Grsec/PaX: 3.0-{3.2.56,3.13.8}-20140401213520140401

57 files changed, 7215 insertions, 378 deletions

diff --git a/3.13.7/0000_README b/3.13.8/0000_README
index f9125d0..c7f2d48 100644
--- a/3.13.7/0000_README
+++ b/3.13.8/0000_README
@@ -2,7 +2,7 @@ README
 -----------------------------------------------------------------------------
 Individual Patch Descriptions:
 -----------------------------------------------------------------------------
-Patch:	4420_grsecurity-3.0-3.13.7-201403281902.patch
+Patch:	4420_grsecurity-3.0-3.13.8-201404011912.patch
 From:	http://www.grsecurity.net
 Desc:	hardened-sources base patch from upstream grsecurity
 
diff --git a/3.13.7/4420_grsecurity-3.0-3.13.7-201403281902.patch b/3.13.8/4420_grsecurity-3.0-3.13.8-201404011912.patch
index 8e4e492..9c4aaac 100644
--- a/3.13.7/4420_grsecurity-3.0-3.13.7-201403281902.patch
+++ b/3.13.8/4420_grsecurity-3.0-3.13.8-201404011912.patch
@@ -287,7 +287,7 @@ index b9e9bd8..bf49b92 100644
  
  	pcd.		[PARIDE]
 diff --git a/Makefile b/Makefile
-index 9f214b4..8c9c622 100644
+index 4cab13b..b7d5e41 100644
 --- a/Makefile
 +++ b/Makefile
 @@ -244,8 +244,9 @@ CONFIG_SHELL := $(shell if [ -x "$$BASH" ]; then echo $$BASH; \
@@ -4097,7 +4097,7 @@ index cf08bdf..772656c 100644
  unsigned long search_exception_table(unsigned long addr);
  
 diff --git a/arch/arm/mm/init.c b/arch/arm/mm/init.c
-index 3e8f106..a0a1fe4 100644
+index ac1d883..5a7bb91 100644
 --- a/arch/arm/mm/init.c
 +++ b/arch/arm/mm/init.c
 @@ -30,6 +30,8 @@
@@ -4109,7 +4109,7 @@ index 3e8f106..a0a1fe4 100644
  
  #include <asm/mach/arch.h>
  #include <asm/mach/map.h>
-@@ -681,7 +683,46 @@ void free_initmem(void)
+@@ -682,7 +684,46 @@ void free_initmem(void)
  {
  #ifdef CONFIG_HAVE_TCM
  	extern char __tcm_start, __tcm_end;
@@ -6662,18 +6662,9 @@ index 25da651..ae2a259 100644
  
  #endif /* __ASM_SMTC_PROC_H */
 diff --git a/arch/mips/include/asm/syscall.h b/arch/mips/include/asm/syscall.h
-index 81c8913..81d8432 100644
+index 33e8dbf..81d8432 100644
 --- a/arch/mips/include/asm/syscall.h
 +++ b/arch/mips/include/asm/syscall.h
-@@ -29,7 +29,7 @@ static inline long syscall_get_nr(struct task_struct *task,
- static inline unsigned long mips_get_syscall_arg(unsigned long *arg,
- 	struct task_struct *task, struct pt_regs *regs, unsigned int n)
- {
--	unsigned long usp = regs->regs[29];
-+	unsigned long usp __maybe_unused = regs->regs[29];
- 
- 	switch (n) {
- 	case 0: case 1: case 2: case 3:
 @@ -39,14 +39,14 @@ static inline unsigned long mips_get_syscall_arg(unsigned long *arg,
  
  #ifdef CONFIG_32BIT
@@ -28104,7 +28095,7 @@ index d86ff15..e77b023 100644
  #define APIC_LVT_NUM			6
  /* 14 is the version for Xeon and Pentium 8.4.8*/
 diff --git a/arch/x86/kvm/paging_tmpl.h b/arch/x86/kvm/paging_tmpl.h
-index ad75d77..a679d32 100644
+index cba218a..1cc1bed 100644
 --- a/arch/x86/kvm/paging_tmpl.h
 +++ b/arch/x86/kvm/paging_tmpl.h
 @@ -331,7 +331,7 @@ retry_walk:
@@ -28144,7 +28135,7 @@ index 532add1..59eb241 100644
  
  	local_irq_disable();
 diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
-index dcc4de3..6bf73f4 100644
+index 31c3e8b..ca3acc6 100644
 --- a/arch/x86/kvm/vmx.c
 +++ b/arch/x86/kvm/vmx.c
 @@ -1316,12 +1316,12 @@ static void vmcs_write64(unsigned long field, u64 value)
@@ -33546,7 +33537,7 @@ index 0000000..dace51c
 +EXPORT_SYMBOL(__pax_close_userland);
 +#endif
 diff --git a/arch/x86/net/bpf_jit.S b/arch/x86/net/bpf_jit.S
-index 877b9a1..f746de8 100644
+index 0149575..f746de8 100644
 --- a/arch/x86/net/bpf_jit.S
 +++ b/arch/x86/net/bpf_jit.S
 @@ -9,6 +9,7 @@
@@ -33620,15 +33611,6 @@ index 877b9a1..f746de8 100644
  	ret
  
  #define sk_negative_common(SIZE)				\
-@@ -140,7 +149,7 @@ bpf_slow_path_byte_msh:
- 	push	%r9;						\
- 	push	SKBDATA;					\
- /* rsi already has offset */					\
--	mov	$SIZE,%ecx;	/* size */			\
-+	mov	$SIZE,%edx;	/* size */			\
- 	call	bpf_internal_load_pointer_neg_helper;		\
- 	test	%rax,%rax;					\
- 	pop	SKBDATA;					\
 @@ -157,6 +166,7 @@ sk_load_word_negative_offset:
  	sk_negative_common(4)
  	mov	(%rax), %eax
@@ -40134,7 +40116,7 @@ index 3c59584..500f2e9 100644
  
  	return ret;
 diff --git a/drivers/gpu/drm/i915/i915_irq.c b/drivers/gpu/drm/i915/i915_irq.c
-index a209177..842a89a 100644
+index 9702704..3fb9e40 100644
 --- a/drivers/gpu/drm/i915/i915_irq.c
 +++ b/drivers/gpu/drm/i915/i915_irq.c
 @@ -1419,7 +1419,7 @@ static irqreturn_t valleyview_irq_handler(int irq, void *arg)
@@ -40191,7 +40173,7 @@ index a209177..842a89a 100644
  
  	I915_WRITE(GEN8_MASTER_IRQ, 0);
  	POSTING_READ(GEN8_MASTER_IRQ);
-@@ -2998,7 +2998,7 @@ static void gen8_irq_uninstall(struct drm_device *dev)
+@@ -2996,7 +2996,7 @@ static void gen8_irq_uninstall(struct drm_device *dev)
  	if (!dev_priv)
  		return;
  
@@ -40200,7 +40182,7 @@ index a209177..842a89a 100644
  
  	I915_WRITE(GEN8_MASTER_IRQ, 0);
  
-@@ -3092,7 +3092,7 @@ static void i8xx_irq_preinstall(struct drm_device * dev)
+@@ -3090,7 +3090,7 @@ static void i8xx_irq_preinstall(struct drm_device * dev)
  	drm_i915_private_t *dev_priv = (drm_i915_private_t *) dev->dev_private;
  	int pipe;
  
@@ -40209,7 +40191,7 @@ index a209177..842a89a 100644
  
  	for_each_pipe(pipe)
  		I915_WRITE(PIPESTAT(pipe), 0);
-@@ -3178,7 +3178,7 @@ static irqreturn_t i8xx_irq_handler(int irq, void *arg)
+@@ -3176,7 +3176,7 @@ static irqreturn_t i8xx_irq_handler(int irq, void *arg)
  		I915_DISPLAY_PLANE_A_FLIP_PENDING_INTERRUPT |
  		I915_DISPLAY_PLANE_B_FLIP_PENDING_INTERRUPT;
  
@@ -40218,7 +40200,7 @@ index a209177..842a89a 100644
  
  	iir = I915_READ16(IIR);
  	if (iir == 0)
-@@ -3253,7 +3253,7 @@ static void i915_irq_preinstall(struct drm_device * dev)
+@@ -3251,7 +3251,7 @@ static void i915_irq_preinstall(struct drm_device * dev)
  	drm_i915_private_t *dev_priv = (drm_i915_private_t *) dev->dev_private;
  	int pipe;
  
@@ -40227,7 +40209,7 @@ index a209177..842a89a 100644
  
  	if (I915_HAS_HOTPLUG(dev)) {
  		I915_WRITE(PORT_HOTPLUG_EN, 0);
-@@ -3360,7 +3360,7 @@ static irqreturn_t i915_irq_handler(int irq, void *arg)
+@@ -3358,7 +3358,7 @@ static irqreturn_t i915_irq_handler(int irq, void *arg)
  		I915_DISPLAY_PLANE_B_FLIP_PENDING_INTERRUPT;
  	int pipe, ret = IRQ_NONE;
  
@@ -40236,7 +40218,7 @@ index a209177..842a89a 100644
  
  	iir = I915_READ(IIR);
  	do {
-@@ -3487,7 +3487,7 @@ static void i965_irq_preinstall(struct drm_device * dev)
+@@ -3485,7 +3485,7 @@ static void i965_irq_preinstall(struct drm_device * dev)
  	drm_i915_private_t *dev_priv = (drm_i915_private_t *) dev->dev_private;
  	int pipe;
  
@@ -40245,7 +40227,7 @@ index a209177..842a89a 100644
  
  	I915_WRITE(PORT_HOTPLUG_EN, 0);
  	I915_WRITE(PORT_HOTPLUG_STAT, I915_READ(PORT_HOTPLUG_STAT));
-@@ -3603,7 +3603,7 @@ static irqreturn_t i965_irq_handler(int irq, void *arg)
+@@ -3601,7 +3601,7 @@ static irqreturn_t i965_irq_handler(int irq, void *arg)
  		I915_DISPLAY_PLANE_A_FLIP_PENDING_INTERRUPT |
  		I915_DISPLAY_PLANE_B_FLIP_PENDING_INTERRUPT;
  
@@ -41475,7 +41457,7 @@ index cea623c..73011b0 100644
  	ret = create_gpadl_header(kbuffer, size, &msginfo, &msgcount);
  	if (ret)
 diff --git a/drivers/hv/hv.c b/drivers/hv/hv.c
-index f0c5e07..399256e 100644
+index f0c5e07..49a4d4a 100644
 --- a/drivers/hv/hv.c
 +++ b/drivers/hv/hv.c
 @@ -112,7 +112,7 @@ static u64 do_hypercall(u64 control, void *input, void *output)
@@ -41487,6 +41469,15 @@ index f0c5e07..399256e 100644
  
  	__asm__ __volatile__ ("call *%8" : "=d"(hv_status_hi),
  			      "=a"(hv_status_lo) : "d" (control_hi),
+@@ -154,7 +154,7 @@ int hv_init(void)
+ 	/* See if the hypercall page is already set */
+ 	rdmsrl(HV_X64_MSR_HYPERCALL, hypercall_msr.as_uint64);
+ 
+-	virtaddr = __vmalloc(PAGE_SIZE, GFP_KERNEL, PAGE_KERNEL_EXEC);
++	virtaddr = __vmalloc(PAGE_SIZE, GFP_KERNEL, PAGE_KERNEL_RX);
+ 
+ 	if (!virtaddr)
+ 		goto cleanup;
 diff --git a/drivers/hv/hv_balloon.c b/drivers/hv/hv_balloon.c
 index 7e17a54..a50a33d 100644
 --- a/drivers/hv/hv_balloon.c
@@ -44527,10 +44518,10 @@ index 46da365..3ba4206 100644
  	dev_set_drvdata(&dev->dev, dev);
  	rc = device_add(&dev->dev);
 diff --git a/drivers/media/usb/dvb-usb/cxusb.c b/drivers/media/usb/dvb-usb/cxusb.c
-index 20e345d..da56fe4 100644
+index a1c641e..3007da9 100644
 --- a/drivers/media/usb/dvb-usb/cxusb.c
 +++ b/drivers/media/usb/dvb-usb/cxusb.c
-@@ -1101,7 +1101,7 @@ static struct dib0070_config dib7070p_dib0070_config = {
+@@ -1112,7 +1112,7 @@ static struct dib0070_config dib7070p_dib0070_config = {
  
  struct dib0700_adapter_state {
  	int (*set_param_save) (struct dvb_frontend *);
@@ -44540,7 +44531,7 @@ index 20e345d..da56fe4 100644
  static int dib7070_set_param_override(struct dvb_frontend *fe)
  {
 diff --git a/drivers/media/usb/dvb-usb/dw2102.c b/drivers/media/usb/dvb-usb/dw2102.c
-index c1a63b2..dbcbfb6 100644
+index f272ed8..6289f9c 100644
 --- a/drivers/media/usb/dvb-usb/dw2102.c
 +++ b/drivers/media/usb/dvb-usb/dw2102.c
 @@ -121,7 +121,7 @@ struct su3000_state {
@@ -45520,19 +45511,6 @@ index 7b5424f..ed1d6ac 100644
  		err = -EFAULT;
  		goto cmd_rel_host;
  	}
-diff --git a/drivers/mmc/card/queue.c b/drivers/mmc/card/queue.c
-index 357bbc5..3e049c1 100644
---- a/drivers/mmc/card/queue.c
-+++ b/drivers/mmc/card/queue.c
-@@ -197,7 +197,7 @@ int mmc_init_queue(struct mmc_queue *mq, struct mmc_card *card,
- 	struct mmc_queue_req *mqrq_prev = &mq->mqrq[1];
- 
- 	if (mmc_dev(host)->dma_mask && *mmc_dev(host)->dma_mask)
--		limit = dma_max_pfn(mmc_dev(host)) << PAGE_SHIFT;
-+		limit = (u64)dma_max_pfn(mmc_dev(host)) << PAGE_SHIFT;
- 
- 	mq->card = card;
- 	mq->queue = blk_init_queue(mmc_request_fn, lock);
 diff --git a/drivers/mmc/core/mmc_ops.c b/drivers/mmc/core/mmc_ops.c
 index e5b5eeb..7bf2212 100644
 --- a/drivers/mmc/core/mmc_ops.c
@@ -48233,10 +48211,10 @@ index 84419af..268ede8 100644
  					&dev_attr_energy_uj.attr;
  	}
 diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c
-index 75dffb79..df850cd 100644
+index 7271299..20217a5 100644
 --- a/drivers/regulator/core.c
 +++ b/drivers/regulator/core.c
-@@ -3370,7 +3370,7 @@ regulator_register(const struct regulator_desc *regulator_desc,
+@@ -3366,7 +3366,7 @@ regulator_register(const struct regulator_desc *regulator_desc,
  {
  	const struct regulation_constraints *constraints = NULL;
  	const struct regulator_init_data *init_data;
@@ -48245,7 +48223,7 @@ index 75dffb79..df850cd 100644
  	struct regulator_dev *rdev;
  	struct device *dev;
  	int ret, i;
-@@ -3440,7 +3440,7 @@ regulator_register(const struct regulator_desc *regulator_desc,
+@@ -3436,7 +3436,7 @@ regulator_register(const struct regulator_desc *regulator_desc,
  	rdev->dev.of_node = config->of_node;
  	rdev->dev.parent = dev;
  	dev_set_name(&rdev->dev, "regulator.%d",
@@ -49380,7 +49358,7 @@ index fe0bcb1..c9255be 100644
  	/* check if the device is still usable */
  	if (unlikely(cmd->device->sdev_state == SDEV_DEL)) {
 diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c
-index 7bd7f0d..93159d8 100644
+index 62ec84b..93159d8 100644
 --- a/drivers/scsi/scsi_lib.c
 +++ b/drivers/scsi/scsi_lib.c
 @@ -1474,7 +1474,7 @@ static void scsi_kill_request(struct request *req, struct request_queue *q)
@@ -49404,15 +49382,6 @@ index 7bd7f0d..93159d8 100644
  
  	disposition = scsi_decide_disposition(cmd);
  	if (disposition != SUCCESS &&
-@@ -1684,7 +1684,7 @@ u64 scsi_calculate_bounce_limit(struct Scsi_Host *shost)
- 
- 	host_dev = scsi_get_device(shost);
- 	if (host_dev && host_dev->dma_mask)
--		bounce_limit = dma_max_pfn(host_dev) << PAGE_SHIFT;
-+		bounce_limit = (u64)dma_max_pfn(host_dev) << PAGE_SHIFT;
- 
- 	return bounce_limit;
- }
 diff --git a/drivers/scsi/scsi_sysfs.c b/drivers/scsi/scsi_sysfs.c
 index 8ff62c2..693b6f7 100644
 --- a/drivers/scsi/scsi_sysfs.c
@@ -52136,6 +52105,38 @@ index 1eab4ac..e21efc9 100644
  	     iommu_group_id(group->iommu_group));
  
  	return 0;
+diff --git a/drivers/vhost/net.c b/drivers/vhost/net.c
+index b12176f..e5522d9 100644
+--- a/drivers/vhost/net.c
++++ b/drivers/vhost/net.c
+@@ -528,6 +528,12 @@ static int get_rx_bufs(struct vhost_virtqueue *vq,
+ 	*iovcount = seg;
+ 	if (unlikely(log))
+ 		*log_num = nlogs;
++
++	/* Detect overrun */
++	if (unlikely(datalen > 0)) {
++		r = UIO_MAXIOV + 1;
++		goto err;
++	}
+ 	return headcount;
+ err:
+ 	vhost_discard_vq_desc(vq, headcount);
+@@ -583,6 +589,14 @@ static void handle_rx(struct vhost_net *net)
+ 		/* On error, stop handling until the next kick. */
+ 		if (unlikely(headcount < 0))
+ 			break;
++		/* On overrun, truncate and discard */
++		if (unlikely(headcount > UIO_MAXIOV)) {
++			msg.msg_iovlen = 1;
++			err = sock->ops->recvmsg(NULL, sock, &msg,
++						 1, MSG_DONTWAIT | MSG_TRUNC);
++			pr_debug("Discarded rx packet: len %zd\n", sock_len);
++			continue;
++		}
+ 		/* OK, now we need to know about added descriptors. */
+ 		if (!headcount) {
+ 			if (unlikely(vhost_enable_notify(&net->dev, vq))) {
 diff --git a/drivers/vhost/vringh.c b/drivers/vhost/vringh.c
 index 5174eba..451e6bc 100644
 --- a/drivers/vhost/vringh.c
@@ -87855,7 +87856,7 @@ index 06ec886..9dba35e 100644
  
  		if (pm_wakeup_pending()) {
 diff --git a/kernel/printk/printk.c b/kernel/printk/printk.c
-index be7c86b..b972b27 100644
+index 97fb834..b972b27 100644
 --- a/kernel/printk/printk.c
 +++ b/kernel/printk/printk.c
 @@ -385,6 +385,11 @@ static int check_syslog_permissions(int type, bool from_file)
@@ -87870,22 +87871,6 @@ index be7c86b..b972b27 100644
  	if (syslog_action_restricted(type)) {
  		if (capable(CAP_SYSLOG))
  			return 0;
-@@ -1080,7 +1085,6 @@ static int syslog_print_all(char __user *buf, int size, bool clear)
- 		next_seq = log_next_seq;
- 
- 		len = 0;
--		prev = 0;
- 		while (len >= 0 && seq < next_seq) {
- 			struct printk_log *msg = log_from_idx(idx);
- 			int textlen;
-@@ -2789,7 +2793,6 @@ bool kmsg_dump_get_buffer(struct kmsg_dumper *dumper, bool syslog,
- 	next_idx = idx;
- 
- 	l = 0;
--	prev = 0;
- 	while (seq < dumper->next_seq) {
- 		struct printk_log *msg = log_from_idx(idx);
- 
 diff --git a/kernel/profile.c b/kernel/profile.c
 index 6631e1e..310c266 100644
 --- a/kernel/profile.c
@@ -90311,10 +90296,10 @@ index 26dc348..8708ca7 100644
 +	return atomic64_inc_return_unchecked(&trace_counter);
  }
 diff --git a/kernel/trace/trace_events.c b/kernel/trace/trace_events.c
-index 2e58196..fdd3d61 100644
+index ba983dc..911aaf9 100644
 --- a/kernel/trace/trace_events.c
 +++ b/kernel/trace/trace_events.c
-@@ -1681,7 +1681,6 @@ __trace_early_add_new_event(struct ftrace_event_call *call,
+@@ -1675,7 +1675,6 @@ __trace_early_add_new_event(struct ftrace_event_call *call,
  	return 0;
  }
  
@@ -91016,7 +91001,7 @@ index 7811ed3..f80ca19 100644
  static inline void *ptr_to_indirect(void *ptr)
  {
 diff --git a/lib/random32.c b/lib/random32.c
-index 1e5b2df..fb616c7 100644
+index 1e5b2df..009bfe8 100644
 --- a/lib/random32.c
 +++ b/lib/random32.c
 @@ -44,7 +44,7 @@
@@ -91028,6 +91013,27 @@ index 1e5b2df..fb616c7 100644
  
  /**
   *	prandom_u32_state - seeded pseudo-random number generator.
+@@ -244,8 +244,19 @@ static void __prandom_reseed(bool late)
+ 	static bool latch = false;
+ 	static DEFINE_SPINLOCK(lock);
+ 
++	/* Asking for random bytes might result in bytes getting
++	 * moved into the nonblocking pool and thus marking it
++	 * as initialized. In this case we would double back into
++	 * this function and attempt to do a late reseed.
++	 * Ignore the pointless attempt to reseed again if we're
++	 * already waiting for bytes when the nonblocking pool
++	 * got initialized.
++	 */
++
+ 	/* only allow initial seeding (late == false) once */
+-	spin_lock_irqsave(&lock, flags);
++	if (!spin_trylock_irqsave(&lock, flags))
++		return;
++
+ 	if (latch && !late)
+ 		goto out;
+ 	latch = true;
 diff --git a/lib/rbtree.c b/lib/rbtree.c
 index 65f4eff..2cfa167 100644
 --- a/lib/rbtree.c
@@ -96649,7 +96655,7 @@ index 3f9b0f3..fc6d4fa 100644
  
  	if (__rtnl_register(PF_CAN, RTM_GETROUTE, NULL, cgw_dump_jobs, NULL)) {
 diff --git a/net/ceph/messenger.c b/net/ceph/messenger.c
-index 4a5df7b..9ad1f1d 100644
+index 464303f..9c30218 100644
 --- a/net/ceph/messenger.c
 +++ b/net/ceph/messenger.c
 @@ -186,7 +186,7 @@ static void con_fault(struct ceph_connection *con);
@@ -101525,24 +101531,6 @@ index e83c416..f87df4c 100644
  
  	set_fs(KERNEL_DS);
  	if (level == SOL_SOCKET)
-diff --git a/net/sunrpc/auth_gss/auth_gss.c b/net/sunrpc/auth_gss/auth_gss.c
-index a642fd616..1eebf22 100644
---- a/net/sunrpc/auth_gss/auth_gss.c
-+++ b/net/sunrpc/auth_gss/auth_gss.c
-@@ -500,10 +500,12 @@ gss_alloc_msg(struct gss_auth *gss_auth,
- 	default:
- 		err = gss_encode_v1_msg(gss_msg, service_name, gss_auth->target_name);
- 		if (err)
--			goto err_free_msg;
-+			goto err_put_pipe_version;
- 	};
- 	kref_get(&gss_auth->kref);
- 	return gss_msg;
-+err_put_pipe_version:
-+	put_pipe_version(gss_auth->net);
- err_free_msg:
- 	kfree(gss_msg);
- err:
 diff --git a/net/sunrpc/auth_gss/svcauth_gss.c b/net/sunrpc/auth_gss/svcauth_gss.c
 index 1b94a9c..496f7f5 100644
 --- a/net/sunrpc/auth_gss/svcauth_gss.c
@@ -102544,16 +102532,16 @@ index 078fe1d..fbdb363 100644
  		fprintf(stderr, "fixdep: sizeof(int) != 4 or wrong endianness? %#x\n",
 diff --git a/scripts/gcc-plugin.sh b/scripts/gcc-plugin.sh
 new file mode 100644
-index 0000000..ed4c19a
+index 0000000..3c23999
 --- /dev/null
 +++ b/scripts/gcc-plugin.sh
 @@ -0,0 +1,16 @@
 +#!/bin/bash
 +srctree=$(dirname "$0")
-+gccplugins_dir=$("$1" -print-file-name=plugin)
++gccplugins_dir=$("$3" -print-file-name=plugin)
 +plugincc=$("$1" -E -shared - -o /dev/null -I${srctree}/../tools/gcc -I${gccplugins_dir}/include 2>&1 <<EOF
 +#include "gcc-common.h"
-+#if __GNUC__ > 4 || __GNUC_MINOR__ >= 8 || defined(ENABLE_BUILD_WITH_CXX)
++#if BUILDING_GCC_VERSION >= 4008 || defined(ENABLE_BUILD_WITH_CXX)
 +#warning $2
 +#else
 +#warning $1
@@ -102788,7 +102776,7 @@ index 0865b3e..7235dd4 100644
  	__ksymtab_gpl		: { *(SORT(___ksymtab_gpl+*)) }
  	__ksymtab_unused	: { *(SORT(___ksymtab_unused+*)) }
 diff --git a/scripts/package/builddeb b/scripts/package/builddeb
-index 90e521f..e9eaf8f 100644
+index c1bb9be..63aed853 100644
 --- a/scripts/package/builddeb
 +++ b/scripts/package/builddeb
 @@ -281,6 +281,7 @@ fi
@@ -107087,7 +107075,7 @@ index 0000000..dd73713
 +}
 diff --git a/tools/gcc/latent_entropy_plugin.c b/tools/gcc/latent_entropy_plugin.c
 new file mode 100644
-index 0000000..c96f80f
+index 0000000..319229d
 --- /dev/null
 +++ b/tools/gcc/latent_entropy_plugin.c
 @@ -0,0 +1,457 @@
@@ -107119,7 +107107,7 @@ index 0000000..c96f80f
 +static tree latent_entropy_decl;
 +
 +static struct plugin_info latent_entropy_plugin_info = {
-+	.version	= "201403042150",
++	.version	= "201403280150",
 +	.help		= NULL
 +};
 +
diff --git a/3.13.7/4425_grsec_remove_EI_PAX.patch b/3.13.8/4425_grsec_remove_EI_PAX.patch
index fc51f79..fc51f79 100644
--- a/3.13.7/4425_grsec_remove_EI_PAX.patch
+++ b/3.13.8/4425_grsec_remove_EI_PAX.patch
diff --git a/3.13.7/4427_force_XATTR_PAX_tmpfs.patch b/3.13.8/4427_force_XATTR_PAX_tmpfs.patch
index 23e60cd..23e60cd 100644
--- a/3.13.7/4427_force_XATTR_PAX_tmpfs.patch
+++ b/3.13.8/4427_force_XATTR_PAX_tmpfs.patch
diff --git a/3.13.7/4430_grsec-remove-localversion-grsec.patch b/3.13.8/4430_grsec-remove-localversion-grsec.patch
index 31cf878..31cf878 100644
--- a/3.13.7/4430_grsec-remove-localversion-grsec.patch
+++ b/3.13.8/4430_grsec-remove-localversion-grsec.patch
diff --git a/3.13.7/4435_grsec-mute-warnings.patch b/3.13.8/4435_grsec-mute-warnings.patch
index cb51a05..cb51a05 100644
--- a/3.13.7/4435_grsec-mute-warnings.patch
+++ b/3.13.8/4435_grsec-mute-warnings.patch
diff --git a/3.13.7/4440_grsec-remove-protected-paths.patch b/3.13.8/4440_grsec-remove-protected-paths.patch
index 741546d..741546d 100644
--- a/3.13.7/4440_grsec-remove-protected-paths.patch
+++ b/3.13.8/4440_grsec-remove-protected-paths.patch
diff --git a/3.13.7/4450_grsec-kconfig-default-gids.patch b/3.13.8/4450_grsec-kconfig-default-gids.patch
index abff221..abff221 100644
--- a/3.13.7/4450_grsec-kconfig-default-gids.patch
+++ b/3.13.8/4450_grsec-kconfig-default-gids.patch
diff --git a/3.13.7/4465_selinux-avc_audit-log-curr_ip.patch b/3.13.8/4465_selinux-avc_audit-log-curr_ip.patch
index 6caf9de..6caf9de 100644
--- a/3.13.7/4465_selinux-avc_audit-log-curr_ip.patch
+++ b/3.13.8/4465_selinux-avc_audit-log-curr_ip.patch
diff --git a/3.13.7/4470_disable-compat_vdso.patch b/3.13.8/4470_disable-compat_vdso.patch
index a25c029..a25c029 100644
--- a/3.13.7/4470_disable-compat_vdso.patch
+++ b/3.13.8/4470_disable-compat_vdso.patch
diff --git a/3.13.7/4475_emutramp_default_on.patch b/3.13.8/4475_emutramp_default_on.patch
index a453a5b..a453a5b 100644
--- a/3.13.7/4475_emutramp_default_on.patch
+++ b/3.13.8/4475_emutramp_default_on.patch
diff --git a/3.2.55/0000_README b/3.2.56/0000_README
index d6fed9e..ce219c9 100644
--- a/3.2.55/0000_README
+++ b/3.2.56/0000_README
@@ -138,7 +138,11 @@ Patch:	1054_linux-3.2.55.patch
 From:	http://www.kernel.org
 Desc:	Linux 3.2.55
 
-Patch:	4420_grsecurity-3.0-3.2.55-201403300851.patch
+Patch:	1055_linux-3.2.56.patch
+From:	http://www.kernel.org
+Desc:	Linux 3.2.56
+
+Patch:	4420_grsecurity-3.0-3.2.56-201404012135.patch
 From:	http://www.grsecurity.net
 Desc:	hardened-sources base patch from upstream grsecurity
 
