diff -druNp --no-dereference linux-libre-4.4.23-gnu/arch/arm/boot/compressed/head.S linux-libre-4.4.24-gnu/arch/arm/boot/compressed/head.S
--- linux-libre-4.4.23-gnu/arch/arm/boot/compressed/head.S	2016-09-30 04:20:43.000000000 -0400
+++ linux-libre-4.4.24-gnu/arch/arm/boot/compressed/head.S	2016-10-07 09:23:59.000000000 -0400
@@ -776,7 +776,7 @@ __armv7_mmu_cache_on:
 		orrne	r0, r0, #1		@ MMU enabled
 		movne	r1, #0xfffffffd		@ domain 0 = client
 		bic     r6, r6, #1 << 31        @ 32-bit translation system
-		bic     r6, r6, #3 << 0         @ use only ttbr0
+		bic     r6, r6, #(7 << 0) | (1 << 4)	@ use only ttbr0
 		mcrne	p15, 0, r3, c2, c0, 0	@ load page table pointer
 		mcrne	p15, 0, r1, c3, c0, 0	@ load domain access control
 		mcrne   p15, 0, r6, c2, c0, 2   @ load ttb control
diff -druNp --no-dereference linux-libre-4.4.23-gnu/arch/arm/boot/dts/sun5i-a13.dtsi linux-libre-4.4.24-gnu/arch/arm/boot/dts/sun5i-a13.dtsi
--- linux-libre-4.4.23-gnu/arch/arm/boot/dts/sun5i-a13.dtsi	2016-09-30 04:20:43.000000000 -0400
+++ linux-libre-4.4.24-gnu/arch/arm/boot/dts/sun5i-a13.dtsi	2016-10-07 09:23:59.000000000 -0400
@@ -83,7 +83,7 @@
 			trips {
 				cpu_alert0: cpu_alert0 {
 					/* milliCelsius */
-					temperature = <850000>;
+					temperature = <85000>;
 					hysteresis = <2000>;
 					type = "passive";
 				};
diff -druNp --no-dereference linux-libre-4.4.23-gnu/arch/arm/common/sa1111.c linux-libre-4.4.24-gnu/arch/arm/common/sa1111.c
--- linux-libre-4.4.23-gnu/arch/arm/common/sa1111.c	2016-09-30 04:20:43.000000000 -0400
+++ linux-libre-4.4.24-gnu/arch/arm/common/sa1111.c	2016-10-07 09:23:59.000000000 -0400
@@ -869,9 +869,9 @@ struct sa1111_save_data {
 
 #ifdef CONFIG_PM
 
-static int sa1111_suspend(struct platform_device *dev, pm_message_t state)
+static int sa1111_suspend_noirq(struct device *dev)
 {
-	struct sa1111 *sachip = platform_get_drvdata(dev);
+	struct sa1111 *sachip = dev_get_drvdata(dev);
 	struct sa1111_save_data *save;
 	unsigned long flags;
 	unsigned int val;
@@ -934,9 +934,9 @@ static int sa1111_suspend(struct platfor
  *	restored by their respective drivers, and must be called
  *	via LDM after this function.
  */
-static int sa1111_resume(struct platform_device *dev)
+static int sa1111_resume_noirq(struct device *dev)
 {
-	struct sa1111 *sachip = platform_get_drvdata(dev);
+	struct sa1111 *sachip = dev_get_drvdata(dev);
 	struct sa1111_save_data *save;
 	unsigned long flags, id;
 	void __iomem *base;
@@ -952,7 +952,7 @@ static int sa1111_resume(struct platform
 	id = sa1111_readl(sachip->base + SA1111_SKID);
 	if ((id & SKID_ID_MASK) != SKID_SA1111_ID) {
 		__sa1111_remove(sachip);
-		platform_set_drvdata(dev, NULL);
+		dev_set_drvdata(dev, NULL);
 		kfree(save);
 		return 0;
 	}
@@ -1003,8 +1003,8 @@ static int sa1111_resume(struct platform
 }
 
 #else
-#define sa1111_suspend NULL
-#define sa1111_resume  NULL
+#define sa1111_suspend_noirq NULL
+#define sa1111_resume_noirq  NULL
 #endif
 
 static int sa1111_probe(struct platform_device *pdev)
@@ -1038,6 +1038,11 @@ static int sa1111_remove(struct platform
 	return 0;
 }
 
+static struct dev_pm_ops sa1111_pm_ops = {
+	.suspend_noirq = sa1111_suspend_noirq,
+	.resume_noirq = sa1111_resume_noirq,
+};
+
 /*
  *	Not sure if this should be on the system bus or not yet.
  *	We really want some way to register a system device at
@@ -1050,10 +1055,9 @@ static int sa1111_remove(struct platform
 static struct platform_driver sa1111_device_driver = {
 	.probe		= sa1111_probe,
 	.remove		= sa1111_remove,
-	.suspend	= sa1111_suspend,
-	.resume		= sa1111_resume,
 	.driver		= {
 		.name	= "sa1111",
+		.pm	= &sa1111_pm_ops,
 	},
 };
 
diff -druNp --no-dereference linux-libre-4.4.23-gnu/arch/arm/include/asm/dma-mapping.h linux-libre-4.4.24-gnu/arch/arm/include/asm/dma-mapping.h
--- linux-libre-4.4.23-gnu/arch/arm/include/asm/dma-mapping.h	2016-09-30 04:20:43.000000000 -0400
+++ linux-libre-4.4.24-gnu/arch/arm/include/asm/dma-mapping.h	2016-10-07 09:23:59.000000000 -0400
@@ -119,7 +119,7 @@ static inline dma_addr_t virt_to_dma(str
 /* The ARM override for dma_max_pfn() */
 static inline unsigned long dma_max_pfn(struct device *dev)
 {
-	return PHYS_PFN_OFFSET + dma_to_pfn(dev, *dev->dma_mask);
+	return dma_to_pfn(dev, *dev->dma_mask);
 }
 #define dma_max_pfn(dev) dma_max_pfn(dev)
 
diff -druNp --no-dereference linux-libre-4.4.23-gnu/arch/arm/kernel/devtree.c linux-libre-4.4.24-gnu/arch/arm/kernel/devtree.c
--- linux-libre-4.4.23-gnu/arch/arm/kernel/devtree.c	2016-09-30 04:20:43.000000000 -0400
+++ linux-libre-4.4.24-gnu/arch/arm/kernel/devtree.c	2016-10-07 09:23:59.000000000 -0400
@@ -87,6 +87,8 @@ void __init arm_dt_init_cpu_maps(void)
 		return;
 
 	for_each_child_of_node(cpus, cpu) {
+		const __be32 *cell;
+		int prop_bytes;
 		u32 hwid;
 
 		if (of_node_cmp(cpu->type, "cpu"))
@@ -98,7 +100,8 @@ void __init arm_dt_init_cpu_maps(void)
 		 * properties is considered invalid to build the
 		 * cpu_logical_map.
 		 */
-		if (of_property_read_u32(cpu, "reg", &hwid)) {
+		cell = of_get_property(cpu, "reg", &prop_bytes);
+		if (!cell || prop_bytes < sizeof(*cell)) {
 			pr_debug(" * %s missing reg property\n",
 				     cpu->full_name);
 			of_node_put(cpu);
@@ -106,10 +109,15 @@ void __init arm_dt_init_cpu_maps(void)
 		}
 
 		/*
-		 * 8 MSBs must be set to 0 in the DT since the reg property
+		 * Bits n:24 must be set to 0 in the DT since the reg property
 		 * defines the MPIDR[23:0].
 		 */
-		if (hwid & ~MPIDR_HWID_BITMASK) {
+		do {
+			hwid = be32_to_cpu(*cell++);
+			prop_bytes -= sizeof(*cell);
+		} while (!hwid && prop_bytes > 0);
+
+		if (prop_bytes || (hwid & ~MPIDR_HWID_BITMASK)) {
 			of_node_put(cpu);
 			return;
 		}
diff -druNp --no-dereference linux-libre-4.4.23-gnu/arch/arm/mach-sa1100/clock.c linux-libre-4.4.24-gnu/arch/arm/mach-sa1100/clock.c
--- linux-libre-4.4.23-gnu/arch/arm/mach-sa1100/clock.c	2016-09-30 04:20:43.000000000 -0400
+++ linux-libre-4.4.24-gnu/arch/arm/mach-sa1100/clock.c	2016-10-07 09:23:59.000000000 -0400
@@ -125,6 +125,8 @@ static unsigned long clk_36864_get_rate(
 }
 
 static struct clkops clk_36864_ops = {
+	.enable		= clk_cpu_enable,
+	.disable	= clk_cpu_disable,
 	.get_rate	= clk_36864_get_rate,
 };
 
@@ -140,9 +142,8 @@ static struct clk_lookup sa11xx_clkregs[
 	CLKDEV_INIT(NULL, "OSTIMER0", &clk_36864),
 };
 
-static int __init sa11xx_clk_init(void)
+int __init sa11xx_clk_init(void)
 {
 	clkdev_add_table(sa11xx_clkregs, ARRAY_SIZE(sa11xx_clkregs));
 	return 0;
 }
-core_initcall(sa11xx_clk_init);
diff -druNp --no-dereference linux-libre-4.4.23-gnu/arch/arm/mach-sa1100/generic.c linux-libre-4.4.24-gnu/arch/arm/mach-sa1100/generic.c
--- linux-libre-4.4.23-gnu/arch/arm/mach-sa1100/generic.c	2016-09-30 04:20:43.000000000 -0400
+++ linux-libre-4.4.24-gnu/arch/arm/mach-sa1100/generic.c	2016-10-07 09:23:59.000000000 -0400
@@ -34,6 +34,7 @@
 
 #include <mach/hardware.h>
 #include <mach/irqs.h>
+#include <mach/reset.h>
 
 #include "generic.h"
 #include <clocksource/pxa.h>
@@ -95,6 +96,8 @@ static void sa1100_power_off(void)
 
 void sa11x0_restart(enum reboot_mode mode, const char *cmd)
 {
+	clear_reset_status(RESET_STATUS_ALL);
+
 	if (mode == REBOOT_SOFT) {
 		/* Jump into ROM at address 0 */
 		soft_restart(0);
@@ -388,6 +391,7 @@ void __init sa1100_init_irq(void)
 	sa11x0_init_irq_nodt(IRQ_GPIO0_SC, irq_resource.start);
 
 	sa1100_init_gpio();
+	sa11xx_clk_init();
 }
 
 /*
diff -druNp --no-dereference linux-libre-4.4.23-gnu/arch/arm/mach-sa1100/generic.h linux-libre-4.4.24-gnu/arch/arm/mach-sa1100/generic.h
--- linux-libre-4.4.23-gnu/arch/arm/mach-sa1100/generic.h	2016-09-30 04:20:43.000000000 -0400
+++ linux-libre-4.4.24-gnu/arch/arm/mach-sa1100/generic.h	2016-10-07 09:23:59.000000000 -0400
@@ -44,3 +44,5 @@ int sa11x0_pm_init(void);
 #else
 static inline int sa11x0_pm_init(void) { return 0; }
 #endif
+
+int sa11xx_clk_init(void);
diff -druNp --no-dereference linux-libre-4.4.23-gnu/arch/arm/mach-shmobile/regulator-quirk-rcar-gen2.c linux-libre-4.4.24-gnu/arch/arm/mach-shmobile/regulator-quirk-rcar-gen2.c
--- linux-libre-4.4.23-gnu/arch/arm/mach-shmobile/regulator-quirk-rcar-gen2.c	2016-09-30 04:20:43.000000000 -0400
+++ linux-libre-4.4.24-gnu/arch/arm/mach-shmobile/regulator-quirk-rcar-gen2.c	2016-10-07 09:23:59.000000000 -0400
@@ -41,39 +41,26 @@
 
 #define REGULATOR_IRQ_MASK	BIT(2)	/* IRQ2, active low */
 
-static void __iomem *irqc;
-
-static const u8 da9063_mask_regs[] = {
-	DA9063_REG_IRQ_MASK_A,
-	DA9063_REG_IRQ_MASK_B,
-	DA9063_REG_IRQ_MASK_C,
-	DA9063_REG_IRQ_MASK_D,
-};
-
-/* DA9210 System Control and Event Registers */
+/* start of DA9210 System Control and Event Registers */
 #define DA9210_REG_MASK_A		0x54
-#define DA9210_REG_MASK_B		0x55
-
-static const u8 da9210_mask_regs[] = {
-	DA9210_REG_MASK_A,
-	DA9210_REG_MASK_B,
-};
 
-static void da9xxx_mask_irqs(struct i2c_client *client, const u8 regs[],
-			     unsigned int nregs)
-{
-	unsigned int i;
+static void __iomem *irqc;
 
-	dev_info(&client->dev, "Masking %s interrupt sources\n", client->name);
+/* first byte sets the memory pointer, following are consecutive reg values */
+static u8 da9063_irq_clr[] = { DA9063_REG_IRQ_MASK_A, 0xff, 0xff, 0xff, 0xff };
+static u8 da9210_irq_clr[] = { DA9210_REG_MASK_A, 0xff, 0xff };
 
-	for (i = 0; i < nregs; i++) {
-		int error = i2c_smbus_write_byte_data(client, regs[i], ~0);
-		if (error) {
-			dev_err(&client->dev, "i2c error %d\n", error);
-			return;
-		}
-	}
-}
+static struct i2c_msg da9xxx_msgs[2] = {
+	{
+		.addr = 0x58,
+		.len = ARRAY_SIZE(da9063_irq_clr),
+		.buf = da9063_irq_clr,
+	}, {
+		.addr = 0x68,
+		.len = ARRAY_SIZE(da9210_irq_clr),
+		.buf = da9210_irq_clr,
+	},
+};
 
 static int regulator_quirk_notify(struct notifier_block *nb,
 				  unsigned long action, void *data)
@@ -93,12 +80,15 @@ static int regulator_quirk_notify(struct
 	client = to_i2c_client(dev);
 	dev_dbg(dev, "Detected %s\n", client->name);
 
-	if ((client->addr == 0x58 && !strcmp(client->name, "da9063")))
-		da9xxx_mask_irqs(client, da9063_mask_regs,
-				 ARRAY_SIZE(da9063_mask_regs));
-	else if (client->addr == 0x68 && !strcmp(client->name, "da9210"))
-		da9xxx_mask_irqs(client, da9210_mask_regs,
-				 ARRAY_SIZE(da9210_mask_regs));
+	if ((client->addr == 0x58 && !strcmp(client->name, "da9063")) ||
+	    (client->addr == 0x68 && !strcmp(client->name, "da9210"))) {
+		int ret;
+
+		dev_info(&client->dev, "clearing da9063/da9210 interrupts\n");
+		ret = i2c_transfer(client->adapter, da9xxx_msgs, ARRAY_SIZE(da9xxx_msgs));
+		if (ret != ARRAY_SIZE(da9xxx_msgs))
+			dev_err(&client->dev, "i2c error %d\n", ret);
+	}
 
 	mon = ioread32(irqc + IRQC_MONITOR);
 	if (mon & REGULATOR_IRQ_MASK)
diff -druNp --no-dereference linux-libre-4.4.23-gnu/arch/arm64/kernel/debug-monitors.c linux-libre-4.4.24-gnu/arch/arm64/kernel/debug-monitors.c
--- linux-libre-4.4.23-gnu/arch/arm64/kernel/debug-monitors.c	2016-09-30 04:20:43.000000000 -0400
+++ linux-libre-4.4.24-gnu/arch/arm64/kernel/debug-monitors.c	2016-10-07 09:23:59.000000000 -0400
@@ -422,8 +422,10 @@ int kernel_active_single_step(void)
 /* ptrace API */
 void user_enable_single_step(struct task_struct *task)
 {
-	set_ti_thread_flag(task_thread_info(task), TIF_SINGLESTEP);
-	set_regs_spsr_ss(task_pt_regs(task));
+	struct thread_info *ti = task_thread_info(task);
+
+	if (!test_and_set_ti_thread_flag(ti, TIF_SINGLESTEP))
+		set_regs_spsr_ss(task_pt_regs(task));
 }
 
 void user_disable_single_step(struct task_struct *task)
diff -druNp --no-dereference linux-libre-4.4.23-gnu/arch/avr32/mach-at32ap/pio.c linux-libre-4.4.24-gnu/arch/avr32/mach-at32ap/pio.c
--- linux-libre-4.4.23-gnu/arch/avr32/mach-at32ap/pio.c	2016-09-30 04:20:43.000000000 -0400
+++ linux-libre-4.4.24-gnu/arch/avr32/mach-at32ap/pio.c	2016-10-07 09:23:59.000000000 -0400
@@ -435,7 +435,7 @@ void __init at32_init_pio(struct platfor
 	struct resource *regs;
 	struct pio_device *pio;
 
