pagebuffer,
+ void *buffer, u32 bufferlen, u64 requestid)
+ {
+- int ret;
+ struct vmbus_channel_packet_multipage_buffer desc;
+ u32 descsize;
+ u32 packetlen;
+ u32 packetlen_aligned;
+ struct kvec bufferlist[3];
+ u64 aligned_data = 0;
+- bool signal = false;
+ bool lock = channel->acquire_ring_lock;
+ u32 pfncount = NUM_PAGES_SPANNED(multi_pagebuffer->offset,
+ multi_pagebuffer->len);
+@@ -913,13 +856,8 @@ int vmbus_sendpacket_multipagebuffer(struct vmbus_channel *channel,
+ bufferlist[2].iov_base = &aligned_data;
+ bufferlist[2].iov_len = (packetlen_aligned - packetlen);
+
+- ret = hv_ringbuffer_write(&channel->outbound, bufferlist, 3,
+- &signal, lock, channel->signal_policy);
+-
+- if (ret == 0 && signal)
+- vmbus_setevent(channel);
+-
+- return ret;
++ return hv_ringbuffer_write(channel, bufferlist, 3,
++ lock, true);
+ }
+ EXPORT_SYMBOL_GPL(vmbus_sendpacket_multipagebuffer);
+
+@@ -941,16 +879,9 @@ __vmbus_recvpacket(struct vmbus_channel *channel, void *buffer,
+ u32 bufferlen, u32 *buffer_actual_len, u64 *requestid,
+ bool raw)
+ {
+- int ret;
+- bool signal = false;
++ return hv_ringbuffer_read(channel, buffer, bufferlen,
++ buffer_actual_len, requestid, raw);
+
+- ret = hv_ringbuffer_read(&channel->inbound, buffer, bufferlen,
+- buffer_actual_len, requestid, &signal, raw);
+-
+- if (signal)
+- vmbus_setevent(channel);
+-
+- return ret;
+ }
+
+ int vmbus_recvpacket(struct vmbus_channel *channel, void *buffer,
+diff --git a/drivers/hv/channel_mgmt.c b/drivers/hv/channel_mgmt.c
+index 1bc1d479..caf3418 100644
+--- a/drivers/hv/channel_mgmt.c
++++ b/drivers/hv/channel_mgmt.c
+@@ -449,8 +449,6 @@ static void vmbus_process_offer(struct vmbus_channel *newchannel)
+ }
+
+ dev_type = hv_get_dev_type(newchannel);
+- if (dev_type == HV_NIC)
+- set_channel_signal_state(newchannel, HV_SIGNAL_POLICY_EXPLICIT);
+
+ init_vp_index(newchannel, dev_type);
+
+diff --git a/drivers/hv/hyperv_vmbus.h b/drivers/hv/hyperv_vmbus.h
+index a5b4442..2b13f2a 100644
+--- a/drivers/hv/hyperv_vmbus.h
++++ b/drivers/hv/hyperv_vmbus.h
+@@ -527,14 +527,14 @@ int hv_ringbuffer_init(struct hv_ring_buffer_info *ring_info,
+
+ void hv_ringbuffer_cleanup(struct hv_ring_buffer_info *ring_info);
+
+-int hv_ringbuffer_write(struct hv_ring_buffer_info *ring_info,
++int hv_ringbuffer_write(struct vmbus_channel *channel,
+ struct kvec *kv_list,
+- u32 kv_count, bool *signal, bool lock,
+- enum hv_signal_policy policy);
++ u32 kv_count, bool lock,
++ bool kick_q);
+
+-int hv_ringbuffer_read(struct hv_ring_buffer_info *inring_info,
++int hv_ringbuffer_read(struct vmbus_channel *channel,
+ void *buffer, u32 buflen, u32 *buffer_actual_len,
+- u64 *requestid, bool *signal, bool raw);
++ u64 *requestid, bool raw);
+
+ void hv_ringbuffer_get_debuginfo(struct hv_ring_buffer_info *ring_info,
+ struct hv_ring_buffer_debug_info *debug_info);
+diff --git a/drivers/hv/ring_buffer.c b/drivers/hv/ring_buffer.c
+index 08043da..308dbda 100644
+--- a/drivers/hv/ring_buffer.c
++++ b/drivers/hv/ring_buffer.c
+@@ -66,21 +66,25 @@ u32 hv_end_read(struct hv_ring_buffer_info *rbi)
+ * once the ring buffer is empty, it will clear the
+ * interrupt_mask and re-check to see if new data has
+ * arrived.
++ *
++ * KYS: Oct. 30, 2016:
++ * It looks like Windows hosts have logic to deal with DOS attacks that
++ * can be triggered if it receives interrupts when it is not expecting
++ * the interrupt. The host expects interrupts only when the ring
++ * transitions from empty to non-empty (or full to non full on the guest
++ * to host ring).
++ * So, base the signaling decision solely on the ring state until the
++ * host logic is fixed.
+ */
+
+-static bool hv_need_to_signal(u32 old_write, struct hv_ring_buffer_info *rbi,
+- enum hv_signal_policy policy)
++static void hv_signal_on_write(u32 old_write, struct vmbus_channel *channel,
++ bool kick_q)
+ {
++ struct hv_ring_buffer_info *rbi = &channel->outbound;
++
+ virt_mb();
+ if (READ_ONCE(rbi->ring_buffer->interrupt_mask))
+- return false;
+-
+- /*
+- * When the client wants to control signaling,
+- * we only honour the host interrupt mask.
+- */
+- if (policy == HV_SIGNAL_POLICY_EXPLICIT)
+- return true;
++ return;
+
+ /* check interrupt_mask before read_index */
+ virt_rmb();
+@@ -89,9 +93,9 @@ static bool hv_need_to_signal(u32 old_write, struct hv_ring_buffer_info *rbi,
+ * ring transitions from being empty to non-empty.
+ */
+ if (old_write == READ_ONCE(rbi->ring_buffer->read_index))
+- return true;
++ vmbus_setevent(channel);
+
+- return false;
++ return;
+ }
+
+ /* Get the next write location for the specified ring buffer. */
+@@ -280,9 +284,9 @@ void hv_ringbuffer_cleanup(struct hv_ring_buffer_info *ring_info)
+ }
+
+ /* Write to the ring buffer. */
+-int hv_ringbuffer_write(struct hv_ring_buffer_info *outring_info,
+- struct kvec *kv_list, u32 kv_count, bool *signal, bool lock,
+- enum hv_signal_policy policy)
++int hv_ringbuffer_write(struct vmbus_channel *channel,
++ struct kvec *kv_list, u32 kv_count, bool lock,
++ bool kick_q)
+ {
+ int i = 0;
+ u32 bytes_avail_towrite;
+@@ -292,6 +296,7 @@ int hv_ringbuffer_write(struct hv_ring_buffer_info *outring_info,
+ u32 old_write;
+ u64 prev_indices = 0;
+ unsigned long flags = 0;
++ struct hv_ring_buffer_info *outring_info = &channel->outbound;
+
+ for (i = 0; i < kv_count; i++)
+ totalbytes_towrite += kv_list[i].iov_len;
+@@ -344,13 +349,13 @@ int hv_ringbuffer_write(struct hv_ring_buffer_info *outring_info,
+ if (lock)
+ spin_unlock_irqrestore(&outring_info->ring_lock, flags);
+
+- *signal = hv_need_to_signal(old_write, outring_info, policy);
++ hv_signal_on_write(old_write, channel, kick_q);
+ return 0;
+ }
+
+-int hv_ringbuffer_read(struct hv_ring_buffer_info *inring_info,
++int hv_ringbuffer_read(struct vmbus_channel *channel,
+ void *buffer, u32 buflen, u32 *buffer_actual_len,
+- u64 *requestid, bool *signal, bool raw)
++ u64 *requestid, bool raw)
+ {
+ u32 bytes_avail_toread;
+ u32 next_read_location = 0;
+@@ -359,6 +364,7 @@ int hv_ringbuffer_read(struct hv_ring_buffer_info *inring_info,
+ u32 offset;
+ u32 packetlen;
+ int ret = 0;
++ struct hv_ring_buffer_info *inring_info = &channel->inbound;
+
+ if (buflen <= 0)
+ return -EINVAL;
+@@ -377,6 +383,7 @@ int hv_ringbuffer_read(struct hv_ring_buffer_info *inring_info,
+ return ret;
+ }
+
++ init_cached_read_index(channel);
+ next_read_location = hv_get_next_read_location(inring_info);
+ next_read_location = hv_copyfrom_ringbuffer(inring_info, &desc,
+ sizeof(desc),
+@@ -416,7 +423,7 @@ int hv_ringbuffer_read(struct hv_ring_buffer_info *inring_info,
+ /* Update the read index */
+ hv_set_next_read_location(inring_info, next_read_location);
+
+- *signal = hv_need_to_signal_on_read(inring_info);
++ hv_signal_on_read(channel);
+
+ return ret;
+ }
+diff --git a/drivers/infiniband/sw/rxe/rxe_mr.c b/drivers/infiniband/sw/rxe/rxe_mr.c
+index 1869152..9b732c5 100644
+--- a/drivers/infiniband/sw/rxe/rxe_mr.c
++++ b/drivers/infiniband/sw/rxe/rxe_mr.c
+@@ -59,9 +59,11 @@ int mem_check_range(struct rxe_mem *mem, u64 iova, size_t length)
+
+ case RXE_MEM_TYPE_MR:
+ case RXE_MEM_TYPE_FMR:
+- return ((iova < mem->iova) ||
+- ((iova + length) > (mem->iova + mem->length))) ?
+- -EFAULT : 0;
++ if (iova < mem->iova ||
++ length > mem->length ||
++ iova > mem->iova + mem->length - length)
++ return -EFAULT;
++ return 0;
+
+ default:
+ return -EFAULT;
+diff --git a/drivers/infiniband/sw/rxe/rxe_resp.c b/drivers/infiniband/sw/rxe/rxe_resp.c
+index dd3d88a..ccf6247 100644
+--- a/drivers/infiniband/sw/rxe/rxe_resp.c
++++ b/drivers/infiniband/sw/rxe/rxe_resp.c
+@@ -472,7 +472,7 @@ static enum resp_states check_rkey(struct rxe_qp *qp,
+ goto err2;
+ }
+
+- resid = mtu;
++ qp->resp.resid = mtu;
+ } else {
+ if (pktlen != resid) {
+ state = RESPST_ERR_LENGTH;
+diff --git a/drivers/input/misc/uinput.c b/drivers/input/misc/uinput.c
+index 92595b9..022be0e 100644
+--- a/drivers/input/misc/uinput.c
++++ b/drivers/input/misc/uinput.c
+@@ -263,13 +263,21 @@ static int uinput_create_device(struct uinput_device *udev)
+ return -EINVAL;
+ }
+
+- if (test_bit(ABS_MT_SLOT, dev->absbit)) {
+- nslot = input_abs_get_max(dev, ABS_MT_SLOT) + 1;
+- error = input_mt_init_slots(dev, nslot, 0);
+- if (error)
++ if (test_bit(EV_ABS, dev->evbit)) {
++ input_alloc_absinfo(dev);
++ if (!dev->absinfo) {
++ error = -EINVAL;
+ goto fail1;
+- } else if (test_bit(ABS_MT_POSITION_X, dev->absbit)) {
+- input_set_events_per_packet(dev, 60);
++ }
++
++ if (test_bit(ABS_MT_SLOT, dev->absbit)) {
++ nslot = input_abs_get_max(dev, ABS_MT_SLOT) + 1;
++ error = input_mt_init_slots(dev, nslot, 0);
++ if (error)
++ goto fail1;
++ } else if (test_bit(ABS_MT_POSITION_X, dev->absbit)) {
++ input_set_events_per_packet(dev, 60);
++ }
+ }
+
+ if (test_bit(EV_FF, dev->evbit) && !udev->ff_effects_max) {
+diff --git a/drivers/md/dm-rq.c b/drivers/md/dm-rq.c
+index 31a89c8..2c96542 100644
+--- a/drivers/md/dm-rq.c
++++ b/drivers/md/dm-rq.c
+@@ -804,6 +804,10 @@ static void dm_old_request_fn(struct request_queue *q)
+ int srcu_idx;
+ struct dm_table *map = dm_get_live_table(md, &srcu_idx);
+
++ if (unlikely(!map)) {
++ dm_put_live_table(md, srcu_idx);
++ return;
++ }
+ ti = dm_table_find_target(map, pos);
+ dm_put_live_table(md, srcu_idx);
+ }
+diff --git a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_reg.h b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_reg.h
+index 878950a..2cf8b1d 100644
+--- a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_reg.h
++++ b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_reg.h
+@@ -1007,9 +1007,7 @@
+
+ static inline void dsaf_write_reg(void __iomem *base, u32 reg, u32 value)
+ {
+- u8 __iomem *reg_addr = ACCESS_ONCE(base);
+-
+- writel(value, reg_addr + reg);
++ writel(value, base + reg);
+ }
+
+ #define dsaf_write_dev(a, reg, value) \
+@@ -1017,9 +1015,7 @@ static inline void dsaf_write_reg(void __iomem *base, u32 reg, u32 value)
+
+ static inline u32 dsaf_read_reg(u8 __iomem *base, u32 reg)
+ {
+- u8 __iomem *reg_addr = ACCESS_ONCE(base);
+-
+- return readl(reg_addr + reg);
++ return readl(base + reg);
+ }
+
+ static inline void dsaf_write_syscon(struct regmap *base, u32 reg, u32 value)
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c b/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c
+index 27ff401..51c6a57 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c
+@@ -991,6 +991,7 @@ static int mlx5e_set_rxfh(struct net_device *dev, const u32 *indir,
+ {
+ struct mlx5e_priv *priv = netdev_priv(dev);
+ int inlen = MLX5_ST_SZ_BYTES(modify_tir_in);
++ bool hash_changed = false;
+ void *in;
+
+ if ((hfunc != ETH_RSS_HASH_NO_CHANGE) &&
+@@ -1012,14 +1013,21 @@ static int mlx5e_set_rxfh(struct net_device *dev, const u32 *indir,
+ mlx5e_redirect_rqt(priv, rqtn, MLX5E_INDIR_RQT_SIZE, 0);
+ }
+
+- if (key)
++ if (hfunc != ETH_RSS_HASH_NO_CHANGE &&
++ hfunc != priv->params.rss_hfunc) {
++ priv->params.rss_hfunc = hfunc;
++ hash_changed = true;
++ }
++
++ if (key) {
+ memcpy(priv->params.toeplitz_hash_key, key,
+ sizeof(priv->params.toeplitz_hash_key));
++ hash_changed = hash_changed ||
++ priv->params.rss_hfunc == ETH_RSS_HASH_TOP;
++ }
+
+- if (hfunc != ETH_RSS_HASH_NO_CHANGE)
+- priv->params.rss_hfunc = hfunc;
+-
+- mlx5e_modify_tirs_hash(priv, in, inlen);
++ if (hash_changed)
++ mlx5e_modify_tirs_hash(priv, in, inlen);
+
+ mutex_unlock(&priv->state_lock);
+
+diff --git a/drivers/net/hyperv/netvsc.c b/drivers/net/hyperv/netvsc.c
+index 720b5fa..c2ac39a 100644
+--- a/drivers/net/hyperv/netvsc.c
++++ b/drivers/net/hyperv/netvsc.c
+@@ -1288,6 +1288,9 @@ void netvsc_channel_cb(void *context)
+ ndev = hv_get_drvdata(device);
+ buffer = get_per_channel_state(channel);
+
++ /* commit_rd_index() -> hv_signal_on_read() needs this. */
++ init_cached_read_index(channel);
++
+ do {
+ desc = get_next_pkt_raw(channel);
+ if (desc != NULL) {
+@@ -1340,6 +1343,9 @@ void netvsc_channel_cb(void *context)
+
+ bufferlen = bytes_recvd;
+ }
++
++ init_cached_read_index(channel);
++
+ } while (1);
+
+ if (bufferlen > NETVSC_PACKET_SIZE)
+diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8192ce/sw.c b/drivers/net/wireless/realtek/rtlwifi/rtl8192ce/sw.c
+index 8b6e37c..20bfb37 100644
+--- a/drivers/net/wireless/realtek/rtlwifi/rtl8192ce/sw.c
++++ b/drivers/net/wireless/realtek/rtlwifi/rtl8192ce/sw.c
+@@ -96,7 +96,7 @@ int rtl92c_init_sw_vars(struct ieee80211_hw *hw)
+ struct rtl_priv *rtlpriv = rtl_priv(hw);
+ struct rtl_pci *rtlpci = rtl_pcidev(rtl_pcipriv(hw));
+ struct rtl_hal *rtlhal = rtl_hal(rtl_priv(hw));
+- char *fw_name = "rtlwifi/rtl8192cfwU.bin";
++ char *fw_name;
+
+ rtl8192ce_bt_reg_init(hw);
+
+@@ -168,8 +168,13 @@ int rtl92c_init_sw_vars(struct ieee80211_hw *hw)
+ }
+
+ /* request fw */
+- if (IS_81XXC_VENDOR_UMC_B_CUT(rtlhal->version))
++ if (IS_VENDOR_UMC_A_CUT(rtlhal->version) &&
++ !IS_92C_SERIAL(rtlhal->version))
++ fw_name = "rtlwifi/rtl8192cfwU.bin";
++ else if (IS_81XXC_VENDOR_UMC_B_CUT(rtlhal->version))
+ fw_name = "rtlwifi/rtl8192cfwU_B.bin";
++ else
++ fw_name = "rtlwifi/rtl8192cfw.bin";
+
+ rtlpriv->max_fw_size = 0x4000;
+ pr_info("Using firmware %s\n", fw_name);
+diff --git a/drivers/net/xen-netfront.c b/drivers/net/xen-netfront.c
+index bf2744e..0cdcb21 100644
+--- a/drivers/net/xen-netfront.c
++++ b/drivers/net/xen-netfront.c
+@@ -1397,6 +1397,8 @@ static void xennet_disconnect_backend(struct netfront_info *info)
+ for (i = 0; i < num_queues && info->queues; ++i) {
+ struct netfront_queue *queue = &info->queues[i];
+
++ del_timer_sync(&queue->rx_refill_timer);
++
+ if (queue->tx_irq && (queue->tx_irq == queue->rx_irq))
+ unbind_from_irqhandler(queue->tx_irq, queue);
+ if (queue->tx_irq && (queue->tx_irq != queue->rx_irq)) {
+@@ -1751,7 +1753,6 @@ static void xennet_destroy_queues(struct netfront_info *info)
+
+ if (netif_running(info->netdev))
+ napi_disable(&queue->napi);
+- del_timer_sync(&queue->rx_refill_timer);
+ netif_napi_del(&queue->napi);
+ }
+
+diff --git a/drivers/nvdimm/namespace_devs.c b/drivers/nvdimm/namespace_devs.c
+index 1480734..aefca64 100644
+--- a/drivers/nvdimm/namespace_devs.c
++++ b/drivers/nvdimm/namespace_devs.c
+@@ -962,8 +962,8 @@ static ssize_t __size_store(struct device *dev, unsigned long long val)
+ struct nvdimm_drvdata *ndd;
+ struct nd_label_id label_id;
+ u32 flags = 0, remainder;
++ int rc, i, id = -1;
+ u8 *uuid = NULL;
+- int rc, i;
+
+ if (dev->driver || ndns->claim)
+ return -EBUSY;
+@@ -972,11 +972,13 @@ static ssize_t __size_store(struct device *dev, unsigned long long val)
+ struct nd_namespace_pmem *nspm = to_nd_namespace_pmem(dev);
+
+ uuid = nspm->uuid;
++ id = nspm->id;
+ } else if (is_namespace_blk(dev)) {
+ struct nd_namespace_blk *nsblk = to_nd_namespace_blk(dev);
+
+ uuid = nsblk->uuid;
+ flags = NSLABEL_FLAG_LOCAL;
++ id = nsblk->id;
+ }
+
+ /*
+@@ -1039,10 +1041,11 @@ static ssize_t __size_store(struct device *dev, unsigned long long val)
+
+ /*
+ * Try to delete the namespace if we deleted all of its
+- * allocation, this is not the seed device for the region, and
+- * it is not actively claimed by a btt instance.
++ * allocation, this is not the seed or 0th device for the
++ * region, and it is not actively claimed by a btt, pfn, or dax
++ * instance.
+ */
+- if (val == 0 && nd_region->ns_seed != dev && !ndns->claim)
++ if (val == 0 && id != 0 && nd_region->ns_seed != dev && !ndns->claim)
+ nd_device_unregister(dev, ND_ASYNC);
+
+ return rc;
+diff --git a/drivers/nvdimm/pfn_devs.c b/drivers/nvdimm/pfn_devs.c
+index a2ac9e6..6c033c9 100644
+--- a/drivers/nvdimm/pfn_devs.c
++++ b/drivers/nvdimm/pfn_devs.c
+@@ -627,15 +627,12 @@ static int nd_pfn_init(struct nd_pfn *nd_pfn)
+ size = resource_size(&nsio->res);
+ npfns = (size - start_pad - end_trunc - SZ_8K) / SZ_4K;
+ if (nd_pfn->mode == PFN_MODE_PMEM) {
+- unsigned long memmap_size;
+-
+ /*
+ * vmemmap_populate_hugepages() allocates the memmap array in
+ * HPAGE_SIZE chunks.
+ */
+- memmap_size = ALIGN(64 * npfns, HPAGE_SIZE);
+- offset = ALIGN(start + SZ_8K + memmap_size + dax_label_reserve,
+- nd_pfn->align) - start;
++ offset = ALIGN(start + SZ_8K + 64 * npfns + dax_label_reserve,
++ max(nd_pfn->align, HPAGE_SIZE)) - start;
+ } else if (nd_pfn->mode == PFN_MODE_RAM)
+ offset = ALIGN(start + SZ_8K + dax_label_reserve,
+ nd_pfn->align) - start;
+diff --git a/drivers/s390/scsi/zfcp_fsf.c b/drivers/s390/scsi/zfcp_fsf.c
+index 75f820ca..27ff38f 100644
+--- a/drivers/s390/scsi/zfcp_fsf.c
++++ b/drivers/s390/scsi/zfcp_fsf.c
+@@ -1583,7 +1583,7 @@ static void zfcp_fsf_open_wka_port_handler(struct zfcp_fsf_req *req)
+ int zfcp_fsf_open_wka_port(struct zfcp_fc_wka_port *wka_port)
+ {
+ struct zfcp_qdio *qdio = wka_port->adapter->qdio;
+- struct zfcp_fsf_req *req = NULL;
++ struct zfcp_fsf_req *req;
+ int retval = -EIO;
+
+ spin_lock_irq(&qdio->req_q_lock);
+@@ -1612,7 +1612,7 @@ int zfcp_fsf_open_wka_port(struct zfcp_fc_wka_port *wka_port)
+ zfcp_fsf_req_free(req);
+ out:
+ spin_unlock_irq(&qdio->req_q_lock);
+- if (req && !IS_ERR(req))
++ if (!retval)
+ zfcp_dbf_rec_run_wka("fsowp_1", wka_port, req->req_id);
+ return retval;
+ }
+@@ -1638,7 +1638,7 @@ static void zfcp_fsf_close_wka_port_handler(struct zfcp_fsf_req *req)
+ int zfcp_fsf_close_wka_port(struct zfcp_fc_wka_port *wka_port)
+ {
+ struct zfcp_qdio *qdio = wka_port->adapter->qdio;
+- struct zfcp_fsf_req *req = NULL;
++ struct zfcp_fsf_req *req;
+ int retval = -EIO;
+
+ spin_lock_irq(&qdio->req_q_lock);
+@@ -1667,7 +1667,7 @@ int zfcp_fsf_close_wka_port(struct zfcp_fc_wka_port *wka_port)
+ zfcp_fsf_req_free(req);
+ out:
+ spin_unlock_irq(&qdio->req_q_lock);
+- if (req && !IS_ERR(req))
++ if (!retval)
+ zfcp_dbf_rec_run_wka("fscwp_1", wka_port, req->req_id);
+ return retval;
+ }
+diff --git a/drivers/scsi/aacraid/comminit.c b/drivers/scsi/aacraid/comminit.c
+index 341ea32..792d3e7 100644
+--- a/drivers/scsi/aacraid/comminit.c
++++ b/drivers/scsi/aacraid/comminit.c
+@@ -50,9 +50,13 @@ struct aac_common aac_config = {
+
+ static inline int aac_is_msix_mode(struct aac_dev *dev)
+ {
+- u32 status;
++ u32 status = 0;
+
+- status = src_readl(dev, MUnit.OMR);
++ if (dev->pdev->device == PMC_DEVICE_S6 ||
++ dev->pdev->device == PMC_DEVICE_S7 ||
++ dev->pdev->device == PMC_DEVICE_S8) {
++ status = src_readl(dev, MUnit.OMR);
++ }
+ return (status & AAC_INT_MODE_MSIX);
+ }
+
+diff --git a/drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c b/drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c
+index e3b911c..91dfd58 100644
+--- a/drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c
++++ b/drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c
+@@ -3929,6 +3929,7 @@ static struct configfs_attribute *ibmvscsis_tpg_attrs[] = {
+ static const struct target_core_fabric_ops ibmvscsis_ops = {
+ .module = THIS_MODULE,
+ .name = "ibmvscsis",
++ .max_data_sg_nents = MAX_TXU / PAGE_SIZE,
+ .get_fabric_name = ibmvscsis_get_fabric_name,
+ .tpg_get_wwn = ibmvscsis_get_fabric_wwn,
+ .tpg_get_tag = ibmvscsis_get_tag,
+diff --git a/drivers/scsi/mpt3sas/mpt3sas_scsih.c b/drivers/scsi/mpt3sas/mpt3sas_scsih.c
+index f84a608..8a7941b 100644
+--- a/drivers/scsi/mpt3sas/mpt3sas_scsih.c
++++ b/drivers/scsi/mpt3sas/mpt3sas_scsih.c
+@@ -51,6 +51,7 @@
+ #include <linux/workqueue.h>
+ #include <linux/delay.h>
+ #include <linux/pci.h>
++#include <linux/pci-aspm.h>
+ #include <linux/interrupt.h>
+ #include <linux/aer.h>
+ #include <linux/raid_class.h>
+@@ -8706,6 +8707,8 @@ _scsih_probe(struct pci_dev *pdev, const struct pci_device_id *id)
+
+ switch (hba_mpi_version) {
+ case MPI2_VERSION:
++ pci_disable_link_state(pdev, PCIE_LINK_STATE_L0S |
++ PCIE_LINK_STATE_L1 | PCIE_LINK_STATE_CLKPM);
+ /* Use mpt2sas driver host template for SAS 2.0 HBA's */
+ shost = scsi_host_alloc(&mpt2sas_driver_template,
+ sizeof(struct MPT3SAS_ADAPTER));
+diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c
+index 078d797..bea819e 100644
+--- a/drivers/scsi/qla2xxx/qla_os.c
++++ b/drivers/scsi/qla2xxx/qla_os.c
+@@ -1459,7 +1459,7 @@ qla2x00_abort_all_cmds(scsi_qla_host_t *vha, int res)
+ /* Don't abort commands in adapter during EEH
+ * recovery as it's not accessible/responding.
+ */
+- if (!ha->flags.eeh_busy) {
++ if (GET_CMD_SP(sp) && !ha->flags.eeh_busy) {
+ /* Get a reference to the sp and drop the lock.
+ * The reference ensures this sp->done() call
+ * - and not the call in qla2xxx_eh_abort() -
+diff --git a/drivers/target/target_core_device.c b/drivers/target/target_core_device.c
+index 6b42348..ea9617c 100644
+--- a/drivers/target/target_core_device.c
++++ b/drivers/target/target_core_device.c
+@@ -351,7 +351,15 @@ int core_enable_device_list_for_node(
+ kfree(new);
+ return -EINVAL;
+ }
+- BUG_ON(orig->se_lun_acl != NULL);
++ if (orig->se_lun_acl != NULL) {
++ pr_warn_ratelimited("Detected existing explicit"
++ " se_lun_acl->se_lun_group reference for %s"
++ " mapped_lun: %llu, failing\n",
++ nacl->initiatorname, mapped_lun);
++ mutex_unlock(&nacl->lun_entry_mutex);
++ kfree(new);
++ return -EINVAL;
++ }
+
+ rcu_assign_pointer(new->se_lun, lun);
+ rcu_assign_pointer(new->se_lun_acl, lun_acl);
+diff --git a/drivers/target/target_core_sbc.c b/drivers/target/target_core_sbc.c
+index 04f616b..aabd660 100644
+--- a/drivers/target/target_core_sbc.c
++++ b/drivers/target/target_core_sbc.c
+@@ -450,6 +450,7 @@ static sense_reason_t compare_and_write_post(struct se_cmd *cmd, bool success,
+ int *post_ret)
+ {
+ struct se_device *dev = cmd->se_dev;
++ sense_reason_t ret = TCM_NO_SENSE;
+
+ /*
+ * Only set SCF_COMPARE_AND_WRITE_POST to force a response fall-through
+@@ -457,9 +458,12 @@ static sense_reason_t compare_and_write_post(struct se_cmd *cmd, bool success,
+ * sent to the backend driver.
+ */
+ spin_lock_irq(&cmd->t_state_lock);
+- if ((cmd->transport_state & CMD_T_SENT) && !cmd->scsi_status) {
++ if (cmd->transport_state & CMD_T_SENT) {
+ cmd->se_cmd_flags |= SCF_COMPARE_AND_WRITE_POST;
+ *post_ret = 1;
++
++ if (cmd->scsi_status == SAM_STAT_CHECK_CONDITION)
++ ret = TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE;
+ }
+ spin_unlock_irq(&cmd->t_state_lock);
+
+@@ -469,7 +473,7 @@ static sense_reason_t compare_and_write_post(struct se_cmd *cmd, bool success,
+ */
+ up(&dev->caw_sem);
+
+- return TCM_NO_SENSE;
++ return ret;
+ }
+
+ static sense_reason_t compare_and_write_callback(struct se_cmd *cmd, bool success,
+diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c
+index 7dfefd6..767d1eb6 100644
+--- a/drivers/target/target_core_transport.c
++++ b/drivers/target/target_core_transport.c
+@@ -457,8 +457,20 @@ static void target_complete_nacl(struct kref *kref)
+ {
+ struct se_node_acl *nacl = container_of(kref,
+ struct se_node_acl, acl_kref);
++ struct se_portal_group *se_tpg = nacl->se_tpg;
+
+- complete(&nacl->acl_free_comp);
++ if (!nacl->dynamic_stop) {
++ complete(&nacl->acl_free_comp);
++ return;
++ }
++
++ mutex_lock(&se_tpg->acl_node_mutex);
++ list_del(&nacl->acl_list);
++ mutex_unlock(&se_tpg->acl_node_mutex);
++
++ core_tpg_wait_for_nacl_pr_ref(nacl);
++ core_free_device_list_for_node(nacl, se_tpg);
++ kfree(nacl);
+ }
+
+ void target_put_nacl(struct se_node_acl *nacl)
+@@ -499,12 +511,39 @@ EXPORT_SYMBOL(transport_deregister_session_configfs);
+ void transport_free_session(struct se_session *se_sess)
+ {
+ struct se_node_acl *se_nacl = se_sess->se_node_acl;
++
+ /*
+ * Drop the se_node_acl->nacl_kref obtained from within
+ * core_tpg_get_initiator_node_acl().
+ */
+ if (se_nacl) {
++ struct se_portal_group *se_tpg = se_nacl->se_tpg;
++ const struct target_core_fabric_ops *se_tfo = se_tpg->se_tpg_tfo;
++ unsigned long flags;
++
+ se_sess->se_node_acl = NULL;
++
++ /*
++ * Also determine if we need to drop the extra ->cmd_kref if
++ * it had been previously dynamically generated, and
++ * the endpoint is not caching dynamic ACLs.
++ */
++ mutex_lock(&se_tpg->acl_node_mutex);
++ if (se_nacl->dynamic_node_acl &&
++ !se_tfo->tpg_check_demo_mode_cache(se_tpg)) {
++ spin_lock_irqsave(&se_nacl->nacl_sess_lock, flags);
++ if (list_empty(&se_nacl->acl_sess_list))
++ se_nacl->dynamic_stop = true;
++ spin_unlock_irqrestore(&se_nacl->nacl_sess_lock, flags);
++
++ if (se_nacl->dynamic_stop)
++ list_del(&se_nacl->acl_list);
++ }
++ mutex_unlock(&se_tpg->acl_node_mutex);
++
++ if (se_nacl->dynamic_stop)
++ target_put_nacl(se_nacl);
++
+ target_put_nacl(se_nacl);
+ }
+ if (se_sess->sess_cmd_map) {
+@@ -518,16 +557,12 @@ EXPORT_SYMBOL(transport_free_session);
+ void transport_deregister_session(struct se_session *se_sess)
+ {
+ struct se_portal_group *se_tpg = se_sess->se_tpg;
+- const struct target_core_fabric_ops *se_tfo;
+- struct se_node_acl *se_nacl;
+ unsigned long flags;
+- bool drop_nacl = false;
+
+ if (!se_tpg) {
+ transport_free_session(se_sess);
+ return;
+ }
+- se_tfo = se_tpg->se_tpg_tfo;
+
+ spin_lock_irqsave(&se_tpg->session_lock, flags);
+ list_del(&se_sess->sess_list);
+@@ -535,33 +570,15 @@ void transport_deregister_session(struct se_session *se_sess)
+ se_sess->fabric_sess_ptr = NULL;
+ spin_unlock_irqrestore(&se_tpg->session_lock, flags);
+
+- /*
+- * Determine if we need to do extra work for this initiator node's
+- * struct se_node_acl if it had been previously dynamically generated.
+- */
+- se_nacl = se_sess->se_node_acl;
+-
+- mutex_lock(&se_tpg->acl_node_mutex);
+- if (se_nacl && se_nacl->dynamic_node_acl) {
+- if (!se_tfo->tpg_check_demo_mode_cache(se_tpg)) {
+- list_del(&se_nacl->acl_list);
+- drop_nacl = true;
+- }
+- }
+- mutex_unlock(&se_tpg->acl_node_mutex);
+-
+- if (drop_nacl) {
+- core_tpg_wait_for_nacl_pr_ref(se_nacl);
+- core_free_device_list_for_node(se_nacl, se_tpg);
+- se_sess->se_node_acl = NULL;
+- kfree(se_nacl);
+- }
+ pr_debug("TARGET_CORE[%s]: Deregistered fabric_sess\n",
+ se_tpg->se_tpg_tfo->get_fabric_name());
+ /*
+ * If last kref is dropping now for an explicit NodeACL, awake sleeping
+ * ->acl_free_comp caller to wakeup configfs se_node_acl->acl_group
+ * removal context from within transport_free_session() code.
++ *
++ * For dynamic ACL, target_put_nacl() uses target_complete_nacl()
++ * to release all remaining generate_node_acl=1 created ACL resources.
+ */
+
+ transport_free_session(se_sess);
+@@ -3086,7 +3103,6 @@ static void target_tmr_work(struct work_struct *work)
+ spin_unlock_irqrestore(&cmd->t_state_lock, flags);
+ goto check_stop;
+ }
+- cmd->t_state = TRANSPORT_ISTATE_PROCESSING;
+ spin_unlock_irqrestore(&cmd->t_state_lock, flags);
+
+ cmd->se_tfo->queue_tm_rsp(cmd);
+@@ -3099,11 +3115,25 @@ int transport_generic_handle_tmr(
+ struct se_cmd *cmd)
+ {
+ unsigned long flags;
++ bool aborted = false;
+
+ spin_lock_irqsave(&cmd->t_state_lock, flags);
+- cmd->transport_state |= CMD_T_ACTIVE;
++ if (cmd->transport_state & CMD_T_ABORTED) {
++ aborted = true;
++ } else {
++ cmd->t_state = TRANSPORT_ISTATE_PROCESSING;
++ cmd->transport_state |= CMD_T_ACTIVE;
++ }
+ spin_unlock_irqrestore(&cmd->t_state_lock, flags);
+
++ if (aborted) {
++ pr_warn_ratelimited("handle_tmr caught CMD_T_ABORTED TMR %d"
++ "ref_tag: %llu tag: %llu\n", cmd->se_tmr_req->function,
++ cmd->se_tmr_req->ref_task_tag, cmd->tag);
++ transport_cmd_check_stop_to_fabric(cmd);
++ return 0;
++ }
++
+ INIT_WORK(&cmd->work, target_tmr_work);
+ queue_work(cmd->se_dev->tmr_wq, &cmd->work);
+ return 0;
+diff --git a/drivers/target/target_core_xcopy.c b/drivers/target/target_core_xcopy.c
+index 094a144..18848ba 100644
+--- a/drivers/target/target_core_xcopy.c
++++ b/drivers/target/target_core_xcopy.c
+@@ -836,7 +836,7 @@ static void target_xcopy_do_work(struct work_struct *work)
+ " CHECK_CONDITION -> sending response\n", rc);
+ ec_cmd->scsi_status = SAM_STAT_CHECK_CONDITION;
+ }
+- target_complete_cmd(ec_cmd, SAM_STAT_CHECK_CONDITION);
++ target_complete_cmd(ec_cmd, ec_cmd->scsi_status);
+ }
+
+ sense_reason_t target_do_xcopy(struct se_cmd *se_cmd)
+diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
+index 7acbd2c..1782804 100644
+--- a/fs/btrfs/ioctl.c
++++ b/fs/btrfs/ioctl.c
+@@ -5648,6 +5648,10 @@ long btrfs_ioctl(struct file *file, unsigned int
+ #ifdef CONFIG_COMPAT
+ long btrfs_compat_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
+ {
++ /*
++ * These all access 32-bit values anyway so no further
++ * handling is necessary.
++ */
+ switch (cmd) {
+ case FS_IOC32_GETFLAGS:
+ cmd = FS_IOC_GETFLAGS;
+@@ -5658,8 +5662,6 @@ long btrfs_compat_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
+ case FS_IOC32_GETVERSION:
+ cmd = FS_IOC_GETVERSION;
+ break;
+- default:
+- return -ENOIOCTLCMD;
+ }
+
+ return btrfs_ioctl(file, cmd, (unsigned long) compat_ptr(arg));
+diff --git a/include/linux/cpumask.h b/include/linux/cpumask.h
+index da7fbf1..fa3b155 100644
+--- a/include/linux/cpumask.h
++++ b/include/linux/cpumask.h
+@@ -560,7 +560,7 @@ static inline void cpumask_copy(struct cpumask *dstp,
+ static inline int cpumask_parse_user(const char __user *buf, int len,
+ struct cpumask *dstp)
+ {
+- return bitmap_parse_user(buf, len, cpumask_bits(dstp), nr_cpu_ids);
++ return bitmap_parse_user(buf, len, cpumask_bits(dstp), nr_cpumask_bits);
+ }
+
+ /**
+@@ -575,7 +575,7 @@ static inline int cpumask_parselist_user(const char __user *buf, int len,
+ struct cpumask *dstp)
+ {
+ return bitmap_parselist_user(buf, len, cpumask_bits(dstp),
+- nr_cpu_ids);
++ nr_cpumask_bits);
+ }
+
+ /**
+@@ -590,7 +590,7 @@ static inline int cpumask_parse(const char *buf, struct cpumask *dstp)
+ char *nl = strchr(buf, '\n');
+ unsigned int len = nl ? (unsigned int)(nl - buf) : strlen(buf);
+
+- return bitmap_parse(buf, len, cpumask_bits(dstp), nr_cpu_ids);
++ return bitmap_parse(buf, len, cpumask_bits(dstp), nr_cpumask_bits);
+ }
+
+ /**
+@@ -602,7 +602,7 @@ static inline int cpumask_parse(const char *buf, struct cpumask *dstp)
+ */
+ static inline int cpulist_parse(const char *buf, struct cpumask *dstp)
+ {
+- return bitmap_parselist(buf, cpumask_bits(dstp), nr_cpu_ids);
++ return bitmap_parselist(buf, cpumask_bits(dstp), nr_cpumask_bits);
+ }
+
+ /**
+diff --git a/include/linux/hyperv.h b/include/linux/hyperv.h
+index cd184bd..c92a083 100644
+--- a/include/linux/hyperv.h
++++ b/include/linux/hyperv.h
+@@ -128,6 +128,7 @@ struct hv_ring_buffer_info {
+ u32 ring_data_startoffset;
+ u32 priv_write_index;
+ u32 priv_read_index;
++ u32 cached_read_index;
+ };
+
+ /*
+@@ -180,6 +181,19 @@ static inline u32 hv_get_bytes_to_write(struct hv_ring_buffer_info *rbi)
+ return write;
+ }
+
++static inline u32 hv_get_cached_bytes_to_write(
++ const struct hv_ring_buffer_info *rbi)
++{
++ u32 read_loc, write_loc, dsize, write;
++
++ dsize = rbi->ring_datasize;
++ read_loc = rbi->cached_read_index;
++ write_loc = rbi->ring_buffer->write_index;
++
++ write = write_loc >= read_loc ? dsize - (write_loc - read_loc) :
++ read_loc - write_loc;
++ return write;
++}
+ /*
+ * VMBUS version is 32 bit entity broken up into
+ * two 16 bit quantities: major_number. minor_number.