diff --git a/3.2.55/1021_linux-3.2.22.patch b/3.2.56/1021_linux-3.2.22.patch
index e6ad93a..e6ad93a 100644
--- a/3.2.55/1021_linux-3.2.22.patch
+++ b/3.2.56/1021_linux-3.2.22.patch
diff --git a/3.2.55/1022_linux-3.2.23.patch b/3.2.56/1022_linux-3.2.23.patch
index 3d796d0..3d796d0 100644
--- a/3.2.55/1022_linux-3.2.23.patch
+++ b/3.2.56/1022_linux-3.2.23.patch
diff --git a/3.2.55/1023_linux-3.2.24.patch b/3.2.56/1023_linux-3.2.24.patch
index 4692eb4..4692eb4 100644
--- a/3.2.55/1023_linux-3.2.24.patch
+++ b/3.2.56/1023_linux-3.2.24.patch
diff --git a/3.2.55/1024_linux-3.2.25.patch b/3.2.56/1024_linux-3.2.25.patch
index e95c213..e95c213 100644
--- a/3.2.55/1024_linux-3.2.25.patch
+++ b/3.2.56/1024_linux-3.2.25.patch
diff --git a/3.2.55/1025_linux-3.2.26.patch b/3.2.56/1025_linux-3.2.26.patch
index 44065b9..44065b9 100644
--- a/3.2.55/1025_linux-3.2.26.patch
+++ b/3.2.56/1025_linux-3.2.26.patch
diff --git a/3.2.55/1026_linux-3.2.27.patch b/3.2.56/1026_linux-3.2.27.patch
index 5878eb4..5878eb4 100644
--- a/3.2.55/1026_linux-3.2.27.patch
+++ b/3.2.56/1026_linux-3.2.27.patch
diff --git a/3.2.55/1027_linux-3.2.28.patch b/3.2.56/1027_linux-3.2.28.patch
index 4dbba4b..4dbba4b 100644
--- a/3.2.55/1027_linux-3.2.28.patch
+++ b/3.2.56/1027_linux-3.2.28.patch
diff --git a/3.2.55/1028_linux-3.2.29.patch b/3.2.56/1028_linux-3.2.29.patch
index 3c65179..3c65179 100644
--- a/3.2.55/1028_linux-3.2.29.patch
+++ b/3.2.56/1028_linux-3.2.29.patch
diff --git a/3.2.55/1029_linux-3.2.30.patch b/3.2.56/1029_linux-3.2.30.patch
index 86aea4b..86aea4b 100644
--- a/3.2.55/1029_linux-3.2.30.patch
+++ b/3.2.56/1029_linux-3.2.30.patch
diff --git a/3.2.55/1030_linux-3.2.31.patch b/3.2.56/1030_linux-3.2.31.patch
index c6accf5..c6accf5 100644
--- a/3.2.55/1030_linux-3.2.31.patch
+++ b/3.2.56/1030_linux-3.2.31.patch
diff --git a/3.2.55/1031_linux-3.2.32.patch b/3.2.56/1031_linux-3.2.32.patch
index 247fc0b..247fc0b 100644
--- a/3.2.55/1031_linux-3.2.32.patch
+++ b/3.2.56/1031_linux-3.2.32.patch
diff --git a/3.2.55/1032_linux-3.2.33.patch b/3.2.56/1032_linux-3.2.33.patch
index c32fb75..c32fb75 100644
--- a/3.2.55/1032_linux-3.2.33.patch
+++ b/3.2.56/1032_linux-3.2.33.patch
diff --git a/3.2.55/1033_linux-3.2.34.patch b/3.2.56/1033_linux-3.2.34.patch
index d647b38..d647b38 100644
--- a/3.2.55/1033_linux-3.2.34.patch
+++ b/3.2.56/1033_linux-3.2.34.patch
diff --git a/3.2.55/1034_linux-3.2.35.patch b/3.2.56/1034_linux-3.2.35.patch
index 76a9c19..76a9c19 100644
--- a/3.2.55/1034_linux-3.2.35.patch
+++ b/3.2.56/1034_linux-3.2.35.patch
diff --git a/3.2.55/1035_linux-3.2.36.patch b/3.2.56/1035_linux-3.2.36.patch
index 5d192a3..5d192a3 100644
--- a/3.2.55/1035_linux-3.2.36.patch
+++ b/3.2.56/1035_linux-3.2.36.patch
diff --git a/3.2.55/1036_linux-3.2.37.patch b/3.2.56/1036_linux-3.2.37.patch
index ad13251..ad13251 100644
--- a/3.2.55/1036_linux-3.2.37.patch
+++ b/3.2.56/1036_linux-3.2.37.patch
diff --git a/3.2.55/1037_linux-3.2.38.patch b/3.2.56/1037_linux-3.2.38.patch
index a3c106f..a3c106f 100644
--- a/3.2.55/1037_linux-3.2.38.patch
+++ b/3.2.56/1037_linux-3.2.38.patch
diff --git a/3.2.55/1038_linux-3.2.39.patch b/3.2.56/1038_linux-3.2.39.patch
index 5639e92..5639e92 100644
--- a/3.2.55/1038_linux-3.2.39.patch
+++ b/3.2.56/1038_linux-3.2.39.patch
diff --git a/3.2.55/1039_linux-3.2.40.patch b/3.2.56/1039_linux-3.2.40.patch
index f26b39c..f26b39c 100644
--- a/3.2.55/1039_linux-3.2.40.patch
+++ b/3.2.56/1039_linux-3.2.40.patch
diff --git a/3.2.55/1040_linux-3.2.41.patch b/3.2.56/1040_linux-3.2.41.patch
index 0d27fcb..0d27fcb 100644
--- a/3.2.55/1040_linux-3.2.41.patch
+++ b/3.2.56/1040_linux-3.2.41.patch
diff --git a/3.2.55/1041_linux-3.2.42.patch b/3.2.56/1041_linux-3.2.42.patch
index 77a08ed..77a08ed 100644
--- a/3.2.55/1041_linux-3.2.42.patch
+++ b/3.2.56/1041_linux-3.2.42.patch
diff --git a/3.2.55/1042_linux-3.2.43.patch b/3.2.56/1042_linux-3.2.43.patch
index a3f878b..a3f878b 100644
--- a/3.2.55/1042_linux-3.2.43.patch
+++ b/3.2.56/1042_linux-3.2.43.patch
diff --git a/3.2.55/1043_linux-3.2.44.patch b/3.2.56/1043_linux-3.2.44.patch
index 3d5e6ff..3d5e6ff 100644
--- a/3.2.55/1043_linux-3.2.44.patch
+++ b/3.2.56/1043_linux-3.2.44.patch
diff --git a/3.2.55/1044_linux-3.2.45.patch b/3.2.56/1044_linux-3.2.45.patch
index 44e1767..44e1767 100644
--- a/3.2.55/1044_linux-3.2.45.patch
+++ b/3.2.56/1044_linux-3.2.45.patch
diff --git a/3.2.55/1045_linux-3.2.46.patch b/3.2.56/1045_linux-3.2.46.patch
index bc10efd..bc10efd 100644
--- a/3.2.55/1045_linux-3.2.46.patch
+++ b/3.2.56/1045_linux-3.2.46.patch
diff --git a/3.2.55/1046_linux-3.2.47.patch b/3.2.56/1046_linux-3.2.47.patch
index b74563c..b74563c 100644
--- a/3.2.55/1046_linux-3.2.47.patch
+++ b/3.2.56/1046_linux-3.2.47.patch
diff --git a/3.2.55/1047_linux-3.2.48.patch b/3.2.56/1047_linux-3.2.48.patch
index 6d55b1f..6d55b1f 100644
--- a/3.2.55/1047_linux-3.2.48.patch
+++ b/3.2.56/1047_linux-3.2.48.patch
diff --git a/3.2.55/1048_linux-3.2.49.patch b/3.2.56/1048_linux-3.2.49.patch
index 2dab0cf..2dab0cf 100644
--- a/3.2.55/1048_linux-3.2.49.patch
+++ b/3.2.56/1048_linux-3.2.49.patch
diff --git a/3.2.55/1049_linux-3.2.50.patch b/3.2.56/1049_linux-3.2.50.patch
index 20b3015..20b3015 100644
--- a/3.2.55/1049_linux-3.2.50.patch
+++ b/3.2.56/1049_linux-3.2.50.patch
diff --git a/3.2.55/1050_linux-3.2.51.patch b/3.2.56/1050_linux-3.2.51.patch
index 5d5832b..5d5832b 100644
--- a/3.2.55/1050_linux-3.2.51.patch
+++ b/3.2.56/1050_linux-3.2.51.patch
diff --git a/3.2.55/1051_linux-3.2.52.patch b/3.2.56/1051_linux-3.2.52.patch
index 94b9359..94b9359 100644
--- a/3.2.55/1051_linux-3.2.52.patch
+++ b/3.2.56/1051_linux-3.2.52.patch
diff --git a/3.2.55/1052_linux-3.2.53.patch b/3.2.56/1052_linux-3.2.53.patch
index 986d714..986d714 100644
--- a/3.2.55/1052_linux-3.2.53.patch
+++ b/3.2.56/1052_linux-3.2.53.patch
diff --git a/3.2.55/1053_linux-3.2.54.patch b/3.2.56/1053_linux-3.2.54.patch
index a907496..a907496 100644
--- a/3.2.55/1053_linux-3.2.54.patch
+++ b/3.2.56/1053_linux-3.2.54.patch
diff --git a/3.2.55/1054_linux-3.2.55.patch b/3.2.56/1054_linux-3.2.55.patch
index 6071ff5..6071ff5 100644
--- a/3.2.55/1054_linux-3.2.55.patch
+++ b/3.2.56/1054_linux-3.2.55.patch
diff --git a/3.2.56/1055_linux-3.2.56.patch b/3.2.56/1055_linux-3.2.56.patch
new file mode 100644
index 0000000..2e8239c
--- /dev/null
+++ b/3.2.56/1055_linux-3.2.56.patch
@@ -0,0 +1,6904 @@
+diff --git a/Documentation/filesystems/proc.txt b/Documentation/filesystems/proc.txt
+index 0ec91f0..404a097 100644
+--- a/Documentation/filesystems/proc.txt
++++ b/Documentation/filesystems/proc.txt
+@@ -1293,8 +1293,8 @@ may allocate from based on an estimation of its current memory and swap use.
+ For example, if a task is using all allowed memory, its badness score will be
+ 1000.  If it is using half of its allowed memory, its score will be 500.
+ 
+-There is an additional factor included in the badness score: root
+-processes are given 3% extra memory over other tasks.
++There is an additional factor included in the badness score: the current memory
++and swap usage is discounted by 3% for root processes.
+ 
+ The amount of "allowed" memory depends on the context in which the oom killer
+ was called.  If it is due to the memory assigned to the allocating task's cpuset
+diff --git a/Documentation/i2c/busses/i2c-piix4 b/Documentation/i2c/busses/i2c-piix4
+index 65da157..0982e72 100644
+--- a/Documentation/i2c/busses/i2c-piix4
++++ b/Documentation/i2c/busses/i2c-piix4
+@@ -8,7 +8,7 @@ Supported adapters:
+     Datasheet: Only available via NDA from ServerWorks
+   * ATI IXP200, IXP300, IXP400, SB600, SB700 and SB800 southbridges
+     Datasheet: Not publicly available
+-  * AMD Hudson-2, CZ
++  * AMD Hudson-2, ML, CZ
+     Datasheet: Not publicly available
+   * Standard Microsystems (SMSC) SLC90E66 (Victory66) southbridge
+     Datasheet: Publicly available at the SMSC website http://www.smsc.com
+diff --git a/Makefile b/Makefile
+index 538463e..ec90bfb 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 3
+ PATCHLEVEL = 2
+-SUBLEVEL = 55
++SUBLEVEL = 56
+ EXTRAVERSION =
+ NAME = Saber-toothed Squirrel
+ 
+diff --git a/arch/alpha/lib/csum_partial_copy.c b/arch/alpha/lib/csum_partial_copy.c
+index 40736da..1d2ef5a 100644
+--- a/arch/alpha/lib/csum_partial_copy.c
++++ b/arch/alpha/lib/csum_partial_copy.c
+@@ -373,6 +373,11 @@ csum_partial_copy_from_user(const void __user *src, void *dst, int len,
+ __wsum
+ csum_partial_copy_nocheck(const void *src, void *dst, int len, __wsum sum)
+ {
+-	return csum_partial_copy_from_user((__force const void __user *)src,
+-			dst, len, sum, NULL);
++	__wsum checksum;
++	mm_segment_t oldfs = get_fs();
++	set_fs(KERNEL_DS);
++	checksum = csum_partial_copy_from_user((__force const void __user *)src,
++						dst, len, sum, NULL);
++	set_fs(oldfs);
++	return checksum;
+ }
+diff --git a/arch/arm/include/asm/cacheflush.h b/arch/arm/include/asm/cacheflush.h
+index 1397408..b1e0e07 100644
+--- a/arch/arm/include/asm/cacheflush.h
++++ b/arch/arm/include/asm/cacheflush.h
+@@ -202,6 +202,7 @@ extern void copy_to_user_page(struct vm_area_struct *, struct page *,
+ static inline void __flush_icache_all(void)
+ {
+ 	__flush_icache_preferred();
++	dsb();
+ }
+ 
+ #define flush_cache_all()		__cpuc_flush_kern_all()
+diff --git a/arch/arm/include/asm/spinlock.h b/arch/arm/include/asm/spinlock.h
+index 65fa3c8..095a9a3 100644
+--- a/arch/arm/include/asm/spinlock.h
++++ b/arch/arm/include/asm/spinlock.h
+@@ -44,18 +44,9 @@
+ 
+ static inline void dsb_sev(void)
+ {
+-#if __LINUX_ARM_ARCH__ >= 7
+-	__asm__ __volatile__ (
+-		"dsb\n"
+-		SEV
+-	);
+-#else
+-	__asm__ __volatile__ (
+-		"mcr p15, 0, %0, c7, c10, 4\n"
+-		SEV
+-		: : "r" (0)
+-	);
+-#endif
++
++	dsb();
++	__asm__(SEV);
+ }
+ 
+ /*
+diff --git a/arch/arm/mm/proc-v6.S b/arch/arm/mm/proc-v6.S
+index 8168d99..85a5348 100644
+--- a/arch/arm/mm/proc-v6.S
++++ b/arch/arm/mm/proc-v6.S
+@@ -199,7 +199,6 @@ __v6_setup:
+ 	mcr	p15, 0, r0, c7, c14, 0		@ clean+invalidate D cache
+ 	mcr	p15, 0, r0, c7, c5, 0		@ invalidate I cache
+ 	mcr	p15, 0, r0, c7, c15, 0		@ clean+invalidate cache
+-	mcr	p15, 0, r0, c7, c10, 4		@ drain write buffer
+ #ifdef CONFIG_MMU
+ 	mcr	p15, 0, r0, c8, c7, 0		@ invalidate I + D TLBs
+ 	mcr	p15, 0, r0, c2, c0, 2		@ TTB control register
+@@ -209,6 +208,8 @@ __v6_setup:
+ 	ALT_UP(orr	r8, r8, #TTB_FLAGS_UP)
+ 	mcr	p15, 0, r8, c2, c0, 1		@ load TTB1
+ #endif /* CONFIG_MMU */
++	mcr	p15, 0, r0, c7, c10, 4		@ drain write buffer and
++						@ complete invalidations
+ 	adr	r5, v6_crval
+ 	ldmia	r5, {r5, r6}
+ #ifdef CONFIG_CPU_ENDIAN_BE8
+diff --git a/arch/arm/mm/proc-v7.S b/arch/arm/mm/proc-v7.S
+index 785365e..19d21ff 100644
+--- a/arch/arm/mm/proc-v7.S
++++ b/arch/arm/mm/proc-v7.S
+@@ -368,7 +368,6 @@ __v7_setup:
+ 
+ 3:	mov	r10, #0
+ 	mcr	p15, 0, r10, c7, c5, 0		@ I+BTB cache invalidate
+-	dsb
+ #ifdef CONFIG_MMU
+ 	mcr	p15, 0, r10, c8, c7, 0		@ invalidate I + D TLBs
+ 	mcr	p15, 0, r10, c2, c0, 2		@ TTB control register
+@@ -382,6 +381,7 @@ __v7_setup:
+ 	mcr	p15, 0, r5, c10, c2, 0		@ write PRRR
+ 	mcr	p15, 0, r6, c10, c2, 1		@ write NMRR
+ #endif
++	dsb					@ Complete invalidations
+ #ifndef CONFIG_ARM_THUMBEE
+ 	mrc	p15, 0, r0, c0, c1, 0		@ read ID_PFR0 for ThumbEE
+ 	and	r0, r0, #(0xf << 12)		@ ThumbEE enabled field
+diff --git a/arch/avr32/Makefile b/arch/avr32/Makefile
+index 22fb665..dba48a5 100644
+--- a/arch/avr32/Makefile
++++ b/arch/avr32/Makefile
+@@ -11,7 +11,7 @@ all: uImage vmlinux.elf
+ 
+ KBUILD_DEFCONFIG	:= atstk1002_defconfig
+ 
+-KBUILD_CFLAGS	+= -pipe -fno-builtin -mno-pic
++KBUILD_CFLAGS	+= -pipe -fno-builtin -mno-pic -D__linux__
+ KBUILD_AFLAGS	+= -mrelax -mno-pic
+ KBUILD_CFLAGS_MODULE += -mno-relax
+ LDFLAGS_vmlinux	+= --relax
+diff --git a/arch/avr32/boards/mimc200/fram.c b/arch/avr32/boards/mimc200/fram.c
+index 9764a1a..c1466a8 100644
+--- a/arch/avr32/boards/mimc200/fram.c
++++ b/arch/avr32/boards/mimc200/fram.c
+@@ -11,6 +11,7 @@
+ #define FRAM_VERSION	"1.0"
+ 
+ #include <linux/miscdevice.h>
++#include <linux/module.h>
+ #include <linux/proc_fs.h>
+ #include <linux/mm.h>
+ #include <linux/io.h>
+diff --git a/arch/mips/mm/c-r4k.c b/arch/mips/mm/c-r4k.c
+index a79fe9a..7d5ac0b 100644
+--- a/arch/mips/mm/c-r4k.c
++++ b/arch/mips/mm/c-r4k.c
+@@ -633,9 +633,6 @@ static void r4k_dma_cache_inv(unsigned long addr, unsigned long size)
+ 		if (size >= scache_size)
+ 			r4k_blast_scache();
+ 		else {
+-			unsigned long lsize = cpu_scache_line_size();
+-			unsigned long almask = ~(lsize - 1);
+-
+ 			/*
+ 			 * There is no clearly documented alignment requirement
+ 			 * for the cache instruction on MIPS processors and
+@@ -644,9 +641,6 @@ static void r4k_dma_cache_inv(unsigned long addr, unsigned long size)
+ 			 * hit ops with insufficient alignment.  Solved by
+ 			 * aligning the address to cache line size.
+ 			 */
+-			cache_op(Hit_Writeback_Inv_SD, addr & almask);
+-			cache_op(Hit_Writeback_Inv_SD,
+-				 (addr + size - 1) & almask);
+ 			blast_inv_scache_range(addr, addr + size);
+ 		}
+ 		__sync();
+@@ -656,12 +650,7 @@ static void r4k_dma_cache_inv(unsigned long addr, unsigned long size)
+ 	if (cpu_has_safe_index_cacheops && size >= dcache_size) {
+ 		r4k_blast_dcache();
+ 	} else {
+-		unsigned long lsize = cpu_dcache_line_size();
+-		unsigned long almask = ~(lsize - 1);
+-
+ 		R4600_HIT_CACHEOP_WAR_IMPL;
+-		cache_op(Hit_Writeback_Inv_D, addr & almask);
+-		cache_op(Hit_Writeback_Inv_D, (addr + size - 1)  & almask);
+ 		blast_inv_dcache_range(addr, addr + size);
+ 	}
+ 
+diff --git a/arch/powerpc/kernel/cacheinfo.c b/arch/powerpc/kernel/cacheinfo.c
+index a3c684b..02ebe1a 100644
+--- a/arch/powerpc/kernel/cacheinfo.c
++++ b/arch/powerpc/kernel/cacheinfo.c
+@@ -788,6 +788,9 @@ static void remove_cache_dir(struct cache_dir *cache_dir)
+ {
+ 	remove_index_dirs(cache_dir);
+ 
++	/* Remove cache dir from sysfs */
++	kobject_del(cache_dir->kobj);
++
+ 	kobject_put(cache_dir->kobj);
+ 
+ 	kfree(cache_dir);
+diff --git a/arch/powerpc/kernel/crash_dump.c b/arch/powerpc/kernel/crash_dump.c
+index 424afb6..39787c9 100644
+--- a/arch/powerpc/kernel/crash_dump.c
++++ b/arch/powerpc/kernel/crash_dump.c
+@@ -108,17 +108,19 @@ ssize_t copy_oldmem_page(unsigned long pfn, char *buf,
+ 			size_t csize, unsigned long offset, int userbuf)
+ {
+ 	void  *vaddr;
++	phys_addr_t paddr;
+ 
+ 	if (!csize)
+ 		return 0;
+ 
+ 	csize = min_t(size_t, csize, PAGE_SIZE);
++	paddr = pfn << PAGE_SHIFT;
+ 
+-	if ((min_low_pfn < pfn) && (pfn < max_pfn)) {
+-		vaddr = __va(pfn << PAGE_SHIFT);
++	if (memblock_is_region_memory(paddr, csize)) {
++		vaddr = __va(paddr);
+ 		csize = copy_oldmem_vaddr(vaddr, buf, csize, offset, userbuf);
+ 	} else {
+-		vaddr = __ioremap(pfn << PAGE_SHIFT, PAGE_SIZE, 0);
++		vaddr = __ioremap(paddr, PAGE_SIZE, 0);
+ 		csize = copy_oldmem_vaddr(vaddr, buf, csize, offset, userbuf);
+ 		iounmap(vaddr);
+ 	}
+diff --git a/arch/powerpc/kernel/reloc_64.S b/arch/powerpc/kernel/reloc_64.S
+index b47a0e1..c712ece 100644
+--- a/arch/powerpc/kernel/reloc_64.S
++++ b/arch/powerpc/kernel/reloc_64.S
+@@ -81,6 +81,7 @@ _GLOBAL(relocate)
+ 
+ 6:	blr
+ 
++.balign 8
+ p_dyn:	.llong	__dynamic_start - 0b
+ p_rela:	.llong	__rela_dyn_start - 0b
+ p_st:	.llong	_stext - 0b
+diff --git a/arch/powerpc/kvm/e500_tlb.c b/arch/powerpc/kvm/e500_tlb.c
+index 13c432e..844fc83 100644
+--- a/arch/powerpc/kvm/e500_tlb.c
++++ b/arch/powerpc/kvm/e500_tlb.c
+@@ -481,7 +481,7 @@ static inline void kvmppc_e500_priv_release(struct tlbe_priv *priv)
+ }
+ 
+ static inline void kvmppc_e500_deliver_tlb_miss(struct kvm_vcpu *vcpu,
+-		unsigned int eaddr, int as)
++		gva_t eaddr, int as)
+ {
+ 	struct kvmppc_vcpu_e500 *vcpu_e500 = to_e500(vcpu);
+ 	unsigned int victim, pidsel, tsized;
+diff --git a/arch/s390/crypto/aes_s390.c b/arch/s390/crypto/aes_s390.c
+index 3ec8b39..51fb1ef 100644
+--- a/arch/s390/crypto/aes_s390.c
++++ b/arch/s390/crypto/aes_s390.c
+@@ -25,6 +25,7 @@
+ #include <linux/err.h>
+ #include <linux/module.h>
+ #include <linux/init.h>
++#include <linux/spinlock.h>
+ #include "crypt_s390.h"
+ 
+ #define AES_KEYLEN_128		1
+@@ -32,6 +33,7 @@
+ #define AES_KEYLEN_256		4
+ 
+ static u8 *ctrblk;
++static DEFINE_SPINLOCK(ctrblk_lock);
+ static char keylen_flag;
+ 
+ struct s390_aes_ctx {
+@@ -324,7 +326,8 @@ static int ecb_aes_crypt(struct blkcipher_desc *desc, long func, void *param,
+ 		u8 *in = walk->src.virt.addr;
+ 
+ 		ret = crypt_s390_km(func, param, out, in, n);
+-		BUG_ON((ret < 0) || (ret != n));
++		if (ret < 0 || ret != n)
++			return -EIO;
+ 
+ 		nbytes &= AES_BLOCK_SIZE - 1;
+ 		ret = blkcipher_walk_done(desc, walk, nbytes);
+@@ -463,7 +466,8 @@ static int cbc_aes_crypt(struct blkcipher_desc *desc, long func,
+ 		u8 *in = walk->src.virt.addr;
+ 
+ 		ret = crypt_s390_kmc(func, &param, out, in, n);
+-		BUG_ON((ret < 0) || (ret != n));
++		if (ret < 0 || ret != n)
++			return -EIO;
+ 
+ 		nbytes &= AES_BLOCK_SIZE - 1;
+ 		ret = blkcipher_walk_done(desc, walk, nbytes);
+@@ -636,7 +640,8 @@ static int xts_aes_crypt(struct blkcipher_desc *desc, long func,
+ 	memcpy(pcc_param.tweak, walk->iv, sizeof(pcc_param.tweak));
+ 	memcpy(pcc_param.key, xts_ctx->pcc_key, 32);
+ 	ret = crypt_s390_pcc(func, &pcc_param.key[offset]);
+-	BUG_ON(ret < 0);
++	if (ret < 0)
++		return -EIO;
+ 
+ 	memcpy(xts_param.key, xts_ctx->key, 32);
+ 	memcpy(xts_param.init, pcc_param.xts, 16);
+@@ -647,7 +652,8 @@ static int xts_aes_crypt(struct blkcipher_desc *desc, long func,
+ 		in = walk->src.virt.addr;
+ 
+ 		ret = crypt_s390_km(func, &xts_param.key[offset], out, in, n);
+-		BUG_ON(ret < 0 || ret != n);
++		if (ret < 0 || ret != n)
++			return -EIO;
+ 
+ 		nbytes &= AES_BLOCK_SIZE - 1;
+ 		ret = blkcipher_walk_done(desc, walk, nbytes);
+@@ -756,42 +762,67 @@ static int ctr_aes_set_key(struct crypto_tfm *tfm, const u8 *in_key,
+ 	return aes_set_key(tfm, in_key, key_len);
+ }
+ 
++static unsigned int __ctrblk_init(u8 *ctrptr, unsigned int nbytes)
++{
++	unsigned int i, n;
++
++	/* only use complete blocks, max. PAGE_SIZE */
++	n = (nbytes > PAGE_SIZE) ? PAGE_SIZE : nbytes & ~(AES_BLOCK_SIZE - 1);
++	for (i = AES_BLOCK_SIZE; i < n; i += AES_BLOCK_SIZE) {
++		memcpy(ctrptr + i, ctrptr + i - AES_BLOCK_SIZE,
++		       AES_BLOCK_SIZE);
++		crypto_inc(ctrptr + i, AES_BLOCK_SIZE);
++	}
++	return n;
++}
++
+ static int ctr_aes_crypt(struct blkcipher_desc *desc, long func,
+ 			 struct s390_aes_ctx *sctx, struct blkcipher_walk *walk)
+ {
+ 	int ret = blkcipher_walk_virt_block(desc, walk, AES_BLOCK_SIZE);
+-	unsigned int i, n, nbytes;
+-	u8 buf[AES_BLOCK_SIZE];
+-	u8 *out, *in;
++	unsigned int n, nbytes;
++	u8 buf[AES_BLOCK_SIZE], ctrbuf[AES_BLOCK_SIZE];
++	u8 *out, *in, *ctrptr = ctrbuf;
+ 
+ 	if (!walk->nbytes)
+ 		return ret;
+ 
+-	memcpy(ctrblk, walk->iv, AES_BLOCK_SIZE);
++	if (spin_trylock(&ctrblk_lock))
++		ctrptr = ctrblk;
++
++	memcpy(ctrptr, walk->iv, AES_BLOCK_SIZE);
+ 	while ((nbytes = walk->nbytes) >= AES_BLOCK_SIZE) {
+ 		out = walk->dst.virt.addr;
+ 		in = walk->src.virt.addr;
+ 		while (nbytes >= AES_BLOCK_SIZE) {
+-			/* only use complete blocks, max. PAGE_SIZE */
+-			n = (nbytes > PAGE_SIZE) ? PAGE_SIZE :
+-						 nbytes & ~(AES_BLOCK_SIZE - 1);
+-			for (i = AES_BLOCK_SIZE; i < n; i += AES_BLOCK_SIZE) {
+-				memcpy(ctrblk + i, ctrblk + i - AES_BLOCK_SIZE,
+-				       AES_BLOCK_SIZE);
+-				crypto_inc(ctrblk + i, AES_BLOCK_SIZE);
++			if (ctrptr == ctrblk)
++				n = __ctrblk_init(ctrptr, nbytes);
++			else
++				n = AES_BLOCK_SIZE;
++			ret = crypt_s390_kmctr(func, sctx->key, out, in,
++					       n, ctrptr);
++			if (ret < 0 || ret != n) {
++				if (ctrptr == ctrblk)
++					spin_unlock(&ctrblk_lock);
++				return -EIO;
+ 			}
+-			ret = crypt_s390_kmctr(func, sctx->key, out, in, n, ctrblk);
+-			BUG_ON(ret < 0 || ret != n);
+ 			if (n > AES_BLOCK_SIZE)
+-				memcpy(ctrblk, ctrblk + n - AES_BLOCK_SIZE,
++				memcpy(ctrptr, ctrptr + n - AES_BLOCK_SIZE,
+ 				       AES_BLOCK_SIZE);
+-			crypto_inc(ctrblk, AES_BLOCK_SIZE);
++			crypto_inc(ctrptr, AES_BLOCK_SIZE);
+ 			out += n;
+ 			in += n;
+ 			nbytes -= n;
+ 		}
+ 		ret = blkcipher_walk_done(desc, walk, nbytes);
+ 	}
++	if (ctrptr == ctrblk) {
++		if (nbytes)
++			memcpy(ctrbuf, ctrptr, AES_BLOCK_SIZE);
++		else
++			memcpy(walk->iv, ctrptr, AES_BLOCK_SIZE);
++		spin_unlock(&ctrblk_lock);
++	}
+ 	/*
+ 	 * final block may be < AES_BLOCK_SIZE, copy only nbytes
+ 	 */
+@@ -799,13 +830,15 @@ static int ctr_aes_crypt(struct blkcipher_desc *desc, long func,
+ 		out = walk->dst.virt.addr;
+ 		in = walk->src.virt.addr;
+ 		ret = crypt_s390_kmctr(func, sctx->key, buf, in,
+-				       AES_BLOCK_SIZE, ctrblk);
+-		BUG_ON(ret < 0 || ret != AES_BLOCK_SIZE);
++				       AES_BLOCK_SIZE, ctrbuf);
++		if (ret < 0 || ret != AES_BLOCK_SIZE)
++			return -EIO;
+ 		memcpy(out, buf, nbytes);
+-		crypto_inc(ctrblk, AES_BLOCK_SIZE);
++		crypto_inc(ctrbuf, AES_BLOCK_SIZE);
+ 		ret = blkcipher_walk_done(desc, walk, 0);
++		memcpy(walk->iv, ctrbuf, AES_BLOCK_SIZE);
+ 	}
+-	memcpy(walk->iv, ctrblk, AES_BLOCK_SIZE);
++
+ 	return ret;
+ }
+ 
+diff --git a/arch/s390/crypto/des_s390.c b/arch/s390/crypto/des_s390.c
+index a52bfd1..991fb7d 100644
+--- a/arch/s390/crypto/des_s390.c
++++ b/arch/s390/crypto/des_s390.c
+@@ -25,6 +25,7 @@
+ #define DES3_KEY_SIZE	(3 * DES_KEY_SIZE)
+ 
+ static u8 *ctrblk;
++static DEFINE_SPINLOCK(ctrblk_lock);
+ 
+ struct s390_des_ctx {
+ 	u8 iv[DES_BLOCK_SIZE];
+@@ -95,7 +96,8 @@ static int ecb_desall_crypt(struct blkcipher_desc *desc, long func,
+ 		u8 *in = walk->src.virt.addr;
+ 
+ 		ret = crypt_s390_km(func, key, out, in, n);
+-		BUG_ON((ret < 0) || (ret != n));
++		if (ret < 0 || ret != n)
++			return -EIO;
+ 
+ 		nbytes &= DES_BLOCK_SIZE - 1;
+ 		ret = blkcipher_walk_done(desc, walk, nbytes);
+@@ -105,28 +107,35 @@ static int ecb_desall_crypt(struct blkcipher_desc *desc, long func,
+ }
+ 
+ static int cbc_desall_crypt(struct blkcipher_desc *desc, long func,
+-			    u8 *iv, struct blkcipher_walk *walk)
++			    struct blkcipher_walk *walk)
+ {
++	struct s390_des_ctx *ctx = crypto_blkcipher_ctx(desc->tfm);
+ 	int ret = blkcipher_walk_virt(desc, walk);
+ 	unsigned int nbytes = walk->nbytes;
++	struct {
++		u8 iv[DES_BLOCK_SIZE];
++		u8 key[DES3_KEY_SIZE];
++	} param;
+ 
+ 	if (!nbytes)
+ 		goto out;
+ 
+-	memcpy(iv, walk->iv, DES_BLOCK_SIZE);
++	memcpy(param.iv, walk->iv, DES_BLOCK_SIZE);
++	memcpy(param.key, ctx->key, DES3_KEY_SIZE);
+ 	do {
+ 		/* only use complete blocks */
+ 		unsigned int n = nbytes & ~(DES_BLOCK_SIZE - 1);
+ 		u8 *out = walk->dst.virt.addr;
+ 		u8 *in = walk->src.virt.addr;
+ 
+-		ret = crypt_s390_kmc(func, iv, out, in, n);
+-		BUG_ON((ret < 0) || (ret != n));
++		ret = crypt_s390_kmc(func, &param, out, in, n);
++		if (ret < 0 || ret != n)
++			return -EIO;
+ 
+ 		nbytes &= DES_BLOCK_SIZE - 1;
+ 		ret = blkcipher_walk_done(desc, walk, nbytes);
+ 	} while ((nbytes = walk->nbytes));
+-	memcpy(walk->iv, iv, DES_BLOCK_SIZE);
++	memcpy(walk->iv, param.iv, DES_BLOCK_SIZE);
+ 
+ out:
+ 	return ret;
+@@ -179,22 +188,20 @@ static int cbc_des_encrypt(struct blkcipher_desc *desc,
+ 			   struct scatterlist *dst, struct scatterlist *src,
+ 			   unsigned int nbytes)
+ {
+-	struct s390_des_ctx *ctx = crypto_blkcipher_ctx(desc->tfm);
+ 	struct blkcipher_walk walk;
+ 
+ 	blkcipher_walk_init(&walk, dst, src, nbytes);
+-	return cbc_desall_crypt(desc, KMC_DEA_ENCRYPT, ctx->iv, &walk);
++	return cbc_desall_crypt(desc, KMC_DEA_ENCRYPT, &walk);
+ }
+ 
+ static int cbc_des_decrypt(struct blkcipher_desc *desc,
+ 			   struct scatterlist *dst, struct scatterlist *src,
+ 			   unsigned int nbytes)
+ {
+-	struct s390_des_ctx *ctx = crypto_blkcipher_ctx(desc->tfm);
+ 	struct blkcipher_walk walk;
+ 
+ 	blkcipher_walk_init(&walk, dst, src, nbytes);
+-	return cbc_desall_crypt(desc, KMC_DEA_DECRYPT, ctx->iv, &walk);
++	return cbc_desall_crypt(desc, KMC_DEA_DECRYPT, &walk);
+ }
+ 
+ static struct crypto_alg cbc_des_alg = {
+@@ -331,22 +338,20 @@ static int cbc_des3_encrypt(struct blkcipher_desc *desc,
+ 			    struct scatterlist *dst, struct scatterlist *src,
+ 			    unsigned int nbytes)
+ {
+-	struct s390_des_ctx *ctx = crypto_blkcipher_ctx(desc->tfm);
+ 	struct blkcipher_walk walk;
+ 
+ 	blkcipher_walk_init(&walk, dst, src, nbytes);
+-	return cbc_desall_crypt(desc, KMC_TDEA_192_ENCRYPT, ctx->iv, &walk);
++	return cbc_desall_crypt(desc, KMC_TDEA_192_ENCRYPT, &walk);
+ }
+ 
+ static int cbc_des3_decrypt(struct blkcipher_desc *desc,
+ 			    struct scatterlist *dst, struct scatterlist *src,
+ 			    unsigned int nbytes)
+ {
+-	struct s390_des_ctx *ctx = crypto_blkcipher_ctx(desc->tfm);
+ 	struct blkcipher_walk walk;
+ 
+ 	blkcipher_walk_init(&walk, dst, src, nbytes);
+-	return cbc_desall_crypt(desc, KMC_TDEA_192_DECRYPT, ctx->iv, &walk);
++	return cbc_desall_crypt(desc, KMC_TDEA_192_DECRYPT, &walk);
+ }
+ 
+ static struct crypto_alg cbc_des3_alg = {
+@@ -372,52 +377,80 @@ static struct crypto_alg cbc_des3_alg = {
+ 	}
+ };
+ 
++static unsigned int __ctrblk_init(u8 *ctrptr, unsigned int nbytes)
++{
++	unsigned int i, n;
++
++	/* align to block size, max. PAGE_SIZE */
++	n = (nbytes > PAGE_SIZE) ? PAGE_SIZE : nbytes & ~(DES_BLOCK_SIZE - 1);
++	for (i = DES_BLOCK_SIZE; i < n; i += DES_BLOCK_SIZE) {
++		memcpy(ctrptr + i, ctrptr + i - DES_BLOCK_SIZE, DES_BLOCK_SIZE);
++		crypto_inc(ctrptr + i, DES_BLOCK_SIZE);
++	}
++	return n;
++}
++
+ static int ctr_desall_crypt(struct blkcipher_desc *desc, long func,
+-			    struct s390_des_ctx *ctx, struct blkcipher_walk *walk)
++			    struct s390_des_ctx *ctx,
++			    struct blkcipher_walk *walk)
+ {
+ 	int ret = blkcipher_walk_virt_block(desc, walk, DES_BLOCK_SIZE);
+-	unsigned int i, n, nbytes;
+-	u8 buf[DES_BLOCK_SIZE];
+-	u8 *out, *in;
++	unsigned int n, nbytes;
++	u8 buf[DES_BLOCK_SIZE], ctrbuf[DES_BLOCK_SIZE];
++	u8 *out, *in, *ctrptr = ctrbuf;
++
++	if (!walk->nbytes)
++		return ret;
++
++	if (spin_trylock(&ctrblk_lock))
++		ctrptr = ctrblk;
+ 
+-	memcpy(ctrblk, walk->iv, DES_BLOCK_SIZE);
++	memcpy(ctrptr, walk->iv, DES_BLOCK_SIZE);
+ 	while ((nbytes = walk->nbytes) >= DES_BLOCK_SIZE) {
+ 		out = walk->dst.virt.addr;
+ 		in = walk->src.virt.addr;
+ 		while (nbytes >= DES_BLOCK_SIZE) {
+-			/* align to block size, max. PAGE_SIZE */
+-			n = (nbytes > PAGE_SIZE) ? PAGE_SIZE :
+-				nbytes & ~(DES_BLOCK_SIZE - 1);
+-			for (i = DES_BLOCK_SIZE; i < n; i += DES_BLOCK_SIZE) {
+-				memcpy(ctrblk + i, ctrblk + i - DES_BLOCK_SIZE,
+-				       DES_BLOCK_SIZE);
+-				crypto_inc(ctrblk + i, DES_BLOCK_SIZE);
++			if (ctrptr == ctrblk)
++				n = __ctrblk_init(ctrptr, nbytes);
++			else
++				n = DES_BLOCK_SIZE;
++			ret = crypt_s390_kmctr(func, ctx->key, out, in,
++					       n, ctrptr);
++			if (ret < 0 || ret != n) {
++				if (ctrptr == ctrblk)
++					spin_unlock(&ctrblk_lock);
++				return -EIO;
+ 			}
+-			ret = crypt_s390_kmctr(func, ctx->key, out, in, n, ctrblk);
+-			BUG_ON((ret < 0) || (ret != n));
+ 			if (n > DES_BLOCK_SIZE)
+-				memcpy(ctrblk, ctrblk + n - DES_BLOCK_SIZE,
++				memcpy(ctrptr, ctrptr + n - DES_BLOCK_SIZE,
+ 				       DES_BLOCK_SIZE);
+-			crypto_inc(ctrblk, DES_BLOCK_SIZE);
++			crypto_inc(ctrptr, DES_BLOCK_SIZE);
+ 			out += n;
+ 			in += n;
+ 			nbytes -= n;
+ 		}
+ 		ret = blkcipher_walk_done(desc, walk, nbytes);
+ 	}
+-
++	if (ctrptr == ctrblk) {
++		if (nbytes)
++			memcpy(ctrbuf, ctrptr, DES_BLOCK_SIZE);
++		else
++			memcpy(walk->iv, ctrptr, DES_BLOCK_SIZE);
++		spin_unlock(&ctrblk_lock);
++	}
+ 	/* final block may be < DES_BLOCK_SIZE, copy only nbytes */
+ 	if (nbytes) {
+ 		out = walk->dst.virt.addr;
+ 		in = walk->src.virt.addr;
+ 		ret = crypt_s390_kmctr(func, ctx->key, buf, in,
+-				       DES_BLOCK_SIZE, ctrblk);
+-		BUG_ON(ret < 0 || ret != DES_BLOCK_SIZE);
++				       DES_BLOCK_SIZE, ctrbuf);
++		if (ret < 0 || ret != DES_BLOCK_SIZE)
++			return -EIO;
+ 		memcpy(out, buf, nbytes);
+-		crypto_inc(ctrblk, DES_BLOCK_SIZE);
++		crypto_inc(ctrbuf, DES_BLOCK_SIZE);
+ 		ret = blkcipher_walk_done(desc, walk, 0);
++		memcpy(walk->iv, ctrbuf, DES_BLOCK_SIZE);
+ 	}
+-	memcpy(walk->iv, ctrblk, DES_BLOCK_SIZE);
+ 	return ret;
+ }
+ 
+diff --git a/arch/s390/crypto/ghash_s390.c b/arch/s390/crypto/ghash_s390.c
+index b1bd170..f6373f0 100644
+--- a/arch/s390/crypto/ghash_s390.c
++++ b/arch/s390/crypto/ghash_s390.c
+@@ -72,14 +72,16 @@ static int ghash_update(struct shash_desc *desc,
+ 		if (!dctx->bytes) {
+ 			ret = crypt_s390_kimd(KIMD_GHASH, ctx, buf,
+ 					      GHASH_BLOCK_SIZE);
+-			BUG_ON(ret != GHASH_BLOCK_SIZE);
++			if (ret != GHASH_BLOCK_SIZE)
++				return -EIO;
+ 		}
+ 	}
+ 
+ 	n = srclen & ~(GHASH_BLOCK_SIZE - 1);
+ 	if (n) {
+ 		ret = crypt_s390_kimd(KIMD_GHASH, ctx, src, n);
+-		BUG_ON(ret != n);
++		if (ret != n)
++			return -EIO;
+ 		src += n;
+ 		srclen -= n;
+ 	}
+@@ -92,7 +94,7 @@ static int ghash_update(struct shash_desc *desc,
+ 	return 0;
+ }
+ 
+-static void ghash_flush(struct ghash_ctx *ctx, struct ghash_desc_ctx *dctx)
++static int ghash_flush(struct ghash_ctx *ctx, struct ghash_desc_ctx *dctx)
+ {
+ 	u8 *buf = dctx->buffer;
+ 	int ret;
+@@ -103,21 +105,24 @@ static void ghash_flush(struct ghash_ctx *ctx, struct ghash_desc_ctx *dctx)
+ 		memset(pos, 0, dctx->bytes);
+ 
+ 		ret = crypt_s390_kimd(KIMD_GHASH, ctx, buf, GHASH_BLOCK_SIZE);
+-		BUG_ON(ret != GHASH_BLOCK_SIZE);
++		if (ret != GHASH_BLOCK_SIZE)
++			return -EIO;
+ 	}
+ 
+ 	dctx->bytes = 0;
++	return 0;
+ }
+ 
+ static int ghash_final(struct shash_desc *desc, u8 *dst)
+ {
+ 	struct ghash_desc_ctx *dctx = shash_desc_ctx(desc);
+ 	struct ghash_ctx *ctx = crypto_shash_ctx(desc->tfm);
++	int ret;
+ 
+-	ghash_flush(ctx, dctx);
+-	memcpy(dst, ctx->icv, GHASH_BLOCK_SIZE);
+-
+-	return 0;
++	ret = ghash_flush(ctx, dctx);
++	if (!ret)
++		memcpy(dst, ctx->icv, GHASH_BLOCK_SIZE);
++	return ret;
+ }
+ 
+ static struct shash_alg ghash_alg = {
+diff --git a/arch/s390/crypto/sha_common.c b/arch/s390/crypto/sha_common.c
+index bd37d09..8620b0e 100644
+--- a/arch/s390/crypto/sha_common.c
++++ b/arch/s390/crypto/sha_common.c
+@@ -36,7 +36,8 @@ int s390_sha_update(struct shash_desc *desc, const u8 *data, unsigned int len)
+ 	if (index) {
+ 		memcpy(ctx->buf + index, data, bsize - index);
+ 		ret = crypt_s390_kimd(ctx->func, ctx->state, ctx->buf, bsize);
+-		BUG_ON(ret != bsize);
++		if (ret != bsize)
++			return -EIO;
+ 		data += bsize - index;
+ 		len -= bsize - index;
+ 		index = 0;
+@@ -46,7 +47,8 @@ int s390_sha_update(struct shash_desc *desc, const u8 *data, unsigned int len)
+ 	if (len >= bsize) {
+ 		ret = crypt_s390_kimd(ctx->func, ctx->state, data,
+ 				      len & ~(bsize - 1));
+-		BUG_ON(ret != (len & ~(bsize - 1)));
++		if (ret != (len & ~(bsize - 1)))
++			return -EIO;
+ 		data += ret;
+ 		len -= ret;
+ 	}
+@@ -88,7 +90,8 @@ int s390_sha_final(struct shash_desc *desc, u8 *out)
+ 	memcpy(ctx->buf + end - 8, &bits, sizeof(bits));
+ 
+ 	ret = crypt_s390_kimd(ctx->func, ctx->state, ctx->buf, end);
+-	BUG_ON(ret != end);
++	if (ret != end)
++		return -EIO;
+ 
+ 	/* copy digest to out */
+ 	memcpy(out, ctx->state, crypto_shash_digestsize(desc->tfm));
+diff --git a/arch/s390/mm/page-states.c b/arch/s390/mm/page-states.c
+index a90d45e..27c50f4 100644
+--- a/arch/s390/mm/page-states.c
++++ b/arch/s390/mm/page-states.c
+@@ -12,6 +12,8 @@
+ #include <linux/mm.h>
+ #include <linux/gfp.h>
+ #include <linux/init.h>
++#include <asm/setup.h>
++#include <asm/ipl.h>
+ 
+ #define ESSA_SET_STABLE		1
+ #define ESSA_SET_UNUSED		2
+@@ -41,6 +43,14 @@ void __init cmma_init(void)
+ 
+ 	if (!cmma_flag)
+ 		return;
++	/*
++	 * Disable CMM for dump, otherwise  the tprot based memory
++	 * detection can fail because of unstable pages.
++	 */
++	if (OLDMEM_BASE || ipl_info.type == IPL_TYPE_FCP_DUMP) {
++		cmma_flag = 0;
++		return;
++	}
+ 	asm volatile(
+ 		"       .insn rrf,0xb9ab0000,%1,%1,0,0\n"
+ 		"0:     la      %0,0\n"
+diff --git a/arch/x86/include/asm/irq.h b/arch/x86/include/asm/irq.h
+index ba870bb..f97134a 100644
+--- a/arch/x86/include/asm/irq.h
++++ b/arch/x86/include/asm/irq.h
+@@ -25,6 +25,7 @@ extern void irq_ctx_init(int cpu);
+ 
+ #ifdef CONFIG_HOTPLUG_CPU
+ #include <linux/cpumask.h>
++extern int check_irq_vectors_for_cpu_disable(void);
+ extern void fixup_irqs(void);
+ extern void irq_force_complete_move(int);
+ #endif
+diff --git a/arch/x86/kernel/cpu/perf_event.c b/arch/x86/kernel/cpu/perf_event.c
+index 2bda212..1c041e0 100644
+--- a/arch/x86/kernel/cpu/perf_event.c
++++ b/arch/x86/kernel/cpu/perf_event.c
+@@ -971,6 +971,9 @@ static void x86_pmu_del(struct perf_event *event, int flags)
+ 	for (i = 0; i < cpuc->n_events; i++) {
+ 		if (event == cpuc->event_list[i]) {
+ 
++			if (i >= cpuc->n_events - cpuc->n_added)
++				--cpuc->n_added;
++
+ 			if (x86_pmu.put_event_constraints)
+ 				x86_pmu.put_event_constraints(cpuc, event);
+ 
+diff --git a/arch/x86/kernel/irq.c b/arch/x86/kernel/irq.c
+index fb2eb32..687637b 100644
+--- a/arch/x86/kernel/irq.c
++++ b/arch/x86/kernel/irq.c
+@@ -222,6 +222,76 @@ void smp_x86_platform_ipi(struct pt_regs *regs)
+ EXPORT_SYMBOL_GPL(vector_used_by_percpu_irq);
+ 
+ #ifdef CONFIG_HOTPLUG_CPU
++/*
++ * This cpu is going to be removed and its vectors migrated to the remaining
++ * online cpus.  Check to see if there are enough vectors in the remaining cpus.
++ * This function is protected by stop_machine().
++ */
++int check_irq_vectors_for_cpu_disable(void)
++{
++	int irq, cpu;
++	unsigned int this_cpu, vector, this_count, count;
++	struct irq_desc *desc;
++	struct irq_data *data;
++	struct cpumask affinity_new, online_new;
++
++	this_cpu = smp_processor_id();
++	cpumask_copy(&online_new, cpu_online_mask);
++	cpu_clear(this_cpu, online_new);
++
++	this_count = 0;
++	for (vector = FIRST_EXTERNAL_VECTOR; vector < NR_VECTORS; vector++) {
++		irq = __this_cpu_read(vector_irq[vector]);
++		if (irq >= 0) {
++			desc = irq_to_desc(irq);
++			data = irq_desc_get_irq_data(desc);
++			cpumask_copy(&affinity_new, data->affinity);
++			cpu_clear(this_cpu, affinity_new);
++
++			/* Do not count inactive or per-cpu irqs. */
++			if (!irq_has_action(irq) || irqd_is_per_cpu(data))
++				continue;
++
++			/*
++			 * A single irq may be mapped to multiple
++			 * cpu's vector_irq[] (for example IOAPIC cluster
++			 * mode).  In this case we have two
++			 * possibilities:
++			 *
++			 * 1) the resulting affinity mask is empty; that is
++			 * this the down'd cpu is the last cpu in the irq's
++			 * affinity mask, or
++			 *
++			 * 2) the resulting affinity mask is no longer
++			 * a subset of the online cpus but the affinity
++			 * mask is not zero; that is the down'd cpu is the
++			 * last online cpu in a user set affinity mask.
++			 */
++			if (cpumask_empty(&affinity_new) ||
++			    !cpumask_subset(&affinity_new, &online_new))
++				this_count++;
++		}
++	}
++
++	count = 0;
++	for_each_online_cpu(cpu) {
++		if (cpu == this_cpu)
++			continue;
++		for (vector = FIRST_EXTERNAL_VECTOR; vector < NR_VECTORS;
++		     vector++) {
++			if (per_cpu(vector_irq, cpu)[vector] < 0)
++				count++;
++		}
++	}
++
++	if (count < this_count) {
++		pr_warn("CPU %d disable failed: CPU has %u vectors assigned and there are only %u available.\n",
++			this_cpu, this_count, count);
++		return -ERANGE;
++	}
++	return 0;
++}
++
+ /* A cpu has been removed from cpu_online_mask.  Reset irq affinities. */
+ void fixup_irqs(void)
+ {
+diff --git a/arch/x86/kernel/quirks.c b/arch/x86/kernel/quirks.c
+index 03920a1..28a3e62 100644
+--- a/arch/x86/kernel/quirks.c
++++ b/arch/x86/kernel/quirks.c
+@@ -525,7 +525,7 @@ static void __init quirk_amd_nb_node(struct pci_dev *dev)
+ 		return;
+ 
+ 	pci_read_config_dword(nb_ht, 0x60, &val);
+-	node = val & 7;
++	node = pcibus_to_node(dev->bus) | (val & 7);
+ 	/*
+ 	 * Some hardware may return an invalid node ID,
+ 	 * so check it first:
+diff --git a/arch/x86/kernel/smpboot.c b/arch/x86/kernel/smpboot.c
+index 9f548cb..b88eadb 100644
+--- a/arch/x86/kernel/smpboot.c
++++ b/arch/x86/kernel/smpboot.c
+@@ -1278,6 +1278,7 @@ void cpu_disable_common(void)
+ int native_cpu_disable(void)
+ {
+ 	int cpu = smp_processor_id();
++	int ret;
+ 
+ 	/*
+ 	 * Perhaps use cpufreq to drop frequency, but that could go
+@@ -1290,6 +1291,10 @@ int native_cpu_disable(void)
+ 	if (cpu == 0)
+ 		return -EBUSY;
+ 
++	ret = check_irq_vectors_for_cpu_disable();
++	if (ret)
++		return ret;
++
+ 	clear_local_APIC();
+ 
+ 	cpu_disable_common();
+diff --git a/arch/x86/kvm/i8254.c b/arch/x86/kvm/i8254.c
+index 405f262..139415e 100644
+--- a/arch/x86/kvm/i8254.c
++++ b/arch/x86/kvm/i8254.c
+@@ -38,6 +38,7 @@
+ 
+ #include "irq.h"
+ #include "i8254.h"
++#include "x86.h"
+ 
+ #ifndef CONFIG_X86_64
+ #define mod_64(x, y) ((x) - (y) * div64_u64(x, y))
+@@ -364,6 +365,23 @@ static void create_pit_timer(struct kvm *kvm, u32 val, int is_period)
+ 	atomic_set(&pt->pending, 0);
+ 	ps->irq_ack = 1;
+ 
++	/*
++	 * Do not allow the guest to program periodic timers with small
++	 * interval, since the hrtimers are not throttled by the host
++	 * scheduler.
++	 */
++	if (ps->is_periodic) {
++		s64 min_period = min_timer_period_us * 1000LL;
++
++		if (pt->period < min_period) {
++			pr_info_ratelimited(
++			    "kvm: requested %lld ns "
++			    "i8254 timer period limited to %lld ns\n",
++			    pt->period, min_period);
++			pt->period = min_period;
++		}
++	}
++
+ 	hrtimer_start(&pt->timer, ktime_add_ns(ktime_get(), interval),
+ 		      HRTIMER_MODE_ABS);
+ }
+diff --git a/arch/x86/kvm/lapic.c b/arch/x86/kvm/lapic.c
+index 757c716..176205a 100644
+--- a/arch/x86/kvm/lapic.c
++++ b/arch/x86/kvm/lapic.c
+@@ -68,9 +68,6 @@
+ #define VEC_POS(v) ((v) & (32 - 1))
+ #define REG_POS(v) (((v) >> 5) << 4)
+ 
+-static unsigned int min_timer_period_us = 500;
+-module_param(min_timer_period_us, uint, S_IRUGO | S_IWUSR);
+-
+ static inline u32 apic_get_reg(struct kvm_lapic *apic, int reg_off)
+ {
+ 	return *((u32 *) (apic->regs + reg_off));
+diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c
+index 94a4672..2102a17 100644
+--- a/arch/x86/kvm/svm.c
++++ b/arch/x86/kvm/svm.c
+@@ -2904,10 +2904,8 @@ static int cr8_write_interception(struct vcpu_svm *svm)
+ 	u8 cr8_prev = kvm_get_cr8(&svm->vcpu);
+ 	/* instruction emulation calls kvm_set_cr8() */
+ 	r = cr_interception(svm);
+-	if (irqchip_in_kernel(svm->vcpu.kvm)) {
+-		clr_cr_intercept(svm, INTERCEPT_CR8_WRITE);
++	if (irqchip_in_kernel(svm->vcpu.kvm))
+ 		return r;
+-	}
+ 	if (cr8_prev <= kvm_get_cr8(&svm->vcpu))
+ 		return r;
+ 	kvm_run->exit_reason = KVM_EXIT_SET_TPR;
+@@ -3462,6 +3460,8 @@ static void update_cr8_intercept(struct kvm_vcpu *vcpu, int tpr, int irr)
+ 	if (is_guest_mode(vcpu) && (vcpu->arch.hflags & HF_VINTR_MASK))
+ 		return;
+ 
++	clr_cr_intercept(svm, INTERCEPT_CR8_WRITE);
++
+ 	if (irr == -1)
+ 		return;
+ 
+diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
+index 7774cca..b9fefaf 100644
+--- a/arch/x86/kvm/x86.c
++++ b/arch/x86/kvm/x86.c
+@@ -92,6 +92,9 @@ EXPORT_SYMBOL_GPL(kvm_x86_ops);
+ int ignore_msrs = 0;
+ module_param_named(ignore_msrs, ignore_msrs, bool, S_IRUGO | S_IWUSR);
+ 
++unsigned int min_timer_period_us = 500;
++module_param(min_timer_period_us, uint, S_IRUGO | S_IWUSR);
++
+ bool kvm_has_tsc_control;
+ EXPORT_SYMBOL_GPL(kvm_has_tsc_control);
+ u32  kvm_max_guest_tsc_khz;
+diff --git a/arch/x86/kvm/x86.h b/arch/x86/kvm/x86.h
+index d36fe23..0e22f64 100644
+--- a/arch/x86/kvm/x86.h
++++ b/arch/x86/kvm/x86.h
+@@ -125,4 +125,6 @@ int kvm_write_guest_virt_system(struct x86_emulate_ctxt *ctxt,
+ 	gva_t addr, void *val, unsigned int bytes,
+ 	struct x86_exception *exception);
+ 
++extern unsigned int min_timer_period_us;
++
+ #endif
+diff --git a/arch/x86/platform/efi/efi.c b/arch/x86/platform/efi/efi.c
+index bee75a6..e56da77 100644
+--- a/arch/x86/platform/efi/efi.c
++++ b/arch/x86/platform/efi/efi.c
+@@ -424,7 +424,7 @@ void __init efi_reserve_boot_services(void)
+ 		 * - Not within any part of the kernel
+ 		 * - Not the bios reserved area
+ 		*/
+-		if ((start+size >= virt_to_phys(_text)
++		if ((start + size > virt_to_phys(_text)
+ 				&& start <= virt_to_phys(_end)) ||
+ 			!e820_all_mapped(start, start+size, E820_RAM) ||
+ 			memblock_x86_check_reserved_size(&start, &size,
+diff --git a/block/blk-lib.c b/block/blk-lib.c
+index 2b461b4..36751e2 100644
+--- a/block/blk-lib.c
++++ b/block/blk-lib.c
+@@ -101,6 +101,14 @@ int blkdev_issue_discard(struct block_device *bdev, sector_t sector,
+ 
+ 		atomic_inc(&bb.done);
+ 		submit_bio(type, bio);
++
++		/*
++		 * We can loop for a long time in here, if someone does
++		 * full device discards (like mkfs). Be nice and allow
++		 * us to schedule out to avoid softlocking if preempt
++		 * is disabled.
++		 */
++		cond_resched();
+ 	}
+ 
+ 	/* Wait for bios in-flight */
+diff --git a/drivers/acpi/bus.c b/drivers/acpi/bus.c
+index 5016de5..f324429 100644
+--- a/drivers/acpi/bus.c
++++ b/drivers/acpi/bus.c
+@@ -33,6 +33,7 @@
+ #include <linux/proc_fs.h>
+ #include <linux/acpi.h>
+ #include <linux/slab.h>
++#include <linux/regulator/machine.h>
+ #ifdef CONFIG_X86
+ #include <asm/mpspec.h>
+ #endif
+@@ -917,6 +918,14 @@ void __init acpi_early_init(void)
+ 		goto error0;
+ 	}
+ 
++	/*
++	 * If the system is using ACPI then we can be reasonably
++	 * confident that any regulators are managed by the firmware
++	 * so tell the regulator core it has everything it needs to
++	 * know.
++	 */
++	regulator_has_full_constraints();
++
+ 	return;
+ 
+       error0:
+diff --git a/drivers/acpi/processor_throttling.c b/drivers/acpi/processor_throttling.c
+index 605a295..abe45cb 100644
+--- a/drivers/acpi/processor_throttling.c
++++ b/drivers/acpi/processor_throttling.c
+@@ -59,6 +59,12 @@ struct throttling_tstate {
+ 	int target_state;		/* target T-state */
+ };
+ 
++struct acpi_processor_throttling_arg {
++	struct acpi_processor *pr;
++	int target_state;
++	bool force;
++};
++
+ #define THROTTLING_PRECHANGE       (1)
+ #define THROTTLING_POSTCHANGE      (2)
+ 
+@@ -1063,16 +1069,24 @@ static int acpi_processor_set_throttling_ptc(struct acpi_processor *pr,
+ 	return 0;
+ }
+ 
++static long acpi_processor_throttling_fn(void *data)
++{
++	struct acpi_processor_throttling_arg *arg = data;
++	struct acpi_processor *pr = arg->pr;
++
++	return pr->throttling.acpi_processor_set_throttling(pr,
++			arg->target_state, arg->force);
++}
++
+ int acpi_processor_set_throttling(struct acpi_processor *pr,
+ 						int state, bool force)
+ {
+-	cpumask_var_t saved_mask;
+ 	int ret = 0;
+ 	unsigned int i;
+ 	struct acpi_processor *match_pr;
+ 	struct acpi_processor_throttling *p_throttling;
++	struct acpi_processor_throttling_arg arg;
+ 	struct throttling_tstate t_state;
+-	cpumask_var_t online_throttling_cpus;
+ 
+ 	if (!pr)
+ 		return -EINVAL;
+@@ -1083,14 +1097,6 @@ int acpi_processor_set_throttling(struct acpi_processor *pr,
+ 	if ((state < 0) || (state > (pr->throttling.state_count - 1)))
+ 		return -EINVAL;
+ 
+-	if (!alloc_cpumask_var(&saved_mask, GFP_KERNEL))
+-		return -ENOMEM;
+-
+-	if (!alloc_cpumask_var(&online_throttling_cpus, GFP_KERNEL)) {
+-		free_cpumask_var(saved_mask);
+-		return -ENOMEM;
+-	}
+-
+ 	if (cpu_is_offline(pr->id)) {
+ 		/*
+ 		 * the cpu pointed by pr->id is offline. Unnecessary to change
+@@ -1099,17 +1105,15 @@ int acpi_processor_set_throttling(struct acpi_processor *pr,
+ 		return -ENODEV;
+ 	}
+ 
+-	cpumask_copy(saved_mask, &current->cpus_allowed);
+ 	t_state.target_state = state;
+ 	p_throttling = &(pr->throttling);
+-	cpumask_and(online_throttling_cpus, cpu_online_mask,
+-		    p_throttling->shared_cpu_map);
++
+ 	/*
+ 	 * The throttling notifier will be called for every
+ 	 * affected cpu in order to get one proper T-state.
+ 	 * The notifier event is THROTTLING_PRECHANGE.
+ 	 */
+-	for_each_cpu(i, online_throttling_cpus) {
++	for_each_cpu_and(i, cpu_online_mask, p_throttling->shared_cpu_map) {
+ 		t_state.cpu = i;
+ 		acpi_processor_throttling_notifier(THROTTLING_PRECHANGE,
+ 							&t_state);
+@@ -1121,21 +1125,18 @@ int acpi_processor_set_throttling(struct acpi_processor *pr,
+ 	 * it can be called only for the cpu pointed by pr.
+ 	 */
+ 	if (p_throttling->shared_type == DOMAIN_COORD_TYPE_SW_ANY) {
+-		/* FIXME: use work_on_cpu() */
+-		if (set_cpus_allowed_ptr(current, cpumask_of(pr->id))) {
+-			/* Can't migrate to the pr->id CPU. Exit */
+-			ret = -ENODEV;
+-			goto exit;
+-		}
+-		ret = p_throttling->acpi_processor_set_throttling(pr,
+-						t_state.target_state, force);
++		arg.pr = pr;
++		arg.target_state = state;
++		arg.force = force;
++		ret = work_on_cpu(pr->id, acpi_processor_throttling_fn, &arg);
+ 	} else {
+ 		/*
+ 		 * When the T-state coordination is SW_ALL or HW_ALL,
+ 		 * it is necessary to set T-state for every affected
+ 		 * cpus.
+ 		 */
+-		for_each_cpu(i, online_throttling_cpus) {
++		for_each_cpu_and(i, cpu_online_mask,
++		    p_throttling->shared_cpu_map) {
+ 			match_pr = per_cpu(processors, i);
+ 			/*
+ 			 * If the pointer is invalid, we will report the
+@@ -1156,13 +1157,12 @@ int acpi_processor_set_throttling(struct acpi_processor *pr,
+ 					"on CPU %d\n", i));
+ 				continue;
+ 			}
+-			t_state.cpu = i;
+-			/* FIXME: use work_on_cpu() */
+-			if (set_cpus_allowed_ptr(current, cpumask_of(i)))
+-				continue;
+-			ret = match_pr->throttling.
+-				acpi_processor_set_throttling(
+-				match_pr, t_state.target_state, force);
++
++			arg.pr = match_pr;
++			arg.target_state = state;
++			arg.force = force;
++			ret = work_on_cpu(pr->id, acpi_processor_throttling_fn,
++				&arg);
+ 		}
+ 	}
+ 	/*
+@@ -1171,17 +1171,12 @@ int acpi_processor_set_throttling(struct acpi_processor *pr,
+ 	 * affected cpu to update the T-states.
+ 	 * The notifier event is THROTTLING_POSTCHANGE
+ 	 */
+-	for_each_cpu(i, online_throttling_cpus) {
++	for_each_cpu_and(i, cpu_online_mask, p_throttling->shared_cpu_map) {
+ 		t_state.cpu = i;
+ 		acpi_processor_throttling_notifier(THROTTLING_POSTCHANGE,
+ 							&t_state);
+ 	}
+-	/* restore the previous state */
+-	/* FIXME: use work_on_cpu() */
+-	set_cpus_allowed_ptr(current, saved_mask);
+-exit:
+-	free_cpumask_var(online_throttling_cpus);
+-	free_cpumask_var(saved_mask);
++
+ 	return ret;
+ }
+ 
+diff --git a/drivers/acpi/video.c b/drivers/acpi/video.c
+index e19898d..2ebfdd2 100644
+--- a/drivers/acpi/video.c
++++ b/drivers/acpi/video.c
+@@ -646,6 +646,7 @@ acpi_video_init_brightness(struct acpi_video_device *device)
+ 	union acpi_object *o;
+ 	struct acpi_video_device_brightness *br = NULL;
+ 	int result = -EINVAL;
++	u32 value;
+ 
+ 	if (!ACPI_SUCCESS(acpi_video_device_lcd_query_levels(device, &obj))) {
+ 		ACPI_DEBUG_PRINT((ACPI_DB_INFO, "Could not query available "
+@@ -676,7 +677,12 @@ acpi_video_init_brightness(struct acpi_video_device *device)
+ 			printk(KERN_ERR PREFIX "Invalid data\n");
+ 			continue;
+ 		}
+-		br->levels[count] = (u32) o->integer.value;
++		value = (u32) o->integer.value;
++		/* Skip duplicate entries */
++		if (count > 2 && br->levels[count - 1] == value)
++			continue;
++
++		br->levels[count] = value;
+ 
+ 		if (br->levels[count] > max_level)
+ 			max_level = br->levels[count];
+diff --git a/drivers/ata/ahci.c b/drivers/ata/ahci.c
+index f4000ee..0feffc3 100644
+--- a/drivers/ata/ahci.c
++++ b/drivers/ata/ahci.c
+@@ -61,6 +61,7 @@ enum board_ids {
+ 	/* board IDs by feature in alphabetical order */
+ 	board_ahci,
+ 	board_ahci_ign_iferr,
++	board_ahci_noncq,
+ 	board_ahci_nosntf,
+ 	board_ahci_yes_fbs,
+ 
+@@ -123,6 +124,13 @@ static const struct ata_port_info ahci_port_info[] = {
+ 		.udma_mask	= ATA_UDMA6,
+ 		.port_ops	= &ahci_ops,
+ 	},
++	[board_ahci_noncq] = {
++		AHCI_HFLAGS	(AHCI_HFLAG_NO_NCQ),
++		.flags		= AHCI_FLAG_COMMON,
++		.pio_mask	= ATA_PIO4,
++		.udma_mask	= ATA_UDMA6,
++		.port_ops	= &ahci_ops,
++	},
+ 	[board_ahci_nosntf] =
+ 	{
+ 		AHCI_HFLAGS	(AHCI_HFLAG_NO_SNTF),
+@@ -458,6 +466,12 @@ static const struct pci_device_id ahci_pci_tbl[] = {
+ 	{ PCI_VDEVICE(ASMEDIA, 0x0611), board_ahci },	/* ASM1061 */
+ 	{ PCI_VDEVICE(ASMEDIA, 0x0612), board_ahci },	/* ASM1062 */
+ 
++	/*
++	 * Samsung SSDs found on some macbooks.  NCQ times out.
++	 * https://bugzilla.kernel.org/show_bug.cgi?id=60731
++	 */
++	{ PCI_VDEVICE(SAMSUNG, 0x1600), board_ahci_noncq },
++
+ 	/* Enmotus */
+ 	{ PCI_DEVICE(0x1c44, 0x8000), board_ahci },
+ 
+diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
+index 72bbb5e..b3f0f5a 100644
+--- a/drivers/ata/libata-core.c
++++ b/drivers/ata/libata-core.c
+@@ -2188,6 +2188,16 @@ int ata_dev_configure(struct ata_device *dev)
+ 	if (rc)
+ 		return rc;
+ 
++	/* some WD SATA-1 drives have issues with LPM, turn on NOLPM for them */
++	if ((dev->horkage & ATA_HORKAGE_WD_BROKEN_LPM) &&
++	    (id[76] & 0xe) == 0x2)
++		dev->horkage |= ATA_HORKAGE_NOLPM;
++
++	if (dev->horkage & ATA_HORKAGE_NOLPM) {
++		ata_dev_warn(dev, "LPM support broken, forcing max_power\n");
++		dev->link->ap->target_lpm_policy = ATA_LPM_MAX_POWER;
++	}
++
+ 	/* let ACPI work its magic */
+ 	rc = ata_acpi_on_devcfg(dev);
+ 	if (rc)
+@@ -4099,6 +4109,7 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = {
+ 
+ 	/* Seagate Momentus SpinPoint M8 seem to have FPMDA_AA issues */
+ 	{ "ST1000LM024 HN-M101MBB", "2AR10001",	ATA_HORKAGE_BROKEN_FPDMA_AA },
++	{ "ST1000LM024 HN-M101MBB", "2BA30001",	ATA_HORKAGE_BROKEN_FPDMA_AA },
+ 
+ 	/* Blacklist entries taken from Silicon Image 3124/3132
+ 	   Windows driver .inf file - also several Linux problem reports */
+@@ -4143,6 +4154,23 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = {
+ 	{ "PIONEER DVD-RW  DVR-212D",	NULL,	ATA_HORKAGE_NOSETXFER },
+ 	{ "PIONEER DVD-RW  DVR-216D",	NULL,	ATA_HORKAGE_NOSETXFER },
+ 
++	/*
++	 * Some WD SATA-I drives spin up and down erratically when the link
++	 * is put into the slumber mode.  We don't have full list of the
++	 * affected devices.  Disable LPM if the device matches one of the
++	 * known prefixes and is SATA-1.  As a side effect LPM partial is
++	 * lost too.
++	 *
++	 * https://bugzilla.kernel.org/show_bug.cgi?id=57211
++	 */
++	{ "WDC WD800JD-*",		NULL,	ATA_HORKAGE_WD_BROKEN_LPM },
++	{ "WDC WD1200JD-*",		NULL,	ATA_HORKAGE_WD_BROKEN_LPM },
++	{ "WDC WD1600JD-*",		NULL,	ATA_HORKAGE_WD_BROKEN_LPM },
++	{ "WDC WD2000JD-*",		NULL,	ATA_HORKAGE_WD_BROKEN_LPM },
++	{ "WDC WD2500JD-*",		NULL,	ATA_HORKAGE_WD_BROKEN_LPM },
++	{ "WDC WD3000JD-*",		NULL,	ATA_HORKAGE_WD_BROKEN_LPM },
++	{ "WDC WD3200JD-*",		NULL,	ATA_HORKAGE_WD_BROKEN_LPM },
++
+ 	/* End Marker */
+ 	{ }
+ };
+diff --git a/drivers/ata/libata-pmp.c b/drivers/ata/libata-pmp.c
+index f5c35be..0ba32fe 100644
+--- a/drivers/ata/libata-pmp.c
++++ b/drivers/ata/libata-pmp.c
+@@ -447,8 +447,11 @@ static void sata_pmp_quirks(struct ata_port *ap)
+ 		 * otherwise.  Don't try hard to recover it.
+ 		 */
+ 		ap->pmp_link[ap->nr_pmp_links - 1].flags |= ATA_LFLAG_NO_RETRY;
+-	} else if (vendor == 0x197b && devid == 0x2352) {
+-		/* chip found in Thermaltake BlackX Duet, jmicron JMB350? */
++	} else if (vendor == 0x197b && (devid == 0x2352 || devid == 0x0325)) {
++		/*
++		 * 0x2352: found in Thermaltake BlackX Duet, jmicron JMB350?
++		 * 0x0325: jmicron JMB394.
++		 */
+ 		ata_for_each_link(link, ap, EDGE) {
+ 			/* SRST breaks detection and disks get misclassified
+ 			 * LPM disabled to avoid potential problems
+diff --git a/drivers/ata/libata-scsi.c b/drivers/ata/libata-scsi.c
+index dd332e5..8460e62 100644
+--- a/drivers/ata/libata-scsi.c
++++ b/drivers/ata/libata-scsi.c
+@@ -111,12 +111,14 @@ static const char *ata_lpm_policy_names[] = {
+ 	[ATA_LPM_MIN_POWER]	= "min_power",
+ };
+ 
+-static ssize_t ata_scsi_lpm_store(struct device *dev,
++static ssize_t ata_scsi_lpm_store(struct device *device,
+ 				  struct device_attribute *attr,
+ 				  const char *buf, size_t count)
+ {
+-	struct Scsi_Host *shost = class_to_shost(dev);
++	struct Scsi_Host *shost = class_to_shost(device);
+ 	struct ata_port *ap = ata_shost_to_port(shost);
++	struct ata_link *link;
++	struct ata_device *dev;
+ 	enum ata_lpm_policy policy;
+ 	unsigned long flags;
+ 
+@@ -132,10 +134,20 @@ static ssize_t ata_scsi_lpm_store(struct device *dev,
+ 		return -EINVAL;
+ 
+ 	spin_lock_irqsave(ap->lock, flags);
++
++	ata_for_each_link(link, ap, EDGE) {
++		ata_for_each_dev(dev, &ap->link, ENABLED) {
++			if (dev->horkage & ATA_HORKAGE_NOLPM) {
++				count = -EOPNOTSUPP;
++				goto out_unlock;
++			}
++		}
++	}
++
+ 	ap->target_lpm_policy = policy;
+ 	ata_port_schedule_eh(ap);
++out_unlock:
+ 	spin_unlock_irqrestore(ap->lock, flags);
+-
+ 	return count;
+ }
+ 
+diff --git a/drivers/ata/sata_sil.c b/drivers/ata/sata_sil.c
+index 9dfb40b..0c4ed89 100644
+--- a/drivers/ata/sata_sil.c
++++ b/drivers/ata/sata_sil.c
+@@ -157,6 +157,7 @@ static const struct sil_drivelist {
+ 	{ "ST380011ASL",	SIL_QUIRK_MOD15WRITE },
+ 	{ "ST3120022ASL",	SIL_QUIRK_MOD15WRITE },
+ 	{ "ST3160021ASL",	SIL_QUIRK_MOD15WRITE },
++	{ "TOSHIBA MK2561GSYN",	SIL_QUIRK_MOD15WRITE },
+ 	{ "Maxtor 4D060H3",	SIL_QUIRK_UDMA5MAX },
+ 	{ }
+ };
+diff --git a/drivers/block/xen-blkfront.c b/drivers/block/xen-blkfront.c
+index 7b2ec59..96b8cb7 100644
+--- a/drivers/block/xen-blkfront.c
++++ b/drivers/block/xen-blkfront.c
+@@ -1281,13 +1281,16 @@ static void blkback_changed(struct xenbus_device *dev,
+ 	case XenbusStateReconfiguring:
+ 	case XenbusStateReconfigured:
+ 	case XenbusStateUnknown:
+-	case XenbusStateClosed:
+ 		break;
+ 
+ 	case XenbusStateConnected:
+ 		blkfront_connect(info);
+ 		break;
+ 
++	case XenbusStateClosed:
++		if (dev->state == XenbusStateClosed)
++			break;
++		/* Missed the backend's Closing state -- fallthrough */
+ 	case XenbusStateClosing:
+ 		blkfront_closing(info);
+ 		break;
+diff --git a/drivers/char/raw.c b/drivers/char/raw.c
+index b6de2c0..5ded1a5 100644
+--- a/drivers/char/raw.c
++++ b/drivers/char/raw.c
+@@ -190,7 +190,7 @@ static int bind_get(int number, dev_t *dev)
+ 	struct raw_device_data *rawdev;
+ 	struct block_device *bdev;
+ 
+-	if (number <= 0 || number >= MAX_RAW_MINORS)
++	if (number <= 0 || number >= max_raw_minors)
+ 		return -EINVAL;
+ 
+ 	rawdev = &raw_devices[number];
+diff --git a/drivers/dma/ioat/dma.c b/drivers/dma/ioat/dma.c
+index 6595180..3f89386 100644
+--- a/drivers/dma/ioat/dma.c
++++ b/drivers/dma/ioat/dma.c
+@@ -75,7 +75,8 @@ static irqreturn_t ioat_dma_do_interrupt(int irq, void *data)
+ 	attnstatus = readl(instance->reg_base + IOAT_ATTNSTATUS_OFFSET);
+ 	for_each_set_bit(bit, &attnstatus, BITS_PER_LONG) {
+ 		chan = ioat_chan_by_index(instance, bit);
+-		tasklet_schedule(&chan->cleanup_task);
++		if (test_bit(IOAT_RUN, &chan->state))
++			tasklet_schedule(&chan->cleanup_task);
+ 	}
+ 
+ 	writeb(intrctrl, instance->reg_base + IOAT_INTRCTRL_OFFSET);
+@@ -91,7 +92,8 @@ static irqreturn_t ioat_dma_do_interrupt_msix(int irq, void *data)
+ {
+ 	struct ioat_chan_common *chan = data;
+ 
+-	tasklet_schedule(&chan->cleanup_task);
++	if (test_bit(IOAT_RUN, &chan->state))
++		tasklet_schedule(&chan->cleanup_task);
+ 
+ 	return IRQ_HANDLED;
+ }
+@@ -113,7 +115,6 @@ void ioat_init_channel(struct ioatdma_device *device, struct ioat_chan_common *c
+ 	chan->timer.function = device->timer_fn;
+ 	chan->timer.data = data;
+ 	tasklet_init(&chan->cleanup_task, device->cleanup_fn, data);
+-	tasklet_disable(&chan->cleanup_task);
+ }
+ 
+ /**
+@@ -356,13 +357,43 @@ static int ioat1_dma_alloc_chan_resources(struct dma_chan *c)
+ 	writel(((u64) chan->completion_dma) >> 32,
+ 	       chan->reg_base + IOAT_CHANCMP_OFFSET_HIGH);
+ 
+-	tasklet_enable(&chan->cleanup_task);
++	set_bit(IOAT_RUN, &chan->state);
+ 	ioat1_dma_start_null_desc(ioat);  /* give chain to dma device */
+ 	dev_dbg(to_dev(chan), "%s: allocated %d descriptors\n",
+ 		__func__, ioat->desccount);
+ 	return ioat->desccount;
+ }
+ 
++void ioat_stop(struct ioat_chan_common *chan)
++{
++	struct ioatdma_device *device = chan->device;
++	struct pci_dev *pdev = device->pdev;
++	int chan_id = chan_num(chan);
++
++	/* 1/ stop irq from firing tasklets
++	 * 2/ stop the tasklet from re-arming irqs
++	 */
++	clear_bit(IOAT_RUN, &chan->state);
++
++	/* flush inflight interrupts */
++#ifdef CONFIG_PCI_MSI
++	if (pdev->msix_enabled) {
++		struct msix_entry *msix = &device->msix_entries[chan_id];
++		synchronize_irq(msix->vector);
++	} else
++#endif
++		synchronize_irq(pdev->irq);
++
++	/* flush inflight timers */
++	del_timer_sync(&chan->timer);
++
++	/* flush inflight tasklet runs */
++	tasklet_kill(&chan->cleanup_task);
++
++	/* final cleanup now that everything is quiesced and can't re-arm */
++	device->cleanup_fn((unsigned long) &chan->common);
++}
++
+ /**
+  * ioat1_dma_free_chan_resources - release all the descriptors
+  * @chan: the channel to be cleaned
+@@ -381,9 +412,7 @@ static void ioat1_dma_free_chan_resources(struct dma_chan *c)
+ 	if (ioat->desccount == 0)
+ 		return;
+ 
+-	tasklet_disable(&chan->cleanup_task);
+-	del_timer_sync(&chan->timer);
+-	ioat1_cleanup(ioat);
++	ioat_stop(chan);
+ 
+ 	/* Delay 100ms after reset to allow internal DMA logic to quiesce
+ 	 * before removing DMA descriptor resources.
+@@ -528,8 +557,11 @@ ioat1_dma_prep_memcpy(struct dma_chan *c, dma_addr_t dma_dest,
+ static void ioat1_cleanup_event(unsigned long data)
+ {
+ 	struct ioat_dma_chan *ioat = to_ioat_chan((void *) data);
++	struct ioat_chan_common *chan = &ioat->base;
+ 
+ 	ioat1_cleanup(ioat);
++	if (!test_bit(IOAT_RUN, &chan->state))
++		return;
+ 	writew(IOAT_CHANCTRL_RUN, ioat->base.reg_base + IOAT_CHANCTRL_OFFSET);
+ }
+ 
+diff --git a/drivers/dma/ioat/dma.h b/drivers/dma/ioat/dma.h
+index 8bebddd..466e0f34c 100644
+--- a/drivers/dma/ioat/dma.h
++++ b/drivers/dma/ioat/dma.h
+@@ -344,6 +344,7 @@ bool ioat_cleanup_preamble(struct ioat_chan_common *chan,
+ 			   dma_addr_t *phys_complete);
+ void ioat_kobject_add(struct ioatdma_device *device, struct kobj_type *type);
+ void ioat_kobject_del(struct ioatdma_device *device);
++void ioat_stop(struct ioat_chan_common *chan);
+ extern const struct sysfs_ops ioat_sysfs_ops;
+ extern struct ioat_sysfs_entry ioat_version_attr;
+ extern struct ioat_sysfs_entry ioat_cap_attr;
+diff --git a/drivers/dma/ioat/dma_v2.c b/drivers/dma/ioat/dma_v2.c
+index cb8864d..e60933e 100644
+--- a/drivers/dma/ioat/dma_v2.c
++++ b/drivers/dma/ioat/dma_v2.c
+@@ -189,8 +189,11 @@ static void ioat2_cleanup(struct ioat2_dma_chan *ioat)
+ void ioat2_cleanup_event(unsigned long data)
+ {
+ 	struct ioat2_dma_chan *ioat = to_ioat2_chan((void *) data);
++	struct ioat_chan_common *chan = &ioat->base;
+ 
+ 	ioat2_cleanup(ioat);
++	if (!test_bit(IOAT_RUN, &chan->state))
++		return;
+ 	writew(IOAT_CHANCTRL_RUN, ioat->base.reg_base + IOAT_CHANCTRL_OFFSET);
+ }
+ 
+@@ -542,10 +545,10 @@ int ioat2_alloc_chan_resources(struct dma_chan *c)
+ 	ioat->issued = 0;
+ 	ioat->tail = 0;
+ 	ioat->alloc_order = order;
++	set_bit(IOAT_RUN, &chan->state);
+ 	spin_unlock_bh(&ioat->prep_lock);
+ 	spin_unlock_bh(&chan->cleanup_lock);
+ 
+-	tasklet_enable(&chan->cleanup_task);
+ 	ioat2_start_null_desc(ioat);
+ 
+ 	/* check that we got off the ground */
+@@ -555,7 +558,6 @@ int ioat2_alloc_chan_resources(struct dma_chan *c)
+ 	} while (i++ < 20 && !is_ioat_active(status) && !is_ioat_idle(status));
+ 
+ 	if (is_ioat_active(status) || is_ioat_idle(status)) {
+-		set_bit(IOAT_RUN, &chan->state);
+ 		return 1 << ioat->alloc_order;
+ 	} else {
+ 		u32 chanerr = readl(chan->reg_base + IOAT_CHANERR_OFFSET);
+@@ -798,11 +800,8 @@ void ioat2_free_chan_resources(struct dma_chan *c)
+ 	if (!ioat->ring)
+ 		return;
+ 
+-	tasklet_disable(&chan->cleanup_task);
+-	del_timer_sync(&chan->timer);
+-	device->cleanup_fn((unsigned long) c);
++	ioat_stop(chan);
+ 	device->reset_hw(chan);
+-	clear_bit(IOAT_RUN, &chan->state);
+ 
+ 	spin_lock_bh(&chan->cleanup_lock);
+ 	spin_lock_bh(&ioat->prep_lock);
+diff --git a/drivers/dma/ioat/dma_v3.c b/drivers/dma/ioat/dma_v3.c
+index 714560f..8680031 100644
+--- a/drivers/dma/ioat/dma_v3.c
++++ b/drivers/dma/ioat/dma_v3.c
+@@ -325,8 +325,11 @@ static void ioat3_cleanup(struct ioat2_dma_chan *ioat)
+ static void ioat3_cleanup_event(unsigned long data)
+ {
+ 	struct ioat2_dma_chan *ioat = to_ioat2_chan((void *) data);
++	struct ioat_chan_common *chan = &ioat->base;
+ 
+ 	ioat3_cleanup(ioat);
++	if (!test_bit(IOAT_RUN, &chan->state))
++		return;
+ 	writew(IOAT_CHANCTRL_RUN, ioat->base.reg_base + IOAT_CHANCTRL_OFFSET);
+ }
+ 
+diff --git a/drivers/dma/ste_dma40.c b/drivers/dma/ste_dma40.c
+index 13259ca..4b27c54 100644
+--- a/drivers/dma/ste_dma40.c
++++ b/drivers/dma/ste_dma40.c
+@@ -1202,6 +1202,7 @@ static void dma_tasklet(unsigned long data)
+ 	struct d40_chan *d40c = (struct d40_chan *) data;
+ 	struct d40_desc *d40d;
+ 	unsigned long flags;
++	bool callback_active;
+ 	dma_async_tx_callback callback;
+ 	void *callback_param;
+ 
+@@ -1225,6 +1226,7 @@ static void dma_tasklet(unsigned long data)
+ 	}
+ 
+ 	/* Callback to client */
++	callback_active = !!(d40d->txd.flags & DMA_PREP_INTERRUPT);
+ 	callback = d40d->txd.callback;
+ 	callback_param = d40d->txd.callback_param;
+ 
+@@ -1249,7 +1251,7 @@ static void dma_tasklet(unsigned long data)
+ 
+ 	spin_unlock_irqrestore(&d40c->lock, flags);
+ 
+-	if (callback && (d40d->txd.flags & DMA_PREP_INTERRUPT))
++	if (callback_active && callback)
+ 		callback(callback_param);
+ 
+ 	return;
+diff --git a/drivers/edac/edac_mc.c b/drivers/edac/edac_mc.c
+index d69144a..7db101b 100644
+--- a/drivers/edac/edac_mc.c
++++ b/drivers/edac/edac_mc.c
+@@ -323,7 +323,8 @@ static void edac_mc_workq_function(struct work_struct *work_req)
+  *
+  *		called with the mem_ctls_mutex held
+  */
+-static void edac_mc_workq_setup(struct mem_ctl_info *mci, unsigned msec)
++static void edac_mc_workq_setup(struct mem_ctl_info *mci, unsigned msec,
++				bool init)
+ {
+ 	debugf0("%s()\n", __func__);
+ 
+@@ -331,7 +332,9 @@ static void edac_mc_workq_setup(struct mem_ctl_info *mci, unsigned msec)
+ 	if (mci->op_state != OP_RUNNING_POLL)
+ 		return;
+ 
+-	INIT_DELAYED_WORK(&mci->work, edac_mc_workq_function);
++	if (init)
++		INIT_DELAYED_WORK(&mci->work, edac_mc_workq_function);
++
+ 	queue_delayed_work(edac_workqueue, &mci->work, msecs_to_jiffies(msec));
+ }
+ 
+@@ -391,7 +394,7 @@ void edac_mc_reset_delay_period(int value)
+ 	list_for_each(item, &mc_devices) {
+ 		mci = list_entry(item, struct mem_ctl_info, link);
+ 
+-		edac_mc_workq_setup(mci, (unsigned long) value);
++		edac_mc_workq_setup(mci, value, false);
+ 	}
+ 
+ 	mutex_unlock(&mem_ctls_mutex);
+@@ -539,7 +542,7 @@ int edac_mc_add_mc(struct mem_ctl_info *mci)
+ 		/* This instance is NOW RUNNING */
+ 		mci->op_state = OP_RUNNING_POLL;
+ 
+-		edac_mc_workq_setup(mci, edac_mc_get_poll_msec());
++		edac_mc_workq_setup(mci, edac_mc_get_poll_msec(), true);
+ 	} else {
+ 		mci->op_state = OP_RUNNING_INTERRUPT;
+ 	}
+diff --git a/drivers/edac/i7300_edac.c b/drivers/edac/i7300_edac.c
+index 2244df0..1e08426 100644
+--- a/drivers/edac/i7300_edac.c
++++ b/drivers/edac/i7300_edac.c
+@@ -962,33 +962,35 @@ static int __devinit i7300_get_devices(struct mem_ctl_info *mci)
+ 
+ 	/* Attempt to 'get' the MCH register we want */
+ 	pdev = NULL;
+-	while (!pvt->pci_dev_16_1_fsb_addr_map ||
+-	       !pvt->pci_dev_16_2_fsb_err_regs) {
+-		pdev = pci_get_device(PCI_VENDOR_ID_INTEL,
+-				      PCI_DEVICE_ID_INTEL_I7300_MCH_ERR, pdev);
+-		if (!pdev) {
+-			/* End of list, leave */
+-			i7300_printk(KERN_ERR,
+-				"'system address,Process Bus' "
+-				"device not found:"
+-				"vendor 0x%x device 0x%x ERR funcs "
+-				"(broken BIOS?)\n",
+-				PCI_VENDOR_ID_INTEL,
+-				PCI_DEVICE_ID_INTEL_I7300_MCH_ERR);
+-			goto error;
+-		}
+-
++	while ((pdev = pci_get_device(PCI_VENDOR_ID_INTEL,
++				      PCI_DEVICE_ID_INTEL_I7300_MCH_ERR,
++				      pdev))) {
+ 		/* Store device 16 funcs 1 and 2 */
+ 		switch (PCI_FUNC(pdev->devfn)) {
+ 		case 1:
+-			pvt->pci_dev_16_1_fsb_addr_map = pdev;
++			if (!pvt->pci_dev_16_1_fsb_addr_map)
++				pvt->pci_dev_16_1_fsb_addr_map =
++							pci_dev_get(pdev);
+ 			break;
+ 		case 2:
+-			pvt->pci_dev_16_2_fsb_err_regs = pdev;
++			if (!pvt->pci_dev_16_2_fsb_err_regs)
++				pvt->pci_dev_16_2_fsb_err_regs =
++							pci_dev_get(pdev);
+ 			break;
+ 		}
+ 	}
+ 
++	if (!pvt->pci_dev_16_1_fsb_addr_map ||
++	    !pvt->pci_dev_16_2_fsb_err_regs) {
++		/* At least one device was not found */
++		i7300_printk(KERN_ERR,
++			"'system address,Process Bus' device not found:"
++			"vendor 0x%x device 0x%x ERR funcs (broken BIOS?)\n",
++			PCI_VENDOR_ID_INTEL,
++			PCI_DEVICE_ID_INTEL_I7300_MCH_ERR);
++		goto error;
++	}
++
+ 	debugf1("System Address, processor bus- PCI Bus ID: %s  %x:%x\n",
+ 		pci_name(pvt->pci_dev_16_0_fsb_ctlr),
+ 		pvt->pci_dev_16_0_fsb_ctlr->vendor,
+diff --git a/drivers/edac/i7core_edac.c b/drivers/edac/i7core_edac.c
+index b3ccefa..4c18b3c 100644
+--- a/drivers/edac/i7core_edac.c
++++ b/drivers/edac/i7core_edac.c
+@@ -1365,14 +1365,19 @@ static int i7core_get_onedevice(struct pci_dev **prev,
+ 	 * is at addr 8086:2c40, instead of 8086:2c41. So, we need
+ 	 * to probe for the alternate address in case of failure
+ 	 */
+-	if (dev_descr->dev_id == PCI_DEVICE_ID_INTEL_I7_NONCORE && !pdev)
++	if (dev_descr->dev_id == PCI_DEVICE_ID_INTEL_I7_NONCORE && !pdev) {
++		pci_dev_get(*prev);	/* pci_get_device will put it */
+ 		pdev = pci_get_device(PCI_VENDOR_ID_INTEL,
+ 				      PCI_DEVICE_ID_INTEL_I7_NONCORE_ALT, *prev);
++	}
+ 
+-	if (dev_descr->dev_id == PCI_DEVICE_ID_INTEL_LYNNFIELD_NONCORE && !pdev)
++	if (dev_descr->dev_id == PCI_DEVICE_ID_INTEL_LYNNFIELD_NONCORE &&
++	    !pdev) {
++		pci_dev_get(*prev);	/* pci_get_device will put it */
+ 		pdev = pci_get_device(PCI_VENDOR_ID_INTEL,
+ 				      PCI_DEVICE_ID_INTEL_LYNNFIELD_NONCORE_ALT,
+ 				      *prev);
++	}
+ 
+ 	if (!pdev) {
+ 		if (*prev) {
+diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
+index 61b708b..2ea8a96 100644
+--- a/drivers/gpu/drm/i915/intel_display.c
++++ b/drivers/gpu/drm/i915/intel_display.c
+@@ -7252,6 +7252,20 @@ static int intel_gen7_queue_flip(struct drm_device *dev,
+ 		goto err_unpin;
+ 	}
+ 
++	/*
++	 * BSpec MI_DISPLAY_FLIP for IVB:
++	 * "The full packet must be contained within the same cache line."
++	 *
++	 * Currently the LRI+SRM+MI_DISPLAY_FLIP all fit within the same
++	 * cacheline, if we ever start emitting more commands before
++	 * the MI_DISPLAY_FLIP we may need to first emit everything else,
++	 * then do the cacheline alignment, and finally emit the
++	 * MI_DISPLAY_FLIP.
++	 */
++	ret = intel_ring_cacheline_align(ring);
++	if (ret)
++		goto err_unpin;
++
+ 	ret = intel_ring_begin(ring, 4);
+ 	if (ret)
+ 		goto err_unpin;
+diff --git a/drivers/gpu/drm/i915/intel_dp.c b/drivers/gpu/drm/i915/intel_dp.c
+index 72163e8..ca75076 100644
+--- a/drivers/gpu/drm/i915/intel_dp.c
++++ b/drivers/gpu/drm/i915/intel_dp.c
+@@ -483,6 +483,7 @@ intel_dp_aux_native_write(struct intel_dp *intel_dp,
+ 	uint8_t	msg[20];
+ 	int msg_bytes;
+ 	uint8_t	ack;
++	int retry;
+ 
+ 	intel_dp_check_edp(intel_dp);
+ 	if (send_bytes > 16)
+@@ -493,18 +494,20 @@ intel_dp_aux_native_write(struct intel_dp *intel_dp,
+ 	msg[3] = send_bytes - 1;
+ 	memcpy(&msg[4], send, send_bytes);
+ 	msg_bytes = send_bytes + 4;
+-	for (;;) {
++	for (retry = 0; retry < 7; retry++) {
+ 		ret = intel_dp_aux_ch(intel_dp, msg, msg_bytes, &ack, 1);
+ 		if (ret < 0)
+ 			return ret;
+ 		if ((ack & AUX_NATIVE_REPLY_MASK) == AUX_NATIVE_REPLY_ACK)
+-			break;
++			return send_bytes;
+ 		else if ((ack & AUX_NATIVE_REPLY_MASK) == AUX_NATIVE_REPLY_DEFER)
+-			udelay(100);
++			usleep_range(400, 500);
+ 		else
+ 			return -EIO;
+ 	}
+-	return send_bytes;
++
++	DRM_ERROR("too many retries, giving up\n");
++	return -EIO;
+ }
+ 
+ /* Write a single byte to the aux channel in native mode */
+@@ -526,6 +529,7 @@ intel_dp_aux_native_read(struct intel_dp *intel_dp,
+ 	int reply_bytes;
+ 	uint8_t ack;
+ 	int ret;
++	int retry;
+ 
+ 	intel_dp_check_edp(intel_dp);
+ 	msg[0] = AUX_NATIVE_READ << 4;
+@@ -536,7 +540,7 @@ intel_dp_aux_native_read(struct intel_dp *intel_dp,
+ 	msg_bytes = 4;
+ 	reply_bytes = recv_bytes + 1;
+ 
+-	for (;;) {
++	for (retry = 0; retry < 7; retry++) {
+ 		ret = intel_dp_aux_ch(intel_dp, msg, msg_bytes,
+ 				      reply, reply_bytes);
+ 		if (ret == 0)
+@@ -549,10 +553,13 @@ intel_dp_aux_native_read(struct intel_dp *intel_dp,
+ 			return ret - 1;
+ 		}
+ 		else if ((ack & AUX_NATIVE_REPLY_MASK) == AUX_NATIVE_REPLY_DEFER)
+-			udelay(100);
++			usleep_range(400, 500);
+ 		else
+ 			return -EIO;
+ 	}
++
++	DRM_ERROR("too many retries, giving up\n");
++	return -EIO;
+ }
+ 
+ static int
+diff --git a/drivers/gpu/drm/i915/intel_ringbuffer.c b/drivers/gpu/drm/i915/intel_ringbuffer.c
+index 3c55cf6..8ee068e 100644
+--- a/drivers/gpu/drm/i915/intel_ringbuffer.c
++++ b/drivers/gpu/drm/i915/intel_ringbuffer.c
+@@ -1213,6 +1213,27 @@ int intel_ring_begin(struct intel_ring_buffer *ring,
+ 	return 0;
+ }
+ 
++/* Align the ring tail to a cacheline boundary */
++int intel_ring_cacheline_align(struct intel_ring_buffer *ring)
++{
++	int num_dwords = (64 - (ring->tail & 63)) / sizeof(uint32_t);
++	int ret;
++
++	if (num_dwords == 0)
++		return 0;
++
++	ret = intel_ring_begin(ring, num_dwords);
++	if (ret)
++		return ret;
++
++	while (num_dwords--)
++		intel_ring_emit(ring, MI_NOOP);
++
++	intel_ring_advance(ring);
++
++	return 0;
++}
++
+ void intel_ring_advance(struct intel_ring_buffer *ring)
+ {
+ 	ring->tail &= ring->size - 1;
+diff --git a/drivers/gpu/drm/i915/intel_ringbuffer.h b/drivers/gpu/drm/i915/intel_ringbuffer.h
+index 68281c9..d83cc97 100644
+--- a/drivers/gpu/drm/i915/intel_ringbuffer.h
++++ b/drivers/gpu/drm/i915/intel_ringbuffer.h
+@@ -174,6 +174,7 @@ static inline int intel_wait_ring_idle(struct intel_ring_buffer *ring)
+ }
+ 
+ int __must_check intel_ring_begin(struct intel_ring_buffer *ring, int n);
++int __must_check intel_ring_cacheline_align(struct intel_ring_buffer *ring);
+ 
+ static inline void intel_ring_emit(struct intel_ring_buffer *ring,
+ 				   u32 data)
+diff --git a/drivers/gpu/drm/radeon/atombios_crtc.c b/drivers/gpu/drm/radeon/atombios_crtc.c
+index 038570a..cd98c06 100644
+--- a/drivers/gpu/drm/radeon/atombios_crtc.c
++++ b/drivers/gpu/drm/radeon/atombios_crtc.c
+@@ -956,10 +956,13 @@ static void atombios_crtc_set_pll(struct drm_crtc *crtc, struct drm_display_mode
+ 						ss_enabled =
+ 							radeon_atombios_get_ppll_ss_info(rdev, &ss,
+ 											 ATOM_DP_SS_ID1);
+-				} else
++				} else {
+ 					ss_enabled =
+ 						radeon_atombios_get_ppll_ss_info(rdev, &ss,
+ 										 ATOM_DP_SS_ID1);
++				}
++				/* disable spread spectrum on DCE3 DP */
++				ss_enabled = false;
+ 			}
+ 			break;
+ 		case ATOM_ENCODER_MODE_LVDS:
+diff --git a/drivers/gpu/drm/radeon/r600.c b/drivers/gpu/drm/radeon/r600.c
+index 57e45c6..f7e3cc0 100644
+--- a/drivers/gpu/drm/radeon/r600.c
++++ b/drivers/gpu/drm/radeon/r600.c
+@@ -2315,14 +2315,18 @@ int r600_ring_test(struct radeon_device *rdev)
+ void r600_fence_ring_emit(struct radeon_device *rdev,
+ 			  struct radeon_fence *fence)
+ {
++	u32 cp_coher_cntl = PACKET3_TC_ACTION_ENA | PACKET3_VC_ACTION_ENA |
++		PACKET3_SH_ACTION_ENA;
++
++	if (rdev->family >= CHIP_RV770)
++		cp_coher_cntl |= PACKET3_FULL_CACHE_ENA;
++
+ 	if (rdev->wb.use_event) {
+ 		u64 addr = rdev->wb.gpu_addr + R600_WB_EVENT_OFFSET +
+ 			(u64)(rdev->fence_drv.scratch_reg - rdev->scratch.reg_base);
+ 		/* flush read cache over gart */
+ 		radeon_ring_write(rdev, PACKET3(PACKET3_SURFACE_SYNC, 3));
+-		radeon_ring_write(rdev, PACKET3_TC_ACTION_ENA |
+-					PACKET3_VC_ACTION_ENA |
+-					PACKET3_SH_ACTION_ENA);
++		radeon_ring_write(rdev, cp_coher_cntl);
+ 		radeon_ring_write(rdev, 0xFFFFFFFF);
+ 		radeon_ring_write(rdev, 0);
+ 		radeon_ring_write(rdev, 10); /* poll interval */
+@@ -2336,9 +2340,7 @@ void r600_fence_ring_emit(struct radeon_device *rdev,
+ 	} else {
+ 		/* flush read cache over gart */
+ 		radeon_ring_write(rdev, PACKET3(PACKET3_SURFACE_SYNC, 3));
+-		radeon_ring_write(rdev, PACKET3_TC_ACTION_ENA |
+-					PACKET3_VC_ACTION_ENA |
+-					PACKET3_SH_ACTION_ENA);
++		radeon_ring_write(rdev, cp_coher_cntl);
+ 		radeon_ring_write(rdev, 0xFFFFFFFF);
+ 		radeon_ring_write(rdev, 0);
+ 		radeon_ring_write(rdev, 10); /* poll interval */
+diff --git a/drivers/gpu/drm/radeon/r600d.h b/drivers/gpu/drm/radeon/r600d.h
+index d4d23a8d..cb29480 100644
+--- a/drivers/gpu/drm/radeon/r600d.h
++++ b/drivers/gpu/drm/radeon/r600d.h
+@@ -838,6 +838,7 @@
+ #define	PACKET3_INDIRECT_BUFFER				0x32
+ #define	PACKET3_SURFACE_SYNC				0x43
+ #              define PACKET3_CB0_DEST_BASE_ENA    (1 << 6)
++#              define PACKET3_FULL_CACHE_ENA       (1 << 20) /* r7xx+ only */
+ #              define PACKET3_TC_ACTION_ENA        (1 << 23)
+ #              define PACKET3_VC_ACTION_ENA        (1 << 24)
+ #              define PACKET3_CB_ACTION_ENA        (1 << 25)
+diff --git a/drivers/gpu/drm/radeon/radeon_atombios.c b/drivers/gpu/drm/radeon/radeon_atombios.c
+index cda89c6b..e4e455e 100644
+--- a/drivers/gpu/drm/radeon/radeon_atombios.c
++++ b/drivers/gpu/drm/radeon/radeon_atombios.c
+@@ -2735,6 +2735,10 @@ void radeon_atom_initialize_bios_scratch_regs(struct drm_device *dev)
+ 	/* tell the bios not to handle mode switching */
+ 	bios_6_scratch |= ATOM_S6_ACC_BLOCK_DISPLAY_SWITCH;
+ 
++	/* clear the vbios dpms state */
++	if (ASIC_IS_DCE4(rdev))
++		bios_2_scratch &= ~ATOM_S2_DEVICE_DPMS_STATE;
++
+ 	if (rdev->family >= CHIP_R600) {
+ 		WREG32(R600_BIOS_2_SCRATCH, bios_2_scratch);
+ 		WREG32(R600_BIOS_6_SCRATCH, bios_6_scratch);
+diff --git a/drivers/gpu/drm/radeon/radeon_i2c.c b/drivers/gpu/drm/radeon/radeon_i2c.c
+index cf20351..894b5f0 100644
+--- a/drivers/gpu/drm/radeon/radeon_i2c.c
++++ b/drivers/gpu/drm/radeon/radeon_i2c.c
+@@ -998,6 +998,9 @@ void radeon_i2c_destroy(struct radeon_i2c_chan *i2c)
+ /* Add the default buses */
+ void radeon_i2c_init(struct radeon_device *rdev)
+ {
++	if (radeon_hw_i2c)
++		DRM_INFO("hw_i2c forced on, you may experience display detection problems!\n");
++
+ 	if (rdev->is_atom_bios)
+ 		radeon_atombios_i2c_init(rdev);
+ 	else
+diff --git a/drivers/gpu/drm/radeon/radeon_pm.c b/drivers/gpu/drm/radeon/radeon_pm.c
+index d58eccb..b0a0ee4 100644
+--- a/drivers/gpu/drm/radeon/radeon_pm.c
++++ b/drivers/gpu/drm/radeon/radeon_pm.c
+@@ -573,8 +573,10 @@ void radeon_pm_resume(struct radeon_device *rdev)
+ 	rdev->pm.current_clock_mode_index = 0;
+ 	rdev->pm.current_sclk = rdev->pm.default_sclk;
+ 	rdev->pm.current_mclk = rdev->pm.default_mclk;
+-	rdev->pm.current_vddc = rdev->pm.power_state[rdev->pm.default_power_state_index].clock_info[0].voltage.voltage;
+-	rdev->pm.current_vddci = rdev->pm.power_state[rdev->pm.default_power_state_index].clock_info[0].voltage.vddci;
++	if (rdev->pm.power_state) {
++		rdev->pm.current_vddc = rdev->pm.power_state[rdev->pm.default_power_state_index].clock_info[0].voltage.voltage;
++		rdev->pm.current_vddci = rdev->pm.power_state[rdev->pm.default_power_state_index].clock_info[0].voltage.vddci;
++	}
+ 	if (rdev->pm.pm_method == PM_METHOD_DYNPM
+ 	    && rdev->pm.dynpm_state == DYNPM_STATE_SUSPENDED) {
+ 		rdev->pm.dynpm_state = DYNPM_STATE_ACTIVE;
+diff --git a/drivers/hv/connection.c b/drivers/hv/connection.c
+index 650c9f0..d7f3df9 100644
+--- a/drivers/hv/connection.c
++++ b/drivers/hv/connection.c
+@@ -45,7 +45,6 @@ struct vmbus_connection vmbus_connection = {
+ int vmbus_connect(void)
+ {
+ 	int ret = 0;
+-	int t;
+ 	struct vmbus_channel_msginfo *msginfo = NULL;
+ 	struct vmbus_channel_initiate_contact *msg;
+ 	unsigned long flags;
+@@ -132,16 +131,7 @@ int vmbus_connect(void)
+ 	}
+ 
+ 	/* Wait for the connection response */
+-	t =  wait_for_completion_timeout(&msginfo->waitevent, 5*HZ);
+-	if (t == 0) {
+-		spin_lock_irqsave(&vmbus_connection.channelmsg_lock,
+-				flags);
+-		list_del(&msginfo->msglistentry);
+-		spin_unlock_irqrestore(&vmbus_connection.channelmsg_lock,
+-					flags);
+-		ret = -ETIMEDOUT;
+-		goto cleanup;
+-	}
++	wait_for_completion(&msginfo->waitevent);
+ 
+ 	spin_lock_irqsave(&vmbus_connection.channelmsg_lock, flags);
+ 	list_del(&msginfo->msglistentry);
+diff --git a/drivers/hwmon/max1668.c b/drivers/hwmon/max1668.c
+index 20d1b2d..e19fef7 100644
+--- a/drivers/hwmon/max1668.c
++++ b/drivers/hwmon/max1668.c
+@@ -243,7 +243,7 @@ static ssize_t set_temp_min(struct device *dev,
+ 	data->temp_min[index] = SENSORS_LIMIT(temp/1000, -128, 127);
+ 	if (i2c_smbus_write_byte_data(client,
+ 					MAX1668_REG_LIML_WR(index),
+-					data->temp_max[index]))
++					data->temp_min[index]))
+ 		count = -EIO;
+ 	mutex_unlock(&data->update_lock);
+ 
+diff --git a/drivers/i2c/busses/Kconfig b/drivers/i2c/busses/Kconfig
+index dbd4fa5..949ea640 100644
+--- a/drivers/i2c/busses/Kconfig
++++ b/drivers/i2c/busses/Kconfig
+@@ -137,6 +137,7 @@ config I2C_PIIX4
+ 	    ATI SB700
+ 	    ATI SB800
+ 	    AMD Hudson-2
++	    AMD ML
+ 	    AMD CZ
+ 	    Serverworks OSB4
+ 	    Serverworks CSB5
+diff --git a/drivers/i2c/busses/i2c-piix4.c b/drivers/i2c/busses/i2c-piix4.c
+index 14b588c..c60f8e1 100644
+--- a/drivers/i2c/busses/i2c-piix4.c
++++ b/drivers/i2c/busses/i2c-piix4.c
+@@ -22,7 +22,7 @@
+ 	Intel PIIX4, 440MX
+ 	Serverworks OSB4, CSB5, CSB6, HT-1000, HT-1100
+ 	ATI IXP200, IXP300, IXP400, SB600, SB700, SB800
+-	AMD Hudson-2, CZ
++	AMD Hudson-2, ML, CZ
+ 	SMSC Victory66
+ 
+    Note: we assume there can only be one device, with one SMBus interface.
+@@ -231,7 +231,8 @@ static int __devinit piix4_setup_sb800(struct pci_dev *PIIX4_dev,
+ 				const struct pci_device_id *id)
+ {
+ 	unsigned short smba_idx = 0xcd6;
+-	u8 smba_en_lo, smba_en_hi, i2ccfg, i2ccfg_offset = 0x10, smb_en = 0x2c;
++	u8 smba_en_lo, smba_en_hi, smb_en, smb_en_status;
++	u8 i2ccfg, i2ccfg_offset = 0x10;
+ 
+ 	/* SB800 and later SMBus does not support forcing address */
+ 	if (force || force_addr) {
+@@ -241,6 +242,16 @@ static int __devinit piix4_setup_sb800(struct pci_dev *PIIX4_dev,
+ 	}
+ 
+ 	/* Determine the address of the SMBus areas */
++	if ((PIIX4_dev->vendor == PCI_VENDOR_ID_AMD &&
++	     PIIX4_dev->device == PCI_DEVICE_ID_AMD_HUDSON2_SMBUS &&
++	     PIIX4_dev->revision >= 0x41) ||
++	    (PIIX4_dev->vendor == PCI_VENDOR_ID_AMD &&
++	     PIIX4_dev->device == 0x790b &&
++	     PIIX4_dev->revision >= 0x49))
++		smb_en = 0x00;
++	else
++		smb_en = 0x2c;
++
+ 	if (!request_region(smba_idx, 2, "smba_idx")) {
+ 		dev_err(&PIIX4_dev->dev, "SMBus base address index region "
+ 			"0x%x already in use!\n", smba_idx);
+@@ -252,13 +263,20 @@ static int __devinit piix4_setup_sb800(struct pci_dev *PIIX4_dev,
+ 	smba_en_hi = inb_p(smba_idx + 1);
+ 	release_region(smba_idx, 2);
+ 
+-	if ((smba_en_lo & 1) == 0) {
++	if (!smb_en) {
++		smb_en_status = smba_en_lo & 0x10;
++		piix4_smba = smba_en_hi << 8;
++	} else {
++		smb_en_status = smba_en_lo & 0x01;
++		piix4_smba = ((smba_en_hi << 8) | smba_en_lo) & 0xffe0;
++	}
++
++	if (!smb_en_status) {
+ 		dev_err(&PIIX4_dev->dev,
+ 			"Host SMBus controller not enabled!\n");
+ 		return -ENODEV;
+ 	}
+ 
+-	piix4_smba = ((smba_en_hi << 8) | smba_en_lo) & 0xffe0;
+ 	if (acpi_check_region(piix4_smba, SMBIOSIZE, piix4_driver.name))
+ 		return -ENODEV;
+ 
+diff --git a/drivers/idle/intel_idle.c b/drivers/idle/intel_idle.c
+index 4fa2b11..44fde43 100644
+--- a/drivers/idle/intel_idle.c
++++ b/drivers/idle/intel_idle.c
+@@ -584,8 +584,9 @@ static int __init intel_idle_init(void)
+ 	intel_idle_cpuidle_driver_init();
+ 	retval = cpuidle_register_driver(&intel_idle_driver);
+ 	if (retval) {
++		struct cpuidle_driver *drv = cpuidle_get_driver();
+ 		printk(KERN_DEBUG PREFIX "intel_idle yielding to %s",
+-			cpuidle_get_driver()->name);
++			drv ? drv->name : "none");
+ 		return retval;
+ 	}
+ 
+diff --git a/drivers/infiniband/hw/qib/qib_iba7322.c b/drivers/infiniband/hw/qib/qib_iba7322.c
+index 5a070e8..d8517fc 100644
+--- a/drivers/infiniband/hw/qib/qib_iba7322.c
++++ b/drivers/infiniband/hw/qib/qib_iba7322.c
+@@ -2279,6 +2279,11 @@ static int qib_7322_bringup_serdes(struct qib_pportdata *ppd)
+ 	qib_write_kreg_port(ppd, krp_ibcctrl_a, ppd->cpspec->ibcctrl_a);
+ 	qib_write_kreg(dd, kr_scratch, 0ULL);
+ 
++	/* ensure previous Tx parameters are not still forced */
++	qib_write_kreg_port(ppd, krp_tx_deemph_override,
++		SYM_MASK(IBSD_TX_DEEMPHASIS_OVERRIDE_0,
++		reset_tx_deemphasis_override));
++
+ 	if (qib_compat_ddr_negotiate) {
+ 		ppd->cpspec->ibdeltainprog = 1;
+ 		ppd->cpspec->ibsymsnap = read_7322_creg32_port(ppd,
+diff --git a/drivers/infiniband/hw/qib/qib_ud.c b/drivers/infiniband/hw/qib/qib_ud.c
+index 828609f..c0d93d4 100644
+--- a/drivers/infiniband/hw/qib/qib_ud.c
++++ b/drivers/infiniband/hw/qib/qib_ud.c
+@@ -57,13 +57,20 @@ static void qib_ud_loopback(struct qib_qp *sqp, struct qib_swqe *swqe)
+ 	struct qib_sge *sge;
+ 	struct ib_wc wc;
+ 	u32 length;
++	enum ib_qp_type sqptype, dqptype;
+ 
+ 	qp = qib_lookup_qpn(ibp, swqe->wr.wr.ud.remote_qpn);
+ 	if (!qp) {
+ 		ibp->n_pkt_drops++;
+ 		return;
+ 	}
+-	if (qp->ibqp.qp_type != sqp->ibqp.qp_type ||
++
++	sqptype = sqp->ibqp.qp_type == IB_QPT_GSI ?
++			IB_QPT_UD : sqp->ibqp.qp_type;
++	dqptype = qp->ibqp.qp_type == IB_QPT_GSI ?
++			IB_QPT_UD : qp->ibqp.qp_type;
++
++	if (dqptype != sqptype ||
+ 	    !(ib_qib_state_ops[qp->state] & QIB_PROCESS_RECV_OK)) {
+ 		ibp->n_pkt_drops++;
+ 		goto drop;
+diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c
+index b4a4aaf..1a51b3d 100644
+--- a/drivers/iommu/intel-iommu.c
++++ b/drivers/iommu/intel-iommu.c
+@@ -884,7 +884,7 @@ static void dma_pte_free_level(struct dmar_domain *domain, int level,
+ 
+ 		/* If range covers entire pagetable, free it */
+ 		if (!(start_pfn > level_pfn ||
+-		      last_pfn < level_pfn + level_size(level))) {
++		      last_pfn < level_pfn + level_size(level) - 1)) {
+ 			dma_clear_pte(pte);
+ 			domain_flush_cache(domain, pte, sizeof(*pte));
+ 			free_pgtable_page(level_pte);
+diff --git a/drivers/md/Kconfig b/drivers/md/Kconfig
+index faa4741..e10b6bb 100644
+--- a/drivers/md/Kconfig
++++ b/drivers/md/Kconfig
+@@ -185,8 +185,12 @@ config MD_FAULTY
+ 
+ 	  In unsure, say N.
+ 
++config BLK_DEV_DM_BUILTIN
++	boolean
++
+ config BLK_DEV_DM
+ 	tristate "Device mapper support"