-	if (pdev->id > MAX_NR_PIO_DEVICES) {
+	if (pdev->id >= MAX_NR_PIO_DEVICES) {
 		dev_err(&pdev->dev, "only %d PIO devices supported\n",
 			MAX_NR_PIO_DEVICES);
 		return;
diff -druNp --no-dereference linux-libre-4.4.23-gnu/arch/mips/include/asm/uprobes.h linux-libre-4.4.24-gnu/arch/mips/include/asm/uprobes.h
--- linux-libre-4.4.23-gnu/arch/mips/include/asm/uprobes.h	2016-09-30 04:20:43.000000000 -0400
+++ linux-libre-4.4.24-gnu/arch/mips/include/asm/uprobes.h	2016-10-07 09:23:59.000000000 -0400
@@ -36,7 +36,6 @@ struct arch_uprobe {
 	unsigned long	resume_epc;
 	u32	insn[2];
 	u32	ixol[2];
-	union	mips_instruction orig_inst[MAX_UINSN_BYTES / 4];
 };
 
 struct arch_uprobe_task {
diff -druNp --no-dereference linux-libre-4.4.23-gnu/arch/mips/kernel/uprobes.c linux-libre-4.4.24-gnu/arch/mips/kernel/uprobes.c
--- linux-libre-4.4.23-gnu/arch/mips/kernel/uprobes.c	2016-09-30 04:20:43.000000000 -0400
+++ linux-libre-4.4.24-gnu/arch/mips/kernel/uprobes.c	2016-10-07 09:23:59.000000000 -0400
@@ -157,7 +157,6 @@ bool is_trap_insn(uprobe_opcode_t *insn)
 int arch_uprobe_pre_xol(struct arch_uprobe *aup, struct pt_regs *regs)
 {
 	struct uprobe_task *utask = current->utask;
-	union mips_instruction insn;
 
 	/*
 	 * Now find the EPC where to resume after the breakpoint has been
@@ -168,10 +167,10 @@ int arch_uprobe_pre_xol(struct arch_upro
 		unsigned long epc;
 
 		epc = regs->cp0_epc;
-		__compute_return_epc_for_insn(regs, insn);
+		__compute_return_epc_for_insn(regs,
+			(union mips_instruction) aup->insn[0]);
 		aup->resume_epc = regs->cp0_epc;
 	}
-
 	utask->autask.saved_trap_nr = current->thread.trap_nr;
 	current->thread.trap_nr = UPROBE_TRAP_NR;
 	regs->cp0_epc = current->utask->xol_vaddr;
@@ -257,7 +256,7 @@ unsigned long arch_uretprobe_hijack_retu
 	ra = regs->regs[31];
 
 	/* Replace the return address with the trampoline address */
-	regs->regs[31] = ra;
+	regs->regs[31] = trampoline_vaddr;
 
 	return ra;
 }
@@ -280,24 +279,6 @@ int __weak set_swbp(struct arch_uprobe *
 	return uprobe_write_opcode(mm, vaddr, UPROBE_SWBP_INSN);
 }
 
-/**
- * set_orig_insn - Restore the original instruction.
- * @mm: the probed process address space.
- * @auprobe: arch specific probepoint information.
- * @vaddr: the virtual address to insert the opcode.
- *
- * For mm @mm, restore the original opcode (opcode) at @vaddr.
- * Return 0 (success) or a negative errno.
- *
- * This overrides the weak version in kernel/events/uprobes.c.
- */
-int set_orig_insn(struct arch_uprobe *auprobe, struct mm_struct *mm,
-		 unsigned long vaddr)
-{
-	return uprobe_write_opcode(mm, vaddr,
-			*(uprobe_opcode_t *)&auprobe->orig_inst[0].word);
-}
-
 void __weak arch_uprobe_copy_ixol(struct page *page, unsigned long vaddr,
 				  void *src, unsigned long len)
 {
diff -druNp --no-dereference linux-libre-4.4.23-gnu/arch/mips/mti-malta/malta-setup.c linux-libre-4.4.24-gnu/arch/mips/mti-malta/malta-setup.c
--- linux-libre-4.4.23-gnu/arch/mips/mti-malta/malta-setup.c	2016-09-30 04:20:43.000000000 -0400
+++ linux-libre-4.4.24-gnu/arch/mips/mti-malta/malta-setup.c	2016-10-07 09:23:59.000000000 -0400
@@ -39,6 +39,9 @@
 #include <linux/console.h>
 #endif
 
+#define ROCIT_CONFIG_GEN0		0x1f403000
+#define  ROCIT_CONFIG_GEN0_PCI_IOCU	BIT(7)
+
 extern void malta_be_init(void);
 extern int malta_be_handler(struct pt_regs *regs, int is_fixup);
 
@@ -107,6 +110,8 @@ static void __init fd_activate(void)
 static int __init plat_enable_iocoherency(void)
 {
 	int supported = 0;
+	u32 cfg;
+
 	if (mips_revision_sconid == MIPS_REVISION_SCON_BONITO) {
 		if (BONITO_PCICACHECTRL & BONITO_PCICACHECTRL_CPUCOH_PRES) {
 			BONITO_PCICACHECTRL |= BONITO_PCICACHECTRL_CPUCOH_EN;
@@ -129,7 +134,8 @@ static int __init plat_enable_iocoherenc
 	} else if (mips_cm_numiocu() != 0) {
 		/* Nothing special needs to be done to enable coherency */
 		pr_info("CMP IOCU detected\n");
-		if ((*(unsigned int *)0xbf403000 & 0x81) != 0x81) {
+		cfg = __raw_readl((u32 *)CKSEG1ADDR(ROCIT_CONFIG_GEN0));
+		if (!(cfg & ROCIT_CONFIG_GEN0_PCI_IOCU)) {
 			pr_crit("IOCU OPERATION DISABLED BY SWITCH - DEFAULTING TO SW IO COHERENCY\n");
 			return 0;
 		}
diff -druNp --no-dereference linux-libre-4.4.23-gnu/arch/powerpc/kernel/prom_init.c linux-libre-4.4.24-gnu/arch/powerpc/kernel/prom_init.c
--- linux-libre-4.4.23-gnu/arch/powerpc/kernel/prom_init.c	2016-09-30 04:20:43.000000000 -0400
+++ linux-libre-4.4.24-gnu/arch/powerpc/kernel/prom_init.c	2016-10-07 09:23:59.000000000 -0400
@@ -694,7 +694,7 @@ unsigned char ibm_architecture_vec[] = {
 	OV4_MIN_ENT_CAP,		/* minimum VP entitled capacity */
 
 	/* option vector 5: PAPR/OF options */
-	VECTOR_LENGTH(18),		/* length */
+	VECTOR_LENGTH(21),		/* length */
 	0,				/* don't ignore, don't halt */
 	OV5_FEAT(OV5_LPAR) | OV5_FEAT(OV5_SPLPAR) | OV5_FEAT(OV5_LARGE_PAGES) |
 	OV5_FEAT(OV5_DRCONF_MEMORY) | OV5_FEAT(OV5_DONATE_DEDICATE_CPU) |
@@ -725,8 +725,11 @@ unsigned char ibm_architecture_vec[] = {
 	0,
 	0,
 	OV5_FEAT(OV5_PFO_HW_RNG) | OV5_FEAT(OV5_PFO_HW_ENCR) |
-	OV5_FEAT(OV5_PFO_HW_842),
-	OV5_FEAT(OV5_SUB_PROCESSORS),
+	OV5_FEAT(OV5_PFO_HW_842),				/* Byte 17 */
+	0,							/* Byte 18 */
+	0,							/* Byte 19 */
+	0,							/* Byte 20 */
+	OV5_FEAT(OV5_SUB_PROCESSORS),				/* Byte 21 */
 
 	/* option vector 6: IBM PAPR hints */
 	VECTOR_LENGTH(3),		/* length */
diff -druNp --no-dereference linux-libre-4.4.23-gnu/arch/tile/include/asm/elf.h linux-libre-4.4.24-gnu/arch/tile/include/asm/elf.h
--- linux-libre-4.4.23-gnu/arch/tile/include/asm/elf.h	2016-09-30 04:20:43.000000000 -0400
+++ linux-libre-4.4.24-gnu/arch/tile/include/asm/elf.h	2016-10-07 09:23:59.000000000 -0400
@@ -129,6 +129,7 @@ extern int dump_task_regs(struct task_st
 struct linux_binprm;
 extern int arch_setup_additional_pages(struct linux_binprm *bprm,
 				       int executable_stack);
+/* update AT_VECTOR_SIZE_ARCH if the number of NEW_AUX_ENT entries changes */
 #define ARCH_DLINFO \
 do { \
 	NEW_AUX_ENT(AT_SYSINFO_EHDR, VDSO_BASE); \
diff -druNp --no-dereference linux-libre-4.4.23-gnu/arch/tile/include/uapi/asm/auxvec.h linux-libre-4.4.24-gnu/arch/tile/include/uapi/asm/auxvec.h
--- linux-libre-4.4.23-gnu/arch/tile/include/uapi/asm/auxvec.h	2016-09-30 04:20:43.000000000 -0400
+++ linux-libre-4.4.24-gnu/arch/tile/include/uapi/asm/auxvec.h	2016-10-07 09:23:59.000000000 -0400
@@ -18,4 +18,6 @@
 /* The vDSO location. */
 #define AT_SYSINFO_EHDR         33
 
+#define AT_VECTOR_SIZE_ARCH 1 /* entries in ARCH_DLINFO */
+
 #endif /* _ASM_TILE_AUXVEC_H */
diff -druNp --no-dereference linux-libre-4.4.23-gnu/arch/x86/include/asm/tlbflush.h linux-libre-4.4.24-gnu/arch/x86/include/asm/tlbflush.h
--- linux-libre-4.4.23-gnu/arch/x86/include/asm/tlbflush.h	2016-09-30 04:20:43.000000000 -0400
+++ linux-libre-4.4.24-gnu/arch/x86/include/asm/tlbflush.h	2016-10-07 09:23:59.000000000 -0400
@@ -32,7 +32,7 @@ DECLARE_PER_CPU_SHARED_ALIGNED(struct tl
 /* Initialize cr4 shadow for this CPU. */
 static inline void cr4_init_shadow(void)
 {
-	this_cpu_write(cpu_tlbstate.cr4, __read_cr4());
+	this_cpu_write(cpu_tlbstate.cr4, __read_cr4_safe());
 }
 
 /* Set in this cpu's CR4. */
diff -druNp --no-dereference linux-libre-4.4.23-gnu/arch/x86/kernel/cpu/common.c linux-libre-4.4.24-gnu/arch/x86/kernel/cpu/common.c
--- linux-libre-4.4.23-gnu/arch/x86/kernel/cpu/common.c	2016-09-30 04:20:43.000000000 -0400
+++ linux-libre-4.4.24-gnu/arch/x86/kernel/cpu/common.c	2016-10-07 09:23:59.000000000 -0400
@@ -737,21 +737,20 @@ static void __init early_identify_cpu(st
 		identify_cpu_without_cpuid(c);
 
 	/* cyrix could have cpuid enabled via c_identify()*/
-	if (!have_cpuid_p())
-		return;
-
-	cpu_detect(c);
-	get_cpu_vendor(c);
-	get_cpu_cap(c);
+	if (have_cpuid_p()) {
+		cpu_detect(c);
+		get_cpu_vendor(c);
+		get_cpu_cap(c);
 
-	if (this_cpu->c_early_init)
-		this_cpu->c_early_init(c);
+		if (this_cpu->c_early_init)
+			this_cpu->c_early_init(c);
 
-	c->cpu_index = 0;
-	filter_cpuid_features(c, false);
+		c->cpu_index = 0;
+		filter_cpuid_features(c, false);
 
-	if (this_cpu->c_bsp_init)
-		this_cpu->c_bsp_init(c);
+		if (this_cpu->c_bsp_init)
+			this_cpu->c_bsp_init(c);
+	}
 
 	setup_force_cpu_cap(X86_FEATURE_ALWAYS);
 	fpu__init_system(c);
diff -druNp --no-dereference linux-libre-4.4.23-gnu/arch/x86/kvm/vmx.c linux-libre-4.4.24-gnu/arch/x86/kvm/vmx.c
--- linux-libre-4.4.23-gnu/arch/x86/kvm/vmx.c	2016-09-30 04:20:43.000000000 -0400
+++ linux-libre-4.4.24-gnu/arch/x86/kvm/vmx.c	2016-10-07 09:23:59.000000000 -0400
@@ -408,6 +408,7 @@ struct nested_vmx {
 	struct list_head vmcs02_pool;
 	int vmcs02_num;
 	u64 vmcs01_tsc_offset;
+	bool change_vmcs01_virtual_x2apic_mode;
 	/* L2 must run next, and mustn't decide to exit to L1. */
 	bool nested_run_pending;
 	/*
@@ -8184,6 +8185,12 @@ static void vmx_set_virtual_x2apic_mode(
 {
 	u32 sec_exec_control;
 
+	/* Postpone execution until vmcs01 is the current VMCS. */
+	if (is_guest_mode(vcpu)) {
+		to_vmx(vcpu)->nested.change_vmcs01_virtual_x2apic_mode = true;
+		return;
+	}
+
 	/*
 	 * There is not point to enable virtualize x2apic without enable
 	 * apicv
@@ -10483,6 +10490,12 @@ static void nested_vmx_vmexit(struct kvm
 	/* Update TSC_OFFSET if TSC was changed while L2 ran */
 	vmcs_write64(TSC_OFFSET, vmx->nested.vmcs01_tsc_offset);
 
+	if (vmx->nested.change_vmcs01_virtual_x2apic_mode) {
+		vmx->nested.change_vmcs01_virtual_x2apic_mode = false;
+		vmx_set_virtual_x2apic_mode(vcpu,
+				vcpu->arch.apic_base & X2APIC_ENABLE);
+	}
+
 	/* This is needed for same reason as it was needed in prepare_vmcs02 */
 	vmx->host_rsp = 0;
 
diff -druNp --no-dereference linux-libre-4.4.23-gnu/block/blk-mq.c linux-libre-4.4.24-gnu/block/blk-mq.c
--- linux-libre-4.4.23-gnu/block/blk-mq.c	2016-09-30 04:20:43.000000000 -0400
+++ linux-libre-4.4.24-gnu/block/blk-mq.c	2016-10-07 09:23:59.000000000 -0400
@@ -780,7 +780,7 @@ static void __blk_mq_run_hw_queue(struct
 		switch (ret) {
 		case BLK_MQ_RQ_QUEUE_OK:
 			queued++;
-			continue;
+			break;
 		case BLK_MQ_RQ_QUEUE_BUSY:
 			list_add(&rq->queuelist, &rq_list);
 			__blk_mq_requeue_request(rq);
diff -druNp --no-dereference linux-libre-4.4.23-gnu/Documentation/devicetree/bindings/regulator/qcom,spmi-regulator.txt linux-libre-4.4.24-gnu/Documentation/devicetree/bindings/regulator/qcom,spmi-regulator.txt
--- linux-libre-4.4.23-gnu/Documentation/devicetree/bindings/regulator/qcom,spmi-regulator.txt	2016-09-30 04:20:43.000000000 -0400
+++ linux-libre-4.4.24-gnu/Documentation/devicetree/bindings/regulator/qcom,spmi-regulator.txt	2016-10-07 09:23:59.000000000 -0400
@@ -81,9 +81,9 @@ pm8916:
 	l14, l15, l16, l17, l18
 
 pm8941:
-	s1, s2, s3, l1, l2, l3, l4, l5, l6, l7, l8, l9, l10, l11, l12, l13, l14,
-	l15, l16, l17, l18, l19, l20, l21, l22, l23, l24, lvs1, lvs2, lvs3,
-	mvs1, mvs2
+	s1, s2, s3, s4, l1, l2, l3, l4, l5, l6, l7, l8, l9, l10, l11, l12, l13,
+	l14, l15, l16, l17, l18, l19, l20, l21, l22, l23, l24, lvs1, lvs2, lvs3,
+	5vs1, 5vs2
 
 The content of each sub-node is defined by the standard binding for regulators -
 see regulator.txt - with additional custom properties described below:
diff -druNp --no-dereference linux-libre-4.4.23-gnu/Documentation/pinctrl.txt linux-libre-4.4.24-gnu/Documentation/pinctrl.txt
--- linux-libre-4.4.23-gnu/Documentation/pinctrl.txt	2016-09-30 04:20:43.000000000 -0400
+++ linux-libre-4.4.24-gnu/Documentation/pinctrl.txt	2016-10-07 09:23:59.000000000 -0400
@@ -831,7 +831,7 @@ separate memory range only intended for
 range dealing with pin config and pin multiplexing get placed into a
 different memory range and a separate section of the data sheet.
 