+@@ -1447,6 +1461,7 @@ void hv_event_tasklet_enable(struct vmbus_channel *channel);
+
+ void hv_process_channel_removal(struct vmbus_channel *channel, u32 relid);
+
++void vmbus_setevent(struct vmbus_channel *channel);
+ /*
+ * Negotiated version with the Host.
+ */
+@@ -1479,10 +1494,11 @@ hv_get_ring_buffer(struct hv_ring_buffer_info *ring_info)
+ * there is room for the producer to send the pending packet.
+ */
+
+-static inline bool hv_need_to_signal_on_read(struct hv_ring_buffer_info *rbi)
++static inline void hv_signal_on_read(struct vmbus_channel *channel)
+ {
+- u32 cur_write_sz;
++ u32 cur_write_sz, cached_write_sz;
+ u32 pending_sz;
++ struct hv_ring_buffer_info *rbi = &channel->inbound;
+
+ /*
+ * Issue a full memory barrier before making the signaling decision.
+@@ -1500,14 +1516,26 @@ static inline bool hv_need_to_signal_on_read(struct hv_ring_buffer_info *rbi)
+ pending_sz = READ_ONCE(rbi->ring_buffer->pending_send_sz);
+ /* If the other end is not blocked on write don't bother. */
+ if (pending_sz == 0)
+- return false;
++ return;
+
+ cur_write_sz = hv_get_bytes_to_write(rbi);
+
+- if (cur_write_sz >= pending_sz)
+- return true;
++ if (cur_write_sz < pending_sz)
++ return;
++
++ cached_write_sz = hv_get_cached_bytes_to_write(rbi);
++ if (cached_write_sz < pending_sz)
++ vmbus_setevent(channel);
++
++ return;
++}
++
++static inline void
++init_cached_read_index(struct vmbus_channel *channel)
++{
++ struct hv_ring_buffer_info *rbi = &channel->inbound;
+
+- return false;
++ rbi->cached_read_index = rbi->ring_buffer->read_index;
+ }
+
+ /*
+@@ -1571,6 +1599,8 @@ static inline void put_pkt_raw(struct vmbus_channel *channel,
+ * This call commits the read index and potentially signals the host.
+ * Here is the pattern for using the "in-place" consumption APIs:
+ *
++ * init_cached_read_index();
++ *
+ * while (get_next_pkt_raw() {
+ * process the packet "in-place";
+ * put_pkt_raw();
+@@ -1589,8 +1619,7 @@ static inline void commit_rd_index(struct vmbus_channel *channel)
+ virt_rmb();
+ ring_info->ring_buffer->read_index = ring_info->priv_read_index;
+
+- if (hv_need_to_signal_on_read(ring_info))
+- vmbus_set_event(channel);
++ hv_signal_on_read(channel);
+ }
+
+
+diff --git a/include/target/target_core_base.h b/include/target/target_core_base.h
+index c211900..48bc1ac 100644
+--- a/include/target/target_core_base.h
++++ b/include/target/target_core_base.h
+@@ -538,6 +538,7 @@ struct se_node_acl {
+ char initiatorname[TRANSPORT_IQN_LEN];
+ /* Used to signal demo mode created ACL, disabled by default */
+ bool dynamic_node_acl;
++ bool dynamic_stop;
+ u32 queue_depth;
+ u32 acl_index;
+ enum target_prot_type saved_prot_type;
+diff --git a/kernel/events/core.c b/kernel/events/core.c
+index b1cfd74..4b33231 100644
+--- a/kernel/events/core.c
++++ b/kernel/events/core.c
+@@ -3461,14 +3461,15 @@ struct perf_read_data {
+ int ret;
+ };
+
+-static int find_cpu_to_read(struct perf_event *event, int local_cpu)
++static int __perf_event_read_cpu(struct perf_event *event, int event_cpu)
+ {
+- int event_cpu = event->oncpu;
+ u16 local_pkg, event_pkg;
+
+ if (event->group_caps & PERF_EV_CAP_READ_ACTIVE_PKG) {
+- event_pkg = topology_physical_package_id(event_cpu);
+- local_pkg = topology_physical_package_id(local_cpu);
++ int local_cpu = smp_processor_id();
++
++ event_pkg = topology_physical_package_id(event_cpu);
++ local_pkg = topology_physical_package_id(local_cpu);
+
+ if (event_pkg == local_pkg)
+ return local_cpu;
+@@ -3598,7 +3599,7 @@ u64 perf_event_read_local(struct perf_event *event)
+
+ static int perf_event_read(struct perf_event *event, bool group)
+ {
+- int ret = 0, cpu_to_read, local_cpu;
++ int event_cpu, ret = 0;
+
+ /*
+ * If event is enabled and currently active on a CPU, update the
+@@ -3611,21 +3612,25 @@ static int perf_event_read(struct perf_event *event, bool group)
+ .ret = 0,
+ };
+
+- local_cpu = get_cpu();
+- cpu_to_read = find_cpu_to_read(event, local_cpu);
+- put_cpu();
++ event_cpu = READ_ONCE(event->oncpu);
++ if ((unsigned)event_cpu >= nr_cpu_ids)
++ return 0;
++
++ preempt_disable();
++ event_cpu = __perf_event_read_cpu(event, event_cpu);
+
+ /*
+ * Purposely ignore the smp_call_function_single() return
+ * value.
+ *
+- * If event->oncpu isn't a valid CPU it means the event got
++ * If event_cpu isn't a valid CPU it means the event got
+ * scheduled out and that will have updated the event count.
+ *
+ * Therefore, either way, we'll have an up-to-date event count
+ * after this.
+ */
+- (void)smp_call_function_single(cpu_to_read, __perf_event_read, &data, 1);
++ (void)smp_call_function_single(event_cpu, __perf_event_read, &data, 1);
++ preempt_enable();
+ ret = data.ret;
+ } else if (event->state == PERF_EVENT_STATE_INACTIVE) {
+ struct perf_event_context *ctx = event->ctx;
+diff --git a/kernel/stacktrace.c b/kernel/stacktrace.c
+index b6e4c16..9c15a91 100644
+--- a/kernel/stacktrace.c
++++ b/kernel/stacktrace.c
+@@ -18,10 +18,8 @@ void print_stack_trace(struct stack_trace *trace, int spaces)
+ if (WARN_ON(!trace->entries))
+ return;
+
+- for (i = 0; i < trace->nr_entries; i++) {
+- printk("%*c", 1 + spaces, ' ');
+- print_ip_sym(trace->entries[i]);
+- }
++ for (i = 0; i < trace->nr_entries; i++)
++ printk("%*c%pS\n", 1 + spaces, ' ', (void *)trace->entries[i]);
+ }
+ EXPORT_SYMBOL_GPL(print_stack_trace);
+
+@@ -29,7 +27,6 @@ int snprint_stack_trace(char *buf, size_t size,
+ struct stack_trace *trace, int spaces)
+ {
+ int i;
+- unsigned long ip;
+ int generated;
+ int total = 0;
+
+@@ -37,9 +34,8 @@ int snprint_stack_trace(char *buf, size_t size,
+ return 0;
+
+ for (i = 0; i < trace->nr_entries; i++) {
+- ip = trace->entries[i];
+- generated = snprintf(buf, size, "%*c[<%p>] %pS\n",
+- 1 + spaces, ' ', (void *) ip, (void *) ip);
++ generated = snprintf(buf, size, "%*c%pS\n", 1 + spaces, ' ',
++ (void *)trace->entries[i]);
+
+ total += generated;
+
+diff --git a/mm/slub.c b/mm/slub.c
+index 2b3e740..7aa0e97 100644
+--- a/mm/slub.c
++++ b/mm/slub.c
+@@ -1419,6 +1419,10 @@ static int init_cache_random_seq(struct kmem_cache *s)
+ int err;
+ unsigned long i, count = oo_objects(s->oo);
+
++ /* Bailout if already initialised */
++ if (s->random_seq)
++ return 0;
++
+ err = cache_random_seq_create(s, count, GFP_KERNEL);
+ if (err) {
+ pr_err("SLUB: Unable to initialize free list for %s\n",
+diff --git a/net/mac80211/mesh.c b/net/mac80211/mesh.c
+index 42120d9..50e1b7f 100644
+--- a/net/mac80211/mesh.c
++++ b/net/mac80211/mesh.c
+@@ -339,7 +339,7 @@ int mesh_add_vendor_ies(struct ieee80211_sub_if_data *sdata,
+ /* fast-forward to vendor IEs */
+ offset = ieee80211_ie_split_vendor(ifmsh->ie, ifmsh->ie_len, 0);
+
+- if (offset) {
++ if (offset < ifmsh->ie_len) {
+ len = ifmsh->ie_len - offset;
+ data = ifmsh->ie + offset;
+ if (skb_tailroom(skb) < len)
+diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
+index 1b3c18c..cd7a419 100644
+--- a/net/wireless/nl80211.c
++++ b/net/wireless/nl80211.c
+@@ -5874,6 +5874,7 @@ do { \
+ break;
+ }
+ cfg->ht_opmode = ht_opmode;
++ mask |= (1 << (NL80211_MESHCONF_HT_OPMODE - 1));
+ }
+ FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathToRootTimeout,
+ 1, 65535, mask,
+diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
+index 09fd610..c2da45a 100644
+--- a/security/selinux/hooks.c
++++ b/security/selinux/hooks.c
+@@ -5858,7 +5858,7 @@ static int selinux_setprocattr(struct task_struct *p,
+ return error;
+
+ /* Obtain a SID for the context, if one was specified. */
+- if (size && str[1] && str[1] != '\n') {
++ if (size && str[0] && str[0] != '\n') {
+ if (str[size-1] == '\n') {
+ str[size-1] = 0;
+ size--;
+diff --git a/sound/core/seq/seq_memory.c b/sound/core/seq/seq_memory.c
+index c850345..dfa5156 100644
+--- a/sound/core/seq/seq_memory.c
++++ b/sound/core/seq/seq_memory.c
+@@ -419,7 +419,6 @@ int snd_seq_pool_done(struct snd_seq_pool *pool)
+ {
+ unsigned long flags;
+ struct snd_seq_event_cell *ptr;
+- int max_count = 5 * HZ;
+
+ if (snd_BUG_ON(!pool))
+ return -EINVAL;
+@@ -432,14 +431,8 @@ int snd_seq_pool_done(struct snd_seq_pool *pool)
+ if (waitqueue_active(&pool->output_sleep))
+ wake_up(&pool->output_sleep);
+
+- while (atomic_read(&pool->counter) > 0) {
+- if (max_count == 0) {
+- pr_warn("ALSA: snd_seq_pool_done timeout: %d cells remain\n", atomic_read(&pool->counter));
+- break;
+- }
++ while (atomic_read(&pool->counter) > 0)
+ schedule_timeout_uninterruptible(1);
+- max_count--;
+- }
+
+ /* release all resources */
+ spin_lock_irqsave(&pool->lock, flags);
+diff --git a/sound/core/seq/seq_queue.c b/sound/core/seq/seq_queue.c
+index 0bec02e..450c518 100644
+--- a/sound/core/seq/seq_queue.c
++++ b/sound/core/seq/seq_queue.c
+@@ -181,6 +181,8 @@ void __exit snd_seq_queues_delete(void)
+ }
+ }
+
++static void queue_use(struct snd_seq_queue *queue, int client, int use);
++
+ /* allocate a new queue -
+ * return queue index value or negative value for error
+ */
+@@ -192,11 +194,11 @@ int snd_seq_queue_alloc(int client, int locked, unsigned int info_flags)
+ if (q == NULL)
+ return -ENOMEM;
+ q->info_flags = info_flags;
++ queue_use(q, client, 1);
+ if (queue_list_add(q) < 0) {
+ queue_delete(q);
+ return -ENOMEM;
+ }
+- snd_seq_queue_use(q->queue, client, 1); /* use this queue */
+ return q->queue;
+ }
+
+@@ -502,19 +504,9 @@ int snd_seq_queue_timer_set_tempo(int queueid, int client,
+ return result;
+ }
+
+-
+-/* use or unuse this queue -
+- * if it is the first client, starts the timer.
+- * if it is not longer used by any clients, stop the timer.
+- */
+-int snd_seq_queue_use(int queueid, int client, int use)
++/* use or unuse this queue */
++static void queue_use(struct snd_seq_queue *queue, int client, int use)
+ {
+- struct snd_seq_queue *queue;
+-
+- queue = queueptr(queueid);
+- if (queue == NULL)
+- return -EINVAL;
+- mutex_lock(&queue->timer_mutex);
+ if (use) {
+ if (!test_and_set_bit(client, queue->clients_bitmap))
+ queue->clients++;
+@@ -529,6 +521,21 @@ int snd_seq_queue_use(int queueid, int client, int use)
+ } else {
+ snd_seq_timer_close(queue);
+ }
++}
++
++/* use or unuse this queue -
++ * if it is the first client, starts the timer.
++ * if it is not longer used by any clients, stop the timer.
++ */
++int snd_seq_queue_use(int queueid, int client, int use)
++{
++ struct snd_seq_queue *queue;
++
++ queue = queueptr(queueid);
++ if (queue == NULL)
++ return -EINVAL;
++ mutex_lock(&queue->timer_mutex);
++ queue_use(queue, client, use);
+ mutex_unlock(&queue->timer_mutex);
+ queuefree(queue);
+ return 0;
+diff --git a/sound/pci/hda/patch_hdmi.c b/sound/pci/hda/patch_hdmi.c
+index 56e5204..4bf4833 100644
+--- a/sound/pci/hda/patch_hdmi.c
++++ b/sound/pci/hda/patch_hdmi.c
+@@ -3638,6 +3638,7 @@ HDA_CODEC_ENTRY(0x10de0070, "GPU 70 HDMI/DP", patch_nvhdmi),
+ HDA_CODEC_ENTRY(0x10de0071, "GPU 71 HDMI/DP", patch_nvhdmi),
+ HDA_CODEC_ENTRY(0x10de0072, "GPU 72 HDMI/DP", patch_nvhdmi),
+ HDA_CODEC_ENTRY(0x10de007d, "GPU 7d HDMI/DP", patch_nvhdmi),
++HDA_CODEC_ENTRY(0x10de0080, "GPU 80 HDMI/DP", patch_nvhdmi),
+ HDA_CODEC_ENTRY(0x10de0082, "GPU 82 HDMI/DP", patch_nvhdmi),
+ HDA_CODEC_ENTRY(0x10de0083, "GPU 83 HDMI/DP", patch_nvhdmi),
+ HDA_CODEC_ENTRY(0x10de8001, "MCP73 HDMI", patch_nvhdmi_2ch),
+diff --git a/sound/usb/line6/driver.c b/sound/usb/line6/driver.c
+index 90009c0..ab3c280 100644
+--- a/sound/usb/line6/driver.c
++++ b/sound/usb/line6/driver.c
+@@ -754,8 +754,9 @@ int line6_probe(struct usb_interface *interface,
+ goto error;
+ }
+
++ line6_get_interval(line6);
++
+ if (properties->capabilities & LINE6_CAP_CONTROL) {
+- line6_get_interval(line6);
+ ret = line6_init_cap_control(line6);
+ if (ret < 0)
+ goto error;
+diff --git a/tools/perf/builtin-diff.c b/tools/perf/builtin-diff.c
+index 9ff0db4..933aeec 100644
+--- a/tools/perf/builtin-diff.c
++++ b/tools/perf/builtin-diff.c
+@@ -1199,7 +1199,7 @@ static int ui_init(void)
+ BUG_ON(1);
+ }
+
+- perf_hpp__register_sort_field(fmt);
++ perf_hpp__prepend_sort_field(fmt);
+ return 0;
+ }
+
+diff --git a/tools/perf/ui/hist.c b/tools/perf/ui/hist.c
+index 3738839..18cfcdc9 100644
+--- a/tools/perf/ui/hist.c
++++ b/tools/perf/ui/hist.c
+@@ -521,6 +521,12 @@ void perf_hpp_list__register_sort_field(struct perf_hpp_list *list,
+ list_add_tail(&format->sort_list, &list->sorts);
+ }
+
++void perf_hpp_list__prepend_sort_field(struct perf_hpp_list *list,
++ struct perf_hpp_fmt *format)
++{
++ list_add(&format->sort_list, &list->sorts);
++}
++
+ void perf_hpp__column_unregister(struct perf_hpp_fmt *format)
+ {
+ list_del(&format->list);
+@@ -560,6 +566,10 @@ void perf_hpp__setup_output_field(struct perf_hpp_list *list)
+ perf_hpp_list__for_each_sort_list(list, fmt) {
+ struct perf_hpp_fmt *pos;
+
++ /* skip sort-only fields ("sort_compute" in perf diff) */
++ if (!fmt->entry && !fmt->color)
++ continue;
++
+ perf_hpp_list__for_each_format(list, pos) {
+ if (fmt_equal(fmt, pos))
+ goto next;
+diff --git a/tools/perf/util/hist.h b/tools/perf/util/hist.h
+index 9928fed..a440a04 100644
+--- a/tools/perf/util/hist.h
++++ b/tools/perf/util/hist.h
+@@ -282,6 +282,8 @@ void perf_hpp_list__column_register(struct perf_hpp_list *list,
+ struct perf_hpp_fmt *format);
+ void perf_hpp_list__register_sort_field(struct perf_hpp_list *list,
+ struct perf_hpp_fmt *format);
++void perf_hpp_list__prepend_sort_field(struct perf_hpp_list *list,
++ struct perf_hpp_fmt *format);
+
+ static inline void perf_hpp__column_register(struct perf_hpp_fmt *format)
+ {
+@@ -293,6 +295,11 @@ static inline void perf_hpp__register_sort_field(struct perf_hpp_fmt *format)
+ perf_hpp_list__register_sort_field(&perf_hpp_list, format);
+ }
+
++static inline void perf_hpp__prepend_sort_field(struct perf_hpp_fmt *format)
++{
++ perf_hpp_list__prepend_sort_field(&perf_hpp_list, format);
++}
++
+ #define perf_hpp_list__for_each_format(_list, format) \
+ list_for_each_entry(format, &(_list)->fields, list)
+
diff --git a/4.9.9/4420_grsecurity-3.1-4.9.9-201702122044.patch b/4.9.10/4420_grsecurity-3.1-4.9.10-201702162016.patch
index 32e3834..ef4d7f3 100644
--- a/4.9.9/4420_grsecurity-3.1-4.9.9-201702122044.patch
+++ b/4.9.10/4420_grsecurity-3.1-4.9.10-201702162016.patch
@@ -419,7 +419,7 @@ index 3d0ae15..84e5412 100644
cmd_syscalls = $(CONFIG_SHELL) $< $(CC) $(c_flags) $(missing_syscalls_flags)
diff --git a/Makefile b/Makefile
-index c0c41c9..630adc4 100644
+index d2fe757..92fd198 100644
--- a/Makefile
+++ b/Makefile
@@ -302,7 +302,9 @@ CONFIG_SHELL := $(shell if [ -x "$$BASH" ]; then echo $$BASH; \
@@ -3161,7 +3161,7 @@ index 91d2d5b..042c26e 100644
}
#endif
diff --git a/arch/arm/kernel/ptrace.c b/arch/arm/kernel/ptrace.c
-index ce131ed..26f9765 100644
+index ae738a6..ee4d46f 100644
--- a/arch/arm/kernel/ptrace.c
+++ b/arch/arm/kernel/ptrace.c
@@ -928,10 +928,19 @@ static void tracehook_report_syscall(struct pt_regs *regs,
@@ -3938,7 +3938,7 @@ index c8c8b9e..c55cc79 100644
atomic64_set(&mm->context.id, asid);
}
diff --git a/arch/arm/mm/fault.c b/arch/arm/mm/fault.c
-index 3a2e678..ebdbf80 100644
+index 0122ad1..1aae1cb 100644
--- a/arch/arm/mm/fault.c
+++ b/arch/arm/mm/fault.c
@@ -25,6 +25,7 @@
@@ -4172,7 +4172,7 @@ index 3a2e678..ebdbf80 100644
inf->name, ifsr, addr);
diff --git a/arch/arm/mm/fault.h b/arch/arm/mm/fault.h
-index 67532f2..10b646e 100644
+index afc1f84..b1daab5 100644
--- a/arch/arm/mm/fault.h
+++ b/arch/arm/mm/fault.h
@@ -3,6 +3,7 @@
@@ -4183,7 +4183,7 @@ index 67532f2..10b646e 100644
*/
#define FSR_LNX_PF (1 << 31)
#define FSR_WRITE (1 << 11)
-@@ -22,6 +23,17 @@ static inline int fsr_fs(unsigned int fsr)
+@@ -26,6 +27,17 @@ static inline int fsr_fs(unsigned int fsr)
}
#endif
@@ -9234,7 +9234,7 @@ index 4ba26dd..2d1137d 100644
#define PAGE_KERNEL_RO __pgprot(_PAGE_BASE | _PAGE_KERNEL_RO)
#define PAGE_KERNEL_ROX __pgprot(_PAGE_BASE | _PAGE_KERNEL_ROX)
diff --git a/arch/powerpc/include/asm/reg.h b/arch/powerpc/include/asm/reg.h
-index 9e1499f..4e03a24 100644
+index 13f5fad..6ec27c3 100644
--- a/arch/powerpc/include/asm/reg.h
+++ b/arch/powerpc/include/asm/reg.h
@@ -270,6 +270,7 @@
@@ -26426,10 +26426,10 @@ index 17f2186..f394307 100644
/*
diff --git a/arch/x86/include/asm/processor.h b/arch/x86/include/asm/processor.h
-index 984a7bf..c3e410d 100644
+index 83db0ea..137bc2c 100644
--- a/arch/x86/include/asm/processor.h
+++ b/arch/x86/include/asm/processor.h
-@@ -135,7 +135,7 @@ struct cpuinfo_x86 {
+@@ -136,7 +136,7 @@ struct cpuinfo_x86 {
/* Index into per_cpu list: */
u16 cpu_index;
u32 microcode;
@@ -26438,7 +26438,7 @@ index 984a7bf..c3e410d 100644
#define X86_VENDOR_INTEL 0
#define X86_VENDOR_CYRIX 1
-@@ -159,7 +159,7 @@ extern __u32 cpu_caps_cleared[NCAPINTS];
+@@ -160,7 +160,7 @@ extern __u32 cpu_caps_cleared[NCAPINTS];
extern __u32 cpu_caps_set[NCAPINTS];
#ifdef CONFIG_SMP
@@ -26447,7 +26447,7 @@ index 984a7bf..c3e410d 100644
#define cpu_data(cpu) per_cpu(cpu_info, cpu)
#else
#define cpu_info boot_cpu_data
-@@ -205,9 +205,21 @@ static inline void native_cpuid(unsigned int *eax, unsigned int *ebx,
+@@ -206,9 +206,21 @@ static inline void native_cpuid(unsigned int *eax, unsigned int *ebx,
: "memory");
}
@@ -26470,7 +26470,7 @@ index 984a7bf..c3e410d 100644
}
#ifdef CONFIG_X86_32
-@@ -307,11 +319,9 @@ struct tss_struct {
+@@ -308,11 +320,9 @@ struct tss_struct {
} ____cacheline_aligned;
@@ -26483,7 +26483,7 @@ index 984a7bf..c3e410d 100644
/*
* Save the original ist values for checking stack pointers during debugging
-@@ -340,6 +350,7 @@ DECLARE_PER_CPU_FIRST(union irq_stack_union, irq_stack_union) __visible;
+@@ -341,6 +351,7 @@ DECLARE_PER_CPU_FIRST(union irq_stack_union, irq_stack_union) __visible;
DECLARE_INIT_PER_CPU(irq_stack_union);
DECLARE_PER_CPU(char *, irq_stack_ptr);
@@ -26491,7 +26491,7 @@ index 984a7bf..c3e410d 100644
DECLARE_PER_CPU(unsigned int, irq_count);
extern asmlinkage void ignore_sysret(void);
#else /* X86_64 */
-@@ -388,6 +399,7 @@ struct thread_struct {
+@@ -389,6 +400,7 @@ struct thread_struct {
unsigned short ds;
unsigned short fsindex;
unsigned short gsindex;
@@ -26499,7 +26499,7 @@ index 984a7bf..c3e410d 100644
#endif
u32 status; /* thread synchronous flags */
-@@ -404,6 +416,9 @@ struct thread_struct {
+@@ -405,6 +417,9 @@ struct thread_struct {
unsigned long gs;
#endif
@@ -26509,7 +26509,7 @@ index 984a7bf..c3e410d 100644
/* Save middle states of ptrace breakpoints */
struct perf_event *ptrace_bps[HBP_NUM];
/* Debug status used for traps, single steps, etc... */
-@@ -425,17 +440,11 @@ struct thread_struct {
+@@ -426,17 +441,11 @@ struct thread_struct {
unsigned io_bitmap_max;
mm_segment_t addr_limit;
@@ -26529,7 +26529,7 @@ index 984a7bf..c3e410d 100644
/*
* Thread-synchronous status.
-@@ -487,12 +496,8 @@ static inline void native_swapgs(void)
+@@ -488,12 +497,8 @@ static inline void native_swapgs(void)
static inline unsigned long current_top_of_stack(void)
{
@@ -26542,7 +26542,7 @@ index 984a7bf..c3e410d 100644
}
#ifdef CONFIG_PARAVIRT
-@@ -717,20 +722,30 @@ static inline void spin_lock_prefetch(const void *x)
+@@ -718,20 +723,30 @@ static inline void spin_lock_prefetch(const void *x)
#define TOP_OF_INIT_STACK ((unsigned long)&init_stack + sizeof(init_stack) - \
TOP_OF_KERNEL_STACK_PADDING)
@@ -26574,7 +26574,7 @@ index 984a7bf..c3e410d 100644
}
/*
-@@ -743,12 +758,7 @@ static inline void spin_lock_prefetch(const void *x)
+@@ -744,12 +759,7 @@ static inline void spin_lock_prefetch(const void *x)
* "struct pt_regs" is possible, but they may contain the
* completely wrong values.
*/
@@ -26588,7 +26588,7 @@ index 984a7bf..c3e410d 100644
#define KSTK_ESP(task) (task_pt_regs(task)->sp)
-@@ -762,13 +772,13 @@ static inline void spin_lock_prefetch(const void *x)
+@@ -763,13 +773,13 @@ static inline void spin_lock_prefetch(const void *x)
* particular problem by preventing anything from being mapped
* at the maximum canonical address.
*/
@@ -26604,7 +26604,7 @@ index 984a7bf..c3e410d 100644
#define TASK_SIZE (test_thread_flag(TIF_ADDR32) ? \
IA32_PAGE_OFFSET : TASK_SIZE_MAX)
-@@ -781,6 +791,7 @@ static inline void spin_lock_prefetch(const void *x)
+@@ -782,6 +792,7 @@ static inline void spin_lock_prefetch(const void *x)
#define INIT_THREAD { \
.sp0 = TOP_OF_INIT_STACK, \
.addr_limit = KERNEL_DS, \
@@ -26612,7 +26612,7 @@ index 984a7bf..c3e410d 100644
}
#define task_pt_regs(tsk) ((struct pt_regs *)(tsk)->thread.sp0 - 1)
-@@ -799,6 +810,10 @@ extern void start_thread(struct pt_regs *regs, unsigned long new_ip,
+@@ -800,6 +811,10 @@ extern void start_thread(struct pt_regs *regs, unsigned long new_ip,
*/
#define TASK_UNMAPPED_BASE (PAGE_ALIGN(TASK_SIZE / 3))
@@ -26623,7 +26623,7 @@ index 984a7bf..c3e410d 100644
#define KSTK_EIP(task) (task_pt_regs(task)->ip)
/* Get/set a process' ability to use the timestamp counter instruction */
-@@ -844,7 +859,7 @@ static inline uint32_t hypervisor_cpuid_base(const char *sig, uint32_t leaves)
+@@ -845,7 +860,7 @@ static inline uint32_t hypervisor_cpuid_base(const char *sig, uint32_t leaves)
return 0;
}
@@ -26632,7 +26632,7 @@ index 984a7bf..c3e410d 100644
extern void free_init_pages(char *what, unsigned long begin, unsigned long end);
void default_idle(void);
-@@ -854,6 +869,6 @@ bool xen_set_default_idle(void);
+@@ -855,6 +870,6 @@ bool xen_set_default_idle(void);
#define xen_set_default_idle 0
#endif
@@ -29131,7 +29131,7 @@ index f223491..9083344 100644
apic_printk(APIC_DEBUG, KERN_DEBUG "APIC error on CPU%d: %02x",
smp_processor_id(), v);
diff --git a/arch/x86/kernel/apic/io_apic.c b/arch/x86/kernel/apic/io_apic.c
-index 7249f15..8e941bd 100644
+index d1e2556..2f6454d 100644
--- a/arch/x86/kernel/apic/io_apic.c
+++ b/arch/x86/kernel/apic/io_apic.c
@@ -1683,7 +1683,7 @@ static unsigned int startup_ioapic_irq(struct irq_data *data)
@@ -29161,7 +29161,7 @@ index 7249f15..8e941bd 100644
.name = "IO-APIC",
.irq_startup = startup_ioapic_irq,
.irq_mask = mask_ioapic_irq,
-@@ -1880,7 +1880,7 @@ static struct irq_chip ioapic_chip __read_mostly = {
+@@ -1879,7 +1879,7 @@ static struct irq_chip ioapic_chip __read_mostly = {
.flags = IRQCHIP_SKIP_SET_WAKE,
};
@@ -29170,7 +29170,7 @@ index 7249f15..8e941bd 100644
.name = "IR-IO-APIC",
.irq_startup = startup_ioapic_irq,
.irq_mask = mask_ioapic_irq,
-@@ -1939,7 +1939,7 @@ static void ack_lapic_irq(struct irq_data *data)
+@@ -1937,7 +1937,7 @@ static void ack_lapic_irq(struct irq_data *data)
ack_APIC_irq();
}
@@ -29377,10 +29377,10 @@ index 4a8697f..8a13428 100644
obj-y += common.o
obj-y += rdrand.o
diff --git a/arch/x86/kernel/cpu/amd.c b/arch/x86/kernel/cpu/amd.c
-index 1d31672..542cba3 100644
+index 2b4cf04..c73b25e 100644
--- a/arch/x86/kernel/cpu/amd.c
+++ b/arch/x86/kernel/cpu/amd.c
-@@ -794,7 +794,7 @@ static void init_amd(struct cpuinfo_x86 *c)
+@@ -808,7 +808,7 @@ static void init_amd(struct cpuinfo_x86 *c)
static unsigned int amd_size_cache(struct cpuinfo_x86 *c, unsigned int size)
{
/* AMD errata T13 (order #21922) */
@@ -29410,7 +29410,7 @@ index a972ac4..938c163 100644
/*
diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c
-index 023c7bf..1ce29b3 100644
+index 4eece91..9eeb03b 100644
--- a/arch/x86/kernel/cpu/common.c
+++ b/arch/x86/kernel/cpu/common.c
@@ -93,60 +93,6 @@ static const struct cpu_dev default_cpu = {
@@ -29616,7 +29616,7 @@ index 023c7bf..1ce29b3 100644
}
}
-@@ -1063,6 +1118,20 @@ static void identify_cpu(struct cpuinfo_x86 *c)
+@@ -1064,6 +1119,20 @@ static void identify_cpu(struct cpuinfo_x86 *c)
setup_smep(c);
setup_smap(c);
@@ -29637,7 +29637,7 @@ index 023c7bf..1ce29b3 100644
/*
* The vendor-specific functions might have changed features.
* Now we do "generic changes."
-@@ -1108,10 +1177,14 @@ static void identify_cpu(struct cpuinfo_x86 *c)
+@@ -1109,10 +1178,14 @@ static void identify_cpu(struct cpuinfo_x86 *c)
* executed, c == &boot_cpu_data.
*/
if (c != &boot_cpu_data) {
@@ -29652,7 +29652,7 @@ index 023c7bf..1ce29b3 100644
/* OR, i.e. replicate the bug flags */
for (i = NCAPINTS; i < NCAPINTS + NBUGINTS; i++)
c->x86_capability[i] |= boot_cpu_data.x86_capability[i];
-@@ -1141,7 +1214,7 @@ void enable_sep_cpu(void)
+@@ -1142,7 +1215,7 @@ void enable_sep_cpu(void)
return;
cpu = get_cpu();
@@ -29661,7 +29661,7 @@ index 023c7bf..1ce29b3 100644
/*
* We cache MSR_IA32_SYSENTER_CS's value in the TSS's ss1 field --
-@@ -1307,6 +1380,8 @@ EXPORT_PER_CPU_SYMBOL(current_task);
+@@ -1308,6 +1381,8 @@ EXPORT_PER_CPU_SYMBOL(current_task);
DEFINE_PER_CPU(char *, irq_stack_ptr) =
init_per_cpu_var(irq_stack_union.irq_stack) + IRQ_STACK_SIZE;
@@ -29670,7 +29670,7 @@ index 023c7bf..1ce29b3 100644
DEFINE_PER_CPU(unsigned int, irq_count) __visible = -1;
-@@ -1399,21 +1474,21 @@ EXPORT_PER_CPU_SYMBOL(current_task);
+@@ -1400,21 +1475,21 @@ EXPORT_PER_CPU_SYMBOL(current_task);
DEFINE_PER_CPU(int, __preempt_count) = INIT_PREEMPT_COUNT;
EXPORT_PER_CPU_SYMBOL(__preempt_count);
@@ -29699,7 +29699,7 @@ index 023c7bf..1ce29b3 100644
/*
* Clear all 6 debug registers:
*/
-@@ -1489,7 +1564,7 @@ void cpu_init(void)
+@@ -1490,7 +1565,7 @@ void cpu_init(void)
*/
load_ucode_ap();
@@ -29708,7 +29708,7 @@ index 023c7bf..1ce29b3 100644
oist = &per_cpu(orig_ist, cpu);
#ifdef CONFIG_NUMA
-@@ -1521,7 +1596,6 @@ void cpu_init(void)
+@@ -1522,7 +1597,6 @@ void cpu_init(void)
wrmsrl(MSR_KERNEL_GS_BASE, 0);
barrier();
@@ -29716,7 +29716,7 @@ index 023c7bf..1ce29b3 100644
x2apic_setup();
/*
-@@ -1573,7 +1647,7 @@ void cpu_init(void)
+@@ -1574,7 +1648,7 @@ void cpu_init(void)
{
int cpu = smp_processor_id();
struct task_struct *curr = current;
@@ -34538,7 +34538,7 @@ index c00cb64..73f6b30 100644
.smp_prepare_cpus = native_smp_prepare_cpus,
.smp_cpus_done = native_smp_cpus_done,
diff --git a/arch/x86/kernel/smpboot.c b/arch/x86/kernel/smpboot.c
-index e9bbe02..aaaed9d 100644
+index 36171bc..e32a454 100644
--- a/arch/x86/kernel/smpboot.c
+++ b/arch/x86/kernel/smpboot.c
@@ -94,7 +94,7 @@ EXPORT_PER_CPU_SYMBOL(cpu_core_map);
@@ -34572,7 +34572,7 @@ index e9bbe02..aaaed9d 100644
/*
* Check TSC synchronization with the BP:
*/
-@@ -925,13 +928,11 @@ void common_cpu_up(unsigned int cpu, struct task_struct *idle)
+@@ -931,13 +934,11 @@ void common_cpu_up(unsigned int cpu, struct task_struct *idle)
per_cpu(current_task, cpu) = idle;
#ifdef CONFIG_X86_32
@@ -34587,7 +34587,7 @@ index e9bbe02..aaaed9d 100644
}
/*
-@@ -952,9 +953,11 @@ static int do_boot_cpu(int apicid, int cpu, struct task_struct *idle)
+@@ -958,9 +959,11 @@ static int do_boot_cpu(int apicid, int cpu, struct task_struct *idle)
unsigned long timeout;
idle->thread.sp = (unsigned long) (((struct pt_regs *)
@@ -34600,7 +34600,7 @@ index e9bbe02..aaaed9d 100644
initial_code = (unsigned long)start_secondary;
initial_stack = idle->thread.sp;
-@@ -1102,6 +1105,15 @@ int native_cpu_up(unsigned int cpu, struct task_struct *tidle)
+@@ -1108,6 +1111,15 @@ int native_cpu_up(unsigned int cpu, struct task_struct *tidle)
common_cpu_up(cpu, tidle);
@@ -37310,10 +37310,18 @@ index 9b33024..cdbc725 100644
ENDPROC(this_cpu_cmpxchg16b_emu)
diff --git a/arch/x86/lib/cmpxchg8b_emu.S b/arch/x86/lib/cmpxchg8b_emu.S
-index 03a186f..34c859b 100644
+index 03a186f..6793bf2 100644
--- a/arch/x86/lib/cmpxchg8b_emu.S
+++ b/arch/x86/lib/cmpxchg8b_emu.S
-@@ -38,7 +38,7 @@ ENTRY(cmpxchg8b_emu)
+@@ -8,6 +8,7 @@
+
+ #include <linux/linkage.h>
+ #include <asm/export.h>
++#include <asm/alternative-asm.h>
+
+ .text
+
+@@ -38,7 +39,7 @@ ENTRY(cmpxchg8b_emu)
movl %ecx, 4(%esi)
popfl
@@ -37322,7 +37330,7 @@ index 03a186f..34c859b 100644
.Lnot_same:
movl (%esi), %eax
-@@ -46,7 +46,7 @@ ENTRY(cmpxchg8b_emu)
+@@ -46,7 +47,7 @@ ENTRY(cmpxchg8b_emu)
movl 4(%esi), %edx
popfl
@@ -40044,10 +40052,10 @@ index 96d2b84..b3db380 100644
+CFLAGS_uderef_64.o := -fcall-saved-rax -fcall-saved-rdi -fcall-saved-rsi -fcall-saved-rdx -fcall-saved-rcx -fcall-saved-r8 -fcall-saved-r9 -fcall-saved-r10 -fcall-saved-r11
+
diff --git a/arch/x86/mm/dump_pagetables.c b/arch/x86/mm/dump_pagetables.c
-index ea9c49a..7ab033a 100644
+index 8aa6bea..1181e44 100644
--- a/arch/x86/mm/dump_pagetables.c
+++ b/arch/x86/mm/dump_pagetables.c
-@@ -27,6 +27,7 @@
+@@ -28,6 +28,7 @@
struct pg_state {
int level;
pgprot_t current_prot;
@@ -40055,7 +40063,7 @@ index ea9c49a..7ab033a 100644
unsigned long start_address;
unsigned long current_address;
const struct addr_marker *marker;
-@@ -184,6 +185,23 @@ static unsigned long normalize_addr(unsigned long u)
+@@ -185,6 +186,23 @@ static unsigned long normalize_addr(unsigned long u)
#endif
}
@@ -40079,7 +40087,7 @@ index ea9c49a..7ab033a 100644
/*
* This function gets called on a break in a continuous series
* of PTE entries; the next one is different so we need to
-@@ -200,11 +218,13 @@ static void note_page(struct seq_file *m, struct pg_state *st,
+@@ -201,11 +219,13 @@ static void note_page(struct seq_file *m, struct pg_state *st,
* we have now. "break" is either changing perms, levels or
* address space marker.