++	select BLK_DEV_DM_BUILTIN
+ 	---help---
+ 	  Device-mapper is a low level volume manager.  It works by allowing
+ 	  people to specify mappings for ranges of logical sectors.  Various
+diff --git a/drivers/md/Makefile b/drivers/md/Makefile
+index 046860c..f67dec3 100644
+--- a/drivers/md/Makefile
++++ b/drivers/md/Makefile
+@@ -28,6 +28,7 @@ obj-$(CONFIG_MD_MULTIPATH)	+= multipath.o
+ obj-$(CONFIG_MD_FAULTY)		+= faulty.o
+ obj-$(CONFIG_BLK_DEV_MD)	+= md-mod.o
+ obj-$(CONFIG_BLK_DEV_DM)	+= dm-mod.o
++obj-$(CONFIG_BLK_DEV_DM_BUILTIN) += dm-builtin.o
+ obj-$(CONFIG_DM_BUFIO)		+= dm-bufio.o
+ obj-$(CONFIG_DM_CRYPT)		+= dm-crypt.o
+ obj-$(CONFIG_DM_DELAY)		+= dm-delay.o
+diff --git a/drivers/md/dm-builtin.c b/drivers/md/dm-builtin.c
+new file mode 100644
+index 0000000..8b82788
+--- /dev/null
++++ b/drivers/md/dm-builtin.c
+@@ -0,0 +1,49 @@
++#include <linux/export.h>
++#include "dm.h"
++
++/*
++ * The kobject release method must not be placed in the module itself,
++ * otherwise we are subject to module unload races.
++ *
++ * The release method is called when the last reference to the kobject is
++ * dropped. It may be called by any other kernel code that drops the last
++ * reference.
++ *
++ * The release method suffers from module unload race. We may prevent the
++ * module from being unloaded at the start of the release method (using
++ * increased module reference count or synchronizing against the release
++ * method), however there is no way to prevent the module from being
++ * unloaded at the end of the release method.
++ *
++ * If this code were placed in the dm module, the following race may
++ * happen:
++ *  1. Some other process takes a reference to dm kobject
++ *  2. The user issues ioctl function to unload the dm device
++ *  3. dm_sysfs_exit calls kobject_put, however the object is not released
++ *     because of the other reference taken at step 1
++ *  4. dm_sysfs_exit waits on the completion
++ *  5. The other process that took the reference in step 1 drops it,
++ *     dm_kobject_release is called from this process
++ *  6. dm_kobject_release calls complete()
++ *  7. a reschedule happens before dm_kobject_release returns
++ *  8. dm_sysfs_exit continues, the dm device is unloaded, module reference
++ *     count is decremented
++ *  9. The user unloads the dm module
++ * 10. The other process that was rescheduled in step 7 continues to run,
++ *     it is now executing code in unloaded module, so it crashes
++ *
++ * Note that if the process that takes the foreign reference to dm kobject
++ * has a low priority and the system is sufficiently loaded with
++ * higher-priority processes that prevent the low-priority process from
++ * being scheduled long enough, this bug may really happen.
++ *
++ * In order to fix this module unload race, we place the release method
++ * into a helper code that is compiled directly into the kernel.
++ */
++
++void dm_kobject_release(struct kobject *kobj)
++{
++	complete(dm_get_completion_from_kobject(kobj));
++}
++
++EXPORT_SYMBOL(dm_kobject_release);
+diff --git a/drivers/md/dm-sysfs.c b/drivers/md/dm-sysfs.c
+index 84d2b91..c62c5ab 100644
+--- a/drivers/md/dm-sysfs.c
++++ b/drivers/md/dm-sysfs.c
+@@ -86,6 +86,7 @@ static const struct sysfs_ops dm_sysfs_ops = {
+ static struct kobj_type dm_ktype = {
+ 	.sysfs_ops	= &dm_sysfs_ops,
+ 	.default_attrs	= dm_attrs,
++	.release	= dm_kobject_release,
+ };
+ 
+ /*
+@@ -104,5 +105,7 @@ int dm_sysfs_init(struct mapped_device *md)
+  */
+ void dm_sysfs_exit(struct mapped_device *md)
+ {
+-	kobject_put(dm_kobject(md));
++	struct kobject *kobj = dm_kobject(md);
++	kobject_put(kobj);
++	wait_for_completion(dm_get_completion_from_kobject(kobj));
+ }
+diff --git a/drivers/md/dm.c b/drivers/md/dm.c
+index 8953630..7ead065 100644
+--- a/drivers/md/dm.c
++++ b/drivers/md/dm.c
+@@ -192,8 +192,8 @@ struct mapped_device {
+ 	/* forced geometry settings */
+ 	struct hd_geometry geometry;
+ 
+-	/* sysfs handle */
+-	struct kobject kobj;
++	/* kobject and completion */
++	struct dm_kobject_holder kobj_holder;
+ 
+ 	/* zero-length flush that will be cloned and submitted to targets */
+ 	struct bio flush_bio;
+@@ -1891,6 +1891,7 @@ static struct mapped_device *alloc_dev(int minor)
+ 	init_waitqueue_head(&md->wait);
+ 	INIT_WORK(&md->work, dm_wq_work);
+ 	init_waitqueue_head(&md->eventq);
++	init_completion(&md->kobj_holder.completion);
+ 
+ 	md->disk->major = _major;
+ 	md->disk->first_minor = minor;
+@@ -2682,7 +2683,7 @@ struct gendisk *dm_disk(struct mapped_device *md)
+ 
+ struct kobject *dm_kobject(struct mapped_device *md)
+ {
+-	return &md->kobj;
++	return &md->kobj_holder.kobj;
+ }
+ 
+ /*
+@@ -2693,9 +2694,7 @@ struct mapped_device *dm_get_from_kobject(struct kobject *kobj)
+ {
+ 	struct mapped_device *md;
+ 
+-	md = container_of(kobj, struct mapped_device, kobj);
+-	if (&md->kobj != kobj)
+-		return NULL;
++	md = container_of(kobj, struct mapped_device, kobj_holder.kobj);
+ 
+ 	if (test_bit(DMF_FREEING, &md->flags) ||
+ 	    dm_deleting_md(md))
+diff --git a/drivers/md/dm.h b/drivers/md/dm.h
+index b7dacd5..9db80c9 100644
+--- a/drivers/md/dm.h
++++ b/drivers/md/dm.h
+@@ -15,6 +15,8 @@
+ #include <linux/list.h>
+ #include <linux/blkdev.h>
+ #include <linux/hdreg.h>
++#include <linux/completion.h>
++#include <linux/kobject.h>
+ 
+ /*
+  * Suspend feature flags
+@@ -119,12 +121,27 @@ void dm_interface_exit(void);
+ /*
+  * sysfs interface
+  */
++struct dm_kobject_holder {
++	struct kobject kobj;
++	struct completion completion;
++};
++
++static inline struct completion *dm_get_completion_from_kobject(struct kobject *kobj)
++{
++	return &container_of(kobj, struct dm_kobject_holder, kobj)->completion;
++}
++
+ int dm_sysfs_init(struct mapped_device *md);
+ void dm_sysfs_exit(struct mapped_device *md);
+ struct kobject *dm_kobject(struct mapped_device *md);
+ struct mapped_device *dm_get_from_kobject(struct kobject *kobj);
+ 
+ /*
++ * The kobject helper
++ */
++void dm_kobject_release(struct kobject *kobj);
++
++/*
+  * Targets for linear and striped mappings
+  */
+ int dm_linear_init(void);
+diff --git a/drivers/md/persistent-data/dm-space-map-common.c b/drivers/md/persistent-data/dm-space-map-common.c
+index df2494c..8c5b824 100644
+--- a/drivers/md/persistent-data/dm-space-map-common.c
++++ b/drivers/md/persistent-data/dm-space-map-common.c
+@@ -244,6 +244,10 @@ int sm_ll_extend(struct ll_disk *ll, dm_block_t extra_blocks)
+ 		return -EINVAL;
+ 	}
+ 
++	/*
++	 * We need to set this before the dm_tm_new_block() call below.
++	 */
++	ll->nr_blocks = nr_blocks;
+ 	for (i = old_blocks; i < blocks; i++) {
+ 		struct dm_block *b;
+ 		struct disk_index_entry idx;
+@@ -251,6 +255,7 @@ int sm_ll_extend(struct ll_disk *ll, dm_block_t extra_blocks)
+ 		r = dm_tm_new_block(ll->tm, &dm_sm_bitmap_validator, &b);
+ 		if (r < 0)
+ 			return r;
++
+ 		idx.blocknr = cpu_to_le64(dm_block_location(b));
+ 
+ 		r = dm_tm_unlock(ll->tm, b);
+@@ -265,7 +270,6 @@ int sm_ll_extend(struct ll_disk *ll, dm_block_t extra_blocks)
+ 			return r;
+ 	}
+ 
+-	ll->nr_blocks = nr_blocks;
+ 	return 0;
+ }
+ 
+diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
+index fb67833..7c963c4 100644
+--- a/drivers/md/raid5.c
++++ b/drivers/md/raid5.c
+@@ -1693,6 +1693,7 @@ static void raid5_end_write_request(struct bio *bi, int error)
+ 	}
+ 
+ 	if (!uptodate) {
++		set_bit(STRIPE_DEGRADED, &sh->state);
+ 		set_bit(WriteErrorSeen, &conf->disks[i].rdev->flags);
+ 		set_bit(R5_WriteError, &sh->dev[i].flags);
+ 	} else if (is_badblock(conf->disks[i].rdev, sh->sector, STRIPE_SECTORS,
+@@ -4449,23 +4450,43 @@ raid5_size(struct mddev *mddev, sector_t sectors, int raid_disks)
+ 	return sectors * (raid_disks - conf->max_degraded);
+ }
+ 
++static void free_scratch_buffer(struct r5conf *conf, struct raid5_percpu *percpu)
++{
++	safe_put_page(percpu->spare_page);
++	kfree(percpu->scribble);
++	percpu->spare_page = NULL;
++	percpu->scribble = NULL;
++}
++
++static int alloc_scratch_buffer(struct r5conf *conf, struct raid5_percpu *percpu)
++{
++	if (conf->level == 6 && !percpu->spare_page)
++		percpu->spare_page = alloc_page(GFP_KERNEL);
++	if (!percpu->scribble)
++		percpu->scribble = kmalloc(conf->scribble_len, GFP_KERNEL);
++
++	if (!percpu->scribble || (conf->level == 6 && !percpu->spare_page)) {
++		free_scratch_buffer(conf, percpu);
++		return -ENOMEM;
++	}
++
++	return 0;
++}
++
+ static void raid5_free_percpu(struct r5conf *conf)
+ {
+-	struct raid5_percpu *percpu;
+ 	unsigned long cpu;
+ 
+ 	if (!conf->percpu)
+ 		return;
+ 
+-	get_online_cpus();
+-	for_each_possible_cpu(cpu) {
+-		percpu = per_cpu_ptr(conf->percpu, cpu);
+-		safe_put_page(percpu->spare_page);
+-		kfree(percpu->scribble);
+-	}
+ #ifdef CONFIG_HOTPLUG_CPU
+ 	unregister_cpu_notifier(&conf->cpu_notify);
+ #endif
++
++	get_online_cpus();
++	for_each_possible_cpu(cpu)
++		free_scratch_buffer(conf, per_cpu_ptr(conf->percpu, cpu));
+ 	put_online_cpus();
+ 
+ 	free_percpu(conf->percpu);
+@@ -4491,15 +4512,7 @@ static int raid456_cpu_notify(struct notifier_block *nfb, unsigned long action,
+ 	switch (action) {
+ 	case CPU_UP_PREPARE:
+ 	case CPU_UP_PREPARE_FROZEN:
+-		if (conf->level == 6 && !percpu->spare_page)
+-			percpu->spare_page = alloc_page(GFP_KERNEL);
+-		if (!percpu->scribble)
+-			percpu->scribble = kmalloc(conf->scribble_len, GFP_KERNEL);
+-
+-		if (!percpu->scribble ||
+-		    (conf->level == 6 && !percpu->spare_page)) {
+-			safe_put_page(percpu->spare_page);
+-			kfree(percpu->scribble);
++		if (alloc_scratch_buffer(conf, percpu)) {
+ 			pr_err("%s: failed memory allocation for cpu%ld\n",
+ 			       __func__, cpu);
+ 			return notifier_from_errno(-ENOMEM);
+@@ -4507,10 +4520,7 @@ static int raid456_cpu_notify(struct notifier_block *nfb, unsigned long action,
+ 		break;
+ 	case CPU_DEAD:
+ 	case CPU_DEAD_FROZEN:
+-		safe_put_page(percpu->spare_page);
+-		kfree(percpu->scribble);
+-		percpu->spare_page = NULL;
+-		percpu->scribble = NULL;
++		free_scratch_buffer(conf, per_cpu_ptr(conf->percpu, cpu));
+ 		break;
+ 	default:
+ 		break;
+@@ -4522,40 +4532,29 @@ static int raid456_cpu_notify(struct notifier_block *nfb, unsigned long action,
+ static int raid5_alloc_percpu(struct r5conf *conf)
+ {
+ 	unsigned long cpu;
+-	struct page *spare_page;
+-	struct raid5_percpu __percpu *allcpus;
+-	void *scribble;
+-	int err;
++	int err = 0;
+ 
+-	allcpus = alloc_percpu(struct raid5_percpu);
+-	if (!allcpus)
++	conf->percpu = alloc_percpu(struct raid5_percpu);
++	if (!conf->percpu)
+ 		return -ENOMEM;
+-	conf->percpu = allcpus;
++
++#ifdef CONFIG_HOTPLUG_CPU
++	conf->cpu_notify.notifier_call = raid456_cpu_notify;
++	conf->cpu_notify.priority = 0;
++	err = register_cpu_notifier(&conf->cpu_notify);
++	if (err)
++		return err;
++#endif
+ 
+ 	get_online_cpus();
+-	err = 0;
+ 	for_each_present_cpu(cpu) {
+-		if (conf->level == 6) {
+-			spare_page = alloc_page(GFP_KERNEL);
+-			if (!spare_page) {
+-				err = -ENOMEM;
+-				break;
+-			}
+-			per_cpu_ptr(conf->percpu, cpu)->spare_page = spare_page;
+-		}
+-		scribble = kmalloc(conf->scribble_len, GFP_KERNEL);
+-		if (!scribble) {
+-			err = -ENOMEM;
++		err = alloc_scratch_buffer(conf, per_cpu_ptr(conf->percpu, cpu));
++		if (err) {
++			pr_err("%s: failed memory allocation for cpu%ld\n",
++			       __func__, cpu);
+ 			break;
+ 		}
+-		per_cpu_ptr(conf->percpu, cpu)->scribble = scribble;
+ 	}
+-#ifdef CONFIG_HOTPLUG_CPU
+-	conf->cpu_notify.notifier_call = raid456_cpu_notify;
+-	conf->cpu_notify.priority = 0;
+-	if (err == 0)
+-		err = register_cpu_notifier(&conf->cpu_notify);
+-#endif
+ 	put_online_cpus();
+ 
+ 	return err;
+diff --git a/drivers/media/dvb/dvb-usb/mxl111sf-tuner.h b/drivers/media/dvb/dvb-usb/mxl111sf-tuner.h
+index ff33396..10b93c4 100644
+--- a/drivers/media/dvb/dvb-usb/mxl111sf-tuner.h
++++ b/drivers/media/dvb/dvb-usb/mxl111sf-tuner.h
+@@ -69,7 +69,7 @@ struct dvb_frontend *mxl111sf_tuner_attach(struct dvb_frontend *fe,
+ #else
+ static inline
+ struct dvb_frontend *mxl111sf_tuner_attach(struct dvb_frontend *fe,
+-					   struct mxl111sf_state *mxl_state
++					   struct mxl111sf_state *mxl_state,
+ 					   struct mxl111sf_tuner_config *cfg)
+ {
+ 	printk(KERN_WARNING "%s: driver disabled by Kconfig\n", __func__);
+diff --git a/drivers/media/dvb/frontends/dib8000.c b/drivers/media/dvb/frontends/dib8000.c
+index fe284d5..a542db1 100644
+--- a/drivers/media/dvb/frontends/dib8000.c
++++ b/drivers/media/dvb/frontends/dib8000.c
+@@ -114,15 +114,10 @@ static u16 dib8000_i2c_read16(struct i2c_device *i2c, u16 reg)
+ 	return ret;
+ }
+ 
+-static u16 dib8000_read_word(struct dib8000_state *state, u16 reg)
++static u16 __dib8000_read_word(struct dib8000_state *state, u16 reg)
+ {
+ 	u16 ret;
+ 
+-	if (mutex_lock_interruptible(&state->i2c_buffer_lock) < 0) {
+-		dprintk("could not acquire lock");
+-		return 0;
+-	}
+-
+ 	state->i2c_write_buffer[0] = reg >> 8;
+ 	state->i2c_write_buffer[1] = reg & 0xff;
+ 
+@@ -140,6 +135,21 @@ static u16 dib8000_read_word(struct dib8000_state *state, u16 reg)
+ 		dprintk("i2c read error on %d", reg);
+ 
+ 	ret = (state->i2c_read_buffer[0] << 8) | state->i2c_read_buffer[1];
++
++	return ret;
++}
++
++static u16 dib8000_read_word(struct dib8000_state *state, u16 reg)
++{
++	u16 ret;
++
++	if (mutex_lock_interruptible(&state->i2c_buffer_lock) < 0) {
++		dprintk("could not acquire lock");
++		return 0;
++	}
++
++	ret = __dib8000_read_word(state, reg);
++
+ 	mutex_unlock(&state->i2c_buffer_lock);
+ 
+ 	return ret;
+@@ -149,8 +159,15 @@ static u32 dib8000_read32(struct dib8000_state *state, u16 reg)
+ {
+ 	u16 rw[2];
+ 
+-	rw[0] = dib8000_read_word(state, reg + 0);
+-	rw[1] = dib8000_read_word(state, reg + 1);
++	if (mutex_lock_interruptible(&state->i2c_buffer_lock) < 0) {
++		dprintk("could not acquire lock");
++		return 0;
++	}
++
++	rw[0] = __dib8000_read_word(state, reg + 0);
++	rw[1] = __dib8000_read_word(state, reg + 1);
++
++	mutex_unlock(&state->i2c_buffer_lock);
+ 
+ 	return ((rw[0] << 16) | (rw[1]));
+ }
+diff --git a/drivers/media/video/saa7134/saa7134-alsa.c b/drivers/media/video/saa7134/saa7134-alsa.c
+index 10460fd..dbcdfbf 100644
+--- a/drivers/media/video/saa7134/saa7134-alsa.c
++++ b/drivers/media/video/saa7134/saa7134-alsa.c
+@@ -172,7 +172,9 @@ static void saa7134_irq_alsa_done(struct saa7134_dev *dev,
+ 		dprintk("irq: overrun [full=%d/%d] - Blocks in %d\n",dev->dmasound.read_count,
+ 			dev->dmasound.bufsize, dev->dmasound.blocks);
+ 		spin_unlock(&dev->slock);
++		snd_pcm_stream_lock(dev->dmasound.substream);
+ 		snd_pcm_stop(dev->dmasound.substream,SNDRV_PCM_STATE_XRUN);
++		snd_pcm_stream_unlock(dev->dmasound.substream);
+ 		return;
+ 	}
+ 
+diff --git a/drivers/mmc/host/atmel-mci.c b/drivers/mmc/host/atmel-mci.c
+index 83790f2..fd61f63 100644
+--- a/drivers/mmc/host/atmel-mci.c
++++ b/drivers/mmc/host/atmel-mci.c
+@@ -1014,11 +1014,22 @@ static void atmci_start_request(struct atmel_mci *host,
+ 	iflags |= ATMCI_CMDRDY;
+ 	cmd = mrq->cmd;
+ 	cmdflags = atmci_prepare_command(slot->mmc, cmd);
+-	atmci_send_command(host, cmd, cmdflags);
++
++	/*
++	 * DMA transfer should be started before sending the command to avoid
++	 * unexpected errors especially for read operations in SDIO mode.
++	 * Unfortunately, in PDC mode, command has to be sent before starting
++	 * the transfer.
++	 */
++	if (host->submit_data != &atmci_submit_data_dma)
++		atmci_send_command(host, cmd, cmdflags);
+ 
+ 	if (data)
+ 		host->submit_data(host, data);
+ 
++	if (host->submit_data == &atmci_submit_data_dma)
++		atmci_send_command(host, cmd, cmdflags);
++
+ 	if (mrq->stop) {
+ 		host->stop_cmdr = atmci_prepare_command(slot->mmc, mrq->stop);
+ 		host->stop_cmdr |= ATMCI_CMDR_STOP_XFER;
+diff --git a/drivers/mmc/host/sdhci.c b/drivers/mmc/host/sdhci.c
+index aaeaff2..9f68b82 100644
+--- a/drivers/mmc/host/sdhci.c
++++ b/drivers/mmc/host/sdhci.c
+@@ -1670,12 +1670,12 @@ static int sdhci_execute_tuning(struct mmc_host *mmc)
+ 	int tuning_loop_counter = MAX_TUNING_LOOP;
+ 	unsigned long timeout;
+ 	int err = 0;
++	unsigned long flags;
+ 
+ 	host = mmc_priv(mmc);
+ 
+ 	sdhci_runtime_pm_get(host);
+-	disable_irq(host->irq);
+-	spin_lock(&host->lock);
++	spin_lock_irqsave(&host->lock, flags);
+ 
+ 	ctrl = sdhci_readw(host, SDHCI_HOST_CONTROL2);
+ 
+@@ -1689,8 +1689,7 @@ static int sdhci_execute_tuning(struct mmc_host *mmc)
+ 	    (host->flags & SDHCI_SDR50_NEEDS_TUNING)))
+ 		ctrl |= SDHCI_CTRL_EXEC_TUNING;
+ 	else {
+-		spin_unlock(&host->lock);
+-		enable_irq(host->irq);
++		spin_unlock_irqrestore(&host->lock, flags);
+ 		sdhci_runtime_pm_put(host);
+ 		return 0;
+ 	}
+@@ -1752,15 +1751,12 @@ static int sdhci_execute_tuning(struct mmc_host *mmc)
+ 		host->cmd = NULL;
+ 		host->mrq = NULL;
+ 
+-		spin_unlock(&host->lock);
+-		enable_irq(host->irq);
+-
++		spin_unlock_irqrestore(&host->lock, flags);
+ 		/* Wait for Buffer Read Ready interrupt */
+ 		wait_event_interruptible_timeout(host->buf_ready_int,
+ 					(host->tuning_done == 1),
+ 					msecs_to_jiffies(50));
+-		disable_irq(host->irq);
+-		spin_lock(&host->lock);
++		spin_lock_irqsave(&host->lock, flags);
+ 
+ 		if (!host->tuning_done) {
+ 			pr_info(DRIVER_NAME ": Timeout waiting for "
+@@ -1833,8 +1829,7 @@ out:
+ 		err = 0;
+ 
+ 	sdhci_clear_set_irqs(host, SDHCI_INT_DATA_AVAIL, ier);
+-	spin_unlock(&host->lock);
+-	enable_irq(host->irq);
++	spin_unlock_irqrestore(&host->lock, flags);
+ 	sdhci_runtime_pm_put(host);
+ 
+ 	return err;
+diff --git a/drivers/mtd/nand/mxc_nand.c b/drivers/mtd/nand/mxc_nand.c
+index 74a43b8..baf8356 100644
+--- a/drivers/mtd/nand/mxc_nand.c
++++ b/drivers/mtd/nand/mxc_nand.c
+@@ -596,7 +596,6 @@ static int mxc_nand_correct_data_v2_v3(struct mtd_info *mtd, u_char *dat,
+ 		ecc_stat >>= 4;
+ 	} while (--no_subpages);
+ 
+-	mtd->ecc_stats.corrected += ret;
+ 	pr_debug("%d Symbol Correctable RS-ECC Error\n", ret);
+ 
+ 	return ret;
+diff --git a/drivers/net/bonding/bond_3ad.c b/drivers/net/bonding/bond_3ad.c
+index 0ae0d7c..aaa7999 100644
+--- a/drivers/net/bonding/bond_3ad.c
++++ b/drivers/net/bonding/bond_3ad.c
+@@ -1854,8 +1854,6 @@ void bond_3ad_initiate_agg_selection(struct bonding *bond, int timeout)
+ 	BOND_AD_INFO(bond).agg_select_timer = timeout;
+ }
+ 
+-static u16 aggregator_identifier;
+-
+ /**
+  * bond_3ad_initialize - initialize a bond's 802.3ad parameters and structures
+  * @bond: bonding struct to work on
+@@ -1869,7 +1867,7 @@ void bond_3ad_initialize(struct bonding *bond, u16 tick_resolution)
+ 	if (MAC_ADDRESS_COMPARE(&(BOND_AD_INFO(bond).system.sys_mac_addr),
+ 				bond->dev->dev_addr)) {
+ 
+-		aggregator_identifier = 0;
++		BOND_AD_INFO(bond).aggregator_identifier = 0;
+ 
+ 		BOND_AD_INFO(bond).system.sys_priority = 0xFFFF;
+ 		BOND_AD_INFO(bond).system.sys_mac_addr = *((struct mac_addr *)bond->dev->dev_addr);
+@@ -1941,7 +1939,7 @@ int bond_3ad_bind_slave(struct slave *slave)
+ 		ad_initialize_agg(aggregator);
+ 
+ 		aggregator->aggregator_mac_address = *((struct mac_addr *)bond->dev->dev_addr);
+-		aggregator->aggregator_identifier = (++aggregator_identifier);
++		aggregator->aggregator_identifier = ++BOND_AD_INFO(bond).aggregator_identifier;
+ 		aggregator->slave = slave;
+ 		aggregator->is_active = 0;
+ 		aggregator->num_of_ports = 0;
+diff --git a/drivers/net/bonding/bond_3ad.h b/drivers/net/bonding/bond_3ad.h
+index 235b2cc..20d9c78 100644
+--- a/drivers/net/bonding/bond_3ad.h
++++ b/drivers/net/bonding/bond_3ad.h
+@@ -253,6 +253,7 @@ struct ad_system {
+ struct ad_bond_info {
+ 	struct ad_system system;	    /* 802.3ad system structure */
+ 	u32 agg_select_timer;	    // Timer to select aggregator after all adapter's hand shakes
++	u16 aggregator_identifier;
+ };
+ 
+ struct ad_slave_info {
+diff --git a/drivers/net/can/flexcan.c b/drivers/net/can/flexcan.c
+index bb828c2..7c6bb5a 100644
+--- a/drivers/net/can/flexcan.c
++++ b/drivers/net/can/flexcan.c
+@@ -777,14 +777,16 @@ static void flexcan_chip_stop(struct net_device *dev)
+ 	struct flexcan_regs __iomem *regs = priv->base;
+ 	u32 reg;
+ 
+-	/* Disable all interrupts */
+-	flexcan_write(0, &regs->imask1);
+-
+ 	/* Disable + halt module */
+ 	reg = flexcan_read(&regs->mcr);
+ 	reg |= FLEXCAN_MCR_MDIS | FLEXCAN_MCR_HALT;
+ 	flexcan_write(reg, &regs->mcr);
+ 
++	/* Disable all interrupts */
++	flexcan_write(0, &regs->imask1);
++	flexcan_write(priv->reg_ctrl_default & ~FLEXCAN_CTRL_ERR_ALL,
++		      &regs->ctrl);
++
+ 	flexcan_transceiver_switch(priv, 0);
+ 	priv->can.state = CAN_STATE_STOPPED;
+ 
+@@ -809,12 +811,14 @@ static int flexcan_open(struct net_device *dev)
+ 	/* start chip and queuing */
+ 	err = flexcan_chip_start(dev);
+ 	if (err)
+-		goto out_close;
++		goto out_free_irq;
+ 	napi_enable(&priv->napi);
+ 	netif_start_queue(dev);
+ 
+ 	return 0;
+ 
++ out_free_irq:
++	free_irq(dev->irq, dev);
+  out_close:
+ 	close_candev(dev);
+  out:
+@@ -1023,6 +1027,7 @@ static int __devexit flexcan_remove(struct platform_device *pdev)
+ 	struct resource *mem;
+ 
+ 	unregister_flexcandev(dev);
++	netif_napi_del(&priv->napi);
+ 	platform_set_drvdata(pdev, NULL);
+ 	iounmap(priv->base);
+ 
+diff --git a/drivers/net/ethernet/broadcom/tg3.c b/drivers/net/ethernet/broadcom/tg3.c
+index d5793d3..c77c462 100644
+--- a/drivers/net/ethernet/broadcom/tg3.c
++++ b/drivers/net/ethernet/broadcom/tg3.c
+@@ -5637,8 +5637,7 @@ static int tg3_rx(struct tg3_napi *tnapi, int budget)
+ 
+ 		work_mask |= opaque_key;
+ 
+-		if ((desc->err_vlan & RXD_ERR_MASK) != 0 &&
+-		    (desc->err_vlan != RXD_ERR_ODD_NIBBLE_RCVD_MII)) {
++		if (desc->err_vlan & RXD_ERR_MASK) {
+ 		drop_it:
+ 			tg3_recycle_rx(tnapi, tpr, opaque_key,
+ 				       desc_idx, *post_ptr);
+@@ -7103,12 +7102,12 @@ static int tg3_change_mtu(struct net_device *dev, int new_mtu)
+ 
+ 	tg3_netif_stop(tp);
+ 
++	tg3_set_mtu(dev, tp, new_mtu);
++
+ 	tg3_full_lock(tp, 1);
+ 
+ 	tg3_halt(tp, RESET_KIND_SHUTDOWN, 1);
+ 
+-	tg3_set_mtu(dev, tp, new_mtu);
+-
+ 	err = tg3_restart_hw(tp, 0);
+ 
+ 	if (!err)
+diff --git a/drivers/net/ethernet/broadcom/tg3.h b/drivers/net/ethernet/broadcom/tg3.h
+index da90ba5..a398a6f 100644
+--- a/drivers/net/ethernet/broadcom/tg3.h
++++ b/drivers/net/ethernet/broadcom/tg3.h
+@@ -2477,7 +2477,11 @@ struct tg3_rx_buffer_desc {
+ #define RXD_ERR_TOO_SMALL		0x00400000
+ #define RXD_ERR_NO_RESOURCES		0x00800000
+ #define RXD_ERR_HUGE_FRAME		0x01000000
+-#define RXD_ERR_MASK			0xffff0000
++
++#define RXD_ERR_MASK	(RXD_ERR_BAD_CRC | RXD_ERR_COLLISION |		\
++			 RXD_ERR_LINK_LOST | RXD_ERR_PHY_DECODE |	\
++			 RXD_ERR_MAC_ABRT | RXD_ERR_TOO_SMALL |		\
++			 RXD_ERR_NO_RESOURCES | RXD_ERR_HUGE_FRAME)
+ 
+ 	u32				reserved;
+ 	u32				opaque;
+diff --git a/drivers/net/usb/gl620a.c b/drivers/net/usb/gl620a.c
+index c4cfd1d..75d9040 100644
+--- a/drivers/net/usb/gl620a.c
++++ b/drivers/net/usb/gl620a.c
+@@ -86,6 +86,10 @@ static int genelink_rx_fixup(struct usbnet *dev, struct sk_buff *skb)
+ 	u32			size;
+ 	u32			count;
+ 
++	/* This check is no longer done by usbnet */
++	if (skb->len < dev->net->hard_header_len)
++		return 0;
++
+ 	header = (struct gl_header *) skb->data;
+ 
+ 	// get the packet count of the received skb
+diff --git a/drivers/net/usb/mcs7830.c b/drivers/net/usb/mcs7830.c
+index db2cb74..a2f7579 100644
+--- a/drivers/net/usb/mcs7830.c
++++ b/drivers/net/usb/mcs7830.c
+@@ -601,8 +601,9 @@ static int mcs7830_rx_fixup(struct usbnet *dev, struct sk_buff *skb)
+ {
+ 	u8 status;
+ 
+-	if (skb->len == 0) {
+-		dev_err(&dev->udev->dev, "unexpected empty rx frame\n");
++	/* This check is no longer done by usbnet */
++	if (skb->len < dev->net->hard_header_len) {
++		dev_err(&dev->udev->dev, "unexpected tiny rx frame\n");
+ 		return 0;
+ 	}
+ 
+diff --git a/drivers/net/usb/net1080.c b/drivers/net/usb/net1080.c
+index 01db460..c9e3278 100644
+--- a/drivers/net/usb/net1080.c
++++ b/drivers/net/usb/net1080.c
+@@ -419,6 +419,10 @@ static int net1080_rx_fixup(struct usbnet *dev, struct sk_buff *skb)
+ 	struct nc_trailer	*trailer;
+ 	u16			hdr_len, packet_len;
+ 
++	/* This check is no longer done by usbnet */
++	if (skb->len < dev->net->hard_header_len)
++		return 0;
++
+ 	if (!(skb->len & 0x01)) {
+ #ifdef DEBUG
+ 		struct net_device	*net = dev->net;
+diff --git a/drivers/net/usb/rndis_host.c b/drivers/net/usb/rndis_host.c
+index 255d6a4..13b40e3 100644
+--- a/drivers/net/usb/rndis_host.c
++++ b/drivers/net/usb/rndis_host.c
+@@ -490,6 +490,10 @@ EXPORT_SYMBOL_GPL(rndis_unbind);
+  */
+ int rndis_rx_fixup(struct usbnet *dev, struct sk_buff *skb)
+ {
++	/* This check is no longer done by usbnet */
++	if (skb->len < dev->net->hard_header_len)
++		return 0;
++
+ 	/* peripheral may have batched packets to us... */
+ 	while (likely(skb->len)) {
+ 		struct rndis_data_hdr	*hdr = (void *)skb->data;
+diff --git a/drivers/net/usb/smsc75xx.c b/drivers/net/usb/smsc75xx.c
+index a8e4640..c41b42b 100644
+--- a/drivers/net/usb/smsc75xx.c
++++ b/drivers/net/usb/smsc75xx.c
+@@ -1079,6 +1079,10 @@ static void smsc75xx_rx_csum_offload(struct usbnet *dev, struct sk_buff *skb,
+ 
+ static int smsc75xx_rx_fixup(struct usbnet *dev, struct sk_buff *skb)
+ {
++	/* This check is no longer done by usbnet */
++	if (skb->len < dev->net->hard_header_len)
++		return 0;
++
+ 	while (skb->len > 0) {
+ 		u32 rx_cmd_a, rx_cmd_b, align_count, size;
+ 		struct sk_buff *ax_skb;
+diff --git a/drivers/net/usb/smsc95xx.c b/drivers/net/usb/smsc95xx.c
+index 55b3218..6617325 100644
+--- a/drivers/net/usb/smsc95xx.c
++++ b/drivers/net/usb/smsc95xx.c
+@@ -1039,6 +1039,10 @@ static void smsc95xx_rx_csum_offload(struct sk_buff *skb)
+ 
+ static int smsc95xx_rx_fixup(struct usbnet *dev, struct sk_buff *skb)
+ {
++	/* This check is no longer done by usbnet */
++	if (skb->len < dev->net->hard_header_len)
++		return 0;
++
+ 	while (skb->len > 0) {
+ 		u32 header, align_count;
+ 		struct sk_buff *ax_skb;
+diff --git a/drivers/net/usb/usbnet.c b/drivers/net/usb/usbnet.c
+index dc53a8f..3d21742 100644
+--- a/drivers/net/usb/usbnet.c
++++ b/drivers/net/usb/usbnet.c
+@@ -414,17 +414,19 @@ static inline void rx_process (struct usbnet *dev, struct sk_buff *skb)
+ 	}
+ 	// else network stack removes extra byte if we forced a short packet
+ 
+-	if (skb->len) {
+-		/* all data was already cloned from skb inside the driver */
+-		if (dev->driver_info->flags & FLAG_MULTI_PACKET)
+-			dev_kfree_skb_any(skb);
+-		else
+-			usbnet_skb_return(dev, skb);
++	/* all data was already cloned from skb inside the driver */
++	if (dev->driver_info->flags & FLAG_MULTI_PACKET)
++		goto done;
++
++	if (skb->len < ETH_HLEN) {
++		dev->net->stats.rx_errors++;
++		dev->net->stats.rx_length_errors++;
++		netif_dbg(dev, rx_err, dev->net, "rx length %d\n", skb->len);
++	} else {
++		usbnet_skb_return(dev, skb);
+ 		return;
+ 	}
+ 
+-	netif_dbg(dev, rx_err, dev->net, "drop\n");
+-	dev->net->stats.rx_errors++;
+ done:
+ 	skb_queue_tail(&dev->done, skb);
+ }
+@@ -446,13 +448,6 @@ static void rx_complete (struct urb *urb)
+ 	switch (urb_status) {
+ 	/* success */
+ 	case 0:
+-		if (skb->len < dev->net->hard_header_len) {
+-			state = rx_cleanup;
+-			dev->net->stats.rx_errors++;
+-			dev->net->stats.rx_length_errors++;
+-			netif_dbg(dev, rx_err, dev->net,
+-				  "rx length %d\n", skb->len);
+-		}
+ 		break;
+ 
+ 	/* stalls need manual reset. this is rare ... except that
+diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
+index 43a6a11..f13a673 100644
+--- a/drivers/net/virtio_net.c
++++ b/drivers/net/virtio_net.c
+@@ -1029,7 +1029,8 @@ static int virtnet_probe(struct virtio_device *vdev)
+ 	/* If we can receive ANY GSO packets, we must allocate large ones. */
+ 	if (virtio_has_feature(vdev, VIRTIO_NET_F_GUEST_TSO4) ||
+ 	    virtio_has_feature(vdev, VIRTIO_NET_F_GUEST_TSO6) ||
+-	    virtio_has_feature(vdev, VIRTIO_NET_F_GUEST_ECN))
++	    virtio_has_feature(vdev, VIRTIO_NET_F_GUEST_ECN) ||
++	    virtio_has_feature(vdev, VIRTIO_NET_F_GUEST_UFO))
+ 		vi->big_packets = true;
+ 
+ 	if (virtio_has_feature(vdev, VIRTIO_NET_F_MRG_RXBUF))
+diff --git a/drivers/net/vmxnet3/vmxnet3_drv.c b/drivers/net/vmxnet3/vmxnet3_drv.c
+index d426261..28ceef2 100644
+--- a/drivers/net/vmxnet3/vmxnet3_drv.c
++++ b/drivers/net/vmxnet3/vmxnet3_drv.c
+@@ -1734,11 +1734,20 @@ vmxnet3_netpoll(struct net_device *netdev)
+ {
+ 	struct vmxnet3_adapter *adapter = netdev_priv(netdev);
+ 
+-	if (adapter->intr.mask_mode == VMXNET3_IMM_ACTIVE)
+-		vmxnet3_disable_all_intrs(adapter);
+-
+-	vmxnet3_do_poll(adapter, adapter->rx_queue[0].rx_ring[0].size);
+-	vmxnet3_enable_all_intrs(adapter);
++	switch (adapter->intr.type) {
++#ifdef CONFIG_PCI_MSI
++	case VMXNET3_IT_MSIX: {
++		int i;
++		for (i = 0; i < adapter->num_rx_queues; i++)
++			vmxnet3_msix_rx(0, &adapter->rx_queue[i]);
++		break;
++	}
++#endif
++	case VMXNET3_IT_MSI:
++	default:
++		vmxnet3_intr(0, adapter->netdev);
++		break;
++	}
+ 
+ }
+ #endif	/* CONFIG_NET_POLL_CONTROLLER */
+diff --git a/drivers/net/wireless/ath/ath9k/ar9462_2p0_initvals.h b/drivers/net/wireless/ath/ath9k/ar9462_2p0_initvals.h
+index 9c51b39..eabf374 100644
+--- a/drivers/net/wireless/ath/ath9k/ar9462_2p0_initvals.h
++++ b/drivers/net/wireless/ath/ath9k/ar9462_2p0_initvals.h
+@@ -55,7 +55,7 @@ static const u32 ar9462_2p0_baseband_postamble[][5] = {
+ 	{0x00009e14, 0x37b95d5e, 0x37b9605e, 0x3039605e, 0x33795d5e},
+ 	{0x00009e18, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+ 	{0x00009e1c, 0x0001cf9c, 0x0001cf9c, 0x00021f9c, 0x00021f9c},
+-	{0x00009e20, 0x000003b5, 0x000003b5, 0x000003ce, 0x000003ce},
++	{0x00009e20, 0x000003a5, 0x000003a5, 0x000003a5, 0x000003a5},
+ 	{0x00009e2c, 0x0000001c, 0x0000001c, 0x00000021, 0x00000021},
+ 	{0x00009e3c, 0xcf946220, 0xcf946220, 0xcfd5c782, 0xcfd5c782},
+ 	{0x00009e44, 0xfe321e27, 0xfe321e27, 0xfe291e27, 0xfe291e27},
+@@ -85,7 +85,7 @@ static const u32 ar9462_2p0_baseband_postamble[][5] = {
+ 	{0x0000ae04, 0x001c0000, 0x001c0000, 0x001c0000, 0x00100000},
+ 	{0x0000ae18, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+ 	{0x0000ae1c, 0x0000019c, 0x0000019c, 0x0000019c, 0x0000019c},
+-	{0x0000ae20, 0x000001b5, 0x000001b5, 0x000001ce, 0x000001ce},
++	{0x0000ae20, 0x000001a6, 0x000001a6, 0x000001aa, 0x000001aa},
+ 	{0x0000b284, 0x00000000, 0x00000000, 0x00000550, 0x00000550},
+ };
+ 
+diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_init.c b/drivers/net/wireless/ath/ath9k/htc_drv_init.c
+index ef921e1..c6c3e1c 100644
+--- a/drivers/net/wireless/ath/ath9k/htc_drv_init.c
++++ b/drivers/net/wireless/ath/ath9k/htc_drv_init.c
+@@ -28,6 +28,10 @@ int htc_modparam_nohwcrypt;
+ module_param_named(nohwcrypt, htc_modparam_nohwcrypt, int, 0444);
+ MODULE_PARM_DESC(nohwcrypt, "Disable hardware encryption");
+ 
++static int ath9k_ps_enable;
++module_param_named(ps_enable, ath9k_ps_enable, int, 0444);
++MODULE_PARM_DESC(ps_enable, "Enable WLAN PowerSave");
++
+ #define CHAN2G(_freq, _idx)  { \
+ 	.center_freq = (_freq), \
+ 	.hw_value = (_idx), \
+@@ -729,11 +733,13 @@ static void ath9k_set_hw_capab(struct ath9k_htc_priv *priv,
+ 		IEEE80211_HW_SPECTRUM_MGMT |
+ 		IEEE80211_HW_HAS_RATE_CONTROL |
+ 		IEEE80211_HW_RX_INCLUDES_FCS |
+-		IEEE80211_HW_SUPPORTS_PS |
+ 		IEEE80211_HW_PS_NULLFUNC_STACK |
+ 		IEEE80211_HW_REPORTS_TX_ACK_STATUS |
+ 		IEEE80211_HW_HOST_BROADCAST_PS_BUFFERING;
+ 
++	if (ath9k_ps_enable)
++		hw->flags |= IEEE80211_HW_SUPPORTS_PS;
++
+ 	hw->wiphy->interface_modes =
+ 		BIT(NL80211_IFTYPE_STATION) |
+ 		BIT(NL80211_IFTYPE_ADHOC) |
+diff --git a/drivers/net/wireless/ath/ath9k/init.c b/drivers/net/wireless/ath/ath9k/init.c
+index ba6a49c..1355d71 100644
+--- a/drivers/net/wireless/ath/ath9k/init.c
++++ b/drivers/net/wireless/ath/ath9k/init.c
+@@ -44,6 +44,10 @@ static int ath9k_btcoex_enable;
+ module_param_named(btcoex_enable, ath9k_btcoex_enable, int, 0444);
+ MODULE_PARM_DESC(btcoex_enable, "Enable wifi-BT coexistence");
+ 
++static int ath9k_ps_enable;
++module_param_named(ps_enable, ath9k_ps_enable, int, 0444);
++MODULE_PARM_DESC(ps_enable, "Enable WLAN PowerSave");
++
+ bool is_ath9k_unloaded;
+ /* We use the hw_value as an index into our private channel structure */
+ 
+@@ -671,11 +675,13 @@ void ath9k_set_hw_capab(struct ath_softc *sc, struct ieee80211_hw *hw)
+ 	hw->flags = IEEE80211_HW_RX_INCLUDES_FCS |
+ 		IEEE80211_HW_HOST_BROADCAST_PS_BUFFERING |
+ 		IEEE80211_HW_SIGNAL_DBM |
+-		IEEE80211_HW_SUPPORTS_PS |
+ 		IEEE80211_HW_PS_NULLFUNC_STACK |
+ 		IEEE80211_HW_SPECTRUM_MGMT |
+ 		IEEE80211_HW_REPORTS_TX_ACK_STATUS;
+ 
++	if (ath9k_ps_enable)
++		hw->flags |= IEEE80211_HW_SUPPORTS_PS;
++
+ 	if (sc->sc_ah->caps.hw_caps & ATH9K_HW_CAP_HT)
+ 		 hw->flags |= IEEE80211_HW_AMPDU_AGGREGATION;
+ 
+diff --git a/drivers/net/wireless/ath/ath9k/xmit.c b/drivers/net/wireless/ath/ath9k/xmit.c
+index 126ed31..2e88af1 100644
+--- a/drivers/net/wireless/ath/ath9k/xmit.c
++++ b/drivers/net/wireless/ath/ath9k/xmit.c
+@@ -1176,14 +1176,16 @@ void ath_tx_aggr_sleep(struct ieee80211_sta *sta, struct ath_softc *sc,
+ 	for (tidno = 0, tid = &an->tid[tidno];
+ 	     tidno < WME_NUM_TID; tidno++, tid++) {
+ 
+-		if (!tid->sched)
+-			continue;
+-
+ 		ac = tid->ac;
+ 		txq = ac->txq;
+ 
+ 		spin_lock_bh(&txq->axq_lock);
+ 
++		if (!tid->sched) {
++			spin_unlock_bh(&txq->axq_lock);
++			continue;
++		}
++
+ 		buffered = !skb_queue_empty(&tid->buf_q);
+ 
+ 		tid->sched = false;
+diff --git a/drivers/net/wireless/b43/xmit.c b/drivers/net/wireless/b43/xmit.c
+index 5f77cbe..c6c34bf 100644
+--- a/drivers/net/wireless/b43/xmit.c
++++ b/drivers/net/wireless/b43/xmit.c
+@@ -819,10 +819,10 @@ void b43_rx(struct b43_wldev *dev, struct sk_buff *skb, const void *_rxhdr)
+ 		 * channel number in b43. */
+ 		if (chanstat & B43_RX_CHAN_5GHZ) {
+ 			status.band = IEEE80211_BAND_5GHZ;
+-			status.freq = b43_freq_to_channel_5ghz(chanid);
++			status.freq = b43_channel_to_freq_5ghz(chanid);
+ 		} else {
+ 			status.band = IEEE80211_BAND_2GHZ;
+-			status.freq = b43_freq_to_channel_2ghz(chanid);
++			status.freq = b43_channel_to_freq_2ghz(chanid);
+ 		}
+ 		break;
+ 	default:
+diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-tx.c b/drivers/net/wireless/iwlwifi/iwl-agn-tx.c
+index df1540c..5fe4602 100644
+--- a/drivers/net/wireless/iwlwifi/iwl-agn-tx.c
++++ b/drivers/net/wireless/iwlwifi/iwl-agn-tx.c
+@@ -854,8 +854,6 @@ int iwlagn_rx_reply_compressed_ba(struct iwl_priv *priv,
+ 	struct iwl_compressed_ba_resp *ba_resp = &pkt->u.compressed_ba;
+ 	struct iwl_ht_agg *agg;
+ 	struct sk_buff_head reclaimed_skbs;
+-	struct ieee80211_tx_info *info;
+-	struct ieee80211_hdr *hdr;
+ 	struct sk_buff *skb;
+ 	unsigned long flags;
+ 	int sta_id;
+@@ -941,24 +939,32 @@ int iwlagn_rx_reply_compressed_ba(struct iwl_priv *priv,
+ 			  0, &reclaimed_skbs);
+ 	freed = 0;
+ 	while (!skb_queue_empty(&reclaimed_skbs)) {
++		struct ieee80211_hdr *hdr;
++		struct ieee80211_tx_info *info;
+ 
+ 		skb = __skb_dequeue(&reclaimed_skbs);
+-		hdr = (struct ieee80211_hdr *)skb->data;
++		hdr = (void *)skb->data;
++		info = IEEE80211_SKB_CB(skb);
+ 
+ 		if (ieee80211_is_data_qos(hdr->frame_control))
+ 			freed++;
+ 		else
+ 			WARN_ON_ONCE(1);
+ 
+-		info = IEEE80211_SKB_CB(skb);
+ 		kmem_cache_free(priv->tx_cmd_pool, (info->driver_data[1]));
+ 
++		memset(&info->status, 0, sizeof(info->status));
++		/* Packet was transmitted successfully, failures come as single
++		 * frames because before failing a frame the firmware transmits
++		 * it without aggregation at least once.
++		 */
++		info->flags |= IEEE80211_TX_STAT_ACK;
++
+ 		if (freed == 1) {
+ 			/* this is the first skb we deliver in this batch */
+ 			/* put the rate scaling data there */
+ 			info = IEEE80211_SKB_CB(skb);
+ 			memset(&info->status, 0, sizeof(info->status));
+-			info->flags |= IEEE80211_TX_STAT_ACK;
+ 			info->flags |= IEEE80211_TX_STAT_AMPDU;
+ 			info->status.ampdu_ack_len = ba_resp->txed_2_done;
+ 			info->status.ampdu_len = ba_resp->txed;
+diff --git a/drivers/net/wireless/mwifiex/11n.c b/drivers/net/wireless/mwifiex/11n.c
+index 34bba52..6543f4f 100644
+--- a/drivers/net/wireless/mwifiex/11n.c
++++ b/drivers/net/wireless/mwifiex/11n.c
+@@ -343,8 +343,7 @@ mwifiex_cmd_append_11n_tlv(struct mwifiex_private *priv,
+ 		ht_cap->header.len =
+ 				cpu_to_le16(sizeof(struct ieee80211_ht_cap));
+ 		memcpy((u8 *) ht_cap + sizeof(struct mwifiex_ie_types_header),
+-		       (u8 *) bss_desc->bcn_ht_cap +
+-		       sizeof(struct ieee_types_header),
++		       (u8 *)bss_desc->bcn_ht_cap,
+ 		       le16_to_cpu(ht_cap->header.len));
+ 
+ 		mwifiex_fill_cap_info(priv, radio_type, ht_cap);
+diff --git a/drivers/net/wireless/rtl818x/rtl8187/rtl8187.h b/drivers/net/wireless/rtl818x/rtl8187/rtl8187.h
+index f1cc907..6d3d653 100644
+--- a/drivers/net/wireless/rtl818x/rtl8187/rtl8187.h
++++ b/drivers/net/wireless/rtl818x/rtl8187/rtl8187.h
+@@ -15,6 +15,8 @@
+ #ifndef RTL8187_H
+ #define RTL8187_H
+ 
++#include <linux/cache.h>
++
+ #include "rtl818x.h"
+ #include "leds.h"
+ 
+@@ -131,7 +133,10 @@ struct rtl8187_priv {
+ 	u8 aifsn[4];
+ 	u8 rfkill_mask;
+ 	struct {
+-		__le64 buf;
++		union {
++			__le64 buf;
++			u8 dummy1[L1_CACHE_BYTES];
++		} ____cacheline_aligned;
+ 		struct sk_buff_head queue;
+ 	} b_tx_status; /* This queue is used by both -b and non-b devices */
+ 	struct mutex io_mutex;
+@@ -139,7 +144,8 @@ struct rtl8187_priv {
+ 		u8 bits8;
+ 		__le16 bits16;
+ 		__le32 bits32;
+-	} *io_dmabuf;
++		u8 dummy2[L1_CACHE_BYTES];
++	} *io_dmabuf ____cacheline_aligned;
+ 	bool rfkill_off;
+ };
+ 
+diff --git a/drivers/net/wireless/rtlwifi/core.c b/drivers/net/wireless/rtlwifi/core.c
+index 3f0f056..4fa987b 100644
+--- a/drivers/net/wireless/rtlwifi/core.c
++++ b/drivers/net/wireless/rtlwifi/core.c
+@@ -131,6 +131,7 @@ static int rtl_op_add_interface(struct ieee80211_hw *hw,
+ 					rtlpriv->cfg->maps
+ 					[RTL_IBSS_INT_MASKS]);
+ 		}
++		mac->link_state = MAC80211_LINKED;
+ 		break;
+ 	case NL80211_IFTYPE_ADHOC:
+ 		RT_TRACE(rtlpriv, COMP_MAC80211, DBG_LOUD,
+diff --git a/drivers/net/wireless/rtlwifi/rtl8192ce/hw.c b/drivers/net/wireless/rtlwifi/rtl8192ce/hw.c
+index cb480d8..ce1fdbe 100644
+--- a/drivers/net/wireless/rtlwifi/rtl8192ce/hw.c
++++ b/drivers/net/wireless/rtlwifi/rtl8192ce/hw.c
+@@ -905,14 +905,26 @@ int rtl92ce_hw_init(struct ieee80211_hw *hw)
+ 	bool is92c;
+ 	int err;
+ 	u8 tmp_u1b;
++	unsigned long flags;
+ 
+ 	rtlpci->being_init_adapter = true;
++
++	/* Since this function can take a very long time (up to 350 ms)
++	 * and can be called with irqs disabled, reenable the irqs
++	 * to let the other devices continue being serviced.
++	 *
++	 * It is safe doing so since our own interrupts will only be enabled
++	 * in a subsequent step.
++	 */
++	local_save_flags(flags);
++	local_irq_enable();
++
+ 	rtlpriv->intf_ops->disable_aspm(hw);
+ 	rtstatus = _rtl92ce_init_mac(hw);
+ 	if (rtstatus != true) {
+ 		RT_TRACE(rtlpriv, COMP_ERR, DBG_EMERG, ("Init MAC failed\n"));
+ 		err = 1;
+-		return err;
++		goto exit;
+ 	}
+ 
+ 	err = rtl92c_download_fw(hw);
+@@ -922,7 +934,7 @@ int rtl92ce_hw_init(struct ieee80211_hw *hw)
+ 			  "without FW now..\n"));
+ 		err = 1;
+ 		rtlhal->fw_ready = false;
+-		return err;
++		goto exit;
+ 	} else {
+ 		rtlhal->fw_ready = true;
+ 	}
+@@ -985,6 +997,8 @@ int rtl92ce_hw_init(struct ieee80211_hw *hw)
+ 		RT_TRACE(rtlpriv, COMP_INIT, DBG_TRACE, ("under 1.5V\n"));
+ 	}
+ 	rtl92c_dm_init(hw);
++exit:
++	local_irq_restore(flags);
+ 	rtlpci->being_init_adapter = false;
+ 	return err;
+ }
+diff --git a/drivers/net/wireless/rtlwifi/rtl8192cu/rf.c b/drivers/net/wireless/rtlwifi/rtl8192cu/rf.c
+index 17a8e96..d984867 100644
+--- a/drivers/net/wireless/rtlwifi/rtl8192cu/rf.c
++++ b/drivers/net/wireless/rtlwifi/rtl8192cu/rf.c
+@@ -85,17 +85,15 @@ void rtl92cu_phy_rf6052_set_cck_txpower(struct ieee80211_hw *hw,
+ 	if (mac->act_scanning) {
+ 		tx_agc[RF90_PATH_A] = 0x3f3f3f3f;
+ 		tx_agc[RF90_PATH_B] = 0x3f3f3f3f;
+-		if (turbo_scanoff) {
+-			for (idx1 = RF90_PATH_A; idx1 <= RF90_PATH_B; idx1++) {
+-				tx_agc[idx1] = ppowerlevel[idx1] |
+-				    (ppowerlevel[idx1] << 8) |
+-				    (ppowerlevel[idx1] << 16) |
+-				    (ppowerlevel[idx1] << 24);
+-				if (rtlhal->interface == INTF_USB) {
+-					if (tx_agc[idx1] > 0x20 &&
+-					    rtlefuse->external_pa)
+-						tx_agc[idx1] = 0x20;
+-				}
++		for (idx1 = RF90_PATH_A; idx1 <= RF90_PATH_B; idx1++) {
++			tx_agc[idx1] = ppowerlevel[idx1] |
++			    (ppowerlevel[idx1] << 8) |
++			    (ppowerlevel[idx1] << 16) |
++			    (ppowerlevel[idx1] << 24);
++			if (rtlhal->interface == INTF_USB) {
++				if (tx_agc[idx1] > 0x20 &&
++				    rtlefuse->external_pa)
++					tx_agc[idx1] = 0x20;
+ 			}
+ 		}
+ 	} else {
+@@ -107,7 +105,7 @@ void rtl92cu_phy_rf6052_set_cck_txpower(struct ieee80211_hw *hw,
+ 			   TXHIGHPWRLEVEL_LEVEL2) {
+ 			tx_agc[RF90_PATH_A] = 0x00000000;
+ 			tx_agc[RF90_PATH_B] = 0x00000000;
+-		} else{
++		} else {
+ 			for (idx1 = RF90_PATH_A; idx1 <= RF90_PATH_B; idx1++) {
+ 				tx_agc[idx1] = ppowerlevel[idx1] |
+ 				    (ppowerlevel[idx1] << 8) |
+@@ -380,7 +378,12 @@ static void _rtl92c_write_ofdm_power_reg(struct ieee80211_hw *hw,
+ 			    regoffset == RTXAGC_B_MCS07_MCS04)
+ 				regoffset = 0xc98;
+ 			for (i = 0; i < 3; i++) {
+-				writeVal = (writeVal > 6) ? (writeVal - 6) : 0;
++				if (i != 2)
++					writeVal = (writeVal > 8) ?
++						   (writeVal - 8) : 0;
++				else
++					writeVal = (writeVal > 6) ?
++						   (writeVal - 6) : 0;
+ 				rtl_write_byte(rtlpriv, (u32)(regoffset + i),
+ 					      (u8)writeVal);
+ 			}
+diff --git a/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c b/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c
+index 016ef86..c184253 100644
+--- a/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c
++++ b/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c
+@@ -316,6 +316,7 @@ static struct usb_device_id rtl8192c_usb_ids[] = {
+ 	{RTL_USB_DEVICE(0x0bda, 0x5088, rtl92cu_hal_cfg)}, /*Thinkware-CC&C*/
+ 	{RTL_USB_DEVICE(0x0df6, 0x0052, rtl92cu_hal_cfg)}, /*Sitecom - Edimax*/
+ 	{RTL_USB_DEVICE(0x0df6, 0x005c, rtl92cu_hal_cfg)}, /*Sitecom - Edimax*/
++	{RTL_USB_DEVICE(0x0df6, 0x0077, rtl92cu_hal_cfg)}, /*Sitecom-WLA2100V2*/
+ 	{RTL_USB_DEVICE(0x0eb0, 0x9071, rtl92cu_hal_cfg)}, /*NO Brand - Etop*/
+ 	{RTL_USB_DEVICE(0x4856, 0x0091, rtl92cu_hal_cfg)}, /*NetweeN - Feixun*/
+ 	/* HP - Lite-On ,8188CUS Slim Combo */
+diff --git a/drivers/of/address.c b/drivers/of/address.c
+index 72c33fb..45c1727 100644
+--- a/drivers/of/address.c
++++ b/drivers/of/address.c
+@@ -97,8 +97,13 @@ static unsigned int of_bus_default_get_flags(const __be32 *addr)
+ 
+ static int of_bus_pci_match(struct device_node *np)
+ {
+-	/* "vci" is for the /chaos bridge on 1st-gen PCI powermacs */
+-	return !strcmp(np->type, "pci") || !strcmp(np->type, "vci");
++	/*
++ 	 * "pciex" is PCI Express
++	 * "vci" is for the /chaos bridge on 1st-gen PCI powermacs
++	 * "ht" is hypertransport
++	 */
++	return !strcmp(np->type, "pci") || !strcmp(np->type, "pciex") ||
++		!strcmp(np->type, "vci") || !strcmp(np->type, "ht");
+ }
+ 
+ static void of_bus_pci_count_cells(struct device_node *np,
+diff --git a/drivers/parport/parport_pc.c b/drivers/parport/parport_pc.c
+index d0b597b..5a4432d 100644
+--- a/drivers/parport/parport_pc.c
++++ b/drivers/parport/parport_pc.c
+@@ -2875,8 +2875,6 @@ enum parport_pc_pci_cards {
+ 	syba_2p_epp,
+ 	syba_1p_ecp,
+ 	titan_010l,
+-	titan_1284p1,
+-	titan_1284p2,
+ 	avlab_1p,
+ 	avlab_2p,
+ 	oxsemi_952,
+@@ -2935,8 +2933,6 @@ static struct parport_pc_pci {
+ 	/* syba_2p_epp AP138B */	{ 2, { { 0, 0x078 }, { 0, 0x178 }, } },
+ 	/* syba_1p_ecp W83787 */	{ 1, { { 0, 0x078 }, } },
+ 	/* titan_010l */		{ 1, { { 3, -1 }, } },
+-	/* titan_1284p1 */              { 1, { { 0, 1 }, } },
+-	/* titan_1284p2 */		{ 2, { { 0, 1 }, { 2, 3 }, } },
+ 	/* avlab_1p		*/	{ 1, { { 0, 1}, } },
+ 	/* avlab_2p		*/	{ 2, { { 0, 1}, { 2, 3 },} },
+ 	/* The Oxford Semi cards are unusual: 954 doesn't support ECP,
+@@ -2952,8 +2948,8 @@ static struct parport_pc_pci {
+ 	/* netmos_9705 */               { 1, { { 0, -1 }, } },
+ 	/* netmos_9715 */               { 2, { { 0, 1 }, { 2, 3 },} },
+ 	/* netmos_9755 */               { 2, { { 0, 1 }, { 2, 3 },} },
+-	/* netmos_9805 */               { 1, { { 0, -1 }, } },
+-	/* netmos_9815 */               { 2, { { 0, -1 }, { 2, -1 }, } },
++	/* netmos_9805 */		{ 1, { { 0, 1 }, } },
++	/* netmos_9815 */		{ 2, { { 0, 1 }, { 2, 3 }, } },
+ 	/* netmos_9901 */               { 1, { { 0, -1 }, } },
+ 	/* netmos_9865 */               { 1, { { 0, -1 }, } },
+ 	/* quatech_sppxp100 */		{ 1, { { 0, 1 }, } },
+@@ -2997,8 +2993,6 @@ static const struct pci_device_id parport_pc_pci_tbl[] = {
+ 	  PCI_ANY_ID, PCI_ANY_ID, 0, 0, syba_1p_ecp },
+ 	{ PCI_VENDOR_ID_TITAN, PCI_DEVICE_ID_TITAN_010L,
+ 	  PCI_ANY_ID, PCI_ANY_ID, 0, 0, titan_010l },
+-	{ 0x9710, 0x9805, 0x1000, 0x0010, 0, 0, titan_1284p1 },
+-	{ 0x9710, 0x9815, 0x1000, 0x0020, 0, 0, titan_1284p2 },
+ 	/* PCI_VENDOR_ID_AVLAB/Intek21 has another bunch of cards ...*/
+ 	/* AFAVLAB_TK9902 */
+ 	{ 0x14db, 0x2120, PCI_ANY_ID, PCI_ANY_ID, 0, 0, avlab_1p},
+diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
+index 9f1fec1..4c3a9e9 100644
+--- a/drivers/pci/pci.c
++++ b/drivers/pci/pci.c
+@@ -1078,6 +1078,8 @@ EXPORT_SYMBOL_GPL(pci_load_and_free_saved_state);
+ static int do_pci_enable_device(struct pci_dev *dev, int bars)
+ {
+ 	int err;
++	u16 cmd;
++	u8 pin;
+ 
+ 	err = pci_set_power_state(dev, PCI_D0);
+ 	if (err < 0 && err != -EIO)
+@@ -1087,6 +1089,17 @@ static int do_pci_enable_device(struct pci_dev *dev, int bars)
+ 		return err;
+ 	pci_fixup_device(pci_fixup_enable, dev);
+ 
++	if (dev->msi_enabled || dev->msix_enabled)
++		return 0;
++
++	pci_read_config_byte(dev, PCI_INTERRUPT_PIN, &pin);
++	if (pin) {
++		pci_read_config_word(dev, PCI_COMMAND, &cmd);
++		if (cmd & PCI_COMMAND_INTX_DISABLE)
++			pci_write_config_word(dev, PCI_COMMAND,
++					      cmd & ~PCI_COMMAND_INTX_DISABLE);
++	}
++
+ 	return 0;
+ }
+ 
+diff --git a/drivers/platform/x86/hp_accel.c b/drivers/platform/x86/hp_accel.c
+index fdacfce..0076fea 100644
+--- a/drivers/platform/x86/hp_accel.c
++++ b/drivers/platform/x86/hp_accel.c
+@@ -77,6 +77,7 @@ static inline void delayed_sysfs_set(struct led_classdev *led_cdev,
+ static struct acpi_device_id lis3lv02d_device_ids[] = {
+ 	{"HPQ0004", 0}, /* HP Mobile Data Protection System PNP */
+ 	{"HPQ6000", 0}, /* HP Mobile Data Protection System PNP */
++	{"HPQ6007", 0}, /* HP Mobile Data Protection System PNP */
+ 	{"", 0},
+ };
+ MODULE_DEVICE_TABLE(acpi, lis3lv02d_device_ids);
+diff --git a/drivers/power/max17040_battery.c b/drivers/power/max17040_battery.c
+index 2f2f9a6..39d3697 100644
+--- a/drivers/power/max17040_battery.c
++++ b/drivers/power/max17040_battery.c
+@@ -148,7 +148,7 @@ static void max17040_get_online(struct i2c_client *client)
+ {
+ 	struct max17040_chip *chip = i2c_get_clientdata(client);
+ 
+-	if (chip->pdata->battery_online)
++	if (chip->pdata && chip->pdata->battery_online)
+ 		chip->online = chip->pdata->battery_online();
+ 	else
+ 		chip->online = 1;
+@@ -158,7 +158,8 @@ static void max17040_get_status(struct i2c_client *client)
+ {
+ 	struct max17040_chip *chip = i2c_get_clientdata(client);
+ 
+-	if (!chip->pdata->charger_online || !chip->pdata->charger_enable) {
++	if (!chip->pdata || !chip->pdata->charger_online
++			|| !chip->pdata->charger_enable) {
+ 		chip->status = POWER_SUPPLY_STATUS_UNKNOWN;
+ 		return;
+ 	}
+diff --git a/drivers/rtc/rtc-cmos.c b/drivers/rtc/rtc-cmos.c
+index e3eed18..cae8985 100644
+--- a/drivers/rtc/rtc-cmos.c
++++ b/drivers/rtc/rtc-cmos.c
+@@ -34,11 +34,11 @@
+ #include <linux/interrupt.h>
+ #include <linux/spinlock.h>
+ #include <linux/platform_device.h>
+-#include <linux/mod_devicetable.h>
+ #include <linux/log2.h>
+ #include <linux/pm.h>
+ #include <linux/of.h>
+ #include <linux/of_platform.h>
++#include <linux/dmi.h>
+ 
+ /* this is for "generic access to PC-style RTC" using CMOS_READ/CMOS_WRITE */
+ #include <asm-generic/rtc.h>
+@@ -377,6 +377,51 @@ static int cmos_set_alarm(struct device *dev, struct rtc_wkalrm *t)
+ 	return 0;
+ }
+ 
++/*
++ * Do not disable RTC alarm on shutdown - workaround for b0rked BIOSes.
++ */
++static bool alarm_disable_quirk;
++
++static int __init set_alarm_disable_quirk(const struct dmi_system_id *id)
++{
++	alarm_disable_quirk = true;
++	pr_info("rtc-cmos: BIOS has alarm-disable quirk. ");
++	pr_info("RTC alarms disabled\n");
++	return 0;
++}
++
++static const struct dmi_system_id rtc_quirks[] __initconst = {
++	/* https://bugzilla.novell.com/show_bug.cgi?id=805740 */
++	{
++		.callback = set_alarm_disable_quirk,
++		.ident    = "IBM Truman",
++		.matches  = {
++			DMI_MATCH(DMI_SYS_VENDOR, "TOSHIBA"),
++			DMI_MATCH(DMI_PRODUCT_NAME, "4852570"),
++		},
++	},
++	/* https://bugzilla.novell.com/show_bug.cgi?id=812592 */
++	{
++		.callback = set_alarm_disable_quirk,
++		.ident    = "Gigabyte GA-990XA-UD3",
++		.matches  = {
++			DMI_MATCH(DMI_SYS_VENDOR,
++					"Gigabyte Technology Co., Ltd."),
++			DMI_MATCH(DMI_PRODUCT_NAME, "GA-990XA-UD3"),
++		},
++	},
++	/* http://permalink.gmane.org/gmane.linux.kernel/1604474 */
++	{
++		.callback = set_alarm_disable_quirk,
++		.ident    = "Toshiba Satellite L300",
++		.matches  = {
++			DMI_MATCH(DMI_SYS_VENDOR, "TOSHIBA"),
++			DMI_MATCH(DMI_PRODUCT_NAME, "Satellite L300"),
++		},
++	},
++	{}
++};
++
+ static int cmos_alarm_irq_enable(struct device *dev, unsigned int enabled)
+ {
+ 	struct cmos_rtc	*cmos = dev_get_drvdata(dev);
+@@ -385,6 +430,9 @@ static int cmos_alarm_irq_enable(struct device *dev, unsigned int enabled)
+ 	if (!is_valid_irq(cmos->irq))
+ 		return -EINVAL;
+ 
++	if (alarm_disable_quirk)
++		return 0;
++
+ 	spin_lock_irqsave(&rtc_lock, flags);
+ 
+ 	if (enabled)
+@@ -1166,6 +1214,8 @@ static int __init cmos_init(void)
+ 			platform_driver_registered = true;
+ 	}
+ 
++	dmi_check_system(rtc_quirks);
++
+ 	if (retval == 0)
+ 		return 0;
+ 
+diff --git a/drivers/scsi/bfa/bfad.c b/drivers/scsi/bfa/bfad.c
+index 66fb725..633048b 100644
+--- a/drivers/scsi/bfa/bfad.c
++++ b/drivers/scsi/bfa/bfad.c
+@@ -1613,7 +1613,7 @@ out:
+ static u32 *
+ bfad_load_fwimg(struct pci_dev *pdev)
+ {
+-	if (pdev->device == BFA_PCI_DEVICE_ID_CT2) {
++	if (bfa_asic_id_ct2(pdev->device)) {
+ 		if (bfi_image_ct2_size == 0)
+ 			bfad_read_firmware(pdev, &bfi_image_ct2,
+ 				&bfi_image_ct2_size, BFAD_FW_FILE_CT2);
+@@ -1623,12 +1623,14 @@ bfad_load_fwimg(struct pci_dev *pdev)
+ 			bfad_read_firmware(pdev, &bfi_image_ct,
+ 				&bfi_image_ct_size, BFAD_FW_FILE_CT);
+ 		return bfi_image_ct;
+-	} else {
++	} else if (bfa_asic_id_cb(pdev->device)) {
+ 		if (bfi_image_cb_size == 0)
+ 			bfad_read_firmware(pdev, &bfi_image_cb,
+ 				&bfi_image_cb_size, BFAD_FW_FILE_CB);
+ 		return bfi_image_cb;
+ 	}
++
++	return NULL;
+ }
+ 
+ static void
+diff --git a/drivers/scsi/isci/host.h b/drivers/scsi/isci/host.h
+index 646051a..ef84778 100644
+--- a/drivers/scsi/isci/host.h
++++ b/drivers/scsi/isci/host.h
+@@ -309,9 +309,8 @@ static inline struct isci_pci_info *to_pci_info(struct pci_dev *pdev)
+ }
+ 
+ #define for_each_isci_host(id, ihost, pdev) \
+-	for (id = 0, ihost = to_pci_info(pdev)->hosts[id]; \
+-	     id < ARRAY_SIZE(to_pci_info(pdev)->hosts) && ihost; \
+-	     ihost = to_pci_info(pdev)->hosts[++id])
++	for (id = 0; id < SCI_MAX_CONTROLLERS && \
++	     (ihost = to_pci_info(pdev)->hosts[id]); id++)
+ 
+ static inline enum isci_status isci_host_get_state(struct isci_host *isci_host)
+ {
+diff --git a/drivers/scsi/isci/port_config.c b/drivers/scsi/isci/port_config.c
+index 38a99d2..21a6769 100644
+--- a/drivers/scsi/isci/port_config.c
++++ b/drivers/scsi/isci/port_config.c
+@@ -610,13 +610,6 @@ static void sci_apc_agent_link_up(struct isci_host *ihost,
+ 		sci_apc_agent_configure_ports(ihost, port_agent, iphy, true);
+ 	} else {
+ 		/* the phy is already the part of the port */
+-		u32 port_state = iport->sm.current_state_id;
+-
+-		/* if the PORT'S state is resetting then the link up is from
+-		 * port hard reset in this case, we need to tell the port
+-		 * that link up is recieved
+-		 */
+-		BUG_ON(port_state != SCI_PORT_RESETTING);
+ 		port_agent->phy_ready_mask |= 1 << phy_index;
+ 		sci_port_link_up(iport, iphy);
+ 	}
+diff --git a/drivers/scsi/isci/task.c b/drivers/scsi/isci/task.c
+index e294d11..60a530f 100644
+--- a/drivers/scsi/isci/task.c
++++ b/drivers/scsi/isci/task.c
+@@ -1390,7 +1390,7 @@ int isci_task_I_T_nexus_reset(struct domain_device *dev)
+ 	spin_unlock_irqrestore(&ihost->scic_lock, flags);
+ 
+ 	if (!idev || !test_bit(IDEV_EH, &idev->flags)) {
+-		ret = TMF_RESP_FUNC_COMPLETE;
++		ret = -ENODEV;
+ 		goto out;
+ 	}
+ 
+diff --git a/drivers/scsi/qla2xxx/qla_def.h b/drivers/scsi/qla2xxx/qla_def.h
+index fcf052c..c491a94 100644
+--- a/drivers/scsi/qla2xxx/qla_def.h
++++ b/drivers/scsi/qla2xxx/qla_def.h
+@@ -2568,8 +2568,7 @@ struct qla_hw_data {
+ 				IS_QLA25XX(ha) || IS_QLA81XX(ha) || \
+ 				IS_QLA82XX(ha))
+ #define IS_MSIX_NACK_CAPABLE(ha) (IS_QLA81XX(ha))
+-#define IS_NOPOLLING_TYPE(ha)	((IS_QLA25XX(ha) || IS_QLA81XX(ha)) && \
+-				(ha)->flags.msix_enabled)
++#define IS_NOPOLLING_TYPE(ha)	(IS_QLA81XX(ha) && (ha)->flags.msix_enabled)
+ #define IS_FAC_REQUIRED(ha)	(IS_QLA81XX(ha))
+ #define IS_NOCACHE_VPD_TYPE(ha)	(IS_QLA81XX(ha))
+ #define IS_ALOGIO_CAPABLE(ha)	(IS_QLA23XX(ha) || IS_FWI2_CAPABLE(ha))
+diff --git a/drivers/staging/comedi/drivers/adv_pci1710.c b/drivers/staging/comedi/drivers/adv_pci1710.c
+index da2b75b..672538e 100644
+--- a/drivers/staging/comedi/drivers/adv_pci1710.c
++++ b/drivers/staging/comedi/drivers/adv_pci1710.c
+@@ -414,6 +414,7 @@ static int pci171x_insn_write_ao(struct comedi_device *dev,
+ 				 struct comedi_subdevice *s,
+ 				 struct comedi_insn *insn, unsigned int *data)
+ {
++	unsigned int val;
+ 	int n, chan, range, ofs;
+ 
+ 	chan = CR_CHAN(insn->chanspec);
+@@ -429,11 +430,14 @@ static int pci171x_insn_write_ao(struct comedi_device *dev,
+ 		outw(devpriv->da_ranges, dev->iobase + PCI171x_DAREF);
+ 		ofs = PCI171x_DA1;
+ 	}
++	val = devpriv->ao_data[chan];
+ 
+-	for (n = 0; n < insn->n; n++)
+-		outw(data[n], dev->iobase + ofs);
++	for (n = 0; n < insn->n; n++) {
++		val = data[n];
++		outw(val, dev->iobase + ofs);
++	}
+ 
+-	devpriv->ao_data[chan] = data[n];
++	devpriv->ao_data[chan] = val;
+ 
+ 	return n;
+ 
+@@ -582,6 +586,7 @@ static int pci1720_insn_write_ao(struct comedi_device *dev,
+ 				 struct comedi_subdevice *s,
+ 				 struct comedi_insn *insn, unsigned int *data)
+ {
++	unsigned int val;
+ 	int n, rangereg, chan;
+ 
+ 	chan = CR_CHAN(insn->chanspec);
+@@ -591,13 +596,15 @@ static int pci1720_insn_write_ao(struct comedi_device *dev,
+ 		outb(rangereg, dev->iobase + PCI1720_RANGE);
+ 		devpriv->da_ranges = rangereg;
+ 	}
++	val = devpriv->ao_data[chan];
+ 
+ 	for (n = 0; n < insn->n; n++) {
+-		outw(data[n], dev->iobase + PCI1720_DA0 + (chan << 1));
++		val = data[n];
++		outw(val, dev->iobase + PCI1720_DA0 + (chan << 1));
+ 		outb(0, dev->iobase + PCI1720_SYNCOUT);	/*  update outputs */
+ 	}
+ 
+-	devpriv->ao_data[chan] = data[n];
++	devpriv->ao_data[chan] = val;
+ 
+ 	return n;
+ }
+diff --git a/drivers/staging/comedi/drivers/pcmuio.c b/drivers/staging/comedi/drivers/pcmuio.c
+index b2c2c89..6c25bd3 100644
+--- a/drivers/staging/comedi/drivers/pcmuio.c
++++ b/drivers/staging/comedi/drivers/pcmuio.c
+@@ -464,13 +464,13 @@ static int pcmuio_detach(struct comedi_device *dev)
+ 	if (dev->iobase)
+ 		release_region(dev->iobase, ASIC_IOSIZE * thisboard->num_asics);
+ 
+-	for (i = 0; i < MAX_ASICS; ++i) {
+-		if (devpriv->asics[i].irq)
+-			free_irq(devpriv->asics[i].irq, dev);
+-	}
+-
+-	if (devpriv && devpriv->sprivs)
++	if (devpriv) {
++		for (i = 0; i < MAX_ASICS; ++i) {
++			if (devpriv->asics[i].irq)
++				free_irq(devpriv->asics[i].irq, dev);
++		}
+ 		kfree(devpriv->sprivs);
++	}
+ 
+ 	return 0;
+ }
+diff --git a/drivers/staging/comedi/drivers/ssv_dnp.c b/drivers/staging/comedi/drivers/ssv_dnp.c
+index 526de2e..0316780 100644
+--- a/drivers/staging/comedi/drivers/ssv_dnp.c
++++ b/drivers/staging/comedi/drivers/ssv_dnp.c
+@@ -251,11 +251,11 @@ static int dnp_dio_insn_bits(struct comedi_device *dev,
+ 
+ 	/* on return, data[1] contains the value of the digital input lines. */
+ 	outb(PADR, CSCIR);
+-	data[0] = inb(CSCDR);
++	data[1] = inb(CSCDR);
+ 	outb(PBDR, CSCIR);
+-	data[0] += inb(CSCDR) << 8;
++	data[1] += inb(CSCDR) << 8;
+ 	outb(PCDR, CSCIR);
+-	data[0] += ((inb(CSCDR) & 0xF0) << 12);
++	data[1] += ((inb(CSCDR) & 0xF0) << 12);
+ 
+ 	return 2;
+ 
+diff --git a/drivers/staging/iio/adc/ad799x_core.c b/drivers/staging/iio/adc/ad799x_core.c
+index ee6cd79..f79d0cb 100644
+--- a/drivers/staging/iio/adc/ad799x_core.c
++++ b/drivers/staging/iio/adc/ad799x_core.c
+@@ -873,7 +873,8 @@ static int __devinit ad799x_probe(struct i2c_client *client,
+ 	return 0;
+ 
+ error_free_irq:
+-	free_irq(client->irq, indio_dev);
++	if (client->irq > 0)
++		free_irq(client->irq, indio_dev);
+ error_cleanup_ring:
+ 	ad799x_ring_cleanup(indio_dev);
+ error_disable_reg:
+diff --git a/drivers/staging/rtl8712/usb_intf.c b/drivers/staging/rtl8712/usb_intf.c
+index 88d1d35..a74e83d 100644
+--- a/drivers/staging/rtl8712/usb_intf.c
++++ b/drivers/staging/rtl8712/usb_intf.c
+@@ -363,6 +363,10 @@ static u8 key_2char2num(u8 hch, u8 lch)
+ 	return (hex_to_bin(hch) << 4) | hex_to_bin(lch);
+ }
+ 
++static const struct device_type wlan_type = {
++	.name = "wlan",
++};
++
+ /*
+  * drv_init() - a device potentially for us
+  *
+@@ -398,6 +402,7 @@ static int r871xu_drv_init(struct usb_interface *pusb_intf,
+ 	padapter->pusb_intf = pusb_intf;
+ 	usb_set_intfdata(pusb_intf, pnetdev);
+ 	SET_NETDEV_DEV(pnetdev, &pusb_intf->dev);
++	pnetdev->dev.type = &wlan_type;
+ 	/* step 2. */
+ 	padapter->dvobj_init = &r8712_usb_dvobj_init;
+ 	padapter->dvobj_deinit = &r8712_usb_dvobj_deinit;
+diff --git a/drivers/staging/vt6656/baseband.c b/drivers/staging/vt6656/baseband.c
+index 0d11147..59cf674 100644
+--- a/drivers/staging/vt6656/baseband.c
++++ b/drivers/staging/vt6656/baseband.c
+@@ -1656,7 +1656,6 @@ BBvUpdatePreEDThreshold(
+ 
+             if( bScanning )
+             {   // need Max sensitivity //RSSI -69, -70,....
+-                if(pDevice->byBBPreEDIndex == 0) break;
+                 pDevice->byBBPreEDIndex = 0;
+                 ControlvWriteByte(pDevice, MESSAGE_REQUEST_BBREG, 0xC9, 0x00); //CR201(0xC9)
+                 ControlvWriteByte(pDevice, MESSAGE_REQUEST_BBREG, 0xCE, 0x30); //CR206(0xCE)
+@@ -1799,7 +1798,6 @@ BBvUpdatePreEDThreshold(
+ 
+             if( bScanning )
+             {   // need Max sensitivity  //RSSI -69, -70, ...
+-                if(pDevice->byBBPreEDIndex == 0) break;
+                 pDevice->byBBPreEDIndex = 0;
+                 ControlvWriteByte(pDevice, MESSAGE_REQUEST_BBREG, 0xC9, 0x00); //CR201(0xC9)
+                 ControlvWriteByte(pDevice, MESSAGE_REQUEST_BBREG, 0xCE, 0x24); //CR206(0xCE)
+@@ -1951,7 +1949,6 @@ BBvUpdatePreEDThreshold(
+         case RF_VT3342A0: //RobertYu:20060627, testing table
+             if( bScanning )
+             {   // need Max sensitivity  //RSSI -67, -68, ...
+-                if(pDevice->byBBPreEDIndex == 0) break;
+                 pDevice->byBBPreEDIndex = 0;
+                 ControlvWriteByte(pDevice, MESSAGE_REQUEST_BBREG, 0xC9, 0x00); //CR201(0xC9)
+                 ControlvWriteByte(pDevice, MESSAGE_REQUEST_BBREG, 0xCE, 0x38); //CR206(0xCE)
+diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c
+index 45c13a6..4a88eea 100644
+--- a/drivers/target/iscsi/iscsi_target.c
++++ b/drivers/target/iscsi/iscsi_target.c
+@@ -50,7 +50,7 @@
+ static LIST_HEAD(g_tiqn_list);
+ static LIST_HEAD(g_np_list);
+ static DEFINE_SPINLOCK(tiqn_lock);
+-static DEFINE_SPINLOCK(np_lock);
++static DEFINE_MUTEX(np_lock);
+ 
+ static struct idr tiqn_idr;
+ struct idr sess_idr;
+@@ -262,6 +262,9 @@ int iscsit_deaccess_np(struct iscsi_np *np, struct iscsi_portal_group *tpg)
+ 	return 0;
+ }
+ 
++/*
++ * Called with mutex np_lock held
++ */
+ static struct iscsi_np *iscsit_get_np(
+ 	struct __kernel_sockaddr_storage *sockaddr,
+ 	int network_transport)
+@@ -272,11 +275,10 @@ static struct iscsi_np *iscsit_get_np(
+ 	int ip_match = 0;
+ 	u16 port;
+ 
+-	spin_lock_bh(&np_lock);
+ 	list_for_each_entry(np, &g_np_list, np_list) {
+-		spin_lock(&np->np_thread_lock);
++		spin_lock_bh(&np->np_thread_lock);
+ 		if (np->np_thread_state != ISCSI_NP_THREAD_ACTIVE) {
+-			spin_unlock(&np->np_thread_lock);
++			spin_unlock_bh(&np->np_thread_lock);
+ 			continue;
+ 		}
+ 
+@@ -309,13 +311,11 @@ static struct iscsi_np *iscsit_get_np(
+ 			 * while iscsi_tpg_add_network_portal() is called.
+ 			 */
+ 			np->np_exports++;
+-			spin_unlock(&np->np_thread_lock);
+-			spin_unlock_bh(&np_lock);
++			spin_unlock_bh(&np->np_thread_lock);
+ 			return np;
+ 		}
+-		spin_unlock(&np->np_thread_lock);
++		spin_unlock_bh(&np->np_thread_lock);
+ 	}
+-	spin_unlock_bh(&np_lock);
+ 
+ 	return NULL;
+ }
+@@ -329,16 +329,22 @@ struct iscsi_np *iscsit_add_np(
+ 	struct sockaddr_in6 *sock_in6;
+ 	struct iscsi_np *np;
+ 	int ret;
++
++	mutex_lock(&np_lock);
++
+ 	/*
+ 	 * Locate the existing struct iscsi_np if already active..
+ 	 */
+ 	np = iscsit_get_np(sockaddr, network_transport);
+-	if (np)
++	if (np) {
++		mutex_unlock(&np_lock);
+ 		return np;
++	}
+ 
+ 	np = kzalloc(sizeof(struct iscsi_np), GFP_KERNEL);
+ 	if (!np) {
+ 		pr_err("Unable to allocate memory for struct iscsi_np\n");
++		mutex_unlock(&np_lock);
+ 		return ERR_PTR(-ENOMEM);
+ 	}
+ 
+@@ -361,6 +367,7 @@ struct iscsi_np *iscsit_add_np(
+ 	ret = iscsi_target_setup_login_socket(np, sockaddr);
+ 	if (ret != 0) {
+ 		kfree(np);
++		mutex_unlock(&np_lock);
+ 		return ERR_PTR(ret);
+ 	}
+ 
+@@ -369,6 +376,7 @@ struct iscsi_np *iscsit_add_np(
+ 		pr_err("Unable to create kthread: iscsi_np\n");
+ 		ret = PTR_ERR(np->np_thread);
+ 		kfree(np);
++		mutex_unlock(&np_lock);
+ 		return ERR_PTR(ret);
+ 	}
+ 	/*
+@@ -379,10 +387,10 @@ struct iscsi_np *iscsit_add_np(
+ 	 * point because iscsi_np has not been added to g_np_list yet.
+ 	 */
+ 	np->np_exports = 1;
++	np->np_thread_state = ISCSI_NP_THREAD_ACTIVE;
+ 
+-	spin_lock_bh(&np_lock);
+ 	list_add_tail(&np->np_list, &g_np_list);
+-	spin_unlock_bh(&np_lock);
++	mutex_unlock(&np_lock);
+ 
+ 	pr_debug("CORE[0] - Added Network Portal: %s:%hu on %s\n",
+ 		np->np_ip, np->np_port, (np->np_network_transport == ISCSI_TCP) ?
+@@ -453,9 +461,9 @@ int iscsit_del_np(struct iscsi_np *np)
+ 	}
+ 	iscsit_del_np_comm(np);
+ 
+-	spin_lock_bh(&np_lock);
++	mutex_lock(&np_lock);
+ 	list_del(&np->np_list);
+-	spin_unlock_bh(&np_lock);
++	mutex_unlock(&np_lock);
+ 
+ 	pr_debug("CORE[0] - Removed Network Portal: %s:%hu on %s\n",
+ 		np->np_ip, np->np_port, (np->np_network_transport == ISCSI_TCP) ?
+diff --git a/drivers/tty/n_gsm.c b/drivers/tty/n_gsm.c
+index d190269..643a0a0 100644
+--- a/drivers/tty/n_gsm.c
++++ b/drivers/tty/n_gsm.c
+@@ -1090,6 +1090,7 @@ static void gsm_control_modem(struct gsm_mux *gsm, u8 *data, int clen)
+ {
+ 	unsigned int addr = 0;
+ 	unsigned int modem = 0;
++	unsigned int brk = 0;
+ 	struct gsm_dlci *dlci;
+ 	int len = clen;
+ 	u8 *dp = data;
+@@ -1116,6 +1117,16 @@ static void gsm_control_modem(struct gsm_mux *gsm, u8 *data, int clen)
+ 		if (len == 0)
+ 			return;
+ 	}
++	len--;
++	if (len > 0) {
++		while (gsm_read_ea(&brk, *dp++) == 0) {
++			len--;
++			if (len == 0)
++				return;
++		}
++		modem <<= 7;
++		modem |= (brk & 0x7f);
++	}
+ 	tty = tty_port_tty_get(&dlci->port);
+ 	gsm_process_modem(tty, dlci, modem, clen);
+ 	if (tty) {
+diff --git a/drivers/tty/serial/8250.c b/drivers/tty/serial/8250.c
+index cff03e5..33601f8 100644
+--- a/drivers/tty/serial/8250.c
++++ b/drivers/tty/serial/8250.c
+@@ -2701,6 +2701,10 @@ static void serial8250_config_port(struct uart_port *port, int flags)
+ 	if (up->port.type == PORT_16550A && up->port.iotype == UPIO_AU)
+ 		up->bugs |= UART_BUG_NOMSR;
+ 
++	/* HW bugs may trigger IRQ while IIR == NO_INT */
++	if (up->port.type == PORT_TEGRA)
++		up->bugs |= UART_BUG_NOMSR;
++
+ 	if (up->port.type != PORT_UNKNOWN && flags & UART_CONFIG_IRQ)
+ 		autoconfig_irq(up);
+ 
+diff --git a/drivers/tty/serial/8250_pci.c b/drivers/tty/serial/8250_pci.c
+index 6c9bcdf..ef24e96 100644
+--- a/drivers/tty/serial/8250_pci.c
++++ b/drivers/tty/serial/8250_pci.c
+@@ -1147,6 +1147,11 @@ pci_xr17c154_setup(struct serial_private *priv,
+ #define PCI_DEVICE_ID_TITAN_800E	0xA014
+ #define PCI_DEVICE_ID_TITAN_200EI	0xA016
+ #define PCI_DEVICE_ID_TITAN_200EISI	0xA017
++#define PCI_DEVICE_ID_TITAN_200V3	0xA306
++#define PCI_DEVICE_ID_TITAN_400V3	0xA310
++#define PCI_DEVICE_ID_TITAN_410V3	0xA312
++#define PCI_DEVICE_ID_TITAN_800V3	0xA314
++#define PCI_DEVICE_ID_TITAN_800V3B	0xA315
+ #define PCI_DEVICE_ID_OXSEMI_16PCI958	0x9538
+ #define PCIE_DEVICE_ID_NEO_2_OX_IBM	0x00F6
+ #define PCI_DEVICE_ID_PLX_CRONYX_OMEGA	0xc001
+@@ -3465,6 +3470,21 @@ static struct pci_device_id serial_pci_tbl[] = {
+ 	{	PCI_VENDOR_ID_TITAN, PCI_DEVICE_ID_TITAN_200EISI,
+ 		PCI_ANY_ID, PCI_ANY_ID, 0, 0,
+ 		pbn_oxsemi_2_4000000 },
++	{	PCI_VENDOR_ID_TITAN, PCI_DEVICE_ID_TITAN_200V3,
++		PCI_ANY_ID, PCI_ANY_ID, 0, 0,
++		pbn_b0_bt_2_921600 },
++	{	PCI_VENDOR_ID_TITAN, PCI_DEVICE_ID_TITAN_400V3,
++		PCI_ANY_ID, PCI_ANY_ID, 0, 0,
++		pbn_b0_4_921600 },
++	{	PCI_VENDOR_ID_TITAN, PCI_DEVICE_ID_TITAN_410V3,
++		PCI_ANY_ID, PCI_ANY_ID, 0, 0,
++		pbn_b0_4_921600 },
++	{	PCI_VENDOR_ID_TITAN, PCI_DEVICE_ID_TITAN_800V3,
++		PCI_ANY_ID, PCI_ANY_ID, 0, 0,
++		pbn_b0_4_921600 },
++	{	PCI_VENDOR_ID_TITAN, PCI_DEVICE_ID_TITAN_800V3B,
++		PCI_ANY_ID, PCI_ANY_ID, 0, 0,
++		pbn_b0_4_921600 },
+ 
+ 	{	PCI_VENDOR_ID_SIIG, PCI_DEVICE_ID_SIIG_1S_10x_550,
+ 		PCI_ANY_ID, PCI_ANY_ID, 0, 0,
+diff --git a/drivers/tty/serial/pmac_zilog.c b/drivers/tty/serial/pmac_zilog.c
+index 086f7fe..a6caf62 100644
+--- a/drivers/tty/serial/pmac_zilog.c
++++ b/drivers/tty/serial/pmac_zilog.c
+@@ -2198,6 +2198,9 @@ static int __init pmz_console_init(void)
+ 	/* Probe ports */
+ 	pmz_probe();
+ 
++	if (pmz_ports_count == 0)
++		return -ENODEV;
++
+ 	/* TODO: Autoprobe console based on OF */
+ 	/* pmz_console.index = i; */
+ 	register_console(&pmz_console);
+diff --git a/drivers/usb/core/config.c b/drivers/usb/core/config.c
+index 78609d3..1e3e211 100644
+--- a/drivers/usb/core/config.c
++++ b/drivers/usb/core/config.c
+@@ -722,6 +722,10 @@ int usb_get_configuration(struct usb_device *dev)
+ 			result = -ENOMEM;
+ 			goto err;
+ 		}
++
++		if (dev->quirks & USB_QUIRK_DELAY_INIT)
++			msleep(100);
++
+ 		result = usb_get_descriptor(dev, USB_DT_CONFIG, cfgno,
+ 		    bigbuffer, length);
+ 		if (result < 0) {
+diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c
+index bcde6f6..3677d22 100644
+--- a/drivers/usb/core/quirks.c
++++ b/drivers/usb/core/quirks.c
+@@ -46,6 +46,10 @@ static const struct usb_device_id usb_quirk_list[] = {
+ 	/* Microsoft LifeCam-VX700 v2.0 */
+ 	{ USB_DEVICE(0x045e, 0x0770), .driver_info = USB_QUIRK_RESET_RESUME },
+ 
++	/* Logitech HD Pro Webcams C920 and C930e */
++	{ USB_DEVICE(0x046d, 0x082d), .driver_info = USB_QUIRK_DELAY_INIT },
++	{ USB_DEVICE(0x046d, 0x0843), .driver_info = USB_QUIRK_DELAY_INIT },
++
+ 	/* Logitech Quickcam Fusion */
+ 	{ USB_DEVICE(0x046d, 0x08c1), .driver_info = USB_QUIRK_RESET_RESUME },
+ 
+diff --git a/drivers/usb/host/ehci-hcd.c b/drivers/usb/host/ehci-hcd.c
+index 339be10..2abdad6 100644
+--- a/drivers/usb/host/ehci-hcd.c
++++ b/drivers/usb/host/ehci-hcd.c
+@@ -807,8 +807,15 @@ static irqreturn_t ehci_irq (struct usb_hcd *hcd)
+ 	struct ehci_hcd		*ehci = hcd_to_ehci (hcd);
+ 	u32			status, masked_status, pcd_status = 0, cmd;
+ 	int			bh;
++	unsigned long		flags;
+ 
+-	spin_lock (&ehci->lock);
++	/*
++	 * For threadirqs option we use spin_lock_irqsave() variant to prevent
++	 * deadlock with ehci hrtimer callback, because hrtimer callbacks run
++	 * in interrupt context even when threadirqs is specified. We can go
++	 * back to spin_lock() variant when hrtimer callbacks become threaded.
++	 */
++	spin_lock_irqsave(&ehci->lock, flags);
+ 
+ 	status = ehci_readl(ehci, &ehci->regs->status);
+ 
+@@ -826,7 +833,7 @@ static irqreturn_t ehci_irq (struct usb_hcd *hcd)
+ 
+ 	/* Shared IRQ? */
+ 	if (!masked_status || unlikely(ehci->rh_state == EHCI_RH_HALTED)) {
+-		spin_unlock(&ehci->lock);
++		spin_unlock_irqrestore(&ehci->lock, flags);
+ 		return IRQ_NONE;
+ 	}
+ 
+@@ -929,7 +936,7 @@ dead:
+ 
+ 	if (bh)
+ 		ehci_work (ehci);
+-	spin_unlock (&ehci->lock);
++	spin_unlock_irqrestore(&ehci->lock, flags);
+ 	if (pcd_status)
+ 		usb_hcd_poll_rh_status(hcd);
+ 	return IRQ_HANDLED;
+diff --git a/drivers/usb/host/ehci-hub.c b/drivers/usb/host/ehci-hub.c
+index 77bbb23..4527b90 100644
+--- a/drivers/usb/host/ehci-hub.c
++++ b/drivers/usb/host/ehci-hub.c
+@@ -207,6 +207,7 @@ static int ehci_bus_suspend (struct usb_hcd *hcd)
+ 	int			port;
+ 	int			mask;
+ 	int			changed;
++	bool			fs_idle_delay;
+ 
+ 	ehci_dbg(ehci, "suspend root hub\n");
+ 
+@@ -249,6 +250,7 @@ static int ehci_bus_suspend (struct usb_hcd *hcd)
+ 	ehci->bus_suspended = 0;
+ 	ehci->owned_ports = 0;
+ 	changed = 0;
++	fs_idle_delay = false;
+ 	port = HCS_N_PORTS(ehci->hcs_params);
+ 	while (port--) {
+ 		u32 __iomem	*reg = &ehci->regs->port_status [port];
+@@ -279,16 +281,34 @@ static int ehci_bus_suspend (struct usb_hcd *hcd)
+ 		if (t1 != t2) {
+ 			ehci_vdbg (ehci, "port %d, %08x -> %08x\n",
+ 				port + 1, t1, t2);
++			/*
++			 * On some controllers, Wake-On-Disconnect will
++			 * generate false wakeup signals until the bus
++			 * switches over to full-speed idle.  For their
++			 * sake, add a delay if we need one.
++			 */
++			if ((t2 & PORT_WKDISC_E) &&
++					ehci_port_speed(ehci, t2) ==
++						USB_PORT_STAT_HIGH_SPEED)
++				fs_idle_delay = true;
+ 			ehci_writel(ehci, t2, reg);
+ 			changed = 1;
+ 		}
+ 	}
++	spin_unlock_irq(&ehci->lock);
++
++	if ((changed && ehci->has_hostpc) || fs_idle_delay) {
++		/*
++		 * Wait for HCD to enter low-power mode or for the bus
++		 * to switch to full-speed idle.
++		 */
++		usleep_range(5000, 5500);
++	}
++
++	spin_lock_irq(&ehci->lock);
+ 
+ 	if (changed && ehci->has_hostpc) {
+-		spin_unlock_irq(&ehci->lock);
+-		msleep(5);	/* 5 ms for HCD to enter low-power mode */
+ 		spin_lock_irq(&ehci->lock);
+-
+ 		port = HCS_N_PORTS(ehci->hcs_params);
+ 		while (port--) {
+ 			u32 __iomem	*hostpc_reg;
+diff --git a/drivers/usb/host/ehci.h b/drivers/usb/host/ehci.h
+index 0a5fda7..b65912d 100644
+--- a/drivers/usb/host/ehci.h
++++ b/drivers/usb/host/ehci.h
+@@ -147,6 +147,7 @@ struct ehci_hcd {			/* one per controller */
+ 	unsigned		use_dummy_qh:1;	/* AMD Frame List table quirk*/
+ 	unsigned		has_synopsys_hc_bug:1; /* Synopsys HC */
+ 	unsigned		frame_index_bug:1; /* MosChip (AKA NetMos) */
++	unsigned		imx28_write_fix:1; /* For Freescale i.MX28 */
+ 
+ 	/* required for usb32 quirk */
+ 	#define OHCI_CTRL_HCFS          (3 << 6)
+@@ -654,6 +655,18 @@ static inline unsigned int ehci_readl(const struct ehci_hcd *ehci,
+ #endif
+ }
+ 
++#ifdef CONFIG_SOC_IMX28
++static inline void imx28_ehci_writel(const unsigned int val,
++		volatile __u32 __iomem *addr)
++{
++	__asm__ ("swp %0, %0, [%1]" : : "r"(val), "r"(addr));
++}
++#else
++static inline void imx28_ehci_writel(const unsigned int val,
++		volatile __u32 __iomem *addr)
++{
++}
++#endif
+ static inline void ehci_writel(const struct ehci_hcd *ehci,
+ 		const unsigned int val, __u32 __iomem *regs)
+ {
+@@ -662,7 +675,10 @@ static inline void ehci_writel(const struct ehci_hcd *ehci,
+ 		writel_be(val, regs) :
+ 		writel(val, regs);
+ #else
+-	writel(val, regs);
++	if (ehci->imx28_write_fix)
++		imx28_ehci_writel(val, regs);
++	else
++		writel(val, regs);
+ #endif
+ }
+ 
+diff --git a/drivers/usb/serial/cypress_m8.h b/drivers/usb/serial/cypress_m8.h
+index b461311..ce13e61 100644
+--- a/drivers/usb/serial/cypress_m8.h
++++ b/drivers/usb/serial/cypress_m8.h
+@@ -63,7 +63,7 @@
+ #define UART_DSR	0x20	/* data set ready - flow control - device to host */
+ #define CONTROL_RTS	0x10	/* request to send - flow control - host to device */
+ #define UART_CTS	0x10	/* clear to send - flow control - device to host */
+-#define UART_RI		0x10	/* ring indicator - modem - device to host */
++#define UART_RI		0x80	/* ring indicator - modem - device to host */
+ #define UART_CD		0x40	/* carrier detect - modem - device to host */
+ #define CYP_ERROR	0x08	/* received from input report - device to host */
+ /* Note - the below has nothing to do with the "feature report" reset */
+diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
+index 85504bb..5c97d9f 100644
+--- a/drivers/usb/serial/ftdi_sio.c
++++ b/drivers/usb/serial/ftdi_sio.c
+@@ -163,6 +163,7 @@ static struct usb_device_id id_table_combined [] = {
+ 	{ USB_DEVICE(FTDI_VID, FTDI_CANUSB_PID) },
+ 	{ USB_DEVICE(FTDI_VID, FTDI_CANDAPTER_PID) },
+ 	{ USB_DEVICE(FTDI_VID, FTDI_NXTCAM_PID) },
++	{ USB_DEVICE(FTDI_VID, FTDI_EV3CON_PID) },
+ 	{ USB_DEVICE(FTDI_VID, FTDI_SCS_DEVICE_0_PID) },
+ 	{ USB_DEVICE(FTDI_VID, FTDI_SCS_DEVICE_1_PID) },
+ 	{ USB_DEVICE(FTDI_VID, FTDI_SCS_DEVICE_2_PID) },
+@@ -202,6 +203,8 @@ static struct usb_device_id id_table_combined [] = {
+ 	{ USB_DEVICE(INTERBIOMETRICS_VID, INTERBIOMETRICS_IOBOARD_PID) },
+ 	{ USB_DEVICE(INTERBIOMETRICS_VID, INTERBIOMETRICS_MINI_IOBOARD_PID) },
+ 	{ USB_DEVICE(FTDI_VID, FTDI_SPROG_II) },
++	{ USB_DEVICE(FTDI_VID, FTDI_TAGSYS_LP101_PID) },
++	{ USB_DEVICE(FTDI_VID, FTDI_TAGSYS_P200X_PID) },
+ 	{ USB_DEVICE(FTDI_VID, FTDI_LENZ_LIUSB_PID) },
+ 	{ USB_DEVICE(FTDI_VID, FTDI_XF_632_PID) },
+ 	{ USB_DEVICE(FTDI_VID, FTDI_XF_634_PID) },
+@@ -914,6 +917,9 @@ static struct usb_device_id id_table_combined [] = {
+ 	{ USB_DEVICE(FTDI_VID, FTDI_LUMEL_PD12_PID) },
+ 	/* Crucible Devices */
+ 	{ USB_DEVICE(FTDI_VID, FTDI_CT_COMET_PID) },
++	{ USB_DEVICE(FTDI_VID, FTDI_Z3X_PID) },
++	/* Cressi Devices */
++	{ USB_DEVICE(FTDI_VID, FTDI_CRESSI_PID) },
+ 	{ },					/* Optional parameter entry */
+ 	{ }					/* Terminating entry */
+ };
+@@ -2193,10 +2199,20 @@ static void ftdi_set_termios(struct tty_struct *tty,
+ 	}
+ 
+ 	/*
+-	 * All FTDI UART chips are limited to CS7/8. We won't pretend to
++	 * All FTDI UART chips are limited to CS7/8. We shouldn't pretend to
+ 	 * support CS5/6 and revert the CSIZE setting instead.
++	 *
++	 * CS5 however is used to control some smartcard readers which abuse
++	 * this limitation to switch modes. Original FTDI chips fall back to
++	 * eight data bits.
++	 *
++	 * TODO: Implement a quirk to only allow this with mentioned
++	 *       readers. One I know of (Argolis Smartreader V1)
++	 *       returns "USB smartcard server" as iInterface string.
++	 *       The vendor didn't bother with a custom VID/PID of
++	 *       course.
+ 	 */
+-	if ((C_CSIZE(tty) != CS8) && (C_CSIZE(tty) != CS7)) {
++	if (C_CSIZE(tty) == CS6) {
+ 		dev_warn(&port->dev, "requested CSIZE setting not supported\n");
+ 
+ 		termios->c_cflag &= ~CSIZE;
+@@ -2243,6 +2259,9 @@ no_skip:
+ 		urb_value |= FTDI_SIO_SET_DATA_PARITY_NONE;
+ 	}
+ 	switch (cflag & CSIZE) {
++	case CS5:
++		dev_dbg(&port->dev, "Setting CS5 quirk\n");
++		break;
+ 	case CS7:
+ 		urb_value |= 7;
+ 		dev_dbg(&port->dev, "Setting CS7\n");
+diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h
+index 61685ed..71fe2de 100644
+--- a/drivers/usb/serial/ftdi_sio_ids.h
++++ b/drivers/usb/serial/ftdi_sio_ids.h
+@@ -50,6 +50,7 @@
+ #define TI_XDS100V2_PID		0xa6d0
+ 
+ #define FTDI_NXTCAM_PID		0xABB8 /* NXTCam for Mindstorms NXT */
++#define FTDI_EV3CON_PID		0xABB9 /* Mindstorms EV3 Console Adapter */
+ 
+ /* US Interface Navigator (http://www.usinterface.com/) */
+ #define FTDI_USINT_CAT_PID	0xb810	/* Navigator CAT and 2nd PTT lines */
+@@ -363,6 +364,12 @@
+ /* Sprog II (Andrew Crosland's SprogII DCC interface) */
+ #define FTDI_SPROG_II		0xF0C8
+ 
++/*
++ * Two of the Tagsys RFID Readers
++ */
++#define FTDI_TAGSYS_LP101_PID	0xF0E9	/* Tagsys L-P101 RFID*/
++#define FTDI_TAGSYS_P200X_PID	0xF0EE	/* Tagsys Medio P200x RFID*/
++
+ /* an infrared receiver for user access control with IR tags */
+ #define FTDI_PIEGROUP_PID	0xF208	/* Product Id */
+ 
+@@ -1307,3 +1314,15 @@
+  * Manufacturer: Crucible Technologies
+  */
+ #define FTDI_CT_COMET_PID	0x8e08
++
++/*
++ * Product: Z3X Box
++ * Manufacturer: Smart GSM Team
++ */
++#define FTDI_Z3X_PID		0x0011
++
++/*
++ * Product: Cressi PC Interface
++ * Manufacturer: Cressi
++ */
++#define FTDI_CRESSI_PID		0x87d0
+diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
+index d6d0fb4..5f5047f 100644
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -325,6 +325,9 @@ static void option_instat_callback(struct urb *urb);
+  * It seems to contain a Qualcomm QSC6240/6290 chipset            */
+ #define FOUR_G_SYSTEMS_PRODUCT_W14		0x9603
+ 
++/* iBall 3.5G connect wireless modem */
++#define IBALL_3_5G_CONNECT			0x9605
++
+ /* Zoom */
+ #define ZOOM_PRODUCT_4597			0x9607
+ 
+@@ -1373,7 +1376,8 @@ static const struct usb_device_id option_ids[] = {
+ 	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1267, 0xff, 0xff, 0xff) },
+ 	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1268, 0xff, 0xff, 0xff) },
+ 	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1269, 0xff, 0xff, 0xff) },
+-	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1270, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1270, 0xff, 0xff, 0xff),
++	  .driver_info = (kernel_ulong_t)&net_intf5_blacklist },
+ 	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1271, 0xff, 0xff, 0xff) },
+ 	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1272, 0xff, 0xff, 0xff) },
+ 	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1273, 0xff, 0xff, 0xff) },
+@@ -1461,6 +1465,17 @@ static const struct usb_device_id option_ids[] = {
+ 		.driver_info = (kernel_ulong_t)&net_intf3_blacklist },
+ 	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0178, 0xff, 0xff, 0xff),
+ 		.driver_info = (kernel_ulong_t)&net_intf3_blacklist },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffe9, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff8b, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff8c, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff8d, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff8e, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff8f, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff90, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff91, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff92, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff93, 0xff, 0xff, 0xff) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff94, 0xff, 0xff, 0xff) },
+ 
+ 	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_CDMA_TECH, 0xff, 0xff, 0xff) },
+ 	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_AC8710, 0xff, 0xff, 0xff) },
+@@ -1509,6 +1524,7 @@ static const struct usb_device_id option_ids[] = {
+   	  .driver_info = (kernel_ulong_t)&four_g_w14_blacklist
+   	},
+ 	{ USB_DEVICE(LONGCHEER_VENDOR_ID, ZOOM_PRODUCT_4597) },
++	{ USB_DEVICE(LONGCHEER_VENDOR_ID, IBALL_3_5G_CONNECT) },
+ 	{ USB_DEVICE(HAIER_VENDOR_ID, HAIER_PRODUCT_CE100) },
+ 	/* Pirelli  */
+ 	{ USB_DEVICE(PIRELLI_VENDOR_ID, PIRELLI_PRODUCT_C100_1)},
+@@ -1530,7 +1546,8 @@ static const struct usb_device_id option_ids[] = {
+ 	/* Cinterion */
+ 	{ USB_DEVICE(CINTERION_VENDOR_ID, CINTERION_PRODUCT_EU3_E) },
+ 	{ USB_DEVICE(CINTERION_VENDOR_ID, CINTERION_PRODUCT_EU3_P) },
+-	{ USB_DEVICE(CINTERION_VENDOR_ID, CINTERION_PRODUCT_PH8) },
++	{ USB_DEVICE(CINTERION_VENDOR_ID, CINTERION_PRODUCT_PH8),
++		.driver_info = (kernel_ulong_t)&net_intf4_blacklist },
+ 	{ USB_DEVICE(CINTERION_VENDOR_ID, CINTERION_PRODUCT_AHXX) },
+ 	{ USB_DEVICE(CINTERION_VENDOR_ID, CINTERION_PRODUCT_PLXX),
+ 		.driver_info = (kernel_ulong_t)&net_intf4_blacklist },
+diff --git a/drivers/usb/serial/pl2303.c b/drivers/usb/serial/pl2303.c
+index e3936c1..7b29317 100644
+--- a/drivers/usb/serial/pl2303.c
++++ b/drivers/usb/serial/pl2303.c
+@@ -153,6 +153,8 @@ struct pl2303_private {
+ 	u8 line_control;
+ 	u8 line_status;
+ 	enum pl2303_type type;
++
++	u8 line_settings[7];
+ };
+ 
+ static int pl2303_vendor_read(__u16 value, __u16 index,
+@@ -266,10 +268,6 @@ static void pl2303_set_termios(struct tty_struct *tty,
+ 
+ 	dbg("%s -  port %d", __func__, port->number);
+ 
+-	/* The PL2303 is reported to lose bytes if you change
+-	   serial settings even to the same values as before. Thus
+-	   we actually need to filter in this specific case */
+-
+ 	if (old_termios && !tty_termios_hw_change(tty->termios, old_termios))
+ 		return;
+ 
+@@ -407,10 +405,29 @@ static void pl2303_set_termios(struct tty_struct *tty,
+ 		dbg("%s - parity = none", __func__);
+ 	}
+ 
+-	i = usb_control_msg(serial->dev, usb_sndctrlpipe(serial->dev, 0),
+-			    SET_LINE_REQUEST, SET_LINE_REQUEST_TYPE,
+-			    0, 0, buf, 7, 100);
+-	dbg("0x21:0x20:0:0  %d", i);
++	/*
++	 * Some PL2303 are known to lose bytes if you change serial settings
++	 * even to the same values as before. Thus we actually need to filter
++	 * in this specific case.
++	 *
++	 * Note that the tty_termios_hw_change check above is not sufficient
++	 * as a previously requested baud rate may differ from the one
++	 * actually used (and stored in old_termios).
++	 *
++	 * NOTE: No additional locking needed for line_settings as it is
++	 *       only used in set_termios, which is serialised against itself.
++	 */
++	if (!old_termios || memcmp(buf, priv->line_settings, 7)) {
++		i = usb_control_msg(serial->dev,
++				    usb_sndctrlpipe(serial->dev, 0),
++				    SET_LINE_REQUEST, SET_LINE_REQUEST_TYPE,
++				    0, 0, buf, 7, 100);
++
++		dbg("0x21:0x20:0:0  %d", i);
++
++		if (i == 7)
++			memcpy(priv->line_settings, buf, 7);
++	}
+ 
+ 	/* change control lines if we are switching to or from B0 */
+ 	spin_lock_irqsave(&priv->lock, flags);
+diff --git a/drivers/usb/storage/Kconfig b/drivers/usb/storage/Kconfig
+index 303c34b..3460ee8 100644
+--- a/drivers/usb/storage/Kconfig
