grsecurity-3.1-4.8.17-20170109082320170109

13 files changed, 3293 insertions, 60 deletions

diff --git a/4.8.16/0000_README b/4.8.17/0000_README
index 6a4ea7b..c7c05dd 100644
--- a/4.8.16/0000_README
+++ b/4.8.17/0000_README
@@ -2,7 +2,11 @@ README
 -----------------------------------------------------------------------------
 Individual Patch Descriptions:
 -----------------------------------------------------------------------------
-Patch:	4420_grsecurity-3.1-4.8.16-201701062021.patch
+Patch:	1016_linux-4.8.17.patch
+From:	http://www.kernel.org
+Desc:	Linux 4.8.17
+
+Patch:	4420_grsecurity-3.1-4.8.17-201701090823.patch
 From:	http://www.grsecurity.net
 Desc:	hardened-sources base patch from upstream grsecurity
 
diff --git a/4.8.17/1016_linux-4.8.17.patch b/4.8.17/1016_linux-4.8.17.patch
new file mode 100644
index 0000000..0b240d8
--- /dev/null
+++ b/4.8.17/1016_linux-4.8.17.patch
@@ -0,0 +1,3229 @@
+diff --git a/Documentation/sphinx/rstFlatTable.py b/Documentation/sphinx/rstFlatTable.py
+index 26db852..9916359 100644
+--- a/Documentation/sphinx/rstFlatTable.py
++++ b/Documentation/sphinx/rstFlatTable.py
+@@ -151,6 +151,11 @@ class ListTableBuilder(object):
+     def buildTableNode(self):
+ 
+         colwidths    = self.directive.get_column_widths(self.max_cols)
++        if isinstance(colwidths, tuple):
++            # Since docutils 0.13, get_column_widths returns a (widths,
++            # colwidths) tuple, where widths is a string (i.e. 'auto').
++            # See https://sourceforge.net/p/docutils/patches/120/.
++            colwidths = colwidths[1]
+         stub_columns = self.directive.options.get('stub-columns', 0)
+         header_rows  = self.directive.options.get('header-rows', 0)
+ 
+diff --git a/Documentation/virtual/kvm/api.txt b/Documentation/virtual/kvm/api.txt
+index 739db9a..a7596e9 100644
+--- a/Documentation/virtual/kvm/api.txt
++++ b/Documentation/virtual/kvm/api.txt
+@@ -2039,6 +2039,7 @@ registers, find a list below:
+   PPC   | KVM_REG_PPC_TM_VSCR           | 32
+   PPC   | KVM_REG_PPC_TM_DSCR           | 64
+   PPC   | KVM_REG_PPC_TM_TAR            | 64
++  PPC   | KVM_REG_PPC_TM_XER            | 64
+         |                               |
+   MIPS  | KVM_REG_MIPS_R0               | 64
+           ...
+diff --git a/Makefile b/Makefile
+index 50f6864..ace32d3 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 4
+ PATCHLEVEL = 8
+-SUBLEVEL = 16
++SUBLEVEL = 17
+ EXTRAVERSION =
+ NAME = Psychotic Stoned Sheep
+ 
+diff --git a/arch/arc/include/asm/cacheflush.h b/arch/arc/include/asm/cacheflush.h
+index a093adb..fc662f4 100644
+--- a/arch/arc/include/asm/cacheflush.h
++++ b/arch/arc/include/asm/cacheflush.h
+@@ -85,6 +85,10 @@ void flush_anon_page(struct vm_area_struct *vma,
+  */
+ #define PG_dc_clean	PG_arch_1
+ 
++#define CACHE_COLORS_NUM	4
++#define CACHE_COLORS_MSK	(CACHE_COLORS_NUM - 1)
++#define CACHE_COLOR(addr)	(((unsigned long)(addr) >> (PAGE_SHIFT)) & CACHE_COLORS_MSK)
++
+ /*
+  * Simple wrapper over config option
+  * Bootup code ensures that hardware matches kernel configuration
+@@ -94,8 +98,6 @@ static inline int cache_is_vipt_aliasing(void)
+ 	return IS_ENABLED(CONFIG_ARC_CACHE_VIPT_ALIASING);
+ }
+ 
+-#define CACHE_COLOR(addr)	(((unsigned long)(addr) >> (PAGE_SHIFT)) & 1)
+-
+ /*
+  * checks if two addresses (after page aligning) index into same cache set
+  */
+diff --git a/arch/arc/mm/cache.c b/arch/arc/mm/cache.c
+index 0b10efe..ab1aaf2 100644
+--- a/arch/arc/mm/cache.c
++++ b/arch/arc/mm/cache.c
+@@ -967,11 +967,16 @@ void arc_cache_init(void)
+ 		/* check for D-Cache aliasing on ARCompact: ARCv2 has PIPT */
+ 		if (is_isa_arcompact()) {
+ 			int handled = IS_ENABLED(CONFIG_ARC_CACHE_VIPT_ALIASING);
+-
+-			if (dc->alias && !handled)
+-				panic("Enable CONFIG_ARC_CACHE_VIPT_ALIASING\n");
+-			else if (!dc->alias && handled)
++			int num_colors = dc->sz_k/dc->assoc/TO_KB(PAGE_SIZE);
++
++			if (dc->alias) {
++				if (!handled)
++					panic("Enable CONFIG_ARC_CACHE_VIPT_ALIASING\n");
++				if (CACHE_COLORS_NUM != num_colors)
++					panic("CACHE_COLORS_NUM not optimized for config\n");
++			} else if (!dc->alias && handled) {
+ 				panic("Disable CONFIG_ARC_CACHE_VIPT_ALIASING\n");
++			}
+ 		}
+ 	}
+ 
+diff --git a/arch/arm64/boot/dts/nvidia/tegra210-p2180.dtsi b/arch/arm64/boot/dts/nvidia/tegra210-p2180.dtsi
+index 5fda583..906fb83 100644
+--- a/arch/arm64/boot/dts/nvidia/tegra210-p2180.dtsi
++++ b/arch/arm64/boot/dts/nvidia/tegra210-p2180.dtsi
+@@ -21,6 +21,10 @@
+ 		reg = <0x0 0x80000000 0x1 0x0>;
+ 	};
+ 
++	gpu@57000000 {
++		vdd-supply = <&vdd_gpu>;
++	};
++
+ 	/* debug port */
+ 	serial@70006000 {
+ 		status = "okay";
+@@ -291,4 +295,18 @@
+ 			clock-frequency = <32768>;
+ 		};
+ 	};
++
++	regulators {
++		vdd_gpu: regulator@100 {
++			compatible = "pwm-regulator";
++			reg = <100>;
++			pwms = <&pwm 1 4880>;
++			regulator-name = "VDD_GPU";
++			regulator-min-microvolt = <710000>;
++			regulator-max-microvolt = <1320000>;
++			enable-gpios = <&pmic 6 GPIO_ACTIVE_HIGH>;
++			regulator-ramp-delay = <80>;
++			regulator-enable-ramp-delay = <1000>;
++		};
++	};
+ };
+diff --git a/arch/arm64/kvm/hyp/switch.c b/arch/arm64/kvm/hyp/switch.c
+index 5a84b45..03498c8 100644
+--- a/arch/arm64/kvm/hyp/switch.c
++++ b/arch/arm64/kvm/hyp/switch.c
+@@ -82,7 +82,13 @@ static void __hyp_text __activate_traps(struct kvm_vcpu *vcpu)
+ 	write_sysreg(val, hcr_el2);
+ 	/* Trap on AArch32 cp15 c15 accesses (EL1 or EL0) */
+ 	write_sysreg(1 << 15, hstr_el2);
+-	/* Make sure we trap PMU access from EL0 to EL2 */
++	/*
++	 * Make sure we trap PMU access from EL0 to EL2. Also sanitize
++	 * PMSELR_EL0 to make sure it never contains the cycle
++	 * counter, which could make a PMXEVCNTR_EL0 access UNDEF at
++	 * EL1 instead of being trapped to EL2.
++	 */
++	write_sysreg(0, pmselr_el0);
+ 	write_sysreg(ARMV8_PMU_USERENR_MASK, pmuserenr_el0);
+ 	write_sysreg(vcpu->arch.mdcr_el2, mdcr_el2);
+ 	__activate_traps_arch()();
+diff --git a/arch/powerpc/boot/ps3-head.S b/arch/powerpc/boot/ps3-head.S
+index b6fcbaf..3dc44b0 100644
+--- a/arch/powerpc/boot/ps3-head.S
++++ b/arch/powerpc/boot/ps3-head.S
+@@ -57,11 +57,6 @@ __system_reset_overlay:
+ 	bctr
+ 
+ 1:
+-	/* Save the value at addr zero for a null pointer write check later. */
+-
+-	li	r4, 0
+-	lwz	r3, 0(r4)
+-
+ 	/* Primary delays then goes to _zimage_start in wrapper. */
+ 
+ 	or	31, 31, 31 /* db16cyc */
+diff --git a/arch/powerpc/boot/ps3.c b/arch/powerpc/boot/ps3.c
+index 4ec2d86..a05558a 100644
+--- a/arch/powerpc/boot/ps3.c
++++ b/arch/powerpc/boot/ps3.c
+@@ -119,13 +119,12 @@ void ps3_copy_vectors(void)
+ 	flush_cache((void *)0x100, 512);
+ }
+ 
+-void platform_init(unsigned long null_check)
++void platform_init(void)
+ {
+ 	const u32 heapsize = 0x1000000 - (u32)_end; /* 16MiB */
+ 	void *chosen;
+ 	unsigned long ft_addr;
+ 	u64 rm_size;
+-	unsigned long val;
+ 
+ 	console_ops.write = ps3_console_write;
+ 	platform_ops.exit = ps3_exit;
+@@ -153,11 +152,6 @@ void platform_init(unsigned long null_check)
+ 
+ 	printf(" flat tree at 0x%lx\n\r", ft_addr);
+ 
+-	val = *(unsigned long *)0;
+-
+-	if (val != null_check)
+-		printf("null check failed: %lx != %lx\n\r", val, null_check);
+-
+ 	((kernel_entry_t)0)(ft_addr, 0, NULL);
+ 
+ 	ps3_exit();
+diff --git a/arch/powerpc/include/asm/kvm_host.h b/arch/powerpc/include/asm/kvm_host.h
+index ec35af3..f2c5dde 100644
+--- a/arch/powerpc/include/asm/kvm_host.h
++++ b/arch/powerpc/include/asm/kvm_host.h
+@@ -555,6 +555,7 @@ struct kvm_vcpu_arch {
+ 	u64 tfiar;
+ 
+ 	u32 cr_tm;
++	u64 xer_tm;
+ 	u64 lr_tm;
+ 	u64 ctr_tm;
+ 	u64 amr_tm;
+diff --git a/arch/powerpc/include/uapi/asm/kvm.h b/arch/powerpc/include/uapi/asm/kvm.h
+index c93cf35..0fb1326 100644
+--- a/arch/powerpc/include/uapi/asm/kvm.h
++++ b/arch/powerpc/include/uapi/asm/kvm.h
+@@ -596,6 +596,7 @@ struct kvm_get_htab_header {
+ #define KVM_REG_PPC_TM_VSCR	(KVM_REG_PPC_TM | KVM_REG_SIZE_U32 | 0x67)
+ #define KVM_REG_PPC_TM_DSCR	(KVM_REG_PPC_TM | KVM_REG_SIZE_U64 | 0x68)
+ #define KVM_REG_PPC_TM_TAR	(KVM_REG_PPC_TM | KVM_REG_SIZE_U64 | 0x69)
++#define KVM_REG_PPC_TM_XER	(KVM_REG_PPC_TM | KVM_REG_SIZE_U64 | 0x6a)
+ 
+ /* PPC64 eXternal Interrupt Controller Specification */
+ #define KVM_DEV_XICS_GRP_SOURCES	1	/* 64-bit source attributes */
+diff --git a/arch/powerpc/kernel/asm-offsets.c b/arch/powerpc/kernel/asm-offsets.c
+index b89d14c..6ba221c 100644
+--- a/arch/powerpc/kernel/asm-offsets.c
++++ b/arch/powerpc/kernel/asm-offsets.c
+@@ -569,6 +569,7 @@ int main(void)
+ 	DEFINE(VCPU_VRS_TM, offsetof(struct kvm_vcpu, arch.vr_tm.vr));
+ 	DEFINE(VCPU_VRSAVE_TM, offsetof(struct kvm_vcpu, arch.vrsave_tm));
+ 	DEFINE(VCPU_CR_TM, offsetof(struct kvm_vcpu, arch.cr_tm));
++	DEFINE(VCPU_XER_TM, offsetof(struct kvm_vcpu, arch.xer_tm));
+ 	DEFINE(VCPU_LR_TM, offsetof(struct kvm_vcpu, arch.lr_tm));
+ 	DEFINE(VCPU_CTR_TM, offsetof(struct kvm_vcpu, arch.ctr_tm));
+ 	DEFINE(VCPU_AMR_TM, offsetof(struct kvm_vcpu, arch.amr_tm));
+diff --git a/arch/powerpc/kernel/head_64.S b/arch/powerpc/kernel/head_64.S
+index f765b04..8825789 100644
+--- a/arch/powerpc/kernel/head_64.S
++++ b/arch/powerpc/kernel/head_64.S
+@@ -201,9 +201,9 @@ booting_thread_hwid:
+  */
+ _GLOBAL(book3e_start_thread)
+ 	LOAD_REG_IMMEDIATE(r5, MSR_KERNEL)
+-	cmpi	0, r3, 0
++	cmpwi	r3, 0
+ 	beq	10f
+-	cmpi	0, r3, 1
++	cmpwi	r3, 1
+ 	beq	11f
+ 	/* If the thread id is invalid, just exit. */
+ 	b	13f
+@@ -228,9 +228,9 @@ _GLOBAL(book3e_start_thread)
+  * r3 = the thread physical id
+  */
+ _GLOBAL(book3e_stop_thread)
+-	cmpi	0, r3, 0
++	cmpwi	r3, 0
+ 	beq	10f
+-	cmpi	0, r3, 1
++	cmpwi	r3, 1
+ 	beq	10f
+ 	/* If the thread id is invalid, just exit. */
+ 	b	13f
+diff --git a/arch/powerpc/kvm/book3s_hv.c b/arch/powerpc/kvm/book3s_hv.c
+index 2fd5580..4c8d344 100644
+--- a/arch/powerpc/kvm/book3s_hv.c
++++ b/arch/powerpc/kvm/book3s_hv.c
+@@ -1235,6 +1235,9 @@ static int kvmppc_get_one_reg_hv(struct kvm_vcpu *vcpu, u64 id,
+ 	case KVM_REG_PPC_TM_CR:
+ 		*val = get_reg_val(id, vcpu->arch.cr_tm);
+ 		break;
++	case KVM_REG_PPC_TM_XER:
++		*val = get_reg_val(id, vcpu->arch.xer_tm);
++		break;
+ 	case KVM_REG_PPC_TM_LR:
+ 		*val = get_reg_val(id, vcpu->arch.lr_tm);
+ 		break;
+@@ -1442,6 +1445,9 @@ static int kvmppc_set_one_reg_hv(struct kvm_vcpu *vcpu, u64 id,
+ 	case KVM_REG_PPC_TM_CR:
+ 		vcpu->arch.cr_tm = set_reg_val(id, *val);
+ 		break;
++	case KVM_REG_PPC_TM_XER:
++		vcpu->arch.xer_tm = set_reg_val(id, *val);
++		break;
+ 	case KVM_REG_PPC_TM_LR:
+ 		vcpu->arch.lr_tm = set_reg_val(id, *val);
+ 		break;
+diff --git a/arch/powerpc/kvm/book3s_hv_rm_mmu.c b/arch/powerpc/kvm/book3s_hv_rm_mmu.c
+index 99b4e9d..5420d06 100644
+--- a/arch/powerpc/kvm/book3s_hv_rm_mmu.c
++++ b/arch/powerpc/kvm/book3s_hv_rm_mmu.c
+@@ -653,6 +653,8 @@ long kvmppc_h_protect(struct kvm_vcpu *vcpu, unsigned long flags,
+ 					      HPTE_V_ABSENT);
+ 			do_tlbies(kvm, &rb, 1, global_invalidates(kvm, flags),
+ 				  true);
++			/* Don't lose R/C bit updates done by hardware */
++			r |= be64_to_cpu(hpte[1]) & (HPTE_R_R | HPTE_R_C);
+ 			hpte[1] = cpu_to_be64(r);
+ 		}
+ 	}
+diff --git a/arch/powerpc/kvm/book3s_hv_rmhandlers.S b/arch/powerpc/kvm/book3s_hv_rmhandlers.S
+index 9756555..bf243a4 100644
+--- a/arch/powerpc/kvm/book3s_hv_rmhandlers.S
++++ b/arch/powerpc/kvm/book3s_hv_rmhandlers.S
+@@ -2579,11 +2579,13 @@ kvmppc_save_tm:
+ 	mfctr	r7
+ 	mfspr	r8, SPRN_AMR
+ 	mfspr	r10, SPRN_TAR
++	mfxer	r11
+ 	std	r5, VCPU_LR_TM(r9)
+ 	stw	r6, VCPU_CR_TM(r9)
+ 	std	r7, VCPU_CTR_TM(r9)
+ 	std	r8, VCPU_AMR_TM(r9)
+ 	std	r10, VCPU_TAR_TM(r9)
++	std	r11, VCPU_XER_TM(r9)
+ 
+ 	/* Restore r12 as trap number. */
+ 	lwz	r12, VCPU_TRAP(r9)
+@@ -2676,11 +2678,13 @@ kvmppc_restore_tm:
+ 	ld	r7, VCPU_CTR_TM(r4)
+ 	ld	r8, VCPU_AMR_TM(r4)
+ 	ld	r9, VCPU_TAR_TM(r4)
++	ld	r10, VCPU_XER_TM(r4)
+ 	mtlr	r5
+ 	mtcr	r6
+ 	mtctr	r7
+ 	mtspr	SPRN_AMR, r8
+ 	mtspr	SPRN_TAR, r9
++	mtxer	r10
+ 
+ 	/*
+ 	 * Load up PPR and DSCR values but don't put them in the actual SPRs
+diff --git a/arch/s390/kernel/setup.c b/arch/s390/kernel/setup.c
+index 7f7ba5f2..d027f2e 100644
+--- a/arch/s390/kernel/setup.c
++++ b/arch/s390/kernel/setup.c
+@@ -445,7 +445,7 @@ static void __init setup_resources(void)
+ 	 * part of the System RAM resource.
+ 	 */
+ 	if (crashk_res.end) {
+-		memblock_add(crashk_res.start, resource_size(&crashk_res));
++		memblock_add_node(crashk_res.start, resource_size(&crashk_res), 0);
+ 		memblock_reserve(crashk_res.start, resource_size(&crashk_res));
+ 		insert_resource(&iomem_resource, &crashk_res);
+ 	}
+diff --git a/arch/x86/entry/entry_32.S b/arch/x86/entry/entry_32.S
+index 0b56666..b84a349 100644
+--- a/arch/x86/entry/entry_32.S
++++ b/arch/x86/entry/entry_32.S
+@@ -852,8 +852,8 @@ ftrace_graph_call:
+ 	jmp	ftrace_stub
+ #endif
+ 
+-.globl ftrace_stub
+-ftrace_stub:
++/* This is weak to keep gas from relaxing the jumps */
++WEAK(ftrace_stub)
+ 	ret
+ END(ftrace_caller)
+ 
+diff --git a/arch/x86/events/core.c b/arch/x86/events/core.c
+index 8c925ec..7b0f1d9 100644
+--- a/arch/x86/events/core.c
++++ b/arch/x86/events/core.c
+@@ -364,7 +364,11 @@ int x86_add_exclusive(unsigned int what)
+ {
+ 	int i;
+ 
+-	if (x86_pmu.lbr_pt_coexist)
++	/*
++	 * When lbr_pt_coexist we allow PT to coexist with either LBR or BTS.
++	 * LBR and BTS are still mutually exclusive.
++	 */
++	if (x86_pmu.lbr_pt_coexist && what == x86_lbr_exclusive_pt)
+ 		return 0;
+ 
+ 	if (!atomic_inc_not_zero(&x86_pmu.lbr_exclusive[what])) {
+@@ -387,7 +391,7 @@ int x86_add_exclusive(unsigned int what)
+ 
+ void x86_del_exclusive(unsigned int what)
+ {
+-	if (x86_pmu.lbr_pt_coexist)
++	if (x86_pmu.lbr_pt_coexist && what == x86_lbr_exclusive_pt)
+ 		return;
+ 
+ 	atomic_dec(&x86_pmu.lbr_exclusive[what]);
+diff --git a/arch/x86/events/intel/cstate.c b/arch/x86/events/intel/cstate.c
+index 3ca87b5..834262a 100644
+--- a/arch/x86/events/intel/cstate.c
++++ b/arch/x86/events/intel/cstate.c
+@@ -571,6 +571,9 @@ static int __init cstate_probe(const struct cstate_model *cm)
+ 
+ static inline void cstate_cleanup(void)
+ {
++	cpuhp_remove_state_nocalls(CPUHP_AP_PERF_X86_CSTATE_ONLINE);
++	cpuhp_remove_state_nocalls(CPUHP_AP_PERF_X86_CSTATE_STARTING);
++
+ 	if (has_cstate_core)
+ 		perf_pmu_unregister(&cstate_core_pmu);
+ 
+@@ -583,16 +586,16 @@ static int __init cstate_init(void)
+ 	int err;
+ 
+ 	cpuhp_setup_state(CPUHP_AP_PERF_X86_CSTATE_STARTING,
+-			  "AP_PERF_X86_CSTATE_STARTING", cstate_cpu_init,
+-			  NULL);
++			  "perf/x86/cstate:starting", cstate_cpu_init, NULL);
+ 	cpuhp_setup_state(CPUHP_AP_PERF_X86_CSTATE_ONLINE,
+-			  "AP_PERF_X86_CSTATE_ONLINE", NULL, cstate_cpu_exit);
++			  "perf/x86/cstate:online", NULL, cstate_cpu_exit);
+ 
+ 	if (has_cstate_core) {
+ 		err = perf_pmu_register(&cstate_core_pmu, cstate_core_pmu.name, -1);
+ 		if (err) {
+ 			has_cstate_core = false;
+ 			pr_info("Failed to register cstate core pmu\n");
++			cstate_cleanup();
+ 			return err;
+ 		}
+ 	}
+@@ -606,8 +609,7 @@ static int __init cstate_init(void)
+ 			return err;
+ 		}
+ 	}
+-
+-	return err;
++	return 0;
+ }
+ 
+ static int __init cstate_pmu_init(void)
+@@ -632,8 +634,6 @@ module_init(cstate_pmu_init);
+ 
+ static void __exit cstate_pmu_exit(void)
+ {
+-	cpuhp_remove_state_nocalls(CPUHP_AP_PERF_X86_CSTATE_ONLINE);
+-	cpuhp_remove_state_nocalls(CPUHP_AP_PERF_X86_CSTATE_STARTING);
+ 	cstate_cleanup();
+ }
+ module_exit(cstate_pmu_exit);
+diff --git a/arch/x86/events/perf_event.h b/arch/x86/events/perf_event.h
+index 181c238..4ab002d 100644
+--- a/arch/x86/events/perf_event.h
++++ b/arch/x86/events/perf_event.h
+@@ -601,7 +601,7 @@ struct x86_pmu {
+ 	u64		lbr_sel_mask;		   /* LBR_SELECT valid bits */
+ 	const int	*lbr_sel_map;		   /* lbr_select mappings */
+ 	bool		lbr_double_abort;	   /* duplicated lbr aborts */
+-	bool		lbr_pt_coexist;		   /* LBR may coexist with PT */
++	bool		lbr_pt_coexist;		   /* (LBR|BTS) may coexist with PT */
+ 
+ 	/*
+ 	 * Intel PT/LBR/BTS are exclusive
+diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
+index 5cede40..7a72db5 100644
+--- a/arch/x86/kvm/vmx.c
++++ b/arch/x86/kvm/vmx.c
+@@ -1336,10 +1336,10 @@ static inline bool nested_cpu_has_posted_intr(struct vmcs12 *vmcs12)
+ 	return vmcs12->pin_based_vm_exec_control & PIN_BASED_POSTED_INTR;
+ }
+ 
+-static inline bool is_exception(u32 intr_info)
++static inline bool is_nmi(u32 intr_info)
+ {
+ 	return (intr_info & (INTR_INFO_INTR_TYPE_MASK | INTR_INFO_VALID_MASK))
+-		== (INTR_TYPE_HARD_EXCEPTION | INTR_INFO_VALID_MASK);
++		== (INTR_TYPE_NMI_INTR | INTR_INFO_VALID_MASK);
+ }
+ 
+ static void nested_vmx_vmexit(struct kvm_vcpu *vcpu, u32 exit_reason,
+@@ -5467,7 +5467,7 @@ static int handle_exception(struct kvm_vcpu *vcpu)
+ 	if (is_machine_check(intr_info))
+ 		return handle_machine_check(vcpu);
+ 
+-	if ((intr_info & INTR_INFO_INTR_TYPE_MASK) == INTR_TYPE_NMI_INTR)
++	if (is_nmi(intr_info))
+ 		return 1;  /* already handled by vmx_vcpu_run() */
+ 
+ 	if (is_no_device(intr_info)) {
+@@ -7974,7 +7974,7 @@ static bool nested_vmx_exit_handled(struct kvm_vcpu *vcpu)
+ 
+ 	switch (exit_reason) {
+ 	case EXIT_REASON_EXCEPTION_NMI:
+-		if (!is_exception(intr_info))
++		if (is_nmi(intr_info))
+ 			return false;
+ 		else if (is_page_fault(intr_info))
+ 			return enable_ept;
+@@ -8572,8 +8572,7 @@ static void vmx_complete_atomic_exit(struct vcpu_vmx *vmx)
+ 		kvm_machine_check();
+ 
+ 	/* We need to handle NMIs before interrupts are enabled */
+-	if ((exit_intr_info & INTR_INFO_INTR_TYPE_MASK) == INTR_TYPE_NMI_INTR &&
+-	    (exit_intr_info & INTR_INFO_VALID_MASK)) {
++	if (is_nmi(exit_intr_info)) {
+ 		kvm_before_handle_nmi(&vmx->vcpu);
+ 		asm("int $2");
+ 		kvm_after_handle_nmi(&vmx->vcpu);
+diff --git a/block/bsg.c b/block/bsg.c
+index d214e92..b9a5361 100644
+--- a/block/bsg.c
++++ b/block/bsg.c
+@@ -655,6 +655,9 @@ bsg_write(struct file *file, const char __user *buf, size_t count, loff_t *ppos)
+ 
+ 	dprintk("%s: write %Zd bytes\n", bd->name, count);
+ 
++	if (unlikely(segment_eq(get_fs(), KERNEL_DS)))
++		return -EINVAL;
++
+ 	bsg_set_block(bd, file);
+ 
+ 	bytes_written = 0;
+diff --git a/drivers/acpi/video_detect.c b/drivers/acpi/video_detect.c
+index a6b36fc..02ded25 100644
+--- a/drivers/acpi/video_detect.c
++++ b/drivers/acpi/video_detect.c
+@@ -296,6 +296,26 @@ static const struct dmi_system_id video_detect_dmi_table[] = {
+ 		DMI_MATCH(DMI_PRODUCT_NAME, "Vostro V131"),
+ 		},
+ 	},
++	{
++	 /* https://bugzilla.redhat.com/show_bug.cgi?id=1123661 */
++	 .callback = video_detect_force_native,
++	 .ident = "Dell XPS 17 L702X",
++	 .matches = {
++		DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
++		DMI_MATCH(DMI_PRODUCT_NAME, "Dell System XPS L702X"),
++		},
++	},
++	{
++	/* https://bugzilla.redhat.com/show_bug.cgi?id=1204476 */
++	/* https://bugs.launchpad.net/ubuntu/+source/linux-lts-trusty/+bug/1416940 */
++	.callback = video_detect_force_native,
++	.ident = "HP Pavilion dv6",
++	.matches = {
++		DMI_MATCH(DMI_SYS_VENDOR, "Hewlett-Packard"),
++		DMI_MATCH(DMI_PRODUCT_NAME, "HP Pavilion dv6 Notebook PC"),
++		},
++	},
++
+ 	{ },
+ };
+ 
+diff --git a/drivers/base/firmware_class.c b/drivers/base/firmware_class.c
+index 22d1760..a95e1e5 100644
+--- a/drivers/base/firmware_class.c
++++ b/drivers/base/firmware_class.c
+@@ -955,13 +955,14 @@ static int _request_firmware_load(struct firmware_priv *fw_priv,
+ 		timeout = MAX_JIFFY_OFFSET;
+ 	}
+ 
+-	retval = wait_for_completion_interruptible_timeout(&buf->completion,
++	timeout = wait_for_completion_interruptible_timeout(&buf->completion,
+ 			timeout);
+-	if (retval == -ERESTARTSYS || !retval) {
++	if (timeout == -ERESTARTSYS || !timeout) {
++		retval = timeout;
+ 		mutex_lock(&fw_lock);
+ 		fw_load_abort(fw_priv);
+ 		mutex_unlock(&fw_lock);
+-	} else if (retval > 0) {
++	} else if (timeout > 0) {
+ 		retval = 0;
+ 	}
+ 
+diff --git a/drivers/clk/bcm/clk-bcm2835.c b/drivers/clk/bcm/clk-bcm2835.c
+index 0fc71cb..3250694 100644
+--- a/drivers/clk/bcm/clk-bcm2835.c
++++ b/drivers/clk/bcm/clk-bcm2835.c
+@@ -751,7 +751,9 @@ static void bcm2835_pll_divider_off(struct clk_hw *hw)
+ 	cprman_write(cprman, data->cm_reg,
+ 		     (cprman_read(cprman, data->cm_reg) &
+ 		      ~data->load_mask) | data->hold_mask);
+-	cprman_write(cprman, data->a2w_reg, A2W_PLL_CHANNEL_DISABLE);
++	cprman_write(cprman, data->a2w_reg,
++		     cprman_read(cprman, data->a2w_reg) |
++		     A2W_PLL_CHANNEL_DISABLE);
+ 	spin_unlock(&cprman->regs_lock);
+ }
+ 
+diff --git a/drivers/gpio/gpiolib.c b/drivers/gpio/gpiolib.c
+index 15704aa..a8eea8a 100644
+--- a/drivers/gpio/gpiolib.c
++++ b/drivers/gpio/gpiolib.c
+@@ -984,7 +984,8 @@ static int gpio_chrdev_open(struct inode *inode, struct file *filp)
+ 		return -ENODEV;
+ 	get_device(&gdev->dev);
+ 	filp->private_data = gdev;
+-	return 0;
++
++	return nonseekable_open(inode, filp);
+ }
+ 
+ /**
+@@ -1009,7 +1010,7 @@ static const struct file_operations gpio_fileops = {
+ 	.release = gpio_chrdev_release,
+ 	.open = gpio_chrdev_open,
+ 	.owner = THIS_MODULE,
+-	.llseek = noop_llseek,
++	.llseek = no_llseek,
+ 	.unlocked_ioctl = gpio_ioctl,
+ #ifdef CONFIG_COMPAT
+ 	.compat_ioctl = gpio_ioctl_compat,
+diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c b/drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c
+index b818461..8199232 100644
+--- a/drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c
++++ b/drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c
+@@ -3798,8 +3798,12 @@ static int gfx_v8_0_init_save_restore_list(struct amdgpu_device *adev)
+ 	temp = mmRLC_SRM_INDEX_CNTL_ADDR_0;
+ 	data = mmRLC_SRM_INDEX_CNTL_DATA_0;
+ 	for (i = 0; i < sizeof(unique_indices) / sizeof(int); i++) {
+-		amdgpu_mm_wreg(adev, temp + i, unique_indices[i] & 0x3FFFF, false);
+-		amdgpu_mm_wreg(adev, data + i, unique_indices[i] >> 20, false);
++		if (unique_indices[i] != 0) {
++			amdgpu_mm_wreg(adev, temp + i,
++					unique_indices[i] & 0x3FFFF, false);
++			amdgpu_mm_wreg(adev, data + i,
++					unique_indices[i] >> 20, false);
++		}
+ 	}
+ 	kfree(register_list_format);
+ 
+@@ -5735,29 +5739,24 @@ static void gfx_v8_0_update_coarse_grain_clock_gating(struct amdgpu_device *adev
+ 	adev->gfx.rlc.funcs->enter_safe_mode(adev);
+ 
+ 	if (enable && (adev->cg_flags & AMD_CG_SUPPORT_GFX_CGCG)) {
+-		/* 1 enable cntx_empty_int_enable/cntx_busy_int_enable/
+-		 * Cmp_busy/GFX_Idle interrupts
+-		 */
+-		gfx_v8_0_enable_gui_idle_interrupt(adev, true);
+-
+ 		temp1 = data1 =	RREG32(mmRLC_CGTT_MGCG_OVERRIDE);
+ 		data1 &= ~RLC_CGTT_MGCG_OVERRIDE__CGCG_MASK;
+ 		if (temp1 != data1)
+ 			WREG32(mmRLC_CGTT_MGCG_OVERRIDE, data1);
+ 
+-		/* 2 wait for RLC_SERDES_CU_MASTER & RLC_SERDES_NONCU_MASTER idle */
++		/* : wait for RLC_SERDES_CU_MASTER & RLC_SERDES_NONCU_MASTER idle */
+ 		gfx_v8_0_wait_for_rlc_serdes(adev);
+ 
+-		/* 3 - clear cgcg override */
++		/* 2 - clear cgcg override */
+ 		gfx_v8_0_send_serdes_cmd(adev, BPM_REG_CGCG_OVERRIDE, CLE_BPM_SERDES_CMD);
+ 
+ 		/* wait for RLC_SERDES_CU_MASTER & RLC_SERDES_NONCU_MASTER idle */
+ 		gfx_v8_0_wait_for_rlc_serdes(adev);
+ 
+-		/* 4 - write cmd to set CGLS */
++		/* 3 - write cmd to set CGLS */
+ 		gfx_v8_0_send_serdes_cmd(adev, BPM_REG_CGLS_EN, SET_BPM_SERDES_CMD);
+ 
+-		/* 5 - enable cgcg */
