summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorAnthony G. Basile <blueness@gentoo.org>2015-08-11 22:13:21 -0400
committerAnthony G. Basile <blueness@gentoo.org>2015-08-11 22:13:21 -0400
commit1de11cdd8e7748bb66eca924f709d2055f64efe0 (patch)
tree7a7097d1c05ab726e674e737b5708fc4a9eeda3b
parentgrsecurity-{3.14.49,4.1.4}-201508032312 (diff)
downloadhardened-patchset-1de11cdd8e7748bb66eca924f709d2055f64efe0.tar.gz
hardened-patchset-1de11cdd8e7748bb66eca924f709d2055f64efe0.tar.bz2
hardened-patchset-1de11cdd8e7748bb66eca924f709d2055f64efe0.zip
grsecurity-{3.2.70,3.14.50,4.1.5}-20150810212920150810
-rw-r--r--3.14.49/1047_linux-3.14.48.patch1019
-rw-r--r--3.14.49/1048_linux-3.14.49.patch4039
-rw-r--r--3.14.50/0000_README (renamed from 3.14.49/0000_README)10
-rw-r--r--3.14.50/1049_linux-3.14.50.patch700
-rw-r--r--3.14.50/4420_grsecurity-3.1-3.14.50-201508102128.patch (renamed from 3.14.49/4420_grsecurity-3.1-3.14.49-201508032312.patch)381
-rw-r--r--3.14.50/4425_grsec_remove_EI_PAX.patch (renamed from 3.14.49/4425_grsec_remove_EI_PAX.patch)0
-rw-r--r--3.14.50/4427_force_XATTR_PAX_tmpfs.patch (renamed from 3.14.49/4427_force_XATTR_PAX_tmpfs.patch)0
-rw-r--r--3.14.50/4430_grsec-remove-localversion-grsec.patch (renamed from 3.14.49/4430_grsec-remove-localversion-grsec.patch)0
-rw-r--r--3.14.50/4435_grsec-mute-warnings.patch (renamed from 3.14.49/4435_grsec-mute-warnings.patch)0
-rw-r--r--3.14.50/4440_grsec-remove-protected-paths.patch (renamed from 3.14.49/4440_grsec-remove-protected-paths.patch)0
-rw-r--r--3.14.50/4450_grsec-kconfig-default-gids.patch (renamed from 3.14.49/4450_grsec-kconfig-default-gids.patch)0
-rw-r--r--3.14.50/4465_selinux-avc_audit-log-curr_ip.patch (renamed from 3.14.49/4465_selinux-avc_audit-log-curr_ip.patch)0
-rw-r--r--3.14.50/4470_disable-compat_vdso.patch (renamed from 3.14.49/4470_disable-compat_vdso.patch)0
-rw-r--r--3.14.50/4475_emutramp_default_on.patch (renamed from 3.14.49/4475_emutramp_default_on.patch)0
-rw-r--r--3.2.70/0000_README (renamed from 3.2.69/0000_README)6
-rw-r--r--3.2.70/1021_linux-3.2.22.patch (renamed from 3.2.69/1021_linux-3.2.22.patch)0
-rw-r--r--3.2.70/1022_linux-3.2.23.patch (renamed from 3.2.69/1022_linux-3.2.23.patch)0
-rw-r--r--3.2.70/1023_linux-3.2.24.patch (renamed from 3.2.69/1023_linux-3.2.24.patch)0
-rw-r--r--3.2.70/1024_linux-3.2.25.patch (renamed from 3.2.69/1024_linux-3.2.25.patch)0
-rw-r--r--3.2.70/1025_linux-3.2.26.patch (renamed from 3.2.69/1025_linux-3.2.26.patch)0
-rw-r--r--3.2.70/1026_linux-3.2.27.patch (renamed from 3.2.69/1026_linux-3.2.27.patch)0
-rw-r--r--3.2.70/1027_linux-3.2.28.patch (renamed from 3.2.69/1027_linux-3.2.28.patch)0
-rw-r--r--3.2.70/1028_linux-3.2.29.patch (renamed from 3.2.69/1028_linux-3.2.29.patch)0
-rw-r--r--3.2.70/1029_linux-3.2.30.patch (renamed from 3.2.69/1029_linux-3.2.30.patch)0
-rw-r--r--3.2.70/1030_linux-3.2.31.patch (renamed from 3.2.69/1030_linux-3.2.31.patch)0
-rw-r--r--3.2.70/1031_linux-3.2.32.patch (renamed from 3.2.69/1031_linux-3.2.32.patch)0
-rw-r--r--3.2.70/1032_linux-3.2.33.patch (renamed from 3.2.69/1032_linux-3.2.33.patch)0
-rw-r--r--3.2.70/1033_linux-3.2.34.patch (renamed from 3.2.69/1033_linux-3.2.34.patch)0
-rw-r--r--3.2.70/1034_linux-3.2.35.patch (renamed from 3.2.69/1034_linux-3.2.35.patch)0
-rw-r--r--3.2.70/1035_linux-3.2.36.patch (renamed from 3.2.69/1035_linux-3.2.36.patch)0
-rw-r--r--3.2.70/1036_linux-3.2.37.patch (renamed from 3.2.69/1036_linux-3.2.37.patch)0
-rw-r--r--3.2.70/1037_linux-3.2.38.patch (renamed from 3.2.69/1037_linux-3.2.38.patch)0
-rw-r--r--3.2.70/1038_linux-3.2.39.patch (renamed from 3.2.69/1038_linux-3.2.39.patch)0
-rw-r--r--3.2.70/1039_linux-3.2.40.patch (renamed from 3.2.69/1039_linux-3.2.40.patch)0
-rw-r--r--3.2.70/1040_linux-3.2.41.patch (renamed from 3.2.69/1040_linux-3.2.41.patch)0
-rw-r--r--3.2.70/1041_linux-3.2.42.patch (renamed from 3.2.69/1041_linux-3.2.42.patch)0
-rw-r--r--3.2.70/1042_linux-3.2.43.patch (renamed from 3.2.69/1042_linux-3.2.43.patch)0
-rw-r--r--3.2.70/1043_linux-3.2.44.patch (renamed from 3.2.69/1043_linux-3.2.44.patch)0
-rw-r--r--3.2.70/1044_linux-3.2.45.patch (renamed from 3.2.69/1044_linux-3.2.45.patch)0
-rw-r--r--3.2.70/1045_linux-3.2.46.patch (renamed from 3.2.69/1045_linux-3.2.46.patch)0
-rw-r--r--3.2.70/1046_linux-3.2.47.patch (renamed from 3.2.69/1046_linux-3.2.47.patch)0
-rw-r--r--3.2.70/1047_linux-3.2.48.patch (renamed from 3.2.69/1047_linux-3.2.48.patch)0
-rw-r--r--3.2.70/1048_linux-3.2.49.patch (renamed from 3.2.69/1048_linux-3.2.49.patch)0
-rw-r--r--3.2.70/1049_linux-3.2.50.patch (renamed from 3.2.69/1049_linux-3.2.50.patch)0
-rw-r--r--3.2.70/1050_linux-3.2.51.patch (renamed from 3.2.69/1050_linux-3.2.51.patch)0
-rw-r--r--3.2.70/1051_linux-3.2.52.patch (renamed from 3.2.69/1051_linux-3.2.52.patch)0
-rw-r--r--3.2.70/1052_linux-3.2.53.patch (renamed from 3.2.69/1052_linux-3.2.53.patch)0
-rw-r--r--3.2.70/1053_linux-3.2.54.patch (renamed from 3.2.69/1053_linux-3.2.54.patch)0
-rw-r--r--3.2.70/1054_linux-3.2.55.patch (renamed from 3.2.69/1054_linux-3.2.55.patch)0
-rw-r--r--3.2.70/1055_linux-3.2.56.patch (renamed from 3.2.69/1055_linux-3.2.56.patch)0
-rw-r--r--3.2.70/1056_linux-3.2.57.patch (renamed from 3.2.69/1056_linux-3.2.57.patch)0
-rw-r--r--3.2.70/1057_linux-3.2.58.patch (renamed from 3.2.69/1057_linux-3.2.58.patch)0
-rw-r--r--3.2.70/1058_linux-3.2.59.patch (renamed from 3.2.69/1058_linux-3.2.59.patch)0
-rw-r--r--3.2.70/1059_linux-3.2.60.patch (renamed from 3.2.69/1059_linux-3.2.60.patch)0
-rw-r--r--3.2.70/1060_linux-3.2.61.patch (renamed from 3.2.69/1060_linux-3.2.61.patch)0
-rw-r--r--3.2.70/1061_linux-3.2.62.patch (renamed from 3.2.69/1061_linux-3.2.62.patch)0
-rw-r--r--3.2.70/1062_linux-3.2.63.patch (renamed from 3.2.69/1062_linux-3.2.63.patch)0
-rw-r--r--3.2.70/1063_linux-3.2.64.patch (renamed from 3.2.69/1063_linux-3.2.64.patch)0
-rw-r--r--3.2.70/1064_linux-3.2.65.patch (renamed from 3.2.69/1064_linux-3.2.65.patch)0
-rw-r--r--3.2.70/1065_linux-3.2.66.patch (renamed from 3.2.69/1065_linux-3.2.66.patch)0
-rw-r--r--3.2.70/1066_linux-3.2.67.patch (renamed from 3.2.69/1066_linux-3.2.67.patch)0
-rw-r--r--3.2.70/1067_linux-3.2.68.patch (renamed from 3.2.69/1067_linux-3.2.68.patch)0
-rw-r--r--3.2.70/1068_linux-3.2.69.patch (renamed from 3.2.69/1068_linux-3.2.69.patch)0
-rw-r--r--3.2.70/1069_linux-3.2.70.patch5879
-rw-r--r--3.2.70/4420_grsecurity-3.1-3.2.70-201508102127.patch (renamed from 3.2.69/4420_grsecurity-3.1-3.2.69-201508020900.patch)742
-rw-r--r--3.2.70/4425_grsec_remove_EI_PAX.patch (renamed from 3.2.69/4425_grsec_remove_EI_PAX.patch)0
-rw-r--r--3.2.70/4427_force_XATTR_PAX_tmpfs.patch (renamed from 3.2.69/4427_force_XATTR_PAX_tmpfs.patch)0
-rw-r--r--3.2.70/4430_grsec-remove-localversion-grsec.patch (renamed from 3.2.69/4430_grsec-remove-localversion-grsec.patch)0
-rw-r--r--3.2.70/4435_grsec-mute-warnings.patch (renamed from 3.2.69/4435_grsec-mute-warnings.patch)0
-rw-r--r--3.2.70/4440_grsec-remove-protected-paths.patch (renamed from 3.2.69/4440_grsec-remove-protected-paths.patch)0
-rw-r--r--3.2.70/4450_grsec-kconfig-default-gids.patch (renamed from 3.2.69/4450_grsec-kconfig-default-gids.patch)0
-rw-r--r--3.2.70/4465_selinux-avc_audit-log-curr_ip.patch (renamed from 3.2.69/4465_selinux-avc_audit-log-curr_ip.patch)0
-rw-r--r--3.2.70/4470_disable-compat_vdso.patch (renamed from 3.2.69/4470_disable-compat_vdso.patch)0
-rw-r--r--3.2.70/4475_emutramp_default_on.patch (renamed from 3.2.69/4475_emutramp_default_on.patch)0
-rw-r--r--4.1.4/1003_linux-4.1.4.patch11078
-rw-r--r--4.1.5/0000_README (renamed from 4.1.4/0000_README)6
-rw-r--r--4.1.5/1004_linux-4.1.5.patch5750
-rw-r--r--4.1.5/4420_grsecurity-3.1-4.1.5-201508102129.patch (renamed from 4.1.4/4420_grsecurity-3.1-4.1.4-201508032312.patch)1460
-rw-r--r--4.1.5/4425_grsec_remove_EI_PAX.patch (renamed from 4.1.4/4425_grsec_remove_EI_PAX.patch)0
-rw-r--r--4.1.5/4427_force_XATTR_PAX_tmpfs.patch (renamed from 4.1.4/4427_force_XATTR_PAX_tmpfs.patch)0
-rw-r--r--4.1.5/4430_grsec-remove-localversion-grsec.patch (renamed from 4.1.4/4430_grsec-remove-localversion-grsec.patch)0
-rw-r--r--4.1.5/4435_grsec-mute-warnings.patch (renamed from 4.1.4/4435_grsec-mute-warnings.patch)0
-rw-r--r--4.1.5/4440_grsec-remove-protected-paths.patch (renamed from 4.1.4/4440_grsec-remove-protected-paths.patch)0
-rw-r--r--4.1.5/4450_grsec-kconfig-default-gids.patch (renamed from 4.1.4/4450_grsec-kconfig-default-gids.patch)0
-rw-r--r--4.1.5/4465_selinux-avc_audit-log-curr_ip.patch (renamed from 4.1.4/4465_selinux-avc_audit-log-curr_ip.patch)0
-rw-r--r--4.1.5/4470_disable-compat_vdso.patch (renamed from 4.1.4/4470_disable-compat_vdso.patch)0
-rw-r--r--4.1.5/4475_emutramp_default_on.patch (renamed from 4.1.4/4475_emutramp_default_on.patch)0
87 files changed, 13527 insertions, 17543 deletions
diff --git a/3.14.49/1047_linux-3.14.48.patch b/3.14.49/1047_linux-3.14.48.patch
deleted file mode 100644
index 3a7169d..0000000
--- a/3.14.49/1047_linux-3.14.48.patch
+++ /dev/null
@@ -1,1019 +0,0 @@
-diff --git a/Makefile b/Makefile
-index f9041e6..25393e8 100644
---- a/Makefile
-+++ b/Makefile
-@@ -1,6 +1,6 @@
- VERSION = 3
- PATCHLEVEL = 14
--SUBLEVEL = 47
-+SUBLEVEL = 48
- EXTRAVERSION =
- NAME = Remembering Coco
-
-diff --git a/arch/arm/include/asm/kvm_mmu.h b/arch/arm/include/asm/kvm_mmu.h
-index 9f79231..7d35af3 100644
---- a/arch/arm/include/asm/kvm_mmu.h
-+++ b/arch/arm/include/asm/kvm_mmu.h
-@@ -117,13 +117,14 @@ static inline void kvm_set_s2pmd_writable(pmd_t *pmd)
- (__boundary - 1 < (end) - 1)? __boundary: (end); \
- })
-
-+#define kvm_pgd_index(addr) pgd_index(addr)
-+
- static inline bool kvm_page_empty(void *ptr)
- {
- struct page *ptr_page = virt_to_page(ptr);
- return page_count(ptr_page) == 1;
- }
-
--
- #define kvm_pte_table_empty(ptep) kvm_page_empty(ptep)
- #define kvm_pmd_table_empty(pmdp) kvm_page_empty(pmdp)
- #define kvm_pud_table_empty(pudp) (0)
-diff --git a/arch/arm/kvm/arm.c b/arch/arm/kvm/arm.c
-index 2e74a61..f6a52a2 100644
---- a/arch/arm/kvm/arm.c
-+++ b/arch/arm/kvm/arm.c
-@@ -441,6 +441,7 @@ static void update_vttbr(struct kvm *kvm)
-
- static int kvm_vcpu_first_run_init(struct kvm_vcpu *vcpu)
- {
-+ struct kvm *kvm = vcpu->kvm;
- int ret;
-
- if (likely(vcpu->arch.has_run_once))
-@@ -452,12 +453,20 @@ static int kvm_vcpu_first_run_init(struct kvm_vcpu *vcpu)
- * Initialize the VGIC before running a vcpu the first time on
- * this VM.
- */
-- if (unlikely(!vgic_initialized(vcpu->kvm))) {
-- ret = kvm_vgic_init(vcpu->kvm);
-+ if (unlikely(!vgic_initialized(kvm))) {
-+ ret = kvm_vgic_init(kvm);
- if (ret)
- return ret;
- }
-
-+ /*
-+ * Enable the arch timers only if we have an in-kernel VGIC
-+ * and it has been properly initialized, since we cannot handle
-+ * interrupts from the virtual timer with a userspace gic.
-+ */
-+ if (irqchip_in_kernel(kvm) && vgic_initialized(kvm))
-+ kvm_timer_enable(kvm);
-+
- return 0;
- }
-
-diff --git a/arch/arm/kvm/interrupts.S b/arch/arm/kvm/interrupts.S
-index 0d68d40..a1467e7 100644
---- a/arch/arm/kvm/interrupts.S
-+++ b/arch/arm/kvm/interrupts.S
-@@ -159,13 +159,9 @@ __kvm_vcpu_return:
- @ Don't trap coprocessor accesses for host kernel
- set_hstr vmexit
- set_hdcr vmexit
-- set_hcptr vmexit, (HCPTR_TTA | HCPTR_TCP(10) | HCPTR_TCP(11))
-+ set_hcptr vmexit, (HCPTR_TTA | HCPTR_TCP(10) | HCPTR_TCP(11)), after_vfp_restore
-
- #ifdef CONFIG_VFPv3
-- @ Save floating point registers we if let guest use them.
-- tst r2, #(HCPTR_TCP(10) | HCPTR_TCP(11))
-- bne after_vfp_restore
--
- @ Switch VFP/NEON hardware state to the host's
- add r7, vcpu, #VCPU_VFP_GUEST
- store_vfp_state r7
-@@ -177,6 +173,8 @@ after_vfp_restore:
- @ Restore FPEXC_EN which we clobbered on entry
- pop {r2}
- VFPFMXR FPEXC, r2
-+#else
-+after_vfp_restore:
- #endif
-
- @ Reset Hyp-role
-@@ -467,7 +465,7 @@ switch_to_guest_vfp:
- push {r3-r7}
-
- @ NEON/VFP used. Turn on VFP access.
-- set_hcptr vmexit, (HCPTR_TCP(10) | HCPTR_TCP(11))
-+ set_hcptr vmtrap, (HCPTR_TCP(10) | HCPTR_TCP(11))
-
- @ Switch VFP/NEON hardware state to the guest's
- add r7, r0, #VCPU_VFP_HOST
-diff --git a/arch/arm/kvm/interrupts_head.S b/arch/arm/kvm/interrupts_head.S
-index 76af9302..2973b2d 100644
---- a/arch/arm/kvm/interrupts_head.S
-+++ b/arch/arm/kvm/interrupts_head.S
-@@ -578,8 +578,13 @@ vcpu .req r0 @ vcpu pointer always in r0
- .endm
-
- /* Configures the HCPTR (Hyp Coprocessor Trap Register) on entry/return
-- * (hardware reset value is 0). Keep previous value in r2. */
--.macro set_hcptr operation, mask
-+ * (hardware reset value is 0). Keep previous value in r2.
-+ * An ISB is emited on vmexit/vmtrap, but executed on vmexit only if
-+ * VFP wasn't already enabled (always executed on vmtrap).
-+ * If a label is specified with vmexit, it is branched to if VFP wasn't
-+ * enabled.
-+ */
-+.macro set_hcptr operation, mask, label = none
- mrc p15, 4, r2, c1, c1, 2
- ldr r3, =\mask
- .if \operation == vmentry
-@@ -588,6 +593,17 @@ vcpu .req r0 @ vcpu pointer always in r0
- bic r3, r2, r3 @ Don't trap defined coproc-accesses
- .endif
- mcr p15, 4, r3, c1, c1, 2
-+ .if \operation != vmentry
-+ .if \operation == vmexit
-+ tst r2, #(HCPTR_TCP(10) | HCPTR_TCP(11))
-+ beq 1f
-+ .endif
-+ isb
-+ .if \label != none
-+ b \label
-+ .endif
-+1:
-+ .endif
- .endm
-
- /* Configures the HDCR (Hyp Debug Configuration Register) on entry/return
-diff --git a/arch/arm/kvm/mmu.c b/arch/arm/kvm/mmu.c
-index 524b4b5..c612e37 100644
---- a/arch/arm/kvm/mmu.c
-+++ b/arch/arm/kvm/mmu.c
-@@ -194,7 +194,7 @@ static void unmap_range(struct kvm *kvm, pgd_t *pgdp,
- phys_addr_t addr = start, end = start + size;
- phys_addr_t next;
-
-- pgd = pgdp + pgd_index(addr);
-+ pgd = pgdp + kvm_pgd_index(addr);
- do {
- next = kvm_pgd_addr_end(addr, end);
- if (!pgd_none(*pgd))
-@@ -264,7 +264,7 @@ static void stage2_flush_memslot(struct kvm *kvm,
- phys_addr_t next;
- pgd_t *pgd;
-
-- pgd = kvm->arch.pgd + pgd_index(addr);
-+ pgd = kvm->arch.pgd + kvm_pgd_index(addr);
- do {
- next = kvm_pgd_addr_end(addr, end);
- stage2_flush_puds(kvm, pgd, addr, next);
-@@ -649,7 +649,7 @@ static pmd_t *stage2_get_pmd(struct kvm *kvm, struct kvm_mmu_memory_cache *cache
- pud_t *pud;
- pmd_t *pmd;
-
-- pgd = kvm->arch.pgd + pgd_index(addr);
-+ pgd = kvm->arch.pgd + kvm_pgd_index(addr);
- pud = pud_offset(pgd, addr);
- if (pud_none(*pud)) {
- if (!cache)
-diff --git a/arch/arm64/include/asm/kvm_emulate.h b/arch/arm64/include/asm/kvm_emulate.h
-index 681cb90..91f33c2 100644
---- a/arch/arm64/include/asm/kvm_emulate.h
-+++ b/arch/arm64/include/asm/kvm_emulate.h
-@@ -41,6 +41,8 @@ void kvm_inject_pabt(struct kvm_vcpu *vcpu, unsigned long addr);
- static inline void vcpu_reset_hcr(struct kvm_vcpu *vcpu)
- {
- vcpu->arch.hcr_el2 = HCR_GUEST_FLAGS;
-+ if (test_bit(KVM_ARM_VCPU_EL1_32BIT, vcpu->arch.features))
-+ vcpu->arch.hcr_el2 &= ~HCR_RW;
- }
-
- static inline unsigned long *vcpu_pc(const struct kvm_vcpu *vcpu)
-diff --git a/arch/arm64/include/asm/kvm_mmu.h b/arch/arm64/include/asm/kvm_mmu.h
-index 0d51874..15a8a86 100644
---- a/arch/arm64/include/asm/kvm_mmu.h
-+++ b/arch/arm64/include/asm/kvm_mmu.h
-@@ -69,6 +69,8 @@
- #define PTRS_PER_S2_PGD (1 << (KVM_PHYS_SHIFT - PGDIR_SHIFT))
- #define S2_PGD_ORDER get_order(PTRS_PER_S2_PGD * sizeof(pgd_t))
-
-+#define kvm_pgd_index(addr) (((addr) >> PGDIR_SHIFT) & (PTRS_PER_S2_PGD - 1))
-+
- int create_hyp_mappings(void *from, void *to);
- int create_hyp_io_mappings(void *from, void *to, phys_addr_t);
- void free_boot_hyp_pgd(void);
-diff --git a/arch/arm64/kvm/hyp.S b/arch/arm64/kvm/hyp.S
-index 5dfc8331..3aaf3bc 100644
---- a/arch/arm64/kvm/hyp.S
-+++ b/arch/arm64/kvm/hyp.S
-@@ -629,6 +629,7 @@ ENTRY(__kvm_tlb_flush_vmid_ipa)
- * Instead, we invalidate Stage-2 for this IPA, and the
- * whole of Stage-1. Weep...
- */
-+ lsr x1, x1, #12
- tlbi ipas2e1is, x1
- /*
- * We have to ensure completion of the invalidation at Stage-2,
-diff --git a/arch/arm64/kvm/reset.c b/arch/arm64/kvm/reset.c
-index 70a7816..0b43265 100644
---- a/arch/arm64/kvm/reset.c
-+++ b/arch/arm64/kvm/reset.c
-@@ -90,7 +90,6 @@ int kvm_reset_vcpu(struct kvm_vcpu *vcpu)
- if (!cpu_has_32bit_el1())
- return -EINVAL;
- cpu_reset = &default_regs_reset32;
-- vcpu->arch.hcr_el2 &= ~HCR_RW;
- } else {
- cpu_reset = &default_regs_reset;
- }
-diff --git a/arch/mips/include/asm/mach-generic/spaces.h b/arch/mips/include/asm/mach-generic/spaces.h
-index 9488fa5..afc96ec 100644
---- a/arch/mips/include/asm/mach-generic/spaces.h
-+++ b/arch/mips/include/asm/mach-generic/spaces.h
-@@ -94,7 +94,11 @@
- #endif
-
- #ifndef FIXADDR_TOP
-+#ifdef CONFIG_KVM_GUEST
-+#define FIXADDR_TOP ((unsigned long)(long)(int)0x7ffe0000)
-+#else
- #define FIXADDR_TOP ((unsigned long)(long)(int)0xfffe0000)
- #endif
-+#endif
-
- #endif /* __ASM_MACH_GENERIC_SPACES_H */
-diff --git a/arch/powerpc/perf/core-book3s.c b/arch/powerpc/perf/core-book3s.c
-index 38265dc..65dfbd0 100644
---- a/arch/powerpc/perf/core-book3s.c
-+++ b/arch/powerpc/perf/core-book3s.c
-@@ -124,7 +124,16 @@ static inline void power_pmu_bhrb_read(struct cpu_hw_events *cpuhw) {}
-
- static bool regs_use_siar(struct pt_regs *regs)
- {
-- return !!regs->result;
-+ /*
-+ * When we take a performance monitor exception the regs are setup
-+ * using perf_read_regs() which overloads some fields, in particular
-+ * regs->result to tell us whether to use SIAR.
-+ *
-+ * However if the regs are from another exception, eg. a syscall, then
-+ * they have not been setup using perf_read_regs() and so regs->result
-+ * is something random.
-+ */
-+ return ((TRAP(regs) == 0xf00) && regs->result);
- }
-
- /*
-diff --git a/arch/sparc/kernel/ldc.c b/arch/sparc/kernel/ldc.c
-index 27bb554..7ef2862 100644
---- a/arch/sparc/kernel/ldc.c
-+++ b/arch/sparc/kernel/ldc.c
-@@ -2307,7 +2307,7 @@ void *ldc_alloc_exp_dring(struct ldc_channel *lp, unsigned int len,
- if (len & (8UL - 1))
- return ERR_PTR(-EINVAL);
-
-- buf = kzalloc(len, GFP_KERNEL);
-+ buf = kzalloc(len, GFP_ATOMIC);
- if (!buf)
- return ERR_PTR(-ENOMEM);
-
-diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
-index 5dab54a..96e743a 100644
---- a/arch/x86/Kconfig
-+++ b/arch/x86/Kconfig
-@@ -2440,9 +2440,19 @@ config X86_DMA_REMAP
- depends on STA2X11
-
- config IOSF_MBI
-- tristate
-- default m
-+ tristate "Intel System On Chip IOSF Sideband support"
- depends on PCI
-+ ---help---
-+ Enables sideband access to mailbox registers on SoC's. The sideband is
-+ available on the following platforms. This list is not meant to be
-+ exclusive.
-+ - BayTrail
-+ - Cherryview
-+ - Braswell
-+ - Quark
-+
-+ You should say Y if you are running a kernel on one of these
-+ platforms.
-
- source "net/Kconfig"
-
-diff --git a/arch/x86/include/asm/kvm_host.h b/arch/x86/include/asm/kvm_host.h
-index e9dc029..ac03bd7 100644
---- a/arch/x86/include/asm/kvm_host.h
-+++ b/arch/x86/include/asm/kvm_host.h
-@@ -571,7 +571,7 @@ struct kvm_arch {
- struct kvm_pic *vpic;
- struct kvm_ioapic *vioapic;
- struct kvm_pit *vpit;
-- int vapics_in_nmi_mode;
-+ atomic_t vapics_in_nmi_mode;
- struct mutex apic_map_lock;
- struct kvm_apic_map *apic_map;
-
-diff --git a/arch/x86/kvm/i8254.c b/arch/x86/kvm/i8254.c
-index 298781d..1406ffd 100644
---- a/arch/x86/kvm/i8254.c
-+++ b/arch/x86/kvm/i8254.c
-@@ -305,7 +305,7 @@ static void pit_do_work(struct kthread_work *work)
- * LVT0 to NMI delivery. Other PIC interrupts are just sent to
- * VCPU0, and only if its LVT0 is in EXTINT mode.
- */
-- if (kvm->arch.vapics_in_nmi_mode > 0)
-+ if (atomic_read(&kvm->arch.vapics_in_nmi_mode) > 0)
- kvm_for_each_vcpu(i, vcpu, kvm)
- kvm_apic_nmi_wd_deliver(vcpu);
- }
-diff --git a/arch/x86/kvm/lapic.c b/arch/x86/kvm/lapic.c
-index 453e5fb..6456734 100644
---- a/arch/x86/kvm/lapic.c
-+++ b/arch/x86/kvm/lapic.c
-@@ -1109,10 +1109,10 @@ static void apic_manage_nmi_watchdog(struct kvm_lapic *apic, u32 lvt0_val)
- if (!nmi_wd_enabled) {
- apic_debug("Receive NMI setting on APIC_LVT0 "
- "for cpu %d\n", apic->vcpu->vcpu_id);
-- apic->vcpu->kvm->arch.vapics_in_nmi_mode++;
-+ atomic_inc(&apic->vcpu->kvm->arch.vapics_in_nmi_mode);
- }
- } else if (nmi_wd_enabled)
-- apic->vcpu->kvm->arch.vapics_in_nmi_mode--;
-+ atomic_dec(&apic->vcpu->kvm->arch.vapics_in_nmi_mode);
- }
-
- static int apic_reg_write(struct kvm_lapic *apic, u32 reg, u32 val)
-diff --git a/arch/x86/pci/acpi.c b/arch/x86/pci/acpi.c
-index 4f25ec0..bf00138 100644
---- a/arch/x86/pci/acpi.c
-+++ b/arch/x86/pci/acpi.c
-@@ -84,6 +84,17 @@ static const struct dmi_system_id pci_crs_quirks[] __initconst = {
- DMI_MATCH(DMI_BIOS_VENDOR, "Phoenix Technologies, LTD"),
- },
- },
-+ /* https://bugs.launchpad.net/ubuntu/+source/alsa-driver/+bug/931368 */
-+ /* https://bugs.launchpad.net/ubuntu/+source/alsa-driver/+bug/1033299 */
-+ {
-+ .callback = set_use_crs,
-+ .ident = "Foxconn K8M890-8237A",
-+ .matches = {
-+ DMI_MATCH(DMI_BOARD_VENDOR, "Foxconn"),
-+ DMI_MATCH(DMI_BOARD_NAME, "K8M890-8237A"),
-+ DMI_MATCH(DMI_BIOS_VENDOR, "Phoenix Technologies, LTD"),
-+ },
-+ },
-
- /* Now for the blacklist.. */
-
-@@ -124,8 +135,10 @@ void __init pci_acpi_crs_quirks(void)
- {
- int year;
-
-- if (dmi_get_date(DMI_BIOS_DATE, &year, NULL, NULL) && year < 2008)
-- pci_use_crs = false;
-+ if (dmi_get_date(DMI_BIOS_DATE, &year, NULL, NULL) && year < 2008) {
-+ if (iomem_resource.end <= 0xffffffff)
-+ pci_use_crs = false;
-+ }
-
- dmi_check_system(pci_crs_quirks);
-
-diff --git a/drivers/cpufreq/intel_pstate.c b/drivers/cpufreq/intel_pstate.c
-index 533a509..fbc693b 100644
---- a/drivers/cpufreq/intel_pstate.c
-+++ b/drivers/cpufreq/intel_pstate.c
-@@ -417,7 +417,7 @@ static void byt_set_pstate(struct cpudata *cpudata, int pstate)
-
- val |= vid;
-
-- wrmsrl(MSR_IA32_PERF_CTL, val);
-+ wrmsrl_on_cpu(cpudata->cpu, MSR_IA32_PERF_CTL, val);
- }
-
- #define BYT_BCLK_FREQS 5
-diff --git a/drivers/crypto/talitos.c b/drivers/crypto/talitos.c
-index 5967667..1f35487 100644
---- a/drivers/crypto/talitos.c
-+++ b/drivers/crypto/talitos.c
-@@ -927,7 +927,8 @@ static int sg_to_link_tbl(struct scatterlist *sg, int sg_count,
- sg_count--;
- link_tbl_ptr--;
- }
-- be16_add_cpu(&link_tbl_ptr->len, cryptlen);
-+ link_tbl_ptr->len = cpu_to_be16(be16_to_cpu(link_tbl_ptr->len)
-+ + cryptlen);
-
- /* tag end of link table */
- link_tbl_ptr->j_extent = DESC_PTR_LNKTBL_RETURN;
-@@ -2563,6 +2564,7 @@ static struct talitos_crypto_alg *talitos_alg_alloc(struct device *dev,
- break;
- default:
- dev_err(dev, "unknown algorithm type %d\n", t_alg->algt.type);
-+ kfree(t_alg);
- return ERR_PTR(-EINVAL);
- }
-
-diff --git a/drivers/iommu/amd_iommu.c b/drivers/iommu/amd_iommu.c
-index 9cbef59..9359740 100644
---- a/drivers/iommu/amd_iommu.c
-+++ b/drivers/iommu/amd_iommu.c
-@@ -1922,9 +1922,15 @@ static void free_pt_##LVL (unsigned long __pt) \
- pt = (u64 *)__pt; \
- \
- for (i = 0; i < 512; ++i) { \
-+ /* PTE present? */ \
- if (!IOMMU_PTE_PRESENT(pt[i])) \
- continue; \
- \
-+ /* Large PTE? */ \
-+ if (PM_PTE_LEVEL(pt[i]) == 0 || \
-+ PM_PTE_LEVEL(pt[i]) == 7) \
-+ continue; \
-+ \
- p = (unsigned long)IOMMU_PTE_PAGE(pt[i]); \
- FN(p); \
- } \
-diff --git a/drivers/net/phy/phy_device.c b/drivers/net/phy/phy_device.c
-index 25f7419..62c3fb9 100644
---- a/drivers/net/phy/phy_device.c
-+++ b/drivers/net/phy/phy_device.c
-@@ -765,10 +765,11 @@ static int genphy_config_advert(struct phy_device *phydev)
- if (phydev->supported & (SUPPORTED_1000baseT_Half |
- SUPPORTED_1000baseT_Full)) {
- adv |= ethtool_adv_to_mii_ctrl1000_t(advertise);
-- if (adv != oldadv)
-- changed = 1;
- }
-
-+ if (adv != oldadv)
-+ changed = 1;
-+
- err = phy_write(phydev, MII_CTRL1000, adv);
- if (err < 0)
- return err;
-diff --git a/fs/dcache.c b/fs/dcache.c
-index 1d7e8a3..aa24f7d 100644
---- a/fs/dcache.c
-+++ b/fs/dcache.c
-@@ -2905,17 +2905,6 @@ restart:
- vfsmnt = &mnt->mnt;
- continue;
- }
-- /*
-- * Filesystems needing to implement special "root names"
-- * should do so with ->d_dname()
-- */
-- if (IS_ROOT(dentry) &&
-- (dentry->d_name.len != 1 ||
-- dentry->d_name.name[0] != '/')) {
-- WARN(1, "Root dentry has weird name <%.*s>\n",
-- (int) dentry->d_name.len,
-- dentry->d_name.name);
-- }
- if (!error)
- error = is_mounted(vfsmnt) ? 1 : 2;
- break;
-diff --git a/fs/inode.c b/fs/inode.c
-index e846a32..644875b 100644
---- a/fs/inode.c
-+++ b/fs/inode.c
-@@ -1631,8 +1631,8 @@ int file_remove_suid(struct file *file)
- error = security_inode_killpriv(dentry);
- if (!error && killsuid)
- error = __remove_suid(dentry, killsuid);
-- if (!error && (inode->i_sb->s_flags & MS_NOSEC))
-- inode->i_flags |= S_NOSEC;
-+ if (!error)
-+ inode_has_no_xattr(inode);
-
- return error;
- }
-diff --git a/fs/namespace.c b/fs/namespace.c
-index 2faa7ea..fc99d18 100644
---- a/fs/namespace.c
-+++ b/fs/namespace.c
-@@ -3031,11 +3031,15 @@ bool fs_fully_visible(struct file_system_type *type)
- if (mnt->mnt.mnt_root != mnt->mnt.mnt_sb->s_root)
- continue;
-
-- /* This mount is not fully visible if there are any child mounts
-- * that cover anything except for empty directories.
-+ /* This mount is not fully visible if there are any
-+ * locked child mounts that cover anything except for
-+ * empty directories.
- */
- list_for_each_entry(child, &mnt->mnt_mounts, mnt_child) {
- struct inode *inode = child->mnt_mountpoint->d_inode;
-+ /* Only worry about locked mounts */
-+ if (!(mnt->mnt.mnt_flags & MNT_LOCKED))
-+ continue;
- if (!S_ISDIR(inode->i_mode))
- goto next;
- if (inode->i_nlink > 2)
-diff --git a/include/kvm/arm_arch_timer.h b/include/kvm/arm_arch_timer.h
-index 6d9aedd..327b155 100644
---- a/include/kvm/arm_arch_timer.h
-+++ b/include/kvm/arm_arch_timer.h
-@@ -60,7 +60,8 @@ struct arch_timer_cpu {
-
- #ifdef CONFIG_KVM_ARM_TIMER
- int kvm_timer_hyp_init(void);
--int kvm_timer_init(struct kvm *kvm);
-+void kvm_timer_enable(struct kvm *kvm);
-+void kvm_timer_init(struct kvm *kvm);
- void kvm_timer_vcpu_reset(struct kvm_vcpu *vcpu,
- const struct kvm_irq_level *irq);
- void kvm_timer_vcpu_init(struct kvm_vcpu *vcpu);
-@@ -73,11 +74,8 @@ static inline int kvm_timer_hyp_init(void)
- return 0;
- };
-
--static inline int kvm_timer_init(struct kvm *kvm)
--{
-- return 0;
--}
--
-+static inline void kvm_timer_enable(struct kvm *kvm) {}
-+static inline void kvm_timer_init(struct kvm *kvm) {}
- static inline void kvm_timer_vcpu_reset(struct kvm_vcpu *vcpu,
- const struct kvm_irq_level *irq) {}
- static inline void kvm_timer_vcpu_init(struct kvm_vcpu *vcpu) {}
-diff --git a/include/net/netns/sctp.h b/include/net/netns/sctp.h
-index 3573a81..8ba379f 100644
---- a/include/net/netns/sctp.h
-+++ b/include/net/netns/sctp.h
-@@ -31,6 +31,7 @@ struct netns_sctp {
- struct list_head addr_waitq;
- struct timer_list addr_wq_timer;
- struct list_head auto_asconf_splist;
-+ /* Lock that protects both addr_waitq and auto_asconf_splist */
- spinlock_t addr_wq_lock;
-
- /* Lock that protects the local_addr_list writers */
-diff --git a/include/net/sctp/structs.h b/include/net/sctp/structs.h
-index 0dfcc92..2c2d388 100644
---- a/include/net/sctp/structs.h
-+++ b/include/net/sctp/structs.h
-@@ -219,6 +219,10 @@ struct sctp_sock {
- atomic_t pd_mode;
- /* Receive to here while partial delivery is in effect. */
- struct sk_buff_head pd_lobby;
-+
-+ /* These must be the last fields, as they will skipped on copies,
-+ * like on accept and peeloff operations
-+ */
- struct list_head auto_asconf_list;
- int do_auto_asconf;
- };
-diff --git a/net/bridge/br_ioctl.c b/net/bridge/br_ioctl.c
-index a9a4a1b..8d423bc 100644
---- a/net/bridge/br_ioctl.c
-+++ b/net/bridge/br_ioctl.c
-@@ -247,9 +247,7 @@ static int old_dev_ioctl(struct net_device *dev, struct ifreq *rq, int cmd)
- if (!ns_capable(dev_net(dev)->user_ns, CAP_NET_ADMIN))
- return -EPERM;
-
-- spin_lock_bh(&br->lock);
- br_stp_set_bridge_priority(br, args[1]);
-- spin_unlock_bh(&br->lock);
- return 0;
-
- case BRCTL_SET_PORT_PRIORITY:
-diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c
-index 11a2e6c..7bbc8fe 100644
---- a/net/bridge/br_multicast.c
-+++ b/net/bridge/br_multicast.c
-@@ -1086,6 +1086,9 @@ static void br_multicast_add_router(struct net_bridge *br,
- struct net_bridge_port *p;
- struct hlist_node *slot = NULL;
-
-+ if (!hlist_unhashed(&port->rlist))
-+ return;
-+
- hlist_for_each_entry(p, &br->router_list, rlist) {
- if ((unsigned long) port >= (unsigned long) p)
- break;
-@@ -1113,12 +1116,8 @@ static void br_multicast_mark_router(struct net_bridge *br,
- if (port->multicast_router != 1)
- return;
-
-- if (!hlist_unhashed(&port->rlist))
-- goto timer;
--
- br_multicast_add_router(br, port);
-
--timer:
- mod_timer(&port->multicast_router_timer,
- now + br->multicast_querier_interval);
- }
-diff --git a/net/bridge/br_stp_if.c b/net/bridge/br_stp_if.c
-index 189ba1e..9a0005a 100644
---- a/net/bridge/br_stp_if.c
-+++ b/net/bridge/br_stp_if.c
-@@ -243,12 +243,13 @@ bool br_stp_recalculate_bridge_id(struct net_bridge *br)
- return true;
- }
-
--/* called under bridge lock */
-+/* Acquires and releases bridge lock */
- void br_stp_set_bridge_priority(struct net_bridge *br, u16 newprio)
- {
- struct net_bridge_port *p;
- int wasroot;
-
-+ spin_lock_bh(&br->lock);
- wasroot = br_is_root_bridge(br);
-
- list_for_each_entry(p, &br->port_list, list) {
-@@ -266,6 +267,7 @@ void br_stp_set_bridge_priority(struct net_bridge *br, u16 newprio)
- br_port_state_selection(br);
- if (br_is_root_bridge(br) && !wasroot)
- br_become_root_bridge(br);
-+ spin_unlock_bh(&br->lock);
- }
-
- /* called under bridge lock */
-diff --git a/net/core/neighbour.c b/net/core/neighbour.c
-index 7d95f69..0f062c6 100644
---- a/net/core/neighbour.c
-+++ b/net/core/neighbour.c
-@@ -976,6 +976,8 @@ int __neigh_event_send(struct neighbour *neigh, struct sk_buff *skb)
- rc = 0;
- if (neigh->nud_state & (NUD_CONNECTED | NUD_DELAY | NUD_PROBE))
- goto out_unlock_bh;
-+ if (neigh->dead)
-+ goto out_dead;
-
- if (!(neigh->nud_state & (NUD_STALE | NUD_INCOMPLETE))) {
- if (NEIGH_VAR(neigh->parms, MCAST_PROBES) +
-@@ -1032,6 +1034,13 @@ out_unlock_bh:
- write_unlock(&neigh->lock);
- local_bh_enable();
- return rc;
-+
-+out_dead:
-+ if (neigh->nud_state & NUD_STALE)
-+ goto out_unlock_bh;
-+ write_unlock_bh(&neigh->lock);
-+ kfree_skb(skb);
-+ return 1;
- }
- EXPORT_SYMBOL(__neigh_event_send);
-
-@@ -1095,6 +1104,8 @@ int neigh_update(struct neighbour *neigh, const u8 *lladdr, u8 new,
- if (!(flags & NEIGH_UPDATE_F_ADMIN) &&
- (old & (NUD_NOARP | NUD_PERMANENT)))
- goto out;
-+ if (neigh->dead)
-+ goto out;
-
- if (!(new & NUD_VALID)) {
- neigh_del_timer(neigh);
-@@ -1244,6 +1255,8 @@ EXPORT_SYMBOL(neigh_update);
- */
- void __neigh_set_probe_once(struct neighbour *neigh)
- {
-+ if (neigh->dead)
-+ return;
- neigh->updated = jiffies;
- if (!(neigh->nud_state & NUD_FAILED))
- return;
-diff --git a/net/core/skbuff.c b/net/core/skbuff.c
-index 69ec61a..8207f8d 100644
---- a/net/core/skbuff.c
-+++ b/net/core/skbuff.c
-@@ -368,9 +368,11 @@ refill:
- for (order = NETDEV_FRAG_PAGE_MAX_ORDER; ;) {
- gfp_t gfp = gfp_mask;
-
-- if (order)
-+ if (order) {
- gfp |= __GFP_COMP | __GFP_NOWARN |
- __GFP_NOMEMALLOC;
-+ gfp &= ~__GFP_WAIT;
-+ }
- nc->frag.page = alloc_pages(gfp, order);
- if (likely(nc->frag.page))
- break;
-diff --git a/net/core/sock.c b/net/core/sock.c
-index 650dd58..8ebfa52 100644
---- a/net/core/sock.c
-+++ b/net/core/sock.c
-@@ -1914,8 +1914,10 @@ bool skb_page_frag_refill(unsigned int sz, struct page_frag *pfrag, gfp_t prio)
- do {
- gfp_t gfp = prio;
-
-- if (order)
-+ if (order) {
- gfp |= __GFP_COMP | __GFP_NOWARN | __GFP_NORETRY;
-+ gfp &= ~__GFP_WAIT;
-+ }
- pfrag->page = alloc_pages(gfp, order);
- if (likely(pfrag->page)) {
- pfrag->offset = 0;
-diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c
-index 07bd8ed..951fe55 100644
---- a/net/ipv4/af_inet.c
-+++ b/net/ipv4/af_inet.c
-@@ -228,6 +228,8 @@ int inet_listen(struct socket *sock, int backlog)
- err = 0;
- if (err)
- goto out;
-+
-+ tcp_fastopen_init_key_once(true);
- }
- err = inet_csk_listen_start(sk, backlog);
- if (err)
-diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
-index 29d240b..dc45221 100644
---- a/net/ipv4/tcp.c
-+++ b/net/ipv4/tcp.c
-@@ -2684,10 +2684,13 @@ static int do_tcp_setsockopt(struct sock *sk, int level,
-
- case TCP_FASTOPEN:
- if (val >= 0 && ((1 << sk->sk_state) & (TCPF_CLOSE |
-- TCPF_LISTEN)))
-+ TCPF_LISTEN))) {
-+ tcp_fastopen_init_key_once(true);
-+
- err = fastopen_init_queue(sk, val);
-- else
-+ } else {
- err = -EINVAL;
-+ }
- break;
- case TCP_TIMESTAMP:
- if (!tp->repair)
-diff --git a/net/ipv4/tcp_fastopen.c b/net/ipv4/tcp_fastopen.c
-index f195d93..ee6518d 100644
---- a/net/ipv4/tcp_fastopen.c
-+++ b/net/ipv4/tcp_fastopen.c
-@@ -84,8 +84,6 @@ void tcp_fastopen_cookie_gen(__be32 src, __be32 dst,
- __be32 path[4] = { src, dst, 0, 0 };
- struct tcp_fastopen_context *ctx;
-
-- tcp_fastopen_init_key_once(true);
--
- rcu_read_lock();
- ctx = rcu_dereference(tcp_fastopen_ctx);
- if (ctx) {
-diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
-index 48b1817..84a60b8 100644
---- a/net/packet/af_packet.c
-+++ b/net/packet/af_packet.c
-@@ -1264,16 +1264,6 @@ static void packet_sock_destruct(struct sock *sk)
- sk_refcnt_debug_dec(sk);
- }
-
--static int fanout_rr_next(struct packet_fanout *f, unsigned int num)
--{
-- int x = atomic_read(&f->rr_cur) + 1;
--
-- if (x >= num)
-- x = 0;
--
-- return x;
--}
--
- static unsigned int fanout_demux_hash(struct packet_fanout *f,
- struct sk_buff *skb,
- unsigned int num)
-@@ -1285,13 +1275,9 @@ static unsigned int fanout_demux_lb(struct packet_fanout *f,
- struct sk_buff *skb,
- unsigned int num)
- {
-- int cur, old;
-+ unsigned int val = atomic_inc_return(&f->rr_cur);
-
-- cur = atomic_read(&f->rr_cur);
-- while ((old = atomic_cmpxchg(&f->rr_cur, cur,
-- fanout_rr_next(f, num))) != cur)
-- cur = old;
-- return cur;
-+ return val % num;
- }
-
- static unsigned int fanout_demux_cpu(struct packet_fanout *f,
-@@ -1345,7 +1331,7 @@ static int packet_rcv_fanout(struct sk_buff *skb, struct net_device *dev,
- struct packet_type *pt, struct net_device *orig_dev)
- {
- struct packet_fanout *f = pt->af_packet_priv;
-- unsigned int num = f->num_members;
-+ unsigned int num = ACCESS_ONCE(f->num_members);
- struct packet_sock *po;
- unsigned int idx;
-
-diff --git a/net/sctp/output.c b/net/sctp/output.c
-index 740ca5f..e39e6d5 100644
---- a/net/sctp/output.c
-+++ b/net/sctp/output.c
-@@ -599,7 +599,9 @@ out:
- return err;
- no_route:
- kfree_skb(nskb);
-- IP_INC_STATS(sock_net(asoc->base.sk), IPSTATS_MIB_OUTNOROUTES);
-+
-+ if (asoc)
-+ IP_INC_STATS(sock_net(asoc->base.sk), IPSTATS_MIB_OUTNOROUTES);
-
- /* FIXME: Returning the 'err' will effect all the associations
- * associated with a socket, although only one of the paths of the
-diff --git a/net/sctp/socket.c b/net/sctp/socket.c
-index 604a6ac..f940fdc 100644
---- a/net/sctp/socket.c
-+++ b/net/sctp/socket.c
-@@ -1532,8 +1532,10 @@ static void sctp_close(struct sock *sk, long timeout)
-
- /* Supposedly, no process has access to the socket, but
- * the net layers still may.
-+ * Also, sctp_destroy_sock() needs to be called with addr_wq_lock
-+ * held and that should be grabbed before socket lock.
- */
-- local_bh_disable();
-+ spin_lock_bh(&net->sctp.addr_wq_lock);
- bh_lock_sock(sk);
-
- /* Hold the sock, since sk_common_release() will put sock_put()
-@@ -1543,7 +1545,7 @@ static void sctp_close(struct sock *sk, long timeout)
- sk_common_release(sk);
-
- bh_unlock_sock(sk);
-- local_bh_enable();
-+ spin_unlock_bh(&net->sctp.addr_wq_lock);
-
- sock_put(sk);
-
-@@ -3511,6 +3513,7 @@ static int sctp_setsockopt_auto_asconf(struct sock *sk, char __user *optval,
- if ((val && sp->do_auto_asconf) || (!val && !sp->do_auto_asconf))
- return 0;
-
-+ spin_lock_bh(&sock_net(sk)->sctp.addr_wq_lock);
- if (val == 0 && sp->do_auto_asconf) {
- list_del(&sp->auto_asconf_list);
- sp->do_auto_asconf = 0;
-@@ -3519,6 +3522,7 @@ static int sctp_setsockopt_auto_asconf(struct sock *sk, char __user *optval,
- &sock_net(sk)->sctp.auto_asconf_splist);
- sp->do_auto_asconf = 1;
- }
-+ spin_unlock_bh(&sock_net(sk)->sctp.addr_wq_lock);
- return 0;
- }
-
-@@ -4009,18 +4013,28 @@ static int sctp_init_sock(struct sock *sk)
- local_bh_disable();
- percpu_counter_inc(&sctp_sockets_allocated);
- sock_prot_inuse_add(net, sk->sk_prot, 1);
-+
-+ /* Nothing can fail after this block, otherwise
-+ * sctp_destroy_sock() will be called without addr_wq_lock held
-+ */
- if (net->sctp.default_auto_asconf) {
-+ spin_lock(&sock_net(sk)->sctp.addr_wq_lock);
- list_add_tail(&sp->auto_asconf_list,
- &net->sctp.auto_asconf_splist);
- sp->do_auto_asconf = 1;
-- } else
-+ spin_unlock(&sock_net(sk)->sctp.addr_wq_lock);
-+ } else {
- sp->do_auto_asconf = 0;
-+ }
-+
- local_bh_enable();
-
- return 0;
- }
-
--/* Cleanup any SCTP per socket resources. */
-+/* Cleanup any SCTP per socket resources. Must be called with
-+ * sock_net(sk)->sctp.addr_wq_lock held if sp->do_auto_asconf is true
-+ */
- static void sctp_destroy_sock(struct sock *sk)
- {
- struct sctp_sock *sp;
-@@ -6973,6 +6987,19 @@ void sctp_copy_sock(struct sock *newsk, struct sock *sk,
- newinet->mc_list = NULL;
- }
-
-+static inline void sctp_copy_descendant(struct sock *sk_to,
-+ const struct sock *sk_from)
-+{
-+ int ancestor_size = sizeof(struct inet_sock) +
-+ sizeof(struct sctp_sock) -
-+ offsetof(struct sctp_sock, auto_asconf_list);
-+
-+ if (sk_from->sk_family == PF_INET6)
-+ ancestor_size += sizeof(struct ipv6_pinfo);
-+
-+ __inet_sk_copy_descendant(sk_to, sk_from, ancestor_size);
-+}
-+
- /* Populate the fields of the newsk from the oldsk and migrate the assoc
- * and its messages to the newsk.
- */
-@@ -6987,7 +7014,6 @@ static void sctp_sock_migrate(struct sock *oldsk, struct sock *newsk,
- struct sk_buff *skb, *tmp;
- struct sctp_ulpevent *event;
- struct sctp_bind_hashbucket *head;
-- struct list_head tmplist;
-
- /* Migrate socket buffer sizes and all the socket level options to the
- * new socket.
-@@ -6995,12 +7021,7 @@ static void sctp_sock_migrate(struct sock *oldsk, struct sock *newsk,
- newsk->sk_sndbuf = oldsk->sk_sndbuf;
- newsk->sk_rcvbuf = oldsk->sk_rcvbuf;
- /* Brute force copy old sctp opt. */
-- if (oldsp->do_auto_asconf) {
-- memcpy(&tmplist, &newsp->auto_asconf_list, sizeof(tmplist));
-- inet_sk_copy_descendant(newsk, oldsk);
-- memcpy(&newsp->auto_asconf_list, &tmplist, sizeof(tmplist));
-- } else
-- inet_sk_copy_descendant(newsk, oldsk);
-+ sctp_copy_descendant(newsk, oldsk);
-
- /* Restore the ep value that was overwritten with the above structure
- * copy.
-diff --git a/virt/kvm/arm/arch_timer.c b/virt/kvm/arm/arch_timer.c
-index 5081e80..c6fe405 100644
---- a/virt/kvm/arm/arch_timer.c
-+++ b/virt/kvm/arm/arch_timer.c
-@@ -61,12 +61,14 @@ static void timer_disarm(struct arch_timer_cpu *timer)
-
- static void kvm_timer_inject_irq(struct kvm_vcpu *vcpu)
- {
-+ int ret;
- struct arch_timer_cpu *timer = &vcpu->arch.timer_cpu;
-
- timer->cntv_ctl |= ARCH_TIMER_CTRL_IT_MASK;
-- kvm_vgic_inject_irq(vcpu->kvm, vcpu->vcpu_id,
-- timer->irq->irq,
-- timer->irq->level);
-+ ret = kvm_vgic_inject_irq(vcpu->kvm, vcpu->vcpu_id,
-+ timer->irq->irq,
-+ timer->irq->level);
-+ WARN_ON(ret);
- }
-
- static irqreturn_t kvm_arch_timer_handler(int irq, void *dev_id)
-@@ -307,12 +309,24 @@ void kvm_timer_vcpu_terminate(struct kvm_vcpu *vcpu)
- timer_disarm(timer);
- }
-
--int kvm_timer_init(struct kvm *kvm)
-+void kvm_timer_enable(struct kvm *kvm)
- {
-- if (timecounter && wqueue) {
-- kvm->arch.timer.cntvoff = kvm_phys_timer_read();
-+ if (kvm->arch.timer.enabled)
-+ return;
-+
-+ /*
-+ * There is a potential race here between VCPUs starting for the first
-+ * time, which may be enabling the timer multiple times. That doesn't
-+ * hurt though, because we're just setting a variable to the same
-+ * variable that it already was. The important thing is that all
-+ * VCPUs have the enabled variable set, before entering the guest, if
-+ * the arch timers are enabled.