-A flag "strict" in struct pinctrl_desc is available to check and deny
+A flag "strict" in struct pinmux_ops is available to check and deny
 simultaneous access to the same pin from GPIO and pin multiplexing
 consumers on hardware of this type. The pinctrl driver should set this flag
 accordingly.
diff -druNp --no-dereference linux-libre-4.4.23-gnu/drivers/acpi/acpica/hwxface.c linux-libre-4.4.24-gnu/drivers/acpi/acpica/hwxface.c
--- linux-libre-4.4.23-gnu/drivers/acpi/acpica/hwxface.c	2016-09-30 04:20:43.000000000 -0400
+++ linux-libre-4.4.24-gnu/drivers/acpi/acpica/hwxface.c	2016-10-07 09:23:59.000000000 -0400
@@ -504,11 +504,20 @@ acpi_get_sleep_type_data(u8 sleep_state,
 	 * Evaluate the \_Sx namespace object containing the register values
 	 * for this state
 	 */
-	info->relative_pathname =
-	    ACPI_CAST_PTR(char, acpi_gbl_sleep_state_names[sleep_state]);
+	info->relative_pathname = ACPI_CAST_PTR(char,
+						acpi_gbl_sleep_state_names
+						[sleep_state]);
+
 	status = acpi_ns_evaluate(info);
 	if (ACPI_FAILURE(status)) {
-		goto cleanup;
+		if (status == AE_NOT_FOUND) {
+
+			/* The _Sx states are optional, ignore NOT_FOUND */
+
+			goto final_cleanup;
+		}
+
+		goto warning_cleanup;
 	}
 
 	/* Must have a return object */
@@ -517,7 +526,7 @@ acpi_get_sleep_type_data(u8 sleep_state,
 		ACPI_ERROR((AE_INFO, "No Sleep State object returned from [%s]",
 			    info->relative_pathname));
 		status = AE_AML_NO_RETURN_VALUE;
-		goto cleanup;
+		goto warning_cleanup;
 	}
 
 	/* Return object must be of type Package */
@@ -526,7 +535,7 @@ acpi_get_sleep_type_data(u8 sleep_state,
 		ACPI_ERROR((AE_INFO,
 			    "Sleep State return object is not a Package"));
 		status = AE_AML_OPERAND_TYPE;
-		goto cleanup1;
+		goto return_value_cleanup;
 	}
 
 	/*
@@ -570,16 +579,17 @@ acpi_get_sleep_type_data(u8 sleep_state,
 		break;
 	}
 
-cleanup1:
+return_value_cleanup:
 	acpi_ut_remove_reference(info->return_object);
 
-cleanup:
+warning_cleanup:
 	if (ACPI_FAILURE(status)) {
 		ACPI_EXCEPTION((AE_INFO, status,
 				"While evaluating Sleep State [%s]",
 				info->relative_pathname));
 	}
 
+final_cleanup:
 	ACPI_FREE(info);
 	return_ACPI_STATUS(status);
 }
diff -druNp --no-dereference linux-libre-4.4.23-gnu/drivers/char/hw_random/omap-rng.c linux-libre-4.4.24-gnu/drivers/char/hw_random/omap-rng.c
--- linux-libre-4.4.23-gnu/drivers/char/hw_random/omap-rng.c	2016-09-30 04:20:43.000000000 -0400
+++ linux-libre-4.4.24-gnu/drivers/char/hw_random/omap-rng.c	2016-10-07 09:23:59.000000000 -0400
@@ -384,7 +384,12 @@ static int omap_rng_probe(struct platfor
 	}
 
 	pm_runtime_enable(&pdev->dev);
-	pm_runtime_get_sync(&pdev->dev);
+	ret = pm_runtime_get_sync(&pdev->dev);
+	if (ret) {
+		dev_err(&pdev->dev, "Failed to runtime_get device: %d\n", ret);
+		pm_runtime_put_noidle(&pdev->dev);
+		goto err_ioremap;
+	}
 
 	ret = (dev->of_node) ? of_get_omap_rng_device_details(priv, pdev) :
 				get_omap_rng_device_details(priv);
@@ -435,8 +440,15 @@ static int __maybe_unused omap_rng_suspe
 static int __maybe_unused omap_rng_resume(struct device *dev)
 {
 	struct omap_rng_dev *priv = dev_get_drvdata(dev);
+	int ret;
+
+	ret = pm_runtime_get_sync(dev);
+	if (ret) {
+		dev_err(dev, "Failed to runtime_get device: %d\n", ret);
+		pm_runtime_put_noidle(dev);
+		return ret;
+	}
 
-	pm_runtime_get_sync(dev);
 	priv->pdata->init(priv);
 
 	return 0;
diff -druNp --no-dereference linux-libre-4.4.23-gnu/drivers/char/tpm/tpm2-cmd.c linux-libre-4.4.24-gnu/drivers/char/tpm/tpm2-cmd.c
--- linux-libre-4.4.23-gnu/drivers/char/tpm/tpm2-cmd.c	2016-09-30 04:20:43.000000000 -0400
+++ linux-libre-4.4.24-gnu/drivers/char/tpm/tpm2-cmd.c	2016-10-07 09:23:59.000000000 -0400
@@ -657,7 +657,7 @@ ssize_t tpm2_get_tpm_pt(struct tpm_chip
 
 	rc = tpm_transmit_cmd(chip, &cmd, sizeof(cmd), desc);
 	if (!rc)
-		*value = cmd.params.get_tpm_pt_out.value;
+		*value = be32_to_cpu(cmd.params.get_tpm_pt_out.value);
 
 	return rc;
 }
diff -druNp --no-dereference linux-libre-4.4.23-gnu/drivers/clk/clk-xgene.c linux-libre-4.4.24-gnu/drivers/clk/clk-xgene.c
--- linux-libre-4.4.23-gnu/drivers/clk/clk-xgene.c	2016-09-30 04:20:43.000000000 -0400
+++ linux-libre-4.4.24-gnu/drivers/clk/clk-xgene.c	2016-10-07 09:23:59.000000000 -0400
@@ -351,8 +351,8 @@ static int xgene_clk_set_rate(struct clk
 		/* Set new divider */
 		data = xgene_clk_read(pclk->param.divider_reg +
 				pclk->param.reg_divider_offset);
-		data &= ~((1 << pclk->param.reg_divider_width) - 1)
-				<< pclk->param.reg_divider_shift;
+		data &= ~(((1 << pclk->param.reg_divider_width) - 1)
+				<< pclk->param.reg_divider_shift);
 		data |= divider;
 		xgene_clk_write(data, pclk->param.divider_reg +
 					pclk->param.reg_divider_offset);
diff -druNp --no-dereference linux-libre-4.4.23-gnu/drivers/dma/at_xdmac.c linux-libre-4.4.24-gnu/drivers/dma/at_xdmac.c
--- linux-libre-4.4.23-gnu/drivers/dma/at_xdmac.c	2016-09-30 04:20:43.000000000 -0400
+++ linux-libre-4.4.24-gnu/drivers/dma/at_xdmac.c	2016-10-07 09:23:59.000000000 -0400
@@ -1183,8 +1183,8 @@ static struct at_xdmac_desc *at_xdmac_me
 	desc->lld.mbr_cfg = chan_cc;
 
 	dev_dbg(chan2dev(chan),
-		"%s: lld: mbr_da=%pad, mbr_ds=%pad, mbr_ubc=0x%08x, mbr_cfg=0x%08x\n",
-		__func__, &desc->lld.mbr_da, &desc->lld.mbr_ds, desc->lld.mbr_ubc,
+		"%s: lld: mbr_da=%pad, mbr_ds=0x%08x, mbr_ubc=0x%08x, mbr_cfg=0x%08x\n",
+		__func__, &desc->lld.mbr_da, desc->lld.mbr_ds, desc->lld.mbr_ubc,
 		desc->lld.mbr_cfg);
 
 	return desc;
@@ -2055,7 +2055,7 @@ err_dma_unregister:
 err_clk_disable:
 	clk_disable_unprepare(atxdmac->clk);
 err_free_irq:
-	free_irq(atxdmac->irq, atxdmac->dma.dev);
+	free_irq(atxdmac->irq, atxdmac);
 	return ret;
 }
 
@@ -2071,7 +2071,7 @@ static int at_xdmac_remove(struct platfo
 
 	synchronize_irq(atxdmac->irq);
 
-	free_irq(atxdmac->irq, atxdmac->dma.dev);
+	free_irq(atxdmac->irq, atxdmac);
 
 	for (i = 0; i < atxdmac->dma.chancnt; i++) {
 		struct at_xdmac_chan *atchan = &atxdmac->chan[i];
diff -druNp --no-dereference linux-libre-4.4.23-gnu/drivers/gpio/gpio-sa1100.c linux-libre-4.4.24-gnu/drivers/gpio/gpio-sa1100.c
--- linux-libre-4.4.23-gnu/drivers/gpio/gpio-sa1100.c	2016-09-30 04:20:43.000000000 -0400
+++ linux-libre-4.4.24-gnu/drivers/gpio/gpio-sa1100.c	2016-10-07 09:23:59.000000000 -0400
@@ -155,7 +155,7 @@ static int sa1100_gpio_irqdomain_map(str
 {
 	irq_set_chip_and_handler(irq, &sa1100_gpio_irq_chip,
 				 handle_edge_irq);
-	irq_set_noprobe(irq);
+	irq_set_probe(irq);
 
 	return 0;
 }
diff -druNp --no-dereference linux-libre-4.4.23-gnu/drivers/gpu/drm/nouveau/nvkm/engine/fifo/dmanv04.c linux-libre-4.4.24-gnu/drivers/gpu/drm/nouveau/nvkm/engine/fifo/dmanv04.c
--- linux-libre-4.4.23-gnu/drivers/gpu/drm/nouveau/nvkm/engine/fifo/dmanv04.c	2016-09-30 04:20:43.000000000 -0400
+++ linux-libre-4.4.24-gnu/drivers/gpu/drm/nouveau/nvkm/engine/fifo/dmanv04.c	2016-10-07 09:23:59.000000000 -0400
@@ -36,7 +36,10 @@ nv04_fifo_dma_object_dtor(struct nvkm_fi
 {
 	struct nv04_fifo_chan *chan = nv04_fifo_chan(base);
 	struct nvkm_instmem *imem = chan->fifo->base.engine.subdev.device->imem;
+
+	mutex_lock(&chan->fifo->base.engine.subdev.mutex);
 	nvkm_ramht_remove(imem->ramht, cookie);
+	mutex_unlock(&chan->fifo->base.engine.subdev.mutex);
 }
 
 static int
diff -druNp --no-dereference linux-libre-4.4.23-gnu/drivers/gpu/drm/radeon/si_dpm.c linux-libre-4.4.24-gnu/drivers/gpu/drm/radeon/si_dpm.c
--- linux-libre-4.4.23-gnu/drivers/gpu/drm/radeon/si_dpm.c	2016-09-30 04:20:43.000000000 -0400
+++ linux-libre-4.4.24-gnu/drivers/gpu/drm/radeon/si_dpm.c	2016-10-07 09:23:59.000000000 -0400
@@ -3015,6 +3015,12 @@ static void si_apply_state_adjust_rules(
 	if (rdev->pdev->device == 0x6811 &&
 	    rdev->pdev->revision == 0x81)
 		max_mclk = 120000;
+	/* limit sclk/mclk on Jet parts for stability */
+	if (rdev->pdev->device == 0x6665 &&
+	    rdev->pdev->revision == 0xc3) {
+		max_sclk = 75000;
+		max_mclk = 80000;
+	}
 
 	if (rps->vce_active) {
 		rps->evclk = rdev->pm.dpm.vce_states[rdev->pm.dpm.vce_level].evclk;
diff -druNp --no-dereference linux-libre-4.4.23-gnu/drivers/hwmon/adt7411.c linux-libre-4.4.24-gnu/drivers/hwmon/adt7411.c
--- linux-libre-4.4.23-gnu/drivers/hwmon/adt7411.c	2016-09-30 04:20:43.000000000 -0400
+++ linux-libre-4.4.24-gnu/drivers/hwmon/adt7411.c	2016-10-07 09:23:59.000000000 -0400
@@ -30,6 +30,7 @@
 
 #define ADT7411_REG_CFG1			0x18
 #define ADT7411_CFG1_START_MONITOR		(1 << 0)
+#define ADT7411_CFG1_RESERVED_BIT3		(1 << 3)
 
 #define ADT7411_REG_CFG2			0x19
 #define ADT7411_CFG2_DISABLE_AVG		(1 << 5)
@@ -296,8 +297,10 @@ static int adt7411_probe(struct i2c_clie
 	mutex_init(&data->device_lock);
 	mutex_init(&data->update_lock);
 
+	/* According to the datasheet, we must only write 1 to bit 3 */
 	ret = adt7411_modify_bit(client, ADT7411_REG_CFG1,
-				 ADT7411_CFG1_START_MONITOR, 1);
+				 ADT7411_CFG1_RESERVED_BIT3
+				 | ADT7411_CFG1_START_MONITOR, 1);
 	if (ret < 0)
 		return ret;
 
diff -druNp --no-dereference linux-libre-4.4.23-gnu/drivers/infiniband/core/multicast.c linux-libre-4.4.24-gnu/drivers/infiniband/core/multicast.c
--- linux-libre-4.4.23-gnu/drivers/infiniband/core/multicast.c	2016-09-30 04:20:43.000000000 -0400
+++ linux-libre-4.4.24-gnu/drivers/infiniband/core/multicast.c	2016-10-07 09:23:59.000000000 -0400
@@ -106,7 +106,6 @@ struct mcast_group {
 	atomic_t		refcount;
 	enum mcast_group_state	state;
 	struct ib_sa_query	*query;
-	int			query_id;
 	u16			pkey_index;
 	u8			leave_state;
 	int			retries;
@@ -339,11 +338,7 @@ static int send_join(struct mcast_group
 				       member->multicast.comp_mask,
 				       3000, GFP_KERNEL, join_handler, group,
 				       &group->query);
-	if (ret >= 0) {
-		group->query_id = ret;
-		ret = 0;
-	}
-	return ret;
+	return (ret > 0) ? 0 : ret;
 }
 
 static int send_leave(struct mcast_group *group, u8 leave_state)
@@ -363,11 +358,7 @@ static int send_leave(struct mcast_group
 				       IB_SA_MCMEMBER_REC_JOIN_STATE,
 				       3000, GFP_KERNEL, leave_handler,
 				       group, &group->query);
-	if (ret >= 0) {
-		group->query_id = ret;
-		ret = 0;
-	}
-	return ret;
+	return (ret > 0) ? 0 : ret;
 }
 
 static void join_group(struct mcast_group *group, struct mcast_member *member,
diff -druNp --no-dereference linux-libre-4.4.23-gnu/drivers/infiniband/hw/mlx4/mad.c linux-libre-4.4.24-gnu/drivers/infiniband/hw/mlx4/mad.c
--- linux-libre-4.4.23-gnu/drivers/infiniband/hw/mlx4/mad.c	2016-09-30 04:20:43.000000000 -0400
+++ linux-libre-4.4.24-gnu/drivers/infiniband/hw/mlx4/mad.c	2016-10-07 09:23:59.000000000 -0400
@@ -1080,6 +1080,27 @@ void handle_port_mgmt_change_event(struc
 
 		/* Generate GUID changed event */
 		if (changed_attr & MLX4_EQ_PORT_INFO_GID_PFX_CHANGE_MASK) {
+			if (mlx4_is_master(dev->dev)) {
+				union ib_gid gid;
+				int err = 0;
+
+				if (!eqe->event.port_mgmt_change.params.port_info.gid_prefix)
+					err = __mlx4_ib_query_gid(&dev->ib_dev, port, 0, &gid, 1);
+				else
+					gid.global.subnet_prefix =
+						eqe->event.port_mgmt_change.params.port_info.gid_prefix;
+				if (err) {
+					pr_warn("Could not change QP1 subnet prefix for port %d: query_gid error (%d)\n",
+						port, err);
+				} else {
+					pr_debug("Changing QP1 subnet prefix for port %d. old=0x%llx. new=0x%llx\n",
+						 port,
+						 (u64)atomic64_read(&dev->sriov.demux[port - 1].subnet_prefix),
+						 be64_to_cpu(gid.global.subnet_prefix));
+					atomic64_set(&dev->sriov.demux[port - 1].subnet_prefix,
+						     be64_to_cpu(gid.global.subnet_prefix));
+				}
+			}
 			mlx4_ib_dispatch_event(dev, port, IB_EVENT_GID_CHANGE);
 			/*if master, notify all slaves*/
 			if (mlx4_is_master(dev->dev))
@@ -2154,6 +2175,8 @@ int mlx4_ib_init_sriov(struct mlx4_ib_de
 		if (err)
 			goto demux_err;
 		dev->sriov.demux[i].guid_cache[0] = gid.global.interface_id;
+		atomic64_set(&dev->sriov.demux[i].subnet_prefix,
+			     be64_to_cpu(gid.global.subnet_prefix));
 		err = alloc_pv_object(dev, mlx4_master_func_num(dev->dev), i + 1,
 				      &dev->sriov.sqps[i]);
 		if (err)
diff -druNp --no-dereference linux-libre-4.4.23-gnu/drivers/infiniband/hw/mlx4/mcg.c linux-libre-4.4.24-gnu/drivers/infiniband/hw/mlx4/mcg.c
--- linux-libre-4.4.23-gnu/drivers/infiniband/hw/mlx4/mcg.c	2016-09-30 04:20:43.000000000 -0400
+++ linux-libre-4.4.24-gnu/drivers/infiniband/hw/mlx4/mcg.c	2016-10-07 09:23:59.000000000 -0400
@@ -489,7 +489,7 @@ static u8 get_leave_state(struct mcast_g
 		if (!group->members[i])
 			leave_state |= (1 << i);
 