++		/* 4 - enable cgcg */
+ 		data |= RLC_CGCG_CGLS_CTRL__CGCG_EN_MASK;
+ 
+ 		if (adev->cg_flags & AMD_CG_SUPPORT_GFX_CGLS) {
+@@ -5775,6 +5774,11 @@ static void gfx_v8_0_update_coarse_grain_clock_gating(struct amdgpu_device *adev
+ 
+ 		if (temp != data)
+ 			WREG32(mmRLC_CGCG_CGLS_CTRL, data);
++
++		/* 5 enable cntx_empty_int_enable/cntx_busy_int_enable/
++		 * Cmp_busy/GFX_Idle interrupts
++		 */
++		gfx_v8_0_enable_gui_idle_interrupt(adev, true);
+ 	} else {
+ 		/* disable cntx_empty_int_enable & GFX Idle interrupt */
+ 		gfx_v8_0_enable_gui_idle_interrupt(adev, false);
+diff --git a/drivers/gpu/drm/ast/ast_main.c b/drivers/gpu/drm/ast/ast_main.c
+index 904beaa..f75c642 100644
+--- a/drivers/gpu/drm/ast/ast_main.c
++++ b/drivers/gpu/drm/ast/ast_main.c
+@@ -223,7 +223,8 @@ static int ast_get_dram_info(struct drm_device *dev)
+ 	ast_write32(ast, 0x10000, 0xfc600309);
+ 
+ 	do {
+-		;
++		if (pci_channel_offline(dev->pdev))
++			return -EIO;
+ 	} while (ast_read32(ast, 0x10000) != 0x01);
+ 	data = ast_read32(ast, 0x10004);
+ 
+@@ -428,7 +429,9 @@ int ast_driver_load(struct drm_device *dev, unsigned long flags)
+ 	ast_detect_chip(dev, &need_post);
+ 
+ 	if (ast->chip != AST1180) {
+-		ast_get_dram_info(dev);
++		ret = ast_get_dram_info(dev);
++		if (ret)
++			goto out_free;
+ 		ast->vram_size = ast_get_vram_info(dev);
+ 		DRM_INFO("dram %d %d %d %08x\n", ast->mclk, ast->dram_type, ast->dram_bus_width, ast->vram_size);
+ 	}
+diff --git a/drivers/gpu/drm/gma500/psb_drv.c b/drivers/gpu/drm/gma500/psb_drv.c
+index 50eb944f..8f3ca52 100644
+--- a/drivers/gpu/drm/gma500/psb_drv.c
++++ b/drivers/gpu/drm/gma500/psb_drv.c
+@@ -473,6 +473,9 @@ static const struct file_operations psb_gem_fops = {
+ 	.open = drm_open,
+ 	.release = drm_release,
+ 	.unlocked_ioctl = psb_unlocked_ioctl,
++#ifdef CONFIG_COMPAT
++	.compat_ioctl = drm_compat_ioctl,
++#endif
+ 	.mmap = drm_gem_mmap,
+ 	.poll = drm_poll,
+ 	.read = drm_read,
+diff --git a/drivers/gpu/drm/i915/i915_gem_stolen.c b/drivers/gpu/drm/i915/i915_gem_stolen.c
+index 2bb69f3..b386b31 100644
+--- a/drivers/gpu/drm/i915/i915_gem_stolen.c
++++ b/drivers/gpu/drm/i915/i915_gem_stolen.c
+@@ -55,10 +55,9 @@ int i915_gem_stolen_insert_node_in_range(struct drm_i915_private *dev_priv,
+ 		return -ENODEV;
+ 
+ 	/* See the comment at the drm_mm_init() call for more about this check.
+-	 * WaSkipStolenMemoryFirstPage:bdw,chv,kbl (incomplete)
++	 * WaSkipStolenMemoryFirstPage:bdw+ (incomplete)
+ 	 */
+-	if (start < 4096 && (IS_GEN8(dev_priv) ||
+-			     IS_KBL_REVID(dev_priv, 0, KBL_REVID_A0)))
++	if (start < 4096 && INTEL_GEN(dev_priv) >= 8)
+ 		start = 4096;
+ 
+ 	mutex_lock(&dev_priv->mm.stolen_lock);
+diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
+index 35d385d..6bc93ba 100644
+--- a/drivers/gpu/drm/i915/intel_display.c
++++ b/drivers/gpu/drm/i915/intel_display.c
+@@ -13494,8 +13494,9 @@ static int intel_modeset_checks(struct drm_atomic_state *state)
+ 
+ 		DRM_DEBUG_KMS("New cdclk calculated to be atomic %u, actual %u\n",
+ 			      intel_state->cdclk, intel_state->dev_cdclk);
+-	} else
++	} else {
+ 		to_intel_atomic_state(state)->cdclk = dev_priv->atomic_cdclk_freq;
++	}
+ 
+ 	intel_modeset_clear_plls(state);
+ 
+@@ -13596,8 +13597,9 @@ static int intel_atomic_check(struct drm_device *dev,
+ 
+ 		if (ret)
+ 			return ret;
+-	} else
+-		intel_state->cdclk = dev_priv->cdclk_freq;
++	} else {
++		intel_state->cdclk = dev_priv->atomic_cdclk_freq;
++	}
+ 
+ 	ret = drm_atomic_helper_check_planes(dev, state);
+ 	if (ret)
+@@ -15902,6 +15904,7 @@ void intel_modeset_init(struct drm_device *dev)
+ 
+ 	intel_update_czclk(dev_priv);
+ 	intel_update_cdclk(dev);
++	dev_priv->atomic_cdclk_freq = dev_priv->cdclk_freq;
+ 
+ 	intel_shared_dpll_init(dev);
+ 
+diff --git a/drivers/gpu/drm/i915/intel_dsi_panel_vbt.c b/drivers/gpu/drm/i915/intel_dsi_panel_vbt.c
+index cd154ce..3460157 100644
+--- a/drivers/gpu/drm/i915/intel_dsi_panel_vbt.c
++++ b/drivers/gpu/drm/i915/intel_dsi_panel_vbt.c
+@@ -296,7 +296,8 @@ static void chv_exec_gpio(struct drm_i915_private *dev_priv,
+ 	mutex_lock(&dev_priv->sb_lock);
+ 	vlv_iosf_sb_write(dev_priv, port, cfg1, 0);
+ 	vlv_iosf_sb_write(dev_priv, port, cfg0,
+-			  CHV_GPIO_GPIOCFG_GPO | CHV_GPIO_GPIOTXSTATE(value));
++			  CHV_GPIO_GPIOEN | CHV_GPIO_GPIOCFG_GPO |
++			  CHV_GPIO_GPIOTXSTATE(value));
+ 	mutex_unlock(&dev_priv->sb_lock);
+ }
+ 
+diff --git a/drivers/gpu/drm/i915/intel_runtime_pm.c b/drivers/gpu/drm/i915/intel_runtime_pm.c
+index 1c603bb..07a7cc0 100644
+--- a/drivers/gpu/drm/i915/intel_runtime_pm.c
++++ b/drivers/gpu/drm/i915/intel_runtime_pm.c
+@@ -1062,7 +1062,18 @@ static bool vlv_power_well_enabled(struct drm_i915_private *dev_priv,
+ 
+ static void vlv_init_display_clock_gating(struct drm_i915_private *dev_priv)
+ {
+-	I915_WRITE(DSPCLK_GATE_D, VRHUNIT_CLOCK_GATE_DISABLE);
++	u32 val;
++
++	/*
++	 * On driver load, a pipe may be active and driving a DSI display.
++	 * Preserve DPOUNIT_CLOCK_GATE_DISABLE to avoid the pipe getting stuck
++	 * (and never recovering) in this case. intel_dsi_post_disable() will
++	 * clear it when we turn off the display.
++	 */
++	val = I915_READ(DSPCLK_GATE_D);
++	val &= DPOUNIT_CLOCK_GATE_DISABLE;
++	val |= VRHUNIT_CLOCK_GATE_DISABLE;
++	I915_WRITE(DSPCLK_GATE_D, val);
+ 
+ 	/*
+ 	 * Disable trickle feed and enable pnd deadline calculation
+diff --git a/drivers/gpu/drm/nouveau/nouveau_bios.c b/drivers/gpu/drm/nouveau/nouveau_bios.c
+index a1570b1..23ffe85 100644
+--- a/drivers/gpu/drm/nouveau/nouveau_bios.c
++++ b/drivers/gpu/drm/nouveau/nouveau_bios.c
+@@ -333,6 +333,9 @@ get_fp_strap(struct drm_device *dev, struct nvbios *bios)
+ 	if (bios->major_version < 5 && bios->data[0x48] & 0x4)
+ 		return NVReadVgaCrtc5758(dev, 0, 0xf) & 0xf;
+ 
++	if (drm->device.info.family >= NV_DEVICE_INFO_V0_MAXWELL)
++		return nvif_rd32(device, 0x001800) & 0x0000000f;
++	else
+ 	if (drm->device.info.family >= NV_DEVICE_INFO_V0_TESLA)
+ 		return (nvif_rd32(device, NV_PEXTDEV_BOOT_0) >> 24) & 0xf;
+ 	else
+diff --git a/drivers/gpu/drm/nouveau/nouveau_bo.c b/drivers/gpu/drm/nouveau/nouveau_bo.c
+index 864323b..fad263b 100644
+--- a/drivers/gpu/drm/nouveau/nouveau_bo.c
++++ b/drivers/gpu/drm/nouveau/nouveau_bo.c
+@@ -1209,6 +1209,7 @@ nouveau_bo_move_ntfy(struct ttm_buffer_object *bo, struct ttm_mem_reg *new_mem)
+ 			       nvbo->page_shift != vma->vm->mmu->lpg_shift)) {
+ 			nvkm_vm_map(vma, new_mem->mm_node);
+ 		} else {
++			WARN_ON(ttm_bo_wait(bo, false, false));
+ 			nvkm_vm_unmap(vma);
+ 		}
+ 	}
+diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/device/base.c b/drivers/gpu/drm/nouveau/nvkm/engine/device/base.c
+index 7218a06..e0d7f84 100644
+--- a/drivers/gpu/drm/nouveau/nvkm/engine/device/base.c
++++ b/drivers/gpu/drm/nouveau/nvkm/engine/device/base.c
+@@ -1851,7 +1851,7 @@ nvf1_chipset = {
+ 	.fb = gk104_fb_new,
+ 	.fuse = gf100_fuse_new,
+ 	.gpio = gk104_gpio_new,
+-	.i2c = gf119_i2c_new,
++	.i2c = gk104_i2c_new,
+ 	.ibus = gk104_ibus_new,
+ 	.iccsense = gf100_iccsense_new,
+ 	.imem = nv50_instmem_new,
+@@ -1965,7 +1965,7 @@ nv117_chipset = {
+ 	.fb = gm107_fb_new,
+ 	.fuse = gm107_fuse_new,
+ 	.gpio = gk104_gpio_new,
+-	.i2c = gf119_i2c_new,
++	.i2c = gk104_i2c_new,
+ 	.ibus = gk104_ibus_new,
+ 	.iccsense = gf100_iccsense_new,
+ 	.imem = nv50_instmem_new,
+@@ -1999,7 +1999,7 @@ nv118_chipset = {
+ 	.fb = gm107_fb_new,
+ 	.fuse = gm107_fuse_new,
+ 	.gpio = gk104_gpio_new,
+-	.i2c = gf119_i2c_new,
++	.i2c = gk104_i2c_new,
+ 	.ibus = gk104_ibus_new,
+ 	.iccsense = gf100_iccsense_new,
+ 	.imem = nv50_instmem_new,
+diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/fifo/gpfifogf100.c b/drivers/gpu/drm/nouveau/nvkm/engine/fifo/gpfifogf100.c
+index cbc67f2..12d96426 100644
+--- a/drivers/gpu/drm/nouveau/nvkm/engine/fifo/gpfifogf100.c
++++ b/drivers/gpu/drm/nouveau/nvkm/engine/fifo/gpfifogf100.c
+@@ -60,6 +60,7 @@ gf100_fifo_gpfifo_engine_fini(struct nvkm_fifo_chan *base,
+ 	struct nvkm_gpuobj *inst = chan->base.inst;
+ 	int ret = 0;
+ 
++	mutex_lock(&subdev->mutex);
+ 	nvkm_wr32(device, 0x002634, chan->base.chid);
+ 	if (nvkm_msec(device, 2000,
+ 		if (nvkm_rd32(device, 0x002634) == chan->base.chid)
+@@ -67,10 +68,12 @@ gf100_fifo_gpfifo_engine_fini(struct nvkm_fifo_chan *base,
+ 	) < 0) {
+ 		nvkm_error(subdev, "channel %d [%s] kick timeout\n",
+ 			   chan->base.chid, chan->base.object.client->name);
+-		ret = -EBUSY;
+-		if (suspend)
+-			return ret;
++		ret = -ETIMEDOUT;
+ 	}
++	mutex_unlock(&subdev->mutex);
++
++	if (ret && suspend)
++		return ret;
+ 
+ 	if (offset) {
+ 		nvkm_kmap(inst);
+diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/fifo/gpfifogk104.c b/drivers/gpu/drm/nouveau/nvkm/engine/fifo/gpfifogk104.c
+index ed43510..a2df4f3 100644
+--- a/drivers/gpu/drm/nouveau/nvkm/engine/fifo/gpfifogk104.c
++++ b/drivers/gpu/drm/nouveau/nvkm/engine/fifo/gpfifogk104.c
+@@ -40,7 +40,9 @@ gk104_fifo_gpfifo_kick(struct gk104_fifo_chan *chan)
+ 	struct nvkm_subdev *subdev = &fifo->base.engine.subdev;
+ 	struct nvkm_device *device = subdev->device;
+ 	struct nvkm_client *client = chan->base.object.client;
++	int ret = 0;
+ 
++	mutex_lock(&subdev->mutex);
+ 	nvkm_wr32(device, 0x002634, chan->base.chid);
+ 	if (nvkm_msec(device, 2000,
+ 		if (!(nvkm_rd32(device, 0x002634) & 0x00100000))
+@@ -48,10 +50,10 @@ gk104_fifo_gpfifo_kick(struct gk104_fifo_chan *chan)
+ 	) < 0) {
+ 		nvkm_error(subdev, "channel %d [%s] kick timeout\n",
+ 			   chan->base.chid, client->name);
+-		return -EBUSY;
++		ret = -ETIMEDOUT;
+ 	}
+-
+-	return 0;
++	mutex_unlock(&subdev->mutex);
++	return ret;
+ }
+ 
+ static u32
+diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/gr/gf100.c b/drivers/gpu/drm/nouveau/nvkm/engine/gr/gf100.c
+index 157919c..6584d50 100644
+--- a/drivers/gpu/drm/nouveau/nvkm/engine/gr/gf100.c
++++ b/drivers/gpu/drm/nouveau/nvkm/engine/gr/gf100.c
+@@ -1756,6 +1756,50 @@ gf100_gr_ = {
+ };
+ 
+ int
++gf100_gr_ctor_fw_legacy(struct gf100_gr *gr, const char *fwname,
++			struct gf100_gr_fuc *fuc, int ret)
++{
++	struct nvkm_subdev *subdev = &gr->base.engine.subdev;
++	struct nvkm_device *device = subdev->device;
++	const struct firmware *fw;
++	char f[32];
++
++	/* see if this firmware has a legacy path */
++	if (!strcmp(fwname, "fecs_inst"))
++		fwname = "fuc409c";
++	else if (!strcmp(fwname, "fecs_data"))
++		fwname = "fuc409d";
++	else if (!strcmp(fwname, "gpccs_inst"))
++		fwname = "fuc41ac";
++	else if (!strcmp(fwname, "gpccs_data"))
++		fwname = "fuc41ad";
++	else {
++		/* nope, let's just return the error we got */
++		nvkm_error(subdev, "failed to load %s\n", fwname);
++		return ret;
++	}
++
++	/* yes, try to load from the legacy path */
++	nvkm_debug(subdev, "%s: falling back to legacy path\n", fwname);
++
++	snprintf(f, sizeof(f), "nouveau/nv%02x_%s", device->chipset, fwname);
++	ret = request_firmware(&fw, f, device->dev);
++	if (ret) {
++		snprintf(f, sizeof(f), "nouveau/%s", fwname);
++		ret = request_firmware(&fw, f, device->dev);
++		if (ret) {
++			nvkm_error(subdev, "failed to load %s\n", fwname);
++			return ret;
++		}
++	}
++
++	fuc->size = fw->size;
++	fuc->data = kmemdup(fw->data, fuc->size, GFP_KERNEL);
++	release_firmware(fw);
++	return (fuc->data != NULL) ? 0 : -ENOMEM;
++}
++
++int
+ gf100_gr_ctor_fw(struct gf100_gr *gr, const char *fwname,
+ 		 struct gf100_gr_fuc *fuc)
+ {
+@@ -1765,10 +1809,8 @@ gf100_gr_ctor_fw(struct gf100_gr *gr, const char *fwname,
+ 	int ret;
+ 
+ 	ret = nvkm_firmware_get(device, fwname, &fw);
+-	if (ret) {
+-		nvkm_error(subdev, "failed to load %s\n", fwname);
+-		return ret;
+-	}
++	if (ret)
++		return gf100_gr_ctor_fw_legacy(gr, fwname, fuc, ret);
+ 
+ 	fuc->size = fw->size;
+ 	fuc->data = kmemdup(fw->data, fuc->size, GFP_KERNEL);
+diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/bios/priv.h b/drivers/gpu/drm/nouveau/nvkm/subdev/bios/priv.h
+index 212800e..7d1d3c6 100644
+--- a/drivers/gpu/drm/nouveau/nvkm/subdev/bios/priv.h
++++ b/drivers/gpu/drm/nouveau/nvkm/subdev/bios/priv.h
+@@ -12,6 +12,7 @@ struct nvbios_source {
+ 	bool rw;
+ 	bool ignore_checksum;
+ 	bool no_pcir;
++	bool require_checksum;
+ };
+ 
+ int nvbios_extend(struct nvkm_bios *, u32 length);
+diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/bios/shadow.c b/drivers/gpu/drm/nouveau/nvkm/subdev/bios/shadow.c
+index b2557e8..7deb81b 100644
+--- a/drivers/gpu/drm/nouveau/nvkm/subdev/bios/shadow.c
++++ b/drivers/gpu/drm/nouveau/nvkm/subdev/bios/shadow.c
+@@ -86,9 +86,12 @@ shadow_image(struct nvkm_bios *bios, int idx, u32 offset, struct shadow *mthd)
+ 		    nvbios_checksum(&bios->data[image.base], image.size)) {
+ 			nvkm_debug(subdev, "%08x: checksum failed\n",
+ 				   image.base);
+-			if (mthd->func->rw)
++			if (!mthd->func->require_checksum) {
++				if (mthd->func->rw)
++					score += 1;
+ 				score += 1;
+-			score += 1;
++			} else
++				return 0;
+ 		} else {
+ 			score += 3;
+ 		}
+diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/bios/shadowacpi.c b/drivers/gpu/drm/nouveau/nvkm/subdev/bios/shadowacpi.c
+index 8fecb5f..06572f8 100644
+--- a/drivers/gpu/drm/nouveau/nvkm/subdev/bios/shadowacpi.c
++++ b/drivers/gpu/drm/nouveau/nvkm/subdev/bios/shadowacpi.c
+@@ -99,6 +99,7 @@ nvbios_acpi_fast = {
+ 	.init = acpi_init,
+ 	.read = acpi_read_fast,
+ 	.rw = false,
++	.require_checksum = true,
+ };
+ 
+ const struct nvbios_source
+diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/ltc/base.c b/drivers/gpu/drm/nouveau/nvkm/subdev/ltc/base.c
+index 39c2a38..0c7ef25 100644
+--- a/drivers/gpu/drm/nouveau/nvkm/subdev/ltc/base.c
++++ b/drivers/gpu/drm/nouveau/nvkm/subdev/ltc/base.c
+@@ -47,8 +47,10 @@ nvkm_ltc_tags_clear(struct nvkm_ltc *ltc, u32 first, u32 count)
+ 
+ 	BUG_ON((first > limit) || (limit >= ltc->num_tags));
+ 
++	mutex_lock(&ltc->subdev.mutex);
+ 	ltc->func->cbc_clear(ltc, first, limit);
+ 	ltc->func->cbc_wait(ltc);
++	mutex_unlock(&ltc->subdev.mutex);
+ }
+ 
+ int
+diff --git a/drivers/gpu/drm/radeon/radeon_cursor.c b/drivers/gpu/drm/radeon/radeon_cursor.c
+index 2a10e24..87a7247 100644
+--- a/drivers/gpu/drm/radeon/radeon_cursor.c
++++ b/drivers/gpu/drm/radeon/radeon_cursor.c
+@@ -90,6 +90,9 @@ static void radeon_show_cursor(struct drm_crtc *crtc)
+ 	struct radeon_crtc *radeon_crtc = to_radeon_crtc(crtc);
+ 	struct radeon_device *rdev = crtc->dev->dev_private;
+ 
++	if (radeon_crtc->cursor_out_of_bounds)
++		return;
++
+ 	if (ASIC_IS_DCE4(rdev)) {
+ 		WREG32(EVERGREEN_CUR_SURFACE_ADDRESS_HIGH + radeon_crtc->crtc_offset,
+ 		       upper_32_bits(radeon_crtc->cursor_addr));
+@@ -148,16 +151,17 @@ static int radeon_cursor_move_locked(struct drm_crtc *crtc, int x, int y)
+ 		x += crtc->x;
+ 		y += crtc->y;
+ 	}
+-	DRM_DEBUG("x %d y %d c->x %d c->y %d\n", x, y, crtc->x, crtc->y);
+ 
+-	if (x < 0) {
++	if (x < 0)
+ 		xorigin = min(-x, radeon_crtc->max_cursor_width - 1);
+-		x = 0;
+-	}
+-	if (y < 0) {
++	if (y < 0)
+ 		yorigin = min(-y, radeon_crtc->max_cursor_height - 1);
+-		y = 0;
++
++	if (!ASIC_IS_AVIVO(rdev)) {
++		x += crtc->x;
++		y += crtc->y;
+ 	}
++	DRM_DEBUG("x %d y %d c->x %d c->y %d\n", x, y, crtc->x, crtc->y);
+ 
+ 	/* fixed on DCE6 and newer */
+ 	if (ASIC_IS_AVIVO(rdev) && !ASIC_IS_DCE6(rdev)) {
+@@ -180,27 +184,31 @@ static int radeon_cursor_move_locked(struct drm_crtc *crtc, int x, int y)
+ 		if (i > 1) {
+ 			int cursor_end, frame_end;
+ 
+-			cursor_end = x - xorigin + w;
++			cursor_end = x + w;
+ 			frame_end = crtc->x + crtc->mode.crtc_hdisplay;
+ 			if (cursor_end >= frame_end) {
+ 				w = w - (cursor_end - frame_end);
+ 				if (!(frame_end & 0x7f))
+ 					w--;
+-			} else {
+-				if (!(cursor_end & 0x7f))
+-					w--;
++			} else if (cursor_end <= 0) {
++				goto out_of_bounds;
++			} else if (!(cursor_end & 0x7f)) {
++				w--;
+ 			}
+ 			if (w <= 0) {
+-				w = 1;
+-				cursor_end = x - xorigin + w;
+-				if (!(cursor_end & 0x7f)) {
+-					x--;
+-					WARN_ON_ONCE(x < 0);
+-				}
++				goto out_of_bounds;
+ 			}
+ 		}
+ 	}
+ 
++	if (x <= (crtc->x - w) || y <= (crtc->y - radeon_crtc->cursor_height) ||
++	    x >= (crtc->x + crtc->mode.crtc_hdisplay) ||
++	    y >= (crtc->y + crtc->mode.crtc_vdisplay))
++		goto out_of_bounds;
++
++	x += xorigin;
++	y += yorigin;
++
+ 	if (ASIC_IS_DCE4(rdev)) {
+ 		WREG32(EVERGREEN_CUR_POSITION + radeon_crtc->crtc_offset, (x << 16) | y);
+ 		WREG32(EVERGREEN_CUR_HOT_SPOT + radeon_crtc->crtc_offset, (xorigin << 16) | yorigin);
+@@ -212,6 +220,9 @@ static int radeon_cursor_move_locked(struct drm_crtc *crtc, int x, int y)
+ 		WREG32(AVIVO_D1CUR_SIZE + radeon_crtc->crtc_offset,
+ 		       ((w - 1) << 16) | (radeon_crtc->cursor_height - 1));
+ 	} else {
++		x -= crtc->x;
++		y -= crtc->y;
++
+ 		if (crtc->mode.flags & DRM_MODE_FLAG_DBLSCAN)
+ 			y *= 2;
+ 
+@@ -232,6 +243,19 @@ static int radeon_cursor_move_locked(struct drm_crtc *crtc, int x, int y)
+ 	radeon_crtc->cursor_x = x;
+ 	radeon_crtc->cursor_y = y;
+ 
++	if (radeon_crtc->cursor_out_of_bounds) {
++		radeon_crtc->cursor_out_of_bounds = false;
++		if (radeon_crtc->cursor_bo)
++			radeon_show_cursor(crtc);
++	}
++
++	return 0;
++
++ out_of_bounds:
++	if (!radeon_crtc->cursor_out_of_bounds) {
++		radeon_hide_cursor(crtc);
++		radeon_crtc->cursor_out_of_bounds = true;
++	}
+ 	return 0;
+ }
+ 
+@@ -297,22 +321,23 @@ int radeon_crtc_cursor_set2(struct drm_crtc *crtc,
+ 		return ret;
+ 	}
+ 
+-	radeon_crtc->cursor_width = width;
+-	radeon_crtc->cursor_height = height;
+-
+ 	radeon_lock_cursor(crtc, true);
+ 
+-	if (hot_x != radeon_crtc->cursor_hot_x ||
++	if (width != radeon_crtc->cursor_width ||
++	    height != radeon_crtc->cursor_height ||
++	    hot_x != radeon_crtc->cursor_hot_x ||
+ 	    hot_y != radeon_crtc->cursor_hot_y) {
+ 		int x, y;
+ 
+ 		x = radeon_crtc->cursor_x + radeon_crtc->cursor_hot_x - hot_x;
+ 		y = radeon_crtc->cursor_y + radeon_crtc->cursor_hot_y - hot_y;
+ 
+-		radeon_cursor_move_locked(crtc, x, y);
+-
++		radeon_crtc->cursor_width = width;
++		radeon_crtc->cursor_height = height;
+ 		radeon_crtc->cursor_hot_x = hot_x;
+ 		radeon_crtc->cursor_hot_y = hot_y;
++
++		radeon_cursor_move_locked(crtc, x, y);
+ 	}
+ 
+ 	radeon_show_cursor(crtc);
+diff --git a/drivers/gpu/drm/radeon/radeon_mode.h b/drivers/gpu/drm/radeon/radeon_mode.h
+index bb75201a..f1da484 100644
+--- a/drivers/gpu/drm/radeon/radeon_mode.h
++++ b/drivers/gpu/drm/radeon/radeon_mode.h
+@@ -330,6 +330,7 @@ struct radeon_crtc {
+ 	u16 lut_r[256], lut_g[256], lut_b[256];
+ 	bool enabled;
+ 	bool can_tile;
++	bool cursor_out_of_bounds;
+ 	uint32_t crtc_offset;
+ 	struct drm_gem_object *cursor_bo;
+ 	uint64_t cursor_addr;
+diff --git a/drivers/gpu/drm/radeon/si.c b/drivers/gpu/drm/radeon/si.c
+index 2523ca9..2297ec7 100644
+--- a/drivers/gpu/drm/radeon/si.c
++++ b/drivers/gpu/drm/radeon/si.c
+@@ -1722,6 +1722,7 @@ static int si_init_microcode(struct radeon_device *rdev)
+ 		    (rdev->pdev->revision == 0x80) ||
+ 		    (rdev->pdev->revision == 0x81) ||
+ 		    (rdev->pdev->revision == 0x83) ||
++		    (rdev->pdev->revision == 0x87) ||
+ 		    (rdev->pdev->device == 0x6604) ||
+ 		    (rdev->pdev->device == 0x6605))
+ 			new_smc = true;
+diff --git a/drivers/gpu/drm/radeon/si_dpm.c b/drivers/gpu/drm/radeon/si_dpm.c
+index c4993452..8b5e697 100644
+--- a/drivers/gpu/drm/radeon/si_dpm.c
++++ b/drivers/gpu/drm/radeon/si_dpm.c
+@@ -3026,6 +3026,7 @@ static void si_apply_state_adjust_rules(struct radeon_device *rdev,
+ 		    (rdev->pdev->revision == 0x80) ||
+ 		    (rdev->pdev->revision == 0x81) ||
+ 		    (rdev->pdev->revision == 0x83) ||
++		    (rdev->pdev->revision == 0x87) ||
+ 		    (rdev->pdev->device == 0x6604) ||
+ 		    (rdev->pdev->device == 0x6605)) {
+ 			max_sclk = 75000;
+diff --git a/drivers/hv/channel_mgmt.c b/drivers/hv/channel_mgmt.c
+index b6c1211..0450852 100644
+--- a/drivers/hv/channel_mgmt.c
++++ b/drivers/hv/channel_mgmt.c
+@@ -348,6 +348,7 @@ void vmbus_free_channels(void)
+ {
+ 	struct vmbus_channel *channel, *tmp;
+ 
++	mutex_lock(&vmbus_connection.channel_mutex);
+ 	list_for_each_entry_safe(channel, tmp, &vmbus_connection.chn_list,
+ 		listentry) {
+ 		/* hv_process_channel_removal() needs this */
+@@ -355,6 +356,7 @@ void vmbus_free_channels(void)
+ 
+ 		vmbus_device_unregister(channel->device_obj);
+ 	}
++	mutex_unlock(&vmbus_connection.channel_mutex);
+ }
+ 
+ /*
+diff --git a/drivers/hwtracing/stm/core.c b/drivers/hwtracing/stm/core.c
+index 51f81d6..a6ea387 100644
+--- a/drivers/hwtracing/stm/core.c
++++ b/drivers/hwtracing/stm/core.c
+@@ -361,7 +361,7 @@ static int stm_char_open(struct inode *inode, struct file *file)
+ 	struct stm_file *stmf;
+ 	struct device *dev;
+ 	unsigned int major = imajor(inode);
+-	int err = -ENODEV;
++	int err = -ENOMEM;
+ 
+ 	dev = class_find_device(&stm_class, NULL, &major, major_match);
+ 	if (!dev)
+@@ -369,8 +369,9 @@ static int stm_char_open(struct inode *inode, struct file *file)
+ 
+ 	stmf = kzalloc(sizeof(*stmf), GFP_KERNEL);
+ 	if (!stmf)
+-		return -ENOMEM;
++		goto err_put_device;
+ 
++	err = -ENODEV;
+ 	stm_output_init(&stmf->output);
+ 	stmf->stm = to_stm_device(dev);
+ 
+@@ -382,9 +383,10 @@ static int stm_char_open(struct inode *inode, struct file *file)
+ 	return nonseekable_open(inode, file);
+ 
+ err_free:
++	kfree(stmf);
++err_put_device:
+ 	/* matches class_find_device() above */
+ 	put_device(dev);
+-	kfree(stmf);
+ 
+ 	return err;
+ }
+diff --git a/drivers/infiniband/core/mad.c b/drivers/infiniband/core/mad.c
+index 2d49228..85b2bfe 100644
+--- a/drivers/infiniband/core/mad.c
++++ b/drivers/infiniband/core/mad.c
+@@ -1746,7 +1746,7 @@ find_mad_agent(struct ib_mad_port_private *port_priv,
+ 			if (!class)
+ 				goto out;
+ 			if (convert_mgmt_class(mad_hdr->mgmt_class) >=
+-			    IB_MGMT_MAX_METHODS)
++			    ARRAY_SIZE(class->method_table))
+ 				goto out;
+ 			method = class->method_table[convert_mgmt_class(
+ 							mad_hdr->mgmt_class)];
+diff --git a/drivers/infiniband/core/multicast.c b/drivers/infiniband/core/multicast.c
+index 51c79b2..45523cf 100644
+--- a/drivers/infiniband/core/multicast.c
++++ b/drivers/infiniband/core/multicast.c
+@@ -518,8 +518,11 @@ static void join_handler(int status, struct ib_sa_mcmember_rec *rec,
+ 		process_join_error(group, status);
+ 	else {
+ 		int mgids_changed, is_mgid0;
+-		ib_find_pkey(group->port->dev->device, group->port->port_num,
+-			     be16_to_cpu(rec->pkey), &pkey_index);
++
++		if (ib_find_pkey(group->port->dev->device,
++				 group->port->port_num, be16_to_cpu(rec->pkey),
++				 &pkey_index))
++			pkey_index = MCAST_INVALID_PKEY_INDEX;
+ 
+ 		spin_lock_irq(&group->port->lock);
+ 		if (group->state == MCAST_BUSY &&
+diff --git a/drivers/infiniband/hw/i40iw/i40iw_verbs.c b/drivers/infiniband/hw/i40iw/i40iw_verbs.c
+index 6329c97..4b892ca 100644
+--- a/drivers/infiniband/hw/i40iw/i40iw_verbs.c
++++ b/drivers/infiniband/hw/i40iw/i40iw_verbs.c
+@@ -2501,7 +2501,7 @@ static int i40iw_get_hw_stats(struct ib_device *ibdev,
+ 			return -ENOSYS;
+ 	}
+ 
+-	memcpy(&stats->value[0], &hw_stats, sizeof(*hw_stats));
++	memcpy(&stats->value[0], hw_stats, sizeof(*hw_stats));
+ 
+ 	return stats->num_counters;
+ }
+diff --git a/drivers/infiniband/sw/rxe/rxe_qp.c b/drivers/infiniband/sw/rxe/rxe_qp.c
+index f724a7e..979e445 100644