*/
@@ -40093,7 +40101,7 @@ index ea9c49a..7ab033a 100644
st->current_prot = new_prot;
st->level = level;
st->marker = address_markers;
-@@ -216,9 +236,8 @@ static void note_page(struct seq_file *m, struct pg_state *st,
+@@ -217,9 +237,8 @@ static void note_page(struct seq_file *m, struct pg_state *st,
const char *unit = units;
unsigned long delta;
int width = sizeof(unsigned long) * 2;
@@ -40104,7 +40112,7 @@ index ea9c49a..7ab033a 100644
WARN_ONCE(1,
"x86/mm: Found insecure W+X mapping at address %p/%pS\n",
(void *)st->start_address,
-@@ -304,9 +323,10 @@ static void walk_pmd_level(struct seq_file *m, struct pg_state *st, pud_t addr,
+@@ -305,9 +324,10 @@ static void walk_pmd_level(struct seq_file *m, struct pg_state *st, pud_t addr,
start = (pmd_t *) pud_page_vaddr(addr);
for (i = 0; i < PTRS_PER_PMD; i++) {
st->current_address = normalize_addr(P + i * PMD_LEVEL_MULT);
@@ -40116,7 +40124,7 @@ index ea9c49a..7ab033a 100644
note_page(m, st, __pgprot(prot), 3);
} else {
walk_pte_level(m, st, *start,
-@@ -337,9 +357,10 @@ static void walk_pud_level(struct seq_file *m, struct pg_state *st, pgd_t addr,
+@@ -338,9 +358,10 @@ static void walk_pud_level(struct seq_file *m, struct pg_state *st, pgd_t addr,
for (i = 0; i < PTRS_PER_PUD; i++) {
st->current_address = normalize_addr(P + i * PUD_LEVEL_MULT);
@@ -40128,7 +40136,7 @@ index ea9c49a..7ab033a 100644
note_page(m, st, __pgprot(prot), 2);
} else {
walk_pmd_level(m, st, *start,
-@@ -395,9 +416,10 @@ static void ptdump_walk_pgd_level_core(struct seq_file *m, pgd_t *pgd,
+@@ -396,9 +417,10 @@ static void ptdump_walk_pgd_level_core(struct seq_file *m, pgd_t *pgd,
for (i = 0; i < PTRS_PER_PGD; i++) {
st.current_address = normalize_addr(i * PGD_LEVEL_MULT);
@@ -49938,7 +49946,7 @@ index 3a1f49f..42a478e 100644
}
EXPORT_SYMBOL_GPL(od_unregister_powersave_bias_handler);
diff --git a/drivers/cpufreq/intel_pstate.c b/drivers/cpufreq/intel_pstate.c
-index 4737520..4cafa68 100644
+index 80fa656..fe055932 100644
--- a/drivers/cpufreq/intel_pstate.c
+++ b/drivers/cpufreq/intel_pstate.c
@@ -283,13 +283,13 @@ struct pstate_funcs {
@@ -50018,7 +50026,7 @@ index 4737520..4cafa68 100644
const char *buf, size_t count)
{
unsigned int input;
-@@ -1154,7 +1154,7 @@ static void intel_pstate_set_pstate(struct cpudata *cpu, int pstate)
+@@ -1173,7 +1173,7 @@ static void intel_pstate_set_pstate(struct cpudata *cpu, int pstate)
* right CPU.
*/
wrmsrl_on_cpu(cpu->cpu, MSR_IA32_PERF_CTL,
@@ -50027,7 +50035,7 @@ index 4737520..4cafa68 100644
}
static void intel_pstate_set_min_pstate(struct cpudata *cpu)
-@@ -1173,14 +1173,14 @@ static void intel_pstate_max_within_limits(struct cpudata *cpu)
+@@ -1192,14 +1192,14 @@ static void intel_pstate_max_within_limits(struct cpudata *cpu)
static void intel_pstate_get_cpu_pstates(struct cpudata *cpu)
{
@@ -50049,7 +50057,7 @@ index 4737520..4cafa68 100644
intel_pstate_set_min_pstate(cpu);
}
-@@ -1329,7 +1329,7 @@ static inline void intel_pstate_update_pstate(struct cpudata *cpu, int pstate)
+@@ -1348,7 +1348,7 @@ static inline void intel_pstate_update_pstate(struct cpudata *cpu, int pstate)
return;
cpu->pstate.current_pstate = pstate;
@@ -50058,7 +50066,7 @@ index 4737520..4cafa68 100644
}
static inline void intel_pstate_adjust_busy_pstate(struct cpudata *cpu)
-@@ -1340,7 +1340,7 @@ static inline void intel_pstate_adjust_busy_pstate(struct cpudata *cpu)
+@@ -1359,7 +1359,7 @@ static inline void intel_pstate_adjust_busy_pstate(struct cpudata *cpu)
from = cpu->pstate.current_pstate;
target_pstate = cpu->policy == CPUFREQ_POLICY_PERFORMANCE ?
@@ -50067,7 +50075,7 @@ index 4737520..4cafa68 100644
intel_pstate_update_pstate(cpu, target_pstate);
-@@ -1653,15 +1653,15 @@ static unsigned int force_load __initdata;
+@@ -1683,15 +1683,15 @@ static unsigned int force_load __initdata;
static int __init intel_pstate_msrs_not_valid(void)
{
@@ -50087,7 +50095,7 @@ index 4737520..4cafa68 100644
{
pid_params.sample_rate_ms = policy->sample_rate_ms;
pid_params.sample_rate_ns = pid_params.sample_rate_ms * NSEC_PER_MSEC;
-@@ -1674,15 +1674,7 @@ static void __init copy_pid_params(struct pstate_adjust_policy *policy)
+@@ -1704,15 +1704,7 @@ static void __init copy_pid_params(struct pstate_adjust_policy *policy)
static void __init copy_cpu_funcs(struct pstate_funcs *funcs)
{
@@ -52837,7 +52845,7 @@ index 670beeb..642dcef 100644
* deal with them for Intel hardware.
*/
diff --git a/drivers/gpu/drm/i915/i915_gem_execbuffer.c b/drivers/gpu/drm/i915/i915_gem_execbuffer.c
-index a218c2e..c834d0b 100644
+index 0c400f8..4f2bba6 100644
--- a/drivers/gpu/drm/i915/i915_gem_execbuffer.c
+++ b/drivers/gpu/drm/i915/i915_gem_execbuffer.c
@@ -1187,12 +1187,12 @@ i915_gem_check_execbuffer(struct drm_i915_gem_execbuffer2 *exec)
@@ -53057,7 +53065,7 @@ index 3fc286c..4c19f25 100644
/**
diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
-index 8079e5b..70051e8 100644
+index b9be8a6..05d5f12 100644
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -16133,13 +16133,13 @@ struct intel_quirk {
@@ -55316,10 +55324,10 @@ index c13fb5b..55a3802 100644
*off += size;
diff --git a/drivers/hv/channel.c b/drivers/hv/channel.c
-index 16f91c8..a45059b 100644
+index 5fb4c6d..29316a6 100644
--- a/drivers/hv/channel.c
+++ b/drivers/hv/channel.c
-@@ -397,7 +397,7 @@ int vmbus_establish_gpadl(struct vmbus_channel *channel, void *kbuffer,
+@@ -398,7 +398,7 @@ int vmbus_establish_gpadl(struct vmbus_channel *channel, void *kbuffer,
int ret = 0;
next_gpadl_handle =
@@ -55328,7 +55336,7 @@ index 16f91c8..a45059b 100644
ret = create_gpadl_header(kbuffer, size, &msginfo);
if (ret)
-@@ -742,9 +742,7 @@ int vmbus_sendpacket_pagebuffer_ctl(struct vmbus_channel *channel,
+@@ -715,9 +715,7 @@ int vmbus_sendpacket_pagebuffer_ctl(struct vmbus_channel *channel,
* Adjust the size down since vmbus_channel_packet_page_buffer is the
* largest size we support
*/
@@ -55496,7 +55504,7 @@ index fdf8da9..d3fefc5 100644
cap_msg.caps.cap_bits.balloon = 1;
cap_msg.caps.cap_bits.hot_add = 1;
diff --git a/drivers/hv/hyperv_vmbus.h b/drivers/hv/hyperv_vmbus.h
-index a5b4442..b3b5e3e 100644
+index 2b13f2a..e150466 100644
--- a/drivers/hv/hyperv_vmbus.h
+++ b/drivers/hv/hyperv_vmbus.h
@@ -567,7 +567,7 @@ enum vmbus_connect_state {
@@ -74069,6 +74077,19 @@ index 2478ccd..1194b50 100644
mwifiex_shutdown_sw(adapter, adapter->card_sem);
}
}
+diff --git a/drivers/net/wireless/marvell/mwifiex/util.c b/drivers/net/wireless/marvell/mwifiex/util.c
+index 18fbb96..db73632 100644
+--- a/drivers/net/wireless/marvell/mwifiex/util.c
++++ b/drivers/net/wireless/marvell/mwifiex/util.c
+@@ -751,7 +751,7 @@ void mwifiex_hist_data_reset(struct mwifiex_private *priv)
+ void *mwifiex_alloc_dma_align_buf(int rx_len, gfp_t flags)
+ {
+ struct sk_buff *skb;
+- int buf_len, pad;
++ long buf_len, pad;
+
+ buf_len = rx_len + MWIFIEX_RX_HEADROOM + MWIFIEX_DMA_ALIGN_SZ;
+
diff --git a/drivers/net/wireless/ralink/rt2x00/rt2400pci.c b/drivers/net/wireless/ralink/rt2x00/rt2400pci.c
index 155f343..5db43e7 100644
--- a/drivers/net/wireless/ralink/rt2x00/rt2400pci.c
@@ -74920,7 +74941,7 @@ index 74dc2bf..e942c3b 100644
struct xenvif *vif = netdev_priv(dev);
struct xenvif_queue *queue = NULL;
diff --git a/drivers/net/xen-netfront.c b/drivers/net/xen-netfront.c
-index bf2744e..c8b5fd0 100644
+index 0cdcb21..72354a5 100644
--- a/drivers/net/xen-netfront.c
+++ b/drivers/net/xen-netfront.c
@@ -550,7 +550,7 @@ static u16 xennet_select_queue(struct net_device *dev, struct sk_buff *skb,
@@ -79178,10 +79199,10 @@ index a1a5ceb..8e83e34 100644
int ret = param_set_int(val, kp);
struct MPT3SAS_ADAPTER *ioc;
diff --git a/drivers/scsi/mpt3sas/mpt3sas_scsih.c b/drivers/scsi/mpt3sas/mpt3sas_scsih.c
-index f84a608..b6e984c 100644
+index 8a7941b..eb919a5 100644
--- a/drivers/scsi/mpt3sas/mpt3sas_scsih.c
+++ b/drivers/scsi/mpt3sas/mpt3sas_scsih.c
-@@ -280,7 +280,7 @@ struct _scsi_io_transfer {
+@@ -281,7 +281,7 @@ struct _scsi_io_transfer {
* Note: The logging levels are defined in mpt3sas_debug.h.
*/
static int
@@ -79190,7 +79211,7 @@ index f84a608..b6e984c 100644
{
int ret = param_set_int(val, kp);
struct MPT3SAS_ADAPTER *ioc;
-@@ -8952,7 +8952,7 @@ scsih_resume(struct pci_dev *pdev)
+@@ -8955,7 +8955,7 @@ scsih_resume(struct pci_dev *pdev)
* PCI_ERS_RESULT_NEED_RESET or PCI_ERS_RESULT_DISCONNECT
*/
static pci_ers_result_t
@@ -79454,7 +79475,7 @@ index 6ca0081..fbb9efd 100644
extern void qla2x00_free_sysfs_attr(scsi_qla_host_t *, bool);
extern void qla2x00_init_host_attr(scsi_qla_host_t *);
diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c
-index 078d797..1735786 100644
+index bea819e..fb745e0 100644
--- a/drivers/scsi/qla2xxx/qla_os.c
+++ b/drivers/scsi/qla2xxx/qla_os.c
@@ -301,12 +301,12 @@ struct scsi_transport_template *qla2xxx_transport_vport_template = NULL;
@@ -83879,6 +83900,28 @@ index 7d90e25..0780424 100644
}
info->fbops = &lynxfb_ops;
+diff --git a/drivers/staging/unisys/visorbus/visorchipset.c b/drivers/staging/unisys/visorbus/visorchipset.c
+index 5987149..15c44ea 100644
+--- a/drivers/staging/unisys/visorbus/visorchipset.c
++++ b/drivers/staging/unisys/visorbus/visorchipset.c
+@@ -2234,7 +2234,7 @@ static __init uint32_t visorutil_spar_detect(void)
+ }
+ }
+
+-static int init_unisys(void)
++static __init int init_unisys(void)
+ {
+ int result;
+
+@@ -2249,7 +2249,7 @@ static int init_unisys(void)
+ return 0;
+ };
+
+-static void exit_unisys(void)
++static __exit void exit_unisys(void)
+ {
+ acpi_bus_unregister_driver(&unisys_acpi_driver);
+ }
diff --git a/drivers/staging/unisys/visornic/visornic_main.c b/drivers/staging/unisys/visornic/visornic_main.c
index 1367007..d7a3530 100644
--- a/drivers/staging/unisys/visornic/visornic_main.c
@@ -138051,7 +138094,7 @@ index bb31373..e85eb5f 100644
#ifdef CONFIG_CPU_IDLE
extern int cpuidle_register_governor(struct cpuidle_governor *gov);
diff --git a/include/linux/cpumask.h b/include/linux/cpumask.h
-index da7fbf1..c2a221b 100644
+index fa3b155..258dde5 100644
--- a/include/linux/cpumask.h
+++ b/include/linux/cpumask.h
@@ -131,17 +131,17 @@ static inline unsigned int cpumask_first(const struct cpumask *srcp)
@@ -148744,7 +148787,7 @@ index e9fdb52..cfb547d 100644
new_table.data = &new_value;
ret = proc_dointvec_minmax(&new_table, write, buffer, lenp, ppos);
diff --git a/kernel/events/core.c b/kernel/events/core.c
-index b1cfd74..62fe53a 100644
+index 4b33231..e0edf1b 100644
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -389,8 +389,15 @@ static struct srcu_struct pmus_srcu;
@@ -148793,7 +148836,7 @@ index b1cfd74..62fe53a 100644
{
u64 frequency = event->attr.sample_freq;
u64 sec = NSEC_PER_SEC;
-@@ -4267,9 +4275,9 @@ u64 perf_event_read_value(struct perf_event *event, u64 *enabled, u64 *running)
+@@ -4272,9 +4280,9 @@ u64 perf_event_read_value(struct perf_event *event, u64 *enabled, u64 *running)
total += perf_event_count(event);
*enabled += event->total_time_enabled +
@@ -148805,7 +148848,7 @@ index b1cfd74..62fe53a 100644
list_for_each_entry(child, &event->child_list, child_list) {
(void)perf_event_read(child, false);
-@@ -4301,12 +4309,12 @@ static int __perf_read_group_add(struct perf_event *leader,
+@@ -4306,12 +4314,12 @@ static int __perf_read_group_add(struct perf_event *leader,
*/
if (read_format & PERF_FORMAT_TOTAL_TIME_ENABLED) {
values[n++] += leader->total_time_enabled +
@@ -148820,7 +148863,7 @@ index b1cfd74..62fe53a 100644
}
/*
-@@ -4829,10 +4837,10 @@ void perf_event_update_userpage(struct perf_event *event)
+@@ -4834,10 +4842,10 @@ void perf_event_update_userpage(struct perf_event *event)
userpg->offset -= local64_read(&event->hw.prev_count);
userpg->time_enabled = enabled +
@@ -148833,7 +148876,7 @@ index b1cfd74..62fe53a 100644
arch_perf_update_userpage(event, userpg, now);
-@@ -5535,7 +5543,7 @@ perf_output_sample_ustack(struct perf_output_handle *handle, u64 dump_size,
+@@ -5540,7 +5548,7 @@ perf_output_sample_ustack(struct perf_output_handle *handle, u64 dump_size,
/* Data. */
sp = perf_user_stack_pointer(regs);
@@ -148842,7 +148885,7 @@ index b1cfd74..62fe53a 100644
dyn_size = dump_size - rem;
perf_output_skip(handle, rem);
-@@ -5626,11 +5634,11 @@ static void perf_output_read_one(struct perf_output_handle *handle,
+@@ -5631,11 +5639,11 @@ static void perf_output_read_one(struct perf_output_handle *handle,
values[n++] = perf_event_count(event);
if (read_format & PERF_FORMAT_TOTAL_TIME_ENABLED) {
values[n++] = enabled +
@@ -148856,7 +148899,7 @@ index b1cfd74..62fe53a 100644
}
if (read_format & PERF_FORMAT_ID)
values[n++] = primary_event_id(event);
-@@ -8705,8 +8713,7 @@ perf_event_mux_interval_ms_store(struct device *dev,
+@@ -8710,8 +8718,7 @@ perf_event_mux_interval_ms_store(struct device *dev,
cpuctx = per_cpu_ptr(pmu->pmu_cpu_context, cpu);
cpuctx->hrtimer_interval = ns_to_ktime(NSEC_PER_MSEC * timer);
@@ -148866,7 +148909,7 @@ index b1cfd74..62fe53a 100644
}
put_online_cpus();
mutex_unlock(&mux_interval_mutex);
-@@ -9152,7 +9159,7 @@ perf_event_alloc(struct perf_event_attr *attr, int cpu,
+@@ -9157,7 +9164,7 @@ perf_event_alloc(struct perf_event_attr *attr, int cpu,
event->parent = parent_event;
event->ns = get_pid_ns(task_active_pid_ns(current));
@@ -148875,7 +148918,7 @@ index b1cfd74..62fe53a 100644
event->state = PERF_EVENT_STATE_INACTIVE;
-@@ -9587,6 +9594,11 @@ SYSCALL_DEFINE5(perf_event_open,
+@@ -9592,6 +9599,11 @@ SYSCALL_DEFINE5(perf_event_open,
if (flags & ~PERF_FLAG_ALL)
return -EINVAL;
@@ -148887,7 +148930,7 @@ index b1cfd74..62fe53a 100644
err = perf_copy_attr(attr_uptr, &attr);
if (err)
return err;
-@@ -10126,10 +10138,10 @@ static void sync_child_event(struct perf_event *child_event,
+@@ -10131,10 +10143,10 @@ static void sync_child_event(struct perf_event *child_event,
/*
* Add back the child's count to the parent's count:
*/
@@ -153143,7 +153186,7 @@ index 4a5c6e7..96ef058 100644
mutex_unlock(&smpboot_threads_lock);
put_online_cpus();
diff --git a/kernel/softirq.c b/kernel/softirq.c
-index 744fa61..32960f2 100644
+index 744fa61..ab73a78 100644
--- a/kernel/softirq.c
+++ b/kernel/softirq.c
@@ -53,7 +53,7 @@ irq_cpustat_t irq_stat[NR_CPUS] ____cacheline_aligned;
@@ -153155,7 +153198,7 @@ index 744fa61..32960f2 100644
DEFINE_PER_CPU(struct task_struct *, ksoftirqd);
-@@ -281,7 +281,7 @@ asmlinkage __visible void __softirq_entry __do_softirq(void)
+@@ -281,10 +281,10 @@ asmlinkage __visible void __softirq_entry __do_softirq(void)
kstat_incr_softirqs_this_cpu(vec_nr);
trace_softirq_entry(vec_nr);
@@ -153163,7 +153206,11 @@ index 744fa61..32960f2 100644
+ h->action();
trace_softirq_exit(vec_nr);
if (unlikely(prev_count != preempt_count())) {
- pr_err("huh, entered softirq %u %s %p with preempt_count %08x, exited with %08x?\n",
+- pr_err("huh, entered softirq %u %s %p with preempt_count %08x, exited with %08x?\n",
++ pr_err("huh, entered softirq %u %s %pA with preempt_count %08x, exited with %08x?\n",
+ vec_nr, softirq_to_name[vec_nr], h->action,
+ prev_count, preempt_count());
+ preempt_count_set(prev_count);
@@ -444,7 +444,7 @@ void __raise_softirq_irqoff(unsigned int nr)
or_softirq_pending(1UL << nr);
}
@@ -161396,7 +161443,7 @@ index 5ec1580..eea07f2 100644
EXPORT_SYMBOL(kmem_cache_free);
diff --git a/mm/slub.c b/mm/slub.c
-index 2b3e740..ca3813c 100644
+index 7aa0e97..ca3813c 100644
--- a/mm/slub.c
+++ b/mm/slub.c
@@ -34,6 +34,7 @@
@@ -161471,18 +161518,7 @@ index 2b3e740..ca3813c 100644
s, (void *)t->addr, jiffies - t->when, t->cpu, t->pid);
#ifdef CONFIG_STACKTRACE
{
-@@ -1419,6 +1430,10 @@ static int init_cache_random_seq(struct kmem_cache *s)
- int err;
- unsigned long i, count = oo_objects(s->oo);
-
-+ /* Bailout if already initialised */
-+ if (s->random_seq)
-+ return 0;
-+
- err = cache_random_seq_create(s, count, GFP_KERNEL);
- if (err) {
- pr_err("SLUB: Unable to initialize free list for %s\n",
-@@ -2911,6 +2926,23 @@ static __always_inline void do_slab_free(struct kmem_cache *s,
+@@ -2915,6 +2926,23 @@ static __always_inline void do_slab_free(struct kmem_cache *s,
void *tail_obj = tail ? : head;
struct kmem_cache_cpu *c;
unsigned long tid;
@@ -161506,7 +161542,7 @@ index 2b3e740..ca3813c 100644
redo:
/*
* Determine the currently cpus per cpu slab.
-@@ -3714,7 +3746,7 @@ static int __init setup_slub_min_objects(char *str)
+@@ -3718,7 +3746,7 @@ static int __init setup_slub_min_objects(char *str)
__setup("slub_min_objects=", setup_slub_min_objects);
@@ -161515,7 +161551,7 @@ index 2b3e740..ca3813c 100644
{
struct kmem_cache *s;
void *ret;
-@@ -3752,7 +3784,7 @@ static void *kmalloc_large_node(size_t size, gfp_t flags, int node)
+@@ -3756,7 +3784,7 @@ static void *kmalloc_large_node(size_t size, gfp_t flags, int node)
return ptr;
}
@@ -161524,7 +161560,7 @@ index 2b3e740..ca3813c 100644
{
struct kmem_cache *s;
void *ret;
-@@ -3783,9 +3815,41 @@ void *__kmalloc_node(size_t size, gfp_t flags, int node)
+@@ -3787,9 +3815,41 @@ void *__kmalloc_node(size_t size, gfp_t flags, int node)
EXPORT_SYMBOL(__kmalloc_node);
#endif
@@ -161567,7 +161603,7 @@ index 2b3e740..ca3813c 100644
*
* Returns NULL if check passes, otherwise const char * to name of cache
* to indicate an error.
-@@ -3795,15 +3859,15 @@ const char *__check_heap_object(const void *ptr, unsigned long n,
+@@ -3799,15 +3859,15 @@ const char *__check_heap_object(const void *ptr, unsigned long n,
{
struct kmem_cache *s;
unsigned long offset;
@@ -161585,7 +161621,7 @@ index 2b3e740..ca3813c 100644
/* Find offset within object. */
offset = (ptr - page_address(page)) % s->size;
-@@ -3815,11 +3879,16 @@ const char *__check_heap_object(const void *ptr, unsigned long n,
+@@ -3819,11 +3879,16 @@ const char *__check_heap_object(const void *ptr, unsigned long n,
offset -= s->red_left_pad;
}
@@ -161606,7 +161642,7 @@ index 2b3e740..ca3813c 100644
}
#endif /* CONFIG_HARDENED_USERCOPY */
-@@ -3861,6 +3930,7 @@ void kfree(const void *x)
+@@ -3865,6 +3930,7 @@ void kfree(const void *x)
if (unlikely(ZERO_OR_NULL_PTR(x)))
return;
@@ -161614,7 +161650,7 @@ index 2b3e740..ca3813c 100644
page = virt_to_head_page(x);
if (unlikely(!PageSlab(page))) {
BUG_ON(!PageCompound(page));
-@@ -4131,7 +4201,7 @@ void __init kmem_cache_init(void)
+@@ -4135,7 +4201,7 @@ void __init kmem_cache_init(void)
kmem_cache = &boot_kmem_cache;
create_boot_cache(kmem_cache_node, "kmem_cache_node",
@@ -161623,7 +161659,7 @@ index 2b3e740..ca3813c 100644
register_hotmemory_notifier(&slab_memory_callback_nb);
-@@ -4141,7 +4211,7 @@ void __init kmem_cache_init(void)
+@@ -4145,7 +4211,7 @@ void __init kmem_cache_init(void)
create_boot_cache(kmem_cache, "kmem_cache",
offsetof(struct kmem_cache, node) +
nr_node_ids * sizeof(struct kmem_cache_node *),
@@ -161632,7 +161668,7 @@ index 2b3e740..ca3813c 100644
kmem_cache = bootstrap(&boot_kmem_cache);
-@@ -4180,7 +4250,7 @@ __kmem_cache_alias(const char *name, size_t size, size_t align,
+@@ -4184,7 +4250,7 @@ __kmem_cache_alias(const char *name, size_t size, size_t align,
s = find_mergeable(size, align, flags, name, ctor);
if (s) {
@@ -161641,7 +161677,7 @@ index 2b3e740..ca3813c 100644
/*
* Adjust the object sizes so that we clear
-@@ -4196,7 +4266,7 @@ __kmem_cache_alias(const char *name, size_t size, size_t align,
+@@ -4200,7 +4266,7 @@ __kmem_cache_alias(const char *name, size_t size, size_t align,
}
if (sysfs_slab_alias(s, name)) {
@@ -161650,7 +161686,7 @@ index 2b3e740..ca3813c 100644
s = NULL;
}
}
-@@ -4208,6 +4278,8 @@ int __kmem_cache_create(struct kmem_cache *s, unsigned long flags)
+@@ -4212,6 +4278,8 @@ int __kmem_cache_create(struct kmem_cache *s, unsigned long flags)
{
int err;
@@ -161659,7 +161695,7 @@ index 2b3e740..ca3813c 100644
err = kmem_cache_open(s, flags);
if (err)
return err;
-@@ -4276,7 +4348,7 @@ void *__kmalloc_node_track_caller(size_t size, gfp_t gfpflags,
+@@ -4280,7 +4348,7 @@ void *__kmalloc_node_track_caller(size_t size, gfp_t gfpflags,
}
#endif
@@ -161668,7 +161704,7 @@ index 2b3e740..ca3813c 100644
static int count_inuse(struct page *page)
{
return page->inuse;
-@@ -4557,7 +4629,11 @@ static int list_locations(struct kmem_cache *s, char *buf,
+@@ -4561,7 +4629,11 @@ static int list_locations(struct kmem_cache *s, char *buf,
len += sprintf(buf + len, "%7ld ", l->count);
if (l->addr)
@@ -161680,7 +161716,7 @@ index 2b3e740..ca3813c 100644
else
len += sprintf(buf + len, "<not-available>");
-@@ -4655,12 +4731,12 @@ static void __init resiliency_test(void)
+@@ -4659,12 +4731,12 @@ static void __init resiliency_test(void)
validate_slab_cache(kmalloc_caches[9]);
}
#else
@@ -161695,7 +161731,7 @@ index 2b3e740..ca3813c 100644
enum slab_stat_type {
SL_ALL, /* All slabs */
SL_PARTIAL, /* Only partially allocated slabs */
-@@ -4897,13 +4973,17 @@ static ssize_t ctor_show(struct kmem_cache *s, char *buf)
+@@ -4901,13 +4973,17 @@ static ssize_t ctor_show(struct kmem_cache *s, char *buf)
{
if (!s->ctor)
return 0;
@@ -161714,7 +161750,7 @@ index 2b3e740..ca3813c 100644
}
SLAB_ATTR_RO(aliases);
-@@ -4991,6 +5071,22 @@ static ssize_t cache_dma_show(struct kmem_cache *s, char *buf)
+@@ -4995,6 +5071,22 @@ static ssize_t cache_dma_show(struct kmem_cache *s, char *buf)
SLAB_ATTR_RO(cache_dma);
#endif
@@ -161737,7 +161773,7 @@ index 2b3e740..ca3813c 100644
static ssize_t destroy_by_rcu_show(struct kmem_cache *s, char *buf)
{
return sprintf(buf, "%d\n", !!(s->flags & SLAB_DESTROY_BY_RCU));
-@@ -5046,7 +5142,7 @@ static ssize_t trace_store(struct kmem_cache *s, const char *buf,
+@@ -5050,7 +5142,7 @@ static ssize_t trace_store(struct kmem_cache *s, const char *buf,
* as well as cause other issues like converting a mergeable
* cache into an umergeable one.
*/
@@ -161746,7 +161782,7 @@ index 2b3e740..ca3813c 100644
return -EINVAL;
s->flags &= ~SLAB_TRACE;
-@@ -5164,7 +5260,7 @@ static ssize_t failslab_show(struct kmem_cache *s, char *buf)
+@@ -5168,7 +5260,7 @@ static ssize_t failslab_show(struct kmem_cache *s, char *buf)
static ssize_t failslab_store(struct kmem_cache *s, const char *buf,
size_t length)
{
@@ -161755,7 +161791,7 @@ index 2b3e740..ca3813c 100644
return -EINVAL;
s->flags &= ~SLAB_FAILSLAB;
-@@ -5296,7 +5392,7 @@ STAT_ATTR(CPU_PARTIAL_NODE, cpu_partial_node);
+@@ -5300,7 +5392,7 @@ STAT_ATTR(CPU_PARTIAL_NODE, cpu_partial_node);
STAT_ATTR(CPU_PARTIAL_DRAIN, cpu_partial_drain);
#endif
@@ -161764,7 +161800,7 @@ index 2b3e740..ca3813c 100644
&slab_size_attr.attr,
&object_size_attr.attr,
&objs_per_slab_attr.attr,
-@@ -5331,6 +5427,12 @@ static struct attribute *slab_attrs[] = {
+@@ -5335,6 +5427,12 @@ static struct attribute *slab_attrs[] = {
#ifdef CONFIG_ZONE_DMA
&cache_dma_attr.attr,
#endif
@@ -161777,7 +161813,7 @@ index 2b3e740..ca3813c 100644
#ifdef CONFIG_NUMA
&remote_node_defrag_ratio_attr.attr,
#endif
-@@ -5574,6 +5676,7 @@ static char *create_unique_id(struct kmem_cache *s)
+@@ -5578,6 +5676,7 @@ static char *create_unique_id(struct kmem_cache *s)
return name;
}
@@ -161785,7 +161821,7 @@ index 2b3e740..ca3813c 100644
static int sysfs_slab_add(struct kmem_cache *s)
{
int err;
-@@ -5645,6 +5748,7 @@ void sysfs_slab_remove(struct kmem_cache *s)
+@@ -5649,6 +5748,7 @@ void sysfs_slab_remove(struct kmem_cache *s)
kobject_del(&s->kobj);
kobject_put(&s->kobj);
}
@@ -161793,7 +161829,7 @@ index 2b3e740..ca3813c 100644
/*
* Need to buffer aliases during bootup until sysfs becomes
-@@ -5658,6 +5762,7 @@ struct saved_alias {
+@@ -5662,6 +5762,7 @@ struct saved_alias {
static struct saved_alias *alias_list;
@@ -161801,7 +161837,7 @@ index 2b3e740..ca3813c 100644
static int sysfs_slab_alias(struct kmem_cache *s, const char *name)
{
struct saved_alias *al;
-@@ -5680,6 +5785,7 @@ static int sysfs_slab_alias(struct kmem_cache *s, const char *name)
+@@ -5684,6 +5785,7 @@ static int sysfs_slab_alias(struct kmem_cache *s, const char *name)
alias_list = al;
return 0;
}
@@ -170432,33 +170468,6 @@ index 6cfb6e9..eaa7ef4 100644
linkwatch_fire_event(dev);
}
}
-diff --git a/net/sched/sch_tbf.c b/net/sched/sch_tbf.c
-index 303355c..d6ce615 100644
---- a/net/sched/sch_tbf.c
-+++ b/net/sched/sch_tbf.c
-@@ -162,7 +162,8 @@ static int tbf_segment(struct sk_buff *skb, struct Qdisc *sch,
- struct sk_buff *segs, *nskb;
- netdev_features_t features = netif_skb_features(skb);
- unsigned int len = 0, prev_len = qdisc_pkt_len(skb);
-- int ret, nb;
-+ int ret;
-+ unsigned int nb;
-
- segs = skb_gso_segment(skb, features & ~NETIF_F_GSO_MASK);
-
-@@ -185,8 +186,10 @@ static int tbf_segment(struct sk_buff *skb, struct Qdisc *sch,
- segs = nskb;
- }
- sch->q.qlen += nb;
-- if (nb > 1)
-- qdisc_tree_reduce_backlog(sch, 1 - nb, prev_len - len);
-+ if (nb > 1) {
-+ nb--;
-+ qdisc_tree_reduce_backlog(sch, -nb, prev_len - len);
-+ }
- consume_skb(skb);
- return nb > 0 ? NET_XMIT_SUCCESS : NET_XMIT_DROP;
- }
diff --git a/net/sctp/ipv6.c b/net/sctp/ipv6.c
index 176af30..585194b 100644
--- a/net/sctp/ipv6.c
@@ -174500,10 +174509,10 @@ index 0000000..7514850
+fi
diff --git a/scripts/gcc-plugins/initify_plugin.c b/scripts/gcc-plugins/initify_plugin.c
new file mode 100644
-index 0000000..ad28ed6
+index 0000000..1c8d204
--- /dev/null
+++ b/scripts/gcc-plugins/initify_plugin.c
-@@ -0,0 +1,1831 @@
+@@ -0,0 +1,1865 @@
+/*
+ * Copyright 2015-2017 by Emese Revfy <re.emese@gmail.com>
+ * Licensed under the GPL v2
@@ -174553,7 +174562,7 @@ index 0000000..ad28ed6
+__visible int plugin_is_GPL_compatible;
+
+static struct plugin_info initify_plugin_info = {
-+ .version = "20170112",
++ .version = "20170215",
+ .help = "disable\tturn off the initify plugin\n"
+ "verbose\tprint all initified strings and all"
+ " functions which should be __init/__exit\n"
@@ -174622,14 +174631,37 @@ index 0000000..ad28ed6
+{
+ delete visited;
+}
++
++typedef struct hash_set<struct cgraph_node *> cgraph_set;
++
++static inline bool pointer_set_insert(cgraph_set *visited, struct cgraph_node *node)
++{
++ return visited->add(node);
++}
++
++static inline cgraph_set* cgraph_pointer_set_create(void)
++{
++ return new hash_set<struct cgraph_node *>;
++}
++
++static inline void pointer_set_destroy(cgraph_set *visited)
++{
++ delete visited;
++}
+#else
+typedef struct pointer_set_t gimple_set;
+typedef struct pointer_set_t tree_set;
++typedef struct pointer_set_t cgraph_set;
+
+static inline tree_set *tree_pointer_set_create(void)
+{
+ return pointer_set_create();
+}
++
++static inline cgraph_set *cgraph_pointer_set_create(void)
++{
++ return pointer_set_create();
++}
+#endif
+
+static gimple initify_get_def_stmt(const_tree node)
@@ -175295,7 +175327,8 @@ index 0000000..ad28ed6
+
+ if (fndecl == NULL_TREE)
+ fndecl = gimple_call_fn(call);
-+ gcc_assert(fndecl != NULL_TREE);
++ if (fndecl == NULL_TREE)
++ return false;
+
+ if (is_negative_nocapture_arg(fndecl, -arg_num) && is_return_value_captured(visited_defs, call))
+ return false;
@@ -175658,7 +175691,7 @@ index 0000000..ad28ed6
+ tree var;
+
+ FOR_EACH_LOCAL_DECL(cfun, i, var) {
-+ tree str, init_val;
++ tree str, init_val, asm_name;
+
+ if (TREE_CODE(TREE_TYPE(var)) != ARRAY_TYPE)
+ continue;
@@ -175669,6 +175702,10 @@ index 0000000..ad28ed6
+ if (TREE_CODE(init_val) != STRING_CST)
+ continue;
+
++ asm_name = DECL_ASSEMBLER_NAME(var);
++ if (asm_name != NULL_TREE && TREE_SYMBOL_REFERENCED(asm_name))
++ continue;
++
+ if (has_capture_use_local_var(var))
+ continue;
+
@@ -176044,18 +176081,21 @@ index 0000000..ad28ed6
+ return false;
+}
+
-+static void has_non_init_clone(struct cgraph_node *node, bool *has_non_init)
++static bool has_non_init_clone(cgraph_set *visited, struct cgraph_node *node)
+{
-+ if (*has_non_init)
-+ return;
++ if (!node)
++ return false;
++
++ if (pointer_set_insert(visited, node))
++ return false;
+
+ if (has_non_init_caller(node))
-+ *has_non_init = true;
++ return true;
+
-+ if (node->clones)
-+ has_non_init_clone(node->clones, has_non_init);
-+ if (node->clone_of)
-+ has_non_init_clone(node->clone_of, has_non_init);
++ if (has_non_init_clone(visited, node->clones))
++ return true;
++
++ return has_non_init_clone(visited, node->clone_of);
+}
+
+/*
@@ -176064,6 +176104,7 @@ index 0000000..ad28ed6
+ */
+static bool should_init_exit(struct cgraph_node *callee)
+{
++ cgraph_set *visited;
+ bool has_non_init;
+ const_tree callee_decl = NODE_DECL(callee);
+
@@ -176079,8 +176120,10 @@ index 0000000..ad28ed6
+ if (NODE_SYMBOL(callee)->address_taken)
+ return false;
+
-+ has_non_init = false;
-+ has_non_init_clone(callee, &has_non_init);
++ visited = cgraph_pointer_set_create();
++ has_non_init = has_non_init_clone(visited, callee);
++ pointer_set_destroy(visited);
++
+ return !has_non_init;
+}
+
@@ -224547,7 +224590,7 @@ index 062c446..a4b6f4c 100644
};
diff --git a/sound/core/seq/seq_memory.c b/sound/core/seq/seq_memory.c
-index c850345..ec0a853 100644
+index dfa5156..05c2b75 100644
--- a/sound/core/seq/seq_memory.c
+++ b/sound/core/seq/seq_memory.c
@@ -87,7 +87,7 @@ int snd_seq_dump_var_event(const struct snd_seq_event *event,
@@ -225456,7 +225499,7 @@ index a020920..55579f6 100644
diff --git a/sound/usb/line6/driver.c b/sound/usb/line6/driver.c
-index 90009c0..41ed071 100644
+index ab3c280..e5cb292 100644
--- a/sound/usb/line6/driver.c
+++ b/sound/usb/line6/driver.c
@@ -337,7 +337,7 @@ int line6_read_data(struct usb_line6 *line6, unsigned address, void *data,
diff --git a/4.9.9/4425_grsec_remove_EI_PAX.patch b/4.9.10/4425_grsec_remove_EI_PAX.patch
index 594598a..594598a 100644
--- a/4.9.9/4425_grsec_remove_EI_PAX.patch
+++ b/4.9.10/4425_grsec_remove_EI_PAX.patch
diff --git a/4.9.9/4426_default_XATTR_PAX_FLAGS.patch b/4.9.10/4426_default_XATTR_PAX_FLAGS.patch
index f7e97b5..f7e97b5 100644
--- a/4.9.9/4426_default_XATTR_PAX_FLAGS.patch
+++ b/4.9.10/4426_default_XATTR_PAX_FLAGS.patch
diff --git a/4.9.9/4427_force_XATTR_PAX_tmpfs.patch b/4.9.10/4427_force_XATTR_PAX_tmpfs.patch
index 3871139..3871139 100644
--- a/4.9.9/4427_force_XATTR_PAX_tmpfs.patch
+++ b/4.9.10/4427_force_XATTR_PAX_tmpfs.patch
diff --git a/4.9.9/4430_grsec-remove-localversion-grsec.patch b/4.9.10/4430_grsec-remove-localversion-grsec.patch
index 31cf878..31cf878 100644
--- a/4.9.9/4430_grsec-remove-localversion-grsec.patch
+++ b/4.9.10/4430_grsec-remove-localversion-grsec.patch
diff --git a/4.9.9/4435_grsec-mute-warnings.patch b/4.9.10/4435_grsec-mute-warnings.patch
index 8929222..8929222 100644
--- a/4.9.9/4435_grsec-mute-warnings.patch
+++ b/4.9.10/4435_grsec-mute-warnings.patch
diff --git a/4.9.9/4440_grsec-remove-protected-paths.patch b/4.9.10/4440_grsec-remove-protected-paths.patch
index 741546d..741546d 100644
--- a/4.9.9/4440_grsec-remove-protected-paths.patch
+++ b/4.9.10/4440_grsec-remove-protected-paths.patch
diff --git a/4.9.9/4450_grsec-kconfig-default-gids.patch b/4.9.10/4450_grsec-kconfig-default-gids.patch
index cee6e27..cee6e27 100644
--- a/4.9.9/4450_grsec-kconfig-default-gids.patch
+++ b/4.9.10/4450_grsec-kconfig-default-gids.patch
diff --git a/4.9.9/4465_selinux-avc_audit-log-curr_ip.patch b/4.9.10/4465_selinux-avc_audit-log-curr_ip.patch
index 06a5294..06a5294 100644
--- a/4.9.9/4465_selinux-avc_audit-log-curr_ip.patch
+++ b/4.9.10/4465_selinux-avc_audit-log-curr_ip.patch
diff --git a/4.9.9/4470_disable-compat_vdso.patch b/4.9.10/4470_disable-compat_vdso.patch
index a1401d8..a1401d8 100644
--- a/4.9.9/4470_disable-compat_vdso.patch
+++ b/4.9.10/4470_disable-compat_vdso.patch
diff --git a/4.9.9/4475_emutramp_default_on.patch b/4.9.10/4475_emutramp_default_on.patch
index feb8c7b..feb8c7b 100644
--- a/4.9.9/4475_emutramp_default_on.patch
+++ b/4.9.10/4475_emutramp_default_on.patch
diff --git a/4.9.9/1007_linux-4.9.8.patch b/4.9.9/1007_linux-4.9.8.patch
deleted file mode 100644
index a93aab4..0000000
--- a/4.9.9/1007_linux-4.9.8.patch
+++ /dev/null
@@ -1,2048 +0,0 @@
-diff --git a/Makefile b/Makefile
-index da704d9..1130803 100644
---- a/Makefile
-+++ b/Makefile
-@@ -1,6 +1,6 @@
- VERSION = 4
- PATCHLEVEL = 9
--SUBLEVEL = 7
-+SUBLEVEL = 8
- EXTRAVERSION =
- NAME = Roaring Lionus
-
-diff --git a/drivers/net/ethernet/broadcom/bcmsysport.c b/drivers/net/ethernet/broadcom/bcmsysport.c
-index 25d1eb4..be7ec5a 100644
---- a/drivers/net/ethernet/broadcom/bcmsysport.c
-+++ b/drivers/net/ethernet/broadcom/bcmsysport.c
-@@ -710,11 +710,8 @@ static unsigned int __bcm_sysport_tx_reclaim(struct bcm_sysport_priv *priv,
- unsigned int c_index, last_c_index, last_tx_cn, num_tx_cbs;
- unsigned int pkts_compl = 0, bytes_compl = 0;
- struct bcm_sysport_cb *cb;
-- struct netdev_queue *txq;
- u32 hw_ind;
-
-- txq = netdev_get_tx_queue(ndev, ring->index);
--
- /* Compute how many descriptors have been processed since last call */
- hw_ind = tdma_readl(priv, TDMA_DESC_RING_PROD_CONS_INDEX(ring->index));
- c_index = (hw_ind >> RING_CONS_INDEX_SHIFT) & RING_CONS_INDEX_MASK;
-@@ -745,9 +742,6 @@ static unsigned int __bcm_sysport_tx_reclaim(struct bcm_sysport_priv *priv,
-
- ring->c_index = c_index;
-
-- if (netif_tx_queue_stopped(txq) && pkts_compl)
-- netif_tx_wake_queue(txq);
--
- netif_dbg(priv, tx_done, ndev,
- "ring=%d c_index=%d pkts_compl=%d, bytes_compl=%d\n",
- ring->index, ring->c_index, pkts_compl, bytes_compl);
-@@ -759,16 +753,33 @@ static unsigned int __bcm_sysport_tx_reclaim(struct bcm_sysport_priv *priv,
- static unsigned int bcm_sysport_tx_reclaim(struct bcm_sysport_priv *priv,
- struct bcm_sysport_tx_ring *ring)
- {
-+ struct netdev_queue *txq;
- unsigned int released;
- unsigned long flags;
-
-+ txq = netdev_get_tx_queue(priv->netdev, ring->index);
-+
- spin_lock_irqsave(&ring->lock, flags);
- released = __bcm_sysport_tx_reclaim(priv, ring);
-+ if (released)
-+ netif_tx_wake_queue(txq);
-+
- spin_unlock_irqrestore(&ring->lock, flags);
-
- return released;
- }
-
-+/* Locked version of the per-ring TX reclaim, but does not wake the queue */
-+static void bcm_sysport_tx_clean(struct bcm_sysport_priv *priv,
-+ struct bcm_sysport_tx_ring *ring)
-+{
-+ unsigned long flags;
-+
-+ spin_lock_irqsave(&ring->lock, flags);
-+ __bcm_sysport_tx_reclaim(priv, ring);
-+ spin_unlock_irqrestore(&ring->lock, flags);
-+}
-+
- static int bcm_sysport_tx_poll(struct napi_struct *napi, int budget)
- {
- struct bcm_sysport_tx_ring *ring =
-@@ -1253,7 +1264,7 @@ static void bcm_sysport_fini_tx_ring(struct bcm_sysport_priv *priv,
- napi_disable(&ring->napi);
- netif_napi_del(&ring->napi);
-
-- bcm_sysport_tx_reclaim(priv, ring);
-+ bcm_sysport_tx_clean(priv, ring);
-
- kfree(ring->cbs);
- ring->cbs = NULL;
-diff --git a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
-index fb8bb02..d223e7c 100644
---- a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
-+++ b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
-@@ -1740,8 +1740,11 @@ int mlx4_en_start_port(struct net_device *dev)
- /* Process all completions if exist to prevent
- * the queues freezing if they are full
- */
-- for (i = 0; i < priv->rx_ring_num; i++)
-+ for (i = 0; i < priv->rx_ring_num; i++) {
-+ local_bh_disable();
- napi_schedule(&priv->rx_cq[i]->napi);
-+ local_bh_enable();
-+ }
-
- netif_tx_start_all_queues(dev);
- netif_device_attach(dev);
-diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
-index 33495d8..e7b2158 100644
---- a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
-+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
-@@ -193,6 +193,9 @@ static inline bool mlx5e_rx_cache_put(struct mlx5e_rq *rq,
- return false;
- }
-
-+ if (unlikely(page_is_pfmemalloc(dma_info->page)))
-+ return false;
-+
- cache->page_cache[cache->tail] = *dma_info;
- cache->tail = tail_next;
- return true;
-diff --git a/drivers/net/ethernet/mellanox/mlxsw/pci.h b/drivers/net/ethernet/mellanox/mlxsw/pci.h
-index d942a3e..846fd4d 100644
---- a/drivers/net/ethernet/mellanox/mlxsw/pci.h
-+++ b/drivers/net/ethernet/mellanox/mlxsw/pci.h
-@@ -211,21 +211,21 @@ MLXSW_ITEM32(pci, eqe, owner, 0x0C, 0, 1);
- /* pci_eqe_cmd_token
- * Command completion event - token
- */
--MLXSW_ITEM32(pci, eqe, cmd_token, 0x08, 16, 16);
-+MLXSW_ITEM32(pci, eqe, cmd_token, 0x00, 16, 16);
-
- /* pci_eqe_cmd_status
- * Command completion event - status
- */
--MLXSW_ITEM32(pci, eqe, cmd_status, 0x08, 0, 8);
-+MLXSW_ITEM32(pci, eqe, cmd_status, 0x00, 0, 8);
-
- /* pci_eqe_cmd_out_param_h
- * Command completion event - output parameter - higher part
- */
--MLXSW_ITEM32(pci, eqe, cmd_out_param_h, 0x0C, 0, 32);
-+MLXSW_ITEM32(pci, eqe, cmd_out_param_h, 0x04, 0, 32);
-
- /* pci_eqe_cmd_out_param_l
- * Command completion event - output parameter - lower part
- */
--MLXSW_ITEM32(pci, eqe, cmd_out_param_l, 0x10, 0, 32);
-+MLXSW_ITEM32(pci, eqe, cmd_out_param_l, 0x08, 0, 32);
-
- #endif
-diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
-index dda5761..f902c4d 100644
---- a/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
-+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
-@@ -684,6 +684,7 @@ static netdev_tx_t mlxsw_sp_port_xmit(struct sk_buff *skb,
- dev_kfree_skb_any(skb_orig);
- return NETDEV_TX_OK;
- }
-+ dev_consume_skb_any(skb_orig);
- }
-
- if (eth_skb_pad(skb)) {
-diff --git a/drivers/net/ethernet/mellanox/mlxsw/switchx2.c b/drivers/net/ethernet/mellanox/mlxsw/switchx2.c
-index 92bda87..d548f0a 100644
---- a/drivers/net/ethernet/mellanox/mlxsw/switchx2.c
-+++ b/drivers/net/ethernet/mellanox/mlxsw/switchx2.c
-@@ -314,6 +314,7 @@ static netdev_tx_t mlxsw_sx_port_xmit(struct sk_buff *skb,
- dev_kfree_skb_any(skb_orig);
- return NETDEV_TX_OK;
- }
-+ dev_consume_skb_any(skb_orig);
- }
- mlxsw_sx_txhdr_construct(skb, &tx_info);
- /* TX header is consumed by HW on the way so we shouldn't count its
-diff --git a/drivers/net/ethernet/renesas/ravb_main.c b/drivers/net/ethernet/renesas/ravb_main.c
-index d6a2178..862f18e 100644
---- a/drivers/net/ethernet/renesas/ravb_main.c
-+++ b/drivers/net/ethernet/renesas/ravb_main.c
-@@ -1508,6 +1508,19 @@ static netdev_tx_t ravb_start_xmit(struct sk_buff *skb, struct net_device *ndev)
- buffer = PTR_ALIGN(priv->tx_align[q], DPTR_ALIGN) +
- entry / NUM_TX_DESC * DPTR_ALIGN;
- len = PTR_ALIGN(skb->data, DPTR_ALIGN) - skb->data;
-+ /* Zero length DMA descriptors are problematic as they seem to
-+ * terminate DMA transfers. Avoid them by simply using a length of
-+ * DPTR_ALIGN (4) when skb data is aligned to DPTR_ALIGN.