-+ */
-+ if (timecounter && wqueue)
- kvm->arch.timer.enabled = 1;
-- }
-+}
-
-- return 0;
-+void kvm_timer_init(struct kvm *kvm)
-+{
-+ kvm->arch.timer.cntvoff = kvm_phys_timer_read();
- }
-diff --git a/virt/kvm/arm/vgic.c b/virt/kvm/arm/vgic.c
-index c324a52..152ec76 100644
---- a/virt/kvm/arm/vgic.c
-+++ b/virt/kvm/arm/vgic.c
-@@ -1042,6 +1042,7 @@ static bool vgic_queue_irq(struct kvm_vcpu *vcpu, u8 sgi_source_id, int irq)
- lr, irq, vgic_cpu->vgic_lr[lr]);
- BUG_ON(!test_bit(lr, vgic_cpu->lr_used));
- vgic_cpu->vgic_lr[lr] |= GICH_LR_PENDING_BIT;
-+ __clear_bit(lr, (unsigned long *)vgic_cpu->vgic_elrsr);
- return true;
- }
-
-@@ -1055,6 +1056,7 @@ static bool vgic_queue_irq(struct kvm_vcpu *vcpu, u8 sgi_source_id, int irq)
- vgic_cpu->vgic_lr[lr] = MK_LR_PEND(sgi_source_id, irq);
- vgic_cpu->vgic_irq_lr_map[irq] = lr;
- set_bit(lr, vgic_cpu->lr_used);
-+ __clear_bit(lr, (unsigned long *)vgic_cpu->vgic_elrsr);
-
- if (!vgic_irq_is_edge(vcpu, irq))
- vgic_cpu->vgic_lr[lr] |= GICH_LR_EOI;
-@@ -1209,6 +1211,14 @@ static bool vgic_process_maintenance(struct kvm_vcpu *vcpu)
- if (vgic_cpu->vgic_misr & GICH_MISR_U)
- vgic_cpu->vgic_hcr &= ~GICH_HCR_UIE;
-
-+ /*
-+ * In the next iterations of the vcpu loop, if we sync the vgic state
-+ * after flushing it, but before entering the guest (this happens for
-+ * pending signals and vmid rollovers), then make sure we don't pick
-+ * up any old maintenance interrupts here.
-+ */
-+ memset(vgic_cpu->vgic_eisr, 0, sizeof(vgic_cpu->vgic_eisr[0]) * 2);
-+
- return level_pending;
- }
-
diff --git a/3.14.49/1048_linux-3.14.49.patch b/3.14.49/1048_linux-3.14.49.patch
deleted file mode 100644
index a202904..0000000
--- a/3.14.49/1048_linux-3.14.49.patch
+++ /dev/null
@@ -1,4039 +0,0 @@
-diff --git a/Documentation/devicetree/bindings/pinctrl/marvell,armada-370-pinctrl.txt b/Documentation/devicetree/bindings/pinctrl/marvell,armada-370-pinctrl.txt
-index 01ef408..8faff12 100644
---- a/Documentation/devicetree/bindings/pinctrl/marvell,armada-370-pinctrl.txt
-+++ b/Documentation/devicetree/bindings/pinctrl/marvell,armada-370-pinctrl.txt
-@@ -91,5 +91,5 @@ mpp61 61 gpo, dev(wen1), uart1(txd), audio(rclk)
- mpp62 62 gpio, dev(a2), uart1(cts), tdm(drx), pcie(clkreq0),
- audio(mclk), uart0(cts)
- mpp63 63 gpo, spi0(sck), tclk
--mpp64 64 gpio, spi0(miso), spi0-1(cs1)
--mpp65 65 gpio, spi0(mosi), spi0-1(cs2)
-+mpp64 64 gpio, spi0(miso), spi0(cs1)
-+mpp65 65 gpio, spi0(mosi), spi0(cs2)
-diff --git a/Documentation/devicetree/bindings/pinctrl/marvell,armada-xp-pinctrl.txt b/Documentation/devicetree/bindings/pinctrl/marvell,armada-xp-pinctrl.txt
-index bfa0a2e..86dec67 100644
---- a/Documentation/devicetree/bindings/pinctrl/marvell,armada-xp-pinctrl.txt
-+++ b/Documentation/devicetree/bindings/pinctrl/marvell,armada-xp-pinctrl.txt
-@@ -41,15 +41,15 @@ mpp20 20 gpio, ge0(rxd4), ge1(rxd2), lcd(d20), ptp(clk)
- mpp21 21 gpio, ge0(rxd5), ge1(rxd3), lcd(d21), mem(bat)
- mpp22 22 gpio, ge0(rxd6), ge1(rxctl), lcd(d22), sata0(prsnt)
- mpp23 23 gpio, ge0(rxd7), ge1(rxclk), lcd(d23), sata1(prsnt)
--mpp24 24 gpio, lcd(hsync), sata1(prsnt), nf(bootcs-re), tdm(rst)
--mpp25 25 gpio, lcd(vsync), sata0(prsnt), nf(bootcs-we), tdm(pclk)
--mpp26 26 gpio, lcd(clk), tdm(fsync), vdd(cpu1-pd)
-+mpp24 24 gpio, lcd(hsync), sata1(prsnt), tdm(rst)
-+mpp25 25 gpio, lcd(vsync), sata0(prsnt), tdm(pclk)
-+mpp26 26 gpio, lcd(clk), tdm(fsync)
- mpp27 27 gpio, lcd(e), tdm(dtx), ptp(trig)
- mpp28 28 gpio, lcd(pwm), tdm(drx), ptp(evreq)
--mpp29 29 gpio, lcd(ref-clk), tdm(int0), ptp(clk), vdd(cpu0-pd)
-+mpp29 29 gpio, lcd(ref-clk), tdm(int0), ptp(clk)
- mpp30 30 gpio, tdm(int1), sd0(clk)
--mpp31 31 gpio, tdm(int2), sd0(cmd), vdd(cpu0-pd)
--mpp32 32 gpio, tdm(int3), sd0(d0), vdd(cpu1-pd)
-+mpp31 31 gpio, tdm(int2), sd0(cmd)
-+mpp32 32 gpio, tdm(int3), sd0(d0)
- mpp33 33 gpio, tdm(int4), sd0(d1), mem(bat)
- mpp34 34 gpio, tdm(int5), sd0(d2), sata0(prsnt)
- mpp35 35 gpio, tdm(int6), sd0(d3), sata1(prsnt)
-@@ -57,21 +57,18 @@ mpp36 36 gpio, spi(mosi)
- mpp37 37 gpio, spi(miso)
- mpp38 38 gpio, spi(sck)
- mpp39 39 gpio, spi(cs0)
--mpp40 40 gpio, spi(cs1), uart2(cts), lcd(vga-hsync), vdd(cpu1-pd),
-- pcie(clkreq0)
-+mpp40 40 gpio, spi(cs1), uart2(cts), lcd(vga-hsync), pcie(clkreq0)
- mpp41 41 gpio, spi(cs2), uart2(rts), lcd(vga-vsync), sata1(prsnt),
- pcie(clkreq1)
--mpp42 42 gpio, uart2(rxd), uart0(cts), tdm(int7), tdm-1(timer),
-- vdd(cpu0-pd)
--mpp43 43 gpio, uart2(txd), uart0(rts), spi(cs3), pcie(rstout),
-- vdd(cpu2-3-pd){1}
-+mpp42 42 gpio, uart2(rxd), uart0(cts), tdm(int7), tdm-1(timer)
-+mpp43 43 gpio, uart2(txd), uart0(rts), spi(cs3), pcie(rstout)
- mpp44 44 gpio, uart2(cts), uart3(rxd), spi(cs4), pcie(clkreq2),
- mem(bat)
- mpp45 45 gpio, uart2(rts), uart3(txd), spi(cs5), sata1(prsnt)
- mpp46 46 gpio, uart3(rts), uart1(rts), spi(cs6), sata0(prsnt)
- mpp47 47 gpio, uart3(cts), uart1(cts), spi(cs7), pcie(clkreq3),
- ref(clkout)
--mpp48 48 gpio, tclk, dev(burst/last)
-+mpp48 48 gpio, dev(clkout), dev(burst/last)
-
- * Marvell Armada XP (mv78260 and mv78460 only)
-
-@@ -83,9 +80,9 @@ mpp51 51 gpio, dev(ad16)
- mpp52 52 gpio, dev(ad17)
- mpp53 53 gpio, dev(ad18)
- mpp54 54 gpio, dev(ad19)
--mpp55 55 gpio, dev(ad20), vdd(cpu0-pd)
--mpp56 56 gpio, dev(ad21), vdd(cpu1-pd)
--mpp57 57 gpio, dev(ad22), vdd(cpu2-3-pd){1}
-+mpp55 55 gpio, dev(ad20)
-+mpp56 56 gpio, dev(ad21)
-+mpp57 57 gpio, dev(ad22)
- mpp58 58 gpio, dev(ad23)
- mpp59 59 gpio, dev(ad24)
- mpp60 60 gpio, dev(ad25)
-@@ -95,6 +92,3 @@ mpp63 63 gpio, dev(ad28)
- mpp64 64 gpio, dev(ad29)
- mpp65 65 gpio, dev(ad30)
- mpp66 66 gpio, dev(ad31)
--
--Notes:
--* {1} vdd(cpu2-3-pd) only available on mv78460.
-diff --git a/Documentation/devicetree/bindings/spi/spi_pl022.txt b/Documentation/devicetree/bindings/spi/spi_pl022.txt
-index 22ed679..4d1673c 100644
---- a/Documentation/devicetree/bindings/spi/spi_pl022.txt
-+++ b/Documentation/devicetree/bindings/spi/spi_pl022.txt
-@@ -4,9 +4,9 @@ Required properties:
- - compatible : "arm,pl022", "arm,primecell"
- - reg : Offset and length of the register set for the device
- - interrupts : Should contain SPI controller interrupt
-+- num-cs : total number of chipselects
-
- Optional properties:
--- num-cs : total number of chipselects
- - cs-gpios : should specify GPIOs used for chipselects.
- The gpios will be referred to as reg = <index> in the SPI child nodes.
- If unspecified, a single SPI device without a chip select can be used.
-diff --git a/Makefile b/Makefile
-index 25393e8..fee8460 100644
---- a/Makefile
-+++ b/Makefile
-@@ -1,6 +1,6 @@
- VERSION = 3
- PATCHLEVEL = 14
--SUBLEVEL = 48
-+SUBLEVEL = 49
- EXTRAVERSION =
- NAME = Remembering Coco
-
-diff --git a/arch/arc/include/asm/cmpxchg.h b/arch/arc/include/asm/cmpxchg.h
-index 03cd689..90de5c5 100644
---- a/arch/arc/include/asm/cmpxchg.h
-+++ b/arch/arc/include/asm/cmpxchg.h
-@@ -25,10 +25,11 @@ __cmpxchg(volatile void *ptr, unsigned long expected, unsigned long new)
- " scond %3, [%1] \n"
- " bnz 1b \n"
- "2: \n"
-- : "=&r"(prev)
-- : "r"(ptr), "ir"(expected),
-- "r"(new) /* can't be "ir". scond can't take limm for "b" */
-- : "cc");
-+ : "=&r"(prev) /* Early clobber, to prevent reg reuse */
-+ : "r"(ptr), /* Not "m": llock only supports reg direct addr mode */
-+ "ir"(expected),
-+ "r"(new) /* can't be "ir". scond can't take LIMM for "b" */
-+ : "cc", "memory"); /* so that gcc knows memory is being written here */
-
- return prev;
- }
-diff --git a/arch/arm64/kernel/vdso/Makefile b/arch/arm64/kernel/vdso/Makefile
-index a268a9a..a622dd0 100644
---- a/arch/arm64/kernel/vdso/Makefile
-+++ b/arch/arm64/kernel/vdso/Makefile
-@@ -15,6 +15,10 @@ ccflags-y := -shared -fno-common -fno-builtin
- ccflags-y += -nostdlib -Wl,-soname=linux-vdso.so.1 \
- $(call cc-ldoption, -Wl$(comma)--hash-style=sysv)
-
-+# Workaround for bare-metal (ELF) toolchains that neglect to pass -shared
-+# down to collect2, resulting in silent corruption of the vDSO image.
-+ccflags-y += -Wl,-shared
-+
- obj-y += vdso.o
- extra-y += vdso.lds vdso-offsets.h
- CPPFLAGS_vdso.lds += -P -C -U$(ARCH)
-diff --git a/arch/arm64/mm/context.c b/arch/arm64/mm/context.c
-index baa758d..76c1e6c 100644
---- a/arch/arm64/mm/context.c
-+++ b/arch/arm64/mm/context.c
-@@ -92,6 +92,14 @@ static void reset_context(void *info)
- unsigned int cpu = smp_processor_id();
- struct mm_struct *mm = current->active_mm;
-
-+ /*
-+ * current->active_mm could be init_mm for the idle thread immediately
-+ * after secondary CPU boot or hotplug. TTBR0_EL1 is already set to
-+ * the reserved value, so no need to reset any context.
-+ */
-+ if (mm == &init_mm)
-+ return;
-+
- smp_rmb();
- asid = cpu_last_asid + cpu;
-
-diff --git a/arch/arm64/mm/hugetlbpage.c b/arch/arm64/mm/hugetlbpage.c
-index 023747b..e3a24b7 100644
---- a/arch/arm64/mm/hugetlbpage.c
-+++ b/arch/arm64/mm/hugetlbpage.c
-@@ -46,13 +46,13 @@ struct page *follow_huge_addr(struct mm_struct *mm, unsigned long address,
-
- int pmd_huge(pmd_t pmd)
- {
-- return !(pmd_val(pmd) & PMD_TABLE_BIT);
-+ return pmd_val(pmd) && !(pmd_val(pmd) & PMD_TABLE_BIT);
- }
-
- int pud_huge(pud_t pud)
- {
- #ifndef __PAGETABLE_PMD_FOLDED
-- return !(pud_val(pud) & PUD_TABLE_BIT);
-+ return pud_val(pud) && !(pud_val(pud) & PUD_TABLE_BIT);
- #else
- return 0;
- #endif
-diff --git a/arch/arm64/mm/init.c b/arch/arm64/mm/init.c
-index d0b4c2e..aeb95a1 100644
---- a/arch/arm64/mm/init.c
-+++ b/arch/arm64/mm/init.c
-@@ -243,7 +243,7 @@ static void __init free_unused_memmap(void)
- * memmap entries are valid from the bank end aligned to
- * MAX_ORDER_NR_PAGES.
- */
-- prev_end = ALIGN(start + __phys_to_pfn(reg->size),
-+ prev_end = ALIGN(__phys_to_pfn(reg->base + reg->size),
- MAX_ORDER_NR_PAGES);
- }
-
-diff --git a/arch/mips/kvm/kvm_mips_emul.c b/arch/mips/kvm/kvm_mips_emul.c
-index e75ef82..c76f297 100644
---- a/arch/mips/kvm/kvm_mips_emul.c
-+++ b/arch/mips/kvm/kvm_mips_emul.c
-@@ -1626,7 +1626,7 @@ kvm_mips_complete_mmio_load(struct kvm_vcpu *vcpu, struct kvm_run *run)
- if (vcpu->mmio_needed == 2)
- *gpr = *(int16_t *) run->mmio.data;
- else
-- *gpr = *(int16_t *) run->mmio.data;
-+ *gpr = *(uint16_t *)run->mmio.data;
-
- break;
- case 1:
-diff --git a/drivers/acpi/acpica/utxfinit.c b/drivers/acpi/acpica/utxfinit.c
-index 246ef68..2c3c578 100644
---- a/drivers/acpi/acpica/utxfinit.c
-+++ b/drivers/acpi/acpica/utxfinit.c
-@@ -175,10 +175,12 @@ acpi_status __init acpi_enable_subsystem(u32 flags)
- * Obtain a permanent mapping for the FACS. This is required for the
- * Global Lock and the Firmware Waking Vector
- */
-- status = acpi_tb_initialize_facs();
-- if (ACPI_FAILURE(status)) {
-- ACPI_WARNING((AE_INFO, "Could not map the FACS table"));
-- return_ACPI_STATUS(status);
-+ if (!(flags & ACPI_NO_FACS_INIT)) {
-+ status = acpi_tb_initialize_facs();
-+ if (ACPI_FAILURE(status)) {
-+ ACPI_WARNING((AE_INFO, "Could not map the FACS table"));
-+ return_ACPI_STATUS(status);
-+ }
- }
- #endif /* !ACPI_REDUCED_HARDWARE */
-
-diff --git a/drivers/acpi/bus.c b/drivers/acpi/bus.c
-index b48aefa..60be8d0 100644
---- a/drivers/acpi/bus.c
-+++ b/drivers/acpi/bus.c
-@@ -450,6 +450,16 @@ static int __init acpi_bus_init_irq(void)
- u8 acpi_gbl_permanent_mmap;
-
-
-+/**
-+ * acpi_early_init - Initialize ACPICA and populate the ACPI namespace.
-+ *
-+ * The ACPI tables are accessible after this, but the handling of events has not
-+ * been initialized and the global lock is not available yet, so AML should not
-+ * be executed at this point.
-+ *
-+ * Doing this before switching the EFI runtime services to virtual mode allows
-+ * the EfiBootServices memory to be freed slightly earlier on boot.
-+ */
- void __init acpi_early_init(void)
- {
- acpi_status status;
-@@ -510,26 +520,42 @@ void __init acpi_early_init(void)
- acpi_gbl_FADT.sci_interrupt = acpi_sci_override_gsi;
- }
- #endif
-+ return;
-+
-+ error0:
-+ disable_acpi();
-+}
-+
-+/**
-+ * acpi_subsystem_init - Finalize the early initialization of ACPI.
-+ *
-+ * Switch over the platform to the ACPI mode (if possible), initialize the
-+ * handling of ACPI events, install the interrupt and global lock handlers.
-+ *
-+ * Doing this too early is generally unsafe, but at the same time it needs to be
-+ * done before all things that really depend on ACPI. The right spot appears to
-+ * be before finalizing the EFI initialization.
-+ */
-+void __init acpi_subsystem_init(void)
-+{
-+ acpi_status status;
-+
-+ if (acpi_disabled)
-+ return;
-
- status = acpi_enable_subsystem(~ACPI_NO_ACPI_ENABLE);
- if (ACPI_FAILURE(status)) {
- printk(KERN_ERR PREFIX "Unable to enable ACPI\n");
-- goto error0;
-+ disable_acpi();
-+ } else {
-+ /*
-+ * If the system is using ACPI then we can be reasonably
-+ * confident that any regulators are managed by the firmware
-+ * so tell the regulator core it has everything it needs to
-+ * know.
-+ */
-+ regulator_has_full_constraints();
- }
--
-- /*
-- * If the system is using ACPI then we can be reasonably
-- * confident that any regulators are managed by the firmware
-- * so tell the regulator core it has everything it needs to
-- * know.
-- */
-- regulator_has_full_constraints();
--
-- return;
--
-- error0:
-- disable_acpi();
-- return;
- }
-
- static int __init acpi_bus_init(void)
-diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
-index b1c0fcd..b0e6691 100644
---- a/drivers/ata/libata-core.c
-+++ b/drivers/ata/libata-core.c
-@@ -4173,9 +4173,10 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = {
- { "ST3320[68]13AS", "SD1[5-9]", ATA_HORKAGE_NONCQ |
- ATA_HORKAGE_FIRMWARE_WARN },
-
-- /* Seagate Momentus SpinPoint M8 seem to have FPMDA_AA issues */
-+ /* drives which fail FPDMA_AA activation (some may freeze afterwards) */
- { "ST1000LM024 HN-M101MBB", "2AR10001", ATA_HORKAGE_BROKEN_FPDMA_AA },
- { "ST1000LM024 HN-M101MBB", "2BA30001", ATA_HORKAGE_BROKEN_FPDMA_AA },
-+ { "VB0250EAVER", "HPG7", ATA_HORKAGE_BROKEN_FPDMA_AA },
-
- /* Blacklist entries taken from Silicon Image 3124/3132
- Windows driver .inf file - also several Linux problem reports */
-@@ -4229,6 +4230,9 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = {
- { "Micron_M550*", NULL, ATA_HORKAGE_NO_NCQ_TRIM, },
- { "Crucial_CT*M550SSD*", NULL, ATA_HORKAGE_NO_NCQ_TRIM, },
-
-+ /* devices that don't properly handle TRIM commands */
-+ { "SuperSSpeed S238*", NULL, ATA_HORKAGE_NOTRIM, },
-+
- /*
- * Some WD SATA-I drives spin up and down erratically when the link
- * is put into the slumber mode. We don't have full list of the
-@@ -4533,7 +4537,8 @@ static unsigned int ata_dev_set_xfermode(struct ata_device *dev)
- else /* In the ancient relic department - skip all of this */
- return 0;
-
-- err_mask = ata_exec_internal(dev, &tf, NULL, DMA_NONE, NULL, 0, 0);
-+ /* On some disks, this command causes spin-up, so we need longer timeout */
-+ err_mask = ata_exec_internal(dev, &tf, NULL, DMA_NONE, NULL, 0, 15000);
-
- DPRINTK("EXIT, err_mask=%x\n", err_mask);
- return err_mask;
-diff --git a/drivers/ata/libata-scsi.c b/drivers/ata/libata-scsi.c
-index ef8567d..6fecf0b 100644
---- a/drivers/ata/libata-scsi.c
-+++ b/drivers/ata/libata-scsi.c
-@@ -2510,7 +2510,8 @@ static unsigned int ata_scsiop_read_cap(struct ata_scsi_args *args, u8 *rbuf)
- rbuf[14] = (lowest_aligned >> 8) & 0x3f;
- rbuf[15] = lowest_aligned;
-
-- if (ata_id_has_trim(args->id)) {
-+ if (ata_id_has_trim(args->id) &&
-+ !(dev->horkage & ATA_HORKAGE_NOTRIM)) {
- rbuf[14] |= 0x80; /* TPE */
-
- if (ata_id_has_zero_after_trim(args->id))
-diff --git a/drivers/base/firmware_class.c b/drivers/base/firmware_class.c
-index 2495ee5..f0c15f9 100644
---- a/drivers/base/firmware_class.c
-+++ b/drivers/base/firmware_class.c
-@@ -544,10 +544,8 @@ static void fw_dev_release(struct device *dev)
- kfree(fw_priv);
- }
-
--static int firmware_uevent(struct device *dev, struct kobj_uevent_env *env)
-+static int do_firmware_uevent(struct firmware_priv *fw_priv, struct kobj_uevent_env *env)
- {
-- struct firmware_priv *fw_priv = to_firmware_priv(dev);
--
- if (add_uevent_var(env, "FIRMWARE=%s", fw_priv->buf->fw_id))
- return -ENOMEM;
- if (add_uevent_var(env, "TIMEOUT=%i", loading_timeout))
-@@ -558,6 +556,18 @@ static int firmware_uevent(struct device *dev, struct kobj_uevent_env *env)
- return 0;
- }
-
-+static int firmware_uevent(struct device *dev, struct kobj_uevent_env *env)
-+{
-+ struct firmware_priv *fw_priv = to_firmware_priv(dev);
-+ int err = 0;
-+
-+ mutex_lock(&fw_lock);
-+ if (fw_priv->buf)
-+ err = do_firmware_uevent(fw_priv, env);
-+ mutex_unlock(&fw_lock);
-+ return err;
-+}
-+
- static struct class firmware_class = {
- .name = "firmware",
- .class_attrs = firmware_class_attrs,
-diff --git a/drivers/base/regmap/regmap.c b/drivers/base/regmap/regmap.c
-index 2f9a3d8..58559d7 100644
---- a/drivers/base/regmap/regmap.c
-+++ b/drivers/base/regmap/regmap.c
-@@ -808,11 +808,10 @@ EXPORT_SYMBOL_GPL(devm_regmap_init);
- static void regmap_field_init(struct regmap_field *rm_field,
- struct regmap *regmap, struct reg_field reg_field)
- {
-- int field_bits = reg_field.msb - reg_field.lsb + 1;
- rm_field->regmap = regmap;
- rm_field->reg = reg_field.reg;
- rm_field->shift = reg_field.lsb;
-- rm_field->mask = ((BIT(field_bits) - 1) << reg_field.lsb);
-+ rm_field->mask = GENMASK(reg_field.msb, reg_field.lsb);
- rm_field->id_size = reg_field.id_size;
- rm_field->id_offset = reg_field.id_offset;
- }
-@@ -1947,7 +1946,7 @@ int regmap_bulk_read(struct regmap *map, unsigned int reg, void *val,
- &ival);
- if (ret != 0)
- return ret;
-- memcpy(val + (i * val_bytes), &ival, val_bytes);
-+ map->format.format_val(val + (i * val_bytes), ival, 0);
- }
- }
-
-diff --git a/drivers/block/rbd.c b/drivers/block/rbd.c
-index 63688d3..12be7cb 100644
---- a/drivers/block/rbd.c
-+++ b/drivers/block/rbd.c
-@@ -1826,11 +1826,11 @@ static struct rbd_obj_request *rbd_obj_request_create(const char *object_name,
- rbd_assert(obj_request_type_valid(type));
-
- size = strlen(object_name) + 1;
-- name = kmalloc(size, GFP_KERNEL);
-+ name = kmalloc(size, GFP_NOIO);
- if (!name)
- return NULL;
-
-- obj_request = kmem_cache_zalloc(rbd_obj_request_cache, GFP_KERNEL);
-+ obj_request = kmem_cache_zalloc(rbd_obj_request_cache, GFP_NOIO);
- if (!obj_request) {
- kfree(name);
- return NULL;
-diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
-index c0e7a9aa9..c23658e 100644
---- a/drivers/bluetooth/btusb.c
-+++ b/drivers/bluetooth/btusb.c
-@@ -1293,6 +1293,8 @@ static int btusb_setup_intel(struct hci_dev *hdev)
- }
- fw_ptr = fw->data;
-
-+ kfree_skb(skb);
-+
- /* This Intel specific command enables the manufacturer mode of the
- * controller.
- *
-diff --git a/drivers/char/agp/intel-gtt.c b/drivers/char/agp/intel-gtt.c
-index 5c85350..19e301f 100644
---- a/drivers/char/agp/intel-gtt.c
-+++ b/drivers/char/agp/intel-gtt.c
-@@ -586,7 +586,7 @@ static inline int needs_ilk_vtd_wa(void)
- /* Query intel_iommu to see if we need the workaround. Presumably that
- * was loaded first.
- */
-- if ((gpu_devid == PCI_DEVICE_ID_INTEL_IRONLAKE_M_HB ||
-+ if ((gpu_devid == PCI_DEVICE_ID_INTEL_IRONLAKE_D_IG ||
- gpu_devid == PCI_DEVICE_ID_INTEL_IRONLAKE_M_IG) &&
- intel_iommu_gfx_mapped)
- return 1;
-diff --git a/drivers/char/tpm/tpm_ibmvtpm.c b/drivers/char/tpm/tpm_ibmvtpm.c
-index 102463ba..643bba7 100644
---- a/drivers/char/tpm/tpm_ibmvtpm.c
-+++ b/drivers/char/tpm/tpm_ibmvtpm.c
-@@ -579,6 +579,9 @@ static int tpm_ibmvtpm_probe(struct vio_dev *vio_dev,
- goto cleanup;
- }
-
-+ ibmvtpm->dev = dev;
-+ ibmvtpm->vdev = vio_dev;
-+
- crq_q = &ibmvtpm->crq_queue;
- crq_q->crq_addr = (struct ibmvtpm_crq *)get_zeroed_page(GFP_KERNEL);
- if (!crq_q->crq_addr) {
-@@ -623,8 +626,6 @@ static int tpm_ibmvtpm_probe(struct vio_dev *vio_dev,
-
- crq_q->index = 0;
-
-- ibmvtpm->dev = dev;
-- ibmvtpm->vdev = vio_dev;
- TPM_VPRIV(chip) = (void *)ibmvtpm;
-
- spin_lock_init(&ibmvtpm->rtce_lock);
-diff --git a/drivers/clocksource/exynos_mct.c b/drivers/clocksource/exynos_mct.c
-index 831b482..ddd03f8 100644
---- a/drivers/clocksource/exynos_mct.c
-+++ b/drivers/clocksource/exynos_mct.c
-@@ -422,15 +422,12 @@ static int exynos4_local_timer_setup(struct clock_event_device *evt)
- exynos4_mct_write(TICK_BASE_CNT, mevt->base + MCT_L_TCNTB_OFFSET);
-
- if (mct_int_type == MCT_INT_SPI) {
-- evt->irq = mct_irqs[MCT_L0_IRQ + cpu];
-- if (request_irq(evt->irq, exynos4_mct_tick_isr,
-- IRQF_TIMER | IRQF_NOBALANCING,
-- evt->name, mevt)) {
-- pr_err("exynos-mct: cannot register IRQ %d\n",
-- evt->irq);
-+
-+ if (evt->irq == -1)
- return -EIO;
-- }
-- irq_force_affinity(mct_irqs[MCT_L0_IRQ + cpu], cpumask_of(cpu));
-+
-+ irq_force_affinity(evt->irq, cpumask_of(cpu));
-+ enable_irq(evt->irq);
- } else {
- enable_percpu_irq(mct_irqs[MCT_L0_IRQ], 0);
- }
-@@ -443,10 +440,12 @@ static int exynos4_local_timer_setup(struct clock_event_device *evt)
- static void exynos4_local_timer_stop(struct clock_event_device *evt)
- {
- evt->set_mode(CLOCK_EVT_MODE_UNUSED, evt);
-- if (mct_int_type == MCT_INT_SPI)
-- free_irq(evt->irq, this_cpu_ptr(&percpu_mct_tick));
-- else
-+ if (mct_int_type == MCT_INT_SPI) {
-+ if (evt->irq != -1)
-+ disable_irq_nosync(evt->irq);
-+ } else {
- disable_percpu_irq(mct_irqs[MCT_L0_IRQ]);
-+ }
- }
-
- static int exynos4_mct_cpu_notify(struct notifier_block *self,
-@@ -478,7 +477,7 @@ static struct notifier_block exynos4_mct_cpu_nb = {
-
- static void __init exynos4_timer_resources(struct device_node *np, void __iomem *base)
- {
-- int err;
-+ int err, cpu;
- struct mct_clock_event_device *mevt = this_cpu_ptr(&percpu_mct_tick);
- struct clk *mct_clk, *tick_clk;
-
-@@ -505,7 +504,25 @@ static void __init exynos4_timer_resources(struct device_node *np, void __iomem
- WARN(err, "MCT: can't request IRQ %d (%d)\n",
- mct_irqs[MCT_L0_IRQ], err);
- } else {
-- irq_set_affinity(mct_irqs[MCT_L0_IRQ], cpumask_of(0));
-+ for_each_possible_cpu(cpu) {
-+ int mct_irq = mct_irqs[MCT_L0_IRQ + cpu];
-+ struct mct_clock_event_device *pcpu_mevt =
-+ per_cpu_ptr(&percpu_mct_tick, cpu);
-+
-+ pcpu_mevt->evt.irq = -1;
-+
-+ irq_set_status_flags(mct_irq, IRQ_NOAUTOEN);
-+ if (request_irq(mct_irq,
-+ exynos4_mct_tick_isr,
-+ IRQF_TIMER | IRQF_NOBALANCING,
-+ pcpu_mevt->name, pcpu_mevt)) {
-+ pr_err("exynos-mct: cannot register IRQ (cpu%d)\n",
-+ cpu);
-+
-+ continue;
-+ }
-+ pcpu_mevt->evt.irq = mct_irq;
-+ }
- }
-
- err = register_cpu_notifier(&exynos4_mct_cpu_nb);
-diff --git a/drivers/cpuidle/cpuidle.c b/drivers/cpuidle/cpuidle.c
-index e3d2052..1adc039 100644
---- a/drivers/cpuidle/cpuidle.c
-+++ b/drivers/cpuidle/cpuidle.c
-@@ -131,6 +131,9 @@ int cpuidle_idle_call(void)
-
- /* ask the governor for the next state */
- next_state = cpuidle_curr_governor->select(drv, dev);
-+ if (next_state < 0)
-+ return -EBUSY;
-+
- if (need_resched()) {
- dev->last_residency = 0;
- /* give the governor an opportunity to reflect on the outcome */
-diff --git a/drivers/cpuidle/governors/menu.c b/drivers/cpuidle/governors/menu.c
-index cf7f2f0..027c484 100644
---- a/drivers/cpuidle/governors/menu.c
-+++ b/drivers/cpuidle/governors/menu.c
-@@ -297,7 +297,7 @@ static int menu_select(struct cpuidle_driver *drv, struct cpuidle_device *dev)
- data->needs_update = 0;
- }
-
-- data->last_state_idx = 0;
-+ data->last_state_idx = CPUIDLE_DRIVER_STATE_START - 1;
- data->exit_us = 0;
-
- /* Special case when user has set very strict latency requirement */
-diff --git a/drivers/dma/mv_xor.c b/drivers/dma/mv_xor.c
-index 394cbc5..6b2f01d 100644
---- a/drivers/dma/mv_xor.c
-+++ b/drivers/dma/mv_xor.c
-@@ -316,7 +316,8 @@ static void __mv_xor_slot_cleanup(struct mv_xor_chan *mv_chan)
- dma_cookie_t cookie = 0;
- int busy = mv_chan_is_busy(mv_chan);
- u32 current_desc = mv_chan_get_current_desc(mv_chan);
-- int seen_current = 0;
-+ int current_cleaned = 0;
-+ struct mv_xor_desc *hw_desc;
-
- dev_dbg(mv_chan_to_devp(mv_chan), "%s %d\n", __func__, __LINE__);
- dev_dbg(mv_chan_to_devp(mv_chan), "current_desc %x\n", current_desc);
-@@ -328,38 +329,57 @@ static void __mv_xor_slot_cleanup(struct mv_xor_chan *mv_chan)
-
- list_for_each_entry_safe(iter, _iter, &mv_chan->chain,
- chain_node) {
-- prefetch(_iter);
-- prefetch(&_iter->async_tx);
-
-- /* do not advance past the current descriptor loaded into the
-- * hardware channel, subsequent descriptors are either in
-- * process or have not been submitted
-- */
-- if (seen_current)
-- break;
-+ /* clean finished descriptors */
-+ hw_desc = iter->hw_desc;
-+ if (hw_desc->status & XOR_DESC_SUCCESS) {
-+ cookie = mv_xor_run_tx_complete_actions(iter, mv_chan,
-+ cookie);
-
-- /* stop the search if we reach the current descriptor and the
-- * channel is busy
-- */
-- if (iter->async_tx.phys == current_desc) {
-- seen_current = 1;
-- if (busy)
-+ /* done processing desc, clean slot */
-+ mv_xor_clean_slot(iter, mv_chan);
-+
-+ /* break if we did cleaned the current */
-+ if (iter->async_tx.phys == current_desc) {
-+ current_cleaned = 1;
-+ break;
-+ }
-+ } else {
-+ if (iter->async_tx.phys == current_desc) {
-+ current_cleaned = 0;
- break;
-+ }
- }
--
-- cookie = mv_xor_run_tx_complete_actions(iter, mv_chan, cookie);
--
-- if (mv_xor_clean_slot(iter, mv_chan))
-- break;
- }
-
- if ((busy == 0) && !list_empty(&mv_chan->chain)) {
-- struct mv_xor_desc_slot *chain_head;
-- chain_head = list_entry(mv_chan->chain.next,
-- struct mv_xor_desc_slot,
-- chain_node);
--
-- mv_xor_start_new_chain(mv_chan, chain_head);
-+ if (current_cleaned) {
-+ /*
-+ * current descriptor cleaned and removed, run
-+ * from list head
-+ */
-+ iter = list_entry(mv_chan->chain.next,
-+ struct mv_xor_desc_slot,
-+ chain_node);
-+ mv_xor_start_new_chain(mv_chan, iter);
-+ } else {
-+ if (!list_is_last(&iter->chain_node, &mv_chan->chain)) {
-+ /*
-+ * descriptors are still waiting after
-+ * current, trigger them
-+ */
-+ iter = list_entry(iter->chain_node.next,
-+ struct mv_xor_desc_slot,
-+ chain_node);
-+ mv_xor_start_new_chain(mv_chan, iter);
-+ } else {
-+ /*
-+ * some descriptors are still waiting
-+ * to be cleaned
-+ */
-+ tasklet_schedule(&mv_chan->irq_tasklet);
-+ }
-+ }
- }
-
- if (cookie > 0)
-diff --git a/drivers/dma/mv_xor.h b/drivers/dma/mv_xor.h
-index d074922..5d14e4b 100644
---- a/drivers/dma/mv_xor.h
-+++ b/drivers/dma/mv_xor.h
-@@ -33,6 +33,7 @@
- #define XOR_OPERATION_MODE_XOR 0
- #define XOR_OPERATION_MODE_MEMCPY 2
- #define XOR_DESCRIPTOR_SWAP BIT(14)
-+#define XOR_DESC_SUCCESS 0x40000000
-
- #define XOR_CURR_DESC(chan) (chan->mmr_high_base + 0x10 + (chan->idx * 4))
- #define XOR_NEXT_DESC(chan) (chan->mmr_high_base + 0x00 + (chan->idx * 4))
-diff --git a/drivers/gpu/drm/drm_crtc.c b/drivers/gpu/drm/drm_crtc.c
-index 3b7d32d..903db3c 100644
---- a/drivers/gpu/drm/drm_crtc.c
-+++ b/drivers/gpu/drm/drm_crtc.c
-@@ -2155,8 +2155,11 @@ int drm_mode_setcrtc(struct drm_device *dev, void *data,
- if (!drm_core_check_feature(dev, DRIVER_MODESET))
- return -EINVAL;
-
-- /* For some reason crtc x/y offsets are signed internally. */
-- if (crtc_req->x > INT_MAX || crtc_req->y > INT_MAX)
-+ /*
-+ * Universal plane src offsets are only 16.16, prevent havoc for
-+ * drivers using universal plane code internally.
-+ */
-+ if (crtc_req->x & 0xffff0000 || crtc_req->y & 0xffff0000)
- return -ERANGE;
-
- drm_modeset_lock_all(dev);
-diff --git a/drivers/gpu/drm/qxl/qxl_cmd.c b/drivers/gpu/drm/qxl/qxl_cmd.c
-index eb89653..c5e96a3 100644
---- a/drivers/gpu/drm/qxl/qxl_cmd.c
-+++ b/drivers/gpu/drm/qxl/qxl_cmd.c
-@@ -505,6 +505,7 @@ int qxl_hw_surface_alloc(struct qxl_device *qdev,
-
- cmd = (struct qxl_surface_cmd *)qxl_release_map(qdev, release);
- cmd->type = QXL_SURFACE_CMD_CREATE;
-+ cmd->flags = QXL_SURF_FLAG_KEEP_DATA;
- cmd->u.surface_create.format = surf->surf.format;
- cmd->u.surface_create.width = surf->surf.width;
- cmd->u.surface_create.height = surf->surf.height;
-diff --git a/drivers/gpu/drm/qxl/qxl_ioctl.c b/drivers/gpu/drm/qxl/qxl_ioctl.c
-index 0bb86e6..56a13a9 100644
---- a/drivers/gpu/drm/qxl/qxl_ioctl.c
-+++ b/drivers/gpu/drm/qxl/qxl_ioctl.c
-@@ -122,8 +122,10 @@ static struct qxl_bo *qxlhw_handle_to_bo(struct qxl_device *qdev,
- qobj = gem_to_qxl_bo(gobj);
-
- ret = qxl_release_list_add(release, qobj);
-- if (ret)
-+ if (ret) {
-+ drm_gem_object_unreference_unlocked(gobj);
- return NULL;
-+ }
-
- return qobj;
- }
-diff --git a/drivers/gpu/drm/radeon/cik.c b/drivers/gpu/drm/radeon/cik.c
-index c4558bd..2fd2fb3 100644
---- a/drivers/gpu/drm/radeon/cik.c
-+++ b/drivers/gpu/drm/radeon/cik.c
-@@ -4148,6 +4148,31 @@ void cik_compute_set_wptr(struct radeon_device *rdev,
- WDOORBELL32(ring->doorbell_index, ring->wptr);
- }
-
-+static void cik_compute_stop(struct radeon_device *rdev,
-+ struct radeon_ring *ring)
-+{
-+ u32 j, tmp;
-+
-+ cik_srbm_select(rdev, ring->me, ring->pipe, ring->queue, 0);
-+ /* Disable wptr polling. */
-+ tmp = RREG32(CP_PQ_WPTR_POLL_CNTL);
-+ tmp &= ~WPTR_POLL_EN;
-+ WREG32(CP_PQ_WPTR_POLL_CNTL, tmp);
-+ /* Disable HQD. */
-+ if (RREG32(CP_HQD_ACTIVE) & 1) {
-+ WREG32(CP_HQD_DEQUEUE_REQUEST, 1);
-+ for (j = 0; j < rdev->usec_timeout; j++) {
-+ if (!(RREG32(CP_HQD_ACTIVE) & 1))
-+ break;
-+ udelay(1);
-+ }
-+ WREG32(CP_HQD_DEQUEUE_REQUEST, 0);
-+ WREG32(CP_HQD_PQ_RPTR, 0);
-+ WREG32(CP_HQD_PQ_WPTR, 0);
-+ }
-+ cik_srbm_select(rdev, 0, 0, 0, 0);
-+}
-+
- /**
- * cik_cp_compute_enable - enable/disable the compute CP MEs
- *
-@@ -4161,6 +4186,15 @@ static void cik_cp_compute_enable(struct radeon_device *rdev, bool enable)
- if (enable)
- WREG32(CP_MEC_CNTL, 0);
- else {
-+ /*
-+ * To make hibernation reliable we need to clear compute ring
-+ * configuration before halting the compute ring.
-+ */
-+ mutex_lock(&rdev->srbm_mutex);
-+ cik_compute_stop(rdev,&rdev->ring[CAYMAN_RING_TYPE_CP1_INDEX]);
-+ cik_compute_stop(rdev,&rdev->ring[CAYMAN_RING_TYPE_CP2_INDEX]);
-+ mutex_unlock(&rdev->srbm_mutex);
-+
- WREG32(CP_MEC_CNTL, (MEC_ME1_HALT | MEC_ME2_HALT));
- rdev->ring[CAYMAN_RING_TYPE_CP1_INDEX].ready = false;
- rdev->ring[CAYMAN_RING_TYPE_CP2_INDEX].ready = false;
-diff --git a/drivers/gpu/drm/radeon/cik_sdma.c b/drivers/gpu/drm/radeon/cik_sdma.c
-index 66ba713..e590aec 100644
---- a/drivers/gpu/drm/radeon/cik_sdma.c
-+++ b/drivers/gpu/drm/radeon/cik_sdma.c
-@@ -266,6 +266,17 @@ static void cik_sdma_gfx_stop(struct radeon_device *rdev)
- }
- rdev->ring[R600_RING_TYPE_DMA_INDEX].ready = false;
- rdev->ring[CAYMAN_RING_TYPE_DMA1_INDEX].ready = false;
-+
-+ /* FIXME use something else than big hammer but after few days can not
-+ * seem to find good combination so reset SDMA blocks as it seems we
-+ * do not shut them down properly. This fix hibernation and does not
-+ * affect suspend to ram.
-+ */
-+ WREG32(SRBM_SOFT_RESET, SOFT_RESET_SDMA | SOFT_RESET_SDMA1);
-+ (void)RREG32(SRBM_SOFT_RESET);
-+ udelay(50);
-+ WREG32(SRBM_SOFT_RESET, 0);
-+ (void)RREG32(SRBM_SOFT_RESET);
- }
-
- /**
-diff --git a/drivers/gpu/drm/radeon/radeon_gart.c b/drivers/gpu/drm/radeon/radeon_gart.c
-index a8f9b46..e609722 100644
---- a/drivers/gpu/drm/radeon/radeon_gart.c
-+++ b/drivers/gpu/drm/radeon/radeon_gart.c
-@@ -251,8 +251,10 @@ void radeon_gart_unbind(struct radeon_device *rdev, unsigned offset,
- }
- }
- }
-- mb();
-- radeon_gart_tlb_flush(rdev);
-+ if (rdev->gart.ptr) {
-+ mb();
-+ radeon_gart_tlb_flush(rdev);
-+ }
- }
-
- /**
-@@ -294,8 +296,10 @@ int radeon_gart_bind(struct radeon_device *rdev, unsigned offset,
- }
- }
- }
-- mb();
-- radeon_gart_tlb_flush(rdev);
-+ if (rdev->gart.ptr) {
-+ mb();
-+ radeon_gart_tlb_flush(rdev);
-+ }
- return 0;
- }
-
-diff --git a/drivers/gpu/drm/radeon/radeon_irq_kms.c b/drivers/gpu/drm/radeon/radeon_irq_kms.c
-index b3f0293..f8b20e1 100644
---- a/drivers/gpu/drm/radeon/radeon_irq_kms.c
-+++ b/drivers/gpu/drm/radeon/radeon_irq_kms.c
-@@ -79,10 +79,12 @@ static void radeon_hotplug_work_func(struct work_struct *work)
- struct drm_mode_config *mode_config = &dev->mode_config;
- struct drm_connector *connector;
-
-+ mutex_lock(&mode_config->mutex);
- if (mode_config->num_connector) {
- list_for_each_entry(connector, &mode_config->connector_list, head)
- radeon_connector_hotplug(connector);
- }
-+ mutex_unlock(&mode_config->mutex);
- /* Just fire off a uevent and let userspace tell us what to do */
- drm_helper_hpd_irq_event(dev);
- }
-diff --git a/drivers/gpu/drm/radeon/si_dpm.c b/drivers/gpu/drm/radeon/si_dpm.c
-index 11804cc..c9053f7 100644
---- a/drivers/gpu/drm/radeon/si_dpm.c
-+++ b/drivers/gpu/drm/radeon/si_dpm.c
-@@ -2914,6 +2914,7 @@ static struct si_dpm_quirk si_dpm_quirk_list[] = {
- /* PITCAIRN - https://bugs.freedesktop.org/show_bug.cgi?id=76490 */
- { PCI_VENDOR_ID_ATI, 0x6810, 0x1462, 0x3036, 0, 120000 },
- { PCI_VENDOR_ID_ATI, 0x6811, 0x174b, 0xe271, 0, 120000 },
-+ { PCI_VENDOR_ID_ATI, 0x6810, 0x174b, 0xe271, 85000, 90000 },
- { 0, 0, 0, 0 },
- };
-
-diff --git a/drivers/hwmon/mcp3021.c b/drivers/hwmon/mcp3021.c
-index d219c06..972444a 100644
---- a/drivers/hwmon/mcp3021.c
-+++ b/drivers/hwmon/mcp3021.c
-@@ -31,14 +31,11 @@
- /* output format */
- #define MCP3021_SAR_SHIFT 2
- #define MCP3021_SAR_MASK 0x3ff
--
- #define MCP3021_OUTPUT_RES 10 /* 10-bit resolution */
--#define MCP3021_OUTPUT_SCALE 4
-
- #define MCP3221_SAR_SHIFT 0
- #define MCP3221_SAR_MASK 0xfff
- #define MCP3221_OUTPUT_RES 12 /* 12-bit resolution */
--#define MCP3221_OUTPUT_SCALE 1
-
- enum chips {
- mcp3021,
-@@ -54,7 +51,6 @@ struct mcp3021_data {
- u16 sar_shift;
- u16 sar_mask;
- u8 output_res;
-- u8 output_scale;
- };
-
- static int mcp3021_read16(struct i2c_client *client)
-@@ -84,13 +80,7 @@ static int mcp3021_read16(struct i2c_client *client)
-
- static inline u16 volts_from_reg(struct mcp3021_data *data, u16 val)
- {
-- if (val == 0)
-- return 0;
--
-- val = val * data->output_scale - data->output_scale / 2;
--
-- return val * DIV_ROUND_CLOSEST(data->vdd,
-- (1 << data->output_res) * data->output_scale);
-+ return DIV_ROUND_CLOSEST(data->vdd * val, 1 << data->output_res);
- }
-
- static ssize_t show_in_input(struct device *dev, struct device_attribute *attr,
-@@ -132,14 +122,12 @@ static int mcp3021_probe(struct i2c_client *client,
- data->sar_shift = MCP3021_SAR_SHIFT;
- data->sar_mask = MCP3021_SAR_MASK;
- data->output_res = MCP3021_OUTPUT_RES;
-- data->output_scale = MCP3021_OUTPUT_SCALE;
- break;
-
- case mcp3221:
- data->sar_shift = MCP3221_SAR_SHIFT;
- data->sar_mask = MCP3221_SAR_MASK;
- data->output_res = MCP3221_OUTPUT_RES;
-- data->output_scale = MCP3221_OUTPUT_SCALE;
- break;
- }
-
-diff --git a/drivers/i2c/busses/i2c-at91.c b/drivers/i2c/busses/i2c-at91.c
-index 8873d84..50862c9 100644
---- a/drivers/i2c/busses/i2c-at91.c
-+++ b/drivers/i2c/busses/i2c-at91.c
-@@ -62,6 +62,9 @@
- #define AT91_TWI_UNRE 0x0080 /* Underrun Error */
- #define AT91_TWI_NACK 0x0100 /* Not Acknowledged */
-
-+#define AT91_TWI_INT_MASK \
-+ (AT91_TWI_TXCOMP | AT91_TWI_RXRDY | AT91_TWI_TXRDY | AT91_TWI_NACK)
-+
- #define AT91_TWI_IER 0x0024 /* Interrupt Enable Register */
- #define AT91_TWI_IDR 0x0028 /* Interrupt Disable Register */
- #define AT91_TWI_IMR 0x002c /* Interrupt Mask Register */
-@@ -117,13 +120,12 @@ static void at91_twi_write(struct at91_twi_dev *dev, unsigned reg, unsigned val)
-
- static void at91_disable_twi_interrupts(struct at91_twi_dev *dev)
- {
-- at91_twi_write(dev, AT91_TWI_IDR,
-- AT91_TWI_TXCOMP | AT91_TWI_RXRDY | AT91_TWI_TXRDY);
-+ at91_twi_write(dev, AT91_TWI_IDR, AT91_TWI_INT_MASK);
- }
-
- static void at91_twi_irq_save(struct at91_twi_dev *dev)
- {
-- dev->imr = at91_twi_read(dev, AT91_TWI_IMR) & 0x7;
-+ dev->imr = at91_twi_read(dev, AT91_TWI_IMR) & AT91_TWI_INT_MASK;
- at91_disable_twi_interrupts(dev);
- }
-
-@@ -213,6 +215,14 @@ static void at91_twi_write_data_dma_callback(void *data)
- dma_unmap_single(dev->dev, sg_dma_address(&dev->dma.sg),
- dev->buf_len, DMA_TO_DEVICE);
-
-+ /*
-+ * When this callback is called, THR/TX FIFO is likely not to be empty
-+ * yet. So we have to wait for TXCOMP or NACK bits to be set into the
-+ * Status Register to be sure that the STOP bit has been sent and the
-+ * transfer is completed. The NACK interrupt has already been enabled,
-+ * we just have to enable TXCOMP one.
-+ */
-+ at91_twi_write(dev, AT91_TWI_IER, AT91_TWI_TXCOMP);
- at91_twi_write(dev, AT91_TWI_CR, AT91_TWI_STOP);
- }
-
-@@ -307,7 +317,7 @@ static void at91_twi_read_data_dma_callback(void *data)
- /* The last two bytes have to be read without using dma */
- dev->buf += dev->buf_len - 2;
- dev->buf_len = 2;
-- at91_twi_write(dev, AT91_TWI_IER, AT91_TWI_RXRDY);
-+ at91_twi_write(dev, AT91_TWI_IER, AT91_TWI_RXRDY | AT91_TWI_TXCOMP);
- }
-
- static void at91_twi_read_data_dma(struct at91_twi_dev *dev)
-@@ -368,7 +378,7 @@ static irqreturn_t atmel_twi_interrupt(int irq, void *dev_id)
- /* catch error flags */
- dev->transfer_status |= status;
-
-- if (irqstatus & AT91_TWI_TXCOMP) {
-+ if (irqstatus & (AT91_TWI_TXCOMP | AT91_TWI_NACK)) {
- at91_disable_twi_interrupts(dev);
- complete(&dev->cmd_complete);
- }
-@@ -381,6 +391,34 @@ static int at91_do_twi_transfer(struct at91_twi_dev *dev)
- int ret;
- bool has_unre_flag = dev->pdata->has_unre_flag;
-
-+ /*
-+ * WARNING: the TXCOMP bit in the Status Register is NOT a clear on
-+ * read flag but shows the state of the transmission at the time the
-+ * Status Register is read. According to the programmer datasheet,
-+ * TXCOMP is set when both holding register and internal shifter are
-+ * empty and STOP condition has been sent.
-+ * Consequently, we should enable NACK interrupt rather than TXCOMP to
-+ * detect transmission failure.
-+ *
-+ * Besides, the TXCOMP bit is already set before the i2c transaction
-+ * has been started. For read transactions, this bit is cleared when
-+ * writing the START bit into the Control Register. So the
-+ * corresponding interrupt can safely be enabled just after.
-+ * However for write transactions managed by the CPU, we first write
-+ * into THR, so TXCOMP is cleared. Then we can safely enable TXCOMP
-+ * interrupt. If TXCOMP interrupt were enabled before writing into THR,
-+ * the interrupt handler would be called immediately and the i2c command
-+ * would be reported as completed.
-+ * Also when a write transaction is managed by the DMA controller,
-+ * enabling the TXCOMP interrupt in this function may lead to a race
-+ * condition since we don't know whether the TXCOMP interrupt is enabled
-+ * before or after the DMA has started to write into THR. So the TXCOMP
-+ * interrupt is enabled later by at91_twi_write_data_dma_callback().
-+ * Immediately after in that DMA callback, we still need to send the
-+ * STOP condition manually writing the corresponding bit into the
-+ * Control Register.
-+ */
-+
- dev_dbg(dev->dev, "transfer: %s %d bytes.\n",
- (dev->msg->flags & I2C_M_RD) ? "read" : "write", dev->buf_len);
-
-@@ -411,26 +449,24 @@ static int at91_do_twi_transfer(struct at91_twi_dev *dev)
- * seems to be the best solution.
- */
- if (dev->use_dma && (dev->buf_len > AT91_I2C_DMA_THRESHOLD)) {
-+ at91_twi_write(dev, AT91_TWI_IER, AT91_TWI_NACK);
- at91_twi_read_data_dma(dev);
-- /*
-- * It is important to enable TXCOMP irq here because
-- * doing it only when transferring the last two bytes
-- * will mask NACK errors since TXCOMP is set when a
-- * NACK occurs.
-- */
-- at91_twi_write(dev, AT91_TWI_IER,
-- AT91_TWI_TXCOMP);
-- } else
-+ } else {
- at91_twi_write(dev, AT91_TWI_IER,
-- AT91_TWI_TXCOMP | AT91_TWI_RXRDY);
-+ AT91_TWI_TXCOMP |
-+ AT91_TWI_NACK |
-+ AT91_TWI_RXRDY);
-+ }
- } else {
- if (dev->use_dma && (dev->buf_len > AT91_I2C_DMA_THRESHOLD)) {
-+ at91_twi_write(dev, AT91_TWI_IER, AT91_TWI_NACK);
- at91_twi_write_data_dma(dev);
-- at91_twi_write(dev, AT91_TWI_IER, AT91_TWI_TXCOMP);
- } else {
- at91_twi_write_next_byte(dev);
- at91_twi_write(dev, AT91_TWI_IER,
-- AT91_TWI_TXCOMP | AT91_TWI_TXRDY);
-+ AT91_TWI_TXCOMP |
-+ AT91_TWI_NACK |
-+ AT91_TWI_TXRDY);
- }
- }
-
-diff --git a/drivers/iio/adc/at91_adc.c b/drivers/iio/adc/at91_adc.c
-index e6bf77d..ed4e45f 100644
---- a/drivers/iio/adc/at91_adc.c
-+++ b/drivers/iio/adc/at91_adc.c
-@@ -58,7 +58,7 @@ struct at91_adc_caps {
- u8 ts_pen_detect_sensitivity;
-
- /* startup time calculate function */
-- u32 (*calc_startup_ticks)(u8 startup_time, u32 adc_clk_khz);
-+ u32 (*calc_startup_ticks)(u32 startup_time, u32 adc_clk_khz);
-
- u8 num_channels;
- struct at91_adc_reg_desc registers;
-@@ -82,7 +82,7 @@ struct at91_adc_state {
- u8 num_channels;
- void __iomem *reg_base;
- struct at91_adc_reg_desc *registers;
-- u8 startup_time;
-+ u32 startup_time;
- u8 sample_hold_time;
- bool sleep_mode;
- struct iio_trigger **trig;
-@@ -590,7 +590,7 @@ ret:
- return ret;
- }
-
--static u32 calc_startup_ticks_9260(u8 startup_time, u32 adc_clk_khz)
-+static u32 calc_startup_ticks_9260(u32 startup_time, u32 adc_clk_khz)
- {
- /*
- * Number of ticks needed to cover the startup time of the ADC
-@@ -601,7 +601,7 @@ static u32 calc_startup_ticks_9260(u8 startup_time, u32 adc_clk_khz)
- return round_up((startup_time * adc_clk_khz / 1000) - 1, 8) / 8;
- }
-
--static u32 calc_startup_ticks_9x5(u8 startup_time, u32 adc_clk_khz)
-+static u32 calc_startup_ticks_9x5(u32 startup_time, u32 adc_clk_khz)
- {
- /*
- * For sama5d3x and at91sam9x5, the formula changes to:
-diff --git a/drivers/iio/dac/ad5624r_spi.c b/drivers/iio/dac/ad5624r_spi.c
-index e8199cc..1e66651 100644
---- a/drivers/iio/dac/ad5624r_spi.c
-+++ b/drivers/iio/dac/ad5624r_spi.c
-@@ -22,7 +22,7 @@
- #include "ad5624r.h"
-
- static int ad5624r_spi_write(struct spi_device *spi,
-- u8 cmd, u8 addr, u16 val, u8 len)
-+ u8 cmd, u8 addr, u16 val, u8 shift)
- {
- u32 data;
- u8 msg[3];
-@@ -35,7 +35,7 @@ static int ad5624r_spi_write(struct spi_device *spi,
- * 14-, 12-bit input code followed by 0, 2, or 4 don't care bits,
- * for the AD5664R, AD5644R, and AD5624R, respectively.