+--- a/drivers/infiniband/sw/rxe/rxe_qp.c
++++ b/drivers/infiniband/sw/rxe/rxe_qp.c
+@@ -850,4 +850,5 @@ void rxe_qp_cleanup(void *arg)
+ 	free_rd_atomic_resources(qp);
+ 
+ 	kernel_sock_shutdown(qp->sk, SHUT_RDWR);
++	sock_release(qp->sk);
+ }
+diff --git a/drivers/infiniband/ulp/ipoib/ipoib_multicast.c b/drivers/infiniband/ulp/ipoib/ipoib_multicast.c
+index 1909dd2..fddff40 100644
+--- a/drivers/infiniband/ulp/ipoib/ipoib_multicast.c
++++ b/drivers/infiniband/ulp/ipoib/ipoib_multicast.c
+@@ -575,8 +575,11 @@ void ipoib_mcast_join_task(struct work_struct *work)
+ 	if (!test_bit(IPOIB_FLAG_OPER_UP, &priv->flags))
+ 		return;
+ 
+-	if (ib_query_port(priv->ca, priv->port, &port_attr) ||
+-	    port_attr.state != IB_PORT_ACTIVE) {
++	if (ib_query_port(priv->ca, priv->port, &port_attr)) {
++		ipoib_dbg(priv, "ib_query_port() failed\n");
++		return;
++	}
++	if (port_attr.state != IB_PORT_ACTIVE) {
+ 		ipoib_dbg(priv, "port state is not ACTIVE (state = %d) suspending join task\n",
+ 			  port_attr.state);
+ 		return;
+diff --git a/drivers/input/misc/drv260x.c b/drivers/input/misc/drv260x.c
+index 2adfd86c..930424e 100644
+--- a/drivers/input/misc/drv260x.c
++++ b/drivers/input/misc/drv260x.c
+@@ -592,7 +592,6 @@ static int drv260x_probe(struct i2c_client *client,
+ 	}
+ 
+ 	haptics->input_dev->name = "drv260x:haptics";
+-	haptics->input_dev->dev.parent = client->dev.parent;
+ 	haptics->input_dev->close = drv260x_close;
+ 	input_set_drvdata(haptics->input_dev, haptics);
+ 	input_set_capability(haptics->input_dev, EV_FF, FF_RUMBLE);
+diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
+index ee7fc37..a87549b 100644
+--- a/drivers/md/raid5.c
++++ b/drivers/md/raid5.c
+@@ -7017,6 +7017,15 @@ static int raid5_run(struct mddev *mddev)
+ 			stripe = (stripe | (stripe-1)) + 1;
+ 		mddev->queue->limits.discard_alignment = stripe;
+ 		mddev->queue->limits.discard_granularity = stripe;
++
++		/*
++		 * We use 16-bit counter of active stripes in bi_phys_segments
++		 * (minus one for over-loaded initialization)
++		 */
++		blk_queue_max_hw_sectors(mddev->queue, 0xfffe * STRIPE_SECTORS);
++		blk_queue_max_discard_sectors(mddev->queue,
++					      0xfffe * STRIPE_SECTORS);
++
+ 		/*
+ 		 * unaligned part of discard request will be ignored, so can't
+ 		 * guarantee discard_zeroes_data
+diff --git a/drivers/media/dvb-frontends/mn88472.c b/drivers/media/dvb-frontends/mn88472.c
+index 18fb2df..7265011 100644
+--- a/drivers/media/dvb-frontends/mn88472.c
++++ b/drivers/media/dvb-frontends/mn88472.c
+@@ -488,18 +488,6 @@ static int mn88472_probe(struct i2c_client *client,
+ 		goto err_kfree;
+ 	}
+ 
+-	/* Check demod answers with correct chip id */
+-	ret = regmap_read(dev->regmap[0], 0xff, &utmp);
+-	if (ret)
+-		goto err_regmap_0_regmap_exit;
+-
+-	dev_dbg(&client->dev, "chip id=%02x\n", utmp);
+-
+-	if (utmp != 0x02) {
+-		ret = -ENODEV;
+-		goto err_regmap_0_regmap_exit;
+-	}
+-
+ 	/*
+ 	 * Chip has three I2C addresses for different register banks. Used
+ 	 * addresses are 0x18, 0x1a and 0x1c. We register two dummy clients,
+@@ -536,6 +524,18 @@ static int mn88472_probe(struct i2c_client *client,
+ 	}
+ 	i2c_set_clientdata(dev->client[2], dev);
+ 
++	/* Check demod answers with correct chip id */
++	ret = regmap_read(dev->regmap[2], 0xff, &utmp);
++	if (ret)
++		goto err_regmap_2_regmap_exit;
++
++	dev_dbg(&client->dev, "chip id=%02x\n", utmp);
++
++	if (utmp != 0x02) {
++		ret = -ENODEV;
++		goto err_regmap_2_regmap_exit;
++	}
++
+ 	/* Sleep because chip is active by default */
+ 	ret = regmap_write(dev->regmap[2], 0x05, 0x3e);
+ 	if (ret)
+diff --git a/drivers/media/dvb-frontends/mn88473.c b/drivers/media/dvb-frontends/mn88473.c
+index 451974a..2932bdc 100644
+--- a/drivers/media/dvb-frontends/mn88473.c
++++ b/drivers/media/dvb-frontends/mn88473.c
+@@ -485,18 +485,6 @@ static int mn88473_probe(struct i2c_client *client,
+ 		goto err_kfree;
+ 	}
+ 
+-	/* Check demod answers with correct chip id */
+-	ret = regmap_read(dev->regmap[0], 0xff, &uitmp);
+-	if (ret)
+-		goto err_regmap_0_regmap_exit;
+-
+-	dev_dbg(&client->dev, "chip id=%02x\n", uitmp);
+-
+-	if (uitmp != 0x03) {
+-		ret = -ENODEV;
+-		goto err_regmap_0_regmap_exit;
+-	}
+-
+ 	/*
+ 	 * Chip has three I2C addresses for different register banks. Used
+ 	 * addresses are 0x18, 0x1a and 0x1c. We register two dummy clients,
+@@ -533,6 +521,18 @@ static int mn88473_probe(struct i2c_client *client,
+ 	}
+ 	i2c_set_clientdata(dev->client[2], dev);
+ 
++	/* Check demod answers with correct chip id */
++	ret = regmap_read(dev->regmap[2], 0xff, &uitmp);
++	if (ret)
++		goto err_regmap_2_regmap_exit;
++
++	dev_dbg(&client->dev, "chip id=%02x\n", uitmp);
++
++	if (uitmp != 0x03) {
++		ret = -ENODEV;
++		goto err_regmap_2_regmap_exit;
++	}
++
+ 	/* Sleep because chip is active by default */
+ 	ret = regmap_write(dev->regmap[2], 0x05, 0x3e);
+ 	if (ret)
+diff --git a/drivers/media/i2c/tvp5150.c b/drivers/media/i2c/tvp5150.c
+index 0b6d46c..02a8f51 100644
+--- a/drivers/media/i2c/tvp5150.c
++++ b/drivers/media/i2c/tvp5150.c
+@@ -815,6 +815,7 @@ static int tvp5150_s_ctrl(struct v4l2_ctrl *ctrl)
+ 		return 0;
+ 	case V4L2_CID_HUE:
+ 		tvp5150_write(sd, TVP5150_HUE_CTL, ctrl->val);
++		break;
+ 	case V4L2_CID_TEST_PATTERN:
+ 		decoder->enable = ctrl->val ? false : true;
+ 		tvp5150_selmux(sd);
+diff --git a/drivers/media/pci/solo6x10/solo6x10.h b/drivers/media/pci/solo6x10/solo6x10.h
+index 5bd4987..3f8da5e 100644
+--- a/drivers/media/pci/solo6x10/solo6x10.h
++++ b/drivers/media/pci/solo6x10/solo6x10.h
+@@ -284,7 +284,10 @@ static inline u32 solo_reg_read(struct solo_dev *solo_dev, int reg)
+ static inline void solo_reg_write(struct solo_dev *solo_dev, int reg,
+ 				  u32 data)
+ {
++	u16 val;
++
+ 	writel(data, solo_dev->reg_base + reg);
++	pci_read_config_word(solo_dev->pdev, PCI_STATUS, &val);
+ }
+ 
+ static inline void solo_irq_on(struct solo_dev *dev, u32 mask)
+diff --git a/drivers/media/platform/s5p-mfc/s5p_mfc.c b/drivers/media/platform/s5p-mfc/s5p_mfc.c
+index e3f104f..9e88c2f 100644
+--- a/drivers/media/platform/s5p-mfc/s5p_mfc.c
++++ b/drivers/media/platform/s5p-mfc/s5p_mfc.c
+@@ -1073,6 +1073,7 @@ static struct device *s5p_mfc_alloc_memdev(struct device *dev,
+ 							 idx);
+ 		if (ret == 0)
+ 			return child;
++		device_del(child);
+ 	}
+ 
+ 	put_device(child);
+diff --git a/drivers/misc/mei/client.c b/drivers/misc/mei/client.c
+index 641c1a5..75be3d5 100644
+--- a/drivers/misc/mei/client.c
++++ b/drivers/misc/mei/client.c
+@@ -675,7 +675,7 @@ void mei_host_client_init(struct mei_device *dev)
+ 
+ 	pm_runtime_mark_last_busy(dev->dev);
+ 	dev_dbg(dev->dev, "rpm: autosuspend\n");
+-	pm_runtime_autosuspend(dev->dev);
++	pm_request_autosuspend(dev->dev);
+ }
+ 
+ /**
+diff --git a/drivers/misc/mei/hw-me-regs.h b/drivers/misc/mei/hw-me-regs.h
+index 7ad15d6..c8307e8 100644
+--- a/drivers/misc/mei/hw-me-regs.h
++++ b/drivers/misc/mei/hw-me-regs.h
+@@ -122,6 +122,8 @@
+ #define MEI_DEV_ID_SPT_H      0xA13A  /* Sunrise Point H */
+ #define MEI_DEV_ID_SPT_H_2    0xA13B  /* Sunrise Point H 2 */
+ 
++#define MEI_DEV_ID_LBG        0xA1BA  /* Lewisburg (SPT) */
++
+ #define MEI_DEV_ID_BXT_M      0x1A9A  /* Broxton M */
+ #define MEI_DEV_ID_APL_I      0x5A9A  /* Apollo Lake I */
+ 
+diff --git a/drivers/misc/mei/pci-me.c b/drivers/misc/mei/pci-me.c
+index 5eb9b75..69fca9b 100644
+--- a/drivers/misc/mei/pci-me.c
++++ b/drivers/misc/mei/pci-me.c
+@@ -87,6 +87,7 @@ static const struct pci_device_id mei_me_pci_tbl[] = {
+ 	{MEI_PCI_DEVICE(MEI_DEV_ID_SPT_2, mei_me_pch8_cfg)},
+ 	{MEI_PCI_DEVICE(MEI_DEV_ID_SPT_H, mei_me_pch8_sps_cfg)},
+ 	{MEI_PCI_DEVICE(MEI_DEV_ID_SPT_H_2, mei_me_pch8_sps_cfg)},
++	{MEI_PCI_DEVICE(MEI_DEV_ID_LBG, mei_me_pch8_cfg)},
+ 
+ 	{MEI_PCI_DEVICE(MEI_DEV_ID_BXT_M, mei_me_pch8_cfg)},
+ 	{MEI_PCI_DEVICE(MEI_DEV_ID_APL_I, mei_me_pch8_cfg)},
+diff --git a/drivers/mmc/host/sdhci.c b/drivers/mmc/host/sdhci.c
+index 6eb8f07..1f6205c 100644
+--- a/drivers/mmc/host/sdhci.c
++++ b/drivers/mmc/host/sdhci.c
+@@ -2074,7 +2074,27 @@ static int sdhci_execute_tuning(struct mmc_host *mmc, u32 opcode)
+ 			ctrl &= ~SDHCI_CTRL_EXEC_TUNING;
+ 			sdhci_writew(host, ctrl, SDHCI_HOST_CONTROL2);
+ 
++			sdhci_do_reset(host, SDHCI_RESET_CMD);
++			sdhci_do_reset(host, SDHCI_RESET_DATA);
++
+ 			err = -EIO;
++
++			if (cmd.opcode != MMC_SEND_TUNING_BLOCK_HS200)
++				goto out;
++
++			sdhci_writel(host, host->ier, SDHCI_INT_ENABLE);
++			sdhci_writel(host, host->ier, SDHCI_SIGNAL_ENABLE);
++
++			spin_unlock_irqrestore(&host->lock, flags);
++
++			memset(&cmd, 0, sizeof(cmd));
++			cmd.opcode = MMC_STOP_TRANSMISSION;
++			cmd.flags = MMC_RSP_SPI_R1B | MMC_RSP_R1B | MMC_CMD_AC;
++			cmd.busy_timeout = 50;
++			mmc_wait_for_cmd(mmc, &cmd, 0);
++
++			spin_lock_irqsave(&host->lock, flags);
++
+ 			goto out;
+ 		}
+ 
+diff --git a/drivers/net/ethernet/marvell/mvpp2.c b/drivers/net/ethernet/marvell/mvpp2.c
+index 60227a3..5588c56 100644
+--- a/drivers/net/ethernet/marvell/mvpp2.c
++++ b/drivers/net/ethernet/marvell/mvpp2.c
+@@ -770,6 +770,17 @@ struct mvpp2_rx_desc {
+ 	u32 reserved8;
+ };
+ 
++struct mvpp2_txq_pcpu_buf {
++	/* Transmitted SKB */
++	struct sk_buff *skb;
++
++	/* Physical address of transmitted buffer */
++	dma_addr_t phys;
++
++	/* Size transmitted */
++	size_t size;
++};
++
+ /* Per-CPU Tx queue control */
+ struct mvpp2_txq_pcpu {
+ 	int cpu;
+@@ -785,11 +796,8 @@ struct mvpp2_txq_pcpu {
+ 	/* Number of Tx DMA descriptors reserved for each CPU */
+ 	int reserved_num;
+ 
+-	/* Array of transmitted skb */
+-	struct sk_buff **tx_skb;
+-
+-	/* Array of transmitted buffers' physical addresses */
+-	dma_addr_t *tx_buffs;
++	/* Infos about transmitted buffers */
++	struct mvpp2_txq_pcpu_buf *buffs;
+ 
+ 	/* Index of last TX DMA descriptor that was inserted */
+ 	int txq_put_index;
+@@ -979,10 +987,11 @@ static void mvpp2_txq_inc_put(struct mvpp2_txq_pcpu *txq_pcpu,
+ 			      struct sk_buff *skb,
+ 			      struct mvpp2_tx_desc *tx_desc)
+ {
+-	txq_pcpu->tx_skb[txq_pcpu->txq_put_index] = skb;
+-	if (skb)
+-		txq_pcpu->tx_buffs[txq_pcpu->txq_put_index] =
+-							 tx_desc->buf_phys_addr;
++	struct mvpp2_txq_pcpu_buf *tx_buf =
++		txq_pcpu->buffs + txq_pcpu->txq_put_index;
++	tx_buf->skb = skb;
++	tx_buf->size = tx_desc->data_size;
++	tx_buf->phys = tx_desc->buf_phys_addr;
+ 	txq_pcpu->txq_put_index++;
+ 	if (txq_pcpu->txq_put_index == txq_pcpu->size)
+ 		txq_pcpu->txq_put_index = 0;
+@@ -4401,17 +4410,16 @@ static void mvpp2_txq_bufs_free(struct mvpp2_port *port,
+ 	int i;
+ 
+ 	for (i = 0; i < num; i++) {
+-		dma_addr_t buf_phys_addr =
+-				    txq_pcpu->tx_buffs[txq_pcpu->txq_get_index];
+-		struct sk_buff *skb = txq_pcpu->tx_skb[txq_pcpu->txq_get_index];
++		struct mvpp2_txq_pcpu_buf *tx_buf =
++			txq_pcpu->buffs + txq_pcpu->txq_get_index;
+ 
+ 		mvpp2_txq_inc_get(txq_pcpu);
+ 
+-		dma_unmap_single(port->dev->dev.parent, buf_phys_addr,
+-				 skb_headlen(skb), DMA_TO_DEVICE);
+-		if (!skb)
++		dma_unmap_single(port->dev->dev.parent, tx_buf->phys,
++				 tx_buf->size, DMA_TO_DEVICE);
++		if (!tx_buf->skb)
+ 			continue;
+-		dev_kfree_skb_any(skb);
++		dev_kfree_skb_any(tx_buf->skb);
+ 	}
+ }
+ 
+@@ -4651,15 +4659,10 @@ static int mvpp2_txq_init(struct mvpp2_port *port,
+ 	for_each_present_cpu(cpu) {
+ 		txq_pcpu = per_cpu_ptr(txq->pcpu, cpu);
+ 		txq_pcpu->size = txq->size;
+-		txq_pcpu->tx_skb = kmalloc(txq_pcpu->size *
+-					   sizeof(*txq_pcpu->tx_skb),
+-					   GFP_KERNEL);
+-		if (!txq_pcpu->tx_skb)
+-			goto error;
+-
+-		txq_pcpu->tx_buffs = kmalloc(txq_pcpu->size *
+-					     sizeof(dma_addr_t), GFP_KERNEL);
+-		if (!txq_pcpu->tx_buffs)
++		txq_pcpu->buffs = kmalloc(txq_pcpu->size *
++					  sizeof(struct mvpp2_txq_pcpu_buf),
++					  GFP_KERNEL);
++		if (!txq_pcpu->buffs)
+ 			goto error;
+ 
+ 		txq_pcpu->count = 0;
+@@ -4673,8 +4676,7 @@ static int mvpp2_txq_init(struct mvpp2_port *port,
+ error:
+ 	for_each_present_cpu(cpu) {
+ 		txq_pcpu = per_cpu_ptr(txq->pcpu, cpu);
+-		kfree(txq_pcpu->tx_skb);
+-		kfree(txq_pcpu->tx_buffs);
++		kfree(txq_pcpu->buffs);
+ 	}
+ 
+ 	dma_free_coherent(port->dev->dev.parent,
+@@ -4693,8 +4695,7 @@ static void mvpp2_txq_deinit(struct mvpp2_port *port,
+ 
+ 	for_each_present_cpu(cpu) {
+ 		txq_pcpu = per_cpu_ptr(txq->pcpu, cpu);
+-		kfree(txq_pcpu->tx_skb);
+-		kfree(txq_pcpu->tx_buffs);
++		kfree(txq_pcpu->buffs);
+ 	}
+ 
+ 	if (txq->descs)
+diff --git a/drivers/net/wireless/ath/ath9k/hw.c b/drivers/net/wireless/ath/ath9k/hw.c
+index 14b13f0..a35f78b 100644
+--- a/drivers/net/wireless/ath/ath9k/hw.c
++++ b/drivers/net/wireless/ath/ath9k/hw.c
+@@ -2792,7 +2792,7 @@ u32 ath9k_hw_gpio_get(struct ath_hw *ah, u32 gpio)
+ 		WARN_ON(1);
+ 	}
+ 
+-	return val;
++	return !!val;
+ }
+ EXPORT_SYMBOL(ath9k_hw_gpio_get);
+ 
+diff --git a/drivers/net/wireless/ath/ath9k/pci.c b/drivers/net/wireless/ath/ath9k/pci.c
+index 0dd454a..aff473d 100644
+--- a/drivers/net/wireless/ath/ath9k/pci.c
++++ b/drivers/net/wireless/ath/ath9k/pci.c
+@@ -26,7 +26,6 @@ static const struct pci_device_id ath_pci_id_table[] = {
+ 	{ PCI_VDEVICE(ATHEROS, 0x0023) }, /* PCI   */
+ 	{ PCI_VDEVICE(ATHEROS, 0x0024) }, /* PCI-E */
+ 	{ PCI_VDEVICE(ATHEROS, 0x0027) }, /* PCI   */
+-	{ PCI_VDEVICE(ATHEROS, 0x0029) }, /* PCI   */
+ 
+ #ifdef CONFIG_ATH9K_PCOEM
+ 	/* Mini PCI AR9220 MB92 cards: Compex WLM200NX, Wistron DNMA-92 */
+@@ -37,7 +36,7 @@ static const struct pci_device_id ath_pci_id_table[] = {
+ 	  .driver_data = ATH9K_PCI_LED_ACT_HI },
+ #endif
+ 
+-	{ PCI_VDEVICE(ATHEROS, 0x002A) }, /* PCI-E */
++	{ PCI_VDEVICE(ATHEROS, 0x0029) }, /* PCI   */
+ 
+ #ifdef CONFIG_ATH9K_PCOEM
+ 	{ PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+@@ -85,7 +84,11 @@ static const struct pci_device_id ath_pci_id_table[] = {
+ 			 0x10CF, /* Fujitsu */
+ 			 0x1536),
+ 	  .driver_data = ATH9K_PCI_D3_L1_WAR },
++#endif
+ 
++	{ PCI_VDEVICE(ATHEROS, 0x002A) }, /* PCI-E */
++
++#ifdef CONFIG_ATH9K_PCOEM
+ 	/* AR9285 card for Asus */
+ 	{ PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+ 			 0x002B,
+diff --git a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c
+index c6b246a..4b78079 100644
+--- a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c
++++ b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c
+@@ -4401,6 +4401,13 @@ void rtl8xxxu_gen1_report_connect(struct rtl8xxxu_priv *priv,
+ void rtl8xxxu_gen2_report_connect(struct rtl8xxxu_priv *priv,
+ 				  u8 macid, bool connect)
+ {
++#ifdef RTL8XXXU_GEN2_REPORT_CONNECT
++	/*
++	 * Barry Day reports this causes issues with 8192eu and 8723bu
++	 * devices reconnecting. The reason for this is unclear, but
++	 * until it is better understood, leave the code in place but
++	 * disabled, so it is not lost.
++	 */
+ 	struct h2c_cmd h2c;
+ 
+ 	memset(&h2c, 0, sizeof(struct h2c_cmd));
+@@ -4412,6 +4419,7 @@ void rtl8xxxu_gen2_report_connect(struct rtl8xxxu_priv *priv,
+ 		h2c.media_status_rpt.parm &= ~BIT(0);
+ 
+ 	rtl8xxxu_gen2_h2c_cmd(priv, &h2c, sizeof(h2c.media_status_rpt));
++#endif
+ }
+ 
+ void rtl8xxxu_gen1_init_aggregation(struct rtl8xxxu_priv *priv)
+diff --git a/drivers/net/wireless/realtek/rtlwifi/base.c b/drivers/net/wireless/realtek/rtlwifi/base.c
+index 264466f..4ac928b 100644
+--- a/drivers/net/wireless/realtek/rtlwifi/base.c
++++ b/drivers/net/wireless/realtek/rtlwifi/base.c
+@@ -1303,12 +1303,13 @@ EXPORT_SYMBOL_GPL(rtl_action_proc);
+ 
+ static void setup_arp_tx(struct rtl_priv *rtlpriv, struct rtl_ps_ctl *ppsc)
+ {
++	struct ieee80211_hw *hw = rtlpriv->hw;
++
+ 	rtlpriv->ra.is_special_data = true;
+ 	if (rtlpriv->cfg->ops->get_btc_status())
+ 		rtlpriv->btcoexist.btc_ops->btc_special_packet_notify(
+ 					rtlpriv, 1);
+-	rtlpriv->enter_ps = false;
+-	schedule_work(&rtlpriv->works.lps_change_work);
++	rtl_lps_leave(hw);
+ 	ppsc->last_delaylps_stamp_jiffies = jiffies;
+ }
+ 
+@@ -1381,8 +1382,7 @@ u8 rtl_is_special_data(struct ieee80211_hw *hw, struct sk_buff *skb, u8 is_tx,
+ 
+ 		if (is_tx) {
+ 			rtlpriv->ra.is_special_data = true;
+-			rtlpriv->enter_ps = false;
+-			schedule_work(&rtlpriv->works.lps_change_work);
++			rtl_lps_leave(hw);
+ 			ppsc->last_delaylps_stamp_jiffies = jiffies;
+ 		}
+ 
+diff --git a/drivers/net/wireless/realtek/rtlwifi/core.c b/drivers/net/wireless/realtek/rtlwifi/core.c
+index 41f77f8..8f783ef 100644
+--- a/drivers/net/wireless/realtek/rtlwifi/core.c
++++ b/drivers/net/wireless/realtek/rtlwifi/core.c
+@@ -1149,10 +1149,8 @@ static void rtl_op_bss_info_changed(struct ieee80211_hw *hw,
+ 		} else {
+ 			mstatus = RT_MEDIA_DISCONNECT;
+ 
+-			if (mac->link_state == MAC80211_LINKED) {
+-				rtlpriv->enter_ps = false;
+-				schedule_work(&rtlpriv->works.lps_change_work);
+-			}
++			if (mac->link_state == MAC80211_LINKED)
++				rtl_lps_leave(hw);
+ 			if (ppsc->p2p_ps_info.p2p_ps_mode > P2P_PS_NONE)
+ 				rtl_p2p_ps_cmd(hw, P2P_PS_DISABLE);
+ 			mac->link_state = MAC80211_NOLINK;
+@@ -1430,8 +1428,7 @@ static void rtl_op_sw_scan_start(struct ieee80211_hw *hw,
+ 	}
+ 
+ 	if (mac->link_state == MAC80211_LINKED) {
+-		rtlpriv->enter_ps = false;
+-		schedule_work(&rtlpriv->works.lps_change_work);
++		rtl_lps_leave(hw);
+ 		mac->link_state = MAC80211_LINKED_SCANNING;
+ 	} else {
+ 		rtl_ips_nic_on(hw);
+diff --git a/drivers/net/wireless/realtek/rtlwifi/pci.c b/drivers/net/wireless/realtek/rtlwifi/pci.c
+index d12586d..e538e23 100644
+--- a/drivers/net/wireless/realtek/rtlwifi/pci.c
++++ b/drivers/net/wireless/realtek/rtlwifi/pci.c
+@@ -662,11 +662,9 @@ static void _rtl_pci_tx_isr(struct ieee80211_hw *hw, int prio)
+ 	}
+ 
+ 	if (((rtlpriv->link_info.num_rx_inperiod +
+-		rtlpriv->link_info.num_tx_inperiod) > 8) ||
+-		(rtlpriv->link_info.num_rx_inperiod > 2)) {
+-		rtlpriv->enter_ps = false;
+-		schedule_work(&rtlpriv->works.lps_change_work);
+-	}
++	      rtlpriv->link_info.num_tx_inperiod) > 8) ||
++	      (rtlpriv->link_info.num_rx_inperiod > 2))
++		rtl_lps_leave(hw);
+ }
+ 
+ static int _rtl_pci_init_one_rxdesc(struct ieee80211_hw *hw,
+@@ -917,10 +915,8 @@ static void _rtl_pci_rx_interrupt(struct ieee80211_hw *hw)
+ 		}
+ 		if (((rtlpriv->link_info.num_rx_inperiod +
+ 		      rtlpriv->link_info.num_tx_inperiod) > 8) ||
+-		      (rtlpriv->link_info.num_rx_inperiod > 2)) {
+-			rtlpriv->enter_ps = false;
+-			schedule_work(&rtlpriv->works.lps_change_work);
+-		}
++		      (rtlpriv->link_info.num_rx_inperiod > 2))
++			rtl_lps_leave(hw);
+ 		skb = new_skb;
+ no_new:
+ 		if (rtlpriv->use_new_trx_flow) {
+diff --git a/drivers/net/wireless/realtek/rtlwifi/ps.c b/drivers/net/wireless/realtek/rtlwifi/ps.c
+index 9a64f9b..424e262 100644
+--- a/drivers/net/wireless/realtek/rtlwifi/ps.c
++++ b/drivers/net/wireless/realtek/rtlwifi/ps.c
+@@ -407,8 +407,8 @@ void rtl_lps_set_psmode(struct ieee80211_hw *hw, u8 rt_psmode)
+ 	}
+ }
+ 
+-/*Enter the leisure power save mode.*/
+-void rtl_lps_enter(struct ieee80211_hw *hw)
++/* Interrupt safe routine to enter the leisure power save mode.*/
++static void rtl_lps_enter_core(struct ieee80211_hw *hw)
+ {
+ 	struct rtl_mac *mac = rtl_mac(rtl_priv(hw));
+ 	struct rtl_ps_ctl *ppsc = rtl_psc(rtl_priv(hw));
+@@ -444,10 +444,9 @@ void rtl_lps_enter(struct ieee80211_hw *hw)
+ 
+ 	spin_unlock_irqrestore(&rtlpriv->locks.lps_lock, flag);
+ }
+-EXPORT_SYMBOL(rtl_lps_enter);
+ 
+-/*Leave the leisure power save mode.*/
+-void rtl_lps_leave(struct ieee80211_hw *hw)
++/* Interrupt safe routine to leave the leisure power save mode.*/
++static void rtl_lps_leave_core(struct ieee80211_hw *hw)
+ {
+ 	struct rtl_priv *rtlpriv = rtl_priv(hw);
+ 	struct rtl_ps_ctl *ppsc = rtl_psc(rtl_priv(hw));
+@@ -477,7 +476,6 @@ void rtl_lps_leave(struct ieee80211_hw *hw)
+ 	}
+ 	spin_unlock_irqrestore(&rtlpriv->locks.lps_lock, flag);
+ }
+-EXPORT_SYMBOL(rtl_lps_leave);
+ 
+ /* For sw LPS*/
+ void rtl_swlps_beacon(struct ieee80211_hw *hw, void *data, unsigned int len)
+@@ -670,12 +668,34 @@ void rtl_lps_change_work_callback(struct work_struct *work)
+ 	struct rtl_priv *rtlpriv = rtl_priv(hw);
+ 
+ 	if (rtlpriv->enter_ps)
+-		rtl_lps_enter(hw);
++		rtl_lps_enter_core(hw);
+ 	else
+-		rtl_lps_leave(hw);
++		rtl_lps_leave_core(hw);
+ }
+ EXPORT_SYMBOL_GPL(rtl_lps_change_work_callback);
+ 
++void rtl_lps_enter(struct ieee80211_hw *hw)
++{
++	struct rtl_priv *rtlpriv = rtl_priv(hw);
++
++	if (!in_interrupt())
++		return rtl_lps_enter_core(hw);
++	rtlpriv->enter_ps = true;
++	schedule_work(&rtlpriv->works.lps_change_work);
++}
++EXPORT_SYMBOL_GPL(rtl_lps_enter);
++
++void rtl_lps_leave(struct ieee80211_hw *hw)
++{
++	struct rtl_priv *rtlpriv = rtl_priv(hw);
++
++	if (!in_interrupt())
++		return rtl_lps_leave_core(hw);
++	rtlpriv->enter_ps = false;
++	schedule_work(&rtlpriv->works.lps_change_work);
++}
++EXPORT_SYMBOL_GPL(rtl_lps_leave);
++
+ void rtl_swlps_wq_callback(void *data)
+ {
+ 	struct rtl_works *rtlworks = container_of_dwork_rtl(data,
+diff --git a/drivers/nvdimm/pfn_devs.c b/drivers/nvdimm/pfn_devs.c
+index cea8350..a2ac9e6 100644
+--- a/drivers/nvdimm/pfn_devs.c
++++ b/drivers/nvdimm/pfn_devs.c
+@@ -108,7 +108,7 @@ static ssize_t align_show(struct device *dev,
+ {
+ 	struct nd_pfn *nd_pfn = to_nd_pfn_safe(dev);
+ 
+-	return sprintf(buf, "%lx\n", nd_pfn->align);
++	return sprintf(buf, "%ld\n", nd_pfn->align);
+ }
+ 
+ static ssize_t __align_store(struct nd_pfn *nd_pfn, const char *buf)
+diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
+index aab9d51..24db77e 100644
+--- a/drivers/pci/pci.c
++++ b/drivers/pci/pci.c
+@@ -2064,6 +2064,10 @@ bool pci_dev_run_wake(struct pci_dev *dev)
+ 	if (!dev->pme_support)
+ 		return false;
+ 
++	/* PME-capable in principle, but not from the intended sleep state */
++	if (!pci_pme_capable(dev, pci_target_state(dev)))
++		return false;
++
+ 	while (bus->parent) {
+ 		struct pci_dev *bridge = bus->self;
+ 
+diff --git a/drivers/platform/x86/asus-nb-wmi.c b/drivers/platform/x86/asus-nb-wmi.c
+index adecc1c..c4ed3e5 100644
+--- a/drivers/platform/x86/asus-nb-wmi.c
++++ b/drivers/platform/x86/asus-nb-wmi.c
+@@ -137,6 +137,15 @@ static const struct dmi_system_id asus_quirks[] = {
+ 	},
+ 	{
+ 		.callback = dmi_matched,
++		.ident = "ASUSTeK COMPUTER INC. X45U",
++		.matches = {
++			DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
++			DMI_MATCH(DMI_PRODUCT_NAME, "X45U"),
++		},
++		.driver_data = &quirk_asus_wapf4,
++	},
++	{
++		.callback = dmi_matched,
+ 		.ident = "ASUSTeK COMPUTER INC. X456UA",
+ 		.matches = {
+ 			DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
+diff --git a/drivers/regulator/stw481x-vmmc.c b/drivers/regulator/stw481x-vmmc.c
+index 7d2ae3e..342f5da 100644
+--- a/drivers/regulator/stw481x-vmmc.c
++++ b/drivers/regulator/stw481x-vmmc.c
+@@ -47,7 +47,8 @@ static struct regulator_desc vmmc_regulator = {
+ 	.volt_table = stw481x_vmmc_voltages,
+ 	.enable_time = 200, /* FIXME: look this up */
+ 	.enable_reg = STW_CONF1,
+-	.enable_mask = STW_CONF1_PDN_VMMC,
++	.enable_mask = STW_CONF1_PDN_VMMC | STW_CONF1_MMC_LS_STATUS,
++	.enable_val = STW_CONF1_PDN_VMMC,
+ 	.vsel_reg = STW_CONF1,
+ 	.vsel_mask = STW_CONF1_VMMC_MASK,
+ };
+diff --git a/drivers/s390/char/vmlogrdr.c b/drivers/s390/char/vmlogrdr.c
+index e883063..3167e85 100644
+--- a/drivers/s390/char/vmlogrdr.c
++++ b/drivers/s390/char/vmlogrdr.c
+@@ -870,7 +870,7 @@ static int __init vmlogrdr_init(void)