-	return leave_state & (group->rec.scope_join_state & 7);
+	return leave_state & (group->rec.scope_join_state & 0xf);
 }
 
 static int join_group(struct mcast_group *group, int slave, u8 join_mask)
@@ -564,8 +564,8 @@ static void mlx4_ib_mcg_timeout_handler(
 		} else
 			mcg_warn_group(group, "DRIVER BUG\n");
 	} else if (group->state == MCAST_LEAVE_SENT) {
-		if (group->rec.scope_join_state & 7)
-			group->rec.scope_join_state &= 0xf8;
+		if (group->rec.scope_join_state & 0xf)
+			group->rec.scope_join_state &= 0xf0;
 		group->state = MCAST_IDLE;
 		mutex_unlock(&group->lock);
 		if (release_group(group, 1))
@@ -605,7 +605,7 @@ static int handle_leave_req(struct mcast
 static int handle_join_req(struct mcast_group *group, u8 join_mask,
 			   struct mcast_req *req)
 {
-	u8 group_join_state = group->rec.scope_join_state & 7;
+	u8 group_join_state = group->rec.scope_join_state & 0xf;
 	int ref = 0;
 	u16 status;
 	struct ib_sa_mcmember_data *sa_data = (struct ib_sa_mcmember_data *)req->sa_mad.data;
@@ -690,8 +690,8 @@ static void mlx4_ib_mcg_work_handler(str
 			u8 cur_join_state;
 
 			resp_join_state = ((struct ib_sa_mcmember_data *)
-						group->response_sa_mad.data)->scope_join_state & 7;
-			cur_join_state = group->rec.scope_join_state & 7;
+						group->response_sa_mad.data)->scope_join_state & 0xf;
+			cur_join_state = group->rec.scope_join_state & 0xf;
 
 			if (method == IB_MGMT_METHOD_GET_RESP) {
 				/* successfull join */
@@ -710,7 +710,7 @@ process_requests:
 		req = list_first_entry(&group->pending_list, struct mcast_req,
 				       group_list);
 		sa_data = (struct ib_sa_mcmember_data *)req->sa_mad.data;
-		req_join_state = sa_data->scope_join_state & 0x7;
+		req_join_state = sa_data->scope_join_state & 0xf;
 
 		/* For a leave request, we will immediately answer the VF, and
 		 * update our internal counters. The actual leave will be sent
diff -druNp --no-dereference linux-libre-4.4.23-gnu/drivers/infiniband/hw/mlx4/mlx4_ib.h linux-libre-4.4.24-gnu/drivers/infiniband/hw/mlx4/mlx4_ib.h
--- linux-libre-4.4.23-gnu/drivers/infiniband/hw/mlx4/mlx4_ib.h	2016-09-30 04:20:43.000000000 -0400
+++ linux-libre-4.4.24-gnu/drivers/infiniband/hw/mlx4/mlx4_ib.h	2016-10-07 09:23:59.000000000 -0400
@@ -441,7 +441,7 @@ struct mlx4_ib_demux_ctx {
 	struct workqueue_struct *wq;
 	struct workqueue_struct *ud_wq;
 	spinlock_t ud_lock;
-	__be64 subnet_prefix;
+	atomic64_t subnet_prefix;
 	__be64 guid_cache[128];
 	struct mlx4_ib_dev *dev;
 	/* the following lock protects both mcg_table and mcg_mgid0_list */
diff -druNp --no-dereference linux-libre-4.4.23-gnu/drivers/infiniband/hw/mlx4/qp.c linux-libre-4.4.24-gnu/drivers/infiniband/hw/mlx4/qp.c
--- linux-libre-4.4.23-gnu/drivers/infiniband/hw/mlx4/qp.c	2016-09-30 04:20:43.000000000 -0400
+++ linux-libre-4.4.24-gnu/drivers/infiniband/hw/mlx4/qp.c	2016-10-07 09:23:59.000000000 -0400
@@ -2331,24 +2331,27 @@ static int build_mlx_header(struct mlx4_
 		sqp->ud_header.grh.flow_label    =
 			ah->av.ib.sl_tclass_flowlabel & cpu_to_be32(0xfffff);
 		sqp->ud_header.grh.hop_limit     = ah->av.ib.hop_limit;
-		if (is_eth)
+		if (is_eth) {
 			memcpy(sqp->ud_header.grh.source_gid.raw, sgid.raw, 16);
-		else {
-		if (mlx4_is_mfunc(to_mdev(ib_dev)->dev)) {
-			/* When multi-function is enabled, the ib_core gid
-			 * indexes don't necessarily match the hw ones, so
-			 * we must use our own cache */
-			sqp->ud_header.grh.source_gid.global.subnet_prefix =
-				to_mdev(ib_dev)->sriov.demux[sqp->qp.port - 1].
-						       subnet_prefix;
-			sqp->ud_header.grh.source_gid.global.interface_id =
-				to_mdev(ib_dev)->sriov.demux[sqp->qp.port - 1].
-					       guid_cache[ah->av.ib.gid_index];
-		} else
-			ib_get_cached_gid(ib_dev,
-					  be32_to_cpu(ah->av.ib.port_pd) >> 24,
-					  ah->av.ib.gid_index,
-					  &sqp->ud_header.grh.source_gid, NULL);
+		} else {
+			if (mlx4_is_mfunc(to_mdev(ib_dev)->dev)) {
+				/* When multi-function is enabled, the ib_core gid
+				 * indexes don't necessarily match the hw ones, so
+				 * we must use our own cache
+				 */
+				sqp->ud_header.grh.source_gid.global.subnet_prefix =
+					cpu_to_be64(atomic64_read(&(to_mdev(ib_dev)->sriov.
+								    demux[sqp->qp.port - 1].
+								    subnet_prefix)));
+				sqp->ud_header.grh.source_gid.global.interface_id =
+					to_mdev(ib_dev)->sriov.demux[sqp->qp.port - 1].
+						       guid_cache[ah->av.ib.gid_index];
+			} else {
+				ib_get_cached_gid(ib_dev,
+						  be32_to_cpu(ah->av.ib.port_pd) >> 24,
+						  ah->av.ib.gid_index,
+						  &sqp->ud_header.grh.source_gid, NULL);
+			}
 		}
 		memcpy(sqp->ud_header.grh.destination_gid.raw,
 		       ah->av.ib.dgid, 16);
diff -druNp --no-dereference linux-libre-4.4.23-gnu/drivers/infiniband/ulp/ipoib/ipoib_cm.c linux-libre-4.4.24-gnu/drivers/infiniband/ulp/ipoib/ipoib_cm.c
--- linux-libre-4.4.23-gnu/drivers/infiniband/ulp/ipoib/ipoib_cm.c	2016-09-30 04:20:43.000000000 -0400
+++ linux-libre-4.4.24-gnu/drivers/infiniband/ulp/ipoib/ipoib_cm.c	2016-10-07 09:23:59.000000000 -0400
@@ -1299,6 +1299,8 @@ void ipoib_cm_destroy_tx(struct ipoib_cm
 	}
 }
 
+#define QPN_AND_OPTIONS_OFFSET	4
+
 static void ipoib_cm_tx_start(struct work_struct *work)
 {
 	struct ipoib_dev_priv *priv = container_of(work, struct ipoib_dev_priv,
@@ -1307,6 +1309,7 @@ static void ipoib_cm_tx_start(struct wor
 	struct ipoib_neigh *neigh;
 	struct ipoib_cm_tx *p;
 	unsigned long flags;
+	struct ipoib_path *path;
 	int ret;
 
 	struct ib_sa_path_rec pathrec;
@@ -1319,7 +1322,19 @@ static void ipoib_cm_tx_start(struct wor
 		p = list_entry(priv->cm.start_list.next, typeof(*p), list);
 		list_del_init(&p->list);
 		neigh = p->neigh;
+
 		qpn = IPOIB_QPN(neigh->daddr);
+		/*
+		 * As long as the search is with these 2 locks,
+		 * path existence indicates its validity.
+		 */
+		path = __path_find(dev, neigh->daddr + QPN_AND_OPTIONS_OFFSET);
+		if (!path) {
+			pr_info("%s ignore not valid path %pI6\n",
+				__func__,
+				neigh->daddr + QPN_AND_OPTIONS_OFFSET);
+			goto free_neigh;
+		}
 		memcpy(&pathrec, &p->path->pathrec, sizeof pathrec);
 
 		spin_unlock_irqrestore(&priv->lock, flags);
@@ -1331,6 +1346,7 @@ static void ipoib_cm_tx_start(struct wor
 		spin_lock_irqsave(&priv->lock, flags);
 
 		if (ret) {
+free_neigh:
 			neigh = p->neigh;
 			if (neigh) {
 				neigh->cm = NULL;
diff -druNp --no-dereference linux-libre-4.4.23-gnu/drivers/infiniband/ulp/ipoib/ipoib.h linux-libre-4.4.24-gnu/drivers/infiniband/ulp/ipoib/ipoib.h
--- linux-libre-4.4.23-gnu/drivers/infiniband/ulp/ipoib/ipoib.h	2016-09-30 04:20:43.000000000 -0400
+++ linux-libre-4.4.24-gnu/drivers/infiniband/ulp/ipoib/ipoib.h	2016-10-07 09:23:59.000000000 -0400
@@ -472,6 +472,7 @@ void ipoib_send(struct net_device *dev,
 		struct ipoib_ah *address, u32 qpn);
 void ipoib_reap_ah(struct work_struct *work);
 
+struct ipoib_path *__path_find(struct net_device *dev, void *gid);
 void ipoib_mark_paths_invalid(struct net_device *dev);
 void ipoib_flush_paths(struct net_device *dev);
 struct ipoib_dev_priv *ipoib_intf_alloc(const char *format);
diff -druNp --no-dereference linux-libre-4.4.23-gnu/drivers/infiniband/ulp/ipoib/ipoib_ib.c linux-libre-4.4.24-gnu/drivers/infiniband/ulp/ipoib/ipoib_ib.c
--- linux-libre-4.4.23-gnu/drivers/infiniband/ulp/ipoib/ipoib_ib.c	2016-09-30 04:20:43.000000000 -0400
+++ linux-libre-4.4.24-gnu/drivers/infiniband/ulp/ipoib/ipoib_ib.c	2016-10-07 09:23:59.000000000 -0400
@@ -1028,8 +1028,17 @@ static void __ipoib_ib_dev_flush(struct
 	}
 
 	if (level == IPOIB_FLUSH_LIGHT) {
+		int oper_up;
 		ipoib_mark_paths_invalid(dev);
+		/* Set IPoIB operation as down to prevent races between:
+		 * the flush flow which leaves MCG and on the fly joins
+		 * which can happen during that time. mcast restart task
+		 * should deal with join requests we missed.
+		 */
+		oper_up = test_and_clear_bit(IPOIB_FLAG_OPER_UP, &priv->flags);
 		ipoib_mcast_dev_flush(dev);
+		if (oper_up)
+			set_bit(IPOIB_FLAG_OPER_UP, &priv->flags);
 		ipoib_flush_ah(dev);
 	}
 
diff -druNp --no-dereference linux-libre-4.4.23-gnu/drivers/infiniband/ulp/ipoib/ipoib_main.c linux-libre-4.4.24-gnu/drivers/infiniband/ulp/ipoib/ipoib_main.c
--- linux-libre-4.4.23-gnu/drivers/infiniband/ulp/ipoib/ipoib_main.c	2016-09-30 04:20:43.000000000 -0400
+++ linux-libre-4.4.24-gnu/drivers/infiniband/ulp/ipoib/ipoib_main.c	2016-10-07 09:23:59.000000000 -0400
@@ -481,7 +481,7 @@ int ipoib_set_mode(struct net_device *de
 	return -EINVAL;
 }
 
-static struct ipoib_path *__path_find(struct net_device *dev, void *gid)
+struct ipoib_path *__path_find(struct net_device *dev, void *gid)
 {
 	struct ipoib_dev_priv *priv = netdev_priv(dev);
 	struct rb_node *n = priv->path_tree.rb_node;
diff -druNp --no-dereference linux-libre-4.4.23-gnu/drivers/irqchip/irq-gic-v3.c linux-libre-4.4.24-gnu/drivers/irqchip/irq-gic-v3.c
--- linux-libre-4.4.23-gnu/drivers/irqchip/irq-gic-v3.c	2016-09-30 04:20:43.000000000 -0400
+++ linux-libre-4.4.24-gnu/drivers/irqchip/irq-gic-v3.c	2016-10-07 09:23:59.000000000 -0400
@@ -544,7 +544,7 @@ static struct notifier_block gic_cpu_not
 static u16 gic_compute_target_list(int *base_cpu, const struct cpumask *mask,
 				   unsigned long cluster_id)
 {
-	int cpu = *base_cpu;
+	int next_cpu, cpu = *base_cpu;
 	unsigned long mpidr = cpu_logical_map(cpu);
 	u16 tlist = 0;
 
@@ -558,9 +558,10 @@ static u16 gic_compute_target_list(int *
 
 		tlist |= 1 << (mpidr & 0xf);
 
-		cpu = cpumask_next(cpu, mask);
-		if (cpu >= nr_cpu_ids)
+		next_cpu = cpumask_next(cpu, mask);
+		if (next_cpu >= nr_cpu_ids)
 			goto out;
+		cpu = next_cpu;
 
 		mpidr = cpu_logical_map(cpu);
 
diff -druNp --no-dereference linux-libre-4.4.23-gnu/drivers/md/dm-log-writes.c linux-libre-4.4.24-gnu/drivers/md/dm-log-writes.c
--- linux-libre-4.4.23-gnu/drivers/md/dm-log-writes.c	2016-09-30 04:20:43.000000000 -0400
+++ linux-libre-4.4.24-gnu/drivers/md/dm-log-writes.c	2016-10-07 09:23:59.000000000 -0400
@@ -259,7 +259,7 @@ static int log_one_block(struct log_writ
 	sector++;
 
 	atomic_inc(&lc->io_blocks);
-	bio = bio_alloc(GFP_KERNEL, block->vec_cnt);
+	bio = bio_alloc(GFP_KERNEL, min(block->vec_cnt, BIO_MAX_PAGES));
 	if (!bio) {
 		DMERR("Couldn't alloc log bio");
 		goto error;
@@ -280,7 +280,7 @@ static int log_one_block(struct log_writ
 		if (ret != block->vecs[i].bv_len) {
 			atomic_inc(&lc->io_blocks);
 			submit_bio(WRITE, bio);
-			bio = bio_alloc(GFP_KERNEL, block->vec_cnt - i);
+			bio = bio_alloc(GFP_KERNEL, min(block->vec_cnt - i, BIO_MAX_PAGES));
 			if (!bio) {
 				DMERR("Couldn't alloc log bio");
 				goto error;
diff -druNp --no-dereference linux-libre-4.4.23-gnu/drivers/media/usb/em28xx/em28xx-i2c.c linux-libre-4.4.24-gnu/drivers/media/usb/em28xx/em28xx-i2c.c
--- linux-libre-4.4.23-gnu/drivers/media/usb/em28xx/em28xx-i2c.c	2016-09-30 04:20:43.000000000 -0400
+++ linux-libre-4.4.24-gnu/drivers/media/usb/em28xx/em28xx-i2c.c	2016-10-07 09:23:59.000000000 -0400
@@ -507,9 +507,8 @@ static int em28xx_i2c_xfer(struct i2c_ad
 	if (dev->disconnected)
 		return -ENODEV;
 
-	rc = rt_mutex_trylock(&dev->i2c_bus_lock);
-	if (rc < 0)
-		return rc;
+	if (!rt_mutex_trylock(&dev->i2c_bus_lock))
+		return -EAGAIN;
 
 	/* Switch I2C bus if needed */
 	if (bus != dev->cur_i2c_bus &&
diff -druNp --no-dereference linux-libre-4.4.23-gnu/drivers/media/usb/gspca/cpia1.c linux-libre-4.4.24-gnu/drivers/media/usb/gspca/cpia1.c
--- linux-libre-4.4.23-gnu/drivers/media/usb/gspca/cpia1.c	2016-09-30 04:20:43.000000000 -0400
+++ linux-libre-4.4.24-gnu/drivers/media/usb/gspca/cpia1.c	2016-10-07 09:23:59.000000000 -0400
@@ -1624,7 +1624,7 @@ static int sd_start(struct gspca_dev *gs
 
 static void sd_stopN(struct gspca_dev *gspca_dev)
 {
-	struct sd *sd = (struct sd *) gspca_dev;
+	struct sd *sd __maybe_unused = (struct sd *) gspca_dev;
 
 	command_pause(gspca_dev);
 
diff -druNp --no-dereference linux-libre-4.4.23-gnu/drivers/media/usb/gspca/konica.c linux-libre-4.4.24-gnu/drivers/media/usb/gspca/konica.c
--- linux-libre-4.4.23-gnu/drivers/media/usb/gspca/konica.c	2016-09-30 04:20:43.000000000 -0400
+++ linux-libre-4.4.24-gnu/drivers/media/usb/gspca/konica.c	2016-10-07 09:23:59.000000000 -0400
@@ -243,7 +243,7 @@ static int sd_start(struct gspca_dev *gs
 
 static void sd_stopN(struct gspca_dev *gspca_dev)
 {
-	struct sd *sd = (struct sd *) gspca_dev;
+	struct sd *sd __maybe_unused = (struct sd *) gspca_dev;
 
 	konica_stream_off(gspca_dev);
 #if IS_ENABLED(CONFIG_INPUT)
diff -druNp --no-dereference linux-libre-4.4.23-gnu/drivers/media/usb/gspca/t613.c linux-libre-4.4.24-gnu/drivers/media/usb/gspca/t613.c
--- linux-libre-4.4.23-gnu/drivers/media/usb/gspca/t613.c	2016-09-30 04:20:43.000000000 -0400
+++ linux-libre-4.4.24-gnu/drivers/media/usb/gspca/t613.c	2016-10-07 09:23:59.000000000 -0400
@@ -837,7 +837,7 @@ static void sd_pkt_scan(struct gspca_dev
 			u8 *data,			/* isoc packet */
 			int len)			/* iso packet length */
 {
-	struct sd *sd = (struct sd *) gspca_dev;
+	struct sd *sd __maybe_unused = (struct sd *) gspca_dev;
 	int pkt_type;
 
 	if (data[0] == 0x5a) {
diff -druNp --no-dereference linux-libre-4.4.23-gnu/drivers/mmc/host/pxamci.c linux-libre-4.4.24-gnu/drivers/mmc/host/pxamci.c
--- linux-libre-4.4.23-gnu/drivers/mmc/host/pxamci.c	2016-09-30 04:20:43.000000000 -0400
+++ linux-libre-4.4.24-gnu/drivers/mmc/host/pxamci.c	2016-10-07 09:23:59.000000000 -0400
@@ -798,14 +798,16 @@ static int pxamci_probe(struct platform_
 		gpio_direction_output(gpio_power,
 				      host->pdata->gpio_power_invert);
 	}
-	if (gpio_is_valid(gpio_ro))
+	if (gpio_is_valid(gpio_ro)) {
 		ret = mmc_gpio_request_ro(mmc, gpio_ro);
-	if (ret) {
-		dev_err(&pdev->dev, "Failed requesting gpio_ro %d\n", gpio_ro);
-		goto out;
-	} else {
-		mmc->caps2 |= host->pdata->gpio_card_ro_invert ?
-			0 : MMC_CAP2_RO_ACTIVE_HIGH;
+		if (ret) {
+			dev_err(&pdev->dev, "Failed requesting gpio_ro %d\n",
+				gpio_ro);
+			goto out;
+		} else {
+			mmc->caps2 |= host->pdata->gpio_card_ro_invert ?
+				0 : MMC_CAP2_RO_ACTIVE_HIGH;
+		}
 	}
 
 	if (gpio_is_valid(gpio_cd))
diff -druNp --no-dereference linux-libre-4.4.23-gnu/drivers/mtd/nand/davinci_nand.c linux-libre-4.4.24-gnu/drivers/mtd/nand/davinci_nand.c
--- linux-libre-4.4.23-gnu/drivers/mtd/nand/davinci_nand.c	2016-09-30 04:20:43.000000000 -0400
+++ linux-libre-4.4.24-gnu/drivers/mtd/nand/davinci_nand.c	2016-10-07 09:23:59.000000000 -0400
@@ -241,6 +241,9 @@ static void nand_davinci_hwctl_4bit(stru
 	unsigned long flags;
 	u32 val;
 