-+ *
-+ * As skb is guaranteed to have at least ETH_ZLEN (60) bytes of
-+ * data by the call to skb_put_padto() above this is safe with
-+ * respect to both the length of the first DMA descriptor (len)
-+ * overflowing the available data and the length of the second DMA
-+ * descriptor (skb->len - len) being negative.
-+ */
-+ if (len == 0)
-+ len = DPTR_ALIGN;
-+
- memcpy(buffer, skb->data, len);
- dma_addr = dma_map_single(ndev->dev.parent, buffer, len, DMA_TO_DEVICE);
- if (dma_mapping_error(ndev->dev.parent, dma_addr))
-diff --git a/drivers/net/hyperv/netvsc_drv.c b/drivers/net/hyperv/netvsc_drv.c
-index c9140c3..ff038e5 100644
---- a/drivers/net/hyperv/netvsc_drv.c
-+++ b/drivers/net/hyperv/netvsc_drv.c
-@@ -659,6 +659,7 @@ int netvsc_recv_callback(struct hv_device *device_obj,
- * policy filters on the host). Deliver these via the VF
- * interface in the guest.
- */
-+ rcu_read_lock();
- vf_netdev = rcu_dereference(net_device_ctx->vf_netdev);
- if (vf_netdev && (vf_netdev->flags & IFF_UP))
- net = vf_netdev;
-@@ -667,6 +668,7 @@ int netvsc_recv_callback(struct hv_device *device_obj,
- skb = netvsc_alloc_recv_skb(net, packet, csum_info, *data, vlan_tci);
- if (unlikely(!skb)) {
- ++net->stats.rx_dropped;
-+ rcu_read_unlock();
- return NVSP_STAT_FAIL;
- }
-
-@@ -696,6 +698,7 @@ int netvsc_recv_callback(struct hv_device *device_obj,
- * TODO - use NAPI?
- */
- netif_rx(skb);
-+ rcu_read_unlock();
-
- return 0;
- }
-diff --git a/drivers/net/macvtap.c b/drivers/net/macvtap.c
-index 7869b06..6f38daf 100644
---- a/drivers/net/macvtap.c
-+++ b/drivers/net/macvtap.c
-@@ -827,7 +827,7 @@ static ssize_t macvtap_put_user(struct macvtap_queue *q,
- return -EINVAL;
-
- ret = virtio_net_hdr_from_skb(skb, &vnet_hdr,
-- macvtap_is_little_endian(q));
-+ macvtap_is_little_endian(q), true);
- if (ret)
- BUG();
-
-diff --git a/drivers/net/phy/bcm63xx.c b/drivers/net/phy/bcm63xx.c
-index e741bf6..b0492ef 100644
---- a/drivers/net/phy/bcm63xx.c
-+++ b/drivers/net/phy/bcm63xx.c
-@@ -21,6 +21,23 @@ MODULE_DESCRIPTION("Broadcom 63xx internal PHY driver");
- MODULE_AUTHOR("Maxime Bizon <mbizon@freebox.fr>");
- MODULE_LICENSE("GPL");
-
-+static int bcm63xx_config_intr(struct phy_device *phydev)
-+{
-+ int reg, err;
-+
-+ reg = phy_read(phydev, MII_BCM63XX_IR);
-+ if (reg < 0)
-+ return reg;
-+
-+ if (phydev->interrupts == PHY_INTERRUPT_ENABLED)
-+ reg &= ~MII_BCM63XX_IR_GMASK;
-+ else
-+ reg |= MII_BCM63XX_IR_GMASK;
-+
-+ err = phy_write(phydev, MII_BCM63XX_IR, reg);
-+ return err;
-+}
-+
- static int bcm63xx_config_init(struct phy_device *phydev)
- {
- int reg, err;
-@@ -55,7 +72,7 @@ static struct phy_driver bcm63xx_driver[] = {
- .config_aneg = genphy_config_aneg,
- .read_status = genphy_read_status,
- .ack_interrupt = bcm_phy_ack_intr,
-- .config_intr = bcm_phy_config_intr,
-+ .config_intr = bcm63xx_config_intr,
- }, {
- /* same phy as above, with just a different OUI */
- .phy_id = 0x002bdc00,
-@@ -67,7 +84,7 @@ static struct phy_driver bcm63xx_driver[] = {
- .config_aneg = genphy_config_aneg,
- .read_status = genphy_read_status,
- .ack_interrupt = bcm_phy_ack_intr,
-- .config_intr = bcm_phy_config_intr,
-+ .config_intr = bcm63xx_config_intr,
- } };
-
- module_phy_driver(bcm63xx_driver);
-diff --git a/drivers/net/tun.c b/drivers/net/tun.c
-index db6acec..18402d7 100644
---- a/drivers/net/tun.c
-+++ b/drivers/net/tun.c
-@@ -1374,7 +1374,7 @@ static ssize_t tun_put_user(struct tun_struct *tun,
- return -EINVAL;
-
- ret = virtio_net_hdr_from_skb(skb, &gso,
-- tun_is_little_endian(tun));
-+ tun_is_little_endian(tun), true);
- if (ret) {
- struct skb_shared_info *sinfo = skb_shinfo(skb);
- pr_err("unexpected GSO type: "
-diff --git a/drivers/net/usb/cdc_ether.c b/drivers/net/usb/cdc_ether.c
-index dd623f6..b82be81 100644
---- a/drivers/net/usb/cdc_ether.c
-+++ b/drivers/net/usb/cdc_ether.c
-@@ -531,6 +531,7 @@ static const struct driver_info wwan_info = {
- #define SAMSUNG_VENDOR_ID 0x04e8
- #define LENOVO_VENDOR_ID 0x17ef
- #define NVIDIA_VENDOR_ID 0x0955
-+#define HP_VENDOR_ID 0x03f0
-
- static const struct usb_device_id products[] = {
- /* BLACKLIST !!
-@@ -677,6 +678,13 @@ static const struct usb_device_id products[] = {
- .driver_info = 0,
- },
-
-+/* HP lt2523 (Novatel E371) - handled by qmi_wwan */
-+{
-+ USB_DEVICE_AND_INTERFACE_INFO(HP_VENDOR_ID, 0x421d, USB_CLASS_COMM,
-+ USB_CDC_SUBCLASS_ETHERNET, USB_CDC_PROTO_NONE),
-+ .driver_info = 0,
-+},
-+
- /* AnyDATA ADU960S - handled by qmi_wwan */
- {
- USB_DEVICE_AND_INTERFACE_INFO(0x16d5, 0x650a, USB_CLASS_COMM,
-diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
-index 6fe1cdb..24d5272 100644
---- a/drivers/net/usb/qmi_wwan.c
-+++ b/drivers/net/usb/qmi_wwan.c
-@@ -654,6 +654,13 @@ static const struct usb_device_id products[] = {
- USB_CDC_PROTO_NONE),
- .driver_info = (unsigned long)&qmi_wwan_info,
- },
-+ { /* HP lt2523 (Novatel E371) */
-+ USB_DEVICE_AND_INTERFACE_INFO(0x03f0, 0x421d,
-+ USB_CLASS_COMM,
-+ USB_CDC_SUBCLASS_ETHERNET,
-+ USB_CDC_PROTO_NONE),
-+ .driver_info = (unsigned long)&qmi_wwan_info,
-+ },
- { /* HP lt4112 LTE/HSPA+ Gobi 4G Module (Huawei me906e) */
- USB_DEVICE_AND_INTERFACE_INFO(0x03f0, 0x581d, USB_CLASS_VENDOR_SPEC, 1, 7),
- .driver_info = (unsigned long)&qmi_wwan_info,
-diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c
-index 4b5cb16..90b426c 100644
---- a/drivers/net/usb/r8152.c
-+++ b/drivers/net/usb/r8152.c
-@@ -32,7 +32,7 @@
- #define NETNEXT_VERSION "08"
-
- /* Information for net */
--#define NET_VERSION "6"
-+#define NET_VERSION "7"
-
- #define DRIVER_VERSION "v1." NETNEXT_VERSION "." NET_VERSION
- #define DRIVER_AUTHOR "Realtek linux nic maintainers <nic_swsd@realtek.com>"
-@@ -1730,7 +1730,7 @@ static u8 r8152_rx_csum(struct r8152 *tp, struct rx_desc *rx_desc)
- u8 checksum = CHECKSUM_NONE;
- u32 opts2, opts3;
-
-- if (tp->version == RTL_VER_01 || tp->version == RTL_VER_02)
-+ if (!(tp->netdev->features & NETIF_F_RXCSUM))
- goto return_result;
-
- opts2 = le32_to_cpu(rx_desc->opts2);
-@@ -3572,6 +3572,8 @@ static bool delay_autosuspend(struct r8152 *tp)
- */
- if (!sw_linking && tp->rtl_ops.in_nway(tp))
- return true;
-+ else if (!skb_queue_empty(&tp->tx_queue))
-+ return true;
- else
- return false;
- }
-@@ -4358,6 +4360,11 @@ static int rtl8152_probe(struct usb_interface *intf,
- NETIF_F_HIGHDMA | NETIF_F_FRAGLIST |
- NETIF_F_IPV6_CSUM | NETIF_F_TSO6;
-
-+ if (tp->version == RTL_VER_01) {
-+ netdev->features &= ~NETIF_F_RXCSUM;
-+ netdev->hw_features &= ~NETIF_F_RXCSUM;
-+ }
-+
- netdev->ethtool_ops = &ops;
- netif_set_gso_max_size(netdev, RTL_LIMITED_TSO_SIZE);
-
-diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
-index cbf1c61..51fc0c3 100644
---- a/drivers/net/virtio_net.c
-+++ b/drivers/net/virtio_net.c
-@@ -840,7 +840,7 @@ static int xmit_skb(struct send_queue *sq, struct sk_buff *skb)
- hdr = skb_vnet_hdr(skb);
-
- if (virtio_net_hdr_from_skb(skb, &hdr->hdr,
-- virtio_is_little_endian(vi->vdev)))
-+ virtio_is_little_endian(vi->vdev), false))
- BUG();
-
- if (vi->mergeable_rx_bufs)
-diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c
-index 2ba01ca..0fafaa9 100644
---- a/drivers/net/vxlan.c
-+++ b/drivers/net/vxlan.c
-@@ -2887,7 +2887,7 @@ static int vxlan_dev_configure(struct net *src_net, struct net_device *dev,
- memcpy(&vxlan->cfg, conf, sizeof(*conf));
- if (!vxlan->cfg.dst_port) {
- if (conf->flags & VXLAN_F_GPE)
-- vxlan->cfg.dst_port = 4790; /* IANA assigned VXLAN-GPE port */
-+ vxlan->cfg.dst_port = htons(4790); /* IANA VXLAN-GPE port */
- else
- vxlan->cfg.dst_port = default_port;
- }
-diff --git a/fs/xfs/libxfs/xfs_alloc.c b/fs/xfs/libxfs/xfs_alloc.c
-index 5050056..9f06a21 100644
---- a/fs/xfs/libxfs/xfs_alloc.c
-+++ b/fs/xfs/libxfs/xfs_alloc.c
-@@ -95,10 +95,7 @@ unsigned int
- xfs_alloc_set_aside(
- struct xfs_mount *mp)
- {
-- unsigned int blocks;
--
-- blocks = 4 + (mp->m_sb.sb_agcount * XFS_ALLOC_AGFL_RESERVE);
-- return blocks;
-+ return mp->m_sb.sb_agcount * (XFS_ALLOC_AGFL_RESERVE + 4);
- }
-
- /*
-@@ -365,36 +362,12 @@ xfs_alloc_fix_len(
- return;
- ASSERT(rlen >= args->minlen && rlen <= args->maxlen);
- ASSERT(rlen % args->prod == args->mod);
-+ ASSERT(args->pag->pagf_freeblks + args->pag->pagf_flcount >=
-+ rlen + args->minleft);
- args->len = rlen;
- }
-
- /*
-- * Fix up length if there is too little space left in the a.g.
-- * Return 1 if ok, 0 if too little, should give up.
-- */
--STATIC int
--xfs_alloc_fix_minleft(
-- xfs_alloc_arg_t *args) /* allocation argument structure */
--{
-- xfs_agf_t *agf; /* a.g. freelist header */
-- int diff; /* free space difference */
--
-- if (args->minleft == 0)
-- return 1;
-- agf = XFS_BUF_TO_AGF(args->agbp);
-- diff = be32_to_cpu(agf->agf_freeblks)
-- - args->len - args->minleft;
-- if (diff >= 0)
-- return 1;
-- args->len += diff; /* shrink the allocated space */
-- /* casts to (int) catch length underflows */
-- if ((int)args->len >= (int)args->minlen)
-- return 1;
-- args->agbno = NULLAGBLOCK;
-- return 0;
--}
--
--/*
- * Update the two btrees, logically removing from freespace the extent
- * starting at rbno, rlen blocks. The extent is contained within the
- * actual (current) free extent fbno for flen blocks.
-@@ -689,8 +662,6 @@ xfs_alloc_ag_vextent(
- xfs_alloc_arg_t *args) /* argument structure for allocation */
- {
- int error=0;
-- xfs_extlen_t reservation;
-- xfs_extlen_t oldmax;
-
- ASSERT(args->minlen > 0);
- ASSERT(args->maxlen > 0);
-@@ -699,20 +670,6 @@ xfs_alloc_ag_vextent(
- ASSERT(args->alignment > 0);
-
- /*
-- * Clamp maxlen to the amount of free space minus any reservations
-- * that have been made.
-- */
-- oldmax = args->maxlen;
-- reservation = xfs_ag_resv_needed(args->pag, args->resv);
-- if (args->maxlen > args->pag->pagf_freeblks - reservation)
-- args->maxlen = args->pag->pagf_freeblks - reservation;
-- if (args->maxlen == 0) {
-- args->agbno = NULLAGBLOCK;
-- args->maxlen = oldmax;
-- return 0;
-- }
--
-- /*
- * Branch to correct routine based on the type.
- */
- args->wasfromfl = 0;
-@@ -731,8 +688,6 @@ xfs_alloc_ag_vextent(
- /* NOTREACHED */
- }
-
-- args->maxlen = oldmax;
--
- if (error || args->agbno == NULLAGBLOCK)
- return error;
-
-@@ -841,9 +796,6 @@ xfs_alloc_ag_vextent_exact(
- args->len = XFS_AGBLOCK_MIN(tend, args->agbno + args->maxlen)
- - args->agbno;
- xfs_alloc_fix_len(args);
-- if (!xfs_alloc_fix_minleft(args))
-- goto not_found;
--
- ASSERT(args->agbno + args->len <= tend);
-
- /*
-@@ -1149,12 +1101,7 @@ xfs_alloc_ag_vextent_near(
- XFS_WANT_CORRUPTED_GOTO(args->mp, i == 1, error0);
- ASSERT(ltbno + ltlen <= be32_to_cpu(XFS_BUF_TO_AGF(args->agbp)->agf_length));
- args->len = blen;
-- if (!xfs_alloc_fix_minleft(args)) {
-- xfs_btree_del_cursor(cnt_cur, XFS_BTREE_NOERROR);
-- trace_xfs_alloc_near_nominleft(args);
-- return 0;
-- }
-- blen = args->len;
-+
- /*
- * We are allocating starting at bnew for blen blocks.
- */
-@@ -1346,12 +1293,6 @@ xfs_alloc_ag_vextent_near(
- */
- args->len = XFS_EXTLEN_MIN(ltlena, args->maxlen);
- xfs_alloc_fix_len(args);
-- if (!xfs_alloc_fix_minleft(args)) {
-- trace_xfs_alloc_near_nominleft(args);
-- xfs_btree_del_cursor(bno_cur_lt, XFS_BTREE_NOERROR);
-- xfs_btree_del_cursor(cnt_cur, XFS_BTREE_NOERROR);
-- return 0;
-- }
- rlen = args->len;
- (void)xfs_alloc_compute_diff(args->agbno, rlen, args->alignment,
- args->datatype, ltbnoa, ltlena, &ltnew);
-@@ -1553,8 +1494,6 @@ xfs_alloc_ag_vextent_size(
- }
- xfs_alloc_fix_len(args);
-
-- if (!xfs_alloc_fix_minleft(args))
-- goto out_nominleft;
- rlen = args->len;
- XFS_WANT_CORRUPTED_GOTO(args->mp, rlen <= flen, error0);
- /*
-@@ -2056,7 +1995,7 @@ xfs_alloc_space_available(
- int flags)
- {
- struct xfs_perag *pag = args->pag;
-- xfs_extlen_t longest;
-+ xfs_extlen_t alloc_len, longest;
- xfs_extlen_t reservation; /* blocks that are still reserved */
- int available;
-
-@@ -2066,17 +2005,28 @@ xfs_alloc_space_available(
- reservation = xfs_ag_resv_needed(pag, args->resv);
-
- /* do we have enough contiguous free space for the allocation? */
-+ alloc_len = args->minlen + (args->alignment - 1) + args->minalignslop;
- longest = xfs_alloc_longest_free_extent(args->mp, pag, min_free,
- reservation);
-- if ((args->minlen + args->alignment + args->minalignslop - 1) > longest)
-+ if (longest < alloc_len)
- return false;
-
- /* do we have enough free space remaining for the allocation? */
- available = (int)(pag->pagf_freeblks + pag->pagf_flcount -
-- reservation - min_free - args->total);
-- if (available < (int)args->minleft || available <= 0)
-+ reservation - min_free - args->minleft);
-+ if (available < (int)max(args->total, alloc_len))
- return false;
-
-+ /*
-+ * Clamp maxlen to the amount of free space available for the actual
-+ * extent allocation.
-+ */
-+ if (available < (int)args->maxlen && !(flags & XFS_ALLOC_FLAG_CHECK)) {
-+ args->maxlen = available;
-+ ASSERT(args->maxlen > 0);
-+ ASSERT(args->maxlen >= args->minlen);
-+ }
-+
- return true;
- }
-
-@@ -2122,7 +2072,8 @@ xfs_alloc_fix_freelist(
- }
-
- need = xfs_alloc_min_freelist(mp, pag);
-- if (!xfs_alloc_space_available(args, need, flags))
-+ if (!xfs_alloc_space_available(args, need, flags |
-+ XFS_ALLOC_FLAG_CHECK))
- goto out_agbp_relse;
-
- /*
-@@ -2638,12 +2589,10 @@ xfs_alloc_vextent(
- xfs_agblock_t agsize; /* allocation group size */
- int error;
- int flags; /* XFS_ALLOC_FLAG_... locking flags */
-- xfs_extlen_t minleft;/* minimum left value, temp copy */
- xfs_mount_t *mp; /* mount structure pointer */
- xfs_agnumber_t sagno; /* starting allocation group number */
- xfs_alloctype_t type; /* input allocation type */
- int bump_rotor = 0;
-- int no_min = 0;
- xfs_agnumber_t rotorstep = xfs_rotorstep; /* inode32 agf stepper */
-
- mp = args->mp;
-@@ -2672,7 +2621,6 @@ xfs_alloc_vextent(
- trace_xfs_alloc_vextent_badargs(args);
- return 0;
- }
-- minleft = args->minleft;
-
- switch (type) {
- case XFS_ALLOCTYPE_THIS_AG:
-@@ -2683,9 +2631,7 @@ xfs_alloc_vextent(
- */
- args->agno = XFS_FSB_TO_AGNO(mp, args->fsbno);
- args->pag = xfs_perag_get(mp, args->agno);
-- args->minleft = 0;
- error = xfs_alloc_fix_freelist(args, 0);
-- args->minleft = minleft;
- if (error) {
- trace_xfs_alloc_vextent_nofix(args);
- goto error0;
-@@ -2750,9 +2696,7 @@ xfs_alloc_vextent(
- */
- for (;;) {
- args->pag = xfs_perag_get(mp, args->agno);
-- if (no_min) args->minleft = 0;
- error = xfs_alloc_fix_freelist(args, flags);
-- args->minleft = minleft;
- if (error) {
- trace_xfs_alloc_vextent_nofix(args);
- goto error0;
-@@ -2792,20 +2736,17 @@ xfs_alloc_vextent(
- * or switch to non-trylock mode.
- */
- if (args->agno == sagno) {
-- if (no_min == 1) {
-+ if (flags == 0) {
- args->agbno = NULLAGBLOCK;
- trace_xfs_alloc_vextent_allfailed(args);
- break;
- }
-- if (flags == 0) {
-- no_min = 1;
-- } else {
-- flags = 0;
-- if (type == XFS_ALLOCTYPE_START_BNO) {
-- args->agbno = XFS_FSB_TO_AGBNO(mp,
-- args->fsbno);
-- args->type = XFS_ALLOCTYPE_NEAR_BNO;
-- }
-+
-+ flags = 0;
-+ if (type == XFS_ALLOCTYPE_START_BNO) {
-+ args->agbno = XFS_FSB_TO_AGBNO(mp,
-+ args->fsbno);
-+ args->type = XFS_ALLOCTYPE_NEAR_BNO;
- }
- }
- xfs_perag_put(args->pag);
-diff --git a/fs/xfs/libxfs/xfs_alloc.h b/fs/xfs/libxfs/xfs_alloc.h
-index 7c404a6..1d0f48a 100644
---- a/fs/xfs/libxfs/xfs_alloc.h
-+++ b/fs/xfs/libxfs/xfs_alloc.h
-@@ -56,7 +56,7 @@ typedef unsigned int xfs_alloctype_t;
- #define XFS_ALLOC_FLAG_FREEING 0x00000002 /* indicate caller is freeing extents*/
- #define XFS_ALLOC_FLAG_NORMAP 0x00000004 /* don't modify the rmapbt */
- #define XFS_ALLOC_FLAG_NOSHRINK 0x00000008 /* don't shrink the freelist */
--
-+#define XFS_ALLOC_FLAG_CHECK 0x00000010 /* test only, don't modify args */
-
- /*
- * Argument structure for xfs_alloc routines.
-diff --git a/fs/xfs/libxfs/xfs_attr.c b/fs/xfs/libxfs/xfs_attr.c
-index af1ecb1..6622d46 100644
---- a/fs/xfs/libxfs/xfs_attr.c
-+++ b/fs/xfs/libxfs/xfs_attr.c
-@@ -131,9 +131,6 @@ xfs_attr_get(
- if (XFS_FORCED_SHUTDOWN(ip->i_mount))
- return -EIO;
-
-- if (!xfs_inode_hasattr(ip))
-- return -ENOATTR;
--
- error = xfs_attr_args_init(&args, ip, name, flags);
- if (error)
- return error;
-@@ -392,9 +389,6 @@ xfs_attr_remove(
- if (XFS_FORCED_SHUTDOWN(dp->i_mount))
- return -EIO;
-
-- if (!xfs_inode_hasattr(dp))
-- return -ENOATTR;
--
- error = xfs_attr_args_init(&args, dp, name, flags);
- if (error)
- return error;
-diff --git a/fs/xfs/libxfs/xfs_bmap.c b/fs/xfs/libxfs/xfs_bmap.c
-index 89d727b..f52fd63 100644
---- a/fs/xfs/libxfs/xfs_bmap.c
-+++ b/fs/xfs/libxfs/xfs_bmap.c
-@@ -3720,7 +3720,7 @@ xfs_bmap_btalloc(
- align = xfs_get_cowextsz_hint(ap->ip);
- else if (xfs_alloc_is_userdata(ap->datatype))
- align = xfs_get_extsz_hint(ap->ip);
-- if (unlikely(align)) {
-+ if (align) {
- error = xfs_bmap_extsize_align(mp, &ap->got, &ap->prev,
- align, 0, ap->eof, 0, ap->conv,
- &ap->offset, &ap->length);
-@@ -3792,7 +3792,7 @@ xfs_bmap_btalloc(
- args.minlen = ap->minlen;
- }
- /* apply extent size hints if obtained earlier */
-- if (unlikely(align)) {
-+ if (align) {
- args.prod = align;
- if ((args.mod = (xfs_extlen_t)do_mod(ap->offset, args.prod)))
- args.mod = (xfs_extlen_t)(args.prod - args.mod);
-@@ -3903,7 +3903,6 @@ xfs_bmap_btalloc(
- args.fsbno = 0;
- args.type = XFS_ALLOCTYPE_FIRST_AG;
- args.total = ap->minlen;
-- args.minleft = 0;
- if ((error = xfs_alloc_vextent(&args)))
- return error;
- ap->dfops->dop_low = true;
-@@ -4437,8 +4436,6 @@ xfs_bmapi_allocate(
- if (error)
- return error;
-
-- if (bma->dfops->dop_low)
-- bma->minleft = 0;
- if (bma->cur)
- bma->cur->bc_private.b.firstblock = *bma->firstblock;
- if (bma->blkno == NULLFSBLOCK)
-@@ -4610,8 +4607,6 @@ xfs_bmapi_write(
- int n; /* current extent index */
- xfs_fileoff_t obno; /* old block number (offset) */
- int whichfork; /* data or attr fork */
-- char inhole; /* current location is hole in file */
-- char wasdelay; /* old extent was delayed */
-
- #ifdef DEBUG
- xfs_fileoff_t orig_bno; /* original block number value */
-@@ -4697,22 +4692,44 @@ xfs_bmapi_write(
- bma.firstblock = firstblock;
-
- while (bno < end && n < *nmap) {
-- inhole = eof || bma.got.br_startoff > bno;
-- wasdelay = !inhole && isnullstartblock(bma.got.br_startblock);
-+ bool need_alloc = false, wasdelay = false;
-
-- /*
-- * Make sure we only reflink into a hole.
-- */
-- if (flags & XFS_BMAPI_REMAP)
-- ASSERT(inhole);
-- if (flags & XFS_BMAPI_COWFORK)
-- ASSERT(!inhole);
-+ /* in hole or beyoned EOF? */
-+ if (eof || bma.got.br_startoff > bno) {
-+ if (flags & XFS_BMAPI_DELALLOC) {
-+ /*
-+ * For the COW fork we can reasonably get a
-+ * request for converting an extent that races
-+ * with other threads already having converted
-+ * part of it, as there converting COW to
-+ * regular blocks is not protected using the
-+ * IOLOCK.
-+ */
-+ ASSERT(flags & XFS_BMAPI_COWFORK);
-+ if (!(flags & XFS_BMAPI_COWFORK)) {
-+ error = -EIO;
-+ goto error0;
-+ }
-+
-+ if (eof || bno >= end)
-+ break;
-+ } else {
-+ need_alloc = true;
-+ }
-+ } else {
-+ /*
-+ * Make sure we only reflink into a hole.
-+ */
-+ ASSERT(!(flags & XFS_BMAPI_REMAP));
-+ if (isnullstartblock(bma.got.br_startblock))
-+ wasdelay = true;
-+ }
-
- /*
- * First, deal with the hole before the allocated space
- * that we found, if any.
- */
-- if (inhole || wasdelay) {
-+ if (need_alloc || wasdelay) {
- bma.eof = eof;
- bma.conv = !!(flags & XFS_BMAPI_CONVERT);
- bma.wasdel = wasdelay;
-diff --git a/fs/xfs/libxfs/xfs_bmap.h b/fs/xfs/libxfs/xfs_bmap.h
-index d6d175a..e7d40b3 100644
---- a/fs/xfs/libxfs/xfs_bmap.h
-+++ b/fs/xfs/libxfs/xfs_bmap.h
-@@ -110,6 +110,9 @@ struct xfs_extent_free_item
- /* Map something in the CoW fork. */
- #define XFS_BMAPI_COWFORK 0x200
-
-+/* Only convert delalloc space, don't allocate entirely new extents */
-+#define XFS_BMAPI_DELALLOC 0x400
-+
- #define XFS_BMAPI_FLAGS \
- { XFS_BMAPI_ENTIRE, "ENTIRE" }, \
- { XFS_BMAPI_METADATA, "METADATA" }, \
-@@ -120,7 +123,8 @@ struct xfs_extent_free_item
- { XFS_BMAPI_CONVERT, "CONVERT" }, \
- { XFS_BMAPI_ZERO, "ZERO" }, \
- { XFS_BMAPI_REMAP, "REMAP" }, \
-- { XFS_BMAPI_COWFORK, "COWFORK" }
-+ { XFS_BMAPI_COWFORK, "COWFORK" }, \
-+ { XFS_BMAPI_DELALLOC, "DELALLOC" }
-
-
- static inline int xfs_bmapi_aflag(int w)
-diff --git a/fs/xfs/libxfs/xfs_bmap_btree.c b/fs/xfs/libxfs/xfs_bmap_btree.c
-index 049fa59..f76c169 100644
---- a/fs/xfs/libxfs/xfs_bmap_btree.c
-+++ b/fs/xfs/libxfs/xfs_bmap_btree.c
-@@ -502,12 +502,11 @@ xfs_bmbt_alloc_block(
- if (args.fsbno == NULLFSBLOCK && args.minleft) {
- /*
- * Could not find an AG with enough free space to satisfy
-- * a full btree split. Try again without minleft and if
-+ * a full btree split. Try again and if
- * successful activate the lowspace algorithm.
- */
- args.fsbno = 0;
- args.type = XFS_ALLOCTYPE_FIRST_AG;
-- args.minleft = 0;
- error = xfs_alloc_vextent(&args);
- if (error)
- goto error0;
-diff --git a/fs/xfs/libxfs/xfs_dir2.c b/fs/xfs/libxfs/xfs_dir2.c
-index 20a96dd..7825d78 100644
---- a/fs/xfs/libxfs/xfs_dir2.c
-+++ b/fs/xfs/libxfs/xfs_dir2.c
-@@ -36,21 +36,29 @@
- struct xfs_name xfs_name_dotdot = { (unsigned char *)"..", 2, XFS_DIR3_FT_DIR };
-
- /*
-- * @mode, if set, indicates that the type field needs to be set up.
-- * This uses the transformation from file mode to DT_* as defined in linux/fs.h
-- * for file type specification. This will be propagated into the directory
-- * structure if appropriate for the given operation and filesystem config.