- */
-- data = (0 << 22) | (cmd << 19) | (addr << 16) | (val << (16 - len));
-+ data = (0 << 22) | (cmd << 19) | (addr << 16) | (val << shift);
- msg[0] = data >> 16;
- msg[1] = data >> 8;
- msg[2] = data;
-diff --git a/drivers/iio/temperature/tmp006.c b/drivers/iio/temperature/tmp006.c
-index 84a0789..7a80509 100644
---- a/drivers/iio/temperature/tmp006.c
-+++ b/drivers/iio/temperature/tmp006.c
-@@ -132,6 +132,9 @@ static int tmp006_write_raw(struct iio_dev *indio_dev,
- struct tmp006_data *data = iio_priv(indio_dev);
- int i;
-
-+ if (mask != IIO_CHAN_INFO_SAMP_FREQ)
-+ return -EINVAL;
-+
- for (i = 0; i < ARRAY_SIZE(tmp006_freqs); i++)
- if ((val == tmp006_freqs[i][0]) &&
- (val2 == tmp006_freqs[i][1])) {
-diff --git a/drivers/infiniband/ulp/isert/ib_isert.c b/drivers/infiniband/ulp/isert/ib_isert.c
-index 6014227..dd2b610 100644
---- a/drivers/infiniband/ulp/isert/ib_isert.c
-+++ b/drivers/infiniband/ulp/isert/ib_isert.c
-@@ -59,6 +59,8 @@ static int
- isert_rdma_accept(struct isert_conn *isert_conn);
- struct rdma_cm_id *isert_setup_id(struct isert_np *isert_np);
-
-+static void isert_release_work(struct work_struct *work);
-+
- static void
- isert_qp_event_callback(struct ib_event *e, void *context)
- {
-@@ -206,7 +208,7 @@ fail:
- static void
- isert_free_rx_descriptors(struct isert_conn *isert_conn)
- {
-- struct ib_device *ib_dev = isert_conn->conn_cm_id->device;
-+ struct ib_device *ib_dev = isert_conn->conn_device->ib_device;
- struct iser_rx_desc *rx_desc;
- int i;
-
-@@ -534,6 +536,7 @@ isert_connect_request(struct rdma_cm_id *cma_id, struct rdma_cm_event *event)
- mutex_init(&isert_conn->conn_mutex);
- spin_lock_init(&isert_conn->conn_lock);
- INIT_LIST_HEAD(&isert_conn->conn_fr_pool);
-+ INIT_WORK(&isert_conn->release_work, isert_release_work);
-
- isert_conn->conn_cm_id = cma_id;
- isert_conn->responder_resources = event->param.conn.responder_resources;
-@@ -647,9 +650,9 @@ out:
- static void
- isert_connect_release(struct isert_conn *isert_conn)
- {
-- struct ib_device *ib_dev = isert_conn->conn_cm_id->device;
- struct isert_device *device = isert_conn->conn_device;
- int cq_index;
-+ struct ib_device *ib_dev = device->ib_device;
-
- pr_debug("Entering isert_connect_release(): >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>\n");
-
-@@ -657,7 +660,8 @@ isert_connect_release(struct isert_conn *isert_conn)
- isert_conn_free_fastreg_pool(isert_conn);
-
- isert_free_rx_descriptors(isert_conn);
-- rdma_destroy_id(isert_conn->conn_cm_id);
-+ if (isert_conn->conn_cm_id)
-+ rdma_destroy_id(isert_conn->conn_cm_id);
-
- if (isert_conn->conn_qp) {
- cq_index = ((struct isert_cq_desc *)
-@@ -799,6 +803,7 @@ isert_disconnected_handler(struct rdma_cm_id *cma_id,
- {
- struct isert_np *isert_np = cma_id->context;
- struct isert_conn *isert_conn;
-+ bool terminating = false;
-
- if (isert_np->np_cm_id == cma_id)
- return isert_np_cma_handler(cma_id->context, event);
-@@ -806,21 +811,37 @@ isert_disconnected_handler(struct rdma_cm_id *cma_id,
- isert_conn = cma_id->qp->qp_context;
-
- mutex_lock(&isert_conn->conn_mutex);
-+ terminating = (isert_conn->state == ISER_CONN_TERMINATING);
- isert_conn_terminate(isert_conn);
- mutex_unlock(&isert_conn->conn_mutex);
-
- pr_info("conn %p completing conn_wait\n", isert_conn);
- complete(&isert_conn->conn_wait);
-
-+ if (terminating)
-+ goto out;
-+
-+ mutex_lock(&isert_np->np_accept_mutex);
-+ if (!list_empty(&isert_conn->conn_accept_node)) {
-+ list_del_init(&isert_conn->conn_accept_node);
-+ isert_put_conn(isert_conn);
-+ queue_work(isert_release_wq, &isert_conn->release_work);
-+ }
-+ mutex_unlock(&isert_np->np_accept_mutex);
-+
-+out:
- return 0;
- }
-
--static void
-+static int
- isert_connect_error(struct rdma_cm_id *cma_id)
- {
- struct isert_conn *isert_conn = cma_id->qp->qp_context;
-
-+ isert_conn->conn_cm_id = NULL;
- isert_put_conn(isert_conn);
-+
-+ return -1;
- }
-
- static int
-@@ -850,7 +871,7 @@ isert_cma_handler(struct rdma_cm_id *cma_id, struct rdma_cm_event *event)
- case RDMA_CM_EVENT_REJECTED: /* FALLTHRU */
- case RDMA_CM_EVENT_UNREACHABLE: /* FALLTHRU */
- case RDMA_CM_EVENT_CONNECT_ERROR:
-- isert_connect_error(cma_id);
-+ ret = isert_connect_error(cma_id);
- break;
- default:
- pr_err("Unhandled RDMA CMA event: %d\n", event->event);
-@@ -2944,7 +2965,6 @@ static void isert_wait_conn(struct iscsi_conn *conn)
-
- wait_for_completion(&isert_conn->conn_wait_comp_err);
-
-- INIT_WORK(&isert_conn->release_work, isert_release_work);
- queue_work(isert_release_wq, &isert_conn->release_work);
- }
-
-diff --git a/drivers/leds/led-class.c b/drivers/leds/led-class.c
-index f37d63c..825545c 100644
---- a/drivers/leds/led-class.c
-+++ b/drivers/leds/led-class.c
-@@ -178,6 +178,7 @@ void led_classdev_resume(struct led_classdev *led_cdev)
- }
- EXPORT_SYMBOL_GPL(led_classdev_resume);
-
-+#ifdef CONFIG_PM_SLEEP
- static int led_suspend(struct device *dev)
- {
- struct led_classdev *led_cdev = dev_get_drvdata(dev);
-@@ -197,11 +198,9 @@ static int led_resume(struct device *dev)
-
- return 0;
- }
-+#endif
-
--static const struct dev_pm_ops leds_class_dev_pm_ops = {
-- .suspend = led_suspend,
-- .resume = led_resume,
--};
-+static SIMPLE_DEV_PM_OPS(leds_class_dev_pm_ops, led_suspend, led_resume);
-
- /**
- * led_classdev_register - register a new object of led_classdev class.
-diff --git a/drivers/md/dm-stats.c b/drivers/md/dm-stats.c
-index 28a9012..b3b0697 100644
---- a/drivers/md/dm-stats.c
-+++ b/drivers/md/dm-stats.c
-@@ -795,6 +795,8 @@ static int message_stats_create(struct mapped_device *md,
- return -EINVAL;
-
- if (sscanf(argv[2], "/%u%c", &divisor, &dummy) == 1) {
-+ if (!divisor)
-+ return -EINVAL;
- step = end - start;
- if (do_div(step, divisor))
- step++;
-diff --git a/drivers/md/md.c b/drivers/md/md.c
-index 40959ee..b4067b9 100644
---- a/drivers/md/md.c
-+++ b/drivers/md/md.c
-@@ -6232,7 +6232,7 @@ static int update_array_info(struct mddev *mddev, mdu_array_info_t *info)
- mddev->ctime != info->ctime ||
- mddev->level != info->level ||
- /* mddev->layout != info->layout || */
-- !mddev->persistent != info->not_persistent||
-+ mddev->persistent != !info->not_persistent ||
- mddev->chunk_sectors != info->chunk_size >> 9 ||
- /* ignore bottom 8 bits of state, and allow SB_BITMAP_PRESENT to change */
- ((state^info->state) & 0xfffffe00)
-diff --git a/drivers/md/persistent-data/dm-btree-remove.c b/drivers/md/persistent-data/dm-btree-remove.c
-index b88757c..a03178e 100644
---- a/drivers/md/persistent-data/dm-btree-remove.c
-+++ b/drivers/md/persistent-data/dm-btree-remove.c
-@@ -309,8 +309,8 @@ static void redistribute3(struct dm_btree_info *info, struct btree_node *parent,
-
- if (s < 0 && nr_center < -s) {
- /* not enough in central node */
-- shift(left, center, nr_center);
-- s = nr_center - target;
-+ shift(left, center, -nr_center);
-+ s += nr_center;
- shift(left, right, s);
- nr_right += s;
- } else
-@@ -323,7 +323,7 @@ static void redistribute3(struct dm_btree_info *info, struct btree_node *parent,
- if (s > 0 && nr_center < s) {
- /* not enough in central node */
- shift(center, right, nr_center);
-- s = target - nr_center;
-+ s -= nr_center;
- shift(left, right, s);
- nr_left -= s;
- } else
-diff --git a/drivers/md/persistent-data/dm-btree.c b/drivers/md/persistent-data/dm-btree.c
-index 200ac12..fdd3793 100644
---- a/drivers/md/persistent-data/dm-btree.c
-+++ b/drivers/md/persistent-data/dm-btree.c
-@@ -255,7 +255,7 @@ int dm_btree_del(struct dm_btree_info *info, dm_block_t root)
- int r;
- struct del_stack *s;
-
-- s = kmalloc(sizeof(*s), GFP_KERNEL);
-+ s = kmalloc(sizeof(*s), GFP_NOIO);
- if (!s)
- return -ENOMEM;
- s->info = info;
-diff --git a/drivers/md/persistent-data/dm-space-map-metadata.c b/drivers/md/persistent-data/dm-space-map-metadata.c
-index f4e22bc..199c9cc 100644
---- a/drivers/md/persistent-data/dm-space-map-metadata.c
-+++ b/drivers/md/persistent-data/dm-space-map-metadata.c
-@@ -204,6 +204,27 @@ static void in(struct sm_metadata *smm)
- smm->recursion_count++;
- }
-
-+static int apply_bops(struct sm_metadata *smm)
-+{
-+ int r = 0;
-+
-+ while (!brb_empty(&smm->uncommitted)) {
-+ struct block_op bop;
-+
-+ r = brb_pop(&smm->uncommitted, &bop);
-+ if (r) {
-+ DMERR("bug in bop ring buffer");
-+ break;
-+ }
-+
-+ r = commit_bop(smm, &bop);
-+ if (r)
-+ break;
-+ }
-+
-+ return r;
-+}
-+
- static int out(struct sm_metadata *smm)
- {
- int r = 0;
-@@ -216,21 +237,8 @@ static int out(struct sm_metadata *smm)
- return -ENOMEM;
- }
-
-- if (smm->recursion_count == 1) {
-- while (!brb_empty(&smm->uncommitted)) {
-- struct block_op bop;
--
-- r = brb_pop(&smm->uncommitted, &bop);
-- if (r) {
-- DMERR("bug in bop ring buffer");
-- break;
-- }
--
-- r = commit_bop(smm, &bop);
-- if (r)
-- break;
-- }
-- }
-+ if (smm->recursion_count == 1)
-+ apply_bops(smm);
-
- smm->recursion_count--;
-
-@@ -702,6 +710,12 @@ static int sm_metadata_extend(struct dm_space_map *sm, dm_block_t extra_blocks)
- }
- old_len = smm->begin;
-
-+ r = apply_bops(smm);
-+ if (r) {
-+ DMERR("%s: apply_bops failed", __func__);
-+ goto out;
-+ }
-+
- r = sm_ll_commit(&smm->ll);
- if (r)
- goto out;
-@@ -771,6 +785,12 @@ int dm_sm_metadata_create(struct dm_space_map *sm,
- if (r)
- return r;
-
-+ r = apply_bops(smm);
-+ if (r) {
-+ DMERR("%s: apply_bops failed", __func__);
-+ return r;
-+ }
-+
- return sm_metadata_commit(sm);
- }
-
-diff --git a/drivers/media/dvb-frontends/af9013.c b/drivers/media/dvb-frontends/af9013.c
-index fb504f1..5930aee 100644
---- a/drivers/media/dvb-frontends/af9013.c
-+++ b/drivers/media/dvb-frontends/af9013.c
-@@ -606,6 +606,10 @@ static int af9013_set_frontend(struct dvb_frontend *fe)
- }
- }
-
-+ /* Return an error if can't find bandwidth or the right clock */
-+ if (i == ARRAY_SIZE(coeff_lut))
-+ return -EINVAL;
-+
- ret = af9013_wr_regs(state, 0xae00, coeff_lut[i].val,
- sizeof(coeff_lut[i].val));
- }
-diff --git a/drivers/media/dvb-frontends/cx24116.c b/drivers/media/dvb-frontends/cx24116.c
-index 2916d7c..7bc68b3 100644
---- a/drivers/media/dvb-frontends/cx24116.c
-+++ b/drivers/media/dvb-frontends/cx24116.c
-@@ -963,6 +963,10 @@ static int cx24116_send_diseqc_msg(struct dvb_frontend *fe,
- struct cx24116_state *state = fe->demodulator_priv;
- int i, ret;
-
-+ /* Validate length */
-+ if (d->msg_len > sizeof(d->msg))
-+ return -EINVAL;
-+
- /* Dump DiSEqC message */
- if (debug) {
- printk(KERN_INFO "cx24116: %s(", __func__);
-@@ -974,10 +978,6 @@ static int cx24116_send_diseqc_msg(struct dvb_frontend *fe,
- printk(") toneburst=%d\n", toneburst);
- }
-
-- /* Validate length */
-- if (d->msg_len > (CX24116_ARGLEN - CX24116_DISEQC_MSGOFS))
-- return -EINVAL;
--
- /* DiSEqC message */
- for (i = 0; i < d->msg_len; i++)
- state->dsec_cmd.args[CX24116_DISEQC_MSGOFS + i] = d->msg[i];
-diff --git a/drivers/media/dvb-frontends/cx24117.c b/drivers/media/dvb-frontends/cx24117.c
-index a6c3c9e..d2eab06 100644
---- a/drivers/media/dvb-frontends/cx24117.c
-+++ b/drivers/media/dvb-frontends/cx24117.c
-@@ -1043,7 +1043,7 @@ static int cx24117_send_diseqc_msg(struct dvb_frontend *fe,
- dev_dbg(&state->priv->i2c->dev, ")\n");
-
- /* Validate length */
-- if (d->msg_len > 15)
-+ if (d->msg_len > sizeof(d->msg))
- return -EINVAL;
-
- /* DiSEqC message */
-diff --git a/drivers/media/dvb-frontends/s5h1420.c b/drivers/media/dvb-frontends/s5h1420.c
-index 93eeaf7..0b4f8fe 100644
---- a/drivers/media/dvb-frontends/s5h1420.c
-+++ b/drivers/media/dvb-frontends/s5h1420.c
-@@ -180,7 +180,7 @@ static int s5h1420_send_master_cmd (struct dvb_frontend* fe,
- int result = 0;
-
- dprintk("enter %s\n", __func__);
-- if (cmd->msg_len > 8)
-+ if (cmd->msg_len > sizeof(cmd->msg))
- return -EINVAL;
-
- /* setup for DISEQC */
-diff --git a/drivers/mmc/card/block.c b/drivers/mmc/card/block.c
-index b1e21fc..d71f5ef 100644
---- a/drivers/mmc/card/block.c
-+++ b/drivers/mmc/card/block.c
-@@ -205,6 +205,8 @@ static ssize_t power_ro_lock_show(struct device *dev,
-
- ret = snprintf(buf, PAGE_SIZE, "%d\n", locked);
-
-+ mmc_blk_put(md);
-+
- return ret;
- }
-
-@@ -1861,9 +1863,11 @@ static int mmc_blk_issue_rw_rq(struct mmc_queue *mq, struct request *rqc)
- break;
- case MMC_BLK_CMD_ERR:
- ret = mmc_blk_cmd_err(md, card, brq, req, ret);
-- if (!mmc_blk_reset(md, card->host, type))
-- break;
-- goto cmd_abort;
-+ if (mmc_blk_reset(md, card->host, type))
-+ goto cmd_abort;
-+ if (!ret)
-+ goto start_new_req;
-+ break;
- case MMC_BLK_RETRY:
- if (retry++ < 5)
- break;
-diff --git a/drivers/mtd/maps/dc21285.c b/drivers/mtd/maps/dc21285.c
-index f8a7dd1..70a3db3 100644
---- a/drivers/mtd/maps/dc21285.c
-+++ b/drivers/mtd/maps/dc21285.c
-@@ -38,9 +38,9 @@ static void nw_en_write(void)
- * we want to write a bit pattern XXX1 to Xilinx to enable
- * the write gate, which will be open for about the next 2ms.
- */
-- spin_lock_irqsave(&nw_gpio_lock, flags);
-+ raw_spin_lock_irqsave(&nw_gpio_lock, flags);
- nw_cpld_modify(CPLD_FLASH_WR_ENABLE, CPLD_FLASH_WR_ENABLE);
-- spin_unlock_irqrestore(&nw_gpio_lock, flags);
-+ raw_spin_unlock_irqrestore(&nw_gpio_lock, flags);
-
- /*
- * let the ISA bus to catch on...
-diff --git a/drivers/mtd/mtd_blkdevs.c b/drivers/mtd/mtd_blkdevs.c
-index 5073cbc..32d5e40 100644
---- a/drivers/mtd/mtd_blkdevs.c
-+++ b/drivers/mtd/mtd_blkdevs.c
-@@ -199,6 +199,7 @@ static int blktrans_open(struct block_device *bdev, fmode_t mode)
- return -ERESTARTSYS; /* FIXME: busy loop! -arnd*/
-
- mutex_lock(&dev->lock);
-+ mutex_lock(&mtd_table_mutex);
-
- if (dev->open)
- goto unlock;
-@@ -222,6 +223,7 @@ static int blktrans_open(struct block_device *bdev, fmode_t mode)
-
- unlock:
- dev->open++;
-+ mutex_unlock(&mtd_table_mutex);
- mutex_unlock(&dev->lock);
- blktrans_dev_put(dev);
- return ret;
-@@ -232,6 +234,7 @@ error_release:
- error_put:
- module_put(dev->tr->owner);
- kref_put(&dev->ref, blktrans_dev_release);
-+ mutex_unlock(&mtd_table_mutex);
- mutex_unlock(&dev->lock);
- blktrans_dev_put(dev);
- return ret;
-@@ -245,6 +248,7 @@ static void blktrans_release(struct gendisk *disk, fmode_t mode)
- return;
-
- mutex_lock(&dev->lock);
-+ mutex_lock(&mtd_table_mutex);
-
- if (--dev->open)
- goto unlock;
-@@ -258,6 +262,7 @@ static void blktrans_release(struct gendisk *disk, fmode_t mode)
- __put_mtd_device(dev->mtd);
- }
- unlock:
-+ mutex_unlock(&mtd_table_mutex);
- mutex_unlock(&dev->lock);
- blktrans_dev_put(dev);
- }
-diff --git a/drivers/mtd/nand/nand_base.c b/drivers/mtd/nand/nand_base.c
-index 9715a7b..efc542d 100644
---- a/drivers/mtd/nand/nand_base.c
-+++ b/drivers/mtd/nand/nand_base.c
-@@ -2000,7 +2000,7 @@ static int nand_write_page_raw_syndrome(struct mtd_info *mtd,
- oob += chip->ecc.prepad;
- }
-
-- chip->read_buf(mtd, oob, eccbytes);
-+ chip->write_buf(mtd, oob, eccbytes);
- oob += eccbytes;
-
- if (chip->ecc.postpad) {
-@@ -3063,7 +3063,7 @@ static int nand_flash_detect_onfi(struct mtd_info *mtd, struct nand_chip *chip,
- int *busw)
- {
- struct nand_onfi_params *p = &chip->onfi_params;
-- int i;
-+ int i, j;
- int val;
-
- /* Try ONFI for unknown chip or LP */
-@@ -3072,18 +3072,10 @@ static int nand_flash_detect_onfi(struct mtd_info *mtd, struct nand_chip *chip,
- chip->read_byte(mtd) != 'F' || chip->read_byte(mtd) != 'I')
- return 0;
-
-- /*
-- * ONFI must be probed in 8-bit mode or with NAND_BUSWIDTH_AUTO, not
-- * with NAND_BUSWIDTH_16
-- */
-- if (chip->options & NAND_BUSWIDTH_16) {
-- pr_err("ONFI cannot be probed in 16-bit mode; aborting\n");
-- return 0;
-- }
--
- chip->cmdfunc(mtd, NAND_CMD_PARAM, 0, -1);
- for (i = 0; i < 3; i++) {
-- chip->read_buf(mtd, (uint8_t *)p, sizeof(*p));
-+ for (j = 0; j < sizeof(*p); j++)
-+ ((uint8_t *)p)[j] = chip->read_byte(mtd);
- if (onfi_crc16(ONFI_CRC_BASE, (uint8_t *)p, 254) ==
- le16_to_cpu(p->crc)) {
- break;
-diff --git a/drivers/net/wireless/ath/ath9k/main.c b/drivers/net/wireless/ath/ath9k/main.c
-index 5924f72..f35ce8e 100644
---- a/drivers/net/wireless/ath/ath9k/main.c
-+++ b/drivers/net/wireless/ath/ath9k/main.c
-@@ -205,11 +205,13 @@ static bool ath_prepare_reset(struct ath_softc *sc)
- ath_stop_ani(sc);
- ath9k_hw_disable_interrupts(ah);
-
-- if (!ath_drain_all_txq(sc))
-- ret = false;
--
-- if (!ath_stoprecv(sc))
-- ret = false;
-+ if (AR_SREV_9300_20_OR_LATER(ah)) {
-+ ret &= ath_stoprecv(sc);
-+ ret &= ath_drain_all_txq(sc);
-+ } else {
-+ ret &= ath_drain_all_txq(sc);
-+ ret &= ath_stoprecv(sc);
-+ }
-
- return ret;
- }
-diff --git a/drivers/of/base.c b/drivers/of/base.c
-index 3935614..e99f329 100644
---- a/drivers/of/base.c
-+++ b/drivers/of/base.c
-@@ -77,7 +77,7 @@ EXPORT_SYMBOL(of_n_size_cells);
- #ifdef CONFIG_NUMA
- int __weak of_node_to_nid(struct device_node *np)
- {
-- return numa_node_id();
-+ return NUMA_NO_NODE;
- }
- #endif
-
-diff --git a/drivers/pcmcia/topic.h b/drivers/pcmcia/topic.h
-index 615a45a..582688fe 100644
---- a/drivers/pcmcia/topic.h
-+++ b/drivers/pcmcia/topic.h
-@@ -104,6 +104,9 @@
- #define TOPIC_EXCA_IF_CONTROL 0x3e /* 8 bit */
- #define TOPIC_EXCA_IFC_33V_ENA 0x01
-
-+#define TOPIC_PCI_CFG_PPBCN 0x3e /* 16-bit */
-+#define TOPIC_PCI_CFG_PPBCN_WBEN 0x0400
-+
- static void topic97_zoom_video(struct pcmcia_socket *sock, int onoff)
- {
- struct yenta_socket *socket = container_of(sock, struct yenta_socket, socket);
-@@ -138,6 +141,7 @@ static int topic97_override(struct yenta_socket *socket)
- static int topic95_override(struct yenta_socket *socket)
- {
- u8 fctrl;
-+ u16 ppbcn;
-
- /* enable 3.3V support for 16bit cards */
- fctrl = exca_readb(socket, TOPIC_EXCA_IF_CONTROL);
-@@ -146,6 +150,18 @@ static int topic95_override(struct yenta_socket *socket)
- /* tell yenta to use exca registers to power 16bit cards */
- socket->flags |= YENTA_16BIT_POWER_EXCA | YENTA_16BIT_POWER_DF;
-
-+ /* Disable write buffers to prevent lockups under load with numerous
-+ Cardbus cards, observed on Tecra 500CDT and reported elsewhere on the
-+ net. This is not a power-on default according to the datasheet
-+ but some BIOSes seem to set it. */
-+ if (pci_read_config_word(socket->dev, TOPIC_PCI_CFG_PPBCN, &ppbcn) == 0
-+ && socket->dev->revision <= 7
-+ && (ppbcn & TOPIC_PCI_CFG_PPBCN_WBEN)) {
-+ ppbcn &= ~TOPIC_PCI_CFG_PPBCN_WBEN;
-+ pci_write_config_word(socket->dev, TOPIC_PCI_CFG_PPBCN, ppbcn);
-+ dev_info(&socket->dev->dev, "Disabled ToPIC95 Cardbus write buffers.\n");
-+ }
-+
- return 0;
- }
-
-diff --git a/drivers/pinctrl/mvebu/pinctrl-armada-370.c b/drivers/pinctrl/mvebu/pinctrl-armada-370.c
-index ae1f760..bb525b1 100644
---- a/drivers/pinctrl/mvebu/pinctrl-armada-370.c
-+++ b/drivers/pinctrl/mvebu/pinctrl-armada-370.c
-@@ -358,11 +358,11 @@ static struct mvebu_mpp_mode mv88f6710_mpp_modes[] = {
- MPP_MODE(64,
- MPP_FUNCTION(0x0, "gpio", NULL),
- MPP_FUNCTION(0x1, "spi0", "miso"),
-- MPP_FUNCTION(0x2, "spi0-1", "cs1")),
-+ MPP_FUNCTION(0x2, "spi0", "cs1")),
- MPP_MODE(65,
- MPP_FUNCTION(0x0, "gpio", NULL),
- MPP_FUNCTION(0x1, "spi0", "mosi"),
-- MPP_FUNCTION(0x2, "spi0-1", "cs2")),
-+ MPP_FUNCTION(0x2, "spi0", "cs2")),
- };
-
- static struct mvebu_pinctrl_soc_info armada_370_pinctrl_info;
-diff --git a/drivers/pinctrl/mvebu/pinctrl-armada-xp.c b/drivers/pinctrl/mvebu/pinctrl-armada-xp.c
-index 843a51f..d918c51 100644
---- a/drivers/pinctrl/mvebu/pinctrl-armada-xp.c
-+++ b/drivers/pinctrl/mvebu/pinctrl-armada-xp.c
-@@ -14,10 +14,7 @@
- * available: mv78230, mv78260 and mv78460. From a pin muxing
- * perspective, the mv78230 has 49 MPP pins. The mv78260 and mv78460
- * both have 67 MPP pins (more GPIOs and address lines for the memory
-- * bus mainly). The only difference between the mv78260 and the
-- * mv78460 in terms of pin muxing is the addition of two functions on
-- * pins 43 and 56 to access the VDD of the CPU2 and 3 (mv78260 has two
-- * cores, mv78460 has four cores).
-+ * bus mainly).
- */
-
- #include <linux/err.h>
-@@ -159,20 +156,17 @@ static struct mvebu_mpp_mode armada_xp_mpp_modes[] = {
- MPP_MODE(24,
- MPP_VAR_FUNCTION(0x0, "gpio", NULL, V_MV78230_PLUS),
- MPP_VAR_FUNCTION(0x1, "sata1", "prsnt", V_MV78230_PLUS),
-- MPP_VAR_FUNCTION(0x2, "nf", "bootcs-re", V_MV78230_PLUS),
- MPP_VAR_FUNCTION(0x3, "tdm", "rst", V_MV78230_PLUS),
- MPP_VAR_FUNCTION(0x4, "lcd", "hsync", V_MV78230_PLUS)),
- MPP_MODE(25,
- MPP_VAR_FUNCTION(0x0, "gpio", NULL, V_MV78230_PLUS),
- MPP_VAR_FUNCTION(0x1, "sata0", "prsnt", V_MV78230_PLUS),
-- MPP_VAR_FUNCTION(0x2, "nf", "bootcs-we", V_MV78230_PLUS),
- MPP_VAR_FUNCTION(0x3, "tdm", "pclk", V_MV78230_PLUS),
- MPP_VAR_FUNCTION(0x4, "lcd", "vsync", V_MV78230_PLUS)),
- MPP_MODE(26,
- MPP_VAR_FUNCTION(0x0, "gpio", NULL, V_MV78230_PLUS),
- MPP_VAR_FUNCTION(0x3, "tdm", "fsync", V_MV78230_PLUS),
-- MPP_VAR_FUNCTION(0x4, "lcd", "clk", V_MV78230_PLUS),
-- MPP_VAR_FUNCTION(0x5, "vdd", "cpu1-pd", V_MV78230_PLUS)),
-+ MPP_VAR_FUNCTION(0x4, "lcd", "clk", V_MV78230_PLUS)),
- MPP_MODE(27,
- MPP_VAR_FUNCTION(0x0, "gpio", NULL, V_MV78230_PLUS),
- MPP_VAR_FUNCTION(0x1, "ptp", "trig", V_MV78230_PLUS),
-@@ -187,8 +181,7 @@ static struct mvebu_mpp_mode armada_xp_mpp_modes[] = {
- MPP_VAR_FUNCTION(0x0, "gpio", NULL, V_MV78230_PLUS),
- MPP_VAR_FUNCTION(0x1, "ptp", "clk", V_MV78230_PLUS),
- MPP_VAR_FUNCTION(0x3, "tdm", "int0", V_MV78230_PLUS),
-- MPP_VAR_FUNCTION(0x4, "lcd", "ref-clk", V_MV78230_PLUS),
-- MPP_VAR_FUNCTION(0x5, "vdd", "cpu0-pd", V_MV78230_PLUS)),
-+ MPP_VAR_FUNCTION(0x4, "lcd", "ref-clk", V_MV78230_PLUS)),
- MPP_MODE(30,
- MPP_VAR_FUNCTION(0x0, "gpio", NULL, V_MV78230_PLUS),
- MPP_VAR_FUNCTION(0x1, "sd0", "clk", V_MV78230_PLUS),
-@@ -196,13 +189,11 @@ static struct mvebu_mpp_mode armada_xp_mpp_modes[] = {
- MPP_MODE(31,
- MPP_VAR_FUNCTION(0x0, "gpio", NULL, V_MV78230_PLUS),
- MPP_VAR_FUNCTION(0x1, "sd0", "cmd", V_MV78230_PLUS),
-- MPP_VAR_FUNCTION(0x3, "tdm", "int2", V_MV78230_PLUS),
-- MPP_VAR_FUNCTION(0x5, "vdd", "cpu0-pd", V_MV78230_PLUS)),
-+ MPP_VAR_FUNCTION(0x3, "tdm", "int2", V_MV78230_PLUS)),
- MPP_MODE(32,
- MPP_VAR_FUNCTION(0x0, "gpio", NULL, V_MV78230_PLUS),
- MPP_VAR_FUNCTION(0x1, "sd0", "d0", V_MV78230_PLUS),
-- MPP_VAR_FUNCTION(0x3, "tdm", "int3", V_MV78230_PLUS),
-- MPP_VAR_FUNCTION(0x5, "vdd", "cpu1-pd", V_MV78230_PLUS)),
-+ MPP_VAR_FUNCTION(0x3, "tdm", "int3", V_MV78230_PLUS)),
- MPP_MODE(33,
- MPP_VAR_FUNCTION(0x0, "gpio", NULL, V_MV78230_PLUS),
- MPP_VAR_FUNCTION(0x1, "sd0", "d1", V_MV78230_PLUS),
-@@ -234,7 +225,6 @@ static struct mvebu_mpp_mode armada_xp_mpp_modes[] = {
- MPP_VAR_FUNCTION(0x0, "gpio", NULL, V_MV78230_PLUS),
- MPP_VAR_FUNCTION(0x1, "spi", "cs1", V_MV78230_PLUS),
- MPP_VAR_FUNCTION(0x2, "uart2", "cts", V_MV78230_PLUS),
-- MPP_VAR_FUNCTION(0x3, "vdd", "cpu1-pd", V_MV78230_PLUS),
- MPP_VAR_FUNCTION(0x4, "lcd", "vga-hsync", V_MV78230_PLUS),
- MPP_VAR_FUNCTION(0x5, "pcie", "clkreq0", V_MV78230_PLUS)),
- MPP_MODE(41,
-@@ -249,15 +239,13 @@ static struct mvebu_mpp_mode armada_xp_mpp_modes[] = {
- MPP_VAR_FUNCTION(0x1, "uart2", "rxd", V_MV78230_PLUS),
- MPP_VAR_FUNCTION(0x2, "uart0", "cts", V_MV78230_PLUS),
- MPP_VAR_FUNCTION(0x3, "tdm", "int7", V_MV78230_PLUS),
-- MPP_VAR_FUNCTION(0x4, "tdm-1", "timer", V_MV78230_PLUS),
-- MPP_VAR_FUNCTION(0x5, "vdd", "cpu0-pd", V_MV78230_PLUS)),
-+ MPP_VAR_FUNCTION(0x4, "tdm-1", "timer", V_MV78230_PLUS)),
- MPP_MODE(43,
- MPP_VAR_FUNCTION(0x0, "gpio", NULL, V_MV78230_PLUS),
- MPP_VAR_FUNCTION(0x1, "uart2", "txd", V_MV78230_PLUS),
- MPP_VAR_FUNCTION(0x2, "uart0", "rts", V_MV78230_PLUS),
- MPP_VAR_FUNCTION(0x3, "spi", "cs3", V_MV78230_PLUS),
-- MPP_VAR_FUNCTION(0x4, "pcie", "rstout", V_MV78230_PLUS),
-- MPP_VAR_FUNCTION(0x5, "vdd", "cpu2-3-pd", V_MV78460)),
-+ MPP_VAR_FUNCTION(0x4, "pcie", "rstout", V_MV78230_PLUS)),
- MPP_MODE(44,
- MPP_VAR_FUNCTION(0x0, "gpio", NULL, V_MV78230_PLUS),
- MPP_VAR_FUNCTION(0x1, "uart2", "cts", V_MV78230_PLUS),
-@@ -286,7 +274,7 @@ static struct mvebu_mpp_mode armada_xp_mpp_modes[] = {
- MPP_VAR_FUNCTION(0x5, "pcie", "clkreq3", V_MV78230_PLUS)),
- MPP_MODE(48,
- MPP_VAR_FUNCTION(0x0, "gpio", NULL, V_MV78230_PLUS),
-- MPP_VAR_FUNCTION(0x1, "tclk", NULL, V_MV78230_PLUS),
-+ MPP_VAR_FUNCTION(0x1, "dev", "clkout", V_MV78230_PLUS),
- MPP_VAR_FUNCTION(0x2, "dev", "burst/last", V_MV78230_PLUS)),
- MPP_MODE(49,
- MPP_VAR_FUNCTION(0x0, "gpio", NULL, V_MV78260_PLUS),
-@@ -308,16 +296,13 @@ static struct mvebu_mpp_mode armada_xp_mpp_modes[] = {
- MPP_VAR_FUNCTION(0x1, "dev", "ad19", V_MV78260_PLUS)),
- MPP_MODE(55,
- MPP_VAR_FUNCTION(0x0, "gpio", NULL, V_MV78260_PLUS),
-- MPP_VAR_FUNCTION(0x1, "dev", "ad20", V_MV78260_PLUS),
-- MPP_VAR_FUNCTION(0x2, "vdd", "cpu0-pd", V_MV78260_PLUS)),
-+ MPP_VAR_FUNCTION(0x1, "dev", "ad20", V_MV78260_PLUS)),
- MPP_MODE(56,
- MPP_VAR_FUNCTION(0x0, "gpio", NULL, V_MV78260_PLUS),
-- MPP_VAR_FUNCTION(0x1, "dev", "ad21", V_MV78260_PLUS),
-- MPP_VAR_FUNCTION(0x2, "vdd", "cpu1-pd", V_MV78260_PLUS)),
-+ MPP_VAR_FUNCTION(0x1, "dev", "ad21", V_MV78260_PLUS)),
- MPP_MODE(57,
- MPP_VAR_FUNCTION(0x0, "gpio", NULL, V_MV78260_PLUS),
-- MPP_VAR_FUNCTION(0x1, "dev", "ad22", V_MV78260_PLUS),
-- MPP_VAR_FUNCTION(0x2, "vdd", "cpu2-3-pd", V_MV78460)),
-+ MPP_VAR_FUNCTION(0x1, "dev", "ad22", V_MV78260_PLUS)),
- MPP_MODE(58,
- MPP_VAR_FUNCTION(0x0, "gpio", NULL, V_MV78260_PLUS),
- MPP_VAR_FUNCTION(0x1, "dev", "ad23", V_MV78260_PLUS)),
-diff --git a/drivers/platform/x86/dell-laptop.c b/drivers/platform/x86/dell-laptop.c
-index fed4111..1beb232 100644
---- a/drivers/platform/x86/dell-laptop.c
-+++ b/drivers/platform/x86/dell-laptop.c
-@@ -272,7 +272,6 @@ static struct dmi_system_id dell_quirks[] = {
- };
-
- static struct calling_interface_buffer *buffer;
--static struct page *bufferpage;
- static DEFINE_MUTEX(buffer_mutex);
-
- static int hwswitch_state;
-@@ -825,12 +824,11 @@ static int __init dell_init(void)
- * Allocate buffer below 4GB for SMI data--only 32-bit physical addr
- * is passed to SMI handler.
- */
-- bufferpage = alloc_page(GFP_KERNEL | GFP_DMA32);
-- if (!bufferpage) {
-+ buffer = (void *)__get_free_page(GFP_KERNEL | GFP_DMA32);
-+ if (!buffer) {
- ret = -ENOMEM;
- goto fail_buffer;
- }
-- buffer = page_address(bufferpage);
-
- ret = dell_setup_rfkill();
-
-@@ -892,7 +890,7 @@ fail_backlight:
- cancel_delayed_work_sync(&dell_rfkill_work);
- dell_cleanup_rfkill();
- fail_rfkill:
-- free_page((unsigned long)bufferpage);
-+ free_page((unsigned long)buffer);
- fail_buffer:
- platform_device_del(platform_device);
- fail_platform_device2:
-diff --git a/drivers/platform/x86/ideapad-laptop.c b/drivers/platform/x86/ideapad-laptop.c
-index 6dd060a..0d1a5d4 100644
---- a/drivers/platform/x86/ideapad-laptop.c
-+++ b/drivers/platform/x86/ideapad-laptop.c
-@@ -461,8 +461,9 @@ const struct ideapad_rfk_data ideapad_rfk_data[] = {
- static int ideapad_rfk_set(void *data, bool blocked)
- {
- struct ideapad_rfk_priv *priv = data;
-+ int opcode = ideapad_rfk_data[priv->dev].opcode;
-
-- return write_ec_cmd(priv->priv->adev->handle, priv->dev, !blocked);
-+ return write_ec_cmd(priv->priv->adev->handle, opcode, !blocked);
- }
-
- static struct rfkill_ops ideapad_rfk_ops = {
-diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c
-index 5d8d2dc..427cb62 100644
---- a/drivers/regulator/core.c
-+++ b/drivers/regulator/core.c
-@@ -773,7 +773,7 @@ static int suspend_prepare(struct regulator_dev *rdev, suspend_state_t state)
- static void print_constraints(struct regulator_dev *rdev)
- {
- struct regulation_constraints *constraints = rdev->constraints;
-- char buf[80] = "";
-+ char buf[160] = "";
- int count = 0;
- int ret;
-
-diff --git a/drivers/scsi/ipr.h b/drivers/scsi/ipr.h
-index 0801f3d..02edae7 100644
---- a/drivers/scsi/ipr.h
-+++ b/drivers/scsi/ipr.h
-@@ -264,7 +264,7 @@
- #define IPR_RUNTIME_RESET 0x40000000
-
- #define IPR_IPL_INIT_MIN_STAGE_TIME 5
--#define IPR_IPL_INIT_DEFAULT_STAGE_TIME 15
-+#define IPR_IPL_INIT_DEFAULT_STAGE_TIME 30
- #define IPR_IPL_INIT_STAGE_UNKNOWN 0x0
- #define IPR_IPL_INIT_STAGE_TRANSOP 0xB0000000
- #define IPR_IPL_INIT_STAGE_MASK 0xff000000
-diff --git a/drivers/scsi/qla2xxx/qla_isr.c b/drivers/scsi/qla2xxx/qla_isr.c
-index 0a1dcb4..13f4bef 100644
---- a/drivers/scsi/qla2xxx/qla_isr.c
-+++ b/drivers/scsi/qla2xxx/qla_isr.c
-@@ -572,8 +572,9 @@ qla2x00_async_event(scsi_qla_host_t *vha, struct rsp_que *rsp, uint16_t *mb)
- struct device_reg_2xxx __iomem *reg = &ha->iobase->isp;
- struct device_reg_24xx __iomem *reg24 = &ha->iobase->isp24;
- struct device_reg_82xx __iomem *reg82 = &ha->iobase->isp82;
-- uint32_t rscn_entry, host_pid;
-+ uint32_t rscn_entry, host_pid, tmp_pid;
- unsigned long flags;
-+ fc_port_t *fcport = NULL;
-
- /* Setup to process RIO completion. */
- handle_cnt = 0;
-@@ -968,6 +969,20 @@ skip_rio:
- if (qla2x00_is_a_vp_did(vha, rscn_entry))
- break;
-
-+ /*
-+ * Search for the rport related to this RSCN entry and mark it
-+ * as lost.
-+ */
-+ list_for_each_entry(fcport, &vha->vp_fcports, list) {
-+ if (atomic_read(&fcport->state) != FCS_ONLINE)
-+ continue;
-+ tmp_pid = fcport->d_id.b24;
-+ if (fcport->d_id.b24 == rscn_entry) {
-+ qla2x00_mark_device_lost(vha, fcport, 0, 0);
-+ break;
-+ }
-+ }
-+
- atomic_set(&vha->loop_down_timer, 0);
- vha->flags.management_server_logged_in = 0;
-
-diff --git a/drivers/scsi/scsi_transport_srp.c b/drivers/scsi/scsi_transport_srp.c
-index e3e794e..b85eaa0 100644
---- a/drivers/scsi/scsi_transport_srp.c
-+++ b/drivers/scsi/scsi_transport_srp.c
-@@ -397,6 +397,36 @@ static void srp_reconnect_work(struct work_struct *work)
- }
- }
-
-+/**
-+ * scsi_request_fn_active() - number of kernel threads inside scsi_request_fn()
-+ * @shost: SCSI host for which to count the number of scsi_request_fn() callers.
-+ *
-+ * To do: add support for scsi-mq in this function.
-+ */
-+static int scsi_request_fn_active(struct Scsi_Host *shost)
-+{
-+ struct scsi_device *sdev;
-+ struct request_queue *q;
-+ int request_fn_active = 0;
-+
-+ shost_for_each_device(sdev, shost) {
-+ q = sdev->request_queue;
-+
-+ spin_lock_irq(q->queue_lock);
-+ request_fn_active += q->request_fn_active;
-+ spin_unlock_irq(q->queue_lock);
-+ }
-+
-+ return request_fn_active;
-+}
-+
-+/* Wait until ongoing shost->hostt->queuecommand() calls have finished. */
-+static void srp_wait_for_queuecommand(struct Scsi_Host *shost)
-+{
-+ while (scsi_request_fn_active(shost))
-+ msleep(20);
-+}
-+
- static void __rport_fail_io_fast(struct srp_rport *rport)
- {
- struct Scsi_Host *shost = rport_to_shost(rport);
-@@ -410,8 +440,10 @@ static void __rport_fail_io_fast(struct srp_rport *rport)
-
- /* Involve the LLD if possible to terminate all I/O on the rport. */
- i = to_srp_internal(shost->transportt);
-- if (i->f->terminate_rport_io)
-+ if (i->f->terminate_rport_io) {
-+ srp_wait_for_queuecommand(shost);
- i->f->terminate_rport_io(rport);
-+ }
- }
-
- /**
-@@ -505,27 +537,6 @@ void srp_start_tl_fail_timers(struct srp_rport *rport)
- EXPORT_SYMBOL(srp_start_tl_fail_timers);
-
- /**
-- * scsi_request_fn_active() - number of kernel threads inside scsi_request_fn()
-- * @shost: SCSI host for which to count the number of scsi_request_fn() callers.
-- */
--static int scsi_request_fn_active(struct Scsi_Host *shost)
--{
-- struct scsi_device *sdev;
-- struct request_queue *q;
-- int request_fn_active = 0;
--
-- shost_for_each_device(sdev, shost) {
-- q = sdev->request_queue;
--
-- spin_lock_irq(q->queue_lock);
-- request_fn_active += q->request_fn_active;
-- spin_unlock_irq(q->queue_lock);
-- }
--
-- return request_fn_active;
--}
--
--/**
- * srp_reconnect_rport() - reconnect to an SRP target port
- * @rport: SRP target port.
- *
-@@ -560,8 +571,7 @@ int srp_reconnect_rport(struct srp_rport *rport)
- if (res)
- goto out;
- scsi_target_block(&shost->shost_gendev);
-- while (scsi_request_fn_active(shost))
-- msleep(20);
-+ srp_wait_for_queuecommand(shost);
- res = rport->state != SRP_RPORT_LOST ? i->f->reconnect(rport) : -ENODEV;
- pr_debug("%s (state %d): transport.reconnect() returned %d\n",
- dev_name(&shost->shost_gendev), rport->state, res);
-diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c
-index d6563ec..f3e3ae8 100644
---- a/drivers/spi/spi.c
-+++ b/drivers/spi/spi.c
-@@ -834,9 +834,6 @@ void spi_finalize_current_message(struct spi_master *master)
-
- spin_lock_irqsave(&master->queue_lock, flags);
- mesg = master->cur_msg;
-- master->cur_msg = NULL;
--
-- queue_kthread_work(&master->kworker, &master->pump_messages);
- spin_unlock_irqrestore(&master->queue_lock, flags);
-
- if (master->cur_msg_prepared && master->unprepare_message) {
-@@ -847,9 +844,13 @@ void spi_finalize_current_message(struct spi_master *master)
- }
- }
-
-- trace_spi_message_done(mesg);
--
-+ spin_lock_irqsave(&master->queue_lock, flags);
-+ master->cur_msg = NULL;
- master->cur_msg_prepared = false;
-+ queue_kthread_work(&master->kworker, &master->pump_messages);
-+ spin_unlock_irqrestore(&master->queue_lock, flags);
-+
-+ trace_spi_message_done(mesg);
-
- mesg->state = NULL;
- if (mesg->complete)
-diff --git a/drivers/staging/rtl8712/rtl8712_recv.c b/drivers/staging/rtl8712/rtl8712_recv.c
-index ea96537..d060b1f 100644
---- a/drivers/staging/rtl8712/rtl8712_recv.c
-+++ b/drivers/staging/rtl8712/rtl8712_recv.c
-@@ -1075,7 +1075,8 @@ static int recvbuf2recvframe(struct _adapter *padapter, struct sk_buff *pskb)
- /* for first fragment packet, driver need allocate 1536 +
- * drvinfo_sz + RXDESC_SIZE to defrag packet. */
- if ((mf == 1) && (frag == 0))
-- alloc_sz = 1658;/*1658+6=1664, 1664 is 128 alignment.*/
-+ /*1658+6=1664, 1664 is 128 alignment.*/
-+ alloc_sz = max_t(u16, tmp_len, 1658);
- else
- alloc_sz = tmp_len;
- /* 2 is for IP header 4 bytes alignment in QoS packet case.
-diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c
-index b61c555..c8d7b30 100644
---- a/drivers/target/iscsi/iscsi_target.c
-+++ b/drivers/target/iscsi/iscsi_target.c
-@@ -518,7 +518,7 @@ static struct iscsit_transport iscsi_target_transport = {
-
- static int __init iscsi_target_init_module(void)
- {
-- int ret = 0;
-+ int ret = 0, size;
-
- pr_debug("iSCSI-Target "ISCSIT_VERSION"\n");
-
-@@ -527,6 +527,7 @@ static int __init iscsi_target_init_module(void)
- pr_err("Unable to allocate memory for iscsit_global\n");
- return -1;
- }
-+ spin_lock_init(&iscsit_global->ts_bitmap_lock);
- mutex_init(&auth_id_lock);
- spin_lock_init(&sess_idr_lock);
- idr_init(&tiqn_idr);
-@@ -536,15 +537,11 @@ static int __init iscsi_target_init_module(void)
- if (ret < 0)
- goto out;
-
-- ret = iscsi_thread_set_init();
-- if (ret < 0)
-+ size = BITS_TO_LONGS(ISCSIT_BITMAP_BITS) * sizeof(long);
-+ iscsit_global->ts_bitmap = vzalloc(size);
-+ if (!iscsit_global->ts_bitmap) {
-+ pr_err("Unable to allocate iscsit_global->ts_bitmap\n");
- goto configfs_out;
--
-- if (iscsi_allocate_thread_sets(TARGET_THREAD_SET_COUNT) !=
-- TARGET_THREAD_SET_COUNT) {
-- pr_err("iscsi_allocate_thread_sets() returned"
-- " unexpected value!\n");
-- goto ts_out1;
- }
-
- lio_qr_cache = kmem_cache_create("lio_qr_cache",
-@@ -553,7 +550,7 @@ static int __init iscsi_target_init_module(void)
- if (!lio_qr_cache) {
- pr_err("nable to kmem_cache_create() for"
- " lio_qr_cache\n");
-- goto ts_out2;
-+ goto bitmap_out;
- }
-
- lio_dr_cache = kmem_cache_create("lio_dr_cache",
-@@ -597,10 +594,8 @@ dr_out:
- kmem_cache_destroy(lio_dr_cache);
- qr_out:
- kmem_cache_destroy(lio_qr_cache);
--ts_out2:
-- iscsi_deallocate_thread_sets();
--ts_out1:
-- iscsi_thread_set_free();
-+bitmap_out:
-+ vfree(iscsit_global->ts_bitmap);
- configfs_out:
- iscsi_target_deregister_configfs();
- out:
-@@ -610,8 +605,6 @@ out:
-
- static void __exit iscsi_target_cleanup_module(void)
- {
-- iscsi_deallocate_thread_sets();
-- iscsi_thread_set_free();
- iscsit_release_discovery_tpg();
- iscsit_unregister_transport(&iscsi_target_transport);
- kmem_cache_destroy(lio_qr_cache);
-@@ -621,6 +614,7 @@ static void __exit iscsi_target_cleanup_module(void)
-
- iscsi_target_deregister_configfs();
-
-+ vfree(iscsit_global->ts_bitmap);
- kfree(iscsit_global);
- }
-
-@@ -3653,17 +3647,16 @@ static int iscsit_send_reject(
-
- void iscsit_thread_get_cpumask(struct iscsi_conn *conn)
- {
-- struct iscsi_thread_set *ts = conn->thread_set;
- int ord, cpu;
- /*
-- * thread_id is assigned from iscsit_global->ts_bitmap from
-- * within iscsi_thread_set.c:iscsi_allocate_thread_sets()
-+ * bitmap_id is assigned from iscsit_global->ts_bitmap from
-+ * within iscsit_start_kthreads()
- *
-- * Here we use thread_id to determine which CPU that this
-- * iSCSI connection's iscsi_thread_set will be scheduled to
-+ * Here we use bitmap_id to determine which CPU that this
-+ * iSCSI connection's RX/TX threads will be scheduled to
- * execute upon.
- */
-- ord = ts->thread_id % cpumask_weight(cpu_online_mask);
-+ ord = conn->bitmap_id % cpumask_weight(cpu_online_mask);
- for_each_online_cpu(cpu) {
- if (ord-- == 0) {
- cpumask_set_cpu(cpu, conn->conn_cpumask);
-@@ -3855,7 +3848,7 @@ check_rsp_state:
- switch (state) {
- case ISTATE_SEND_LOGOUTRSP:
- if (!iscsit_logout_post_handler(cmd, conn))
-- goto restart;
-+ return -ECONNRESET;
- /* fall through */
- case ISTATE_SEND_STATUS:
- case ISTATE_SEND_ASYNCMSG:
-@@ -3883,8 +3876,6 @@ check_rsp_state:
-
- err:
- return -1;
--restart:
-- return -EAGAIN;
- }
-
- static int iscsit_handle_response_queue(struct iscsi_conn *conn)
-@@ -3911,21 +3902,13 @@ static int iscsit_handle_response_queue(struct iscsi_conn *conn)
- int iscsi_target_tx_thread(void *arg)
- {
- int ret = 0;
-- struct iscsi_conn *conn;
-- struct iscsi_thread_set *ts = arg;
-+ struct iscsi_conn *conn = arg;
- /*
- * Allow ourselves to be interrupted by SIGINT so that a
- * connection recovery / failure event can be triggered externally.