+	/* Reset ECC hardware */
+	davinci_nand_readl(info, NAND_4BIT_ECC1_OFFSET);
+
 	spin_lock_irqsave(&davinci_nand_lock, flags);
 
 	/* Start 4-bit ECC calculation for read/write */
diff -druNp --no-dereference linux-libre-4.4.23-gnu/drivers/net/can/dev.c linux-libre-4.4.24-gnu/drivers/net/can/dev.c
--- linux-libre-4.4.23-gnu/drivers/net/can/dev.c	2016-09-30 04:20:43.000000000 -0400
+++ linux-libre-4.4.24-gnu/drivers/net/can/dev.c	2016-10-07 09:23:59.000000000 -0400
@@ -21,6 +21,7 @@
 #include <linux/slab.h>
 #include <linux/netdevice.h>
 #include <linux/if_arp.h>
+#include <linux/workqueue.h>
 #include <linux/can.h>
 #include <linux/can/dev.h>
 #include <linux/can/skb.h>
@@ -471,9 +472,8 @@ EXPORT_SYMBOL_GPL(can_free_echo_skb);
 /*
  * CAN device restart for bus-off recovery
  */
-static void can_restart(unsigned long data)
+static void can_restart(struct net_device *dev)
 {
-	struct net_device *dev = (struct net_device *)data;
 	struct can_priv *priv = netdev_priv(dev);
 	struct net_device_stats *stats = &dev->stats;
 	struct sk_buff *skb;
@@ -513,6 +513,14 @@ restart:
 		netdev_err(dev, "Error %d during restart", err);
 }
 
+static void can_restart_work(struct work_struct *work)
+{
+	struct delayed_work *dwork = to_delayed_work(work);
+	struct can_priv *priv = container_of(dwork, struct can_priv, restart_work);
+
+	can_restart(priv->dev);
+}
+
 int can_restart_now(struct net_device *dev)
 {
 	struct can_priv *priv = netdev_priv(dev);
@@ -526,8 +534,8 @@ int can_restart_now(struct net_device *d
 	if (priv->state != CAN_STATE_BUS_OFF)
 		return -EBUSY;
 
-	/* Runs as soon as possible in the timer context */
-	mod_timer(&priv->restart_timer, jiffies);
+	cancel_delayed_work_sync(&priv->restart_work);
+	can_restart(dev);
 
 	return 0;
 }
@@ -548,8 +556,8 @@ void can_bus_off(struct net_device *dev)
 	netif_carrier_off(dev);
 
 	if (priv->restart_ms)
-		mod_timer(&priv->restart_timer,
-			  jiffies + (priv->restart_ms * HZ) / 1000);
+		schedule_delayed_work(&priv->restart_work,
+				      msecs_to_jiffies(priv->restart_ms));
 }
 EXPORT_SYMBOL_GPL(can_bus_off);
 
@@ -658,6 +666,7 @@ struct net_device *alloc_candev(int size
 		return NULL;
 
 	priv = netdev_priv(dev);
+	priv->dev = dev;
 
 	if (echo_skb_max) {
 		priv->echo_skb_max = echo_skb_max;
@@ -667,7 +676,7 @@ struct net_device *alloc_candev(int size
 
 	priv->state = CAN_STATE_STOPPED;
 
-	init_timer(&priv->restart_timer);
+	INIT_DELAYED_WORK(&priv->restart_work, can_restart_work);
 
 	return dev;
 }
@@ -748,8 +757,6 @@ int open_candev(struct net_device *dev)
 	if (!netif_carrier_ok(dev))
 		netif_carrier_on(dev);
 
-	setup_timer(&priv->restart_timer, can_restart, (unsigned long)dev);
-
 	return 0;
 }
 EXPORT_SYMBOL_GPL(open_candev);
@@ -764,7 +771,7 @@ void close_candev(struct net_device *dev
 {
 	struct can_priv *priv = netdev_priv(dev);
 
-	del_timer_sync(&priv->restart_timer);
+	cancel_delayed_work_sync(&priv->restart_work);
 	can_flush_echo_skb(dev);
 }
 EXPORT_SYMBOL_GPL(close_candev);
diff -druNp --no-dereference linux-libre-4.4.23-gnu/drivers/net/ethernet/intel/i40e/i40e_common.c linux-libre-4.4.24-gnu/drivers/net/ethernet/intel/i40e/i40e_common.c
--- linux-libre-4.4.23-gnu/drivers/net/ethernet/intel/i40e/i40e_common.c	2016-09-30 04:20:43.000000000 -0400
+++ linux-libre-4.4.24-gnu/drivers/net/ethernet/intel/i40e/i40e_common.c	2016-10-07 09:23:59.000000000 -0400
@@ -302,13 +302,15 @@ void i40e_debug_aq(struct i40e_hw *hw, e
 		   void *buffer, u16 buf_len)
 {
 	struct i40e_aq_desc *aq_desc = (struct i40e_aq_desc *)desc;
-	u16 len = le16_to_cpu(aq_desc->datalen);
+	u16 len;
 	u8 *buf = (u8 *)buffer;
 	u16 i = 0;
 
 	if ((!(mask & hw->debug_mask)) || (desc == NULL))
 		return;
 
+	len = le16_to_cpu(aq_desc->datalen);
+
 	i40e_debug(hw, mask,
 		   "AQ CMD: opcode 0x%04X, flags 0x%04X, datalen 0x%04X, retval 0x%04X\n",
 		   le16_to_cpu(aq_desc->opcode),
diff -druNp --no-dereference linux-libre-4.4.23-gnu/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c linux-libre-4.4.24-gnu/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
--- linux-libre-4.4.23-gnu/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c	2016-09-30 04:20:43.000000000 -0400
+++ linux-libre-4.4.24-gnu/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c	2016-10-07 09:23:59.000000000 -0400
@@ -4176,7 +4176,7 @@ static void ath9k_hw_ar9300_set_board_va
 	if (!AR_SREV_9330(ah) && !AR_SREV_9340(ah) && !AR_SREV_9531(ah))
 		ar9003_hw_internal_regulator_apply(ah);
 	ar9003_hw_apply_tuning_caps(ah);
-	ar9003_hw_apply_minccapwr_thresh(ah, chan);
+	ar9003_hw_apply_minccapwr_thresh(ah, is2ghz);
 	ar9003_hw_txend_to_xpa_off_apply(ah, is2ghz);
 	ar9003_hw_thermometer_apply(ah);
 	ar9003_hw_thermo_cal_apply(ah);
diff -druNp --no-dereference linux-libre-4.4.23-gnu/drivers/net/wireless/brcm80211/brcmfmac/bcmsdh.c linux-libre-4.4.24-gnu/drivers/net/wireless/brcm80211/brcmfmac/bcmsdh.c
--- linux-libre-4.4.23-gnu/drivers/net/wireless/brcm80211/brcmfmac/bcmsdh.c	2016-09-30 04:20:43.000000000 -0400
+++ linux-libre-4.4.24-gnu/drivers/net/wireless/brcm80211/brcmfmac/bcmsdh.c	2016-10-07 09:23:59.000000000 -0400
@@ -726,8 +726,10 @@ int brcmf_sdiod_recv_chain(struct brcmf_
 			return -ENOMEM;
 		err = brcmf_sdiod_buffrw(sdiodev, SDIO_FUNC_2, false, addr,
 					 glom_skb);
-		if (err)
+		if (err) {
+			brcmu_pkt_buf_free_skb(glom_skb);
 			goto done;
+		}
 
 		skb_queue_walk(pktq, skb) {
 			memcpy(skb->data, glom_skb->data, skb->len);
diff -druNp --no-dereference linux-libre-4.4.23-gnu/drivers/net/wireless/brcm80211/brcmsmac/dma.c linux-libre-4.4.24-gnu/drivers/net/wireless/brcm80211/brcmsmac/dma.c
--- linux-libre-4.4.23-gnu/drivers/net/wireless/brcm80211/brcmsmac/dma.c	2016-09-30 04:20:43.000000000 -0400
+++ linux-libre-4.4.24-gnu/drivers/net/wireless/brcm80211/brcmsmac/dma.c	2016-10-07 09:23:59.000000000 -0400
@@ -1079,8 +1079,10 @@ bool dma_rxfill(struct dma_pub *pub)
 
 		pa = dma_map_single(di->dmadev, p->data, di->rxbufsize,
 				    DMA_FROM_DEVICE);
-		if (dma_mapping_error(di->dmadev, pa))
+		if (dma_mapping_error(di->dmadev, pa)) {
+			brcmu_pkt_buf_free_skb(p);
 			return false;
+		}
 
 		/* save the free packet pointer */
 		di->rxp[rxout] = p;
diff -druNp --no-dereference linux-libre-4.4.23-gnu/drivers/net/wireless/brcm80211/brcmsmac/stf.c linux-libre-4.4.24-gnu/drivers/net/wireless/brcm80211/brcmsmac/stf.c
--- linux-libre-4.4.23-gnu/drivers/net/wireless/brcm80211/brcmsmac/stf.c	2016-09-30 04:20:43.000000000 -0400
+++ linux-libre-4.4.24-gnu/drivers/net/wireless/brcm80211/brcmsmac/stf.c	2016-10-07 09:23:59.000000000 -0400
@@ -87,7 +87,7 @@ void
 brcms_c_stf_ss_algo_channel_get(struct brcms_c_info *wlc, u16 *ss_algo_channel,
 			    u16 chanspec)
 {
-	struct tx_power power;
+	struct tx_power power = { };
 	u8 siso_mcs_id, cdd_mcs_id, stbc_mcs_id;
 
 	/* Clear previous settings */
diff -druNp --no-dereference linux-libre-4.4.23-gnu/drivers/net/wireless/iwlwifi/mvm/fw.c linux-libre-4.4.24-gnu/drivers/net/wireless/iwlwifi/mvm/fw.c
--- linux-libre-4.4.23-gnu/drivers/net/wireless/iwlwifi/mvm/fw.c	2016-09-30 04:20:43.000000000 -0400
+++ linux-libre-4.4.24-gnu/drivers/net/wireless/iwlwifi/mvm/fw.c	2016-10-07 09:23:59.000000000 -0400
@@ -935,7 +935,8 @@ int iwl_mvm_start_fw_dbg_conf(struct iwl
 	}
 
 	mvm->fw_dbg_conf = conf_id;
-	return ret;
+
+	return 0;
 }
 
 static int iwl_mvm_config_ltr(struct iwl_mvm *mvm)
diff -druNp --no-dereference linux-libre-4.4.23-gnu/drivers/net/wireless/iwlwifi/mvm/mac80211.c linux-libre-4.4.24-gnu/drivers/net/wireless/iwlwifi/mvm/mac80211.c
--- linux-libre-4.4.23-gnu/drivers/net/wireless/iwlwifi/mvm/mac80211.c	2016-09-30 04:20:43.000000000 -0400
+++ linux-libre-4.4.24-gnu/drivers/net/wireless/iwlwifi/mvm/mac80211.c	2016-10-07 09:23:59.000000000 -0400
@@ -3992,8 +3992,8 @@ static int iwl_mvm_mac_get_survey(struct
 	if (idx != 0)
 		return -ENOENT;
 
-	if (fw_has_capa(&mvm->fw->ucode_capa,
-			IWL_UCODE_TLV_CAPA_RADIO_BEACON_STATS))
+	if (!fw_has_capa(&mvm->fw->ucode_capa,
+			 IWL_UCODE_TLV_CAPA_RADIO_BEACON_STATS))
 		return -ENOENT;
 
 	mutex_lock(&mvm->mutex);
@@ -4039,8 +4039,8 @@ static void iwl_mvm_mac_sta_statistics(s
 	struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
 	struct iwl_mvm_sta *mvmsta = iwl_mvm_sta_from_mac80211(sta);
 
-	if (fw_has_capa(&mvm->fw->ucode_capa,
-			IWL_UCODE_TLV_CAPA_RADIO_BEACON_STATS))
+	if (!fw_has_capa(&mvm->fw->ucode_capa,
+			 IWL_UCODE_TLV_CAPA_RADIO_BEACON_STATS))
 		return;
 
 	/* if beacon filtering isn't on mac80211 does it anyway */
diff -druNp --no-dereference linux-libre-4.4.23-gnu/drivers/net/wireless/iwlwifi/mvm/sf.c linux-libre-4.4.24-gnu/drivers/net/wireless/iwlwifi/mvm/sf.c
--- linux-libre-4.4.23-gnu/drivers/net/wireless/iwlwifi/mvm/sf.c	2016-09-30 04:20:43.000000000 -0400
+++ linux-libre-4.4.24-gnu/drivers/net/wireless/iwlwifi/mvm/sf.c	2016-10-07 09:23:59.000000000 -0400
@@ -215,7 +215,7 @@ static int iwl_mvm_sf_config(struct iwl_
 			     enum iwl_sf_state new_state)
 {
 	struct iwl_sf_cfg_cmd sf_cmd = {
-		.state = cpu_to_le32(SF_FULL_ON),
+		.state = cpu_to_le32(new_state),
 	};
 	struct ieee80211_sta *sta;
 	int ret = 0;
diff -druNp --no-dereference linux-libre-4.4.23-gnu/drivers/net/wireless/iwlwifi/pcie/tx.c linux-libre-4.4.24-gnu/drivers/net/wireless/iwlwifi/pcie/tx.c
--- linux-libre-4.4.23-gnu/drivers/net/wireless/iwlwifi/pcie/tx.c	2016-09-30 04:20:43.000000000 -0400
+++ linux-libre-4.4.24-gnu/drivers/net/wireless/iwlwifi/pcie/tx.c	2016-10-07 09:23:59.000000000 -0400
@@ -1508,9 +1508,9 @@ static int iwl_pcie_enqueue_hcmd(struct
 
 	/* start the TFD with the scratchbuf */
 	scratch_size = min_t(int, copy_size, IWL_HCMD_SCRATCHBUF_SIZE);
-	memcpy(&txq->scratchbufs[q->write_ptr], &out_cmd->hdr, scratch_size);
+	memcpy(&txq->scratchbufs[idx], &out_cmd->hdr, scratch_size);
 	iwl_pcie_txq_build_tfd(trans, txq,
-			       iwl_pcie_get_scratchbuf_dma(txq, q->write_ptr),
+			       iwl_pcie_get_scratchbuf_dma(txq, idx),
 			       scratch_size, true);
 