+ 		goto cleanup;
+ 
+ 	for (i=0; i < MAXMINOR; ++i ) {
+-		sys_ser[i].buffer = (char *) get_zeroed_page(GFP_KERNEL);
++		sys_ser[i].buffer = (char *) get_zeroed_page(GFP_KERNEL | GFP_DMA);
+ 		if (!sys_ser[i].buffer) {
+ 			rc = -ENOMEM;
+ 			break;
+diff --git a/drivers/s390/scsi/zfcp_dbf.c b/drivers/s390/scsi/zfcp_dbf.c
+index 5810019..d5bf36e 100644
+--- a/drivers/s390/scsi/zfcp_dbf.c
++++ b/drivers/s390/scsi/zfcp_dbf.c
+@@ -289,11 +289,12 @@ void zfcp_dbf_rec_trig(char *tag, struct zfcp_adapter *adapter,
+ 
+ 
+ /**
+- * zfcp_dbf_rec_run - trace event related to running recovery
++ * zfcp_dbf_rec_run_lvl - trace event related to running recovery
++ * @level: trace level to be used for event
+  * @tag: identifier for event
+  * @erp: erp_action running
+  */
+-void zfcp_dbf_rec_run(char *tag, struct zfcp_erp_action *erp)
++void zfcp_dbf_rec_run_lvl(int level, char *tag, struct zfcp_erp_action *erp)
+ {
+ 	struct zfcp_dbf *dbf = erp->adapter->dbf;
+ 	struct zfcp_dbf_rec *rec = &dbf->rec_buf;
+@@ -319,11 +320,21 @@ void zfcp_dbf_rec_run(char *tag, struct zfcp_erp_action *erp)
+ 	else
+ 		rec->u.run.rec_count = atomic_read(&erp->adapter->erp_counter);
+ 
+-	debug_event(dbf->rec, 1, rec, sizeof(*rec));
++	debug_event(dbf->rec, level, rec, sizeof(*rec));
+ 	spin_unlock_irqrestore(&dbf->rec_lock, flags);
+ }
+ 
+ /**
++ * zfcp_dbf_rec_run - trace event related to running recovery
++ * @tag: identifier for event
++ * @erp: erp_action running
++ */
++void zfcp_dbf_rec_run(char *tag, struct zfcp_erp_action *erp)
++{
++	zfcp_dbf_rec_run_lvl(1, tag, erp);
++}
++
++/**
+  * zfcp_dbf_rec_run_wka - trace wka port event with info like running recovery
+  * @tag: identifier for event
+  * @wka_port: well known address port
+diff --git a/drivers/s390/scsi/zfcp_dbf.h b/drivers/s390/scsi/zfcp_dbf.h
+index 36d0758..db186d4 100644
+--- a/drivers/s390/scsi/zfcp_dbf.h
++++ b/drivers/s390/scsi/zfcp_dbf.h
+@@ -2,7 +2,7 @@
+  * zfcp device driver
+  * debug feature declarations
+  *
+- * Copyright IBM Corp. 2008, 2015
++ * Copyright IBM Corp. 2008, 2016
+  */
+ 
+ #ifndef ZFCP_DBF_H
+@@ -283,6 +283,30 @@ struct zfcp_dbf {
+ 	struct zfcp_dbf_scsi		scsi_buf;
+ };
+ 
++/**
++ * zfcp_dbf_hba_fsf_resp_suppress - true if we should not trace by default
++ * @req: request that has been completed
++ *
++ * Returns true if FCP response with only benign residual under count.
++ */
++static inline
++bool zfcp_dbf_hba_fsf_resp_suppress(struct zfcp_fsf_req *req)
++{
++	struct fsf_qtcb *qtcb = req->qtcb;
++	u32 fsf_stat = qtcb->header.fsf_status;
++	struct fcp_resp *fcp_rsp;
++	u8 rsp_flags, fr_status;
++
++	if (qtcb->prefix.qtcb_type != FSF_IO_COMMAND)
++		return false; /* not an FCP response */
++	fcp_rsp = (struct fcp_resp *)&qtcb->bottom.io.fcp_rsp;
++	rsp_flags = fcp_rsp->fr_flags;
++	fr_status = fcp_rsp->fr_status;
++	return (fsf_stat == FSF_FCP_RSP_AVAILABLE) &&
++		(rsp_flags == FCP_RESID_UNDER) &&
++		(fr_status == SAM_STAT_GOOD);
++}
++
+ static inline
+ void zfcp_dbf_hba_fsf_resp(char *tag, int level, struct zfcp_fsf_req *req)
+ {
+@@ -304,7 +328,9 @@ void zfcp_dbf_hba_fsf_response(struct zfcp_fsf_req *req)
+ 		zfcp_dbf_hba_fsf_resp("fs_perr", 1, req);
+ 
+ 	} else if (qtcb->header.fsf_status != FSF_GOOD) {
+-		zfcp_dbf_hba_fsf_resp("fs_ferr", 1, req);
++		zfcp_dbf_hba_fsf_resp("fs_ferr",
++				      zfcp_dbf_hba_fsf_resp_suppress(req)
++				      ? 5 : 1, req);
+ 
+ 	} else if ((req->fsf_command == FSF_QTCB_OPEN_PORT_WITH_DID) ||
+ 		   (req->fsf_command == FSF_QTCB_OPEN_LUN)) {
+@@ -388,4 +414,15 @@ void zfcp_dbf_scsi_devreset(char *tag, struct scsi_cmnd *scmnd, u8 flag)
+ 	_zfcp_dbf_scsi(tmp_tag, 1, scmnd, NULL);
+ }
+ 
++/**
++ * zfcp_dbf_scsi_nullcmnd() - trace NULLify of SCSI command in dev/tgt-reset.
++ * @scmnd: SCSI command that was NULLified.
++ * @fsf_req: request that owned @scmnd.
++ */
++static inline void zfcp_dbf_scsi_nullcmnd(struct scsi_cmnd *scmnd,
++					  struct zfcp_fsf_req *fsf_req)
++{
++	_zfcp_dbf_scsi("scfc__1", 3, scmnd, fsf_req);
++}
++
+ #endif /* ZFCP_DBF_H */
+diff --git a/drivers/s390/scsi/zfcp_erp.c b/drivers/s390/scsi/zfcp_erp.c
+index a59d678..7ccfce5 100644
+--- a/drivers/s390/scsi/zfcp_erp.c
++++ b/drivers/s390/scsi/zfcp_erp.c
+@@ -3,7 +3,7 @@
+  *
+  * Error Recovery Procedures (ERP).
+  *
+- * Copyright IBM Corp. 2002, 2015
++ * Copyright IBM Corp. 2002, 2016
+  */
+ 
+ #define KMSG_COMPONENT "zfcp"
+@@ -1204,6 +1204,62 @@ static void zfcp_erp_action_dequeue(struct zfcp_erp_action *erp_action)
+ 	}
+ }
+ 
++/**
++ * zfcp_erp_try_rport_unblock - unblock rport if no more/new recovery
++ * @port: zfcp_port whose fc_rport we should try to unblock
++ */
++static void zfcp_erp_try_rport_unblock(struct zfcp_port *port)
++{
++	unsigned long flags;
++	struct zfcp_adapter *adapter = port->adapter;
++	int port_status;
++	struct Scsi_Host *shost = adapter->scsi_host;
++	struct scsi_device *sdev;
++
++	write_lock_irqsave(&adapter->erp_lock, flags);
++	port_status = atomic_read(&port->status);
++	if ((port_status & ZFCP_STATUS_COMMON_UNBLOCKED)    == 0 ||
++	    (port_status & (ZFCP_STATUS_COMMON_ERP_INUSE |
++			    ZFCP_STATUS_COMMON_ERP_FAILED)) != 0) {
++		/* new ERP of severity >= port triggered elsewhere meanwhile or
++		 * local link down (adapter erp_failed but not clear unblock)
++		 */
++		zfcp_dbf_rec_run_lvl(4, "ertru_p", &port->erp_action);
++		write_unlock_irqrestore(&adapter->erp_lock, flags);
++		return;
++	}
++	spin_lock(shost->host_lock);
++	__shost_for_each_device(sdev, shost) {
++		struct zfcp_scsi_dev *zsdev = sdev_to_zfcp(sdev);
++		int lun_status;
++
++		if (zsdev->port != port)
++			continue;
++		/* LUN under port of interest */
++		lun_status = atomic_read(&zsdev->status);
++		if ((lun_status & ZFCP_STATUS_COMMON_ERP_FAILED) != 0)
++			continue; /* unblock rport despite failed LUNs */
++		/* LUN recovery not given up yet [maybe follow-up pending] */
++		if ((lun_status & ZFCP_STATUS_COMMON_UNBLOCKED) == 0 ||
++		    (lun_status & ZFCP_STATUS_COMMON_ERP_INUSE) != 0) {
++			/* LUN blocked:
++			 * not yet unblocked [LUN recovery pending]
++			 * or meanwhile blocked [new LUN recovery triggered]
++			 */
++			zfcp_dbf_rec_run_lvl(4, "ertru_l", &zsdev->erp_action);
++			spin_unlock(shost->host_lock);
++			write_unlock_irqrestore(&adapter->erp_lock, flags);
++			return;
++		}
++	}
++	/* now port has no child or all children have completed recovery,
++	 * and no ERP of severity >= port was meanwhile triggered elsewhere
++	 */
++	zfcp_scsi_schedule_rport_register(port);
++	spin_unlock(shost->host_lock);
++	write_unlock_irqrestore(&adapter->erp_lock, flags);
++}
++
+ static void zfcp_erp_action_cleanup(struct zfcp_erp_action *act, int result)
+ {
+ 	struct zfcp_adapter *adapter = act->adapter;
+@@ -1214,6 +1270,7 @@ static void zfcp_erp_action_cleanup(struct zfcp_erp_action *act, int result)
+ 	case ZFCP_ERP_ACTION_REOPEN_LUN:
+ 		if (!(act->status & ZFCP_STATUS_ERP_NO_REF))
+ 			scsi_device_put(sdev);
++		zfcp_erp_try_rport_unblock(port);
+ 		break;
+ 
+ 	case ZFCP_ERP_ACTION_REOPEN_PORT:
+@@ -1224,7 +1281,7 @@ static void zfcp_erp_action_cleanup(struct zfcp_erp_action *act, int result)
+ 		 */
+ 		if (act->step != ZFCP_ERP_STEP_UNINITIALIZED)
+ 			if (result == ZFCP_ERP_SUCCEEDED)
+-				zfcp_scsi_schedule_rport_register(port);
++				zfcp_erp_try_rport_unblock(port);
+ 		/* fall through */
+ 	case ZFCP_ERP_ACTION_REOPEN_PORT_FORCED:
+ 		put_device(&port->dev);
+diff --git a/drivers/s390/scsi/zfcp_ext.h b/drivers/s390/scsi/zfcp_ext.h
+index c8fed9f..21c8c68 100644
+--- a/drivers/s390/scsi/zfcp_ext.h
++++ b/drivers/s390/scsi/zfcp_ext.h
+@@ -3,7 +3,7 @@
+  *
+  * External function declarations.
+  *
+- * Copyright IBM Corp. 2002, 2015
++ * Copyright IBM Corp. 2002, 2016
+  */
+ 
+ #ifndef ZFCP_EXT_H
+@@ -35,6 +35,8 @@ extern void zfcp_dbf_adapter_unregister(struct zfcp_adapter *);
+ extern void zfcp_dbf_rec_trig(char *, struct zfcp_adapter *,
+ 			      struct zfcp_port *, struct scsi_device *, u8, u8);
+ extern void zfcp_dbf_rec_run(char *, struct zfcp_erp_action *);
++extern void zfcp_dbf_rec_run_lvl(int level, char *tag,
++				 struct zfcp_erp_action *erp);
+ extern void zfcp_dbf_rec_run_wka(char *, struct zfcp_fc_wka_port *, u64);
+ extern void zfcp_dbf_hba_fsf_uss(char *, struct zfcp_fsf_req *);
+ extern void zfcp_dbf_hba_fsf_res(char *, int, struct zfcp_fsf_req *);
+diff --git a/drivers/s390/scsi/zfcp_fsf.h b/drivers/s390/scsi/zfcp_fsf.h
+index be1c04b..ea3c76a 100644
+--- a/drivers/s390/scsi/zfcp_fsf.h
++++ b/drivers/s390/scsi/zfcp_fsf.h
+@@ -3,7 +3,7 @@
+  *
+  * Interface to the FSF support functions.
+  *
+- * Copyright IBM Corp. 2002, 2015
++ * Copyright IBM Corp. 2002, 2016
+  */
+ 
+ #ifndef FSF_H
+@@ -78,6 +78,7 @@
+ #define FSF_APP_TAG_CHECK_FAILURE		0x00000082
+ #define FSF_REF_TAG_CHECK_FAILURE		0x00000083
+ #define FSF_ADAPTER_STATUS_AVAILABLE		0x000000AD
++#define FSF_FCP_RSP_AVAILABLE			0x000000AF
+ #define FSF_UNKNOWN_COMMAND			0x000000E2
+ #define FSF_UNKNOWN_OP_SUBTYPE                  0x000000E3
+ #define FSF_INVALID_COMMAND_OPTION              0x000000E5
+diff --git a/drivers/s390/scsi/zfcp_reqlist.h b/drivers/s390/scsi/zfcp_reqlist.h
+index 7c2c619..703fce5 100644
+--- a/drivers/s390/scsi/zfcp_reqlist.h
++++ b/drivers/s390/scsi/zfcp_reqlist.h
+@@ -4,7 +4,7 @@
+  * Data structure and helper functions for tracking pending FSF
+  * requests.
+  *
+- * Copyright IBM Corp. 2009
++ * Copyright IBM Corp. 2009, 2016
+  */
+ 
+ #ifndef ZFCP_REQLIST_H
+@@ -180,4 +180,32 @@ static inline void zfcp_reqlist_move(struct zfcp_reqlist *rl,
+ 	spin_unlock_irqrestore(&rl->lock, flags);
+ }
+ 
++/**
++ * zfcp_reqlist_apply_for_all() - apply a function to every request.
++ * @rl: the requestlist that contains the target requests.
++ * @f: the function to apply to each request; the first parameter of the
++ *     function will be the target-request; the second parameter is the same
++ *     pointer as given with the argument @data.
++ * @data: freely chosen argument; passed through to @f as second parameter.
++ *
++ * Uses :c:macro:`list_for_each_entry` to iterate over the lists in the hash-
++ * table (not a 'safe' variant, so don't modify the list).
++ *
++ * Holds @rl->lock over the entire request-iteration.
++ */
++static inline void
++zfcp_reqlist_apply_for_all(struct zfcp_reqlist *rl,
++			   void (*f)(struct zfcp_fsf_req *, void *), void *data)
++{
++	struct zfcp_fsf_req *req;
++	unsigned long flags;
++	unsigned int i;
++
++	spin_lock_irqsave(&rl->lock, flags);
++	for (i = 0; i < ZFCP_REQ_LIST_BUCKETS; i++)
++		list_for_each_entry(req, &rl->buckets[i], list)
++			f(req, data);
++	spin_unlock_irqrestore(&rl->lock, flags);
++}
++
+ #endif /* ZFCP_REQLIST_H */
+diff --git a/drivers/s390/scsi/zfcp_scsi.c b/drivers/s390/scsi/zfcp_scsi.c
+index 9069f98..07ffdbb 100644
+--- a/drivers/s390/scsi/zfcp_scsi.c
++++ b/drivers/s390/scsi/zfcp_scsi.c
+@@ -3,7 +3,7 @@
+  *
+  * Interface to Linux SCSI midlayer.
+  *
+- * Copyright IBM Corp. 2002, 2015
++ * Copyright IBM Corp. 2002, 2016
+  */
+ 
+ #define KMSG_COMPONENT "zfcp"
+@@ -88,9 +88,7 @@ int zfcp_scsi_queuecommand(struct Scsi_Host *shost, struct scsi_cmnd *scpnt)
+ 	}
+ 
+ 	if (unlikely(!(status & ZFCP_STATUS_COMMON_UNBLOCKED))) {
+-		/* This could be either
+-		 * open LUN pending: this is temporary, will result in
+-		 *	open LUN or ERP_FAILED, so retry command
++		/* This could be
+ 		 * call to rport_delete pending: mimic retry from
+ 		 * 	fc_remote_port_chkready until rport is BLOCKED
+ 		 */
+@@ -209,6 +207,57 @@ static int zfcp_scsi_eh_abort_handler(struct scsi_cmnd *scpnt)
+ 	return retval;
+ }
+ 
++struct zfcp_scsi_req_filter {
++	u8 tmf_scope;
++	u32 lun_handle;
++	u32 port_handle;
++};
++
++static void zfcp_scsi_forget_cmnd(struct zfcp_fsf_req *old_req, void *data)
++{
++	struct zfcp_scsi_req_filter *filter =
++		(struct zfcp_scsi_req_filter *)data;
++
++	/* already aborted - prevent side-effects - or not a SCSI command */
++	if (old_req->data == NULL || old_req->fsf_command != FSF_QTCB_FCP_CMND)
++		return;
++
++	/* (tmf_scope == FCP_TMF_TGT_RESET || tmf_scope == FCP_TMF_LUN_RESET) */
++	if (old_req->qtcb->header.port_handle != filter->port_handle)
++		return;
++
++	if (filter->tmf_scope == FCP_TMF_LUN_RESET &&
++	    old_req->qtcb->header.lun_handle != filter->lun_handle)
++		return;
++
++	zfcp_dbf_scsi_nullcmnd((struct scsi_cmnd *)old_req->data, old_req);
++	old_req->data = NULL;
++}
++
++static void zfcp_scsi_forget_cmnds(struct zfcp_scsi_dev *zsdev, u8 tm_flags)
++{
++	struct zfcp_adapter *adapter = zsdev->port->adapter;
++	struct zfcp_scsi_req_filter filter = {
++		.tmf_scope = FCP_TMF_TGT_RESET,
++		.port_handle = zsdev->port->handle,
++	};
++	unsigned long flags;
++
++	if (tm_flags == FCP_TMF_LUN_RESET) {
++		filter.tmf_scope = FCP_TMF_LUN_RESET;
++		filter.lun_handle = zsdev->lun_handle;
++	}
++
++	/*
++	 * abort_lock secures against other processings - in the abort-function
++	 * and normal cmnd-handler - of (struct zfcp_fsf_req *)->data
++	 */
++	write_lock_irqsave(&adapter->abort_lock, flags);
++	zfcp_reqlist_apply_for_all(adapter->req_list, zfcp_scsi_forget_cmnd,
++				   &filter);
++	write_unlock_irqrestore(&adapter->abort_lock, flags);
++}
++
+ static int zfcp_task_mgmt_function(struct scsi_cmnd *scpnt, u8 tm_flags)
+ {
+ 	struct zfcp_scsi_dev *zfcp_sdev = sdev_to_zfcp(scpnt->device);
+@@ -241,8 +290,10 @@ static int zfcp_task_mgmt_function(struct scsi_cmnd *scpnt, u8 tm_flags)
+ 	if (fsf_req->status & ZFCP_STATUS_FSFREQ_TMFUNCFAILED) {
+ 		zfcp_dbf_scsi_devreset("fail", scpnt, tm_flags);
+ 		retval = FAILED;
+-	} else
++	} else {
+ 		zfcp_dbf_scsi_devreset("okay", scpnt, tm_flags);
++		zfcp_scsi_forget_cmnds(zfcp_sdev, tm_flags);
++	}
+ 
+ 	zfcp_fsf_req_free(fsf_req);
+ 	return retval;
+diff --git a/drivers/scsi/aacraid/linit.c b/drivers/scsi/aacraid/linit.c
+index 79871f3..d5b26fa 100644
+--- a/drivers/scsi/aacraid/linit.c
++++ b/drivers/scsi/aacraid/linit.c
+@@ -160,7 +160,6 @@ static const struct pci_device_id aac_pci_tbl[] = {
+ 	{ 0x9005, 0x028b, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 62 }, /* Adaptec PMC Series 6 (Tupelo) */
+ 	{ 0x9005, 0x028c, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 63 }, /* Adaptec PMC Series 7 (Denali) */
+ 	{ 0x9005, 0x028d, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 64 }, /* Adaptec PMC Series 8 */
+-	{ 0x9005, 0x028f, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 65 }, /* Adaptec PMC Series 9 */
+ 	{ 0,}
+ };
+ MODULE_DEVICE_TABLE(pci, aac_pci_tbl);
+@@ -239,7 +238,6 @@ static struct aac_driver_ident aac_drivers[] = {
+ 	{ aac_src_init, "aacraid", "ADAPTEC ", "RAID            ", 2, AAC_QUIRK_SRC }, /* Adaptec PMC Series 6 (Tupelo) */
+ 	{ aac_srcv_init, "aacraid", "ADAPTEC ", "RAID            ", 2, AAC_QUIRK_SRC }, /* Adaptec PMC Series 7 (Denali) */
+ 	{ aac_srcv_init, "aacraid", "ADAPTEC ", "RAID            ", 2, AAC_QUIRK_SRC }, /* Adaptec PMC Series 8 */
+-	{ aac_srcv_init, "aacraid", "ADAPTEC ", "RAID            ", 2, AAC_QUIRK_SRC } /* Adaptec PMC Series 9 */
+ };
+ 
+ /**
+diff --git a/drivers/scsi/megaraid/megaraid_sas_fusion.c b/drivers/scsi/megaraid/megaraid_sas_fusion.c
+index 52d8bbf..bd04bd0 100644
+--- a/drivers/scsi/megaraid/megaraid_sas_fusion.c
++++ b/drivers/scsi/megaraid/megaraid_sas_fusion.c
+@@ -2000,6 +2000,8 @@ megasas_build_syspd_fusion(struct megasas_instance *instance,
+ 		io_request->DevHandle = pd_sync->seq[pd_index].devHandle;
+ 		pRAID_Context->regLockFlags |=
+ 			(MR_RL_FLAGS_SEQ_NUM_ENABLE|MR_RL_FLAGS_GRANT_DESTINATION_CUDA);
++		pRAID_Context->Type = MPI2_TYPE_CUDA;
++		pRAID_Context->nseg = 0x1;
+ 	} else if (fusion->fast_path_io) {
+ 		pRAID_Context->VirtualDiskTgtId = cpu_to_le16(device_id);
+ 		pRAID_Context->configSeqNum = 0;
+@@ -2035,12 +2037,10 @@ megasas_build_syspd_fusion(struct megasas_instance *instance,
+ 		pRAID_Context->timeoutValue =
+ 			cpu_to_le16((os_timeout_value > timeout_limit) ?
+ 			timeout_limit : os_timeout_value);
+-		if (fusion->adapter_type == INVADER_SERIES) {
+-			pRAID_Context->Type = MPI2_TYPE_CUDA;
+-			pRAID_Context->nseg = 0x1;
++		if (fusion->adapter_type == INVADER_SERIES)
+ 			io_request->IoFlags |=
+ 				cpu_to_le16(MPI25_SAS_DEVICE0_FLAGS_ENABLED_FAST_PATH);
+-		}
++
+ 		cmd->request_desc->SCSIIO.RequestFlags =
+ 			(MPI2_REQ_DESCRIPT_FLAGS_FP_IO <<
+ 				MEGASAS_REQ_DESCRIPT_FLAGS_TYPE_SHIFT);
+@@ -2823,6 +2823,7 @@ int megasas_wait_for_outstanding_fusion(struct megasas_instance *instance,
+ 		dev_err(&instance->pdev->dev, "pending commands remain after waiting, "
+ 		       "will reset adapter scsi%d.\n",
+ 		       instance->host->host_no);
++		*convert = 1;
+ 		retval = 1;
+ 	}
+ out:
+diff --git a/drivers/scsi/scsi_sysfs.c b/drivers/scsi/scsi_sysfs.c
+index 0734927..82dfe07 100644
+--- a/drivers/scsi/scsi_sysfs.c
++++ b/drivers/scsi/scsi_sysfs.c
+@@ -1204,10 +1204,6 @@ int scsi_sysfs_add_sdev(struct scsi_device *sdev)
+ 	struct request_queue *rq = sdev->request_queue;
+ 	struct scsi_target *starget = sdev->sdev_target;
+ 
+-	error = scsi_device_set_state(sdev, SDEV_RUNNING);
+-	if (error)
+-		return error;
+-
+ 	error = scsi_target_add(starget);
+ 	if (error)
+ 		return error;
+diff --git a/drivers/scsi/sg.c b/drivers/scsi/sg.c
+index ae7d9bd..a1c29b0 100644
+--- a/drivers/scsi/sg.c
++++ b/drivers/scsi/sg.c
+@@ -592,6 +592,9 @@ sg_write(struct file *filp, const char __user *buf, size_t count, loff_t * ppos)
+ 	sg_io_hdr_t *hp;
+ 	unsigned char cmnd[SG_MAX_CDB_SIZE];
+ 
++	if (unlikely(segment_eq(get_fs(), KERNEL_DS)))
++		return -EINVAL;
++
+ 	if ((!(sfp = (Sg_fd *) filp->private_data)) || (!(sdp = sfp->parentdp)))
+ 		return -ENXIO;
+ 	SCSI_LOG_TIMEOUT(3, sg_printk(KERN_INFO, sdp,
+diff --git a/drivers/ssb/pci.c b/drivers/ssb/pci.c
+index 0f28c08..77b551d 100644
+--- a/drivers/ssb/pci.c
++++ b/drivers/ssb/pci.c
+@@ -909,6 +909,7 @@ static int ssb_pci_sprom_get(struct ssb_bus *bus,
+ 			if (err) {
+ 				ssb_warn("WARNING: Using fallback SPROM failed (err %d)\n",
+ 					 err);
++				goto out_free;
+ 			} else {
+ 				ssb_dbg("Using SPROM revision %d provided by platform\n",
+ 					sprom->revision);
+diff --git a/drivers/staging/comedi/drivers/ni_mio_common.c b/drivers/staging/comedi/drivers/ni_mio_common.c
+index 0f97d7b..1c967c3 100644
+--- a/drivers/staging/comedi/drivers/ni_mio_common.c
++++ b/drivers/staging/comedi/drivers/ni_mio_common.c
+@@ -1832,7 +1832,7 @@ static int ni_ai_insn_read(struct comedi_device *dev,
+ 			   unsigned int *data)
+ {
+ 	struct ni_private *devpriv = dev->private;
+-	unsigned int mask = (s->maxdata + 1) >> 1;
++	unsigned int mask = s->maxdata;
+ 	int i, n;
+ 	unsigned int signbits;
+ 	unsigned int d;
+@@ -1875,7 +1875,7 @@ static int ni_ai_insn_read(struct comedi_device *dev,
+ 				return -ETIME;
+ 			}
+ 			d += signbits;
+-			data[n] = d;
++			data[n] = d & 0xffff;
+ 		}
+ 	} else if (devpriv->is_6143) {
+ 		for (n = 0; n < insn->n; n++) {
+@@ -1924,9 +1924,8 @@ static int ni_ai_insn_read(struct comedi_device *dev,
+ 				data[n] = dl;
+ 			} else {
+ 				d = ni_readw(dev, NI_E_AI_FIFO_DATA_REG);
+-				/* subtle: needs to be short addition */
+ 				d += signbits;
+-				data[n] = d;
++				data[n] = d & 0xffff;
+ 			}
+ 		}
+ 	}
+diff --git a/drivers/target/iscsi/iscsi_target_configfs.c b/drivers/target/iscsi/iscsi_target_configfs.c
+index 923c032..e980e2d 100644
+--- a/drivers/target/iscsi/iscsi_target_configfs.c
++++ b/drivers/target/iscsi/iscsi_target_configfs.c
+@@ -100,8 +100,10 @@ static ssize_t lio_target_np_driver_store(struct config_item *item,
+ 
+ 		tpg_np_new = iscsit_tpg_add_network_portal(tpg,
+ 					&np->np_sockaddr, tpg_np, type);
+-		if (IS_ERR(tpg_np_new))
++		if (IS_ERR(tpg_np_new)) {
++			rc = PTR_ERR(tpg_np_new);
+ 			goto out;
++		}
+ 	} else {
+ 		tpg_np_new = iscsit_tpg_locate_child_np(tpg_np, type);
+ 		if (tpg_np_new) {
+diff --git a/drivers/target/target_core_user.c b/drivers/target/target_core_user.c
+index 62bf4fe..b8a986c 100644
+--- a/drivers/target/target_core_user.c
++++ b/drivers/target/target_core_user.c
+@@ -682,8 +682,6 @@ static int tcmu_check_expired_cmd(int id, void *p, void *data)
+ 	target_complete_cmd(cmd->se_cmd, SAM_STAT_CHECK_CONDITION);
+ 	cmd->se_cmd = NULL;
+ 
+-	kmem_cache_free(tcmu_cmd_cache, cmd);
+-
+ 	return 0;
+ }
+ 
+diff --git a/drivers/thermal/thermal_hwmon.c b/drivers/thermal/thermal_hwmon.c
+index c41c774..2dcd419 100644
+--- a/drivers/thermal/thermal_hwmon.c
++++ b/drivers/thermal/thermal_hwmon.c
+@@ -98,7 +98,7 @@ temp_crit_show(struct device *dev, struct device_attribute *attr, char *buf)
+ 	int temperature;
+ 	int ret;
+ 
+-	ret = tz->ops->get_trip_temp(tz, 0, &temperature);
++	ret = tz->ops->get_crit_temp(tz, &temperature);
+ 	if (ret)
+ 		return ret;
+ 
+diff --git a/drivers/tty/serial/sc16is7xx.c b/drivers/tty/serial/sc16is7xx.c
+index f36e6df..e086ea4 100644
+--- a/drivers/tty/serial/sc16is7xx.c
++++ b/drivers/tty/serial/sc16is7xx.c
+@@ -1240,7 +1240,7 @@ static int sc16is7xx_probe(struct device *dev,
+ 
+ 	/* Setup interrupt */
+ 	ret = devm_request_irq(dev, irq, sc16is7xx_irq,
+-			       IRQF_ONESHOT | flags, dev_name(dev), s);
++			       flags, dev_name(dev), s);
+ 	if (!ret)
+ 		return 0;
+ 
+diff --git a/drivers/tty/vt/keyboard.c b/drivers/tty/vt/keyboard.c
+index 0f8caae..ece10e6 100644
+--- a/drivers/tty/vt/keyboard.c
++++ b/drivers/tty/vt/keyboard.c
+@@ -982,7 +982,7 @@ static void kbd_led_trigger_activate(struct led_classdev *cdev)
+ 	KBD_LED_TRIGGER((_led_bit) + 8, _name)
+ 
+ static struct kbd_led_trigger kbd_led_triggers[] = {
+-	KBD_LED_TRIGGER(VC_SCROLLOCK, "kbd-scrollock"),
++	KBD_LED_TRIGGER(VC_SCROLLOCK, "kbd-scrolllock"),
+ 	KBD_LED_TRIGGER(VC_NUMLOCK,   "kbd-numlock"),
+ 	KBD_LED_TRIGGER(VC_CAPSLOCK,  "kbd-capslock"),
+ 	KBD_LED_TRIGGER(VC_KANALOCK,  "kbd-kanalock"),
+diff --git a/fs/block_dev.c b/fs/block_dev.c
+index b010242..496d99b 100644
+--- a/fs/block_dev.c
++++ b/fs/block_dev.c
+@@ -1885,6 +1885,7 @@ void iterate_bdevs(void (*func)(struct block_device *, void *), void *arg)
+ 	spin_lock(&blockdev_superblock->s_inode_list_lock);
+ 	list_for_each_entry(inode, &blockdev_superblock->s_inodes, i_sb_list) {
+ 		struct address_space *mapping = inode->i_mapping;
++		struct block_device *bdev;
+ 
+ 		spin_lock(&inode->i_lock);
+ 		if (inode->i_state & (I_FREEING|I_WILL_FREE|I_NEW) ||
+@@ -1905,8 +1906,12 @@ void iterate_bdevs(void (*func)(struct block_device *, void *), void *arg)
+ 		 */
+ 		iput(old_inode);
+ 		old_inode = inode;
++		bdev = I_BDEV(inode);
+ 
+-		func(I_BDEV(inode), arg);
++		mutex_lock(&bdev->bd_mutex);
++		if (bdev->bd_openers)
++			func(bdev, arg);
++		mutex_unlock(&bdev->bd_mutex);
+ 
+ 		spin_lock(&blockdev_superblock->s_inode_list_lock);
+ 	}
+diff --git a/fs/nfs/file.c b/fs/nfs/file.c
+index ca699dd..e6a0d22 100644
+--- a/fs/nfs/file.c
++++ b/fs/nfs/file.c
+@@ -397,7 +397,7 @@ static int nfs_write_end(struct file *file, struct address_space *mapping,
+ 	 */
+ 	if (!PageUptodate(page)) {
+ 		unsigned pglen = nfs_page_length(page);
+-		unsigned end = offset + len;
++		unsigned end = offset + copied;
+ 
+ 		if (pglen == 0) {
+ 			zero_user_segments(page, 0, offset,