- */
- allow_signal(SIGINT);
-
--restart:
-- conn = iscsi_tx_thread_pre_handler(ts);
-- if (!conn)
-- goto out;
--
-- ret = 0;
--
- while (!kthread_should_stop()) {
- /*
- * Ensure that both TX and RX per connection kthreads
-@@ -3934,11 +3917,9 @@ restart:
- iscsit_thread_check_cpumask(conn, current, 1);
-
- wait_event_interruptible(conn->queues_wq,
-- !iscsit_conn_all_queues_empty(conn) ||
-- ts->status == ISCSI_THREAD_SET_RESET);
-+ !iscsit_conn_all_queues_empty(conn));
-
-- if ((ts->status == ISCSI_THREAD_SET_RESET) ||
-- signal_pending(current))
-+ if (signal_pending(current))
- goto transport_err;
-
- get_immediate:
-@@ -3949,15 +3930,14 @@ get_immediate:
- ret = iscsit_handle_response_queue(conn);
- if (ret == 1)
- goto get_immediate;
-- else if (ret == -EAGAIN)
-- goto restart;
-+ else if (ret == -ECONNRESET)
-+ goto out;
- else if (ret < 0)
- goto transport_err;
- }
-
- transport_err:
- iscsit_take_action_for_connection_exit(conn);
-- goto restart;
- out:
- return 0;
- }
-@@ -4046,8 +4026,7 @@ int iscsi_target_rx_thread(void *arg)
- int ret;
- u8 buffer[ISCSI_HDR_LEN], opcode;
- u32 checksum = 0, digest = 0;
-- struct iscsi_conn *conn = NULL;
-- struct iscsi_thread_set *ts = arg;
-+ struct iscsi_conn *conn = arg;
- struct kvec iov;
- /*
- * Allow ourselves to be interrupted by SIGINT so that a
-@@ -4055,11 +4034,6 @@ int iscsi_target_rx_thread(void *arg)
- */
- allow_signal(SIGINT);
-
--restart:
-- conn = iscsi_rx_thread_pre_handler(ts);
-- if (!conn)
-- goto out;
--
- if (conn->conn_transport->transport_type == ISCSI_INFINIBAND) {
- struct completion comp;
- int rc;
-@@ -4069,7 +4043,7 @@ restart:
- if (rc < 0)
- goto transport_err;
-
-- goto out;
-+ goto transport_err;
- }
-
- while (!kthread_should_stop()) {
-@@ -4145,8 +4119,6 @@ transport_err:
- if (!signal_pending(current))
- atomic_set(&conn->transport_failed, 1);
- iscsit_take_action_for_connection_exit(conn);
-- goto restart;
--out:
- return 0;
- }
-
-@@ -4208,7 +4180,24 @@ int iscsit_close_connection(
- if (conn->conn_transport->transport_type == ISCSI_TCP)
- complete(&conn->conn_logout_comp);
-
-- iscsi_release_thread_set(conn);
-+ if (!strcmp(current->comm, ISCSI_RX_THREAD_NAME)) {
-+ if (conn->tx_thread &&
-+ cmpxchg(&conn->tx_thread_active, true, false)) {
-+ send_sig(SIGINT, conn->tx_thread, 1);
-+ kthread_stop(conn->tx_thread);
-+ }
-+ } else if (!strcmp(current->comm, ISCSI_TX_THREAD_NAME)) {
-+ if (conn->rx_thread &&
-+ cmpxchg(&conn->rx_thread_active, true, false)) {
-+ send_sig(SIGINT, conn->rx_thread, 1);
-+ kthread_stop(conn->rx_thread);
-+ }
-+ }
-+
-+ spin_lock(&iscsit_global->ts_bitmap_lock);
-+ bitmap_release_region(iscsit_global->ts_bitmap, conn->bitmap_id,
-+ get_order(1));
-+ spin_unlock(&iscsit_global->ts_bitmap_lock);
-
- iscsit_stop_timers_for_cmds(conn);
- iscsit_stop_nopin_response_timer(conn);
-@@ -4487,15 +4476,13 @@ static void iscsit_logout_post_handler_closesession(
- struct iscsi_conn *conn)
- {
- struct iscsi_session *sess = conn->sess;
--
-- iscsi_set_thread_clear(conn, ISCSI_CLEAR_TX_THREAD);
-- iscsi_set_thread_set_signal(conn, ISCSI_SIGNAL_TX_THREAD);
-+ int sleep = cmpxchg(&conn->tx_thread_active, true, false);
-
- atomic_set(&conn->conn_logout_remove, 0);
- complete(&conn->conn_logout_comp);
-
- iscsit_dec_conn_usage_count(conn);
-- iscsit_stop_session(sess, 1, 1);
-+ iscsit_stop_session(sess, sleep, sleep);
- iscsit_dec_session_usage_count(sess);
- target_put_session(sess->se_sess);
- }
-@@ -4503,13 +4490,12 @@ static void iscsit_logout_post_handler_closesession(
- static void iscsit_logout_post_handler_samecid(
- struct iscsi_conn *conn)
- {
-- iscsi_set_thread_clear(conn, ISCSI_CLEAR_TX_THREAD);
-- iscsi_set_thread_set_signal(conn, ISCSI_SIGNAL_TX_THREAD);
-+ int sleep = cmpxchg(&conn->tx_thread_active, true, false);
-
- atomic_set(&conn->conn_logout_remove, 0);
- complete(&conn->conn_logout_comp);
-
-- iscsit_cause_connection_reinstatement(conn, 1);
-+ iscsit_cause_connection_reinstatement(conn, sleep);
- iscsit_dec_conn_usage_count(conn);
- }
-
-diff --git a/drivers/target/iscsi/iscsi_target_core.h b/drivers/target/iscsi/iscsi_target_core.h
-index 1d4a8c8..825b579 100644
---- a/drivers/target/iscsi/iscsi_target_core.h
-+++ b/drivers/target/iscsi/iscsi_target_core.h
-@@ -601,6 +601,11 @@ struct iscsi_conn {
- struct iscsi_session *sess;
- /* Pointer to thread_set in use for this conn's threads */
- struct iscsi_thread_set *thread_set;
-+ int bitmap_id;
-+ int rx_thread_active;
-+ struct task_struct *rx_thread;
-+ int tx_thread_active;
-+ struct task_struct *tx_thread;
- /* list_head for session connection list */
- struct list_head conn_list;
- } ____cacheline_aligned;
-@@ -869,10 +874,12 @@ struct iscsit_global {
- /* Unique identifier used for the authentication daemon */
- u32 auth_id;
- u32 inactive_ts;
-+#define ISCSIT_BITMAP_BITS 262144
- /* Thread Set bitmap count */
- int ts_bitmap_count;
- /* Thread Set bitmap pointer */
- unsigned long *ts_bitmap;
-+ spinlock_t ts_bitmap_lock;
- /* Used for iSCSI discovery session authentication */
- struct iscsi_node_acl discovery_acl;
- struct iscsi_portal_group *discovery_tpg;
-diff --git a/drivers/target/iscsi/iscsi_target_erl0.c b/drivers/target/iscsi/iscsi_target_erl0.c
-index 0d1e6ee..7396d90 100644
---- a/drivers/target/iscsi/iscsi_target_erl0.c
-+++ b/drivers/target/iscsi/iscsi_target_erl0.c
-@@ -864,7 +864,10 @@ void iscsit_connection_reinstatement_rcfr(struct iscsi_conn *conn)
- }
- spin_unlock_bh(&conn->state_lock);
-
-- iscsi_thread_set_force_reinstatement(conn);
-+ if (conn->tx_thread && conn->tx_thread_active)
-+ send_sig(SIGINT, conn->tx_thread, 1);
-+ if (conn->rx_thread && conn->rx_thread_active)
-+ send_sig(SIGINT, conn->rx_thread, 1);
-
- sleep:
- wait_for_completion(&conn->conn_wait_rcfr_comp);
-@@ -889,10 +892,10 @@ void iscsit_cause_connection_reinstatement(struct iscsi_conn *conn, int sleep)
- return;
- }
-
-- if (iscsi_thread_set_force_reinstatement(conn) < 0) {
-- spin_unlock_bh(&conn->state_lock);
-- return;
-- }
-+ if (conn->tx_thread && conn->tx_thread_active)
-+ send_sig(SIGINT, conn->tx_thread, 1);
-+ if (conn->rx_thread && conn->rx_thread_active)
-+ send_sig(SIGINT, conn->rx_thread, 1);
-
- atomic_set(&conn->connection_reinstatement, 1);
- if (!sleep) {
-diff --git a/drivers/target/iscsi/iscsi_target_login.c b/drivers/target/iscsi/iscsi_target_login.c
-index c5d3811..449df09 100644
---- a/drivers/target/iscsi/iscsi_target_login.c
-+++ b/drivers/target/iscsi/iscsi_target_login.c
-@@ -681,6 +681,51 @@ static void iscsi_post_login_start_timers(struct iscsi_conn *conn)
- iscsit_start_nopin_timer(conn);
- }
-
-+int iscsit_start_kthreads(struct iscsi_conn *conn)
-+{
-+ int ret = 0;
-+
-+ spin_lock(&iscsit_global->ts_bitmap_lock);
-+ conn->bitmap_id = bitmap_find_free_region(iscsit_global->ts_bitmap,
-+ ISCSIT_BITMAP_BITS, get_order(1));
-+ spin_unlock(&iscsit_global->ts_bitmap_lock);
-+
-+ if (conn->bitmap_id < 0) {
-+ pr_err("bitmap_find_free_region() failed for"
-+ " iscsit_start_kthreads()\n");
-+ return -ENOMEM;
-+ }
-+
-+ conn->tx_thread = kthread_run(iscsi_target_tx_thread, conn,
-+ "%s", ISCSI_TX_THREAD_NAME);
-+ if (IS_ERR(conn->tx_thread)) {
-+ pr_err("Unable to start iscsi_target_tx_thread\n");
-+ ret = PTR_ERR(conn->tx_thread);
-+ goto out_bitmap;
-+ }
-+ conn->tx_thread_active = true;
-+
-+ conn->rx_thread = kthread_run(iscsi_target_rx_thread, conn,
-+ "%s", ISCSI_RX_THREAD_NAME);
-+ if (IS_ERR(conn->rx_thread)) {
-+ pr_err("Unable to start iscsi_target_rx_thread\n");
-+ ret = PTR_ERR(conn->rx_thread);
-+ goto out_tx;
-+ }
-+ conn->rx_thread_active = true;
-+
-+ return 0;
-+out_tx:
-+ kthread_stop(conn->tx_thread);
-+ conn->tx_thread_active = false;
-+out_bitmap:
-+ spin_lock(&iscsit_global->ts_bitmap_lock);
-+ bitmap_release_region(iscsit_global->ts_bitmap, conn->bitmap_id,
-+ get_order(1));
-+ spin_unlock(&iscsit_global->ts_bitmap_lock);
-+ return ret;
-+}
-+
- int iscsi_post_login_handler(
- struct iscsi_np *np,
- struct iscsi_conn *conn,
-@@ -691,7 +736,7 @@ int iscsi_post_login_handler(
- struct se_session *se_sess = sess->se_sess;
- struct iscsi_portal_group *tpg = sess->tpg;
- struct se_portal_group *se_tpg = &tpg->tpg_se_tpg;
-- struct iscsi_thread_set *ts;
-+ int rc;
-
- iscsit_inc_conn_usage_count(conn);
-
-@@ -706,7 +751,6 @@ int iscsi_post_login_handler(
- /*
- * SCSI Initiator -> SCSI Target Port Mapping
- */
-- ts = iscsi_get_thread_set();
- if (!zero_tsih) {
- iscsi_set_session_parameters(sess->sess_ops,
- conn->param_list, 0);
-@@ -733,9 +777,11 @@ int iscsi_post_login_handler(
- sess->sess_ops->InitiatorName);
- spin_unlock_bh(&sess->conn_lock);
-
-- iscsi_post_login_start_timers(conn);
-+ rc = iscsit_start_kthreads(conn);
-+ if (rc)
-+ return rc;
-
-- iscsi_activate_thread_set(conn, ts);
-+ iscsi_post_login_start_timers(conn);
- /*
- * Determine CPU mask to ensure connection's RX and TX kthreads
- * are scheduled on the same CPU.
-@@ -792,8 +838,11 @@ int iscsi_post_login_handler(
- " iSCSI Target Portal Group: %hu\n", tpg->nsessions, tpg->tpgt);
- spin_unlock_bh(&se_tpg->session_lock);
-
-+ rc = iscsit_start_kthreads(conn);
-+ if (rc)
-+ return rc;
-+
- iscsi_post_login_start_timers(conn);
-- iscsi_activate_thread_set(conn, ts);
- /*
- * Determine CPU mask to ensure connection's RX and TX kthreads
- * are scheduled on the same CPU.
-diff --git a/drivers/thermal/step_wise.c b/drivers/thermal/step_wise.c
-index ee52ab7..c501eba 100644
---- a/drivers/thermal/step_wise.c
-+++ b/drivers/thermal/step_wise.c
-@@ -76,7 +76,7 @@ static unsigned long get_target_state(struct thermal_instance *instance,
- next_target = instance->upper;
- break;
- case THERMAL_TREND_DROPPING:
-- if (cur_state == instance->lower) {
-+ if (cur_state <= instance->lower) {
- if (!throttle)
- next_target = THERMAL_NO_TARGET;
- } else {
-diff --git a/drivers/usb/core/devio.c b/drivers/usb/core/devio.c
-index 45b7b96..8016aaa 100644
---- a/drivers/usb/core/devio.c
-+++ b/drivers/usb/core/devio.c
-@@ -513,7 +513,7 @@ static void async_completed(struct urb *urb)
- snoop(&urb->dev->dev, "urb complete\n");
- snoop_urb(urb->dev, as->userurb, urb->pipe, urb->actual_length,
- as->status, COMPLETE, NULL, 0);
-- if ((urb->transfer_flags & URB_DIR_MASK) == USB_DIR_IN)
-+ if ((urb->transfer_flags & URB_DIR_MASK) == URB_DIR_IN)
- snoop_urb_data(urb, urb->actual_length);
-
- if (as->status < 0 && as->bulk_addr && as->status != -ECONNRESET &&
-@@ -1591,7 +1591,7 @@ static struct async *reap_as(struct dev_state *ps)
- for (;;) {
- __set_current_state(TASK_INTERRUPTIBLE);
- as = async_getcompleted(ps);
-- if (as)
-+ if (as || !connected(ps))
- break;
- if (signal_pending(current))
- break;
-@@ -1614,7 +1614,7 @@ static int proc_reapurb(struct dev_state *ps, void __user *arg)
- }
- if (signal_pending(current))
- return -EINTR;
-- return -EIO;
-+ return -ENODEV;
- }
-
- static int proc_reapurbnonblock(struct dev_state *ps, void __user *arg)
-@@ -1623,10 +1623,11 @@ static int proc_reapurbnonblock(struct dev_state *ps, void __user *arg)
- struct async *as;
-
- as = async_getcompleted(ps);
-- retval = -EAGAIN;
- if (as) {
- retval = processcompl(as, (void __user * __user *)arg);
- free_async(as);
-+ } else {
-+ retval = (connected(ps) ? -EAGAIN : -ENODEV);
- }
- return retval;
- }
-@@ -1756,7 +1757,7 @@ static int proc_reapurb_compat(struct dev_state *ps, void __user *arg)
- }
- if (signal_pending(current))
- return -EINTR;
-- return -EIO;
-+ return -ENODEV;
- }
-
- static int proc_reapurbnonblock_compat(struct dev_state *ps, void __user *arg)
-@@ -1764,11 +1765,12 @@ static int proc_reapurbnonblock_compat(struct dev_state *ps, void __user *arg)
- int retval;
- struct async *as;
-
-- retval = -EAGAIN;
- as = async_getcompleted(ps);
- if (as) {
- retval = processcompl_compat(as, (void __user * __user *)arg);
- free_async(as);
-+ } else {
-+ retval = (connected(ps) ? -EAGAIN : -ENODEV);
- }
- return retval;
- }
-@@ -1940,7 +1942,8 @@ static int proc_get_capabilities(struct dev_state *ps, void __user *arg)
- {
- __u32 caps;
-
-- caps = USBDEVFS_CAP_ZERO_PACKET | USBDEVFS_CAP_NO_PACKET_SIZE_LIM;
-+ caps = USBDEVFS_CAP_ZERO_PACKET | USBDEVFS_CAP_NO_PACKET_SIZE_LIM |
-+ USBDEVFS_CAP_REAP_AFTER_DISCONNECT;
- if (!ps->dev->bus->no_stop_on_short)
- caps |= USBDEVFS_CAP_BULK_CONTINUATION;
- if (ps->dev->bus->sg_tablesize)
-@@ -2001,6 +2004,32 @@ static long usbdev_do_ioctl(struct file *file, unsigned int cmd,
- return -EPERM;
-
- usb_lock_device(dev);
-+
-+ /* Reap operations are allowed even after disconnection */
-+ switch (cmd) {
-+ case USBDEVFS_REAPURB:
-+ snoop(&dev->dev, "%s: REAPURB\n", __func__);
-+ ret = proc_reapurb(ps, p);
-+ goto done;
-+
-+ case USBDEVFS_REAPURBNDELAY:
-+ snoop(&dev->dev, "%s: REAPURBNDELAY\n", __func__);
-+ ret = proc_reapurbnonblock(ps, p);
-+ goto done;
-+
-+#ifdef CONFIG_COMPAT
-+ case USBDEVFS_REAPURB32:
-+ snoop(&dev->dev, "%s: REAPURB32\n", __func__);
-+ ret = proc_reapurb_compat(ps, p);
-+ goto done;
-+
-+ case USBDEVFS_REAPURBNDELAY32:
-+ snoop(&dev->dev, "%s: REAPURBNDELAY32\n", __func__);
-+ ret = proc_reapurbnonblock_compat(ps, p);
-+ goto done;
-+#endif
-+ }
-+
- if (!connected(ps)) {
- usb_unlock_device(dev);
- return -ENODEV;
-@@ -2094,16 +2123,6 @@ static long usbdev_do_ioctl(struct file *file, unsigned int cmd,
- inode->i_mtime = CURRENT_TIME;
- break;
-
-- case USBDEVFS_REAPURB32:
-- snoop(&dev->dev, "%s: REAPURB32\n", __func__);
-- ret = proc_reapurb_compat(ps, p);
-- break;
--
-- case USBDEVFS_REAPURBNDELAY32:
-- snoop(&dev->dev, "%s: REAPURBNDELAY32\n", __func__);
-- ret = proc_reapurbnonblock_compat(ps, p);
-- break;
--
- case USBDEVFS_IOCTL32:
- snoop(&dev->dev, "%s: IOCTL32\n", __func__);
- ret = proc_ioctl_compat(ps, ptr_to_compat(p));
-@@ -2115,16 +2134,6 @@ static long usbdev_do_ioctl(struct file *file, unsigned int cmd,
- ret = proc_unlinkurb(ps, p);
- break;
-
-- case USBDEVFS_REAPURB:
-- snoop(&dev->dev, "%s: REAPURB\n", __func__);
-- ret = proc_reapurb(ps, p);
-- break;
--
-- case USBDEVFS_REAPURBNDELAY:
-- snoop(&dev->dev, "%s: REAPURBNDELAY\n", __func__);
-- ret = proc_reapurbnonblock(ps, p);
-- break;
--
- case USBDEVFS_DISCSIGNAL:
- snoop(&dev->dev, "%s: DISCSIGNAL\n", __func__);
- ret = proc_disconnectsignal(ps, p);
-@@ -2161,6 +2170,8 @@ static long usbdev_do_ioctl(struct file *file, unsigned int cmd,
- ret = proc_disconnect_claim(ps, p);
- break;
- }
-+
-+ done:
- usb_unlock_device(dev);
- if (ret >= 0)
- inode->i_atime = CURRENT_TIME;
-diff --git a/drivers/usb/dwc3/ep0.c b/drivers/usb/dwc3/ep0.c
-index 0985ff7..a05fc58 100644
---- a/drivers/usb/dwc3/ep0.c
-+++ b/drivers/usb/dwc3/ep0.c
-@@ -707,6 +707,10 @@ static int dwc3_ep0_std_request(struct dwc3 *dwc, struct usb_ctrlrequest *ctrl)
- dev_vdbg(dwc->dev, "USB_REQ_SET_ISOCH_DELAY\n");
- ret = dwc3_ep0_set_isoch_delay(dwc, ctrl);
- break;
-+ case USB_REQ_SET_INTERFACE:
-+ dev_vdbg(dwc->dev, "USB_REQ_SET_INTERFACE\n");
-+ dwc->start_config_issued = false;
-+ /* Fall through */
- default:
- dev_vdbg(dwc->dev, "Forwarding to gadget driver\n");
- ret = dwc3_ep0_delegate_req(dwc, ctrl);
-diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
-index 8f6738d..a57ad1f 100644
---- a/drivers/usb/dwc3/gadget.c
-+++ b/drivers/usb/dwc3/gadget.c
-@@ -299,6 +299,8 @@ int dwc3_send_gadget_generic_command(struct dwc3 *dwc, int cmd, u32 param)
- if (!(reg & DWC3_DGCMD_CMDACT)) {
- dev_vdbg(dwc->dev, "Command Complete --> %d\n",
- DWC3_DGCMD_STATUS(reg));
-+ if (DWC3_DGCMD_STATUS(reg))
-+ return -EINVAL;
- return 0;
- }
-
-@@ -335,6 +337,8 @@ int dwc3_send_gadget_ep_cmd(struct dwc3 *dwc, unsigned ep,
- if (!(reg & DWC3_DEPCMD_CMDACT)) {
- dev_vdbg(dwc->dev, "Command Complete --> %d\n",
- DWC3_DEPCMD_STATUS(reg));
-+ if (DWC3_DEPCMD_STATUS(reg))
-+ return -EINVAL;
- return 0;
- }
-
-diff --git a/drivers/usb/host/xhci-mem.c b/drivers/usb/host/xhci-mem.c
-index 9bce4f0..f8893b3 100644
---- a/drivers/usb/host/xhci-mem.c
-+++ b/drivers/usb/host/xhci-mem.c
-@@ -1331,10 +1331,10 @@ int xhci_endpoint_init(struct xhci_hcd *xhci,
- /* Attempt to use the ring cache */
- if (virt_dev->num_rings_cached == 0)
- return -ENOMEM;
-+ virt_dev->num_rings_cached--;
- virt_dev->eps[ep_index].new_ring =
- virt_dev->ring_cache[virt_dev->num_rings_cached];
- virt_dev->ring_cache[virt_dev->num_rings_cached] = NULL;
-- virt_dev->num_rings_cached--;
- xhci_reinit_cached_ring(xhci, virt_dev->eps[ep_index].new_ring,
- 1, type);
- }
-diff --git a/drivers/usb/musb/musb_virthub.c b/drivers/usb/musb/musb_virthub.c
-index 0241a3a..1e9bde4 100644
---- a/drivers/usb/musb/musb_virthub.c
-+++ b/drivers/usb/musb/musb_virthub.c
-@@ -273,9 +273,7 @@ static int musb_has_gadget(struct musb *musb)
- #ifdef CONFIG_USB_MUSB_HOST
- return 1;
- #else
-- if (musb->port_mode == MUSB_PORT_MODE_HOST)
-- return 1;
-- return musb->g.dev.driver != NULL;
-+ return musb->port_mode == MUSB_PORT_MODE_HOST;
- #endif
- }
-
-diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c
-index 73c7292..d11335d 100644
---- a/drivers/usb/serial/cp210x.c
-+++ b/drivers/usb/serial/cp210x.c
-@@ -187,6 +187,7 @@ static const struct usb_device_id id_table[] = {
- { USB_DEVICE(0x1FB9, 0x0602) }, /* Lake Shore Model 648 Magnet Power Supply */
- { USB_DEVICE(0x1FB9, 0x0700) }, /* Lake Shore Model 737 VSM Controller */
- { USB_DEVICE(0x1FB9, 0x0701) }, /* Lake Shore Model 776 Hall Matrix */
-+ { USB_DEVICE(0x2626, 0xEA60) }, /* Aruba Networks 7xxx USB Serial Console */
- { USB_DEVICE(0x3195, 0xF190) }, /* Link Instruments MSO-19 */
- { USB_DEVICE(0x3195, 0xF280) }, /* Link Instruments MSO-28 */
- { USB_DEVICE(0x3195, 0xF281) }, /* Link Instruments MSO-28 */
-diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
-index 8b34841..096438e 100644
---- a/drivers/usb/serial/option.c
-+++ b/drivers/usb/serial/option.c
-@@ -1755,6 +1755,7 @@ static const struct usb_device_id option_ids[] = {
- { USB_DEVICE_AND_INTERFACE_INFO(0x2001, 0x7d03, 0xff, 0x00, 0x00) },
- { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e01, 0xff, 0xff, 0xff) }, /* D-Link DWM-152/C1 */
- { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e02, 0xff, 0xff, 0xff) }, /* D-Link DWM-156/C1 */
-+ { USB_DEVICE_INTERFACE_CLASS(0x2020, 0x4000, 0xff) }, /* OLICARD300 - MT6225 */
- { USB_DEVICE(INOVIA_VENDOR_ID, INOVIA_SEW858) },
- { USB_DEVICE(VIATELECOM_VENDOR_ID, VIATELECOM_PRODUCT_CDS7) },
- { } /* Terminating entry */
-diff --git a/drivers/usb/serial/usb-serial.c b/drivers/usb/serial/usb-serial.c
-index 9a08e18..3d66e9c 100644
---- a/drivers/usb/serial/usb-serial.c
-+++ b/drivers/usb/serial/usb-serial.c
-@@ -1300,6 +1300,7 @@ static void __exit usb_serial_exit(void)
- tty_unregister_driver(usb_serial_tty_driver);
- put_tty_driver(usb_serial_tty_driver);
- bus_unregister(&usb_serial_bus_type);
-+ idr_destroy(&serial_minors);
- }
-
-
-diff --git a/drivers/watchdog/omap_wdt.c b/drivers/watchdog/omap_wdt.c
-index 09cf013..90a6406 100644
---- a/drivers/watchdog/omap_wdt.c
-+++ b/drivers/watchdog/omap_wdt.c
-@@ -134,6 +134,13 @@ static int omap_wdt_start(struct watchdog_device *wdog)
-
- pm_runtime_get_sync(wdev->dev);
-
-+ /*
-+ * Make sure the watchdog is disabled. This is unfortunately required
-+ * because writing to various registers with the watchdog running has no
-+ * effect.
-+ */
-+ omap_wdt_disable(wdev);
-+
- /* initialize prescaler */
- while (readl_relaxed(base + OMAP_WATCHDOG_WPS) & 0x01)
- cpu_relax();
-diff --git a/fs/9p/vfs_inode.c b/fs/9p/vfs_inode.c
-index bb7991c..bfdeadb 100644
---- a/fs/9p/vfs_inode.c
-+++ b/fs/9p/vfs_inode.c
-@@ -540,8 +540,7 @@ static struct inode *v9fs_qid_iget(struct super_block *sb,
- unlock_new_inode(inode);
- return inode;
- error:
-- unlock_new_inode(inode);
-- iput(inode);
-+ iget_failed(inode);
- return ERR_PTR(retval);
-
- }
-diff --git a/fs/9p/vfs_inode_dotl.c b/fs/9p/vfs_inode_dotl.c
-index 59dc8e8..de8606c 100644
---- a/fs/9p/vfs_inode_dotl.c
-+++ b/fs/9p/vfs_inode_dotl.c
-@@ -149,8 +149,7 @@ static struct inode *v9fs_qid_iget_dotl(struct super_block *sb,
- unlock_new_inode(inode);
- return inode;
- error:
-- unlock_new_inode(inode);
-- iput(inode);
-+ iget_failed(inode);
- return ERR_PTR(retval);
-
- }
-diff --git a/fs/bio.c b/fs/bio.c
-index 8754e7b..b2b1451 100644
---- a/fs/bio.c
-+++ b/fs/bio.c
-@@ -1806,8 +1806,9 @@ EXPORT_SYMBOL(bio_endio_nodec);
- * Allocates and returns a new bio which represents @sectors from the start of
- * @bio, and updates @bio to represent the remaining sectors.
- *
-- * The newly allocated bio will point to @bio's bi_io_vec; it is the caller's
-- * responsibility to ensure that @bio is not freed before the split.
-+ * Unless this is a discard request the newly allocated bio will point
-+ * to @bio's bi_io_vec; it is the caller's responsibility to ensure that
-+ * @bio is not freed before the split.
- */
- struct bio *bio_split(struct bio *bio, int sectors,
- gfp_t gfp, struct bio_set *bs)
-@@ -1817,7 +1818,15 @@ struct bio *bio_split(struct bio *bio, int sectors,
- BUG_ON(sectors <= 0);
- BUG_ON(sectors >= bio_sectors(bio));
-
-- split = bio_clone_fast(bio, gfp, bs);
-+ /*
-+ * Discards need a mutable bio_vec to accommodate the payload
-+ * required by the DSM TRIM and UNMAP commands.
-+ */
-+ if (bio->bi_rw & REQ_DISCARD)
-+ split = bio_clone_bioset(bio, gfp, bs);
-+ else
-+ split = bio_clone_fast(bio, gfp, bs);
-+
- if (!split)
- return NULL;
-
-diff --git a/fs/btrfs/inode-map.c b/fs/btrfs/inode-map.c
-index ab485e5..644942a 100644
---- a/fs/btrfs/inode-map.c
-+++ b/fs/btrfs/inode-map.c
-@@ -281,7 +281,7 @@ void btrfs_unpin_free_ino(struct btrfs_root *root)
- __btrfs_add_free_space(ctl, info->offset, count);
- free:
- rb_erase(&info->offset_index, rbroot);
-- kfree(info);
-+ kmem_cache_free(btrfs_free_space_cachep, info);
- }
- }
-
-diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
-index 3e16042..d40ae42 100644
---- a/fs/btrfs/ioctl.c
-+++ b/fs/btrfs/ioctl.c
-@@ -2743,7 +2743,7 @@ out_unlock:
- static long btrfs_ioctl_file_extent_same(struct file *file,
- struct btrfs_ioctl_same_args __user *argp)
- {
-- struct btrfs_ioctl_same_args *same;
-+ struct btrfs_ioctl_same_args *same = NULL;
- struct btrfs_ioctl_same_extent_info *info;
- struct inode *src = file_inode(file);
- u64 off;
-@@ -2773,6 +2773,7 @@ static long btrfs_ioctl_file_extent_same(struct file *file,
-
- if (IS_ERR(same)) {
- ret = PTR_ERR(same);
-+ same = NULL;
- goto out;
- }
-
-@@ -2843,6 +2844,7 @@ static long btrfs_ioctl_file_extent_same(struct file *file,
-
- out:
- mnt_drop_write_file(file);
-+ kfree(same);
- return ret;
- }
-
-diff --git a/fs/ext4/indirect.c b/fs/ext4/indirect.c
-index e6574d7..a7c5277 100644
---- a/fs/ext4/indirect.c
-+++ b/fs/ext4/indirect.c
-@@ -576,7 +576,7 @@ int ext4_ind_map_blocks(handle_t *handle, struct inode *inode,
- EXT4_FEATURE_RO_COMPAT_BIGALLOC)) {
- EXT4_ERROR_INODE(inode, "Can't allocate blocks for "
- "non-extent mapped inodes with bigalloc");
-- return -ENOSPC;
-+ return -EUCLEAN;
- }
-
- goal = ext4_find_goal(inode, map->m_lblk, partial);
-diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
-index da03340..f9c63ae 100644
---- a/fs/ext4/inode.c
-+++ b/fs/ext4/inode.c
-@@ -1357,7 +1357,7 @@ static void ext4_da_page_release_reservation(struct page *page,
- unsigned int offset,
- unsigned int length)
- {
-- int to_release = 0;
-+ int to_release = 0, contiguous_blks = 0;
- struct buffer_head *head, *bh;
- unsigned int curr_off = 0;
- struct inode *inode = page->mapping->host;
-@@ -1378,14 +1378,23 @@ static void ext4_da_page_release_reservation(struct page *page,
-
- if ((offset <= curr_off) && (buffer_delay(bh))) {
- to_release++;
-+ contiguous_blks++;
- clear_buffer_delay(bh);
-+ } else if (contiguous_blks) {
-+ lblk = page->index <<
-+ (PAGE_CACHE_SHIFT - inode->i_blkbits);
-+ lblk += (curr_off >> inode->i_blkbits) -
-+ contiguous_blks;
-+ ext4_es_remove_extent(inode, lblk, contiguous_blks);
-+ contiguous_blks = 0;
- }
- curr_off = next_off;
- } while ((bh = bh->b_this_page) != head);
-
-- if (to_release) {
-+ if (contiguous_blks) {
- lblk = page->index << (PAGE_CACHE_SHIFT - inode->i_blkbits);
-- ext4_es_remove_extent(inode, lblk, to_release);
-+ lblk += (curr_off >> inode->i_blkbits) - contiguous_blks;
-+ ext4_es_remove_extent(inode, lblk, contiguous_blks);
- }
-
- /* If we have released all the blocks belonging to a cluster, then we
-@@ -1744,19 +1753,32 @@ static int __ext4_journalled_writepage(struct page *page,
- ext4_walk_page_buffers(handle, page_bufs, 0, len,
- NULL, bget_one);
- }
-- /* As soon as we unlock the page, it can go away, but we have
-- * references to buffers so we are safe */
-+ /*
-+ * We need to release the page lock before we start the
-+ * journal, so grab a reference so the page won't disappear
-+ * out from under us.
-+ */
-+ get_page(page);
- unlock_page(page);
-
- handle = ext4_journal_start(inode, EXT4_HT_WRITE_PAGE,
- ext4_writepage_trans_blocks(inode));
- if (IS_ERR(handle)) {
- ret = PTR_ERR(handle);
-- goto out;
-+ put_page(page);
-+ goto out_no_pagelock;
- }
--
- BUG_ON(!ext4_handle_valid(handle));
-
-+ lock_page(page);
-+ put_page(page);
-+ if (page->mapping != mapping) {
-+ /* The page got truncated from under us */
-+ ext4_journal_stop(handle);
-+ ret = 0;
-+ goto out;
-+ }
-+
- if (inline_data) {
- ret = ext4_journal_get_write_access(handle, inode_bh);
-
-@@ -1781,6 +1803,8 @@ static int __ext4_journalled_writepage(struct page *page,
- NULL, bput_one);
- ext4_set_inode_state(inode, EXT4_STATE_JDATA);
- out:
-+ unlock_page(page);
-+out_no_pagelock:
- brelse(inode_bh);
- return ret;
- }
-diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c
-index 7620133..c4a5e4d 100644
---- a/fs/ext4/mballoc.c
-+++ b/fs/ext4/mballoc.c
-@@ -4793,18 +4793,12 @@ do_more:
- /*
- * blocks being freed are metadata. these blocks shouldn't
- * be used until this transaction is committed
-+ *
-+ * We use __GFP_NOFAIL because ext4_free_blocks() is not allowed
-+ * to fail.
- */
-- retry:
-- new_entry = kmem_cache_alloc(ext4_free_data_cachep, GFP_NOFS);
-- if (!new_entry) {
-- /*
-- * We use a retry loop because
-- * ext4_free_blocks() is not allowed to fail.
-- */
-- cond_resched();
-- congestion_wait(BLK_RW_ASYNC, HZ/50);
-- goto retry;
-- }
-+ new_entry = kmem_cache_alloc(ext4_free_data_cachep,
-+ GFP_NOFS|__GFP_NOFAIL);
- new_entry->efd_start_cluster = bit;
- new_entry->efd_group = block_group;
- new_entry->efd_count = count_clusters;
-diff --git a/fs/ext4/migrate.c b/fs/ext4/migrate.c
-index 2ae73a8..be92ed2 100644
---- a/fs/ext4/migrate.c
-+++ b/fs/ext4/migrate.c
-@@ -616,6 +616,7 @@ int ext4_ind_migrate(struct inode *inode)
- struct ext4_inode_info *ei = EXT4_I(inode);
- struct ext4_extent *ex;
- unsigned int i, len;
-+ ext4_lblk_t start, end;
- ext4_fsblk_t blk;
- handle_t *handle;
- int ret;
-@@ -629,6 +630,14 @@ int ext4_ind_migrate(struct inode *inode)
- EXT4_FEATURE_RO_COMPAT_BIGALLOC))
- return -EOPNOTSUPP;
-
-+ /*
-+ * In order to get correct extent info, force all delayed allocation
-+ * blocks to be allocated, otherwise delayed allocation blocks may not
-+ * be reflected and bypass the checks on extent header.
-+ */
-+ if (test_opt(inode->i_sb, DELALLOC))
-+ ext4_alloc_da_blocks(inode);
-+
- handle = ext4_journal_start(inode, EXT4_HT_MIGRATE, 1);
- if (IS_ERR(handle))
- return PTR_ERR(handle);
-@@ -646,11 +655,13 @@ int ext4_ind_migrate(struct inode *inode)
- goto errout;
- }
- if (eh->eh_entries == 0)
-- blk = len = 0;
-+ blk = len = start = end = 0;
- else {
- len = le16_to_cpu(ex->ee_len);
- blk = ext4_ext_pblock(ex);
-- if (len > EXT4_NDIR_BLOCKS) {
-+ start = le32_to_cpu(ex->ee_block);
-+ end = start + len - 1;
-+ if (end >= EXT4_NDIR_BLOCKS) {
- ret = -EOPNOTSUPP;
- goto errout;
- }
-@@ -658,7 +669,7 @@ int ext4_ind_migrate(struct inode *inode)
-
- ext4_clear_inode_flag(inode, EXT4_INODE_EXTENTS);
- memset(ei->i_data, 0, sizeof(ei->i_data));
-- for (i=0; i < len; i++)
-+ for (i = start; i <= end; i++)
- ei->i_data[i] = cpu_to_le32(blk++);
- ext4_mark_inode_dirty(handle, inode);
- errout:
-diff --git a/fs/ext4/super.c b/fs/ext4/super.c
-index 9fb3e6c..a07af5b 100644
---- a/fs/ext4/super.c
-+++ b/fs/ext4/super.c
-@@ -832,6 +832,7 @@ static void ext4_put_super(struct super_block *sb)
- dump_orphan_list(sb, sbi);
- J_ASSERT(list_empty(&sbi->s_orphan));
-
-+ sync_blockdev(sb->s_bdev);
- invalidate_bdev(sb->s_bdev);
- if (sbi->journal_bdev && sbi->journal_bdev != sb->s_bdev) {
- /*
-diff --git a/fs/fuse/inode.c b/fs/fuse/inode.c
-index 73f6bcb..faf00af 100644
---- a/fs/fuse/inode.c
-+++ b/fs/fuse/inode.c
-@@ -1026,6 +1026,7 @@ static int fuse_fill_super(struct super_block *sb, void *data, int silent)
- goto err_fput;
-
- fuse_conn_init(fc);
-+ fc->release = fuse_free_conn;
-
- fc->dev = sb->s_dev;
- fc->sb = sb;
-@@ -1040,7 +1041,6 @@ static int fuse_fill_super(struct super_block *sb, void *data, int silent)
- fc->dont_mask = 1;
- sb->s_flags |= MS_POSIXACL;
-
-- fc->release = fuse_free_conn;
- fc->flags = d.flags;
- fc->user_id = d.user_id;
- fc->group_id = d.group_id;
-diff --git a/fs/hpfs/super.c b/fs/hpfs/super.c
-index 4534ff6..77b583d 100644
---- a/fs/hpfs/super.c
-+++ b/fs/hpfs/super.c
-@@ -52,17 +52,20 @@ static void unmark_dirty(struct super_block *s)
- }
-
- /* Filesystem error... */
--static char err_buf[1024];
--
- void hpfs_error(struct super_block *s, const char *fmt, ...)
- {
-+ struct va_format vaf;
- va_list args;
-
- va_start(args, fmt);
-- vsnprintf(err_buf, sizeof(err_buf), fmt, args);
-+
-+ vaf.fmt = fmt;
-+ vaf.va = &args;
-+
-+ pr_err("filesystem error: %pV", &vaf);
-+
- va_end(args);
-
-- printk("HPFS: filesystem error: %s", err_buf);
- if (!hpfs_sb(s)->sb_was_error) {
- if (hpfs_sb(s)->sb_err == 2) {
- printk("; crashing the system because you wanted it\n");
-diff --git a/fs/jbd2/checkpoint.c b/fs/jbd2/checkpoint.c
-index 7f34f47..b892355 100644
---- a/fs/jbd2/checkpoint.c
-+++ b/fs/jbd2/checkpoint.c
-@@ -448,7 +448,7 @@ int jbd2_cleanup_journal_tail(journal_t *journal)
- unsigned long blocknr;
-
- if (is_journal_aborted(journal))
-- return 1;
-+ return -EIO;
-
- if (!jbd2_journal_get_log_tail(journal, &first_tid, &blocknr))
- return 1;
-@@ -463,10 +463,9 @@ int jbd2_cleanup_journal_tail(journal_t *journal)
- * jbd2_cleanup_journal_tail() doesn't get called all that often.
- */
- if (journal->j_flags & JBD2_BARRIER)
-- blkdev_issue_flush(journal->j_fs_dev, GFP_KERNEL, NULL);
-+ blkdev_issue_flush(journal->j_fs_dev, GFP_NOFS, NULL);
-
-- __jbd2_update_log_tail(journal, first_tid, blocknr);
-- return 0;
-+ return __jbd2_update_log_tail(journal, first_tid, blocknr);
- }
-
-
-diff --git a/fs/jbd2/journal.c b/fs/jbd2/journal.c
-index f2d78a3..e8d62d7 100644
---- a/fs/jbd2/journal.c
-+++ b/fs/jbd2/journal.c
-@@ -885,9 +885,10 @@ int jbd2_journal_get_log_tail(journal_t *journal, tid_t *tid,
- *
- * Requires j_checkpoint_mutex
- */
--void __jbd2_update_log_tail(journal_t *journal, tid_t tid, unsigned long block)
-+int __jbd2_update_log_tail(journal_t *journal, tid_t tid, unsigned long block)
- {
- unsigned long freed;
-+ int ret;
-
- BUG_ON(!mutex_is_locked(&journal->j_checkpoint_mutex));
-
-@@ -897,7 +898,10 @@ void __jbd2_update_log_tail(journal_t *journal, tid_t tid, unsigned long block)
- * space and if we lose sb update during power failure we'd replay
- * old transaction with possibly newly overwritten data.
- */
-- jbd2_journal_update_sb_log_tail(journal, tid, block, WRITE_FUA);
-+ ret = jbd2_journal_update_sb_log_tail(journal, tid, block, WRITE_FUA);
-+ if (ret)
-+ goto out;
-+
- write_lock(&journal->j_state_lock);
- freed = block - journal->j_tail;
- if (block < journal->j_tail)
-@@ -913,6 +917,9 @@ void __jbd2_update_log_tail(journal_t *journal, tid_t tid, unsigned long block)
- journal->j_tail_sequence = tid;
- journal->j_tail = block;
- write_unlock(&journal->j_state_lock);
-+
-+out:
-+ return ret;
- }
-
- /*
-@@ -1331,7 +1338,7 @@ static int journal_reset(journal_t *journal)
- return jbd2_journal_start_thread(journal);
- }
-
--static void jbd2_write_superblock(journal_t *journal, int write_op)
-+static int jbd2_write_superblock(journal_t *journal, int write_op)
- {
- struct buffer_head *bh = journal->j_sb_buffer;
- journal_superblock_t *sb = journal->j_superblock;
-@@ -1370,7 +1377,10 @@ static void jbd2_write_superblock(journal_t *journal, int write_op)
- printk(KERN_ERR "JBD2: Error %d detected when updating "
- "journal superblock for %s.\n", ret,
- journal->j_devname);
-+ jbd2_journal_abort(journal, ret);
- }
-+
-+ return ret;
- }
-
- /**
-@@ -1383,10 +1393,11 @@ static void jbd2_write_superblock(journal_t *journal, int write_op)
- * Update a journal's superblock information about log tail and write it to
- * disk, waiting for the IO to complete.
- */
--void jbd2_journal_update_sb_log_tail(journal_t *journal, tid_t tail_tid,
-+int jbd2_journal_update_sb_log_tail(journal_t *journal, tid_t tail_tid,
- unsigned long tail_block, int write_op)
- {
- journal_superblock_t *sb = journal->j_superblock;
-+ int ret;
-
- BUG_ON(!mutex_is_locked(&journal->j_checkpoint_mutex));
- jbd_debug(1, "JBD2: updating superblock (start %lu, seq %u)\n",
-@@ -1395,13 +1406,18 @@ void jbd2_journal_update_sb_log_tail(journal_t *journal, tid_t tail_tid,
- sb->s_sequence = cpu_to_be32(tail_tid);
- sb->s_start = cpu_to_be32(tail_block);
-
-- jbd2_write_superblock(journal, write_op);
-+ ret = jbd2_write_superblock(journal, write_op);
-+ if (ret)
-+ goto out;
-
- /* Log is no longer empty */
- write_lock(&journal->j_state_lock);
- WARN_ON(!sb->s_sequence);
- journal->j_flags &= ~JBD2_FLUSHED;
- write_unlock(&journal->j_state_lock);
-+
-+out:
-+ return ret;
- }
-
- /**
-@@ -1952,7 +1968,14 @@ int jbd2_journal_flush(journal_t *journal)
- return -EIO;
-
- mutex_lock(&journal->j_checkpoint_mutex);
-- jbd2_cleanup_journal_tail(journal);
-+ if (!err) {
-+ err = jbd2_cleanup_journal_tail(journal);
-+ if (err < 0) {
-+ mutex_unlock(&journal->j_checkpoint_mutex);
-+ goto out;
-+ }
-+ err = 0;
-+ }
-
- /* Finally, mark the journal as really needing no recovery.
- * This sets s_start==0 in the underlying superblock, which is
-@@ -1968,7 +1991,8 @@ int jbd2_journal_flush(journal_t *journal)
- J_ASSERT(journal->j_head == journal->j_tail);
- J_ASSERT(journal->j_tail_sequence == journal->j_transaction_sequence);
- write_unlock(&journal->j_state_lock);
-- return 0;
-+out:
-+ return err;
- }
-
- /**
-diff --git a/fs/nfs/nfs3xdr.c b/fs/nfs/nfs3xdr.c
-index fa6d721..4495cad 100644
---- a/fs/nfs/nfs3xdr.c
-+++ b/fs/nfs/nfs3xdr.c
-@@ -1342,7 +1342,7 @@ static void nfs3_xdr_enc_setacl3args(struct rpc_rqst *req,
- if (args->npages != 0)
- xdr_write_pages(xdr, args->pages, 0, args->len);
- else
-- xdr_reserve_space(xdr, NFS_ACL_INLINE_BUFSIZE);
-+ xdr_reserve_space(xdr, args->len);
-
- error = nfsacl_encode(xdr->buf, base, args->inode,
- (args->mask & NFS_ACL) ?
-diff --git a/fs/nfs/nfs4state.c b/fs/nfs/nfs4state.c
-index b4f177f..c402b67 100644
---- a/fs/nfs/nfs4state.c
-+++ b/fs/nfs/nfs4state.c
-@@ -1482,6 +1482,8 @@ restart:
- spin_unlock(&state->state_lock);
- }
- nfs4_put_open_state(state);
-+ clear_bit(NFS4CLNT_RECLAIM_NOGRACE,
-+ &state->flags);
- spin_lock(&sp->so_lock);
- goto restart;
- }
-diff --git a/fs/xfs/xfs_symlink.c b/fs/xfs/xfs_symlink.c
-index 14e58f2..98d4948 100644
---- a/fs/xfs/xfs_symlink.c
-+++ b/fs/xfs/xfs_symlink.c
-@@ -102,7 +102,7 @@ xfs_readlink_bmap(
- cur_chunk += sizeof(struct xfs_dsymlink_hdr);
- }
-
-- memcpy(link + offset, bp->b_addr, byte_cnt);
-+ memcpy(link + offset, cur_chunk, byte_cnt);
-
- pathlen -= byte_cnt;
- offset += byte_cnt;
-diff --git a/include/acpi/actypes.h b/include/acpi/actypes.h
-index 8fc12f8..69afb57 100644
---- a/include/acpi/actypes.h
-+++ b/include/acpi/actypes.h
-@@ -561,6 +561,7 @@ typedef u64 acpi_integer;
- #define ACPI_NO_ACPI_ENABLE 0x10
- #define ACPI_NO_DEVICE_INIT 0x20
- #define ACPI_NO_OBJECT_INIT 0x40
-+#define ACPI_NO_FACS_INIT 0x80
-
- /*
- * Initialization state
-diff --git a/include/linux/acpi.h b/include/linux/acpi.h
-index cd80aa8..77af621 100644
---- a/include/linux/acpi.h
-+++ b/include/linux/acpi.h
-@@ -402,6 +402,7 @@ extern acpi_status acpi_pci_osc_control_set(acpi_handle handle,
- #define ACPI_OST_SC_INSERT_NOT_SUPPORTED 0x82
-
- extern void acpi_early_init(void);
-+extern void acpi_subsystem_init(void);
-
- extern int acpi_nvs_register(__u64 start, __u64 size);
-
-@@ -436,6 +437,7 @@ static inline const char *acpi_dev_name(struct acpi_device *adev)
- }
-
- static inline void acpi_early_init(void) { }
-+static inline void acpi_subsystem_init(void) { }
-
- static inline int early_acpi_boot_init(void)
- {
-diff --git a/include/linux/jbd2.h b/include/linux/jbd2.h
-index 0dae71e..e1fb0f6 100644
---- a/include/linux/jbd2.h
-+++ b/include/linux/jbd2.h
-@@ -1035,7 +1035,7 @@ struct buffer_head *jbd2_journal_get_descriptor_buffer(journal_t *journal);
- int jbd2_journal_next_log_block(journal_t *, unsigned long long *);
- int jbd2_journal_get_log_tail(journal_t *journal, tid_t *tid,
- unsigned long *block);
--void __jbd2_update_log_tail(journal_t *journal, tid_t tid, unsigned long block);
-+int __jbd2_update_log_tail(journal_t *journal, tid_t tid, unsigned long block);
- void jbd2_update_log_tail(journal_t *journal, tid_t tid, unsigned long block);
-
- /* Commit management */
-@@ -1157,7 +1157,7 @@ extern int jbd2_journal_recover (journal_t *journal);
- extern int jbd2_journal_wipe (journal_t *, int);
- extern int jbd2_journal_skip_recovery (journal_t *);
- extern void jbd2_journal_update_sb_errno(journal_t *);
--extern void jbd2_journal_update_sb_log_tail (journal_t *, tid_t,
-+extern int jbd2_journal_update_sb_log_tail (journal_t *, tid_t,
- unsigned long, int);
- extern void __jbd2_journal_abort_hard (journal_t *);
- extern void jbd2_journal_abort (journal_t *, int);
-diff --git a/include/linux/libata.h b/include/linux/libata.h
-index b84e786..189c9ff 100644
---- a/include/linux/libata.h
-+++ b/include/linux/libata.h
-@@ -428,6 +428,7 @@ enum {
- ATA_HORKAGE_NO_NCQ_TRIM = (1 << 19), /* don't use queued TRIM */
- ATA_HORKAGE_NOLPM = (1 << 20), /* don't use LPM */
- ATA_HORKAGE_WD_BROKEN_LPM = (1 << 21), /* some WDs have broken LPM */
-+ ATA_HORKAGE_NOTRIM = (1 << 24), /* don't use TRIM */
-
- /* DMA mask for user DMA control: User visible values; DO NOT
- renumber */
-diff --git a/include/linux/nfs_xdr.h b/include/linux/nfs_xdr.h
-index 53988cb..3a36a2c 100644
---- a/include/linux/nfs_xdr.h
-+++ b/include/linux/nfs_xdr.h
-@@ -1155,7 +1155,7 @@ struct nfs41_state_protection {
- struct nfs4_op_map allow;
- };
-
--#define NFS4_EXCHANGE_ID_LEN (48)
-+#define NFS4_EXCHANGE_ID_LEN (127)
- struct nfs41_exchange_id_args {
- struct nfs_client *client;
- nfs4_verifier *verifier;
-diff --git a/include/linux/of.h b/include/linux/of.h
-index 3f8144d..9f2698d 100644
---- a/include/linux/of.h
-+++ b/include/linux/of.h
-@@ -517,7 +517,10 @@ static inline const char *of_prop_next_string(struct property *prop,
- #if defined(CONFIG_OF) && defined(CONFIG_NUMA)
- extern int of_node_to_nid(struct device_node *np);
- #else
--static inline int of_node_to_nid(struct device_node *device) { return 0; }
-+static inline int of_node_to_nid(struct device_node *device)
-+{
-+ return NUMA_NO_NODE;
-+}
- #endif
-
- static inline struct device_node *of_find_matching_node(
-diff --git a/include/uapi/linux/usbdevice_fs.h b/include/uapi/linux/usbdevice_fs.h
-index 0c65e4b..ef29266 100644
---- a/include/uapi/linux/usbdevice_fs.h
-+++ b/include/uapi/linux/usbdevice_fs.h
-@@ -125,11 +125,12 @@ struct usbdevfs_hub_portinfo {
- char port [127]; /* e.g. port 3 connects to device 27 */
- };
-
--/* Device capability flags */
-+/* System and bus capability flags */
- #define USBDEVFS_CAP_ZERO_PACKET 0x01
- #define USBDEVFS_CAP_BULK_CONTINUATION 0x02
- #define USBDEVFS_CAP_NO_PACKET_SIZE_LIM 0x04
- #define USBDEVFS_CAP_BULK_SCATTER_GATHER 0x08
-+#define USBDEVFS_CAP_REAP_AFTER_DISCONNECT 0x10
-
- /* USBDEVFS_DISCONNECT_CLAIM flags & struct */
-
-diff --git a/init/main.c b/init/main.c
-index 58c132d..008edce 100644
---- a/init/main.c
-+++ b/init/main.c
-@@ -643,6 +643,7 @@ asmlinkage void __init start_kernel(void)
-
- check_bugs();
-
-+ acpi_subsystem_init();
- sfi_init_late();
-
- if (efi_enabled(EFI_RUNTIME_SERVICES)) {
-diff --git a/kernel/irq/devres.c b/kernel/irq/devres.c
-index 1ef0606..0296d6f 100644
---- a/kernel/irq/devres.c
-+++ b/kernel/irq/devres.c
-@@ -104,7 +104,7 @@ int devm_request_any_context_irq(struct device *dev, unsigned int irq,
- return -ENOMEM;
-
- rc = request_any_context_irq(irq, handler, irqflags, devname, dev_id);
-- if (rc) {
-+ if (rc < 0) {
- devres_free(dr);
- return rc;
- }
-@@ -113,7 +113,7 @@ int devm_request_any_context_irq(struct device *dev, unsigned int irq,
- dr->dev_id = dev_id;
- devres_add(dev, dr);
-
-- return 0;
-+ return rc;
- }
- EXPORT_SYMBOL(devm_request_any_context_irq);
-
-diff --git a/kernel/power/Kconfig b/kernel/power/Kconfig
-index 2fac9cc..9d18628 100644
---- a/kernel/power/Kconfig
-+++ b/kernel/power/Kconfig
-@@ -191,7 +191,7 @@ config DPM_WATCHDOG
- config DPM_WATCHDOG_TIMEOUT
- int "Watchdog timeout in seconds"
- range 1 120
-- default 12
-+ default 60
- depends on DPM_WATCHDOG
-
- config PM_TRACE
-diff --git a/kernel/printk/printk.c b/kernel/printk/printk.c
-index a755ad7..02e7fb4 100644
---- a/kernel/printk/printk.c
-+++ b/kernel/printk/printk.c
-@@ -383,11 +383,11 @@ static int check_syslog_permissions(int type, bool from_file)
- * already done the capabilities checks at open time.
- */
- if (from_file && type != SYSLOG_ACTION_OPEN)
-- return 0;
-+ goto ok;
-
- if (syslog_action_restricted(type)) {
- if (capable(CAP_SYSLOG))
-- return 0;
-+ goto ok;
- /*
- * For historical reasons, accept CAP_SYS_ADMIN too, with
- * a warning.
-@@ -397,10 +397,11 @@ static int check_syslog_permissions(int type, bool from_file)
- "CAP_SYS_ADMIN but no CAP_SYSLOG "
- "(deprecated).\n",
- current->comm, task_pid_nr(current));
-- return 0;
-+ goto ok;
- }
- return -EPERM;
- }
-+ok:
- return security_syslog(type);
- }
-
-@@ -1126,10 +1127,6 @@ int do_syslog(int type, char __user *buf, int len, bool from_file)
- if (error)
- goto out;
-
-- error = security_syslog(type);
-- if (error)
-- return error;
--
- switch (type) {
- case SYSLOG_ACTION_CLOSE: /* Close log */
- break;
-diff --git a/kernel/rcu/tiny.c b/kernel/rcu/tiny.c
-index 1254f31..ae359f0 100644
---- a/kernel/rcu/tiny.c
-+++ b/kernel/rcu/tiny.c
-@@ -284,6 +284,11 @@ static void __rcu_process_callbacks(struct rcu_ctrlblk *rcp)
-
- /* Move the ready-to-invoke callbacks to a local list. */
- local_irq_save(flags);
-+ if (rcp->donetail == &rcp->rcucblist) {
-+ /* No callbacks ready, so just leave. */
-+ local_irq_restore(flags);
-+ return;
-+ }
- RCU_TRACE(trace_rcu_batch_start(rcp->name, 0, rcp->qlen, -1));
- list = rcp->rcucblist;
- rcp->rcucblist = *rcp->donetail;
-diff --git a/kernel/trace/trace.h b/kernel/trace/trace.h
-index c8bd809..c1be95c 100644
---- a/kernel/trace/trace.h
-+++ b/kernel/trace/trace.h
-@@ -422,6 +422,7 @@ enum {
-
- TRACE_CONTROL_BIT,
-
-+ TRACE_BRANCH_BIT,
- /*
- * Abuse of the trace_recursion.
