Grsec/PaX: 3.0-{3.2.59,3.14.4}-20140525204720140525

51 files changed, 1719 insertions, 251 deletions

diff --git a/3.14.4/0000_README b/3.14.4/0000_README
index d9b0963..1ddd194 100644
--- a/3.14.4/0000_README
+++ b/3.14.4/0000_README
@@ -2,7 +2,7 @@ README
 -----------------------------------------------------------------------------
 Individual Patch Descriptions:
 -----------------------------------------------------------------------------
-Patch:	4420_grsecurity-3.0-3.14.4-201405141623.patch
+Patch:	4420_grsecurity-3.0-3.14.4-201405252047.patch
 From:	http://www.grsecurity.net
 Desc:	hardened-sources base patch from upstream grsecurity
 
diff --git a/3.14.4/4420_grsecurity-3.0-3.14.4-201405141623.patch b/3.14.4/4420_grsecurity-3.0-3.14.4-201405252047.patch
index 723fbc4..f294dbc 100644
--- a/3.14.4/4420_grsecurity-3.0-3.14.4-201405141623.patch
+++ b/3.14.4/4420_grsecurity-3.0-3.14.4-201405252047.patch
@@ -287,7 +287,7 @@ index 7116fda..d8ed6e8 100644
  
  	pcd.		[PARIDE]
 diff --git a/Makefile b/Makefile
-index d7c07fd..d6d4bfa 100644
+index d7c07fd..1ad8228 100644
 --- a/Makefile
 +++ b/Makefile
 @@ -244,8 +244,9 @@ CONFIG_SHELL := $(shell if [ -x "$$BASH" ]; then echo $$BASH; \
@@ -445,17 +445,19 @@ index d7c07fd..d6d4bfa 100644
  
  # Target to install modules
  PHONY += modules_install
-@@ -1072,7 +1146,8 @@ MRPROPER_FILES += .config .config.old .version .old_version $(version_h) \
+@@ -1072,7 +1146,10 @@ MRPROPER_FILES += .config .config.old .version .old_version $(version_h) \
  		  Module.symvers tags TAGS cscope* GPATH GTAGS GRTAGS GSYMS \
  		  signing_key.priv signing_key.x509 x509.genkey		\
  		  extra_certificates signing_key.x509.keyid		\
 -		  signing_key.x509.signer
-+		  signing_key.x509.signer tools/gcc/size_overflow_hash.h \
++		  signing_key.x509.signer				\
++		  tools/gcc/size_overflow_plugin/size_overflow_hash_aux.h \
++		  tools/gcc/size_overflow_plugin/size_overflow_hash.h \
 +		  tools/gcc/randomize_layout_seed.h
  
  # clean - Delete most, but leave enough to build external modules
  #
-@@ -1112,6 +1187,7 @@ distclean: mrproper
+@@ -1112,6 +1189,7 @@ distclean: mrproper
  		\( -name '*.orig' -o -name '*.rej' -o -name '*~' \
  		-o -name '*.bak' -o -name '#*#' -o -name '.*.orig' \
  		-o -name '.*.rej' \
@@ -463,7 +465,7 @@ index d7c07fd..d6d4bfa 100644
  		-o -name '*%' -o -name '.*.cmd' -o -name 'core' \) \
  		-type f -print | xargs rm -f
  
-@@ -1273,6 +1349,8 @@ PHONY += $(module-dirs) modules
+@@ -1273,6 +1351,8 @@ PHONY += $(module-dirs) modules
  $(module-dirs): crmodverdir $(objtree)/Module.symvers
  	$(Q)$(MAKE) $(build)=$(patsubst _module_%,%,$@)
  
@@ -472,7 +474,7 @@ index d7c07fd..d6d4bfa 100644
  modules: $(module-dirs)
  	@$(kecho) '  Building modules, stage 2.';
  	$(Q)$(MAKE) -f $(srctree)/scripts/Makefile.modpost
-@@ -1412,17 +1490,21 @@ else
+@@ -1412,17 +1492,21 @@ else
          target-dir = $(if $(KBUILD_EXTMOD),$(dir $<),$(dir $@))
  endif
  
@@ -498,7 +500,7 @@ index d7c07fd..d6d4bfa 100644
  	$(Q)$(MAKE) $(build)=$(build-dir) $(target-dir)$(notdir $@)
  %.symtypes: %.c prepare scripts FORCE
  	$(Q)$(MAKE) $(build)=$(build-dir) $(target-dir)$(notdir $@)
-@@ -1432,11 +1514,15 @@ endif
+@@ -1432,11 +1516,15 @@ endif
  	$(cmd_crmodverdir)
  	$(Q)$(MAKE) KBUILD_MODULES=$(if $(CONFIG_MODULES),1) \
  	$(build)=$(build-dir)
@@ -16968,6 +16970,18 @@ index b4c1f54..e290c08 100644
  
  	pagefault_enable();
  
+diff --git a/arch/x86/include/asm/hugetlb.h b/arch/x86/include/asm/hugetlb.h
+index a809121..68c0539 100644
+--- a/arch/x86/include/asm/hugetlb.h
++++ b/arch/x86/include/asm/hugetlb.h
+@@ -52,6 +52,7 @@ static inline pte_t huge_ptep_get_and_clear(struct mm_struct *mm,
+ static inline void huge_ptep_clear_flush(struct vm_area_struct *vma,
+ 					 unsigned long addr, pte_t *ptep)
+ {
++	ptep_clear_flush(vma, addr, ptep);
+ }
+ 
+ static inline int huge_pte_none(pte_t pte)
 diff --git a/arch/x86/include/asm/hw_irq.h b/arch/x86/include/asm/hw_irq.h
 index 67d69b8..50e4b77 100644
 --- a/arch/x86/include/asm/hw_irq.h
@@ -25819,10 +25833,19 @@ index c2bedae..25e7ab6 100644
  		.name = "data",
  		.mode = S_IRUGO,
 diff --git a/arch/x86/kernel/ldt.c b/arch/x86/kernel/ldt.c
-index af1d14a..37b8776 100644
+index af1d14a..81ae763 100644
 --- a/arch/x86/kernel/ldt.c
 +++ b/arch/x86/kernel/ldt.c
-@@ -66,13 +66,13 @@ static int alloc_ldt(mm_context_t *pc, int mincount, int reload)
+@@ -20,6 +20,8 @@
+ #include <asm/mmu_context.h>
+ #include <asm/syscalls.h>
+ 
++int sysctl_ldt16 = 0;
++
+ #ifdef CONFIG_SMP
+ static void flush_ldt(void *current_mm)
+ {
+@@ -66,13 +68,13 @@ static int alloc_ldt(mm_context_t *pc, int mincount, int reload)
  	if (reload) {
  #ifdef CONFIG_SMP
  		preempt_disable();
@@ -25838,7 +25861,7 @@ index af1d14a..37b8776 100644
  #endif
  	}
  	if (oldsize) {
-@@ -94,7 +94,7 @@ static inline int copy_ldt(mm_context_t *new, mm_context_t *old)
+@@ -94,7 +96,7 @@ static inline int copy_ldt(mm_context_t *new, mm_context_t *old)
  		return err;
  
  	for (i = 0; i < old->size; i++)
@@ -25847,7 +25870,7 @@ index af1d14a..37b8776 100644
  	return 0;
  }
  
-@@ -115,6 +115,24 @@ int init_new_context(struct task_struct *tsk, struct mm_struct *mm)
+@@ -115,6 +117,24 @@ int init_new_context(struct task_struct *tsk, struct mm_struct *mm)
  		retval = copy_ldt(&mm->context, &old_mm->context);
  		mutex_unlock(&old_mm->context.lock);
  	}
@@ -25872,7 +25895,7 @@ index af1d14a..37b8776 100644
  	return retval;
  }
  
-@@ -229,6 +247,13 @@ static int write_ldt(void __user *ptr, unsigned long bytecount, int oldmode)
+@@ -229,12 +249,19 @@ static int write_ldt(void __user *ptr, unsigned long bytecount, int oldmode)
  		}
  	}
  
@@ -25886,6 +25909,13 @@ index af1d14a..37b8776 100644
  	/*
  	 * On x86-64 we do not support 16-bit segments due to
  	 * IRET leaking the high bits of the kernel stack address.
+ 	 */
+ #ifdef CONFIG_X86_64
+-	if (!ldt_info.seg_32bit) {
++	if (!ldt_info.seg_32bit && !sysctl_ldt16) {
+ 		error = -EINVAL;
+ 		goto out_unlock;
+ 	}
 diff --git a/arch/x86/kernel/machine_kexec_32.c b/arch/x86/kernel/machine_kexec_32.c
 index 1667b1d..16492c5 100644
 --- a/arch/x86/kernel/machine_kexec_32.c
@@ -35598,7 +35628,7 @@ index fd14be1..e3c79c0 100644
  
  #
 diff --git a/arch/x86/vdso/vdso32-setup.c b/arch/x86/vdso/vdso32-setup.c
-index d6bfb87..876ee18 100644
+index d6bfb87..a75c5f7 100644
 --- a/arch/x86/vdso/vdso32-setup.c
 +++ b/arch/x86/vdso/vdso32-setup.c
 @@ -25,6 +25,7 @@
@@ -35609,7 +35639,15 @@ index d6bfb87..876ee18 100644
  
  enum {
  	VDSO_DISABLED = 0,
-@@ -226,7 +227,7 @@ static inline void map_compat_vdso(int map)
+@@ -41,6 +42,7 @@ enum {
+ #ifdef CONFIG_X86_64
+ #define vdso_enabled			sysctl_vsyscall32
+ #define arch_setup_additional_pages	syscall32_setup_pages
++extern int sysctl_ldt16;
+ #endif
+ 
+ /*
+@@ -226,7 +228,7 @@ static inline void map_compat_vdso(int map)
  void enable_sep_cpu(void)
  {
  	int cpu = get_cpu();
@@ -35618,7 +35656,7 @@ index d6bfb87..876ee18 100644
  
  	if (!boot_cpu_has(X86_FEATURE_SEP)) {
  		put_cpu();
-@@ -249,7 +250,7 @@ static int __init gate_vma_init(void)
+@@ -249,7 +251,7 @@ static int __init gate_vma_init(void)
  	gate_vma.vm_start = FIXADDR_USER_START;
  	gate_vma.vm_end = FIXADDR_USER_END;
  	gate_vma.vm_flags = VM_READ | VM_MAYREAD | VM_EXEC | VM_MAYEXEC;
@@ -35627,7 +35665,7 @@ index d6bfb87..876ee18 100644
  
  	return 0;
  }
-@@ -330,14 +331,14 @@ int arch_setup_additional_pages(struct linux_binprm *bprm, int uses_interp)
+@@ -330,14 +332,14 @@ int arch_setup_additional_pages(struct linux_binprm *bprm, int uses_interp)
  	if (compat)
  		addr = VDSO_HIGH_BASE;
  	else {
@@ -35644,7 +35682,7 @@ index d6bfb87..876ee18 100644
  
  	if (compat_uses_vma || !compat) {
  		/*
-@@ -353,11 +354,11 @@ int arch_setup_additional_pages(struct linux_binprm *bprm, int uses_interp)
+@@ -353,11 +355,11 @@ int arch_setup_additional_pages(struct linux_binprm *bprm, int uses_interp)
  	}
  
  	current_thread_info()->sysenter_return =
@@ -35658,7 +35696,21 @@ index d6bfb87..876ee18 100644
  
  	up_write(&mm->mmap_sem);
  
-@@ -404,8 +405,14 @@ __initcall(ia32_binfmt_init);
+@@ -380,6 +382,13 @@ static struct ctl_table abi_table2[] = {
+ 		.mode		= 0644,
+ 		.proc_handler	= proc_dointvec
+ 	},
++	{
++		.procname	= "ldt16",
++		.data		= &sysctl_ldt16,
++		.maxlen		= sizeof(int),
++		.mode		= 0644,
++		.proc_handler	= proc_dointvec
++	},
+ 	{}
+ };
+ 
+@@ -404,8 +413,14 @@ __initcall(ia32_binfmt_init);
  
  const char *arch_vma_name(struct vm_area_struct *vma)
  {
@@ -35674,7 +35726,7 @@ index d6bfb87..876ee18 100644
  	return NULL;
  }
  
-@@ -415,7 +422,7 @@ struct vm_area_struct *get_gate_vma(struct mm_struct *mm)
+@@ -415,7 +430,7 @@ struct vm_area_struct *get_gate_vma(struct mm_struct *mm)
  	 * Check to see if the corresponding task was created in compat vdso
  	 * mode.
  	 */
@@ -65598,6 +65650,25 @@ index ee0d761..b346c58 100644
  		return PTR_ERR(kn);
  	}
  
+diff --git a/fs/sysfs/file.c b/fs/sysfs/file.c
+index 810cf6e..5fd2bf1 100644
+--- a/fs/sysfs/file.c
++++ b/fs/sysfs/file.c
+@@ -47,12 +47,13 @@ static int sysfs_kf_seq_show(struct seq_file *sf, void *v)
+ 	ssize_t count;
+ 	char *buf;
+ 
+-	/* acquire buffer and ensure that it's >= PAGE_SIZE */
++	/* acquire buffer and ensure that it's >= PAGE_SIZE and clear */
+ 	count = seq_get_buf(sf, &buf);
+ 	if (count < PAGE_SIZE) {
+ 		seq_commit(sf, -1);
+ 		return 0;
+ 	}
++	memset(buf, 0, PAGE_SIZE);
+ 
+ 	/*
+ 	 * Invoke show().  Control may reach here via seq file lseek even
 diff --git a/fs/sysv/sysv.h b/fs/sysv/sysv.h
 index 69d4889..a810bd4 100644
 --- a/fs/sysv/sysv.h
@@ -96328,7 +96399,7 @@ index 4bf8809..98a6914 100644
  EXPORT_SYMBOL(kmem_cache_free);
  
 diff --git a/mm/slub.c b/mm/slub.c
-index 25f14ad..ff4d0b7 100644
+index 25f14ad..c904f6f 100644
 --- a/mm/slub.c
 +++ b/mm/slub.c
 @@ -207,7 +207,7 @@ struct track {
@@ -96487,7 +96558,19 @@ index 25f14ad..ff4d0b7 100644
  static int count_inuse(struct page *page)
  {
  	return page->inuse;
-@@ -4268,12 +4333,12 @@ static void resiliency_test(void)
+@@ -4163,7 +4228,11 @@ static int list_locations(struct kmem_cache *s, char *buf,
+ 		len += sprintf(buf + len, "%7ld ", l->count);
+ 
+ 		if (l->addr)
++#ifdef CONFIG_GRKERNSEC_HIDESYM
++			len += sprintf(buf + len, "%pS", NULL);
++#else
+ 			len += sprintf(buf + len, "%pS", (void *)l->addr);
++#endif
+ 		else
+ 			len += sprintf(buf + len, "<not-available>");
+ 
+@@ -4268,12 +4337,12 @@ static void resiliency_test(void)
  	validate_slab_cache(kmalloc_caches[9]);
  }
  #else
@@ -96502,7 +96585,17 @@ index 25f14ad..ff4d0b7 100644
  enum slab_stat_type {
  	SL_ALL,			/* All slabs */
  	SL_PARTIAL,		/* Only partially allocated slabs */
-@@ -4519,7 +4584,7 @@ SLAB_ATTR_RO(ctor);
+@@ -4513,13 +4582,17 @@ static ssize_t ctor_show(struct kmem_cache *s, char *buf)
+ {
+ 	if (!s->ctor)
+ 		return 0;
++#ifdef CONFIG_GRKERNSEC_HIDESYM
++	return sprintf(buf, "%pS\n", NULL);
++#else
+ 	return sprintf(buf, "%pS\n", s->ctor);
++#endif
+ }
+ SLAB_ATTR_RO(ctor);
  
  static ssize_t aliases_show(struct kmem_cache *s, char *buf)
  {
@@ -96511,7 +96604,7 @@ index 25f14ad..ff4d0b7 100644
  }
  SLAB_ATTR_RO(aliases);
  
-@@ -4607,6 +4672,14 @@ static ssize_t cache_dma_show(struct kmem_cache *s, char *buf)
+@@ -4607,6 +4680,14 @@ static ssize_t cache_dma_show(struct kmem_cache *s, char *buf)
  SLAB_ATTR_RO(cache_dma);
  #endif
  
@@ -96526,7 +96619,7 @@ index 25f14ad..ff4d0b7 100644
  static ssize_t destroy_by_rcu_show(struct kmem_cache *s, char *buf)
  {
  	return sprintf(buf, "%d\n", !!(s->flags & SLAB_DESTROY_BY_RCU));
-@@ -4941,6 +5014,9 @@ static struct attribute *slab_attrs[] = {
+@@ -4941,6 +5022,9 @@ static struct attribute *slab_attrs[] = {
  #ifdef CONFIG_ZONE_DMA
  	&cache_dma_attr.attr,
  #endif
@@ -96536,7 +96629,7 @@ index 25f14ad..ff4d0b7 100644
  #ifdef CONFIG_NUMA
  	&remote_node_defrag_ratio_attr.attr,
  #endif
-@@ -5173,6 +5249,7 @@ static char *create_unique_id(struct kmem_cache *s)
+@@ -5173,6 +5257,7 @@ static char *create_unique_id(struct kmem_cache *s)
  	return name;
  }
  
@@ -96544,7 +96637,7 @@ index 25f14ad..ff4d0b7 100644
  static int sysfs_slab_add(struct kmem_cache *s)
  {
  	int err;
-@@ -5230,6 +5307,7 @@ static void sysfs_slab_remove(struct kmem_cache *s)
+@@ -5230,6 +5315,7 @@ static void sysfs_slab_remove(struct kmem_cache *s)
  	kobject_del(&s->kobj);
  	kobject_put(&s->kobj);
  }
@@ -96552,7 +96645,7 @@ index 25f14ad..ff4d0b7 100644
  
  /*
   * Need to buffer aliases during bootup until sysfs becomes
-@@ -5243,6 +5321,7 @@ struct saved_alias {
+@@ -5243,6 +5329,7 @@ struct saved_alias {
  
  static struct saved_alias *alias_list;
  