 	/* map first command fragment, if any remains */
diff -druNp --no-dereference linux-libre-4.4.23-gnu/drivers/nfc/fdp/fdp.c linux-libre-4.4.24-gnu/drivers/nfc/fdp/fdp.c
--- linux-libre-4.4.23-gnu/drivers/nfc/fdp/fdp.c	2016-09-30 07:17:33.000000000 -0400
+++ linux-libre-4.4.24-gnu/drivers/nfc/fdp/fdp.c	2016-10-08 02:59:30.000000000 -0400
@@ -352,7 +352,7 @@ static int fdp_nci_patch_otp(struct nci_
 {
 	struct fdp_nci_info *info = nci_get_drvdata(ndev);
 	struct device *dev = &info->phy->i2c_dev->dev;
-	u8 conn_id;
+	int conn_id;
 	int r = 0;
 
 	if (info->otp_version >= info->otp_patch_version)
@@ -423,7 +423,7 @@ static int fdp_nci_patch_ram(struct nci_
 {
 	struct fdp_nci_info *info = nci_get_drvdata(ndev);
 	struct device *dev = &info->phy->i2c_dev->dev;
-	u8 conn_id;
+	int conn_id;
 	int r = 0;
 
 	if (info->ram_version >= info->ram_patch_version)
diff -druNp --no-dereference linux-libre-4.4.23-gnu/drivers/perf/arm_pmu.c linux-libre-4.4.24-gnu/drivers/perf/arm_pmu.c
--- linux-libre-4.4.23-gnu/drivers/perf/arm_pmu.c	2016-09-30 04:20:43.000000000 -0400
+++ linux-libre-4.4.24-gnu/drivers/perf/arm_pmu.c	2016-10-07 09:23:59.000000000 -0400
@@ -815,6 +815,7 @@ static int of_pmu_irq_cfg(struct arm_pmu
 			if (i > 0 && spi != using_spi) {
 				pr_err("PPI/SPI IRQ type mismatch for %s!\n",
 					dn->name);
+				of_node_put(dn);
 				kfree(irqs);
 				return -EINVAL;
 			}
diff -druNp --no-dereference linux-libre-4.4.23-gnu/drivers/pinctrl/uniphier/pinctrl-uniphier-core.c linux-libre-4.4.24-gnu/drivers/pinctrl/uniphier/pinctrl-uniphier-core.c
--- linux-libre-4.4.23-gnu/drivers/pinctrl/uniphier/pinctrl-uniphier-core.c	2016-09-30 04:20:43.000000000 -0400
+++ linux-libre-4.4.24-gnu/drivers/pinctrl/uniphier/pinctrl-uniphier-core.c	2016-10-07 09:23:59.000000000 -0400
@@ -73,6 +73,12 @@ static void uniphier_pctl_pin_dbg_show(s
 	case UNIPHIER_PIN_PULL_DOWN:
 		pull_dir = "DOWN";
 		break;
+	case UNIPHIER_PIN_PULL_UP_FIXED:
+		pull_dir = "UP(FIXED)";
+		break;
+	case UNIPHIER_PIN_PULL_DOWN_FIXED:
+		pull_dir = "DOWN(FIXED)";
+		break;
 	case UNIPHIER_PIN_PULL_NONE:
 		pull_dir = "NONE";
 		break;
diff -druNp --no-dereference linux-libre-4.4.23-gnu/drivers/regulator/qcom_smd-regulator.c linux-libre-4.4.24-gnu/drivers/regulator/qcom_smd-regulator.c
--- linux-libre-4.4.23-gnu/drivers/regulator/qcom_smd-regulator.c	2016-09-30 04:20:43.000000000 -0400
+++ linux-libre-4.4.24-gnu/drivers/regulator/qcom_smd-regulator.c	2016-10-07 09:23:59.000000000 -0400
@@ -166,29 +166,30 @@ static const struct regulator_desc pm8x4
 static const struct regulator_desc pm8841_ftsmps = {
 	.linear_ranges = (struct regulator_linear_range[]) {
 		REGULATOR_LINEAR_RANGE(350000,  0, 184, 5000),
-		REGULATOR_LINEAR_RANGE(700000, 185, 339, 10000),
+		REGULATOR_LINEAR_RANGE(1280000, 185, 261, 10000),
 	},
 	.n_linear_ranges = 2,
-	.n_voltages = 340,
+	.n_voltages = 262,
 	.ops = &rpm_smps_ldo_ops,
 };
 
 static const struct regulator_desc pm8941_boost = {
 	.linear_ranges = (struct regulator_linear_range[]) {
-		REGULATOR_LINEAR_RANGE(4000000, 0, 15, 100000),
+		REGULATOR_LINEAR_RANGE(4000000, 0, 30, 50000),
 	},
 	.n_linear_ranges = 1,
-	.n_voltages = 16,
+	.n_voltages = 31,
 	.ops = &rpm_smps_ldo_ops,
 };
 
 static const struct regulator_desc pm8941_pldo = {
 	.linear_ranges = (struct regulator_linear_range[]) {
-		REGULATOR_LINEAR_RANGE( 750000,  0,  30, 25000),
-		REGULATOR_LINEAR_RANGE(1500000, 31, 99, 50000),
+		REGULATOR_LINEAR_RANGE( 750000,  0,  63, 12500),
+		REGULATOR_LINEAR_RANGE(1550000, 64, 126, 25000),
+		REGULATOR_LINEAR_RANGE(3100000, 127, 163, 50000),
 	},
-	.n_linear_ranges = 2,
-	.n_voltages = 100,
+	.n_linear_ranges = 3,
+	.n_voltages = 164,
 	.ops = &rpm_smps_ldo_ops,
 };
 
diff -druNp --no-dereference linux-libre-4.4.23-gnu/drivers/regulator/qcom_spmi-regulator.c linux-libre-4.4.24-gnu/drivers/regulator/qcom_spmi-regulator.c
--- linux-libre-4.4.23-gnu/drivers/regulator/qcom_spmi-regulator.c	2016-09-30 04:20:43.000000000 -0400
+++ linux-libre-4.4.24-gnu/drivers/regulator/qcom_spmi-regulator.c	2016-10-07 09:23:59.000000000 -0400
@@ -1050,6 +1050,8 @@ static struct regulator_ops spmi_vs_ops
 	.set_pull_down		= spmi_regulator_common_set_pull_down,
 	.set_soft_start		= spmi_regulator_common_set_soft_start,
 	.set_over_current_protection = spmi_regulator_vs_ocp,
+	.set_mode		= spmi_regulator_common_set_mode,
+	.get_mode		= spmi_regulator_common_get_mode,
 };
 
 static struct regulator_ops spmi_boost_ops = {
@@ -1440,6 +1442,7 @@ static const struct spmi_regulator_data
 	{ "s1", 0x1400, "vdd_s1", },
 	{ "s2", 0x1700, "vdd_s2", },
 	{ "s3", 0x1a00, "vdd_s3", },
+	{ "s4", 0xa000, },
 	{ "l1", 0x4000, "vdd_l1_l3", },
 	{ "l2", 0x4100, "vdd_l2_lvs_1_2_3", },
 	{ "l3", 0x4200, "vdd_l1_l3", },
@@ -1467,8 +1470,8 @@ static const struct spmi_regulator_data
 	{ "lvs1", 0x8000, "vdd_l2_lvs_1_2_3", },
 	{ "lvs2", 0x8100, "vdd_l2_lvs_1_2_3", },
 	{ "lvs3", 0x8200, "vdd_l2_lvs_1_2_3", },
-	{ "mvs1", 0x8300, "vin_5vs", },
-	{ "mvs2", 0x8400, "vin_5vs", },
+	{ "5vs1", 0x8300, "vin_5vs", "ocp-5vs1", },
+	{ "5vs2", 0x8400, "vin_5vs", "ocp-5vs2", },
 	{ }
 };
 
diff -druNp --no-dereference linux-libre-4.4.23-gnu/drivers/scsi/fnic/fnic_fcs.c linux-libre-4.4.24-gnu/drivers/scsi/fnic/fnic_fcs.c
--- linux-libre-4.4.23-gnu/drivers/scsi/fnic/fnic_fcs.c	2016-09-30 04:20:43.000000000 -0400
+++ linux-libre-4.4.24-gnu/drivers/scsi/fnic/fnic_fcs.c	2016-10-07 09:23:59.000000000 -0400
@@ -954,8 +954,8 @@ int fnic_alloc_rq_frame(struct vnic_rq *
 	skb_put(skb, len);
 	pa = pci_map_single(fnic->pdev, skb->data, len, PCI_DMA_FROMDEVICE);
 
-	r = pci_dma_mapping_error(fnic->pdev, pa);
-	if (r) {
+	if (pci_dma_mapping_error(fnic->pdev, pa)) {
+		r = -ENOMEM;
 		printk(KERN_ERR "PCI mapping failed with error %d\n", r);
 		goto free_skb;
 	}
@@ -1093,8 +1093,8 @@ static int fnic_send_frame(struct fnic *
 
 	pa = pci_map_single(fnic->pdev, eth_hdr, tot_len, PCI_DMA_TODEVICE);
 
-	ret = pci_dma_mapping_error(fnic->pdev, pa);
-	if (ret) {
+	if (pci_dma_mapping_error(fnic->pdev, pa)) {
+		ret = -ENOMEM;
 		printk(KERN_ERR "DMA map failed with error %d\n", ret);
 		goto free_skb_on_err;
 	}
diff -druNp --no-dereference linux-libre-4.4.23-gnu/drivers/spi/spi-sh-msiof.c linux-libre-4.4.24-gnu/drivers/spi/spi-sh-msiof.c
--- linux-libre-4.4.23-gnu/drivers/spi/spi-sh-msiof.c	2016-09-30 04:20:43.000000000 -0400
+++ linux-libre-4.4.24-gnu/drivers/spi/spi-sh-msiof.c	2016-10-07 09:23:59.000000000 -0400
@@ -263,6 +263,9 @@ static void sh_msiof_spi_set_clk_regs(st
 
 	for (k = 0; k < ARRAY_SIZE(sh_msiof_spi_div_table); k++) {
 		brps = DIV_ROUND_UP(div, sh_msiof_spi_div_table[k].div);
+		/* SCR_BRDV_DIV_1 is valid only if BRPS is x 1/1 or x 1/2 */
+		if (sh_msiof_spi_div_table[k].div == 1 && brps > 2)
+			continue;
 		if (brps <= 32) /* max of brdv is 32 */
 			break;
 	}
diff -druNp --no-dereference linux-libre-4.4.23-gnu/drivers/staging/fbtft/fbtft-core.c linux-libre-4.4.24-gnu/drivers/staging/fbtft/fbtft-core.c
--- linux-libre-4.4.23-gnu/drivers/staging/fbtft/fbtft-core.c	2016-09-30 04:20:43.000000000 -0400
+++ linux-libre-4.4.24-gnu/drivers/staging/fbtft/fbtft-core.c	2016-10-07 09:23:59.000000000 -0400
@@ -392,11 +392,11 @@ static void fbtft_update_display(struct
 
 	if (unlikely(timeit)) {
 		ts_end = ktime_get();
-		if (ktime_to_ns(par->update_time))
+		if (!ktime_to_ns(par->update_time))
 			par->update_time = ts_start;
 
-		par->update_time = ts_start;
 		fps = ktime_us_delta(ts_start, par->update_time);
+		par->update_time = ts_start;
 		fps = fps ? 1000000 / fps : 0;
 
 		throughput = ktime_us_delta(ts_end, ts_start);
diff -druNp --no-dereference linux-libre-4.4.23-gnu/drivers/usb/class/usbtmc.c linux-libre-4.4.24-gnu/drivers/usb/class/usbtmc.c
--- linux-libre-4.4.23-gnu/drivers/usb/class/usbtmc.c	2016-09-30 04:20:43.000000000 -0400
+++ linux-libre-4.4.24-gnu/drivers/usb/class/usbtmc.c	2016-10-07 09:23:59.000000000 -0400
@@ -121,6 +121,7 @@ static void usbtmc_delete(struct kref *k
 	struct usbtmc_device_data *data = to_usbtmc_data(kref);
 
 	usb_put_dev(data->usb_dev);
+	kfree(data);
 }
 
 static int usbtmc_open(struct inode *inode, struct file *filp)
@@ -1104,7 +1105,7 @@ static int usbtmc_probe(struct usb_inter
 
 	dev_dbg(&intf->dev, "%s called\n", __func__);
 
-	data = devm_kzalloc(&intf->dev, sizeof(*data), GFP_KERNEL);
+	data = kmalloc(sizeof(*data), GFP_KERNEL);
 	if (!data)
 		return -ENOMEM;
 
diff -druNp --no-dereference linux-libre-4.4.23-gnu/drivers/usb/gadget/udc/fsl_qe_udc.c linux-libre-4.4.24-gnu/drivers/usb/gadget/udc/fsl_qe_udc.c
--- linux-libre-4.4.23-gnu/drivers/usb/gadget/udc/fsl_qe_udc.c	2016-09-30 04:20:43.000000000 -0400
+++ linux-libre-4.4.24-gnu/drivers/usb/gadget/udc/fsl_qe_udc.c	2016-10-07 09:23:59.000000000 -0400
@@ -1878,11 +1878,8 @@ static int qe_get_frame(struct usb_gadge
 
 	tmp = in_be16(&udc->usb_param->frame_n);
 	if (tmp & 0x8000)
-		tmp = tmp & 0x07ff;
-	else
-		tmp = -EINVAL;
-
-	return (int)tmp;
+		return tmp & 0x07ff;
+	return -EINVAL;
 }
 
 static int fsl_qe_start(struct usb_gadget *gadget,
diff -druNp --no-dereference linux-libre-4.4.23-gnu/drivers/usb/misc/legousbtower.c linux-libre-4.4.24-gnu/drivers/usb/misc/legousbtower.c
--- linux-libre-4.4.23-gnu/drivers/usb/misc/legousbtower.c	2016-09-30 04:20:43.000000000 -0400
+++ linux-libre-4.4.24-gnu/drivers/usb/misc/legousbtower.c	2016-10-07 09:23:59.000000000 -0400
@@ -898,24 +898,6 @@ static int tower_probe (struct usb_inter
 	dev->interrupt_in_interval = interrupt_in_interval ? interrupt_in_interval : dev->interrupt_in_endpoint->bInterval;
 	dev->interrupt_out_interval = interrupt_out_interval ? interrupt_out_interval : dev->interrupt_out_endpoint->bInterval;
 
-	/* we can register the device now, as it is ready */
-	usb_set_intfdata (interface, dev);
-
-	retval = usb_register_dev (interface, &tower_class);
-
-	if (retval) {
-		/* something prevented us from registering this driver */
-		dev_err(idev, "Not able to get a minor for this device.\n");
-		usb_set_intfdata (interface, NULL);
-		goto error;
-	}
-	dev->minor = interface->minor;
-
-	/* let the user know what node this device is now attached to */
-	dev_info(&interface->dev, "LEGO USB Tower #%d now attached to major "
-		 "%d minor %d\n", (dev->minor - LEGO_USB_TOWER_MINOR_BASE),
-		 USB_MAJOR, dev->minor);
-
 	/* get the firmware version and log it */
 	result = usb_control_msg (udev,
 				  usb_rcvctrlpipe(udev, 0),
@@ -936,6 +918,23 @@ static int tower_probe (struct usb_inter
 		 get_version_reply.minor,
 		 le16_to_cpu(get_version_reply.build_no));
 
+	/* we can register the device now, as it is ready */
+	usb_set_intfdata (interface, dev);
+
+	retval = usb_register_dev (interface, &tower_class);
+
+	if (retval) {
+		/* something prevented us from registering this driver */
+		dev_err(idev, "Not able to get a minor for this device.\n");
+		usb_set_intfdata (interface, NULL);
+		goto error;
+	}
+	dev->minor = interface->minor;
+
+	/* let the user know what node this device is now attached to */
+	dev_info(&interface->dev, "LEGO USB Tower #%d now attached to major "
+		 "%d minor %d\n", (dev->minor - LEGO_USB_TOWER_MINOR_BASE),
+		 USB_MAJOR, dev->minor);
 
 exit:
 	return retval;
diff -druNp --no-dereference linux-libre-4.4.23-gnu/drivers/usb/musb/musb_host.c linux-libre-4.4.24-gnu/drivers/usb/musb/musb_host.c
--- linux-libre-4.4.23-gnu/drivers/usb/musb/musb_host.c	2016-09-30 04:20:43.000000000 -0400
+++ linux-libre-4.4.24-gnu/drivers/usb/musb/musb_host.c	2016-10-07 09:23:59.000000000 -0400
@@ -661,7 +661,7 @@ static int musb_tx_dma_set_mode_mentor(s
 		csr &= ~(MUSB_TXCSR_AUTOSET | MUSB_TXCSR_DMAMODE);
 		csr |= MUSB_TXCSR_DMAENAB; /* against programmer's guide */
 	}
-	channel->desired_mode = mode;
+	channel->desired_mode = *mode;
 	musb_writew(epio, MUSB_TXCSR, csr);
 
 	return 0;
@@ -2008,10 +2008,8 @@ void musb_host_rx(struct musb *musb, u8
 				qh->offset,
 				urb->transfer_buffer_length);
 