-+ * Convert inode mode to directory entry filetype
- */
--const unsigned char xfs_mode_to_ftype[S_IFMT >> S_SHIFT] = {
-- [0] = XFS_DIR3_FT_UNKNOWN,
-- [S_IFREG >> S_SHIFT] = XFS_DIR3_FT_REG_FILE,
-- [S_IFDIR >> S_SHIFT] = XFS_DIR3_FT_DIR,
-- [S_IFCHR >> S_SHIFT] = XFS_DIR3_FT_CHRDEV,
-- [S_IFBLK >> S_SHIFT] = XFS_DIR3_FT_BLKDEV,
-- [S_IFIFO >> S_SHIFT] = XFS_DIR3_FT_FIFO,
-- [S_IFSOCK >> S_SHIFT] = XFS_DIR3_FT_SOCK,
-- [S_IFLNK >> S_SHIFT] = XFS_DIR3_FT_SYMLINK,
--};
-+unsigned char xfs_mode_to_ftype(int mode)
-+{
-+ switch (mode & S_IFMT) {
-+ case S_IFREG:
-+ return XFS_DIR3_FT_REG_FILE;
-+ case S_IFDIR:
-+ return XFS_DIR3_FT_DIR;
-+ case S_IFCHR:
-+ return XFS_DIR3_FT_CHRDEV;
-+ case S_IFBLK:
-+ return XFS_DIR3_FT_BLKDEV;
-+ case S_IFIFO:
-+ return XFS_DIR3_FT_FIFO;
-+ case S_IFSOCK:
-+ return XFS_DIR3_FT_SOCK;
-+ case S_IFLNK:
-+ return XFS_DIR3_FT_SYMLINK;
-+ default:
-+ return XFS_DIR3_FT_UNKNOWN;
-+ }
-+}
-
- /*
- * ASCII case-insensitive (ie. A-Z) support for directories that was
-@@ -631,7 +639,8 @@ xfs_dir2_isblock(
- if ((rval = xfs_bmap_last_offset(args->dp, &last, XFS_DATA_FORK)))
- return rval;
- rval = XFS_FSB_TO_B(args->dp->i_mount, last) == args->geo->blksize;
-- ASSERT(rval == 0 || args->dp->i_d.di_size == args->geo->blksize);
-+ if (rval != 0 && args->dp->i_d.di_size != args->geo->blksize)
-+ return -EFSCORRUPTED;
- *vp = rval;
- return 0;
- }
-diff --git a/fs/xfs/libxfs/xfs_dir2.h b/fs/xfs/libxfs/xfs_dir2.h
-index becc926..ae0d55b 100644
---- a/fs/xfs/libxfs/xfs_dir2.h
-+++ b/fs/xfs/libxfs/xfs_dir2.h
-@@ -18,6 +18,9 @@
- #ifndef __XFS_DIR2_H__
- #define __XFS_DIR2_H__
-
-+#include "xfs_da_format.h"
-+#include "xfs_da_btree.h"
-+
- struct xfs_defer_ops;
- struct xfs_da_args;
- struct xfs_inode;
-@@ -32,10 +35,9 @@ struct xfs_dir2_data_unused;
- extern struct xfs_name xfs_name_dotdot;
-
- /*
-- * directory filetype conversion tables.
-+ * Convert inode mode to directory entry filetype
- */
--#define S_SHIFT 12
--extern const unsigned char xfs_mode_to_ftype[];
-+extern unsigned char xfs_mode_to_ftype(int mode);
-
- /*
- * directory operations vector for encode/decode routines
-diff --git a/fs/xfs/libxfs/xfs_inode_buf.c b/fs/xfs/libxfs/xfs_inode_buf.c
-index c906e50..37ee7f0 100644
---- a/fs/xfs/libxfs/xfs_inode_buf.c
-+++ b/fs/xfs/libxfs/xfs_inode_buf.c
-@@ -29,6 +29,7 @@
- #include "xfs_icache.h"
- #include "xfs_trans.h"
- #include "xfs_ialloc.h"
-+#include "xfs_dir2.h"
-
- /*
- * Check that none of the inode's in the buffer have a next
-@@ -386,6 +387,7 @@ xfs_dinode_verify(
- struct xfs_inode *ip,
- struct xfs_dinode *dip)
- {
-+ uint16_t mode;
- uint16_t flags;
- uint64_t flags2;
-
-@@ -396,8 +398,12 @@ xfs_dinode_verify(
- if (be64_to_cpu(dip->di_size) & (1ULL << 63))
- return false;
-
-- /* No zero-length symlinks. */
-- if (S_ISLNK(be16_to_cpu(dip->di_mode)) && dip->di_size == 0)
-+ mode = be16_to_cpu(dip->di_mode);
-+ if (mode && xfs_mode_to_ftype(mode) == XFS_DIR3_FT_UNKNOWN)
-+ return false;
-+
-+ /* No zero-length symlinks/dirs. */
-+ if ((S_ISLNK(mode) || S_ISDIR(mode)) && dip->di_size == 0)
- return false;
-
- /* only version 3 or greater inodes are extensively verified here */
-diff --git a/fs/xfs/libxfs/xfs_sb.c b/fs/xfs/libxfs/xfs_sb.c
-index 2580262..584ec89 100644
---- a/fs/xfs/libxfs/xfs_sb.c
-+++ b/fs/xfs/libxfs/xfs_sb.c
-@@ -242,7 +242,7 @@ xfs_mount_validate_sb(
- sbp->sb_blocklog < XFS_MIN_BLOCKSIZE_LOG ||
- sbp->sb_blocklog > XFS_MAX_BLOCKSIZE_LOG ||
- sbp->sb_blocksize != (1 << sbp->sb_blocklog) ||
-- sbp->sb_dirblklog > XFS_MAX_BLOCKSIZE_LOG ||
-+ sbp->sb_dirblklog + sbp->sb_blocklog > XFS_MAX_BLOCKSIZE_LOG ||
- sbp->sb_inodesize < XFS_DINODE_MIN_SIZE ||
- sbp->sb_inodesize > XFS_DINODE_MAX_SIZE ||
- sbp->sb_inodelog < XFS_DINODE_MIN_LOG ||
-diff --git a/fs/xfs/xfs_bmap_util.c b/fs/xfs/xfs_bmap_util.c
-index 0670a8b..efb8ccd 100644
---- a/fs/xfs/xfs_bmap_util.c
-+++ b/fs/xfs/xfs_bmap_util.c
-@@ -528,7 +528,6 @@ xfs_getbmap(
- xfs_bmbt_irec_t *map; /* buffer for user's data */
- xfs_mount_t *mp; /* file system mount point */
- int nex; /* # of user extents can do */
-- int nexleft; /* # of user extents left */
- int subnex; /* # of bmapi's can do */
- int nmap; /* number of map entries */
- struct getbmapx *out; /* output structure */
-@@ -686,10 +685,8 @@ xfs_getbmap(
- goto out_free_map;
- }
-
-- nexleft = nex;
--
- do {
-- nmap = (nexleft > subnex) ? subnex : nexleft;
-+ nmap = (nex> subnex) ? subnex : nex;
- error = xfs_bmapi_read(ip, XFS_BB_TO_FSBT(mp, bmv->bmv_offset),
- XFS_BB_TO_FSB(mp, bmv->bmv_length),
- map, &nmap, bmapi_flags);
-@@ -697,8 +694,8 @@ xfs_getbmap(
- goto out_free_map;
- ASSERT(nmap <= subnex);
-
-- for (i = 0; i < nmap && nexleft && bmv->bmv_length &&
-- cur_ext < bmv->bmv_count; i++) {
-+ for (i = 0; i < nmap && bmv->bmv_length &&
-+ cur_ext < bmv->bmv_count - 1; i++) {
- out[cur_ext].bmv_oflags = 0;
- if (map[i].br_state == XFS_EXT_UNWRITTEN)
- out[cur_ext].bmv_oflags |= BMV_OF_PREALLOC;
-@@ -760,16 +757,27 @@ xfs_getbmap(
- continue;
- }
-
-+ /*
-+ * In order to report shared extents accurately,
-+ * we report each distinct shared/unshared part
-+ * of a single bmbt record using multiple bmap
-+ * extents. To make that happen, we iterate the
-+ * same map array item multiple times, each
-+ * time trimming out the subextent that we just
-+ * reported.
-+ *
-+ * Because of this, we must check the out array
-+ * index (cur_ext) directly against bmv_count-1
-+ * to avoid overflows.
-+ */
- if (inject_map.br_startblock != NULLFSBLOCK) {
- map[i] = inject_map;
- i--;
-- } else
-- nexleft--;
-+ }
- bmv->bmv_entries++;
- cur_ext++;
- }
-- } while (nmap && nexleft && bmv->bmv_length &&
-- cur_ext < bmv->bmv_count);
-+ } while (nmap && bmv->bmv_length && cur_ext < bmv->bmv_count - 1);
-
- out_free_map:
- kmem_free(map);
-diff --git a/fs/xfs/xfs_buf.c b/fs/xfs/xfs_buf.c
-index b5b9bff..d7a67d7 100644
---- a/fs/xfs/xfs_buf.c
-+++ b/fs/xfs/xfs_buf.c
-@@ -423,6 +423,7 @@ xfs_buf_allocate_memory(
- out_free_pages:
- for (i = 0; i < bp->b_page_count; i++)
- __free_page(bp->b_pages[i]);
-+ bp->b_flags &= ~_XBF_PAGES;
- return error;
- }
-
-diff --git a/fs/xfs/xfs_dquot.c b/fs/xfs/xfs_dquot.c
-index 7a30b8f..9d06cc3 100644
---- a/fs/xfs/xfs_dquot.c
-+++ b/fs/xfs/xfs_dquot.c
-@@ -710,6 +710,10 @@ xfs_dq_get_next_id(
- /* Simple advance */
- next_id = *id + 1;
-
-+ /* If we'd wrap past the max ID, stop */
-+ if (next_id < *id)
-+ return -ENOENT;
-+
- /* If new ID is within the current chunk, advancing it sufficed */
- if (next_id % mp->m_quotainfo->qi_dqperchunk) {
- *id = next_id;
-diff --git a/fs/xfs/xfs_iomap.c b/fs/xfs/xfs_iomap.c
-index 15a83813..cdc6bdd 100644
---- a/fs/xfs/xfs_iomap.c
-+++ b/fs/xfs/xfs_iomap.c
-@@ -681,7 +681,7 @@ xfs_iomap_write_allocate(
- xfs_trans_t *tp;
- int nimaps;
- int error = 0;
-- int flags = 0;
-+ int flags = XFS_BMAPI_DELALLOC;
- int nres;
-
- if (whichfork == XFS_COW_FORK)
-diff --git a/fs/xfs/xfs_iops.c b/fs/xfs/xfs_iops.c
-index 405a65c..f5e0f60 100644
---- a/fs/xfs/xfs_iops.c
-+++ b/fs/xfs/xfs_iops.c
-@@ -98,12 +98,27 @@ xfs_init_security(
- static void
- xfs_dentry_to_name(
- struct xfs_name *namep,
-+ struct dentry *dentry)
-+{
-+ namep->name = dentry->d_name.name;
-+ namep->len = dentry->d_name.len;
-+ namep->type = XFS_DIR3_FT_UNKNOWN;
-+}
-+
-+static int
-+xfs_dentry_mode_to_name(
-+ struct xfs_name *namep,
- struct dentry *dentry,
- int mode)
- {
- namep->name = dentry->d_name.name;
- namep->len = dentry->d_name.len;
-- namep->type = xfs_mode_to_ftype[(mode & S_IFMT) >> S_SHIFT];
-+ namep->type = xfs_mode_to_ftype(mode);
-+
-+ if (unlikely(namep->type == XFS_DIR3_FT_UNKNOWN))
-+ return -EFSCORRUPTED;
-+
-+ return 0;
- }
-
- STATIC void
-@@ -119,7 +134,7 @@ xfs_cleanup_inode(
- * xfs_init_security we must back out.
- * ENOSPC can hit here, among other things.
- */
-- xfs_dentry_to_name(&teardown, dentry, 0);
-+ xfs_dentry_to_name(&teardown, dentry);
-
- xfs_remove(XFS_I(dir), &teardown, XFS_I(inode));
- }
-@@ -154,8 +169,12 @@ xfs_generic_create(
- if (error)
- return error;
-
-+ /* Verify mode is valid also for tmpfile case */
-+ error = xfs_dentry_mode_to_name(&name, dentry, mode);
-+ if (unlikely(error))
-+ goto out_free_acl;
-+
- if (!tmpfile) {
-- xfs_dentry_to_name(&name, dentry, mode);
- error = xfs_create(XFS_I(dir), &name, mode, rdev, &ip);
- } else {
- error = xfs_create_tmpfile(XFS_I(dir), dentry, mode, &ip);
-@@ -248,7 +267,7 @@ xfs_vn_lookup(
- if (dentry->d_name.len >= MAXNAMELEN)
- return ERR_PTR(-ENAMETOOLONG);
-
-- xfs_dentry_to_name(&name, dentry, 0);
-+ xfs_dentry_to_name(&name, dentry);
- error = xfs_lookup(XFS_I(dir), &name, &cip, NULL);
- if (unlikely(error)) {
- if (unlikely(error != -ENOENT))
-@@ -275,7 +294,7 @@ xfs_vn_ci_lookup(
- if (dentry->d_name.len >= MAXNAMELEN)
- return ERR_PTR(-ENAMETOOLONG);
-
-- xfs_dentry_to_name(&xname, dentry, 0);
-+ xfs_dentry_to_name(&xname, dentry);
- error = xfs_lookup(XFS_I(dir), &xname, &ip, &ci_name);
- if (unlikely(error)) {
- if (unlikely(error != -ENOENT))
-@@ -310,7 +329,9 @@ xfs_vn_link(
- struct xfs_name name;
- int error;
-
-- xfs_dentry_to_name(&name, dentry, inode->i_mode);
-+ error = xfs_dentry_mode_to_name(&name, dentry, inode->i_mode);
-+ if (unlikely(error))
-+ return error;
-
- error = xfs_link(XFS_I(dir), XFS_I(inode), &name);
- if (unlikely(error))
-@@ -329,7 +350,7 @@ xfs_vn_unlink(
- struct xfs_name name;
- int error;
-
-- xfs_dentry_to_name(&name, dentry, 0);
-+ xfs_dentry_to_name(&name, dentry);
-
- error = xfs_remove(XFS_I(dir), &name, XFS_I(d_inode(dentry)));
- if (error)
-@@ -359,7 +380,9 @@ xfs_vn_symlink(
-
- mode = S_IFLNK |
- (irix_symlink_mode ? 0777 & ~current_umask() : S_IRWXUGO);
-- xfs_dentry_to_name(&name, dentry, mode);
-+ error = xfs_dentry_mode_to_name(&name, dentry, mode);
-+ if (unlikely(error))
-+ goto out;
-
- error = xfs_symlink(XFS_I(dir), &name, symname, mode, &cip);
- if (unlikely(error))
-@@ -395,6 +418,7 @@ xfs_vn_rename(
- {
- struct inode *new_inode = d_inode(ndentry);
- int omode = 0;
-+ int error;
- struct xfs_name oname;
- struct xfs_name nname;
-
-@@ -405,8 +429,14 @@ xfs_vn_rename(
- if (flags & RENAME_EXCHANGE)
- omode = d_inode(ndentry)->i_mode;
-
-- xfs_dentry_to_name(&oname, odentry, omode);
-- xfs_dentry_to_name(&nname, ndentry, d_inode(odentry)->i_mode);
-+ error = xfs_dentry_mode_to_name(&oname, odentry, omode);
-+ if (omode && unlikely(error))
-+ return error;
-+
-+ error = xfs_dentry_mode_to_name(&nname, ndentry,
-+ d_inode(odentry)->i_mode);
-+ if (unlikely(error))
-+ return error;
-
- return xfs_rename(XFS_I(odir), &oname, XFS_I(d_inode(odentry)),
- XFS_I(ndir), &nname,
-diff --git a/fs/xfs/xfs_linux.h b/fs/xfs/xfs_linux.h
-index 68640fb..1455b2520 100644
---- a/fs/xfs/xfs_linux.h
-+++ b/fs/xfs/xfs_linux.h
-@@ -330,11 +330,11 @@ static inline __uint64_t howmany_64(__uint64_t x, __uint32_t y)
- }
-
- #define ASSERT_ALWAYS(expr) \
-- (unlikely(expr) ? (void)0 : assfail(#expr, __FILE__, __LINE__))
-+ (likely(expr) ? (void)0 : assfail(#expr, __FILE__, __LINE__))
-
- #ifdef DEBUG
- #define ASSERT(expr) \
-- (unlikely(expr) ? (void)0 : assfail(#expr, __FILE__, __LINE__))
-+ (likely(expr) ? (void)0 : assfail(#expr, __FILE__, __LINE__))
-
- #ifndef STATIC
- # define STATIC noinline
-@@ -345,7 +345,7 @@ static inline __uint64_t howmany_64(__uint64_t x, __uint32_t y)
- #ifdef XFS_WARN
-
- #define ASSERT(expr) \
-- (unlikely(expr) ? (void)0 : asswarn(#expr, __FILE__, __LINE__))
-+ (likely(expr) ? (void)0 : asswarn(#expr, __FILE__, __LINE__))
-
- #ifndef STATIC
- # define STATIC static noinline
-diff --git a/fs/xfs/xfs_log.c b/fs/xfs/xfs_log.c
-index 3b74fa0..4017aa9 100644
---- a/fs/xfs/xfs_log.c
-+++ b/fs/xfs/xfs_log.c
-@@ -3324,12 +3324,8 @@ xfs_log_force(
- xfs_mount_t *mp,
- uint flags)
- {
-- int error;
--
- trace_xfs_log_force(mp, 0, _RET_IP_);
-- error = _xfs_log_force(mp, flags, NULL);
-- if (error)
-- xfs_warn(mp, "%s: error %d returned.", __func__, error);
-+ _xfs_log_force(mp, flags, NULL);
- }
-
- /*
-@@ -3473,12 +3469,8 @@ xfs_log_force_lsn(
- xfs_lsn_t lsn,
- uint flags)
- {
-- int error;
--
- trace_xfs_log_force(mp, lsn, _RET_IP_);
-- error = _xfs_log_force_lsn(mp, lsn, flags, NULL);
-- if (error)
-- xfs_warn(mp, "%s: error %d returned.", __func__, error);
-+ _xfs_log_force_lsn(mp, lsn, flags, NULL);
- }
-
- /*
-diff --git a/include/linux/tcp.h b/include/linux/tcp.h
-index a17ae7b..647532b 100644
---- a/include/linux/tcp.h
-+++ b/include/linux/tcp.h
-@@ -62,8 +62,13 @@ static inline unsigned int tcp_optlen(const struct sk_buff *skb)
-
- /* TCP Fast Open Cookie as stored in memory */
- struct tcp_fastopen_cookie {
-+ union {
-+ u8 val[TCP_FASTOPEN_COOKIE_MAX];
-+#if IS_ENABLED(CONFIG_IPV6)
-+ struct in6_addr addr;
-+#endif
-+ };
- s8 len;
-- u8 val[TCP_FASTOPEN_COOKIE_MAX];
- bool exp; /* In RFC6994 experimental option format */
- };
-
-diff --git a/include/linux/virtio_net.h b/include/linux/virtio_net.h
-index 1c912f8..f211c34 100644
---- a/include/linux/virtio_net.h
-+++ b/include/linux/virtio_net.h
-@@ -56,7 +56,8 @@ static inline int virtio_net_hdr_to_skb(struct sk_buff *skb,
-
- static inline int virtio_net_hdr_from_skb(const struct sk_buff *skb,
- struct virtio_net_hdr *hdr,
-- bool little_endian)
-+ bool little_endian,
-+ bool has_data_valid)
- {
- memset(hdr, 0, sizeof(*hdr));
-
-@@ -91,7 +92,8 @@ static inline int virtio_net_hdr_from_skb(const struct sk_buff *skb,
- skb_checksum_start_offset(skb));
- hdr->csum_offset = __cpu_to_virtio16(little_endian,
- skb->csum_offset);
-- } else if (skb->ip_summed == CHECKSUM_UNNECESSARY) {
-+ } else if (has_data_valid &&
-+ skb->ip_summed == CHECKSUM_UNNECESSARY) {
- hdr->flags = VIRTIO_NET_HDR_F_DATA_VALID;
- } /* else everything is zero */
-
-diff --git a/include/net/lwtunnel.h b/include/net/lwtunnel.h
-index ea3f80f..fc7c0db 100644
---- a/include/net/lwtunnel.h
-+++ b/include/net/lwtunnel.h
-@@ -43,13 +43,12 @@ struct lwtunnel_encap_ops {
- int (*get_encap_size)(struct lwtunnel_state *lwtstate);
- int (*cmp_encap)(struct lwtunnel_state *a, struct lwtunnel_state *b);
- int (*xmit)(struct sk_buff *skb);
-+
-+ struct module *owner;
- };
-
- #ifdef CONFIG_LWTUNNEL
--static inline void lwtstate_free(struct lwtunnel_state *lws)
--{
-- kfree(lws);
--}
-+void lwtstate_free(struct lwtunnel_state *lws);
-
- static inline struct lwtunnel_state *
- lwtstate_get(struct lwtunnel_state *lws)
-@@ -106,6 +105,8 @@ int lwtunnel_encap_add_ops(const struct lwtunnel_encap_ops *op,
- unsigned int num);
- int lwtunnel_encap_del_ops(const struct lwtunnel_encap_ops *op,
- unsigned int num);
-+int lwtunnel_valid_encap_type(u16 encap_type);
-+int lwtunnel_valid_encap_type_attr(struct nlattr *attr, int len);
- int lwtunnel_build_state(struct net_device *dev, u16 encap_type,
- struct nlattr *encap,
- unsigned int family, const void *cfg,
-@@ -169,6 +170,15 @@ static inline int lwtunnel_encap_del_ops(const struct lwtunnel_encap_ops *op,
- return -EOPNOTSUPP;
- }
-
-+static inline int lwtunnel_valid_encap_type(u16 encap_type)
-+{
-+ return -EOPNOTSUPP;
-+}
-+static inline int lwtunnel_valid_encap_type_attr(struct nlattr *attr, int len)
-+{
-+ return -EOPNOTSUPP;
-+}
-+
- static inline int lwtunnel_build_state(struct net_device *dev, u16 encap_type,
- struct nlattr *encap,
- unsigned int family, const void *cfg,
-diff --git a/net/ax25/ax25_subr.c b/net/ax25/ax25_subr.c
-index 655a7d4..983f0b5 100644
---- a/net/ax25/ax25_subr.c
-+++ b/net/ax25/ax25_subr.c
-@@ -264,7 +264,7 @@ void ax25_disconnect(ax25_cb *ax25, int reason)
- {
- ax25_clear_queues(ax25);
-
-- if (!sock_flag(ax25->sk, SOCK_DESTROY))
-+ if (!ax25->sk || !sock_flag(ax25->sk, SOCK_DESTROY))
- ax25_stop_heartbeat(ax25);
- ax25_stop_t1timer(ax25);
- ax25_stop_t2timer(ax25);
-diff --git a/net/bridge/br_netlink.c b/net/bridge/br_netlink.c
-index e99037c..0474106 100644
---- a/net/bridge/br_netlink.c
-+++ b/net/bridge/br_netlink.c
-@@ -781,20 +781,6 @@ static int br_validate(struct nlattr *tb[], struct nlattr *data[])
- return 0;
- }
-
--static int br_dev_newlink(struct net *src_net, struct net_device *dev,
-- struct nlattr *tb[], struct nlattr *data[])
--{
-- struct net_bridge *br = netdev_priv(dev);
--
-- if (tb[IFLA_ADDRESS]) {
-- spin_lock_bh(&br->lock);
-- br_stp_change_bridge_id(br, nla_data(tb[IFLA_ADDRESS]));
-- spin_unlock_bh(&br->lock);
-- }
--
-- return register_netdevice(dev);
--}
--
- static int br_port_slave_changelink(struct net_device *brdev,
- struct net_device *dev,
- struct nlattr *tb[],
-@@ -1093,6 +1079,25 @@ static int br_changelink(struct net_device *brdev, struct nlattr *tb[],
- return 0;
- }
-
-+static int br_dev_newlink(struct net *src_net, struct net_device *dev,
-+ struct nlattr *tb[], struct nlattr *data[])
-+{
-+ struct net_bridge *br = netdev_priv(dev);
-+ int err;
-+
-+ if (tb[IFLA_ADDRESS]) {
-+ spin_lock_bh(&br->lock);
-+ br_stp_change_bridge_id(br, nla_data(tb[IFLA_ADDRESS]));
-+ spin_unlock_bh(&br->lock);
-+ }
-+
-+ err = br_changelink(dev, tb, data);
-+ if (err)
-+ return err;
-+
-+ return register_netdevice(dev);
-+}
-+
- static size_t br_get_size(const struct net_device *brdev)
- {
- return nla_total_size(sizeof(u32)) + /* IFLA_BR_FORWARD_DELAY */
-diff --git a/net/core/dev.c b/net/core/dev.c
-index e1d731f..df51c50 100644
---- a/net/core/dev.c
-+++ b/net/core/dev.c
-@@ -2815,9 +2815,9 @@ static netdev_features_t harmonize_features(struct sk_buff *skb,
- if (skb->ip_summed != CHECKSUM_NONE &&
- !can_checksum_protocol(features, type)) {
- features &= ~(NETIF_F_CSUM_MASK | NETIF_F_GSO_MASK);
-- } else if (illegal_highdma(skb->dev, skb)) {
-- features &= ~NETIF_F_SG;
- }
-+ if (illegal_highdma(skb->dev, skb))
-+ features &= ~NETIF_F_SG;
-
- return features;
- }
-diff --git a/net/core/lwtunnel.c b/net/core/lwtunnel.c
-index e5f84c2..afa64f0 100644
---- a/net/core/lwtunnel.c
-+++ b/net/core/lwtunnel.c
-@@ -26,6 +26,7 @@
- #include <net/lwtunnel.h>
- #include <net/rtnetlink.h>
- #include <net/ip6_fib.h>
-+#include <net/nexthop.h>
-
- #ifdef CONFIG_MODULES
-
-@@ -65,6 +66,15 @@ EXPORT_SYMBOL(lwtunnel_state_alloc);
- static const struct lwtunnel_encap_ops __rcu *
- lwtun_encaps[LWTUNNEL_ENCAP_MAX + 1] __read_mostly;
-
-+void lwtstate_free(struct lwtunnel_state *lws)
-+{
-+ const struct lwtunnel_encap_ops *ops = lwtun_encaps[lws->type];
-+
-+ kfree(lws);
-+ module_put(ops->owner);
-+}
-+EXPORT_SYMBOL(lwtstate_free);
-+
- int lwtunnel_encap_add_ops(const struct lwtunnel_encap_ops *ops,
- unsigned int num)
- {
-@@ -110,25 +120,77 @@ int lwtunnel_build_state(struct net_device *dev, u16 encap_type,
- ret = -EOPNOTSUPP;
- rcu_read_lock();
- ops = rcu_dereference(lwtun_encaps[encap_type]);
-+ if (likely(ops && ops->build_state && try_module_get(ops->owner))) {
-+ ret = ops->build_state(dev, encap, family, cfg, lws);
-+ if (ret)
-+ module_put(ops->owner);
-+ }
-+ rcu_read_unlock();
-+
-+ return ret;
-+}
-+EXPORT_SYMBOL(lwtunnel_build_state);
-+
-+int lwtunnel_valid_encap_type(u16 encap_type)
-+{
-+ const struct lwtunnel_encap_ops *ops;
-+ int ret = -EINVAL;
-+
-+ if (encap_type == LWTUNNEL_ENCAP_NONE ||
-+ encap_type > LWTUNNEL_ENCAP_MAX)
-+ return ret;
-+
-+ rcu_read_lock();
-+ ops = rcu_dereference(lwtun_encaps[encap_type]);
-+ rcu_read_unlock();
- #ifdef CONFIG_MODULES
- if (!ops) {
- const char *encap_type_str = lwtunnel_encap_str(encap_type);
-
- if (encap_type_str) {
-- rcu_read_unlock();
-+ __rtnl_unlock();
- request_module("rtnl-lwt-%s", encap_type_str);
-+ rtnl_lock();
-+
- rcu_read_lock();
- ops = rcu_dereference(lwtun_encaps[encap_type]);
-+ rcu_read_unlock();
- }
- }
- #endif
-- if (likely(ops && ops->build_state))
-- ret = ops->build_state(dev, encap, family, cfg, lws);
-- rcu_read_unlock();
-+ return ops ? 0 : -EOPNOTSUPP;
-+}
-+EXPORT_SYMBOL(lwtunnel_valid_encap_type);
-
-- return ret;
-+int lwtunnel_valid_encap_type_attr(struct nlattr *attr, int remaining)
-+{
-+ struct rtnexthop *rtnh = (struct rtnexthop *)attr;
-+ struct nlattr *nla_entype;
-+ struct nlattr *attrs;
-+ struct nlattr *nla;
-+ u16 encap_type;
-+ int attrlen;
-+
-+ while (rtnh_ok(rtnh, remaining)) {
-+ attrlen = rtnh_attrlen(rtnh);
-+ if (attrlen > 0) {
-+ attrs = rtnh_attrs(rtnh);
-+ nla = nla_find(attrs, attrlen, RTA_ENCAP);
-+ nla_entype = nla_find(attrs, attrlen, RTA_ENCAP_TYPE);
-+
-+ if (nla_entype) {
-+ encap_type = nla_get_u16(nla_entype);
-+
-+ if (lwtunnel_valid_encap_type(encap_type) != 0)
-+ return -EOPNOTSUPP;
-+ }
-+ }
-+ rtnh = rtnh_next(rtnh, &remaining);
-+ }
-+
-+ return 0;
- }
--EXPORT_SYMBOL(lwtunnel_build_state);
-+EXPORT_SYMBOL(lwtunnel_valid_encap_type_attr);
-
- int lwtunnel_fill_encap(struct sk_buff *skb, struct lwtunnel_state *lwtstate)
- {
-diff --git a/net/dsa/slave.c b/net/dsa/slave.c
-index 30e2e21..3ff9d97 100644
---- a/net/dsa/slave.c
-+++ b/net/dsa/slave.c
-@@ -1201,6 +1201,8 @@ int dsa_slave_suspend(struct net_device *slave_dev)
- {
- struct dsa_slave_priv *p = netdev_priv(slave_dev);
-
-+ netif_device_detach(slave_dev);
-+
- if (p->phy) {
- phy_stop(p->phy);
- p->old_pause = -1;
-diff --git a/net/ipv4/fib_frontend.c b/net/ipv4/fib_frontend.c
-index 3e4f183..5b03d7f 100644
---- a/net/ipv4/fib_frontend.c
-+++ b/net/ipv4/fib_frontend.c
-@@ -46,6 +46,7 @@
- #include <net/rtnetlink.h>
- #include <net/xfrm.h>
- #include <net/l3mdev.h>
-+#include <net/lwtunnel.h>
- #include <trace/events/fib.h>
-
- #ifndef CONFIG_IP_MULTIPLE_TABLES
-@@ -676,6 +677,10 @@ static int rtm_to_fib_config(struct net *net, struct sk_buff *skb,
- cfg->fc_mx_len = nla_len(attr);
- break;
- case RTA_MULTIPATH:
-+ err = lwtunnel_valid_encap_type_attr(nla_data(attr),
-+ nla_len(attr));
-+ if (err < 0)
-+ goto errout;
- cfg->fc_mp = nla_data(attr);
- cfg->fc_mp_len = nla_len(attr);
- break;
-@@ -690,6 +695,9 @@ static int rtm_to_fib_config(struct net *net, struct sk_buff *skb,
- break;
- case RTA_ENCAP_TYPE:
- cfg->fc_encap_type = nla_get_u16(attr);
-+ err = lwtunnel_valid_encap_type(cfg->fc_encap_type);
-+ if (err < 0)
-+ goto errout;
- break;
- }
- }
-diff --git a/net/ipv4/fib_semantics.c b/net/ipv4/fib_semantics.c
-index a8508b7..6a40680 100644
---- a/net/ipv4/fib_semantics.c
-+++ b/net/ipv4/fib_semantics.c
-@@ -1278,8 +1278,9 @@ int fib_dump_info(struct sk_buff *skb, u32 portid, u32 seq, int event,
- nla_put_u32(skb, RTA_FLOW, fi->fib_nh[0].nh_tclassid))
- goto nla_put_failure;
- #endif
-- if (fi->fib_nh->nh_lwtstate)
-- lwtunnel_fill_encap(skb, fi->fib_nh->nh_lwtstate);
-+ if (fi->fib_nh->nh_lwtstate &&
-+ lwtunnel_fill_encap(skb, fi->fib_nh->nh_lwtstate) < 0)
-+ goto nla_put_failure;
- }
- #ifdef CONFIG_IP_ROUTE_MULTIPATH
- if (fi->fib_nhs > 1) {
-@@ -1315,8 +1316,10 @@ int fib_dump_info(struct sk_buff *skb, u32 portid, u32 seq, int event,
- nla_put_u32(skb, RTA_FLOW, nh->nh_tclassid))
- goto nla_put_failure;
- #endif
-- if (nh->nh_lwtstate)
-- lwtunnel_fill_encap(skb, nh->nh_lwtstate);
-+ if (nh->nh_lwtstate &&
-+ lwtunnel_fill_encap(skb, nh->nh_lwtstate) < 0)
-+ goto nla_put_failure;
-+
- /* length of rtnetlink header + attributes */
- rtnh->rtnh_len = nlmsg_get_pos(skb) - (void *) rtnh;
- } endfor_nexthops(fi);
-diff --git a/net/ipv4/ip_tunnel_core.c b/net/ipv4/ip_tunnel_core.c
-index fed3d29..0fd1976 100644
---- a/net/ipv4/ip_tunnel_core.c
-+++ b/net/ipv4/ip_tunnel_core.c
-@@ -313,6 +313,7 @@ static const struct lwtunnel_encap_ops ip_tun_lwt_ops = {
- .fill_encap = ip_tun_fill_encap_info,
- .get_encap_size = ip_tun_encap_nlsize,
- .cmp_encap = ip_tun_cmp_encap,
-+ .owner = THIS_MODULE,
- };
-
- static const struct nla_policy ip6_tun_policy[LWTUNNEL_IP6_MAX + 1] = {
-@@ -403,6 +404,7 @@ static const struct lwtunnel_encap_ops ip6_tun_lwt_ops = {
- .fill_encap = ip6_tun_fill_encap_info,
- .get_encap_size = ip6_tun_encap_nlsize,
- .cmp_encap = ip_tun_cmp_encap,
-+ .owner = THIS_MODULE,
- };
-
- void __init ip_tunnel_core_init(void)
-diff --git a/net/ipv4/route.c b/net/ipv4/route.c
-index 8197b06..d851cae 100644
---- a/net/ipv4/route.c
-+++ b/net/ipv4/route.c
-@@ -2440,7 +2440,7 @@ static int rt_fill_info(struct net *net, __be32 dst, __be32 src, u32 table_id,
- r->rtm_dst_len = 32;
- r->rtm_src_len = 0;
- r->rtm_tos = fl4->flowi4_tos;
-- r->rtm_table = table_id;
-+ r->rtm_table = table_id < 256 ? table_id : RT_TABLE_COMPAT;
- if (nla_put_u32(skb, RTA_TABLE, table_id))
- goto nla_put_failure;
- r->rtm_type = rt->rt_type;
-diff --git a/net/ipv4/tcp_fastopen.c b/net/ipv4/tcp_fastopen.c
-index 4e777a3..dd2560c 100644
---- a/net/ipv4/tcp_fastopen.c
-+++ b/net/ipv4/tcp_fastopen.c
-@@ -113,7 +113,7 @@ static bool tcp_fastopen_cookie_gen(struct request_sock *req,
- struct tcp_fastopen_cookie tmp;
-
- if (__tcp_fastopen_cookie_gen(&ip6h->saddr, &tmp)) {
-- struct in6_addr *buf = (struct in6_addr *) tmp.val;
-+ struct in6_addr *buf = &tmp.addr;
- int i;
-
- for (i = 0; i < 4; i++)
-@@ -205,6 +205,7 @@ static struct sock *tcp_fastopen_create_child(struct sock *sk,
- * scaled. So correct it appropriately.
- */
- tp->snd_wnd = ntohs(tcp_hdr(skb)->window);
-+ tp->max_window = tp->snd_wnd;
-
- /* Activate the retrans timer so that SYNACK can be retransmitted.