+diff --git a/fs/nfs/flexfilelayout/flexfilelayout.c b/fs/nfs/flexfilelayout/flexfilelayout.c
+index 51b5136..dcc21f9 100644
+--- a/fs/nfs/flexfilelayout/flexfilelayout.c
++++ b/fs/nfs/flexfilelayout/flexfilelayout.c
+@@ -28,6 +28,9 @@
+ 
+ static struct group_info	*ff_zero_group;
+ 
++static void ff_layout_read_record_layoutstats_done(struct rpc_task *task,
++		struct nfs_pgio_header *hdr);
++
+ static struct pnfs_layout_hdr *
+ ff_layout_alloc_layout_hdr(struct inode *inode, gfp_t gfp_flags)
+ {
+@@ -1293,6 +1296,7 @@ static int ff_layout_read_done_cb(struct rpc_task *task,
+ 					hdr->pgio_mirror_idx + 1,
+ 					&hdr->pgio_mirror_idx))
+ 			goto out_eagain;
++		ff_layout_read_record_layoutstats_done(task, hdr);
+ 		pnfs_read_resend_pnfs(hdr);
+ 		return task->tk_status;
+ 	case -NFS4ERR_RESET_TO_MDS:
+diff --git a/fs/nfs/pnfs.c b/fs/nfs/pnfs.c
+index 2c93a85..eb8edb3 100644
+--- a/fs/nfs/pnfs.c
++++ b/fs/nfs/pnfs.c
+@@ -252,6 +252,14 @@ pnfs_put_layout_hdr(struct pnfs_layout_hdr *lo)
+ 	}
+ }
+ 
++static void
++pnfs_clear_layoutreturn_info(struct pnfs_layout_hdr *lo)
++{
++	lo->plh_return_iomode = 0;
++	lo->plh_return_seq = 0;
++	clear_bit(NFS_LAYOUT_RETURN_REQUESTED, &lo->plh_flags);
++}
++
+ /*
+  * Mark a pnfs_layout_hdr and all associated layout segments as invalid
+  *
+@@ -270,6 +278,7 @@ pnfs_mark_layout_stateid_invalid(struct pnfs_layout_hdr *lo,
+ 	};
+ 
+ 	set_bit(NFS_LAYOUT_INVALID_STID, &lo->plh_flags);
++	pnfs_clear_layoutreturn_info(lo);
+ 	return pnfs_mark_matching_lsegs_invalid(lo, lseg_list, &range, 0);
+ }
+ 
+@@ -364,7 +373,9 @@ pnfs_layout_remove_lseg(struct pnfs_layout_hdr *lo,
+ 	list_del_init(&lseg->pls_list);
+ 	/* Matched by pnfs_get_layout_hdr in pnfs_layout_insert_lseg */
+ 	atomic_dec(&lo->plh_refcount);
+-	if (list_empty(&lo->plh_segs)) {
++	if (list_empty(&lo->plh_segs) &&
++	    !test_bit(NFS_LAYOUT_RETURN_REQUESTED, &lo->plh_flags) &&
++	    !test_bit(NFS_LAYOUT_RETURN, &lo->plh_flags)) {
+ 		if (atomic_read(&lo->plh_outstanding) == 0)
+ 			set_bit(NFS_LAYOUT_INVALID_STID, &lo->plh_flags);
+ 		clear_bit(NFS_LAYOUT_BULK_RECALL, &lo->plh_flags);
+@@ -769,14 +780,6 @@ pnfs_destroy_all_layouts(struct nfs_client *clp)
+ 	pnfs_destroy_layouts_byclid(clp, false);
+ }
+ 
+-static void
+-pnfs_clear_layoutreturn_info(struct pnfs_layout_hdr *lo)
+-{
+-	lo->plh_return_iomode = 0;
+-	lo->plh_return_seq = 0;
+-	clear_bit(NFS_LAYOUT_RETURN_REQUESTED, &lo->plh_flags);
+-}
+-
+ /* update lo->plh_stateid with new if is more recent */
+ void
+ pnfs_set_layout_stateid(struct pnfs_layout_hdr *lo, const nfs4_stateid *new,
+@@ -897,6 +900,7 @@ static void pnfs_clear_layoutcommit(struct inode *inode,
+ void pnfs_clear_layoutreturn_waitbit(struct pnfs_layout_hdr *lo)
+ {
+ 	clear_bit_unlock(NFS_LAYOUT_RETURN, &lo->plh_flags);
++	clear_bit(NFS_LAYOUT_RETURN_LOCK, &lo->plh_flags);
+ 	smp_mb__after_atomic();
+ 	wake_up_bit(&lo->plh_flags, NFS_LAYOUT_RETURN);
+ 	rpc_wake_up(&NFS_SERVER(lo->plh_inode)->roc_rpcwaitq);
+@@ -910,8 +914,9 @@ pnfs_prepare_layoutreturn(struct pnfs_layout_hdr *lo,
+ 	/* Serialise LAYOUTGET/LAYOUTRETURN */
+ 	if (atomic_read(&lo->plh_outstanding) != 0)
+ 		return false;
+-	if (test_and_set_bit(NFS_LAYOUT_RETURN, &lo->plh_flags))
++	if (test_and_set_bit(NFS_LAYOUT_RETURN_LOCK, &lo->plh_flags))
+ 		return false;
++	set_bit(NFS_LAYOUT_RETURN, &lo->plh_flags);
+ 	pnfs_get_layout_hdr(lo);
+ 	if (test_bit(NFS_LAYOUT_RETURN_REQUESTED, &lo->plh_flags)) {
+ 		if (stateid != NULL) {
+@@ -1903,6 +1908,8 @@ void pnfs_error_mark_layout_for_return(struct inode *inode,
+ 
+ 	spin_lock(&inode->i_lock);
+ 	pnfs_set_plh_return_info(lo, range.iomode, 0);
++	/* Block LAYOUTGET */
++	set_bit(NFS_LAYOUT_RETURN, &lo->plh_flags);
+ 	/*
+ 	 * mark all matching lsegs so that we are sure to have no live
+ 	 * segments at hand when sending layoutreturn. See pnfs_put_lseg()
+@@ -2241,6 +2248,10 @@ void pnfs_read_resend_pnfs(struct nfs_pgio_header *hdr)
+ 	struct nfs_pageio_descriptor pgio;
+ 
+ 	if (!test_and_set_bit(NFS_IOHDR_REDO, &hdr->flags)) {
++		/* Prevent deadlocks with layoutreturn! */
++		pnfs_put_lseg(hdr->lseg);
++		hdr->lseg = NULL;
++
+ 		nfs_pageio_init_read(&pgio, hdr->inode, false,
+ 					hdr->completion_ops);
+ 		hdr->task.tk_status = nfs_pageio_resend(&pgio, hdr);
+diff --git a/fs/nfs/pnfs.h b/fs/nfs/pnfs.h
+index 31d99b2..98dbb51 100644
+--- a/fs/nfs/pnfs.h
++++ b/fs/nfs/pnfs.h
+@@ -96,6 +96,7 @@ enum {
+ 	NFS_LAYOUT_RW_FAILED,		/* get rw layout failed stop trying */
+ 	NFS_LAYOUT_BULK_RECALL,		/* bulk recall affecting layout */
+ 	NFS_LAYOUT_RETURN,		/* layoutreturn in progress */
++	NFS_LAYOUT_RETURN_LOCK,		/* Serialise layoutreturn */
+ 	NFS_LAYOUT_RETURN_REQUESTED,	/* Return this layout ASAP */
+ 	NFS_LAYOUT_INVALID_STID,	/* layout stateid id is invalid */
+ 	NFS_LAYOUT_FIRST_LAYOUTGET,	/* Serialize first layoutget */
+diff --git a/fs/notify/inode_mark.c b/fs/notify/inode_mark.c
+index 741077d..a364524 100644
+--- a/fs/notify/inode_mark.c
++++ b/fs/notify/inode_mark.c
+@@ -150,12 +150,10 @@ int fsnotify_add_inode_mark(struct fsnotify_mark *mark,
+  */
+ void fsnotify_unmount_inodes(struct super_block *sb)
+ {
+-	struct inode *inode, *next_i, *need_iput = NULL;
++	struct inode *inode, *iput_inode = NULL;
+ 
+ 	spin_lock(&sb->s_inode_list_lock);
+-	list_for_each_entry_safe(inode, next_i, &sb->s_inodes, i_sb_list) {
+-		struct inode *need_iput_tmp;
+-
++	list_for_each_entry(inode, &sb->s_inodes, i_sb_list) {
+ 		/*
+ 		 * We cannot __iget() an inode in state I_FREEING,
+ 		 * I_WILL_FREE, or I_NEW which is fine because by that point
+@@ -178,49 +176,24 @@ void fsnotify_unmount_inodes(struct super_block *sb)
+ 			continue;
+ 		}
+ 
+-		need_iput_tmp = need_iput;
+-		need_iput = NULL;
+-
+-		/* In case fsnotify_inode_delete() drops a reference. */
+-		if (inode != need_iput_tmp)
+-			__iget(inode);
+-		else
+-			need_iput_tmp = NULL;
++		__iget(inode);
+ 		spin_unlock(&inode->i_lock);
+-
+-		/* In case the dropping of a reference would nuke next_i. */
+-		while (&next_i->i_sb_list != &sb->s_inodes) {
+-			spin_lock(&next_i->i_lock);
+-			if (!(next_i->i_state & (I_FREEING | I_WILL_FREE)) &&
+-						atomic_read(&next_i->i_count)) {
+-				__iget(next_i);
+-				need_iput = next_i;
+-				spin_unlock(&next_i->i_lock);
+-				break;
+-			}
+-			spin_unlock(&next_i->i_lock);
+-			next_i = list_next_entry(next_i, i_sb_list);
+-		}
+-
+-		/*
+-		 * We can safely drop s_inode_list_lock here because either
+-		 * we actually hold references on both inode and next_i or
+-		 * end of list.  Also no new inodes will be added since the
+-		 * umount has begun.
+-		 */
+ 		spin_unlock(&sb->s_inode_list_lock);
+ 
+-		if (need_iput_tmp)
+-			iput(need_iput_tmp);
++		if (iput_inode)
++			iput(iput_inode);
+ 
+ 		/* for each watch, send FS_UNMOUNT and then remove it */
+ 		fsnotify(inode, FS_UNMOUNT, inode, FSNOTIFY_EVENT_INODE, NULL, 0);
+ 
+ 		fsnotify_inode_delete(inode);
+ 
+-		iput(inode);
++		iput_inode = inode;
+ 
+ 		spin_lock(&sb->s_inode_list_lock);
+ 	}
+ 	spin_unlock(&sb->s_inode_list_lock);
++
++	if (iput_inode)
++		iput(iput_inode);
+ }
+diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h
+index beb7610..95b1b57b 100644
+--- a/include/net/cfg80211.h
++++ b/include/net/cfg80211.h
+@@ -4393,6 +4393,17 @@ void cfg80211_rx_assoc_resp(struct net_device *dev,
+ void cfg80211_assoc_timeout(struct net_device *dev, struct cfg80211_bss *bss);
+ 
+ /**
++ * cfg80211_abandon_assoc - notify cfg80211 of abandoned association attempt
++ * @dev: network device
++ * @bss: The BSS entry with which association was abandoned.
++ *
++ * Call this whenever - for reasons reported through other API, like deauth RX,
++ * an association attempt was abandoned.
++ * This function may sleep. The caller must hold the corresponding wdev's mutex.
++ */
++void cfg80211_abandon_assoc(struct net_device *dev, struct cfg80211_bss *bss);
++
++/**
+  * cfg80211_tx_mlme_mgmt - notification of transmitted deauth/disassoc frame
+  * @dev: network device
+  * @buf: 802.11 frame (header + body)
+diff --git a/include/rdma/ib_addr.h b/include/rdma/ib_addr.h
+index 931a47b..1beab55 100644
+--- a/include/rdma/ib_addr.h
++++ b/include/rdma/ib_addr.h
+@@ -205,10 +205,12 @@ static inline void iboe_addr_get_sgid(struct rdma_dev_addr *dev_addr,
+ 
+ 	dev = dev_get_by_index(&init_net, dev_addr->bound_dev_if);
+ 	if (dev) {
+-		ip4 = (struct in_device *)dev->ip_ptr;
+-		if (ip4 && ip4->ifa_list && ip4->ifa_list->ifa_address)
++		ip4 = in_dev_get(dev);
++		if (ip4 && ip4->ifa_list && ip4->ifa_list->ifa_address) {
+ 			ipv6_addr_set_v4mapped(ip4->ifa_list->ifa_address,
+ 					       (struct in6_addr *)gid);
++			in_dev_put(ip4);
++		}
+ 		dev_put(dev);
+ 	}
+ }
+diff --git a/kernel/time/timekeeping.c b/kernel/time/timekeeping.c
+index 37dec7e..46e312e 100644
+--- a/kernel/time/timekeeping.c
++++ b/kernel/time/timekeeping.c
+@@ -299,10 +299,10 @@ u32 (*arch_gettimeoffset)(void) = default_arch_gettimeoffset;
+ static inline u32 arch_gettimeoffset(void) { return 0; }
+ #endif
+ 
+-static inline s64 timekeeping_delta_to_ns(struct tk_read_base *tkr,
++static inline u64 timekeeping_delta_to_ns(struct tk_read_base *tkr,
+ 					  cycle_t delta)
+ {
+-	s64 nsec;
++	u64 nsec;
+ 
+ 	nsec = delta * tkr->mult + tkr->xtime_nsec;
+ 	nsec >>= tkr->shift;
+diff --git a/kernel/trace/trace_functions_graph.c b/kernel/trace/trace_functions_graph.c
+index 7363ccf..16047a8 100644
+--- a/kernel/trace/trace_functions_graph.c
++++ b/kernel/trace/trace_functions_graph.c
+@@ -780,6 +780,10 @@ print_graph_entry_leaf(struct trace_iterator *iter,
+ 
+ 		cpu_data = per_cpu_ptr(data->cpu_data, cpu);
+ 
++		/* If a graph tracer ignored set_graph_notrace */
++		if (call->depth < -1)
++			call->depth += FTRACE_NOTRACE_DEPTH;
++
+ 		/*
+ 		 * Comments display at + 1 to depth. Since
+ 		 * this is a leaf function, keep the comments
+@@ -788,7 +792,8 @@ print_graph_entry_leaf(struct trace_iterator *iter,
+ 		cpu_data->depth = call->depth - 1;
+ 
+ 		/* No need to keep this function around for this depth */
+-		if (call->depth < FTRACE_RETFUNC_DEPTH)
++		if (call->depth < FTRACE_RETFUNC_DEPTH &&
++		    !WARN_ON_ONCE(call->depth < 0))
+ 			cpu_data->enter_funcs[call->depth] = 0;
+ 	}
+ 
+@@ -818,11 +823,16 @@ print_graph_entry_nested(struct trace_iterator *iter,
+ 		struct fgraph_cpu_data *cpu_data;
+ 		int cpu = iter->cpu;
+ 
++		/* If a graph tracer ignored set_graph_notrace */
++		if (call->depth < -1)
++			call->depth += FTRACE_NOTRACE_DEPTH;
++
+ 		cpu_data = per_cpu_ptr(data->cpu_data, cpu);
+ 		cpu_data->depth = call->depth;
+ 
+ 		/* Save this function pointer to see if the exit matches */
+-		if (call->depth < FTRACE_RETFUNC_DEPTH)
++		if (call->depth < FTRACE_RETFUNC_DEPTH &&
++		    !WARN_ON_ONCE(call->depth < 0))
+ 			cpu_data->enter_funcs[call->depth] = call->func;
+ 	}
+ 
+@@ -1052,7 +1062,8 @@ print_graph_return(struct ftrace_graph_ret *trace, struct trace_seq *s,
+ 		 */
+ 		cpu_data->depth = trace->depth - 1;
+ 
+-		if (trace->depth < FTRACE_RETFUNC_DEPTH) {
++		if (trace->depth < FTRACE_RETFUNC_DEPTH &&
++		    !WARN_ON_ONCE(trace->depth < 0)) {
+ 			if (cpu_data->enter_funcs[trace->depth] != trace->func)
+ 				func_match = 0;
+ 			cpu_data->enter_funcs[trace->depth] = 0;
+diff --git a/net/ceph/messenger.c b/net/ceph/messenger.c
+index a550289..2efb335 100644
+--- a/net/ceph/messenger.c
++++ b/net/ceph/messenger.c
+@@ -2027,6 +2027,19 @@ static int process_connect(struct ceph_connection *con)
+ 
+ 	dout("process_connect on %p tag %d\n", con, (int)con->in_tag);
+ 
++	if (con->auth_reply_buf) {
++		/*
++		 * Any connection that defines ->get_authorizer()
++		 * should also define ->verify_authorizer_reply().
++		 * See get_connect_authorizer().
++		 */
++		ret = con->ops->verify_authorizer_reply(con, 0);
++		if (ret < 0) {
++			con->error_msg = "bad authorize reply";
++			return ret;
++		}
++	}
++
+ 	switch (con->in_reply.tag) {
+ 	case CEPH_MSGR_TAG_FEATURES:
+ 		pr_err("%s%lld %s feature set mismatch,"
+diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
+index 8d426f6..b2e3c32 100644
+--- a/net/mac80211/mlme.c
++++ b/net/mac80211/mlme.c
+@@ -2506,7 +2506,7 @@ static void ieee80211_destroy_auth_data(struct ieee80211_sub_if_data *sdata,
+ }
+ 
+ static void ieee80211_destroy_assoc_data(struct ieee80211_sub_if_data *sdata,
+-					 bool assoc)
++					 bool assoc, bool abandon)
+ {
+ 	struct ieee80211_mgd_assoc_data *assoc_data = sdata->u.mgd.assoc_data;
+ 
+@@ -2529,6 +2529,9 @@ static void ieee80211_destroy_assoc_data(struct ieee80211_sub_if_data *sdata,
+ 		mutex_lock(&sdata->local->mtx);
+ 		ieee80211_vif_release_channel(sdata);
+ 		mutex_unlock(&sdata->local->mtx);
++
++		if (abandon)
++			cfg80211_abandon_assoc(sdata->dev, assoc_data->bss);
+ 	}
+ 
+ 	kfree(assoc_data);
+@@ -2758,7 +2761,7 @@ static void ieee80211_rx_mgmt_deauth(struct ieee80211_sub_if_data *sdata,
+ 			   bssid, reason_code,
+ 			   ieee80211_get_reason_code_string(reason_code));
+ 
+-		ieee80211_destroy_assoc_data(sdata, false);
++		ieee80211_destroy_assoc_data(sdata, false, true);
+ 
+ 		cfg80211_rx_mlme_mgmt(sdata->dev, (u8 *)mgmt, len);
+ 		return;
+@@ -3163,14 +3166,14 @@ static void ieee80211_rx_mgmt_assoc_resp(struct ieee80211_sub_if_data *sdata,
+ 	if (status_code != WLAN_STATUS_SUCCESS) {
+ 		sdata_info(sdata, "%pM denied association (code=%d)\n",
+ 			   mgmt->sa, status_code);
+-		ieee80211_destroy_assoc_data(sdata, false);
++		ieee80211_destroy_assoc_data(sdata, false, false);
+ 		event.u.mlme.status = MLME_DENIED;
+ 		event.u.mlme.reason = status_code;
+ 		drv_event_callback(sdata->local, sdata, &event);
+ 	} else {
+ 		if (!ieee80211_assoc_success(sdata, bss, mgmt, len)) {
+ 			/* oops -- internal error -- send timeout for now */
+-			ieee80211_destroy_assoc_data(sdata, false);
++			ieee80211_destroy_assoc_data(sdata, false, false);
+ 			cfg80211_assoc_timeout(sdata->dev, bss);
+ 			return;
+ 		}
+@@ -3183,7 +3186,7 @@ static void ieee80211_rx_mgmt_assoc_resp(struct ieee80211_sub_if_data *sdata,
+ 		 * recalc after assoc_data is NULL but before associated
+ 		 * is set can cause the interface to go idle
+ 		 */
+-		ieee80211_destroy_assoc_data(sdata, true);
++		ieee80211_destroy_assoc_data(sdata, true, false);
+ 
+ 		/* get uapsd queues configuration */
+ 		uapsd_queues = 0;
+@@ -3882,7 +3885,7 @@ void ieee80211_sta_work(struct ieee80211_sub_if_data *sdata)
+ 				.u.mlme.status = MLME_TIMEOUT,
+ 			};
+ 
+-			ieee80211_destroy_assoc_data(sdata, false);
++			ieee80211_destroy_assoc_data(sdata, false, false);
+ 			cfg80211_assoc_timeout(sdata->dev, bss);
+ 			drv_event_callback(sdata->local, sdata, &event);
+ 		}
+@@ -4021,7 +4024,7 @@ void ieee80211_mgd_quiesce(struct ieee80211_sub_if_data *sdata)
+ 					       WLAN_REASON_DEAUTH_LEAVING,
+ 					       false, frame_buf);
+ 		if (ifmgd->assoc_data)
+-			ieee80211_destroy_assoc_data(sdata, false);
++			ieee80211_destroy_assoc_data(sdata, false, true);
+ 		if (ifmgd->auth_data)
+ 			ieee80211_destroy_auth_data(sdata, false);
+ 		cfg80211_tx_mlme_mgmt(sdata->dev, frame_buf,
+@@ -4903,7 +4906,7 @@ int ieee80211_mgd_deauth(struct ieee80211_sub_if_data *sdata,
+ 					       IEEE80211_STYPE_DEAUTH,
+ 					       req->reason_code, tx,
+ 					       frame_buf);
+-		ieee80211_destroy_assoc_data(sdata, false);
++		ieee80211_destroy_assoc_data(sdata, false, true);
+ 		ieee80211_report_disconnect(sdata, frame_buf,
+ 					    sizeof(frame_buf), true,
+ 					    req->reason_code);
+@@ -4978,7 +4981,7 @@ void ieee80211_mgd_stop(struct ieee80211_sub_if_data *sdata)
+ 	sdata_lock(sdata);
+ 	if (ifmgd->assoc_data) {
+ 		struct cfg80211_bss *bss = ifmgd->assoc_data->bss;
+-		ieee80211_destroy_assoc_data(sdata, false);
++		ieee80211_destroy_assoc_data(sdata, false, false);
+ 		cfg80211_assoc_timeout(sdata->dev, bss);
+ 	}
+ 	if (ifmgd->auth_data)
+diff --git a/net/sunrpc/auth_gss/auth_gss.c b/net/sunrpc/auth_gss/auth_gss.c
+index 976c781..a0110c2 100644
+--- a/net/sunrpc/auth_gss/auth_gss.c
++++ b/net/sunrpc/auth_gss/auth_gss.c
+@@ -541,9 +541,13 @@ gss_setup_upcall(struct gss_auth *gss_auth, struct rpc_cred *cred)
+ 		return gss_new;
+ 	gss_msg = gss_add_msg(gss_new);
+ 	if (gss_msg == gss_new) {
+-		int res = rpc_queue_upcall(gss_new->pipe, &gss_new->msg);
++		int res;
++		atomic_inc(&gss_msg->count);
++		res = rpc_queue_upcall(gss_new->pipe, &gss_new->msg);
+ 		if (res) {
+ 			gss_unhash_msg(gss_new);
++			atomic_dec(&gss_msg->count);
++			gss_release_msg(gss_new);
+ 			gss_msg = ERR_PTR(res);
+ 		}
+ 	} else
+@@ -836,6 +840,7 @@ gss_pipe_destroy_msg(struct rpc_pipe_msg *msg)
+ 			warn_gssd();
+ 		gss_release_msg(gss_msg);
+ 	}
++	gss_release_msg(gss_msg);
+ }
+ 
+ static void gss_pipe_dentry_destroy(struct dentry *dir,
+diff --git a/net/vmw_vsock/virtio_transport_common.c b/net/vmw_vsock/virtio_transport_common.c
+index a53b3a1..62c056e 100644
+--- a/net/vmw_vsock/virtio_transport_common.c
++++ b/net/vmw_vsock/virtio_transport_common.c
+@@ -606,9 +606,9 @@ static int virtio_transport_reset_no_sock(struct virtio_vsock_pkt *pkt)
+ 		return 0;
+ 
+ 	pkt = virtio_transport_alloc_pkt(&info, 0,
+-					 le32_to_cpu(pkt->hdr.dst_cid),
++					 le64_to_cpu(pkt->hdr.dst_cid),
+ 					 le32_to_cpu(pkt->hdr.dst_port),
+-					 le32_to_cpu(pkt->hdr.src_cid),
++					 le64_to_cpu(pkt->hdr.src_cid),
+ 					 le32_to_cpu(pkt->hdr.src_port));
+ 	if (!pkt)
+ 		return -ENOMEM;
+@@ -823,7 +823,7 @@ virtio_transport_send_response(struct vsock_sock *vsk,
+ 	struct virtio_vsock_pkt_info info = {
+ 		.op = VIRTIO_VSOCK_OP_RESPONSE,
+ 		.type = VIRTIO_VSOCK_TYPE_STREAM,
+-		.remote_cid = le32_to_cpu(pkt->hdr.src_cid),
++		.remote_cid = le64_to_cpu(pkt->hdr.src_cid),
+ 		.remote_port = le32_to_cpu(pkt->hdr.src_port),
+ 		.reply = true,
+ 	};
+@@ -863,9 +863,9 @@ virtio_transport_recv_listen(struct sock *sk, struct virtio_vsock_pkt *pkt)
+ 	child->sk_state = SS_CONNECTED;
+ 
+ 	vchild = vsock_sk(child);
+-	vsock_addr_init(&vchild->local_addr, le32_to_cpu(pkt->hdr.dst_cid),
++	vsock_addr_init(&vchild->local_addr, le64_to_cpu(pkt->hdr.dst_cid),
+ 			le32_to_cpu(pkt->hdr.dst_port));
+-	vsock_addr_init(&vchild->remote_addr, le32_to_cpu(pkt->hdr.src_cid),
++	vsock_addr_init(&vchild->remote_addr, le64_to_cpu(pkt->hdr.src_cid),
+ 			le32_to_cpu(pkt->hdr.src_port));
+ 
+ 	vsock_insert_connected(vchild);
+@@ -904,9 +904,9 @@ void virtio_transport_recv_pkt(struct virtio_vsock_pkt *pkt)
+ 	struct sock *sk;
+ 	bool space_available;
+ 
+-	vsock_addr_init(&src, le32_to_cpu(pkt->hdr.src_cid),
++	vsock_addr_init(&src, le64_to_cpu(pkt->hdr.src_cid),
+ 			le32_to_cpu(pkt->hdr.src_port));
+-	vsock_addr_init(&dst, le32_to_cpu(pkt->hdr.dst_cid),
++	vsock_addr_init(&dst, le64_to_cpu(pkt->hdr.dst_cid),
+ 			le32_to_cpu(pkt->hdr.dst_port));
+ 
+ 	trace_virtio_transport_recv_pkt(src.svm_cid, src.svm_port,
+diff --git a/net/wireless/core.h b/net/wireless/core.h
+index 66f2a11..b5cf218 100644
+--- a/net/wireless/core.h
++++ b/net/wireless/core.h
+@@ -410,6 +410,7 @@ void cfg80211_sme_disassoc(struct wireless_dev *wdev);
+ void cfg80211_sme_deauth(struct wireless_dev *wdev);
+ void cfg80211_sme_auth_timeout(struct wireless_dev *wdev);
+ void cfg80211_sme_assoc_timeout(struct wireless_dev *wdev);
++void cfg80211_sme_abandon_assoc(struct wireless_dev *wdev);
+ 
+ /* internal helpers */
+ bool cfg80211_supported_cipher_suite(struct wiphy *wiphy, u32 cipher);
+diff --git a/net/wireless/mlme.c b/net/wireless/mlme.c
+index c284d88..2a62ef6 100644
+--- a/net/wireless/mlme.c
++++ b/net/wireless/mlme.c
+@@ -149,6 +149,18 @@ void cfg80211_assoc_timeout(struct net_device *dev, struct cfg80211_bss *bss)
+ }
+ EXPORT_SYMBOL(cfg80211_assoc_timeout);
+ 
++void cfg80211_abandon_assoc(struct net_device *dev, struct cfg80211_bss *bss)
++{
++	struct wireless_dev *wdev = dev->ieee80211_ptr;
++	struct wiphy *wiphy = wdev->wiphy;
++
++	cfg80211_sme_abandon_assoc(wdev);
++
++	cfg80211_unhold_bss(bss_from_pub(bss));
++	cfg80211_put_bss(wiphy, bss);
++}
++EXPORT_SYMBOL(cfg80211_abandon_assoc);
++
+ void cfg80211_tx_mlme_mgmt(struct net_device *dev, const u8 *buf, size_t len)
+ {
+ 	struct wireless_dev *wdev = dev->ieee80211_ptr;
+diff --git a/net/wireless/sme.c b/net/wireless/sme.c
+index add6824..95c713c 100644
+--- a/net/wireless/sme.c
++++ b/net/wireless/sme.c
+@@ -39,6 +39,7 @@ struct cfg80211_conn {
+ 		CFG80211_CONN_ASSOCIATING,
+ 		CFG80211_CONN_ASSOC_FAILED,
+ 		CFG80211_CONN_DEAUTH,
++		CFG80211_CONN_ABANDON,
+ 		CFG80211_CONN_CONNECTED,
+ 	} state;
+ 	u8 bssid[ETH_ALEN], prev_bssid[ETH_ALEN];
+@@ -206,6 +207,8 @@ static int cfg80211_conn_do_work(struct wireless_dev *wdev)
+ 		cfg80211_mlme_deauth(rdev, wdev->netdev, params->bssid,
+ 				     NULL, 0,
+ 				     WLAN_REASON_DEAUTH_LEAVING, false);
++		/* fall through */
++	case CFG80211_CONN_ABANDON:
+ 		/* free directly, disconnected event already sent */
+ 		cfg80211_sme_free(wdev);
+ 		return 0;
+@@ -423,6 +426,17 @@ void cfg80211_sme_assoc_timeout(struct wireless_dev *wdev)
+ 	schedule_work(&rdev->conn_work);
+ }
+ 
++void cfg80211_sme_abandon_assoc(struct wireless_dev *wdev)
++{
++	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
++
++	if (!wdev->conn)
++		return;
++
++	wdev->conn->state = CFG80211_CONN_ABANDON;
++	schedule_work(&rdev->conn_work);
++}
++
+ static int cfg80211_sme_get_conn_ies(struct wireless_dev *wdev,
+ 				     const u8 *ies, size_t ies_len,
+ 				     const u8 **out_ies, size_t *out_ies_len)
+diff --git a/scripts/kconfig/nconf.gui.c b/scripts/kconfig/nconf.gui.c
+index 8275f0e5..4b2f44c 100644
+--- a/scripts/kconfig/nconf.gui.c
++++ b/scripts/kconfig/nconf.gui.c
+@@ -364,12 +364,14 @@ int dialog_inputbox(WINDOW *main_window,
+ 	WINDOW *prompt_win;
+ 	WINDOW *form_win;
+ 	PANEL *panel;
+-	int i, x, y;
++	int i, x, y, lines, columns, win_lines, win_cols;
+ 	int res = -1;
+ 	int cursor_position = strlen(init);
+ 	int cursor_form_win;
+ 	char *result = *resultp;
+ 
++	getmaxyx(stdscr, lines, columns);
++
+ 	if (strlen(init)+1 > *result_len) {
+ 		*result_len = strlen(init)+1;
+ 		*resultp = result = realloc(result, *result_len);
+@@ -386,14 +388,19 @@ int dialog_inputbox(WINDOW *main_window,
+ 	if (title)
+ 		prompt_width = max(prompt_width, strlen(title));
+ 
++	win_lines = min(prompt_lines+6, lines-2);
++	win_cols = min(prompt_width+7, columns-2);
++	prompt_lines = max(win_lines-6, 0);
++	prompt_width = max(win_cols-7, 0);
++
+ 	/* place dialog in middle of screen */
+-	y = (getmaxy(stdscr)-(prompt_lines+4))/2;
+-	x = (getmaxx(stdscr)-(prompt_width+4))/2;
++	y = (lines-win_lines)/2;
++	x = (columns-win_cols)/2;
+ 
+ 	strncpy(result, init, *result_len);
+ 
+ 	/* create the windows */
+-	win = newwin(prompt_lines+6, prompt_width+7, y, x);
++	win = newwin(win_lines, win_cols, y, x);
+ 	prompt_win = derwin(win, prompt_lines+1, prompt_width, 2, 2);
+ 	form_win = derwin(win, 1, prompt_width, prompt_lines+3, 2);
+ 	keypad(form_win, TRUE);
diff --git a/4.8.16/4420_grsecurity-3.1-4.8.16-201701062021.patch b/4.8.17/4420_grsecurity-3.1-4.8.17-201701090823.patch
index e3d42d6..2dc50ac 100644
--- a/4.8.16/4420_grsecurity-3.1-4.8.16-201701062021.patch
+++ b/4.8.17/4420_grsecurity-3.1-4.8.17-201701090823.patch
@@ -407,7 +407,7 @@ index ffab8b5..b8fcd61 100644
  