@@ -96560,7 +96653,7 @@ index 25f14ad..ff4d0b7 100644
  static int sysfs_slab_alias(struct kmem_cache *s, const char *name)
  {
  	struct saved_alias *al;
-@@ -5265,6 +5344,7 @@ static int sysfs_slab_alias(struct kmem_cache *s, const char *name)
+@@ -5265,6 +5352,7 @@ static int sysfs_slab_alias(struct kmem_cache *s, const char *name)
  	alias_list = al;
  	return 0;
  }
@@ -110658,10 +110751,10 @@ index 0000000..3e8148c
 +}
 diff --git a/tools/gcc/size_overflow_plugin/insert_size_overflow_check_core.c b/tools/gcc/size_overflow_plugin/insert_size_overflow_check_core.c
 new file mode 100644
-index 0000000..880cd86
+index 0000000..88469e9
 --- /dev/null
 +++ b/tools/gcc/size_overflow_plugin/insert_size_overflow_check_core.c
-@@ -0,0 +1,897 @@
+@@ -0,0 +1,902 @@
 +/*
 + * Copyright 2011-2014 by Emese Revfy <re.emese@gmail.com>
 + * Licensed under the GPL v2, or (at your option) v3
@@ -111349,8 +111442,13 @@ index 0000000..880cd86
 +		return create_assign(visited, def_stmt, lhs, AFTER_STMT);
 +
 +	switch (TREE_CODE(rhs1)) {
-+	case SSA_NAME:
-+		return handle_unary_rhs(visited, caller_node, def_stmt);
++	case SSA_NAME: {
++		tree ret = handle_unary_rhs(visited, caller_node, def_stmt);
++
++		if (gimple_assign_cast_p(stmt))
++			unsigned_signed_cast_intentional_overflow(visited, stmt);
++		return ret;
++	}
 +	case ARRAY_REF:
 +	case BIT_FIELD_REF:
 +	case ADDR_EXPR:
@@ -112700,10 +112798,10 @@ index 0000000..f8f5dd5
 +
 diff --git a/tools/gcc/size_overflow_plugin/intentional_overflow.c b/tools/gcc/size_overflow_plugin/intentional_overflow.c
 new file mode 100644
-index 0000000..967c0b2
+index 0000000..38904bc
 --- /dev/null
 +++ b/tools/gcc/size_overflow_plugin/intentional_overflow.c
-@@ -0,0 +1,635 @@
+@@ -0,0 +1,733 @@
 +/*
 + * Copyright 2011-2014 by Emese Revfy <re.emese@gmail.com>
 + * Licensed under the GPL v2, or (at your option) v3
@@ -112963,21 +113061,29 @@ index 0000000..967c0b2
 +	return true;
 +}
 +
-+static bool no_uses(tree node)
++static unsigned int uses_num(tree node)
 +{
 +	imm_use_iterator imm_iter;
 +	use_operand_p use_p;
++	unsigned int num = 0;
 +
 +	FOR_EACH_IMM_USE_FAST(use_p, imm_iter, node) {
-+		const_gimple use_stmt = USE_STMT(use_p);
++		gimple use_stmt = USE_STMT(use_p);
 +
 +		if (use_stmt == NULL)
-+			return true;
++			return num;
 +		if (is_gimple_debug(use_stmt))
 +			continue;
-+		return false;
++		if (gimple_assign_cast_p(use_stmt) && is_size_overflow_type(gimple_assign_lhs(use_stmt)))
++			continue;
++		num++;
 +	}
-+	return true;
++	return num;
++}
++
++static bool no_uses(tree node)
++{
++	return !uses_num(node);
 +}
 +
 +// 3.8.5 mm/page-writeback.c __ilog2_u64(): ret, uint + uintmax; uint -> int; int max
@@ -113339,12 +113445,102 @@ index 0000000..967c0b2
 +	return NO_INTENTIONAL_OVERFLOW;
 +}
 +
++static gimple get_dup_stmt(struct visited *visited, gimple stmt)
++{
++	gimple my_stmt;
++	gimple_stmt_iterator gsi = gsi_for_stmt(stmt);
++
++	gsi_next(&gsi);
++	my_stmt = gsi_stmt(gsi);
++
++	gcc_assert(pointer_set_contains(visited->my_stmts, my_stmt));
++	gcc_assert(gimple_assign_rhs_code(stmt) == gimple_assign_rhs_code(my_stmt));
++
++	return my_stmt;
++}
++
++/* unsigned type -> unary or binary assign (rhs1 or rhs2 is constant)
++ * unsigned type cast to signed type, unsigned type: no more uses
++ * e.g., lib/vsprintf.c:simple_strtol()
++ * _10 = (unsigned long int) _9
++ * _11 = -_10;
++ * _12 = (long int) _11; (_11_ no more uses)
++ */
++static bool is_call_or_cast(gimple stmt)
++{
++	return gimple_assign_cast_p(stmt) || is_gimple_call(stmt);
++}
++
++static bool is_unsigned_cast_or_call_def_stmt(const_tree node)
++{
++	const_tree rhs;
++	gimple def_stmt;
++
++	if (node == NULL_TREE)
++		return true;
++	if (is_gimple_constant(node))
++		return true;
++
++	def_stmt = get_def_stmt(node);
++	if (!def_stmt)
++		return false;
++
++	if (is_call_or_cast(def_stmt))
++		return true;
++
++	if (!is_gimple_assign(def_stmt) || gimple_num_ops(def_stmt) != 2)
++		return false;
++	rhs = gimple_assign_rhs1(def_stmt);
++	def_stmt = get_def_stmt(rhs);
++	if (!def_stmt)
++		return false;
++	return is_call_or_cast(def_stmt);
++}
++
++void unsigned_signed_cast_intentional_overflow(struct visited *visited, gimple stmt)
++{
++	unsigned int use_num;
++	gimple so_stmt;
++	const_gimple def_stmt;
++	const_tree rhs1, rhs2;
++	tree rhs = gimple_assign_rhs1(stmt);
++	tree lhs_type = TREE_TYPE(gimple_assign_lhs(stmt));
++	const_tree rhs_type = TREE_TYPE(rhs);
++
++	if (!(TYPE_UNSIGNED(rhs_type) && !TYPE_UNSIGNED(lhs_type)))
++		return;
++	if (GET_MODE_BITSIZE(TYPE_MODE(rhs_type)) != GET_MODE_BITSIZE(TYPE_MODE(lhs_type)))
++		return;
++	use_num = uses_num(rhs);
++	if (use_num != 1)
++		return;
++
++	def_stmt = get_def_stmt(rhs);
++	if (!def_stmt)
++		return;
++	if (!is_gimple_assign(def_stmt))
++		return;
++
++	rhs1 = gimple_assign_rhs1(def_stmt);
++	if (!is_unsigned_cast_or_call_def_stmt(rhs1))
++		return;
++
++	rhs2 = gimple_assign_rhs2(def_stmt);
++	if (!is_unsigned_cast_or_call_def_stmt(rhs2))
++		return;
++	if (gimple_num_ops(def_stmt) == 3 && !is_gimple_constant(rhs1) && !is_gimple_constant(rhs2))
++		return;
++
++	so_stmt = get_dup_stmt(visited, stmt);
++	create_up_and_down_cast(visited, so_stmt, lhs_type, gimple_assign_rhs1(so_stmt));
++}
++
 diff --git a/tools/gcc/size_overflow_plugin/misc.c b/tools/gcc/size_overflow_plugin/misc.c
 new file mode 100644
-index 0000000..ca4def3
+index 0000000..4bddad2
 --- /dev/null
 +++ b/tools/gcc/size_overflow_plugin/misc.c
-@@ -0,0 +1,180 @@
+@@ -0,0 +1,203 @@
 +/*
 + * Copyright 2011-2014 by Emese Revfy <re.emese@gmail.com>
 + * Licensed under the GPL v2, or (at your option) v3
@@ -113525,12 +113721,35 @@ index 0000000..ca4def3
 +	return assign;
 +}
 +
++bool is_size_overflow_type(const_tree var)
++{
++	const char *name;
++	const_tree type_name, type;
++
++	if (var == NULL_TREE)
++		return false;
++
++	type = TREE_TYPE(var);
++	type_name = TYPE_NAME(type);
++	if (type_name == NULL_TREE)
++		return false;
++
++	if (DECL_P(type_name))
++		name = DECL_NAME_POINTER(type_name);
++	else
++		name = IDENTIFIER_POINTER(type_name);
++
++	if (!strncmp(name, "size_overflow_type", 18))
++		return true;
++	return false;
++}
++
 diff --git a/tools/gcc/size_overflow_plugin/remove_unnecessary_dup.c b/tools/gcc/size_overflow_plugin/remove_unnecessary_dup.c
 new file mode 100644
-index 0000000..ee108f0
+index 0000000..7c9e6d1
 --- /dev/null
 +++ b/tools/gcc/size_overflow_plugin/remove_unnecessary_dup.c
-@@ -0,0 +1,161 @@
+@@ -0,0 +1,138 @@
 +/*
 + * Copyright 2011-2014 by Emese Revfy <re.emese@gmail.com>
 + * Licensed under the GPL v2, or (at your option) v3
@@ -113575,30 +113794,7 @@ index 0000000..ee108f0
 +	}
 +}
 +
-+static bool is_size_overflow_type(const_tree var)
-+{
-+	const char *name;
-+	const_tree type_name, type;
-+
-+	if (var == NULL_TREE)
-+		return false;
-+
-+	type = TREE_TYPE(var);
-+	type_name = TYPE_NAME(type);
-+	if (type_name == NULL_TREE)
-+		return false;
-+
-+	if (DECL_P(type_name))
-+		name = DECL_NAME_POINTER(type_name);
-+	else
-+		name = IDENTIFIER_POINTER(type_name);
-+
-+	if (!strncmp(name, "size_overflow_type", 18))
-+		return true;
-+	return false;
-+}
-+
-+static void create_up_and_down_cast(struct visited *visited, gimple use_stmt, tree orig_type, tree rhs)
++void create_up_and_down_cast(struct visited *visited, gimple use_stmt, tree orig_type, tree rhs)
 +{
 +	const_tree orig_rhs1;
 +	tree down_lhs, new_lhs, dup_type = TREE_TYPE(rhs);
@@ -113694,10 +113890,10 @@ index 0000000..ee108f0
 +
 diff --git a/tools/gcc/size_overflow_plugin/size_overflow.h b/tools/gcc/size_overflow_plugin/size_overflow.h
 new file mode 100644
-index 0000000..0729973
+index 0000000..e5b4e50
 --- /dev/null
 +++ b/tools/gcc/size_overflow_plugin/size_overflow.h
-@@ -0,0 +1,124 @@
+@@ -0,0 +1,127 @@
 +#ifndef SIZE_OVERFLOW_H
 +#define SIZE_OVERFLOW_H
 +
@@ -113786,6 +113982,7 @@ index 0000000..0729973
 +extern tree handle_integer_truncation(struct visited *visited, struct cgraph_node *caller_node, const_tree lhs);
 +extern bool is_a_neg_overflow(const_gimple stmt, const_tree rhs);
 +extern enum intentional_overflow_type add_mul_intentional_overflow(const_gimple def_stmt);
++extern void unsigned_signed_cast_intentional_overflow(struct visited *visited, gimple stmt);
 +
 +
 +// insert_size_overflow_check_ipa.c
@@ -113807,6 +114004,7 @@ index 0000000..0729973
 +extern gimple build_cast_stmt(struct visited *visited, tree dst_type, tree rhs, tree lhs, gimple_stmt_iterator *gsi, bool before, bool force);
 +extern bool skip_types(const_tree var);
 +extern tree cast_a_tree(tree type, tree var);
++extern bool is_size_overflow_type(const_tree var);
 +
 +
 +// insert_size_overflow_check_core.c
@@ -113820,6 +114018,7 @@ index 0000000..0729973
 +extern struct opt_pass *make_remove_unnecessary_dup_pass(void);
 +extern void insert_cast_expr(struct visited *visited, gimple stmt, enum intentional_overflow_type type);
 +extern bool skip_expr_on_double_type(const_gimple stmt);
++extern void create_up_and_down_cast(struct visited *visited, gimple use_stmt, tree orig_type, tree rhs);
 +
 +#endif
 diff --git a/tools/gcc/size_overflow_plugin/size_overflow_debug.c b/tools/gcc/size_overflow_plugin/size_overflow_debug.c
@@ -113946,10 +114145,10 @@ index 0000000..4378111
 +}
 diff --git a/tools/gcc/size_overflow_plugin/size_overflow_hash.data b/tools/gcc/size_overflow_plugin/size_overflow_hash.data
 new file mode 100644
-index 0000000..41777a8
+index 0000000..72e9c0e
 --- /dev/null
 +++ b/tools/gcc/size_overflow_plugin/size_overflow_hash.data
-@@ -0,0 +1,5934 @@
+@@ -0,0 +1,5986 @@
 +intel_fake_agp_alloc_by_type_1 intel_fake_agp_alloc_by_type 1 1 NULL
 +ocfs2_get_refcount_tree_3 ocfs2_get_refcount_tree 0 3 NULL
 +storvsc_connect_to_vsp_22 storvsc_connect_to_vsp 2 22 NULL
@@ -113993,6 +114192,7 @@ index 0000000..41777a8
 +zlib_deflate_workspacesize_537 zlib_deflate_workspacesize 0-1-2 537 NULL
 +iwl_dbgfs_wowlan_sram_read_540 iwl_dbgfs_wowlan_sram_read 3 540 NULL
 +sco_sock_setsockopt_552 sco_sock_setsockopt 5 552 NULL
++lpfc_nlp_state_name_556 lpfc_nlp_state_name 2 556 NULL
 +snd_aw2_saa7146_get_hw_ptr_playback_558 snd_aw2_saa7146_get_hw_ptr_playback 0 558 NULL
 +start_isoc_chain_565 start_isoc_chain 2 565 NULL nohasharray
 +dev_hard_header_565 dev_hard_header 0 565 &start_isoc_chain_565
@@ -114008,7 +114208,7 @@ index 0000000..41777a8
 +unlink_queued_645 unlink_queued 4 645 NULL
 +dtim_interval_read_654 dtim_interval_read 3 654 NULL
 +mem_rx_free_mem_blks_read_675 mem_rx_free_mem_blks_read 3 675 NULL
-+persistent_ram_vmap_709 persistent_ram_vmap 2-1 709 NULL
++persistent_ram_vmap_709 persistent_ram_vmap 1-2 709 NULL
 +xfs_bmap_eof_728 xfs_bmap_eof 0 728 NULL
 +sctp_setsockopt_peer_addr_params_734 sctp_setsockopt_peer_addr_params 3 734 NULL
 +dvb_video_write_754 dvb_video_write 3 754 NULL
@@ -114022,6 +114222,7 @@ index 0000000..41777a8
 +snd_pcm_action_single_905 snd_pcm_action_single 0 905 NULL
 +carl9170_cmd_buf_950 carl9170_cmd_buf 3 950 NULL
 +__nodes_weight_956 __nodes_weight 2-0 956 NULL
++bnx2x_fill_fw_str_968 bnx2x_fill_fw_str 3 968 NULL
 +mnt_want_write_975 mnt_want_write 0 975 NULL
 +usnic_ib_qp_grp_dump_hdr_989 usnic_ib_qp_grp_dump_hdr 2 989 NULL
 +memcmp_990 memcmp 0 990 NULL
@@ -114076,6 +114277,7 @@ index 0000000..41777a8
 +ath6kl_init_get_fwcaps_1557 ath6kl_init_get_fwcaps 3 1557 NULL
 +ffs_mutex_lock_1564 ffs_mutex_lock 0 1564 NULL
 +ieee80211_if_read_dot11MeshHWMPnetDiameterTraversalTime_1589 ieee80211_if_read_dot11MeshHWMPnetDiameterTraversalTime 3 1589 NULL
++ipath_ht_handle_hwerrors_1592 ipath_ht_handle_hwerrors 3 1592 NULL
 +packet_buffer_init_1607 packet_buffer_init 2 1607 NULL
 +btmrvl_hscmd_read_1614 btmrvl_hscmd_read 3 1614 NULL
 +v9fs_fid_xattr_get_1618 v9fs_fid_xattr_get 0 1618 NULL
@@ -114398,6 +114600,7 @@ index 0000000..41777a8
 +blk_rq_sectors_5091 blk_rq_sectors 0 5091 &get_random_bytes_5091
 +sound_write_5102 sound_write 3 5102 NULL
 +i40e_dbg_netdev_ops_write_5117 i40e_dbg_netdev_ops_write 3 5117 NULL
++qib_7220_handle_hwerrors_5142 qib_7220_handle_hwerrors 3 5142 NULL
 +__uwb_addr_print_5161 __uwb_addr_print 2 5161 NULL
 +iwl_dbgfs_status_read_5171 iwl_dbgfs_status_read 3 5171 NULL
 +acpi_pcc_get_sqty_5176 acpi_pcc_get_sqty 0 5176 NULL
@@ -114558,6 +114761,7 @@ index 0000000..41777a8
 +beacon_interval_read_7091 beacon_interval_read 3 7091 NULL
 +pipeline_enc_rx_stat_fifo_int_read_7107 pipeline_enc_rx_stat_fifo_int_read 3 7107 NULL
 +osc_resend_count_seq_write_7120 osc_resend_count_seq_write 3 7120 NULL
++qib_format_hwerrors_7133 qib_format_hwerrors 5 7133 NULL
 +kvm_mmu_notifier_test_young_7139 kvm_mmu_notifier_test_young 3 7139 NULL
 +__alloc_objio_seg_7203 __alloc_objio_seg 1 7203 NULL
 +hdlc_loop_7255 hdlc_loop 0 7255 NULL
@@ -114776,6 +114980,7 @@ index 0000000..41777a8
 +crypt_status_9492 crypt_status 5 9492 NULL
 +lbs_threshold_write_9502 lbs_threshold_write 5 9502 NULL
 +lp_write_9511 lp_write 3 9511 NULL
++mext_calc_swap_extents_9517 mext_calc_swap_extents 4 9517 NULL
 +scsi_tgt_kspace_exec_9522 scsi_tgt_kspace_exec 8 9522 NULL
 +ll_max_read_ahead_whole_mb_seq_write_9528 ll_max_read_ahead_whole_mb_seq_write 3 9528 NULL
 +read_file_dma_9530 read_file_dma 3 9530 NULL
@@ -114826,6 +115031,7 @@ index 0000000..41777a8
 +bm_register_write_9893 bm_register_write 3 9893 &snd_midi_event_new_9893
 +snd_gf1_pcm_playback_copy_9895 snd_gf1_pcm_playback_copy 5-3 9895 NULL
 +nonpaging_page_fault_9908 nonpaging_page_fault 2 9908 NULL
++root_nfs_parse_options_9937 root_nfs_parse_options 3 9937 NULL
 +pstore_ftrace_knob_read_9947 pstore_ftrace_knob_read 3 9947 NULL
 +read_file_misc_9948 read_file_misc 3 9948 NULL
 +csum_partial_copy_fromiovecend_9957 csum_partial_copy_fromiovecend 3-4 9957 NULL
@@ -114929,8 +115135,8 @@ index 0000000..41777a8
 +kvm_write_guest_cached_11106 kvm_write_guest_cached 4 11106 NULL
 +tw_change_queue_depth_11116 tw_change_queue_depth 2 11116 NULL
 +page_offset_11120 page_offset 0 11120 NULL
-+tracing_buffers_read_11124 tracing_buffers_read 3 11124 NULL nohasharray
-+cea_db_payload_len_11124 cea_db_payload_len 0 11124 &tracing_buffers_read_11124
++cea_db_payload_len_11124 cea_db_payload_len 0 11124 NULL nohasharray
++tracing_buffers_read_11124 tracing_buffers_read 3 11124 &cea_db_payload_len_11124
 +snd_gf1_pcm_playback_silence_11172 snd_gf1_pcm_playback_silence 4-3 11172 NULL
 +il_dbgfs_rx_queue_read_11221 il_dbgfs_rx_queue_read 3 11221 NULL
 +comedi_alloc_spriv_11234 comedi_alloc_spriv 2 11234 NULL
@@ -114945,7 +115151,7 @@ index 0000000..41777a8
 +construct_key_11329 construct_key 3 11329 NULL nohasharray
 +__kfifo_out_peek_11329 __kfifo_out_peek 0-3 11329 &construct_key_11329
 +next_segment_11330 next_segment 0-2-1 11330 NULL
-+persistent_ram_buffer_map_11332 persistent_ram_buffer_map 1-2 11332 NULL
++persistent_ram_buffer_map_11332 persistent_ram_buffer_map 2-1 11332 NULL
 +ext4_get_inline_size_11349 ext4_get_inline_size 0 11349 NULL
 +sel_write_create_11353 sel_write_create 3 11353 NULL nohasharray
 +nl80211_send_mgmt_11353 nl80211_send_mgmt 7 11353 &sel_write_create_11353
@@ -115170,6 +115376,7 @@ index 0000000..41777a8
 +packet_snd_13634 packet_snd 3 13634 NULL
 +blk_msg_write_13655 blk_msg_write 3 13655 NULL
 +cache_downcall_13666 cache_downcall 3 13666 NULL
++ext3_xattr_list_entries_13682 ext3_xattr_list_entries 0 13682 NULL
 +usb_get_string_13693 usb_get_string 0 13693 NULL
 +fw_iso_buffer_alloc_13704 fw_iso_buffer_alloc 2 13704 NULL
 +audit_unpack_string_13748 audit_unpack_string 3 13748 NULL
@@ -115242,6 +115449,7 @@ index 0000000..41777a8
 +ath6kl_regdump_read_14393 ath6kl_regdump_read 3 14393 NULL
 +smk_write_onlycap_14400 smk_write_onlycap 3 14400 NULL
 +mtd_concat_create_14416 mtd_concat_create 2 14416 NULL
++get_kcore_size_14425 get_kcore_size 0 14425 NULL
 +_iwl_dbgfs_sram_write_14439 _iwl_dbgfs_sram_write 3 14439 NULL
 +block_size_14443 block_size 0 14443 NULL
 +lmv_user_md_size_14456 lmv_user_md_size 0-1 14456 NULL
@@ -115273,6 +115481,7 @@ index 0000000..41777a8
 +persistent_ram_ecc_string_14704 persistent_ram_ecc_string 0 14704 NULL
 +u_audio_playback_14709 u_audio_playback 3 14709 NULL
 +rtw_cbuf_alloc_14710 rtw_cbuf_alloc 1 14710 NULL
++cgroup_path_14713 cgroup_path 3 14713 NULL
 +vfd_write_14717 vfd_write 3 14717 NULL
 +__blk_end_request_14729 __blk_end_request 3 14729 NULL
 +raid1_resize_14740 raid1_resize 2 14740 NULL
@@ -115286,6 +115495,7 @@ index 0000000..41777a8
 +__kfifo_in_14797 __kfifo_in 3-0 14797 NULL
 +hpet_readl_14801 hpet_readl 0 14801 NULL nohasharray
 +snd_als300_gcr_read_14801 snd_als300_gcr_read 0 14801 &hpet_readl_14801
++security_inode_rename_14805 security_inode_rename 0 14805 NULL
 +xfs_btree_kill_iroot_14824 xfs_btree_kill_iroot 0 14824 NULL
 +mrp_attr_create_14853 mrp_attr_create 3 14853 NULL
 +lcd_write_14857 lcd_write 3 14857 NULL
@@ -115554,6 +115764,7 @@ index 0000000..41777a8
 +gnttab_max_grant_frames_17993 gnttab_max_grant_frames 0 17993 NULL
 +pvr2_v4l2_read_18006 pvr2_v4l2_read 3 18006 NULL
 +alloc_rx_desc_ring_18016 alloc_rx_desc_ring 2 18016 NULL
++cpufreq_add_dev_symlink_18028 cpufreq_add_dev_symlink 0 18028 NULL
 +o2hb_highest_node_18034 o2hb_highest_node 0 18034 NULL
 +cryptd_alloc_instance_18048 cryptd_alloc_instance 2-3 18048 NULL
 +__btrfs_drop_extents_18049 __btrfs_drop_extents 5 18049 NULL
@@ -115743,22 +115954,25 @@ index 0000000..41777a8
 +iwl_dbgfs_rx_queue_read_19943 iwl_dbgfs_rx_queue_read 3 19943 NULL
 +cfg80211_rx_assoc_resp_19944 cfg80211_rx_assoc_resp 4 19944 NULL
 +ll_xattr_cache_list_19954 ll_xattr_cache_list 0 19954 NULL
++get_jack_mode_name_19976 get_jack_mode_name 4 19976 NULL
 +attach_hdlc_protocol_19986 attach_hdlc_protocol 3 19986 NULL
 +rtw_set_wps_probe_resp_19989 rtw_set_wps_probe_resp 3 19989 NULL
 +diva_um_idi_read_20003 diva_um_idi_read 0 20003 NULL
-+event_trigger_write_20009 event_trigger_write 3 20009 NULL nohasharray
-+lov_stripe_md_size_20009 lov_stripe_md_size 0-1 20009 &event_trigger_write_20009
++lov_stripe_md_size_20009 lov_stripe_md_size 0-1 20009 NULL nohasharray
++event_trigger_write_20009 event_trigger_write 3 20009 &lov_stripe_md_size_20009
 +tree_mod_log_eb_move_20011 tree_mod_log_eb_move 5 20011 NULL
 +SYSC_fgetxattr_20027 SYSC_fgetxattr 4 20027 NULL
 +split_scan_timeout_read_20029 split_scan_timeout_read 3 20029 NULL
 +alloc_ieee80211_20063 alloc_ieee80211 1 20063 NULL
 +iwl_mvm_power_mac_dbgfs_read_20067 iwl_mvm_power_mac_dbgfs_read 4 20067 NULL
++target_message_20072 target_message 2 20072 NULL
 +rawv6_sendmsg_20080 rawv6_sendmsg 4 20080 NULL
 +fuse_conn_limit_read_20084 fuse_conn_limit_read 3 20084 NULL
 +aat2870_reg_write_file_20086 aat2870_reg_write_file 3 20086 NULL
 +team_options_register_20091 team_options_register 3 20091 NULL
 +qla2x00_adjust_sdev_qdepth_up_20097 qla2x00_adjust_sdev_qdepth_up 2 20097 NULL
 +xfs_qm_dqget_20103 xfs_qm_dqget 0 20103 NULL
++root_nfs_copy_20111 root_nfs_copy 3 20111 NULL
 +hptiop_adjust_disk_queue_depth_20122 hptiop_adjust_disk_queue_depth 2 20122 NULL
 +tomoyo_commit_ok_20167 tomoyo_commit_ok 2 20167 NULL
 +read_flush_pipefs_20171 read_flush_pipefs 3 20171 NULL
@@ -115829,6 +116043,7 @@ index 0000000..41777a8
 +uvc_alloc_entity_20836 uvc_alloc_entity 4-3 20836 NULL
 +p9_tag_alloc_20845 p9_tag_alloc 3 20845 NULL
 +nvme_trans_supported_vpd_pages_20847 nvme_trans_supported_vpd_pages 4 20847 NULL
++get_name_20855 get_name 4 20855 NULL
 +iwl_dbgfs_pm_params_read_20866 iwl_dbgfs_pm_params_read 3 20866 NULL
 +snd_pcm_capture_avail_20867 snd_pcm_capture_avail 0 20867 NULL
 +srq_free_res_20868 srq_free_res 5 20868 NULL
@@ -115854,6 +116069,7 @@ index 0000000..41777a8
 +lbs_threshold_read_21046 lbs_threshold_read 5 21046 NULL
 +reiserfs_direct_IO_21051 reiserfs_direct_IO 4 21051 NULL
 +proc_fault_inject_write_21058 proc_fault_inject_write 3 21058 NULL
++qdisc_get_default_21072 qdisc_get_default 2 21072 NULL
 +event_calibration_read_21083 event_calibration_read 3 21083 NULL
 +bl_add_page_to_bio_21094 bl_add_page_to_bio 2 21094 NULL nohasharray
 +multipath_status_21094 multipath_status 5 21094 &bl_add_page_to_bio_21094
@@ -116110,8 +116326,8 @@ index 0000000..41777a8
 +bin_to_hex_dup_23853 bin_to_hex_dup 2 23853 NULL
 +ocfs2_xattr_get_clusters_23857 ocfs2_xattr_get_clusters 0 23857 NULL
 +ieee80211_if_read_dot11MeshMaxPeerLinks_23878 ieee80211_if_read_dot11MeshMaxPeerLinks 3 23878 NULL
-+writeback_single_inode_23881 writeback_single_inode 0 23881 NULL nohasharray
-+nouveau_clock_create__23881 nouveau_clock_create_ 5 23881 &writeback_single_inode_23881
++nouveau_clock_create__23881 nouveau_clock_create_ 5 23881 NULL nohasharray
++writeback_single_inode_23881 writeback_single_inode 0 23881 &nouveau_clock_create__23881
 +tipc_snprintf_23893 tipc_snprintf 2-0 23893 NULL
 +add_new_gdb_meta_bg_23911 add_new_gdb_meta_bg 3 23911 NULL nohasharray
 +ieee80211_if_read_hw_queues_23911 ieee80211_if_read_hw_queues 3 23911 &add_new_gdb_meta_bg_23911
@@ -116221,8 +116437,8 @@ index 0000000..41777a8