- * The request socket is not added to the ehash
-diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
-index 4bc5ba3..95dfcba 100644
---- a/net/ipv6/addrconf.c
-+++ b/net/ipv6/addrconf.c
-@@ -5515,8 +5515,7 @@ static void addrconf_disable_change(struct net *net, __s32 newf)
- struct net_device *dev;
- struct inet6_dev *idev;
-
-- rcu_read_lock();
-- for_each_netdev_rcu(net, dev) {
-+ for_each_netdev(net, dev) {
- idev = __in6_dev_get(dev);
- if (idev) {
- int changed = (!idev->cnf.disable_ipv6) ^ (!newf);
-@@ -5525,7 +5524,6 @@ static void addrconf_disable_change(struct net *net, __s32 newf)
- dev_disable_change(idev);
- }
- }
-- rcu_read_unlock();
- }
-
- static int addrconf_disable_ipv6(struct ctl_table *table, int *p, int newf)
-diff --git a/net/ipv6/ila/ila_lwt.c b/net/ipv6/ila/ila_lwt.c
-index e50c27a..f3db364 100644
---- a/net/ipv6/ila/ila_lwt.c
-+++ b/net/ipv6/ila/ila_lwt.c
-@@ -164,6 +164,7 @@ static const struct lwtunnel_encap_ops ila_encap_ops = {
- .fill_encap = ila_fill_encap_info,
- .get_encap_size = ila_encap_nlsize,
- .cmp_encap = ila_encap_cmp,
-+ .owner = THIS_MODULE,
- };
-
- int ila_lwt_init(void)
-diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c
-index d76674e..f95437f 100644
---- a/net/ipv6/ip6_tunnel.c
-+++ b/net/ipv6/ip6_tunnel.c
-@@ -1108,7 +1108,7 @@ int ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev, __u8 dsfield,
- t->parms.name);
- goto tx_err_dst_release;
- }
-- mtu = dst_mtu(dst) - psh_hlen;
-+ mtu = dst_mtu(dst) - psh_hlen - t->tun_hlen;
- if (encap_limit >= 0) {
- max_headroom += 8;
- mtu -= 8;
-@@ -1117,7 +1117,7 @@ int ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev, __u8 dsfield,
- mtu = IPV6_MIN_MTU;
- if (skb_dst(skb) && !t->parms.collect_md)
- skb_dst(skb)->ops->update_pmtu(skb_dst(skb), NULL, skb, mtu);
-- if (skb->len > mtu && !skb_is_gso(skb)) {
-+ if (skb->len - t->tun_hlen > mtu && !skb_is_gso(skb)) {
- *pmtu = mtu;
- err = -EMSGSIZE;
- goto tx_err_dst_release;
-diff --git a/net/ipv6/route.c b/net/ipv6/route.c
-index 1b57e11..bff4460 100644
---- a/net/ipv6/route.c
-+++ b/net/ipv6/route.c
-@@ -2885,6 +2885,11 @@ static int rtm_to_fib6_config(struct sk_buff *skb, struct nlmsghdr *nlh,
- if (tb[RTA_MULTIPATH]) {
- cfg->fc_mp = nla_data(tb[RTA_MULTIPATH]);
- cfg->fc_mp_len = nla_len(tb[RTA_MULTIPATH]);
-+
-+ err = lwtunnel_valid_encap_type_attr(cfg->fc_mp,
-+ cfg->fc_mp_len);
-+ if (err < 0)
-+ goto errout;
- }
-
- if (tb[RTA_PREF]) {
-@@ -2898,9 +2903,14 @@ static int rtm_to_fib6_config(struct sk_buff *skb, struct nlmsghdr *nlh,
- if (tb[RTA_ENCAP])
- cfg->fc_encap = tb[RTA_ENCAP];
-
-- if (tb[RTA_ENCAP_TYPE])
-+ if (tb[RTA_ENCAP_TYPE]) {
- cfg->fc_encap_type = nla_get_u16(tb[RTA_ENCAP_TYPE]);
-
-+ err = lwtunnel_valid_encap_type(cfg->fc_encap_type);
-+ if (err < 0)
-+ goto errout;
-+ }
-+
- if (tb[RTA_EXPIRES]) {
- unsigned long timeout = addrconf_timeout_fixup(nla_get_u32(tb[RTA_EXPIRES]), HZ);
-
-@@ -3306,7 +3316,8 @@ static int rt6_fill_node(struct net *net,
- if (nla_put_u8(skb, RTA_PREF, IPV6_EXTRACT_PREF(rt->rt6i_flags)))
- goto nla_put_failure;
-
-- lwtunnel_fill_encap(skb, rt->dst.lwtstate);
-+ if (lwtunnel_fill_encap(skb, rt->dst.lwtstate) < 0)
-+ goto nla_put_failure;
-
- nlmsg_end(skb, nlh);
- return 0;
-diff --git a/net/mpls/af_mpls.c b/net/mpls/af_mpls.c
-index 15fe976..5b77377 100644
---- a/net/mpls/af_mpls.c
-+++ b/net/mpls/af_mpls.c
-@@ -98,18 +98,19 @@ bool mpls_pkt_too_big(const struct sk_buff *skb, unsigned int mtu)
- }
- EXPORT_SYMBOL_GPL(mpls_pkt_too_big);
-
--static u32 mpls_multipath_hash(struct mpls_route *rt,
-- struct sk_buff *skb, bool bos)
-+static u32 mpls_multipath_hash(struct mpls_route *rt, struct sk_buff *skb)
- {
- struct mpls_entry_decoded dec;
-+ unsigned int mpls_hdr_len = 0;
- struct mpls_shim_hdr *hdr;
- bool eli_seen = false;
- int label_index;
- u32 hash = 0;
-
-- for (label_index = 0; label_index < MAX_MP_SELECT_LABELS && !bos;
-+ for (label_index = 0; label_index < MAX_MP_SELECT_LABELS;
- label_index++) {
-- if (!pskb_may_pull(skb, sizeof(*hdr) * label_index))
-+ mpls_hdr_len += sizeof(*hdr);
-+ if (!pskb_may_pull(skb, mpls_hdr_len))
- break;
-
- /* Read and decode the current label */
-@@ -134,37 +135,38 @@ static u32 mpls_multipath_hash(struct mpls_route *rt,
- eli_seen = true;
- }
-
-- bos = dec.bos;
-- if (bos && pskb_may_pull(skb, sizeof(*hdr) * label_index +
-- sizeof(struct iphdr))) {
-+ if (!dec.bos)
-+ continue;
-+
-+ /* found bottom label; does skb have room for a header? */
-+ if (pskb_may_pull(skb, mpls_hdr_len + sizeof(struct iphdr))) {
- const struct iphdr *v4hdr;
-
-- v4hdr = (const struct iphdr *)(mpls_hdr(skb) +
-- label_index);
-+ v4hdr = (const struct iphdr *)(hdr + 1);
- if (v4hdr->version == 4) {
- hash = jhash_3words(ntohl(v4hdr->saddr),
- ntohl(v4hdr->daddr),
- v4hdr->protocol, hash);
- } else if (v4hdr->version == 6 &&
-- pskb_may_pull(skb, sizeof(*hdr) * label_index +
-- sizeof(struct ipv6hdr))) {
-+ pskb_may_pull(skb, mpls_hdr_len +
-+ sizeof(struct ipv6hdr))) {
- const struct ipv6hdr *v6hdr;
-
-- v6hdr = (const struct ipv6hdr *)(mpls_hdr(skb) +
-- label_index);
--
-+ v6hdr = (const struct ipv6hdr *)(hdr + 1);
- hash = __ipv6_addr_jhash(&v6hdr->saddr, hash);
- hash = __ipv6_addr_jhash(&v6hdr->daddr, hash);
- hash = jhash_1word(v6hdr->nexthdr, hash);
- }
- }
-+
-+ break;
- }
-
- return hash;
- }
-
- static struct mpls_nh *mpls_select_multipath(struct mpls_route *rt,
-- struct sk_buff *skb, bool bos)
-+ struct sk_buff *skb)
- {
- int alive = ACCESS_ONCE(rt->rt_nhn_alive);
- u32 hash = 0;
-@@ -180,7 +182,7 @@ static struct mpls_nh *mpls_select_multipath(struct mpls_route *rt,
- if (alive <= 0)
- return NULL;
-
-- hash = mpls_multipath_hash(rt, skb, bos);
-+ hash = mpls_multipath_hash(rt, skb);
- nh_index = hash % alive;
- if (alive == rt->rt_nhn)
- goto out;
-@@ -278,17 +280,11 @@ static int mpls_forward(struct sk_buff *skb, struct net_device *dev,
- hdr = mpls_hdr(skb);
- dec = mpls_entry_decode(hdr);
-
-- /* Pop the label */
-- skb_pull(skb, sizeof(*hdr));
-- skb_reset_network_header(skb);
--
-- skb_orphan(skb);
--
- rt = mpls_route_input_rcu(net, dec.label);
- if (!rt)
- goto drop;
-
-- nh = mpls_select_multipath(rt, skb, dec.bos);
-+ nh = mpls_select_multipath(rt, skb);
- if (!nh)
- goto drop;
-
-@@ -297,6 +293,12 @@ static int mpls_forward(struct sk_buff *skb, struct net_device *dev,
- if (!mpls_output_possible(out_dev))
- goto drop;
-
-+ /* Pop the label */
-+ skb_pull(skb, sizeof(*hdr));
-+ skb_reset_network_header(skb);
-+
-+ skb_orphan(skb);
-+
- if (skb_warn_if_lro(skb))
- goto drop;
-
-diff --git a/net/mpls/mpls_iptunnel.c b/net/mpls/mpls_iptunnel.c
-index cf52cf3..bc9aaf5 100644
---- a/net/mpls/mpls_iptunnel.c
-+++ b/net/mpls/mpls_iptunnel.c
-@@ -218,6 +218,7 @@ static const struct lwtunnel_encap_ops mpls_iptun_ops = {
- .fill_encap = mpls_fill_encap_info,
- .get_encap_size = mpls_encap_nlsize,
- .cmp_encap = mpls_encap_cmp,
-+ .owner = THIS_MODULE,
- };
-
- static int __init mpls_iptunnel_init(void)
-diff --git a/net/openvswitch/conntrack.c b/net/openvswitch/conntrack.c
-index fecefa2..eab210b 100644
---- a/net/openvswitch/conntrack.c
-+++ b/net/openvswitch/conntrack.c
-@@ -514,7 +514,7 @@ static int ovs_ct_nat_execute(struct sk_buff *skb, struct nf_conn *ct,
- int hooknum, nh_off, err = NF_ACCEPT;
-
- nh_off = skb_network_offset(skb);
-- skb_pull(skb, nh_off);
-+ skb_pull_rcsum(skb, nh_off);
-
- /* See HOOK2MANIP(). */
- if (maniptype == NF_NAT_MANIP_SRC)
-@@ -579,6 +579,7 @@ static int ovs_ct_nat_execute(struct sk_buff *skb, struct nf_conn *ct,
- err = nf_nat_packet(ct, ctinfo, hooknum, skb);
- push:
- skb_push(skb, nh_off);
-+ skb_postpush_rcsum(skb, skb->data, nh_off);
-
- return err;
- }
-@@ -890,7 +891,7 @@ int ovs_ct_execute(struct net *net, struct sk_buff *skb,
-
- /* The conntrack module expects to be working at L3. */
- nh_ofs = skb_network_offset(skb);
-- skb_pull(skb, nh_ofs);
-+ skb_pull_rcsum(skb, nh_ofs);
-
- if (key->ip.frag != OVS_FRAG_TYPE_NONE) {
- err = handle_fragments(net, key, info->zone.id, skb);
-@@ -904,6 +905,7 @@ int ovs_ct_execute(struct net *net, struct sk_buff *skb,
- err = ovs_ct_lookup(net, key, info, skb);
-
- skb_push(skb, nh_ofs);
-+ skb_postpush_rcsum(skb, skb->data, nh_ofs);
- if (err)
- kfree_skb(skb);
- return err;
-diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
-index dd23323..94e4a59 100644
---- a/net/packet/af_packet.c
-+++ b/net/packet/af_packet.c
-@@ -1972,7 +1972,7 @@ static int __packet_rcv_vnet(const struct sk_buff *skb,
- {
- *vnet_hdr = (const struct virtio_net_hdr) { 0 };
-
-- if (virtio_net_hdr_from_skb(skb, vnet_hdr, vio_le()))
-+ if (virtio_net_hdr_from_skb(skb, vnet_hdr, vio_le(), true))
- BUG();
-
- return 0;
-diff --git a/net/sched/act_api.c b/net/sched/act_api.c
-index f893d18..c6c2a93 100644
---- a/net/sched/act_api.c
-+++ b/net/sched/act_api.c
-@@ -903,8 +903,6 @@ tca_action_gd(struct net *net, struct nlattr *nla, struct nlmsghdr *n,
- goto err;
- }
- act->order = i;
-- if (event == RTM_GETACTION)
-- act->tcfa_refcnt++;
- list_add_tail(&act->list, &actions);
- }
-
-@@ -917,7 +915,8 @@ tca_action_gd(struct net *net, struct nlattr *nla, struct nlmsghdr *n,
- return ret;
- }
- err:
-- tcf_action_destroy(&actions, 0);
-+ if (event != RTM_GETACTION)
-+ tcf_action_destroy(&actions, 0);
- return ret;
- }
-
-diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
-index 2358f26..2d03d5b 100644
---- a/net/unix/af_unix.c
-+++ b/net/unix/af_unix.c
-@@ -995,6 +995,7 @@ static int unix_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
- unsigned int hash;
- struct unix_address *addr;
- struct hlist_head *list;
-+ struct path path = { NULL, NULL };
-
- err = -EINVAL;
- if (sunaddr->sun_family != AF_UNIX)
-@@ -1010,9 +1011,20 @@ static int unix_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
- goto out;
- addr_len = err;
-
-+ if (sun_path[0]) {
-+ umode_t mode = S_IFSOCK |
-+ (SOCK_INODE(sock)->i_mode & ~current_umask());
-+ err = unix_mknod(sun_path, mode, &path);
-+ if (err) {
-+ if (err == -EEXIST)
-+ err = -EADDRINUSE;
-+ goto out;
-+ }
-+ }
-+
- err = mutex_lock_interruptible(&u->bindlock);
- if (err)
-- goto out;
-+ goto out_put;
-
- err = -EINVAL;
- if (u->addr)
-@@ -1029,16 +1041,6 @@ static int unix_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
- atomic_set(&addr->refcnt, 1);
-
- if (sun_path[0]) {
-- struct path path;
-- umode_t mode = S_IFSOCK |
-- (SOCK_INODE(sock)->i_mode & ~current_umask());
-- err = unix_mknod(sun_path, mode, &path);
-- if (err) {
-- if (err == -EEXIST)
-- err = -EADDRINUSE;
-- unix_release_addr(addr);
-- goto out_up;
-- }
- addr->hash = UNIX_HASH_SIZE;
- hash = d_real_inode(path.dentry)->i_ino & (UNIX_HASH_SIZE - 1);
- spin_lock(&unix_table_lock);
-@@ -1065,6 +1067,9 @@ static int unix_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
- spin_unlock(&unix_table_lock);
- out_up:
- mutex_unlock(&u->bindlock);
-+out_put:
-+ if (err)
-+ path_put(&path);
- out:
- return err;
- }
diff --git a/4.9.9/1008_linux-4.9.9.patch b/4.9.9/1008_linux-4.9.9.patch
deleted file mode 100644
index 411ce9b..0000000
--- a/4.9.9/1008_linux-4.9.9.patch
+++ /dev/null
@@ -1,2333 +0,0 @@
-diff --git a/Makefile b/Makefile
-index 1130803..c0c41c9 100644
---- a/Makefile
-+++ b/Makefile
-@@ -1,6 +1,6 @@
- VERSION = 4
- PATCHLEVEL = 9
--SUBLEVEL = 8
-+SUBLEVEL = 9
- EXTRAVERSION =
- NAME = Roaring Lionus
-
-diff --git a/arch/arm64/crypto/aes-modes.S b/arch/arm64/crypto/aes-modes.S
-index c53dbea..838dad5 100644
---- a/arch/arm64/crypto/aes-modes.S
-+++ b/arch/arm64/crypto/aes-modes.S
-@@ -193,15 +193,16 @@ AES_ENTRY(aes_cbc_encrypt)
- cbz w6, .Lcbcencloop
-
- ld1 {v0.16b}, [x5] /* get iv */
-- enc_prepare w3, x2, x5
-+ enc_prepare w3, x2, x6
-
- .Lcbcencloop:
- ld1 {v1.16b}, [x1], #16 /* get next pt block */
- eor v0.16b, v0.16b, v1.16b /* ..and xor with iv */
-- encrypt_block v0, w3, x2, x5, w6
-+ encrypt_block v0, w3, x2, x6, w7
- st1 {v0.16b}, [x0], #16
- subs w4, w4, #1
- bne .Lcbcencloop
-+ st1 {v0.16b}, [x5] /* return iv */
- ret
- AES_ENDPROC(aes_cbc_encrypt)
-
-@@ -211,7 +212,7 @@ AES_ENTRY(aes_cbc_decrypt)
- cbz w6, .LcbcdecloopNx
-
- ld1 {v7.16b}, [x5] /* get iv */
-- dec_prepare w3, x2, x5
-+ dec_prepare w3, x2, x6
-
- .LcbcdecloopNx:
- #if INTERLEAVE >= 2
-@@ -248,7 +249,7 @@ AES_ENTRY(aes_cbc_decrypt)
- .Lcbcdecloop:
- ld1 {v1.16b}, [x1], #16 /* get next ct block */
- mov v0.16b, v1.16b /* ...and copy to v0 */
-- decrypt_block v0, w3, x2, x5, w6
-+ decrypt_block v0, w3, x2, x6, w7
- eor v0.16b, v0.16b, v7.16b /* xor with iv => pt */
- mov v7.16b, v1.16b /* ct is next iv */
- st1 {v0.16b}, [x0], #16
-@@ -256,6 +257,7 @@ AES_ENTRY(aes_cbc_decrypt)
- bne .Lcbcdecloop
- .Lcbcdecout:
- FRAME_POP
-+ st1 {v7.16b}, [x5] /* return iv */
- ret
- AES_ENDPROC(aes_cbc_decrypt)
-
-@@ -267,24 +269,15 @@ AES_ENDPROC(aes_cbc_decrypt)
-
- AES_ENTRY(aes_ctr_encrypt)
- FRAME_PUSH
-- cbnz w6, .Lctrfirst /* 1st time around? */
-- umov x5, v4.d[1] /* keep swabbed ctr in reg */
-- rev x5, x5
--#if INTERLEAVE >= 2
-- cmn w5, w4 /* 32 bit overflow? */
-- bcs .Lctrinc
-- add x5, x5, #1 /* increment BE ctr */
-- b .LctrincNx
--#else
-- b .Lctrinc
--#endif
--.Lctrfirst:
-+ cbz w6, .Lctrnotfirst /* 1st time around? */
- enc_prepare w3, x2, x6
- ld1 {v4.16b}, [x5]
-- umov x5, v4.d[1] /* keep swabbed ctr in reg */
-- rev x5, x5
-+
-+.Lctrnotfirst:
-+ umov x8, v4.d[1] /* keep swabbed ctr in reg */
-+ rev x8, x8
- #if INTERLEAVE >= 2
-- cmn w5, w4 /* 32 bit overflow? */
-+ cmn w8, w4 /* 32 bit overflow? */
- bcs .Lctrloop
- .LctrloopNx:
- subs w4, w4, #INTERLEAVE
-@@ -292,11 +285,11 @@ AES_ENTRY(aes_ctr_encrypt)
- #if INTERLEAVE == 2
- mov v0.8b, v4.8b
- mov v1.8b, v4.8b
-- rev x7, x5
-- add x5, x5, #1
-+ rev x7, x8
-+ add x8, x8, #1
- ins v0.d[1], x7
-- rev x7, x5
-- add x5, x5, #1
-+ rev x7, x8
-+ add x8, x8, #1
- ins v1.d[1], x7
- ld1 {v2.16b-v3.16b}, [x1], #32 /* get 2 input blocks */
- do_encrypt_block2x
-@@ -305,7 +298,7 @@ AES_ENTRY(aes_ctr_encrypt)
- st1 {v0.16b-v1.16b}, [x0], #32
- #else
- ldr q8, =0x30000000200000001 /* addends 1,2,3[,0] */
-- dup v7.4s, w5
-+ dup v7.4s, w8
- mov v0.16b, v4.16b
- add v7.4s, v7.4s, v8.4s
- mov v1.16b, v4.16b
-@@ -323,18 +316,12 @@ AES_ENTRY(aes_ctr_encrypt)
- eor v2.16b, v7.16b, v2.16b
- eor v3.16b, v5.16b, v3.16b
- st1 {v0.16b-v3.16b}, [x0], #64
-- add x5, x5, #INTERLEAVE
-+ add x8, x8, #INTERLEAVE
- #endif
-- cbz w4, .LctroutNx
--.LctrincNx:
-- rev x7, x5
-+ rev x7, x8
- ins v4.d[1], x7
-+ cbz w4, .Lctrout
- b .LctrloopNx
--.LctroutNx:
-- sub x5, x5, #1
-- rev x7, x5
-- ins v4.d[1], x7
-- b .Lctrout
- .Lctr1x:
- adds w4, w4, #INTERLEAVE
- beq .Lctrout
-@@ -342,30 +329,39 @@ AES_ENTRY(aes_ctr_encrypt)
- .Lctrloop:
- mov v0.16b, v4.16b
- encrypt_block v0, w3, x2, x6, w7
-+
-+ adds x8, x8, #1 /* increment BE ctr */
-+ rev x7, x8
-+ ins v4.d[1], x7
-+ bcs .Lctrcarry /* overflow? */
-+
-+.Lctrcarrydone:
- subs w4, w4, #1
- bmi .Lctrhalfblock /* blocks < 0 means 1/2 block */
- ld1 {v3.16b}, [x1], #16
- eor v3.16b, v0.16b, v3.16b
- st1 {v3.16b}, [x0], #16
-- beq .Lctrout
--.Lctrinc:
-- adds x5, x5, #1 /* increment BE ctr */
-- rev x7, x5
-- ins v4.d[1], x7
-- bcc .Lctrloop /* no overflow? */
-- umov x7, v4.d[0] /* load upper word of ctr */
-- rev x7, x7 /* ... to handle the carry */
-- add x7, x7, #1
-- rev x7, x7
-- ins v4.d[0], x7
-- b .Lctrloop
-+ bne .Lctrloop
-+
-+.Lctrout:
-+ st1 {v4.16b}, [x5] /* return next CTR value */
-+ FRAME_POP
-+ ret
-+
- .Lctrhalfblock:
- ld1 {v3.8b}, [x1]
- eor v3.8b, v0.8b, v3.8b
- st1 {v3.8b}, [x0]
--.Lctrout:
- FRAME_POP
- ret
-+
-+.Lctrcarry:
-+ umov x7, v4.d[0] /* load upper word of ctr */
-+ rev x7, x7 /* ... to handle the carry */
-+ add x7, x7, #1
-+ rev x7, x7
-+ ins v4.d[0], x7
-+ b .Lctrcarrydone
- AES_ENDPROC(aes_ctr_encrypt)
- .ltorg
-
-diff --git a/arch/powerpc/include/asm/cpu_has_feature.h b/arch/powerpc/include/asm/cpu_has_feature.h
-index b312b15..6e834ca 100644
---- a/arch/powerpc/include/asm/cpu_has_feature.h
-+++ b/arch/powerpc/include/asm/cpu_has_feature.h
-@@ -23,7 +23,9 @@ static __always_inline bool cpu_has_feature(unsigned long feature)
- {
- int i;
-
-+#ifndef __clang__ /* clang can't cope with this */
- BUILD_BUG_ON(!__builtin_constant_p(feature));
-+#endif
-
- #ifdef CONFIG_JUMP_LABEL_FEATURE_CHECK_DEBUG
- if (!static_key_initialized) {
-diff --git a/arch/powerpc/include/asm/mmu.h b/arch/powerpc/include/asm/mmu.h
-index e311c25..a244e09 100644
---- a/arch/powerpc/include/asm/mmu.h
-+++ b/arch/powerpc/include/asm/mmu.h
-@@ -160,7 +160,9 @@ static __always_inline bool mmu_has_feature(unsigned long feature)
- {
- int i;
-
-+#ifndef __clang__ /* clang can't cope with this */
- BUILD_BUG_ON(!__builtin_constant_p(feature));
-+#endif
-
- #ifdef CONFIG_JUMP_LABEL_FEATURE_CHECK_DEBUG
- if (!static_key_initialized) {
-diff --git a/arch/powerpc/kernel/eeh_driver.c b/arch/powerpc/kernel/eeh_driver.c
-index 5c31369..a5dd493 100644
---- a/arch/powerpc/kernel/eeh_driver.c
-+++ b/arch/powerpc/kernel/eeh_driver.c
-@@ -545,7 +545,7 @@ static void *eeh_pe_detach_dev(void *data, void *userdata)
- static void *__eeh_clear_pe_frozen_state(void *data, void *flag)
- {
- struct eeh_pe *pe = (struct eeh_pe *)data;
-- bool *clear_sw_state = flag;
-+ bool clear_sw_state = *(bool *)flag;
- int i, rc = 1;
-
- for (i = 0; rc && i < 3; i++)
-diff --git a/arch/powerpc/kernel/prom_init.c b/arch/powerpc/kernel/prom_init.c
-index 88ac964..1e8c572 100644
---- a/arch/powerpc/kernel/prom_init.c
-+++ b/arch/powerpc/kernel/prom_init.c
-@@ -2747,6 +2747,9 @@ static void __init prom_find_boot_cpu(void)
-
- cpu_pkg = call_prom("instance-to-package", 1, 1, prom_cpu);
-
-+ if (!PHANDLE_VALID(cpu_pkg))
-+ return;
-+
- prom_getprop(cpu_pkg, "reg", &rval, sizeof(rval));
- prom.cpu = be32_to_cpu(rval);
-
-diff --git a/arch/powerpc/mm/pgtable-radix.c b/arch/powerpc/mm/pgtable-radix.c
-index ebb7f46..9a25dce 100644
---- a/arch/powerpc/mm/pgtable-radix.c
-+++ b/arch/powerpc/mm/pgtable-radix.c
-@@ -65,7 +65,7 @@ int radix__map_kernel_page(unsigned long ea, unsigned long pa,
- if (!pmdp)
- return -ENOMEM;
- if (map_page_size == PMD_SIZE) {
-- ptep = (pte_t *)pudp;
-+ ptep = pmdp_ptep(pmdp);
- goto set_the_pte;
- }
- ptep = pte_alloc_kernel(pmdp, ea);
-@@ -90,7 +90,7 @@ int radix__map_kernel_page(unsigned long ea, unsigned long pa,
- }
- pmdp = pmd_offset(pudp, ea);
- if (map_page_size == PMD_SIZE) {
-- ptep = (pte_t *)pudp;
-+ ptep = pmdp_ptep(pmdp);
- goto set_the_pte;
- }
- if (!pmd_present(*pmdp)) {
-diff --git a/arch/x86/events/intel/uncore.c b/arch/x86/events/intel/uncore.c
-index dbaaf7dc..19d646a 100644
---- a/arch/x86/events/intel/uncore.c
-+++ b/arch/x86/events/intel/uncore.c
-@@ -763,30 +763,6 @@ static void uncore_pmu_unregister(struct intel_uncore_pmu *pmu)
- pmu->registered = false;
- }
-
--static void __uncore_exit_boxes(struct intel_uncore_type *type, int cpu)
--{
-- struct intel_uncore_pmu *pmu = type->pmus;
-- struct intel_uncore_box *box;
-- int i, pkg;
--
-- if (pmu) {
-- pkg = topology_physical_package_id(cpu);
-- for (i = 0; i < type->num_boxes; i++, pmu++) {
-- box = pmu->boxes[pkg];
-- if (box)
-- uncore_box_exit(box);
-- }
-- }
--}
--
--static void uncore_exit_boxes(void *dummy)
--{
-- struct intel_uncore_type **types;
--
-- for (types = uncore_msr_uncores; *types; types++)
-- __uncore_exit_boxes(*types++, smp_processor_id());
--}
--
- static void uncore_free_boxes(struct intel_uncore_pmu *pmu)
- {
- int pkg;
-@@ -1077,22 +1053,12 @@ static int uncore_cpu_dying(unsigned int cpu)
- return 0;
- }
-
--static int first_init;
--
- static int uncore_cpu_starting(unsigned int cpu)
- {
- struct intel_uncore_type *type, **types = uncore_msr_uncores;
- struct intel_uncore_pmu *pmu;
- struct intel_uncore_box *box;
-- int i, pkg, ncpus = 1;
--
-- if (first_init) {
-- /*
-- * On init we get the number of online cpus in the package
-- * and set refcount for all of them.
-- */
-- ncpus = cpumask_weight(topology_core_cpumask(cpu));
-- }
-+ int i, pkg;
-
- pkg = topology_logical_package_id(cpu);
- for (; *types; types++) {
-@@ -1103,7 +1069,7 @@ static int uncore_cpu_starting(unsigned int cpu)
- if (!box)
- continue;
- /* The first cpu on a package activates the box */
-- if (atomic_add_return(ncpus, &box->refcnt) == ncpus)
-+ if (atomic_inc_return(&box->refcnt) == 1)
- uncore_box_init(box);
- }
- }
-@@ -1407,19 +1373,17 @@ static int __init intel_uncore_init(void)
- "PERF_X86_UNCORE_PREP",
- uncore_cpu_prepare, NULL);
- }
-- first_init = 1;
-+
- cpuhp_setup_state(CPUHP_AP_PERF_X86_UNCORE_STARTING,
- "AP_PERF_X86_UNCORE_STARTING",
- uncore_cpu_starting, uncore_cpu_dying);
-- first_init = 0;
-+
- cpuhp_setup_state(CPUHP_AP_PERF_X86_UNCORE_ONLINE,
- "AP_PERF_X86_UNCORE_ONLINE",
- uncore_event_cpu_online, uncore_event_cpu_offline);
- return 0;
-
- err:
-- /* Undo box->init_box() */
-- on_each_cpu_mask(&uncore_cpu_mask, uncore_exit_boxes, NULL, 1);
- uncore_types_exit(uncore_msr_uncores);
- uncore_pci_exit();
- return ret;
-diff --git a/arch/x86/kernel/apic/io_apic.c b/arch/x86/kernel/apic/io_apic.c
-index 3d8ff40..7249f15 100644
---- a/arch/x86/kernel/apic/io_apic.c
-+++ b/arch/x86/kernel/apic/io_apic.c
-@@ -2118,6 +2118,7 @@ static inline void __init check_timer(void)
- if (idx != -1 && irq_trigger(idx))
- unmask_ioapic_irq(irq_get_chip_data(0));
- }
-+ irq_domain_deactivate_irq(irq_data);
- irq_domain_activate_irq(irq_data);
- if (timer_irq_works()) {
- if (disable_timer_pin_1 > 0)
-@@ -2139,6 +2140,7 @@ static inline void __init check_timer(void)
- * legacy devices should be connected to IO APIC #0
- */
- replace_pin_at_irq_node(data, node, apic1, pin1, apic2, pin2);
-+ irq_domain_deactivate_irq(irq_data);
- irq_domain_activate_irq(irq_data);
- legacy_pic->unmask(0);
- if (timer_irq_works()) {
-diff --git a/arch/x86/kernel/hpet.c b/arch/x86/kernel/hpet.c
-index 274fab9..932348fb 100644
---- a/arch/x86/kernel/hpet.c
-+++ b/arch/x86/kernel/hpet.c
-@@ -352,6 +352,7 @@ static int hpet_resume(struct clock_event_device *evt, int timer)
- } else {
- struct hpet_dev *hdev = EVT_TO_HPET_DEV(evt);
-
-+ irq_domain_deactivate_irq(irq_get_irq_data(hdev->irq));
- irq_domain_activate_irq(irq_get_irq_data(hdev->irq));
- disable_irq(hdev->irq);
- irq_set_affinity(hdev->irq, cpumask_of(hdev->cpu));
-diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
-index 487b957..731044e 100644
---- a/arch/x86/kvm/x86.c
-+++ b/arch/x86/kvm/x86.c
-@@ -3148,6 +3148,7 @@ static void fill_xsave(u8 *dest, struct kvm_vcpu *vcpu)
- memcpy(dest, xsave, XSAVE_HDR_OFFSET);
-
- /* Set XSTATE_BV */
-+ xstate_bv &= vcpu->arch.guest_supported_xcr0 | XFEATURE_MASK_FPSSE;
- *(u64 *)(dest + XSAVE_HDR_OFFSET) = xstate_bv;
-
- /*
-diff --git a/arch/x86/platform/efi/efi_64.c b/arch/x86/platform/efi/efi_64.c
-index 319148b..2f25a36 100644
---- a/arch/x86/platform/efi/efi_64.c
-+++ b/arch/x86/platform/efi/efi_64.c
-@@ -269,6 +269,22 @@ int __init efi_setup_page_tables(unsigned long pa_memmap, unsigned num_pages)
- efi_scratch.use_pgd = true;
-
- /*
-+ * Certain firmware versions are way too sentimential and still believe
-+ * they are exclusive and unquestionable owners of the first physical page,
-+ * even though they explicitly mark it as EFI_CONVENTIONAL_MEMORY
-+ * (but then write-access it later during SetVirtualAddressMap()).
-+ *
-+ * Create a 1:1 mapping for this page, to avoid triple faults during early
-+ * boot with such firmware. We are free to hand this page to the BIOS,
-+ * as trim_bios_range() will reserve the first page and isolate it away
-+ * from memory allocators anyway.
-+ */
-+ if (kernel_map_pages_in_pgd(pgd, 0x0, 0x0, 1, _PAGE_RW)) {
-+ pr_err("Failed to create 1:1 mapping for the first page!\n");
-+ return 1;
-+ }
-+
-+ /*
- * When making calls to the firmware everything needs to be 1:1
- * mapped and addressable with 32-bit pointers. Map the kernel
- * text and allocate a new stack because we can't rely on the
-diff --git a/arch/xtensa/kernel/setup.c b/arch/xtensa/kernel/setup.c
-index 88a044a..32cdc2c 100644
---- a/arch/xtensa/kernel/setup.c
-+++ b/arch/xtensa/kernel/setup.c
-@@ -540,7 +540,7 @@ subsys_initcall(topology_init);
-
- void cpu_reset(void)
- {
--#if XCHAL_HAVE_PTP_MMU
-+#if XCHAL_HAVE_PTP_MMU && IS_ENABLED(CONFIG_MMU)
- local_irq_disable();
- /*
- * We have full MMU: all autoload ways, ways 7, 8 and 9 of DTLB must
-diff --git a/crypto/algapi.c b/crypto/algapi.c
-index df939b5..1fad2a6 100644
---- a/crypto/algapi.c
-+++ b/crypto/algapi.c
-@@ -356,6 +356,7 @@ int crypto_register_alg(struct crypto_alg *alg)
- struct crypto_larval *larval;
- int err;
-
-+ alg->cra_flags &= ~CRYPTO_ALG_DEAD;
- err = crypto_check_alg(alg);
- if (err)
- return err;
-diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
-index 223a770..33e363d 100644
---- a/drivers/ata/libata-core.c
-+++ b/drivers/ata/libata-core.c
-@@ -1695,6 +1695,8 @@ unsigned ata_exec_internal_sg(struct ata_device *dev,
-
- if (qc->err_mask & ~AC_ERR_OTHER)
- qc->err_mask &= ~AC_ERR_OTHER;
-+ } else if (qc->tf.command == ATA_CMD_REQ_SENSE_DATA) {
-+ qc->result_tf.command |= ATA_SENSE;
- }
-
- /* finish up */
-@@ -4316,10 +4318,10 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = {
- { "ST380013AS", "3.20", ATA_HORKAGE_MAX_SEC_1024 },
-
- /*
-- * Device times out with higher max sects.
-+ * These devices time out with higher max sects.
- * https://bugzilla.kernel.org/show_bug.cgi?id=121671
- */
-- { "LITEON CX1-JB256-HP", NULL, ATA_HORKAGE_MAX_SEC_1024 },
-+ { "LITEON CX1-JB*-HP", NULL, ATA_HORKAGE_MAX_SEC_1024 },
-
- /* Devices we expect to fail diagnostics */
-
-diff --git a/drivers/ata/sata_mv.c b/drivers/ata/sata_mv.c
-index 823e938..2f32782 100644
---- a/drivers/ata/sata_mv.c
-+++ b/drivers/ata/sata_mv.c
-@@ -4132,6 +4132,9 @@ static int mv_platform_probe(struct platform_device *pdev)
- host->iomap = NULL;
- hpriv->base = devm_ioremap(&pdev->dev, res->start,
- resource_size(res));
-+ if (!hpriv->base)
-+ return -ENOMEM;
-+
- hpriv->base -= SATAHC0_REG_BASE;
-
- hpriv->clk = clk_get(&pdev->dev, NULL);
-diff --git a/drivers/base/memory.c b/drivers/base/memory.c
-index e7f86a8..c5cdd19 100644
---- a/drivers/base/memory.c
-+++ b/drivers/base/memory.c
-@@ -391,33 +391,33 @@ static ssize_t show_valid_zones(struct device *dev,
- {
- struct memory_block *mem = to_memory_block(dev);
- unsigned long start_pfn, end_pfn;
-+ unsigned long valid_start, valid_end, valid_pages;
- unsigned long nr_pages = PAGES_PER_SECTION * sections_per_block;
-- struct page *first_page;
- struct zone *zone;
- int zone_shift = 0;
-
- start_pfn = section_nr_to_pfn(mem->start_section_nr);
- end_pfn = start_pfn + nr_pages;
-- first_page = pfn_to_page(start_pfn);
-
- /* The block contains more than one zone can not be offlined. */
-- if (!test_pages_in_a_zone(start_pfn, end_pfn))
-+ if (!test_pages_in_a_zone(start_pfn, end_pfn, &valid_start, &valid_end))
- return sprintf(buf, "none\n");
-
-- zone = page_zone(first_page);
-+ zone = page_zone(pfn_to_page(valid_start));
-+ valid_pages = valid_end - valid_start;
-
- /* MMOP_ONLINE_KEEP */
- sprintf(buf, "%s", zone->name);
-
- /* MMOP_ONLINE_KERNEL */
-- zone_can_shift(start_pfn, nr_pages, ZONE_NORMAL, &zone_shift);
-+ zone_can_shift(valid_start, valid_pages, ZONE_NORMAL, &zone_shift);
- if (zone_shift) {
- strcat(buf, " ");
- strcat(buf, (zone + zone_shift)->name);
- }
-
- /* MMOP_ONLINE_MOVABLE */
-- zone_can_shift(start_pfn, nr_pages, ZONE_MOVABLE, &zone_shift);
-+ zone_can_shift(valid_start, valid_pages, ZONE_MOVABLE, &zone_shift);
- if (zone_shift) {
- strcat(buf, " ");
- strcat(buf, (zone + zone_shift)->name);
-diff --git a/drivers/bcma/bcma_private.h b/drivers/bcma/bcma_private.h
-index f642c42..168fa17 100644
---- a/drivers/bcma/bcma_private.h
-+++ b/drivers/bcma/bcma_private.h
-@@ -45,6 +45,9 @@ int bcma_sprom_get(struct bcma_bus *bus);
- void bcma_core_chipcommon_early_init(struct bcma_drv_cc *cc);
- void bcma_core_chipcommon_init(struct bcma_drv_cc *cc);
- void bcma_chipco_bcm4331_ext_pa_lines_ctl(struct bcma_drv_cc *cc, bool enable);
-+#ifdef CONFIG_BCMA_DRIVER_MIPS
-+void bcma_chipco_serial_init(struct bcma_drv_cc *cc);
-+#endif /* CONFIG_BCMA_DRIVER_MIPS */
-
- /* driver_chipcommon_b.c */
- int bcma_core_chipcommon_b_init(struct bcma_drv_cc_b *ccb);
-diff --git a/drivers/bcma/driver_chipcommon.c b/drivers/bcma/driver_chipcommon.c
-index b4f6520..62f5bfa 100644
---- a/drivers/bcma/driver_chipcommon.c
-+++ b/drivers/bcma/driver_chipcommon.c
-@@ -15,8 +15,6 @@
- #include <linux/platform_device.h>
- #include <linux/bcma/bcma.h>
-
--static void bcma_chipco_serial_init(struct bcma_drv_cc *cc);
--
- static inline u32 bcma_cc_write32_masked(struct bcma_drv_cc *cc, u16 offset,
- u32 mask, u32 value)
- {
-@@ -186,9 +184,6 @@ void bcma_core_chipcommon_early_init(struct bcma_drv_cc *cc)
- if (cc->capabilities & BCMA_CC_CAP_PMU)
- bcma_pmu_early_init(cc);
-
-- if (IS_BUILTIN(CONFIG_BCM47XX) && bus->hosttype == BCMA_HOSTTYPE_SOC)
-- bcma_chipco_serial_init(cc);
--
- if (bus->hosttype == BCMA_HOSTTYPE_SOC)
- bcma_core_chipcommon_flash_detect(cc);
-
-@@ -378,9 +373,9 @@ u32 bcma_chipco_gpio_pulldown(struct bcma_drv_cc *cc, u32 mask, u32 value)
- return res;
- }
-
--static void bcma_chipco_serial_init(struct bcma_drv_cc *cc)
-+#ifdef CONFIG_BCMA_DRIVER_MIPS
-+void bcma_chipco_serial_init(struct bcma_drv_cc *cc)
- {
--#if IS_BUILTIN(CONFIG_BCM47XX)
- unsigned int irq;
- u32 baud_base;
- u32 i;
-@@ -422,5 +417,5 @@ static void bcma_chipco_serial_init(struct bcma_drv_cc *cc)
- ports[i].baud_base = baud_base;
- ports[i].reg_shift = 0;
- }
--#endif /* CONFIG_BCM47XX */
- }
-+#endif /* CONFIG_BCMA_DRIVER_MIPS */
-diff --git a/drivers/bcma/driver_mips.c b/drivers/bcma/driver_mips.c
-index 96f1713..89af807 100644
---- a/drivers/bcma/driver_mips.c
-+++ b/drivers/bcma/driver_mips.c
-@@ -278,9 +278,12 @@ static void bcma_core_mips_nvram_init(struct bcma_drv_mips *mcore)
-
- void bcma_core_mips_early_init(struct bcma_drv_mips *mcore)
- {
-+ struct bcma_bus *bus = mcore->core->bus;
-+
- if (mcore->early_setup_done)
- return;
-
-+ bcma_chipco_serial_init(&bus->drv_cc);
- bcma_core_mips_nvram_init(mcore);
-
- mcore->early_setup_done = true;
-diff --git a/drivers/dma/cppi41.c b/drivers/dma/cppi41.c
-index d5ba43a..55c1782 100644
---- a/drivers/dma/cppi41.c
-+++ b/drivers/dma/cppi41.c
-@@ -153,6 +153,8 @@ struct cppi41_dd {
-
- /* context for suspend/resume */
- unsigned int dma_tdfdq;
-+
-+ bool is_suspended;
- };
-
- #define FIST_COMPLETION_QUEUE 93
-@@ -257,6 +259,10 @@ static struct cppi41_channel *desc_to_chan(struct cppi41_dd *cdd, u32 desc)
- BUG_ON(desc_num >= ALLOC_DECS_NUM);
- c = cdd->chan_busy[desc_num];
- cdd->chan_busy[desc_num] = NULL;
-+
-+ /* Usecount for chan_busy[], paired with push_desc_queue() */
-+ pm_runtime_put(cdd->ddev.dev);
-+
- return c;
- }
-
-@@ -447,6 +453,15 @@ static void push_desc_queue(struct cppi41_channel *c)
- */
- __iowmb();
-
-+ /*
-+ * DMA transfers can take at least 200ms to complete with USB mass
-+ * storage connected. To prevent autosuspend timeouts, we must use
-+ * pm_runtime_get/put() when chan_busy[] is modified. This will get
-+ * cleared in desc_to_chan() or cppi41_stop_chan() depending on the
-+ * outcome of the transfer.