  A toggle value indicating if modules are allowed to be loaded
 diff --git a/Makefile b/Makefile
-index 50f6864..90fa89a 100644
+index ace32d3..f21d750 100644
 --- a/Makefile
 +++ b/Makefile
 @@ -302,7 +302,9 @@ CONFIG_SHELL := $(shell if [ -x "$$BASH" ]; then echo $$BASH; \
@@ -16890,7 +16890,7 @@ index 1433f6b..dac4cbe 100644
  		) {
  
 diff --git a/arch/x86/entry/entry_32.S b/arch/x86/entry/entry_32.S
-index 0b56666..92043f9 100644
+index b84a349..7ed55b6 100644
 --- a/arch/x86/entry/entry_32.S
 +++ b/arch/x86/entry/entry_32.S
 @@ -147,13 +147,157 @@
@@ -17401,8 +17401,8 @@ index 0b56666..92043f9 100644
  ENTRY(ftrace_caller)
  	pushl	%eax
 @@ -855,7 +1082,7 @@ ftrace_graph_call:
- .globl ftrace_stub
- ftrace_stub:
+ /* This is weak to keep gas from relaxing the jumps */
+ WEAK(ftrace_stub)
  	ret
 -END(ftrace_caller)
 +ENDPROC(ftrace_caller)
@@ -19051,10 +19051,10 @@ index b28200d..e93e14d 100644
  