-			done = musb_rx_dma_in_inventra_cppi41(c, hw_ep, qh,
-							      urb, xfer_len,
-							      iso_err);
-			if (done)
+			if (musb_rx_dma_in_inventra_cppi41(c, hw_ep, qh, urb,
+							   xfer_len, iso_err))
 				goto finish;
 			else
 				dev_err(musb->controller, "error: rx_dma failed\n");
diff -druNp --no-dereference linux-libre-4.4.23-gnu/drivers/usb/serial/cp210x.c linux-libre-4.4.24-gnu/drivers/usb/serial/cp210x.c
--- linux-libre-4.4.23-gnu/drivers/usb/serial/cp210x.c	2016-09-30 04:20:43.000000000 -0400
+++ linux-libre-4.4.24-gnu/drivers/usb/serial/cp210x.c	2016-10-07 09:23:59.000000000 -0400
@@ -117,6 +117,7 @@ static const struct usb_device_id id_tab
 	{ USB_DEVICE(0x10C4, 0x8411) }, /* Kyocera GPS Module */
 	{ USB_DEVICE(0x10C4, 0x8418) }, /* IRZ Automation Teleport SG-10 GSM/GPRS Modem */
 	{ USB_DEVICE(0x10C4, 0x846E) }, /* BEI USB Sensor Interface (VCP) */
+	{ USB_DEVICE(0x10C4, 0x8470) }, /* Juniper Networks BX Series System Console */
 	{ USB_DEVICE(0x10C4, 0x8477) }, /* Balluff RFID */
 	{ USB_DEVICE(0x10C4, 0x84B6) }, /* Starizona Hyperion */
 	{ USB_DEVICE(0x10C4, 0x85EA) }, /* AC-Services IBUS-IF */
@@ -784,7 +785,7 @@ static void cp210x_set_termios(struct tt
 		} else {
 			modem_ctl[0] &= ~0x7B;
 			modem_ctl[0] |= 0x01;
-			modem_ctl[1] |= 0x40;
+			modem_ctl[1] = 0x40;
 			dev_dbg(dev, "%s - flow control = NONE\n", __func__);
 		}
 
diff -druNp --no-dereference linux-libre-4.4.23-gnu/fs/aio.c linux-libre-4.4.24-gnu/fs/aio.c
--- linux-libre-4.4.23-gnu/fs/aio.c	2016-09-30 04:20:43.000000000 -0400
+++ linux-libre-4.4.24-gnu/fs/aio.c	2016-10-07 09:23:59.000000000 -0400
@@ -239,7 +239,12 @@ static struct dentry *aio_mount(struct f
 	static const struct dentry_operations ops = {
 		.d_dname	= simple_dname,
 	};
-	return mount_pseudo(fs_type, "aio:", NULL, &ops, AIO_RING_MAGIC);
+	struct dentry *root = mount_pseudo(fs_type, "aio:", NULL, &ops,
+					   AIO_RING_MAGIC);
+
+	if (!IS_ERR(root))
+		root->d_sb->s_iflags |= SB_I_NOEXEC;
+	return root;
 }
 
 /* aio_setup
diff -druNp --no-dereference linux-libre-4.4.23-gnu/fs/ceph/inode.c linux-libre-4.4.24-gnu/fs/ceph/inode.c
--- linux-libre-4.4.23-gnu/fs/ceph/inode.c	2016-09-30 04:20:43.000000000 -0400
+++ linux-libre-4.4.24-gnu/fs/ceph/inode.c	2016-10-07 09:23:59.000000000 -0400
@@ -1358,15 +1358,20 @@ static int fill_readdir_cache(struct ino
 
 	if (!ctl->page || pgoff != page_index(ctl->page)) {
 		ceph_readdir_cache_release(ctl);
-		ctl->page  = grab_cache_page(&dir->i_data, pgoff);
+		if (idx == 0)
+			ctl->page = grab_cache_page(&dir->i_data, pgoff);
+		else
+			ctl->page = find_lock_page(&dir->i_data, pgoff);
 		if (!ctl->page) {
 			ctl->index = -1;
-			return -ENOMEM;
+			return idx == 0 ? -ENOMEM : 0;
 		}
 		/* reading/filling the cache are serialized by
 		 * i_mutex, no need to use page lock */
 		unlock_page(ctl->page);
 		ctl->dentries = kmap(ctl->page);
+		if (idx == 0)
+			memset(ctl->dentries, 0, PAGE_CACHE_SIZE);
 	}
 
 	if (req->r_dir_release_cnt == atomic64_read(&ci->i_release_count) &&
diff -druNp --no-dereference linux-libre-4.4.23-gnu/fs/nfs/callback_xdr.c linux-libre-4.4.24-gnu/fs/nfs/callback_xdr.c
--- linux-libre-4.4.23-gnu/fs/nfs/callback_xdr.c	2016-09-30 04:20:43.000000000 -0400
+++ linux-libre-4.4.24-gnu/fs/nfs/callback_xdr.c	2016-10-07 09:23:59.000000000 -0400
@@ -912,7 +912,7 @@ static __be32 nfs4_callback_compound(str
 	if (hdr_arg.minorversion == 0) {
 		cps.clp = nfs4_find_client_ident(SVC_NET(rqstp), hdr_arg.cb_ident);
 		if (!cps.clp || !check_gss_callback_principal(cps.clp, rqstp))
-			return rpc_drop_reply;
+			goto out_invalidcred;
 	}
 
 	cps.minorversion = hdr_arg.minorversion;
@@ -940,6 +940,10 @@ static __be32 nfs4_callback_compound(str
 	nfs_put_client(cps.clp);
 	dprintk("%s: done, status = %u\n", __func__, ntohl(status));
 	return rpc_success;
+
+out_invalidcred:
+	pr_warn_ratelimited("NFS: NFSv4 callback contains invalid cred\n");
+	return rpc_autherr_badcred;
 }
 
 /*
diff -druNp --no-dereference linux-libre-4.4.23-gnu/fs/nfs/filelayout/filelayout.c linux-libre-4.4.24-gnu/fs/nfs/filelayout/filelayout.c
--- linux-libre-4.4.23-gnu/fs/nfs/filelayout/filelayout.c	2016-09-30 04:20:43.000000000 -0400
+++ linux-libre-4.4.24-gnu/fs/nfs/filelayout/filelayout.c	2016-10-07 09:23:59.000000000 -0400
@@ -374,8 +374,7 @@ static int filelayout_commit_done_cb(str
 		return -EAGAIN;
 	}
 
-	if (data->verf.committed == NFS_UNSTABLE)
-		pnfs_set_layoutcommit(data->inode, data->lseg, data->lwb);
+	pnfs_set_layoutcommit(data->inode, data->lseg, data->lwb);
 
 	return 0;
 }
diff -druNp --no-dereference linux-libre-4.4.23-gnu/fs/nfs/flexfilelayout/flexfilelayout.c linux-libre-4.4.24-gnu/fs/nfs/flexfilelayout/flexfilelayout.c
--- linux-libre-4.4.23-gnu/fs/nfs/flexfilelayout/flexfilelayout.c	2016-09-30 04:20:43.000000000 -0400
+++ linux-libre-4.4.24-gnu/fs/nfs/flexfilelayout/flexfilelayout.c	2016-10-07 09:23:59.000000000 -0400
@@ -1414,8 +1414,7 @@ static int ff_layout_commit_done_cb(stru
 		return -EAGAIN;
 	}
 
-	if (data->verf.committed == NFS_UNSTABLE
-	    && ff_layout_need_layoutcommit(data->lseg))
+	if (ff_layout_need_layoutcommit(data->lseg))
 		pnfs_set_layoutcommit(data->inode, data->lseg, data->lwb);
 
 	return 0;
diff -druNp --no-dereference linux-libre-4.4.23-gnu/fs/pstore/inode.c linux-libre-4.4.24-gnu/fs/pstore/inode.c
--- linux-libre-4.4.23-gnu/fs/pstore/inode.c	2016-09-30 04:20:43.000000000 -0400
+++ linux-libre-4.4.24-gnu/fs/pstore/inode.c	2016-10-07 09:23:59.000000000 -0400
@@ -178,7 +178,6 @@ static loff_t pstore_file_llseek(struct
 }
 
 static const struct file_operations pstore_file_operations = {
-	.owner		= THIS_MODULE,
 	.open		= pstore_file_open,
 	.read		= pstore_file_read,
 	.llseek		= pstore_file_llseek,
diff -druNp --no-dereference linux-libre-4.4.23-gnu/include/linux/can/dev.h linux-libre-4.4.24-gnu/include/linux/can/dev.h
--- linux-libre-4.4.23-gnu/include/linux/can/dev.h	2016-09-30 04:20:43.000000000 -0400
+++ linux-libre-4.4.24-gnu/include/linux/can/dev.h	2016-10-07 09:23:59.000000000 -0400
@@ -32,6 +32,7 @@ enum can_mode {
  * CAN common private data
  */
 struct can_priv {
+	struct net_device *dev;
 	struct can_device_stats can_stats;
 
 	struct can_bittiming bittiming, data_bittiming;
@@ -47,7 +48,7 @@ struct can_priv {
 	u32 ctrlmode_static;	/* static enabled options for driver/hardware */
 
 	int restart_ms;
-	struct timer_list restart_timer;
+	struct delayed_work restart_work;
 
 	int (*do_set_bittiming)(struct net_device *dev);
 	int (*do_set_data_bittiming)(struct net_device *dev);
diff -druNp --no-dereference linux-libre-4.4.23-gnu/include/linux/nvmem-consumer.h linux-libre-4.4.24-gnu/include/linux/nvmem-consumer.h
--- linux-libre-4.4.23-gnu/include/linux/nvmem-consumer.h	2016-09-30 04:20:43.000000000 -0400
+++ linux-libre-4.4.24-gnu/include/linux/nvmem-consumer.h	2016-10-07 09:23:59.000000000 -0400
@@ -74,7 +74,7 @@ static inline void nvmem_cell_put(struct
 {
 }
 
-static inline char *nvmem_cell_read(struct nvmem_cell *cell, size_t *len)
+static inline void *nvmem_cell_read(struct nvmem_cell *cell, size_t *len)
 {
 	return ERR_PTR(-ENOSYS);
 }
diff -druNp --no-dereference linux-libre-4.4.23-gnu/include/linux/sysctl.h linux-libre-4.4.24-gnu/include/linux/sysctl.h
--- linux-libre-4.4.23-gnu/include/linux/sysctl.h	2016-09-30 04:20:43.000000000 -0400
+++ linux-libre-4.4.24-gnu/include/linux/sysctl.h	2016-10-07 09:23:59.000000000 -0400
@@ -41,6 +41,8 @@ extern int proc_dostring(struct ctl_tabl
 			 void __user *, size_t *, loff_t *);
 extern int proc_dointvec(struct ctl_table *, int,
 			 void __user *, size_t *, loff_t *);
+extern int proc_douintvec(struct ctl_table *, int,
+			 void __user *, size_t *, loff_t *);
 extern int proc_dointvec_minmax(struct ctl_table *, int,
 				void __user *, size_t *, loff_t *);
 extern int proc_dointvec_jiffies(struct ctl_table *, int,
diff -druNp --no-dereference linux-libre-4.4.23-gnu/kernel/cpuset.c linux-libre-4.4.24-gnu/kernel/cpuset.c
--- linux-libre-4.4.23-gnu/kernel/cpuset.c	2016-09-30 04:20:43.000000000 -0400
+++ linux-libre-4.4.24-gnu/kernel/cpuset.c	2016-10-07 09:23:59.000000000 -0400
@@ -324,8 +324,7 @@ static struct file_system_type cpuset_fs
 /*
  * Return in pmask the portion of a cpusets's cpus_allowed that
  * are online.  If none are online, walk up the cpuset hierarchy
- * until we find one that does have some online cpus.  The top
- * cpuset always has some cpus online.
+ * until we find one that does have some online cpus.
  *
  * One way or another, we guarantee to return some non-empty subset
  * of cpu_online_mask.
@@ -334,8 +333,20 @@ static struct file_system_type cpuset_fs
  */
 static void guarantee_online_cpus(struct cpuset *cs, struct cpumask *pmask)
 {
-	while (!cpumask_intersects(cs->effective_cpus, cpu_online_mask))
+	while (!cpumask_intersects(cs->effective_cpus, cpu_online_mask)) {
 		cs = parent_cs(cs);
+		if (unlikely(!cs)) {
+			/*
+			 * The top cpuset doesn't have any online cpu as a
+			 * consequence of a race between cpuset_hotplug_work
+			 * and cpu hotplug notifier.  But we know the top
+			 * cpuset's effective_cpus is on its way to to be
+			 * identical to cpu_online_mask.
+			 */
+			cpumask_copy(pmask, cpu_online_mask);
+			return;
+		}
+	}
 	cpumask_and(pmask, cs->effective_cpus, cpu_online_mask);
 }
 
diff -druNp --no-dereference linux-libre-4.4.23-gnu/kernel/events/core.c linux-libre-4.4.24-gnu/kernel/events/core.c
--- linux-libre-4.4.23-gnu/kernel/events/core.c	2016-09-30 04:20:43.000000000 -0400
+++ linux-libre-4.4.24-gnu/kernel/events/core.c	2016-10-07 09:23:59.000000000 -0400
@@ -1539,12 +1539,33 @@ static int __init perf_workqueue_init(vo
 
 core_initcall(perf_workqueue_init);
 
-static inline int pmu_filter_match(struct perf_event *event)
+static inline int __pmu_filter_match(struct perf_event *event)
 {
 	struct pmu *pmu = event->pmu;
 	return pmu->filter_match ? pmu->filter_match(event) : 1;
 }
 
+/*
+ * Check whether we should attempt to schedule an event group based on
+ * PMU-specific filtering. An event group can consist of HW and SW events,
+ * potentially with a SW leader, so we must check all the filters, to
+ * determine whether a group is schedulable:
+ */
+static inline int pmu_filter_match(struct perf_event *event)
+{
+	struct perf_event *child;
+
+	if (!__pmu_filter_match(event))
+		return 0;
+
+	list_for_each_entry(child, &event->sibling_list, group_entry) {
+		if (!__pmu_filter_match(child))
+			return 0;
+	}
+
+	return 1;
+}
+
 static inline int
 event_filter_match(struct perf_event *event)
 {
diff -druNp --no-dereference linux-libre-4.4.23-gnu/kernel/fork.c linux-libre-4.4.24-gnu/kernel/fork.c
--- linux-libre-4.4.23-gnu/kernel/fork.c	2016-09-30 04:20:43.000000000 -0400
+++ linux-libre-4.4.24-gnu/kernel/fork.c	2016-10-07 09:23:59.000000000 -0400
@@ -901,14 +901,12 @@ void mm_release(struct task_struct *tsk,
 	deactivate_mm(tsk, mm);
 
 	/*
-	 * If we're exiting normally, clear a user-space tid field if
-	 * requested.  We leave this alone when dying by signal, to leave
-	 * the value intact in a core dump, and to save the unnecessary
-	 * trouble, say, a killed vfork parent shouldn't touch this mm.
-	 * Userland only wants this done for a sys_exit.
+	 * Signal userspace if we're not exiting with a core dump
+	 * because we want to leave the value intact for debugging
+	 * purposes.
 	 */
 	if (tsk->clear_child_tid) {
-		if (!(tsk->flags & PF_SIGNALED) &&
+		if (!(tsk->signal->flags & SIGNAL_GROUP_COREDUMP) &&
 		    atomic_read(&mm->mm_users) > 1) {
 			/*
 			 * We don't check the error code - if userspace has
diff -druNp --no-dereference linux-libre-4.4.23-gnu/kernel/printk/braille.c linux-libre-4.4.24-gnu/kernel/printk/braille.c
--- linux-libre-4.4.23-gnu/kernel/printk/braille.c	2016-09-30 04:20:43.000000000 -0400
+++ linux-libre-4.4.24-gnu/kernel/printk/braille.c	2016-10-07 09:23:59.000000000 -0400
@@ -9,10 +9,10 @@
 
 char *_braille_console_setup(char **str, char **brl_options)
 {
-	if (!memcmp(*str, "brl,", 4)) {
+	if (!strncmp(*str, "brl,", 4)) {
 		*brl_options = "";
 		*str += 4;
-	} else if (!memcmp(str, "brl=", 4)) {
+	} else if (!strncmp(*str, "brl=", 4)) {
 		*brl_options = *str + 4;
 		*str = strchr(*brl_options, ',');
 		if (!*str)
diff -druNp --no-dereference linux-libre-4.4.23-gnu/kernel/sysctl.c linux-libre-4.4.24-gnu/kernel/sysctl.c
--- linux-libre-4.4.23-gnu/kernel/sysctl.c	2016-09-30 04:20:43.000000000 -0400
+++ linux-libre-4.4.24-gnu/kernel/sysctl.c	2016-10-07 09:23:59.000000000 -0400
@@ -2051,6 +2051,21 @@ static int do_proc_dointvec_conv(bool *n
 	return 0;
 }
 
+static int do_proc_douintvec_conv(bool *negp, unsigned long *lvalp,
+				 int *valp,
+				 int write, void *data)
+{
+	if (write) {
+		if (*negp)
+			return -EINVAL;
+		*valp = *lvalp;
+	} else {
+		unsigned int val = *valp;
+		*lvalp = (unsigned long)val;
+	}
+	return 0;
+}
+
 static const char proc_wspace_sep[] = { ' ', '\t', '\n' };
 
 static int __do_proc_dointvec(void *tbl_data, struct ctl_table *table,
@@ -2178,8 +2193,27 @@ static int do_proc_dointvec(struct ctl_t
 int proc_dointvec(struct ctl_table *table, int write,
 		     void __user *buffer, size_t *lenp, loff_t *ppos)
 {
-    return do_proc_dointvec(table,write,buffer,lenp,ppos,
-		    	    NULL,NULL);
+	return do_proc_dointvec(table, write, buffer, lenp, ppos, NULL, NULL);
+}
+
+/**
+ * proc_douintvec - read a vector of unsigned integers
+ * @table: the sysctl table
+ * @write: %TRUE if this is a write to the sysctl file
+ * @buffer: the user buffer
+ * @lenp: the size of the user buffer
+ * @ppos: file position
+ *
+ * Reads/writes up to table->maxlen/sizeof(unsigned int) unsigned integer
+ * values from/to the user buffer, treated as an ASCII string.
+ *
+ * Returns 0 on success.
+ */
+int proc_douintvec(struct ctl_table *table, int write,
+		     void __user *buffer, size_t *lenp, loff_t *ppos)
+{
+	return do_proc_dointvec(table, write, buffer, lenp, ppos,
+				do_proc_douintvec_conv, NULL);
 }
 