 +__vxge_hw_vp_initialize_24885 __vxge_hw_vp_initialize 2 24885 NULL
 +xfs_qm_dqattach_24898 xfs_qm_dqattach 0 24898 NULL
 +codec_list_read_file_24910 codec_list_read_file 3 24910 NULL
-+__btrfs_free_extent_24927 __btrfs_free_extent 7 24927 NULL nohasharray
-+v4l2_ctrl_new_24927 v4l2_ctrl_new 7 24927 &__btrfs_free_extent_24927
++v4l2_ctrl_new_24927 v4l2_ctrl_new 7 24927 NULL nohasharray
++__btrfs_free_extent_24927 __btrfs_free_extent 7 24927 &v4l2_ctrl_new_24927
 +ocfs2_fiemap_24949 ocfs2_fiemap 4-3 24949 NULL
 +packet_sendmsg_24954 packet_sendmsg 4 24954 NULL
 +twl_i2c_write_u8_24976 twl_i2c_write_u8 3 24976 NULL
@@ -116238,6 +116454,7 @@ index 0000000..41777a8
 +ll_track_pid_seq_write_25068 ll_track_pid_seq_write 3 25068 NULL
 +SYSC_listxattr_25072 SYSC_listxattr 3 25072 NULL
 +ima_appraise_measurement_25093 ima_appraise_measurement 6 25093 NULL
++blkg_path_25099 blkg_path 3 25099 NULL
 +snd_rawmidi_kernel_write_25106 snd_rawmidi_kernel_write 3 25106 NULL
 +gfs2_quota_check_25130 gfs2_quota_check 0 25130 NULL
 +ipath_init_qp_table_25167 ipath_init_qp_table 2 25167 NULL
@@ -116259,6 +116476,7 @@ index 0000000..41777a8
 +dai_list_read_file_25421 dai_list_read_file 3 25421 NULL
 +xfs_qm_dqtobp_25448 xfs_qm_dqtobp 0 25448 NULL
 +generic_file_buffered_write_25464 generic_file_buffered_write 4-0-7 25464 NULL
++ipath_decode_err_25468 ipath_decode_err 3 25468 NULL
 +crypto_hash_digestsize_25469 crypto_hash_digestsize 0 25469 NULL
 +ivtv_buf_copy_from_user_25502 ivtv_buf_copy_from_user 4-0 25502 NULL
 +snd_pcm_plugin_build_25505 snd_pcm_plugin_build 5 25505 NULL
@@ -116458,8 +116676,10 @@ index 0000000..41777a8
 +sky2_pci_read16_27863 sky2_pci_read16 0 27863 NULL
 +ieee80211_if_read_dot11MeshHWMProotInterval_27873 ieee80211_if_read_dot11MeshHWMProotInterval 3 27873 NULL
 +unix_seqpacket_sendmsg_27893 unix_seqpacket_sendmsg 4 27893 NULL
-+tracing_clock_write_27961 tracing_clock_write 3 27961 NULL nohasharray
-+bio_next_split_27961 bio_next_split 2 27961 &tracing_clock_write_27961
++check_mapped_name_27943 check_mapped_name 3 27943 NULL
++bio_next_split_27961 bio_next_split 2 27961 NULL nohasharray
++tracing_clock_write_27961 tracing_clock_write 3 27961 &bio_next_split_27961
++security_path_chown_27966 security_path_chown 0 27966 NULL
 +tipc_media_addr_printf_27971 tipc_media_addr_printf 2 27971 NULL
 +device_register_27972 device_register 0 27972 NULL nohasharray
 +mic_rx_pkts_read_27972 mic_rx_pkts_read 3 27972 &device_register_27972
@@ -116500,6 +116720,7 @@ index 0000000..41777a8
 +kstrtos16_from_user_28300 kstrtos16_from_user 2 28300 NULL
 +nouveau_compat_ioctl_28305 nouveau_compat_ioctl 2 28305 NULL
 +snd_pcm_oss_read_28317 snd_pcm_oss_read 3 28317 NULL
++security_inode_link_28327 security_inode_link 0 28327 NULL
 +generic_write_checks_28329 generic_write_checks 0 28329 NULL
 +bm_entry_write_28338 bm_entry_write 3 28338 NULL
 +tcp_copy_to_iovec_28344 tcp_copy_to_iovec 3 28344 NULL
@@ -116532,6 +116753,7 @@ index 0000000..41777a8
 +kfifo_unused_28612 kfifo_unused 0 28612 NULL
 +snd_nm256_capture_copy_28622 snd_nm256_capture_copy 5-3 28622 NULL
 +setup_usemap_28636 setup_usemap 3-4 28636 NULL
++qib_handle_6120_hwerrors_28642 qib_handle_6120_hwerrors 3 28642 NULL
 +xfs_bmap_finish_28644 xfs_bmap_finish 0 28644 NULL
 +p9_fcall_alloc_28652 p9_fcall_alloc 1 28652 NULL
 +read_nic_io_byte_28654 read_nic_io_byte 0 28654 NULL
@@ -116615,6 +116837,7 @@ index 0000000..41777a8
 +leaf_dealloc_29566 leaf_dealloc 3 29566 NULL
 +kvm_read_guest_virt_system_29569 kvm_read_guest_virt_system 4-2 29569 NULL
 +lbs_lowsnr_read_29571 lbs_lowsnr_read 3 29571 NULL
++security_path_chmod_29578 security_path_chmod 0 29578 NULL
 +iwl_dbgfs_missed_beacon_write_29586 iwl_dbgfs_missed_beacon_write 3 29586 NULL
 +pvr2_hdw_report_unlocked_29589 pvr2_hdw_report_unlocked 4-0 29589 NULL
 +dio_set_defer_completion_29599 dio_set_defer_completion 0 29599 NULL
@@ -116769,6 +116992,7 @@ index 0000000..41777a8
 +uvc_simplify_fraction_31303 uvc_simplify_fraction 3 31303 NULL
 +sisusbcon_scroll_31315 sisusbcon_scroll 5-2-3 31315 NULL
 +command_file_write_31318 command_file_write 3 31318 NULL
++hwerr_crcbits_31334 hwerr_crcbits 4 31334 NULL
 +radix_tree_insert_31336 radix_tree_insert 0 31336 NULL
 +em28xx_init_usb_xfer_31337 em28xx_init_usb_xfer 4-6 31337 NULL
 +outlen_write_31358 outlen_write 3 31358 NULL
@@ -117111,6 +117335,7 @@ index 0000000..41777a8
 +btrfs_super_chunk_root_34925 btrfs_super_chunk_root 0 34925 NULL nohasharray
 +__inode_permission_34925 __inode_permission 0 34925 &btrfs_super_chunk_root_34925
 +ceph_aio_write_34930 ceph_aio_write 4 34930 NULL
++sec_flags2str_34933 sec_flags2str 3 34933 NULL
 +snd_info_entry_read_34938 snd_info_entry_read 3 34938 NULL
 +i2c_transfer_34958 i2c_transfer 0 34958 NULL
 +do_add_page_to_bio_34974 do_add_page_to_bio 2-10 34974 NULL
@@ -117333,7 +117558,8 @@ index 0000000..41777a8
 +ext3_direct_IO_37308 ext3_direct_IO 4 37308 NULL
 +jffs2_write_dirent_37311 jffs2_write_dirent 5 37311 NULL
 +send_msg_37323 send_msg 4 37323 NULL
-+l2cap_create_connless_pdu_37327 l2cap_create_connless_pdu 3 37327 NULL
++l2cap_create_connless_pdu_37327 l2cap_create_connless_pdu 3 37327 NULL nohasharray
++bnx2x_vf_fill_fw_str_37327 bnx2x_vf_fill_fw_str 3 37327 &l2cap_create_connless_pdu_37327
 +scsi_mode_select_37330 scsi_mode_select 6 37330 NULL
 +rxrpc_server_sendmsg_37331 rxrpc_server_sendmsg 4 37331 NULL
 +xfs_iomap_write_allocate_37336 xfs_iomap_write_allocate 0 37336 NULL
@@ -117504,8 +117730,9 @@ index 0000000..41777a8
 +qcam_read_bytes_39205 qcam_read_bytes 0 39205 NULL
 +ivtv_v4l2_write_39226 ivtv_v4l2_write 3 39226 NULL
 +posix_acl_to_xattr_39237 posix_acl_to_xattr 0 39237 NULL
-+pwr_cont_miss_bcns_spread_read_39250 pwr_cont_miss_bcns_spread_read 3 39250 NULL nohasharray
-+r128_compat_ioctl_39250 r128_compat_ioctl 2 39250 &pwr_cont_miss_bcns_spread_read_39250
++snd_pcm_capture_forward_39248 snd_pcm_capture_forward 2 39248 NULL
++r128_compat_ioctl_39250 r128_compat_ioctl 2 39250 NULL nohasharray
++pwr_cont_miss_bcns_spread_read_39250 pwr_cont_miss_bcns_spread_read 3 39250 &r128_compat_ioctl_39250
 +i915_error_state_read_39254 i915_error_state_read 3 39254 NULL
 +rx_filter_protection_filter_read_39282 rx_filter_protection_filter_read 3 39282 NULL
 +_iwl_dbgfs_pm_params_write_39325 _iwl_dbgfs_pm_params_write 3 39325 NULL
@@ -117569,6 +117796,7 @@ index 0000000..41777a8
 +broadsheetfb_write_39976 broadsheetfb_write 3 39976 NULL
 +mthca_array_init_39987 mthca_array_init 2 39987 NULL
 +fw_device_op_read_39990 fw_device_op_read 3 39990 NULL
++server_name2svname_39998 server_name2svname 4 39998 NULL
 +xen_hvm_config_40018 xen_hvm_config 2 40018 NULL
 +ivtvfb_write_40023 ivtvfb_write 3 40023 NULL
 +disc_pwup_write_40027 disc_pwup_write 3 40027 NULL
@@ -117638,7 +117866,7 @@ index 0000000..41777a8
 +pg_write_40766 pg_write 3 40766 NULL
 +kernfs_fop_read_40770 kernfs_fop_read 3 40770 NULL
 +show_list_40775 show_list 3-0 40775 NULL
-+kfifo_out_copy_r_40784 kfifo_out_copy_r 0-3 40784 NULL
++kfifo_out_copy_r_40784 kfifo_out_copy_r 3-0 40784 NULL
 +bitmap_weight_40791 bitmap_weight 0-2 40791 NULL
 +pyra_sysfs_read_40795 pyra_sysfs_read 6 40795 NULL
 +add_action_40811 add_action 4 40811 NULL
@@ -117722,6 +117950,7 @@ index 0000000..41777a8
 +rx_rx_pre_complt_read_41653 rx_rx_pre_complt_read 3 41653 NULL
 +get_std_timing_41654 get_std_timing 0 41654 NULL
 +ieee80211_if_fmt_bssid_41677 ieee80211_if_fmt_bssid 3 41677 NULL
++fill_pcm_stream_name_41685 fill_pcm_stream_name 2 41685 NULL
 +lov_unpackmd_41701 lov_unpackmd 4 41701 NULL
 +apei_exec_for_each_entry_41717 apei_exec_for_each_entry 0 41717 NULL
 +fillonedir_41746 fillonedir 3 41746 NULL
@@ -117891,6 +118120,7 @@ index 0000000..41777a8
 +tx_frag_failed_read_43540 tx_frag_failed_read 3 43540 NULL
 +request_resource_43548 request_resource 0 43548 NULL
 +rpc_malloc_43573 rpc_malloc 2 43573 NULL
++handle_frequent_errors_43599 handle_frequent_errors 4 43599 NULL
 +lpfc_idiag_drbacc_read_reg_43606 lpfc_idiag_drbacc_read_reg 0-3 43606 NULL
 +proc_read_43614 proc_read 3 43614 NULL
 +disable_dma_on_even_43618 disable_dma_on_even 0 43618 NULL
@@ -117960,6 +118190,7 @@ index 0000000..41777a8
 +rts_threshold_read_44384 rts_threshold_read 3 44384 NULL
 +mtip_hw_read_flags_44396 mtip_hw_read_flags 3 44396 NULL
 +aoedev_flush_44398 aoedev_flush 2 44398 NULL
++strlcpy_44400 strlcpy 3 44400 NULL
 +drm_buffer_alloc_44405 drm_buffer_alloc 2 44405 NULL
 +osst_do_scsi_44410 osst_do_scsi 4 44410 NULL
 +ieee80211_if_read_rc_rateidx_mcs_mask_5ghz_44423 ieee80211_if_read_rc_rateidx_mcs_mask_5ghz 3 44423 NULL
@@ -118072,7 +118303,8 @@ index 0000000..41777a8
 +unix_dgram_sendmsg_45699 unix_dgram_sendmsg 4 45699 NULL nohasharray
 +bscnl_emit_45699 bscnl_emit 2-5-0 45699 &unix_dgram_sendmsg_45699
 +sg_proc_write_adio_45704 sg_proc_write_adio 3 45704 NULL
-+snd_cs46xx_io_read_45734 snd_cs46xx_io_read 5 45734 NULL
++snd_cs46xx_io_read_45734 snd_cs46xx_io_read 5 45734 NULL nohasharray
++task_cgroup_path_45734 task_cgroup_path 3 45734 &snd_cs46xx_io_read_45734
 +rw_copy_check_uvector_45748 rw_copy_check_uvector 3-0 45748 NULL nohasharray
 +v4l2_ctrl_new_std_45748 v4l2_ctrl_new_std 5 45748 &rw_copy_check_uvector_45748
 +lkdtm_debugfs_read_45752 lkdtm_debugfs_read 3 45752 NULL
@@ -118151,7 +118383,7 @@ index 0000000..41777a8
 +snd_compr_write_data_46592 snd_compr_write_data 3 46592 NULL
 +il3945_stats_flag_46606 il3945_stats_flag 0-3 46606 NULL
 +vscnprintf_46617 vscnprintf 0-2 46617 NULL
-+__kfifo_out_r_46623 __kfifo_out_r 0-3 46623 NULL
++__kfifo_out_r_46623 __kfifo_out_r 3-0 46623 NULL
 +request_key_async_with_auxdata_46624 request_key_async_with_auxdata 4 46624 NULL
 +pci_enable_device_46642 pci_enable_device 0 46642 NULL
 +vfs_getxattr_alloc_46649 vfs_getxattr_alloc 0 46649 NULL
@@ -118186,12 +118418,14 @@ index 0000000..41777a8
 +SYSC_poll_46965 SYSC_poll 2 46965 NULL
 +crypto_tfm_alg_alignmask_46971 crypto_tfm_alg_alignmask 0 46971 NULL
 +mgmt_pending_add_46976 mgmt_pending_add 5 46976 NULL
++strlcat_46985 strlcat 3 46985 NULL
 +bitmap_file_clear_bit_46990 bitmap_file_clear_bit 2 46990 NULL
 +sel_write_bool_46996 sel_write_bool 3 46996 NULL
 +blk_rq_map_kern_47004 blk_rq_map_kern 4 47004 NULL
 +cx231xx_init_bulk_47024 cx231xx_init_bulk 3-2-4 47024 NULL
 +fs_path_len_47060 fs_path_len 0 47060 NULL
 +event_trigger_regex_write_47067 event_trigger_regex_write 3 47067 NULL
++ext4_xattr_list_entries_47070 ext4_xattr_list_entries 0 47070 NULL
 +pipeline_dec_packet_in_read_47076 pipeline_dec_packet_in_read 3 47076 NULL
 +scsi_deactivate_tcq_47086 scsi_deactivate_tcq 2 47086 NULL
 +iwl_dump_nic_event_log_47089 iwl_dump_nic_event_log 0 47089 NULL
@@ -118246,7 +118480,8 @@ index 0000000..41777a8
 +twl4030_clear_set_47624 twl4030_clear_set 4 47624 NULL
 +ccp_sha_setkey_47633 ccp_sha_setkey 3 47633 NULL
 +get_size_47644 get_size 1-2 47644 NULL
-+packet_recvmsg_47700 packet_recvmsg 4 47700 NULL
++packet_recvmsg_47700 packet_recvmsg 4 47700 NULL nohasharray
++ipath_format_hwmsg_47700 ipath_format_hwmsg 2 47700 &packet_recvmsg_47700
 +save_microcode_47717 save_microcode 3 47717 NULL
 +bits_to_user_47733 bits_to_user 2-3 47733 NULL
 +carl9170_debugfs_read_47738 carl9170_debugfs_read 3 47738 NULL
@@ -118267,6 +118502,7 @@ index 0000000..41777a8
 +cfs_percpt_alloc_47918 cfs_percpt_alloc 2 47918 NULL
 +comedi_write_47926 comedi_write 3 47926 NULL
 +nvme_trans_get_blk_desc_len_47946 nvme_trans_get_blk_desc_len 0-2 47946 NULL
++gether_get_ifname_47972 gether_get_ifname 3 47972 NULL
 +mempool_resize_47983 mempool_resize 2 47983 NULL nohasharray
 +iwl_dbgfs_ucode_tracing_read_47983 iwl_dbgfs_ucode_tracing_read 3 47983 &mempool_resize_47983
 +dbg_port_buf_47990 dbg_port_buf 2 47990 NULL
@@ -118319,6 +118555,7 @@ index 0000000..41777a8
 +print_filtered_48442 print_filtered 2-0 48442 NULL
 +tun_recvmsg_48463 tun_recvmsg 4 48463 NULL
 +compat_SyS_preadv64_48469 compat_SyS_preadv64 3 48469 NULL
++ipath_format_hwerrors_48487 ipath_format_hwerrors 5 48487 NULL
 +r8712_usbctrl_vendorreq_48489 r8712_usbctrl_vendorreq 6 48489 NULL
 +send_control_msg_48498 send_control_msg 6 48498 NULL
 +count_masked_bytes_48507 count_masked_bytes 0-1 48507 NULL
@@ -118385,6 +118622,7 @@ index 0000000..41777a8
 +ath6kl_bgscan_int_write_49178 ath6kl_bgscan_int_write 3 49178 NULL
 +dvb_dvr_ioctl_49182 dvb_dvr_ioctl 2 49182 NULL
 +print_queue_49191 print_queue 4-0 49191 NULL
++root_nfs_cat_49192 root_nfs_cat 3 49192 NULL
 +iwl_dbgfs_ucode_general_stats_read_49199 iwl_dbgfs_ucode_general_stats_read 3 49199 NULL
 +il4965_rs_sta_dbgfs_stats_table_read_49206 il4965_rs_sta_dbgfs_stats_table_read 3 49206 NULL
 +do_jffs2_getxattr_49210 do_jffs2_getxattr 0 49210 NULL
@@ -118465,6 +118703,7 @@ index 0000000..41777a8
 +ioread8_50049 ioread8 0 50049 NULL
 +fuse_conn_max_background_write_50061 fuse_conn_max_background_write 3 50061 NULL
 +__kfifo_dma_in_prepare_50081 __kfifo_dma_in_prepare 4 50081 NULL
++dev_set_alias_50084 dev_set_alias 3 50084 NULL
 +libcfs_ioctl_popdata_50087 libcfs_ioctl_popdata 3 50087 NULL
 +sock_setsockopt_50088 sock_setsockopt 5 50088 NULL
 +altera_swap_dr_50090 altera_swap_dr 2 50090 NULL
@@ -118683,6 +118922,7 @@ index 0000000..41777a8
 +mdiobus_alloc_size_52259 mdiobus_alloc_size 1 52259 NULL
 +shrink_slab_52261 shrink_slab 2 52261 NULL
 +sisusbcon_do_font_op_52271 sisusbcon_do_font_op 9 52271 NULL
++handle_supp_msgs_52284 handle_supp_msgs 4 52284 NULL
 +kobject_set_name_vargs_52309 kobject_set_name_vargs 0 52309 NULL
 +read_file_reset_52310 read_file_reset 3 52310 NULL
 +request_asymmetric_key_52317 request_asymmetric_key 2-4 52317 NULL
@@ -118742,6 +118982,7 @@ index 0000000..41777a8
 +lb_alloc_ep_req_52837 lb_alloc_ep_req 2 52837 NULL
 +mon_bin_get_event_52863 mon_bin_get_event 4-6 52863 NULL
 +twl6030_gpadc_write_52867 twl6030_gpadc_write 1 52867 NULL
++qib_decode_6120_err_52876 qib_decode_6120_err 3 52876 NULL
 +twlreg_write_52880 twlreg_write 3 52880 NULL
 +pvr2_ctrl_value_to_sym_internal_52881 pvr2_ctrl_value_to_sym_internal 5 52881 NULL
 +cache_read_procfs_52882 cache_read_procfs 3 52882 NULL
@@ -118967,7 +119208,7 @@ index 0000000..41777a8
 +dbAllocDmap_55227 dbAllocDmap 0 55227 NULL
 +memcpy_fromiovec_55247 memcpy_fromiovec 3 55247 NULL
 +lbs_failcount_write_55276 lbs_failcount_write 3 55276 NULL
-+persistent_ram_new_55286 persistent_ram_new 1-2 55286 NULL
++persistent_ram_new_55286 persistent_ram_new 2-1 55286 NULL
 +rx_streaming_interval_read_55291 rx_streaming_interval_read 3 55291 NULL
 +lov_get_stripecnt_55297 lov_get_stripecnt 0-3 55297 NULL
 +gsm_control_modem_55303 gsm_control_modem 3 55303 NULL
@@ -119123,12 +119364,14 @@ index 0000000..41777a8
 +debug_debug3_read_56894 debug_debug3_read 3 56894 NULL
 +batadv_tt_update_changes_56895 batadv_tt_update_changes 3 56895 NULL
 +hfsplus_find_cat_56899 hfsplus_find_cat 0 56899 NULL
++strcspn_56913 strcspn 0 56913 NULL
 +__kfifo_out_56927 __kfifo_out 0-3 56927 NULL
 +journal_init_revoke_56933 journal_init_revoke 2 56933 NULL
 +xfs_alloc_ag_vextent_56943 xfs_alloc_ag_vextent 0 56943 NULL
 +nouveau_xtensa_create__56952 nouveau_xtensa_create_ 8 56952 NULL
 +diva_get_driver_info_56967 diva_get_driver_info 0 56967 NULL
 +nouveau_device_create__56984 nouveau_device_create_ 6 56984 NULL
++sptlrpc_secflags2str_56995 sptlrpc_secflags2str 3 56995 NULL
 +vlsi_alloc_ring_57003 vlsi_alloc_ring 3-4 57003 NULL
 +btrfs_super_csum_size_57004 btrfs_super_csum_size 0 57004 NULL
 +aircable_process_packet_57027 aircable_process_packet 4 57027 NULL
@@ -119140,6 +119383,7 @@ index 0000000..41777a8
 +sca3000_read_data_57064 sca3000_read_data 4 57064 NULL
 +pcmcia_replace_cis_57066 pcmcia_replace_cis 3 57066 NULL
 +tracing_set_trace_write_57096 tracing_set_trace_write 3 57096 NULL
++altera_get_note_57099 altera_get_note 6 57099 NULL
 +hpfs_readpages_57106 hpfs_readpages 4 57106 NULL
 +crypto_compress_ctxsize_57109 crypto_compress_ctxsize 0 57109 NULL
 +cipso_v4_gentag_loc_57119 cipso_v4_gentag_loc 0 57119 NULL
@@ -119153,7 +119397,7 @@ index 0000000..41777a8
 +rx_hw_stuck_read_57179 rx_hw_stuck_read 3 57179 NULL
 +hash_netnet6_expire_57191 hash_netnet6_expire 4 57191 NULL
 +tt3650_ci_msg_57219 tt3650_ci_msg 4 57219 NULL
-+dma_fifo_alloc_57236 dma_fifo_alloc 2-3-5 57236 NULL
++dma_fifo_alloc_57236 dma_fifo_alloc 5-3-2 57236 NULL
 +flush_space_57241 flush_space 0 57241 NULL
 +rsxx_cram_write_57244 rsxx_cram_write 3 57244 NULL
 +ieee80211_if_fmt_tsf_57249 ieee80211_if_fmt_tsf 3 57249 NULL
@@ -119214,6 +119458,7 @@ index 0000000..41777a8
 +ieee80211_if_fmt_dot11MeshHWMPpreqMinInterval_57762 ieee80211_if_fmt_dot11MeshHWMPpreqMinInterval 3 57762 NULL
 +SYSC_process_vm_writev_57776 SYSC_process_vm_writev 3-5 57776 NULL
 +apei_exec_collect_resources_57788 apei_exec_collect_resources 0 57788 NULL
++security_inode_unlink_57791 security_inode_unlink 0 57791 NULL
 +ld2_57794 ld2 0 57794 NULL
 +ivtv_read_57796 ivtv_read 3 57796 NULL
 +ion_test_ioctl_57799 ion_test_ioctl 2 57799 NULL
@@ -119283,6 +119528,7 @@ index 0000000..41777a8
 +rndis_add_response_58544 rndis_add_response 2 58544 NULL
 +wep_decrypt_fail_read_58567 wep_decrypt_fail_read 3 58567 NULL
 +scnprint_mac_oui_58578 scnprint_mac_oui 3-0 58578 NULL
++get_rhf_errstring_58582 get_rhf_errstring 3 58582 NULL
 +ea_read_inline_58589 ea_read_inline 0 58589 NULL
 +isku_sysfs_read_keys_thumbster_58590 isku_sysfs_read_keys_thumbster 6 58590 NULL
 +xip_file_read_58592 xip_file_read 3 58592 NULL
@@ -119337,6 +119583,7 @@ index 0000000..41777a8
 +ocfs2_move_extent_59187 ocfs2_move_extent 2-5 59187 NULL
 +xfs_ialloc_next_rec_59193 xfs_ialloc_next_rec 0 59193 NULL
 +xfs_iext_realloc_indirect_59211 xfs_iext_realloc_indirect 2 59211 NULL
++check_mapped_selector_name_59216 check_mapped_selector_name 5 59216 NULL
 +dt3155_read_59226 dt3155_read 3 59226 NULL
 +paging64_gpte_to_gfn_lvl_59229 paging64_gpte_to_gfn_lvl 0-1-2 59229 NULL
 +nla_len_59258 nla_len 0 59258 NULL
@@ -119513,7 +119760,8 @@ index 0000000..41777a8
 +smk_read_ambient_61220 smk_read_ambient 3 61220 NULL
 +v9fs_mmap_file_read_61262 v9fs_mmap_file_read 3 61262 NULL
 +btrfs_bio_alloc_61270 btrfs_bio_alloc 3 61270 NULL nohasharray
-+find_get_pages_tag_61270 find_get_pages_tag 0 61270 &btrfs_bio_alloc_61270
++find_get_pages_tag_61270 find_get_pages_tag 0 61270 &btrfs_bio_alloc_61270 nohasharray
++ifalias_store_61270 ifalias_store 4 61270 &find_get_pages_tag_61270
 +vortex_adbdma_getlinearpos_61283 vortex_adbdma_getlinearpos 0 61283 NULL nohasharray
 +hfsplus_getxattr_finder_info_61283 hfsplus_getxattr_finder_info 0 61283 &vortex_adbdma_getlinearpos_61283
 +nvme_trans_copy_to_user_61288 nvme_trans_copy_to_user 3 61288 NULL
@@ -119550,6 +119798,7 @@ index 0000000..41777a8
 +resize_stripes_61650 resize_stripes 2 61650 NULL
 +ttm_page_pool_free_61661 ttm_page_pool_free 2-0 61661 NULL
 +insert_one_name_61668 insert_one_name 7 61668 NULL
++qib_format_hwmsg_61679 qib_format_hwmsg 2 61679 NULL
 +lock_loop_61681 lock_loop 1 61681 NULL
 +filter_read_61692 filter_read 3 61692 NULL
 +iov_length_61716 iov_length 0 61716 NULL
@@ -119700,6 +119949,7 @@ index 0000000..41777a8
 +si5351_bulk_write_63468 si5351_bulk_write 2-3 63468 NULL
 +snd_info_entry_write_63474 snd_info_entry_write 3 63474 NULL
 +reada_find_extent_63486 reada_find_extent 2 63486 NULL
++read_kcore_63488 read_kcore 3 63488 NULL
 +snd_pcm_plug_write_transfer_63503 snd_pcm_plug_write_transfer 0-3 63503 NULL
 +efx_mcdi_rpc_async_63529 efx_mcdi_rpc_async 4-5 63529 NULL
 +ubi_more_leb_change_data_63534 ubi_more_leb_change_data 4 63534 NULL nohasharray
@@ -119846,6 +120096,7 @@ index 0000000..41777a8
 +suspend_dtim_interval_read_64971 suspend_dtim_interval_read 3 64971 NULL
 +crypto_ahash_digestsize_65014 crypto_ahash_digestsize 0 65014 NULL
 +insert_dent_65034 insert_dent 7 65034 NULL
++snd_hda_get_pin_label_65035 snd_hda_get_pin_label 5 65035 NULL
 +ext4_ind_trans_blocks_65053 ext4_ind_trans_blocks 0-2 65053 NULL
 +pcibios_enable_device_65059 pcibios_enable_device 0 65059 NULL
 +__alloc_bootmem_node_high_65076 __alloc_bootmem_node_high 2 65076 NULL
@@ -119984,7 +120235,7 @@ index 0000000..560cd7b
 +zpios_read_64734 zpios_read 3 64734 NULL
 diff --git a/tools/gcc/size_overflow_plugin/size_overflow_plugin.c b/tools/gcc/size_overflow_plugin/size_overflow_plugin.c
 new file mode 100644
-index 0000000..0e9dcee
+index 0000000..e6fe17b
 --- /dev/null
 +++ b/tools/gcc/size_overflow_plugin/size_overflow_plugin.c
 @@ -0,0 +1,259 @@
@@ -120020,7 +120271,7 @@ index 0000000..0e9dcee
 +tree size_overflow_type_TI;
 +
 +static struct plugin_info size_overflow_plugin_info = {
-+	.version	= "20140515",
++	.version	= "20140517",
 +	.help		= "no-size-overflow\tturn off size overflow checking\n",
 +};
 +
diff --git a/3.2.58/0000_README b/3.2.59/0000_README
index 5094122..e328e8d 100644
--- a/3.2.58/0000_README
+++ b/3.2.59/0000_README
@@ -150,7 +150,11 @@ Patch:	1057_linux-3.2.58.patch
 From:	http://www.kernel.org
 Desc:	Linux 3.2.58
 