  	while (amd_iommu_v2_event_descs[i].attr.attr.name)
 diff --git a/arch/x86/events/core.c b/arch/x86/events/core.c
-index 8c925ec..287eaab 100644
+index 7b0f1d9..09c8710 100644
 --- a/arch/x86/events/core.c
 +++ b/arch/x86/events/core.c
-@@ -1545,7 +1545,7 @@ static void __init pmu_check_apic(void)
+@@ -1549,7 +1549,7 @@ static void __init pmu_check_apic(void)
  
  }
  
@@ -19063,7 +19063,7 @@ index 8c925ec..287eaab 100644
  	.name = "format",
  	.attrs = NULL,
  };
-@@ -1676,7 +1676,7 @@ static struct attribute *events_attr[] = {
+@@ -1680,7 +1680,7 @@ static struct attribute *events_attr[] = {
  	NULL,
  };
  
@@ -19072,7 +19072,7 @@ index 8c925ec..287eaab 100644
  	.name = "events",
  	.attrs = events_attr,
  };
-@@ -2313,7 +2313,7 @@ static unsigned long get_segment_base(unsigned int segment)
+@@ -2317,7 +2317,7 @@ static unsigned long get_segment_base(unsigned int segment)
  		if (idx > GDT_ENTRIES)
  			return 0;
  
@@ -19081,7 +19081,7 @@ index 8c925ec..287eaab 100644
  	}
  
  	return get_desc_base(desc);
-@@ -2413,7 +2413,7 @@ perf_callchain_user(struct perf_callchain_entry_ctx *entry, struct pt_regs *regs
+@@ -2417,7 +2417,7 @@ perf_callchain_user(struct perf_callchain_entry_ctx *entry, struct pt_regs *regs
  			break;
  
  		perf_callchain_store(entry, frame.return_address);
@@ -19236,7 +19236,7 @@ index 8f82b02..b10c4b0 100644
  	ret = perf_pmu_register(&intel_cqm_pmu, "intel_cqm", -1);
  	if (ret) {
 diff --git a/arch/x86/events/intel/cstate.c b/arch/x86/events/intel/cstate.c
-index 3ca87b5..207a386 100644
+index 834262a..a1fc484 100644
 --- a/arch/x86/events/intel/cstate.c
 +++ b/arch/x86/events/intel/cstate.c
 @@ -95,14 +95,14 @@
@@ -19494,7 +19494,7 @@ index 78b9c23..2f5c61e 100644
  
  static inline unsigned uncore_pci_box_ctl(struct intel_uncore_box *box)
 diff --git a/arch/x86/events/perf_event.h b/arch/x86/events/perf_event.h
-index 181c238..5634d77 100644
+index 4ab002d..5a30205 100644
 --- a/arch/x86/events/perf_event.h
 +++ b/arch/x86/events/perf_event.h
 @@ -801,7 +801,7 @@ static inline void set_linear_ip(struct pt_regs *regs, unsigned long ip)
@@ -32997,7 +32997,7 @@ index af523d8..ba7da48 100644
  	.disabled_by_bios = is_disabled,
  	.hardware_setup = svm_hardware_setup,
 diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
-index 5cede40..f932797 100644
+index 7a72db5..b5f6032 100644
 --- a/arch/x86/kvm/vmx.c
 +++ b/arch/x86/kvm/vmx.c
 @@ -1666,14 +1666,14 @@ static __always_inline void vmcs_writel(unsigned long field, unsigned long value
@@ -33102,7 +33102,7 @@ index 5cede40..f932797 100644
  	}
  
  	if (cpu_has_vmx_preemption_timer() && enable_preemption_timer) {
-@@ -8890,6 +8909,12 @@ static void __noclone vmx_vcpu_run(struct kvm_vcpu *vcpu)
+@@ -8889,6 +8908,12 @@ static void __noclone vmx_vcpu_run(struct kvm_vcpu *vcpu)
  		"jmp 2f \n\t"
  		"1: " __ex(ASM_VMX_VMRESUME) "\n\t"
  		"2: "
@@ -33115,7 +33115,7 @@ index 5cede40..f932797 100644
  		/* Save guest registers, load host registers, keep flags */
  		"mov %0, %c[wordsize](%%" _ASM_SP ") \n\t"
  		"pop %0 \n\t"
-@@ -8942,6 +8967,11 @@ static void __noclone vmx_vcpu_run(struct kvm_vcpu *vcpu)
+@@ -8941,6 +8966,11 @@ static void __noclone vmx_vcpu_run(struct kvm_vcpu *vcpu)
  #endif
  		[cr2]"i"(offsetof(struct vcpu_vmx, vcpu.arch.cr2)),
  		[wordsize]"i"(sizeof(ulong))
@@ -33127,7 +33127,7 @@ index 5cede40..f932797 100644
  	      : "cc", "memory"
  #ifdef CONFIG_X86_64
  		, "rax", "rbx", "rdi", "rsi"
-@@ -8955,7 +8985,7 @@ static void __noclone vmx_vcpu_run(struct kvm_vcpu *vcpu)
+@@ -8954,7 +8984,7 @@ static void __noclone vmx_vcpu_run(struct kvm_vcpu *vcpu)
  	if (debugctlmsr)
  		update_debugctlmsr(debugctlmsr);
  