++++ b/drivers/usb/storage/Kconfig
+@@ -19,7 +19,9 @@ config USB_STORAGE
+ 
+ 	  This option depends on 'SCSI' support being enabled, but you
+ 	  probably also need 'SCSI device support: SCSI disk support'
+-	  (BLK_DEV_SD) for most USB storage devices.
++	  (BLK_DEV_SD) for most USB storage devices.  Some devices also
++	  will require 'Probe all LUNs on each SCSI device'
++	  (SCSI_MULTI_LUN).
+ 
+ 	  To compile this driver as a module, choose M here: the
+ 	  module will be called usb-storage.
+diff --git a/drivers/usb/storage/scsiglue.c b/drivers/usb/storage/scsiglue.c
+index 13b8bcd..eb660bb 100644
+--- a/drivers/usb/storage/scsiglue.c
++++ b/drivers/usb/storage/scsiglue.c
+@@ -116,6 +116,10 @@ static int slave_alloc (struct scsi_device *sdev)
+ 	if (us->subclass == USB_SC_UFI)
+ 		sdev->sdev_target->pdt_1f_for_no_lun = 1;
+ 
++	/* Tell the SCSI layer if we know there is more than one LUN */
++	if (us->protocol == USB_PR_BULK && us->max_lun > 0)
++		sdev->sdev_bflags |= BLIST_FORCELUN;
++
+ 	return 0;
+ }
+ 
+diff --git a/drivers/usb/storage/unusual_cypress.h b/drivers/usb/storage/unusual_cypress.h
+index 65a6a75..82e8ed0 100644
+--- a/drivers/usb/storage/unusual_cypress.h
++++ b/drivers/usb/storage/unusual_cypress.h
+@@ -31,7 +31,7 @@ UNUSUAL_DEV(  0x04b4, 0x6831, 0x0000, 0x9999,
+ 		"Cypress ISD-300LP",
+ 		USB_SC_CYP_ATACB, USB_PR_DEVICE, NULL, 0),
+ 
+-UNUSUAL_DEV( 0x14cd, 0x6116, 0x0000, 0x0219,
++UNUSUAL_DEV( 0x14cd, 0x6116, 0x0160, 0x0160,
+ 		"Super Top",
+ 		"USB 2.0  SATA BRIDGE",
+ 		USB_SC_CYP_ATACB, USB_PR_DEVICE, NULL, 0),
+diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h
+index 8a3b531..08711bc 100644
+--- a/drivers/usb/storage/unusual_devs.h
++++ b/drivers/usb/storage/unusual_devs.h
+@@ -226,6 +226,13 @@ UNUSUAL_DEV(  0x0421, 0x0495, 0x0370, 0x0370,
+ 		USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+ 		US_FL_MAX_SECTORS_64 ),
+ 
++/* Patch submitted by Mikhail Zolotaryov <lebon@lebon.org.ua> */
++UNUSUAL_DEV(  0x0421, 0x06aa, 0x1110, 0x1110,
++		"Nokia",
++		"502",
++		USB_SC_DEVICE, USB_PR_DEVICE, NULL,
++		US_FL_MAX_SECTORS_64 ),
++
+ #ifdef NO_SDDR09
+ UNUSUAL_DEV(  0x0436, 0x0005, 0x0100, 0x0100,
+ 		"Microtech",
+@@ -1434,6 +1441,13 @@ UNUSUAL_DEV( 0x0f88, 0x042e, 0x0100, 0x0100,
+ 		USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+ 		US_FL_FIX_CAPACITY ),
+ 
++/* Reported by Moritz Moeller-Herrmann <moritz-kernel@moeller-herrmann.de> */
++UNUSUAL_DEV(  0x0fca, 0x8004, 0x0201, 0x0201,
++		"Research In Motion",
++		"BlackBerry Bold 9000",
++		USB_SC_DEVICE, USB_PR_DEVICE, NULL,
++		US_FL_MAX_SECTORS_64 ),
++
+ /* Reported by Michael Stattmann <michael@stattmann.com> */
+ UNUSUAL_DEV(  0x0fce, 0xd008, 0x0000, 0x0000,
+ 		"Sony Ericsson",
+diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
+index 49eefdb..f63719a 100644
+--- a/fs/btrfs/extent-tree.c
++++ b/fs/btrfs/extent-tree.c
+@@ -6725,7 +6725,7 @@ out:
+ 	 */
+ 	if (root_dropped == false)
+ 		btrfs_add_dead_root(root);
+-	if (err)
++	if (err && err != -EAGAIN)
+ 		btrfs_std_error(root->fs_info, err);
+ 	return;
+ }
+diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
+index 1372634..622d322 100644
+--- a/fs/btrfs/inode.c
++++ b/fs/btrfs/inode.c
+@@ -56,7 +56,7 @@
+ #include "inode-map.h"
+ 
+ struct btrfs_iget_args {
+-	u64 ino;
++	struct btrfs_key *location;
+ 	struct btrfs_root *root;
+ };
+ 
+@@ -3847,7 +3847,9 @@ again:
+ static int btrfs_init_locked_inode(struct inode *inode, void *p)
+ {
+ 	struct btrfs_iget_args *args = p;
+-	inode->i_ino = args->ino;
++	inode->i_ino = args->location->objectid;
++	memcpy(&BTRFS_I(inode)->location, args->location,
++	       sizeof(*args->location));
+ 	BTRFS_I(inode)->root = args->root;
+ 	btrfs_set_inode_space_info(args->root, inode);
+ 	return 0;
+@@ -3856,20 +3858,20 @@ static int btrfs_init_locked_inode(struct inode *inode, void *p)
+ static int btrfs_find_actor(struct inode *inode, void *opaque)
+ {
+ 	struct btrfs_iget_args *args = opaque;
+-	return args->ino == btrfs_ino(inode) &&
++	return args->location->objectid == BTRFS_I(inode)->location.objectid &&
+ 		args->root == BTRFS_I(inode)->root;
+ }
+ 
+ static struct inode *btrfs_iget_locked(struct super_block *s,
+-				       u64 objectid,
++				       struct btrfs_key *location,
+ 				       struct btrfs_root *root)
+ {
+ 	struct inode *inode;
+ 	struct btrfs_iget_args args;
+-	args.ino = objectid;
++	args.location = location;
+ 	args.root = root;
+ 
+-	inode = iget5_locked(s, objectid, btrfs_find_actor,
++	inode = iget5_locked(s, location->objectid, btrfs_find_actor,
+ 			     btrfs_init_locked_inode,
+ 			     (void *)&args);
+ 	return inode;
+@@ -3883,13 +3885,11 @@ struct inode *btrfs_iget(struct super_block *s, struct btrfs_key *location,
+ {
+ 	struct inode *inode;
+ 
+-	inode = btrfs_iget_locked(s, location->objectid, root);
++	inode = btrfs_iget_locked(s, location, root);
+ 	if (!inode)
+ 		return ERR_PTR(-ENOMEM);
+ 
+ 	if (inode->i_state & I_NEW) {
+-		BTRFS_I(inode)->root = root;
+-		memcpy(&BTRFS_I(inode)->location, location, sizeof(*location));
+ 		btrfs_read_locked_inode(inode);
+ 		if (!is_bad_inode(inode)) {
+ 			inode_tree_add(inode);
+diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
+index 618ae6f..7cbe2f8 100644
+--- a/fs/btrfs/ioctl.c
++++ b/fs/btrfs/ioctl.c
+@@ -1327,12 +1327,17 @@ static noinline int btrfs_ioctl_snap_create_transid(struct file *file,
+ 			printk(KERN_INFO "btrfs: Snapshot src from "
+ 			       "another FS\n");
+ 			ret = -EINVAL;
+-			fput(src_file);
+-			goto out;
++		} else if (!inode_owner_or_capable(src_inode)) {
++			/*
++			 * Subvolume creation is not restricted, but snapshots
++			 * are limited to own subvolumes only
++			 */
++			ret = -EPERM;
++		} else {
++			ret = btrfs_mksubvol(&file->f_path, name, namelen,
++					     BTRFS_I(src_inode)->root,
++					     transid, readonly);
+ 		}
+-		ret = btrfs_mksubvol(&file->f_path, name, namelen,
+-				     BTRFS_I(src_inode)->root,
+-				     transid, readonly);
+ 		fput(src_file);
+ 	}
+ out:
+diff --git a/fs/buffer.c b/fs/buffer.c
+index 19a4f0b..5f4bde2 100644
+--- a/fs/buffer.c
++++ b/fs/buffer.c
+@@ -663,14 +663,16 @@ EXPORT_SYMBOL(mark_buffer_dirty_inode);
+ static void __set_page_dirty(struct page *page,
+ 		struct address_space *mapping, int warn)
+ {
+-	spin_lock_irq(&mapping->tree_lock);
++	unsigned long flags;
++
++	spin_lock_irqsave(&mapping->tree_lock, flags);
+ 	if (page->mapping) {	/* Race with truncate? */
+ 		WARN_ON_ONCE(warn && !PageUptodate(page));
+ 		account_page_dirtied(page, mapping);
+ 		radix_tree_tag_set(&mapping->page_tree,
+ 				page_index(page), PAGECACHE_TAG_DIRTY);
+ 	}
+-	spin_unlock_irq(&mapping->tree_lock);
++	spin_unlock_irqrestore(&mapping->tree_lock, flags);
+ 	__mark_inode_dirty(mapping->host, I_DIRTY_PAGES);
+ }
+ 
+diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
+index 56c152d..49d6e21 100644
+--- a/fs/cifs/connect.c
++++ b/fs/cifs/connect.c
+@@ -1113,7 +1113,8 @@ cifs_parse_mount_options(const char *mountdata, const char *devname,
+ 				cERROR(1, "Krb5 cifs privacy not supported");
+ 				goto cifs_parse_mount_err;
+ 			} else if (strnicmp(value, "krb5", 4) == 0) {
+-				vol->secFlg |= CIFSSEC_MAY_KRB5;
++				vol->secFlg |= CIFSSEC_MAY_KRB5 | 
++					CIFSSEC_MAY_SIGN;
+ 			} else if (strnicmp(value, "ntlmsspi", 8) == 0) {
+ 				vol->secFlg |= CIFSSEC_MAY_NTLMSSP |
+ 					CIFSSEC_MUST_SIGN;
+diff --git a/fs/exofs/ore.c b/fs/exofs/ore.c
+index 26bb512..df4a10f 100644
+--- a/fs/exofs/ore.c
++++ b/fs/exofs/ore.c
+@@ -103,7 +103,7 @@ int ore_verify_layout(unsigned total_comps, struct ore_layout *layout)
+ 
+ 	layout->max_io_length =
+ 		(BIO_MAX_PAGES_KMALLOC * PAGE_SIZE - layout->stripe_unit) *
+-							layout->group_width;
++					(layout->group_width - layout->parity);
+ 	if (layout->parity) {
+ 		unsigned stripe_length =
+ 				(layout->group_width - layout->parity) *
+@@ -286,7 +286,8 @@ int  ore_get_rw_state(struct ore_layout *layout, struct ore_components *oc,
+ 	if (length) {
+ 		ore_calc_stripe_info(layout, offset, length, &ios->si);
+ 		ios->length = ios->si.length;
+-		ios->nr_pages = (ios->length + PAGE_SIZE - 1) / PAGE_SIZE;
++		ios->nr_pages = ((ios->offset & (PAGE_SIZE - 1)) +
++				 ios->length + PAGE_SIZE - 1) / PAGE_SIZE;
+ 		if (layout->parity)
+ 			_ore_post_alloc_raid_stuff(ios);
+ 	}
+@@ -536,6 +537,7 @@ void ore_calc_stripe_info(struct ore_layout *layout, u64 file_offset,
+ 	u64	H = LmodS - G * T;
+ 
+ 	u32	N = div_u64(H, U);
++	u32	Nlast;
+ 
+ 	/* "H - (N * U)" is just "H % U" so it's bound to u32 */
+ 	u32	C = (u32)(H - (N * U)) / stripe_unit + G * group_width;
+@@ -568,6 +570,10 @@ void ore_calc_stripe_info(struct ore_layout *layout, u64 file_offset,
+ 	si->length = T - H;
+ 	if (si->length > length)
+ 		si->length = length;
++
++	Nlast = div_u64(H + si->length + U - 1, U);
++	si->maxdevUnits = Nlast - N;
++
+ 	si->M = M;
+ }
+ EXPORT_SYMBOL(ore_calc_stripe_info);
+@@ -583,13 +589,16 @@ int _ore_add_stripe_unit(struct ore_io_state *ios,  unsigned *cur_pg,
+ 	int ret;
+ 
+ 	if (per_dev->bio == NULL) {
+-		unsigned pages_in_stripe = ios->layout->group_width *
+-					(ios->layout->stripe_unit / PAGE_SIZE);
+-		unsigned nr_pages = ios->nr_pages * ios->layout->group_width /
+-					(ios->layout->group_width -
+-					 ios->layout->parity);
+-		unsigned bio_size = (nr_pages + pages_in_stripe) /
+-					ios->layout->group_width;
++		unsigned bio_size;
++
++		if (!ios->reading) {
++			bio_size = ios->si.maxdevUnits;
++		} else {
++			bio_size = (ios->si.maxdevUnits + 1) *
++			     (ios->layout->group_width - ios->layout->parity) /
++			     ios->layout->group_width;
++		}
++		bio_size *= (ios->layout->stripe_unit / PAGE_SIZE);
+ 
+ 		per_dev->bio = bio_kmalloc(GFP_KERNEL, bio_size);
+ 		if (unlikely(!per_dev->bio)) {
+@@ -609,8 +618,12 @@ int _ore_add_stripe_unit(struct ore_io_state *ios,  unsigned *cur_pg,
+ 		added_len = bio_add_pc_page(q, per_dev->bio, pages[pg],
+ 					    pglen, pgbase);
+ 		if (unlikely(pglen != added_len)) {
+-			ORE_DBGMSG("Failed bio_add_pc_page bi_vcnt=%u\n",
+-				   per_dev->bio->bi_vcnt);
++			/* If bi_vcnt == bi_max then this is a SW BUG */
++			ORE_DBGMSG("Failed bio_add_pc_page bi_vcnt=0x%x "
++				   "bi_max=0x%x BIO_MAX=0x%x cur_len=0x%x\n",
++				   per_dev->bio->bi_vcnt,
++				   per_dev->bio->bi_max_vecs,
++				   BIO_MAX_PAGES_KMALLOC, cur_len);
+ 			ret = -ENOMEM;
+ 			goto out;
+ 		}
+@@ -1099,7 +1112,7 @@ int ore_truncate(struct ore_layout *layout, struct ore_components *oc,
+ 		size_attr->attr = g_attr_logical_length;
+ 		size_attr->attr.val_ptr = &size_attr->newsize;
+ 
+-		ORE_DBGMSG("trunc(0x%llx) obj_offset=0x%llx dev=%d\n",
++		ORE_DBGMSG2("trunc(0x%llx) obj_offset=0x%llx dev=%d\n",
+ 			     _LLU(oc->comps->obj.id), _LLU(obj_size), i);
+ 		ret = _truncate_mirrors(ios, i * ios->layout->mirrors_p1,
+ 					&size_attr->attr);
+diff --git a/fs/ext4/ext4.h b/fs/ext4/ext4.h
+index 68b1602..40f4d06 100644
+--- a/fs/ext4/ext4.h
++++ b/fs/ext4/ext4.h
+@@ -745,6 +745,8 @@ do {									       \
+ 	if (EXT4_FITS_IN_INODE(raw_inode, einode, xtime))		       \
+ 		(einode)->xtime.tv_sec = 				       \
+ 			(signed)le32_to_cpu((raw_inode)->xtime);	       \
++	else								       \
++		(einode)->xtime.tv_sec = 0;				       \
+ 	if (EXT4_FITS_IN_INODE(raw_inode, einode, xtime ## _extra))	       \
+ 		ext4_decode_extra_time(&(einode)->xtime,		       \
+ 				       raw_inode->xtime ## _extra);	       \
+diff --git a/fs/file.c b/fs/file.c
+index 4c6992d..30bfc99 100644
+--- a/fs/file.c
++++ b/fs/file.c
+@@ -47,7 +47,7 @@ static void *alloc_fdmem(unsigned int size)
+ 	 * vmalloc() if the allocation size will be considered "large" by the VM.
+ 	 */
+ 	if (size <= (PAGE_SIZE << PAGE_ALLOC_COSTLY_ORDER)) {
+-		void *data = kmalloc(size, GFP_KERNEL|__GFP_NOWARN);
++		void *data = kmalloc(size, GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY);
+ 		if (data != NULL)
+ 			return data;
+ 	}
+diff --git a/fs/fuse/dev.c b/fs/fuse/dev.c
+index 5c029fb..cf0098d 100644
+--- a/fs/fuse/dev.c
++++ b/fs/fuse/dev.c
+@@ -1199,22 +1199,6 @@ static ssize_t fuse_dev_read(struct kiocb *iocb, const struct iovec *iov,
+ 	return fuse_dev_do_read(fc, file, &cs, iov_length(iov, nr_segs));
+ }
+ 
+-static int fuse_dev_pipe_buf_steal(struct pipe_inode_info *pipe,
+-				   struct pipe_buffer *buf)
+-{
+-	return 1;
+-}
+-
+-static const struct pipe_buf_operations fuse_dev_pipe_buf_ops = {
+-	.can_merge = 0,
+-	.map = generic_pipe_buf_map,
+-	.unmap = generic_pipe_buf_unmap,
+-	.confirm = generic_pipe_buf_confirm,
+-	.release = generic_pipe_buf_release,
+-	.steal = fuse_dev_pipe_buf_steal,
+-	.get = generic_pipe_buf_get,
+-};
+-
+ static ssize_t fuse_dev_splice_read(struct file *in, loff_t *ppos,
+ 				    struct pipe_inode_info *pipe,
+ 				    size_t len, unsigned int flags)
+@@ -1261,7 +1245,11 @@ static ssize_t fuse_dev_splice_read(struct file *in, loff_t *ppos,
+ 		buf->page = bufs[page_nr].page;
+ 		buf->offset = bufs[page_nr].offset;
+ 		buf->len = bufs[page_nr].len;
+-		buf->ops = &fuse_dev_pipe_buf_ops;
++		/*
++		 * Need to be careful about this.  Having buf->ops in module
++		 * code can Oops if the buffer persists after module unload.
++		 */
++		buf->ops = &nosteal_pipe_buf_ops;
+ 
+ 		pipe->nrbufs++;
+ 		page_nr++;
+diff --git a/fs/hpfs/alloc.c b/fs/hpfs/alloc.c
+index 7a5eb2c..e0d57c0 100644
+--- a/fs/hpfs/alloc.c
++++ b/fs/hpfs/alloc.c
+@@ -8,6 +8,58 @@
+ 
+ #include "hpfs_fn.h"
+ 
++static void hpfs_claim_alloc(struct super_block *s, secno sec)
++{
++	struct hpfs_sb_info *sbi = hpfs_sb(s);
++	if (sbi->sb_n_free != (unsigned)-1) {
++		if (unlikely(!sbi->sb_n_free)) {
++			hpfs_error(s, "free count underflow, allocating sector %08x", sec);
++			sbi->sb_n_free = -1;
++			return;
++		}
++		sbi->sb_n_free--;
++	}
++}
++
++static void hpfs_claim_free(struct super_block *s, secno sec)
++{
++	struct hpfs_sb_info *sbi = hpfs_sb(s);
++	if (sbi->sb_n_free != (unsigned)-1) {
++		if (unlikely(sbi->sb_n_free >= sbi->sb_fs_size)) {
++			hpfs_error(s, "free count overflow, freeing sector %08x", sec);
++			sbi->sb_n_free = -1;
++			return;
++		}
++		sbi->sb_n_free++;
++	}
++}
++
++static void hpfs_claim_dirband_alloc(struct super_block *s, secno sec)
++{
++	struct hpfs_sb_info *sbi = hpfs_sb(s);
++	if (sbi->sb_n_free_dnodes != (unsigned)-1) {
++		if (unlikely(!sbi->sb_n_free_dnodes)) {
++			hpfs_error(s, "dirband free count underflow, allocating sector %08x", sec);
++			sbi->sb_n_free_dnodes = -1;
++			return;
++		}
++		sbi->sb_n_free_dnodes--;
++	}
++}
++
++static void hpfs_claim_dirband_free(struct super_block *s, secno sec)
++{
++	struct hpfs_sb_info *sbi = hpfs_sb(s);
++	if (sbi->sb_n_free_dnodes != (unsigned)-1) {
++		if (unlikely(sbi->sb_n_free_dnodes >= sbi->sb_dirband_size / 4)) {
++			hpfs_error(s, "dirband free count overflow, freeing sector %08x", sec);
++			sbi->sb_n_free_dnodes = -1;
++			return;
++		}
++		sbi->sb_n_free_dnodes++;
++	}
++}
++
+ /*
+  * Check if a sector is allocated in bitmap
+  * This is really slow. Turned on only if chk==2
+@@ -203,9 +255,15 @@ secno hpfs_alloc_sector(struct super_block *s, secno near, unsigned n, int forwa
+ 	}
+ 	sec = 0;
+ 	ret:
++	if (sec) {
++		i = 0;
++		do
++			hpfs_claim_alloc(s, sec + i);
++		while (unlikely(++i < n));
++	}
+ 	if (sec && f_p) {
+ 		for (i = 0; i < forward; i++) {
+-			if (!hpfs_alloc_if_possible(s, sec + i + 1)) {
++			if (!hpfs_alloc_if_possible(s, sec + n + i)) {
+ 				hpfs_error(s, "Prealloc doesn't work! Wanted %d, allocated at %08x, can't allocate %d", forward, sec, i);
+ 				sec = 0;
+ 				break;
+@@ -228,6 +286,7 @@ static secno alloc_in_dirband(struct super_block *s, secno near)
+ 	nr >>= 2;
+ 	sec = alloc_in_bmp(s, (~0x3fff) | nr, 1, 0);
+ 	if (!sec) return 0;
++	hpfs_claim_dirband_alloc(s, sec);
+ 	return ((sec & 0x3fff) << 2) + sbi->sb_dirband_start;
+ }
+ 
+@@ -242,6 +301,7 @@ int hpfs_alloc_if_possible(struct super_block *s, secno sec)
+ 		bmp[(sec & 0x3fff) >> 5] &= cpu_to_le32(~(1 << (sec & 0x1f)));
+ 		hpfs_mark_4buffers_dirty(&qbh);
+ 		hpfs_brelse4(&qbh);
++		hpfs_claim_alloc(s, sec);
+ 		return 1;
+ 	}
+ 	hpfs_brelse4(&qbh);
+@@ -275,6 +335,7 @@ void hpfs_free_sectors(struct super_block *s, secno sec, unsigned n)
+ 		return;
+ 	}
+ 	bmp[(sec & 0x3fff) >> 5] |= cpu_to_le32(1 << (sec & 0x1f));
++	hpfs_claim_free(s, sec);
+ 	if (!--n) {
+ 		hpfs_mark_4buffers_dirty(&qbh);
+ 		hpfs_brelse4(&qbh);
+@@ -359,6 +420,7 @@ void hpfs_free_dnode(struct super_block *s, dnode_secno dno)
+ 		bmp[ssec >> 5] |= cpu_to_le32(1 << (ssec & 0x1f));
+ 		hpfs_mark_4buffers_dirty(&qbh);
+ 		hpfs_brelse4(&qbh);
++		hpfs_claim_dirband_free(s, dno);
+ 	}
+ }
+ 
+@@ -366,7 +428,7 @@ struct dnode *hpfs_alloc_dnode(struct super_block *s, secno near,
+ 			 dnode_secno *dno, struct quad_buffer_head *qbh)
+ {
+ 	struct dnode *d;
+-	if (hpfs_count_one_bitmap(s, hpfs_sb(s)->sb_dmap) > FREE_DNODES_ADD) {
++	if (hpfs_get_free_dnodes(s) > FREE_DNODES_ADD) {
+ 		if (!(*dno = alloc_in_dirband(s, near)))
+ 			if (!(*dno = hpfs_alloc_sector(s, near, 4, 0))) return NULL;
+ 	} else {
+diff --git a/fs/hpfs/dir.c b/fs/hpfs/dir.c
+index 2fa0089..46549c7 100644
+--- a/fs/hpfs/dir.c
++++ b/fs/hpfs/dir.c
+@@ -33,25 +33,27 @@ static loff_t hpfs_dir_lseek(struct file *filp, loff_t off, int whence)
+ 	if (whence == SEEK_DATA || whence == SEEK_HOLE)
+ 		return -EINVAL;
+ 
++	mutex_lock(&i->i_mutex);
+ 	hpfs_lock(s);
+ 
+ 	/*printk("dir lseek\n");*/
+ 	if (new_off == 0 || new_off == 1 || new_off == 11 || new_off == 12 || new_off == 13) goto ok;
+-	mutex_lock(&i->i_mutex);
+ 	pos = ((loff_t) hpfs_de_as_down_as_possible(s, hpfs_inode->i_dno) << 4) + 1;
+ 	while (pos != new_off) {
+ 		if (map_pos_dirent(i, &pos, &qbh)) hpfs_brelse4(&qbh);
+ 		else goto fail;
+ 		if (pos == 12) goto fail;
+ 	}
+-	mutex_unlock(&i->i_mutex);
++	hpfs_add_pos(i, &filp->f_pos);
+ ok:
++	filp->f_pos = new_off;
+ 	hpfs_unlock(s);
+-	return filp->f_pos = new_off;
+-fail:
+ 	mutex_unlock(&i->i_mutex);
++	return new_off;
++fail:
+ 	/*printk("illegal lseek: %016llx\n", new_off);*/
+ 	hpfs_unlock(s);
++	mutex_unlock(&i->i_mutex);
+ 	return -ESPIPE;
+ }
+ 
+diff --git a/fs/hpfs/hpfs_fn.h b/fs/hpfs/hpfs_fn.h
+index de94617..f1f2ca7 100644
+--- a/fs/hpfs/hpfs_fn.h
++++ b/fs/hpfs/hpfs_fn.h
+@@ -314,7 +314,7 @@ static inline struct hpfs_sb_info *hpfs_sb(struct super_block *sb)
+ __printf(2, 3)
+ void hpfs_error(struct super_block *, const char *, ...);
+ int hpfs_stop_cycles(struct super_block *, int, int *, int *, char *);
+-unsigned hpfs_count_one_bitmap(struct super_block *, secno);
++unsigned hpfs_get_free_dnodes(struct super_block *);
+ 
+ /*
+  * local time (HPFS) to GMT (Unix)
+diff --git a/fs/hpfs/super.c b/fs/hpfs/super.c
+index f760c15..b03e766 100644
+--- a/fs/hpfs/super.c
++++ b/fs/hpfs/super.c
+@@ -115,7 +115,7 @@ static void hpfs_put_super(struct super_block *s)
+ 	kfree(sbi);
+ }
+ 
+-unsigned hpfs_count_one_bitmap(struct super_block *s, secno secno)
++static unsigned hpfs_count_one_bitmap(struct super_block *s, secno secno)
+ {
+ 	struct quad_buffer_head qbh;
+ 	unsigned long *bits;
+@@ -123,7 +123,7 @@ unsigned hpfs_count_one_bitmap(struct super_block *s, secno secno)
+ 
+ 	bits = hpfs_map_4sectors(s, secno, &qbh, 4);
+ 	if (!bits)
+-		return 0;
++		return (unsigned)-1;
+ 	count = bitmap_weight(bits, 2048 * BITS_PER_BYTE);
+ 	hpfs_brelse4(&qbh);
+ 	return count;
+@@ -134,29 +134,45 @@ static unsigned count_bitmaps(struct super_block *s)
+ 	unsigned n, count, n_bands;
+ 	n_bands = (hpfs_sb(s)->sb_fs_size + 0x3fff) >> 14;
+ 	count = 0;
+-	for (n = 0; n < n_bands; n++)
+-		count += hpfs_count_one_bitmap(s, le32_to_cpu(hpfs_sb(s)->sb_bmp_dir[n]));
++	for (n = 0; n < n_bands; n++) {
++		unsigned c;
++		c = hpfs_count_one_bitmap(s, le32_to_cpu(hpfs_sb(s)->sb_bmp_dir[n]));
++		if (c != (unsigned)-1)
++			count += c;
++	}
+ 	return count;
+ }
+ 
++unsigned hpfs_get_free_dnodes(struct super_block *s)
++{
++	struct hpfs_sb_info *sbi = hpfs_sb(s);
++	if (sbi->sb_n_free_dnodes == (unsigned)-1) {
++		unsigned c = hpfs_count_one_bitmap(s, sbi->sb_dmap);
++		if (c == (unsigned)-1)
++			return 0;
++		sbi->sb_n_free_dnodes = c;
++	}
++	return sbi->sb_n_free_dnodes;
++}
++
+ static int hpfs_statfs(struct dentry *dentry, struct kstatfs *buf)
+ {
+ 	struct super_block *s = dentry->d_sb;
+ 	struct hpfs_sb_info *sbi = hpfs_sb(s);
+ 	u64 id = huge_encode_dev(s->s_bdev->bd_dev);
++
+ 	hpfs_lock(s);
+ 
+-	/*if (sbi->sb_n_free == -1) {*/
++	if (sbi->sb_n_free == (unsigned)-1)
+ 		sbi->sb_n_free = count_bitmaps(s);
+-		sbi->sb_n_free_dnodes = hpfs_count_one_bitmap(s, sbi->sb_dmap);
+-	/*}*/
++
+ 	buf->f_type = s->s_magic;
+ 	buf->f_bsize = 512;
+ 	buf->f_blocks = sbi->sb_fs_size;
+ 	buf->f_bfree = sbi->sb_n_free;
+ 	buf->f_bavail = sbi->sb_n_free;
+ 	buf->f_files = sbi->sb_dirband_size / 4;
+-	buf->f_ffree = sbi->sb_n_free_dnodes;
++	buf->f_ffree = hpfs_get_free_dnodes(s);
+ 	buf->f_fsid.val[0] = (u32)id;
+ 	buf->f_fsid.val[1] = (u32)(id >> 32);
+ 	buf->f_namelen = 254;
+diff --git a/fs/lockd/svclock.c b/fs/lockd/svclock.c
+index cd8703d..cb7b186 100644
+--- a/fs/lockd/svclock.c
++++ b/fs/lockd/svclock.c
+@@ -741,6 +741,7 @@ nlmsvc_grant_blocked(struct nlm_block *block)
+ 	struct nlm_file		*file = block->b_file;
+ 	struct nlm_lock		*lock = &block->b_call->a_args.lock;
+ 	int			error;
++	loff_t			fl_start, fl_end;
+ 
+ 	dprintk("lockd: grant blocked lock %p\n", block);
+ 
+@@ -758,9 +759,16 @@ nlmsvc_grant_blocked(struct nlm_block *block)
+ 	}
+ 
+ 	/* Try the lock operation again */
++	/* vfs_lock_file() can mangle fl_start and fl_end, but we need
++	 * them unchanged for the GRANT_MSG
++	 */
+ 	lock->fl.fl_flags |= FL_SLEEP;
++	fl_start = lock->fl.fl_start;
++	fl_end = lock->fl.fl_end;
+ 	error = vfs_lock_file(file->f_file, F_SETLK, &lock->fl, NULL);
+ 	lock->fl.fl_flags &= ~FL_SLEEP;
++	lock->fl.fl_start = fl_start;
++	lock->fl.fl_end = fl_end;
+ 
+ 	switch (error) {
+ 	case 0:
+diff --git a/fs/nfs/blocklayout/extents.c b/fs/nfs/blocklayout/extents.c
+index 4e2ee99..bb15ccc 100644
+--- a/fs/nfs/blocklayout/extents.c
++++ b/fs/nfs/blocklayout/extents.c
+@@ -44,7 +44,7 @@
+ static inline sector_t normalize(sector_t s, int base)
+ {
+ 	sector_t tmp = s; /* Since do_div modifies its argument */
+-	return s - do_div(tmp, base);
++	return s - sector_div(tmp, base);
+ }
+ 
+ static inline sector_t normalize_up(sector_t s, int base)
+diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
+index 3d02931..5aea30a 100644
+--- a/fs/nfs/nfs4proc.c
++++ b/fs/nfs/nfs4proc.c
+@@ -6197,7 +6197,7 @@ nfs41_proc_secinfo_no_name(struct nfs_server *server, struct nfs_fh *fhandle,
+ 		switch (err) {
+ 		case 0:
+ 		case -NFS4ERR_WRONGSEC:
+-		case -NFS4ERR_NOTSUPP:
++		case -ENOTSUPP:
+ 			goto out;
+ 		default:
+ 			err = nfs4_handle_exception(server, err, &exception);
+@@ -6229,7 +6229,7 @@ nfs41_find_root_sec(struct nfs_server *server, struct nfs_fh *fhandle,
+ 	 * Fall back on "guess and check" method if
+ 	 * the server doesn't support SECINFO_NO_NAME
+ 	 */
+-	if (err == -NFS4ERR_WRONGSEC || err == -NFS4ERR_NOTSUPP) {
++	if (err == -NFS4ERR_WRONGSEC || err == -ENOTSUPP) {
+ 		err = nfs4_find_root_sec(server, fhandle, info);
+ 		goto out_freepage;
+ 	}
+diff --git a/fs/nfs/nfs4xdr.c b/fs/nfs/nfs4xdr.c
+index 00818c8..4479f66 100644
+--- a/fs/nfs/nfs4xdr.c
++++ b/fs/nfs/nfs4xdr.c
+@@ -3056,7 +3056,8 @@ out_overflow:
+ 	return -EIO;
+ }
+ 
+-static int decode_op_hdr(struct xdr_stream *xdr, enum nfs_opnum4 expected)
++static bool __decode_op_hdr(struct xdr_stream *xdr, enum nfs_opnum4 expected,
++		int *nfs_retval)
+ {
+ 	__be32 *p;
+ 	uint32_t opnum;
+@@ -3066,19 +3067,32 @@ static int decode_op_hdr(struct xdr_stream *xdr, enum nfs_opnum4 expected)
+ 	if (unlikely(!p))
+ 		goto out_overflow;
+ 	opnum = be32_to_cpup(p++);
+-	if (opnum != expected) {
+-		dprintk("nfs: Server returned operation"
+-			" %d but we issued a request for %d\n",
+-				opnum, expected);
+-		return -EIO;
+-	}
++	if (unlikely(opnum != expected))
++		goto out_bad_operation;
+ 	nfserr = be32_to_cpup(p);
+-	if (nfserr != NFS_OK)
+-		return nfs4_stat_to_errno(nfserr);
+-	return 0;
++	if (nfserr == NFS_OK)
++		*nfs_retval = 0;
++	else
++		*nfs_retval = nfs4_stat_to_errno(nfserr);
++	return true;
++out_bad_operation:
++	dprintk("nfs: Server returned operation"
++		" %d but we issued a request for %d\n",
++			opnum, expected);
++	*nfs_retval = -EREMOTEIO;
++	return false;
+ out_overflow:
+ 	print_overflow_msg(__func__, xdr);
+-	return -EIO;
++	*nfs_retval = -EIO;
++	return false;
++}
++
++static int decode_op_hdr(struct xdr_stream *xdr, enum nfs_opnum4 expected)
++{
++	int retval;
++
++	__decode_op_hdr(xdr, expected, &retval);
++	return retval;
+ }
+ 
+ /* Dummy routine */
+@@ -4744,11 +4758,12 @@ static int decode_open(struct xdr_stream *xdr, struct nfs_openres *res)
+ 	uint32_t savewords, bmlen, i;
+ 	int status;
+ 
+-	status = decode_op_hdr(xdr, OP_OPEN);
+-	if (status != -EIO)
+-		nfs_increment_open_seqid(status, res->seqid);
+-	if (!status)
+-		status = decode_stateid(xdr, &res->stateid);
++	if (!__decode_op_hdr(xdr, OP_OPEN, &status))
++		return status;
++	nfs_increment_open_seqid(status, res->seqid);
++	if (status)
++		return status;
++	status = decode_stateid(xdr, &res->stateid);
+ 	if (unlikely(status))
+ 		return status;
+ 
+diff --git a/fs/ocfs2/file.c b/fs/ocfs2/file.c
+index 1c7d45e..d20d64c 100644
+--- a/fs/ocfs2/file.c
++++ b/fs/ocfs2/file.c
+@@ -2389,8 +2389,8 @@ out_dio:
+ 
+ 	if (((file->f_flags & O_DSYNC) && !direct_io) || IS_SYNC(inode) ||
+ 	    ((file->f_flags & O_DIRECT) && !direct_io)) {
+-		ret = filemap_fdatawrite_range(file->f_mapping, pos,
+-					       pos + count - 1);
++		ret = filemap_fdatawrite_range(file->f_mapping, *ppos,
++					       *ppos + count - 1);
+ 		if (ret < 0)
+ 			written = ret;
+ 
+@@ -2403,8 +2403,8 @@ out_dio:
+ 		}
+ 
+ 		if (!ret)
+-			ret = filemap_fdatawait_range(file->f_mapping, pos,
+-						      pos + count - 1);
++			ret = filemap_fdatawait_range(file->f_mapping, *ppos,
++						      *ppos + count - 1);
+ 	}
+ 
+ 	/*
+diff --git a/fs/ocfs2/quota_global.c b/fs/ocfs2/quota_global.c
+index 92fcd57..a40e5ce 100644
+--- a/fs/ocfs2/quota_global.c
++++ b/fs/ocfs2/quota_global.c
+@@ -712,6 +712,12 @@ static int ocfs2_release_dquot(struct dquot *dquot)
+ 	 */
+ 	if (status < 0)
+ 		mlog_errno(status);
++	/*
++	 * Clear dq_off so that we search for the structure in quota file next
++	 * time we acquire it. The structure might be deleted and reallocated
++	 * elsewhere by another node while our dquot structure is on freelist.
++	 */
++	dquot->dq_off = 0;
+ 	clear_bit(DQ_ACTIVE_B, &dquot->dq_flags);
+ out_trans:
+ 	ocfs2_commit_trans(osb, handle);
+@@ -750,16 +756,17 @@ static int ocfs2_acquire_dquot(struct dquot *dquot)
+ 	status = ocfs2_lock_global_qf(info, 1);
+ 	if (status < 0)
+ 		goto out;
+-	if (!test_bit(DQ_READ_B, &dquot->dq_flags)) {
+-		status = ocfs2_qinfo_lock(info, 0);
+-		if (status < 0)
+-			goto out_dq;
+-		status = qtree_read_dquot(&info->dqi_gi, dquot);
+-		ocfs2_qinfo_unlock(info, 0);
+-		if (status < 0)
+-			goto out_dq;
+-	}
+-	set_bit(DQ_READ_B, &dquot->dq_flags);
++	status = ocfs2_qinfo_lock(info, 0);
++	if (status < 0)
++		goto out_dq;
++	/*
++	 * We always want to read dquot structure from disk because we don't
++	 * know what happened with it while it was on freelist.
++	 */
++	status = qtree_read_dquot(&info->dqi_gi, dquot);
++	ocfs2_qinfo_unlock(info, 0);
++	if (status < 0)
++		goto out_dq;
+ 
+ 	OCFS2_DQUOT(dquot)->dq_use_count++;
+ 	OCFS2_DQUOT(dquot)->dq_origspace = dquot->dq_dqb.dqb_curspace;
+diff --git a/fs/ocfs2/quota_local.c b/fs/ocfs2/quota_local.c
+index f100bf7..b6cfcf2 100644
+--- a/fs/ocfs2/quota_local.c
++++ b/fs/ocfs2/quota_local.c
+@@ -1300,10 +1300,6 @@ int ocfs2_local_release_dquot(handle_t *handle, struct dquot *dquot)
+ 	ocfs2_journal_dirty(handle, od->dq_chunk->qc_headerbh);
+ 
+ out:
+-	/* Clear the read bit so that next time someone uses this
+-	 * dquot he reads fresh info from disk and allocates local
+-	 * dquot structure */
+-	clear_bit(DQ_READ_B, &dquot->dq_flags);
+ 	return status;
+ }
+ 
+diff --git a/fs/quota/dquot.c b/fs/quota/dquot.c
+index 5b572c8..3d5d717 100644
+--- a/fs/quota/dquot.c
++++ b/fs/quota/dquot.c
+@@ -580,9 +580,17 @@ int dquot_scan_active(struct super_block *sb,
+ 		dqstats_inc(DQST_LOOKUPS);
+ 		dqput(old_dquot);
+ 		old_dquot = dquot;
+-		ret = fn(dquot, priv);
+-		if (ret < 0)
+-			goto out;
++		/*
++		 * ->release_dquot() can be racing with us. Our reference
++		 * protects us from new calls to it so just wait for any
++		 * outstanding call and recheck the DQ_ACTIVE_B after that.
++		 */
++		wait_on_dquot(dquot);
++		if (test_bit(DQ_ACTIVE_B, &dquot->dq_flags)) {
++			ret = fn(dquot, priv);
++			if (ret < 0)
++				goto out;
++		}
+ 		spin_lock(&dq_list_lock);
+ 		/* We are safe to continue now because our dquot could not
+ 		 * be moved out of the inuse list while we hold the reference */
+diff --git a/fs/splice.c b/fs/splice.c
+index 58ab918..714471d 100644
+--- a/fs/splice.c
++++ b/fs/splice.c
+@@ -554,6 +554,24 @@ static const struct pipe_buf_operations default_pipe_buf_ops = {
+ 	.get = generic_pipe_buf_get,
+ };
+ 
++static int generic_pipe_buf_nosteal(struct pipe_inode_info *pipe,
++				    struct pipe_buffer *buf)
++{
++	return 1;
++}
++
++/* Pipe buffer operations for a socket and similar. */
++const struct pipe_buf_operations nosteal_pipe_buf_ops = {
++	.can_merge = 0,
++	.map = generic_pipe_buf_map,
++	.unmap = generic_pipe_buf_unmap,
++	.confirm = generic_pipe_buf_confirm,
++	.release = generic_pipe_buf_release,
++	.steal = generic_pipe_buf_nosteal,
++	.get = generic_pipe_buf_get,
++};
++EXPORT_SYMBOL(nosteal_pipe_buf_ops);
++
+ static ssize_t kernel_readv(struct file *file, const struct iovec *vec,
+ 			    unsigned long vlen, loff_t offset)
+ {
+diff --git a/include/linux/compiler-gcc4.h b/include/linux/compiler-gcc4.h
+index 643d6c4..e2a360a 100644
+--- a/include/linux/compiler-gcc4.h
++++ b/include/linux/compiler-gcc4.h
+@@ -39,11 +39,7 @@
+  *
+  * (asm goto is automatically volatile - the naming reflects this.)
+  */
+-#if GCC_VERSION <= 40801
+-# define asm_volatile_goto(x...)	do { asm goto(x); asm (""); } while (0)
+-#else
+-# define asm_volatile_goto(x...)	do { asm goto(x); } while (0)
+-#endif
++#define asm_volatile_goto(x...)	do { asm goto(x); asm (""); } while (0)
+ 
+ #if __GNUC_MINOR__ >= 5
+ /*
+diff --git a/include/linux/jiffies.h b/include/linux/jiffies.h
+index 265e2c3..f5df3dc 100644
+--- a/include/linux/jiffies.h
++++ b/include/linux/jiffies.h
+@@ -106,13 +106,13 @@ static inline u64 get_jiffies_64(void)
+ #define time_after(a,b)		\
+ 	(typecheck(unsigned long, a) && \
+ 	 typecheck(unsigned long, b) && \
+-	 ((long)(b) - (long)(a) < 0))
++	 ((long)((b) - (a)) < 0))
+ #define time_before(a,b)	time_after(b,a)
+ 
+ #define time_after_eq(a,b)	\
+ 	(typecheck(unsigned long, a) && \
+ 	 typecheck(unsigned long, b) && \
+-	 ((long)(a) - (long)(b) >= 0))
++	 ((long)((a) - (b)) >= 0))
+ #define time_before_eq(a,b)	time_after_eq(b,a)
+ 
+ /*
+@@ -135,13 +135,13 @@ static inline u64 get_jiffies_64(void)
+ #define time_after64(a,b)	\
+ 	(typecheck(__u64, a) &&	\
+ 	 typecheck(__u64, b) && \
+-	 ((__s64)(b) - (__s64)(a) < 0))
++	 ((__s64)((b) - (a)) < 0))
+ #define time_before64(a,b)	time_after64(b,a)
+ 
+ #define time_after_eq64(a,b)	\
+ 	(typecheck(__u64, a) && \
+ 	 typecheck(__u64, b) && \
+-	 ((__s64)(a) - (__s64)(b) >= 0))
++	 ((__s64)((a) - (b)) >= 0))
+ #define time_before_eq64(a,b)	time_after_eq64(b,a)
+ 
+ /*
+diff --git a/include/linux/libata.h b/include/linux/libata.h
+index 62467ca..b1fcdba 100644
+--- a/include/linux/libata.h
++++ b/include/linux/libata.h
+@@ -393,6 +393,8 @@ enum {
+ 	ATA_HORKAGE_BROKEN_FPDMA_AA	= (1 << 15),	/* skip AA */
+ 	ATA_HORKAGE_DUMP_ID	= (1 << 16),	/* dump IDENTIFY data */
+ 	ATA_HORKAGE_MAX_SEC_LBA48 = (1 << 17),	/* Set max sects to 65535 */
++	ATA_HORKAGE_NOLPM	= (1 << 20),	/* don't use LPM */
++	ATA_HORKAGE_WD_BROKEN_LPM = (1 << 21),	/* some WDs have broken LPM */
+ 
+ 	 /* DMA mask for user DMA control: User visible values; DO NOT
+ 	    renumber */
+diff --git a/include/linux/pipe_fs_i.h b/include/linux/pipe_fs_i.h
+index 0072a53..8778c26 100644
+--- a/include/linux/pipe_fs_i.h
++++ b/include/linux/pipe_fs_i.h
+@@ -160,6 +160,8 @@ int generic_pipe_buf_confirm(struct pipe_inode_info *, struct pipe_buffer *);
+ int generic_pipe_buf_steal(struct pipe_inode_info *, struct pipe_buffer *);
+ void generic_pipe_buf_release(struct pipe_inode_info *, struct pipe_buffer *);
+ 
++extern const struct pipe_buf_operations nosteal_pipe_buf_ops;
++
+ /* for F_SETPIPE_SZ and F_GETPIPE_SZ */
+ long pipe_fcntl(struct file *, unsigned int, unsigned long arg);
+ struct pipe_inode_info *get_pipe_info(struct file *file);
+diff --git a/include/linux/tracepoint.h b/include/linux/tracepoint.h
+index df0a779..f3680aa 100644
+--- a/include/linux/tracepoint.h
++++ b/include/linux/tracepoint.h
+@@ -60,6 +60,12 @@ struct tp_module {
+ 	unsigned int num_tracepoints;
+ 	struct tracepoint * const *tracepoints_ptrs;
+ };
++bool trace_module_has_bad_taint(struct module *mod);
++#else
++static inline bool trace_module_has_bad_taint(struct module *mod)
++{
++	return false;
++}
+ #endif /* CONFIG_MODULES */
+ 
+ struct tracepoint_iter {
+diff --git a/include/scsi/osd_ore.h b/include/scsi/osd_ore.h
+index f05fa82..47b458c 100644
+--- a/include/scsi/osd_ore.h
++++ b/include/scsi/osd_ore.h
+@@ -101,6 +101,7 @@ struct ore_striping_info {
+ 	unsigned unit_off;
+ 	unsigned cur_pg;
+ 	unsigned cur_comp;
++	unsigned maxdevUnits;
+ };
+ 
+ struct ore_io_state;
+diff --git a/include/xen/Kbuild b/include/xen/Kbuild
+index 84ad8f0..563161a 100644
+--- a/include/xen/Kbuild
++++ b/include/xen/Kbuild
+@@ -1,2 +1,4 @@
+ header-y += evtchn.h
++header-y += gntalloc.h
++header-y += gntdev.h
+ header-y += privcmd.h
+diff --git a/kernel/cgroup.c b/kernel/cgroup.c
+index 2a1ffb7..93fc15e 100644
+--- a/kernel/cgroup.c
++++ b/kernel/cgroup.c
+@@ -2785,9 +2785,14 @@ static void cgroup_enable_task_cg_lists(void)
+ 		 * We should check if the process is exiting, otherwise
+ 		 * it will race with cgroup_exit() in that the list
+ 		 * entry won't be deleted though the process has exited.
++		 * Do it while holding siglock so that we don't end up
++		 * racing against cgroup_exit().
+ 		 */
++		spin_lock_irq(&p->sighand->siglock);
+ 		if (!(p->flags & PF_EXITING) && list_empty(&p->cg_list))
+ 			list_add(&p->cg_list, &p->cgroups->tasks);
++		spin_unlock_irq(&p->sighand->siglock);
++
+ 		task_unlock(p);
+ 	} while_each_thread(g, p);
+ 	write_unlock(&css_set_lock);
+diff --git a/kernel/cpuset.c b/kernel/cpuset.c
+index 57eb98d..1e2c5f0 100644
+--- a/kernel/cpuset.c
++++ b/kernel/cpuset.c
+@@ -2366,9 +2366,9 @@ int __cpuset_node_allowed_softwall(int node, gfp_t gfp_mask)
+ 
+ 	task_lock(current);
+ 	cs = nearest_hardwall_ancestor(task_cs(current));
++	allowed = node_isset(node, cs->mems_allowed);
+ 	task_unlock(current);
+ 
+-	allowed = node_isset(node, cs->mems_allowed);
+ 	mutex_unlock(&callback_mutex);
+ 	return allowed;
+ }
+diff --git a/kernel/events/core.c b/kernel/events/core.c
+index 83d5621..b15b4f7 100644
+--- a/kernel/events/core.c
++++ b/kernel/events/core.c
+@@ -7101,14 +7101,14 @@ static void perf_pmu_rotate_stop(struct pmu *pmu)
+ static void __perf_event_exit_context(void *__info)
+ {
+ 	struct perf_event_context *ctx = __info;
+-	struct perf_event *event, *tmp;
++	struct perf_event *event;
+ 
+ 	perf_pmu_rotate_stop(ctx->pmu);
+ 
+-	list_for_each_entry_safe(event, tmp, &ctx->pinned_groups, group_entry)
+-		__perf_remove_from_context(event);
+-	list_for_each_entry_safe(event, tmp, &ctx->flexible_groups, group_entry)
++	rcu_read_lock();
++	list_for_each_entry_rcu(event, &ctx->event_list, event_entry)
+ 		__perf_remove_from_context(event);
++	rcu_read_unlock();
+ }
+ 
+ static void perf_event_exit_cpu_context(int cpu)
+@@ -7132,11 +7132,11 @@ static void perf_event_exit_cpu(int cpu)
+ {
+ 	struct swevent_htable *swhash = &per_cpu(swevent_htable, cpu);
+ 
++	perf_event_exit_cpu_context(cpu);
++
+ 	mutex_lock(&swhash->hlist_mutex);
+ 	swevent_hlist_release(swhash);
+ 	mutex_unlock(&swhash->hlist_mutex);
+-
+-	perf_event_exit_cpu_context(cpu);
+ }
+ #else
+ static inline void perf_event_exit_cpu(int cpu) { }
+diff --git a/kernel/irq/manage.c b/kernel/irq/manage.c
+index 52bdd58..4775229 100644
+--- a/kernel/irq/manage.c
++++ b/kernel/irq/manage.c
+@@ -819,7 +819,7 @@ static int irq_thread(void *data)
+ 
+ 		wake = atomic_dec_and_test(&desc->threads_active);
+ 
+-		if (wake && waitqueue_active(&desc->wait_for_threads))
++		if (wake)
+ 			wake_up(&desc->wait_for_threads);
+ 	}
+ 
+diff --git a/kernel/printk.c b/kernel/printk.c
+index 16688ec..8fac434 100644
+--- a/kernel/printk.c
++++ b/kernel/printk.c
+@@ -1165,7 +1165,6 @@ static int __cpuinit console_cpu_notify(struct notifier_block *self,
+ 	switch (action) {
+ 	case CPU_ONLINE:
+ 	case CPU_DEAD:
+-	case CPU_DYING:
+ 	case CPU_DOWN_FAILED:
+ 	case CPU_UP_CANCELED:
+ 		console_lock();
+diff --git a/kernel/sched_fair.c b/kernel/sched_fair.c
+index 37f3f39..4c6dae1 100644
+--- a/kernel/sched_fair.c
++++ b/kernel/sched_fair.c
+@@ -4953,15 +4953,15 @@ static void switched_from_fair(struct rq *rq, struct task_struct *p)
+ 	struct cfs_rq *cfs_rq = cfs_rq_of(se);
+ 
+ 	/*
+-	 * Ensure the task's vruntime is normalized, so that when its
++	 * Ensure the task's vruntime is normalized, so that when it's
+ 	 * switched back to the fair class the enqueue_entity(.flags=0) will
+ 	 * do the right thing.
+ 	 *
+-	 * If it was on_rq, then the dequeue_entity(.flags=0) will already
+-	 * have normalized the vruntime, if it was !on_rq, then only when
++	 * If it's on_rq, then the dequeue_entity(.flags=0) will already
++	 * have normalized the vruntime, if it's !on_rq, then only when
+ 	 * the task is sleeping will it still have non-normalized vruntime.
+ 	 */
+-	if (!se->on_rq && p->state != TASK_RUNNING) {
++	if (!p->on_rq && p->state != TASK_RUNNING) {
+ 		/*
+ 		 * Fix up our vruntime so that the current sleep doesn't
+ 		 * cause 'unlimited' sleep bonus.
+diff --git a/kernel/time/jiffies.c b/kernel/time/jiffies.c
+index a470154..955560e 100644
+--- a/kernel/time/jiffies.c
++++ b/kernel/time/jiffies.c
+@@ -51,7 +51,13 @@
+  * HZ shrinks, so values greater than 8 overflow 32bits when
+  * HZ=100.
+  */
++#if HZ < 34
++#define JIFFIES_SHIFT	6
++#elif HZ < 67
++#define JIFFIES_SHIFT	7
++#else
+ #define JIFFIES_SHIFT	8
++#endif
+ 
+ static cycle_t jiffies_read(struct clocksource *cs)
+ {
+diff --git a/kernel/time/timekeeping.c b/kernel/time/timekeeping.c
+index cb7f33e..068c092 100644
+--- a/kernel/time/timekeeping.c
++++ b/kernel/time/timekeeping.c
+@@ -1161,7 +1161,7 @@ void get_monotonic_boottime(struct timespec *ts)
+ 	} while (read_seqretry(&xtime_lock, seq));
+ 
+ 	set_normalized_timespec(ts, ts->tv_sec + tomono.tv_sec + sleep.tv_sec,
+-			ts->tv_nsec + tomono.tv_nsec + sleep.tv_nsec + nsecs);
++		(s64)ts->tv_nsec + tomono.tv_nsec + sleep.tv_nsec + nsecs);
+ }
+ EXPORT_SYMBOL_GPL(get_monotonic_boottime);
+ 
+diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
+index cf8b439..a65fa36 100644
+--- a/kernel/trace/ftrace.c
++++ b/kernel/trace/ftrace.c
+@@ -190,6 +190,12 @@ static void update_global_ops(void)
+ 	global_ops.func = func;
+ }
+ 
++#ifdef CONFIG_FUNCTION_GRAPH_TRACER
++static void update_function_graph_func(void);
++#else
++static inline void update_function_graph_func(void) { }
++#endif
++
+ static void update_ftrace_function(void)
+ {
+ 	ftrace_func_t func;
+@@ -237,6 +243,8 @@ static int remove_ftrace_ops(struct ftrace_ops **list, struct ftrace_ops *ops)
+ {
+ 	struct ftrace_ops **p;
+ 
++	update_function_graph_func();
++
+ 	/*
+ 	 * If we are removing the last function, then simply point
+ 	 * to the ftrace_stub.
+@@ -283,6 +291,17 @@ static int __register_ftrace_function(struct ftrace_ops *ops)
+ 	return 0;
+ }
+ 
++static void ftrace_sync(struct work_struct *work)
++{
++	/*
++	 * This function is just a stub to implement a hard force
++	 * of synchronize_sched(). This requires synchronizing
++	 * tasks even in userspace and idle.
++	 *
++	 * Yes, function tracing is rude.
++	 */
++}
++
+ static int __unregister_ftrace_function(struct ftrace_ops *ops)
+ {
+ 	int ret;
+@@ -308,13 +327,6 @@ static int __unregister_ftrace_function(struct ftrace_ops *ops)
+ 	if (ftrace_enabled)
+ 		update_ftrace_function();
+ 
+-	/*
+-	 * Dynamic ops may be freed, we must make sure that all
+-	 * callers are done before leaving this function.
+-	 */
+-	if (ops->flags & FTRACE_OPS_FL_DYNAMIC)
+-		synchronize_sched();
+-
+ 	return 0;
+ }
+ 
+@@ -1775,6 +1787,24 @@ static int ftrace_shutdown(struct ftrace_ops *ops, int command)
+ 		return 0;
+ 
+ 	ftrace_run_update_code(command);
++
++	/*
++	 * Dynamic ops may be freed, we must make sure that all
++	 * callers are done before leaving this function.
++	 * The same goes for freeing the per_cpu data of the control
++	 * ops.
++	 *
++	 * Again, normal synchronize_sched() is not good enough.
++	 * We need to do a hard force of sched synchronization.
++	 * This is because we use preempt_disable() to do RCU, but
++	 * the function tracers can be called where RCU is not watching
++	 * (like before user_exit()). We can not rely on the RCU
++	 * infrastructure to do the synchronization, thus we must do it
++	 * ourselves.
++	 */
++	if (ops->flags & (FTRACE_OPS_FL_DYNAMIC))
++		schedule_on_each_cpu(ftrace_sync);
++
+ 	return 0;
+ }
+ 
+@@ -4045,6 +4075,7 @@ int ftrace_graph_entry_stub(struct ftrace_graph_ent *trace)
+ trace_func_graph_ret_t ftrace_graph_return =
+ 			(trace_func_graph_ret_t)ftrace_stub;
+ trace_func_graph_ent_t ftrace_graph_entry = ftrace_graph_entry_stub;
++static trace_func_graph_ent_t __ftrace_graph_entry = ftrace_graph_entry_stub;
+ 
+ /* Try to assign a return stack array on FTRACE_RETSTACK_ALLOC_SIZE tasks. */
+ static int alloc_retstack_tasklist(struct ftrace_ret_stack **ret_stack_list)
+@@ -4185,6 +4216,30 @@ static struct ftrace_ops fgraph_ops __read_mostly = {
+ 	.flags		= FTRACE_OPS_FL_GLOBAL,
+ };
+ 
++static int ftrace_graph_entry_test(struct ftrace_graph_ent *trace)
++{
++	if (!ftrace_ops_test(&global_ops, trace->func))
++		return 0;
++	return __ftrace_graph_entry(trace);
++}
++
++/*
++ * The function graph tracer should only trace the functions defined
++ * by set_ftrace_filter and set_ftrace_notrace. If another function
++ * tracer ops is registered, the graph tracer requires testing the
++ * function against the global ops, and not just trace any function
++ * that any ftrace_ops registered.
++ */
++static void update_function_graph_func(void)
++{
++	if (ftrace_ops_list == &ftrace_list_end ||
++	    (ftrace_ops_list == &global_ops &&
++	     global_ops.next == &ftrace_list_end))
++		ftrace_graph_entry = __ftrace_graph_entry;
++	else
++		ftrace_graph_entry = ftrace_graph_entry_test;
++}
++
+ int register_ftrace_graph(trace_func_graph_ret_t retfunc,
+ 			trace_func_graph_ent_t entryfunc)
+ {
+@@ -4209,7 +4264,16 @@ int register_ftrace_graph(trace_func_graph_ret_t retfunc,
+ 	}
+ 
+ 	ftrace_graph_return = retfunc;
+-	ftrace_graph_entry = entryfunc;
++
++	/*
++	 * Update the indirect function to the entryfunc, and the
++	 * function that gets called to the entry_test first. Then
++	 * call the update fgraph entry function to determine if
++	 * the entryfunc should be called directly or not.
++	 */
++	__ftrace_graph_entry = entryfunc;
++	ftrace_graph_entry = ftrace_graph_entry_test;
++	update_function_graph_func();
+ 
+ 	ret = ftrace_startup(&fgraph_ops, FTRACE_START_FUNC_RET);
+ 
+@@ -4228,6 +4292,7 @@ void unregister_ftrace_graph(void)
+ 	ftrace_graph_active--;
+ 	ftrace_graph_return = (trace_func_graph_ret_t)ftrace_stub;
+ 	ftrace_graph_entry = ftrace_graph_entry_stub;
++	__ftrace_graph_entry = ftrace_graph_entry_stub;
+ 	ftrace_shutdown(&fgraph_ops, FTRACE_STOP_FUNC_RET);
+ 	unregister_pm_notifier(&ftrace_suspend_notifier);
+ 	unregister_trace_sched_switch(ftrace_graph_probe_sched_switch, NULL);
+diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c
+index 6fdc629..648f25a 100644
+--- a/kernel/trace/ring_buffer.c
++++ b/kernel/trace/ring_buffer.c
+@@ -2040,6 +2040,13 @@ __rb_reserve_next(struct ring_buffer_per_cpu *cpu_buffer,
+ 	write &= RB_WRITE_MASK;
+ 	tail = write - length;
+ 
++	/*
++	 * If this is the first commit on the page, then it has the same
++	 * timestamp as the page itself.
++	 */
++	if (!tail)
++		delta = 0;
++
+ 	/* See if we shot pass the end of this buffer page */
+ 	if (unlikely(write > BUF_PAGE_SIZE))
+ 		return rb_move_tail(cpu_buffer, length, tail,
+diff --git a/kernel/trace/trace_events.c b/kernel/trace/trace_events.c
+index c212a7f..875fed4 100644
+--- a/kernel/trace/trace_events.c
++++ b/kernel/trace/trace_events.c
+@@ -1345,6 +1345,16 @@ static void trace_module_add_events(struct module *mod)
+ 	struct ftrace_module_file_ops *file_ops = NULL;
+ 	struct ftrace_event_call **call, **start, **end;
+ 
++	if (!mod->num_trace_events)
++		return;
++
++	/* Don't add infrastructure for mods without tracepoints */
++	if (trace_module_has_bad_taint(mod)) {
++		pr_err("%s: module has bad taint, not creating trace events\n",
++		       mod->name);
++		return;
++	}
++
+ 	start = mod->trace_events;
+ 	end = mod->trace_events + mod->num_trace_events;
+ 
+diff --git a/kernel/tracepoint.c b/kernel/tracepoint.c
+index f1539de..41b25a0 100644
+--- a/kernel/tracepoint.c
++++ b/kernel/tracepoint.c
+@@ -628,6 +628,11 @@ void tracepoint_iter_reset(struct tracepoint_iter *iter)
+ EXPORT_SYMBOL_GPL(tracepoint_iter_reset);
+ 
+ #ifdef CONFIG_MODULES
++bool trace_module_has_bad_taint(struct module *mod)
++{
++	return mod->taints & ~((1 << TAINT_OOT_MODULE) | (1 << TAINT_CRAP));
++}
++
+ static int tracepoint_module_coming(struct module *mod)
+ {
+ 	struct tp_module *tp_mod, *iter;
+@@ -638,7 +643,7 @@ static int tracepoint_module_coming(struct module *mod)
+ 	 * module headers (for forced load), to make sure we don't cause a crash.
+ 	 * Staging and out-of-tree GPL modules are fine.
+ 	 */
+-	if (mod->taints & ~((1 << TAINT_OOT_MODULE) | (1 << TAINT_CRAP)))
++	if (trace_module_has_bad_taint(mod))
+ 		return 0;
+ 	mutex_lock(&tracepoints_mutex);
+ 	tp_mod = kmalloc(sizeof(struct tp_module), GFP_KERNEL);
+diff --git a/kernel/workqueue.c b/kernel/workqueue.c
+index 0bc9ff0..563820c 100644
+--- a/kernel/workqueue.c
++++ b/kernel/workqueue.c
+@@ -1474,12 +1474,19 @@ static void destroy_worker(struct worker *worker)
+ 	if (worker->flags & WORKER_IDLE)
+ 		gcwq->nr_idle--;
+ 
++	/*
++	 * Once WORKER_DIE is set, the kworker may destroy itself at any
++	 * point.  Pin to ensure the task stays until we're done with it.
++	 */
++	get_task_struct(worker->task);
++
+ 	list_del_init(&worker->entry);
+ 	worker->flags |= WORKER_DIE;
+ 
+ 	spin_unlock_irq(&gcwq->lock);
+ 
+ 	kthread_stop(worker->task);
++	put_task_struct(worker->task);
+ 	kfree(worker);
+ 
+ 	spin_lock_irq(&gcwq->lock);
+diff --git a/lib/Makefile b/lib/Makefile
+index a4da283..c06efca 100644
+--- a/lib/Makefile
++++ b/lib/Makefile
+@@ -40,6 +40,7 @@ obj-$(CONFIG_DEBUG_SPINLOCK) += spinlock_debug.o
+ lib-$(CONFIG_RWSEM_GENERIC_SPINLOCK) += rwsem-spinlock.o
+ lib-$(CONFIG_RWSEM_XCHGADD_ALGORITHM) += rwsem.o
+ 
++GCOV_PROFILE_hweight.o := n
+ CFLAGS_hweight.o = $(subst $(quote),,$(CONFIG_ARCH_HWEIGHT_CFLAGS))
+ obj-$(CONFIG_GENERIC_HWEIGHT) += hweight.o
+ 
+diff --git a/mm/oom_kill.c b/mm/oom_kill.c
+index 069b64e..4dda948 100644
+--- a/mm/oom_kill.c
++++ b/mm/oom_kill.c
+@@ -213,7 +213,7 @@ unsigned int oom_badness(struct task_struct *p, struct mem_cgroup *mem,
+ 	 * implementation used by LSMs.
+ 	 */
+ 	if (has_capability_noaudit(p, CAP_SYS_ADMIN))
+-		points -= 30;
++		points -= (points * 3) / 100;
+ 
+ 	/*
+ 	 * /proc/pid/oom_score_adj ranges from -1000 to +1000 such that it may
+diff --git a/mm/page-writeback.c b/mm/page-writeback.c
+index ea3f83b..b5cd796 100644
+--- a/mm/page-writeback.c
++++ b/mm/page-writeback.c
+@@ -1776,11 +1776,12 @@ int __set_page_dirty_nobuffers(struct page *page)
+ 	if (!TestSetPageDirty(page)) {
+ 		struct address_space *mapping = page_mapping(page);
+ 		struct address_space *mapping2;
++		unsigned long flags;
+ 
+ 		if (!mapping)
+ 			return 1;
+ 
+-		spin_lock_irq(&mapping->tree_lock);
++		spin_lock_irqsave(&mapping->tree_lock, flags);
+ 		mapping2 = page_mapping(page);
+ 		if (mapping2) { /* Race with truncate? */
+ 			BUG_ON(mapping2 != mapping);
+@@ -1789,7 +1790,7 @@ int __set_page_dirty_nobuffers(struct page *page)
+ 			radix_tree_tag_set(&mapping->page_tree,
+ 				page_index(page), PAGECACHE_TAG_DIRTY);
+ 		}
+-		spin_unlock_irq(&mapping->tree_lock);
++		spin_unlock_irqrestore(&mapping->tree_lock, flags);
+ 		if (mapping->host) {
+ 			/* !PageAnon && !swapper_space */
+ 			__mark_inode_dirty(mapping->host, I_DIRTY_PAGES);
+diff --git a/mm/rmap.c b/mm/rmap.c
+index 8685697..52a2f36 100644
+--- a/mm/rmap.c
++++ b/mm/rmap.c
+@@ -581,7 +581,11 @@ pte_t *__page_check_address(struct page *page, struct mm_struct *mm,
+ 	spinlock_t *ptl;
+ 
+ 	if (unlikely(PageHuge(page))) {
++		/* when pud is not present, pte will be NULL */
+ 		pte = huge_pte_offset(mm, address);
++		if (!pte)
++			return NULL;
++
+ 		ptl = &mm->page_table_lock;
+ 		goto check;
+ 	}
+diff --git a/mm/slub.c b/mm/slub.c
+index 5710788..fc719f7 100644
+--- a/mm/slub.c
++++ b/mm/slub.c
+@@ -4483,7 +4483,13 @@ static ssize_t show_slab_objects(struct kmem_cache *s,
+ 			page = c->partial;
+ 
+ 			if (page) {
+-				x = page->pobjects;
++				node = page_to_nid(page);
++				if (flags & SO_TOTAL)
++					WARN_ON_ONCE(1);
++				else if (flags & SO_OBJECTS)
++					WARN_ON_ONCE(1);
++				else
++					x = page->pages;
+ 				total += x;
+ 				nodes[node] += x;
+ 			}
+diff --git a/mm/swapfile.c b/mm/swapfile.c
+index fad1830..dbd2b67 100644
+--- a/mm/swapfile.c
++++ b/mm/swapfile.c
+@@ -1649,7 +1649,6 @@ SYSCALL_DEFINE1(swapoff, const char __user *, specialfile)
+ 	p->max = 0;
+ 	swap_map = p->swap_map;
+ 	p->swap_map = NULL;
+-	p->flags = 0;
+ 	spin_unlock(&swap_lock);
+ 	mutex_unlock(&swapon_mutex);
+ 	vfree(swap_map);
+@@ -1667,6 +1666,16 @@ SYSCALL_DEFINE1(swapoff, const char __user *, specialfile)
+ 		mutex_unlock(&inode->i_mutex);
+ 	}
+ 	filp_close(swap_file, NULL);
++
++	/*
++	 * Clear the SWP_USED flag after all resources are freed so that swapon
++	 * can reuse this swap_info in alloc_swap_info() safely.  It is ok to
++	 * not hold p->lock after we cleared its SWP_WRITEOK.
++	 */
++	spin_lock(&swap_lock);
++	p->flags = 0;
++	spin_unlock(&swap_lock);
++
+ 	err = 0;
+ 	atomic_inc(&proc_poll_event);
+ 	wake_up_interruptible(&proc_poll_wait);
+diff --git a/net/core/fib_rules.c b/net/core/fib_rules.c
+index c0c21b1..6af54f2 100644
+--- a/net/core/fib_rules.c
++++ b/net/core/fib_rules.c
+@@ -718,6 +718,13 @@ static int fib_rules_event(struct notifier_block *this, unsigned long event,
+ 			attach_rules(&ops->rules_list, dev);
+ 		break;
+ 
++	case NETDEV_CHANGENAME:
++		list_for_each_entry(ops, &net->rules_ops, list) {
++			detach_rules(&ops->rules_list, dev);
++			attach_rules(&ops->rules_list, dev);
++		}
++		break;
++
+ 	case NETDEV_UNREGISTER:
+ 		list_for_each_entry(ops, &net->rules_ops, list)
+ 			detach_rules(&ops->rules_list, dev);
+diff --git a/net/core/skbuff.c b/net/core/skbuff.c
+index af9c3c6..5d6cb54 100644
+--- a/net/core/skbuff.c
++++ b/net/core/skbuff.c
+@@ -74,36 +74,6 @@
+ static struct kmem_cache *skbuff_head_cache __read_mostly;
+ static struct kmem_cache *skbuff_fclone_cache __read_mostly;
+ 
+-static void sock_pipe_buf_release(struct pipe_inode_info *pipe,
+-				  struct pipe_buffer *buf)
+-{
+-	put_page(buf->page);
+-}
+-
+-static void sock_pipe_buf_get(struct pipe_inode_info *pipe,
+-				struct pipe_buffer *buf)
+-{
+-	get_page(buf->page);
+-}
+-
+-static int sock_pipe_buf_steal(struct pipe_inode_info *pipe,
+-			       struct pipe_buffer *buf)
+-{
+-	return 1;
+-}
+-
+-
+-/* Pipe buffer operations for a socket. */
+-static const struct pipe_buf_operations sock_pipe_buf_ops = {
+-	.can_merge = 0,
+-	.map = generic_pipe_buf_map,
+-	.unmap = generic_pipe_buf_unmap,
+-	.confirm = generic_pipe_buf_confirm,
+-	.release = sock_pipe_buf_release,
+-	.steal = sock_pipe_buf_steal,
+-	.get = sock_pipe_buf_get,
+-};
+-
+ /*
+  *	Keep out-of-line to prevent kernel bloat.
+  *	__builtin_return_address is not used because it is not always
+@@ -1665,7 +1635,7 @@ int skb_splice_bits(struct sk_buff *skb, unsigned int offset,
+ 		.partial = partial,
+ 		.nr_pages_max = MAX_SKB_FRAGS,
+ 		.flags = flags,
+-		.ops = &sock_pipe_buf_ops,
++		.ops = &nosteal_pipe_buf_ops,
+ 		.spd_release = sock_spd_release,
+ 	};
+ 	struct sk_buff *frag_iter;
+diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c
+index 488600c..1914f5a 100644
+--- a/net/mac80211/sta_info.c
++++ b/net/mac80211/sta_info.c
+@@ -292,6 +292,7 @@ struct sta_info *sta_info_alloc(struct ieee80211_sub_if_data *sdata,
+ 		return NULL;
+ 
+ 	spin_lock_init(&sta->lock);
++	spin_lock_init(&sta->ps_lock);
+ 	INIT_WORK(&sta->drv_unblock_wk, sta_unblock);
+ 	INIT_WORK(&sta->ampdu_mlme.work, ieee80211_ba_session_work);
+ 	mutex_init(&sta->ampdu_mlme.mtx);
+@@ -1141,6 +1142,8 @@ void ieee80211_sta_ps_deliver_wakeup(struct sta_info *sta)
+ 
+ 	skb_queue_head_init(&pending);
+ 
++	/* sync with ieee80211_tx_h_unicast_ps_buf */
++	spin_lock(&sta->ps_lock);
+ 	/* Send all buffered frames to the station */
+ 	for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
+ 		int count = skb_queue_len(&pending), tmp;
+@@ -1160,6 +1163,7 @@ void ieee80211_sta_ps_deliver_wakeup(struct sta_info *sta)
+ 	}
+ 
+ 	ieee80211_add_pending_skbs_fn(local, &pending, clear_sta_ps_flags, sta);
++	spin_unlock(&sta->ps_lock);
+ 
+ 	local->total_ps_buffered -= buffered;
+ 
+@@ -1207,6 +1211,7 @@ static void ieee80211_send_null_response(struct ieee80211_sub_if_data *sdata,
+ 	memcpy(nullfunc->addr1, sta->sta.addr, ETH_ALEN);
+ 	memcpy(nullfunc->addr2, sdata->vif.addr, ETH_ALEN);
+ 	memcpy(nullfunc->addr3, sdata->vif.addr, ETH_ALEN);
++	nullfunc->seq_ctrl = 0;
+ 
+ 	skb->priority = tid;
+ 	skb_set_queue_mapping(skb, ieee802_1d_to_ac[tid]);
+diff --git a/net/mac80211/sta_info.h b/net/mac80211/sta_info.h
+index 8c8ce05..a68155f 100644
+--- a/net/mac80211/sta_info.h
++++ b/net/mac80211/sta_info.h
+@@ -216,6 +216,7 @@ struct sta_ampdu_mlme {
+  * @drv_unblock_wk: used for driver PS unblocking
+  * @listen_interval: listen interval of this station, when we're acting as AP
+  * @_flags: STA flags, see &enum ieee80211_sta_info_flags, do not use directly
++ * @ps_lock: used for powersave (when mac80211 is the AP) related locking
+  * @ps_tx_buf: buffers (per AC) of frames to transmit to this station
+  *	when it leaves power saving state or polls
+  * @tx_filtered: buffers (per AC) of frames we already tried to
+@@ -284,10 +285,8 @@ struct sta_info {
+ 	/* use the accessors defined below */
+ 	unsigned long _flags;
+ 
+-	/*
+-	 * STA powersave frame queues, no more than the internal
+-	 * locking required.
+-	 */
++	/* STA powersave lock and frame queues */
++	spinlock_t ps_lock;
+ 	struct sk_buff_head ps_tx_buf[IEEE80211_NUM_ACS];
+ 	struct sk_buff_head tx_filtered[IEEE80211_NUM_ACS];
+ 	unsigned long driver_buffered_tids;
+diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
+index 4ff35bf..25bbb2e 100644
+--- a/net/mac80211/tx.c
++++ b/net/mac80211/tx.c
+@@ -464,6 +464,20 @@ ieee80211_tx_h_unicast_ps_buf(struct ieee80211_tx_data *tx)
+ #endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */
+ 		if (tx->local->total_ps_buffered >= TOTAL_MAX_TX_BUFFER)
+ 			purge_old_ps_buffers(tx->local);
++
++		/* sync with ieee80211_sta_ps_deliver_wakeup */
++		spin_lock(&sta->ps_lock);
++		/*
++		 * STA woke up the meantime and all the frames on ps_tx_buf have
++		 * been queued to pending queue. No reordering can happen, go
++		 * ahead and Tx the packet.
++		 */
++		if (!test_sta_flag(sta, WLAN_STA_PS_STA) &&
++		    !test_sta_flag(sta, WLAN_STA_PS_DRIVER)) {
++			spin_unlock(&sta->ps_lock);
++			return TX_CONTINUE;
++		}
++
+ 		if (skb_queue_len(&sta->ps_tx_buf[ac]) >= STA_MAX_TX_BUFFER) {
+ 			struct sk_buff *old = skb_dequeue(&sta->ps_tx_buf[ac]);
+ #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
+@@ -480,6 +494,7 @@ ieee80211_tx_h_unicast_ps_buf(struct ieee80211_tx_data *tx)
+ 		info->control.vif = &tx->sdata->vif;
+ 		info->flags |= IEEE80211_TX_INTFL_NEED_TXPROCESSING;
+ 		skb_queue_tail(&sta->ps_tx_buf[ac], tx->skb);
++		spin_unlock(&sta->ps_lock);
+ 
+ 		if (!timer_pending(&local->sta_cleanup))
+ 			mod_timer(&local->sta_cleanup,
+@@ -884,7 +899,7 @@ static int ieee80211_fragment(struct ieee80211_local *local,
+ 		pos += fraglen;
+ 	}
+ 
+-	skb->len = hdrlen + per_fragm;
++	skb_trim(skb, hdrlen + per_fragm);
+ 	return 0;
+ }
+ 
+diff --git a/net/sctp/sm_statefuns.c b/net/sctp/sm_statefuns.c
+index cb1c430..f131caf 100644
+--- a/net/sctp/sm_statefuns.c
++++ b/net/sctp/sm_statefuns.c
+@@ -747,6 +747,13 @@ sctp_disposition_t sctp_sf_do_5_1D_ce(const struct sctp_endpoint *ep,
+ 		struct sctp_chunk auth;
+ 		sctp_ierror_t ret;
+ 
++		/* Make sure that we and the peer are AUTH capable */
++		if (!sctp_auth_enable || !new_asoc->peer.auth_capable) {
++			kfree_skb(chunk->auth_chunk);
++			sctp_association_free(new_asoc);
++			return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
++		}
++
+ 		/* set-up our fake chunk so that we can process it */
+ 		auth.skb = chunk->auth_chunk;
+ 		auth.asoc = chunk->asoc;
+diff --git a/net/sctp/socket.c b/net/sctp/socket.c
+index c53d01e..c28eb7b 100644
+--- a/net/sctp/socket.c
++++ b/net/sctp/socket.c
+@@ -70,6 +70,7 @@
+ #include <linux/init.h>
+ #include <linux/crypto.h>
+ #include <linux/slab.h>
++#include <linux/compat.h>
+ 
+ #include <net/ip.h>
+ #include <net/icmp.h>
+@@ -1376,11 +1377,19 @@ SCTP_STATIC int sctp_setsockopt_connectx(struct sock* sk,
+ /*
+  * New (hopefully final) interface for the API.
+  * We use the sctp_getaddrs_old structure so that use-space library
+- * can avoid any unnecessary allocations.   The only defferent part
++ * can avoid any unnecessary allocations. The only different part
+  * is that we store the actual length of the address buffer into the
+- * addrs_num structure member.  That way we can re-use the existing
++ * addrs_num structure member. That way we can re-use the existing
+  * code.
+  */
++#ifdef CONFIG_COMPAT
++struct compat_sctp_getaddrs_old {
++	sctp_assoc_t	assoc_id;
++	s32		addr_num;
++	compat_uptr_t	addrs;		/* struct sockaddr * */
++};
++#endif
++
+ SCTP_STATIC int sctp_getsockopt_connectx3(struct sock* sk, int len,
+ 					char __user *optval,
+ 					int __user *optlen)
+@@ -1389,16 +1398,30 @@ SCTP_STATIC int sctp_getsockopt_connectx3(struct sock* sk, int len,
+ 	sctp_assoc_t assoc_id = 0;
+ 	int err = 0;
+ 
+-	if (len < sizeof(param))
+-		return -EINVAL;
++#ifdef CONFIG_COMPAT
++	if (is_compat_task()) {
++		struct compat_sctp_getaddrs_old param32;
+ 
+-	if (copy_from_user(&param, optval, sizeof(param)))
+-		return -EFAULT;
++		if (len < sizeof(param32))
++			return -EINVAL;
++		if (copy_from_user(&param32, optval, sizeof(param32)))
++			return -EFAULT;
+ 
+-	err = __sctp_setsockopt_connectx(sk,
+-			(struct sockaddr __user *)param.addrs,
+-			param.addr_num, &assoc_id);
++		param.assoc_id = param32.assoc_id;
++		param.addr_num = param32.addr_num;
++		param.addrs = compat_ptr(param32.addrs);
++	} else
++#endif
++	{
++		if (len < sizeof(param))
++			return -EINVAL;
++		if (copy_from_user(&param, optval, sizeof(param)))
++			return -EFAULT;
++	}
+ 
++	err = __sctp_setsockopt_connectx(sk, (struct sockaddr __user *)
++					 param.addrs, param.addr_num,
++					 &assoc_id);
+ 	if (err == 0 || err == -EINPROGRESS) {
+ 		if (copy_to_user(optval, &assoc_id, sizeof(assoc_id)))
+ 			return -EFAULT;
+diff --git a/net/sunrpc/clnt.c b/net/sunrpc/clnt.c
+index b2250da..a0e55e5 100644
+--- a/net/sunrpc/clnt.c
++++ b/net/sunrpc/clnt.c
+@@ -1002,9 +1002,13 @@ call_refreshresult(struct rpc_task *task)
+ 	task->tk_action = call_refresh;
+ 	switch (status) {
+ 	case 0:
+-		if (rpcauth_uptodatecred(task))
++		if (rpcauth_uptodatecred(task)) {
+ 			task->tk_action = call_allocate;
+-		return;
++			return;
++		}
++		/* Use rate-limiting and a max number of retries if refresh
++		 * had status 0 but failed to update the cred.
++		 */
+ 	case -ETIMEDOUT:
+ 		rpc_delay(task, 3*HZ);
+ 	case -EAGAIN:
+diff --git a/net/sunrpc/xprtsock.c b/net/sunrpc/xprtsock.c
+index bfb78fa..d77a4f0 100644
+--- a/net/sunrpc/xprtsock.c
++++ b/net/sunrpc/xprtsock.c
+@@ -501,6 +501,7 @@ static int xs_nospace(struct rpc_task *task)
+ 	struct rpc_rqst *req = task->tk_rqstp;
+ 	struct rpc_xprt *xprt = req->rq_xprt;
+ 	struct sock_xprt *transport = container_of(xprt, struct sock_xprt, xprt);
++	struct sock *sk = transport->inet;
+ 	int ret = -EAGAIN;
+ 
+ 	dprintk("RPC: %5u xmit incomplete (%u left of %u)\n",
+@@ -518,7 +519,7 @@ static int xs_nospace(struct rpc_task *task)
+ 			 * window size
+ 			 */
+ 			set_bit(SOCK_NOSPACE, &transport->sock->flags);
+-			transport->inet->sk_write_pending++;
++			sk->sk_write_pending++;
+ 			/* ...and wait for more buffer space */
+ 			xprt_wait_for_buffer_space(task, xs_nospace_callback);
+ 		}
+@@ -528,6 +529,9 @@ static int xs_nospace(struct rpc_task *task)
+ 	}
+ 
+ 	spin_unlock_bh(&xprt->transport_lock);
++
++	/* Race breaker in case memory is freed before above code is called */
++	sk->sk_write_space(sk);
+ 	return ret;
+ }
+ 
+diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
+index eddfdec..54fc90b 100644
+--- a/net/unix/af_unix.c
++++ b/net/unix/af_unix.c
+@@ -149,8 +149,8 @@ static inline void unix_set_secdata(struct scm_cookie *scm, struct sk_buff *skb)
+ 
+ static inline unsigned unix_hash_fold(__wsum n)
+ {
+-	unsigned hash = (__force unsigned)n;
+-	hash ^= hash>>16;
++	unsigned int hash = (__force unsigned int)csum_fold(n);
++
+ 	hash ^= hash>>8;
+ 	return hash&(UNIX_HASH_SIZE-1);
+ }
+diff --git a/scripts/mod/file2alias.c b/scripts/mod/file2alias.c
+index d1d0ae8..98ff331 100644
+--- a/scripts/mod/file2alias.c
++++ b/scripts/mod/file2alias.c
+@@ -130,8 +130,8 @@ static void do_usb_entry(struct usb_device_id *id,
+ 				range_lo < 0x9 ? "[%X-9" : "[%X",
+ 				range_lo);
+ 			sprintf(alias + strlen(alias),
+-				range_hi > 0xA ? "a-%X]" : "%X]",
+-				range_lo);
++				range_hi > 0xA ? "A-%X]" : "%X]",
++				range_hi);
+ 		}
+ 	}
+ 	if (bcdDevice_initial_digits < (sizeof(id->bcdDevice_lo) * 2 - 1))
+diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
+index bcf1d73..4fa7939 100644
+--- a/security/selinux/hooks.c
++++ b/security/selinux/hooks.c
+@@ -4676,22 +4676,31 @@ static unsigned int selinux_ip_postroute(struct sk_buff *skb, int ifindex,
+ 	 * as fast and as clean as possible. */
+ 	if (!selinux_policycap_netpeer)
+ 		return selinux_ip_postroute_compat(skb, ifindex, family);
++
++	secmark_active = selinux_secmark_enabled();
++	peerlbl_active = netlbl_enabled() || selinux_xfrm_enabled();
++	if (!secmark_active && !peerlbl_active)
++		return NF_ACCEPT;
++
++	sk = skb->sk;
++
+ #ifdef CONFIG_XFRM
+ 	/* If skb->dst->xfrm is non-NULL then the packet is undergoing an IPsec
+ 	 * packet transformation so allow the packet to pass without any checks
+ 	 * since we'll have another chance to perform access control checks
+ 	 * when the packet is on it's final way out.
+ 	 * NOTE: there appear to be some IPv6 multicast cases where skb->dst
+-	 *       is NULL, in this case go ahead and apply access control. */
+-	if (skb_dst(skb) != NULL && skb_dst(skb)->xfrm != NULL)
++	 *       is NULL, in this case go ahead and apply access control.
++	 * NOTE: if this is a local socket (skb->sk != NULL) that is in the
++	 *       TCP listening state we cannot wait until the XFRM processing
++	 *       is done as we will miss out on the SA label if we do;
++	 *       unfortunately, this means more work, but it is only once per
++	 *       connection. */
++	if (skb_dst(skb) != NULL && skb_dst(skb)->xfrm != NULL &&
++	    !(sk != NULL && sk->sk_state == TCP_LISTEN))
+ 		return NF_ACCEPT;
+ #endif
+-	secmark_active = selinux_secmark_enabled();
+-	peerlbl_active = netlbl_enabled() || selinux_xfrm_enabled();
+-	if (!secmark_active && !peerlbl_active)
+-		return NF_ACCEPT;
+ 
+-	sk = skb->sk;
+ 	if (sk == NULL) {
+ 		/* Without an associated socket the packet is either coming
+ 		 * from the kernel or it is being forwarded; check the packet
+@@ -4719,6 +4728,25 @@ static unsigned int selinux_ip_postroute(struct sk_buff *skb, int ifindex,
+ 		struct sk_security_struct *sksec = sk->sk_security;
+ 		if (selinux_skb_peerlbl_sid(skb, family, &skb_sid))
+ 			return NF_DROP;
++		/* At this point, if the returned skb peerlbl is SECSID_NULL
++		 * and the packet has been through at least one XFRM
++		 * transformation then we must be dealing with the "final"
++		 * form of labeled IPsec packet; since we've already applied
++		 * all of our access controls on this packet we can safely
++		 * pass the packet. */
++		if (skb_sid == SECSID_NULL) {
++			switch (family) {
++			case PF_INET:
++				if (IPCB(skb)->flags & IPSKB_XFRM_TRANSFORMED)
++					return NF_ACCEPT;
++				break;
++			case PF_INET6:
++				if (IP6CB(skb)->flags & IP6SKB_XFRM_TRANSFORMED)
++					return NF_ACCEPT;
++			default:
++				return NF_DROP_ERR(-ECONNREFUSED);
++			}
++		}
+ 		if (selinux_conn_sid(sksec->sid, skb_sid, &peer_sid))
+ 			return NF_DROP;
+ 		secmark_perm = PACKET__SEND;
+diff --git a/security/selinux/ss/policydb.c b/security/selinux/ss/policydb.c
+index a7f61d5..23e9cba 100644
+--- a/security/selinux/ss/policydb.c
++++ b/security/selinux/ss/policydb.c
+@@ -1914,7 +1914,19 @@ static int filename_trans_read(struct policydb *p, void *fp)
+ 		if (rc)
+ 			goto out;
+ 
+-		hashtab_insert(p->filename_trans, ft, otype);
++		rc = hashtab_insert(p->filename_trans, ft, otype);
++		if (rc) {
++			/*
++			 * Do not return -EEXIST to the caller, or the system
++			 * will not boot.
++			 */
++			if (rc != -EEXIST)
++				goto out;
++			/* But free memory to avoid memory leak. */
++			kfree(ft);
++			kfree(name);
++			kfree(otype);
++		}
+ 	}
+ 	hash_eval(p->filename_trans, "filenametr");
+ 	return 0;
+@@ -3202,10 +3214,10 @@ static int filename_write_helper(void *key, void *data, void *ptr)
+ 	if (rc)
+ 		return rc;
+ 
+-	buf[0] = ft->stype;
+-	buf[1] = ft->ttype;
+-	buf[2] = ft->tclass;
+-	buf[3] = otype->otype;
++	buf[0] = cpu_to_le32(ft->stype);
++	buf[1] = cpu_to_le32(ft->ttype);
++	buf[2] = cpu_to_le32(ft->tclass);
++	buf[3] = cpu_to_le32(otype->otype);
+ 
+ 	rc = put_entry(buf, sizeof(u32), 4, fp);
+ 	if (rc)
+diff --git a/security/selinux/ss/services.c b/security/selinux/ss/services.c
+index 185f849..72b20b1 100644
+--- a/security/selinux/ss/services.c
++++ b/security/selinux/ss/services.c
+@@ -1229,6 +1229,10 @@ static int security_context_to_sid_core(const char *scontext, u32 scontext_len,
+ 	struct context context;
+ 	int rc = 0;
+ 
++	/* An empty security context is never valid. */
++	if (!scontext_len)
++		return -EINVAL;
++
+ 	if (!ss_initialized) {
+ 		int i;
+ 
+diff --git a/sound/pci/Kconfig b/sound/pci/Kconfig
+index 8816804..e7244ac 100644
+--- a/sound/pci/Kconfig
++++ b/sound/pci/Kconfig
+@@ -30,6 +30,7 @@ config SND_ALS300
+ 	select SND_PCM
+ 	select SND_AC97_CODEC
+ 	select SND_OPL3_LIB
++	select ZONE_DMA
+ 	help
+ 	  Say 'Y' or 'M' to include support for Avance Logic ALS300/ALS300+
+ 
+@@ -54,6 +55,7 @@ config SND_ALI5451
+ 	tristate "ALi M5451 PCI Audio Controller"
+ 	select SND_MPU401_UART
+ 	select SND_AC97_CODEC
++	select ZONE_DMA
+ 	help
+ 	  Say Y here to include support for the integrated AC97 sound
+ 	  device on motherboards using the ALi M5451 Audio Controller
+@@ -158,6 +160,7 @@ config SND_AZT3328
+ 	select SND_PCM
+ 	select SND_RAWMIDI
+ 	select SND_AC97_CODEC
++	select ZONE_DMA
+ 	help
+ 	  Say Y here to include support for Aztech AZF3328 (PCI168)
+ 	  soundcards.
+@@ -463,6 +466,7 @@ config SND_EMU10K1
+ 	select SND_HWDEP
+ 	select SND_RAWMIDI
+ 	select SND_AC97_CODEC
++	select ZONE_DMA
+ 	help
+ 	  Say Y to include support for Sound Blaster PCI 512, Live!,
+ 	  Audigy and E-mu APS (partially supported) soundcards.
+@@ -478,6 +482,7 @@ config SND_EMU10K1X
+ 	tristate "Emu10k1X (Dell OEM Version)"
+ 	select SND_AC97_CODEC
+ 	select SND_RAWMIDI
++	select ZONE_DMA
+ 	help
+ 	  Say Y here to include support for the Dell OEM version of the
+ 	  Sound Blaster Live!.
+@@ -511,6 +516,7 @@ config SND_ES1938
+ 	select SND_OPL3_LIB
+ 	select SND_MPU401_UART
+ 	select SND_AC97_CODEC
++	select ZONE_DMA
+ 	help
+ 	  Say Y here to include support for soundcards based on ESS Solo-1
+ 	  (ES1938, ES1946, ES1969) chips.
+@@ -522,6 +528,7 @@ config SND_ES1968
+ 	tristate "ESS ES1968/1978 (Maestro-1/2/2E)"
+ 	select SND_MPU401_UART
+ 	select SND_AC97_CODEC
++	select ZONE_DMA
+ 	help
+ 	  Say Y here to include support for soundcards based on ESS Maestro
+ 	  1/2/2E chips.
+@@ -602,6 +609,7 @@ config SND_ICE1712
+ 	select SND_MPU401_UART
+ 	select SND_AC97_CODEC
+ 	select BITREVERSE
++	select ZONE_DMA
+ 	help
+ 	  Say Y here to include support for soundcards based on the
+ 	  ICE1712 (Envy24) chip.
+@@ -688,6 +696,7 @@ config SND_LX6464ES
+ config SND_MAESTRO3
+ 	tristate "ESS Allegro/Maestro3"
+ 	select SND_AC97_CODEC
++	select ZONE_DMA
+ 	help
+ 	  Say Y here to include support for soundcards based on ESS Maestro 3
+ 	  (Allegro) chips.
+@@ -782,6 +791,7 @@ config SND_SIS7019
+ 	tristate "SiS 7019 Audio Accelerator"
+ 	depends on X86 && !X86_64
+ 	select SND_AC97_CODEC
++	select ZONE_DMA
+ 	help
+ 	  Say Y here to include support for the SiS 7019 Audio Accelerator.
+ 
+@@ -793,6 +803,7 @@ config SND_SONICVIBES
+ 	select SND_OPL3_LIB
+ 	select SND_MPU401_UART
+ 	select SND_AC97_CODEC
++	select ZONE_DMA
+ 	help
+ 	  Say Y here to include support for soundcards based on the S3
+ 	  SonicVibes chip.
+@@ -804,6 +815,7 @@ config SND_TRIDENT
+ 	tristate "Trident 4D-Wave DX/NX; SiS 7018"
+ 	select SND_MPU401_UART
+ 	select SND_AC97_CODEC
++	select ZONE_DMA
+ 	help
+ 	  Say Y here to include support for soundcards based on Trident
+ 	  4D-Wave DX/NX or SiS 7018 chips.
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index 1f78ca6..36bce68 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -5157,6 +5157,9 @@ static int alc269_fill_coef(struct hda_codec *codec)
+ 
+ 	if (spec->codec_variant != ALC269_TYPE_ALC269VB)
+ 		return 0;
++	/* ALC271X doesn't seem to support these COEFs (bko#52181) */
++	if (!strcmp(codec->chip_name, "ALC271X"))
++		return 0;
+ 
+ 	if ((alc_get_coef0(codec) & 0x00ff) < 0x015) {
+ 		alc_write_coef_idx(codec, 0xf, 0x960b);
+diff --git a/sound/pci/oxygen/xonar_dg.c b/sound/pci/oxygen/xonar_dg.c
+index bc6eb58..59eda0a 100644
+--- a/sound/pci/oxygen/xonar_dg.c
++++ b/sound/pci/oxygen/xonar_dg.c
+@@ -294,6 +294,16 @@ static int output_switch_put(struct snd_kcontrol *ctl,
+ 		oxygen_write16_masked(chip, OXYGEN_GPIO_DATA,
+ 				      data->output_sel == 1 ? GPIO_HP_REAR : 0,
+ 				      GPIO_HP_REAR);
++		oxygen_write8_masked(chip, OXYGEN_PLAY_ROUTING,
++				     data->output_sel == 0 ?
++				     OXYGEN_PLAY_MUTE01 :
++				     OXYGEN_PLAY_MUTE23 |
++				     OXYGEN_PLAY_MUTE45 |
++				     OXYGEN_PLAY_MUTE67,
++				     OXYGEN_PLAY_MUTE01 |
++				     OXYGEN_PLAY_MUTE23 |
++				     OXYGEN_PLAY_MUTE45 |
++				     OXYGEN_PLAY_MUTE67);
+ 	}
+ 	mutex_unlock(&chip->mutex);
+ 	return changed;
+@@ -597,7 +607,7 @@ struct oxygen_model model_xonar_dg = {
+ 	.model_data_size = sizeof(struct dg),
+ 	.device_config = PLAYBACK_0_TO_I2S |
+ 			 PLAYBACK_1_TO_SPDIF |
+-			 CAPTURE_0_FROM_I2S_2,
++			 CAPTURE_0_FROM_I2S_1,
+ 	.dac_channels_pcm = 6,
+ 	.dac_channels_mixer = 0,
+ 	.function_flags = OXYGEN_FUNCTION_SPI,
+diff --git a/sound/pci/rme9652/rme9652.c b/sound/pci/rme9652/rme9652.c
+index 732c5e8..1b35864 100644
+--- a/sound/pci/rme9652/rme9652.c
++++ b/sound/pci/rme9652/rme9652.c
+@@ -285,7 +285,7 @@ static char channel_map_9636_ds[26] = {
+ 	/* ADAT channels are remapped */
+ 	1, 3, 5, 7, 9, 11, 13, 15,
+ 	/* channels 8 and 9 are S/PDIF */
+-	24, 25
++	24, 25,
+ 	/* others don't exist */
+ 	-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1
+ };
+diff --git a/sound/soc/codecs/adau1701.c b/sound/soc/codecs/adau1701.c
+index 8b7e1c5..3cca558 100644
+--- a/sound/soc/codecs/adau1701.c
++++ b/sound/soc/codecs/adau1701.c
+@@ -64,7 +64,7 @@
+ 
+ #define ADAU1701_SEROCTL_WORD_LEN_24	0x0000
+ #define ADAU1701_SEROCTL_WORD_LEN_20	0x0001
+-#define ADAU1701_SEROCTL_WORD_LEN_16	0x0010
++#define ADAU1701_SEROCTL_WORD_LEN_16	0x0002
+ #define ADAU1701_SEROCTL_WORD_LEN_MASK	0x0003
+ 
+ #define ADAU1701_AUXNPOW_VBPD		0x40
+diff --git a/sound/soc/codecs/sta32x.c b/sound/soc/codecs/sta32x.c
+index d2f3715..25ae059 100644
+--- a/sound/soc/codecs/sta32x.c
++++ b/sound/soc/codecs/sta32x.c
+@@ -143,42 +143,42 @@ static const unsigned int sta32x_limiter_drc_release_tlv[] = {
+ 	13, 16, TLV_DB_SCALE_ITEM(-1500, 300, 0),
+ };
+ 
+-static const struct soc_enum sta32x_drc_ac_enum =
+-	SOC_ENUM_SINGLE(STA32X_CONFD, STA32X_CONFD_DRC_SHIFT,
+-			2, sta32x_drc_ac);
+-static const struct soc_enum sta32x_auto_eq_enum =
+-	SOC_ENUM_SINGLE(STA32X_AUTO1, STA32X_AUTO1_AMEQ_SHIFT,
+-			3, sta32x_auto_eq_mode);
+-static const struct soc_enum sta32x_auto_gc_enum =
+-	SOC_ENUM_SINGLE(STA32X_AUTO1, STA32X_AUTO1_AMGC_SHIFT,
+-			4, sta32x_auto_gc_mode);
+-static const struct soc_enum sta32x_auto_xo_enum =
+-	SOC_ENUM_SINGLE(STA32X_AUTO2, STA32X_AUTO2_XO_SHIFT,
+-			16, sta32x_auto_xo_mode);
+-static const struct soc_enum sta32x_preset_eq_enum =
+-	SOC_ENUM_SINGLE(STA32X_AUTO3, STA32X_AUTO3_PEQ_SHIFT,
+-			32, sta32x_preset_eq_mode);
+-static const struct soc_enum sta32x_limiter_ch1_enum =
+-	SOC_ENUM_SINGLE(STA32X_C1CFG, STA32X_CxCFG_LS_SHIFT,
+-			3, sta32x_limiter_select);
+-static const struct soc_enum sta32x_limiter_ch2_enum =
+-	SOC_ENUM_SINGLE(STA32X_C2CFG, STA32X_CxCFG_LS_SHIFT,
+-			3, sta32x_limiter_select);
+-static const struct soc_enum sta32x_limiter_ch3_enum =
+-	SOC_ENUM_SINGLE(STA32X_C3CFG, STA32X_CxCFG_LS_SHIFT,
+-			3, sta32x_limiter_select);
+-static const struct soc_enum sta32x_limiter1_attack_rate_enum =
+-	SOC_ENUM_SINGLE(STA32X_L1AR, STA32X_LxA_SHIFT,
+-			16, sta32x_limiter_attack_rate);
+-static const struct soc_enum sta32x_limiter2_attack_rate_enum =
+-	SOC_ENUM_SINGLE(STA32X_L2AR, STA32X_LxA_SHIFT,
+-			16, sta32x_limiter_attack_rate);
+-static const struct soc_enum sta32x_limiter1_release_rate_enum =
+-	SOC_ENUM_SINGLE(STA32X_L1AR, STA32X_LxR_SHIFT,
+-			16, sta32x_limiter_release_rate);
+-static const struct soc_enum sta32x_limiter2_release_rate_enum =
+-	SOC_ENUM_SINGLE(STA32X_L2AR, STA32X_LxR_SHIFT,
+-			16, sta32x_limiter_release_rate);
++static SOC_ENUM_SINGLE_DECL(sta32x_drc_ac_enum,
++			    STA32X_CONFD, STA32X_CONFD_DRC_SHIFT,
++			    sta32x_drc_ac);
++static SOC_ENUM_SINGLE_DECL(sta32x_auto_eq_enum,
++			    STA32X_AUTO1, STA32X_AUTO1_AMEQ_SHIFT,
++			    sta32x_auto_eq_mode);
++static SOC_ENUM_SINGLE_DECL(sta32x_auto_gc_enum,
++			    STA32X_AUTO1, STA32X_AUTO1_AMGC_SHIFT,
++			    sta32x_auto_gc_mode);
++static SOC_ENUM_SINGLE_DECL(sta32x_auto_xo_enum,
++			    STA32X_AUTO2, STA32X_AUTO2_XO_SHIFT,
++			    sta32x_auto_xo_mode);
++static SOC_ENUM_SINGLE_DECL(sta32x_preset_eq_enum,
++			    STA32X_AUTO3, STA32X_AUTO3_PEQ_SHIFT,
++			    sta32x_preset_eq_mode);
++static SOC_ENUM_SINGLE_DECL(sta32x_limiter_ch1_enum,
++			    STA32X_C1CFG, STA32X_CxCFG_LS_SHIFT,
++			    sta32x_limiter_select);
++static SOC_ENUM_SINGLE_DECL(sta32x_limiter_ch2_enum,
++			    STA32X_C2CFG, STA32X_CxCFG_LS_SHIFT,
++			    sta32x_limiter_select);
++static SOC_ENUM_SINGLE_DECL(sta32x_limiter_ch3_enum,
++			    STA32X_C3CFG, STA32X_CxCFG_LS_SHIFT,
++			    sta32x_limiter_select);
++static SOC_ENUM_SINGLE_DECL(sta32x_limiter1_attack_rate_enum,
++			    STA32X_L1AR, STA32X_LxA_SHIFT,
++			    sta32x_limiter_attack_rate);
++static SOC_ENUM_SINGLE_DECL(sta32x_limiter2_attack_rate_enum,
++			    STA32X_L2AR, STA32X_LxA_SHIFT,
++			    sta32x_limiter_attack_rate);
++static SOC_ENUM_SINGLE_DECL(sta32x_limiter1_release_rate_enum,
++			    STA32X_L1AR, STA32X_LxR_SHIFT,
++			    sta32x_limiter_release_rate);
++static SOC_ENUM_SINGLE_DECL(sta32x_limiter2_release_rate_enum,
++			    STA32X_L2AR, STA32X_LxR_SHIFT,
++			    sta32x_limiter_release_rate);
+ 
+ /* byte array controls for setting biquad, mixer, scaling coefficients;
+  * for biquads all five coefficients need to be set in one go,
+@@ -350,7 +350,7 @@ SOC_SINGLE_TLV("Treble Tone Control", STA32X_TONE, STA32X_TONE_TTC_SHIFT, 15, 0,
+ SOC_ENUM("Limiter1 Attack Rate (dB/ms)", sta32x_limiter1_attack_rate_enum),
+ SOC_ENUM("Limiter2 Attack Rate (dB/ms)", sta32x_limiter2_attack_rate_enum),
+ SOC_ENUM("Limiter1 Release Rate (dB/ms)", sta32x_limiter1_release_rate_enum),
+-SOC_ENUM("Limiter2 Release Rate (dB/ms)", sta32x_limiter1_release_rate_enum),
++SOC_ENUM("Limiter2 Release Rate (dB/ms)", sta32x_limiter2_release_rate_enum),
+ 
+ /* depending on mode, the attack/release thresholds have
+  * two different enum definitions; provide both
+diff --git a/sound/soc/codecs/wm8770.c b/sound/soc/codecs/wm8770.c
+index aa05e65..d5f7d8d 100644
+--- a/sound/soc/codecs/wm8770.c
++++ b/sound/soc/codecs/wm8770.c
+@@ -163,8 +163,8 @@ static const char *ain_text[] = {
+ 	"AIN5", "AIN6", "AIN7", "AIN8"
+ };
+ 
+-static const struct soc_enum ain_enum =
+-	SOC_ENUM_DOUBLE(WM8770_ADCMUX, 0, 4, 8, ain_text);
++static SOC_ENUM_DOUBLE_DECL(ain_enum,
++			    WM8770_ADCMUX, 0, 4, ain_text);
+ 
+ static const struct snd_kcontrol_new ain_mux =
+ 	SOC_DAPM_ENUM("Capture Mux", ain_enum);
+diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c
+index 41b9fe0..4f7b330 100644
+--- a/sound/usb/mixer.c
++++ b/sound/usb/mixer.c
+@@ -831,6 +831,7 @@ static void volume_control_quirks(struct usb_mixer_elem_info *cval,
+ 		}
+ 		break;
+ 
++	case USB_ID(0x046d, 0x0807): /* Logitech Webcam C500 */
+ 	case USB_ID(0x046d, 0x0808):
+ 	case USB_ID(0x046d, 0x0809):
+ 	case USB_ID(0x046d, 0x081b): /* HD Webcam c310 */
+diff --git a/sound/usb/mixer_maps.c b/sound/usb/mixer_maps.c
+index f1324c4..0e4e909 100644
+--- a/sound/usb/mixer_maps.c
++++ b/sound/usb/mixer_maps.c
+@@ -304,6 +304,11 @@ static struct usbmix_name_map hercules_usb51_map[] = {
+ 	{ 0 }				/* terminator */
+ };
+ 
++static const struct usbmix_name_map kef_x300a_map[] = {
++	{ 10, NULL }, /* firmware locks up (?) when we try to access this FU */
++	{ 0 }
++};
++
+ /*
+  * Control map entries
+  */
+@@ -371,6 +376,10 @@ static struct usbmix_ctl_map usbmix_ctl_maps[] = {
+ 		.map = scratch_live_map,
+ 		.ignore_ctl_error = 1,
+ 	},
++	{
++		.id = USB_ID(0x27ac, 0x1000),
++		.map = kef_x300a_map,
++	},
+ 	{ 0 } /* terminator */
+ };
+ 
+diff --git a/tools/power/x86/turbostat/turbostat.c b/tools/power/x86/turbostat/turbostat.c
+index 3c6f780..279a2f1 100644
+--- a/tools/power/x86/turbostat/turbostat.c
++++ b/tools/power/x86/turbostat/turbostat.c
+@@ -32,6 +32,7 @@
+ #include <dirent.h>
+ #include <string.h>
+ #include <ctype.h>
++#include <cpuid.h>
+ 
+ #define MSR_TSC	0x10
+ #define MSR_NEHALEM_PLATFORM_INFO	0xCE
+@@ -847,7 +848,7 @@ void check_cpuid()
+ 
+ 	eax = ebx = ecx = edx = 0;
+ 
+-	asm("cpuid" : "=a" (max_level), "=b" (ebx), "=c" (ecx), "=d" (edx) : "a" (0));
++	__get_cpuid(0, &max_level, &ebx, &ecx, &edx);
+ 
+ 	if (ebx == 0x756e6547 && edx == 0x49656e69 && ecx == 0x6c65746e)
+ 		genuine_intel = 1;
+@@ -856,7 +857,7 @@ void check_cpuid()
+ 		fprintf(stderr, "%.4s%.4s%.4s ",
+ 			(char *)&ebx, (char *)&edx, (char *)&ecx);
+ 
+-	asm("cpuid" : "=a" (fms), "=c" (ecx), "=d" (edx) : "a" (1) : "ebx");
++	__get_cpuid(1, &fms, &ebx, &ecx, &edx);
+ 	family = (fms >> 8) & 0xf;
+ 	model = (fms >> 4) & 0xf;
+ 	stepping = fms & 0xf;
+@@ -878,7 +879,7 @@ void check_cpuid()
+ 	 * This check is valid for both Intel and AMD.
+ 	 */
+ 	ebx = ecx = edx = 0;
+-	asm("cpuid" : "=a" (max_level), "=b" (ebx), "=c" (ecx), "=d" (edx) : "a" (0x80000000));
++	__get_cpuid(0x80000000, &max_level, &ebx, &ecx, &edx);
+ 
+ 	if (max_level < 0x80000007) {
+ 		fprintf(stderr, "CPUID: no invariant TSC (max_level 0x%x)\n", max_level);
+@@ -889,7 +890,7 @@ void check_cpuid()
+ 	 * Non-Stop TSC is advertised by CPUID.EAX=0x80000007: EDX.bit8
+ 	 * this check is valid for both Intel and AMD
+ 	 */
+-	asm("cpuid" : "=a" (eax), "=b" (ebx), "=c" (ecx), "=d" (edx) : "a" (0x80000007));
++	__get_cpuid(0x80000007, &eax, &ebx, &ecx, &edx);
+ 	has_invariant_tsc = edx & (1 << 8);
+ 
+ 	if (!has_invariant_tsc) {
+@@ -902,7 +903,7 @@ void check_cpuid()
+ 	 * this check is valid for both Intel and AMD
+ 	 */
+ 
+-	asm("cpuid" : "=a" (eax), "=b" (ebx), "=c" (ecx), "=d" (edx) : "a" (0x6));
++	__get_cpuid(0x6, &eax, &ebx, &ecx, &edx);
+ 	has_aperf = ecx & (1 << 0);
+ 	if (!has_aperf) {
+ 		fprintf(stderr, "No APERF MSR\n");
+diff --git a/virt/kvm/coalesced_mmio.c b/virt/kvm/coalesced_mmio.c
+index a6ec206..e56b240 100644
+--- a/virt/kvm/coalesced_mmio.c
++++ b/virt/kvm/coalesced_mmio.c
+@@ -148,17 +148,13 @@ int kvm_vm_ioctl_register_coalesced_mmio(struct kvm *kvm,
+ 	list_add_tail(&dev->list, &kvm->coalesced_zones);
+ 	mutex_unlock(&kvm->slots_lock);
+ 
+-	return ret;
++	return 0;
+ 
+ out_free_dev:
+ 	mutex_unlock(&kvm->slots_lock);
+-
+ 	kfree(dev);
+ 
+-	if (dev == NULL)
+-		return -ENXIO;
+-
+-	return 0;
++	return ret;
+ }
+ 
+ int kvm_vm_ioctl_unregister_coalesced_mmio(struct kvm *kvm,
diff --git a/3.2.55/4420_grsecurity-3.0-3.2.55-201403300851.patch b/3.2.56/4420_grsecurity-3.0-3.2.56-201404012135.patch
index 73a3dcc..4f4f0f9 100644
--- a/3.2.55/4420_grsecurity-3.0-3.2.55-201403300851.patch
+++ b/3.2.56/4420_grsecurity-3.0-3.2.56-201404012135.patch
@@ -273,7 +273,7 @@ index 88fd7f5..b318a78 100644
  ==============================================================
  