-Patch:	4420_grsecurity-3.0-3.2.58-201405112002.patch
+Patch:	1058_linux-3.2.59.patch
+From:	http://www.kernel.org
+Desc:	Linux 3.2.59
+
+Patch:	4420_grsecurity-3.0-3.2.59-201405252042.patch
 From:	http://www.grsecurity.net
 Desc:	hardened-sources base patch from upstream grsecurity
 
diff --git a/3.2.58/1021_linux-3.2.22.patch b/3.2.59/1021_linux-3.2.22.patch
index e6ad93a..e6ad93a 100644
--- a/3.2.58/1021_linux-3.2.22.patch
+++ b/3.2.59/1021_linux-3.2.22.patch
diff --git a/3.2.58/1022_linux-3.2.23.patch b/3.2.59/1022_linux-3.2.23.patch
index 3d796d0..3d796d0 100644
--- a/3.2.58/1022_linux-3.2.23.patch
+++ b/3.2.59/1022_linux-3.2.23.patch
diff --git a/3.2.58/1023_linux-3.2.24.patch b/3.2.59/1023_linux-3.2.24.patch
index 4692eb4..4692eb4 100644
--- a/3.2.58/1023_linux-3.2.24.patch
+++ b/3.2.59/1023_linux-3.2.24.patch
diff --git a/3.2.58/1024_linux-3.2.25.patch b/3.2.59/1024_linux-3.2.25.patch
index e95c213..e95c213 100644
--- a/3.2.58/1024_linux-3.2.25.patch
+++ b/3.2.59/1024_linux-3.2.25.patch
diff --git a/3.2.58/1025_linux-3.2.26.patch b/3.2.59/1025_linux-3.2.26.patch
index 44065b9..44065b9 100644
--- a/3.2.58/1025_linux-3.2.26.patch
+++ b/3.2.59/1025_linux-3.2.26.patch
diff --git a/3.2.58/1026_linux-3.2.27.patch b/3.2.59/1026_linux-3.2.27.patch
index 5878eb4..5878eb4 100644
--- a/3.2.58/1026_linux-3.2.27.patch
+++ b/3.2.59/1026_linux-3.2.27.patch
diff --git a/3.2.58/1027_linux-3.2.28.patch b/3.2.59/1027_linux-3.2.28.patch
index 4dbba4b..4dbba4b 100644
--- a/3.2.58/1027_linux-3.2.28.patch
+++ b/3.2.59/1027_linux-3.2.28.patch
diff --git a/3.2.58/1028_linux-3.2.29.patch b/3.2.59/1028_linux-3.2.29.patch
index 3c65179..3c65179 100644
--- a/3.2.58/1028_linux-3.2.29.patch
+++ b/3.2.59/1028_linux-3.2.29.patch
diff --git a/3.2.58/1029_linux-3.2.30.patch b/3.2.59/1029_linux-3.2.30.patch
index 86aea4b..86aea4b 100644
--- a/3.2.58/1029_linux-3.2.30.patch
+++ b/3.2.59/1029_linux-3.2.30.patch
diff --git a/3.2.58/1030_linux-3.2.31.patch b/3.2.59/1030_linux-3.2.31.patch
index c6accf5..c6accf5 100644
--- a/3.2.58/1030_linux-3.2.31.patch
+++ b/3.2.59/1030_linux-3.2.31.patch
diff --git a/3.2.58/1031_linux-3.2.32.patch b/3.2.59/1031_linux-3.2.32.patch
index 247fc0b..247fc0b 100644
--- a/3.2.58/1031_linux-3.2.32.patch
+++ b/3.2.59/1031_linux-3.2.32.patch
diff --git a/3.2.58/1032_linux-3.2.33.patch b/3.2.59/1032_linux-3.2.33.patch
index c32fb75..c32fb75 100644
--- a/3.2.58/1032_linux-3.2.33.patch
+++ b/3.2.59/1032_linux-3.2.33.patch
diff --git a/3.2.58/1033_linux-3.2.34.patch b/3.2.59/1033_linux-3.2.34.patch
index d647b38..d647b38 100644
--- a/3.2.58/1033_linux-3.2.34.patch
+++ b/3.2.59/1033_linux-3.2.34.patch
diff --git a/3.2.58/1034_linux-3.2.35.patch b/3.2.59/1034_linux-3.2.35.patch
index 76a9c19..76a9c19 100644
--- a/3.2.58/1034_linux-3.2.35.patch
+++ b/3.2.59/1034_linux-3.2.35.patch
diff --git a/3.2.58/1035_linux-3.2.36.patch b/3.2.59/1035_linux-3.2.36.patch
index 5d192a3..5d192a3 100644
--- a/3.2.58/1035_linux-3.2.36.patch
+++ b/3.2.59/1035_linux-3.2.36.patch
diff --git a/3.2.58/1036_linux-3.2.37.patch b/3.2.59/1036_linux-3.2.37.patch
index ad13251..ad13251 100644
--- a/3.2.58/1036_linux-3.2.37.patch
+++ b/3.2.59/1036_linux-3.2.37.patch
diff --git a/3.2.58/1037_linux-3.2.38.patch b/3.2.59/1037_linux-3.2.38.patch
index a3c106f..a3c106f 100644
--- a/3.2.58/1037_linux-3.2.38.patch
+++ b/3.2.59/1037_linux-3.2.38.patch
diff --git a/3.2.58/1038_linux-3.2.39.patch b/3.2.59/1038_linux-3.2.39.patch
index 5639e92..5639e92 100644
--- a/3.2.58/1038_linux-3.2.39.patch
+++ b/3.2.59/1038_linux-3.2.39.patch
diff --git a/3.2.58/1039_linux-3.2.40.patch b/3.2.59/1039_linux-3.2.40.patch
index f26b39c..f26b39c 100644
--- a/3.2.58/1039_linux-3.2.40.patch
+++ b/3.2.59/1039_linux-3.2.40.patch
diff --git a/3.2.58/1040_linux-3.2.41.patch b/3.2.59/1040_linux-3.2.41.patch
index 0d27fcb..0d27fcb 100644
--- a/3.2.58/1040_linux-3.2.41.patch
+++ b/3.2.59/1040_linux-3.2.41.patch
diff --git a/3.2.58/1041_linux-3.2.42.patch b/3.2.59/1041_linux-3.2.42.patch
index 77a08ed..77a08ed 100644
--- a/3.2.58/1041_linux-3.2.42.patch
+++ b/3.2.59/1041_linux-3.2.42.patch
diff --git a/3.2.58/1042_linux-3.2.43.patch b/3.2.59/1042_linux-3.2.43.patch
index a3f878b..a3f878b 100644
--- a/3.2.58/1042_linux-3.2.43.patch
+++ b/3.2.59/1042_linux-3.2.43.patch
diff --git a/3.2.58/1043_linux-3.2.44.patch b/3.2.59/1043_linux-3.2.44.patch
index 3d5e6ff..3d5e6ff 100644
--- a/3.2.58/1043_linux-3.2.44.patch
+++ b/3.2.59/1043_linux-3.2.44.patch
diff --git a/3.2.58/1044_linux-3.2.45.patch b/3.2.59/1044_linux-3.2.45.patch
index 44e1767..44e1767 100644
--- a/3.2.58/1044_linux-3.2.45.patch
+++ b/3.2.59/1044_linux-3.2.45.patch
diff --git a/3.2.58/1045_linux-3.2.46.patch b/3.2.59/1045_linux-3.2.46.patch
index bc10efd..bc10efd 100644
--- a/3.2.58/1045_linux-3.2.46.patch
+++ b/3.2.59/1045_linux-3.2.46.patch
diff --git a/3.2.58/1046_linux-3.2.47.patch b/3.2.59/1046_linux-3.2.47.patch
index b74563c..b74563c 100644
--- a/3.2.58/1046_linux-3.2.47.patch
+++ b/3.2.59/1046_linux-3.2.47.patch
diff --git a/3.2.58/1047_linux-3.2.48.patch b/3.2.59/1047_linux-3.2.48.patch
index 6d55b1f..6d55b1f 100644
--- a/3.2.58/1047_linux-3.2.48.patch
+++ b/3.2.59/1047_linux-3.2.48.patch
diff --git a/3.2.58/1048_linux-3.2.49.patch b/3.2.59/1048_linux-3.2.49.patch
index 2dab0cf..2dab0cf 100644
--- a/3.2.58/1048_linux-3.2.49.patch
+++ b/3.2.59/1048_linux-3.2.49.patch
diff --git a/3.2.58/1049_linux-3.2.50.patch b/3.2.59/1049_linux-3.2.50.patch
index 20b3015..20b3015 100644
--- a/3.2.58/1049_linux-3.2.50.patch
+++ b/3.2.59/1049_linux-3.2.50.patch
diff --git a/3.2.58/1050_linux-3.2.51.patch b/3.2.59/1050_linux-3.2.51.patch
index 5d5832b..5d5832b 100644
--- a/3.2.58/1050_linux-3.2.51.patch
+++ b/3.2.59/1050_linux-3.2.51.patch
diff --git a/3.2.58/1051_linux-3.2.52.patch b/3.2.59/1051_linux-3.2.52.patch
index 94b9359..94b9359 100644
--- a/3.2.58/1051_linux-3.2.52.patch
+++ b/3.2.59/1051_linux-3.2.52.patch
diff --git a/3.2.58/1052_linux-3.2.53.patch b/3.2.59/1052_linux-3.2.53.patch
index 986d714..986d714 100644
--- a/3.2.58/1052_linux-3.2.53.patch
+++ b/3.2.59/1052_linux-3.2.53.patch
diff --git a/3.2.58/1053_linux-3.2.54.patch b/3.2.59/1053_linux-3.2.54.patch
index a907496..a907496 100644
--- a/3.2.58/1053_linux-3.2.54.patch
+++ b/3.2.59/1053_linux-3.2.54.patch
diff --git a/3.2.58/1054_linux-3.2.55.patch b/3.2.59/1054_linux-3.2.55.patch
index 6071ff5..6071ff5 100644
--- a/3.2.58/1054_linux-3.2.55.patch
+++ b/3.2.59/1054_linux-3.2.55.patch
diff --git a/3.2.58/1055_linux-3.2.56.patch b/3.2.59/1055_linux-3.2.56.patch
index 2e8239c..2e8239c 100644
--- a/3.2.58/1055_linux-3.2.56.patch
+++ b/3.2.59/1055_linux-3.2.56.patch
diff --git a/3.2.58/1056_linux-3.2.57.patch b/3.2.59/1056_linux-3.2.57.patch
index 7b8f174..7b8f174 100644
--- a/3.2.58/1056_linux-3.2.57.patch
+++ b/3.2.59/1056_linux-3.2.57.patch
diff --git a/3.2.58/1057_linux-3.2.58.patch b/3.2.59/1057_linux-3.2.58.patch
index db5723a..db5723a 100644
--- a/3.2.58/1057_linux-3.2.58.patch
+++ b/3.2.59/1057_linux-3.2.58.patch
diff --git a/3.2.59/1058_linux-3.2.59.patch b/3.2.59/1058_linux-3.2.59.patch
new file mode 100644
index 0000000..cd59fe9
--- /dev/null
+++ b/3.2.59/1058_linux-3.2.59.patch
@@ -0,0 +1,1213 @@
+diff --git a/Makefile b/Makefile
+index d59b394..1be3414 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 3
+ PATCHLEVEL = 2
+-SUBLEVEL = 58
++SUBLEVEL = 59
+ EXTRAVERSION =
+ NAME = Saber-toothed Squirrel
+ 
+diff --git a/arch/arm/include/asm/div64.h b/arch/arm/include/asm/div64.h
+index d3f0a9e..506e33b 100644
+--- a/arch/arm/include/asm/div64.h
++++ b/arch/arm/include/asm/div64.h
+@@ -156,7 +156,7 @@
+ 		/* Select the best insn combination to perform the   */	\
+ 		/* actual __m * __n / (__p << 64) operation.         */	\
+ 		if (!__c) {						\
+-			asm (	"umull	%Q0, %R0, %1, %Q2\n\t"		\
++			asm (	"umull	%Q0, %R0, %Q1, %Q2\n\t"		\
+ 				"mov	%Q0, #0"			\
+ 				: "=&r" (__res)				\
+ 				: "r" (__m), "r" (__n)			\
+diff --git a/arch/parisc/kernel/syscall_table.S b/arch/parisc/kernel/syscall_table.S
+index 3735abd..4014d90 100644
+--- a/arch/parisc/kernel/syscall_table.S
++++ b/arch/parisc/kernel/syscall_table.S
+@@ -395,7 +395,7 @@
+ 	ENTRY_COMP(vmsplice)
+ 	ENTRY_COMP(move_pages)		/* 295 */
+ 	ENTRY_SAME(getcpu)
+-	ENTRY_SAME(epoll_pwait)
++	ENTRY_COMP(epoll_pwait)
+ 	ENTRY_COMP(statfs64)
+ 	ENTRY_COMP(fstatfs64)
+ 	ENTRY_COMP(kexec_load)		/* 300 */
+diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
+index b3f0f5a..2b662725 100644
+--- a/drivers/ata/libata-core.c
++++ b/drivers/ata/libata-core.c
+@@ -4718,21 +4718,26 @@ void swap_buf_le16(u16 *buf, unsigned int buf_words)
+ static struct ata_queued_cmd *ata_qc_new(struct ata_port *ap)
+ {
+ 	struct ata_queued_cmd *qc = NULL;
+-	unsigned int i;
++	unsigned int i, tag;
+ 
+ 	/* no command while frozen */
+ 	if (unlikely(ap->pflags & ATA_PFLAG_FROZEN))
+ 		return NULL;
+ 
+-	/* the last tag is reserved for internal command. */
+-	for (i = 0; i < ATA_MAX_QUEUE - 1; i++)
+-		if (!test_and_set_bit(i, &ap->qc_allocated)) {
+-			qc = __ata_qc_from_tag(ap, i);
++	for (i = 0; i < ATA_MAX_QUEUE; i++) {
++		tag = (i + ap->last_tag + 1) % ATA_MAX_QUEUE;
++
++		/* the last tag is reserved for internal command. */
++		if (tag == ATA_TAG_INTERNAL)
++			continue;
++
++		if (!test_and_set_bit(tag, &ap->qc_allocated)) {
++			qc = __ata_qc_from_tag(ap, tag);
++			qc->tag = tag;
++			ap->last_tag = tag;
+ 			break;
+ 		}
+-
+-	if (qc)
+-		qc->tag = i;
++	}
+ 
+ 	return qc;
+ }
+diff --git a/drivers/block/floppy.c b/drivers/block/floppy.c
+index 7a90d4a..6d0f3e1 100644
+--- a/drivers/block/floppy.c
++++ b/drivers/block/floppy.c
+@@ -3060,7 +3060,10 @@ static int raw_cmd_copyout(int cmd, void __user *param,
+ 	int ret;
+ 
+ 	while (ptr) {
+-		ret = copy_to_user(param, ptr, sizeof(*ptr));
++		struct floppy_raw_cmd cmd = *ptr;
++		cmd.next = NULL;
++		cmd.kernel_data = NULL;
++		ret = copy_to_user(param, &cmd, sizeof(cmd));
+ 		if (ret)
+ 			return -EFAULT;
+ 		param += sizeof(struct floppy_raw_cmd);
+@@ -3114,10 +3117,11 @@ loop:
+ 		return -ENOMEM;
+ 	*rcmd = ptr;
+ 	ret = copy_from_user(ptr, param, sizeof(*ptr));
+-	if (ret)
+-		return -EFAULT;
+ 	ptr->next = NULL;
+ 	ptr->buffer_length = 0;
++	ptr->kernel_data = NULL;
++	if (ret)
++		return -EFAULT;
+ 	param += sizeof(struct floppy_raw_cmd);
+ 	if (ptr->cmd_count > 33)
+ 			/* the command may now also take up the space
+@@ -3133,7 +3137,6 @@ loop:
+ 	for (i = 0; i < 16; i++)
+ 		ptr->reply[i] = 0;
+ 	ptr->resultcode = 0;
+-	ptr->kernel_data = NULL;
+ 
+ 	if (ptr->flags & (FD_RAW_READ | FD_RAW_WRITE)) {
+ 		if (ptr->length <= 0)
+diff --git a/drivers/firmware/dmi_scan.c b/drivers/firmware/dmi_scan.c
+index 4cd392d..2861ef4 100644
+--- a/drivers/firmware/dmi_scan.c
++++ b/drivers/firmware/dmi_scan.c
+@@ -534,9 +534,15 @@ static bool dmi_matches(const struct dmi_system_id *dmi)
+ 		int s = dmi->matches[i].slot;
+ 		if (s == DMI_NONE)
+ 			break;
+-		if (dmi_ident[s]
+-		    && strstr(dmi_ident[s], dmi->matches[i].substr))
+-			continue;
++		if (dmi_ident[s]) {
++			if (!dmi->matches[i].exact_match &&
++			    strstr(dmi_ident[s], dmi->matches[i].substr))
++				continue;
++			else if (dmi->matches[i].exact_match &&
++				 !strcmp(dmi_ident[s], dmi->matches[i].substr))
++				continue;
++		}
++
+ 		/* No match */
+ 		return false;
+ 	}
+diff --git a/drivers/input/mouse/synaptics.c b/drivers/input/mouse/synaptics.c
+index bc35070..886c191 100644
+--- a/drivers/input/mouse/synaptics.c
++++ b/drivers/input/mouse/synaptics.c
+@@ -1394,6 +1394,14 @@ static const struct dmi_system_id min_max_dmi_table[] __initconst = {
+ 		.driver_data = (int []){1232, 5710, 1156, 4696},
+ 	},
+ 	{
++		/* Lenovo ThinkPad T431s */
++		.matches = {
++			DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
++			DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad T431"),
++		},
++		.driver_data = (int []){1024, 5112, 2024, 4832},
++	},
++	{
+ 		/* Lenovo ThinkPad T440s */
+ 		.matches = {
+ 			DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
+@@ -1402,6 +1410,14 @@ static const struct dmi_system_id min_max_dmi_table[] __initconst = {
+ 		.driver_data = (int []){1024, 5112, 2024, 4832},
+ 	},
+ 	{
++		/* Lenovo ThinkPad L440 */
++		.matches = {
++			DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
++			DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad L440"),
++		},
++		.driver_data = (int []){1024, 5112, 2024, 4832},
++	},
++	{
+ 		/* Lenovo ThinkPad T540p */
+ 		.matches = {
+ 			DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
+@@ -1409,6 +1425,32 @@ static const struct dmi_system_id min_max_dmi_table[] __initconst = {
+ 		},
+ 		.driver_data = (int []){1024, 5056, 2058, 4832},
+ 	},
++	{
++		/* Lenovo ThinkPad L540 */
++		.matches = {
++			DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
++			DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad L540"),
++		},
++		.driver_data = (int []){1024, 5112, 2024, 4832},
++	},
++	{
++		/* Lenovo Yoga S1 */
++		.matches = {
++			DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
++			DMI_EXACT_MATCH(DMI_PRODUCT_VERSION,
++					"ThinkPad S1 Yoga"),
++		},
++		.driver_data = (int []){1232, 5710, 1156, 4696},
++	},
++	{
++		/* Lenovo ThinkPad X1 Carbon Haswell (3rd generation) */
++		.matches = {
++			DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
++			DMI_MATCH(DMI_PRODUCT_VERSION,
++					"ThinkPad X1 Carbon 2nd"),
++		},
++		.driver_data = (int []){1024, 5112, 2024, 4832},
++	},
+ #endif
+ 	{ }
+ };
+diff --git a/drivers/net/ethernet/mellanox/mlx4/en_cq.c b/drivers/net/ethernet/mellanox/mlx4/en_cq.c
+index 5829e0b..ba7c861 100644
+--- a/drivers/net/ethernet/mellanox/mlx4/en_cq.c
++++ b/drivers/net/ethernet/mellanox/mlx4/en_cq.c
+@@ -58,7 +58,6 @@ int mlx4_en_create_cq(struct mlx4_en_priv *priv,
+ 
+ 	cq->ring = ring;
+ 	cq->is_tx = mode;
+-	spin_lock_init(&cq->lock);
+ 
+ 	err = mlx4_alloc_hwq_res(mdev->dev, &cq->wqres,
+ 				cq->buf_size, 2 * PAGE_SIZE);
+diff --git a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
+index 78d776b..308349a 100644
+--- a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
++++ b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
+@@ -355,15 +355,11 @@ static void mlx4_en_netpoll(struct net_device *dev)
+ {
+ 	struct mlx4_en_priv *priv = netdev_priv(dev);
+ 	struct mlx4_en_cq *cq;
+-	unsigned long flags;
+ 	int i;
+ 
+ 	for (i = 0; i < priv->rx_ring_num; i++) {
+ 		cq = &priv->rx_cq[i];
+-		spin_lock_irqsave(&cq->lock, flags);
+-		napi_synchronize(&cq->napi);
+-		mlx4_en_process_rx_cq(dev, cq, 0);
+-		spin_unlock_irqrestore(&cq->lock, flags);
++		napi_schedule(&cq->napi);
+ 	}
+ }
+ #endif
+diff --git a/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h b/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h
+index 207b5ad..4920558 100644
+--- a/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h
++++ b/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h
+@@ -300,7 +300,6 @@ struct mlx4_en_cq {
+ 	struct mlx4_cq          mcq;
+ 	struct mlx4_hwq_resources wqres;
+ 	int                     ring;
+-	spinlock_t              lock;
+ 	struct net_device      *dev;
+ 	struct napi_struct	napi;
+ 	/* Per-core Tx cq processing support */
+diff --git a/drivers/net/wireless/rtlwifi/rtl8192c/dm_common.c b/drivers/net/wireless/rtlwifi/rtl8192c/dm_common.c
+index a004ad7..ba7ef2f 100644
+--- a/drivers/net/wireless/rtlwifi/rtl8192c/dm_common.c
++++ b/drivers/net/wireless/rtlwifi/rtl8192c/dm_common.c
+@@ -1228,11 +1228,14 @@ static void rtl92c_dm_refresh_rate_adaptive_mask(struct ieee80211_hw *hw)
+ 			if (rtlhal->interface == INTF_PCI) {
+ 				rcu_read_lock();
+ 				sta = ieee80211_find_sta(mac->vif, mac->bssid);
++				if (!sta)
++					goto out_unlock;
+ 			}
+ 			rtlpriv->cfg->ops->update_rate_tbl(hw, sta,
+ 					p_ra->ratr_state);
+ 
+ 			p_ra->pre_ratr_state = p_ra->ratr_state;
++		out_unlock:
+ 			if (rtlhal->interface == INTF_PCI)
+ 				rcu_read_unlock();
+ 		}
+diff --git a/drivers/staging/rtl8712/rtl871x_recv.c b/drivers/staging/rtl8712/rtl871x_recv.c
+index 7069f06..4cc68d1 100644
+--- a/drivers/staging/rtl8712/rtl871x_recv.c
++++ b/drivers/staging/rtl8712/rtl871x_recv.c
+@@ -254,7 +254,7 @@ union recv_frame *r8712_portctrl(struct _adapter *adapter,
+ 	struct sta_info *psta;
+ 	struct	sta_priv *pstapriv;
+ 	union recv_frame *prtnframe;
+-	u16 ether_type = 0;
++	u16 ether_type;
+ 
+ 	pstapriv = &adapter->stapriv;
+ 	ptr = get_recvframe_data(precv_frame);
+@@ -263,15 +263,14 @@ union recv_frame *r8712_portctrl(struct _adapter *adapter,
+ 	psta = r8712_get_stainfo(pstapriv, psta_addr);
+ 	auth_alg = adapter->securitypriv.AuthAlgrthm;
+ 	if (auth_alg == 2) {
++		/* get ether_type */
++		ptr = ptr + pfhdr->attrib.hdrlen + LLC_HEADER_SIZE;
++		memcpy(&ether_type, ptr, 2);
++		ether_type = ntohs((unsigned short)ether_type);
++
+ 		if ((psta != NULL) && (psta->ieee8021x_blocked)) {
+ 			/* blocked
+ 			 * only accept EAPOL frame */
+-			prtnframe = precv_frame;
+-			/*get ether_type */
+-			ptr = ptr + pfhdr->attrib.hdrlen +
+-			      pfhdr->attrib.iv_len + LLC_HEADER_SIZE;
+-			memcpy(&ether_type, ptr, 2);
+-			ether_type = ntohs((unsigned short)ether_type);
+ 			if (ether_type == 0x888e)
+ 				prtnframe = precv_frame;
+ 			else {
+diff --git a/drivers/tty/n_tty.c b/drivers/tty/n_tty.c
+index 0f8a785..bac83d8 100644
+--- a/drivers/tty/n_tty.c
++++ b/drivers/tty/n_tty.c
+@@ -1997,7 +1997,9 @@ static ssize_t n_tty_write(struct tty_struct *tty, struct file *file,
+ 				tty->ops->flush_chars(tty);
+ 		} else {
+ 			while (nr > 0) {
++				mutex_lock(&tty->output_lock);
+ 				c = tty->ops->write(tty, b, nr);
++				mutex_unlock(&tty->output_lock);
+ 				if (c < 0) {
+ 					retval = c;
+ 					goto break_out;
+diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
+index 636ee9e..320db2a 100644
+--- a/drivers/usb/class/cdc-acm.c
++++ b/drivers/usb/class/cdc-acm.c
+@@ -1493,13 +1493,27 @@ static const struct usb_device_id acm_ids[] = {
+ 	},
+ 	/* Motorola H24 HSPA module: */
+ 	{ USB_DEVICE(0x22b8, 0x2d91) }, /* modem                                */
+-	{ USB_DEVICE(0x22b8, 0x2d92) }, /* modem           + diagnostics        */
+-	{ USB_DEVICE(0x22b8, 0x2d93) }, /* modem + AT port                      */
+-	{ USB_DEVICE(0x22b8, 0x2d95) }, /* modem + AT port + diagnostics        */
+-	{ USB_DEVICE(0x22b8, 0x2d96) }, /* modem                         + NMEA */
+-	{ USB_DEVICE(0x22b8, 0x2d97) }, /* modem           + diagnostics + NMEA */
+-	{ USB_DEVICE(0x22b8, 0x2d99) }, /* modem + AT port               + NMEA */
+-	{ USB_DEVICE(0x22b8, 0x2d9a) }, /* modem + AT port + diagnostics + NMEA */
++	{ USB_DEVICE(0x22b8, 0x2d92),   /* modem           + diagnostics        */
++	.driver_info = NO_UNION_NORMAL, /* handle only modem interface          */
++	},
++	{ USB_DEVICE(0x22b8, 0x2d93),   /* modem + AT port                      */
++	.driver_info = NO_UNION_NORMAL, /* handle only modem interface          */
++	},
++	{ USB_DEVICE(0x22b8, 0x2d95),   /* modem + AT port + diagnostics        */
++	.driver_info = NO_UNION_NORMAL, /* handle only modem interface          */
++	},
++	{ USB_DEVICE(0x22b8, 0x2d96),   /* modem                         + NMEA */
++	.driver_info = NO_UNION_NORMAL, /* handle only modem interface          */
++	},
++	{ USB_DEVICE(0x22b8, 0x2d97),   /* modem           + diagnostics + NMEA */
++	.driver_info = NO_UNION_NORMAL, /* handle only modem interface          */
++	},
++	{ USB_DEVICE(0x22b8, 0x2d99),   /* modem + AT port               + NMEA */
++	.driver_info = NO_UNION_NORMAL, /* handle only modem interface          */
++	},
++	{ USB_DEVICE(0x22b8, 0x2d9a),   /* modem + AT port + diagnostics + NMEA */
++	.driver_info = NO_UNION_NORMAL, /* handle only modem interface          */
++	},
+ 
+ 	{ USB_DEVICE(0x0572, 0x1329), /* Hummingbird huc56s (Conexant) */
+ 	.driver_info = NO_UNION_NORMAL, /* union descriptor misplaced on
+diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
+index 2b4f42b..1886544 100644
+--- a/drivers/usb/host/xhci-ring.c
++++ b/drivers/usb/host/xhci-ring.c
+@@ -570,10 +570,11 @@ void xhci_find_new_dequeue_state(struct xhci_hcd *xhci,
+ 		struct xhci_dequeue_state *state)
+ {
+ 	struct xhci_virt_device *dev = xhci->devs[slot_id];
++	struct xhci_virt_ep *ep = &dev->eps[ep_index];
+ 	struct xhci_ring *ep_ring;
+ 	struct xhci_generic_trb *trb;
+-	struct xhci_ep_ctx *ep_ctx;
+ 	dma_addr_t addr;
++	u64 hw_dequeue;
+ 
+ 	ep_ring = xhci_triad_to_transfer_ring(xhci, slot_id,
+ 			ep_index, stream_id);
+@@ -583,52 +584,62 @@ void xhci_find_new_dequeue_state(struct xhci_hcd *xhci,
+ 				stream_id);
+ 		return;
+ 	}
+-	state->new_cycle_state = 0;
+-	xhci_dbg(xhci, "Finding segment containing stopped TRB.\n");
+-	state->new_deq_seg = find_trb_seg(cur_td->start_seg,
+-			dev->eps[ep_index].stopped_trb,
+-			&state->new_cycle_state);
+-	if (!state->new_deq_seg) {
+-		WARN_ON(1);
+-		return;
+-	}
+ 
+ 	/* Dig out the cycle state saved by the xHC during the stop ep cmd */
+ 	xhci_dbg(xhci, "Finding endpoint context\n");
+-	ep_ctx = xhci_get_ep_ctx(xhci, dev->out_ctx, ep_index);
+-	state->new_cycle_state = 0x1 & le64_to_cpu(ep_ctx->deq);
++	/* 4.6.9 the css flag is written to the stream context for streams */
++	if (ep->ep_state & EP_HAS_STREAMS) {
++		struct xhci_stream_ctx *ctx =
++			&ep->stream_info->stream_ctx_array[stream_id];
++		hw_dequeue = le64_to_cpu(ctx->stream_ring);
++	} else {
++		struct xhci_ep_ctx *ep_ctx
++			= xhci_get_ep_ctx(xhci, dev->out_ctx, ep_index);
++		hw_dequeue = le64_to_cpu(ep_ctx->deq);
++	}
++
++	/* Find virtual address and segment of hardware dequeue pointer */
++	state->new_deq_seg = ep_ring->deq_seg;
++	state->new_deq_ptr = ep_ring->dequeue;
++	while (xhci_trb_virt_to_dma(state->new_deq_seg, state->new_deq_ptr)
++			!= (dma_addr_t)(hw_dequeue & ~0xf)) {
++		next_trb(xhci, ep_ring, &state->new_deq_seg,
++					&state->new_deq_ptr);
++		if (state->new_deq_ptr == ep_ring->dequeue) {
++			WARN_ON(1);
++			return;
++		}
++	}
++	/*
++	 * Find cycle state for last_trb, starting at old cycle state of
++	 * hw_dequeue. If there is only one segment ring, find_trb_seg() will
++	 * return immediately and cannot toggle the cycle state if this search
++	 * wraps around, so add one more toggle manually in that case.
++	 */
++	state->new_cycle_state = hw_dequeue & 0x1;
++	if (ep_ring->first_seg == ep_ring->first_seg->next &&
++			cur_td->last_trb < state->new_deq_ptr)
++		state->new_cycle_state ^= 0x1;
+ 
+ 	state->new_deq_ptr = cur_td->last_trb;
+ 	xhci_dbg(xhci, "Finding segment containing last TRB in TD.\n");
+ 	state->new_deq_seg = find_trb_seg(state->new_deq_seg,
+-			state->new_deq_ptr,
+-			&state->new_cycle_state);
++			state->new_deq_ptr, &state->new_cycle_state);
+ 	if (!state->new_deq_seg) {
+ 		WARN_ON(1);
+ 		return;
+ 	}
+ 
++	/* Increment to find next TRB after last_trb. Cycle if appropriate. */
+ 	trb = &state->new_deq_ptr->generic;
+ 	if (TRB_TYPE_LINK_LE32(trb->field[3]) &&
+ 	    (trb->field[3] & cpu_to_le32(LINK_TOGGLE)))
+ 		state->new_cycle_state ^= 0x1;
+ 	next_trb(xhci, ep_ring, &state->new_deq_seg, &state->new_deq_ptr);
+ 
+-	/*
+-	 * If there is only one segment in a ring, find_trb_seg()'s while loop
+-	 * will not run, and it will return before it has a chance to see if it
+-	 * needs to toggle the cycle bit.  It can't tell if the stalled transfer
+-	 * ended just before the link TRB on a one-segment ring, or if the TD
+-	 * wrapped around the top of the ring, because it doesn't have the TD in
+-	 * question.  Look for the one-segment case where stalled TRB's address
+-	 * is greater than the new dequeue pointer address.
+-	 */
+-	if (ep_ring->first_seg == ep_ring->first_seg->next &&
+-			state->new_deq_ptr < dev->eps[ep_index].stopped_trb)
+-		state->new_cycle_state ^= 0x1;
++	/* Don't update the ring cycle state for the producer (us). */
+ 	xhci_dbg(xhci, "Cycle state = 0x%x\n", state->new_cycle_state);
+ 
+-	/* Don't update the ring cycle state for the producer (us). */
+ 	xhci_dbg(xhci, "New dequeue segment = %p (virtual)\n",
+ 			state->new_deq_seg);
+ 	addr = xhci_trb_virt_to_dma(state->new_deq_seg, state->new_deq_ptr);
+@@ -813,7 +824,6 @@ static void handle_stopped_endpoint(struct xhci_hcd *xhci,
+ 	if (list_empty(&ep->cancelled_td_list)) {
+ 		xhci_stop_watchdog_timer_in_irq(xhci, ep);
+ 		ep->stopped_td = NULL;
+-		ep->stopped_trb = NULL;
+ 		ring_doorbell_for_active_rings(xhci, slot_id, ep_index);
+ 		return;
+ 	}
+@@ -880,11 +890,9 @@ remove_finished_td:
+ 		ring_doorbell_for_active_rings(xhci, slot_id, ep_index);
+ 	}
+ 
+-	/* Clear stopped_td and stopped_trb if endpoint is not halted */
+-	if (!(ep->ep_state & EP_HALTED)) {
++	/* Clear stopped_td if endpoint is not halted */
++	if (!(ep->ep_state & EP_HALTED))
+ 		ep->stopped_td = NULL;
+-		ep->stopped_trb = NULL;
+-	}
+ 
+ 	/*
+ 	 * Drop the lock and complete the URBs in the cancelled TD list.
+@@ -1744,14 +1752,12 @@ static void xhci_cleanup_halted_endpoint(struct xhci_hcd *xhci,
+ 	struct xhci_virt_ep *ep = &xhci->devs[slot_id]->eps[ep_index];
+ 	ep->ep_state |= EP_HALTED;
+ 	ep->stopped_td = td;
+-	ep->stopped_trb = event_trb;
+ 	ep->stopped_stream = stream_id;
+ 
+ 	xhci_queue_reset_ep(xhci, slot_id, ep_index);
+ 	xhci_cleanup_stalled_ring(xhci, td->urb->dev, ep_index);
+ 
+ 	ep->stopped_td = NULL;
+-	ep->stopped_trb = NULL;
+ 	ep->stopped_stream = 0;
+ 
+ 	xhci_ring_cmd_db(xhci);
+@@ -1833,7 +1839,6 @@ static int finish_td(struct xhci_hcd *xhci, struct xhci_td *td,
+ 		 * the ring dequeue pointer or take this TD off any lists yet.
+ 		 */
+ 		ep->stopped_td = td;
+-		ep->stopped_trb = event_trb;
+ 		return 0;
+ 	} else {
+ 		if (trb_comp_code == COMP_STALL) {
+@@ -1845,7 +1850,6 @@ static int finish_td(struct xhci_hcd *xhci, struct xhci_td *td,
+ 			 * USB class driver clear the stall later.
+ 			 */
+ 			ep->stopped_td = td;
+-			ep->stopped_trb = event_trb;
+ 			ep->stopped_stream = ep_ring->stream_id;
+ 		} else if (xhci_requires_manual_halt_cleanup(xhci,
+ 					ep_ctx, trb_comp_code)) {
+diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
+index 03c35da..b2eac8d 100644
+--- a/drivers/usb/host/xhci.c
++++ b/drivers/usb/host/xhci.c
+@@ -378,16 +378,16 @@ static int xhci_try_enable_msi(struct usb_hcd *hcd)
+ 
+ #else
+ 
+-static int xhci_try_enable_msi(struct usb_hcd *hcd)
++static inline int xhci_try_enable_msi(struct usb_hcd *hcd)
+ {
+ 	return 0;
+ }
+ 
+-static void xhci_cleanup_msix(struct xhci_hcd *xhci)
++static inline void xhci_cleanup_msix(struct xhci_hcd *xhci)
+ {
+ }
+ 
+-static void xhci_msix_sync_irqs(struct xhci_hcd *xhci)
++static inline void xhci_msix_sync_irqs(struct xhci_hcd *xhci)
+ {
+ }
+ 
+@@ -2884,7 +2884,6 @@ void xhci_endpoint_reset(struct usb_hcd *hcd,
+ 		xhci_ring_cmd_db(xhci);
+ 	}
+ 	virt_ep->stopped_td = NULL;
+-	virt_ep->stopped_trb = NULL;
+ 	virt_ep->stopped_stream = 0;
+ 	spin_unlock_irqrestore(&xhci->lock, flags);
+ 
+diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h
+index cf4fd24..1bc91c8 100644
+--- a/drivers/usb/host/xhci.h
++++ b/drivers/usb/host/xhci.h
+@@ -835,8 +835,6 @@ struct xhci_virt_ep {
+ #define EP_GETTING_NO_STREAMS	(1 << 5)
+ 	/* ----  Related to URB cancellation ---- */
+ 	struct list_head	cancelled_td_list;
+-	/* The TRB that was last reported in a stopped endpoint ring */
+-	union xhci_trb		*stopped_trb;
+ 	struct xhci_td		*stopped_td;
+ 	unsigned int		stopped_stream;
+ 	/* Watchdog timer for stop endpoint command to cancel URBs */
+diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c
+index c408ff7..01fd64a 100644
+--- a/drivers/usb/serial/cp210x.c
++++ b/drivers/usb/serial/cp210x.c
+@@ -110,6 +110,7 @@ static const struct usb_device_id id_table[] = {
+ 	{ USB_DEVICE(0x10C4, 0x8218) }, /* Lipowsky Industrie Elektronik GmbH, HARP-1 */
+ 	{ USB_DEVICE(0x10C4, 0x822B) }, /* Modem EDGE(GSM) Comander 2 */
+ 	{ USB_DEVICE(0x10C4, 0x826B) }, /* Cygnal Integrated Products, Inc., Fasttrax GPS demonstration module */
++	{ USB_DEVICE(0x10C4, 0x8281) }, /* Nanotec Plug & Drive */
+ 	{ USB_DEVICE(0x10C4, 0x8293) }, /* Telegesis ETRX2USB */
+ 	{ USB_DEVICE(0x10C4, 0x82F9) }, /* Procyon AVS */