- * As we need a way to maintain state if we are tracing the function
-diff --git a/kernel/trace/trace_branch.c b/kernel/trace/trace_branch.c
-index 697fb9b..60850b4 100644
---- a/kernel/trace/trace_branch.c
-+++ b/kernel/trace/trace_branch.c
-@@ -37,9 +37,12 @@ probe_likely_condition(struct ftrace_branch_data *f, int val, int expect)
- struct trace_branch *entry;
- struct ring_buffer *buffer;
- unsigned long flags;
-- int cpu, pc;
-+ int pc;
- const char *p;
-
-+ if (current->trace_recursion & TRACE_BRANCH_BIT)
-+ return;
-+
- /*
- * I would love to save just the ftrace_likely_data pointer, but
- * this code can also be used by modules. Ugly things can happen
-@@ -50,10 +53,10 @@ probe_likely_condition(struct ftrace_branch_data *f, int val, int expect)
- if (unlikely(!tr))
- return;
-
-- local_irq_save(flags);
-- cpu = raw_smp_processor_id();
-- data = per_cpu_ptr(tr->trace_buffer.data, cpu);
-- if (atomic_inc_return(&data->disabled) != 1)
-+ raw_local_irq_save(flags);
-+ current->trace_recursion |= TRACE_BRANCH_BIT;
-+ data = this_cpu_ptr(tr->trace_buffer.data);
-+ if (atomic_read(&data->disabled))
- goto out;
-
- pc = preempt_count();
-@@ -82,8 +85,8 @@ probe_likely_condition(struct ftrace_branch_data *f, int val, int expect)
- __buffer_unlock_commit(buffer, event);
-
- out:
-- atomic_dec(&data->disabled);
-- local_irq_restore(flags);
-+ current->trace_recursion &= ~TRACE_BRANCH_BIT;
-+ raw_local_irq_restore(flags);
- }
-
- static inline
-diff --git a/kernel/trace/trace_events_filter.c b/kernel/trace/trace_events_filter.c
-index cb347e8..7b244d0 100644
---- a/kernel/trace/trace_events_filter.c
-+++ b/kernel/trace/trace_events_filter.c
-@@ -1086,6 +1086,9 @@ static void parse_init(struct filter_parse_state *ps,
-
- static char infix_next(struct filter_parse_state *ps)
- {
-+ if (!ps->infix.cnt)
-+ return 0;
-+
- ps->infix.cnt--;
-
- return ps->infix.string[ps->infix.tail++];
-@@ -1101,6 +1104,9 @@ static char infix_peek(struct filter_parse_state *ps)
-
- static void infix_advance(struct filter_parse_state *ps)
- {
-+ if (!ps->infix.cnt)
-+ return;
-+
- ps->infix.cnt--;
- ps->infix.tail++;
- }
-@@ -1413,7 +1419,9 @@ static int check_preds(struct filter_parse_state *ps)
- continue;
- }
- n_normal_preds++;
-- WARN_ON_ONCE(cnt < 0);
-+ /* all ops should have operands */
-+ if (cnt < 0)
-+ break;
- }
-
- if (cnt != 1 || !n_normal_preds || n_logical_preds >= n_normal_preds) {
-diff --git a/lib/bitmap.c b/lib/bitmap.c
-index e5c4ebe..c0634aa 100644
---- a/lib/bitmap.c
-+++ b/lib/bitmap.c
-@@ -603,12 +603,12 @@ static int __bitmap_parselist(const char *buf, unsigned int buflen,
- unsigned a, b;
- int c, old_c, totaldigits;
- const char __user __force *ubuf = (const char __user __force *)buf;
-- int exp_digit, in_range;
-+ int at_start, in_range;
-
- totaldigits = c = 0;
- bitmap_zero(maskp, nmaskbits);
- do {
-- exp_digit = 1;
-+ at_start = 1;
- in_range = 0;
- a = b = 0;
-
-@@ -637,11 +637,10 @@ static int __bitmap_parselist(const char *buf, unsigned int buflen,
- break;
-
- if (c == '-') {
-- if (exp_digit || in_range)
-+ if (at_start || in_range)
- return -EINVAL;
- b = 0;
- in_range = 1;
-- exp_digit = 1;
- continue;
- }
-
-@@ -651,16 +650,18 @@ static int __bitmap_parselist(const char *buf, unsigned int buflen,
- b = b * 10 + (c - '0');
- if (!in_range)
- a = b;
-- exp_digit = 0;
-+ at_start = 0;
- totaldigits++;
- }
- if (!(a <= b))
- return -EINVAL;
- if (b >= nmaskbits)
- return -ERANGE;
-- while (a <= b) {
-- set_bit(a, maskp);
-- a++;
-+ if (!at_start) {
-+ while (a <= b) {
-+ set_bit(a, maskp);
-+ a++;
-+ }
- }
- } while (buflen && c == ',');
- return 0;
-diff --git a/net/9p/client.c b/net/9p/client.c
-index 9186550..08046f3 100644
---- a/net/9p/client.c
-+++ b/net/9p/client.c
-@@ -839,7 +839,8 @@ static struct p9_req_t *p9_client_zc_rpc(struct p9_client *c, int8_t type,
- if (err < 0) {
- if (err == -EIO)
- c->status = Disconnected;
-- goto reterr;
-+ if (err != -ERESTARTSYS)
-+ goto reterr;
- }
- if (req->status == REQ_STATUS_ERROR) {
- p9_debug(P9_DEBUG_ERROR, "req_status error %d\n", req->t_err);
-diff --git a/net/ceph/osdmap.c b/net/ceph/osdmap.c
-index aade4a5..bde94d8 100644
---- a/net/ceph/osdmap.c
-+++ b/net/ceph/osdmap.c
-@@ -89,7 +89,7 @@ static int crush_decode_tree_bucket(void **p, void *end,
- {
- int j;
- dout("crush_decode_tree_bucket %p to %p\n", *p, end);
-- ceph_decode_32_safe(p, end, b->num_nodes, bad);
-+ ceph_decode_8_safe(p, end, b->num_nodes, bad);
- b->node_weights = kcalloc(b->num_nodes, sizeof(u32), GFP_NOFS);
- if (b->node_weights == NULL)
- return -ENOMEM;
-diff --git a/net/mac80211/main.c b/net/mac80211/main.c
-index c7a7a86..9e58c99 100644
---- a/net/mac80211/main.c
-+++ b/net/mac80211/main.c
-@@ -248,6 +248,7 @@ static void ieee80211_restart_work(struct work_struct *work)
- {
- struct ieee80211_local *local =
- container_of(work, struct ieee80211_local, restart_work);
-+ struct ieee80211_sub_if_data *sdata;
-
- /* wait for scan work complete */
- flush_workqueue(local->workqueue);
-@@ -256,6 +257,8 @@ static void ieee80211_restart_work(struct work_struct *work)
- "%s called with hardware scan in progress\n", __func__);
-
- rtnl_lock();
-+ list_for_each_entry(sdata, &local->interfaces, list)
-+ flush_delayed_work(&sdata->dec_tailroom_needed_wk);
- ieee80211_scan_cancel(local);
- ieee80211_reconfig(local);
- rtnl_unlock();
-diff --git a/net/sunrpc/backchannel_rqst.c b/net/sunrpc/backchannel_rqst.c
-index e860d4f..ab21968 100644
---- a/net/sunrpc/backchannel_rqst.c
-+++ b/net/sunrpc/backchannel_rqst.c
-@@ -60,7 +60,7 @@ static void xprt_free_allocation(struct rpc_rqst *req)
-
- dprintk("RPC: free allocations for req= %p\n", req);
- WARN_ON_ONCE(test_bit(RPC_BC_PA_IN_USE, &req->rq_bc_pa_state));
-- xbufp = &req->rq_private_buf;
-+ xbufp = &req->rq_rcv_buf;
- free_page((unsigned long)xbufp->head[0].iov_base);
- xbufp = &req->rq_snd_buf;
- free_page((unsigned long)xbufp->head[0].iov_base);
-diff --git a/security/integrity/evm/evm_main.c b/security/integrity/evm/evm_main.c
-index 7e71e06..048550a 100644
---- a/security/integrity/evm/evm_main.c
-+++ b/security/integrity/evm/evm_main.c
-@@ -20,6 +20,7 @@
- #include <linux/xattr.h>
- #include <linux/integrity.h>
- #include <linux/evm.h>
-+#include <linux/magic.h>
- #include <crypto/hash.h>
- #include "evm.h"
-
-@@ -275,6 +276,17 @@ static int evm_protect_xattr(struct dentry *dentry, const char *xattr_name,
- iint = integrity_iint_find(dentry->d_inode);
- if (iint && (iint->flags & IMA_NEW_FILE))
- return 0;
-+
-+ /* exception for pseudo filesystems */
-+ if (dentry->d_inode->i_sb->s_magic == TMPFS_MAGIC
-+ || dentry->d_inode->i_sb->s_magic == SYSFS_MAGIC)
-+ return 0;
-+
-+ integrity_audit_msg(AUDIT_INTEGRITY_METADATA,
-+ dentry->d_inode, dentry->d_name.name,
-+ "update_metadata",
-+ integrity_status_msg[evm_status],
-+ -EPERM, 0);
- }
- out:
- if (evm_status != INTEGRITY_PASS)
-diff --git a/security/integrity/ima/ima.h b/security/integrity/ima/ima.h
-index f79fa8b..5cb7de9 100644
---- a/security/integrity/ima/ima.h
-+++ b/security/integrity/ima/ima.h
-@@ -106,7 +106,7 @@ void ima_add_violation(struct file *file, const unsigned char *filename,
- const char *op, const char *cause);
- int ima_init_crypto(void);
- void ima_putc(struct seq_file *m, void *data, int datalen);
--void ima_print_digest(struct seq_file *m, u8 *digest, int size);
-+void ima_print_digest(struct seq_file *m, u8 *digest, u32 size);
- struct ima_template_desc *ima_template_desc_current(void);
- int ima_init_template(void);
-
-diff --git a/security/integrity/ima/ima_fs.c b/security/integrity/ima/ima_fs.c
-index 468a3ba..35f3c90 100644
---- a/security/integrity/ima/ima_fs.c
-+++ b/security/integrity/ima/ima_fs.c
-@@ -186,9 +186,9 @@ static const struct file_operations ima_measurements_ops = {
- .release = seq_release,
- };
-
--void ima_print_digest(struct seq_file *m, u8 *digest, int size)
-+void ima_print_digest(struct seq_file *m, u8 *digest, u32 size)
- {
-- int i;
-+ u32 i;
-
- for (i = 0; i < size; i++)
- seq_printf(m, "%02x", *(digest + i));
-diff --git a/security/integrity/ima/ima_template_lib.c b/security/integrity/ima/ima_template_lib.c
-index e8592e7..dcf77b7 100644
---- a/security/integrity/ima/ima_template_lib.c
-+++ b/security/integrity/ima/ima_template_lib.c
-@@ -79,7 +79,8 @@ static void ima_show_template_data_ascii(struct seq_file *m,
- enum data_formats datafmt,
- struct ima_field_data *field_data)
- {
-- u8 *buf_ptr = field_data->data, buflen = field_data->len;
-+ u8 *buf_ptr = field_data->data;
-+ u32 buflen = field_data->len;
-
- switch (datafmt) {
- case DATA_FMT_DIGEST_WITH_ALGO:
-diff --git a/security/keys/keyring.c b/security/keys/keyring.c
-index 2fb2576..04d0d7c 100644
---- a/security/keys/keyring.c
-+++ b/security/keys/keyring.c
-@@ -1151,9 +1151,11 @@ void __key_link_end(struct key *keyring,
- if (index_key->type == &key_type_keyring)
- up_write(&keyring_serialise_link_sem);
-
-- if (edit && !edit->dead_leaf) {
-- key_payload_reserve(keyring,
-- keyring->datalen - KEYQUOTA_LINK_BYTES);
-+ if (edit) {
-+ if (!edit->dead_leaf) {
-+ key_payload_reserve(keyring,
-+ keyring->datalen - KEYQUOTA_LINK_BYTES);
-+ }
- assoc_array_cancel_edit(edit);
- }
- up_write(&keyring->sem);
-diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
-index ba17522..2f503c0 100644
---- a/sound/pci/hda/patch_realtek.c
-+++ b/sound/pci/hda/patch_realtek.c
-@@ -3955,6 +3955,7 @@ enum {
- ALC269_FIXUP_LIFEBOOK,
- ALC269_FIXUP_LIFEBOOK_EXTMIC,
- ALC269_FIXUP_LIFEBOOK_HP_PIN,
-+ ALC269_FIXUP_LIFEBOOK_NO_HP_TO_LINEOUT,
- ALC269_FIXUP_AMIC,
- ALC269_FIXUP_DMIC,
- ALC269VB_FIXUP_AMIC,
-@@ -3973,6 +3974,7 @@ enum {
- ALC269_FIXUP_DELL3_MIC_NO_PRESENCE,
- ALC269_FIXUP_HEADSET_MODE,
- ALC269_FIXUP_HEADSET_MODE_NO_HP_MIC,
-+ ALC269_FIXUP_ASPIRE_HEADSET_MIC,
- ALC269_FIXUP_ASUS_X101_FUNC,
- ALC269_FIXUP_ASUS_X101_VERB,
- ALC269_FIXUP_ASUS_X101,
-@@ -4096,6 +4098,10 @@ static const struct hda_fixup alc269_fixups[] = {
- { }
- },
- },
-+ [ALC269_FIXUP_LIFEBOOK_NO_HP_TO_LINEOUT] = {
-+ .type = HDA_FIXUP_FUNC,
-+ .v.func = alc269_fixup_pincfg_no_hp_to_lineout,
-+ },
- [ALC269_FIXUP_AMIC] = {
- .type = HDA_FIXUP_PINS,
- .v.pins = (const struct hda_pintbl[]) {
-@@ -4214,6 +4220,15 @@ static const struct hda_fixup alc269_fixups[] = {
- .type = HDA_FIXUP_FUNC,
- .v.func = alc_fixup_headset_mode_no_hp_mic,
- },
-+ [ALC269_FIXUP_ASPIRE_HEADSET_MIC] = {
-+ .type = HDA_FIXUP_PINS,
-+ .v.pins = (const struct hda_pintbl[]) {
-+ { 0x19, 0x01a1913c }, /* headset mic w/o jack detect */
-+ { }
-+ },
-+ .chained = true,
-+ .chain_id = ALC269_FIXUP_HEADSET_MODE,
-+ },
- [ALC286_FIXUP_SONY_MIC_NO_PRESENCE] = {
- .type = HDA_FIXUP_PINS,
- .v.pins = (const struct hda_pintbl[]) {
-@@ -4397,6 +4412,8 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
- SND_PCI_QUIRK(0x1025, 0x029b, "Acer 1810TZ", ALC269_FIXUP_INV_DMIC),
- SND_PCI_QUIRK(0x1025, 0x0349, "Acer AOD260", ALC269_FIXUP_INV_DMIC),
- SND_PCI_QUIRK(0x1025, 0x047c, "Acer AC700", ALC269_FIXUP_ACER_AC700),
-+ SND_PCI_QUIRK(0x1025, 0x072d, "Acer Aspire V5-571G", ALC269_FIXUP_ASPIRE_HEADSET_MIC),
-+ SND_PCI_QUIRK(0x1025, 0x080d, "Acer Aspire V5-122P", ALC269_FIXUP_ASPIRE_HEADSET_MIC),
- SND_PCI_QUIRK(0x1025, 0x0740, "Acer AO725", ALC271_FIXUP_HP_GATE_MIC_JACK),
- SND_PCI_QUIRK(0x1025, 0x0742, "Acer AO756", ALC271_FIXUP_HP_GATE_MIC_JACK),
- SND_PCI_QUIRK_VENDOR(0x1025, "Acer Aspire", ALC271_FIXUP_DMIC),
-@@ -4549,6 +4566,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
- SND_PCI_QUIRK(0x104d, 0x9084, "Sony VAIO", ALC275_FIXUP_SONY_HWEQ),
- SND_PCI_QUIRK_VENDOR(0x104d, "Sony VAIO", ALC269_FIXUP_SONY_VAIO),
- SND_PCI_QUIRK(0x10cf, 0x1475, "Lifebook", ALC269_FIXUP_LIFEBOOK),
-+ SND_PCI_QUIRK(0x10cf, 0x159f, "Lifebook E780", ALC269_FIXUP_LIFEBOOK_NO_HP_TO_LINEOUT),
- SND_PCI_QUIRK(0x10cf, 0x15dc, "Lifebook T731", ALC269_FIXUP_LIFEBOOK_HP_PIN),
- SND_PCI_QUIRK(0x10cf, 0x1757, "Lifebook E752", ALC269_FIXUP_LIFEBOOK_HP_PIN),
- SND_PCI_QUIRK(0x10cf, 0x1845, "Lifebook U904", ALC269_FIXUP_LIFEBOOK_EXTMIC),
-diff --git a/sound/soc/codecs/wm5102.c b/sound/soc/codecs/wm5102.c
-index ce9c8e1..fbee45c 100644
---- a/sound/soc/codecs/wm5102.c
-+++ b/sound/soc/codecs/wm5102.c
-@@ -41,7 +41,7 @@ struct wm5102_priv {
- static DECLARE_TLV_DB_SCALE(ana_tlv, 0, 100, 0);
- static DECLARE_TLV_DB_SCALE(eq_tlv, -1200, 100, 0);
- static DECLARE_TLV_DB_SCALE(digital_tlv, -6400, 50, 0);
--static DECLARE_TLV_DB_SCALE(noise_tlv, 0, 600, 0);
-+static DECLARE_TLV_DB_SCALE(noise_tlv, -13200, 600, 0);
- static DECLARE_TLV_DB_SCALE(ng_tlv, -10200, 600, 0);
-
- static const struct wm_adsp_region wm5102_dsp1_regions[] = {
-diff --git a/sound/soc/codecs/wm5110.c b/sound/soc/codecs/wm5110.c
-index 2c3c962..0fce853 100644
---- a/sound/soc/codecs/wm5110.c
-+++ b/sound/soc/codecs/wm5110.c
-@@ -167,7 +167,7 @@ static int wm5110_sysclk_ev(struct snd_soc_dapm_widget *w,
- static DECLARE_TLV_DB_SCALE(ana_tlv, 0, 100, 0);
- static DECLARE_TLV_DB_SCALE(eq_tlv, -1200, 100, 0);
- static DECLARE_TLV_DB_SCALE(digital_tlv, -6400, 50, 0);
--static DECLARE_TLV_DB_SCALE(noise_tlv, 0, 600, 0);
-+static DECLARE_TLV_DB_SCALE(noise_tlv, -13200, 600, 0);
- static DECLARE_TLV_DB_SCALE(ng_tlv, -10200, 600, 0);
-
- #define WM5110_NG_SRC(name, base) \
-diff --git a/sound/soc/codecs/wm8737.c b/sound/soc/codecs/wm8737.c
-index 2f167a8..62bacb8 100644
---- a/sound/soc/codecs/wm8737.c
-+++ b/sound/soc/codecs/wm8737.c
-@@ -494,7 +494,8 @@ static int wm8737_set_bias_level(struct snd_soc_codec *codec,
-
- /* Fast VMID ramp at 2*2.5k */
- snd_soc_update_bits(codec, WM8737_MISC_BIAS_CONTROL,
-- WM8737_VMIDSEL_MASK, 0x4);
-+ WM8737_VMIDSEL_MASK,
-+ 2 << WM8737_VMIDSEL_SHIFT);
-
- /* Bring VMID up */
- snd_soc_update_bits(codec, WM8737_POWER_MANAGEMENT,
-@@ -508,7 +509,8 @@ static int wm8737_set_bias_level(struct snd_soc_codec *codec,
-
- /* VMID at 2*300k */
- snd_soc_update_bits(codec, WM8737_MISC_BIAS_CONTROL,
-- WM8737_VMIDSEL_MASK, 2);
-+ WM8737_VMIDSEL_MASK,
-+ 1 << WM8737_VMIDSEL_SHIFT);
-
- break;
-
-diff --git a/sound/soc/codecs/wm8903.h b/sound/soc/codecs/wm8903.h
-index db94931..0bb4a64 100644
---- a/sound/soc/codecs/wm8903.h
-+++ b/sound/soc/codecs/wm8903.h
-@@ -172,7 +172,7 @@ extern int wm8903_mic_detect(struct snd_soc_codec *codec,
- #define WM8903_VMID_BUF_ENA_WIDTH 1 /* VMID_BUF_ENA */
-
- #define WM8903_VMID_RES_50K 2
--#define WM8903_VMID_RES_250K 3
-+#define WM8903_VMID_RES_250K 4
- #define WM8903_VMID_RES_5K 6
-
- /*
-diff --git a/sound/soc/codecs/wm8955.c b/sound/soc/codecs/wm8955.c
-index 1c1fc61..475fc24 100644
---- a/sound/soc/codecs/wm8955.c
-+++ b/sound/soc/codecs/wm8955.c
-@@ -298,7 +298,7 @@ static int wm8955_configure_clocking(struct snd_soc_codec *codec)
- snd_soc_update_bits(codec, WM8955_PLL_CONTROL_2,
- WM8955_K_17_9_MASK,
- (pll.k >> 9) & WM8955_K_17_9_MASK);
-- snd_soc_update_bits(codec, WM8955_PLL_CONTROL_2,
-+ snd_soc_update_bits(codec, WM8955_PLL_CONTROL_3,
- WM8955_K_8_0_MASK,
- pll.k & WM8955_K_8_0_MASK);
- if (pll.k)
-diff --git a/sound/soc/codecs/wm8960.c b/sound/soc/codecs/wm8960.c
-index edfd4ed..e04dbaa 100644
---- a/sound/soc/codecs/wm8960.c
-+++ b/sound/soc/codecs/wm8960.c
-@@ -242,7 +242,7 @@ SOC_SINGLE("PCM Playback -6dB Switch", WM8960_DACCTL1, 7, 1, 0),
- SOC_ENUM("ADC Polarity", wm8960_enum[0]),
- SOC_SINGLE("ADC High Pass Filter Switch", WM8960_DACCTL1, 0, 1, 0),
-
--SOC_ENUM("DAC Polarity", wm8960_enum[2]),
-+SOC_ENUM("DAC Polarity", wm8960_enum[1]),
- SOC_SINGLE_BOOL_EXT("DAC Deemphasis Switch", 0,
- wm8960_get_deemph, wm8960_put_deemph),
-
-diff --git a/sound/soc/codecs/wm8997.c b/sound/soc/codecs/wm8997.c
-index 555115e..1461ae61 100644
---- a/sound/soc/codecs/wm8997.c
-+++ b/sound/soc/codecs/wm8997.c
-@@ -40,7 +40,7 @@ struct wm8997_priv {
- static DECLARE_TLV_DB_SCALE(ana_tlv, 0, 100, 0);
- static DECLARE_TLV_DB_SCALE(eq_tlv, -1200, 100, 0);
- static DECLARE_TLV_DB_SCALE(digital_tlv, -6400, 50, 0);
--static DECLARE_TLV_DB_SCALE(noise_tlv, 0, 600, 0);
-+static DECLARE_TLV_DB_SCALE(noise_tlv, -13200, 600, 0);
- static DECLARE_TLV_DB_SCALE(ng_tlv, -10200, 600, 0);
-
- static const struct reg_default wm8997_sysclk_reva_patch[] = {
-diff --git a/sound/soc/fsl/imx-wm8962.c b/sound/soc/fsl/imx-wm8962.c
-index 3a3d17c..6644525 100644
---- a/sound/soc/fsl/imx-wm8962.c
-+++ b/sound/soc/fsl/imx-wm8962.c
-@@ -190,7 +190,7 @@ static int imx_wm8962_probe(struct platform_device *pdev)
- dev_err(&pdev->dev, "audmux internal port setup failed\n");
- return ret;
- }
-- imx_audmux_v2_configure_port(ext_port,
-+ ret = imx_audmux_v2_configure_port(ext_port,
- IMX_AUDMUX_V2_PTCR_SYN,
- IMX_AUDMUX_V2_PDCR_RXDSEL(int_port));
- if (ret) {
diff --git a/3.14.49/0000_README b/3.14.50/0000_README
index eb9a47e..5416cb6 100644
--- a/3.14.49/0000_README
+++ b/3.14.50/0000_README
@@ -2,15 +2,11 @@ README
-----------------------------------------------------------------------------
Individual Patch Descriptions:
-----------------------------------------------------------------------------
-Patch: 1047_linux-3.14.48.patch
+Patch: 1049_linux-3.14.50.patch
From: http://www.kernel.org
-Desc: Linux 3.14.48
+Desc: Linux 3.14.50
-Patch: 1048_linux-3.14.49.patch
-From: http://www.kernel.org
-Desc: Linux 3.14.49
-
-Patch: 4420_grsecurity-3.1-3.14.49-201508032312.patch
+Patch: 4420_grsecurity-3.1-3.14.50-201508102128.patch
From: http://www.grsecurity.net
Desc: hardened-sources base patch from upstream grsecurity
diff --git a/3.14.50/1049_linux-3.14.50.patch b/3.14.50/1049_linux-3.14.50.patch
new file mode 100644
index 0000000..bd7d238
--- /dev/null
+++ b/3.14.50/1049_linux-3.14.50.patch
@@ -0,0 +1,700 @@
+diff --git a/Makefile b/Makefile
+index fee8460..d71c40a 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 3
+ PATCHLEVEL = 14
+-SUBLEVEL = 49
++SUBLEVEL = 50
+ EXTRAVERSION =
+ NAME = Remembering Coco
+
+diff --git a/arch/arc/include/asm/ptrace.h b/arch/arc/include/asm/ptrace.h
+index 1bfeec2..2a58af7 100644
+--- a/arch/arc/include/asm/ptrace.h
++++ b/arch/arc/include/asm/ptrace.h
+@@ -63,7 +63,7 @@ struct callee_regs {
+ long r25, r24, r23, r22, r21, r20, r19, r18, r17, r16, r15, r14, r13;
+ };
+
+-#define instruction_pointer(regs) ((regs)->ret)
++#define instruction_pointer(regs) (unsigned long)((regs)->ret)
+ #define profile_pc(regs) instruction_pointer(regs)
+
+ /* return 1 if user mode or 0 if kernel mode */
+diff --git a/arch/avr32/mach-at32ap/clock.c b/arch/avr32/mach-at32ap/clock.c
+index 23b1a97..52c179b 100644
+--- a/arch/avr32/mach-at32ap/clock.c
++++ b/arch/avr32/mach-at32ap/clock.c
+@@ -80,6 +80,9 @@ int clk_enable(struct clk *clk)
+ {
+ unsigned long flags;
+
++ if (!clk)
++ return 0;
++
+ spin_lock_irqsave(&clk_lock, flags);
+ __clk_enable(clk);
+ spin_unlock_irqrestore(&clk_lock, flags);
+@@ -106,6 +109,9 @@ void clk_disable(struct clk *clk)
+ {
+ unsigned long flags;
+
++ if (IS_ERR_OR_NULL(clk))
++ return;
++
+ spin_lock_irqsave(&clk_lock, flags);
+ __clk_disable(clk);
+ spin_unlock_irqrestore(&clk_lock, flags);
+@@ -117,6 +123,9 @@ unsigned long clk_get_rate(struct clk *clk)
+ unsigned long flags;
+ unsigned long rate;
+
++ if (!clk)
++ return 0;
++
+ spin_lock_irqsave(&clk_lock, flags);
+ rate = clk->get_rate(clk);
+ spin_unlock_irqrestore(&clk_lock, flags);
+@@ -129,6 +138,9 @@ long clk_round_rate(struct clk *clk, unsigned long rate)
+ {
+ unsigned long flags, actual_rate;
+
++ if (!clk)
++ return 0;
++
+ if (!clk->set_rate)
+ return -ENOSYS;
+
+@@ -145,6 +157,9 @@ int clk_set_rate(struct clk *clk, unsigned long rate)
+ unsigned long flags;
+ long ret;
+
++ if (!clk)
++ return 0;
++
+ if (!clk->set_rate)
+ return -ENOSYS;
+
+@@ -161,6 +176,9 @@ int clk_set_parent(struct clk *clk, struct clk *parent)
+ unsigned long flags;
+ int ret;
+
++ if (!clk)
++ return 0;
++
+ if (!clk->set_parent)
+ return -ENOSYS;
+
+@@ -174,7 +192,7 @@ EXPORT_SYMBOL(clk_set_parent);
+
+ struct clk *clk_get_parent(struct clk *clk)
+ {
+- return clk->parent;
++ return !clk ? NULL : clk->parent;
+ }
+ EXPORT_SYMBOL(clk_get_parent);
+
+diff --git a/arch/s390/kernel/sclp.S b/arch/s390/kernel/sclp.S
+index 29bd7be..1ecd47b 100644
+--- a/arch/s390/kernel/sclp.S
++++ b/arch/s390/kernel/sclp.S
+@@ -276,6 +276,8 @@ ENTRY(_sclp_print_early)
+ jno .Lesa2
+ ahi %r15,-80
+ stmh %r6,%r15,96(%r15) # store upper register halves
++ basr %r13,0
++ lmh %r0,%r15,.Lzeroes-.(%r13) # clear upper register halves
+ .Lesa2:
+ #endif
+ lr %r10,%r2 # save string pointer
+@@ -299,6 +301,8 @@ ENTRY(_sclp_print_early)
+ #endif
+ lm %r6,%r15,120(%r15) # restore registers
+ br %r14
++.Lzeroes:
++ .fill 64,4,0
+
+ .LwritedataS4:
+ .long 0x00760005 # SCLP command for write data
+diff --git a/arch/tile/kernel/setup.c b/arch/tile/kernel/setup.c
+index 74c9172..bdb3ecf 100644
+--- a/arch/tile/kernel/setup.c
++++ b/arch/tile/kernel/setup.c
+@@ -1146,7 +1146,7 @@ static void __init load_hv_initrd(void)
+
+ void __init free_initrd_mem(unsigned long begin, unsigned long end)
+ {
+- free_bootmem(__pa(begin), end - begin);
++ free_bootmem_late(__pa(begin), end - begin);
+ }
+
+ static int __init setup_initrd(char *str)
+diff --git a/arch/x86/boot/compressed/eboot.c b/arch/x86/boot/compressed/eboot.c
+index 78cbb2d..ec5a3c7 100644
+--- a/arch/x86/boot/compressed/eboot.c
++++ b/arch/x86/boot/compressed/eboot.c
+@@ -560,6 +560,10 @@ static efi_status_t setup_e820(struct boot_params *params,
+ unsigned int e820_type = 0;
+ unsigned long m = efi->efi_memmap;
+
++#ifdef CONFIG_X86_64
++ m |= (u64)efi->efi_memmap_hi << 32;
++#endif
++
+ d = (efi_memory_desc_t *)(m + (i * efi->efi_memdesc_size));
+ switch (d->type) {
+ case EFI_RESERVED_TYPE:
+diff --git a/arch/x86/boot/compressed/head_32.S b/arch/x86/boot/compressed/head_32.S
+index c5b56ed..a814c80 100644
+--- a/arch/x86/boot/compressed/head_32.S
++++ b/arch/x86/boot/compressed/head_32.S
+@@ -54,7 +54,7 @@ ENTRY(efi_pe_entry)
+ call reloc
+ reloc:
+ popl %ecx
+- subl reloc, %ecx
++ subl $reloc, %ecx
+ movl %ecx, BP_code32_start(%eax)
+
+ sub $0x4, %esp
+diff --git a/block/blk-cgroup.c b/block/blk-cgroup.c
+index d8f80e7..a717585 100644
+--- a/block/blk-cgroup.c
++++ b/block/blk-cgroup.c
+@@ -703,8 +703,12 @@ int blkg_conf_prep(struct blkcg *blkcg, const struct blkcg_policy *pol,
+ return -EINVAL;
+
+ disk = get_gendisk(MKDEV(major, minor), &part);
+- if (!disk || part)
++ if (!disk)
+ return -EINVAL;
++ if (part) {
++ put_disk(disk);
++ return -EINVAL;
++ }
+
+ rcu_read_lock();
+ spin_lock_irq(disk->queue->queue_lock);
+diff --git a/drivers/ata/libata-pmp.c b/drivers/ata/libata-pmp.c
+index 7ccc084..85aa761 100644
+--- a/drivers/ata/libata-pmp.c
++++ b/drivers/ata/libata-pmp.c
+@@ -460,6 +460,13 @@ static void sata_pmp_quirks(struct ata_port *ap)
+ ATA_LFLAG_NO_SRST |
+ ATA_LFLAG_ASSUME_ATA;
+ }
++ } else if (vendor == 0x11ab && devid == 0x4140) {
++ /* Marvell 4140 quirks */
++ ata_for_each_link(link, ap, EDGE) {
++ /* port 4 is for SEMB device and it doesn't like SRST */
++ if (link->pmp == 4)
++ link->flags |= ATA_LFLAG_DISABLED;
++ }
+ }
+ }
+
+diff --git a/drivers/input/touchscreen/usbtouchscreen.c b/drivers/input/touchscreen/usbtouchscreen.c
+index a096633..c6f7e91 100644
+--- a/drivers/input/touchscreen/usbtouchscreen.c
++++ b/drivers/input/touchscreen/usbtouchscreen.c
+@@ -625,6 +625,9 @@ static int dmc_tsc10_init(struct usbtouch_usb *usbtouch)
+ goto err_out;
+ }
+
++ /* TSC-25 data sheet specifies a delay after the RESET command */
++ msleep(150);
++
+ /* set coordinate output rate */
+ buf[0] = buf[1] = 0xFF;
+ ret = usb_control_msg(dev, usb_rcvctrlpipe (dev, 0),
+diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c
+index b96ee9d..9be97e0 100644
+--- a/drivers/md/raid1.c
++++ b/drivers/md/raid1.c
+@@ -336,7 +336,7 @@ static void raid1_end_read_request(struct bio *bio, int error)
+ spin_lock_irqsave(&conf->device_lock, flags);
+ if (r1_bio->mddev->degraded == conf->raid_disks ||
+ (r1_bio->mddev->degraded == conf->raid_disks-1 &&
+- !test_bit(Faulty, &conf->mirrors[mirror].rdev->flags)))
++ test_bit(In_sync, &conf->mirrors[mirror].rdev->flags)))
+ uptodate = 1;
+ spin_unlock_irqrestore(&conf->device_lock, flags);
+ }
+diff --git a/drivers/mmc/host/sdhci-esdhc.h b/drivers/mmc/host/sdhci-esdhc.h
+index a7d9f95..7fd86be 100644
+--- a/drivers/mmc/host/sdhci-esdhc.h
++++ b/drivers/mmc/host/sdhci-esdhc.h
+@@ -47,6 +47,6 @@
+ #define ESDHC_DMA_SYSCTL 0x40c
+ #define ESDHC_DMA_SNOOP 0x00000040
+
+-#define ESDHC_HOST_CONTROL_RES 0x05
++#define ESDHC_HOST_CONTROL_RES 0x01
+
+ #endif /* _DRIVERS_MMC_SDHCI_ESDHC_H */
+diff --git a/drivers/mmc/host/sdhci-pxav3.c b/drivers/mmc/host/sdhci-pxav3.c
+index 561c6b4..b807666 100644
+--- a/drivers/mmc/host/sdhci-pxav3.c
++++ b/drivers/mmc/host/sdhci-pxav3.c
+@@ -257,6 +257,7 @@ static int sdhci_pxav3_probe(struct platform_device *pdev)
+ goto err_of_parse;
+ sdhci_get_of_property(pdev);
+ pdata = pxav3_get_mmc_pdata(dev);
++ pdev->dev.platform_data = pdata;
+ } else if (pdata) {
+ /* on-chip device */
+ if (pdata->flags & PXA_FLAG_CARD_PERMANENT)
+diff --git a/drivers/scsi/st.c b/drivers/scsi/st.c
+index a1d6986..f310982 100644
+--- a/drivers/scsi/st.c
++++ b/drivers/scsi/st.c
+@@ -1262,9 +1262,9 @@ static int st_open(struct inode *inode, struct file *filp)
+ spin_lock(&st_use_lock);
+ STp->in_use = 0;
+ spin_unlock(&st_use_lock);
+- scsi_tape_put(STp);
+ if (resumed)
+ scsi_autopm_put_device(STp->device);
++ scsi_tape_put(STp);
+ return retval;
+
+ }
+diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c
+index c8d7b30..55ec9b4 100644
+--- a/drivers/target/iscsi/iscsi_target.c
++++ b/drivers/target/iscsi/iscsi_target.c
+@@ -4476,7 +4476,18 @@ static void iscsit_logout_post_handler_closesession(
+ struct iscsi_conn *conn)
+ {
+ struct iscsi_session *sess = conn->sess;
+- int sleep = cmpxchg(&conn->tx_thread_active, true, false);
++ int sleep = 1;
++ /*
++ * Traditional iscsi/tcp will invoke this logic from TX thread
++ * context during session logout, so clear tx_thread_active and
++ * sleep if iscsit_close_connection() has not already occured.
++ *
++ * Since iser-target invokes this logic from it's own workqueue,
++ * always sleep waiting for RX/TX thread shutdown to complete
++ * within iscsit_close_connection().
++ */
++ if (conn->conn_transport->transport_type == ISCSI_TCP)
++ sleep = cmpxchg(&conn->tx_thread_active, true, false);
+
+ atomic_set(&conn->conn_logout_remove, 0);
+ complete(&conn->conn_logout_comp);
+@@ -4490,7 +4501,10 @@ static void iscsit_logout_post_handler_closesession(
+ static void iscsit_logout_post_handler_samecid(
+ struct iscsi_conn *conn)
+ {
+- int sleep = cmpxchg(&conn->tx_thread_active, true, false);
++ int sleep = 1;
++
++ if (conn->conn_transport->transport_type == ISCSI_TCP)
++ sleep = cmpxchg(&conn->tx_thread_active, true, false);
+
+ atomic_set(&conn->conn_logout_remove, 0);
+ complete(&conn->conn_logout_comp);
+@@ -4709,6 +4723,7 @@ int iscsit_release_sessions_for_tpg(struct iscsi_portal_group *tpg, int force)
+ struct iscsi_session *sess;
+ struct se_portal_group *se_tpg = &tpg->tpg_se_tpg;
+ struct se_session *se_sess, *se_sess_tmp;
++ LIST_HEAD(free_list);
+ int session_count = 0;
+
+ spin_lock_bh(&se_tpg->session_lock);
+@@ -4730,14 +4745,17 @@ int iscsit_release_sessions_for_tpg(struct iscsi_portal_group *tpg, int force)
+ }
+ atomic_set(&sess->session_reinstatement, 1);
+ spin_unlock(&sess->conn_lock);
+- spin_unlock_bh(&se_tpg->session_lock);
+
+- iscsit_free_session(sess);
+- spin_lock_bh(&se_tpg->session_lock);
++ list_move_tail(&se_sess->sess_list, &free_list);
++ }
++ spin_unlock_bh(&se_tpg->session_lock);
+
++ list_for_each_entry_safe(se_sess, se_sess_tmp, &free_list, sess_list) {
++ sess = (struct iscsi_session *)se_sess->fabric_sess_ptr;
++
++ iscsit_free_session(sess);
+ session_count++;
+ }
+- spin_unlock_bh(&se_tpg->session_lock);
+
+ pr_debug("Released %d iSCSI Session(s) from Target Portal"
+ " Group: %hu\n", session_count, tpg->tpgt);
+diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c
+index b9e16abb..5c95765 100644
+--- a/drivers/usb/host/xhci-hub.c
++++ b/drivers/usb/host/xhci-hub.c
+@@ -480,10 +480,13 @@ static void xhci_hub_report_usb3_link_state(struct xhci_hcd *xhci,
+ u32 pls = status_reg & PORT_PLS_MASK;
+
+ /* resume state is a xHCI internal state.
+- * Do not report it to usb core.
++ * Do not report it to usb core, instead, pretend to be U3,
++ * thus usb core knows it's not ready for transfer
+ */
+- if (pls == XDEV_RESUME)
++ if (pls == XDEV_RESUME) {
++ *status |= USB_SS_PORT_LS_U3;
+ return;
++ }
+
+ /* When the CAS bit is set then warm reset
+ * should be performed on port
+@@ -584,7 +587,14 @@ static u32 xhci_get_port_status(struct usb_hcd *hcd,
+ status |= USB_PORT_STAT_C_RESET << 16;
+ /* USB3.0 only */
+ if (hcd->speed == HCD_USB3) {
+- if ((raw_port_status & PORT_PLC))
++ /* Port link change with port in resume state should not be
++ * reported to usbcore, as this is an internal state to be
++ * handled by xhci driver. Reporting PLC to usbcore may
++ * cause usbcore clearing PLC first and port change event
++ * irq won't be generated.
++ */
++ if ((raw_port_status & PORT_PLC) &&
++ (raw_port_status & PORT_PLS_MASK) != XDEV_RESUME)
+ status |= USB_PORT_STAT_C_LINK_STATE << 16;
+ if ((raw_port_status & PORT_WRC))
+ status |= USB_PORT_STAT_C_BH_RESET << 16;
+@@ -1114,10 +1124,10 @@ int xhci_bus_suspend(struct usb_hcd *hcd)
+ spin_lock_irqsave(&xhci->lock, flags);
+
+ if (hcd->self.root_hub->do_remote_wakeup) {
+- if (bus_state->resuming_ports) {
++ if (bus_state->resuming_ports || /* USB2 */
++ bus_state->port_remote_wakeup) { /* USB3 */
+ spin_unlock_irqrestore(&xhci->lock, flags);
+- xhci_dbg(xhci, "suspend failed because "
+- "a port is resuming\n");
++ xhci_dbg(xhci, "suspend failed because a port is resuming\n");
+ return -EBUSY;
+ }
+ }
+diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
+index f615712..bcc43a2 100644
+--- a/drivers/usb/host/xhci-ring.c
++++ b/drivers/usb/host/xhci-ring.c
+@@ -1740,6 +1740,9 @@ static void handle_port_status(struct xhci_hcd *xhci,
+ usb_hcd_resume_root_hub(hcd);
+ }
+
++ if (hcd->speed == HCD_USB3 && (temp & PORT_PLS_MASK) == XDEV_INACTIVE)
++ bus_state->port_remote_wakeup &= ~(1 << faked_port_index);
++
+ if ((temp & PORT_PLC) && (temp & PORT_PLS_MASK) == XDEV_RESUME) {
+ xhci_dbg(xhci, "port resume event for port %d\n", port_id);
+
+diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
+index 16f4f8d..fc61e663b 100644
+--- a/drivers/usb/host/xhci.c
++++ b/drivers/usb/host/xhci.c
+@@ -3424,6 +3424,9 @@ int xhci_discover_or_reset_device(struct usb_hcd *hcd, struct usb_device *udev)
+ return -EINVAL;
+ }
+
++ if (virt_dev->tt_info)
++ old_active_eps = virt_dev->tt_info->active_eps;
++
+ if (virt_dev->udev != udev) {
+ /* If the virt_dev and the udev does not match, this virt_dev
+ * may belong to another udev.
+diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h
+index 70facb7..c167485 100644
+--- a/drivers/usb/host/xhci.h
++++ b/drivers/usb/host/xhci.h
+@@ -285,6 +285,7 @@ struct xhci_op_regs {
+ #define XDEV_U0 (0x0 << 5)
+ #define XDEV_U2 (0x2 << 5)
+ #define XDEV_U3 (0x3 << 5)
++#define XDEV_INACTIVE (0x6 << 5)
+ #define XDEV_RESUME (0xf << 5)
+ /* true: port has power (see HCC_PPC) */
+ #define PORT_POWER (1 << 9)
+diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h
+index 821e1e2..da380a9 100644
+--- a/drivers/usb/storage/unusual_devs.h
++++ b/drivers/usb/storage/unusual_devs.h
+@@ -2032,6 +2032,18 @@ UNUSUAL_DEV( 0x1908, 0x3335, 0x0200, 0x0200,
+ USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+ US_FL_NO_READ_DISC_INFO ),
+
++/* Reported by Oliver Neukum <oneukum@suse.com>
++ * This device morphes spontaneously into another device if the access
++ * pattern of Windows isn't followed. Thus writable media would be dirty
++ * if the initial instance is used. So the device is limited to its
++ * virtual CD.
++ * And yes, the concept that BCD goes up to 9 is not heeded */
++UNUSUAL_DEV( 0x19d2, 0x1225, 0x0000, 0xffff,
++ "ZTE,Incorporated",
++ "ZTE WCDMA Technologies MSM",
++ USB_SC_DEVICE, USB_PR_DEVICE, NULL,
++ US_FL_SINGLE_LUN ),
++
+ /* Reported by Sven Geggus <sven-usbst@geggus.net>
+ * This encrypted pen drive returns bogus data for the initial READ(10).
+ */
+diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c
+index 78987e4..85095d7 100644
+--- a/drivers/vhost/vhost.c
++++ b/drivers/vhost/vhost.c
+@@ -876,6 +876,7 @@ long vhost_dev_ioctl(struct vhost_dev *d, unsigned int ioctl, void __user *argp)
+ }
+ if (eventfp != d->log_file) {
+ filep = d->log_file;
++ d->log_file = eventfp;
+ ctx = d->log_ctx;
+ d->log_ctx = eventfp ?
+ eventfd_ctx_fileget(eventfp) : NULL;
+diff --git a/fs/dcache.c b/fs/dcache.c
+index aa24f7d..3d2f27b 100644
+--- a/fs/dcache.c
++++ b/fs/dcache.c
+@@ -587,6 +587,9 @@ repeat:
+ if (unlikely(d_unhashed(dentry)))
+ goto kill_it;
+
++ if (unlikely(dentry->d_flags & DCACHE_DISCONNECTED))
++ goto kill_it;
++
+ if (unlikely(dentry->d_flags & DCACHE_OP_DELETE)) {
+ if (dentry->d_op->d_delete(dentry))
+ goto kill_it;
+diff --git a/kernel/irq/resend.c b/kernel/irq/resend.c
+index 9065107..7a5237a 100644
+--- a/kernel/irq/resend.c
++++ b/kernel/irq/resend.c
+@@ -75,13 +75,21 @@ void check_irq_resend(struct irq_desc *desc, unsigned int irq)
+ !desc->irq_data.chip->irq_retrigger(&desc->irq_data)) {
+ #ifdef CONFIG_HARDIRQS_SW_RESEND
+ /*
+- * If the interrupt has a parent irq and runs
+- * in the thread context of the parent irq,
+- * retrigger the parent.
++ * If the interrupt is running in the thread
++ * context of the parent irq we need to be
++ * careful, because we cannot trigger it
++ * directly.
+ */
+- if (desc->parent_irq &&
+- irq_settings_is_nested_thread(desc))
++ if (irq_settings_is_nested_thread(desc)) {
++ /*
++ * If the parent_irq is valid, we
++ * retrigger the parent, otherwise we
++ * do nothing.