 diff --git a/Makefile b/Makefile
-index 538463e..aa55228 100644
+index ec90bfb..3e09b31 100644
 --- a/Makefile
 +++ b/Makefile
 @@ -245,8 +245,9 @@ CONFIG_SHELL := $(shell if [ -x "$$BASH" ]; then echo $$BASH; \
@@ -1563,7 +1563,7 @@ index 75fe66b..2255c86 100644
  /*
   * Memory returned by kmalloc() may be used for DMA, so we must make
 diff --git a/arch/arm/include/asm/cacheflush.h b/arch/arm/include/asm/cacheflush.h
-index 1397408..c4f6969 100644
+index b1e0e07..071fe7c 100644
 --- a/arch/arm/include/asm/cacheflush.h
 +++ b/arch/arm/include/asm/cacheflush.h
 @@ -108,7 +108,7 @@ struct cpu_cache_fns {
@@ -17832,10 +17832,10 @@ index df5e41f..816c719 100644
  extern int generic_get_free_region(unsigned long base, unsigned long size,
  				   int replace_reg);
 diff --git a/arch/x86/kernel/cpu/perf_event.c b/arch/x86/kernel/cpu/perf_event.c
-index 2bda212..78cc605 100644
+index 1c041e0..ec625d2 100644
 --- a/arch/x86/kernel/cpu/perf_event.c
 +++ b/arch/x86/kernel/cpu/perf_event.c
-@@ -1529,7 +1529,7 @@ perf_callchain_user(struct perf_callchain_entry *entry, struct pt_regs *regs)
+@@ -1532,7 +1532,7 @@ perf_callchain_user(struct perf_callchain_entry *entry, struct pt_regs *regs)
  			break;
  