@@ -33136,7 +33136,7 @@ index 5cede40..f932797 100644
  	/*
  	 * The sysexit path does not restore ds/es, so we must set them to
  	 * a reasonable value ourselves.
-@@ -8964,8 +8994,18 @@ static void __noclone vmx_vcpu_run(struct kvm_vcpu *vcpu)
+@@ -8963,8 +8993,18 @@ static void __noclone vmx_vcpu_run(struct kvm_vcpu *vcpu)
  	 * may be executed in interrupt context, which saves and restore segments
  	 * around it, nullifying its effect.
  	 */
@@ -33157,7 +33157,7 @@ index 5cede40..f932797 100644
  #endif
  
  	vcpu->arch.regs_avail = ~((1 << VCPU_REGS_RIP) | (1 << VCPU_REGS_RSP)
-@@ -11177,7 +11217,7 @@ static void vmx_setup_mce(struct kvm_vcpu *vcpu)
+@@ -11176,7 +11216,7 @@ static void vmx_setup_mce(struct kvm_vcpu *vcpu)
  			~FEATURE_CONTROL_LMCE;
  }
  
@@ -41913,7 +41913,7 @@ index f4ebe39..f937534 100644
  	 * Award BIOS on this AOpen makes thermal control almost worthless.
  	 * http://bugzilla.kernel.org/show_bug.cgi?id=8842
 diff --git a/drivers/acpi/video_detect.c b/drivers/acpi/video_detect.c
-index a6b36fc53..dc320a6 100644
+index 02ded25..ff23e2d 100644
 --- a/drivers/acpi/video_detect.c
 +++ b/drivers/acpi/video_detect.c
 @@ -41,7 +41,6 @@ ACPI_MODULE_NAME("video");
@@ -41924,7 +41924,7 @@ index a6b36fc53..dc320a6 100644
  static struct work_struct backlight_notify_work;
  
  static enum acpi_backlight_type acpi_backlight_cmdline = acpi_backlight_undef;
-@@ -319,6 +318,10 @@ static int acpi_video_backlight_notify(struct notifier_block *nb,
+@@ -339,6 +338,10 @@ static int acpi_video_backlight_notify(struct notifier_block *nb,
  	return NOTIFY_OK;
  }
  
@@ -41935,7 +41935,7 @@ index a6b36fc53..dc320a6 100644
  /*
   * Determine which type of backlight interface to use on this system,
   * First check cmdline, then dmi quirks, then do autodetect.
-@@ -349,8 +352,6 @@ enum acpi_backlight_type acpi_video_get_backlight_type(void)
+@@ -369,8 +372,6 @@ enum acpi_backlight_type acpi_video_get_backlight_type(void)
  				    &video_caps, NULL);
  		INIT_WORK(&backlight_notify_work,
  			  acpi_video_backlight_notify_work);
@@ -45004,10 +45004,10 @@ index 4aae0d2..3d84db8 100644
  
  static void resize_console(struct port *port)
 diff --git a/drivers/clk/bcm/clk-bcm2835.c b/drivers/clk/bcm/clk-bcm2835.c
-index 0fc71cb..225b0c0 100644
+index 3250694..ab0e01e 100644
 --- a/drivers/clk/bcm/clk-bcm2835.c
 +++ b/drivers/clk/bcm/clk-bcm2835.c
-@@ -1145,8 +1145,9 @@ static const struct clk_ops bcm2835_vpu_clock_clk_ops = {
+@@ -1147,8 +1147,9 @@ static const struct clk_ops bcm2835_vpu_clock_clk_ops = {
  };
  
  static struct clk *bcm2835_register_pll(struct bcm2835_cprman *cprman,
@@ -45018,7 +45018,7 @@ index 0fc71cb..225b0c0 100644
  	struct bcm2835_pll *pll;
  	struct clk_init_data init;
  
-@@ -1172,8 +1173,9 @@ static struct clk *bcm2835_register_pll(struct bcm2835_cprman *cprman,
+@@ -1174,8 +1175,9 @@ static struct clk *bcm2835_register_pll(struct bcm2835_cprman *cprman,
  
  static struct clk *
  bcm2835_register_pll_divider(struct bcm2835_cprman *cprman,
@@ -45029,7 +45029,7 @@ index 0fc71cb..225b0c0 100644
  	struct bcm2835_pll_divider *divider;
  	struct clk_init_data init;
  	struct clk *clk;
-@@ -1231,8 +1233,9 @@ bcm2835_register_pll_divider(struct bcm2835_cprman *cprman,
+@@ -1233,8 +1235,9 @@ bcm2835_register_pll_divider(struct bcm2835_cprman *cprman,
  }
  
  static struct clk *bcm2835_register_clock(struct bcm2835_cprman *cprman,
@@ -45040,7 +45040,7 @@ index 0fc71cb..225b0c0 100644
  	struct bcm2835_clock *clock;
  	struct clk_init_data init;
  	const char *parents[1 << CM_SRC_BITS];
-@@ -1274,8 +1277,10 @@ static struct clk *bcm2835_register_clock(struct bcm2835_cprman *cprman,
+@@ -1276,8 +1279,10 @@ static struct clk *bcm2835_register_clock(struct bcm2835_cprman *cprman,
  }
  
  static struct clk *bcm2835_register_gate(struct bcm2835_cprman *cprman,
@@ -45052,7 +45052,7 @@ index 0fc71cb..225b0c0 100644
  	return clk_register_gate(cprman->dev, data->name, data->parent,
  				 CLK_IGNORE_UNUSED | CLK_SET_RATE_GATE,
  				 cprman->regs + data->ctl_reg,
-@@ -1290,8 +1295,7 @@ struct bcm2835_clk_desc {
+@@ -1292,8 +1297,7 @@ struct bcm2835_clk_desc {
  };
  
  /* assignment helper macros for different clock types */
@@ -46670,10 +46670,10 @@ index ac8deb0..f3caa10 100644
  	return -EINVAL;
  }
 diff --git a/drivers/gpio/gpiolib.c b/drivers/gpio/gpiolib.c
-index 15704aa..623f140 100644
+index a8eea8a..d131bfd 100644
 --- a/drivers/gpio/gpiolib.c
 +++ b/drivers/gpio/gpiolib.c
-@@ -1631,8 +1631,10 @@ static void gpiochip_irqchip_remove(struct gpio_chip *gpiochip)
+@@ -1632,8 +1632,10 @@ static void gpiochip_irqchip_remove(struct gpio_chip *gpiochip)
  	}
  
  	if (gpiochip->irqchip) {
@@ -46686,7 +46686,7 @@ index 15704aa..623f140 100644
  		gpiochip->irqchip = NULL;
  	}
  }
-@@ -1709,8 +1711,10 @@ int _gpiochip_irqchip_add(struct gpio_chip *gpiochip,
+@@ -1710,8 +1712,10 @@ int _gpiochip_irqchip_add(struct gpio_chip *gpiochip,
  	 */
  	if (!irqchip->irq_request_resources &&
  	    !irqchip->irq_release_resources) {
@@ -48274,7 +48274,7 @@ index 8b2eb32..78566a8 100644
  {
  	if (mode->clock > 165000)
 diff --git a/drivers/gpu/drm/gma500/psb_drv.c b/drivers/gpu/drm/gma500/psb_drv.c
-index 50eb944f..93904f6 100644
+index 8f3ca52..b341aa8 100644
 --- a/drivers/gpu/drm/gma500/psb_drv.c
 +++ b/drivers/gpu/drm/gma500/psb_drv.c
 @@ -373,7 +373,6 @@ static int psb_driver_load(struct drm_device *dev, unsigned long flags)
@@ -48670,10 +48670,10 @@ index 1c2aec3..f807515 100644
  
  /**
 diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
-index 35d385d..7ed8f57 100644
+index 6bc93ba..57e0fa9 100644
 --- a/drivers/gpu/drm/i915/intel_display.c
 +++ b/drivers/gpu/drm/i915/intel_display.c
-@@ -15593,13 +15593,13 @@ struct intel_quirk {
+@@ -15595,13 +15595,13 @@ struct intel_quirk {
  	int subsystem_vendor;
  	int subsystem_device;
  	void (*hook)(struct drm_device *dev);
@@ -48690,7 +48690,7 @@ index 35d385d..7ed8f57 100644
  
  static int intel_dmi_reverse_brightness(const struct dmi_system_id *id)
  {
-@@ -15607,18 +15607,20 @@ static int intel_dmi_reverse_brightness(const struct dmi_system_id *id)
+@@ -15609,18 +15609,20 @@ static int intel_dmi_reverse_brightness(const struct dmi_system_id *id)
  	return 1;
  }
  
@@ -48721,7 +48721,7 @@ index 35d385d..7ed8f57 100644
  		.hook = quirk_invert_brightness,
  	},
  };
-@@ -15701,7 +15703,7 @@ static void intel_init_quirks(struct drm_device *dev)
+@@ -15703,7 +15705,7 @@ static void intel_init_quirks(struct drm_device *dev)
  			q->hook(dev);
  	}
  	for (i = 0; i < ARRAY_SIZE(intel_dmi_quirks); i++) {
@@ -48979,10 +48979,10 @@ index 193573d..3f62e53 100644
  	/* easy option one - intel vendor ID means Integrated */
  	if (pdev->vendor == PCI_VENDOR_ID_INTEL)
 diff --git a/drivers/gpu/drm/nouveau/nouveau_bios.c b/drivers/gpu/drm/nouveau/nouveau_bios.c
-index a1570b1..0e3c08c 100644
+index 23ffe85..f87a82d 100644
 --- a/drivers/gpu/drm/nouveau/nouveau_bios.c
 +++ b/drivers/gpu/drm/nouveau/nouveau_bios.c
-@@ -964,7 +964,7 @@ static int parse_bit_tmds_tbl_entry(struct drm_device *dev, struct nvbios *bios,
+@@ -967,7 +967,7 @@ static int parse_bit_tmds_tbl_entry(struct drm_device *dev, struct nvbios *bios,
  struct bit_table {
  	const char id;
  	int (* const parse_fn)(struct drm_device *, struct nvbios *, struct bit_entry *);
@@ -49143,10 +49143,10 @@ index c6a180a..c5c7855 100644
  
  static const struct vga_switcheroo_client_ops
 diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/bios/shadow.c b/drivers/gpu/drm/nouveau/nvkm/subdev/bios/shadow.c
-index b2557e8..2d4f9f4 100644
+index 7deb81b..bb22bc2 100644
 --- a/drivers/gpu/drm/nouveau/nvkm/subdev/bios/shadow.c
 +++ b/drivers/gpu/drm/nouveau/nvkm/subdev/bios/shadow.c
-@@ -151,11 +151,16 @@ shadow_fw_init(struct nvkm_bios *bios, const char *name)
+@@ -154,11 +154,16 @@ shadow_fw_init(struct nvkm_bios *bios, const char *name)
  	return (void *)fw;
  }
  
@@ -52871,7 +52871,7 @@ index 6abe1c6..f866a31 100644
  	struct qib_devdata *dd = pci_get_drvdata(pdev);
  	pci_ers_result_t ret = PCI_ERS_RESULT_RECOVERED;
 diff --git a/drivers/infiniband/sw/rxe/rxe_qp.c b/drivers/infiniband/sw/rxe/rxe_qp.c
-index f724a7e..18ffc45 100644
+index 979e445..bd9986e 100644
 --- a/drivers/infiniband/sw/rxe/rxe_qp.c
 +++ b/drivers/infiniband/sw/rxe/rxe_qp.c
 @@ -219,7 +219,7 @@ static void rxe_qp_init_misc(struct rxe_dev *rxe, struct rxe_qp *qp,
@@ -58105,7 +58105,7 @@ index 39fddda..be1dd54 100644
  		for (i = 0; i < conf->copies; i++) {
  			int d = r10_bio->devs[i].devnum;
 diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
-index ee7fc37..d7efe3d 100644
+index a87549b..da197af 100644
 --- a/drivers/md/raid5.c
 +++ b/drivers/md/raid5.c
 @@ -1120,23 +1120,23 @@ async_copy_data(int frombio, struct bio *bio, struct page **page,
@@ -58548,7 +58548,7 @@ index 8c84846..27b4f83 100644
  			p2m_id = -p2m_id;
  	}
 diff --git a/drivers/media/pci/solo6x10/solo6x10.h b/drivers/media/pci/solo6x10/solo6x10.h
-index 5bd4987..bfcdd17 100644
+index 3f8da5e..b1de8be 100644
 --- a/drivers/media/pci/solo6x10/solo6x10.h
 +++ b/drivers/media/pci/solo6x10/solo6x10.h
 @@ -216,7 +216,7 @@ struct solo_dev {
@@ -64621,10 +64621,10 @@ index d41c28d..ef80211 100644
  	struct mvneta_port *pp = netdev_priv(dev);
  	u16 txq_id = skb_get_queue_mapping(skb);
 diff --git a/drivers/net/ethernet/marvell/mvpp2.c b/drivers/net/ethernet/marvell/mvpp2.c
-index 60227a3..160ba02 100644
+index 5588c56..d62eade 100644
 --- a/drivers/net/ethernet/marvell/mvpp2.c
 +++ b/drivers/net/ethernet/marvell/mvpp2.c
-@@ -5236,7 +5236,7 @@ error:
+@@ -5237,7 +5237,7 @@ error:
  }
  
  /* Main tx processing */
@@ -70347,7 +70347,7 @@ index c1397a6..82c223d 100644
  	u32 reg;
  
 diff --git a/drivers/net/wireless/realtek/rtlwifi/base.c b/drivers/net/wireless/realtek/rtlwifi/base.c
-index 264466f..ab69236 100644
+index 4ac928b..9832ba8 100644
 --- a/drivers/net/wireless/realtek/rtlwifi/base.c
 +++ b/drivers/net/wireless/realtek/rtlwifi/base.c
 @@ -467,15 +467,15 @@ static void _rtl_init_deferred_work(struct ieee80211_hw *hw)
@@ -70405,10 +70405,10 @@ index 74233d6..482e495 100644
  void rtl_get_tcb_desc(struct ieee80211_hw *hw,
  		      struct ieee80211_tx_info *info,
 diff --git a/drivers/net/wireless/realtek/rtlwifi/pci.c b/drivers/net/wireless/realtek/rtlwifi/pci.c
-index d12586d..d6f3388 100644
+index e538e23..9e24271 100644
 --- a/drivers/net/wireless/realtek/rtlwifi/pci.c
 +++ b/drivers/net/wireless/realtek/rtlwifi/pci.c
-@@ -1098,13 +1098,16 @@ done:
+@@ -1094,13 +1094,16 @@ done:
  	return ret;
  }
  
@@ -70427,7 +70427,7 @@ index d12586d..d6f3388 100644
  	struct rtl_priv *rtlpriv = rtl_priv(hw);
  	struct rtl_pci *rtlpci = rtl_pcidev(rtl_pcipriv(hw));
  	struct rtl_mac *mac = rtl_mac(rtl_priv(hw));
-@@ -1225,12 +1228,8 @@ static void _rtl_pci_init_struct(struct ieee80211_hw *hw,
+@@ -1221,12 +1224,8 @@ static void _rtl_pci_init_struct(struct ieee80211_hw *hw,
  	rtlpci->acm_method = EACMWAY2_SW;
  
  	/*task */
@@ -70443,7 +70443,7 @@ index d12586d..d6f3388 100644
  		  rtl_lps_change_work_callback);
  }
 diff --git a/drivers/net/wireless/realtek/rtlwifi/ps.c b/drivers/net/wireless/realtek/rtlwifi/ps.c
-index 9a64f9b..a7728e9 100644
+index 424e262..6b1ade8 100644
 --- a/drivers/net/wireless/realtek/rtlwifi/ps.c
 +++ b/drivers/net/wireless/realtek/rtlwifi/ps.c
 @@ -198,7 +198,7 @@ static void _rtl_ps_inactive_ps(struct ieee80211_hw *hw)
@@ -70455,7 +70455,7 @@ index 9a64f9b..a7728e9 100644
  {
  	struct rtl_works *rtlworks =
  	    container_of_dwork_rtl(data, struct rtl_works, ips_nic_off_wq);
-@@ -584,7 +584,7 @@ void rtl_swlps_rf_awake(struct ieee80211_hw *hw)
+@@ -582,7 +582,7 @@ void rtl_swlps_rf_awake(struct ieee80211_hw *hw)
  	spin_unlock_irqrestore(&rtlpriv->locks.lps_lock, flag);
  }
  
@@ -70464,9 +70464,9 @@ index 9a64f9b..a7728e9 100644
  {
  	struct rtl_works *rtlworks =
  	    container_of_dwork_rtl(data, struct rtl_works, ps_rfon_wq);
-@@ -676,7 +676,7 @@ void rtl_lps_change_work_callback(struct work_struct *work)
+@@ -696,7 +696,7 @@ void rtl_lps_leave(struct ieee80211_hw *hw)
  }
- EXPORT_SYMBOL_GPL(rtl_lps_change_work_callback);
+ EXPORT_SYMBOL_GPL(rtl_lps_leave);
  
 -void rtl_swlps_wq_callback(void *data)
 +void rtl_swlps_wq_callback(struct work_struct *data)
@@ -75900,7 +75900,7 @@ index c71344a..94f1f9e 100644
  	/* check if the device is still usable */
  	if (unlikely(cmd->device->sdev_state == SDEV_DEL)) {
 diff --git a/drivers/scsi/scsi_sysfs.c b/drivers/scsi/scsi_sysfs.c
-index 0734927..427833a 100644
+index 82dfe07..2b3eeae 100644
 --- a/drivers/scsi/scsi_sysfs.c
 +++ b/drivers/scsi/scsi_sysfs.c
 @@ -848,7 +848,7 @@ show_iostat_##field(struct device *dev, struct device_attribute *attr,	\
@@ -76068,10 +76068,10 @@ index d3e852a..5a04bed 100644
  	if (!sdp->request_queue->rq_timeout) {
  		if (sdp->type != TYPE_MOD)
 diff --git a/drivers/scsi/sg.c b/drivers/scsi/sg.c
-index ae7d9bd..77e1f04 100644
+index a1c29b0..4740ad32 100644
 --- a/drivers/scsi/sg.c
 +++ b/drivers/scsi/sg.c
-@@ -1090,7 +1090,7 @@ sg_ioctl(struct file *filp, unsigned int cmd_in, unsigned long arg)
+@@ -1093,7 +1093,7 @@ sg_ioctl(struct file *filp, unsigned int cmd_in, unsigned long arg)
  				       sdp->disk->disk_name,
  				       MKDEV(SCSI_GENERIC_MAJOR, sdp->index),
  				       NULL,
@@ -81934,7 +81934,7 @@ index c3f9d93..f81070c 100644
  	tty_port_tty_set(port, tty);
  
 diff --git a/drivers/tty/vt/keyboard.c b/drivers/tty/vt/keyboard.c
-index 0f8caae..07939b5 100644
+index ece10e6..1621e80 100644
 --- a/drivers/tty/vt/keyboard.c
 +++ b/drivers/tty/vt/keyboard.c
 @@ -630,6 +630,16 @@ static void k_spec(struct vc_data *vc, unsigned char value, char up_flag)
@@ -100518,7 +100518,7 @@ index 464a972..c889ed6 100644
  		for (i = 0; i < numnote; i++)
  			sz += notesize(notes + i);
 diff --git a/fs/block_dev.c b/fs/block_dev.c
-index b010242..922ff51 100644
+index 496d99b..f8cf029 100644
 --- a/fs/block_dev.c
 +++ b/fs/block_dev.c
 @@ -840,7 +840,7 @@ static bool bd_may_claim(struct block_device *bdev, struct block_device *whole,
@@ -149562,7 +149562,7 @@ index 667b933..1668952 100644
  		update_vsyscall_tz();
  		if (firsttime) {
 diff --git a/kernel/time/timekeeping.c b/kernel/time/timekeeping.c
-index 37dec7e..6a6ac85 100644
+index 46e312e..c96310f 100644
 --- a/kernel/time/timekeeping.c
 +++ b/kernel/time/timekeeping.c
 @@ -15,6 +15,7 @@
@@ -150316,7 +150316,7 @@ index f3a960e..f4ce9f9 100644
  
  static int hist_show(struct seq_file *m, void *v)
 diff --git a/kernel/trace/trace_functions_graph.c b/kernel/trace/trace_functions_graph.c
-index 7363ccf..807cbf1 100644
+index 16047a8..6ca9aaf 100644
 --- a/kernel/trace/trace_functions_graph.c
 +++ b/kernel/trace/trace_functions_graph.c
 @@ -138,7 +138,7 @@ ftrace_push_return_trace(unsigned long ret, unsigned long func, int *depth,
@@ -159070,7 +159070,7 @@ index bddfcf6..36880cd 100644
  #include <linux/module.h>
  #include <linux/mount.h>
 diff --git a/net/ceph/messenger.c b/net/ceph/messenger.c
-index a550289..218652a 100644
+index 2efb335..e8a499d 100644
 --- a/net/ceph/messenger.c
 +++ b/net/ceph/messenger.c
 @@ -187,7 +187,7 @@ static void con_fault(struct ceph_connection *con);
diff --git a/4.8.16/4425_grsec_remove_EI_PAX.patch b/4.8.17/4425_grsec_remove_EI_PAX.patch
index 594598a..594598a 100644
--- a/4.8.16/4425_grsec_remove_EI_PAX.patch
+++ b/4.8.17/4425_grsec_remove_EI_PAX.patch
diff --git a/4.8.16/4426_default_XATTR_PAX_FLAGS.patch b/4.8.17/4426_default_XATTR_PAX_FLAGS.patch
index f7e97b5..f7e97b5 100644
--- a/4.8.16/4426_default_XATTR_PAX_FLAGS.patch
+++ b/4.8.17/4426_default_XATTR_PAX_FLAGS.patch
diff --git a/4.8.16/4427_force_XATTR_PAX_tmpfs.patch b/4.8.17/4427_force_XATTR_PAX_tmpfs.patch
index caecb91..caecb91 100644
--- a/4.8.16/4427_force_XATTR_PAX_tmpfs.patch
+++ b/4.8.17/4427_force_XATTR_PAX_tmpfs.patch
diff --git a/4.8.16/4430_grsec-remove-localversion-grsec.patch b/4.8.17/4430_grsec-remove-localversion-grsec.patch
index 31cf878..31cf878 100644
--- a/4.8.16/4430_grsec-remove-localversion-grsec.patch
+++ b/4.8.17/4430_grsec-remove-localversion-grsec.patch
diff --git a/4.8.16/4435_grsec-mute-warnings.patch b/4.8.17/4435_grsec-mute-warnings.patch
index 8929222..8929222 100644
--- a/4.8.16/4435_grsec-mute-warnings.patch
+++ b/4.8.17/4435_grsec-mute-warnings.patch
diff --git a/4.8.16/4440_grsec-remove-protected-paths.patch b/4.8.17/4440_grsec-remove-protected-paths.patch
index 741546d..741546d 100644
--- a/4.8.16/4440_grsec-remove-protected-paths.patch
+++ b/4.8.17/4440_grsec-remove-protected-paths.patch
diff --git a/4.8.16/4450_grsec-kconfig-default-gids.patch b/4.8.17/4450_grsec-kconfig-default-gids.patch
index cee6e27..cee6e27 100644
--- a/4.8.16/4450_grsec-kconfig-default-gids.patch
+++ b/4.8.17/4450_grsec-kconfig-default-gids.patch
diff --git a/4.8.16/4465_selinux-avc_audit-log-curr_ip.patch b/4.8.17/4465_selinux-avc_audit-log-curr_ip.patch
index 06a5294..06a5294 100644
--- a/4.8.16/4465_selinux-avc_audit-log-curr_ip.patch
+++ b/4.8.17/4465_selinux-avc_audit-log-curr_ip.patch
diff --git a/4.8.16/4470_disable-compat_vdso.patch b/4.8.17/4470_disable-compat_vdso.patch
index 1e4b84a..1e4b84a 100644
--- a/4.8.16/4470_disable-compat_vdso.patch
+++ b/4.8.17/4470_disable-compat_vdso.patch
diff --git a/4.8.16/4475_emutramp_default_on.patch b/4.8.17/4475_emutramp_default_on.patch
index 7b468ee..7b468ee 100644
--- a/4.8.16/4475_emutramp_default_on.patch
+++ b/4.8.17/4475_emutramp_default_on.patch