-+ */
-+ pm_runtime_get(cdd->ddev.dev);
-+
- desc_phys = lower_32_bits(c->desc_phys);
- desc_num = (desc_phys - cdd->descs_phys) / sizeof(struct cppi41_desc);
- WARN_ON(cdd->chan_busy[desc_num]);
-@@ -457,20 +472,26 @@ static void push_desc_queue(struct cppi41_channel *c)
- cppi_writel(reg, cdd->qmgr_mem + QMGR_QUEUE_D(c->q_num));
- }
-
--static void pending_desc(struct cppi41_channel *c)
-+/*
-+ * Caller must hold cdd->lock to prevent push_desc_queue()
-+ * getting called out of order. We have both cppi41_dma_issue_pending()
-+ * and cppi41_runtime_resume() call this function.
-+ */
-+static void cppi41_run_queue(struct cppi41_dd *cdd)
- {
-- struct cppi41_dd *cdd = c->cdd;
-- unsigned long flags;
-+ struct cppi41_channel *c, *_c;
-
-- spin_lock_irqsave(&cdd->lock, flags);
-- list_add_tail(&c->node, &cdd->pending);
-- spin_unlock_irqrestore(&cdd->lock, flags);
-+ list_for_each_entry_safe(c, _c, &cdd->pending, node) {
-+ push_desc_queue(c);
-+ list_del(&c->node);
-+ }
- }
-
- static void cppi41_dma_issue_pending(struct dma_chan *chan)
- {
- struct cppi41_channel *c = to_cpp41_chan(chan);
- struct cppi41_dd *cdd = c->cdd;
-+ unsigned long flags;
- int error;
-
- error = pm_runtime_get(cdd->ddev.dev);
-@@ -482,10 +503,11 @@ static void cppi41_dma_issue_pending(struct dma_chan *chan)
- return;
- }
-
-- if (likely(pm_runtime_active(cdd->ddev.dev)))
-- push_desc_queue(c);
-- else
-- pending_desc(c);
-+ spin_lock_irqsave(&cdd->lock, flags);
-+ list_add_tail(&c->node, &cdd->pending);
-+ if (!cdd->is_suspended)
-+ cppi41_run_queue(cdd);
-+ spin_unlock_irqrestore(&cdd->lock, flags);
-
- pm_runtime_mark_last_busy(cdd->ddev.dev);
- pm_runtime_put_autosuspend(cdd->ddev.dev);
-@@ -705,6 +727,9 @@ static int cppi41_stop_chan(struct dma_chan *chan)
- WARN_ON(!cdd->chan_busy[desc_num]);
- cdd->chan_busy[desc_num] = NULL;
-
-+ /* Usecount for chan_busy[], paired with push_desc_queue() */
-+ pm_runtime_put(cdd->ddev.dev);
-+
- return 0;
- }
-
-@@ -1150,8 +1175,12 @@ static int __maybe_unused cppi41_resume(struct device *dev)
- static int __maybe_unused cppi41_runtime_suspend(struct device *dev)
- {
- struct cppi41_dd *cdd = dev_get_drvdata(dev);
-+ unsigned long flags;
-
-+ spin_lock_irqsave(&cdd->lock, flags);
-+ cdd->is_suspended = true;
- WARN_ON(!list_empty(&cdd->pending));
-+ spin_unlock_irqrestore(&cdd->lock, flags);
-
- return 0;
- }
-@@ -1159,14 +1188,11 @@ static int __maybe_unused cppi41_runtime_suspend(struct device *dev)
- static int __maybe_unused cppi41_runtime_resume(struct device *dev)
- {
- struct cppi41_dd *cdd = dev_get_drvdata(dev);
-- struct cppi41_channel *c, *_c;
- unsigned long flags;
-
- spin_lock_irqsave(&cdd->lock, flags);
-- list_for_each_entry_safe(c, _c, &cdd->pending, node) {
-- push_desc_queue(c);
-- list_del(&c->node);
-- }
-+ cdd->is_suspended = false;
-+ cppi41_run_queue(cdd);
- spin_unlock_irqrestore(&cdd->lock, flags);
-
- return 0;
-diff --git a/drivers/firmware/efi/libstub/fdt.c b/drivers/firmware/efi/libstub/fdt.c
-index 921dfa0..260c4b4 100644
---- a/drivers/firmware/efi/libstub/fdt.c
-+++ b/drivers/firmware/efi/libstub/fdt.c
-@@ -187,6 +187,7 @@ static efi_status_t update_fdt_memmap(void *fdt, struct efi_boot_memmap *map)
- struct exit_boot_struct {
- efi_memory_desc_t *runtime_map;
- int *runtime_entry_count;
-+ void *new_fdt_addr;
- };
-
- static efi_status_t exit_boot_func(efi_system_table_t *sys_table_arg,
-@@ -202,7 +203,7 @@ static efi_status_t exit_boot_func(efi_system_table_t *sys_table_arg,
- efi_get_virtmap(*map->map, *map->map_size, *map->desc_size,
- p->runtime_map, p->runtime_entry_count);
-
-- return EFI_SUCCESS;
-+ return update_fdt_memmap(p->new_fdt_addr, map);
- }
-
- /*
-@@ -300,22 +301,13 @@ efi_status_t allocate_new_fdt_and_exit_boot(efi_system_table_t *sys_table,
-
- priv.runtime_map = runtime_map;
- priv.runtime_entry_count = &runtime_entry_count;
-+ priv.new_fdt_addr = (void *)*new_fdt_addr;
- status = efi_exit_boot_services(sys_table, handle, &map, &priv,
- exit_boot_func);
-
- if (status == EFI_SUCCESS) {
- efi_set_virtual_address_map_t *svam;
-
-- status = update_fdt_memmap((void *)*new_fdt_addr, &map);
-- if (status != EFI_SUCCESS) {
-- /*
-- * The kernel won't get far without the memory map, but
-- * may still be able to print something meaningful so
-- * return success here.
-- */
-- return EFI_SUCCESS;
-- }
--
- /* Install the new virtual address map */
- svam = sys_table->runtime->set_virtual_address_map;
- status = svam(runtime_entry_count * desc_size, desc_size,
-diff --git a/drivers/gpu/drm/amd/amdgpu/gmc_v6_0.c b/drivers/gpu/drm/amd/amdgpu/gmc_v6_0.c
-index b13c8aa..6df924f 100644
---- a/drivers/gpu/drm/amd/amdgpu/gmc_v6_0.c
-+++ b/drivers/gpu/drm/amd/amdgpu/gmc_v6_0.c
-@@ -227,6 +227,9 @@ static void gmc_v6_0_mc_program(struct amdgpu_device *adev)
- }
- WREG32(HDP_REG_COHERENCY_FLUSH_CNTL, 0);
-
-+ if (adev->mode_info.num_crtc)
-+ amdgpu_display_set_vga_render_state(adev, false);
-+
- gmc_v6_0_mc_stop(adev, &save);
-
- if (gmc_v6_0_wait_for_idle((void *)adev)) {
-@@ -256,7 +259,6 @@ static void gmc_v6_0_mc_program(struct amdgpu_device *adev)
- dev_warn(adev->dev, "Wait for MC idle timedout !\n");
- }
- gmc_v6_0_mc_resume(adev, &save);
-- amdgpu_display_set_vga_render_state(adev, false);
- }
-
- static int gmc_v6_0_mc_init(struct amdgpu_device *adev)
-diff --git a/drivers/gpu/drm/i915/intel_lrc.c b/drivers/gpu/drm/i915/intel_lrc.c
-index 67db157..4147e51 100644
---- a/drivers/gpu/drm/i915/intel_lrc.c
-+++ b/drivers/gpu/drm/i915/intel_lrc.c
-@@ -2152,30 +2152,42 @@ static int execlists_context_deferred_alloc(struct i915_gem_context *ctx,
-
- void intel_lr_context_resume(struct drm_i915_private *dev_priv)
- {
-- struct i915_gem_context *ctx = dev_priv->kernel_context;
- struct intel_engine_cs *engine;
-+ struct i915_gem_context *ctx;
-+
-+ /* Because we emit WA_TAIL_DWORDS there may be a disparity
-+ * between our bookkeeping in ce->ring->head and ce->ring->tail and
-+ * that stored in context. As we only write new commands from
-+ * ce->ring->tail onwards, everything before that is junk. If the GPU
-+ * starts reading from its RING_HEAD from the context, it may try to
-+ * execute that junk and die.
-+ *
-+ * So to avoid that we reset the context images upon resume. For
-+ * simplicity, we just zero everything out.
-+ */
-+ list_for_each_entry(ctx, &dev_priv->context_list, link) {
-+ for_each_engine(engine, dev_priv) {
-+ struct intel_context *ce = &ctx->engine[engine->id];
-+ u32 *reg;
-
-- for_each_engine(engine, dev_priv) {
-- struct intel_context *ce = &ctx->engine[engine->id];
-- void *vaddr;
-- uint32_t *reg_state;
--
-- if (!ce->state)
-- continue;
--
-- vaddr = i915_gem_object_pin_map(ce->state->obj, I915_MAP_WB);
-- if (WARN_ON(IS_ERR(vaddr)))
-- continue;
-+ if (!ce->state)
-+ continue;
-
-- reg_state = vaddr + LRC_STATE_PN * PAGE_SIZE;
-+ reg = i915_gem_object_pin_map(ce->state->obj,
-+ I915_MAP_WB);
-+ if (WARN_ON(IS_ERR(reg)))
-+ continue;
-
-- reg_state[CTX_RING_HEAD+1] = 0;
-- reg_state[CTX_RING_TAIL+1] = 0;
-+ reg += LRC_STATE_PN * PAGE_SIZE / sizeof(*reg);
-+ reg[CTX_RING_HEAD+1] = 0;
-+ reg[CTX_RING_TAIL+1] = 0;
-
-- ce->state->obj->dirty = true;
-- i915_gem_object_unpin_map(ce->state->obj);
-+ ce->state->obj->dirty = true;
-+ i915_gem_object_unpin_map(ce->state->obj);
-
-- ce->ring->head = 0;
-- ce->ring->tail = 0;
-+ ce->ring->head = ce->ring->tail = 0;
-+ ce->ring->last_retired_head = -1;
-+ intel_ring_update_space(ce->ring);
-+ }
- }
- }
-diff --git a/drivers/gpu/drm/nouveau/dispnv04/hw.c b/drivers/gpu/drm/nouveau/dispnv04/hw.c
-index 74856a8..e64f524 100644
---- a/drivers/gpu/drm/nouveau/dispnv04/hw.c
-+++ b/drivers/gpu/drm/nouveau/dispnv04/hw.c
-@@ -222,6 +222,7 @@ nouveau_hw_get_clock(struct drm_device *dev, enum nvbios_pll_type plltype)
- uint32_t mpllP;
-
- pci_read_config_dword(pci_get_bus_and_slot(0, 3), 0x6c, &mpllP);
-+ mpllP = (mpllP >> 8) & 0xf;
- if (!mpllP)
- mpllP = 4;
-
-@@ -232,7 +233,7 @@ nouveau_hw_get_clock(struct drm_device *dev, enum nvbios_pll_type plltype)
- uint32_t clock;
-
- pci_read_config_dword(pci_get_bus_and_slot(0, 5), 0x4c, &clock);
-- return clock;
-+ return clock / 1000;
- }
-
- ret = nouveau_hw_get_pllvals(dev, plltype, &pllvals);
-diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/disp/hdagt215.c b/drivers/gpu/drm/nouveau/nvkm/engine/disp/hdagt215.c
-index 6f0436d..f8f2f16 100644
---- a/drivers/gpu/drm/nouveau/nvkm/engine/disp/hdagt215.c
-+++ b/drivers/gpu/drm/nouveau/nvkm/engine/disp/hdagt215.c
-@@ -59,7 +59,7 @@ gt215_hda_eld(NV50_DISP_MTHD_V1)
- );
- }
- for (i = 0; i < size; i++)
-- nvkm_wr32(device, 0x61c440 + soff, (i << 8) | args->v0.data[0]);
-+ nvkm_wr32(device, 0x61c440 + soff, (i << 8) | args->v0.data[i]);
- for (; i < 0x60; i++)
- nvkm_wr32(device, 0x61c440 + soff, (i << 8));
- nvkm_mask(device, 0x61c448 + soff, 0x80000003, 0x80000003);
-diff --git a/drivers/hid/hid-cp2112.c b/drivers/hid/hid-cp2112.c
-index 60d3020..e06c134 100644
---- a/drivers/hid/hid-cp2112.c
-+++ b/drivers/hid/hid-cp2112.c
-@@ -167,7 +167,7 @@ struct cp2112_device {
- atomic_t xfer_avail;
- struct gpio_chip gc;
- u8 *in_out_buffer;
-- spinlock_t lock;
-+ struct mutex lock;
- };
-
- static int gpio_push_pull = 0xFF;
-@@ -179,10 +179,9 @@ static int cp2112_gpio_direction_input(struct gpio_chip *chip, unsigned offset)
- struct cp2112_device *dev = gpiochip_get_data(chip);
- struct hid_device *hdev = dev->hdev;
- u8 *buf = dev->in_out_buffer;
-- unsigned long flags;
- int ret;
-
-- spin_lock_irqsave(&dev->lock, flags);
-+ mutex_lock(&dev->lock);
-
- ret = hid_hw_raw_request(hdev, CP2112_GPIO_CONFIG, buf,
- CP2112_GPIO_CONFIG_LENGTH, HID_FEATURE_REPORT,
-@@ -206,8 +205,8 @@ static int cp2112_gpio_direction_input(struct gpio_chip *chip, unsigned offset)
- ret = 0;
-
- exit:
-- spin_unlock_irqrestore(&dev->lock, flags);
-- return ret <= 0 ? ret : -EIO;
-+ mutex_unlock(&dev->lock);
-+ return ret < 0 ? ret : -EIO;
- }
-
- static void cp2112_gpio_set(struct gpio_chip *chip, unsigned offset, int value)
-@@ -215,10 +214,9 @@ static void cp2112_gpio_set(struct gpio_chip *chip, unsigned offset, int value)
- struct cp2112_device *dev = gpiochip_get_data(chip);
- struct hid_device *hdev = dev->hdev;
- u8 *buf = dev->in_out_buffer;
-- unsigned long flags;
- int ret;
-
-- spin_lock_irqsave(&dev->lock, flags);
-+ mutex_lock(&dev->lock);
-
- buf[0] = CP2112_GPIO_SET;
- buf[1] = value ? 0xff : 0;
-@@ -230,7 +228,7 @@ static void cp2112_gpio_set(struct gpio_chip *chip, unsigned offset, int value)
- if (ret < 0)
- hid_err(hdev, "error setting GPIO values: %d\n", ret);
-
-- spin_unlock_irqrestore(&dev->lock, flags);
-+ mutex_unlock(&dev->lock);
- }
-
- static int cp2112_gpio_get(struct gpio_chip *chip, unsigned offset)
-@@ -238,10 +236,9 @@ static int cp2112_gpio_get(struct gpio_chip *chip, unsigned offset)
- struct cp2112_device *dev = gpiochip_get_data(chip);
- struct hid_device *hdev = dev->hdev;
- u8 *buf = dev->in_out_buffer;
-- unsigned long flags;
- int ret;
-
-- spin_lock_irqsave(&dev->lock, flags);
-+ mutex_lock(&dev->lock);
-
- ret = hid_hw_raw_request(hdev, CP2112_GPIO_GET, buf,
- CP2112_GPIO_GET_LENGTH, HID_FEATURE_REPORT,
-@@ -255,7 +252,7 @@ static int cp2112_gpio_get(struct gpio_chip *chip, unsigned offset)
- ret = (buf[1] >> offset) & 1;
-
- exit:
-- spin_unlock_irqrestore(&dev->lock, flags);
-+ mutex_unlock(&dev->lock);
-
- return ret;
- }
-@@ -266,10 +263,9 @@ static int cp2112_gpio_direction_output(struct gpio_chip *chip,
- struct cp2112_device *dev = gpiochip_get_data(chip);
- struct hid_device *hdev = dev->hdev;
- u8 *buf = dev->in_out_buffer;
-- unsigned long flags;
- int ret;
-
-- spin_lock_irqsave(&dev->lock, flags);
-+ mutex_lock(&dev->lock);
-
- ret = hid_hw_raw_request(hdev, CP2112_GPIO_CONFIG, buf,
- CP2112_GPIO_CONFIG_LENGTH, HID_FEATURE_REPORT,
-@@ -290,7 +286,7 @@ static int cp2112_gpio_direction_output(struct gpio_chip *chip,
- goto fail;
- }
-
-- spin_unlock_irqrestore(&dev->lock, flags);
-+ mutex_unlock(&dev->lock);
-
- /*
- * Set gpio value when output direction is already set,
-@@ -301,7 +297,7 @@ static int cp2112_gpio_direction_output(struct gpio_chip *chip,
- return 0;
-
- fail:
-- spin_unlock_irqrestore(&dev->lock, flags);
-+ mutex_unlock(&dev->lock);
- return ret < 0 ? ret : -EIO;
- }
-
-@@ -1057,7 +1053,7 @@ static int cp2112_probe(struct hid_device *hdev, const struct hid_device_id *id)
- if (!dev->in_out_buffer)
- return -ENOMEM;
-
-- spin_lock_init(&dev->lock);
-+ mutex_init(&dev->lock);
-
- ret = hid_parse(hdev);
- if (ret) {
-diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
-index 575aa65..9845189 100644
---- a/drivers/hid/hid-ids.h
-+++ b/drivers/hid/hid-ids.h
-@@ -76,6 +76,9 @@
- #define USB_VENDOR_ID_ALPS_JP 0x044E
- #define HID_DEVICE_ID_ALPS_U1_DUAL 0x120B
-
-+#define USB_VENDOR_ID_AMI 0x046b
-+#define USB_DEVICE_ID_AMI_VIRT_KEYBOARD_AND_MOUSE 0xff10
-+
- #define USB_VENDOR_ID_ANTON 0x1130
- #define USB_DEVICE_ID_ANTON_TOUCH_PAD 0x3101
-
-diff --git a/drivers/hid/hid-lg.c b/drivers/hid/hid-lg.c
-index c5c5fbe..52026dc 100644
---- a/drivers/hid/hid-lg.c
-+++ b/drivers/hid/hid-lg.c
-@@ -872,7 +872,7 @@ static const struct hid_device_id lg_devices[] = {
- { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_WINGMAN_FFG),
- .driver_data = LG_NOGET | LG_FF4 },
- { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_RUMBLEPAD2),
-- .driver_data = LG_FF2 },
-+ .driver_data = LG_NOGET | LG_FF2 },
- { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_FLIGHT_SYSTEM_G940),
- .driver_data = LG_FF3 },
- { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_SPACENAVIGATOR),
-diff --git a/drivers/hid/usbhid/hid-quirks.c b/drivers/hid/usbhid/hid-quirks.c
-index e6cfd32..cde060f 100644
---- a/drivers/hid/usbhid/hid-quirks.c
-+++ b/drivers/hid/usbhid/hid-quirks.c
-@@ -57,6 +57,7 @@ static const struct hid_blacklist {
- { USB_VENDOR_ID_AIREN, USB_DEVICE_ID_AIREN_SLIMPLUS, HID_QUIRK_NOGET },
- { USB_VENDOR_ID_AKAI, USB_DEVICE_ID_AKAI_MPKMINI2, HID_QUIRK_NO_INIT_REPORTS },
- { USB_VENDOR_ID_AKAI_09E8, USB_DEVICE_ID_AKAI_09E8_MIDIMIX, HID_QUIRK_NO_INIT_REPORTS },
-+ { USB_VENDOR_ID_AMI, USB_DEVICE_ID_AMI_VIRT_KEYBOARD_AND_MOUSE, HID_QUIRK_ALWAYS_POLL },
- { USB_VENDOR_ID_ATEN, USB_DEVICE_ID_ATEN_UC100KM, HID_QUIRK_NOGET },
- { USB_VENDOR_ID_ATEN, USB_DEVICE_ID_ATEN_CS124U, HID_QUIRK_NOGET },
- { USB_VENDOR_ID_ATEN, USB_DEVICE_ID_ATEN_2PORTKVM, HID_QUIRK_NOGET },
-diff --git a/drivers/hid/wacom_wac.c b/drivers/hid/wacom_wac.c
-index 1cb7992..623be90 100644
---- a/drivers/hid/wacom_wac.c
-+++ b/drivers/hid/wacom_wac.c
-@@ -164,19 +164,21 @@ static int wacom_pl_irq(struct wacom_wac *wacom)
- wacom->id[0] = STYLUS_DEVICE_ID;
- }
-
-- pressure = (signed char)((data[7] << 1) | ((data[4] >> 2) & 1));
-- if (features->pressure_max > 255)
-- pressure = (pressure << 1) | ((data[4] >> 6) & 1);
-- pressure += (features->pressure_max + 1) / 2;
--
-- input_report_abs(input, ABS_X, data[3] | (data[2] << 7) | ((data[1] & 0x03) << 14));
-- input_report_abs(input, ABS_Y, data[6] | (data[5] << 7) | ((data[4] & 0x03) << 14));
-- input_report_abs(input, ABS_PRESSURE, pressure);
--
-- input_report_key(input, BTN_TOUCH, data[4] & 0x08);
-- input_report_key(input, BTN_STYLUS, data[4] & 0x10);
-- /* Only allow the stylus2 button to be reported for the pen tool. */
-- input_report_key(input, BTN_STYLUS2, (wacom->tool[0] == BTN_TOOL_PEN) && (data[4] & 0x20));
-+ if (prox) {
-+ pressure = (signed char)((data[7] << 1) | ((data[4] >> 2) & 1));
-+ if (features->pressure_max > 255)
-+ pressure = (pressure << 1) | ((data[4] >> 6) & 1);
-+ pressure += (features->pressure_max + 1) / 2;
-+
-+ input_report_abs(input, ABS_X, data[3] | (data[2] << 7) | ((data[1] & 0x03) << 14));
-+ input_report_abs(input, ABS_Y, data[6] | (data[5] << 7) | ((data[4] & 0x03) << 14));
-+ input_report_abs(input, ABS_PRESSURE, pressure);
-+
-+ input_report_key(input, BTN_TOUCH, data[4] & 0x08);
-+ input_report_key(input, BTN_STYLUS, data[4] & 0x10);
-+ /* Only allow the stylus2 button to be reported for the pen tool. */
-+ input_report_key(input, BTN_STYLUS2, (wacom->tool[0] == BTN_TOOL_PEN) && (data[4] & 0x20));
-+ }
-
- if (!prox)
- wacom->id[0] = 0;
-diff --git a/drivers/iio/adc/palmas_gpadc.c b/drivers/iio/adc/palmas_gpadc.c
-index 2bbf0c5..7d61b56 100644
---- a/drivers/iio/adc/palmas_gpadc.c
-+++ b/drivers/iio/adc/palmas_gpadc.c
-@@ -775,7 +775,7 @@ static int palmas_adc_wakeup_reset(struct palmas_gpadc *adc)
-
- static int palmas_gpadc_suspend(struct device *dev)
- {
-- struct iio_dev *indio_dev = dev_to_iio_dev(dev);
-+ struct iio_dev *indio_dev = dev_get_drvdata(dev);
- struct palmas_gpadc *adc = iio_priv(indio_dev);
- int wakeup = adc->wakeup1_enable || adc->wakeup2_enable;
- int ret;
-@@ -798,7 +798,7 @@ static int palmas_gpadc_suspend(struct device *dev)
-
- static int palmas_gpadc_resume(struct device *dev)
- {
-- struct iio_dev *indio_dev = dev_to_iio_dev(dev);
-+ struct iio_dev *indio_dev = dev_get_drvdata(dev);
- struct palmas_gpadc *adc = iio_priv(indio_dev);
- int wakeup = adc->wakeup1_enable || adc->wakeup2_enable;
- int ret;
-diff --git a/drivers/iio/health/afe4403.c b/drivers/iio/health/afe4403.c
-index 9a08146..6bb23a4 100644
---- a/drivers/iio/health/afe4403.c
-+++ b/drivers/iio/health/afe4403.c
-@@ -422,7 +422,7 @@ MODULE_DEVICE_TABLE(of, afe4403_of_match);
-
- static int __maybe_unused afe4403_suspend(struct device *dev)
- {
-- struct iio_dev *indio_dev = dev_to_iio_dev(dev);
-+ struct iio_dev *indio_dev = spi_get_drvdata(to_spi_device(dev));
- struct afe4403_data *afe = iio_priv(indio_dev);
- int ret;
-
-@@ -443,7 +443,7 @@ static int __maybe_unused afe4403_suspend(struct device *dev)
-
- static int __maybe_unused afe4403_resume(struct device *dev)
- {
-- struct iio_dev *indio_dev = dev_to_iio_dev(dev);
-+ struct iio_dev *indio_dev = spi_get_drvdata(to_spi_device(dev));
- struct afe4403_data *afe = iio_priv(indio_dev);
- int ret;
-
-diff --git a/drivers/iio/health/afe4404.c b/drivers/iio/health/afe4404.c
-index 4526640..964f523 100644
---- a/drivers/iio/health/afe4404.c
-+++ b/drivers/iio/health/afe4404.c
-@@ -428,7 +428,7 @@ MODULE_DEVICE_TABLE(of, afe4404_of_match);
-
- static int __maybe_unused afe4404_suspend(struct device *dev)
- {
-- struct iio_dev *indio_dev = dev_to_iio_dev(dev);
-+ struct iio_dev *indio_dev = i2c_get_clientdata(to_i2c_client(dev));
- struct afe4404_data *afe = iio_priv(indio_dev);
- int ret;
-
-@@ -449,7 +449,7 @@ static int __maybe_unused afe4404_suspend(struct device *dev)
-
- static int __maybe_unused afe4404_resume(struct device *dev)
- {
-- struct iio_dev *indio_dev = dev_to_iio_dev(dev);
-+ struct iio_dev *indio_dev = i2c_get_clientdata(to_i2c_client(dev));
- struct afe4404_data *afe = iio_priv(indio_dev);
- int ret;
-
-diff --git a/drivers/iio/health/max30100.c b/drivers/iio/health/max30100.c
-index 90ab8a2d..183c143 100644
---- a/drivers/iio/health/max30100.c
-+++ b/drivers/iio/health/max30100.c
-@@ -238,7 +238,7 @@ static irqreturn_t max30100_interrupt_handler(int irq, void *private)
-
- mutex_lock(&data->lock);
-
-- while (cnt || (cnt = max30100_fifo_count(data) > 0)) {
-+ while (cnt || (cnt = max30100_fifo_count(data)) > 0) {
- ret = max30100_read_measurement(data);
- if (ret)
- break;
-diff --git a/drivers/iio/humidity/dht11.c b/drivers/iio/humidity/dht11.c
-index 9c47bc9..2a22ad9 100644
---- a/drivers/iio/humidity/dht11.c
-+++ b/drivers/iio/humidity/dht11.c
-@@ -71,7 +71,8 @@
- * a) select an implementation using busy loop polling on those systems
- * b) use the checksum to do some probabilistic decoding
- */
--#define DHT11_START_TRANSMISSION 18 /* ms */
-+#define DHT11_START_TRANSMISSION_MIN 18000 /* us */
-+#define DHT11_START_TRANSMISSION_MAX 20000 /* us */
- #define DHT11_MIN_TIMERES 34000 /* ns */
- #define DHT11_THRESHOLD 49000 /* ns */
- #define DHT11_AMBIG_LOW 23000 /* ns */
-@@ -228,7 +229,8 @@ static int dht11_read_raw(struct iio_dev *iio_dev,
- ret = gpio_direction_output(dht11->gpio, 0);
- if (ret)
- goto err;
-- msleep(DHT11_START_TRANSMISSION);
-+ usleep_range(DHT11_START_TRANSMISSION_MIN,
-+ DHT11_START_TRANSMISSION_MAX);
- ret = gpio_direction_input(dht11->gpio);
- if (ret)
- goto err;
-diff --git a/drivers/infiniband/hw/cxgb4/qp.c b/drivers/infiniband/hw/cxgb4/qp.c
-index bb0fde6..cc2243f 100644
---- a/drivers/infiniband/hw/cxgb4/qp.c
-+++ b/drivers/infiniband/hw/cxgb4/qp.c
-@@ -321,7 +321,8 @@ static int create_qp(struct c4iw_rdev *rdev, struct t4_wq *wq,
- FW_RI_RES_WR_DCAEN_V(0) |
- FW_RI_RES_WR_DCACPU_V(0) |
- FW_RI_RES_WR_FBMIN_V(2) |
-- FW_RI_RES_WR_FBMAX_V(2) |
-+ (t4_sq_onchip(&wq->sq) ? FW_RI_RES_WR_FBMAX_V(2) :
-+ FW_RI_RES_WR_FBMAX_V(3)) |
- FW_RI_RES_WR_CIDXFTHRESHO_V(0) |
- FW_RI_RES_WR_CIDXFTHRESH_V(0) |
- FW_RI_RES_WR_EQSIZE_V(eqsize));
-@@ -345,7 +346,7 @@ static int create_qp(struct c4iw_rdev *rdev, struct t4_wq *wq,
- FW_RI_RES_WR_DCAEN_V(0) |
- FW_RI_RES_WR_DCACPU_V(0) |
- FW_RI_RES_WR_FBMIN_V(2) |
-- FW_RI_RES_WR_FBMAX_V(2) |
-+ FW_RI_RES_WR_FBMAX_V(3) |
- FW_RI_RES_WR_CIDXFTHRESHO_V(0) |
- FW_RI_RES_WR_CIDXFTHRESH_V(0) |
- FW_RI_RES_WR_EQSIZE_V(eqsize));
-diff --git a/drivers/mmc/host/sdhci.c b/drivers/mmc/host/sdhci.c
-index e1e274a..ba637ff 100644
---- a/drivers/mmc/host/sdhci.c
-+++ b/drivers/mmc/host/sdhci.c
-@@ -2719,7 +2719,8 @@ static irqreturn_t sdhci_irq(int irq, void *dev_id)
- if (intmask & SDHCI_INT_RETUNE)
- mmc_retune_needed(host->mmc);
-
-- if (intmask & SDHCI_INT_CARD_INT) {
-+ if ((intmask & SDHCI_INT_CARD_INT) &&
-+ (host->ier & SDHCI_INT_CARD_INT)) {
- sdhci_enable_sdio_irq_nolock(host, false);
- host->thread_isr |= SDHCI_INT_CARD_INT;
- result = IRQ_WAKE_THREAD;
-diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-8000.c b/drivers/net/wireless/intel/iwlwifi/iwl-8000.c
-index d02ca14..8d3e53f 100644
---- a/drivers/net/wireless/intel/iwlwifi/iwl-8000.c
-+++ b/drivers/net/wireless/intel/iwlwifi/iwl-8000.c
-@@ -91,7 +91,7 @@
-
- #define IWL8000_FW_PRE "iwlwifi-8000C-"
- #define IWL8000_MODULE_FIRMWARE(api) \
-- IWL8000_FW_PRE "-" __stringify(api) ".ucode"
-+ IWL8000_FW_PRE __stringify(api) ".ucode"
-
- #define IWL8265_FW_PRE "iwlwifi-8265-"
- #define IWL8265_MODULE_FIRMWARE(api) \
-diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/sta.c b/drivers/net/wireless/intel/iwlwifi/mvm/sta.c
-index fc77188..52de3c6 100644
---- a/drivers/net/wireless/intel/iwlwifi/mvm/sta.c
-+++ b/drivers/net/wireless/intel/iwlwifi/mvm/sta.c
-@@ -1144,9 +1144,10 @@ static void iwl_mvm_realloc_queues_after_restart(struct iwl_mvm *mvm,
- .frame_limit = IWL_FRAME_LIMIT,
- };
-
-- /* Make sure reserved queue is still marked as such (or allocated) */
-- mvm->queue_info[mvm_sta->reserved_queue].status =
-- IWL_MVM_QUEUE_RESERVED;
-+ /* Make sure reserved queue is still marked as such (if allocated) */
-+ if (mvm_sta->reserved_queue != IEEE80211_INVAL_HW_QUEUE)
-+ mvm->queue_info[mvm_sta->reserved_queue].status =
-+ IWL_MVM_QUEUE_RESERVED;
-
- for (i = 0; i <= IWL_MAX_TID_COUNT; i++) {
- struct iwl_mvm_tid_data *tid_data = &mvm_sta->tid_data[i];
-diff --git a/drivers/pci/pcie/aspm.c b/drivers/pci/pcie/aspm.c
-index 0ec649d..b0916b1 100644
---- a/drivers/pci/pcie/aspm.c
-+++ b/drivers/pci/pcie/aspm.c
-@@ -518,25 +518,32 @@ static struct pcie_link_state *alloc_pcie_link_state(struct pci_dev *pdev)
- link = kzalloc(sizeof(*link), GFP_KERNEL);
- if (!link)
- return NULL;
-+
- INIT_LIST_HEAD(&link->sibling);
- INIT_LIST_HEAD(&link->children);
- INIT_LIST_HEAD(&link->link);
- link->pdev = pdev;
-- if (pci_pcie_type(pdev) != PCI_EXP_TYPE_ROOT_PORT) {
-+
-+ /*
-+ * Root Ports and PCI/PCI-X to PCIe Bridges are roots of PCIe
-+ * hierarchies.