  		perf_callchain_store(entry, frame.return_address);
@@ -21090,7 +21090,7 @@ index 8c96897..060ff2d 100644
  	regs->flags = (regs->flags & ~X86_EFLAGS_IOPL) | (level << 12);
  	t->iopl = level << 12;
 diff --git a/arch/x86/kernel/irq.c b/arch/x86/kernel/irq.c
-index fb2eb32..62793bd 100644
+index 687637b..3e626d9 100644
 --- a/arch/x86/kernel/irq.c
 +++ b/arch/x86/kernel/irq.c
 @@ -18,7 +18,7 @@
@@ -23040,7 +23040,7 @@ index 16204dc..0e7d4b7 100644
  	.smp_prepare_cpus	= native_smp_prepare_cpus,
  	.smp_cpus_done		= native_smp_cpus_done,
 diff --git a/arch/x86/kernel/smpboot.c b/arch/x86/kernel/smpboot.c
-index 9f548cb..053b7e5 100644
+index b88eadb..ac6663c 100644
 --- a/arch/x86/kernel/smpboot.c
 +++ b/arch/x86/kernel/smpboot.c
 @@ -692,7 +692,7 @@ static int __cpuinit do_boot_cpu(int apicid, int cpu)
@@ -24363,7 +24363,7 @@ index f5302da..6ee193e 100644
  