+ 	{ USB_DEVICE(0x10C4, 0x8341) }, /* Siemens MC35PU GPRS Modem */
+diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
+index 5c97d9f..332f04d 100644
+--- a/drivers/usb/serial/ftdi_sio.c
++++ b/drivers/usb/serial/ftdi_sio.c
+@@ -920,6 +920,39 @@ static struct usb_device_id id_table_combined [] = {
+ 	{ USB_DEVICE(FTDI_VID, FTDI_Z3X_PID) },
+ 	/* Cressi Devices */
+ 	{ USB_DEVICE(FTDI_VID, FTDI_CRESSI_PID) },
++	/* Brainboxes Devices */
++	{ USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_VX_001_PID) },
++	{ USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_VX_012_PID) },
++	{ USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_VX_023_PID) },
++	{ USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_VX_034_PID) },
++	{ USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_101_PID) },
++	{ USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_160_1_PID) },
++	{ USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_160_2_PID) },
++	{ USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_160_3_PID) },
++	{ USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_160_4_PID) },
++	{ USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_160_5_PID) },
++	{ USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_160_6_PID) },
++	{ USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_160_7_PID) },
++	{ USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_160_8_PID) },
++	{ USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_257_PID) },
++	{ USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_279_1_PID) },
++	{ USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_279_2_PID) },
++	{ USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_279_3_PID) },
++	{ USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_279_4_PID) },
++	{ USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_313_PID) },
++	{ USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_324_PID) },
++	{ USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_346_1_PID) },
++	{ USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_346_2_PID) },
++	{ USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_357_PID) },
++	{ USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_606_1_PID) },
++	{ USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_606_2_PID) },
++	{ USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_606_3_PID) },
++	{ USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_701_1_PID) },
++	{ USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_701_2_PID) },
++	{ USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_842_1_PID) },
++	{ USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_842_2_PID) },
++	{ USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_842_3_PID) },
++	{ USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_842_4_PID) },
+ 	{ },					/* Optional parameter entry */
+ 	{ }					/* Terminating entry */
+ };
+diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h
+index 71fe2de..83a440f 100644
+--- a/drivers/usb/serial/ftdi_sio_ids.h
++++ b/drivers/usb/serial/ftdi_sio_ids.h
+@@ -1326,3 +1326,40 @@
+  * Manufacturer: Cressi
+  */
+ #define FTDI_CRESSI_PID		0x87d0
++
++/*
++ * Brainboxes devices
++ */
++#define BRAINBOXES_VID			0x05d1
++#define BRAINBOXES_VX_001_PID		0x1001 /* VX-001 ExpressCard 1 Port RS232 */
++#define BRAINBOXES_VX_012_PID		0x1002 /* VX-012 ExpressCard 2 Port RS232 */
++#define BRAINBOXES_VX_023_PID		0x1003 /* VX-023 ExpressCard 1 Port RS422/485 */
++#define BRAINBOXES_VX_034_PID		0x1004 /* VX-034 ExpressCard 2 Port RS422/485 */
++#define BRAINBOXES_US_101_PID		0x1011 /* US-101 1xRS232 */
++#define BRAINBOXES_US_324_PID		0x1013 /* US-324 1xRS422/485 1Mbaud */
++#define BRAINBOXES_US_606_1_PID		0x2001 /* US-606 6 Port RS232 Serial Port 1 and 2 */
++#define BRAINBOXES_US_606_2_PID		0x2002 /* US-606 6 Port RS232 Serial Port 3 and 4 */
++#define BRAINBOXES_US_606_3_PID		0x2003 /* US-606 6 Port RS232 Serial Port 4 and 6 */
++#define BRAINBOXES_US_701_1_PID		0x2011 /* US-701 4xRS232 1Mbaud Port 1 and 2 */
++#define BRAINBOXES_US_701_2_PID		0x2012 /* US-701 4xRS422 1Mbaud Port 3 and 4 */
++#define BRAINBOXES_US_279_1_PID		0x2021 /* US-279 8xRS422 1Mbaud Port 1 and 2 */
++#define BRAINBOXES_US_279_2_PID		0x2022 /* US-279 8xRS422 1Mbaud Port 3 and 4 */
++#define BRAINBOXES_US_279_3_PID		0x2023 /* US-279 8xRS422 1Mbaud Port 5 and 6 */
++#define BRAINBOXES_US_279_4_PID		0x2024 /* US-279 8xRS422 1Mbaud Port 7 and 8 */
++#define BRAINBOXES_US_346_1_PID		0x3011 /* US-346 4xRS422/485 1Mbaud Port 1 and 2 */
++#define BRAINBOXES_US_346_2_PID		0x3012 /* US-346 4xRS422/485 1Mbaud Port 3 and 4 */
++#define BRAINBOXES_US_257_PID		0x5001 /* US-257 2xRS232 1Mbaud */
++#define BRAINBOXES_US_313_PID		0x6001 /* US-313 2xRS422/485 1Mbaud */
++#define BRAINBOXES_US_357_PID		0x7001 /* US_357 1xRS232/422/485 */
++#define BRAINBOXES_US_842_1_PID		0x8001 /* US-842 8xRS422/485 1Mbaud Port 1 and 2 */
++#define BRAINBOXES_US_842_2_PID		0x8002 /* US-842 8xRS422/485 1Mbaud Port 3 and 4 */
++#define BRAINBOXES_US_842_3_PID		0x8003 /* US-842 8xRS422/485 1Mbaud Port 5 and 6 */
++#define BRAINBOXES_US_842_4_PID		0x8004 /* US-842 8xRS422/485 1Mbaud Port 7 and 8 */
++#define BRAINBOXES_US_160_1_PID		0x9001 /* US-160 16xRS232 1Mbaud Port 1 and 2 */
++#define BRAINBOXES_US_160_2_PID		0x9002 /* US-160 16xRS232 1Mbaud Port 3 and 4 */
++#define BRAINBOXES_US_160_3_PID		0x9003 /* US-160 16xRS232 1Mbaud Port 5 and 6 */
++#define BRAINBOXES_US_160_4_PID		0x9004 /* US-160 16xRS232 1Mbaud Port 7 and 8 */
++#define BRAINBOXES_US_160_5_PID		0x9005 /* US-160 16xRS232 1Mbaud Port 9 and 10 */
++#define BRAINBOXES_US_160_6_PID		0x9006 /* US-160 16xRS232 1Mbaud Port 11 and 12 */
++#define BRAINBOXES_US_160_7_PID		0x9007 /* US-160 16xRS232 1Mbaud Port 13 and 14 */
++#define BRAINBOXES_US_160_8_PID		0x9008 /* US-160 16xRS232 1Mbaud Port 15 and 16 */
+diff --git a/drivers/usb/serial/io_ti.c b/drivers/usb/serial/io_ti.c
+index f42119d..c575e0a 100644
+--- a/drivers/usb/serial/io_ti.c
++++ b/drivers/usb/serial/io_ti.c
+@@ -36,6 +36,7 @@
+ #include <linux/spinlock.h>
+ #include <linux/mutex.h>
+ #include <linux/serial.h>
++#include <linux/swab.h>
+ #include <linux/kfifo.h>
+ #include <linux/ioctl.h>
+ #include <linux/firmware.h>
+@@ -306,7 +307,7 @@ static int read_download_mem(struct usb_device *dev, int start_address,
+ {
+ 	int status = 0;
+ 	__u8 read_length;
+-	__be16 be_start_address;
++	u16 be_start_address;
+ 
+ 	dbg("%s - @ %x for %d", __func__, start_address, length);
+ 
+@@ -323,10 +324,14 @@ static int read_download_mem(struct usb_device *dev, int start_address,
+ 			dbg("%s - @ %x for %d", __func__,
+ 			     start_address, read_length);
+ 		}
+-		be_start_address = cpu_to_be16(start_address);
++		/*
++		 * NOTE: Must use swab as wIndex is sent in little-endian
++		 *       byte order regardless of host byte order.
++		 */
++		be_start_address = swab16((u16)start_address);
+ 		status = ti_vread_sync(dev, UMPC_MEMORY_READ,
+ 					(__u16)address_type,
+-					(__force __u16)be_start_address,
++					be_start_address,
+ 					buffer, read_length);
+ 
+ 		if (status) {
+@@ -426,7 +431,7 @@ static int write_i2c_mem(struct edgeport_serial *serial,
+ {
+ 	int status = 0;
+ 	int write_length;
+-	__be16 be_start_address;
++	u16 be_start_address;
+ 
+ 	/* We can only send a maximum of 1 aligned byte page at a time */
+ 
+@@ -442,11 +447,16 @@ static int write_i2c_mem(struct edgeport_serial *serial,
+ 	usb_serial_debug_data(debug, &serial->serial->dev->dev,
+ 						__func__, write_length, buffer);
+ 
+-	/* Write first page */
+-	be_start_address = cpu_to_be16(start_address);
++	/*
++	 * Write first page.
++	 *
++	 * NOTE: Must use swab as wIndex is sent in little-endian byte order
++	 *       regardless of host byte order.
++	 */
++	be_start_address = swab16((u16)start_address);
+ 	status = ti_vsend_sync(serial->serial->dev,
+ 				UMPC_MEMORY_WRITE, (__u16)address_type,
+-				(__force __u16)be_start_address,
++				be_start_address,
+ 				buffer,	write_length);
+ 	if (status) {
+ 		dbg("%s - ERROR %d", __func__, status);
+@@ -470,11 +480,16 @@ static int write_i2c_mem(struct edgeport_serial *serial,
+ 		usb_serial_debug_data(debug, &serial->serial->dev->dev,
+ 					__func__, write_length, buffer);
+ 
+-		/* Write next page */
+-		be_start_address = cpu_to_be16(start_address);
++		/*
++		 * Write next page.
++		 *
++		 * NOTE: Must use swab as wIndex is sent in little-endian byte
++		 *       order regardless of host byte order.
++		 */
++		be_start_address = swab16((u16)start_address);
+ 		status = ti_vsend_sync(serial->serial->dev, UMPC_MEMORY_WRITE,
+ 				(__u16)address_type,
+-				(__force __u16)be_start_address,
++				be_start_address,
+ 				buffer, write_length);
+ 		if (status) {
+ 			dev_err(&serial->serial->dev->dev, "%s - ERROR %d\n",
+@@ -681,8 +696,8 @@ static int get_descriptor_addr(struct edgeport_serial *serial,
+ 		if (rom_desc->Type == desc_type)
+ 			return start_address;
+ 
+-		start_address = start_address + sizeof(struct ti_i2c_desc)
+-							+ rom_desc->Size;
++		start_address = start_address + sizeof(struct ti_i2c_desc) +
++						le16_to_cpu(rom_desc->Size);
+ 
+ 	} while ((start_address < TI_MAX_I2C_SIZE) && rom_desc->Type);
+ 
+@@ -695,7 +710,7 @@ static int valid_csum(struct ti_i2c_desc *rom_desc, __u8 *buffer)
+ 	__u16 i;
+ 	__u8 cs = 0;
+ 
+-	for (i = 0; i < rom_desc->Size; i++)
++	for (i = 0; i < le16_to_cpu(rom_desc->Size); i++)
+ 		cs = (__u8)(cs + buffer[i]);
+ 
+ 	if (cs != rom_desc->CheckSum) {
+@@ -749,7 +764,7 @@ static int check_i2c_image(struct edgeport_serial *serial)
+ 			break;
+ 
+ 		if ((start_address + sizeof(struct ti_i2c_desc) +
+-					rom_desc->Size) > TI_MAX_I2C_SIZE) {
++			le16_to_cpu(rom_desc->Size)) > TI_MAX_I2C_SIZE) {
+ 			status = -ENODEV;
+ 			dbg("%s - structure too big, erroring out.", __func__);
+ 			break;
+@@ -764,7 +779,8 @@ static int check_i2c_image(struct edgeport_serial *serial)
+ 			/* Read the descriptor data */
+ 			status = read_rom(serial, start_address +
+ 						sizeof(struct ti_i2c_desc),
+-						rom_desc->Size, buffer);
++						le16_to_cpu(rom_desc->Size),
++						buffer);
+ 			if (status)
+ 				break;
+ 
+@@ -773,7 +789,7 @@ static int check_i2c_image(struct edgeport_serial *serial)
+ 				break;
+ 		}
+ 		start_address = start_address + sizeof(struct ti_i2c_desc) +
+-								rom_desc->Size;
++						le16_to_cpu(rom_desc->Size);
+ 
+ 	} while ((rom_desc->Type != I2C_DESC_TYPE_ION) &&
+ 				(start_address < TI_MAX_I2C_SIZE));
+@@ -812,7 +828,7 @@ static int get_manuf_info(struct edgeport_serial *serial, __u8 *buffer)
+ 
+ 	/* Read the descriptor data */
+ 	status = read_rom(serial, start_address+sizeof(struct ti_i2c_desc),
+-						rom_desc->Size, buffer);
++					le16_to_cpu(rom_desc->Size), buffer);
+ 	if (status)
+ 		goto exit;
+ 
+diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
+index 5f5047f..9823e79 100644
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -234,8 +234,31 @@ static void option_instat_callback(struct urb *urb);
+ #define QUALCOMM_VENDOR_ID			0x05C6
+ 
+ #define CMOTECH_VENDOR_ID			0x16d8
+-#define CMOTECH_PRODUCT_6008			0x6008
+-#define CMOTECH_PRODUCT_6280			0x6280
++#define CMOTECH_PRODUCT_6001			0x6001
++#define CMOTECH_PRODUCT_CMU_300			0x6002
++#define CMOTECH_PRODUCT_6003			0x6003
++#define CMOTECH_PRODUCT_6004			0x6004
++#define CMOTECH_PRODUCT_6005			0x6005
++#define CMOTECH_PRODUCT_CGU_628A		0x6006
++#define CMOTECH_PRODUCT_CHE_628S		0x6007
++#define CMOTECH_PRODUCT_CMU_301			0x6008
++#define CMOTECH_PRODUCT_CHU_628			0x6280
++#define CMOTECH_PRODUCT_CHU_628S		0x6281
++#define CMOTECH_PRODUCT_CDU_680			0x6803
++#define CMOTECH_PRODUCT_CDU_685A		0x6804
++#define CMOTECH_PRODUCT_CHU_720S		0x7001
++#define CMOTECH_PRODUCT_7002			0x7002
++#define CMOTECH_PRODUCT_CHU_629K		0x7003
++#define CMOTECH_PRODUCT_7004			0x7004
++#define CMOTECH_PRODUCT_7005			0x7005
++#define CMOTECH_PRODUCT_CGU_629			0x7006
++#define CMOTECH_PRODUCT_CHU_629S		0x700a
++#define CMOTECH_PRODUCT_CHU_720I		0x7211
++#define CMOTECH_PRODUCT_7212			0x7212
++#define CMOTECH_PRODUCT_7213			0x7213
++#define CMOTECH_PRODUCT_7251			0x7251
++#define CMOTECH_PRODUCT_7252			0x7252
++#define CMOTECH_PRODUCT_7253			0x7253
+ 
+ #define TELIT_VENDOR_ID				0x1bc7
+ #define TELIT_PRODUCT_UC864E			0x1003
+@@ -243,6 +266,7 @@ static void option_instat_callback(struct urb *urb);
+ #define TELIT_PRODUCT_CC864_DUAL		0x1005
+ #define TELIT_PRODUCT_CC864_SINGLE		0x1006
+ #define TELIT_PRODUCT_DE910_DUAL		0x1010
++#define TELIT_PRODUCT_UE910_V2			0x1012
+ #define TELIT_PRODUCT_LE920			0x1200
+ 
+ /* ZTE PRODUCTS */
+@@ -291,6 +315,7 @@ static void option_instat_callback(struct urb *urb);
+ #define ALCATEL_PRODUCT_X060S_X200		0x0000
+ #define ALCATEL_PRODUCT_X220_X500D		0x0017
+ #define ALCATEL_PRODUCT_L100V			0x011e
++#define ALCATEL_PRODUCT_L800MA			0x0203
+ 
+ #define PIRELLI_VENDOR_ID			0x1266
+ #define PIRELLI_PRODUCT_C100_1			0x1002
+@@ -353,6 +378,7 @@ static void option_instat_callback(struct urb *urb);
+ #define OLIVETTI_PRODUCT_OLICARD100		0xc000
+ #define OLIVETTI_PRODUCT_OLICARD145		0xc003
+ #define OLIVETTI_PRODUCT_OLICARD200		0xc005
++#define OLIVETTI_PRODUCT_OLICARD500		0xc00b
+ 
+ /* Celot products */
+ #define CELOT_VENDOR_ID				0x211f
+@@ -514,6 +540,10 @@ static const struct option_blacklist_info huawei_cdc12_blacklist = {
+ 	.reserved = BIT(1) | BIT(2),
+ };
+ 
++static const struct option_blacklist_info net_intf0_blacklist = {
++	.reserved = BIT(0),
++};
++
+ static const struct option_blacklist_info net_intf1_blacklist = {
+ 	.reserved = BIT(1),
+ };
+@@ -1048,13 +1078,53 @@ static const struct usb_device_id option_ids[] = {
+ 	{ USB_DEVICE(QUALCOMM_VENDOR_ID, 0x6613)}, /* Onda H600/ZTE MF330 */
+ 	{ USB_DEVICE(QUALCOMM_VENDOR_ID, 0x0023)}, /* ONYX 3G device */
+ 	{ USB_DEVICE(QUALCOMM_VENDOR_ID, 0x9000)}, /* SIMCom SIM5218 */
+-	{ USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_6280) }, /* BP3-USB & BP3-EXT HSDPA */
+-	{ USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_6008) },
++	{ USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_6001) },
++	{ USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_CMU_300) },
++	{ USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_6003),
++	  .driver_info = (kernel_ulong_t)&net_intf0_blacklist },
++	{ USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_6004) },
++	{ USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_6005) },
++	{ USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_CGU_628A) },
++	{ USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_CHE_628S),
++	  .driver_info = (kernel_ulong_t)&net_intf0_blacklist },
++	{ USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_CMU_301),
++	  .driver_info = (kernel_ulong_t)&net_intf0_blacklist },
++	{ USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_CHU_628),
++	  .driver_info = (kernel_ulong_t)&net_intf0_blacklist },
++	{ USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_CHU_628S) },
++	{ USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_CDU_680) },
++	{ USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_CDU_685A) },
++	{ USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_CHU_720S),
++	  .driver_info = (kernel_ulong_t)&net_intf0_blacklist },
++	{ USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_7002),
++	  .driver_info = (kernel_ulong_t)&net_intf0_blacklist },
++	{ USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_CHU_629K),
++	  .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
++	{ USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_7004),
++	  .driver_info = (kernel_ulong_t)&net_intf3_blacklist },
++	{ USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_7005) },
++	{ USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_CGU_629),
++	  .driver_info = (kernel_ulong_t)&net_intf5_blacklist },
++	{ USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_CHU_629S),
++	  .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
++	{ USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_CHU_720I),
++	  .driver_info = (kernel_ulong_t)&net_intf0_blacklist },
++	{ USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_7212),
++	  .driver_info = (kernel_ulong_t)&net_intf0_blacklist },
++	{ USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_7213),
++	  .driver_info = (kernel_ulong_t)&net_intf0_blacklist },
++	{ USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_7251),
++	  .driver_info = (kernel_ulong_t)&net_intf1_blacklist },
++	{ USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_7252),
++	  .driver_info = (kernel_ulong_t)&net_intf1_blacklist },
++	{ USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_7253),
++	  .driver_info = (kernel_ulong_t)&net_intf1_blacklist },
+ 	{ USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_UC864E) },
+ 	{ USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_UC864G) },
+ 	{ USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_CC864_DUAL) },
+ 	{ USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_CC864_SINGLE) },
+ 	{ USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_DE910_DUAL) },
++	{ USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_UE910_V2) },
+ 	{ USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE920),
+ 		.driver_info = (kernel_ulong_t)&telit_le920_blacklist },
+ 	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_MF622, 0xff, 0xff, 0xff) }, /* ZTE WCDMA products */
+@@ -1518,6 +1588,8 @@ static const struct usb_device_id option_ids[] = {
+ 	  .driver_info = (kernel_ulong_t)&net_intf5_blacklist },
+ 	{ USB_DEVICE(ALCATEL_VENDOR_ID, ALCATEL_PRODUCT_L100V),
+ 	  .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
++	{ USB_DEVICE(ALCATEL_VENDOR_ID, ALCATEL_PRODUCT_L800MA),
++	  .driver_info = (kernel_ulong_t)&net_intf2_blacklist },
+ 	{ USB_DEVICE(AIRPLUS_VENDOR_ID, AIRPLUS_PRODUCT_MCD650) },
+ 	{ USB_DEVICE(TLAYTECH_VENDOR_ID, TLAYTECH_PRODUCT_TEU800) },
+ 	{ USB_DEVICE(LONGCHEER_VENDOR_ID, FOUR_G_SYSTEMS_PRODUCT_W14),
+@@ -1563,6 +1635,9 @@ static const struct usb_device_id option_ids[] = {
+ 	{ USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD200),
+ 		.driver_info = (kernel_ulong_t)&net_intf6_blacklist
+ 	},
++	{ USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD500),
++		.driver_info = (kernel_ulong_t)&net_intf4_blacklist
++	},
+ 	{ USB_DEVICE(CELOT_VENDOR_ID, CELOT_PRODUCT_CT680M) }, /* CT-650 CDMA 450 1xEVDO modem */
+ 	{ USB_DEVICE_AND_INTERFACE_INFO(SAMSUNG_VENDOR_ID, SAMSUNG_PRODUCT_GT_B3730, USB_CLASS_CDC_DATA, 0x00, 0x00) }, /* Samsung GT-B3730 LTE USB modem.*/
+ 	{ USB_DEVICE(YUGA_VENDOR_ID, YUGA_PRODUCT_CEM600) },
+diff --git a/drivers/usb/serial/pl2303.c b/drivers/usb/serial/pl2303.c
+index 7b29317..45a288c 100644
+--- a/drivers/usb/serial/pl2303.c
++++ b/drivers/usb/serial/pl2303.c
+@@ -86,6 +86,9 @@ static const struct usb_device_id id_table[] = {
+ 	{ USB_DEVICE(YCCABLE_VENDOR_ID, YCCABLE_PRODUCT_ID) },
+ 	{ USB_DEVICE(SUPERIAL_VENDOR_ID, SUPERIAL_PRODUCT_ID) },
+ 	{ USB_DEVICE(HP_VENDOR_ID, HP_LD220_PRODUCT_ID) },
++	{ USB_DEVICE(HP_VENDOR_ID, HP_LD960_PRODUCT_ID) },
++	{ USB_DEVICE(HP_VENDOR_ID, HP_LCM220_PRODUCT_ID) },
++	{ USB_DEVICE(HP_VENDOR_ID, HP_LCM960_PRODUCT_ID) },
+ 	{ USB_DEVICE(CRESSI_VENDOR_ID, CRESSI_EDY_PRODUCT_ID) },
+ 	{ USB_DEVICE(ZEAGLE_VENDOR_ID, ZEAGLE_N2ITION3_PRODUCT_ID) },
+ 	{ USB_DEVICE(SONY_VENDOR_ID, SONY_QN3USB_PRODUCT_ID) },
+diff --git a/drivers/usb/serial/pl2303.h b/drivers/usb/serial/pl2303.h
+index c38b8c0..42bc082 100644
+--- a/drivers/usb/serial/pl2303.h
++++ b/drivers/usb/serial/pl2303.h
+@@ -121,8 +121,11 @@
+ #define SUPERIAL_VENDOR_ID	0x5372
+ #define SUPERIAL_PRODUCT_ID	0x2303
+ 
+-/* Hewlett-Packard LD220-HP POS Pole Display */
++/* Hewlett-Packard POS Pole Displays */
+ #define HP_VENDOR_ID		0x03f0
++#define HP_LD960_PRODUCT_ID	0x0b39
++#define HP_LCM220_PRODUCT_ID	0x3139
++#define HP_LCM960_PRODUCT_ID	0x3239
+ #define HP_LD220_PRODUCT_ID	0x3524
+ 
+ /* Cressi Edy (diving computer) PC interface */
+diff --git a/drivers/usb/serial/sierra.c b/drivers/usb/serial/sierra.c
+index a7fa673..dbdfeb4 100644
+--- a/drivers/usb/serial/sierra.c
++++ b/drivers/usb/serial/sierra.c
+@@ -305,7 +305,6 @@ static const struct usb_device_id id_table[] = {
+ 	{ USB_DEVICE(0x0f3d, 0x68A3), 	/* Airprime/Sierra Wireless Direct IP modems */
+ 	  .driver_info = (kernel_ulong_t)&direct_ip_interface_blacklist
+ 	},
+-       { USB_DEVICE(0x413C, 0x08133) }, /* Dell Computer Corp. Wireless 5720 VZW Mobile Broadband (EVDO Rev-A) Minicard GPS Port */
+ 
+ 	{ }
+ };
+diff --git a/drivers/usb/serial/usb-serial.c b/drivers/usb/serial/usb-serial.c
+index 850faa4..8f76a2b 100644
+--- a/drivers/usb/serial/usb-serial.c
++++ b/drivers/usb/serial/usb-serial.c
+@@ -1400,10 +1400,12 @@ void usb_serial_deregister(struct usb_serial_driver *device)
+ 	/* must be called with BKL held */
+ 	printk(KERN_INFO "USB Serial deregistering driver %s\n",
+ 	       device->description);
++
+ 	mutex_lock(&table_lock);
+ 	list_del(&device->driver_list);
+-	usb_serial_bus_deregister(device);
+ 	mutex_unlock(&table_lock);
++
++	usb_serial_bus_deregister(device);
+ }
+ EXPORT_SYMBOL_GPL(usb_serial_deregister);
+ 
+diff --git a/fs/btrfs/inode-map.c b/fs/btrfs/inode-map.c
+index f8962a9..a1fee6f 100644
+--- a/fs/btrfs/inode-map.c
++++ b/fs/btrfs/inode-map.c
+@@ -207,24 +207,14 @@ again:
+ 
+ void btrfs_return_ino(struct btrfs_root *root, u64 objectid)
+ {
+-	struct btrfs_free_space_ctl *ctl = root->free_ino_ctl;
+ 	struct btrfs_free_space_ctl *pinned = root->free_ino_pinned;
+ 
+ 	if (!btrfs_test_opt(root, INODE_MAP_CACHE))
+ 		return;
+-
+ again:
+ 	if (root->cached == BTRFS_CACHE_FINISHED) {
+-		__btrfs_add_free_space(ctl, objectid, 1);
++		__btrfs_add_free_space(pinned, objectid, 1);
+ 	} else {
+-		/*
+-		 * If we are in the process of caching free ino chunks,
+-		 * to avoid adding the same inode number to the free_ino
+-		 * tree twice due to cross transaction, we'll leave it
+-		 * in the pinned tree until a transaction is committed
+-		 * or the caching work is done.
+-		 */
+-
+ 		mutex_lock(&root->fs_commit_mutex);
+ 		spin_lock(&root->cache_lock);
+ 		if (root->cached == BTRFS_CACHE_FINISHED) {
+@@ -236,11 +226,7 @@ again:
+ 
+ 		start_caching(root);
+ 
+-		if (objectid <= root->cache_progress ||
+-		    objectid > root->highest_objectid)
+-			__btrfs_add_free_space(ctl, objectid, 1);
+-		else
+-			__btrfs_add_free_space(pinned, objectid, 1);
++		__btrfs_add_free_space(pinned, objectid, 1);
+ 
+ 		mutex_unlock(&root->fs_commit_mutex);
+ 	}
+diff --git a/fs/ext4/file.c b/fs/ext4/file.c
+index cb70f18..6199922 100644
+--- a/fs/ext4/file.c
++++ b/fs/ext4/file.c
+@@ -80,7 +80,7 @@ ext4_unaligned_aio(struct inode *inode, const struct iovec *iov,
+ 	size_t count = iov_length(iov, nr_segs);
+ 	loff_t final_size = pos + count;
+ 
+-	if (pos >= inode->i_size)
++	if (pos >= i_size_read(inode))
+ 		return 0;
+ 
+ 	if ((pos & blockmask) || (final_size & blockmask))
+diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
+index dc9f0ec..55d4f46 100644
+--- a/fs/ext4/inode.c
++++ b/fs/ext4/inode.c
+@@ -481,6 +481,11 @@ int ext4_map_blocks(handle_t *handle, struct inode *inode,
+ 	ext_debug("ext4_map_blocks(): inode %lu, flag %d, max_blocks %u,"
+ 		  "logical block %lu\n", inode->i_ino, flags, map->m_len,
+ 		  (unsigned long) map->m_lblk);
++
++	/* We can handle the block number less than EXT_MAX_BLOCKS */
++	if (unlikely(map->m_lblk >= EXT_MAX_BLOCKS))
++		return -EIO;
++
+ 	/*
+ 	 * Try to see if we can get the block without requesting a new
+ 	 * file system block.
+diff --git a/fs/ext4/page-io.c b/fs/ext4/page-io.c
+index 54f566d..b46a675 100644
+--- a/fs/ext4/page-io.c
++++ b/fs/ext4/page-io.c
+@@ -241,13 +241,14 @@ static void ext4_end_bio(struct bio *bio, int error)
+ 
+ 	if (error) {
+ 		io_end->flag |= EXT4_IO_END_ERROR;
+-		ext4_warning(inode->i_sb, "I/O error writing to inode %lu "
++		ext4_warning(inode->i_sb, "I/O error %d writing to inode %lu "
+ 			     "(offset %llu size %ld starting block %llu)",
+-			     inode->i_ino,
++			     error, inode->i_ino,
+ 			     (unsigned long long) io_end->offset,
+ 			     (long) io_end->size,
+ 			     (unsigned long long)
+ 			     bi_sector >> (inode->i_blkbits - 9));
++		mapping_set_error(inode->i_mapping, error);
+ 	}
+ 
+ 	if (!(io_end->flag & EXT4_IO_END_UNWRITTEN)) {
+diff --git a/fs/locks.c b/fs/locks.c
+index fcc50ab..d4f1d89 100644
+--- a/fs/locks.c
++++ b/fs/locks.c
+@@ -1253,11 +1253,10 @@ int __break_lease(struct inode *inode, unsigned int mode)
+ 
+ restart:
+ 	break_time = flock->fl_break_time;
+-	if (break_time != 0) {
++	if (break_time != 0)
+ 		break_time -= jiffies;
+-		if (break_time == 0)
+-			break_time++;
+-	}
++	if (break_time == 0)
++		break_time++;
+ 	locks_insert_block(flock, new_fl);
+ 	unlock_flocks();
+ 	error = wait_event_interruptible_timeout(new_fl->fl_wait,
+diff --git a/fs/nfsd/nfs4callback.c b/fs/nfsd/nfs4callback.c
+index 7748d6a..809a38a 100644
+--- a/fs/nfsd/nfs4callback.c
++++ b/fs/nfsd/nfs4callback.c
+@@ -633,9 +633,11 @@ static int max_cb_time(void)
+ 
+ static int setup_callback_client(struct nfs4_client *clp, struct nfs4_cb_conn *conn, struct nfsd4_session *ses)
+ {
++	int maxtime = max_cb_time();
+ 	struct rpc_timeout	timeparms = {
+-		.to_initval	= max_cb_time(),
++		.to_initval	= maxtime,
+ 		.to_retries	= 0,
++		.to_maxval	= maxtime,
+ 	};
+ 	struct rpc_create_args args = {
+ 		.net		= &init_net,
+diff --git a/include/linux/libata.h b/include/linux/libata.h
+index b1fcdba..375dfdf 100644
+--- a/include/linux/libata.h
++++ b/include/linux/libata.h
+@@ -763,6 +763,7 @@ struct ata_port {
+ 	unsigned long		qc_allocated;
+ 	unsigned int		qc_active;
+ 	int			nr_active_links; /* #links with active qcs */
++	unsigned int		last_tag;	/* track next tag hw expects */
+ 
+ 	struct ata_link		link;		/* host default link */
+ 	struct ata_link		*slave_link;	/* see ata_slave_link_init() */
+diff --git a/include/linux/mod_devicetable.h b/include/linux/mod_devicetable.h
+index 468819c..226e0ff 100644
+--- a/include/linux/mod_devicetable.h
++++ b/include/linux/mod_devicetable.h
+@@ -461,7 +461,8 @@ enum dmi_field {
+ };
+ 
+ struct dmi_strmatch {
+-	unsigned char slot;
++	unsigned char slot:7;
++	unsigned char exact_match:1;
+ 	char substr[79];
+ };
+ 
+@@ -489,7 +490,8 @@ struct dmi_system_id {
+ #define dmi_device_id dmi_system_id
+ #endif
+ 
+-#define DMI_MATCH(a, b)	{ a, b }
++#define DMI_MATCH(a, b)	{ .slot = a, .substr = b }
++#define DMI_EXACT_MATCH(a, b)	{ .slot = a, .substr = b, .exact_match = 1 }
+ 
+ #define PLATFORM_NAME_SIZE	20
+ #define PLATFORM_MODULE_PREFIX	"platform:"
+diff --git a/mm/hugetlb.c b/mm/hugetlb.c
+index d399f5f..cac2441 100644
+--- a/mm/hugetlb.c
++++ b/mm/hugetlb.c
+@@ -1078,6 +1078,7 @@ static void return_unused_surplus_pages(struct hstate *h,
+ 	while (nr_pages--) {
+ 		if (!free_pool_huge_page(h, &node_states[N_HIGH_MEMORY], 1))
+ 			break;
++		cond_resched_lock(&hugetlb_lock);
+ 	}
+ }
+ 
+diff --git a/mm/memory.c b/mm/memory.c
+index d5f913b..483e665 100644
+--- a/mm/memory.c
++++ b/mm/memory.c
+@@ -1852,12 +1852,17 @@ int fixup_user_fault(struct task_struct *tsk, struct mm_struct *mm,
+ 		     unsigned long address, unsigned int fault_flags)
+ {
+ 	struct vm_area_struct *vma;
++	vm_flags_t vm_flags;
+ 	int ret;
+ 
+ 	vma = find_extend_vma(mm, address);
+ 	if (!vma || address < vma->vm_start)
+ 		return -EFAULT;
+ 
++	vm_flags = (fault_flags & FAULT_FLAG_WRITE) ? VM_WRITE : VM_READ;
++	if (!(vm_flags & vma->vm_flags))
++		return -EFAULT;
++
+ 	ret = handle_mm_fault(mm, vma, address, fault_flags);
+ 	if (ret & VM_FAULT_ERROR) {
+ 		if (ret & VM_FAULT_OOM)
diff --git a/3.2.58/4420_grsecurity-3.0-3.2.58-201405112002.patch b/3.2.59/4420_grsecurity-3.0-3.2.59-201405252042.patch
index b77f99b..a27bb43 100644
--- a/3.2.58/4420_grsecurity-3.0-3.2.58-201405112002.patch
+++ b/3.2.59/4420_grsecurity-3.0-3.2.59-201405252042.patch
@@ -273,7 +273,7 @@ index 88fd7f5..b318a78 100644
  ==============================================================
  