 /*
@@ -2792,6 +2826,12 @@ int proc_dointvec(struct ctl_table *tabl
 	return -ENOSYS;
 }
 
+int proc_douintvec(struct ctl_table *table, int write,
+		  void __user *buffer, size_t *lenp, loff_t *ppos)
+{
+	return -ENOSYS;
+}
+
 int proc_dointvec_minmax(struct ctl_table *table, int write,
 		    void __user *buffer, size_t *lenp, loff_t *ppos)
 {
@@ -2837,6 +2877,7 @@ int proc_doulongvec_ms_jiffies_minmax(st
  * exception granted :-)
  */
 EXPORT_SYMBOL(proc_dointvec);
+EXPORT_SYMBOL(proc_douintvec);
 EXPORT_SYMBOL(proc_dointvec_jiffies);
 EXPORT_SYMBOL(proc_dointvec_minmax);
 EXPORT_SYMBOL(proc_dointvec_userhz_jiffies);
diff -druNp --no-dereference linux-libre-4.4.23-gnu/Makefile linux-libre-4.4.24-gnu/Makefile
--- linux-libre-4.4.23-gnu/Makefile	2016-09-30 07:04:33.000000000 -0400
+++ linux-libre-4.4.24-gnu/Makefile	2016-10-08 02:40:40.000000000 -0400
@@ -1,6 +1,6 @@
 VERSION = 4
 PATCHLEVEL = 4
-SUBLEVEL = 23
+SUBLEVEL = 24
 EXTRAVERSION = -gnu
 NAME = Blurry Fish Butt
 
diff -druNp --no-dereference linux-libre-4.4.23-gnu/mm/ksm.c linux-libre-4.4.24-gnu/mm/ksm.c
--- linux-libre-4.4.23-gnu/mm/ksm.c	2016-09-30 04:20:43.000000000 -0400
+++ linux-libre-4.4.24-gnu/mm/ksm.c	2016-10-07 09:23:59.000000000 -0400
@@ -283,7 +283,8 @@ static inline struct rmap_item *alloc_rm
 {
 	struct rmap_item *rmap_item;
 
-	rmap_item = kmem_cache_zalloc(rmap_item_cache, GFP_KERNEL);
+	rmap_item = kmem_cache_zalloc(rmap_item_cache, GFP_KERNEL |
+						__GFP_NORETRY | __GFP_NOWARN);
 	if (rmap_item)
 		ksm_rmap_items++;
 	return rmap_item;
diff -druNp --no-dereference linux-libre-4.4.23-gnu/net/batman-adv/originator.c linux-libre-4.4.24-gnu/net/batman-adv/originator.c
--- linux-libre-4.4.23-gnu/net/batman-adv/originator.c	2016-09-30 04:20:43.000000000 -0400
+++ linux-libre-4.4.24-gnu/net/batman-adv/originator.c	2016-10-07 09:23:59.000000000 -0400
@@ -197,18 +197,12 @@ static void batadv_neigh_node_release(st
 {
 	struct hlist_node *node_tmp;
 	struct batadv_neigh_ifinfo *neigh_ifinfo;
-	struct batadv_algo_ops *bao;
-
-	bao = neigh_node->orig_node->bat_priv->bat_algo_ops;
 
 	hlist_for_each_entry_safe(neigh_ifinfo, node_tmp,
 				  &neigh_node->ifinfo_list, list) {
 		batadv_neigh_ifinfo_free_ref(neigh_ifinfo);
 	}
 
-	if (bao->bat_neigh_free)
-		bao->bat_neigh_free(neigh_node);
-
 	batadv_hardif_free_ref(neigh_node->if_incoming);
 
 	kfree_rcu(neigh_node, rcu);
diff -druNp --no-dereference linux-libre-4.4.23-gnu/net/batman-adv/types.h linux-libre-4.4.24-gnu/net/batman-adv/types.h
--- linux-libre-4.4.23-gnu/net/batman-adv/types.h	2016-09-30 04:20:43.000000000 -0400
+++ linux-libre-4.4.24-gnu/net/batman-adv/types.h	2016-10-07 09:23:59.000000000 -0400
@@ -1136,8 +1136,6 @@ struct batadv_forw_packet {
  * @bat_neigh_is_equiv_or_better: check if neigh1 is equally good or better
  *  than neigh2 for their respective outgoing interface from the metric
  *  prospective
- * @bat_neigh_free: free the resources allocated by the routing algorithm for a
- *  neigh_node object
  * @bat_orig_print: print the originator table (optional)
  * @bat_orig_free: free the resources allocated by the routing algorithm for an
  *  orig_node object
@@ -1165,7 +1163,6 @@ struct batadv_algo_ops {
 		 struct batadv_hard_iface *if_outgoing1,
 		 struct batadv_neigh_node *neigh2,
 		 struct batadv_hard_iface *if_outgoing2);
-	void (*bat_neigh_free)(struct batadv_neigh_node *neigh);
 	/* orig_node handling API */
 	void (*bat_orig_print)(struct batadv_priv *priv, struct seq_file *seq,
 			       struct batadv_hard_iface *hard_iface);
diff -druNp --no-dereference linux-libre-4.4.23-gnu/net/netfilter/ipvs/ip_vs_sync.c linux-libre-4.4.24-gnu/net/netfilter/ipvs/ip_vs_sync.c
--- linux-libre-4.4.23-gnu/net/netfilter/ipvs/ip_vs_sync.c	2016-09-30 04:20:43.000000000 -0400
+++ linux-libre-4.4.24-gnu/net/netfilter/ipvs/ip_vs_sync.c	2016-10-07 09:23:59.000000000 -0400
@@ -1545,7 +1545,8 @@ error:
 /*
  *      Set up receiving multicast socket over UDP
  */
-static struct socket *make_receive_sock(struct netns_ipvs *ipvs, int id)
+static struct socket *make_receive_sock(struct netns_ipvs *ipvs, int id,
+					int ifindex)
 {
 	/* multicast addr */
 	union ipvs_sockaddr mcast_addr;
@@ -1566,6 +1567,7 @@ static struct socket *make_receive_sock(
 		set_sock_size(sock->sk, 0, result);
 
 	get_mcast_sockaddr(&mcast_addr, &salen, &ipvs->bcfg, id);
+	sock->sk->sk_bound_dev_if = ifindex;
 	result = sock->ops->bind(sock, (struct sockaddr *)&mcast_addr, salen);
 	if (result < 0) {
 		pr_err("Error binding to the multicast addr\n");
@@ -1868,7 +1870,7 @@ int start_sync_thread(struct netns_ipvs
 		if (state == IP_VS_STATE_MASTER)
 			sock = make_send_sock(ipvs, id);
 		else
-			sock = make_receive_sock(ipvs, id);
+			sock = make_receive_sock(ipvs, id, dev->ifindex);
 		if (IS_ERR(sock)) {
 			result = PTR_ERR(sock);
 			goto outtinfo;
diff -druNp --no-dereference linux-libre-4.4.23-gnu/net/sunrpc/svc.c linux-libre-4.4.24-gnu/net/sunrpc/svc.c
--- linux-libre-4.4.23-gnu/net/sunrpc/svc.c	2016-09-30 04:20:43.000000000 -0400
+++ linux-libre-4.4.24-gnu/net/sunrpc/svc.c	2016-10-07 09:23:59.000000000 -0400
@@ -1188,11 +1188,17 @@ svc_process_common(struct svc_rqst *rqst
 		*statp = procp->pc_func(rqstp, rqstp->rq_argp, rqstp->rq_resp);
 
 		/* Encode reply */
-		if (test_bit(RQ_DROPME, &rqstp->rq_flags)) {
+		if (*statp == rpc_drop_reply ||
+		    test_bit(RQ_DROPME, &rqstp->rq_flags)) {
 			if (procp->pc_release)
 				procp->pc_release(rqstp, NULL, rqstp->rq_resp);
 			goto dropit;
 		}
+		if (*statp == rpc_autherr_badcred) {
+			if (procp->pc_release)
+				procp->pc_release(rqstp, NULL, rqstp->rq_resp);
+			goto err_bad_auth;
+		}
 		if (*statp == rpc_success &&
 		    (xdr = procp->pc_encode) &&
 		    !xdr(rqstp, resv->iov_base+resv->iov_len, rqstp->rq_resp)) {
diff -druNp --no-dereference linux-libre-4.4.23-gnu/sound/pci/hda/patch_conexant.c linux-libre-4.4.24-gnu/sound/pci/hda/patch_conexant.c
--- linux-libre-4.4.23-gnu/sound/pci/hda/patch_conexant.c	2016-09-30 04:20:43.000000000 -0400
+++ linux-libre-4.4.24-gnu/sound/pci/hda/patch_conexant.c	2016-10-07 09:23:59.000000000 -0400
@@ -261,6 +261,7 @@ enum {
 	CXT_FIXUP_HP_530,
 	CXT_FIXUP_CAP_MIX_AMP_5047,
 	CXT_FIXUP_MUTE_LED_EAPD,
+	CXT_FIXUP_HP_SPECTRE,
 };
 
 /* for hda_fixup_thinkpad_acpi() */
@@ -765,6 +766,14 @@ static const struct hda_fixup cxt_fixups
 		.type = HDA_FIXUP_FUNC,
 		.v.func = cxt_fixup_mute_led_eapd,
 	},
+	[CXT_FIXUP_HP_SPECTRE] = {
+		.type = HDA_FIXUP_PINS,
+		.v.pins = (const struct hda_pintbl[]) {
+			/* enable NID 0x1d for the speaker on top */
+			{ 0x1d, 0x91170111 },
+			{ }
+		}
+	},
 };
 
 static const struct snd_pci_quirk cxt5045_fixups[] = {
@@ -814,6 +823,7 @@ static const struct snd_pci_quirk cxt506
 	SND_PCI_QUIRK(0x1025, 0x0543, "Acer Aspire One 522", CXT_FIXUP_STEREO_DMIC),
 	SND_PCI_QUIRK(0x1025, 0x054c, "Acer Aspire 3830TG", CXT_FIXUP_ASPIRE_DMIC),
 	SND_PCI_QUIRK(0x1025, 0x054f, "Acer Aspire 4830T", CXT_FIXUP_ASPIRE_DMIC),
+	SND_PCI_QUIRK(0x103c, 0x8174, "HP Spectre x360", CXT_FIXUP_HP_SPECTRE),
 	SND_PCI_QUIRK(0x1043, 0x138d, "Asus", CXT_FIXUP_HEADPHONE_MIC_PIN),
 	SND_PCI_QUIRK(0x152d, 0x0833, "OLPC XO-1.5", CXT_FIXUP_OLPC_XO),
 	SND_PCI_QUIRK(0x17aa, 0x20f2, "Lenovo T400", CXT_PINCFG_LENOVO_TP410),
diff -druNp --no-dereference linux-libre-4.4.23-gnu/sound/pci/hda/patch_realtek.c linux-libre-4.4.24-gnu/sound/pci/hda/patch_realtek.c
--- linux-libre-4.4.23-gnu/sound/pci/hda/patch_realtek.c	2016-09-30 04:20:43.000000000 -0400
+++ linux-libre-4.4.24-gnu/sound/pci/hda/patch_realtek.c	2016-10-07 09:23:59.000000000 -0400
@@ -5790,6 +5790,13 @@ static const struct hda_model_fixup alc2
 	{0x14, 0x90170110}, \
 	{0x15, 0x0221401f}
 
+#define ALC295_STANDARD_PINS \
+	{0x12, 0xb7a60130}, \
+	{0x14, 0x90170110}, \
+	{0x17, 0x21014020}, \
+	{0x18, 0x21a19030}, \
+	{0x21, 0x04211020}
+
 #define ALC298_STANDARD_PINS \
 	{0x12, 0x90a60130}, \
 	{0x21, 0x03211020}
@@ -5830,6 +5837,10 @@ static const struct snd_hda_pin_quirk al
 		{0x14, 0x90170120},
 		{0x21, 0x02211030}),
 	SND_HDA_PIN_QUIRK(0x10ec0255, 0x1028, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE,
+		{0x14, 0x90170110},
+		{0x1b, 0x02011020},
+		{0x21, 0x0221101f}),
+	SND_HDA_PIN_QUIRK(0x10ec0255, 0x1028, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE,
 		{0x14, 0x90170130},
 		{0x1b, 0x01014020},
 		{0x21, 0x0221103f}),
@@ -5895,6 +5906,10 @@ static const struct snd_hda_pin_quirk al
 		{0x14, 0x90170120},
 		{0x21, 0x02211030}),
 	SND_HDA_PIN_QUIRK(0x10ec0256, 0x1028, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE,
+		{0x12, 0xb7a60130},
+		{0x14, 0x90170110},
+		{0x21, 0x02211020}),
+	SND_HDA_PIN_QUIRK(0x10ec0256, 0x1028, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE,
 		ALC256_STANDARD_PINS),
 	SND_HDA_PIN_QUIRK(0x10ec0280, 0x103c, "HP", ALC280_FIXUP_HP_GPIO4,
 		{0x12, 0x90a60130},
@@ -6005,6 +6020,8 @@ static const struct snd_hda_pin_quirk al
 	SND_HDA_PIN_QUIRK(0x10ec0293, 0x1028, "Dell", ALC293_FIXUP_DELL1_MIC_NO_PRESENCE,
 		ALC292_STANDARD_PINS,
 		{0x13, 0x90a60140}),
+	SND_HDA_PIN_QUIRK(0x10ec0295, 0x1028, "Dell", ALC269_FIXUP_DELL1_MIC_NO_PRESENCE,
+		ALC295_STANDARD_PINS),
 	SND_HDA_PIN_QUIRK(0x10ec0298, 0x1028, "Dell", ALC298_FIXUP_DELL1_MIC_NO_PRESENCE,
 		ALC298_STANDARD_PINS,
 		{0x17, 0x90170110}),
diff -druNp --no-dereference linux-libre-4.4.23-gnu/sound/soc/intel/skylake/skl.c linux-libre-4.4.24-gnu/sound/soc/intel/skylake/skl.c
--- linux-libre-4.4.23-gnu/sound/soc/intel/skylake/skl.c	2016-09-30 04:20:43.000000000 -0400
+++ linux-libre-4.4.24-gnu/sound/soc/intel/skylake/skl.c	2016-10-07 09:23:59.000000000 -0400
@@ -464,8 +464,10 @@ static int skl_probe(struct pci_dev *pci
 
 	skl->nhlt = skl_nhlt_init(bus->dev);
 
-	if (skl->nhlt == NULL)
+	if (skl->nhlt == NULL) {
+		err = -ENODEV;
 		goto out_free;
+	}
 
 	pci_set_drvdata(skl->pci, ebus);
 
diff -druNp --no-dereference linux-libre-4.4.23-gnu/sound/soc/omap/omap-mcpdm.c linux-libre-4.4.24-gnu/sound/soc/omap/omap-mcpdm.c
--- linux-libre-4.4.23-gnu/sound/soc/omap/omap-mcpdm.c	2016-09-30 04:20:43.000000000 -0400
+++ linux-libre-4.4.24-gnu/sound/soc/omap/omap-mcpdm.c	2016-10-07 09:23:59.000000000 -0400
@@ -390,8 +390,8 @@ static int omap_mcpdm_probe(struct snd_s
 	pm_runtime_get_sync(mcpdm->dev);
 	omap_mcpdm_write(mcpdm, MCPDM_REG_CTRL, 0x00);
 
-	ret = devm_request_irq(mcpdm->dev, mcpdm->irq, omap_mcpdm_irq_handler,
-				0, "McPDM", (void *)mcpdm);
+	ret = request_irq(mcpdm->irq, omap_mcpdm_irq_handler, 0, "McPDM",
+			  (void *)mcpdm);
 
 	pm_runtime_put_sync(mcpdm->dev);
 
@@ -416,6 +416,7 @@ static int omap_mcpdm_remove(struct snd_
 {
 	struct omap_mcpdm *mcpdm = snd_soc_dai_get_drvdata(dai);
 
+	free_irq(mcpdm->irq, (void *)mcpdm);
 	pm_runtime_disable(mcpdm->dev);
 
 	return 0;
diff -druNp --no-dereference linux-libre-4.4.23-gnu/tools/vm/slabinfo.c linux-libre-4.4.24-gnu/tools/vm/slabinfo.c
--- linux-libre-4.4.23-gnu/tools/vm/slabinfo.c	2016-09-30 04:20:43.000000000 -0400
+++ linux-libre-4.4.24-gnu/tools/vm/slabinfo.c	2016-10-07 09:23:59.000000000 -0400
@@ -510,10 +510,11 @@ static void slab_stats(struct slabinfo *
 			s->alloc_node_mismatch, (s->alloc_node_mismatch * 100) / total);
 	}
 
-	if (s->cmpxchg_double_fail || s->cmpxchg_double_cpu_fail)
+	if (s->cmpxchg_double_fail || s->cmpxchg_double_cpu_fail) {
 		printf("\nCmpxchg_double Looping\n------------------------\n");
 		printf("Locked Cmpxchg Double redos   %lu\nUnlocked Cmpxchg Double redos %lu\n",
 			s->cmpxchg_double_fail, s->cmpxchg_double_cpu_fail);
+	}
 }
 
 static void report(struct slabinfo *s)