  /* instruction has only one source operand, destination is implicit (e.g. mul, div, imul, idiv) */
 diff --git a/arch/x86/kvm/lapic.c b/arch/x86/kvm/lapic.c
-index 757c716..11c70cf 100644
+index 176205a..920cd58 100644
 --- a/arch/x86/kvm/lapic.c
 +++ b/arch/x86/kvm/lapic.c
 @@ -53,7 +53,7 @@
@@ -24420,10 +24420,10 @@ index 9299410..ade2f9b 100644
  	spin_unlock(&vcpu->kvm->mmu_lock);
  
 diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c
-index 94a4672..5c6b853 100644
+index 2102a17..16e1531 100644
 --- a/arch/x86/kvm/svm.c
 +++ b/arch/x86/kvm/svm.c
-@@ -3405,7 +3405,11 @@ static void reload_tss(struct kvm_vcpu *vcpu)
+@@ -3403,7 +3403,11 @@ static void reload_tss(struct kvm_vcpu *vcpu)
  	int cpu = raw_smp_processor_id();
  
  	struct svm_cpu_data *sd = per_cpu(svm_data, cpu);
@@ -24566,10 +24566,10 @@ index aac5ea7..266eda9 100644
  
  	vmx->exit_reason = vmcs_read32(VM_EXIT_REASON);
 diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
-index 7774cca..97dedc9 100644
+index b9fefaf..32b0407 100644
 --- a/arch/x86/kvm/x86.c
 +++ b/arch/x86/kvm/x86.c
-@@ -1341,8 +1341,8 @@ static int xen_hvm_config(struct kvm_vcpu *vcpu, u64 data)
+@@ -1344,8 +1344,8 @@ static int xen_hvm_config(struct kvm_vcpu *vcpu, u64 data)
  {
  	struct kvm *kvm = vcpu->kvm;
  	int lm = is_long_mode(vcpu);
@@ -24580,7 +24580,7 @@ index 7774cca..97dedc9 100644
  	u8 blob_size = lm ? kvm->arch.xen_hvm_config.blob_size_64
  		: kvm->arch.xen_hvm_config.blob_size_32;
  	u32 page_num = data & ~PAGE_MASK;
-@@ -2159,6 +2159,8 @@ long kvm_arch_dev_ioctl(struct file *filp,
+@@ -2162,6 +2162,8 @@ long kvm_arch_dev_ioctl(struct file *filp,
  		if (n < msr_list.nmsrs)
  			goto out;
  		r = -EFAULT;
@@ -24589,7 +24589,7 @@ index 7774cca..97dedc9 100644
  		if (copy_to_user(user_msr_list->indices, &msrs_to_save,
  				 num_msrs_to_save * sizeof(u32)))
  			goto out;
-@@ -2334,15 +2336,20 @@ static int kvm_vcpu_ioctl_set_cpuid2(struct kvm_vcpu *vcpu,
+@@ -2337,15 +2339,20 @@ static int kvm_vcpu_ioctl_set_cpuid2(struct kvm_vcpu *vcpu,
  				     struct kvm_cpuid2 *cpuid,
  				     struct kvm_cpuid_entry2 __user *entries)
  {
@@ -24613,7 +24613,7 @@ index 7774cca..97dedc9 100644
  	vcpu->arch.cpuid_nent = cpuid->nent;
  	kvm_apic_set_version(vcpu);
  	kvm_x86_ops->cpuid_update(vcpu);
-@@ -2357,15 +2364,19 @@ static int kvm_vcpu_ioctl_get_cpuid2(struct kvm_vcpu *vcpu,
+@@ -2360,15 +2367,19 @@ static int kvm_vcpu_ioctl_get_cpuid2(struct kvm_vcpu *vcpu,
  				     struct kvm_cpuid2 *cpuid,
  				     struct kvm_cpuid_entry2 __user *entries)
  {
@@ -24636,7 +24636,7 @@ index 7774cca..97dedc9 100644
  	return 0;
  
  out:
-@@ -2740,7 +2751,7 @@ static int kvm_vcpu_ioctl_set_lapic(struct kvm_vcpu *vcpu,
+@@ -2743,7 +2754,7 @@ static int kvm_vcpu_ioctl_set_lapic(struct kvm_vcpu *vcpu,
  static int kvm_vcpu_ioctl_interrupt(struct kvm_vcpu *vcpu,
  				    struct kvm_interrupt *irq)
  {
@@ -24645,7 +24645,7 @@ index 7774cca..97dedc9 100644
  		return -EINVAL;
  	if (irqchip_in_kernel(vcpu->kvm))
  		return -ENXIO;
-@@ -5181,7 +5192,7 @@ static void kvm_set_mmio_spte_mask(void)
+@@ -5184,7 +5195,7 @@ static void kvm_set_mmio_spte_mask(void)
  	kvm_mmu_set_mmio_spte_mask(mask);
  }
  
@@ -32367,10 +32367,10 @@ index de2802c..2260da9 100644
  				unsigned long timeout_msec)
  {
 diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
-index 72bbb5e..19f16d3 100644
+index b3f0f5a..b6bc0a7 100644
 --- a/drivers/ata/libata-core.c
 +++ b/drivers/ata/libata-core.c
-@@ -4749,7 +4749,7 @@ void ata_qc_free(struct ata_queued_cmd *qc)
+@@ -4777,7 +4777,7 @@ void ata_qc_free(struct ata_queued_cmd *qc)
  	struct ata_port *ap;
  	unsigned int tag;
  
@@ -32379,7 +32379,7 @@ index 72bbb5e..19f16d3 100644
  	ap = qc->ap;
  
  	qc->flags = 0;
-@@ -4765,7 +4765,7 @@ void __ata_qc_complete(struct ata_queued_cmd *qc)
+@@ -4793,7 +4793,7 @@ void __ata_qc_complete(struct ata_queued_cmd *qc)
  	struct ata_port *ap;
  	struct ata_link *link;
  
@@ -32388,7 +32388,7 @@ index 72bbb5e..19f16d3 100644
  	WARN_ON_ONCE(!(qc->flags & ATA_QCFLAG_ACTIVE));
  	ap = qc->ap;
  	link = qc->dev->link;
-@@ -5770,6 +5770,7 @@ static void ata_finalize_port_ops(struct ata_port_operations *ops)
+@@ -5798,6 +5798,7 @@ static void ata_finalize_port_ops(struct ata_port_operations *ops)
  		return;
  
  	spin_lock(&lock);
@@ -32396,7 +32396,7 @@ index 72bbb5e..19f16d3 100644
  
  	for (cur = ops->inherits; cur; cur = cur->inherits) {
  		void **inherit = (void **)cur;
-@@ -5783,8 +5784,9 @@ static void ata_finalize_port_ops(struct ata_port_operations *ops)
+@@ -5811,8 +5812,9 @@ static void ata_finalize_port_ops(struct ata_port_operations *ops)
  		if (IS_ERR(*pp))
  			*pp = NULL;
  
@@ -36739,10 +36739,10 @@ index 74d6ec34..baff517 100644
  	{0,}			/* 0 terminated list. */
  };
 diff --git a/drivers/edac/i7300_edac.c b/drivers/edac/i7300_edac.c
-index 2244df0..8a3b7a9 100644
+index 1e08426..87e8c13 100644
 --- a/drivers/edac/i7300_edac.c
 +++ b/drivers/edac/i7300_edac.c
-@@ -1192,7 +1192,7 @@ static void __devexit i7300_remove_one(struct pci_dev *pdev)
+@@ -1194,7 +1194,7 @@ static void __devexit i7300_remove_one(struct pci_dev *pdev)
   *
   * Has only 8086:360c PCI ID
   */
@@ -36752,7 +36752,7 @@ index 2244df0..8a3b7a9 100644
  	{0,}			/* 0 terminated list. */
  };
 diff --git a/drivers/edac/i7core_edac.c b/drivers/edac/i7core_edac.c
-index b3ccefa..d39303b 100644
+index 4c18b3c..f256adc 100644
 --- a/drivers/edac/i7core_edac.c
 +++ b/drivers/edac/i7core_edac.c
 @@ -391,7 +391,7 @@ static const struct pci_id_table pci_dev_table[] = {
@@ -37691,7 +37691,7 @@ index 93e74fb..4a1182d 100644
  	INIT_WORK(&dev_priv->hotplug_work, i915_hotplug_work_func);
  	INIT_WORK(&dev_priv->error_work, i915_error_work_func);
 diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
-index 61b708b..c8ca0e9 100644
+index 2ea8a96..65e685e 100644
 --- a/drivers/gpu/drm/i915/intel_display.c
 +++ b/drivers/gpu/drm/i915/intel_display.c
 @@ -2215,7 +2215,7 @@ intel_finish_fb(struct drm_framebuffer *old_fb)
@@ -37728,7 +37728,7 @@ index 61b708b..c8ca0e9 100644
  	pipesrc = I915_READ(PIPESRC(intel_crtc->pipe)) & 0x0fff0fff;
  	OUT_RING(pf | pipesrc);
  
-@@ -7333,7 +7338,7 @@ static int intel_crtc_page_flip(struct drm_crtc *crtc,
+@@ -7347,7 +7352,7 @@ static int intel_crtc_page_flip(struct drm_crtc *crtc,
  	/* Block clients from rendering to the new back buffer until
  	 * the flip occurs and the object is no longer visible.
  	 */
@@ -37737,7 +37737,7 @@ index 61b708b..c8ca0e9 100644
  
  	ret = dev_priv->display.queue_flip(dev, crtc, fb, obj);
  	if (ret)
-@@ -7347,7 +7352,7 @@ static int intel_crtc_page_flip(struct drm_crtc *crtc,
+@@ -7361,7 +7366,7 @@ static int intel_crtc_page_flip(struct drm_crtc *crtc,
  	return 0;
  
  cleanup_pending:
@@ -37746,7 +37746,7 @@ index 61b708b..c8ca0e9 100644
  	crtc->fb = old_fb;
  	drm_gem_object_unreference(&work->old_fb_obj->base);
  	drm_gem_object_unreference(&obj->base);
-@@ -7482,11 +7487,15 @@ static void intel_crtc_init(struct drm_device *dev, int pipe)
+@@ -7496,11 +7501,15 @@ static void intel_crtc_init(struct drm_device *dev, int pipe)
  	if (HAS_PCH_SPLIT(dev)) {
  		if (pipe == 2 && IS_IVYBRIDGE(dev))
  			intel_crtc->no_pll = true;
@@ -37766,7 +37766,7 @@ index 61b708b..c8ca0e9 100644
  	}
  
  	drm_crtc_helper_add(&intel_crtc->base, &intel_helper_funcs);
-@@ -8862,7 +8871,7 @@ struct intel_quirk {
+@@ -8876,7 +8885,7 @@ struct intel_quirk {
  	int subsystem_vendor;
  	int subsystem_device;
  	void (*hook)(struct drm_device *dev);
@@ -38230,10 +38230,10 @@ index 441570b..8896094 100644
  }
  
 diff --git a/drivers/gpu/drm/radeon/r600.c b/drivers/gpu/drm/radeon/r600.c
-index 57e45c6..73bf8a5 100644
+index f7e3cc0..d9878ef 100644
 --- a/drivers/gpu/drm/radeon/r600.c
 +++ b/drivers/gpu/drm/radeon/r600.c
-@@ -2440,7 +2440,9 @@ int r600_startup(struct radeon_device *rdev)
+@@ -2442,7 +2442,9 @@ int r600_startup(struct radeon_device *rdev)
  	r = r600_blit_init(rdev);
  	if (r) {
  		r600_blit_fini(rdev);
@@ -38954,7 +38954,7 @@ index f4c3d28..82f45a9 100644
  	ret = create_gpadl_header(kbuffer, size, &msginfo, &msgcount);
  	if (ret)
 diff --git a/drivers/hv/hv.c b/drivers/hv/hv.c
-index 0fb100e..baf87e5 100644
+index 0fb100e..8a1a2a4 100644
 --- a/drivers/hv/hv.c
 +++ b/drivers/hv/hv.c
 @@ -132,7 +132,7 @@ static u64 do_hypercall(u64 control, void *input, void *output)
@@ -38966,6 +38966,15 @@ index 0fb100e..baf87e5 100644
  
  	__asm__ __volatile__ ("call *%8" : "=d"(hv_status_hi),
  			      "=a"(hv_status_lo) : "d" (control_hi),
+@@ -176,7 +176,7 @@ int hv_init(void)
+ 	/* See if the hypercall page is already set */
+ 	rdmsrl(HV_X64_MSR_HYPERCALL, hypercall_msr.as_uint64);
+ 
+-	virtaddr = __vmalloc(PAGE_SIZE, GFP_KERNEL, PAGE_KERNEL_EXEC);
++	virtaddr = __vmalloc(PAGE_SIZE, GFP_KERNEL, PAGE_KERNEL_RX);
+ 
+ 	if (!virtaddr)
+ 		goto cleanup;
 diff --git a/drivers/hv/hyperv_vmbus.h b/drivers/hv/hyperv_vmbus.h
 index 0aee112..b72d21f 100644
 --- a/drivers/hv/hyperv_vmbus.h
@@ -41676,7 +41685,7 @@ index 237571a..fb6d19b 100644
  	pmd->bl_info.value_type.inc = data_block_inc;
  	pmd->bl_info.value_type.dec = data_block_dec;
 diff --git a/drivers/md/dm.c b/drivers/md/dm.c
-index 8953630..29b12d9 100644
+index 7ead065..832d24d 100644
 --- a/drivers/md/dm.c
 +++ b/drivers/md/dm.c
 @@ -177,9 +177,9 @@ struct mapped_device {
@@ -41702,7 +41711,7 @@ index 8953630..29b12d9 100644
  	INIT_LIST_HEAD(&md->uevent_list);
  	spin_lock_init(&md->uevent_lock);
  
-@@ -2006,7 +2006,7 @@ static void event_callback(void *context)
+@@ -2007,7 +2007,7 @@ static void event_callback(void *context)
  
  	dm_send_uevents(&uevents, &disk_to_dev(md->disk)->kobj);
  
@@ -41711,7 +41720,7 @@ index 8953630..29b12d9 100644
  	wake_up(&md->eventq);
  }
  
-@@ -2648,18 +2648,18 @@ int dm_kobject_uevent(struct mapped_device *md, enum kobject_action action,
+@@ -2649,18 +2649,18 @@ int dm_kobject_uevent(struct mapped_device *md, enum kobject_action action,
  
  uint32_t dm_next_uevent_seq(struct mapped_device *md)
  {
@@ -41991,7 +42000,7 @@ index 6d05e26..a579e8c 100644
  
  			rdev_dec_pending(rdev, mddev);
 diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
-index fb67833..09c4732 100644
+index 7c963c4..1204886 100644
 --- a/drivers/md/raid5.c
 +++ b/drivers/md/raid5.c
 @@ -1618,19 +1618,19 @@ static void raid5_end_read_request(struct bio * bi, int error)
@@ -43493,7 +43502,7 @@ index 9a517c2..6d245e1 100644
  /**
   * Send and RX_MODE ramrod according to the provided parameters.
 diff --git a/drivers/net/ethernet/broadcom/tg3.h b/drivers/net/ethernet/broadcom/tg3.h
-index da90ba5..dcba1fd 100644
+index a398a6f..4b6f6df 100644
 --- a/drivers/net/ethernet/broadcom/tg3.h
 +++ b/drivers/net/ethernet/broadcom/tg3.h
 @@ -134,6 +134,7 @@
@@ -44429,7 +44438,7 @@ index e773250..9ee61ab 100644
  
  	/* we will have to manufacture ethernet headers, prepare template */
 diff --git a/drivers/net/usb/usbnet.c b/drivers/net/usb/usbnet.c
-index dc53a8f..2b66cc1 100644
+index 3d21742..ddf9899 100644
 --- a/drivers/net/usb/usbnet.c
 +++ b/drivers/net/usb/usbnet.c
 @@ -344,6 +344,12 @@ static int rx_submit (struct usbnet *dev, struct urb *urb, gfp_t flags)
@@ -44445,7 +44454,7 @@ index dc53a8f..2b66cc1 100644
  	if ((skb = alloc_skb (size + NET_IP_ALIGN, flags)) == NULL) {
  		netif_dbg(dev, rx_err, dev->net, "no rx skb\n");
  		usbnet_defer_kevent (dev, EVENT_RX_MEMORY);
-@@ -503,6 +509,17 @@ block:
+@@ -498,6 +504,17 @@ block:
  		break;
  	}
  
@@ -44463,7 +44472,7 @@ index dc53a8f..2b66cc1 100644
  	state = defer_bh(dev, skb, &dev->rxq, state);
  
  	if (urb) {
-@@ -789,6 +806,11 @@ int usbnet_open (struct net_device *net)
+@@ -784,6 +801,11 @@ int usbnet_open (struct net_device *net)
  		   (dev->driver_info->flags & FLAG_FRAMING_AX) ? "ASIX" :
  		   "simple");
  
@@ -44475,7 +44484,7 @@ index dc53a8f..2b66cc1 100644
  	// delay posting reads until we're fully open
  	tasklet_schedule (&dev->bh);
  	if (info->manage_power) {
-@@ -1227,6 +1249,9 @@ static void usbnet_bh (unsigned long param)
+@@ -1222,6 +1244,9 @@ static void usbnet_bh (unsigned long param)
  		}
  	}
  
@@ -44681,7 +44690,7 @@ index ac1176a..79e93d4 100644
  
  	/* Only super-user can write RIDs */
 diff --git a/drivers/net/wireless/at76c50x-usb.c b/drivers/net/wireless/at76c50x-usb.c
-index 4045e5a..506f1cf 100644
+index 4045e5a..506f1cfd 100644
 --- a/drivers/net/wireless/at76c50x-usb.c
 +++ b/drivers/net/wireless/at76c50x-usb.c
 @@ -353,7 +353,7 @@ static u8 at76_dfu_get_state(struct usb_device *udev, u8 *state)
@@ -46145,10 +46154,10 @@ index 023d17d..74ef35b 100644
  		init_data = &pdata->regulators[i];
  		priv->regulators[i] = regulator_register(
 diff --git a/drivers/rtc/rtc-cmos.c b/drivers/rtc/rtc-cmos.c
-index e3eed18..155946b 100644
+index cae8985..8027fa7 100644
 --- a/drivers/rtc/rtc-cmos.c
 +++ b/drivers/rtc/rtc-cmos.c
-@@ -724,7 +724,9 @@ cmos_do_probe(struct device *dev, struct resource *ports, int rtc_irq)
+@@ -772,7 +772,9 @@ cmos_do_probe(struct device *dev, struct resource *ports, int rtc_irq)
  	hpet_rtc_timer_init();
  
  	/* export at least the first block of NVRAM */
@@ -47889,10 +47898,10 @@ index ed147c4..94fc3c6 100644
  
  /* core tmem accessor functions */
 diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c
-index 45c13a6..f8c847c 100644
+index 4a88eea..f00e986 100644
 --- a/drivers/target/iscsi/iscsi_target.c
 +++ b/drivers/target/iscsi/iscsi_target.c
-@@ -1349,7 +1349,7 @@ static int iscsit_handle_data_out(struct iscsi_conn *conn, unsigned char *buf)
+@@ -1357,7 +1357,7 @@ static int iscsit_handle_data_out(struct iscsi_conn *conn, unsigned char *buf)
  		 * outstanding_r2ts reaches zero, go ahead and send the delayed
  		 * TASK_ABORTED status.
  		 */
@@ -48333,10 +48342,10 @@ index ef92869..f4ebd88 100644
  			ipwireless_disassociate_network_ttys(network,
  							     ttyj->channel_idx);
 diff --git a/drivers/tty/n_gsm.c b/drivers/tty/n_gsm.c
-index d190269..f59727e 100644
+index 643a0a0..4da1c03 100644
 --- a/drivers/tty/n_gsm.c
 +++ b/drivers/tty/n_gsm.c
-@@ -1638,7 +1638,7 @@ static struct gsm_dlci *gsm_dlci_alloc(struct gsm_mux *gsm, int addr)
+@@ -1649,7 +1649,7 @@ static struct gsm_dlci *gsm_dlci_alloc(struct gsm_mux *gsm, int addr)
  	kref_init(&dlci->ref);
  	mutex_init(&dlci->mutex);
  	dlci->fifo = &dlci->_fifo;
@@ -49317,6 +49326,38 @@ index 5f6df6e..0a16602 100644
  }
  