++ */
++ if (!desc->parent_irq)
++ return;
+ irq = desc->parent_irq;
++ }
+ /* Set it pending and activate the softirq: */
+ set_bit(irq, irqs_resend);
+ tasklet_schedule(&resend_tasklet);
+diff --git a/mm/memory.c b/mm/memory.c
+index 749e1c6..e9ddc7a 100644
+--- a/mm/memory.c
++++ b/mm/memory.c
+@@ -3234,6 +3234,10 @@ static int do_anonymous_page(struct mm_struct *mm, struct vm_area_struct *vma,
+
+ pte_unmap(page_table);
+
++ /* File mapping without ->vm_ops ? */
++ if (vma->vm_flags & VM_SHARED)
++ return VM_FAULT_SIGBUS;
++
+ /* Check if we need to add a guard page to the stack */
+ if (check_stack_guard_page(vma, address) < 0)
+ return VM_FAULT_SIGSEGV;
+@@ -3502,6 +3506,9 @@ static int do_linear_fault(struct mm_struct *mm, struct vm_area_struct *vma,
+ - vma->vm_start) >> PAGE_SHIFT) + vma->vm_pgoff;
+
+ pte_unmap(page_table);
++ /* The VMA was not fully populated on mmap() or missing VM_DONTEXPAND */
++ if (!vma->vm_ops->fault)
++ return VM_FAULT_SIGBUS;
+ return __do_fault(mm, vma, address, pmd, pgoff, flags, orig_pte);
+ }
+
+@@ -3650,11 +3657,9 @@ static int handle_pte_fault(struct mm_struct *mm,
+ entry = ACCESS_ONCE(*pte);
+ if (!pte_present(entry)) {
+ if (pte_none(entry)) {
+- if (vma->vm_ops) {
+- if (likely(vma->vm_ops->fault))
+- return do_linear_fault(mm, vma, address,
++ if (vma->vm_ops)
++ return do_linear_fault(mm, vma, address,
+ pte, pmd, flags, entry);
+- }
+ return do_anonymous_page(mm, vma, address,
+ pte, pmd, flags);
+ }
+diff --git a/net/mac80211/debugfs_netdev.c b/net/mac80211/debugfs_netdev.c
+index 653ce5d..5d8bc1f 100644
+--- a/net/mac80211/debugfs_netdev.c
++++ b/net/mac80211/debugfs_netdev.c
+@@ -712,6 +712,7 @@ void ieee80211_debugfs_remove_netdev(struct ieee80211_sub_if_data *sdata)
+
+ debugfs_remove_recursive(sdata->vif.debugfs_dir);
+ sdata->vif.debugfs_dir = NULL;
++ sdata->debugfs.subdir_stations = NULL;
+ }
+
+ void ieee80211_debugfs_rename_netdev(struct ieee80211_sub_if_data *sdata)
+diff --git a/net/rds/ib_rdma.c b/net/rds/ib_rdma.c
+index e8fdb17..a985158 100644
+--- a/net/rds/ib_rdma.c
++++ b/net/rds/ib_rdma.c
+@@ -759,8 +759,10 @@ void *rds_ib_get_mr(struct scatterlist *sg, unsigned long nents,
+ }
+
+ ibmr = rds_ib_alloc_fmr(rds_ibdev);
+- if (IS_ERR(ibmr))
++ if (IS_ERR(ibmr)) {
++ rds_ib_dev_put(rds_ibdev);
+ return ibmr;
++ }
+
+ ret = rds_ib_map_fmr(rds_ibdev, ibmr, sg, nents);
+ if (ret == 0)
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index 2f503c0..907371d 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -2282,7 +2282,7 @@ static const struct snd_pci_quirk alc882_fixup_tbl[] = {
+ SND_PCI_QUIRK(0x106b, 0x4300, "iMac 9,1", ALC889_FIXUP_IMAC91_VREF),
+ SND_PCI_QUIRK(0x106b, 0x4600, "MacbookPro 5,2", ALC889_FIXUP_IMAC91_VREF),
+ SND_PCI_QUIRK(0x106b, 0x4900, "iMac 9,1 Aluminum", ALC889_FIXUP_IMAC91_VREF),
+- SND_PCI_QUIRK(0x106b, 0x4a00, "Macbook 5,2", ALC889_FIXUP_IMAC91_VREF),
++ SND_PCI_QUIRK(0x106b, 0x4a00, "Macbook 5,2", ALC889_FIXUP_MBA11_VREF),
+
+ SND_PCI_QUIRK(0x1071, 0x8258, "Evesham Voyaeger", ALC882_FIXUP_EAPD),
+ SND_PCI_QUIRK(0x1462, 0x7350, "MSI-7350", ALC889_FIXUP_CD),
+diff --git a/sound/usb/mixer_maps.c b/sound/usb/mixer_maps.c
+index b16be39..9a3e107 100644
+--- a/sound/usb/mixer_maps.c
++++ b/sound/usb/mixer_maps.c
+@@ -336,6 +336,20 @@ static const struct usbmix_name_map scms_usb3318_map[] = {
+ { 0 }
+ };
+
++/* Bose companion 5, the dB conversion factor is 16 instead of 256 */
++static struct usbmix_dB_map bose_companion5_dB = {-5006, -6};
++static struct usbmix_name_map bose_companion5_map[] = {
++ { 3, NULL, .dB = &bose_companion5_dB },
++ { 0 } /* terminator */
++};
++
++/* Dragonfly DAC 1.2, the dB conversion factor is 1 instead of 256 */
++static struct usbmix_dB_map dragonfly_1_2_dB = {0, 5000};
++static struct usbmix_name_map dragonfly_1_2_map[] = {
++ { 7, NULL, .dB = &dragonfly_1_2_dB },
++ { 0 } /* terminator */
++};
++
+ /*
+ * Control map entries
+ */
+@@ -442,6 +456,16 @@ static struct usbmix_ctl_map usbmix_ctl_maps[] = {
+ .id = USB_ID(0x25c4, 0x0003),
+ .map = scms_usb3318_map,
+ },
++ {
++ /* Bose Companion 5 */
++ .id = USB_ID(0x05a7, 0x1020),
++ .map = bose_companion5_map,
++ },
++ {
++ /* Dragonfly DAC 1.2 */
++ .id = USB_ID(0x21b4, 0x0081),
++ .map = dragonfly_1_2_map,
++ },
+ { 0 } /* terminator */
+ };
+
+diff --git a/sound/usb/quirks-table.h b/sound/usb/quirks-table.h
+index 5293b5a..7c24088 100644
+--- a/sound/usb/quirks-table.h
++++ b/sound/usb/quirks-table.h
+@@ -2516,6 +2516,74 @@ YAMAHA_DEVICE(0x7010, "UB99"),
+ }
+ },
+
++/* Steinberg devices */
++{
++ /* Steinberg MI2 */
++ USB_DEVICE_VENDOR_SPEC(0x0a4e, 0x2040),
++ .driver_info = (unsigned long) & (const struct snd_usb_audio_quirk) {
++ .ifnum = QUIRK_ANY_INTERFACE,
++ .type = QUIRK_COMPOSITE,
++ .data = & (const struct snd_usb_audio_quirk[]) {
++ {
++ .ifnum = 0,
++ .type = QUIRK_AUDIO_STANDARD_INTERFACE
++ },
++ {
++ .ifnum = 1,
++ .type = QUIRK_AUDIO_STANDARD_INTERFACE
++ },
++ {
++ .ifnum = 2,
++ .type = QUIRK_AUDIO_STANDARD_INTERFACE
++ },
++ {
++ .ifnum = 3,
++ .type = QUIRK_MIDI_FIXED_ENDPOINT,
++ .data = &(const struct snd_usb_midi_endpoint_info) {
++ .out_cables = 0x0001,
++ .in_cables = 0x0001
++ }
++ },
++ {
++ .ifnum = -1
++ }
++ }
++ }
++},
++{
++ /* Steinberg MI4 */
++ USB_DEVICE_VENDOR_SPEC(0x0a4e, 0x4040),
++ .driver_info = (unsigned long) & (const struct snd_usb_audio_quirk) {
++ .ifnum = QUIRK_ANY_INTERFACE,
++ .type = QUIRK_COMPOSITE,
++ .data = & (const struct snd_usb_audio_quirk[]) {
++ {
++ .ifnum = 0,
++ .type = QUIRK_AUDIO_STANDARD_INTERFACE
++ },
++ {
++ .ifnum = 1,
++ .type = QUIRK_AUDIO_STANDARD_INTERFACE
++ },
++ {
++ .ifnum = 2,
++ .type = QUIRK_AUDIO_STANDARD_INTERFACE
++ },
++ {
++ .ifnum = 3,
++ .type = QUIRK_MIDI_FIXED_ENDPOINT,
++ .data = &(const struct snd_usb_midi_endpoint_info) {
++ .out_cables = 0x0001,
++ .in_cables = 0x0001
++ }
++ },
++ {
++ .ifnum = -1
++ }
++ }
++ }
++},
++
+ /* TerraTec devices */
+ {
+ USB_DEVICE_VENDOR_SPEC(0x0ccd, 0x0012),
diff --git a/3.14.49/4420_grsecurity-3.1-3.14.49-201508032312.patch b/3.14.50/4420_grsecurity-3.1-3.14.50-201508102128.patch
index 75ba2f6..1086c4e 100644
--- a/3.14.49/4420_grsecurity-3.1-3.14.49-201508032312.patch
+++ b/3.14.50/4420_grsecurity-3.1-3.14.50-201508102128.patch
@@ -328,7 +328,7 @@ index 855d9b3..154c500 100644
A toggle value indicating if modules are allowed to be loaded
diff --git a/Makefile b/Makefile
-index fee8460..5d81b33 100644
+index d71c40a..4d15036 100644
--- a/Makefile
+++ b/Makefile
@@ -244,8 +244,9 @@ CONFIG_SHELL := $(shell if [ -x "$$BASH" ]; then echo $$BASH; \
@@ -10431,6 +10431,40 @@ index ad7e178..26cd4a7 100644
if (unlikely(ret))
ret = copy_to_user_fixup(to, from, size);
return ret;
+diff --git a/arch/sparc/include/asm/visasm.h b/arch/sparc/include/asm/visasm.h
+index 11fdf0e..50d6f16 100644
+--- a/arch/sparc/include/asm/visasm.h
++++ b/arch/sparc/include/asm/visasm.h
+@@ -28,16 +28,10 @@
+ * Must preserve %o5 between VISEntryHalf and VISExitHalf */
+
+ #define VISEntryHalf \
+- rd %fprs, %o5; \
+- andcc %o5, FPRS_FEF, %g0; \
+- be,pt %icc, 297f; \
+- sethi %hi(298f), %g7; \
+- sethi %hi(VISenterhalf), %g1; \
+- jmpl %g1 + %lo(VISenterhalf), %g0; \
+- or %g7, %lo(298f), %g7; \
+- clr %o5; \
+-297: wr %o5, FPRS_FEF, %fprs; \
+-298:
++ VISEntry
++
++#define VISExitHalf \
++ VISExit
+
+ #define VISEntryHalfFast(fail_label) \
+ rd %fprs, %o5; \
+@@ -47,7 +41,7 @@
+ ba,a,pt %xcc, fail_label; \
+ 297: wr %o5, FPRS_FEF, %fprs;
+
+-#define VISExitHalf \
++#define VISExitHalfFast \
+ wr %o5, 0, %fprs;
+
+ #ifndef __ASSEMBLY__
diff --git a/arch/sparc/kernel/Makefile b/arch/sparc/kernel/Makefile
index d15cc17..d0ae796 100644
--- a/arch/sparc/kernel/Makefile
@@ -11092,6 +11126,105 @@ index dbe119b..089c7c1 100644
lib-$(CONFIG_SPARC32) += ashrdi3.o
lib-$(CONFIG_SPARC32) += memcpy.o memset.o
+diff --git a/arch/sparc/lib/NG4memcpy.S b/arch/sparc/lib/NG4memcpy.S
+index 140527a..83aeeb1 100644
+--- a/arch/sparc/lib/NG4memcpy.S
++++ b/arch/sparc/lib/NG4memcpy.S
+@@ -240,8 +240,11 @@ FUNC_NAME: /* %o0=dst, %o1=src, %o2=len */
+ add %o0, 0x40, %o0
+ bne,pt %icc, 1b
+ LOAD(prefetch, %g1 + 0x200, #n_reads_strong)
++#ifdef NON_USER_COPY
++ VISExitHalfFast
++#else
+ VISExitHalf
+-
++#endif
+ brz,pn %o2, .Lexit
+ cmp %o2, 19
+ ble,pn %icc, .Lsmall_unaligned
+diff --git a/arch/sparc/lib/VISsave.S b/arch/sparc/lib/VISsave.S
+index b320ae9..a063d84 100644
+--- a/arch/sparc/lib/VISsave.S
++++ b/arch/sparc/lib/VISsave.S
+@@ -44,9 +44,8 @@ vis1: ldub [%g6 + TI_FPSAVED], %g3
+
+ stx %g3, [%g6 + TI_GSR]
+ 2: add %g6, %g1, %g3
+- cmp %o5, FPRS_DU
+- be,pn %icc, 6f
+- sll %g1, 3, %g1
++ mov FPRS_DU | FPRS_DL | FPRS_FEF, %o5
++ sll %g1, 3, %g1
+ stb %o5, [%g3 + TI_FPSAVED]
+ rd %gsr, %g2
+ add %g6, %g1, %g3
+@@ -80,65 +79,3 @@ vis1: ldub [%g6 + TI_FPSAVED], %g3
+ .align 32
+ 80: jmpl %g7 + %g0, %g0
+ nop
+-
+-6: ldub [%g3 + TI_FPSAVED], %o5
+- or %o5, FPRS_DU, %o5
+- add %g6, TI_FPREGS+0x80, %g2
+- stb %o5, [%g3 + TI_FPSAVED]
+-
+- sll %g1, 5, %g1
+- add %g6, TI_FPREGS+0xc0, %g3
+- wr %g0, FPRS_FEF, %fprs
+- membar #Sync
+- stda %f32, [%g2 + %g1] ASI_BLK_P
+- stda %f48, [%g3 + %g1] ASI_BLK_P
+- membar #Sync
+- ba,pt %xcc, 80f
+- nop
+-
+- .align 32
+-80: jmpl %g7 + %g0, %g0
+- nop
+-
+- .align 32
+-VISenterhalf:
+- ldub [%g6 + TI_FPDEPTH], %g1
+- brnz,a,pn %g1, 1f
+- cmp %g1, 1
+- stb %g0, [%g6 + TI_FPSAVED]
+- stx %fsr, [%g6 + TI_XFSR]
+- clr %o5
+- jmpl %g7 + %g0, %g0
+- wr %g0, FPRS_FEF, %fprs
+-
+-1: bne,pn %icc, 2f
+- srl %g1, 1, %g1
+- ba,pt %xcc, vis1
+- sub %g7, 8, %g7
+-2: addcc %g6, %g1, %g3
+- sll %g1, 3, %g1
+- andn %o5, FPRS_DU, %g2
+- stb %g2, [%g3 + TI_FPSAVED]
+-
+- rd %gsr, %g2
+- add %g6, %g1, %g3
+- stx %g2, [%g3 + TI_GSR]
+- add %g6, %g1, %g2
+- stx %fsr, [%g2 + TI_XFSR]
+- sll %g1, 5, %g1
+-3: andcc %o5, FPRS_DL, %g0
+- be,pn %icc, 4f
+- add %g6, TI_FPREGS, %g2
+-
+- add %g6, TI_FPREGS+0x40, %g3
+- membar #Sync
+- stda %f0, [%g2 + %g1] ASI_BLK_P
+- stda %f16, [%g3 + %g1] ASI_BLK_P
+- membar #Sync
+- ba,pt %xcc, 4f
+- nop
+-
+- .align 32
+-4: and %o5, FPRS_DU, %o5
+- jmpl %g7 + %g0, %g0
+- wr %o5, FPRS_FEF, %fprs
diff --git a/arch/sparc/lib/atomic_64.S b/arch/sparc/lib/atomic_64.S
index 85c233d..68500e0 100644
--- a/arch/sparc/lib/atomic_64.S
@@ -11307,7 +11440,7 @@ index 85c233d..68500e0 100644
cmp %g1, %g7
bne,pn %xcc, BACKOFF_LABEL(2f, 1b)
diff --git a/arch/sparc/lib/ksyms.c b/arch/sparc/lib/ksyms.c
-index 323335b..ed85ea2 100644
+index 323335b..e8ee09d 100644
--- a/arch/sparc/lib/ksyms.c
+++ b/arch/sparc/lib/ksyms.c
@@ -100,12 +100,18 @@ EXPORT_SYMBOL(__clear_user);
@@ -11329,6 +11462,17 @@ index 323335b..ed85ea2 100644
EXPORT_SYMBOL(atomic64_sub_ret);
EXPORT_SYMBOL(atomic64_dec_if_positive);
+@@ -126,10 +132,6 @@ EXPORT_SYMBOL(copy_user_page);
+ void VISenter(void);
+ EXPORT_SYMBOL(VISenter);
+
+-/* CRYPTO code needs this */
+-void VISenterhalf(void);
+-EXPORT_SYMBOL(VISenterhalf);
+-
+ extern void xor_vis_2(unsigned long, unsigned long *, unsigned long *);
+ extern void xor_vis_3(unsigned long, unsigned long *, unsigned long *,
+ unsigned long *);
diff --git a/arch/sparc/mm/Makefile b/arch/sparc/mm/Makefile
index 30c3ecc..736f015 100644
--- a/arch/sparc/mm/Makefile
@@ -12816,21 +12960,6 @@ index 67e9f5c..2af15db 100644
KBUILD_AFLAGS := $(KBUILD_CFLAGS) -D__ASSEMBLY__
GCOV_PROFILE := n
-diff --git a/arch/x86/boot/compressed/eboot.c b/arch/x86/boot/compressed/eboot.c
-index 78cbb2d..ec5a3c7 100644
---- a/arch/x86/boot/compressed/eboot.c
-+++ b/arch/x86/boot/compressed/eboot.c
-@@ -560,6 +560,10 @@ static efi_status_t setup_e820(struct boot_params *params,
- unsigned int e820_type = 0;
- unsigned long m = efi->efi_memmap;
-
-+#ifdef CONFIG_X86_64
-+ m |= (u64)efi->efi_memmap_hi << 32;
-+#endif
-+
- d = (efi_memory_desc_t *)(m + (i * efi->efi_memdesc_size));
- switch (d->type) {
- case EFI_RESERVED_TYPE:
diff --git a/arch/x86/boot/compressed/efi_stub_32.S b/arch/x86/boot/compressed/efi_stub_32.S
index a53440e..c3dbf1e 100644
--- a/arch/x86/boot/compressed/efi_stub_32.S
@@ -12874,7 +13003,7 @@ index a53440e..c3dbf1e 100644
.previous
diff --git a/arch/x86/boot/compressed/head_32.S b/arch/x86/boot/compressed/head_32.S
-index c5b56ed..9f79ed3 100644
+index a814c80..5df45f6 100644
--- a/arch/x86/boot/compressed/head_32.S
+++ b/arch/x86/boot/compressed/head_32.S
@@ -119,10 +119,10 @@ preferred_addr:
@@ -36926,10 +37055,10 @@ index af00795..2bb8105 100644
#define XCHAL_ICACHE_SIZE 32768 /* I-cache size in bytes or 0 */
#define XCHAL_DCACHE_SIZE 32768 /* D-cache size in bytes or 0 */
diff --git a/block/blk-cgroup.c b/block/blk-cgroup.c
-index d8f80e7..5f41702 100644
+index a717585..11de03b 100644
--- a/block/blk-cgroup.c
+++ b/block/blk-cgroup.c
-@@ -809,7 +809,7 @@ static void blkcg_css_free(struct cgroup_subsys_state *css)
+@@ -813,7 +813,7 @@ static void blkcg_css_free(struct cgroup_subsys_state *css)
static struct cgroup_subsys_state *
blkcg_css_alloc(struct cgroup_subsys_state *parent_css)
{
@@ -36938,7 +37067,7 @@ index d8f80e7..5f41702 100644
struct blkcg *blkcg;
if (!parent_css) {
-@@ -823,7 +823,7 @@ blkcg_css_alloc(struct cgroup_subsys_state *parent_css)
+@@ -827,7 +827,7 @@ blkcg_css_alloc(struct cgroup_subsys_state *parent_css)
blkcg->cfq_weight = CFQ_WEIGHT_DEFAULT;
blkcg->cfq_leaf_weight = CFQ_WEIGHT_DEFAULT;
@@ -46093,7 +46222,7 @@ index 3e6d115..ffecdeb 100644
/*----------------------------------------------------------------*/
diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c
-index b96ee9d..1d38b21 100644
+index 9be97e0..71b21b0 100644
--- a/drivers/md/raid1.c
+++ b/drivers/md/raid1.c
@@ -1937,7 +1937,7 @@ static int fix_sync_read_error(struct r1bio *r1_bio)
@@ -49509,7 +49638,7 @@ index f9e96c4..6b1faeb 100644
deferred:
#endif
diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
-index 841b608..198a8b7 100644
+index 841b608..1f38243 100644
--- a/drivers/net/virtio_net.c
+++ b/drivers/net/virtio_net.c
@@ -47,7 +47,7 @@ module_param(gso, bool, 0444);
@@ -49521,6 +49650,18 @@ index 841b608..198a8b7 100644
#define VIRTNET_DRIVER_VERSION "1.0.0"
+@@ -1652,9 +1652,9 @@ static int virtnet_probe(struct virtio_device *vdev)
+ /* Do we support "hardware" checksums? */
+ if (virtio_has_feature(vdev, VIRTIO_NET_F_CSUM)) {
+ /* This opens up the world of extra features. */
+- dev->hw_features |= NETIF_F_HW_CSUM|NETIF_F_SG|NETIF_F_FRAGLIST;
++ dev->hw_features |= NETIF_F_HW_CSUM|NETIF_F_SG;
+ if (csum)
+- dev->features |= NETIF_F_HW_CSUM|NETIF_F_SG|NETIF_F_FRAGLIST;
++ dev->features |= NETIF_F_HW_CSUM|NETIF_F_SG;
+
+ if (virtio_has_feature(vdev, VIRTIO_NET_F_GSO)) {
+ dev->hw_features |= NETIF_F_TSO | NETIF_F_UFO
diff --git a/drivers/net/vmxnet3/vmxnet3_drv.c b/drivers/net/vmxnet3/vmxnet3_drv.c
index 0fa3b44..e913fc9 100644
--- a/drivers/net/vmxnet3/vmxnet3_drv.c
@@ -53028,21 +53169,6 @@ index 40d8592..8e89146 100644
int block_sectors = 0;
long error_sector;
struct scsi_cd *cd = scsi_cd(SCpnt->request->rq_disk);
-diff --git a/drivers/scsi/st.c b/drivers/scsi/st.c
-index a1d6986..f310982 100644
---- a/drivers/scsi/st.c
-+++ b/drivers/scsi/st.c
-@@ -1262,9 +1262,9 @@ static int st_open(struct inode *inode, struct file *filp)
- spin_lock(&st_use_lock);
- STp->in_use = 0;
- spin_unlock(&st_use_lock);
-- scsi_tape_put(STp);
- if (resumed)
- scsi_autopm_put_device(STp->device);
-+ scsi_tape_put(STp);
- return retval;
-
- }
diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c
index f3e3ae8..f876b14 100644
--- a/drivers/spi/spi.c
@@ -74381,7 +74507,7 @@ index a93f7e6..d58bcbe 100644
return 0;
while (nr) {
diff --git a/fs/dcache.c b/fs/dcache.c
-index aa24f7d..8f1bf8c 100644
+index 3d2f27b..8f1bf8c 100644
--- a/fs/dcache.c
+++ b/fs/dcache.c
@@ -250,7 +250,7 @@ static void __d_free(struct rcu_head *head)
@@ -74393,17 +74519,7 @@ index aa24f7d..8f1bf8c 100644
this_cpu_dec(nr_dentry);
if (dentry->d_op && dentry->d_op->d_release)
dentry->d_op->d_release(dentry);
-@@ -587,6 +587,9 @@ repeat:
- if (unlikely(d_unhashed(dentry)))
- goto kill_it;
-
-+ if (unlikely(dentry->d_flags & DCACHE_DISCONNECTED))
-+ goto kill_it;
-+
- if (unlikely(dentry->d_flags & DCACHE_OP_DELETE)) {
- if (dentry->d_op->d_delete(dentry))
- goto kill_it;
-@@ -596,7 +599,7 @@ repeat:
+@@ -599,7 +599,7 @@ repeat:
dentry->d_flags |= DCACHE_REFERENCED;
dentry_lru_add(dentry);
@@ -74412,7 +74528,7 @@ index aa24f7d..8f1bf8c 100644
spin_unlock(&dentry->d_lock);
return;
-@@ -651,7 +654,7 @@ int d_invalidate(struct dentry * dentry)
+@@ -654,7 +654,7 @@ int d_invalidate(struct dentry * dentry)
* We also need to leave mountpoints alone,
* directory or not.
*/
@@ -74421,7 +74537,7 @@ index aa24f7d..8f1bf8c 100644
if (S_ISDIR(dentry->d_inode->i_mode) || d_mountpoint(dentry)) {
spin_unlock(&dentry->d_lock);
return -EBUSY;
-@@ -667,7 +670,7 @@ EXPORT_SYMBOL(d_invalidate);
+@@ -670,7 +670,7 @@ EXPORT_SYMBOL(d_invalidate);
/* This must be called with d_lock held */
static inline void __dget_dlock(struct dentry *dentry)
{
@@ -74430,7 +74546,7 @@ index aa24f7d..8f1bf8c 100644
}
static inline void __dget(struct dentry *dentry)
-@@ -708,8 +711,8 @@ repeat:
+@@ -711,8 +711,8 @@ repeat:
goto repeat;
}
rcu_read_unlock();
@@ -74441,7 +74557,7 @@ index aa24f7d..8f1bf8c 100644
spin_unlock(&ret->d_lock);
return ret;
}
-@@ -792,7 +795,7 @@ restart:
+@@ -795,7 +795,7 @@ restart:
spin_lock(&inode->i_lock);
hlist_for_each_entry(dentry, &inode->i_dentry, d_u.d_alias) {
spin_lock(&dentry->d_lock);
@@ -74450,7 +74566,7 @@ index aa24f7d..8f1bf8c 100644
/*
* inform the fs via d_prune that this dentry
* is about to be unhashed and destroyed.
-@@ -884,7 +887,7 @@ static void shrink_dentry_list(struct list_head *list)
+@@ -887,7 +887,7 @@ static void shrink_dentry_list(struct list_head *list)
* We found an inuse dentry which was not removed from
* the LRU because of laziness during lookup. Do not free it.
*/
@@ -74459,7 +74575,7 @@ index aa24f7d..8f1bf8c 100644
spin_unlock(&dentry->d_lock);
continue;
}
-@@ -930,7 +933,7 @@ dentry_lru_isolate(struct list_head *item, spinlock_t *lru_lock, void *arg)
+@@ -933,7 +933,7 @@ dentry_lru_isolate(struct list_head *item, spinlock_t *lru_lock, void *arg)
* counts, just remove them from the LRU. Otherwise give them
* another pass through the LRU.
*/
@@ -74468,7 +74584,7 @@ index aa24f7d..8f1bf8c 100644
d_lru_isolate(dentry);
spin_unlock(&dentry->d_lock);
return LRU_REMOVED;
-@@ -1269,7 +1272,7 @@ static enum d_walk_ret select_collect(void *_data, struct dentry *dentry)
+@@ -1272,7 +1272,7 @@ static enum d_walk_ret select_collect(void *_data, struct dentry *dentry)
* loop in shrink_dcache_parent() might not make any progress
* and loop forever.
*/
@@ -74477,7 +74593,7 @@ index aa24f7d..8f1bf8c 100644
dentry_lru_del(dentry);
} else if (!(dentry->d_flags & DCACHE_SHRINK_LIST)) {
/*
-@@ -1323,11 +1326,11 @@ static enum d_walk_ret umount_collect(void *_data, struct dentry *dentry)
+@@ -1326,11 +1326,11 @@ static enum d_walk_ret umount_collect(void *_data, struct dentry *dentry)
struct select_data *data = _data;
enum d_walk_ret ret = D_WALK_CONTINUE;
@@ -74491,7 +74607,7 @@ index aa24f7d..8f1bf8c 100644
goto out;
printk(KERN_ERR
"BUG: Dentry %p{i=%lx,n=%s}"
-@@ -1337,7 +1340,7 @@ static enum d_walk_ret umount_collect(void *_data, struct dentry *dentry)
+@@ -1340,7 +1340,7 @@ static enum d_walk_ret umount_collect(void *_data, struct dentry *dentry)
dentry->d_inode ?
dentry->d_inode->i_ino : 0UL,
dentry->d_name.name,
@@ -74500,7 +74616,7 @@ index aa24f7d..8f1bf8c 100644
dentry->d_sb->s_type->name,
dentry->d_sb->s_id);
BUG();
-@@ -1495,7 +1498,7 @@ struct dentry *__d_alloc(struct super_block *sb, const struct qstr *name)
+@@ -1498,7 +1498,7 @@ struct dentry *__d_alloc(struct super_block *sb, const struct qstr *name)
*/
dentry->d_iname[DNAME_INLINE_LEN-1] = 0;
if (name->len > DNAME_INLINE_LEN-1) {
@@ -74509,7 +74625,7 @@ index aa24f7d..8f1bf8c 100644
if (!dname) {
kmem_cache_free(dentry_cache, dentry);
return NULL;
-@@ -1513,7 +1516,7 @@ struct dentry *__d_alloc(struct super_block *sb, const struct qstr *name)
+@@ -1516,7 +1516,7 @@ struct dentry *__d_alloc(struct super_block *sb, const struct qstr *name)
smp_wmb();
dentry->d_name.name = dname;
@@ -74518,7 +74634,7 @@ index aa24f7d..8f1bf8c 100644
dentry->d_flags = 0;
spin_lock_init(&dentry->d_lock);
seqcount_init(&dentry->d_seq);
-@@ -1522,6 +1525,9 @@ struct dentry *__d_alloc(struct super_block *sb, const struct qstr *name)
+@@ -1525,6 +1525,9 @@ struct dentry *__d_alloc(struct super_block *sb, const struct qstr *name)
dentry->d_sb = sb;
dentry->d_op = NULL;
dentry->d_fsdata = NULL;
@@ -74528,7 +74644,7 @@ index aa24f7d..8f1bf8c 100644
INIT_HLIST_BL_NODE(&dentry->d_hash);
INIT_LIST_HEAD(&dentry->d_lru);
INIT_LIST_HEAD(&dentry->d_subdirs);
-@@ -2276,7 +2282,7 @@ struct dentry *__d_lookup(const struct dentry *parent, const struct qstr *name)
+@@ -2279,7 +2282,7 @@ struct dentry *__d_lookup(const struct dentry *parent, const struct qstr *name)
goto next;
}
@@ -74537,7 +74653,7 @@ index aa24f7d..8f1bf8c 100644
found = dentry;
spin_unlock(&dentry->d_lock);
break;
-@@ -2375,7 +2381,7 @@ again:
+@@ -2378,7 +2381,7 @@ again:
spin_lock(&dentry->d_lock);
inode = dentry->d_inode;
isdir = S_ISDIR(inode->i_mode);
@@ -74546,7 +74662,7 @@ index aa24f7d..8f1bf8c 100644
if (!spin_trylock(&inode->i_lock)) {
spin_unlock(&dentry->d_lock);
cpu_relax();
-@@ -3308,7 +3314,7 @@ static enum d_walk_ret d_genocide_kill(void *data, struct dentry *dentry)
+@@ -3311,7 +3314,7 @@ static enum d_walk_ret d_genocide_kill(void *data, struct dentry *dentry)
if (!(dentry->d_flags & DCACHE_GENOCIDE)) {
dentry->d_flags |= DCACHE_GENOCIDE;
@@ -74555,7 +74671,7 @@ index aa24f7d..8f1bf8c 100644
}
}
return D_WALK_CONTINUE;
-@@ -3424,7 +3430,8 @@ void __init vfs_caches_init(unsigned long mempages)
+@@ -3427,7 +3430,8 @@ void __init vfs_caches_init(unsigned long mempages)
mempages -= reserve;
names_cachep = kmem_cache_create("names_cache", PATH_MAX, 0,
@@ -77944,7 +78060,7 @@ index b29e42f..5ea7fdf 100644
#define MNT_NS_INTERNAL ERR_PTR(-EINVAL) /* distinct from any mnt_namespace */
diff --git a/fs/namei.c b/fs/namei.c
-index ccb8000..ac58c5a 100644
+index ccb8000..02d506e 100644
--- a/fs/namei.c
+++ b/fs/namei.c
@@ -331,17 +331,34 @@ int generic_permission(struct inode *inode, int mask)
@@ -78000,6 +78116,15 @@ index ccb8000..ac58c5a 100644
return -EACCES;
}
+@@ -733,7 +742,7 @@ static inline int may_follow_link(struct path *link, struct nameidata *nd)
+ return 0;
+
+ /* Allowed if parent directory not sticky and world-writable. */
+- parent = nd->path.dentry->d_inode;
++ parent = nd->inode;
+ if ((parent->i_mode & (S_ISVTX|S_IWOTH)) != (S_ISVTX|S_IWOTH))
+ return 0;
+
@@ -821,7 +830,7 @@ follow_link(struct path *link, struct nameidata *nd, void **p)
{
struct dentry *dentry = link->dentry;
@@ -111608,7 +111733,7 @@ index 9502057..a83c0d4 100644
}
unset_migratetype_isolate(page, MIGRATE_MOVABLE);
diff --git a/mm/memory.c b/mm/memory.c
-index 749e1c6..f7fbc29 100644
+index e9ddc7a..f465481 100644
--- a/mm/memory.c
+++ b/mm/memory.c
@@ -403,6 +403,7 @@ static inline void free_pmd_range(struct mmu_gather *tlb, pud_t *pud,
@@ -112065,7 +112190,7 @@ index 749e1c6..f7fbc29 100644
* We enter with non-exclusive mmap_sem (to exclude vma changes,
* but allow concurrent faults), and pte mapped but not yet locked.
* We return with mmap_sem still held, but pte unmapped and unlocked.
-@@ -3228,27 +3412,23 @@ static int do_anonymous_page(struct mm_struct *mm, struct vm_area_struct *vma,
+@@ -3228,31 +3412,29 @@ static int do_anonymous_page(struct mm_struct *mm, struct vm_area_struct *vma,
unsigned long address, pte_t *page_table, pmd_t *pmd,
unsigned int flags)
{
@@ -112076,6 +112201,13 @@ index 749e1c6..f7fbc29 100644
- pte_unmap(page_table);
-
+ /* File mapping without ->vm_ops ? */
+- if (vma->vm_flags & VM_SHARED)
++ if (vma->vm_flags & VM_SHARED) {
++ pte_unmap(page_table);
+ return VM_FAULT_SIGBUS;
++ }
+
- /* Check if we need to add a guard page to the stack */
- if (check_stack_guard_page(vma, address) < 0)
- return VM_FAULT_SIGSEGV;
@@ -112098,7 +112230,7 @@ index 749e1c6..f7fbc29 100644
if (unlikely(anon_vma_prepare(vma)))
goto oom;
page = alloc_zeroed_user_highpage_movable(vma, address);
-@@ -3272,6 +3452,11 @@ static int do_anonymous_page(struct mm_struct *mm, struct vm_area_struct *vma,
+@@ -3276,6 +3458,11 @@ static int do_anonymous_page(struct mm_struct *mm, struct vm_area_struct *vma,
if (!pte_none(*page_table))
goto release;
@@ -112110,7 +112242,7 @@ index 749e1c6..f7fbc29 100644
inc_mm_counter_fast(mm, MM_ANONPAGES);
page_add_new_anon_rmap(page, vma, address);
setpte:
-@@ -3279,6 +3464,12 @@ setpte:
+@@ -3283,6 +3470,12 @@ setpte:
/* No need to invalidate - it was non-present before */
update_mmu_cache(vma, address, page_table);
@@ -112123,7 +112255,7 @@ index 749e1c6..f7fbc29 100644
unlock:
pte_unmap_unlock(page_table, ptl);
return 0;
-@@ -3423,6 +3614,12 @@ static int __do_fault(struct mm_struct *mm, struct vm_area_struct *vma,
+@@ -3427,6 +3620,12 @@ static int __do_fault(struct mm_struct *mm, struct vm_area_struct *vma,
*/
/* Only go through if we didn't race with anybody else... */
if (likely(pte_same(*page_table, orig_pte))) {
@@ -112136,7 +112268,7 @@ index 749e1c6..f7fbc29 100644
flush_icache_page(vma, page);
entry = mk_pte(page, vma->vm_page_prot);
if (flags & FAULT_FLAG_WRITE)
-@@ -3444,6 +3641,14 @@ static int __do_fault(struct mm_struct *mm, struct vm_area_struct *vma,
+@@ -3448,6 +3647,14 @@ static int __do_fault(struct mm_struct *mm, struct vm_area_struct *vma,
/* no need to invalidate: a not-present page won't be cached */
update_mmu_cache(vma, address, page_table);
@@ -112151,7 +112283,7 @@ index 749e1c6..f7fbc29 100644
} else {
if (cow_page)
mem_cgroup_uncharge_page(cow_page);
-@@ -3691,6 +3896,12 @@ static int handle_pte_fault(struct mm_struct *mm,
+@@ -3696,6 +3903,12 @@ static int handle_pte_fault(struct mm_struct *mm,
if (flags & FAULT_FLAG_WRITE)
flush_tlb_fix_spurious_fault(vma, address);
}
@@ -112164,7 +112296,7 @@ index 749e1c6..f7fbc29 100644
unlock:
pte_unmap_unlock(pte, ptl);
return 0;
-@@ -3707,9 +3918,41 @@ static int __handle_mm_fault(struct mm_struct *mm, struct vm_area_struct *vma,
+@@ -3712,9 +3925,41 @@ static int __handle_mm_fault(struct mm_struct *mm, struct vm_area_struct *vma,
pmd_t *pmd;
pte_t *pte;
@@ -112206,7 +112338,7 @@ index 749e1c6..f7fbc29 100644
pgd = pgd_offset(mm, address);
pud = pud_alloc(mm, pgd, address);
if (!pud)
-@@ -3837,6 +4080,23 @@ int __pud_alloc(struct mm_struct *mm, pgd_t *pgd, unsigned long address)
+@@ -3842,6 +4087,23 @@ int __pud_alloc(struct mm_struct *mm, pgd_t *pgd, unsigned long address)
spin_unlock(&mm->page_table_lock);
return 0;
}
@@ -112230,7 +112362,7 @@ index 749e1c6..f7fbc29 100644
#endif /* __PAGETABLE_PUD_FOLDED */
#ifndef __PAGETABLE_PMD_FOLDED
-@@ -3867,6 +4127,30 @@ int __pmd_alloc(struct mm_struct *mm, pud_t *pud, unsigned long address)
+@@ -3872,6 +4134,30 @@ int __pmd_alloc(struct mm_struct *mm, pud_t *pud, unsigned long address)
spin_unlock(&mm->page_table_lock);
return 0;
}
@@ -112261,7 +112393,7 @@ index 749e1c6..f7fbc29 100644
#endif /* __PAGETABLE_PMD_FOLDED */
#if !defined(__HAVE_ARCH_GATE_AREA)
-@@ -3880,7 +4164,7 @@ static int __init gate_vma_init(void)
+@@ -3885,7 +4171,7 @@ static int __init gate_vma_init(void)
gate_vma.vm_start = FIXADDR_USER_START;
gate_vma.vm_end = FIXADDR_USER_END;
gate_vma.vm_flags = VM_READ | VM_MAYREAD | VM_EXEC | VM_MAYEXEC;
@@ -112270,7 +112402,7 @@ index 749e1c6..f7fbc29 100644
return 0;
}
-@@ -4014,8 +4298,8 @@ out:
+@@ -4019,8 +4305,8 @@ out:
return ret;
}
@@ -112281,7 +112413,7 @@ index 749e1c6..f7fbc29 100644
{
resource_size_t phys_addr;
unsigned long prot = 0;
-@@ -4041,8 +4325,8 @@ EXPORT_SYMBOL_GPL(generic_access_phys);
+@@ -4046,8 +4332,8 @@ EXPORT_SYMBOL_GPL(generic_access_phys);
* Access another process' address space as given in mm. If non-NULL, use the
* given task for page fault accounting.
*/
@@ -112292,7 +112424,7 @@ index 749e1c6..f7fbc29 100644
{
struct vm_area_struct *vma;
void *old_buf = buf;
-@@ -4050,7 +4334,7 @@ static int __access_remote_vm(struct task_struct *tsk, struct mm_struct *mm,
+@@ -4055,7 +4341,7 @@ static int __access_remote_vm(struct task_struct *tsk, struct mm_struct *mm,
down_read(&mm->mmap_sem);
/* ignore errors, just check how much was successfully transferred */
while (len) {
@@ -112301,7 +112433,7 @@ index 749e1c6..f7fbc29 100644
void *maddr;
struct page *page = NULL;
-@@ -4109,8 +4393,8 @@ static int __access_remote_vm(struct task_struct *tsk, struct mm_struct *mm,
+@@ -4114,8 +4400,8 @@ static int __access_remote_vm(struct task_struct *tsk, struct mm_struct *mm,
*
* The caller must hold a reference on @mm.
*/
@@ -112312,7 +112444,7 @@ index 749e1c6..f7fbc29 100644
{
return __access_remote_vm(NULL, mm, addr, buf, len, write);
}
-@@ -4120,11 +4404,11 @@ int access_remote_vm(struct mm_struct *mm, unsigned long addr,
+@@ -4125,11 +4411,11 @@ int access_remote_vm(struct mm_struct *mm, unsigned long addr,
* Source/target buffer must be kernel space,
* Do not walk the page table directly, use get_user_pages
*/
@@ -117100,19 +117232,19 @@ index d125290..e86e034 100644
a0 = a[0];
a1 = a[1];
diff --git a/net/core/datagram.c b/net/core/datagram.c
-index a16ed7b..689402b 100644
+index a16ed7b..a334f7d 100644
--- a/net/core/datagram.c
+++ b/net/core/datagram.c
@@ -130,6 +130,35 @@ out_noerr:
goto out;
}
-+static int skb_set_peeked(struct sk_buff *skb)
++static struct sk_buff *skb_set_peeked(struct sk_buff *skb)
+{
+ struct sk_buff *nskb;
+
+ if (skb->peeked)
-+ return 0;
++ return skb;
+
+ /* We have to unshare an skb before modifying it. */
+ if (!skb_shared(skb))
@@ -117120,7 +117252,7 @@ index a16ed7b..689402b 100644
+
+ nskb = skb_clone(skb, GFP_ATOMIC);
+ if (!nskb)
-+ return -ENOMEM;
++ return ERR_PTR(-ENOMEM);
+
+ skb->prev->next = nskb;
+ skb->next->prev = nskb;
@@ -117133,7 +117265,7 @@ index a16ed7b..689402b 100644
+done:
+ skb->peeked = 1;
+
-+ return 0;
++ return skb;
+}
+
/**
@@ -117158,20 +117290,21 @@ index a16ed7b..689402b 100644
int _off = *off;
last = (struct sk_buff *)queue;
-@@ -198,7 +227,11 @@ struct sk_buff *__skb_recv_datagram(struct sock *sk, unsigned int flags,
+@@ -198,7 +227,12 @@ struct sk_buff *__skb_recv_datagram(struct sock *sk, unsigned int flags,
_off -= skb->len;
continue;
}
- skb->peeked = 1;
+
-+ error = skb_set_peeked(skb);
-+ if (error)
++ skb = skb_set_peeked(skb);
++ error = PTR_ERR(skb);
++ if (IS_ERR(skb))
+ goto unlock_err;
+
atomic_inc(&skb->users);
} else
__skb_unlink(skb, queue);
-@@ -222,6 +255,8 @@ struct sk_buff *__skb_recv_datagram(struct sock *sk, unsigned int flags,
+@@ -222,6 +256,8 @@ struct sk_buff *__skb_recv_datagram(struct sock *sk, unsigned int flags,
return NULL;
@@ -117180,7 +117313,7 @@ index a16ed7b..689402b 100644
no_packet:
*err = error;
return NULL;
-@@ -301,7 +336,7 @@ int skb_kill_datagram(struct sock *sk, struct sk_buff *skb, unsigned int flags)
+@@ -301,7 +337,7 @@ int skb_kill_datagram(struct sock *sk, struct sk_buff *skb, unsigned int flags)
}
kfree_skb(skb);
@@ -121788,6 +121921,19 @@ index b7ebe23..b6352f6 100644
}
#endif
+diff --git a/net/rds/info.c b/net/rds/info.c
+index 9a6b4f6..140a44a 100644
+--- a/net/rds/info.c
++++ b/net/rds/info.c
+@@ -176,7 +176,7 @@ int rds_info_getsockopt(struct socket *sock, int optname, char __user *optval,
+
+ /* check for all kinds of wrapping and the like */
+ start = (unsigned long)optval;
+- if (len < 0 || len + PAGE_SIZE - 1 < len || start + len < start) {
++ if (len < 0 || len > INT_MAX - PAGE_SIZE + 1 || start + len < start) {
+ ret = -EINVAL;
+ goto out;
+ }
diff --git a/net/rds/iw.h b/net/rds/iw.h
index 04ce3b1..48119a6 100644
--- a/net/rds/iw.h
@@ -135209,10 +135355,10 @@ index 0000000..176c32f
+#endif
diff --git a/tools/gcc/size_overflow_plugin/size_overflow_hash.data b/tools/gcc/size_overflow_plugin/size_overflow_hash.data
new file mode 100644
-index 0000000..51560ee
+index 0000000..b5dfeff
--- /dev/null
+++ b/tools/gcc/size_overflow_plugin/size_overflow_hash.data
-@@ -0,0 +1,6061 @@
+@@ -0,0 +1,6092 @@
+intel_fake_agp_alloc_by_type_1 intel_fake_agp_alloc_by_type 1 1 NULL
+ocfs2_get_refcount_tree_3 ocfs2_get_refcount_tree 0 3 NULL
+storvsc_connect_to_vsp_22 storvsc_connect_to_vsp 2 22 NULL
@@ -135517,6 +135663,7 @@ index 0000000..51560ee
+_iwl_dbgfs_d3_sram_write_3315 _iwl_dbgfs_d3_sram_write 3 3315 NULL
+dbDiscardAG_3322 dbDiscardAG 3 3322 NULL
+compat_sys_setsockopt_3326 compat_sys_setsockopt 5 3326 NULL
++ocfs2_extend_xattr_bucket_3328 ocfs2_extend_xattr_bucket 4 3328 NULL
+read_from_oldmem_3337 read_from_oldmem 2 3337 NULL
+sysfs_create_group_3339 sysfs_create_group 0 3339 NULL
+tty_port_register_device_attr_3341 tty_port_register_device_attr 3 3341 NULL
@@ -135611,7 +135758,7 @@ index 0000000..51560ee
+__copy_from_user_inatomic_4365 __copy_from_user_inatomic 0-3 4365 NULL nohasharray
+lookup_string_4365 lookup_string 0 4365 &__copy_from_user_inatomic_4365
+irda_sendmsg_4388 irda_sendmsg 4 4388 NULL
-+access_process_vm_4412 access_process_vm 0 4412 NULL nohasharray
++access_process_vm_4412 access_process_vm 0-2-4 4412 NULL nohasharray
+cxacru_cm_get_array_4412 cxacru_cm_get_array 4 4412 &access_process_vm_4412
+libfc_vport_create_4415 libfc_vport_create 2 4415 NULL
+rtw_android_get_rssi_4421 rtw_android_get_rssi 0 4421 NULL
@@ -135967,6 +136114,7 @@ index 0000000..51560ee
+ocfs2_find_path_8754 ocfs2_find_path 0 8754 NULL
+yurex_write_8761 yurex_write 3 8761 NULL
+joydev_compat_ioctl_8765 joydev_compat_ioctl 2 8765 NULL
++x32_arch_ptrace_8767 x32_arch_ptrace 3 8767 NULL
+kstrtoint_from_user_8778 kstrtoint_from_user 2 8778 NULL
+paging32_prefetch_gpte_8783 paging32_prefetch_gpte 4 8783 NULL
+ext4_try_to_write_inline_data_8785 ext4_try_to_write_inline_data 3-4 8785 NULL
@@ -136209,6 +136357,7 @@ index 0000000..51560ee
+insert_inline_extent_backref_11063 insert_inline_extent_backref 8 11063 NULL
+tcp_send_mss_11079 tcp_send_mss 0 11079 NULL
+count_argc_11083 count_argc 0 11083 NULL
++ocfs2_blocks_per_xattr_bucket_11099 ocfs2_blocks_per_xattr_bucket 0 11099 NULL
+kvm_write_guest_cached_11106 kvm_write_guest_cached 4 11106 NULL
+tw_change_queue_depth_11116 tw_change_queue_depth 2 11116 NULL
+page_offset_11120 page_offset 0 11120 NULL
@@ -136405,6 +136554,7 @@ index 0000000..51560ee
+snd_rme96_playback_copy_13111 snd_rme96_playback_copy 5 13111 NULL
+bfad_debugfs_read_13119 bfad_debugfs_read 3 13119 NULL
+blk_update_request_13146 blk_update_request 3 13146 NULL
++ocfs2_quota_trans_credits_13150 ocfs2_quota_trans_credits 0 13150 NULL
+caif_stream_recvmsg_13173 caif_stream_recvmsg 4 13173 NULL
+pwr_disable_ps_read_13176 pwr_disable_ps_read 3 13176 NULL
+ucs2_strlen_13178 ucs2_strlen 0 13178 NULL
@@ -136774,7 +136924,7 @@ index 0000000..51560ee
+befs_nls2utf_17163 befs_nls2utf 3 17163 NULL
+tx_tx_start_templates_read_17164 tx_tx_start_templates_read 3 17164 NULL
+UniStrnlen_17169 UniStrnlen 0 17169 NULL
-+access_remote_vm_17189 access_remote_vm 0 17189 NULL nohasharray
++access_remote_vm_17189 access_remote_vm 0-2-4 17189 NULL nohasharray
+iwl_dbgfs_txfifo_flush_write_17189 iwl_dbgfs_txfifo_flush_write 3 17189 &access_remote_vm_17189 nohasharray
+ocfs2_flock_handle_signal_17189 ocfs2_flock_handle_signal 0 17189 &iwl_dbgfs_txfifo_flush_write_17189
+iscsit_find_cmd_from_itt_or_dump_17194 iscsit_find_cmd_from_itt_or_dump 3 17194 NULL nohasharray
@@ -136814,6 +136964,7 @@ index 0000000..51560ee
+osst_execute_17607 osst_execute 7-6 17607 NULL
+ieee80211_if_read_dot11MeshHWMPactivePathToRootTimeout_17618 ieee80211_if_read_dot11MeshHWMPactivePathToRootTimeout 3 17618 NULL
+dma_map_page_17628 dma_map_page 0 17628 NULL
++ocfs2_rotate_subtree_left_17634 ocfs2_rotate_subtree_left 5 17634 NULL
+twl4030_set_gpio_direction_17645 twl4030_set_gpio_direction 1 17645 NULL
+SYSC_migrate_pages_17657 SYSC_migrate_pages 2 17657 NULL
+packet_setsockopt_17662 packet_setsockopt 5 17662 NULL
@@ -137164,6 +137315,7 @@ index 0000000..51560ee
+bl_add_page_to_bio_21094 bl_add_page_to_bio 2 21094 NULL nohasharray
+multipath_status_21094 multipath_status 5 21094 &bl_add_page_to_bio_21094
+rate_control_pid_events_read_21099 rate_control_pid_events_read 3 21099 NULL
++ocfs2_extend_meta_needed_21104 ocfs2_extend_meta_needed 0 21104 NULL
+ath6kl_send_go_probe_resp_21113 ath6kl_send_go_probe_resp 3 21113 NULL
+_efx_mcdi_rpc_async_21119 _efx_mcdi_rpc_async 4-5 21119 NULL
+i2400m_rx_trace_21127 i2400m_rx_trace 3 21127 NULL
@@ -137183,6 +137335,7 @@ index 0000000..51560ee
+get_zeroed_page_21322 get_zeroed_page 0 21322 NULL
+ftrace_profile_read_21327 ftrace_profile_read 3 21327 NULL
+read_file_bool_bmps_21344 read_file_bool_bmps 3 21344 NULL
++ocfs2_find_subtree_root_21351 ocfs2_find_subtree_root 0 21351 NULL
+gfs2_ea_get_copy_21353 gfs2_ea_get_copy 0 21353 NULL
+alloc_orinocodev_21371 alloc_orinocodev 1 21371 NULL
+SYSC_rt_sigpending_21379 SYSC_rt_sigpending 2 21379 NULL
@@ -137360,6 +137513,7 @@ index 0000000..51560ee
+usblp_write_23178 usblp_write 3 23178 NULL
+gss_pipe_downcall_23182 gss_pipe_downcall 3 23182 NULL
+mpi_alloc_limb_space_23190 mpi_alloc_limb_space 1 23190 NULL
++convert_ip_to_linear_23198 convert_ip_to_linear 0 23198 NULL
+tty_buffer_request_room_23228 tty_buffer_request_room 2-0 23228 NULL
+xlog_get_bp_23229 xlog_get_bp 2 23229 NULL nohasharray
+__read_status_pci_23229 __read_status_pci 0 23229 &xlog_get_bp_23229
@@ -137776,6 +137930,7 @@ index 0000000..51560ee
+sky2_pci_read16_27863 sky2_pci_read16 0 27863 NULL
+ieee80211_if_read_dot11MeshHWMProotInterval_27873 ieee80211_if_read_dot11MeshHWMProotInterval 3 27873 NULL
+unix_seqpacket_sendmsg_27893 unix_seqpacket_sendmsg 4 27893 NULL
++SyS_ptrace_27924 SyS_ptrace 3 27924 NULL
+check_mapped_name_27943 check_mapped_name 3 27943 NULL
+bio_next_split_27961 bio_next_split 2 27961 NULL nohasharray
+tracing_clock_write_27961 tracing_clock_write 3 27961 &bio_next_split_27961
@@ -137996,6 +138151,7 @@ index 0000000..51560ee
+read_4k_modal_eeprom_30212 read_4k_modal_eeprom 3 30212 NULL
+SyS_semop_30227 SyS_semop 3 30227 NULL
+bitmap_file_set_bit_30228 bitmap_file_set_bit 2 30228 NULL
++ocfs2_calc_bg_discontig_credits_30230 ocfs2_calc_bg_discontig_credits 0 30230 NULL
+shmem_unuse_inode_30263 shmem_unuse_inode 0 30263 NULL
+rawv6_recvmsg_30265 rawv6_recvmsg 4 30265 NULL
+try_break_deleg_30271 try_break_deleg 0 30271 NULL nohasharray
@@ -138007,6 +138163,7 @@ index 0000000..51560ee
+osc_contention_seconds_seq_write_30305 osc_contention_seconds_seq_write 3 30305 NULL
+ext4_acl_from_disk_30320 ext4_acl_from_disk 2 30320 NULL
+i8254_read_30330 i8254_read 0 30330 NULL
++generic_ptrace_pokedata_30338 generic_ptrace_pokedata 2 30338 NULL
+resource_from_user_30341 resource_from_user 3 30341 NULL
+o2nm_this_node_30342 o2nm_this_node 0 30342 NULL
+gfs2_trans_begin_30359 gfs2_trans_begin 0 30359 NULL
@@ -138081,6 +138238,7 @@ index 0000000..51560ee
+size_inside_page_31141 size_inside_page 0 31141 NULL
+w9966_v4l_read_31148 w9966_v4l_read 3 31148 NULL
+ch_do_scsi_31171 ch_do_scsi 4 31171 NULL
++crypto_rng_seedsize_31196 crypto_rng_seedsize 0 31196 NULL
+r592_read_fifo_pio_31198 r592_read_fifo_pio 3 31198 NULL
+mtdchar_readoob_31200 mtdchar_readoob 4 31200 NULL
+__btrfs_free_reserved_extent_31207 __btrfs_free_reserved_extent 2 31207 NULL
@@ -138177,6 +138335,7 @@ index 0000000..51560ee
+calc_hmac_32010 calc_hmac 3 32010 NULL
+aead_len_32021 aead_len 0 32021 NULL
+stk_read_32038 stk_read 3 32038 NULL
++ocfs2_update_edge_lengths_32046 ocfs2_update_edge_lengths 3 32046 NULL
+SYSC_llistxattr_32061 SYSC_llistxattr 3 32061 NULL
+proc_scsi_devinfo_write_32064 proc_scsi_devinfo_write 3 32064 NULL
+xfs_buf_iowait_32068 xfs_buf_iowait 0 32068 NULL
@@ -138258,6 +138417,7 @@ index 0000000..51560ee
+zlib_inflate_workspacesize_32927 zlib_inflate_workspacesize 0 32927 NULL
+rmap_recycle_32938 rmap_recycle 3 32938 NULL
+xfs_log_reserve_32959 xfs_log_reserve 0 32959 NULL
++arch_ptrace_32981 arch_ptrace 3 32981 NULL
+compat_filldir_32999 compat_filldir 3 32999 NULL
+SyS_syslog_33007 SyS_syslog 3 33007 NULL
+br_multicast_set_hash_max_33012 br_multicast_set_hash_max 2 33012 NULL
@@ -138389,6 +138549,7 @@ index 0000000..51560ee
+mwifiex_regrdwr_read_34472 mwifiex_regrdwr_read 3 34472 NULL
+skcipher_sndbuf_34476 skcipher_sndbuf 0 34476 NULL
+i2o_parm_field_get_34477 i2o_parm_field_get 5 34477 NULL
++ocfs2_mv_xattr_buckets_34484 ocfs2_mv_xattr_buckets 6 34484 NULL
+security_inode_permission_34488 security_inode_permission 0 34488 NULL
+SyS_pwritev_34494 SyS_pwritev 3 34494 NULL
+qp_alloc_res_34496 qp_alloc_res 5 34496 NULL
@@ -138510,6 +138671,7 @@ index 0000000..51560ee
+SYSC_pwritev_35690 SYSC_pwritev 3 35690 NULL
+rds_page_copy_user_35691 rds_page_copy_user 4 35691 NULL
+md_super_write_35703 md_super_write 4 35703 NULL
++ocfs2_extent_recs_per_gd_35710 ocfs2_extent_recs_per_gd 0 35710 NULL
+iwl_dbgfs_disable_ht40_read_35761 iwl_dbgfs_disable_ht40_read 3 35761 NULL
+udf_alloc_i_data_35786 udf_alloc_i_data 2 35786 NULL
+pvr2_hdw_cpufw_get_35824 pvr2_hdw_cpufw_get 0-4-2 35824 NULL
@@ -138546,6 +138708,7 @@ index 0000000..51560ee
+mtip_hw_read_device_status_36082 mtip_hw_read_device_status 3 36082 NULL
+vga_arb_write_36112 vga_arb_write 3 36112 NULL
+simple_xattr_alloc_36118 simple_xattr_alloc 2 36118 NULL
++compat_ptrace_request_36131 compat_ptrace_request 3 36131 NULL
+ext3_readpages_36144 ext3_readpages 4 36144 NULL
+twl_set_36154 twl_set 2 36154 NULL
+b1_alloc_card_36155 b1_alloc_card 1 36155 NULL
@@ -138663,6 +138826,7 @@ index 0000000..51560ee
+_iwl_dbgfs_fw_restart_write_37270 _iwl_dbgfs_fw_restart_write 3 37270 NULL
+ieee80211_if_read_power_mode_37305 ieee80211_if_read_power_mode 3 37305 NULL
+ext3_direct_IO_37308 ext3_direct_IO 4 37308 NULL
++ocfs2_calc_extend_credits_37310 ocfs2_calc_extend_credits 0 37310 NULL
+jffs2_write_dirent_37311 jffs2_write_dirent 5 37311 NULL
+send_msg_37323 send_msg 4 37323 NULL
+l2cap_create_connless_pdu_37327 l2cap_create_connless_pdu 3 37327 NULL nohasharray
@@ -138791,6 +138955,7 @@ index 0000000..51560ee
+_ipw_read32_38565 _ipw_read32 0 38565 NULL
+snd_nm256_playback_copy_38567 snd_nm256_playback_copy 5-3 38567 NULL
+copy_ctl_value_to_user_38587 copy_ctl_value_to_user 4 38587 NULL
++compat_sys_ptrace_38595 compat_sys_ptrace 3 38595 NULL
+rd_allocate_sgl_table_38607 rd_allocate_sgl_table 3 38607 NULL
+icn_writecmd_38629 icn_writecmd 2 38629 NULL
+write_enabled_file_bool_38630 write_enabled_file_bool 3 38630 NULL
@@ -139011,6 +139176,7 @@ index 0000000..51560ee
+provide_user_output_41105 provide_user_output 3 41105 NULL
+f_audio_buffer_alloc_41110 f_audio_buffer_alloc 1 41110 NULL
+ath10k_read_wmi_services_41112 ath10k_read_wmi_services 3 41112 NULL
++ocfs2_extend_trans_41116 ocfs2_extend_trans 2 41116 NULL
+v4l2_ctrl_new_int_menu_41151 v4l2_ctrl_new_int_menu 4 41151 NULL
+tx_frag_mpdu_alloc_failed_read_41167 tx_frag_mpdu_alloc_failed_read 3 41167 NULL
+dvb_ca_write_41171 dvb_ca_write 3 41171 NULL
@@ -139331,6 +139497,7 @@ index 0000000..51560ee
+sysfs_create_link_44685 sysfs_create_link 0 44685 NULL
+ts_read_44687 ts_read 3 44687 NULL
+lov_emerg_alloc_44698 lov_emerg_alloc 1 44698 NULL
++__ocfs2_rotate_tree_left_44705 __ocfs2_rotate_tree_left 3 44705 NULL
+xfer_to_user_44713 xfer_to_user 3 44713 NULL nohasharray
+__generic_block_fiemap_44713 __generic_block_fiemap 4 44713 &xfer_to_user_44713
+_zd_iowrite32v_locked_44725 _zd_iowrite32v_locked 3 44725 NULL
@@ -139360,7 +139527,7 @@ index 0000000..51560ee
+regmap_spi_read_44921 regmap_spi_read 3-5 44921 NULL
+tx_queue_status_read_44978 tx_queue_status_read 3 44978 NULL
+bytepos_delta_45017 bytepos_delta 0-2 45017 NULL
-+ptrace_writedata_45021 ptrace_writedata 4 45021 NULL
++ptrace_writedata_45021 ptrace_writedata 4-3 45021 NULL
+dm_kvzalloc_45025 dm_kvzalloc 1 45025 NULL
+sysfs_do_create_link_sd_45057 sysfs_do_create_link_sd 0 45057 NULL
+sel_write_user_45060 sel_write_user 3 45060 NULL
@@ -139452,7 +139619,7 @@ index 0000000..51560ee
+sierra_setup_urb_46029 sierra_setup_urb 5 46029 NULL
+fnic_reset_stats_read_46030 fnic_reset_stats_read 3 46030 NULL nohasharray
+get_free_entries_46030 get_free_entries 1 46030 &fnic_reset_stats_read_46030
-+__access_remote_vm_46031 __access_remote_vm 0 46031 NULL
++__access_remote_vm_46031 __access_remote_vm 0-3-5 46031 NULL
+snd_emu10k1x_ptr_read_46049 snd_emu10k1x_ptr_read 0 46049 NULL
+__ocfs2_move_extent_46060 __ocfs2_move_extent 3-4 46060 NULL nohasharray
+dma_tx_errors_read_46060 dma_tx_errors_read 3 46060 &__ocfs2_move_extent_46060
@@ -139578,6 +139745,7 @@ index 0000000..51560ee