 diff --git a/Makefile b/Makefile
-index d59b394..cbbdc10 100644
+index 1be3414..ef0a264 100644
 --- a/Makefile
 +++ b/Makefile
 @@ -245,8 +245,9 @@ CONFIG_SHELL := $(shell if [ -x "$$BASH" ]; then echo $$BASH; \
@@ -13573,6 +13573,18 @@ index d09bb03..0a3629b 100644
  		     : "i" (-EFAULT), "r" (newval), "1" (oldval)
  		     : "memory"
  	);
+diff --git a/arch/x86/include/asm/hugetlb.h b/arch/x86/include/asm/hugetlb.h
+index 439a9ac..48fa391 100644
+--- a/arch/x86/include/asm/hugetlb.h
++++ b/arch/x86/include/asm/hugetlb.h
+@@ -51,6 +51,7 @@ static inline pte_t huge_ptep_get_and_clear(struct mm_struct *mm,
+ static inline void huge_ptep_clear_flush(struct vm_area_struct *vma,
+ 					 unsigned long addr, pte_t *ptep)
+ {
++	ptep_clear_flush(vma, addr, ptep);
+ }
+ 
+ static inline int huge_pte_none(pte_t pte)
 diff --git a/arch/x86/include/asm/hw_irq.h b/arch/x86/include/asm/hw_irq.h
 index eb92a6e..b98b2f4 100644
 --- a/arch/x86/include/asm/hw_irq.h
@@ -21726,10 +21738,19 @@ index a9c2116..94c1e1a 100644
  };
  #endif
 diff --git a/arch/x86/kernel/ldt.c b/arch/x86/kernel/ldt.c
-index 4ac4531..2476f99 100644
+index 4ac4531..d655d56 100644
 --- a/arch/x86/kernel/ldt.c
 +++ b/arch/x86/kernel/ldt.c
-@@ -67,13 +67,13 @@ static int alloc_ldt(mm_context_t *pc, int mincount, int reload)
+@@ -21,6 +21,8 @@
+ #include <asm/mmu_context.h>
+ #include <asm/syscalls.h>
+ 
++int sysctl_ldt16 = 0;
++
+ #ifdef CONFIG_SMP
+ static void flush_ldt(void *current_mm)
+ {
+@@ -67,13 +69,13 @@ static int alloc_ldt(mm_context_t *pc, int mincount, int reload)
  	if (reload) {
  #ifdef CONFIG_SMP
  		preempt_disable();
@@ -21745,7 +21766,7 @@ index 4ac4531..2476f99 100644
  #endif
  	}
  	if (oldsize) {
-@@ -95,7 +95,7 @@ static inline int copy_ldt(mm_context_t *new, mm_context_t *old)
+@@ -95,7 +97,7 @@ static inline int copy_ldt(mm_context_t *new, mm_context_t *old)
  		return err;
  