  /*
+diff --git a/drivers/vhost/net.c b/drivers/vhost/net.c
+index 5c58128..92c839d 100644
+--- a/drivers/vhost/net.c
++++ b/drivers/vhost/net.c
+@@ -346,6 +346,12 @@ static int get_rx_bufs(struct vhost_virtqueue *vq,
+ 	*iovcount = seg;
+ 	if (unlikely(log))
+ 		*log_num = nlogs;
++
++	/* Detect overrun */
++	if (unlikely(datalen > 0)) {
++		r = UIO_MAXIOV + 1;
++		goto err;
++	}
+ 	return headcount;
+ err:
+ 	vhost_discard_vq_desc(vq, headcount);
+@@ -400,6 +406,14 @@ static void handle_rx(struct vhost_net *net)
+ 		/* On error, stop handling until the next kick. */
+ 		if (unlikely(headcount < 0))
+ 			break;
++		/* On overrun, truncate and discard */
++		if (unlikely(headcount > UIO_MAXIOV)) {
++			msg.msg_iovlen = 1;
++			err = sock->ops->recvmsg(NULL, sock, &msg,
++						 1, MSG_DONTWAIT | MSG_TRUNC);
++			pr_debug("Discarded rx packet: len %zd\n", sock_len);
++			continue;
++		}
+ 		/* OK, now we need to know about added descriptors. */
+ 		if (!headcount) {
+ 			if (unlikely(vhost_enable_notify(&net->dev, vq))) {
 diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c
 index be32b1b..b5f6c08 100644
 --- a/drivers/vhost/vhost.c
@@ -54392,7 +54433,7 @@ index dede441..f2a2507 100644
  
  		WARN_ON(trans->transid != btrfs_header_generation(parent));
 diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
-index 49eefdb..547693e 100644
+index f63719a..5f00ed6 100644
 --- a/fs/btrfs/extent-tree.c
 +++ b/fs/btrfs/extent-tree.c
 @@ -5642,7 +5642,7 @@ again:
@@ -54405,25 +54446,10 @@ index 49eefdb..547693e 100644
  		do_chunk_alloc(trans, root->fs_info->extent_root,
  			       num_bytes, data, CHUNK_ALLOC_FORCE);
 diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
-index 618ae6f..82d0bc6 100644
+index 7cbe2f8..2e2ed72 100644
 --- a/fs/btrfs/ioctl.c
 +++ b/fs/btrfs/ioctl.c
-@@ -1329,6 +1329,14 @@ static noinline int btrfs_ioctl_snap_create_transid(struct file *file,
- 			ret = -EINVAL;
- 			fput(src_file);
- 			goto out;
-+		} else if (!inode_owner_or_capable(src_inode)) {
-+			/*
-+			 * Subvolume creation is not restricted, but snapshots
-+			 * are limited to own subvolumes only
-+			 */
-+			ret = -EPERM;
-+			fput(src_file);
-+			goto out;
- 		}
- 		ret = btrfs_mksubvol(&file->f_path, name, namelen,
- 				     BTRFS_I(src_inode)->root,
-@@ -2733,9 +2741,12 @@ long btrfs_ioctl_space_info(struct btrfs_root *root, void __user *arg)
+@@ -2738,9 +2738,12 @@ long btrfs_ioctl_space_info(struct btrfs_root *root, void __user *arg)
  	for (i = 0; i < num_types; i++) {
  		struct btrfs_space_info *tmp;
  
@@ -54436,7 +54462,7 @@ index 618ae6f..82d0bc6 100644
  		info = NULL;
  		rcu_read_lock();
  		list_for_each_entry_rcu(tmp, &root->fs_info->space_info,
-@@ -2757,15 +2768,12 @@ long btrfs_ioctl_space_info(struct btrfs_root *root, void __user *arg)
+@@ -2762,15 +2765,12 @@ long btrfs_ioctl_space_info(struct btrfs_root *root, void __user *arg)
  				memcpy(dest, &space, sizeof(space));
  				dest++;
  				space_args.total_spaces++;
@@ -54493,10 +54519,10 @@ index 200f63b..490b833 100644
  /*
   * used by btrfsctl to scan devices when no FS is mounted
 diff --git a/fs/buffer.c b/fs/buffer.c
-index 19a4f0b..6638f5c 100644
+index 5f4bde2..9dffef0 100644
 --- a/fs/buffer.c
 +++ b/fs/buffer.c
-@@ -3314,7 +3314,7 @@ void __init buffer_init(void)
+@@ -3316,7 +3316,7 @@ void __init buffer_init(void)
  	bh_cachep = kmem_cache_create("buffer_head",
  			sizeof(struct buffer_head), 0,
  				(SLAB_RECLAIM_ACCOUNT|SLAB_PANIC|
@@ -56709,19 +56735,10 @@ index 2845a1f..f29de63 100644
  		if (free_clusters >= (nclusters + dirty_clusters))
  			return 1;
 diff --git a/fs/ext4/ext4.h b/fs/ext4/ext4.h
-index 68b1602..7f3507d 100644
+index 40f4d06..7f3507d 100644
 --- a/fs/ext4/ext4.h
 +++ b/fs/ext4/ext4.h
-@@ -745,6 +745,8 @@ do {									       \
- 	if (EXT4_FITS_IN_INODE(raw_inode, einode, xtime))		       \
- 		(einode)->xtime.tv_sec = 				       \
- 			(signed)le32_to_cpu((raw_inode)->xtime);	       \
-+	else								       \
-+		(einode)->xtime.tv_sec = 0;				       \
- 	if (EXT4_FITS_IN_INODE(raw_inode, einode, xtime ## _extra))	       \
- 		ext4_decode_extra_time(&(einode)->xtime,		       \
- 				       raw_inode->xtime ## _extra);	       \
-@@ -1216,19 +1218,19 @@ struct ext4_sb_info {
+@@ -1218,19 +1218,19 @@ struct ext4_sb_info {
  	unsigned long s_mb_last_start;
  
  	/* stats for buddy allocator */
@@ -57119,7 +57136,7 @@ index cf6f434..3d7942c 100644
  
  err_nocleanup:
 diff --git a/fs/file.c b/fs/file.c
-index 4c6992d..41c1f84 100644
+index 30bfc99..b4b9a12 100644
 --- a/fs/file.c
 +++ b/fs/file.c
 @@ -15,6 +15,7 @@
@@ -58652,10 +58669,10 @@ index 3426521..3b75162 100644
  	cuse_class = class_create(THIS_MODULE, "cuse");
  	if (IS_ERR(cuse_class))
 diff --git a/fs/fuse/dev.c b/fs/fuse/dev.c
-index 5c029fb..96e676c 100644
+index cf0098d..a849907 100644
 --- a/fs/fuse/dev.c
 +++ b/fs/fuse/dev.c
-@@ -1242,7 +1242,7 @@ static ssize_t fuse_dev_splice_read(struct file *in, loff_t *ppos,
+@@ -1226,7 +1226,7 @@ static ssize_t fuse_dev_splice_read(struct file *in, loff_t *ppos,
  	ret = 0;
  	pipe_lock(pipe);
  
@@ -58773,10 +58790,10 @@ index 2f72da5..7ee87b1 100644
  static int __init init_hostfs(void)
  {
 diff --git a/fs/hpfs/super.c b/fs/hpfs/super.c
-index f760c15..61b7191 100644
+index b03e766..0b5cb61 100644
 --- a/fs/hpfs/super.c
 +++ b/fs/hpfs/super.c
-@@ -691,6 +691,7 @@ static struct file_system_type hpfs_fs_type = {
+@@ -707,6 +707,7 @@ static struct file_system_type hpfs_fs_type = {
  	.kill_sb	= kill_block_super,
  	.fs_flags	= FS_REQUIRES_DEV,
  };
@@ -59884,7 +59901,7 @@ index b78b5b6..c64d84f 100644
  
  void nfs_fattr_init(struct nfs_fattr *fattr)
 diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
-index 3d02931..e2b575a 100644
+index 5aea30a..5dcc620 100644
 --- a/fs/nfs/nfs4proc.c
 +++ b/fs/nfs/nfs4proc.c
 @@ -1037,7 +1037,7 @@ static struct nfs4_state *nfs4_try_open_cached(struct nfs4_opendata *opendata)
@@ -62580,7 +62597,7 @@ index dba43c3..4e25536 100644
  
  	if (op) {
 diff --git a/fs/splice.c b/fs/splice.c
-index 58ab918..24425c2 100644
+index 714471d..2ca7fb5 100644
 --- a/fs/splice.c
 +++ b/fs/splice.c
 @@ -195,7 +195,7 @@ ssize_t splice_to_pipe(struct pipe_inode_info *pipe,
@@ -62604,7 +62621,7 @@ index 58ab918..24425c2 100644
  	}
  
  	pipe_unlock(pipe);
-@@ -564,7 +564,7 @@ static ssize_t kernel_readv(struct file *file, const struct iovec *vec,
+@@ -582,7 +582,7 @@ static ssize_t kernel_readv(struct file *file, const struct iovec *vec,
  	old_fs = get_fs();
  	set_fs(get_ds());
  	/* The cast to a user pointer is valid due to the set_fs() */
@@ -62613,7 +62630,7 @@ index 58ab918..24425c2 100644
  	set_fs(old_fs);
  
  	return res;
-@@ -579,7 +579,7 @@ static ssize_t kernel_write(struct file *file, const char *buf, size_t count,
+@@ -597,7 +597,7 @@ static ssize_t kernel_write(struct file *file, const char *buf, size_t count,
  	old_fs = get_fs();
  	set_fs(get_ds());
  	/* The cast to a user pointer is valid due to the set_fs() */
@@ -62622,7 +62639,7 @@ index 58ab918..24425c2 100644
  	set_fs(old_fs);
  
  	return res;
-@@ -631,7 +631,7 @@ ssize_t default_file_splice_read(struct file *in, loff_t *ppos,
+@@ -649,7 +649,7 @@ ssize_t default_file_splice_read(struct file *in, loff_t *ppos,
  			goto err;
  
  		this_len = min_t(size_t, len, PAGE_CACHE_SIZE - offset);
@@ -62631,7 +62648,7 @@ index 58ab918..24425c2 100644
  		vec[i].iov_len = this_len;
  		spd.pages[i] = page;
  		spd.nr_pages++;
-@@ -855,10 +855,10 @@ EXPORT_SYMBOL(splice_from_pipe_feed);
+@@ -873,10 +873,10 @@ EXPORT_SYMBOL(splice_from_pipe_feed);
  int splice_from_pipe_next(struct pipe_inode_info *pipe, struct splice_desc *sd)
  {
  	while (!pipe->nrbufs) {
@@ -62644,7 +62661,7 @@ index 58ab918..24425c2 100644
  			return 0;
  
  		if (sd->flags & SPLICE_F_NONBLOCK)
-@@ -1191,7 +1191,7 @@ ssize_t splice_direct_to_actor(struct file *in, struct splice_desc *sd,
+@@ -1209,7 +1209,7 @@ ssize_t splice_direct_to_actor(struct file *in, struct splice_desc *sd,
  		 * out of the pipe right after the splice_to_pipe(). So set
  		 * PIPE_READERS appropriately.
  		 */
@@ -62653,7 +62670,7 @@ index 58ab918..24425c2 100644
  
  		current->splice_pipe = pipe;
  	}
-@@ -1459,6 +1459,7 @@ static int get_iovec_page_array(const struct iovec __user *iov,
+@@ -1477,6 +1477,7 @@ static int get_iovec_page_array(const struct iovec __user *iov,
  
  			partial[buffers].offset = off;
  			partial[buffers].len = plen;
@@ -62661,7 +62678,7 @@ index 58ab918..24425c2 100644
  
  			off = 0;
  			len -= plen;
-@@ -1744,9 +1745,9 @@ static int ipipe_prep(struct pipe_inode_info *pipe, unsigned int flags)
+@@ -1762,9 +1763,9 @@ static int ipipe_prep(struct pipe_inode_info *pipe, unsigned int flags)
  			ret = -ERESTARTSYS;
  			break;
  		}
@@ -62673,7 +62690,7 @@ index 58ab918..24425c2 100644
  			if (flags & SPLICE_F_NONBLOCK) {
  				ret = -EAGAIN;
  				break;
-@@ -1778,7 +1779,7 @@ static int opipe_prep(struct pipe_inode_info *pipe, unsigned int flags)
+@@ -1796,7 +1797,7 @@ static int opipe_prep(struct pipe_inode_info *pipe, unsigned int flags)
  	pipe_lock(pipe);
  
  	while (pipe->nrbufs >= pipe->buffers) {
@@ -62682,7 +62699,7 @@ index 58ab918..24425c2 100644
  			send_sig(SIGPIPE, current, 0);
  			ret = -EPIPE;
  			break;
-@@ -1791,9 +1792,9 @@ static int opipe_prep(struct pipe_inode_info *pipe, unsigned int flags)
+@@ -1809,9 +1810,9 @@ static int opipe_prep(struct pipe_inode_info *pipe, unsigned int flags)
  			ret = -ERESTARTSYS;
  			break;
  		}
@@ -62694,7 +62711,7 @@ index 58ab918..24425c2 100644
  	}
  
  	pipe_unlock(pipe);
-@@ -1829,14 +1830,14 @@ retry:
+@@ -1847,14 +1848,14 @@ retry:
  	pipe_double_lock(ipipe, opipe);
  
  	do {
@@ -62711,7 +62728,7 @@ index 58ab918..24425c2 100644
  			break;
  
  		/*
-@@ -1933,7 +1934,7 @@ static int link_pipe(struct pipe_inode_info *ipipe,
+@@ -1951,7 +1952,7 @@ static int link_pipe(struct pipe_inode_info *ipipe,
  	pipe_double_lock(ipipe, opipe);
  
  	do {
@@ -62720,7 +62737,7 @@ index 58ab918..24425c2 100644
  			send_sig(SIGPIPE, current, 0);
  			if (!ret)
  				ret = -EPIPE;
-@@ -1978,7 +1979,7 @@ static int link_pipe(struct pipe_inode_info *ipipe,
+@@ -1996,7 +1997,7 @@ static int link_pipe(struct pipe_inode_info *ipipe,
  	 * return EAGAIN if we have the potential of some data in the
  	 * future, otherwise just return 0
  	 */
@@ -75610,18 +75627,11 @@ index d42bd48..554dcd5 100644
  /*
   * epoll (fs/eventpoll.c) compat bits follow ...
 diff --git a/include/linux/compiler-gcc4.h b/include/linux/compiler-gcc4.h
-index 643d6c4..3c5171b 100644
+index e2a360a..1d61efb 100644
 --- a/include/linux/compiler-gcc4.h
 +++ b/include/linux/compiler-gcc4.h
-@@ -39,13 +39,29 @@
-  *
-  * (asm goto is automatically volatile - the naming reflects this.)
-  */
--#if GCC_VERSION <= 40801
- # define asm_volatile_goto(x...)	do { asm goto(x); asm (""); } while (0)
--#else
--# define asm_volatile_goto(x...)	do { asm goto(x); } while (0)
--#endif
+@@ -42,6 +42,26 @@
+ #define asm_volatile_goto(x...)	do { asm goto(x); asm (""); } while (0)
  
  #if __GNUC_MINOR__ >= 5
 +
@@ -75647,7 +75657,7 @@ index 643d6c4..3c5171b 100644
  /*
   * Mark a position in code as unreachable.  This can be used to
   * suppress control flow warnings after asm blocks that transfer
-@@ -61,6 +77,11 @@
+@@ -57,6 +77,11 @@
  #define __noclone	__attribute__((__noclone__))
  
  #endif
@@ -78098,7 +78108,7 @@ index f1e2527..9a323d1 100644
  	irq_flow_handler_t	handle_irq;
  #ifdef CONFIG_IRQ_PREFLOW_FASTEOI
 diff --git a/include/linux/jiffies.h b/include/linux/jiffies.h
-index 265e2c3..cdd6f29 100644
+index f5df3dc..116cbeb 100644
 --- a/include/linux/jiffies.h
 +++ b/include/linux/jiffies.h
 @@ -295,9 +295,9 @@ extern unsigned long preset_lpj;
@@ -78337,10 +78347,10 @@ index e6796c1..350d338 100644
  
  int kvm_arch_vcpu_init(struct kvm_vcpu *vcpu);
 diff --git a/include/linux/libata.h b/include/linux/libata.h
-index 62467ca..3d65d7d 100644
+index b1fcdba..855901a 100644
 --- a/include/linux/libata.h
 +++ b/include/linux/libata.h
-@@ -910,7 +910,7 @@ struct ata_port_operations {
+@@ -912,7 +912,7 @@ struct ata_port_operations {
  	 * fields must be pointers.
  	 */
  	const struct ata_port_operations	*inherits;
@@ -79338,7 +79348,7 @@ index 38d1032..d3f6744 100644
  extern struct pid_namespace init_pid_ns;
  
 diff --git a/include/linux/pipe_fs_i.h b/include/linux/pipe_fs_i.h
-index 0072a53..c5dcca5 100644
+index 8778c26..732cf42 100644
 --- a/include/linux/pipe_fs_i.h
 +++ b/include/linux/pipe_fs_i.h
 @@ -47,9 +47,9 @@ struct pipe_buffer {
@@ -83846,10 +83856,10 @@ index b463871..59495fd 100644
   * nsown_capable - Check superior capability to one's own user_ns
   * @cap: The capability in question
 diff --git a/kernel/cgroup.c b/kernel/cgroup.c
-index 2a1ffb7..b99a595 100644
+index 93fc15e..6e62dfa 100644
 --- a/kernel/cgroup.c
 +++ b/kernel/cgroup.c
-@@ -5164,7 +5164,7 @@ static int cgroup_css_links_read(struct cgroup *cont,
+@@ -5169,7 +5169,7 @@ static int cgroup_css_links_read(struct cgroup *cont,
  		struct css_set *cg = link->cg;
  		struct task_struct *task;
  		int count = 0;
@@ -84267,7 +84277,7 @@ index 63786e7..0780cac 100644
  #ifdef CONFIG_MODULE_UNLOAD
  		{
 diff --git a/kernel/events/core.c b/kernel/events/core.c
-index 83d5621..8c6738d 100644
+index b15b4f7..dc15ea9 100644
 --- a/kernel/events/core.c
 +++ b/kernel/events/core.c
 @@ -145,8 +145,15 @@ static struct srcu_struct pmus_srcu;
@@ -85045,7 +85055,7 @@ index 60f7e32..d703ad4 100644
  };
  
 diff --git a/kernel/irq/manage.c b/kernel/irq/manage.c
-index 52bdd58..56002b5 100644
+index 47752298..4d8aa3c 100644
 --- a/kernel/irq/manage.c
 +++ b/kernel/irq/manage.c
 @@ -900,22 +900,6 @@ __setup_irq(unsigned int irq, struct irq_desc *desc, struct irqaction *new)
@@ -86934,7 +86944,7 @@ index 3d4b954..11af930 100644
  
  		if (pm_wakeup_pending()) {
 diff --git a/kernel/printk.c b/kernel/printk.c
-index 16688ec..327729b 100644
+index 8fac434..7759a11 100644
 --- a/kernel/printk.c
 +++ b/kernel/printk.c
 @@ -313,6 +313,11 @@ static int check_syslog_permissions(int type, bool from_file)
@@ -87893,7 +87903,7 @@ index f280df1..da1281d 100644
  #ifdef CONFIG_RT_GROUP_SCHED
  	/*
 diff --git a/kernel/sched_fair.c b/kernel/sched_fair.c
-index 37f3f39..6d3b6e1 100644
+index 4c6dae1..0050e446 100644
 --- a/kernel/sched_fair.c
 +++ b/kernel/sched_fair.c
 @@ -4803,7 +4803,7 @@ static void nohz_idle_balance(int this_cpu, enum cpu_idle_type idle) { }
@@ -89398,7 +89408,7 @@ index c3509fb..ebec319 100644
  			cpumask_clear_cpu(cpu, tick_get_broadcast_mask());
  			tick_broadcast_clear_oneshot(cpu);
 diff --git a/kernel/time/timekeeping.c b/kernel/time/timekeeping.c
-index cb7f33e..7504d61 100644
+index 068c092..13b1bff 100644
 --- a/kernel/time/timekeeping.c
 +++ b/kernel/time/timekeeping.c
 @@ -14,6 +14,7 @@
@@ -89599,10 +89609,10 @@ index 16fc34a..efd8bb8 100644
  	ret = -EIO;
  	bt->dropped_file = debugfs_create_file("dropped", 0444, dir, bt,
 diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
-index cf8b439..fe97a05 100644
+index a65fa36..ca1b827 100644
 --- a/kernel/trace/ftrace.c
 +++ b/kernel/trace/ftrace.c
-@@ -1598,12 +1598,17 @@ ftrace_code_disable(struct module *mod, struct dyn_ftrace *rec)
+@@ -1610,12 +1610,17 @@ ftrace_code_disable(struct module *mod, struct dyn_ftrace *rec)
  	if (unlikely(ftrace_disabled))
  		return 0;
  
@@ -89622,7 +89632,7 @@ index cf8b439..fe97a05 100644
  }
  
  /*
-@@ -2665,7 +2670,7 @@ static void ftrace_free_entry_rcu(struct rcu_head *rhp)
+@@ -2695,7 +2700,7 @@ static void ftrace_free_entry_rcu(struct rcu_head *rhp)
  
  int
  register_ftrace_function_probe(char *glob, struct ftrace_probe_ops *ops,
@@ -89631,7 +89641,7 @@ index cf8b439..fe97a05 100644
  {
  	struct ftrace_func_probe *entry;
  	struct ftrace_page *pg;
-@@ -4034,8 +4039,6 @@ ftrace_enable_sysctl(struct ctl_table *table, int write,
+@@ -4064,8 +4069,6 @@ ftrace_enable_sysctl(struct ctl_table *table, int write,
  #ifdef CONFIG_FUNCTION_GRAPH_TRACER
  
  static int ftrace_graph_active;
@@ -89640,7 +89650,7 @@ index cf8b439..fe97a05 100644
  int ftrace_graph_entry_stub(struct ftrace_graph_ent *trace)
  {
  	return 0;
-@@ -4179,6 +4182,10 @@ ftrace_suspend_notifier_call(struct notifier_block *bl, unsigned long state,
+@@ -4210,6 +4213,10 @@ ftrace_suspend_notifier_call(struct notifier_block *bl, unsigned long state,
  	return NOTIFY_DONE;
  }
  
@@ -89651,7 +89661,7 @@ index cf8b439..fe97a05 100644
  /* Just a place holder for function graph */
  static struct ftrace_ops fgraph_ops __read_mostly = {
  	.func		= ftrace_stub,
-@@ -4198,7 +4205,6 @@ int register_ftrace_graph(trace_func_graph_ret_t retfunc,
+@@ -4253,7 +4260,6 @@ int register_ftrace_graph(trace_func_graph_ret_t retfunc,
  		goto out;
  	}
  
@@ -89660,7 +89670,7 @@ index cf8b439..fe97a05 100644
  
  	ftrace_graph_active++;
 diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c
-index 6fdc629..55739fe 100644
+index 648f25a..5971796 100644
 --- a/kernel/trace/ring_buffer.c
 +++ b/kernel/trace/ring_buffer.c
 @@ -376,9 +376,9 @@ struct buffer_data_page {
@@ -89789,7 +89799,7 @@ index 6fdc629..55739fe 100644
  
  	/* set write to only the index of the write */
  	write &= RB_WRITE_MASK;
-@@ -2051,7 +2051,7 @@ __rb_reserve_next(struct ring_buffer_per_cpu *cpu_buffer,
+@@ -2058,7 +2058,7 @@ __rb_reserve_next(struct ring_buffer_per_cpu *cpu_buffer,
  	kmemcheck_annotate_bitfield(event, bitfield);
  	rb_update_event(cpu_buffer, event, length, add_timestamp, delta);
  
@@ -89798,7 +89808,7 @@ index 6fdc629..55739fe 100644
  
  	/*
  	 * If this is the first commit on the page, then update
-@@ -2084,7 +2084,7 @@ rb_try_to_discard(struct ring_buffer_per_cpu *cpu_buffer,
+@@ -2091,7 +2091,7 @@ rb_try_to_discard(struct ring_buffer_per_cpu *cpu_buffer,
  
  	if (bpage->page == (void *)addr && rb_page_write(bpage) == old_index) {
  		unsigned long write_mask =
@@ -89807,7 +89817,7 @@ index 6fdc629..55739fe 100644
  		unsigned long event_length = rb_event_length(event);
  		/*
  		 * This is on the tail page. It is possible that
-@@ -2094,7 +2094,7 @@ rb_try_to_discard(struct ring_buffer_per_cpu *cpu_buffer,
+@@ -2101,7 +2101,7 @@ rb_try_to_discard(struct ring_buffer_per_cpu *cpu_buffer,
  		 */
  		old_index += write_mask;
  		new_index += write_mask;
@@ -89816,7 +89826,7 @@ index 6fdc629..55739fe 100644
  		if (index == old_index) {
  			/* update counters */
  			local_sub(event_length, &cpu_buffer->entries_bytes);
-@@ -2433,7 +2433,7 @@ rb_decrement_entry(struct ring_buffer_per_cpu *cpu_buffer,
+@@ -2440,7 +2440,7 @@ rb_decrement_entry(struct ring_buffer_per_cpu *cpu_buffer,
  
  	/* Do the likely case first */
  	if (likely(bpage->page == (void *)addr)) {
@@ -89825,7 +89835,7 @@ index 6fdc629..55739fe 100644
  		return;
  	}
  
-@@ -2445,7 +2445,7 @@ rb_decrement_entry(struct ring_buffer_per_cpu *cpu_buffer,
+@@ -2452,7 +2452,7 @@ rb_decrement_entry(struct ring_buffer_per_cpu *cpu_buffer,
  	start = bpage;
  	do {
  		if (bpage->page == (void *)addr) {
@@ -89834,7 +89844,7 @@ index 6fdc629..55739fe 100644
  			return;
  		}
  		rb_inc_page(cpu_buffer, &bpage);
-@@ -2670,7 +2670,7 @@ static inline unsigned long
+@@ -2677,7 +2677,7 @@ static inline unsigned long
  rb_num_of_entries(struct ring_buffer_per_cpu *cpu_buffer)
  {
  	return local_read(&cpu_buffer->entries) -
@@ -89843,7 +89853,7 @@ index 6fdc629..55739fe 100644
  }
  
  /**
-@@ -2758,7 +2758,7 @@ unsigned long ring_buffer_overrun_cpu(struct ring_buffer *buffer, int cpu)
+@@ -2765,7 +2765,7 @@ unsigned long ring_buffer_overrun_cpu(struct ring_buffer *buffer, int cpu)
  		return 0;
  
  	cpu_buffer = buffer->buffers[cpu];
@@ -89852,7 +89862,7 @@ index 6fdc629..55739fe 100644
  
  	return ret;
  }
-@@ -2779,7 +2779,7 @@ ring_buffer_commit_overrun_cpu(struct ring_buffer *buffer, int cpu)
+@@ -2786,7 +2786,7 @@ ring_buffer_commit_overrun_cpu(struct ring_buffer *buffer, int cpu)
  		return 0;
  
  	cpu_buffer = buffer->buffers[cpu];
@@ -89861,7 +89871,7 @@ index 6fdc629..55739fe 100644
  
  	return ret;
  }
-@@ -2824,7 +2824,7 @@ unsigned long ring_buffer_overruns(struct ring_buffer *buffer)
+@@ -2831,7 +2831,7 @@ unsigned long ring_buffer_overruns(struct ring_buffer *buffer)
  	/* if you care about this being correct, lock the buffer */
  	for_each_buffer_cpu(buffer, cpu) {
  		cpu_buffer = buffer->buffers[cpu];
@@ -89870,7 +89880,7 @@ index 6fdc629..55739fe 100644
  	}
  
  	return overruns;
-@@ -2996,8 +2996,8 @@ rb_get_reader_page(struct ring_buffer_per_cpu *cpu_buffer)
+@@ -3003,8 +3003,8 @@ rb_get_reader_page(struct ring_buffer_per_cpu *cpu_buffer)
  	/*
  	 * Reset the reader page to size zero.
  	 */
@@ -89881,7 +89891,7 @@ index 6fdc629..55739fe 100644
  	local_set(&cpu_buffer->reader_page->page->commit, 0);
  	cpu_buffer->reader_page->real_end = 0;
  
-@@ -3031,7 +3031,7 @@ rb_get_reader_page(struct ring_buffer_per_cpu *cpu_buffer)
+@@ -3038,7 +3038,7 @@ rb_get_reader_page(struct ring_buffer_per_cpu *cpu_buffer)
  	 * want to compare with the last_overrun.
  	 */
  	smp_mb();
@@ -89890,7 +89900,7 @@ index 6fdc629..55739fe 100644
  
  	/*
  	 * Here's the tricky part.
-@@ -3579,8 +3579,8 @@ rb_reset_cpu(struct ring_buffer_per_cpu *cpu_buffer)
+@@ -3586,8 +3586,8 @@ rb_reset_cpu(struct ring_buffer_per_cpu *cpu_buffer)
  
  	cpu_buffer->head_page
  		= list_entry(cpu_buffer->pages, struct buffer_page, list);
@@ -89901,7 +89911,7 @@ index 6fdc629..55739fe 100644
  	local_set(&cpu_buffer->head_page->page->commit, 0);
  
  	cpu_buffer->head_page->read = 0;
-@@ -3589,14 +3589,14 @@ rb_reset_cpu(struct ring_buffer_per_cpu *cpu_buffer)
+@@ -3596,14 +3596,14 @@ rb_reset_cpu(struct ring_buffer_per_cpu *cpu_buffer)
  	cpu_buffer->commit_page = cpu_buffer->head_page;
  
  	INIT_LIST_HEAD(&cpu_buffer->reader_page->list);
@@ -89920,7 +89930,7 @@ index 6fdc629..55739fe 100644
  	local_set(&cpu_buffer->entries, 0);
  	local_set(&cpu_buffer->committing, 0);
  	local_set(&cpu_buffer->commits, 0);
-@@ -3994,8 +3994,8 @@ int ring_buffer_read_page(struct ring_buffer *buffer,
+@@ -4001,8 +4001,8 @@ int ring_buffer_read_page(struct ring_buffer *buffer,
  		rb_init_page(bpage);
  		bpage = reader->page;
  		reader->page = *data_page;
@@ -90002,7 +90012,7 @@ index 3947835..8c0488b 100644
 +	return atomic64_add_return_unchecked(1, &trace_counter);
  }
 diff --git a/kernel/trace/trace_events.c b/kernel/trace/trace_events.c
-index c212a7f..a2560bc 100644
+index 875fed4..7a76cbb 100644
 --- a/kernel/trace/trace_events.c
 +++ b/kernel/trace/trace_events.c
 @@ -1299,10 +1299,6 @@ static LIST_HEAD(ftrace_module_file_list);
@@ -90040,7 +90050,7 @@ index c212a7f..a2560bc 100644
  
  	list_add(&file_ops->list, &ftrace_module_file_list);
  
-@@ -1357,8 +1348,8 @@ static void trace_module_add_events(struct module *mod)
+@@ -1367,8 +1358,8 @@ static void trace_module_add_events(struct module *mod)
  
  	for_each_event(call, start, end) {
  		__trace_add_event_call(*call, mod,
@@ -90236,10 +90246,10 @@ index a8bc4d9..eae8357 100644
  };
  
 diff --git a/kernel/workqueue.c b/kernel/workqueue.c
-index 0bc9ff0..4722738 100644
+index 563820c..1548b9b 100644
 --- a/kernel/workqueue.c
 +++ b/kernel/workqueue.c
-@@ -3499,7 +3499,7 @@ static int __cpuinit trustee_thread(void *__gcwq)
+@@ -3506,7 +3506,7 @@ static int __cpuinit trustee_thread(void *__gcwq)
  		 */
  		worker_flags |= WORKER_REBIND;
  		worker_flags &= ~WORKER_ROGUE;
@@ -90306,10 +90316,10 @@ index 82928f5..a3c7bb1 100644
  	  This option lets you use the FireWire bus for remote debugging
  	  with help of the firewire-ohci driver. It enables unfiltered
 diff --git a/lib/Makefile b/lib/Makefile
-index a4da283..57fec5e 100644
+index c06efca..bcafc28 100644
 --- a/lib/Makefile
 +++ b/lib/Makefile
-@@ -45,7 +45,7 @@ obj-$(CONFIG_GENERIC_HWEIGHT) += hweight.o
+@@ -46,7 +46,7 @@ obj-$(CONFIG_GENERIC_HWEIGHT) += hweight.o
  
  obj-$(CONFIG_BTREE) += btree.o
  obj-$(CONFIG_DEBUG_PREEMPT) += smp_processor_id.o
@@ -90792,7 +90802,7 @@ index d9df745..e73c2fe 100644
  static inline void *ptr_to_indirect(void *ptr)
  {
 diff --git a/lib/random32.c b/lib/random32.c
-index 1f44bdc..fb616c7 100644
+index 1f44bdc..009bfe8 100644
 --- a/lib/random32.c
 +++ b/lib/random32.c
 @@ -2,19 +2,19 @@
@@ -90991,7 +91001,7 @@ index 1f44bdc..fb616c7 100644
  {
  	int i;
  	/*
-@@ -92,59 +179,264 @@ void srandom32(u32 entropy)
+@@ -92,59 +179,275 @@ void srandom32(u32 entropy)
  	 */
  	for_each_possible_cpu (i) {
  		struct rnd_state *state = &per_cpu(net_rand_state, i);
@@ -91078,8 +91088,19 @@ index 1f44bdc..fb616c7 100644
 +	static bool latch = false;
 +	static DEFINE_SPINLOCK(lock);
 +
++	/* Asking for random bytes might result in bytes getting
++	 * moved into the nonblocking pool and thus marking it
++	 * as initialized. In this case we would double back into
++	 * this function and attempt to do a late reseed.
++	 * Ignore the pointless attempt to reseed again if we're
++	 * already waiting for bytes when the nonblocking pool
++	 * got initialized.
++	 */
++
 +	/* only allow initial seeding (late == false) once */
-+	spin_lock_irqsave(&lock, flags);
++	if (!spin_trylock_irqsave(&lock, flags))
++		return;
++
 +	if (latch && !late)
 +		goto out;
 +	latch = true;
@@ -94815,7 +94836,7 @@ index 1db7971..5dba7b6 100644
  	struct mm_struct *mm;
  
 diff --git a/mm/page-writeback.c b/mm/page-writeback.c
-index ea3f83b..001a216 100644
+index b5cd796..9e4ec7c 100644
 --- a/mm/page-writeback.c
 +++ b/mm/page-writeback.c
 @@ -522,7 +522,7 @@ unsigned long bdi_dirty_limit(struct backing_dev_info *bdi, unsigned long dirty)
@@ -95033,7 +95054,7 @@ index cbcbb02..dfdc1de 100644
  				   pgoff_t offset, unsigned long max)
  {
 diff --git a/mm/rmap.c b/mm/rmap.c
-index 8685697..7c99a3c 100644
+index 52a2f36..7c99a3c 100644
 --- a/mm/rmap.c
 +++ b/mm/rmap.c
 @@ -153,6 +153,10 @@ int anon_vma_prepare(struct vm_area_struct *vma)
@@ -95138,18 +95159,6 @@ index 8685697..7c99a3c 100644
  }
  
  /*
-@@ -581,7 +620,11 @@ pte_t *__page_check_address(struct page *page, struct mm_struct *mm,
- 	spinlock_t *ptl;
- 
- 	if (unlikely(PageHuge(page))) {
-+		/* when pud is not present, pte will be NULL */
- 		pte = huge_pte_offset(mm, address);
-+		if (!pte)
-+			return NULL;
-+
- 		ptl = &mm->page_table_lock;
- 		goto check;
- 	}
 diff --git a/mm/shmem.c b/mm/shmem.c
 index a78acf0..a31df98 100644
 --- a/mm/shmem.c
@@ -95870,7 +95879,7 @@ index 8105be4..8c1ce34 100644
  EXPORT_SYMBOL(kmem_cache_free);
  
 diff --git a/mm/slub.c b/mm/slub.c
-index 5710788..3d095c0 100644
+index fc719f7..47b3df4 100644
 --- a/mm/slub.c
 +++ b/mm/slub.c
 @@ -186,7 +186,7 @@ static enum {
@@ -96158,7 +96167,7 @@ index 5710788..3d095c0 100644
  enum slab_stat_type {
  	SL_ALL,			/* All slabs */
  	SL_PARTIAL,		/* Only partially allocated slabs */
-@@ -4670,7 +4760,7 @@ SLAB_ATTR_RO(ctor);
+@@ -4676,7 +4766,7 @@ SLAB_ATTR_RO(ctor);
  
  static ssize_t aliases_show(struct kmem_cache *s, char *buf)
  {
@@ -96167,7 +96176,7 @@ index 5710788..3d095c0 100644
  }
  SLAB_ATTR_RO(aliases);
  
-@@ -5237,6 +5327,7 @@ static char *create_unique_id(struct kmem_cache *s)
+@@ -5243,6 +5333,7 @@ static char *create_unique_id(struct kmem_cache *s)
  	return name;
  }
  
@@ -96175,7 +96184,7 @@ index 5710788..3d095c0 100644
  static int sysfs_slab_add(struct kmem_cache *s)
  {
  	int err;
-@@ -5265,7 +5356,7 @@ static int sysfs_slab_add(struct kmem_cache *s)
+@@ -5271,7 +5362,7 @@ static int sysfs_slab_add(struct kmem_cache *s)
  	}
  
  	s->kobj.kset = slab_kset;
@@ -96184,7 +96193,7 @@ index 5710788..3d095c0 100644
  	if (err) {
  		kobject_put(&s->kobj);
  		return err;
-@@ -5299,6 +5390,7 @@ static void sysfs_slab_remove(struct kmem_cache *s)
+@@ -5305,6 +5396,7 @@ static void sysfs_slab_remove(struct kmem_cache *s)
  	kobject_del(&s->kobj);
  	kobject_put(&s->kobj);
  }
@@ -96192,7 +96201,7 @@ index 5710788..3d095c0 100644
  
  /*
   * Need to buffer aliases during bootup until sysfs becomes
-@@ -5312,6 +5404,7 @@ struct saved_alias {
+@@ -5318,6 +5410,7 @@ struct saved_alias {
  
  static struct saved_alias *alias_list;
  
@@ -96200,7 +96209,7 @@ index 5710788..3d095c0 100644
  static int sysfs_slab_alias(struct kmem_cache *s, const char *name)
  {
  	struct saved_alias *al;
-@@ -5334,6 +5427,7 @@ static int sysfs_slab_alias(struct kmem_cache *s, const char *name)
+@@ -5340,6 +5433,7 @@ static int sysfs_slab_alias(struct kmem_cache *s, const char *name)
  	alias_list = al;
  	return 0;
  }
@@ -96249,7 +96258,7 @@ index a4b9016..d1a1b68 100644
  }
  
 diff --git a/mm/swapfile.c b/mm/swapfile.c
-index fad1830..6aa3a7f 100644
+index dbd2b67..a1eac8c 100644
 --- a/mm/swapfile.c
 +++ b/mm/swapfile.c
 @@ -61,7 +61,7 @@ static DEFINE_MUTEX(swapon_mutex);
@@ -96261,16 +96270,16 @@ index fad1830..6aa3a7f 100644
  
  static inline unsigned char swap_count(unsigned char ent)
  {
-@@ -1668,7 +1668,7 @@ SYSCALL_DEFINE1(swapoff, const char __user *, specialfile)
- 	}
- 	filp_close(swap_file, NULL);
+@@ -1677,7 +1677,7 @@ SYSCALL_DEFINE1(swapoff, const char __user *, specialfile)
+ 	spin_unlock(&swap_lock);
+ 
  	err = 0;
 -	atomic_inc(&proc_poll_event);
 +	atomic_inc_unchecked(&proc_poll_event);
  	wake_up_interruptible(&proc_poll_wait);
  
  out_dput:
-@@ -1684,8 +1684,8 @@ static unsigned swaps_poll(struct file *file, poll_table *wait)
+@@ -1693,8 +1693,8 @@ static unsigned swaps_poll(struct file *file, poll_table *wait)
  
  	poll_wait(file, &proc_poll_wait, wait);
  
@@ -96281,7 +96290,7 @@ index fad1830..6aa3a7f 100644
  		return POLLIN | POLLRDNORM | POLLERR | POLLPRI;
  	}
  
-@@ -1783,7 +1783,7 @@ static int swaps_open(struct inode *inode, struct file *file)
+@@ -1792,7 +1792,7 @@ static int swaps_open(struct inode *inode, struct file *file)
  		return ret;
  
  	seq = file->private_data;
@@ -96290,7 +96299,7 @@ index fad1830..6aa3a7f 100644
  	return 0;
  }
  
-@@ -2117,7 +2117,7 @@ SYSCALL_DEFINE2(swapon, const char __user *, specialfile, int, swap_flags)
+@@ -2126,7 +2126,7 @@ SYSCALL_DEFINE2(swapon, const char __user *, specialfile, int, swap_flags)
  		(p->flags & SWP_DISCARDABLE) ? "D" : "");
  
  	mutex_unlock(&swapon_mutex);
@@ -98111,10 +98120,10 @@ index 925991a..209a505 100644
  #ifdef CONFIG_INET
  static u32 seq_scale(u32 seq)
 diff --git a/net/core/skbuff.c b/net/core/skbuff.c
-index af9c3c6..76914a3 100644
+index 5d6cb54..6367e1e 100644
 --- a/net/core/skbuff.c
 +++ b/net/core/skbuff.c
-@@ -2902,13 +2902,15 @@ void __init skb_init(void)
+@@ -2872,13 +2872,15 @@ void __init skb_init(void)
  	skbuff_head_cache = kmem_cache_create("skbuff_head_cache",
  					      sizeof(struct sk_buff),
  					      0,
@@ -102468,29 +102477,11 @@ index 76388b0..a967f68 100644
  	NULL,
  	sctp_generate_t1_cookie_event,
  	sctp_generate_t1_init_event,
-diff --git a/net/sctp/sm_statefuns.c b/net/sctp/sm_statefuns.c
-index cb1c430..f131caf 100644
---- a/net/sctp/sm_statefuns.c
-+++ b/net/sctp/sm_statefuns.c
-@@ -747,6 +747,13 @@ sctp_disposition_t sctp_sf_do_5_1D_ce(const struct sctp_endpoint *ep,
- 		struct sctp_chunk auth;
- 		sctp_ierror_t ret;
- 
-+		/* Make sure that we and the peer are AUTH capable */
-+		if (!sctp_auth_enable || !new_asoc->peer.auth_capable) {
-+			kfree_skb(chunk->auth_chunk);
-+			sctp_association_free(new_asoc);
-+			return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
-+		}
-+
- 		/* set-up our fake chunk so that we can process it */
- 		auth.skb = chunk->auth_chunk;
- 		auth.asoc = chunk->asoc;
 diff --git a/net/sctp/socket.c b/net/sctp/socket.c
-index c53d01e..9659111 100644
+index c28eb7b..7afe73d 100644
 --- a/net/sctp/socket.c
 +++ b/net/sctp/socket.c
-@@ -2160,11 +2160,13 @@ static int sctp_setsockopt_events(struct sock *sk, char __user *optval,
+@@ -2183,11 +2183,13 @@ static int sctp_setsockopt_events(struct sock *sk, char __user *optval,
  {
  	struct sctp_association *asoc;
  	struct sctp_ulpevent *event;
@@ -102505,7 +102496,7 @@ index c53d01e..9659111 100644
  
  	/*
  	 * At the time when a user app subscribes to SCTP_SENDER_DRY_EVENT,
-@@ -4150,13 +4152,16 @@ static int sctp_getsockopt_disable_fragments(struct sock *sk, int len,
+@@ -4173,13 +4175,16 @@ static int sctp_getsockopt_disable_fragments(struct sock *sk, int len,
  static int sctp_getsockopt_events(struct sock *sk, int len, char __user *optval,
  				  int __user *optlen)
  {
@@ -102523,7 +102514,7 @@ index c53d01e..9659111 100644
  		return -EFAULT;
  	return 0;
  }
-@@ -4174,6 +4179,8 @@ static int sctp_getsockopt_events(struct sock *sk, int len, char __user *optval,
+@@ -4197,6 +4202,8 @@ static int sctp_getsockopt_events(struct sock *sk, int len, char __user *optval,
   */
  static int sctp_getsockopt_autoclose(struct sock *sk, int len, char __user *optval, int __user *optlen)
  {
@@ -102532,7 +102523,7 @@ index c53d01e..9659111 100644
  	/* Applicable to UDP-style socket only */
  	if (sctp_style(sk, TCP))
  		return -EOPNOTSUPP;
-@@ -4182,7 +4189,8 @@ static int sctp_getsockopt_autoclose(struct sock *sk, int len, char __user *optv
+@@ -4205,7 +4212,8 @@ static int sctp_getsockopt_autoclose(struct sock *sk, int len, char __user *optv
  	len = sizeof(int);
  	if (put_user(len, optlen))
  		return -EFAULT;
@@ -102542,7 +102533,7 @@ index c53d01e..9659111 100644
  		return -EFAULT;
  	return 0;
  }
-@@ -4546,12 +4554,15 @@ static int sctp_getsockopt_delayed_ack(struct sock *sk, int len,
+@@ -4569,12 +4577,15 @@ static int sctp_getsockopt_delayed_ack(struct sock *sk, int len,
   */
  static int sctp_getsockopt_initmsg(struct sock *sk, int len, char __user *optval, int __user *optlen)
  {
@@ -102559,7 +102550,7 @@ index c53d01e..9659111 100644
  		return -EFAULT;
  	return 0;
  }
-@@ -4592,6 +4603,8 @@ static int sctp_getsockopt_peer_addrs(struct sock *sk, int len,
+@@ -4615,6 +4626,8 @@ static int sctp_getsockopt_peer_addrs(struct sock *sk, int len,
  		addrlen = sctp_get_af_specific(temp.sa.sa_family)->sockaddr_len;
  		if (space_left < addrlen)
  			return -ENOMEM;
@@ -102929,7 +102920,7 @@ index d4faade..002025a 100644
  	set_fs(KERNEL_DS);
  	if (level == SOL_SOCKET)
 diff --git a/net/sunrpc/clnt.c b/net/sunrpc/clnt.c
-index b2250da..2680674 100644
+index a0e55e5..2680674 100644
 --- a/net/sunrpc/clnt.c
 +++ b/net/sunrpc/clnt.c
 @@ -163,10 +163,8 @@ static struct rpc_clnt * rpc_new_client(const struct rpc_create_args *args, stru
@@ -102967,22 +102958,6 @@ index b2250da..2680674 100644
  	clnt->cl_stats->rpccnt++;
  	task->tk_action = call_reserve;
  }
-@@ -1002,9 +1001,13 @@ call_refreshresult(struct rpc_task *task)
- 	task->tk_action = call_refresh;
- 	switch (status) {
- 	case 0:
--		if (rpcauth_uptodatecred(task))
-+		if (rpcauth_uptodatecred(task)) {
- 			task->tk_action = call_allocate;
--		return;
-+			return;
-+		}
-+		/* Use rate-limiting and a max number of retries if refresh
-+		 * had status 0 but failed to update the cred.
-+		 */
- 	case -ETIMEDOUT:
- 		rpc_delay(task, 3*HZ);
- 	case -EAGAIN:
 diff --git a/net/sunrpc/rpc_pipe.c b/net/sunrpc/rpc_pipe.c
 index bfddd68..567429b 100644
 --- a/net/sunrpc/rpc_pipe.c
@@ -103750,7 +103725,7 @@ index 1983717..4d6102c 100644
  
  	sub->evt.event = htohl(event, sub->swap);
 diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
-index eddfdec..9eb64a4 100644
+index 54fc90b..fb87ef6 100644
 --- a/net/unix/af_unix.c
 +++ b/net/unix/af_unix.c
 @@ -768,6 +768,12 @@ static struct sock *unix_find_other(struct net *net,
@@ -104417,16 +104392,16 @@ index cb1f50c..cef2a7c 100644
  		fprintf(stderr, "fixdep: sizeof(int) != 4 or wrong endianess? %#x\n",
 diff --git a/scripts/gcc-plugin.sh b/scripts/gcc-plugin.sh
 new file mode 100644
-index 0000000..ed4c19a
+index 0000000..3c23999
 --- /dev/null
 +++ b/scripts/gcc-plugin.sh
 @@ -0,0 +1,16 @@
 +#!/bin/bash
 +srctree=$(dirname "$0")
-+gccplugins_dir=$("$1" -print-file-name=plugin)
++gccplugins_dir=$("$3" -print-file-name=plugin)
 +plugincc=$("$1" -E -shared - -o /dev/null -I${srctree}/../tools/gcc -I${gccplugins_dir}/include 2>&1 <<EOF
 +#include "gcc-common.h"
-+#if __GNUC__ > 4 || __GNUC_MINOR__ >= 8 || defined(ENABLE_BUILD_WITH_CXX)
++#if BUILDING_GCC_VERSION >= 4008 || defined(ENABLE_BUILD_WITH_CXX)
 +#warning $2
 +#else
 +#warning $1
@@ -104450,7 +104425,7 @@ index 48462be..3e08f94 100644
  		$line =~ s/\s__attribute_const__$//g;
  		$line =~ s/\b__packed\b/__attribute__((packed))/g;
 diff --git a/scripts/mod/file2alias.c b/scripts/mod/file2alias.c
-index d1d0ae8..6b73b2a 100644
+index 98ff331..9a48619 100644
 --- a/scripts/mod/file2alias.c
 +++ b/scripts/mod/file2alias.c
 @@ -72,7 +72,7 @@ static void device_id_check(const char *modname, const char *device_id,
@@ -107086,7 +107061,7 @@ index dca1c22..4fa4591 100644
  		lock = &avc_cache.slots_lock[hvalue];
  
 diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
-index bcf1d73..04f8b47 100644
+index 4fa7939..bf547c8 100644
 --- a/security/selinux/hooks.c
 +++ b/security/selinux/hooks.c
 @@ -95,8 +95,6 @@
@@ -107122,7 +107097,7 @@ index bcf1d73..04f8b47 100644
  		new_tsec->sid = old_tsec->sid;
  
  	if (new_tsec->sid == old_tsec->sid) {
-@@ -5526,7 +5532,7 @@ static int selinux_key_getsecurity(struct key *key, char **_buffer)
+@@ -5554,7 +5560,7 @@ static int selinux_key_getsecurity(struct key *key, char **_buffer)
  
  #endif
  
@@ -107131,7 +107106,7 @@ index bcf1d73..04f8b47 100644
  	.name =				"selinux",
  
  	.ptrace_access_check =		selinux_ptrace_access_check,
-@@ -5872,6 +5878,9 @@ static void selinux_nf_ip_exit(void)
+@@ -5900,6 +5906,9 @@ static void selinux_nf_ip_exit(void)
  #ifdef CONFIG_SECURITY_SELINUX_DISABLE
  static int selinux_disabled;
  
@@ -107141,7 +107116,7 @@ index bcf1d73..04f8b47 100644
  int selinux_disable(void)
  {
  	if (ss_initialized) {
-@@ -5889,7 +5898,9 @@ int selinux_disable(void)
+@@ -5917,7 +5926,9 @@ int selinux_disable(void)
  	selinux_disabled = 1;
  	selinux_enabled = 0;
  
@@ -107165,40 +107140,6 @@ index b43813c..74be837 100644
  }
  #else
  static inline int selinux_xfrm_enabled(void)
-diff --git a/security/selinux/ss/policydb.c b/security/selinux/ss/policydb.c
-index a7f61d5..4d7c0b4 100644
---- a/security/selinux/ss/policydb.c
-+++ b/security/selinux/ss/policydb.c
-@@ -3202,10 +3202,10 @@ static int filename_write_helper(void *key, void *data, void *ptr)
- 	if (rc)
- 		return rc;
- 
--	buf[0] = ft->stype;
--	buf[1] = ft->ttype;
--	buf[2] = ft->tclass;
--	buf[3] = otype->otype;
-+	buf[0] = cpu_to_le32(ft->stype);
-+	buf[1] = cpu_to_le32(ft->ttype);
-+	buf[2] = cpu_to_le32(ft->tclass);
-+	buf[3] = cpu_to_le32(otype->otype);
- 
- 	rc = put_entry(buf, sizeof(u32), 4, fp);
- 	if (rc)
-diff --git a/security/selinux/ss/services.c b/security/selinux/ss/services.c
-index 185f849..72b20b1 100644
---- a/security/selinux/ss/services.c
-+++ b/security/selinux/ss/services.c
-@@ -1229,6 +1229,10 @@ static int security_context_to_sid_core(const char *scontext, u32 scontext_len,
- 	struct context context;
- 	int rc = 0;
- 
-+	/* An empty security context is never valid. */
-+	if (!scontext_len)
-+		return -EINVAL;
-+
- 	if (!ss_initialized) {
- 		int i;
- 
 diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c
 index 7db62b4..ee4d949 100644
 --- a/security/smack/smack_lsm.c
@@ -109984,7 +109925,7 @@ index 0000000..dd73713
 +}
 diff --git a/tools/gcc/latent_entropy_plugin.c b/tools/gcc/latent_entropy_plugin.c
 new file mode 100644
-index 0000000..c96f80f
+index 0000000..319229d
 --- /dev/null
 +++ b/tools/gcc/latent_entropy_plugin.c
 @@ -0,0 +1,457 @@
@@ -110016,7 +109957,7 @@ index 0000000..c96f80f
 +static tree latent_entropy_decl;
 +
 +static struct plugin_info latent_entropy_plugin_info = {
-+	.version	= "201403042150",
++	.version	= "201403280150",
 +	.help		= NULL
 +};
 +
diff --git a/3.2.55/4425_grsec_remove_EI_PAX.patch b/3.2.56/4425_grsec_remove_EI_PAX.patch
index cf65d90..cf65d90 100644
--- a/3.2.55/4425_grsec_remove_EI_PAX.patch
+++ b/3.2.56/4425_grsec_remove_EI_PAX.patch
diff --git a/3.2.55/4427_force_XATTR_PAX_tmpfs.patch b/3.2.56/4427_force_XATTR_PAX_tmpfs.patch
index 8c7a533..8c7a533 100644
--- a/3.2.55/4427_force_XATTR_PAX_tmpfs.patch
+++ b/3.2.56/4427_force_XATTR_PAX_tmpfs.patch
diff --git a/3.2.55/4430_grsec-remove-localversion-grsec.patch b/3.2.56/4430_grsec-remove-localversion-grsec.patch
index 31cf878..31cf878 100644
--- a/3.2.55/4430_grsec-remove-localversion-grsec.patch
+++ b/3.2.56/4430_grsec-remove-localversion-grsec.patch
diff --git a/3.2.55/4435_grsec-mute-warnings.patch b/3.2.56/4435_grsec-mute-warnings.patch
index f099757..f099757 100644
--- a/3.2.55/4435_grsec-mute-warnings.patch
+++ b/3.2.56/4435_grsec-mute-warnings.patch
diff --git a/3.2.55/4440_grsec-remove-protected-paths.patch b/3.2.56/4440_grsec-remove-protected-paths.patch
index 741546d..741546d 100644
--- a/3.2.55/4440_grsec-remove-protected-paths.patch
+++ b/3.2.56/4440_grsec-remove-protected-paths.patch
diff --git a/3.2.55/4450_grsec-kconfig-default-gids.patch b/3.2.56/4450_grsec-kconfig-default-gids.patch
index 2c2c6ec..2c2c6ec 100644
--- a/3.2.55/4450_grsec-kconfig-default-gids.patch
+++ b/3.2.56/4450_grsec-kconfig-default-gids.patch
diff --git a/3.2.55/4465_selinux-avc_audit-log-curr_ip.patch b/3.2.56/4465_selinux-avc_audit-log-curr_ip.patch
index 610fb07..610fb07 100644
--- a/3.2.55/4465_selinux-avc_audit-log-curr_ip.patch
+++ b/3.2.56/4465_selinux-avc_audit-log-curr_ip.patch
diff --git a/3.2.55/4470_disable-compat_vdso.patch b/3.2.56/4470_disable-compat_vdso.patch
index f6eb9f7..f6eb9f7 100644
--- a/3.2.55/4470_disable-compat_vdso.patch
+++ b/3.2.56/4470_disable-compat_vdso.patch
diff --git a/3.2.55/4475_emutramp_default_on.patch b/3.2.56/4475_emutramp_default_on.patch
index 10a2580..10a2580 100644
--- a/3.2.55/4475_emutramp_default_on.patch
+++ b/3.2.56/4475_emutramp_default_on.patch