-+ */
-+ if (pci_pcie_type(pdev) == PCI_EXP_TYPE_ROOT_PORT ||
-+ pci_pcie_type(pdev) == PCI_EXP_TYPE_PCIE_BRIDGE) {
-+ link->root = link;
-+ } else {
- struct pcie_link_state *parent;
-+
- parent = pdev->bus->parent->self->link_state;
- if (!parent) {
- kfree(link);
- return NULL;
- }
-+
- link->parent = parent;
-+ link->root = link->parent->root;
- list_add(&link->link, &parent->children);
- }
-- /* Setup a pointer to the root port link */
-- if (!link->parent)
-- link->root = link;
-- else
-- link->root = link->parent->root;
-
- list_add(&link->sibling, &link_list);
- pdev->link_state = link;
-diff --git a/drivers/pinctrl/intel/pinctrl-baytrail.c b/drivers/pinctrl/intel/pinctrl-baytrail.c
-index 0790153..583ae3f 100644
---- a/drivers/pinctrl/intel/pinctrl-baytrail.c
-+++ b/drivers/pinctrl/intel/pinctrl-baytrail.c
-@@ -731,16 +731,23 @@ static void __iomem *byt_gpio_reg(struct byt_gpio *vg, unsigned int offset,
- int reg)
- {
- struct byt_community *comm = byt_get_community(vg, offset);
-- u32 reg_offset = 0;
-+ u32 reg_offset;
-
- if (!comm)
- return NULL;
-
- offset -= comm->pin_base;
-- if (reg == BYT_INT_STAT_REG)
-+ switch (reg) {
-+ case BYT_INT_STAT_REG:
- reg_offset = (offset / 32) * 4;
-- else
-+ break;
-+ case BYT_DEBOUNCE_REG:
-+ reg_offset = 0;
-+ break;
-+ default:
- reg_offset = comm->pad_map[offset] * 16;
-+ break;
-+ }
-
- return comm->reg_base + reg_offset + reg;
- }
-@@ -1612,7 +1619,9 @@ static void byt_gpio_irq_handler(struct irq_desc *desc)
- continue;
- }
-
-+ raw_spin_lock(&vg->lock);
- pending = readl(reg);
-+ raw_spin_unlock(&vg->lock);
- for_each_set_bit(pin, &pending, 32) {
- virq = irq_find_mapping(vg->chip.irqdomain, base + pin);
- generic_handle_irq(virq);
-diff --git a/drivers/pinctrl/intel/pinctrl-merrifield.c b/drivers/pinctrl/intel/pinctrl-merrifield.c
-index 7826c7f..9931be6 100644
---- a/drivers/pinctrl/intel/pinctrl-merrifield.c
-+++ b/drivers/pinctrl/intel/pinctrl-merrifield.c
-@@ -794,6 +794,9 @@ static int mrfld_config_set(struct pinctrl_dev *pctldev, unsigned int pin,
- unsigned int i;
- int ret;
-
-+ if (!mrfld_buf_available(mp, pin))
-+ return -ENOTSUPP;
-+
- for (i = 0; i < nconfigs; i++) {
- switch (pinconf_to_config_param(configs[i])) {
- case PIN_CONFIG_BIAS_DISABLE:
-diff --git a/drivers/regulator/axp20x-regulator.c b/drivers/regulator/axp20x-regulator.c
-index e6a512e..a3ade9e 100644
---- a/drivers/regulator/axp20x-regulator.c
-+++ b/drivers/regulator/axp20x-regulator.c
-@@ -272,7 +272,7 @@ static const struct regulator_desc axp806_regulators[] = {
- 64, AXP806_DCDCD_V_CTRL, 0x3f, AXP806_PWR_OUT_CTRL1,
- BIT(3)),
- AXP_DESC(AXP806, DCDCE, "dcdce", "vine", 1100, 3400, 100,
-- AXP806_DCDCB_V_CTRL, 0x1f, AXP806_PWR_OUT_CTRL1, BIT(4)),
-+ AXP806_DCDCE_V_CTRL, 0x1f, AXP806_PWR_OUT_CTRL1, BIT(4)),
- AXP_DESC(AXP806, ALDO1, "aldo1", "aldoin", 700, 3300, 100,
- AXP806_ALDO1_V_CTRL, 0x1f, AXP806_PWR_OUT_CTRL1, BIT(5)),
- AXP_DESC(AXP806, ALDO2, "aldo2", "aldoin", 700, 3400, 100,
-diff --git a/drivers/staging/greybus/timesync_platform.c b/drivers/staging/greybus/timesync_platform.c
-index 113f3d6..27f75b1 100644
---- a/drivers/staging/greybus/timesync_platform.c
-+++ b/drivers/staging/greybus/timesync_platform.c
-@@ -45,12 +45,18 @@ u32 gb_timesync_platform_get_clock_rate(void)
-
- int gb_timesync_platform_lock_bus(struct gb_timesync_svc *pdata)
- {
-+ if (!arche_platform_change_state_cb)
-+ return 0;
-+
- return arche_platform_change_state_cb(ARCHE_PLATFORM_STATE_TIME_SYNC,
- pdata);
- }
-
- void gb_timesync_platform_unlock_bus(void)
- {
-+ if (!arche_platform_change_state_cb)
-+ return;
-+
- arche_platform_change_state_cb(ARCHE_PLATFORM_STATE_ACTIVE, NULL);
- }
-
-diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c
-index d2e50a2..24f9f98 100644
---- a/drivers/usb/core/quirks.c
-+++ b/drivers/usb/core/quirks.c
-@@ -37,6 +37,10 @@ static const struct usb_device_id usb_quirk_list[] = {
- /* CBM - Flash disk */
- { USB_DEVICE(0x0204, 0x6025), .driver_info = USB_QUIRK_RESET_RESUME },
-
-+ /* WORLDE easy key (easykey.25) MIDI controller */
-+ { USB_DEVICE(0x0218, 0x0401), .driver_info =
-+ USB_QUIRK_CONFIG_INTF_STRINGS },
-+
- /* HP 5300/5370C scanner */
- { USB_DEVICE(0x03f0, 0x0701), .driver_info =
- USB_QUIRK_STRING_FETCH_255 },
-diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c
-index 17989b7..8d412d8 100644
---- a/drivers/usb/gadget/function/f_fs.c
-+++ b/drivers/usb/gadget/function/f_fs.c
-@@ -2269,6 +2269,8 @@ static int __ffs_data_do_os_desc(enum ffs_os_desc_type type,
- if (len < sizeof(*d) || h->interface >= ffs->interfaces_count)
- return -EINVAL;
- length = le32_to_cpu(d->dwSize);
-+ if (len < length)
-+ return -EINVAL;
- type = le32_to_cpu(d->dwPropertyDataType);
- if (type < USB_EXT_PROP_UNICODE ||
- type > USB_EXT_PROP_UNICODE_MULTI) {
-@@ -2277,6 +2279,11 @@ static int __ffs_data_do_os_desc(enum ffs_os_desc_type type,
- return -EINVAL;
- }
- pnl = le16_to_cpu(d->wPropertyNameLength);
-+ if (length < 14 + pnl) {
-+ pr_vdebug("invalid os descriptor length: %d pnl:%d (descriptor %d)\n",
-+ length, pnl, type);
-+ return -EINVAL;
-+ }
- pdl = le32_to_cpu(*(u32 *)((u8 *)data + 10 + pnl));
- if (length != 14 + pnl + pdl) {
- pr_vdebug("invalid os descriptor length: %d pnl:%d pdl:%d (descriptor %d)\n",
-@@ -2363,6 +2370,9 @@ static int __ffs_data_got_descs(struct ffs_data *ffs,
- }
- }
- if (flags & (1 << i)) {
-+ if (len < 4) {
-+ goto error;
-+ }
- os_descs_count = get_unaligned_le32(data);
- data += 4;
- len -= 4;
-@@ -2435,7 +2445,8 @@ static int __ffs_data_got_strings(struct ffs_data *ffs,
-
- ENTER();
-
-- if (unlikely(get_unaligned_le32(data) != FUNCTIONFS_STRINGS_MAGIC ||
-+ if (unlikely(len < 16 ||
-+ get_unaligned_le32(data) != FUNCTIONFS_STRINGS_MAGIC ||
- get_unaligned_le32(data + 4) != len))
- goto error;
- str_count = get_unaligned_le32(data + 8);
-diff --git a/drivers/usb/musb/musb_core.c b/drivers/usb/musb/musb_core.c
-index c3e172e..338575f 100644
---- a/drivers/usb/musb/musb_core.c
-+++ b/drivers/usb/musb/musb_core.c
-@@ -578,11 +578,11 @@ static irqreturn_t musb_stage0_irq(struct musb *musb, u8 int_usb,
- | MUSB_PORT_STAT_RESUME;
- musb->rh_timer = jiffies
- + msecs_to_jiffies(USB_RESUME_TIMEOUT);
-- musb->need_finish_resume = 1;
--
- musb->xceiv->otg->state = OTG_STATE_A_HOST;
- musb->is_active = 1;
- musb_host_resume_root_hub(musb);
-+ schedule_delayed_work(&musb->finish_resume_work,
-+ msecs_to_jiffies(USB_RESUME_TIMEOUT));
- break;
- case OTG_STATE_B_WAIT_ACON:
- musb->xceiv->otg->state = OTG_STATE_B_PERIPHERAL;
-@@ -2691,11 +2691,6 @@ static int musb_resume(struct device *dev)
- mask = MUSB_DEVCTL_BDEVICE | MUSB_DEVCTL_FSDEV | MUSB_DEVCTL_LSDEV;
- if ((devctl & mask) != (musb->context.devctl & mask))
- musb->port1_status = 0;
-- if (musb->need_finish_resume) {
-- musb->need_finish_resume = 0;
-- schedule_delayed_work(&musb->finish_resume_work,
-- msecs_to_jiffies(USB_RESUME_TIMEOUT));
-- }
-
- /*
- * The USB HUB code expects the device to be in RPM_ACTIVE once it came
-@@ -2747,12 +2742,6 @@ static int musb_runtime_resume(struct device *dev)
-
- musb_restore_context(musb);
-
-- if (musb->need_finish_resume) {
-- musb->need_finish_resume = 0;
-- schedule_delayed_work(&musb->finish_resume_work,
-- msecs_to_jiffies(USB_RESUME_TIMEOUT));
-- }
--
- spin_lock_irqsave(&musb->lock, flags);
- error = musb_run_resume_work(musb);
- if (error)
-diff --git a/drivers/usb/musb/musb_core.h b/drivers/usb/musb/musb_core.h
-index 47331db..854fbf7 100644
---- a/drivers/usb/musb/musb_core.h
-+++ b/drivers/usb/musb/musb_core.h
-@@ -410,7 +410,6 @@ struct musb {
-
- /* is_suspended means USB B_PERIPHERAL suspend */
- unsigned is_suspended:1;
-- unsigned need_finish_resume :1;
-
- /* may_wakeup means remote wakeup is enabled */
- unsigned may_wakeup:1;
-diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
-index 7ce31a4..42cc72e 100644
---- a/drivers/usb/serial/option.c
-+++ b/drivers/usb/serial/option.c
-@@ -2007,6 +2007,7 @@ static const struct usb_device_id option_ids[] = {
- { USB_DEVICE_AND_INTERFACE_INFO(WETELECOM_VENDOR_ID, WETELECOM_PRODUCT_WMD200, 0xff, 0xff, 0xff) },
- { USB_DEVICE_AND_INTERFACE_INFO(WETELECOM_VENDOR_ID, WETELECOM_PRODUCT_6802, 0xff, 0xff, 0xff) },
- { USB_DEVICE_AND_INTERFACE_INFO(WETELECOM_VENDOR_ID, WETELECOM_PRODUCT_WMD300, 0xff, 0xff, 0xff) },
-+ { USB_DEVICE_AND_INTERFACE_INFO(0x03f0, 0x421d, 0xff, 0xff, 0xff) }, /* HP lt2523 (Novatel E371) */
- { } /* Terminating entry */
- };
- MODULE_DEVICE_TABLE(usb, option_ids);
-diff --git a/drivers/usb/serial/pl2303.c b/drivers/usb/serial/pl2303.c
-index 46fca6b..1db4b61 100644
---- a/drivers/usb/serial/pl2303.c
-+++ b/drivers/usb/serial/pl2303.c
-@@ -49,6 +49,7 @@ static const struct usb_device_id id_table[] = {
- { USB_DEVICE(IODATA_VENDOR_ID, IODATA_PRODUCT_ID) },
- { USB_DEVICE(IODATA_VENDOR_ID, IODATA_PRODUCT_ID_RSAQ5) },
- { USB_DEVICE(ATEN_VENDOR_ID, ATEN_PRODUCT_ID) },
-+ { USB_DEVICE(ATEN_VENDOR_ID, ATEN_PRODUCT_ID2) },
- { USB_DEVICE(ATEN_VENDOR_ID2, ATEN_PRODUCT_ID) },
- { USB_DEVICE(ELCOM_VENDOR_ID, ELCOM_PRODUCT_ID) },
- { USB_DEVICE(ELCOM_VENDOR_ID, ELCOM_PRODUCT_ID_UCSGT) },
-diff --git a/drivers/usb/serial/pl2303.h b/drivers/usb/serial/pl2303.h
-index e3b7af8..09d9be8 100644
---- a/drivers/usb/serial/pl2303.h
-+++ b/drivers/usb/serial/pl2303.h
-@@ -27,6 +27,7 @@
- #define ATEN_VENDOR_ID 0x0557
- #define ATEN_VENDOR_ID2 0x0547
- #define ATEN_PRODUCT_ID 0x2008
-+#define ATEN_PRODUCT_ID2 0x2118
-
- #define IODATA_VENDOR_ID 0x04bb
- #define IODATA_PRODUCT_ID 0x0a03
-diff --git a/drivers/usb/serial/qcserial.c b/drivers/usb/serial/qcserial.c
-index 1bc6089..696458d 100644
---- a/drivers/usb/serial/qcserial.c
-+++ b/drivers/usb/serial/qcserial.c
-@@ -124,6 +124,7 @@ static const struct usb_device_id id_table[] = {
- {USB_DEVICE(0x1410, 0xa021)}, /* Novatel Gobi 3000 Composite */
- {USB_DEVICE(0x413c, 0x8193)}, /* Dell Gobi 3000 QDL */
- {USB_DEVICE(0x413c, 0x8194)}, /* Dell Gobi 3000 Composite */
-+ {USB_DEVICE(0x413c, 0x81a6)}, /* Dell DW5570 QDL (MC8805) */
- {USB_DEVICE(0x1199, 0x68a4)}, /* Sierra Wireless QDL */
- {USB_DEVICE(0x1199, 0x68a5)}, /* Sierra Wireless Modem */
- {USB_DEVICE(0x1199, 0x68a8)}, /* Sierra Wireless QDL */
-diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c
-index c6f2d89..64613fb 100644
---- a/drivers/vhost/vhost.c
-+++ b/drivers/vhost/vhost.c
-@@ -130,14 +130,14 @@ static long vhost_get_vring_endian(struct vhost_virtqueue *vq, u32 idx,
-
- static void vhost_init_is_le(struct vhost_virtqueue *vq)
- {
-- if (vhost_has_feature(vq, VIRTIO_F_VERSION_1))
-- vq->is_le = true;
-+ vq->is_le = vhost_has_feature(vq, VIRTIO_F_VERSION_1)
-+ || virtio_legacy_is_little_endian();
- }
- #endif /* CONFIG_VHOST_CROSS_ENDIAN_LEGACY */
-
- static void vhost_reset_is_le(struct vhost_virtqueue *vq)
- {
-- vq->is_le = virtio_legacy_is_little_endian();
-+ vhost_init_is_le(vq);
- }
-
- struct vhost_flush_struct {
-@@ -1713,10 +1713,8 @@ int vhost_vq_init_access(struct vhost_virtqueue *vq)
- int r;
- bool is_le = vq->is_le;
-
-- if (!vq->private_data) {
-- vhost_reset_is_le(vq);
-+ if (!vq->private_data)
- return 0;
-- }
-
- vhost_init_is_le(vq);
-
-diff --git a/drivers/virtio/virtio_ring.c b/drivers/virtio/virtio_ring.c
-index f136048..489bfc6 100644
---- a/drivers/virtio/virtio_ring.c
-+++ b/drivers/virtio/virtio_ring.c
-@@ -159,13 +159,6 @@ static bool vring_use_dma_api(struct virtio_device *vdev)
- if (xen_domain())
- return true;
-
-- /*
-- * On ARM-based machines, the DMA ops will do the right thing,
-- * so always use them with legacy devices.
-- */
-- if (IS_ENABLED(CONFIG_ARM) || IS_ENABLED(CONFIG_ARM64))
-- return !virtio_has_feature(vdev, VIRTIO_F_VERSION_1);
--
- return false;
- }
-
-diff --git a/fs/cifs/readdir.c b/fs/cifs/readdir.c
-index 8f6a2a5..a27fc87 100644
---- a/fs/cifs/readdir.c
-+++ b/fs/cifs/readdir.c
-@@ -285,6 +285,7 @@ initiate_cifs_search(const unsigned int xid, struct file *file)
- rc = -ENOMEM;
- goto error_exit;
- }
-+ spin_lock_init(&cifsFile->file_info_lock);
- file->private_data = cifsFile;
- cifsFile->tlink = cifs_get_tlink(tlink);
- tcon = tlink_tcon(tlink);
-diff --git a/fs/dax.c b/fs/dax.c
-index 014defd..bf6218d 100644
---- a/fs/dax.c
-+++ b/fs/dax.c
-@@ -1270,6 +1270,11 @@ iomap_dax_actor(struct inode *inode, loff_t pos, loff_t length, void *data,
- struct blk_dax_ctl dax = { 0 };
- ssize_t map_len;
-
-+ if (fatal_signal_pending(current)) {
-+ ret = -EINTR;
-+ break;
-+ }
-+
- dax.sector = iomap->blkno +
- (((pos & PAGE_MASK) - iomap->offset) >> 9);
- dax.size = (length + offset + PAGE_SIZE - 1) & PAGE_MASK;
-diff --git a/fs/ext4/super.c b/fs/ext4/super.c
-index 478630a..bbc316d 100644
---- a/fs/ext4/super.c
-+++ b/fs/ext4/super.c
-@@ -3827,6 +3827,15 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent)
- (EXT4_MAX_BLOCK_FILE_PHYS / EXT4_BLOCKS_PER_GROUP(sb)));
- db_count = (sbi->s_groups_count + EXT4_DESC_PER_BLOCK(sb) - 1) /
- EXT4_DESC_PER_BLOCK(sb);
-+ if (ext4_has_feature_meta_bg(sb)) {
-+ if (le32_to_cpu(es->s_first_meta_bg) >= db_count) {
-+ ext4_msg(sb, KERN_WARNING,
-+ "first meta block group too large: %u "
-+ "(group descriptor block count %u)",
-+ le32_to_cpu(es->s_first_meta_bg), db_count);
-+ goto failed_mount;
-+ }
-+ }
- sbi->s_group_desc = ext4_kvmalloc(db_count *
- sizeof(struct buffer_head *),
- GFP_KERNEL);
-diff --git a/fs/iomap.c b/fs/iomap.c
-index a8ee8c3..814ae8f 100644
---- a/fs/iomap.c
-+++ b/fs/iomap.c
-@@ -113,6 +113,9 @@ iomap_write_begin(struct inode *inode, loff_t pos, unsigned len, unsigned flags,
-
- BUG_ON(pos + len > iomap->offset + iomap->length);
-
-+ if (fatal_signal_pending(current))
-+ return -EINTR;
-+
- page = grab_cache_page_write_begin(inode->i_mapping, index, flags);
- if (!page)
- return -ENOMEM;
-diff --git a/fs/nfsd/nfs4layouts.c b/fs/nfsd/nfs4layouts.c
-index 42aace4..6481369 100644
---- a/fs/nfsd/nfs4layouts.c
-+++ b/fs/nfsd/nfs4layouts.c
-@@ -223,10 +223,11 @@ nfsd4_alloc_layout_stateid(struct nfsd4_compound_state *cstate,
- struct nfs4_layout_stateid *ls;
- struct nfs4_stid *stp;
-
-- stp = nfs4_alloc_stid(cstate->clp, nfs4_layout_stateid_cache);
-+ stp = nfs4_alloc_stid(cstate->clp, nfs4_layout_stateid_cache,
-+ nfsd4_free_layout_stateid);
- if (!stp)
- return NULL;
-- stp->sc_free = nfsd4_free_layout_stateid;
-+
- get_nfs4_file(fp);
- stp->sc_file = fp;
-
-diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c
-index 4b4beaa..a0dee8a 100644
---- a/fs/nfsd/nfs4state.c
-+++ b/fs/nfsd/nfs4state.c
-@@ -633,8 +633,8 @@ find_or_hash_clnt_odstate(struct nfs4_file *fp, struct nfs4_clnt_odstate *new)
- return co;
- }
-
--struct nfs4_stid *nfs4_alloc_stid(struct nfs4_client *cl,
-- struct kmem_cache *slab)
-+struct nfs4_stid *nfs4_alloc_stid(struct nfs4_client *cl, struct kmem_cache *slab,
-+ void (*sc_free)(struct nfs4_stid *))
- {
- struct nfs4_stid *stid;
- int new_id;
-@@ -650,6 +650,8 @@ struct nfs4_stid *nfs4_alloc_stid(struct nfs4_client *cl,
- idr_preload_end();
- if (new_id < 0)
- goto out_free;
-+
-+ stid->sc_free = sc_free;
- stid->sc_client = cl;
- stid->sc_stateid.si_opaque.so_id = new_id;
- stid->sc_stateid.si_opaque.so_clid = cl->cl_clientid;
-@@ -675,15 +677,12 @@ struct nfs4_stid *nfs4_alloc_stid(struct nfs4_client *cl,
- static struct nfs4_ol_stateid * nfs4_alloc_open_stateid(struct nfs4_client *clp)
- {
- struct nfs4_stid *stid;
-- struct nfs4_ol_stateid *stp;
-
-- stid = nfs4_alloc_stid(clp, stateid_slab);
-+ stid = nfs4_alloc_stid(clp, stateid_slab, nfs4_free_ol_stateid);
- if (!stid)
- return NULL;
-
-- stp = openlockstateid(stid);
-- stp->st_stid.sc_free = nfs4_free_ol_stateid;
-- return stp;
-+ return openlockstateid(stid);
- }
-
- static void nfs4_free_deleg(struct nfs4_stid *stid)
-@@ -781,11 +780,10 @@ alloc_init_deleg(struct nfs4_client *clp, struct svc_fh *current_fh,
- goto out_dec;
- if (delegation_blocked(&current_fh->fh_handle))
- goto out_dec;
-- dp = delegstateid(nfs4_alloc_stid(clp, deleg_slab));
-+ dp = delegstateid(nfs4_alloc_stid(clp, deleg_slab, nfs4_free_deleg));
- if (dp == NULL)
- goto out_dec;
-
-- dp->dl_stid.sc_free = nfs4_free_deleg;
- /*
- * delegation seqid's are never incremented. The 4.1 special
- * meaning of seqid 0 isn't meaningful, really, but let's avoid
-@@ -5580,7 +5578,6 @@ init_lock_stateid(struct nfs4_ol_stateid *stp, struct nfs4_lockowner *lo,
- stp->st_stateowner = nfs4_get_stateowner(&lo->lo_owner);
- get_nfs4_file(fp);
- stp->st_stid.sc_file = fp;
-- stp->st_stid.sc_free = nfs4_free_lock_stateid;
- stp->st_access_bmap = 0;
- stp->st_deny_bmap = open_stp->st_deny_bmap;
- stp->st_openstp = open_stp;
-@@ -5623,7 +5620,7 @@ find_or_create_lock_stateid(struct nfs4_lockowner *lo, struct nfs4_file *fi,
- lst = find_lock_stateid(lo, fi);
- if (lst == NULL) {
- spin_unlock(&clp->cl_lock);
-- ns = nfs4_alloc_stid(clp, stateid_slab);
-+ ns = nfs4_alloc_stid(clp, stateid_slab, nfs4_free_lock_stateid);
- if (ns == NULL)
- return NULL;
-
-diff --git a/fs/nfsd/state.h b/fs/nfsd/state.h
-index c939936..4516e8b 100644
---- a/fs/nfsd/state.h
-+++ b/fs/nfsd/state.h
-@@ -603,8 +603,8 @@ extern __be32 nfs4_preprocess_stateid_op(struct svc_rqst *rqstp,
- __be32 nfsd4_lookup_stateid(struct nfsd4_compound_state *cstate,
- stateid_t *stateid, unsigned char typemask,
- struct nfs4_stid **s, struct nfsd_net *nn);
--struct nfs4_stid *nfs4_alloc_stid(struct nfs4_client *cl,
-- struct kmem_cache *slab);
-+struct nfs4_stid *nfs4_alloc_stid(struct nfs4_client *cl, struct kmem_cache *slab,
-+ void (*sc_free)(struct nfs4_stid *));
- void nfs4_unhash_stid(struct nfs4_stid *s);
- void nfs4_put_stid(struct nfs4_stid *s);
- void nfs4_inc_and_copy_stateid(stateid_t *dst, struct nfs4_stid *stid);
-diff --git a/include/linux/irq.h b/include/linux/irq.h
-index e798755..39e3254 100644
---- a/include/linux/irq.h
-+++ b/include/linux/irq.h
-@@ -184,6 +184,7 @@ struct irq_data {
- *
- * IRQD_TRIGGER_MASK - Mask for the trigger type bits
- * IRQD_SETAFFINITY_PENDING - Affinity setting is pending
-+ * IRQD_ACTIVATED - Interrupt has already been activated
- * IRQD_NO_BALANCING - Balancing disabled for this IRQ
- * IRQD_PER_CPU - Interrupt is per cpu
- * IRQD_AFFINITY_SET - Interrupt affinity was set
-@@ -202,6 +203,7 @@ struct irq_data {
- enum {
- IRQD_TRIGGER_MASK = 0xf,
- IRQD_SETAFFINITY_PENDING = (1 << 8),
-+ IRQD_ACTIVATED = (1 << 9),
- IRQD_NO_BALANCING = (1 << 10),
- IRQD_PER_CPU = (1 << 11),
- IRQD_AFFINITY_SET = (1 << 12),
-@@ -312,6 +314,21 @@ static inline bool irqd_affinity_is_managed(struct irq_data *d)
- return __irqd_to_state(d) & IRQD_AFFINITY_MANAGED;
- }
-
-+static inline bool irqd_is_activated(struct irq_data *d)
-+{
-+ return __irqd_to_state(d) & IRQD_ACTIVATED;
-+}
-+
-+static inline void irqd_set_activated(struct irq_data *d)
-+{
-+ __irqd_to_state(d) |= IRQD_ACTIVATED;
-+}
-+
-+static inline void irqd_clr_activated(struct irq_data *d)
-+{
-+ __irqd_to_state(d) &= ~IRQD_ACTIVATED;
-+}
-+
- #undef __irqd_to_state
-
- static inline irq_hw_number_t irqd_to_hwirq(struct irq_data *d)
-diff --git a/include/linux/memory_hotplug.h b/include/linux/memory_hotplug.h
-index c1784c0..134a2f6 100644
---- a/include/linux/memory_hotplug.h
-+++ b/include/linux/memory_hotplug.h
-@@ -85,7 +85,8 @@ extern int zone_grow_waitqueues(struct zone *zone, unsigned long nr_pages);
- extern int add_one_highpage(struct page *page, int pfn, int bad_ppro);
- /* VM interface that may be used by firmware interface */
- extern int online_pages(unsigned long, unsigned long, int);
--extern int test_pages_in_a_zone(unsigned long, unsigned long);
-+extern int test_pages_in_a_zone(unsigned long start_pfn, unsigned long end_pfn,
-+ unsigned long *valid_start, unsigned long *valid_end);
- extern void __offline_isolated_pages(unsigned long, unsigned long);
-
- typedef void (*online_page_callback_t)(struct page *page);
-diff --git a/include/linux/percpu-refcount.h b/include/linux/percpu-refcount.h
-index 1c7eec0..3a481a4 100644
---- a/include/linux/percpu-refcount.h
-+++ b/include/linux/percpu-refcount.h
-@@ -204,7 +204,7 @@ static inline void percpu_ref_get(struct percpu_ref *ref)
- static inline bool percpu_ref_tryget(struct percpu_ref *ref)
- {
- unsigned long __percpu *percpu_count;
-- int ret;
-+ bool ret;
-
- rcu_read_lock_sched();
-
-@@ -238,7 +238,7 @@ static inline bool percpu_ref_tryget(struct percpu_ref *ref)
- static inline bool percpu_ref_tryget_live(struct percpu_ref *ref)
- {
- unsigned long __percpu *percpu_count;
-- int ret = false;
-+ bool ret = false;
-
- rcu_read_lock_sched();
-
-diff --git a/kernel/cgroup.c b/kernel/cgroup.c
-index 85bc9be..4e2f3de 100644
---- a/kernel/cgroup.c
-+++ b/kernel/cgroup.c
-@@ -5219,6 +5219,11 @@ static struct cgroup_subsys_state *css_create(struct cgroup *cgrp,
- return ERR_PTR(err);
- }
-
-+/*
-+ * The returned cgroup is fully initialized including its control mask, but
-+ * it isn't associated with its kernfs_node and doesn't have the control
-+ * mask applied.
-+ */
- static struct cgroup *cgroup_create(struct cgroup *parent)
- {
- struct cgroup_root *root = parent->root;
-@@ -5283,11 +5288,6 @@ static struct cgroup *cgroup_create(struct cgroup *parent)
-
- cgroup_propagate_control(cgrp);
-
-- /* @cgrp doesn't have dir yet so the following will only create csses */
-- ret = cgroup_apply_control_enable(cgrp);
-- if (ret)
-- goto out_destroy;
--
- return cgrp;
-
- out_cancel_ref:
-@@ -5295,9 +5295,6 @@ static struct cgroup *cgroup_create(struct cgroup *parent)
- out_free_cgrp:
- kfree(cgrp);
- return ERR_PTR(ret);
--out_destroy:
-- cgroup_destroy_locked(cgrp);
-- return ERR_PTR(ret);
- }
-
- static int cgroup_mkdir(struct kernfs_node *parent_kn, const char *name,
-diff --git a/kernel/events/core.c b/kernel/events/core.c
-index e5a8839..b1cfd74 100644
---- a/kernel/events/core.c
-+++ b/kernel/events/core.c
-@@ -1469,7 +1469,6 @@ ctx_group_list(struct perf_event *event, struct perf_event_context *ctx)
- static void
- list_add_event(struct perf_event *event, struct perf_event_context *ctx)
- {
--
- lockdep_assert_held(&ctx->lock);
-
- WARN_ON_ONCE(event->attach_state & PERF_ATTACH_CONTEXT);
-@@ -1624,6 +1623,8 @@ static void perf_group_attach(struct perf_event *event)
- {
- struct perf_event *group_leader = event->group_leader, *pos;
-
-+ lockdep_assert_held(&event->ctx->lock);
-+
- /*
- * We can have double attach due to group movement in perf_event_open.
- */
-@@ -1697,6 +1698,8 @@ static void perf_group_detach(struct perf_event *event)
- struct perf_event *sibling, *tmp;
- struct list_head *list = NULL;
-
-+ lockdep_assert_held(&event->ctx->lock);
-+
- /*
- * We can have double detach due to exit/hot-unplug + close.
- */
-@@ -1895,9 +1898,29 @@ __perf_remove_from_context(struct perf_event *event,
- */
- static void perf_remove_from_context(struct perf_event *event, unsigned long flags)
- {
-- lockdep_assert_held(&event->ctx->mutex);
-+ struct perf_event_context *ctx = event->ctx;
-+
-+ lockdep_assert_held(&ctx->mutex);
-
- event_function_call(event, __perf_remove_from_context, (void *)flags);
-+
-+ /*
-+ * The above event_function_call() can NO-OP when it hits
-+ * TASK_TOMBSTONE. In that case we must already have been detached
-+ * from the context (by perf_event_exit_event()) but the grouping
-+ * might still be in-tact.
-+ */
-+ WARN_ON_ONCE(event->attach_state & PERF_ATTACH_CONTEXT);
-+ if ((flags & DETACH_GROUP) &&
-+ (event->attach_state & PERF_ATTACH_GROUP)) {
-+ /*
-+ * Since in that case we cannot possibly be scheduled, simply
-+ * detach now.
-+ */
-+ raw_spin_lock_irq(&ctx->lock);
-+ perf_group_detach(event);
-+ raw_spin_unlock_irq(&ctx->lock);
-+ }
- }
-
- /*
-@@ -6583,6 +6606,27 @@ static void perf_event_mmap_event(struct perf_mmap_event *mmap_event)
- char *buf = NULL;
- char *name;
-
-+ if (vma->vm_flags & VM_READ)
-+ prot |= PROT_READ;
-+ if (vma->vm_flags & VM_WRITE)
-+ prot |= PROT_WRITE;
-+ if (vma->vm_flags & VM_EXEC)
-+ prot |= PROT_EXEC;
-+
-+ if (vma->vm_flags & VM_MAYSHARE)
-+ flags = MAP_SHARED;
-+ else
-+ flags = MAP_PRIVATE;
-+
-+ if (vma->vm_flags & VM_DENYWRITE)
-+ flags |= MAP_DENYWRITE;
-+ if (vma->vm_flags & VM_MAYEXEC)
-+ flags |= MAP_EXECUTABLE;
-+ if (vma->vm_flags & VM_LOCKED)
-+ flags |= MAP_LOCKED;
-+ if (vma->vm_flags & VM_HUGETLB)
-+ flags |= MAP_HUGETLB;
-+
- if (file) {
- struct inode *inode;
- dev_t dev;
-@@ -6609,27 +6653,6 @@ static void perf_event_mmap_event(struct perf_mmap_event *mmap_event)
- maj = MAJOR(dev);
- min = MINOR(dev);
-
-- if (vma->vm_flags & VM_READ)
-- prot |= PROT_READ;
-- if (vma->vm_flags & VM_WRITE)
-- prot |= PROT_WRITE;
-- if (vma->vm_flags & VM_EXEC)
-- prot |= PROT_EXEC;
--
-- if (vma->vm_flags & VM_MAYSHARE)
-- flags = MAP_SHARED;
-- else
-- flags = MAP_PRIVATE;
--
-- if (vma->vm_flags & VM_DENYWRITE)
-- flags |= MAP_DENYWRITE;
-- if (vma->vm_flags & VM_MAYEXEC)
-- flags |= MAP_EXECUTABLE;
-- if (vma->vm_flags & VM_LOCKED)
-- flags |= MAP_LOCKED;
-- if (vma->vm_flags & VM_HUGETLB)
-- flags |= MAP_HUGETLB;
--
- goto got_name;
- } else {
- if (vma->vm_ops && vma->vm_ops->name) {
-diff --git a/kernel/irq/irqdomain.c b/kernel/irq/irqdomain.c
-index 8c0a0ae..b59e676 100644
---- a/kernel/irq/irqdomain.c
-+++ b/kernel/irq/irqdomain.c
-@@ -1346,6 +1346,30 @@ void irq_domain_free_irqs_parent(struct irq_domain *domain,
- }
- EXPORT_SYMBOL_GPL(irq_domain_free_irqs_parent);
-
-+static void __irq_domain_activate_irq(struct irq_data *irq_data)
-+{
-+ if (irq_data && irq_data->domain) {
-+ struct irq_domain *domain = irq_data->domain;
-+
-+ if (irq_data->parent_data)
-+ __irq_domain_activate_irq(irq_data->parent_data);
-+ if (domain->ops->activate)
-+ domain->ops->activate(domain, irq_data);
-+ }
-+}
-+
-+static void __irq_domain_deactivate_irq(struct irq_data *irq_data)
-+{
-+ if (irq_data && irq_data->domain) {
-+ struct irq_domain *domain = irq_data->domain;
-+
-+ if (domain->ops->deactivate)
-+ domain->ops->deactivate(domain, irq_data);
-+ if (irq_data->parent_data)
-+ __irq_domain_deactivate_irq(irq_data->parent_data);
-+ }
-+}
-+
- /**
- * irq_domain_activate_irq - Call domain_ops->activate recursively to activate
- * interrupt
-@@ -1356,13 +1380,9 @@ EXPORT_SYMBOL_GPL(irq_domain_free_irqs_parent);
- */
- void irq_domain_activate_irq(struct irq_data *irq_data)
- {
-- if (irq_data && irq_data->domain) {
-- struct irq_domain *domain = irq_data->domain;
--
-- if (irq_data->parent_data)
-- irq_domain_activate_irq(irq_data->parent_data);
-- if (domain->ops->activate)
-- domain->ops->activate(domain, irq_data);
-+ if (!irqd_is_activated(irq_data)) {
-+ __irq_domain_activate_irq(irq_data);
-+ irqd_set_activated(irq_data);
- }
- }
-
-@@ -1376,13 +1396,9 @@ void irq_domain_activate_irq(struct irq_data *irq_data)
- */
- void irq_domain_deactivate_irq(struct irq_data *irq_data)
- {
-- if (irq_data && irq_data->domain) {
-- struct irq_domain *domain = irq_data->domain;
--
-- if (domain->ops->deactivate)
-- domain->ops->deactivate(domain, irq_data);
-- if (irq_data->parent_data)
-- irq_domain_deactivate_irq(irq_data->parent_data);
-+ if (irqd_is_activated(irq_data)) {
-+ __irq_domain_deactivate_irq(irq_data);
-+ irqd_clr_activated(irq_data);
- }
- }
-
-diff --git a/kernel/trace/trace_hwlat.c b/kernel/trace/trace_hwlat.c
-index b97286c..f00b013 100644
---- a/kernel/trace/trace_hwlat.c
-+++ b/kernel/trace/trace_hwlat.c
-@@ -266,7 +266,7 @@ static int get_sample(void)
- static struct cpumask save_cpumask;
- static bool disable_migrate;
-
--static void move_to_next_cpu(void)
-+static void move_to_next_cpu(bool initmask)
- {
- static struct cpumask *current_mask;
- int next_cpu;
-@@ -275,7 +275,7 @@ static void move_to_next_cpu(void)
- return;
-
- /* Just pick the first CPU on first iteration */
-- if (!current_mask) {
-+ if (initmask) {
- current_mask = &save_cpumask;
- get_online_cpus();
- cpumask_and(current_mask, cpu_online_mask, tracing_buffer_mask);
-@@ -330,10 +330,12 @@ static void move_to_next_cpu(void)
- static int kthread_fn(void *data)
- {
- u64 interval;
-+ bool initmask = true;
-
- while (!kthread_should_stop()) {
-
-- move_to_next_cpu();
-+ move_to_next_cpu(initmask);
-+ initmask = false;
-
- local_irq_disable();
- get_sample();
-diff --git a/mm/filemap.c b/mm/filemap.c
-index 7798010..d8d7df8 100644
---- a/mm/filemap.c
-+++ b/mm/filemap.c
-@@ -1703,6 +1703,11 @@ static ssize_t do_generic_file_read(struct file *filp, loff_t *ppos,
-
- cond_resched();
- find_page:
-+ if (fatal_signal_pending(current)) {
-+ error = -EINTR;
-+ goto out;
-+ }
-+
- page = find_get_page(mapping, index);
- if (!page) {
- page_cache_sync_readahead(mapping,
-diff --git a/mm/memory_hotplug.c b/mm/memory_hotplug.c
-index c3a8141..ede13734 100644
---- a/mm/memory_hotplug.c
-+++ b/mm/memory_hotplug.c
-@@ -1483,17 +1483,20 @@ bool is_mem_section_removable(unsigned long start_pfn, unsigned long nr_pages)
- }
-
- /*
-- * Confirm all pages in a range [start, end) is belongs to the same zone.
-+ * Confirm all pages in a range [start, end) belong to the same zone.
-+ * When true, return its valid [start, end).
- */
--int test_pages_in_a_zone(unsigned long start_pfn, unsigned long end_pfn)
-+int test_pages_in_a_zone(unsigned long start_pfn, unsigned long end_pfn,
-+ unsigned long *valid_start, unsigned long *valid_end)
- {
- unsigned long pfn, sec_end_pfn;
-+ unsigned long start, end;
- struct zone *zone = NULL;
- struct page *page;
- int i;
-- for (pfn = start_pfn, sec_end_pfn = SECTION_ALIGN_UP(start_pfn);
-+ for (pfn = start_pfn, sec_end_pfn = SECTION_ALIGN_UP(start_pfn + 1);
- pfn < end_pfn;
-- pfn = sec_end_pfn + 1, sec_end_pfn += PAGES_PER_SECTION) {
-+ pfn = sec_end_pfn, sec_end_pfn += PAGES_PER_SECTION) {
- /* Make sure the memory section is present first */
- if (!present_section_nr(pfn_to_section_nr(pfn)))
- continue;
-@@ -1509,10 +1512,20 @@ int test_pages_in_a_zone(unsigned long start_pfn, unsigned long end_pfn)
- page = pfn_to_page(pfn + i);
- if (zone && page_zone(page) != zone)
- return 0;
-+ if (!zone)
-+ start = pfn + i;
- zone = page_zone(page);
-+ end = pfn + MAX_ORDER_NR_PAGES;
- }
- }
-- return 1;
-+
-+ if (zone) {
-+ *valid_start = start;
-+ *valid_end = end;
-+ return 1;
-+ } else {
-+ return 0;
-+ }
- }
-
- /*
-@@ -1859,6 +1872,7 @@ static int __ref __offline_pages(unsigned long start_pfn,
- long offlined_pages;
- int ret, drain, retry_max, node;
- unsigned long flags;
-+ unsigned long valid_start, valid_end;
- struct zone *zone;
- struct memory_notify arg;
-
-@@ -1869,10 +1883,10 @@ static int __ref __offline_pages(unsigned long start_pfn,
- return -EINVAL;
- /* This makes hotplug much easier...and readable.
- we assume this for now. .*/
-- if (!test_pages_in_a_zone(start_pfn, end_pfn))
-+ if (!test_pages_in_a_zone(start_pfn, end_pfn, &valid_start, &valid_end))
- return -EINVAL;
-
-- zone = page_zone(pfn_to_page(start_pfn));
-+ zone = page_zone(pfn_to_page(valid_start));
- node = zone_to_nid(zone);
- nr_pages = end_pfn - start_pfn;
-
-diff --git a/mm/zswap.c b/mm/zswap.c
-index 275b22c..dbef278 100644
---- a/mm/zswap.c
-+++ b/mm/zswap.c
-@@ -78,7 +78,13 @@ static u64 zswap_duplicate_entry;
-
- /* Enable/disable zswap (disabled by default) */
- static bool zswap_enabled;
--module_param_named(enabled, zswap_enabled, bool, 0644);
-+static int zswap_enabled_param_set(const char *,
-+ const struct kernel_param *);
-+static struct kernel_param_ops zswap_enabled_param_ops = {
-+ .set = zswap_enabled_param_set,
-+ .get = param_get_bool,
-+};
-+module_param_cb(enabled, &zswap_enabled_param_ops, &zswap_enabled, 0644);
-
- /* Crypto compressor to use */
- #define ZSWAP_COMPRESSOR_DEFAULT "lzo"
-@@ -176,6 +182,9 @@ static atomic_t zswap_pools_count = ATOMIC_INIT(0);
- /* used by param callback function */
- static bool zswap_init_started;
-
-+/* fatal error during init */
-+static bool zswap_init_failed;
-+
- /*********************************
- * helpers and fwd declarations
- **********************************/
-@@ -706,6 +715,11 @@ static int __zswap_param_set(const char *val, const struct kernel_param *kp,
- char *s = strstrip((char *)val);
- int ret;
-
-+ if (zswap_init_failed) {
-+ pr_err("can't set param, initialization failed\n");
-+ return -ENODEV;
-+ }
-+
- /* no change required */
- if (!strcmp(s, *(char **)kp->arg))
- return 0;
-@@ -785,6 +799,17 @@ static int zswap_zpool_param_set(const char *val,
- return __zswap_param_set(val, kp, NULL, zswap_compressor);
- }
-
-+static int zswap_enabled_param_set(const char *val,
-+ const struct kernel_param *kp)
-+{
-+ if (zswap_init_failed) {
-+ pr_err("can't enable, initialization failed\n");
-+ return -ENODEV;
-+ }
-+
-+ return param_set_bool(val, kp);
-+}
-+
- /*********************************
- * writeback code
- **********************************/
-@@ -1271,6 +1296,9 @@ static int __init init_zswap(void)
- dstmem_fail:
- zswap_entry_cache_destroy();
- cache_fail:
-+ /* if built-in, we aren't unloaded on failure; don't allow use */
-+ zswap_init_failed = true;
-+ zswap_enabled = false;
- return -ENOMEM;
- }
- /* must be late so crypto has time to come up */
-diff --git a/net/can/bcm.c b/net/can/bcm.c
-index 436a753..5e9ed5e 100644
---- a/net/can/bcm.c
-+++ b/net/can/bcm.c
-@@ -734,14 +734,23 @@ static struct bcm_op *bcm_find_op(struct list_head *ops,
-
- static void bcm_remove_op(struct bcm_op *op)
- {
-- hrtimer_cancel(&op->timer);
-- hrtimer_cancel(&op->thrtimer);
--
-- if (op->tsklet.func)
-- tasklet_kill(&op->tsklet);
-+ if (op->tsklet.func) {
-+ while (test_bit(TASKLET_STATE_SCHED, &op->tsklet.state) ||
-+ test_bit(TASKLET_STATE_RUN, &op->tsklet.state) ||
-+ hrtimer_active(&op->timer)) {
-+ hrtimer_cancel(&op->timer);
-+ tasklet_kill(&op->tsklet);
-+ }
-+ }
-
-- if (op->thrtsklet.func)
-- tasklet_kill(&op->thrtsklet);
-+ if (op->thrtsklet.func) {
-+ while (test_bit(TASKLET_STATE_SCHED, &op->thrtsklet.state) ||
-+ test_bit(TASKLET_STATE_RUN, &op->thrtsklet.state) ||
-+ hrtimer_active(&op->thrtimer)) {
-+ hrtimer_cancel(&op->thrtimer);
-+ tasklet_kill(&op->thrtsklet);
-+ }
-+ }
-
- if ((op->frames) && (op->frames != &op->sframe))
- kfree(op->frames);
-diff --git a/net/sunrpc/auth_gss/gss_rpc_xdr.c b/net/sunrpc/auth_gss/gss_rpc_xdr.c
-index dc6fb79..25d9a9c 100644
---- a/net/sunrpc/auth_gss/gss_rpc_xdr.c
-+++ b/net/sunrpc/auth_gss/gss_rpc_xdr.c
-@@ -260,7 +260,7 @@ static int gssx_dec_option_array(struct xdr_stream *xdr,
- if (!oa->data)
- return -ENOMEM;
-
-- creds = kmalloc(sizeof(struct svc_cred), GFP_KERNEL);
-+ creds = kzalloc(sizeof(struct svc_cred), GFP_KERNEL);
- if (!creds) {
- kfree(oa->data);
- return -ENOMEM;