  	for (i = 0; i < old->size; i++)
@@ -21754,7 +21775,7 @@ index 4ac4531..2476f99 100644
  	return 0;
  }
  
-@@ -116,6 +116,24 @@ int init_new_context(struct task_struct *tsk, struct mm_struct *mm)
+@@ -116,6 +118,24 @@ int init_new_context(struct task_struct *tsk, struct mm_struct *mm)
  		retval = copy_ldt(&mm->context, &old_mm->context);
  		mutex_unlock(&old_mm->context.lock);
  	}
@@ -21779,7 +21800,7 @@ index 4ac4531..2476f99 100644
  	return retval;
  }
  
-@@ -230,6 +248,13 @@ static int write_ldt(void __user *ptr, unsigned long bytecount, int oldmode)
+@@ -230,12 +250,19 @@ static int write_ldt(void __user *ptr, unsigned long bytecount, int oldmode)
  		}
  	}
  
@@ -21793,6 +21814,13 @@ index 4ac4531..2476f99 100644
  	/*
  	 * On x86-64 we do not support 16-bit segments due to
  	 * IRET leaking the high bits of the kernel stack address.
+ 	 */
+ #ifdef CONFIG_X86_64
+-	if (!ldt_info.seg_32bit) {
++	if (!ldt_info.seg_32bit && !sysctl_ldt16) {
+ 		error = -EINVAL;
+ 		goto out_unlock;
+ 	}
 diff --git a/arch/x86/kernel/machine_kexec_32.c b/arch/x86/kernel/machine_kexec_32.c
 index a3fa43b..8966f4c 100644
 --- a/arch/x86/kernel/machine_kexec_32.c
@@ -22097,7 +22125,7 @@ index 676b8c7..870ba04 100644
  	.spin_is_locked = __ticket_spin_is_locked,
  	.spin_is_contended = __ticket_spin_is_contended,
 diff --git a/arch/x86/kernel/paravirt.c b/arch/x86/kernel/paravirt.c
-index 84c938f..09fb3e0 100644
+index 84c938f..fa25421 100644
 --- a/arch/x86/kernel/paravirt.c
 +++ b/arch/x86/kernel/paravirt.c
 @@ -53,6 +53,9 @@ u64 _paravirt_ident_64(u64 x)
@@ -22110,11 +22138,13 @@ index 84c938f..09fb3e0 100644
  
  void __init default_banner(void)
  {
-@@ -145,15 +148,19 @@ unsigned paravirt_patch_default(u8 type, u16 clobbers, void *insnbuf,
+@@ -144,16 +147,20 @@ unsigned paravirt_patch_default(u8 type, u16 clobbers, void *insnbuf,
+ 
  	if (opfunc == NULL)
  		/* If there's no function, patch it with a ud2a (BUG) */
- 		ret = paravirt_patch_insns(insnbuf, len, ud2a, ud2a+sizeof(ud2a));
+-		ret = paravirt_patch_insns(insnbuf, len, ud2a, ud2a+sizeof(ud2a));
 -	else if (opfunc == _paravirt_nop)
++		ret = paravirt_patch_insns(insnbuf, len, ktva_ktla(ud2a), ud2a+sizeof(ud2a));
 +	else if (opfunc == (void *)_paravirt_nop)
  		/* If the operation is a nop, then nop the callsite */
  		ret = paravirt_patch_nop();
@@ -31445,7 +31475,7 @@ index 5d17950..2253fc9 100644
  
  #
 diff --git a/arch/x86/vdso/vdso32-setup.c b/arch/x86/vdso/vdso32-setup.c
-index 468d591..8e80a0a 100644
+index 468d591..8be5888 100644
 --- a/arch/x86/vdso/vdso32-setup.c
 +++ b/arch/x86/vdso/vdso32-setup.c
 @@ -25,6 +25,7 @@
@@ -31456,7 +31486,15 @@ index 468d591..8e80a0a 100644
  
  enum {
  	VDSO_DISABLED = 0,
-@@ -226,7 +227,7 @@ static inline void map_compat_vdso(int map)
+@@ -41,6 +42,7 @@ enum {
+ #ifdef CONFIG_X86_64
+ #define vdso_enabled			sysctl_vsyscall32
+ #define arch_setup_additional_pages	syscall32_setup_pages
++extern int sysctl_ldt16;
+ #endif
+ 
+ /*
+@@ -226,7 +228,7 @@ static inline void map_compat_vdso(int map)
  void enable_sep_cpu(void)
  {
  	int cpu = get_cpu();
@@ -31465,7 +31503,7 @@ index 468d591..8e80a0a 100644
  
  	if (!boot_cpu_has(X86_FEATURE_SEP)) {
  		put_cpu();
-@@ -249,7 +250,7 @@ static int __init gate_vma_init(void)
+@@ -249,7 +251,7 @@ static int __init gate_vma_init(void)
  	gate_vma.vm_start = FIXADDR_USER_START;
  	gate_vma.vm_end = FIXADDR_USER_END;
  	gate_vma.vm_flags = VM_READ | VM_MAYREAD | VM_EXEC | VM_MAYEXEC;
@@ -31474,7 +31512,7 @@ index 468d591..8e80a0a 100644
  	/*
  	 * Make sure the vDSO gets into every core dump.
  	 * Dumping its contents makes post-mortem fully interpretable later
-@@ -331,14 +332,14 @@ int arch_setup_additional_pages(struct linux_binprm *bprm, int uses_interp)
+@@ -331,14 +333,14 @@ int arch_setup_additional_pages(struct linux_binprm *bprm, int uses_interp)
  	if (compat)
  		addr = VDSO_HIGH_BASE;
  	else {
@@ -31491,7 +31529,7 @@ index 468d591..8e80a0a 100644
  
  	if (compat_uses_vma || !compat) {
  		/*
-@@ -361,11 +362,11 @@ int arch_setup_additional_pages(struct linux_binprm *bprm, int uses_interp)
+@@ -361,11 +363,11 @@ int arch_setup_additional_pages(struct linux_binprm *bprm, int uses_interp)
  	}
  
  	current_thread_info()->sysenter_return =
@@ -31505,7 +31543,21 @@ index 468d591..8e80a0a 100644
  
  	up_write(&mm->mmap_sem);
  
-@@ -412,8 +413,14 @@ __initcall(ia32_binfmt_init);
+@@ -388,6 +390,13 @@ static ctl_table abi_table2[] = {
+ 		.mode		= 0644,
+ 		.proc_handler	= proc_dointvec
+ 	},
++	{
++		.procname	= "ldt16",
++		.data		= &sysctl_ldt16,
++		.maxlen		= sizeof(int),
++		.mode		= 0644,
++		.proc_handler	= proc_dointvec
++	},
+ 	{}
+ };
+ 
+@@ -412,8 +421,14 @@ __initcall(ia32_binfmt_init);
  
  const char *arch_vma_name(struct vm_area_struct *vma)
  {
@@ -31521,7 +31573,7 @@ index 468d591..8e80a0a 100644
  	return NULL;
  }
  
-@@ -423,7 +430,7 @@ struct vm_area_struct *get_gate_vma(struct mm_struct *mm)
+@@ -423,7 +438,7 @@ struct vm_area_struct *get_gate_vma(struct mm_struct *mm)
  	 * Check to see if the corresponding task was created in compat vdso
  	 * mode.
  	 */
@@ -32482,10 +32534,10 @@ index de2802c..2260da9 100644
  				unsigned long timeout_msec)
  {
 diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
-index b3f0f5a..b6bc0a7 100644
+index 2b662725..202bcc8 100644
 --- a/drivers/ata/libata-core.c
 +++ b/drivers/ata/libata-core.c
-@@ -4777,7 +4777,7 @@ void ata_qc_free(struct ata_queued_cmd *qc)
+@@ -4782,7 +4782,7 @@ void ata_qc_free(struct ata_queued_cmd *qc)
  	struct ata_port *ap;
  	unsigned int tag;
  
@@ -32494,7 +32546,7 @@ index b3f0f5a..b6bc0a7 100644
  	ap = qc->ap;
  
  	qc->flags = 0;
-@@ -4793,7 +4793,7 @@ void __ata_qc_complete(struct ata_queued_cmd *qc)
+@@ -4798,7 +4798,7 @@ void __ata_qc_complete(struct ata_queued_cmd *qc)
  	struct ata_port *ap;
  	struct ata_link *link;
  
@@ -32503,7 +32555,7 @@ index b3f0f5a..b6bc0a7 100644
  	WARN_ON_ONCE(!(qc->flags & ATA_QCFLAG_ACTIVE));
  	ap = qc->ap;
  	link = qc->dev->link;
-@@ -5798,6 +5798,7 @@ static void ata_finalize_port_ops(struct ata_port_operations *ops)
+@@ -5803,6 +5803,7 @@ static void ata_finalize_port_ops(struct ata_port_operations *ops)
  		return;
  
  	spin_lock(&lock);
@@ -32511,7 +32563,7 @@ index b3f0f5a..b6bc0a7 100644
  
  	for (cur = ops->inherits; cur; cur = cur->inherits) {
  		void **inherit = (void **)cur;
-@@ -5811,8 +5812,9 @@ static void ata_finalize_port_ops(struct ata_port_operations *ops)
+@@ -5816,8 +5817,9 @@ static void ata_finalize_port_ops(struct ata_port_operations *ops)
  		if (IS_ERR(*pp))
  			*pp = NULL;
  
@@ -34259,44 +34311,6 @@ index 13cbdd3..d374957 100644
  
  static struct asender_cmd *get_asender_cmd(int cmd)
  {
-diff --git a/drivers/block/floppy.c b/drivers/block/floppy.c
-index 7a90d4a..6d0f3e1 100644
---- a/drivers/block/floppy.c
-+++ b/drivers/block/floppy.c
-@@ -3060,7 +3060,10 @@ static int raw_cmd_copyout(int cmd, void __user *param,
- 	int ret;
- 
- 	while (ptr) {
--		ret = copy_to_user(param, ptr, sizeof(*ptr));
-+		struct floppy_raw_cmd cmd = *ptr;
-+		cmd.next = NULL;
-+		cmd.kernel_data = NULL;
-+		ret = copy_to_user(param, &cmd, sizeof(cmd));
- 		if (ret)
- 			return -EFAULT;
- 		param += sizeof(struct floppy_raw_cmd);
-@@ -3114,10 +3117,11 @@ loop:
- 		return -ENOMEM;
- 	*rcmd = ptr;
- 	ret = copy_from_user(ptr, param, sizeof(*ptr));
--	if (ret)
--		return -EFAULT;
- 	ptr->next = NULL;
- 	ptr->buffer_length = 0;
-+	ptr->kernel_data = NULL;
-+	if (ret)
-+		return -EFAULT;
- 	param += sizeof(struct floppy_raw_cmd);
- 	if (ptr->cmd_count > 33)
- 			/* the command may now also take up the space
-@@ -3133,7 +3137,6 @@ loop:
- 	for (i = 0; i < 16; i++)
- 		ptr->reply[i] = 0;
- 	ptr->resultcode = 0;
--	ptr->kernel_data = NULL;
- 
- 	if (ptr->flags & (FD_RAW_READ | FD_RAW_WRITE)) {
- 		if (ptr->length <= 0)
 diff --git a/drivers/block/loop.c b/drivers/block/loop.c
 index d659135..45fe633 100644
 --- a/drivers/block/loop.c
@@ -34891,7 +34905,7 @@ index da3cfee..a5a6606 100644
  
  	*ppos = i;
 diff --git a/drivers/char/random.c b/drivers/char/random.c
-index c244f0e..05e9c5e 100644
+index c244f0e..0fa19d6 100644
 --- a/drivers/char/random.c
 +++ b/drivers/char/random.c
 @@ -255,10 +255,8 @@
@@ -35629,7 +35643,7 @@ index c244f0e..05e9c5e 100644
  }
  #endif
  
-@@ -835,104 +915,127 @@ static ssize_t extract_entropy(struct entropy_store *r, void *buf,
+@@ -835,104 +915,130 @@ static ssize_t extract_entropy(struct entropy_store *r, void *buf,
   * from the primary pool to the secondary extraction pool. We make
   * sure we pull enough for a 'catastrophic reseed'.
   */
@@ -35753,10 +35767,10 @@ index c244f0e..05e9c5e 100644
 +		ibytes = min_t(size_t, ibytes, max(0, have_bytes - reserved));
 +	if (ibytes < min)
 +		ibytes = 0;
-+	entropy_count = max_t(int, 0,
-+			      entropy_count - (ibytes << (ENTROPY_SHIFT + 3)));
-+	if (cmpxchg(&r->entropy_count, orig, entropy_count) != orig)
-+		goto retry;
++	if (have_bytes >= ibytes + reserved)
++		entropy_count -= ibytes << (ENTROPY_SHIFT + 3);
++	else
++		entropy_count = reserved << (ENTROPY_SHIFT + 3);
  
 -		if (entropy_count / 8 >= nbytes + reserved) {
 -			entropy_count -= nbytes*8;
@@ -35767,7 +35781,9 @@ index c244f0e..05e9c5e 100644
 -			if (cmpxchg(&r->entropy_count, orig, entropy_count) != orig)
 -				goto retry;
 -		}
--
++	if (cmpxchg(&r->entropy_count, orig, entropy_count) != orig)
++		goto retry;
+ 
 -		if (entropy_count < random_write_wakeup_thresh) {
 -			wake_up_interruptible(&random_write_wait);
 -			kill_fasync(&fasync, SIGIO, POLL_OUT);
@@ -35823,7 +35839,7 @@ index c244f0e..05e9c5e 100644
  	spin_lock_irqsave(&r->lock, flags);
  	for (i = 0; i < r->poolinfo->poolwords; i += 16)
  		sha_transform(hash.w, (__u8 *)(r->pool + i), workspace);
-@@ -966,27 +1069,43 @@ static void extract_buf(struct entropy_store *r, __u8 *out)
+@@ -966,27 +1072,43 @@ static void extract_buf(struct entropy_store *r, __u8 *out)
  	hash.w[1] ^= hash.w[4];
  	hash.w[2] ^= rol32(hash.w[2], 16);
  
@@ -35878,7 +35894,7 @@ index c244f0e..05e9c5e 100644
  	xfer_secondary_pool(r, nbytes);
  	nbytes = account(r, nbytes, min, reserved);
  
-@@ -994,8 +1113,6 @@ static ssize_t extract_entropy(struct entropy_store *r, void *buf,
+@@ -994,8 +1116,6 @@ static ssize_t extract_entropy(struct entropy_store *r, void *buf,
  		extract_buf(r, tmp);
  
  		if (fips_enabled) {
@@ -35887,7 +35903,7 @@ index c244f0e..05e9c5e 100644
  			spin_lock_irqsave(&r->lock, flags);
  			if (!memcmp(tmp, r->last_data, EXTRACT_SIZE))
  				panic("Hardware RNG duplicated output!\n");
-@@ -1015,12 +1132,17 @@ static ssize_t extract_entropy(struct entropy_store *r, void *buf,
+@@ -1015,12 +1135,17 @@ static ssize_t extract_entropy(struct entropy_store *r, void *buf,
  	return ret;
  }
  
@@ -35905,7 +35921,7 @@ index c244f0e..05e9c5e 100644
  	xfer_secondary_pool(r, nbytes);
  	nbytes = account(r, nbytes, 0, 0);
  
-@@ -1036,7 +1158,7 @@ static ssize_t extract_entropy_user(struct entropy_store *r, void __user *buf,
+@@ -1036,7 +1161,7 @@ static ssize_t extract_entropy_user(struct entropy_store *r, void __user *buf,
  
  		extract_buf(r, tmp);
  		i = min_t(int, nbytes, EXTRACT_SIZE);
@@ -35914,7 +35930,7 @@ index c244f0e..05e9c5e 100644
  			ret = -EFAULT;
  			break;
  		}
-@@ -1055,11 +1177,20 @@ static ssize_t extract_entropy_user(struct entropy_store *r, void __user *buf,
+@@ -1055,11 +1180,20 @@ static ssize_t extract_entropy_user(struct entropy_store *r, void __user *buf,
  /*
   * This function is the exported kernel interface.  It returns some
   * number of good random numbers, suitable for key generation, seeding
@@ -35937,7 +35953,7 @@ index c244f0e..05e9c5e 100644
  	extract_entropy(&nonblocking_pool, buf, nbytes, 0, 0);
  }
  EXPORT_SYMBOL(get_random_bytes);
-@@ -1078,6 +1209,7 @@ void get_random_bytes_arch(void *buf, int nbytes)
+@@ -1078,6 +1212,7 @@ void get_random_bytes_arch(void *buf, int nbytes)
  {
  	char *p = buf;
  
@@ -35945,7 +35961,7 @@ index c244f0e..05e9c5e 100644
  	while (nbytes) {
  		unsigned long v;
  		int chunk = min(nbytes, (int)sizeof(unsigned long));
-@@ -1111,12 +1243,11 @@ static void init_std_data(struct entropy_store *r)
+@@ -1111,12 +1246,11 @@ static void init_std_data(struct entropy_store *r)
  	ktime_t now = ktime_get_real();
  	unsigned long rv;
  
@@ -35961,7 +35977,7 @@ index c244f0e..05e9c5e 100644
  		mix_pool_bytes(r, &rv, sizeof(rv), NULL);
  	}
  	mix_pool_bytes(r, utsname(), sizeof(*(utsname())), NULL);
-@@ -1139,25 +1270,7 @@ static int rand_initialize(void)
+@@ -1139,25 +1273,7 @@ static int rand_initialize(void)
  	init_std_data(&nonblocking_pool);
  	return 0;
  }
@@ -35988,7 +36004,7 @@ index c244f0e..05e9c5e 100644
  
  #ifdef CONFIG_BLOCK
  void rand_initialize_disk(struct gendisk *disk)
-@@ -1169,71 +1282,59 @@ void rand_initialize_disk(struct gendisk *disk)
+@@ -1169,71 +1285,59 @@ void rand_initialize_disk(struct gendisk *disk)
  	 * source.
  	 */
  	state = kzalloc(sizeof(struct timer_rand_state), GFP_KERNEL);
@@ -36096,7 +36112,7 @@ index c244f0e..05e9c5e 100644
  }
  
  static unsigned int
-@@ -1244,9 +1345,9 @@ random_poll(struct file *file, poll_table * wait)
+@@ -1244,9 +1348,9 @@ random_poll(struct file *file, poll_table * wait)
  	poll_wait(file, &random_read_wait, wait);
  	poll_wait(file, &random_write_wait, wait);
  	mask = 0;
@@ -36108,7 +36124,7 @@ index c244f0e..05e9c5e 100644
  		mask |= POLLOUT | POLLWRNORM;
  	return mask;
  }
-@@ -1297,7 +1398,8 @@ static long random_ioctl(struct file *f, unsigned int cmd, unsigned long arg)
+@@ -1297,7 +1401,8 @@ static long random_ioctl(struct file *f, unsigned int cmd, unsigned long arg)
  	switch (cmd) {
  	case RNDGETENTCNT:
  		/* inherently racy, no point locking */
@@ -36118,7 +36134,7 @@ index c244f0e..05e9c5e 100644
  			return -EFAULT;
  		return 0;
  	case RNDADDTOENTCNT:
-@@ -1305,7 +1407,7 @@ static long random_ioctl(struct file *f, unsigned int cmd, unsigned long arg)
+@@ -1305,7 +1410,7 @@ static long random_ioctl(struct file *f, unsigned int cmd, unsigned long arg)
  			return -EPERM;
  		if (get_user(ent_count, p))
  			return -EFAULT;
@@ -36127,7 +36143,7 @@ index c244f0e..05e9c5e 100644
  		return 0;
  	case RNDADDENTROPY:
  		if (!capable(CAP_SYS_ADMIN))
-@@ -1320,14 +1422,19 @@ static long random_ioctl(struct file *f, unsigned int cmd, unsigned long arg)
+@@ -1320,14 +1425,19 @@ static long random_ioctl(struct file *f, unsigned int cmd, unsigned long arg)
  				    size);
  		if (retval < 0)
  			return retval;
@@ -36150,7 +36166,7 @@ index c244f0e..05e9c5e 100644
  		return 0;
  	default:
  		return -EINVAL;
-@@ -1387,23 +1494,23 @@ EXPORT_SYMBOL(generate_random_uuid);
+@@ -1387,23 +1497,23 @@ EXPORT_SYMBOL(generate_random_uuid);
  #include <linux/sysctl.h>
  
  static int min_read_thresh = 8, min_write_thresh;
@@ -36181,7 +36197,7 @@ index c244f0e..05e9c5e 100644
  	unsigned char buf[64], tmp_uuid[16], *uuid;
  
  	uuid = table->data;
-@@ -1427,8 +1534,26 @@ static int proc_do_uuid(ctl_table *table, int write,
+@@ -1427,8 +1537,26 @@ static int proc_do_uuid(ctl_table *table, int write,
  	return proc_dostring(&fake_table, write, buffer, lenp, ppos);
  }
  
@@ -36209,7 +36225,7 @@ index c244f0e..05e9c5e 100644
  	{
  		.procname	= "poolsize",
  		.data		= &sysctl_poolsize,
-@@ -1440,12 +1565,12 @@ ctl_table random_table[] = {
+@@ -1440,12 +1568,12 @@ ctl_table random_table[] = {
  		.procname	= "entropy_avail",
  		.maxlen		= sizeof(int),
  		.mode		= 0444,
@@ -36224,7 +36240,7 @@ index c244f0e..05e9c5e 100644
  		.maxlen		= sizeof(int),
  		.mode		= 0644,
  		.proc_handler	= proc_dointvec_minmax,
-@@ -1454,7 +1579,7 @@ ctl_table random_table[] = {
+@@ -1454,7 +1582,7 @@ ctl_table random_table[] = {
  	},
  	{
  		.procname	= "write_wakeup_threshold",
@@ -36233,7 +36249,7 @@ index c244f0e..05e9c5e 100644
  		.maxlen		= sizeof(int),
  		.mode		= 0644,
  		.proc_handler	= proc_dointvec_minmax,
-@@ -1462,6 +1587,13 @@ ctl_table random_table[] = {
+@@ -1462,6 +1590,13 @@ ctl_table random_table[] = {
  		.extra2		= &max_write_thresh,
  	},
  	{
@@ -36247,7 +36263,7 @@ index c244f0e..05e9c5e 100644
  		.procname	= "boot_id",
  		.data		= &sysctl_bootid,
  		.maxlen		= 16,
-@@ -1492,7 +1624,7 @@ int random_int_secret_init(void)
+@@ -1492,7 +1627,7 @@ int random_int_secret_init(void)
   * value is not cryptographically secure but for several uses the cost of
   * depleting entropy is too high
   */
@@ -36256,7 +36272,7 @@ index c244f0e..05e9c5e 100644
  unsigned int get_random_int(void)
  {
  	__u32 *hash;
-@@ -1510,6 +1642,7 @@ unsigned int get_random_int(void)
+@@ -1510,6 +1645,7 @@ unsigned int get_random_int(void)
  
  	return ret;
  }
@@ -37119,7 +37135,7 @@ index 94a58a0..f5eba42 100644
  	container_of(_dev_attr, struct dmi_device_attribute, dev_attr)
  
 diff --git a/drivers/firmware/dmi_scan.c b/drivers/firmware/dmi_scan.c
-index 4cd392d..4b629e1 100644
+index 2861ef4..9e90c69 100644
 --- a/drivers/firmware/dmi_scan.c
 +++ b/drivers/firmware/dmi_scan.c
 @@ -490,11 +490,6 @@ void __init dmi_scan_machine(void)
@@ -37134,7 +37150,7 @@ index 4cd392d..4b629e1 100644
  		p = dmi_ioremap(0xF0000, 0x10000);
  		if (p == NULL)
  			goto error;
-@@ -769,7 +764,7 @@ int dmi_walk(void (*decode)(const struct dmi_header *, void *),
+@@ -775,7 +770,7 @@ int dmi_walk(void (*decode)(const struct dmi_header *, void *),
  	if (buf == NULL)
  		return -1;
  