+sta_vht_capa_read_47409 sta_vht_capa_read 3 47409 NULL
+crypto_ablkcipher_alignmask_47410 crypto_ablkcipher_alignmask 0 47410 NULL
+lbs_wrrf_write_47418 lbs_wrrf_write 3 47418 NULL
++environ_read_47451 environ_read 3 47451 NULL
+nvme_trans_send_fw_cmd_47479 nvme_trans_send_fw_cmd 4 47479 NULL
+newpart_47485 newpart 6-4 47485 NULL
+core_sys_select_47494 core_sys_select 1 47494 NULL
@@ -139817,6 +139985,7 @@ index 0000000..51560ee
+dn_mss_from_pmtu_50011 dn_mss_from_pmtu 0-2 50011 NULL
+xfs_ialloc_inode_init_50015 xfs_ialloc_inode_init 0 50015 NULL
+security_context_to_sid_50019 security_context_to_sid 2 50019 NULL
++ptrace_readdata_50020 ptrace_readdata 2-4 50020 NULL
+isdn_read_50021 isdn_read 3 50021 NULL
+mdc_rename_pack_50023 mdc_rename_pack 4-6 50023 NULL
+brcmf_debugfs_chipinfo_read_50033 brcmf_debugfs_chipinfo_read 3 50033 NULL
@@ -139951,7 +140120,8 @@ index 0000000..51560ee
+init_map_ipmac_51317 init_map_ipmac 5 51317 NULL
+alloc_hippi_dev_51320 alloc_hippi_dev 1 51320 NULL
+ext2_xattr_get_51327 ext2_xattr_get 0 51327 NULL
-+alloc_smp_req_51337 alloc_smp_req 1 51337 NULL
++alloc_smp_req_51337 alloc_smp_req 1 51337 NULL nohasharray
++compat_arch_ptrace_51337 compat_arch_ptrace 3 51337 &alloc_smp_req_51337
+ipw_get_event_log_len_51341 ipw_get_event_log_len 0 51341 NULL
+ieee80211_if_fmt_estab_plinks_51370 ieee80211_if_fmt_estab_plinks 3 51370 NULL
+radeon_kms_compat_ioctl_51371 radeon_kms_compat_ioctl 2 51371 NULL
@@ -140334,6 +140504,7 @@ index 0000000..51560ee
+memcpy_fromiovec_55247 memcpy_fromiovec 3 55247 NULL
+lbs_failcount_write_55276 lbs_failcount_write 3 55276 NULL
+persistent_ram_new_55286 persistent_ram_new 2-1 55286 NULL
++ptrace_request_55288 ptrace_request 3 55288 NULL
+rx_streaming_interval_read_55291 rx_streaming_interval_read 3 55291 NULL nohasharray
+xd_read_cis_55291 xd_read_cis 4 55291 &rx_streaming_interval_read_55291
+lov_get_stripecnt_55297 lov_get_stripecnt 0-3 55297 NULL
@@ -140590,6 +140761,7 @@ index 0000000..51560ee
+ld2_57794 ld2 0 57794 NULL
+ivtv_read_57796 ivtv_read 3 57796 NULL
+ion_test_ioctl_57799 ion_test_ioctl 2 57799 NULL
++generic_ptrace_peekdata_57806 generic_ptrace_peekdata 2 57806 NULL
+bfad_debugfs_read_regrd_57830 bfad_debugfs_read_regrd 3 57830 NULL
+copy_to_user_57835 copy_to_user 3-0 57835 NULL
+xfs_rtpick_extent_57843 xfs_rtpick_extent 0 57843 NULL nohasharray
@@ -140691,6 +140863,7 @@ index 0000000..51560ee
+ieee80211_if_fmt_dot11MeshHWMPactivePathToRootTimeout_58965 ieee80211_if_fmt_dot11MeshHWMPactivePathToRootTimeout 3 58965 NULL
+crypto_aead_ivsize_58970 crypto_aead_ivsize 0 58970 NULL
+__mem_cgroup_try_charge_58976 __mem_cgroup_try_charge 0 58976 NULL
++bch_extent_to_text_58987 bch_extent_to_text 2 58987 NULL
+init_list_set_59005 init_list_set 3 59005 NULL
+ep_write_59008 ep_write 3 59008 NULL
+lpfc_idiag_baracc_write_59014 lpfc_idiag_baracc_write 3 59014 NULL
@@ -140777,6 +140950,7 @@ index 0000000..51560ee
+pvr2_ioread_set_sync_key_59882 pvr2_ioread_set_sync_key 3 59882 NULL
+l2cap_sock_recvmsg_59886 l2cap_sock_recvmsg 4 59886 NULL
+ffs_prepare_buffer_59892 ffs_prepare_buffer 2 59892 NULL
++ocfs2_extend_rotate_transaction_59894 ocfs2_extend_rotate_transaction 2-3 59894 NULL
+kvm_mmu_notifier_invalidate_range_start_59944 kvm_mmu_notifier_invalidate_range_start 3-4 59944 NULL
+ath10k_read_dfs_stats_59949 ath10k_read_dfs_stats 3 59949 NULL
+dapm_widget_power_read_file_59950 dapm_widget_power_read_file 3 59950 NULL nohasharray
@@ -140997,10 +141171,12 @@ index 0000000..51560ee
+nfsd_read_file_62241 nfsd_read_file 6 62241 NULL
+subtract_dirty_62242 subtract_dirty 2-3 62242 NULL
+ion_handle_test_dma_62262 ion_handle_test_dma 4-5 62262 NULL
++get_random_int_62279 get_random_int 0 62279 NULL
+il_dbgfs_sram_read_62296 il_dbgfs_sram_read 3 62296 NULL
+sparse_early_usemaps_alloc_pgdat_section_62304 sparse_early_usemaps_alloc_pgdat_section 2 62304 NULL
+subsystem_filter_read_62310 subsystem_filter_read 3 62310 NULL
+Wb35Reg_BurstWrite_62327 Wb35Reg_BurstWrite 4 62327 NULL
++ocfs2_xattr_buckets_per_cluster_62330 ocfs2_xattr_buckets_per_cluster 0 62330 NULL
+subseq_list_62332 subseq_list 3-0 62332 NULL
+ll_statahead_max_seq_write_62333 ll_statahead_max_seq_write 3 62333 NULL
+flash_write_62354 flash_write 3 62354 NULL
@@ -141145,6 +141321,7 @@ index 0000000..51560ee
+bypass_wd_write_64120 bypass_wd_write 3 64120 NULL
+ext4_prepare_inline_data_64124 ext4_prepare_inline_data 3 64124 NULL
+init_bch_64130 init_bch 1-2 64130 NULL
++SYSC_ptrace_64136 SYSC_ptrace 3 64136 NULL
+ablkcipher_copy_iv_64140 ablkcipher_copy_iv 3 64140 NULL
+dlfb_ops_write_64150 dlfb_ops_write 3 64150 NULL
+cpumask_scnprintf_64170 cpumask_scnprintf 0-2 64170 NULL
@@ -141374,7 +141551,7 @@ index 0000000..560cd7b
+zpios_read_64734 zpios_read 3 64734 NULL
diff --git a/tools/gcc/size_overflow_plugin/size_overflow_plugin.c b/tools/gcc/size_overflow_plugin/size_overflow_plugin.c
new file mode 100644
-index 0000000..7e07890
+index 0000000..2133228
--- /dev/null
+++ b/tools/gcc/size_overflow_plugin/size_overflow_plugin.c
@@ -0,0 +1,260 @@
@@ -141411,7 +141588,7 @@ index 0000000..7e07890
+tree size_overflow_type_TI;
+
+static struct plugin_info size_overflow_plugin_info = {
-+ .version = "20140725_01",
++ .version = "20140725_02",
+ .help = "no-size-overflow\tturn off size overflow checking\n",
+};
+
diff --git a/3.14.49/4425_grsec_remove_EI_PAX.patch b/3.14.50/4425_grsec_remove_EI_PAX.patch
index a80a5d7..a80a5d7 100644
--- a/3.14.49/4425_grsec_remove_EI_PAX.patch
+++ b/3.14.50/4425_grsec_remove_EI_PAX.patch
diff --git a/3.14.49/4427_force_XATTR_PAX_tmpfs.patch b/3.14.50/4427_force_XATTR_PAX_tmpfs.patch
index 4c236cc..4c236cc 100644
--- a/3.14.49/4427_force_XATTR_PAX_tmpfs.patch
+++ b/3.14.50/4427_force_XATTR_PAX_tmpfs.patch
diff --git a/3.14.49/4430_grsec-remove-localversion-grsec.patch b/3.14.50/4430_grsec-remove-localversion-grsec.patch
index 31cf878..31cf878 100644
--- a/3.14.49/4430_grsec-remove-localversion-grsec.patch
+++ b/3.14.50/4430_grsec-remove-localversion-grsec.patch
diff --git a/3.14.49/4435_grsec-mute-warnings.patch b/3.14.50/4435_grsec-mute-warnings.patch
index 2c2d463..2c2d463 100644
--- a/3.14.49/4435_grsec-mute-warnings.patch
+++ b/3.14.50/4435_grsec-mute-warnings.patch
diff --git a/3.14.49/4440_grsec-remove-protected-paths.patch b/3.14.50/4440_grsec-remove-protected-paths.patch
index 741546d..741546d 100644
--- a/3.14.49/4440_grsec-remove-protected-paths.patch
+++ b/3.14.50/4440_grsec-remove-protected-paths.patch
diff --git a/3.14.49/4450_grsec-kconfig-default-gids.patch b/3.14.50/4450_grsec-kconfig-default-gids.patch
index b96defc..b96defc 100644
--- a/3.14.49/4450_grsec-kconfig-default-gids.patch
+++ b/3.14.50/4450_grsec-kconfig-default-gids.patch
diff --git a/3.14.49/4465_selinux-avc_audit-log-curr_ip.patch b/3.14.50/4465_selinux-avc_audit-log-curr_ip.patch
index bba906e..bba906e 100644
--- a/3.14.49/4465_selinux-avc_audit-log-curr_ip.patch
+++ b/3.14.50/4465_selinux-avc_audit-log-curr_ip.patch
diff --git a/3.14.49/4470_disable-compat_vdso.patch b/3.14.50/4470_disable-compat_vdso.patch
index 3b3953b..3b3953b 100644
--- a/3.14.49/4470_disable-compat_vdso.patch
+++ b/3.14.50/4470_disable-compat_vdso.patch
diff --git a/3.14.49/4475_emutramp_default_on.patch b/3.14.50/4475_emutramp_default_on.patch
index a128205..a128205 100644
--- a/3.14.49/4475_emutramp_default_on.patch
+++ b/3.14.50/4475_emutramp_default_on.patch
diff --git a/3.2.69/0000_README b/3.2.70/0000_README
index 96cd54d..52d8c39 100644
--- a/3.2.69/0000_README
+++ b/3.2.70/0000_README
@@ -194,7 +194,11 @@ Patch: 1068_linux-3.2.69.patch
From: http://www.kernel.org
Desc: Linux 3.2.69
-Patch: 4420_grsecurity-3.1-3.2.69-201508020900.patch
+Patch: 1069_linux-3.2.70.patch
+From: http://www.kernel.org
+Desc: Linux 3.2.70
+
+Patch: 4420_grsecurity-3.1-3.2.70-201508102127.patch
From: http://www.grsecurity.net
Desc: hardened-sources base patch from upstream grsecurity
diff --git a/3.2.69/1021_linux-3.2.22.patch b/3.2.70/1021_linux-3.2.22.patch
index e6ad93a..e6ad93a 100644
--- a/3.2.69/1021_linux-3.2.22.patch
+++ b/3.2.70/1021_linux-3.2.22.patch
diff --git a/3.2.69/1022_linux-3.2.23.patch b/3.2.70/1022_linux-3.2.23.patch
index 3d796d0..3d796d0 100644
--- a/3.2.69/1022_linux-3.2.23.patch
+++ b/3.2.70/1022_linux-3.2.23.patch
diff --git a/3.2.69/1023_linux-3.2.24.patch b/3.2.70/1023_linux-3.2.24.patch
index 4692eb4..4692eb4 100644
--- a/3.2.69/1023_linux-3.2.24.patch
+++ b/3.2.70/1023_linux-3.2.24.patch
diff --git a/3.2.69/1024_linux-3.2.25.patch b/3.2.70/1024_linux-3.2.25.patch
index e95c213..e95c213 100644
--- a/3.2.69/1024_linux-3.2.25.patch
+++ b/3.2.70/1024_linux-3.2.25.patch
diff --git a/3.2.69/1025_linux-3.2.26.patch b/3.2.70/1025_linux-3.2.26.patch
index 44065b9..44065b9 100644
--- a/3.2.69/1025_linux-3.2.26.patch
+++ b/3.2.70/1025_linux-3.2.26.patch
diff --git a/3.2.69/1026_linux-3.2.27.patch b/3.2.70/1026_linux-3.2.27.patch
index 5878eb4..5878eb4 100644
--- a/3.2.69/1026_linux-3.2.27.patch
+++ b/3.2.70/1026_linux-3.2.27.patch
diff --git a/3.2.69/1027_linux-3.2.28.patch b/3.2.70/1027_linux-3.2.28.patch
index 4dbba4b..4dbba4b 100644
--- a/3.2.69/1027_linux-3.2.28.patch
+++ b/3.2.70/1027_linux-3.2.28.patch
diff --git a/3.2.69/1028_linux-3.2.29.patch b/3.2.70/1028_linux-3.2.29.patch
index 3c65179..3c65179 100644
--- a/3.2.69/1028_linux-3.2.29.patch
+++ b/3.2.70/1028_linux-3.2.29.patch
diff --git a/3.2.69/1029_linux-3.2.30.patch b/3.2.70/1029_linux-3.2.30.patch
index 86aea4b..86aea4b 100644
--- a/3.2.69/1029_linux-3.2.30.patch
+++ b/3.2.70/1029_linux-3.2.30.patch
diff --git a/3.2.69/1030_linux-3.2.31.patch b/3.2.70/1030_linux-3.2.31.patch
index c6accf5..c6accf5 100644
--- a/3.2.69/1030_linux-3.2.31.patch
+++ b/3.2.70/1030_linux-3.2.31.patch
diff --git a/3.2.69/1031_linux-3.2.32.patch b/3.2.70/1031_linux-3.2.32.patch
index 247fc0b..247fc0b 100644
--- a/3.2.69/1031_linux-3.2.32.patch
+++ b/3.2.70/1031_linux-3.2.32.patch
diff --git a/3.2.69/1032_linux-3.2.33.patch b/3.2.70/1032_linux-3.2.33.patch
index c32fb75..c32fb75 100644
--- a/3.2.69/1032_linux-3.2.33.patch
+++ b/3.2.70/1032_linux-3.2.33.patch
diff --git a/3.2.69/1033_linux-3.2.34.patch b/3.2.70/1033_linux-3.2.34.patch
index d647b38..d647b38 100644
--- a/3.2.69/1033_linux-3.2.34.patch
+++ b/3.2.70/1033_linux-3.2.34.patch
diff --git a/3.2.69/1034_linux-3.2.35.patch b/3.2.70/1034_linux-3.2.35.patch
index 76a9c19..76a9c19 100644
--- a/3.2.69/1034_linux-3.2.35.patch
+++ b/3.2.70/1034_linux-3.2.35.patch
diff --git a/3.2.69/1035_linux-3.2.36.patch b/3.2.70/1035_linux-3.2.36.patch
index 5d192a3..5d192a3 100644
--- a/3.2.69/1035_linux-3.2.36.patch
+++ b/3.2.70/1035_linux-3.2.36.patch
diff --git a/3.2.69/1036_linux-3.2.37.patch b/3.2.70/1036_linux-3.2.37.patch
index ad13251..ad13251 100644
--- a/3.2.69/1036_linux-3.2.37.patch
+++ b/3.2.70/1036_linux-3.2.37.patch
diff --git a/3.2.69/1037_linux-3.2.38.patch b/3.2.70/1037_linux-3.2.38.patch
index a3c106f..a3c106f 100644
--- a/3.2.69/1037_linux-3.2.38.patch
+++ b/3.2.70/1037_linux-3.2.38.patch
diff --git a/3.2.69/1038_linux-3.2.39.patch b/3.2.70/1038_linux-3.2.39.patch
index 5639e92..5639e92 100644
--- a/3.2.69/1038_linux-3.2.39.patch
+++ b/3.2.70/1038_linux-3.2.39.patch
diff --git a/3.2.69/1039_linux-3.2.40.patch b/3.2.70/1039_linux-3.2.40.patch
index f26b39c..f26b39c 100644
--- a/3.2.69/1039_linux-3.2.40.patch
+++ b/3.2.70/1039_linux-3.2.40.patch
diff --git a/3.2.69/1040_linux-3.2.41.patch b/3.2.70/1040_linux-3.2.41.patch
index 0d27fcb..0d27fcb 100644
--- a/3.2.69/1040_linux-3.2.41.patch
+++ b/3.2.70/1040_linux-3.2.41.patch
diff --git a/3.2.69/1041_linux-3.2.42.patch b/3.2.70/1041_linux-3.2.42.patch
index 77a08ed..77a08ed 100644
--- a/3.2.69/1041_linux-3.2.42.patch
+++ b/3.2.70/1041_linux-3.2.42.patch
diff --git a/3.2.69/1042_linux-3.2.43.patch b/3.2.70/1042_linux-3.2.43.patch
index a3f878b..a3f878b 100644
--- a/3.2.69/1042_linux-3.2.43.patch
+++ b/3.2.70/1042_linux-3.2.43.patch
diff --git a/3.2.69/1043_linux-3.2.44.patch b/3.2.70/1043_linux-3.2.44.patch
index 3d5e6ff..3d5e6ff 100644
--- a/3.2.69/1043_linux-3.2.44.patch
+++ b/3.2.70/1043_linux-3.2.44.patch
diff --git a/3.2.69/1044_linux-3.2.45.patch b/3.2.70/1044_linux-3.2.45.patch
index 44e1767..44e1767 100644
--- a/3.2.69/1044_linux-3.2.45.patch
+++ b/3.2.70/1044_linux-3.2.45.patch
diff --git a/3.2.69/1045_linux-3.2.46.patch b/3.2.70/1045_linux-3.2.46.patch
index bc10efd..bc10efd 100644
--- a/3.2.69/1045_linux-3.2.46.patch
+++ b/3.2.70/1045_linux-3.2.46.patch
diff --git a/3.2.69/1046_linux-3.2.47.patch b/3.2.70/1046_linux-3.2.47.patch
index b74563c..b74563c 100644
--- a/3.2.69/1046_linux-3.2.47.patch
+++ b/3.2.70/1046_linux-3.2.47.patch
diff --git a/3.2.69/1047_linux-3.2.48.patch b/3.2.70/1047_linux-3.2.48.patch
index 6d55b1f..6d55b1f 100644
--- a/3.2.69/1047_linux-3.2.48.patch
+++ b/3.2.70/1047_linux-3.2.48.patch
diff --git a/3.2.69/1048_linux-3.2.49.patch b/3.2.70/1048_linux-3.2.49.patch
index 2dab0cf..2dab0cf 100644
--- a/3.2.69/1048_linux-3.2.49.patch
+++ b/3.2.70/1048_linux-3.2.49.patch
diff --git a/3.2.69/1049_linux-3.2.50.patch b/3.2.70/1049_linux-3.2.50.patch
index 20b3015..20b3015 100644
--- a/3.2.69/1049_linux-3.2.50.patch
+++ b/3.2.70/1049_linux-3.2.50.patch
diff --git a/3.2.69/1050_linux-3.2.51.patch b/3.2.70/1050_linux-3.2.51.patch
index 5d5832b..5d5832b 100644
--- a/3.2.69/1050_linux-3.2.51.patch
+++ b/3.2.70/1050_linux-3.2.51.patch
diff --git a/3.2.69/1051_linux-3.2.52.patch b/3.2.70/1051_linux-3.2.52.patch
index 94b9359..94b9359 100644
--- a/3.2.69/1051_linux-3.2.52.patch
+++ b/3.2.70/1051_linux-3.2.52.patch
diff --git a/3.2.69/1052_linux-3.2.53.patch b/3.2.70/1052_linux-3.2.53.patch
index 986d714..986d714 100644
--- a/3.2.69/1052_linux-3.2.53.patch
+++ b/3.2.70/1052_linux-3.2.53.patch
diff --git a/3.2.69/1053_linux-3.2.54.patch b/3.2.70/1053_linux-3.2.54.patch
index a907496..a907496 100644
--- a/3.2.69/1053_linux-3.2.54.patch
+++ b/3.2.70/1053_linux-3.2.54.patch
diff --git a/3.2.69/1054_linux-3.2.55.patch b/3.2.70/1054_linux-3.2.55.patch
index 6071ff5..6071ff5 100644
--- a/3.2.69/1054_linux-3.2.55.patch
+++ b/3.2.70/1054_linux-3.2.55.patch
diff --git a/3.2.69/1055_linux-3.2.56.patch b/3.2.70/1055_linux-3.2.56.patch
index 2e8239c..2e8239c 100644
--- a/3.2.69/1055_linux-3.2.56.patch
+++ b/3.2.70/1055_linux-3.2.56.patch
diff --git a/3.2.69/1056_linux-3.2.57.patch b/3.2.70/1056_linux-3.2.57.patch
index 7b8f174..7b8f174 100644
--- a/3.2.69/1056_linux-3.2.57.patch
+++ b/3.2.70/1056_linux-3.2.57.patch
diff --git a/3.2.69/1057_linux-3.2.58.patch b/3.2.70/1057_linux-3.2.58.patch
index db5723a..db5723a 100644
--- a/3.2.69/1057_linux-3.2.58.patch
+++ b/3.2.70/1057_linux-3.2.58.patch
diff --git a/3.2.69/1058_linux-3.2.59.patch b/3.2.70/1058_linux-3.2.59.patch
index cd59fe9..cd59fe9 100644
--- a/3.2.69/1058_linux-3.2.59.patch
+++ b/3.2.70/1058_linux-3.2.59.patch
diff --git a/3.2.69/1059_linux-3.2.60.patch b/3.2.70/1059_linux-3.2.60.patch
index c5a9389..c5a9389 100644
--- a/3.2.69/1059_linux-3.2.60.patch
+++ b/3.2.70/1059_linux-3.2.60.patch
diff --git a/3.2.69/1060_linux-3.2.61.patch b/3.2.70/1060_linux-3.2.61.patch
index a1bf580..a1bf580 100644
--- a/3.2.69/1060_linux-3.2.61.patch
+++ b/3.2.70/1060_linux-3.2.61.patch
diff --git a/3.2.69/1061_linux-3.2.62.patch b/3.2.70/1061_linux-3.2.62.patch
index 34217f0..34217f0 100644
--- a/3.2.69/1061_linux-3.2.62.patch
+++ b/3.2.70/1061_linux-3.2.62.patch
diff --git a/3.2.69/1062_linux-3.2.63.patch b/3.2.70/1062_linux-3.2.63.patch
index f7c7415..f7c7415 100644
--- a/3.2.69/1062_linux-3.2.63.patch
+++ b/3.2.70/1062_linux-3.2.63.patch
diff --git a/3.2.69/1063_linux-3.2.64.patch b/3.2.70/1063_linux-3.2.64.patch
index 862b4f0..862b4f0 100644
--- a/3.2.69/1063_linux-3.2.64.patch
+++ b/3.2.70/1063_linux-3.2.64.patch
diff --git a/3.2.69/1064_linux-3.2.65.patch b/3.2.70/1064_linux-3.2.65.patch
index c3ae4fa..c3ae4fa 100644
--- a/3.2.69/1064_linux-3.2.65.patch
+++ b/3.2.70/1064_linux-3.2.65.patch
diff --git a/3.2.69/1065_linux-3.2.66.patch b/3.2.70/1065_linux-3.2.66.patch
index 73fa646..73fa646 100644
--- a/3.2.69/1065_linux-3.2.66.patch
+++ b/3.2.70/1065_linux-3.2.66.patch
diff --git a/3.2.69/1066_linux-3.2.67.patch b/3.2.70/1066_linux-3.2.67.patch
index c0a9278..c0a9278 100644
--- a/3.2.69/1066_linux-3.2.67.patch
+++ b/3.2.70/1066_linux-3.2.67.patch
diff --git a/3.2.69/1067_linux-3.2.68.patch b/3.2.70/1067_linux-3.2.68.patch
index 200e8b8..200e8b8 100644
--- a/3.2.69/1067_linux-3.2.68.patch
+++ b/3.2.70/1067_linux-3.2.68.patch
diff --git a/3.2.69/1068_linux-3.2.69.patch b/3.2.70/1068_linux-3.2.69.patch
index 8848e8e..8848e8e 100644
--- a/3.2.69/1068_linux-3.2.69.patch
+++ b/3.2.70/1068_linux-3.2.69.patch
diff --git a/3.2.70/1069_linux-3.2.70.patch b/3.2.70/1069_linux-3.2.70.patch
new file mode 100644
index 0000000..b694627
--- /dev/null
+++ b/3.2.70/1069_linux-3.2.70.patch
@@ -0,0 +1,5879 @@
+diff --git a/Documentation/networking/rds.txt b/Documentation/networking/rds.txt
+index c67077c..e1a3d59 100644
+--- a/Documentation/networking/rds.txt
++++ b/Documentation/networking/rds.txt
+@@ -62,11 +62,10 @@ Socket Interface
+ ================
+
+ AF_RDS, PF_RDS, SOL_RDS
+- These constants haven't been assigned yet, because RDS isn't in
+- mainline yet. Currently, the kernel module assigns some constant
+- and publishes it to user space through two sysctl files
+- /proc/sys/net/rds/pf_rds
+- /proc/sys/net/rds/sol_rds
++ AF_RDS and PF_RDS are the domain type to be used with socket(2)
++ to create RDS sockets. SOL_RDS is the socket-level to be used
++ with setsockopt(2) and getsockopt(2) for RDS specific socket
++ options.
+
+ fd = socket(PF_RDS, SOCK_SEQPACKET, 0);
+ This creates a new, unbound RDS socket.
+diff --git a/Documentation/pinctrl.txt b/Documentation/pinctrl.txt
+index b04cb7d..074da62 100644
+--- a/Documentation/pinctrl.txt
++++ b/Documentation/pinctrl.txt
+@@ -164,8 +164,8 @@ static const char *foo_get_group_name(struct pinctrl_dev *pctldev,
+ }
+
+ static int foo_get_group_pins(struct pinctrl_dev *pctldev, unsigned selector,
+- unsigned ** const pins,
+- unsigned * const num_pins)
++ const unsigned **pins,
++ unsigned *num_pins)
+ {
+ *pins = (unsigned *) foo_groups[selector].pins;
+ *num_pins = foo_groups[selector].num_pins;
+diff --git a/Makefile b/Makefile
+index 8071888..41a626b 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 3
+ PATCHLEVEL = 2
+-SUBLEVEL = 69
++SUBLEVEL = 70
+ EXTRAVERSION =
+ NAME = Saber-toothed Squirrel
+
+diff --git a/arch/arm/include/asm/elf.h b/arch/arm/include/asm/elf.h
+index 0e9ce8d..a4b1186 100644
+--- a/arch/arm/include/asm/elf.h
++++ b/arch/arm/include/asm/elf.h
+@@ -116,7 +116,7 @@ int dump_task_regs(struct task_struct *t, elf_gregset_t *elfregs);
+ the loader. We need to make sure that it is out of the way of the program
+ that it will "exec", and that there is sufficient room for the brk. */
+
+-#define ELF_ET_DYN_BASE (2 * TASK_SIZE / 3)
++#define ELF_ET_DYN_BASE (TASK_SIZE / 3 * 2)
+
+ /* When the program starts, a1 contains a pointer to a function to be
+ registered with atexit, as per the SVR4 ABI. A value of 0 means we
+diff --git a/arch/mips/include/asm/cacheflush.h b/arch/mips/include/asm/cacheflush.h
+index 69468de..484c5bc 100644
+--- a/arch/mips/include/asm/cacheflush.h
++++ b/arch/mips/include/asm/cacheflush.h
+@@ -29,6 +29,20 @@
+ * - flush_icache_all() flush the entire instruction cache
+ * - flush_data_cache_page() flushes a page from the data cache
+ */
++
++ /*
++ * This flag is used to indicate that the page pointed to by a pte
++ * is dirty and requires cleaning before returning it to the user.
++ */
++#define PG_dcache_dirty PG_arch_1
++
++#define Page_dcache_dirty(page) \
++ test_bit(PG_dcache_dirty, &(page)->flags)
++#define SetPageDcacheDirty(page) \
++ set_bit(PG_dcache_dirty, &(page)->flags)
++#define ClearPageDcacheDirty(page) \
++ clear_bit(PG_dcache_dirty, &(page)->flags)
++
+ extern void (*flush_cache_all)(void);
+ extern void (*__flush_cache_all)(void);
+ extern void (*flush_cache_mm)(struct mm_struct *mm);
+@@ -37,13 +51,15 @@ extern void (*flush_cache_range)(struct vm_area_struct *vma,
+ unsigned long start, unsigned long end);
+ extern void (*flush_cache_page)(struct vm_area_struct *vma, unsigned long page, unsigned long pfn);
+ extern void __flush_dcache_page(struct page *page);
++extern void __flush_icache_page(struct vm_area_struct *vma, struct page *page);
+
+ #define ARCH_IMPLEMENTS_FLUSH_DCACHE_PAGE 1
+ static inline void flush_dcache_page(struct page *page)
+ {
+- if (cpu_has_dc_aliases || !cpu_has_ic_fills_f_dc)
++ if (cpu_has_dc_aliases)
+ __flush_dcache_page(page);
+-
++ else if (!cpu_has_ic_fills_f_dc)
++ SetPageDcacheDirty(page);
+ }
+
+ #define flush_dcache_mmap_lock(mapping) do { } while (0)
+@@ -61,6 +77,11 @@ static inline void flush_anon_page(struct vm_area_struct *vma,
+ static inline void flush_icache_page(struct vm_area_struct *vma,
+ struct page *page)
+ {
++ if (!cpu_has_ic_fills_f_dc && (vma->vm_flags & VM_EXEC) &&
++ Page_dcache_dirty(page)) {
++ __flush_icache_page(vma, page);
++ ClearPageDcacheDirty(page);
++ }
+ }
+
+ extern void (*flush_icache_range)(unsigned long start, unsigned long end);
+@@ -95,19 +116,6 @@ extern void (*flush_icache_all)(void);
+ extern void (*local_flush_data_cache_page)(void * addr);
+ extern void (*flush_data_cache_page)(unsigned long addr);
+
+-/*
+- * This flag is used to indicate that the page pointed to by a pte
+- * is dirty and requires cleaning before returning it to the user.
+- */
+-#define PG_dcache_dirty PG_arch_1
+-
+-#define Page_dcache_dirty(page) \
+- test_bit(PG_dcache_dirty, &(page)->flags)
+-#define SetPageDcacheDirty(page) \
+- set_bit(PG_dcache_dirty, &(page)->flags)
+-#define ClearPageDcacheDirty(page) \
+- clear_bit(PG_dcache_dirty, &(page)->flags)
+-
+ /* Run kernel code uncached, useful for cache probing functions. */
+ unsigned long run_uncached(void *func);
+
+diff --git a/arch/mips/include/asm/cpu-features.h b/arch/mips/include/asm/cpu-features.h
+index ca400f7..0f4991b 100644
+--- a/arch/mips/include/asm/cpu-features.h
++++ b/arch/mips/include/asm/cpu-features.h
+@@ -153,8 +153,32 @@
+ #define cpu_has_mips_r (cpu_has_mips32r1 | cpu_has_mips32r2 | \
+ cpu_has_mips64r1 | cpu_has_mips64r2)
+
++/*
++ * cpu_has_mips_r2_exec_hazard - return if IHB is required on current processor
++ *
++ * Returns non-zero value if the current processor implementation requires
++ * an IHB instruction to deal with an instruction hazard as per MIPS R2
++ * architecture specification, zero otherwise.
++ */
+ #ifndef cpu_has_mips_r2_exec_hazard
+-#define cpu_has_mips_r2_exec_hazard cpu_has_mips_r2
++#define cpu_has_mips_r2_exec_hazard \
++({ \
++ int __res; \
++ \
++ switch (current_cpu_type()) { \
++ case CPU_74K: \
++ case CPU_CAVIUM_OCTEON: \
++ case CPU_CAVIUM_OCTEON_PLUS: \
++ case CPU_CAVIUM_OCTEON2: \
++ __res = 0; \
++ break; \
++ \
++ default: \
++ __res = 1; \
++ } \
++ \
++ __res; \
++})
+ #endif
+
+ /*
+diff --git a/arch/mips/include/asm/mach-cavium-octeon/cpu-feature-overrides.h b/arch/mips/include/asm/mach-cavium-octeon/cpu-feature-overrides.h
+index a58addb..6ae8e3c 100644
+--- a/arch/mips/include/asm/mach-cavium-octeon/cpu-feature-overrides.h
++++ b/arch/mips/include/asm/mach-cavium-octeon/cpu-feature-overrides.h
+@@ -51,7 +51,6 @@
+ #define cpu_has_mips32r2 0
+ #define cpu_has_mips64r1 0
+ #define cpu_has_mips64r2 1
+-#define cpu_has_mips_r2_exec_hazard 0
+ #define cpu_has_dsp 0
+ #define cpu_has_mipsmt 0
+ #define cpu_has_vint 0
+diff --git a/arch/mips/include/asm/octeon/pci-octeon.h b/arch/mips/include/asm/octeon/pci-octeon.h
+index fba2ba2..ac83283 100644
+--- a/arch/mips/include/asm/octeon/pci-octeon.h
++++ b/arch/mips/include/asm/octeon/pci-octeon.h
+@@ -11,9 +11,6 @@
+
+ #include <linux/pci.h>
+
+-/* Some PCI cards require delays when accessing config space. */
+-#define PCI_CONFIG_SPACE_DELAY 10000
+-
+ /*
+ * The physical memory base mapped by BAR1. 256MB at the end of the
+ * first 4GB.
+diff --git a/arch/mips/kernel/irq.c b/arch/mips/kernel/irq.c
+index 7f50318..6e489e5 100644
+--- a/arch/mips/kernel/irq.c
++++ b/arch/mips/kernel/irq.c
+@@ -111,7 +111,7 @@ void __init init_IRQ(void)
+ #endif
+ }
+
+-#ifdef DEBUG_STACKOVERFLOW
++#ifdef CONFIG_DEBUG_STACKOVERFLOW
+ static inline void check_stack_overflow(void)
+ {
+ unsigned long sp;
+diff --git a/arch/mips/mm/cache.c b/arch/mips/mm/cache.c
+index 829320c..0f8839b 100644
+--- a/arch/mips/mm/cache.c
++++ b/arch/mips/mm/cache.c
+@@ -118,6 +118,18 @@ void __flush_anon_page(struct page *page, unsigned long vmaddr)
+
+ EXPORT_SYMBOL(__flush_anon_page);
+
++void __flush_icache_page(struct vm_area_struct *vma, struct page *page)
++{
++ unsigned long addr;
++
++ if (PageHighMem(page))
++ return;
++
++ addr = (unsigned long) page_address(page);
++ flush_data_cache_page(addr);
++}
++EXPORT_SYMBOL_GPL(__flush_icache_page);
++
+ void __update_cache(struct vm_area_struct *vma, unsigned long address,
+ pte_t pte)
+ {
+diff --git a/arch/mips/pci/pci-octeon.c b/arch/mips/pci/pci-octeon.c
+index ed1c542..66d3c38 100644
+--- a/arch/mips/pci/pci-octeon.c
++++ b/arch/mips/pci/pci-octeon.c
+@@ -279,9 +279,6 @@ static int octeon_read_config(struct pci_bus *bus, unsigned int devfn,
+ pci_addr.s.func = devfn & 0x7;
+ pci_addr.s.reg = reg;
+
+-#if PCI_CONFIG_SPACE_DELAY
+- udelay(PCI_CONFIG_SPACE_DELAY);
+-#endif
+ switch (size) {
+ case 4:
+ *val = le32_to_cpu(cvmx_read64_uint32(pci_addr.u64));
+@@ -316,9 +313,6 @@ static int octeon_write_config(struct pci_bus *bus, unsigned int devfn,
+ pci_addr.s.func = devfn & 0x7;
+ pci_addr.s.reg = reg;
+
+-#if PCI_CONFIG_SPACE_DELAY
+- udelay(PCI_CONFIG_SPACE_DELAY);
+-#endif
+ switch (size) {
+ case 4:
+ cvmx_write64_uint32(pci_addr.u64, cpu_to_le32(val));
+diff --git a/arch/mips/pci/pcie-octeon.c b/arch/mips/pci/pcie-octeon.c
+index 0583c463..37a8790 100644
+--- a/arch/mips/pci/pcie-octeon.c
++++ b/arch/mips/pci/pcie-octeon.c
+@@ -1219,9 +1219,6 @@ static inline int octeon_pcie_write_config(int pcie_port, struct pci_bus *bus,
+ devfn & 0x7, reg, val);
+ return PCIBIOS_SUCCESSFUL;
+ }
+-#if PCI_CONFIG_SPACE_DELAY
+- udelay(PCI_CONFIG_SPACE_DELAY);
+-#endif
+ return PCIBIOS_FUNC_NOT_SUPPORTED;
+ }
+
+diff --git a/arch/mips/power/hibernate.S b/arch/mips/power/hibernate.S
+index 5bf34ec..2ca1735 100644
+--- a/arch/mips/power/hibernate.S
++++ b/arch/mips/power/hibernate.S
+@@ -31,6 +31,8 @@ LEAF(swsusp_arch_suspend)
+ END(swsusp_arch_suspend)
+
+ LEAF(swsusp_arch_resume)
++ /* Avoid TLB mismatch during and after kernel resume */
++ jal local_flush_tlb_all
+ PTR_L t0, restore_pblist
+ 0:
+ PTR_L t1, PBE_ADDRESS(t0) /* source */
+@@ -44,7 +46,6 @@ LEAF(swsusp_arch_resume)
+ bne t1, t3, 1b
+ PTR_L t0, PBE_NEXT(t0)
+ bnez t0, 0b
+- jal local_flush_tlb_all /* Avoid TLB mismatch after kernel resume */
+ PTR_LA t0, saved_regs
+ PTR_L ra, PT_R31(t0)
+ PTR_L sp, PT_R29(t0)
+diff --git a/arch/parisc/kernel/parisc_ksyms.c b/arch/parisc/kernel/parisc_ksyms.c
+index a7bb757..c3f1be95 100644
+--- a/arch/parisc/kernel/parisc_ksyms.c
++++ b/arch/parisc/kernel/parisc_ksyms.c
+@@ -121,11 +121,13 @@ extern void __ashrdi3(void);
+ extern void __ashldi3(void);
+ extern void __lshrdi3(void);
+ extern void __muldi3(void);
++extern void __ucmpdi2(void);
+
+ EXPORT_SYMBOL(__ashrdi3);
+ EXPORT_SYMBOL(__ashldi3);
+ EXPORT_SYMBOL(__lshrdi3);
+ EXPORT_SYMBOL(__muldi3);
++EXPORT_SYMBOL(__ucmpdi2);
+
+ asmlinkage void * __canonicalize_funcptr_for_compare(void *);
+ EXPORT_SYMBOL(__canonicalize_funcptr_for_compare);
+diff --git a/arch/parisc/lib/Makefile b/arch/parisc/lib/Makefile
+index 5f2e690..5651536 100644
+--- a/arch/parisc/lib/Makefile
++++ b/arch/parisc/lib/Makefile
+@@ -2,6 +2,7 @@
+ # Makefile for parisc-specific library files
+ #
+
+-lib-y := lusercopy.o bitops.o checksum.o io.o memset.o fixup.o memcpy.o
++lib-y := lusercopy.o bitops.o checksum.o io.o memset.o fixup.o memcpy.o \
++ ucmpdi2.o
+
+ obj-y := iomap.o
+diff --git a/arch/parisc/lib/ucmpdi2.c b/arch/parisc/lib/ucmpdi2.c
+new file mode 100644
+index 0000000..149c016
+--- /dev/null
++++ b/arch/parisc/lib/ucmpdi2.c
+@@ -0,0 +1,25 @@
++#include <linux/module.h>
++
++union ull_union {
++ unsigned long long ull;
++ struct {
++ unsigned int high;
++ unsigned int low;
++ } ui;
++};
++
++int __ucmpdi2(unsigned long long a, unsigned long long b)
++{
++ union ull_union au = {.ull = a};
++ union ull_union bu = {.ull = b};
++
++ if (au.ui.high < bu.ui.high)
++ return 0;
++ else if (au.ui.high > bu.ui.high)
++ return 2;
++ if (au.ui.low < bu.ui.low)
++ return 0;
++ else if (au.ui.low > bu.ui.low)
++ return 2;
++ return 1;
++}
+diff --git a/arch/powerpc/kernel/cacheinfo.c b/arch/powerpc/kernel/cacheinfo.c
+index 02ebe1a..4f15565 100644
+--- a/arch/powerpc/kernel/cacheinfo.c
++++ b/arch/powerpc/kernel/cacheinfo.c
+@@ -62,12 +62,22 @@ struct cache_type_info {
+ };
+
+ /* These are used to index the cache_type_info array. */
+-#define CACHE_TYPE_UNIFIED 0
+-#define CACHE_TYPE_INSTRUCTION 1
+-#define CACHE_TYPE_DATA 2
++#define CACHE_TYPE_UNIFIED 0 /* cache-size, cache-block-size, etc. */
++#define CACHE_TYPE_UNIFIED_D 1 /* d-cache-size, d-cache-block-size, etc */
++#define CACHE_TYPE_INSTRUCTION 2
++#define CACHE_TYPE_DATA 3
+
+ static const struct cache_type_info cache_type_info[] = {
+ {
++ /* Embedded systems that use cache-size, cache-block-size,
++ * etc. for the Unified (typically L2) cache. */
++ .name = "Unified",
++ .size_prop = "cache-size",
++ .line_size_props = { "cache-line-size",
++ "cache-block-size", },
++ .nr_sets_prop = "cache-sets",
++ },
++ {
+ /* PowerPC Processor binding says the [di]-cache-*
+ * must be equal on unified caches, so just use
+ * d-cache properties. */
+@@ -293,7 +303,8 @@ static struct cache *cache_find_first_sibling(struct cache *cache)
+ {
+ struct cache *iter;
+
+- if (cache->type == CACHE_TYPE_UNIFIED)
++ if (cache->type == CACHE_TYPE_UNIFIED ||
++ cache->type == CACHE_TYPE_UNIFIED_D)
+ return cache;
+
+ list_for_each_entry(iter, &cache_list, list)
+@@ -324,15 +335,29 @@ static bool cache_node_is_unified(const struct device_node *np)
+ return of_get_property(np, "cache-unified", NULL);
+ }
+
+-static struct cache *__cpuinit cache_do_one_devnode_unified(struct device_node *node, int level)
++/*
++ * Unified caches can have two different sets of tags. Most embedded
++ * use cache-size, etc. for the unified cache size, but open firmware systems
++ * use d-cache-size, etc. Check on initialization for which type we have, and
++ * return the appropriate structure type. Assume it's embedded if it isn't
++ * open firmware. If it's yet a 3rd type, then there will be missing entries
++ * in /sys/devices/system/cpu/cpu0/cache/index2/, and this code will need
++ * to be extended further.
++ */
++static int cache_is_unified_d(const struct device_node *np)
+ {
+- struct cache *cache;
++ return of_get_property(np,
++ cache_type_info[CACHE_TYPE_UNIFIED_D].size_prop, NULL) ?
++ CACHE_TYPE_UNIFIED_D : CACHE_TYPE_UNIFIED;
++}
+
++/*
++ */
++static struct cache *__cpuinit cache_do_one_devnode_unified(struct device_node *node, int level)
++{
+ pr_debug("creating L%d ucache for %s\n", level, node->full_name);
+
+- cache = new_cache(CACHE_TYPE_UNIFIED, level, node);
+-
+- return cache;
++ return new_cache(cache_is_unified_d(node), level, node);
+ }
+
+ static struct cache *__cpuinit cache_do_one_devnode_split(struct device_node *node, int level)
+diff --git a/arch/powerpc/kernel/perf_callchain.c b/arch/powerpc/kernel/perf_callchain.c
+index 564c1d8..e80026c 100644
+--- a/arch/powerpc/kernel/perf_callchain.c
++++ b/arch/powerpc/kernel/perf_callchain.c
+@@ -243,7 +243,7 @@ static void perf_callchain_user_64(struct perf_callchain_entry *entry,
+ sp = regs->gpr[1];
+ perf_callchain_store(entry, next_ip);
+
+- for (;;) {
++ while (entry->nr < PERF_MAX_STACK_DEPTH) {
+ fp = (unsigned long __user *) sp;
+ if (!valid_user_sp(sp, 1) || read_user_stack_64(fp, &next_sp))
+ return;
+diff --git a/arch/powerpc/kernel/setup-common.c b/arch/powerpc/kernel/setup-common.c
+index 82288e9..83940d7 100644
+--- a/arch/powerpc/kernel/setup-common.c
++++ b/arch/powerpc/kernel/setup-common.c
+@@ -428,7 +428,7 @@ void __init smp_setup_cpu_maps(void)
+ DBG("smp_setup_cpu_maps()\n");
+
+ while ((dn = of_find_node_by_type(dn, "cpu")) && cpu < nr_cpu_ids) {
+- const int *intserv;
++ const __be32 *intserv;
+ int j, len;
+
+ DBG(" * %s...\n", dn->full_name);
+@@ -447,10 +447,18 @@ void __init smp_setup_cpu_maps(void)
+ }
+
+ for (j = 0; j < nthreads && cpu < nr_cpu_ids; j++) {
++ bool avail;
++
+ DBG(" thread %d -> cpu %d (hard id %d)\n",
+- j, cpu, intserv[j]);
+- set_cpu_present(cpu, of_device_is_available(dn));
+- set_hard_smp_processor_id(cpu, intserv[j]);
++ j, cpu, be32_to_cpu(intserv[j]));
++
++ avail = of_device_is_available(dn);
++ if (!avail)
++ avail = !of_property_match_string(dn,
++ "enable-method", "spin-table");
++
++ set_cpu_present(cpu, avail);
++ set_hard_smp_processor_id(cpu, be32_to_cpu(intserv[j]));
+ set_cpu_possible(cpu, true);
+ cpu++;
+ }
+diff --git a/arch/powerpc/kernel/vmlinux.lds.S b/arch/powerpc/kernel/vmlinux.lds.S
+index 3e8fe4b..cec664a 100644
+--- a/arch/powerpc/kernel/vmlinux.lds.S
++++ b/arch/powerpc/kernel/vmlinux.lds.S
+@@ -212,6 +212,7 @@ SECTIONS
+ *(.opd)
+ }
+
++ . = ALIGN(256);
+ .got : AT(ADDR(.got) - LOAD_OFFSET) {
+ __toc_start = .;
+ *(.got)
+diff --git a/arch/powerpc/mm/mmap_64.c b/arch/powerpc/mm/mmap_64.c
+index 5a783d8..67a42ed 100644
+--- a/arch/powerpc/mm/mmap_64.c
++++ b/arch/powerpc/mm/mmap_64.c
+@@ -53,14 +53,6 @@ static inline int mmap_is_legacy(void)
+ return sysctl_legacy_va_layout;
+ }
+
+-/*
+- * Since get_random_int() returns the same value within a 1 jiffy window,
+- * we will almost always get the same randomisation for the stack and mmap
+- * region. This will mean the relative distance between stack and mmap will
+- * be the same.
+- *
+- * To avoid this we can shift the randomness by 1 bit.
+- */
+ static unsigned long mmap_rnd(void)
+ {
+ unsigned long rnd = 0;
+@@ -68,11 +60,11 @@ static unsigned long mmap_rnd(void)
+ if (current->flags & PF_RANDOMIZE) {
+ /* 8MB for 32bit, 1GB for 64bit */
+ if (is_32bit_task())
+- rnd = (long)(get_random_int() % (1<<(22-PAGE_SHIFT)));
++ rnd = (long)(get_random_int() % (1<<(23-PAGE_SHIFT)));
+ else
+- rnd = (long)(get_random_int() % (1<<(29-PAGE_SHIFT)));
++ rnd = (long)(get_random_int() % (1<<(30-PAGE_SHIFT)));
+ }
+- return (rnd << PAGE_SHIFT) * 2;
++ return rnd << PAGE_SHIFT;
+ }
+
+ static inline unsigned long mmap_base(void)
+diff --git a/arch/powerpc/platforms/pseries/dlpar.c b/arch/powerpc/platforms/pseries/dlpar.c
+index 0f1b706..2767276 100644
+--- a/arch/powerpc/platforms/pseries/dlpar.c
++++ b/arch/powerpc/platforms/pseries/dlpar.c
+@@ -416,6 +416,12 @@ static ssize_t dlpar_cpu_probe(const char *buf, size_t count)
+ goto out;
+ }
+
++ rc = dlpar_acquire_drc(drc_index);
++ if (rc) {
++ rc = -EINVAL;
++ goto out;
++ }
++
+ dn = dlpar_configure_connector(drc_index);
+ if (!dn) {
+ rc = -EINVAL;
+@@ -436,13 +442,6 @@ static ssize_t dlpar_cpu_probe(const char *buf, size_t count)
+ kfree(dn->full_name);
+ dn->full_name = cpu_name;
+
+- rc = dlpar_acquire_drc(drc_index);
+- if (rc) {
+- dlpar_free_cc_nodes(dn);
+- rc = -EINVAL;
+- goto out;
+- }
+-
+ rc = dlpar_attach_node(dn);
+ if (rc) {
+ dlpar_release_drc(drc_index);
+diff --git a/arch/s390/crypto/ghash_s390.c b/arch/s390/crypto/ghash_s390.c
+index 31086ea..568521a 100644
+--- a/arch/s390/crypto/ghash_s390.c
++++ b/arch/s390/crypto/ghash_s390.c
+@@ -16,11 +16,12 @@
+ #define GHASH_DIGEST_SIZE 16
+
+ struct ghash_ctx {
+- u8 icv[16];
+- u8 key[16];
++ u8 key[GHASH_BLOCK_SIZE];
+ };
+
+ struct ghash_desc_ctx {
++ u8 icv[GHASH_BLOCK_SIZE];
++ u8 key[GHASH_BLOCK_SIZE];
+ u8 buffer[GHASH_BLOCK_SIZE];
+ u32 bytes;
+ };
+@@ -28,8 +29,10 @@ struct ghash_desc_ctx {
+ static int ghash_init(struct shash_desc *desc)
+ {
+ struct ghash_desc_ctx *dctx = shash_desc_ctx(desc);
++ struct ghash_ctx *ctx = crypto_shash_ctx(desc->tfm);
+
+ memset(dctx, 0, sizeof(*dctx));
++ memcpy(dctx->key, ctx->key, GHASH_BLOCK_SIZE);
+
+ return 0;
+ }
+@@ -45,7 +48,6 @@ static int ghash_setkey(struct crypto_shash *tfm,
+ }
+
+ memcpy(ctx->key, key, GHASH_BLOCK_SIZE);
+- memset(ctx->icv, 0, GHASH_BLOCK_SIZE);
+
+ return 0;
+ }
+@@ -54,7 +56,6 @@ static int ghash_update(struct shash_desc *desc,
+ const u8 *src, unsigned int srclen)
+ {
+ struct ghash_desc_ctx *dctx = shash_desc_ctx(desc);
+- struct ghash_ctx *ctx = crypto_shash_ctx(desc->tfm);
+ unsigned int n;
+ u8 *buf = dctx->buffer;
+ int ret;
+@@ -70,7 +71,7 @@ static int ghash_update(struct shash_desc *desc,
+ src += n;
+
+ if (!dctx->bytes) {
+- ret = crypt_s390_kimd(KIMD_GHASH, ctx, buf,
++ ret = crypt_s390_kimd(KIMD_GHASH, dctx, buf,
+ GHASH_BLOCK_SIZE);
+ if (ret != GHASH_BLOCK_SIZE)
+ return -EIO;
+@@ -79,7 +80,7 @@ static int ghash_update(struct shash_desc *desc,
+
+ n = srclen & ~(GHASH_BLOCK_SIZE - 1);
+ if (n) {
+- ret = crypt_s390_kimd(KIMD_GHASH, ctx, src, n);
++ ret = crypt_s390_kimd(KIMD_GHASH, dctx, src, n);
+ if (ret != n)
+ return -EIO;
+ src += n;
+@@ -94,7 +95,7 @@ static int ghash_update(struct shash_desc *desc,
+ return 0;
+ }
+
+-static int ghash_flush(struct ghash_ctx *ctx, struct ghash_desc_ctx *dctx)
++static int ghash_flush(struct ghash_desc_ctx *dctx)
+ {
+ u8 *buf = dctx->buffer;
+ int ret;
+@@ -104,24 +105,24 @@ static int ghash_flush(struct ghash_ctx *ctx, struct ghash_desc_ctx *dctx)
+
+ memset(pos, 0, dctx->bytes);
+
+- ret = crypt_s390_kimd(KIMD_GHASH, ctx, buf, GHASH_BLOCK_SIZE);
++ ret = crypt_s390_kimd(KIMD_GHASH, dctx, buf, GHASH_BLOCK_SIZE);
+ if (ret != GHASH_BLOCK_SIZE)
+ return -EIO;
++
++ dctx->bytes = 0;
+ }
+
+- dctx->bytes = 0;
+ return 0;
+ }
+
+ static int ghash_final(struct shash_desc *desc, u8 *dst)
+ {
+ struct ghash_desc_ctx *dctx = shash_desc_ctx(desc);
+- struct ghash_ctx *ctx = crypto_shash_ctx(desc->tfm);
+ int ret;
+
+- ret = ghash_flush(ctx, dctx);
++ ret = ghash_flush(dctx);
+ if (!ret)
+- memcpy(dst, ctx->icv, GHASH_BLOCK_SIZE);
++ memcpy(dst, dctx->icv, GHASH_BLOCK_SIZE);
+ return ret;
+ }
+
+diff --git a/arch/s390/kernel/suspend.c b/arch/s390/kernel/suspend.c
+index 47df775..ba17092 100644
+--- a/arch/s390/kernel/suspend.c
++++ b/arch/s390/kernel/suspend.c
+@@ -9,6 +9,8 @@
+ #include <linux/pfn.h>
+ #include <linux/suspend.h>
+ #include <linux/mm.h>
++#include <asm/ipl.h>
++#include <asm/sections.h>
+ #include <asm/system.h>
+
+ /*
+@@ -137,6 +139,8 @@ int pfn_is_nosave(unsigned long pfn)
+ {
+ unsigned long nosave_begin_pfn = PFN_DOWN(__pa(&__nosave_begin));
+ unsigned long nosave_end_pfn = PFN_DOWN(__pa(&__nosave_end));
++ unsigned long eshared_pfn = PFN_DOWN(__pa(&_eshared)) - 1;
++ unsigned long stext_pfn = PFN_DOWN(__pa(&_stext));
+
+ /* Always save lowcore pages (LC protection might be enabled). */
+ if (pfn <= LC_PAGES)
+@@ -144,6 +148,8 @@ int pfn_is_nosave(unsigned long pfn)
+ if (pfn >= nosave_begin_pfn && pfn < nosave_end_pfn)
+ return 1;
+ /* Skip memory holes and read-only pages (NSS, DCSS, ...). */
++ if (pfn >= stext_pfn && pfn <= eshared_pfn)
++ return ipl_info.type == IPL_TYPE_NSS ? 1 : 0;
+ if (tprot(PFN_PHYS(pfn)))
+ return 1;
+ return 0;
+diff --git a/arch/s390/kvm/priv.c b/arch/s390/kvm/priv.c
+index d026389..c593e1e 100644
+--- a/arch/s390/kvm/priv.c
++++ b/arch/s390/kvm/priv.c
+@@ -219,6 +219,7 @@ static void handle_stsi_3_2_2(struct kvm_vcpu *vcpu, struct sysinfo_3_2_2 *mem)
+ for (n = mem->count - 1; n > 0 ; n--)
+ memcpy(&mem->vm[n], &mem->vm[n - 1], sizeof(mem->vm[0]));
+
++ memset(&mem->vm[0], 0, sizeof(mem->vm[0]));
+ mem->vm[0].cpus_total = cpus;
+ mem->vm[0].cpus_configured = cpus;
+ mem->vm[0].cpus_standby = 0;
+diff --git a/arch/sparc/kernel/leon_pci.c b/arch/sparc/kernel/leon_pci.c
+index f1cf6ef..a0ef32e 100644
+--- a/arch/sparc/kernel/leon_pci.c
++++ b/arch/sparc/kernel/leon_pci.c
+@@ -78,7 +78,6 @@ EXPORT_SYMBOL(pcibios_bus_to_resource);
+
+ void __devinit pcibios_fixup_bus(struct pci_bus *pbus)
+ {
+- struct leon_pci_info *info = pbus->sysdata;
+ struct pci_dev *dev;
+ int i, has_io, has_mem;
+ u16 cmd;
+@@ -153,18 +152,6 @@ int pcibios_enable_device(struct pci_dev *dev, int mask)
+ return pci_enable_resources(dev, mask);
+ }
+
+-struct device_node *pci_device_to_OF_node(struct pci_dev *pdev)
+-{
+- /*
+- * Currently the OpenBoot nodes are not connected with the PCI device,
+- * this is because the LEON PROM does not create PCI nodes. Eventually
+- * this will change and the same approach as pcic.c can be used to
+- * match PROM nodes with pci devices.
+- */
+- return NULL;
+-}
+-EXPORT_SYMBOL(pci_device_to_OF_node);
+-
+ void __devinit pcibios_update_irq(struct pci_dev *dev, int irq)
+ {
+ #ifdef CONFIG_PCI_DEBUG
+diff --git a/arch/sparc/kernel/sys_sparc_64.c b/arch/sparc/kernel/sys_sparc_64.c
+index 5e4252b..0ff682d 100644
+--- a/arch/sparc/kernel/sys_sparc_64.c
++++ b/arch/sparc/kernel/sys_sparc_64.c
+@@ -368,11 +368,11 @@ static unsigned long mmap_rnd(void)
+ if (current->flags & PF_RANDOMIZE) {
+ unsigned long val = get_random_int();
+ if (test_thread_flag(TIF_32BIT))
+- rnd = (val % (1UL << (22UL-PAGE_SHIFT)));
++ rnd = (val % (1UL << (23UL-PAGE_SHIFT)));
+ else
+- rnd = (val % (1UL << (29UL-PAGE_SHIFT)));
++ rnd = (val % (1UL << (30UL-PAGE_SHIFT)));
+ }
+- return (rnd << PAGE_SHIFT) * 2;
++ return rnd << PAGE_SHIFT;
+ }
+
+ void arch_pick_mmap_layout(struct mm_struct *mm)
+diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
+index 28a1bca..d720208 100644
+--- a/arch/x86/Kconfig
++++ b/arch/x86/Kconfig
+@@ -133,7 +133,8 @@ config SBUS
+ bool
+
+ config NEED_DMA_MAP_STATE
+- def_bool (X86_64 || INTEL_IOMMU || DMA_API_DEBUG)
++ def_bool y
++ depends on X86_64 || INTEL_IOMMU || DMA_API_DEBUG || SWIOTLB
+
+ config NEED_SG_DMA_LENGTH
+ def_bool y
+diff --git a/arch/x86/include/asm/iommu_table.h b/arch/x86/include/asm/iommu_table.h
+index f229b13..0c54822 100644
+--- a/arch/x86/include/asm/iommu_table.h
++++ b/arch/x86/include/asm/iommu_table.h
+@@ -79,11 +79,12 @@ struct iommu_table_entry {
+ * d). Similar to the 'init', except that this gets called from pci_iommu_init
+ * where we do have a memory allocator.
+ *
+- * The standard vs the _FINISH differs in that the _FINISH variant will
+- * continue detecting other IOMMUs in the call list after the
+- * the detection routine returns a positive number. The _FINISH will
+- * stop the execution chain. Both will still call the 'init' and
+- * 'late_init' functions if they are set.
++ * The standard IOMMU_INIT differs from the IOMMU_INIT_FINISH variant
++ * in that the former will continue detecting other IOMMUs in the call
++ * list after the detection routine returns a positive number, while the
++ * latter will stop the execution chain upon first successful detection.
++ * Both variants will still call the 'init' and 'late_init' functions if
++ * they are set.
+ */
+ #define IOMMU_INIT_FINISH(_detect, _depend, _init, _late_init) \
+ __IOMMU_INIT(_detect, _depend, _init, _late_init, 1)
+diff --git a/arch/x86/kernel/reboot.c b/arch/x86/kernel/reboot.c
+index 41b2f57..78842ce 100644
+--- a/arch/x86/kernel/reboot.c
++++ b/arch/x86/kernel/reboot.c
+@@ -700,9 +700,12 @@ void native_machine_shutdown(void)
+ /* Make certain I only run on the appropriate processor */
+ set_cpus_allowed_ptr(current, cpumask_of(reboot_cpu_id));
+
+- /* O.K Now that I'm on the appropriate processor,
+- * stop all of the others.
++ /*
++ * O.K Now that I'm on the appropriate processor, stop all of the
++ * others. Also disable the local irq to not receive the per-cpu
++ * timer interrupt which may trigger scheduler's load balance.
+ */
++ local_irq_disable();
+ stop_other_cpus();
+ #endif
+
+diff --git a/arch/x86/kvm/mmu.c b/arch/x86/kvm/mmu.c
+index bfc9507..4a949c7 100644
+--- a/arch/x86/kvm/mmu.c
++++ b/arch/x86/kvm/mmu.c
+@@ -3609,7 +3609,7 @@ void kvm_mmu_pte_write(struct kvm_vcpu *vcpu, gpa_t gpa,
+ }
+ }
+
+- mask.cr0_wp = mask.cr4_pae = mask.nxe = 1;
++ mask.cr0_wp = mask.cr4_pae = mask.nxe = mask.smep_andnot_wp = 1;
+ for_each_gfn_indirect_valid_sp(vcpu->kvm, sp, gfn, node) {
+ pte_size = sp->role.cr4_pae ? 8 : 4;
+ misaligned = (offset ^ (offset + bytes - 1)) & ~(pte_size - 1);
+diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
+index 8831c43..421958f 100644
+--- a/arch/x86/kvm/vmx.c
++++ b/arch/x86/kvm/vmx.c
+@@ -3032,8 +3032,16 @@ static void vmx_set_cr3(struct kvm_vcpu *vcpu, unsigned long cr3)
+
+ static int vmx_set_cr4(struct kvm_vcpu *vcpu, unsigned long cr4)
+ {
+- unsigned long hw_cr4 = cr4 | (to_vmx(vcpu)->rmode.vm86_active ?