@@ -49403,7 +49419,7 @@ index 643a0a0..4da1c03 100644
  		return NULL;
  	}
 diff --git a/drivers/tty/n_tty.c b/drivers/tty/n_tty.c
-index 0f8a785..9b332e0 100644
+index bac83d8..37d177a 100644
 --- a/drivers/tty/n_tty.c
 +++ b/drivers/tty/n_tty.c
 @@ -1639,6 +1639,7 @@ static int copy_from_read_buf(struct tty_struct *tty,
@@ -49434,7 +49450,7 @@ index 0f8a785..9b332e0 100644
  		spin_unlock_irqrestore(&tty->read_lock, flags);
  		*b += n;
  		*nr -= n;
-@@ -1996,10 +1997,17 @@ static ssize_t n_tty_write(struct tty_struct *tty, struct file *file,
+@@ -1996,12 +1997,19 @@ static ssize_t n_tty_write(struct tty_struct *tty, struct file *file,
  			if (tty->ops->flush_chars)
  				tty->ops->flush_chars(tty);
  		} else {
@@ -49444,7 +49460,9 @@ index 0f8a785..9b332e0 100644
 +			if (lock)
 +				mutex_lock(&tty->output_lock);
  			while (nr > 0) {
+ 				mutex_lock(&tty->output_lock);
  				c = tty->ops->write(tty, b, nr);
+ 				mutex_unlock(&tty->output_lock);
  				if (c < 0) {
  					retval = c;
 +					if (lock)
@@ -49452,7 +49470,7 @@ index 0f8a785..9b332e0 100644
  					goto break_out;
  				}
  				if (!c)
-@@ -2007,6 +2015,8 @@ static ssize_t n_tty_write(struct tty_struct *tty, struct file *file,
+@@ -2009,6 +2017,8 @@ static ssize_t n_tty_write(struct tty_struct *tty, struct file *file,
  				b += c;
  				nr -= c;
  			}
@@ -49461,7 +49479,7 @@ index 0f8a785..9b332e0 100644
  		}
  		if (!nr)
  			break;
-@@ -2132,6 +2142,7 @@ void n_tty_inherit_ops(struct tty_ldisc_ops *ops)
+@@ -2134,6 +2144,7 @@ void n_tty_inherit_ops(struct tty_ldisc_ops *ops)
  {
  	*ops = tty_ldisc_N_TTY;
  	ops->owner = NULL;
@@ -60198,10 +60216,10 @@ index 2444780..2544030 100644
  		error = PTR_ERR(nlmsvc_task);
  		svc_exit_thread(nlmsvc_rqst);
 diff --git a/fs/locks.c b/fs/locks.c
-index fcc50ab..c3dacf26 100644
+index d4f1d89..0114708 100644
 --- a/fs/locks.c
 +++ b/fs/locks.c
-@@ -2075,16 +2075,16 @@ void locks_remove_flock(struct file *filp)
+@@ -2074,16 +2074,16 @@ void locks_remove_flock(struct file *filp)
  		return;
  
  	if (filp->f_op && filp->f_op->flock) {
@@ -79815,10 +79833,10 @@ index e6796c1..350d338 100644
  
  int kvm_arch_vcpu_init(struct kvm_vcpu *vcpu);
 diff --git a/include/linux/libata.h b/include/linux/libata.h
-index b1fcdba..855901a 100644
+index 375dfdf..7dca34f 100644
 --- a/include/linux/libata.h
 +++ b/include/linux/libata.h
-@@ -912,7 +912,7 @@ struct ata_port_operations {
+@@ -913,7 +913,7 @@ struct ata_port_operations {
  	 * fields must be pointers.
  	 */
  	const struct ata_port_operations	*inherits;
@@ -80284,7 +80302,7 @@ index 25842b6..6e42df8 100644
  	/*
  	 * The target ratio of ACTIVE_ANON to INACTIVE_ANON pages on
 diff --git a/include/linux/mod_devicetable.h b/include/linux/mod_devicetable.h
-index 468819c..c02b63b 100644
+index 226e0ff..7a566d0 100644
 --- a/include/linux/mod_devicetable.h
 +++ b/include/linux/mod_devicetable.h
 @@ -12,7 +12,7 @@
@@ -80305,7 +80323,7 @@ index 468819c..c02b63b 100644
  
  struct hid_device_id {
  	__u16 bus;
-@@ -479,7 +479,7 @@ struct dmi_system_id {
+@@ -480,7 +480,7 @@ struct dmi_system_id {
  	const char *ident;
  	struct dmi_strmatch matches[4];
  	void *driver_data;
@@ -93399,7 +93417,7 @@ index 2a07f97..2cdc054 100644
  	set_page_address(page, (void *)vaddr);
  
 diff --git a/mm/huge_memory.c b/mm/huge_memory.c
-index ed0ed8a..cc835b9 100644
+index ed0ed8a..cc835b97 100644
 --- a/mm/huge_memory.c
 +++ b/mm/huge_memory.c
 @@ -704,7 +704,7 @@ out:
@@ -93412,10 +93430,10 @@ index ed0ed8a..cc835b9 100644
  	/* if an huge pmd materialized from under us just retry later */
  	if (unlikely(pmd_trans_huge(*pmd)))
 diff --git a/mm/hugetlb.c b/mm/hugetlb.c
-index d399f5f..786c190 100644
+index cac2441..2e0afc5 100644
 --- a/mm/hugetlb.c
 +++ b/mm/hugetlb.c
-@@ -2008,15 +2008,17 @@ static int hugetlb_sysctl_handler_common(bool obey_mempolicy,
+@@ -2009,15 +2009,17 @@ static int hugetlb_sysctl_handler_common(bool obey_mempolicy,
  	struct hstate *h = &default_hstate;
  	unsigned long tmp;
  	int ret;
@@ -93436,7 +93454,7 @@ index d399f5f..786c190 100644
  	if (ret)
  		goto out;
  
-@@ -2073,15 +2075,17 @@ int hugetlb_overcommit_handler(struct ctl_table *table, int write,
+@@ -2074,15 +2076,17 @@ int hugetlb_overcommit_handler(struct ctl_table *table, int write,
  	struct hstate *h = &default_hstate;
  	unsigned long tmp;
  	int ret;
@@ -93457,7 +93475,7 @@ index d399f5f..786c190 100644
  	if (ret)
  		goto out;
  
-@@ -2500,6 +2504,27 @@ static int unmap_ref_private(struct mm_struct *mm, struct vm_area_struct *vma,
+@@ -2501,6 +2505,27 @@ static int unmap_ref_private(struct mm_struct *mm, struct vm_area_struct *vma,
  	return 1;
  }
  
@@ -93485,7 +93503,7 @@ index d399f5f..786c190 100644
  /*
   * Hugetlb_cow() should be called with page lock of the original hugepage held.
   */
-@@ -2602,6 +2627,11 @@ retry_avoidcopy:
+@@ -2603,6 +2628,11 @@ retry_avoidcopy:
  				make_huge_pte(vma, new_page, 1));
  		page_remove_rmap(old_page);
  		hugepage_add_new_anon_rmap(new_page, vma, address);
@@ -93497,7 +93515,7 @@ index d399f5f..786c190 100644
  		/* Make the old page be freed below */
  		new_page = old_page;
  		mmu_notifier_invalidate_range_end(mm,
-@@ -2753,6 +2783,10 @@ retry:
+@@ -2754,6 +2784,10 @@ retry:
  				&& (vma->vm_flags & VM_SHARED)));
  	set_huge_pte_at(mm, address, ptep, new_pte);
  
@@ -93508,7 +93526,7 @@ index d399f5f..786c190 100644
  	if ((flags & FAULT_FLAG_WRITE) && !(vma->vm_flags & VM_SHARED)) {
  		/* Optimization, do the COW without a second fault */
  		ret = hugetlb_cow(mm, vma, address, ptep, new_pte, page);
-@@ -2782,6 +2816,10 @@ int hugetlb_fault(struct mm_struct *mm, struct vm_area_struct *vma,
+@@ -2783,6 +2817,10 @@ int hugetlb_fault(struct mm_struct *mm, struct vm_area_struct *vma,
  	static DEFINE_MUTEX(hugetlb_instantiation_mutex);
  	struct hstate *h = hstate_vma(vma);
  
@@ -93519,7 +93537,7 @@ index d399f5f..786c190 100644
  	ptep = huge_pte_offset(mm, address);
  	if (ptep) {
  		entry = huge_ptep_get(ptep);
-@@ -2793,6 +2831,26 @@ int hugetlb_fault(struct mm_struct *mm, struct vm_area_struct *vma,
+@@ -2794,6 +2832,26 @@ int hugetlb_fault(struct mm_struct *mm, struct vm_area_struct *vma,
  			       VM_FAULT_SET_HINDEX(h - hstates);
  	}
  
@@ -93784,7 +93802,7 @@ index 96c4bcf..436254e 100644
  	/* keep elevated page count for bad page */
  	return ret;
 diff --git a/mm/memory.c b/mm/memory.c
-index d5f913b..32583a0 100644
+index 483e665..32583a0 100644
 --- a/mm/memory.c
 +++ b/mm/memory.c
 @@ -462,8 +462,12 @@ static inline void free_pmd_range(struct mmu_gather *tlb, pud_t *pud,
@@ -93869,25 +93887,7 @@ index d5f913b..32583a0 100644
  	return i;
  }
  EXPORT_SYMBOL(__get_user_pages);
-@@ -1852,12 +1848,17 @@ int fixup_user_fault(struct task_struct *tsk, struct mm_struct *mm,
- 		     unsigned long address, unsigned int fault_flags)
- {
- 	struct vm_area_struct *vma;
-+	vm_flags_t vm_flags;
- 	int ret;
- 
- 	vma = find_extend_vma(mm, address);
- 	if (!vma || address < vma->vm_start)
- 		return -EFAULT;
- 
-+	vm_flags = (fault_flags & FAULT_FLAG_WRITE) ? VM_WRITE : VM_READ;
-+	if (!(vm_flags & vma->vm_flags))
-+		return -EFAULT;
-+
- 	ret = handle_mm_fault(mm, vma, address, fault_flags);
- 	if (ret & VM_FAULT_ERROR) {
- 		if (ret & VM_FAULT_OOM)
-@@ -2023,6 +2024,10 @@ static int insert_page(struct vm_area_struct *vma, unsigned long addr,
+@@ -2028,6 +2024,10 @@ static int insert_page(struct vm_area_struct *vma, unsigned long addr,
  	page_add_file_rmap(page);
  	set_pte_at(mm, addr, pte, mk_pte(page, prot));
  
@@ -93898,7 +93898,7 @@ index d5f913b..32583a0 100644
  	retval = 0;
  	pte_unmap_unlock(pte, ptl);
  	return retval;
-@@ -2057,10 +2062,22 @@ out:
+@@ -2062,10 +2062,22 @@ out:
  int vm_insert_page(struct vm_area_struct *vma, unsigned long addr,
  			struct page *page)
  {
@@ -93921,7 +93921,7 @@ index d5f913b..32583a0 100644
  	vma->vm_flags |= VM_INSERTPAGE;
  	return insert_page(vma, addr, page, vma->vm_page_prot);
  }
-@@ -2146,6 +2163,7 @@ int vm_insert_mixed(struct vm_area_struct *vma, unsigned long addr,
+@@ -2151,6 +2163,7 @@ int vm_insert_mixed(struct vm_area_struct *vma, unsigned long addr,
  			unsigned long pfn)
  {
  	BUG_ON(!(vma->vm_flags & VM_MIXEDMAP));
@@ -93929,7 +93929,7 @@ index d5f913b..32583a0 100644
  
  	if (addr < vma->vm_start || addr >= vma->vm_end)
  		return -EFAULT;
-@@ -2400,7 +2418,9 @@ static int apply_to_pmd_range(struct mm_struct *mm, pud_t *pud,
+@@ -2405,7 +2418,9 @@ static int apply_to_pmd_range(struct mm_struct *mm, pud_t *pud,
  
  	BUG_ON(pud_huge(*pud));
  
@@ -93940,7 +93940,7 @@ index d5f913b..32583a0 100644
  	if (!pmd)
  		return -ENOMEM;
  	do {
-@@ -2420,7 +2440,9 @@ static int apply_to_pud_range(struct mm_struct *mm, pgd_t *pgd,
+@@ -2425,7 +2440,9 @@ static int apply_to_pud_range(struct mm_struct *mm, pgd_t *pgd,
  	unsigned long next;
  	int err;
  
@@ -93951,7 +93951,7 @@ index d5f913b..32583a0 100644
  	if (!pud)
  		return -ENOMEM;
  	do {
-@@ -2508,6 +2530,186 @@ static inline void cow_user_page(struct page *dst, struct page *src, unsigned lo
+@@ -2513,6 +2530,186 @@ static inline void cow_user_page(struct page *dst, struct page *src, unsigned lo
  		copy_user_highpage(dst, src, va, vma);
  }
  
@@ -94138,7 +94138,7 @@ index d5f913b..32583a0 100644
  /*
   * This routine handles present pages, when users try to write
   * to a shared page. It is done by copying the page to a new address
-@@ -2719,6 +2921,12 @@ gotten:
+@@ -2724,6 +2921,12 @@ gotten:
  	 */
  	page_table = pte_offset_map_lock(mm, pmd, address, &ptl);
  	if (likely(pte_same(*page_table, orig_pte))) {
@@ -94151,7 +94151,7 @@ index d5f913b..32583a0 100644
  		if (old_page) {
  			if (!PageAnon(old_page)) {
  				dec_mm_counter_fast(mm, MM_FILEPAGES);
-@@ -2770,6 +2978,10 @@ gotten:
+@@ -2775,6 +2978,10 @@ gotten:
  			page_remove_rmap(old_page);
  		}
  
@@ -94162,7 +94162,7 @@ index d5f913b..32583a0 100644
  		/* Free the old page.. */
  		new_page = old_page;
  		ret |= VM_FAULT_WRITE;
-@@ -3049,6 +3261,11 @@ static int do_swap_page(struct mm_struct *mm, struct vm_area_struct *vma,
+@@ -3054,6 +3261,11 @@ static int do_swap_page(struct mm_struct *mm, struct vm_area_struct *vma,
  	swap_free(entry);
  	if (vm_swap_full() || (vma->vm_flags & VM_LOCKED) || PageMlocked(page))
  		try_to_free_swap(page);
@@ -94174,7 +94174,7 @@ index d5f913b..32583a0 100644
  	unlock_page(page);
  	if (swapcache) {
  		/*
-@@ -3072,6 +3289,11 @@ static int do_swap_page(struct mm_struct *mm, struct vm_area_struct *vma,
+@@ -3077,6 +3289,11 @@ static int do_swap_page(struct mm_struct *mm, struct vm_area_struct *vma,
  
  	/* No need to invalidate - it was non-present before */
  	update_mmu_cache(vma, address, page_table);
@@ -94186,7 +94186,7 @@ index d5f913b..32583a0 100644
  unlock:
  	pte_unmap_unlock(page_table, ptl);
  out:
-@@ -3091,40 +3313,6 @@ out_release:
+@@ -3096,40 +3313,6 @@ out_release:
  }
  
  /*
@@ -94227,7 +94227,7 @@ index d5f913b..32583a0 100644
   * We enter with non-exclusive mmap_sem (to exclude vma changes,
   * but allow concurrent faults), and pte mapped but not yet locked.
   * We return with mmap_sem still held, but pte unmapped and unlocked.
-@@ -3133,27 +3321,23 @@ static int do_anonymous_page(struct mm_struct *mm, struct vm_area_struct *vma,
+@@ -3138,27 +3321,23 @@ static int do_anonymous_page(struct mm_struct *mm, struct vm_area_struct *vma,
  		unsigned long address, pte_t *page_table, pmd_t *pmd,
  		unsigned int flags)
  {
@@ -94260,7 +94260,7 @@ index d5f913b..32583a0 100644
  	if (unlikely(anon_vma_prepare(vma)))
  		goto oom;
  	page = alloc_zeroed_user_highpage_movable(vma, address);
-@@ -3172,6 +3356,11 @@ static int do_anonymous_page(struct mm_struct *mm, struct vm_area_struct *vma,
+@@ -3177,6 +3356,11 @@ static int do_anonymous_page(struct mm_struct *mm, struct vm_area_struct *vma,
  	if (!pte_none(*page_table))
  		goto release;
  
@@ -94272,7 +94272,7 @@ index d5f913b..32583a0 100644
  	inc_mm_counter_fast(mm, MM_ANONPAGES);
  	page_add_new_anon_rmap(page, vma, address);
  setpte:
-@@ -3179,6 +3368,12 @@ setpte:
+@@ -3184,6 +3368,12 @@ setpte:
  
  	/* No need to invalidate - it was non-present before */
  	update_mmu_cache(vma, address, page_table);
@@ -94285,7 +94285,7 @@ index d5f913b..32583a0 100644
  unlock:
  	pte_unmap_unlock(page_table, ptl);
  	return 0;
-@@ -3322,6 +3517,12 @@ static int __do_fault(struct mm_struct *mm, struct vm_area_struct *vma,
+@@ -3327,6 +3517,12 @@ static int __do_fault(struct mm_struct *mm, struct vm_area_struct *vma,
  	 */
  	/* Only go through if we didn't race with anybody else... */
  	if (likely(pte_same(*page_table, orig_pte))) {
@@ -94298,7 +94298,7 @@ index d5f913b..32583a0 100644
  		flush_icache_page(vma, page);
  		entry = mk_pte(page, vma->vm_page_prot);
  		if (flags & FAULT_FLAG_WRITE)
-@@ -3341,6 +3542,14 @@ static int __do_fault(struct mm_struct *mm, struct vm_area_struct *vma,
+@@ -3346,6 +3542,14 @@ static int __do_fault(struct mm_struct *mm, struct vm_area_struct *vma,
  
  		/* no need to invalidate: a not-present page won't be cached */
  		update_mmu_cache(vma, address, page_table);
@@ -94313,7 +94313,7 @@ index d5f913b..32583a0 100644
  	} else {
  		if (cow_page)
  			mem_cgroup_uncharge_page(cow_page);
-@@ -3494,6 +3703,12 @@ int handle_pte_fault(struct mm_struct *mm,
+@@ -3499,6 +3703,12 @@ int handle_pte_fault(struct mm_struct *mm,
  		if (flags & FAULT_FLAG_WRITE)
  			flush_tlb_fix_spurious_fault(vma, address);
  	}
@@ -94326,7 +94326,7 @@ index d5f913b..32583a0 100644
  unlock:
  	pte_unmap_unlock(pte, ptl);
  	return 0;
-@@ -3510,6 +3725,10 @@ int handle_mm_fault(struct mm_struct *mm, struct vm_area_struct *vma,
+@@ -3515,6 +3725,10 @@ int handle_mm_fault(struct mm_struct *mm, struct vm_area_struct *vma,
  	pmd_t *pmd;
  	pte_t *pte;
  
@@ -94337,7 +94337,7 @@ index d5f913b..32583a0 100644
  	__set_current_state(TASK_RUNNING);
  
  	count_vm_event(PGFAULT);
-@@ -3521,6 +3740,34 @@ int handle_mm_fault(struct mm_struct *mm, struct vm_area_struct *vma,
+@@ -3526,6 +3740,34 @@ int handle_mm_fault(struct mm_struct *mm, struct vm_area_struct *vma,
  	if (unlikely(is_vm_hugetlb_page(vma)))
  		return hugetlb_fault(mm, vma, address, flags);
  
@@ -94372,7 +94372,7 @@ index d5f913b..32583a0 100644
  retry:
  	pgd = pgd_offset(mm, address);
  	pud = pud_alloc(mm, pgd, address);
-@@ -3562,7 +3809,7 @@ retry:
+@@ -3567,7 +3809,7 @@ retry:
  	 * run pte_offset_map on the pmd, if an huge pmd could
  	 * materialize from under us from a different thread.
  	 */
@@ -94381,7 +94381,7 @@ index d5f913b..32583a0 100644
  		return VM_FAULT_OOM;
  	/* if an huge pmd materialized from under us just retry later */
  	if (unlikely(pmd_trans_huge(*pmd)))
-@@ -3599,6 +3846,23 @@ int __pud_alloc(struct mm_struct *mm, pgd_t *pgd, unsigned long address)
+@@ -3604,6 +3846,23 @@ int __pud_alloc(struct mm_struct *mm, pgd_t *pgd, unsigned long address)
  	spin_unlock(&mm->page_table_lock);
  	return 0;
  }
@@ -94405,7 +94405,7 @@ index d5f913b..32583a0 100644
  #endif /* __PAGETABLE_PUD_FOLDED */
  
  #ifndef __PAGETABLE_PMD_FOLDED
-@@ -3629,11 +3893,35 @@ int __pmd_alloc(struct mm_struct *mm, pud_t *pud, unsigned long address)
+@@ -3634,11 +3893,35 @@ int __pmd_alloc(struct mm_struct *mm, pud_t *pud, unsigned long address)
  	spin_unlock(&mm->page_table_lock);
  	return 0;
  }
@@ -94443,7 +94443,7 @@ index d5f913b..32583a0 100644
  	struct vm_area_struct * vma;
  
  	vma = find_vma(current->mm, addr);
-@@ -3666,7 +3954,7 @@ static int __init gate_vma_init(void)
+@@ -3671,7 +3954,7 @@ static int __init gate_vma_init(void)
  	gate_vma.vm_start = FIXADDR_USER_START;
  	gate_vma.vm_end = FIXADDR_USER_END;
  	gate_vma.vm_flags = VM_READ | VM_MAYREAD | VM_EXEC | VM_MAYEXEC;
@@ -94452,7 +94452,7 @@ index d5f913b..32583a0 100644
  	/*
  	 * Make sure the vDSO gets into every core dump.
  	 * Dumping its contents makes post-mortem fully interpretable later
-@@ -3806,8 +4094,8 @@ out:
+@@ -3811,8 +4094,8 @@ out:
  	return ret;
  }
  
@@ -94463,7 +94463,7 @@ index d5f913b..32583a0 100644
  {
  	resource_size_t phys_addr;
  	unsigned long prot = 0;
-@@ -3832,8 +4120,8 @@ int generic_access_phys(struct vm_area_struct *vma, unsigned long addr,
+@@ -3837,8 +4120,8 @@ int generic_access_phys(struct vm_area_struct *vma, unsigned long addr,
   * Access another process' address space as given in mm.  If non-NULL, use the
   * given task for page fault accounting.
   */
@@ -94474,7 +94474,7 @@ index d5f913b..32583a0 100644
  {
  	struct vm_area_struct *vma;
  	void *old_buf = buf;
-@@ -3841,7 +4129,7 @@ static int __access_remote_vm(struct task_struct *tsk, struct mm_struct *mm,
+@@ -3846,7 +4129,7 @@ static int __access_remote_vm(struct task_struct *tsk, struct mm_struct *mm,
  	down_read(&mm->mmap_sem);
  	/* ignore errors, just check how much was successfully transferred */
  	while (len) {
@@ -94483,7 +94483,7 @@ index d5f913b..32583a0 100644
  		void *maddr;
  		struct page *page = NULL;
  
-@@ -3900,8 +4188,8 @@ static int __access_remote_vm(struct task_struct *tsk, struct mm_struct *mm,
+@@ -3905,8 +4188,8 @@ static int __access_remote_vm(struct task_struct *tsk, struct mm_struct *mm,
   *
   * The caller must hold a reference on @mm.
   */
@@ -94494,7 +94494,7 @@ index d5f913b..32583a0 100644
  {
  	return __access_remote_vm(NULL, mm, addr, buf, len, write);
  }
-@@ -3911,11 +4199,11 @@ int access_remote_vm(struct mm_struct *mm, unsigned long addr,
+@@ -3916,11 +4199,11 @@ int access_remote_vm(struct mm_struct *mm, unsigned long addr,
   * Source/target buffer must be kernel space,
   * Do not walk the page table directly, use get_user_pages
   */
diff --git a/3.2.58/4425_grsec_remove_EI_PAX.patch b/3.2.59/4425_grsec_remove_EI_PAX.patch
index cf65d90..cf65d90 100644
--- a/3.2.58/4425_grsec_remove_EI_PAX.patch
+++ b/3.2.59/4425_grsec_remove_EI_PAX.patch
diff --git a/3.2.58/4427_force_XATTR_PAX_tmpfs.patch b/3.2.59/4427_force_XATTR_PAX_tmpfs.patch
index 8c7a533..8c7a533 100644
--- a/3.2.58/4427_force_XATTR_PAX_tmpfs.patch
+++ b/3.2.59/4427_force_XATTR_PAX_tmpfs.patch
diff --git a/3.2.58/4430_grsec-remove-localversion-grsec.patch b/3.2.59/4430_grsec-remove-localversion-grsec.patch
index 31cf878..31cf878 100644
--- a/3.2.58/4430_grsec-remove-localversion-grsec.patch
+++ b/3.2.59/4430_grsec-remove-localversion-grsec.patch
diff --git a/3.2.58/4435_grsec-mute-warnings.patch b/3.2.59/4435_grsec-mute-warnings.patch
index da01ac7..da01ac7 100644
--- a/3.2.58/4435_grsec-mute-warnings.patch
+++ b/3.2.59/4435_grsec-mute-warnings.patch
diff --git a/3.2.58/4440_grsec-remove-protected-paths.patch b/3.2.59/4440_grsec-remove-protected-paths.patch
index 741546d..741546d 100644
--- a/3.2.58/4440_grsec-remove-protected-paths.patch
+++ b/3.2.59/4440_grsec-remove-protected-paths.patch
diff --git a/3.2.58/4450_grsec-kconfig-default-gids.patch b/3.2.59/4450_grsec-kconfig-default-gids.patch
index d3f1d5d..d3f1d5d 100644
--- a/3.2.58/4450_grsec-kconfig-default-gids.patch
+++ b/3.2.59/4450_grsec-kconfig-default-gids.patch
diff --git a/3.2.58/4465_selinux-avc_audit-log-curr_ip.patch b/3.2.59/4465_selinux-avc_audit-log-curr_ip.patch
index ad26eba..ad26eba 100644
--- a/3.2.58/4465_selinux-avc_audit-log-curr_ip.patch
+++ b/3.2.59/4465_selinux-avc_audit-log-curr_ip.patch
diff --git a/3.2.58/4470_disable-compat_vdso.patch b/3.2.59/4470_disable-compat_vdso.patch
index f6eb9f7..f6eb9f7 100644
--- a/3.2.58/4470_disable-compat_vdso.patch
+++ b/3.2.59/4470_disable-compat_vdso.patch
diff --git a/3.2.58/4475_emutramp_default_on.patch b/3.2.59/4475_emutramp_default_on.patch
index 10a2580..10a2580 100644
--- a/3.2.58/4475_emutramp_default_on.patch
+++ b/3.2.59/4475_emutramp_default_on.patch