+- KVM_RMODE_VM_CR4_ALWAYS_ON : KVM_PMODE_VM_CR4_ALWAYS_ON);
++ /*
++ * Pass through host's Machine Check Enable value to hw_cr4, which
++ * is in force while we are in guest mode. Do not let guests control
++ * this bit, even if host CR4.MCE == 0.
++ */
++ unsigned long hw_cr4 =
++ (read_cr4() & X86_CR4_MCE) |
++ (cr4 & ~X86_CR4_MCE) |
++ (to_vmx(vcpu)->rmode.vm86_active ?
++ KVM_RMODE_VM_CR4_ALWAYS_ON : KVM_PMODE_VM_CR4_ALWAYS_ON);
+
+ if (cr4 & X86_CR4_VMXE) {
+ /*
+diff --git a/arch/x86/lib/usercopy_64.c b/arch/x86/lib/usercopy_64.c
+index 554b7b5..433b21d 100644
+--- a/arch/x86/lib/usercopy_64.c
++++ b/arch/x86/lib/usercopy_64.c
+@@ -113,7 +113,7 @@ long __strnlen_user(const char __user *s, long n)
+ char c;
+
+ while (1) {
+- if (res>n)
++ if (res >= n)
+ return n+1;
+ if (__get_user(c, s))
+ return 0;
+diff --git a/arch/x86/net/bpf_jit_comp.c b/arch/x86/net/bpf_jit_comp.c
+index 5a5b6e4..11e3100 100644
+--- a/arch/x86/net/bpf_jit_comp.c
++++ b/arch/x86/net/bpf_jit_comp.c
+@@ -150,7 +150,12 @@ void bpf_jit_compile(struct sk_filter *fp)
+ }
+ cleanup_addr = proglen; /* epilogue address */
+
+- for (pass = 0; pass < 10; pass++) {
++ /* JITed image shrinks with every pass and the loop iterates
++ * until the image stops shrinking. Very large bpf programs
++ * may converge on the last pass. In such case do one more
++ * pass to emit the final image
++ */
++ for (pass = 0; pass < 10 || image; pass++) {
+ u8 seen_or_pass0 = (pass == 0) ? (SEEN_XREG | SEEN_DATAREF | SEEN_MEM) : seen;
+ /* no prologue/epilogue for trivial filters (RET something) */
+ proglen = 0;
+diff --git a/drivers/acpi/acpica/acmacros.h b/drivers/acpi/acpica/acmacros.h
+index b7491ee..6454fe6 100644
+--- a/drivers/acpi/acpica/acmacros.h
++++ b/drivers/acpi/acpica/acmacros.h
+@@ -59,19 +59,15 @@
+ #define ACPI_SET64(ptr) *ACPI_CAST_PTR (u64, ptr)
+
+ /*
+- * printf() format helpers
++ * printf() format helper. This macros is a workaround for the difficulties
++ * with emitting 64-bit integers and 64-bit pointers with the same code
++ * for both 32-bit and 64-bit hosts.
+ */
+
+ /* Split 64-bit integer into two 32-bit values. Use with %8.8_x%8.8_x */
+
+ #define ACPI_FORMAT_UINT64(i) ACPI_HIDWORD(i), ACPI_LODWORD(i)
+
+-#if ACPI_MACHINE_WIDTH == 64
+-#define ACPI_FORMAT_NATIVE_UINT(i) ACPI_FORMAT_UINT64(i)
+-#else
+-#define ACPI_FORMAT_NATIVE_UINT(i) 0, (i)
+-#endif
+-
+ /*
+ * Macros for moving data around to/from buffers that are possibly unaligned.
+ * If the hardware supports the transfer of unaligned data, just do the store.
+diff --git a/drivers/acpi/acpica/dsopcode.c b/drivers/acpi/acpica/dsopcode.c
+index c627a28..9d19587 100644
+--- a/drivers/acpi/acpica/dsopcode.c
++++ b/drivers/acpi/acpica/dsopcode.c
+@@ -446,7 +446,7 @@ acpi_ds_eval_region_operands(struct acpi_walk_state *walk_state,
+
+ ACPI_DEBUG_PRINT((ACPI_DB_EXEC, "RgnObj %p Addr %8.8X%8.8X Len %X\n",
+ obj_desc,
+- ACPI_FORMAT_NATIVE_UINT(obj_desc->region.address),
++ ACPI_FORMAT_UINT64(obj_desc->region.address),
+ obj_desc->region.length));
+
+ /* Now the address and length are valid for this opregion */
+@@ -545,7 +545,7 @@ acpi_ds_eval_table_region_operands(struct acpi_walk_state *walk_state,
+
+ ACPI_DEBUG_PRINT((ACPI_DB_EXEC, "RgnObj %p Addr %8.8X%8.8X Len %X\n",
+ obj_desc,
+- ACPI_FORMAT_NATIVE_UINT(obj_desc->region.address),
++ ACPI_FORMAT_UINT64(obj_desc->region.address),
+ obj_desc->region.length));
+
+ /* Now the address and length are valid for this opregion */
+diff --git a/drivers/acpi/acpica/evregion.c b/drivers/acpi/acpica/evregion.c
+index f0edf5c..cb18ab4 100644
+--- a/drivers/acpi/acpica/evregion.c
++++ b/drivers/acpi/acpica/evregion.c
+@@ -450,8 +450,8 @@ acpi_ev_address_space_dispatch(union acpi_operand_object *region_obj,
+ ACPI_DEBUG_PRINT((ACPI_DB_OPREGION,
+ "Handler %p (@%p) Address %8.8X%8.8X [%s]\n",
+ &region_obj->region.handler->address_space, handler,
+- ACPI_FORMAT_NATIVE_UINT(region_obj->region.address +
+- region_offset),
++ ACPI_FORMAT_UINT64(region_obj->region.address +
++ region_offset),
+ acpi_ut_get_region_name(region_obj->region.
+ space_id)));
+
+diff --git a/drivers/acpi/acpica/exdump.c b/drivers/acpi/acpica/exdump.c
+index 61b8c0e..c572fa0 100644
+--- a/drivers/acpi/acpica/exdump.c
++++ b/drivers/acpi/acpica/exdump.c
+@@ -613,8 +613,8 @@ void acpi_ex_dump_operand(union acpi_operand_object *obj_desc, u32 depth)
+ acpi_os_printf("\n");
+ } else {
+ acpi_os_printf(" base %8.8X%8.8X Length %X\n",
+- ACPI_FORMAT_NATIVE_UINT(obj_desc->region.
+- address),
++ ACPI_FORMAT_UINT64(obj_desc->region.
++ address),
+ obj_desc->region.length);
+ }
+ break;
+diff --git a/drivers/acpi/acpica/exfldio.c b/drivers/acpi/acpica/exfldio.c
+index b334f54..be22142 100644
+--- a/drivers/acpi/acpica/exfldio.c
++++ b/drivers/acpi/acpica/exfldio.c
+@@ -257,17 +257,15 @@ acpi_ex_access_region(union acpi_operand_object *obj_desc,
+ }
+
+ ACPI_DEBUG_PRINT_RAW((ACPI_DB_BFIELD,
+- " Region [%s:%X], Width %X, ByteBase %X, Offset %X at %p\n",
++ " Region [%s:%X], Width %X, ByteBase %X, Offset %X at %8.8X%8.8X\n",
+ acpi_ut_get_region_name(rgn_desc->region.
+ space_id),
+ rgn_desc->region.space_id,
+ obj_desc->common_field.access_byte_width,
+ obj_desc->common_field.base_byte_offset,
+- field_datum_byte_offset, ACPI_CAST_PTR(void,
+- (rgn_desc->
+- region.
+- address +
+- region_offset))));
++ field_datum_byte_offset,
++ ACPI_FORMAT_UINT64(rgn_desc->region.address +
++ region_offset)));
+
+ /* Invoke the appropriate address_space/op_region handler */
+
+diff --git a/drivers/acpi/acpica/exregion.c b/drivers/acpi/acpica/exregion.c
+index f0d5e14..dd5e930 100644
+--- a/drivers/acpi/acpica/exregion.c
++++ b/drivers/acpi/acpica/exregion.c
+@@ -174,7 +174,7 @@ acpi_ex_system_memory_space_handler(u32 function,
+ if (!mem_info->mapped_logical_address) {
+ ACPI_ERROR((AE_INFO,
+ "Could not map memory at 0x%8.8X%8.8X, size %u",
+- ACPI_FORMAT_NATIVE_UINT(address),
++ ACPI_FORMAT_UINT64(address),
+ (u32) map_length));
+ mem_info->mapped_length = 0;
+ return_ACPI_STATUS(AE_NO_MEMORY);
+@@ -195,8 +195,7 @@ acpi_ex_system_memory_space_handler(u32 function,
+
+ ACPI_DEBUG_PRINT((ACPI_DB_INFO,
+ "System-Memory (width %u) R/W %u Address=%8.8X%8.8X\n",
+- bit_width, function,
+- ACPI_FORMAT_NATIVE_UINT(address)));
++ bit_width, function, ACPI_FORMAT_UINT64(address)));
+
+ /*
+ * Perform the memory read or write
+@@ -298,8 +297,7 @@ acpi_ex_system_io_space_handler(u32 function,
+
+ ACPI_DEBUG_PRINT((ACPI_DB_INFO,
+ "System-IO (width %u) R/W %u Address=%8.8X%8.8X\n",
+- bit_width, function,
+- ACPI_FORMAT_NATIVE_UINT(address)));
++ bit_width, function, ACPI_FORMAT_UINT64(address)));
+
+ /* Decode the function parameter */
+
+diff --git a/drivers/acpi/acpica/hwvalid.c b/drivers/acpi/acpica/hwvalid.c
+index 5f16058..d43b8af 100644
+--- a/drivers/acpi/acpica/hwvalid.c
++++ b/drivers/acpi/acpica/hwvalid.c
+@@ -141,17 +141,17 @@ acpi_hw_validate_io_request(acpi_io_address address, u32 bit_width)
+ byte_width = ACPI_DIV_8(bit_width);
+ last_address = address + byte_width - 1;
+
+- ACPI_DEBUG_PRINT((ACPI_DB_IO, "Address %p LastAddress %p Length %X",
+- ACPI_CAST_PTR(void, address), ACPI_CAST_PTR(void,
+- last_address),
+- byte_width));
++ ACPI_DEBUG_PRINT((ACPI_DB_IO,
++ "Address %8.8X%8.8X LastAddress %8.8X%8.8X Length %X",
++ ACPI_FORMAT_UINT64(address),
++ ACPI_FORMAT_UINT64(last_address), byte_width));
+
+ /* Maximum 16-bit address in I/O space */
+
+ if (last_address > ACPI_UINT16_MAX) {
+ ACPI_ERROR((AE_INFO,
+- "Illegal I/O port address/length above 64K: %p/0x%X",
+- ACPI_CAST_PTR(void, address), byte_width));
++ "Illegal I/O port address/length above 64K: %8.8X%8.8X/0x%X",
++ ACPI_FORMAT_UINT64(address), byte_width));
+ return_ACPI_STATUS(AE_LIMIT);
+ }
+
+@@ -180,8 +180,8 @@ acpi_hw_validate_io_request(acpi_io_address address, u32 bit_width)
+
+ if (acpi_gbl_osi_data >= port_info->osi_dependency) {
+ ACPI_DEBUG_PRINT((ACPI_DB_IO,
+- "Denied AML access to port 0x%p/%X (%s 0x%.4X-0x%.4X)",
+- ACPI_CAST_PTR(void, address),
++ "Denied AML access to port 0x%8.8X%8.8X/%X (%s 0x%.4X-0x%.4X)",
++ ACPI_FORMAT_UINT64(address),
+ byte_width, port_info->name,
+ port_info->start,
+ port_info->end));
+diff --git a/drivers/acpi/acpica/nsdump.c b/drivers/acpi/acpica/nsdump.c
+index b683cc2..0a68c73 100644
+--- a/drivers/acpi/acpica/nsdump.c
++++ b/drivers/acpi/acpica/nsdump.c
+@@ -251,12 +251,11 @@ acpi_ns_dump_one_object(acpi_handle obj_handle,
+ switch (type) {
+ case ACPI_TYPE_PROCESSOR:
+
+- acpi_os_printf("ID %X Len %.4X Addr %p\n",
++ acpi_os_printf("ID %02X Len %02X Addr %8.8X%8.8X\n",
+ obj_desc->processor.proc_id,
+ obj_desc->processor.length,
+- ACPI_CAST_PTR(void,
+- obj_desc->processor.
+- address));
++ ACPI_FORMAT_UINT64(obj_desc->processor.
++ address));
+ break;
+
+ case ACPI_TYPE_DEVICE:
+@@ -327,8 +326,9 @@ acpi_ns_dump_one_object(acpi_handle obj_handle,
+ space_id));
+ if (obj_desc->region.flags & AOPOBJ_DATA_VALID) {
+ acpi_os_printf(" Addr %8.8X%8.8X Len %.4X\n",
+- ACPI_FORMAT_NATIVE_UINT
+- (obj_desc->region.address),
++ ACPI_FORMAT_UINT64(obj_desc->
++ region.
++ address),
+ obj_desc->region.length);
+ } else {
+ acpi_os_printf
+diff --git a/drivers/acpi/acpica/tbinstal.c b/drivers/acpi/acpica/tbinstal.c
+index 62365f6..08a3380 100644
+--- a/drivers/acpi/acpica/tbinstal.c
++++ b/drivers/acpi/acpica/tbinstal.c
+@@ -228,9 +228,9 @@ acpi_tb_add_table(struct acpi_table_desc *table_desc, u32 *table_index)
+ status = acpi_os_table_override(table_desc->pointer, &override_table);
+ if (ACPI_SUCCESS(status) && override_table) {
+ ACPI_INFO((AE_INFO,
+- "%4.4s @ 0x%p Table override, replaced with:",
++ "%4.4s @ 0x%8.8X%8.8X Table override, replaced with:",
+ table_desc->pointer->signature,
+- ACPI_CAST_PTR(void, table_desc->address)));
++ ACPI_FORMAT_UINT64(table_desc->address)));
+
+ /* We can delete the table that was passed as a parameter */
+
+diff --git a/drivers/acpi/acpica/tbutils.c b/drivers/acpi/acpica/tbutils.c
+index 0f2d395..24de78fe 100644
+--- a/drivers/acpi/acpica/tbutils.c
++++ b/drivers/acpi/acpica/tbutils.c
+@@ -237,16 +237,12 @@ acpi_tb_print_table_header(acpi_physical_address address,
+ {
+ struct acpi_table_header local_header;
+
+- /*
+- * The reason that the Address is cast to a void pointer is so that we
+- * can use %p which will work properly on both 32-bit and 64-bit hosts.
+- */
+ if (ACPI_COMPARE_NAME(header->signature, ACPI_SIG_FACS)) {
+
+ /* FACS only has signature and length fields */
+
+- ACPI_INFO((AE_INFO, "%4.4s %p %05X",
+- header->signature, ACPI_CAST_PTR(void, address),
++ ACPI_INFO((AE_INFO, "%4.4s 0x%8.8X%8.8X %05X",
++ header->signature, ACPI_FORMAT_UINT64(address),
+ header->length));
+ } else if (ACPI_COMPARE_NAME(header->signature, ACPI_SIG_RSDP)) {
+
+@@ -257,8 +253,8 @@ acpi_tb_print_table_header(acpi_physical_address address,
+ header)->oem_id, ACPI_OEM_ID_SIZE);
+ acpi_tb_fix_string(local_header.oem_id, ACPI_OEM_ID_SIZE);
+
+- ACPI_INFO((AE_INFO, "RSDP %p %05X (v%.2d %6.6s)",
+- ACPI_CAST_PTR (void, address),
++ ACPI_INFO((AE_INFO, "RSDP 0x%8.8X%8.8X %05X (v%.2d %6.6s)",
++ ACPI_FORMAT_UINT64(address),
+ (ACPI_CAST_PTR(struct acpi_table_rsdp, header)->
+ revision >
+ 0) ? ACPI_CAST_PTR(struct acpi_table_rsdp,
+@@ -272,8 +268,8 @@ acpi_tb_print_table_header(acpi_physical_address address,
+ acpi_tb_cleanup_table_header(&local_header, header);
+
+ ACPI_INFO((AE_INFO,
+- "%4.4s %p %05X (v%.2d %6.6s %8.8s %08X %4.4s %08X)",
+- local_header.signature, ACPI_CAST_PTR(void, address),
++ "%-4.4s 0x%8.8X%8.8X %05X (v%.2d %-6.6s %-8.8s %08X %-4.4s %08X)",
++ local_header.signature, ACPI_FORMAT_UINT64(address),
+ local_header.length, local_header.revision,
+ local_header.oem_id, local_header.oem_table_id,
+ local_header.oem_revision,
+@@ -488,9 +484,8 @@ acpi_tb_install_table(acpi_physical_address address,
+ status = acpi_os_table_override(mapped_table, &override_table);
+ if (ACPI_SUCCESS(status) && override_table) {
+ ACPI_INFO((AE_INFO,
+- "%4.4s @ 0x%p Table override, replaced with:",
+- mapped_table->signature, ACPI_CAST_PTR(void,
+- address)));
++ "%4.4s @ 0x%8.8X%8.8X Table override, replaced with:",
++ mapped_table->signature, ACPI_FORMAT_UINT64(address)));
+
+ acpi_gbl_root_table_list.tables[table_index].pointer =
+ override_table;
+diff --git a/drivers/acpi/acpica/tbxfroot.c b/drivers/acpi/acpica/tbxfroot.c
+index 7eb6c6c..0272fbe 100644
+--- a/drivers/acpi/acpica/tbxfroot.c
++++ b/drivers/acpi/acpica/tbxfroot.c
+@@ -119,7 +119,7 @@ static acpi_status acpi_tb_validate_rsdp(struct acpi_table_rsdp *rsdp)
+ *
+ ******************************************************************************/
+
+-acpi_status acpi_find_root_pointer(acpi_size *table_address)
++acpi_status acpi_find_root_pointer(acpi_physical_address * table_address)
+ {
+ u8 *table_ptr;
+ u8 *mem_rover;
+@@ -177,7 +177,8 @@ acpi_status acpi_find_root_pointer(acpi_size *table_address)
+ physical_address +=
+ (u32) ACPI_PTR_DIFF(mem_rover, table_ptr);
+
+- *table_address = physical_address;
++ *table_address =
++ (acpi_physical_address) physical_address;
+ return_ACPI_STATUS(AE_OK);
+ }
+ }
+@@ -210,7 +211,7 @@ acpi_status acpi_find_root_pointer(acpi_size *table_address)
+ (ACPI_HI_RSDP_WINDOW_BASE +
+ ACPI_PTR_DIFF(mem_rover, table_ptr));
+
+- *table_address = physical_address;
++ *table_address = (acpi_physical_address) physical_address;
+ return_ACPI_STATUS(AE_OK);
+ }
+
+diff --git a/drivers/acpi/osl.c b/drivers/acpi/osl.c
+index a6664d2..7be7aa6 100644
+--- a/drivers/acpi/osl.c
++++ b/drivers/acpi/osl.c
+@@ -179,7 +179,7 @@ static void __init acpi_request_region (struct acpi_generic_address *addr,
+ request_mem_region(addr->address, length, desc);
+ }
+
+-static int __init acpi_reserve_resources(void)
++static void __init acpi_reserve_resources(void)
+ {
+ acpi_request_region(&acpi_gbl_FADT.xpm1a_event_block, acpi_gbl_FADT.pm1_event_length,
+ "ACPI PM1a_EVT_BLK");
+@@ -208,10 +208,7 @@ static int __init acpi_reserve_resources(void)
+ if (!(acpi_gbl_FADT.gpe1_block_length & 0x1))
+ acpi_request_region(&acpi_gbl_FADT.xgpe1_block,
+ acpi_gbl_FADT.gpe1_block_length, "ACPI GPE1_BLK");
+-
+- return 0;
+ }
+-device_initcall(acpi_reserve_resources);
+
+ void acpi_os_printf(const char *fmt, ...)
+ {
+@@ -1630,6 +1627,7 @@ acpi_status __init acpi_os_initialize(void)
+
+ acpi_status __init acpi_os_initialize1(void)
+ {
++ acpi_reserve_resources();
+ kacpid_wq = alloc_workqueue("kacpid", 0, 1);
+ kacpi_notify_wq = alloc_workqueue("kacpi_notify", 0, 1);
+ kacpi_hotplug_wq = alloc_workqueue("kacpi_hotplug", 0, 1);
+diff --git a/drivers/ata/ahci.c b/drivers/ata/ahci.c
+index 81f32e5..e2958aa 100644
+--- a/drivers/ata/ahci.c
++++ b/drivers/ata/ahci.c
+@@ -67,6 +67,7 @@ enum board_ids {
+ board_ahci_yes_fbs,
+
+ /* board IDs for specific chipsets in alphabetical order */
++ board_ahci_avn,
+ board_ahci_mcp65,
+ board_ahci_mcp77,
+ board_ahci_mcp89,
+@@ -85,6 +86,8 @@ enum board_ids {
+ static int ahci_init_one(struct pci_dev *pdev, const struct pci_device_id *ent);
+ static int ahci_vt8251_hardreset(struct ata_link *link, unsigned int *class,
+ unsigned long deadline);
++static int ahci_avn_hardreset(struct ata_link *link, unsigned int *class,
++ unsigned long deadline);
+ static int ahci_p5wdh_hardreset(struct ata_link *link, unsigned int *class,
+ unsigned long deadline);
+ #ifdef CONFIG_PM
+@@ -108,6 +111,11 @@ static struct ata_port_operations ahci_p5wdh_ops = {
+
+ #define AHCI_HFLAGS(flags) .private_data = (void *)(flags)
+
++static struct ata_port_operations ahci_avn_ops = {
++ .inherits = &ahci_ops,
++ .hardreset = ahci_avn_hardreset,
++};
++
+ static const struct ata_port_info ahci_port_info[] = {
+ /* by features */
+ [board_ahci] =
+@@ -156,6 +164,12 @@ static const struct ata_port_info ahci_port_info[] = {
+ .port_ops = &ahci_ops,
+ },
+ /* by chipsets */
++ [board_ahci_avn] = {
++ .flags = AHCI_FLAG_COMMON,
++ .pio_mask = ATA_PIO4,
++ .udma_mask = ATA_UDMA6,
++ .port_ops = &ahci_avn_ops,
++ },
+ [board_ahci_mcp65] =
+ {
+ AHCI_HFLAGS (AHCI_HFLAG_NO_FPDMA_AA | AHCI_HFLAG_NO_PMP |
+@@ -302,14 +316,14 @@ static const struct pci_device_id ahci_pci_tbl[] = {
+ { PCI_VDEVICE(INTEL, 0x1f27), board_ahci }, /* Avoton RAID */
+ { PCI_VDEVICE(INTEL, 0x1f2e), board_ahci }, /* Avoton RAID */
+ { PCI_VDEVICE(INTEL, 0x1f2f), board_ahci }, /* Avoton RAID */
+- { PCI_VDEVICE(INTEL, 0x1f32), board_ahci }, /* Avoton AHCI */
+- { PCI_VDEVICE(INTEL, 0x1f33), board_ahci }, /* Avoton AHCI */
+- { PCI_VDEVICE(INTEL, 0x1f34), board_ahci }, /* Avoton RAID */
+- { PCI_VDEVICE(INTEL, 0x1f35), board_ahci }, /* Avoton RAID */
+- { PCI_VDEVICE(INTEL, 0x1f36), board_ahci }, /* Avoton RAID */
+- { PCI_VDEVICE(INTEL, 0x1f37), board_ahci }, /* Avoton RAID */
+- { PCI_VDEVICE(INTEL, 0x1f3e), board_ahci }, /* Avoton RAID */
+- { PCI_VDEVICE(INTEL, 0x1f3f), board_ahci }, /* Avoton RAID */
++ { PCI_VDEVICE(INTEL, 0x1f32), board_ahci_avn }, /* Avoton AHCI */
++ { PCI_VDEVICE(INTEL, 0x1f33), board_ahci_avn }, /* Avoton AHCI */
++ { PCI_VDEVICE(INTEL, 0x1f34), board_ahci_avn }, /* Avoton RAID */
++ { PCI_VDEVICE(INTEL, 0x1f35), board_ahci_avn }, /* Avoton RAID */
++ { PCI_VDEVICE(INTEL, 0x1f36), board_ahci_avn }, /* Avoton RAID */
++ { PCI_VDEVICE(INTEL, 0x1f37), board_ahci_avn }, /* Avoton RAID */
++ { PCI_VDEVICE(INTEL, 0x1f3e), board_ahci_avn }, /* Avoton RAID */
++ { PCI_VDEVICE(INTEL, 0x1f3f), board_ahci_avn }, /* Avoton RAID */
+ { PCI_VDEVICE(INTEL, 0x8d02), board_ahci }, /* Wellsburg AHCI */
+ { PCI_VDEVICE(INTEL, 0x8d04), board_ahci }, /* Wellsburg RAID */
+ { PCI_VDEVICE(INTEL, 0x8d06), board_ahci }, /* Wellsburg RAID */
+@@ -680,6 +694,78 @@ static int ahci_p5wdh_hardreset(struct ata_link *link, unsigned int *class,
+ return rc;
+ }
+
++/*
++ * ahci_avn_hardreset - attempt more aggressive recovery of Avoton ports.
++ *
++ * It has been observed with some SSDs that the timing of events in the
++ * link synchronization phase can leave the port in a state that can not
++ * be recovered by a SATA-hard-reset alone. The failing signature is
++ * SStatus.DET stuck at 1 ("Device presence detected but Phy
++ * communication not established"). It was found that unloading and
++ * reloading the driver when this problem occurs allows the drive
++ * connection to be recovered (DET advanced to 0x3). The critical
++ * component of reloading the driver is that the port state machines are
++ * reset by bouncing "port enable" in the AHCI PCS configuration
++ * register. So, reproduce that effect by bouncing a port whenever we
++ * see DET==1 after a reset.
++ */
++static int ahci_avn_hardreset(struct ata_link *link, unsigned int *class,
++ unsigned long deadline)
++{
++ const unsigned long *timing = sata_ehc_deb_timing(&link->eh_context);
++ struct ata_port *ap = link->ap;
++ struct ahci_port_priv *pp = ap->private_data;
++ u8 *d2h_fis = pp->rx_fis + RX_FIS_D2H_REG;
++ unsigned long tmo = deadline - jiffies;
++ struct ata_taskfile tf;
++ bool online;
++ int rc, i;
++
++ DPRINTK("ENTER\n");
++
++ ahci_stop_engine(ap);
++
++ for (i = 0; i < 2; i++) {
++ u16 val;
++ u32 sstatus;
++ int port = ap->port_no;
++ struct ata_host *host = ap->host;
++ struct pci_dev *pdev = to_pci_dev(host->dev);
++
++ /* clear D2H reception area to properly wait for D2H FIS */
++ ata_tf_init(link->device, &tf);
++ tf.command = ATA_BUSY;
++ ata_tf_to_fis(&tf, 0, 0, d2h_fis);
++
++ rc = sata_link_hardreset(link, timing, deadline, &online,
++ ahci_check_ready);
++
++ if (sata_scr_read(link, SCR_STATUS, &sstatus) != 0 ||
++ (sstatus & 0xf) != 1)
++ break;
++
++ ata_link_printk(link, KERN_INFO, "avn bounce port%d\n",
++ port);
++
++ pci_read_config_word(pdev, 0x92, &val);
++ val &= ~(1 << port);
++ pci_write_config_word(pdev, 0x92, val);
++ ata_msleep(ap, 1000);
++ val |= 1 << port;
++ pci_write_config_word(pdev, 0x92, val);
++ deadline += tmo;
++ }
++
++ ahci_start_engine(ap);
++
++ if (online)
++ *class = ahci_dev_classify(ap);
++
++ DPRINTK("EXIT, rc=%d, class=%u\n", rc, *class);
++ return rc;
++}
++
++
+ #ifdef CONFIG_PM
+ static int ahci_pci_device_suspend(struct pci_dev *pdev, pm_message_t mesg)
+ {
+diff --git a/drivers/ata/ahci.h b/drivers/ata/ahci.h
+index b175000..cdf58f7 100644
+--- a/drivers/ata/ahci.h
++++ b/drivers/ata/ahci.h
+@@ -314,6 +314,7 @@ extern struct device_attribute *ahci_sdev_attrs[];
+ extern struct ata_port_operations ahci_ops;
+ extern struct ata_port_operations ahci_pmp_retry_srst_ops;
+
++unsigned int ahci_dev_classify(struct ata_port *ap);
+ void ahci_fill_cmd_slot(struct ahci_port_priv *pp, unsigned int tag,
+ u32 opts);
+ void ahci_save_initial_config(struct device *dev,
+diff --git a/drivers/ata/libahci.c b/drivers/ata/libahci.c
+index de2802c..41ffb8c 100644
+--- a/drivers/ata/libahci.c
++++ b/drivers/ata/libahci.c
+@@ -1137,7 +1137,7 @@ static void ahci_dev_config(struct ata_device *dev)
+ }
+ }
+
+-static unsigned int ahci_dev_classify(struct ata_port *ap)
++unsigned int ahci_dev_classify(struct ata_port *ap)
+ {
+ void __iomem *port_mmio = ahci_port_base(ap);
+ struct ata_taskfile tf;
+@@ -1151,6 +1151,7 @@ static unsigned int ahci_dev_classify(struct ata_port *ap)
+
+ return ata_dev_classify(&tf);
+ }
++EXPORT_SYMBOL_GPL(ahci_dev_classify);
+
+ void ahci_fill_cmd_slot(struct ahci_port_priv *pp, unsigned int tag,
+ u32 opts)
+@@ -1668,8 +1669,7 @@ static void ahci_port_intr(struct ata_port *ap)
+ if (unlikely(resetting))
+ status &= ~PORT_IRQ_BAD_PMP;
+
+- /* if LPM is enabled, PHYRDY doesn't mean anything */
+- if (ap->link.lpm_policy > ATA_LPM_MAX_POWER) {
++ if (sata_lpm_ignore_phy_events(&ap->link)) {
+ status &= ~PORT_IRQ_PHYRDY;
+ ahci_scr_write(&ap->link, SCR_ERROR, SERR_PHYRDY_CHG);
+ }
+diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
+index 5d8fc3d..fcd8586 100644
+--- a/drivers/ata/libata-core.c
++++ b/drivers/ata/libata-core.c
+@@ -6615,6 +6615,38 @@ u32 ata_wait_register(struct ata_port *ap, void __iomem *reg, u32 mask, u32 val,
+ return tmp;
+ }
+
++/**
++ * sata_lpm_ignore_phy_events - test if PHY event should be ignored
++ * @link: Link receiving the event
++ *
++ * Test whether the received PHY event has to be ignored or not.
++ *
++ * LOCKING:
++ * None:
++ *
++ * RETURNS:
++ * True if the event has to be ignored.
++ */
++bool sata_lpm_ignore_phy_events(struct ata_link *link)
++{
++ unsigned long lpm_timeout = link->last_lpm_change +
++ msecs_to_jiffies(ATA_TMOUT_SPURIOUS_PHY);
++
++ /* if LPM is enabled, PHYRDY doesn't mean anything */
++ if (link->lpm_policy > ATA_LPM_MAX_POWER)
++ return true;
++
++ /* ignore the first PHY event after the LPM policy changed
++ * as it is might be spurious
++ */
++ if ((link->flags & ATA_LFLAG_CHANGED) &&
++ time_before(jiffies, lpm_timeout))
++ return true;
++
++ return false;
++}
++EXPORT_SYMBOL_GPL(sata_lpm_ignore_phy_events);
++
+ /*
+ * Dummy port_ops
+ */
+diff --git a/drivers/ata/libata-eh.c b/drivers/ata/libata-eh.c
+index 7d1a478..f54b0775 100644
+--- a/drivers/ata/libata-eh.c
++++ b/drivers/ata/libata-eh.c
+@@ -3423,6 +3423,9 @@ static int ata_eh_set_lpm(struct ata_link *link, enum ata_lpm_policy policy,
+ }
+ }
+
++ link->last_lpm_change = jiffies;
++ link->flags |= ATA_LFLAG_CHANGED;
++
+ return 0;
+
+ fail:
+diff --git a/drivers/bluetooth/ath3k.c b/drivers/bluetooth/ath3k.c
+index 3eb6ad2..9f32f43 100644
+--- a/drivers/bluetooth/ath3k.c
++++ b/drivers/bluetooth/ath3k.c
+@@ -63,6 +63,7 @@ static struct usb_device_id ath3k_table[] = {
+ /* Atheros AR3011 with sflash firmware*/
+ { USB_DEVICE(0x0489, 0xE027) },
+ { USB_DEVICE(0x0489, 0xE03D) },
++ { USB_DEVICE(0x04F2, 0xAFF1) },
+ { USB_DEVICE(0x0930, 0x0215) },
+ { USB_DEVICE(0x0CF3, 0x3002) },
+ { USB_DEVICE(0x0CF3, 0xE019) },
+diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
+index 5c385e5..92973a3 100644
+--- a/drivers/bluetooth/btusb.c
++++ b/drivers/bluetooth/btusb.c
+@@ -148,6 +148,7 @@ static struct usb_device_id blacklist_table[] = {
+ /* Atheros 3011 with sflash firmware */
+ { USB_DEVICE(0x0489, 0xe027), .driver_info = BTUSB_IGNORE },
+ { USB_DEVICE(0x0489, 0xe03d), .driver_info = BTUSB_IGNORE },
++ { USB_DEVICE(0x04f2, 0xaff1), .driver_info = BTUSB_IGNORE },
+ { USB_DEVICE(0x0930, 0x0215), .driver_info = BTUSB_IGNORE },
+ { USB_DEVICE(0x0cf3, 0x3002), .driver_info = BTUSB_IGNORE },
+ { USB_DEVICE(0x0cf3, 0xe019), .driver_info = BTUSB_IGNORE },
+diff --git a/drivers/edac/Kconfig b/drivers/edac/Kconfig
+index 5948a21..203361e 100644
+--- a/drivers/edac/Kconfig
++++ b/drivers/edac/Kconfig
+@@ -214,7 +214,7 @@ config EDAC_I7300
+
+ config EDAC_SBRIDGE
+ tristate "Intel Sandy-Bridge Integrated MC"
+- depends on EDAC_MM_EDAC && PCI && X86_64 && X86_MCE_INTEL
++ depends on EDAC_MM_EDAC && PCI && X86 && X86_MCE_INTEL
+ depends on EXPERIMENTAL
+ help
+ Support for error detection and correction the Intel
+diff --git a/drivers/edac/sb_edac.c b/drivers/edac/sb_edac.c
+index da71881..f8f790c 100644
+--- a/drivers/edac/sb_edac.c
++++ b/drivers/edac/sb_edac.c
+@@ -20,6 +20,7 @@
+ #include <linux/mmzone.h>
+ #include <linux/smp.h>
+ #include <linux/bitmap.h>
++#include <linux/math64.h>
+ #include <asm/processor.h>
+ #include <asm/mce.h>
+
+@@ -671,6 +672,7 @@ static void get_memory_layout(const struct mem_ctl_info *mci)
+ u32 reg;
+ u64 limit, prv = 0;
+ u64 tmp_mb;
++ u32 gb, mb;
+ u32 rir_way;
+
+ /*
+@@ -683,8 +685,9 @@ static void get_memory_layout(const struct mem_ctl_info *mci)
+ pvt->tolm = GET_TOLM(reg);
+ tmp_mb = (1 + pvt->tolm) >> 20;
+
+- debugf0("TOLM: %Lu.%03Lu GB (0x%016Lx)\n",
+- tmp_mb / 1000, tmp_mb % 1000, (u64)pvt->tolm);
++ gb = div_u64_rem(tmp_mb, 1024, &mb);
++ debugf0("TOHM: %u.%03u GB (0x%016Lx)\n",
++ gb, (mb*1000)/1024, (u64)pvt->tohm);
+
+ /* Address range is already 45:25 */
+ pci_read_config_dword(pvt->pci_sad1, TOHM,
+@@ -692,8 +695,9 @@ static void get_memory_layout(const struct mem_ctl_info *mci)
+ pvt->tohm = GET_TOHM(reg);
+ tmp_mb = (1 + pvt->tohm) >> 20;
+
+- debugf0("TOHM: %Lu.%03Lu GB (0x%016Lx)",
+- tmp_mb / 1000, tmp_mb % 1000, (u64)pvt->tohm);
++ gb = div_u64_rem(tmp_mb, 1024, &mb);
++ debugf0("TOHM: %u.%03u GB (0x%016Lx)",
++ gb, (mb*1000)/1024, (u64)pvt->tohm);
+
+ /*
+ * Step 2) Get SAD range and SAD Interleave list
+@@ -715,10 +719,11 @@ static void get_memory_layout(const struct mem_ctl_info *mci)
+ break;
+
+ tmp_mb = (limit + 1) >> 20;
+- debugf0("SAD#%d %s up to %Lu.%03Lu GB (0x%016Lx) %s reg=0x%08x\n",
++ gb = div_u64_rem(tmp_mb, 1000, &mb);
++ debugf0("SAD#%d %s up to %u.%03u GB (0x%016Lx) %s reg=0x%08x\n",
+ n_sads,
+ get_dram_attr(reg),
+- tmp_mb / 1000, tmp_mb % 1000,
++ gb, (mb*1000)/1024,
+ ((u64)tmp_mb) << 20L,
+ INTERLEAVE_MODE(reg) ? "Interleave: 8:6" : "Interleave: [8:6]XOR[18:16]",
+ reg);
+@@ -748,8 +753,9 @@ static void get_memory_layout(const struct mem_ctl_info *mci)
+ break;
+ tmp_mb = (limit + 1) >> 20;
+
+- debugf0("TAD#%d: up to %Lu.%03Lu GB (0x%016Lx), socket interleave %d, memory interleave %d, TGT: %d, %d, %d, %d, reg=0x%08x\n",
+- n_tads, tmp_mb / 1000, tmp_mb % 1000,
++ gb = div_u64_rem(tmp_mb, 1000, &mb);
++ debugf0("TAD#%d: up to %u.%03u GB (0x%016Lx), socket interleave %d, memory interleave %d, TGT: %d, %d, %d, %d, reg=0x%08x\n",
++ n_tads, gb, (mb*1000)/1024,
+ ((u64)tmp_mb) << 20L,
+ (u32)TAD_SOCK(reg),
+ (u32)TAD_CH(reg),
+@@ -772,9 +778,10 @@ static void get_memory_layout(const struct mem_ctl_info *mci)
+ tad_ch_nilv_offset[j],
+ &reg);
+ tmp_mb = TAD_OFFSET(reg) >> 20;
+- debugf0("TAD CH#%d, offset #%d: %Lu.%03Lu GB (0x%016Lx), reg=0x%08x\n",
++ gb = div_u64_rem(tmp_mb, 1024, &mb);
++ debugf0("TAD CH#%d, offset #%d: %u.%03u GB (0x%016Lx), reg=0x%08x\n",
+ i, j,
+- tmp_mb / 1000, tmp_mb % 1000,
++ gb, (mb*1000)/1024,
+ ((u64)tmp_mb) << 20L,
+ reg);
+ }
+@@ -796,9 +803,10 @@ static void get_memory_layout(const struct mem_ctl_info *mci)
+
+ tmp_mb = RIR_LIMIT(reg) >> 20;
+ rir_way = 1 << RIR_WAY(reg);
+- debugf0("CH#%d RIR#%d, limit: %Lu.%03Lu GB (0x%016Lx), way: %d, reg=0x%08x\n",
++ gb = div_u64_rem(tmp_mb, 1024, &mb);
++ debugf0("CH#%d RIR#%d, limit: %u.%03u GB (0x%016Lx), way: %d, reg=0x%08x\n",
+ i, j,
+- tmp_mb / 1000, tmp_mb % 1000,
++ gb, (mb*1000)/1024,
+ ((u64)tmp_mb) << 20L,
+ rir_way,
+ reg);
+@@ -809,9 +817,10 @@ static void get_memory_layout(const struct mem_ctl_info *mci)
+ &reg);
+ tmp_mb = RIR_OFFSET(reg) << 6;
+
+- debugf0("CH#%d RIR#%d INTL#%d, offset %Lu.%03Lu GB (0x%016Lx), tgt: %d, reg=0x%08x\n",
++ gb = div_u64_rem(tmp_mb, 1024, &mb);
++ debugf0("CH#%d RIR#%d INTL#%d, offset %u.%03u GB (0x%016Lx), tgt: %d, reg=0x%08x\n",
+ i, j, k,
+- tmp_mb / 1000, tmp_mb % 1000,
++ gb, (mb*1000)/1024,
+ ((u64)tmp_mb) << 20L,
+ (u32)RIR_RNK_TGT(reg),
+ reg);
+@@ -849,6 +858,7 @@ static int get_memory_error_data(struct mem_ctl_info *mci,
+ u8 ch_way,sck_way;
+ u32 tad_offset;
+ u32 rir_way;
++ u32 gb, mb;
+ u64 ch_addr, offset, limit, prv = 0;
+
+
+@@ -859,7 +869,7 @@ static int get_memory_error_data(struct mem_ctl_info *mci,
+ * range (e. g. VGA addresses). It is unlikely, however, that the
+ * memory controller would generate an error on that range.
+ */
+- if ((addr > (u64) pvt->tolm) && (addr < (1L << 32))) {
++ if ((addr > (u64) pvt->tolm) && (addr < (1LL << 32))) {
+ sprintf(msg, "Error at TOLM area, on addr 0x%08Lx", addr);
+ edac_mc_handle_ce_no_info(mci, msg);
+ return -EINVAL;
+@@ -1054,7 +1064,7 @@ static int get_memory_error_data(struct mem_ctl_info *mci,
+ ch_addr = addr & 0x7f;
+ /* Remove socket wayness and remove 6 bits */
+ addr >>= 6;
+- addr /= sck_xch;
++ addr = div_u64(addr, sck_xch);
+ #if 0
+ /* Divide by channel way */
+ addr = addr / ch_way;
+@@ -1074,10 +1084,10 @@ static int get_memory_error_data(struct mem_ctl_info *mci,
+ continue;
+
+ limit = RIR_LIMIT(reg);
+-
+- debugf0("RIR#%d, limit: %Lu.%03Lu GB (0x%016Lx), way: %d\n",
++ gb = div_u64_rem(limit >> 20, 1024, &mb);
++ debugf0("RIR#%d, limit: %u.%03u GB (0x%016Lx), way: %d\n",
+ n_rir,
+- (limit >> 20) / 1000, (limit >> 20) % 1000,
++ gb, (mb*1000)/1024,
+ limit,
+ 1 << RIR_WAY(reg));
+ if (ch_addr <= limit)
+diff --git a/drivers/firmware/dmi_scan.c b/drivers/firmware/dmi_scan.c
+index 2861ef4..20f7daa 100644
+--- a/drivers/firmware/dmi_scan.c
++++ b/drivers/firmware/dmi_scan.c
+@@ -410,24 +410,48 @@ static void __init dmi_dump_ids(void)
+ printk(KERN_CONT "\n");
+ }
+
+-static int __init dmi_present(const char __iomem *p)
++static int __init dmi_present(const u8 *buf)
+ {
+- u8 buf[15];
++ int smbios_ver;
+
+- memcpy_fromio(buf, p, 15);
+- if (dmi_checksum(buf, 15)) {
++ if (memcmp(buf, "_SM_", 4) == 0 &&
++ buf[5] < 32 && dmi_checksum(buf, buf[5])) {
++ smbios_ver = (buf[6] << 8) + buf[7];
++
++ /* Some BIOS report weird SMBIOS version, fix that up */
++ switch (smbios_ver) {
++ case 0x021F:
++ case 0x0221:
++ pr_debug("SMBIOS version fixup(2.%d->2.%d)\n",
++ smbios_ver & 0xFF, 3);
++ smbios_ver = 0x0203;
++ break;
++ case 0x0233:
++ pr_debug("SMBIOS version fixup(2.%d->2.%d)\n", 51, 6);
++ smbios_ver = 0x0206;
++ break;
++ }
++ } else {
++ smbios_ver = 0;
++ }
++
++ buf += 16;
++
++ if (memcmp(buf, "_DMI_", 5) == 0 && dmi_checksum(buf, 15)) {
++ if (smbios_ver)
++ dmi_ver = smbios_ver;
++ else
++ dmi_ver = (buf[14] & 0xF0) << 4 | (buf[14] & 0x0F);
+ dmi_num = (buf[13] << 8) | buf[12];
+ dmi_len = (buf[7] << 8) | buf[6];
+ dmi_base = (buf[11] << 24) | (buf[10] << 16) |
+ (buf[9] << 8) | buf[8];
+
+ if (dmi_walk_early(dmi_decode) == 0) {
+- if (dmi_ver)
++ if (smbios_ver) {
+ pr_info("SMBIOS %d.%d present.\n",
+ dmi_ver >> 8, dmi_ver & 0xFF);
+- else {
+- dmi_ver = (buf[14] & 0xF0) << 4 |
+- (buf[14] & 0x0F);
++ } else {
+ pr_info("Legacy DMI %d.%d present.\n",
+ dmi_ver >> 8, dmi_ver & 0xFF);
+ }
+@@ -435,40 +459,14 @@ static int __init dmi_present(const char __iomem *p)
+ return 0;
+ }
+ }
+- dmi_ver = 0;
+- return 1;
+-}
+
+-static int __init smbios_present(const char __iomem *p)
+-{
+- u8 buf[32];
+-
+- memcpy_fromio(buf, p, 32);
+- if ((buf[5] < 32) && dmi_checksum(buf, buf[5])) {
+- dmi_ver = (buf[6] << 8) + buf[7];
+-
+- /* Some BIOS report weird SMBIOS version, fix that up */
+- switch (dmi_ver) {
+- case 0x021F:
+- case 0x0221:
+- pr_debug("SMBIOS version fixup(2.%d->2.%d)\n",
+- dmi_ver & 0xFF, 3);
+- dmi_ver = 0x0203;
+- break;
+- case 0x0233:
+- pr_debug("SMBIOS version fixup(2.%d->2.%d)\n", 51, 6);
+- dmi_ver = 0x0206;
+- break;
+- }
+- return memcmp(p + 16, "_DMI_", 5) || dmi_present(p + 16);
+- }
+ return 1;
+ }
+
+ void __init dmi_scan_machine(void)
+ {
+ char __iomem *p, *q;
+- int rc;
++ char buf[32];
+
+ if (efi_enabled(EFI_CONFIG_TABLES)) {
+ if (efi.smbios == EFI_INVALID_TABLE_ADDR)
+@@ -481,10 +479,10 @@ void __init dmi_scan_machine(void)
+ p = dmi_ioremap(efi.smbios, 32);
+ if (p == NULL)
+ goto error;
+-
+- rc = smbios_present(p);
++ memcpy_fromio(buf, p, 32);
+ dmi_iounmap(p, 32);
+- if (!rc) {
++
++ if (!dmi_present(buf)) {
+ dmi_available = 1;
+ goto out;
+ }
+@@ -499,18 +497,15 @@ void __init dmi_scan_machine(void)
+ if (p == NULL)
+ goto error;
+
++ memset(buf, 0, 16);
+ for (q = p; q < p + 0x10000; q += 16) {
+- if (memcmp(q, "_SM_", 4) == 0 && q - p <= 0xFFE0)
+- rc = smbios_present(q);
+- else if (memcmp(q, "_DMI_", 5) == 0)
+- rc = dmi_present(q);
+- else
+- continue;
+- if (!rc) {
++ memcpy_fromio(buf + 16, q, 16);
++ if (!dmi_present(buf)) {
+ dmi_available = 1;
+ dmi_iounmap(p, 0x10000);
+ goto out;
+ }
++ memcpy(buf, buf + 16, 16);
+ }
+ dmi_iounmap(p, 0x10000);
+ }
+diff --git a/drivers/gpio/gpiolib.c b/drivers/gpio/gpiolib.c
+index 36ae055..e901fef 100644
+--- a/drivers/gpio/gpiolib.c
++++ b/drivers/gpio/gpiolib.c
+@@ -726,6 +726,7 @@ static struct class gpio_class = {
+ */
+ int gpio_export(unsigned gpio, bool direction_may_change)
+ {
++ struct gpio_chip *chip;
+ unsigned long flags;
+ struct gpio_desc *desc;
+ int status;
+@@ -743,10 +744,18 @@ int gpio_export(unsigned gpio, bool direction_may_change)
+ return -EINVAL;
+ }
+
++ desc = &gpio_desc[gpio];
++ chip = desc->chip;
++
+ mutex_lock(&sysfs_lock);
+
++ /* check if chip is being removed */
++ if (!chip || !chip->exported) {
++ status = -ENODEV;
++ goto fail_unlock;
++ }
++
+ spin_lock_irqsave(&gpio_lock, flags);
+- desc = &gpio_desc[gpio];
+ if (!test_bit(FLAG_REQUESTED, &desc->flags) ||
+ test_bit(FLAG_EXPORT, &desc->flags)) {
+ spin_unlock_irqrestore(&gpio_lock, flags);
+@@ -973,12 +982,15 @@ static void gpiochip_unexport(struct gpio_chip *chip)
+ {
+ int status;
+ struct device *dev;
++ struct gpio_desc *desc;
++ unsigned int i;
+
+ mutex_lock(&sysfs_lock);
+ dev = class_find_device(&gpio_class, NULL, chip, match_export);
+ if (dev) {
+ put_device(dev);
+ device_unregister(dev);
++ /* prevent further gpiod exports */
+ chip->exported = 0;
+ status = 0;
+ } else
+@@ -988,6 +1000,13 @@ static void gpiochip_unexport(struct gpio_chip *chip)
+ if (status)
+ pr_debug("%s: chip %s status %d\n", __func__,
+ chip->label, status);
++
++ /* unregister gpio class devices owned by sysfs */
++ for (i = 0; i < chip->ngpio; i++) {
++ desc = &gpio_desc[chip->base + i];
++ if (test_and_clear_bit(FLAG_SYSFS, &desc->flags))
++ gpio_free(chip->base + i);
++ }
+ }
+
+ static int __init gpiolib_sysfs_init(void)
+@@ -1137,6 +1156,8 @@ int gpiochip_remove(struct gpio_chip *chip)
+ int status = 0;
+ unsigned id;
+
++ gpiochip_unexport(chip);
++
+ spin_lock_irqsave(&gpio_lock, flags);
+
+ of_gpiochip_remove(chip);
+@@ -1154,9 +1175,6 @@ int gpiochip_remove(struct gpio_chip *chip)
+
+ spin_unlock_irqrestore(&gpio_lock, flags);
+
+- if (status == 0)
+- gpiochip_unexport(chip);
+-
+ return status;
+ }
+ EXPORT_SYMBOL_GPL(gpiochip_remove);
+diff --git a/drivers/gpu/drm/radeon/atombios_crtc.c b/drivers/gpu/drm/radeon/atombios_crtc.c
+index 927d170..76c4f2a 100644
+--- a/drivers/gpu/drm/radeon/atombios_crtc.c
++++ b/drivers/gpu/drm/radeon/atombios_crtc.c
+@@ -302,8 +302,10 @@ atombios_set_crtc_dtd_timing(struct drm_crtc *crtc,
+ misc |= ATOM_COMPOSITESYNC;
+ if (mode->flags & DRM_MODE_FLAG_INTERLACE)
+ misc |= ATOM_INTERLACE;
+- if (mode->flags & DRM_MODE_FLAG_DBLSCAN)
++ if (mode->flags & DRM_MODE_FLAG_DBLCLK)
+ misc |= ATOM_DOUBLE_CLOCK_MODE;
++ if (mode->flags & DRM_MODE_FLAG_DBLSCAN)
++ misc |= ATOM_H_REPLICATIONBY2 | ATOM_V_REPLICATIONBY2;
+
+ args.susModeMiscInfo.usAccess = cpu_to_le16(misc);
+ args.ucCRTC = radeon_crtc->crtc_id;
+@@ -346,8 +348,10 @@ static void atombios_crtc_set_timing(struct drm_crtc *crtc,
+ misc |= ATOM_COMPOSITESYNC;
+ if (mode->flags & DRM_MODE_FLAG_INTERLACE)
+ misc |= ATOM_INTERLACE;
+- if (mode->flags & DRM_MODE_FLAG_DBLSCAN)
++ if (mode->flags & DRM_MODE_FLAG_DBLCLK)
+ misc |= ATOM_DOUBLE_CLOCK_MODE;
++ if (mode->flags & DRM_MODE_FLAG_DBLSCAN)
++ misc |= ATOM_H_REPLICATIONBY2 | ATOM_V_REPLICATIONBY2;
+
+ args.susModeMiscInfo.usAccess = cpu_to_le16(misc);
+ args.ucCRTC = radeon_crtc->crtc_id;
+diff --git a/drivers/hv/channel.c b/drivers/hv/channel.c
+index 44a1ea4..a7e6f03 100644
+--- a/drivers/hv/channel.c
++++ b/drivers/hv/channel.c
+@@ -177,7 +177,7 @@ int vmbus_open(struct vmbus_channel *newchannel, u32 send_ringbuffer_size,
+ GFP_KERNEL);
+ if (!open_info) {
+ err = -ENOMEM;
+- goto error0;
++ goto error_gpadl;
+ }
+
+ init_completion(&open_info->waitevent);
+@@ -193,7 +193,7 @@ int vmbus_open(struct vmbus_channel *newchannel, u32 send_ringbuffer_size,
+
+ if (userdatalen > MAX_USER_DEFINED_BYTES) {
+ err = -EINVAL;
+- goto error0;
++ goto error_gpadl;
+ }
+
+ if (userdatalen)
+@@ -234,6 +234,9 @@ error1:
+ list_del(&open_info->msglistentry);
+ spin_unlock_irqrestore(&vmbus_connection.channelmsg_lock, flags);
+
++error_gpadl:
++ vmbus_teardown_gpadl(newchannel, newchannel->ringbuffer_gpadlhandle);
++
+ error0:
+ free_pages((unsigned long)out,
+ get_order(send_ringbuffer_size + recv_ringbuffer_size));
+diff --git a/drivers/hv/channel_mgmt.c b/drivers/hv/channel_mgmt.c
+index 12b85ff..7f963328b 100644
+--- a/drivers/hv/channel_mgmt.c
++++ b/drivers/hv/channel_mgmt.c
+@@ -606,7 +606,7 @@ int vmbus_request_offers(void)
+ {
+ struct vmbus_channel_message_header *msg;
+ struct vmbus_channel_msginfo *msginfo;
+- int ret, t;
++ int ret;
+
+ msginfo = kmalloc(sizeof(*msginfo) +
+ sizeof(struct vmbus_channel_message_header),
+@@ -614,8 +614,6 @@ int vmbus_request_offers(void)
+ if (!msginfo)
+ return -ENOMEM;
+
+- init_completion(&msginfo->waitevent);
+-
+ msg = (struct vmbus_channel_message_header *)msginfo->msg;
+
+ msg->msgtype = CHANNELMSG_REQUESTOFFERS;
+@@ -629,14 +627,6 @@ int vmbus_request_offers(void)
+ goto cleanup;
+ }
+
+- t = wait_for_completion_timeout(&msginfo->waitevent, 5*HZ);
+- if (t == 0) {
+- ret = -ETIMEDOUT;
+- goto cleanup;
+- }
+-
+-
+-
+ cleanup:
+ kfree(msginfo);
+
+diff --git a/drivers/infiniband/core/umem.c b/drivers/infiniband/core/umem.c
+index 055ebeb..c1fef27 100644
+--- a/drivers/infiniband/core/umem.c
++++ b/drivers/infiniband/core/umem.c
+@@ -94,12 +94,15 @@ struct ib_umem *ib_umem_get(struct ib_ucontext *context, unsigned long addr,
+ if (dmasync)
+ dma_set_attr(DMA_ATTR_WRITE_BARRIER, &attrs);
+
++ if (!size)
++ return ERR_PTR(-EINVAL);
++
+ /*
+ * If the combination of the addr and size requested for this memory
+ * region causes an integer overflow, return error.
+ */
+- if ((PAGE_ALIGN(addr + size) <= size) ||
+- (PAGE_ALIGN(addr + size) <= addr))
++ if (((addr + size) < addr) ||
++ PAGE_ALIGN(addr + size) < (addr + size))
+ return ERR_PTR(-EINVAL);
+
+ if (!can_do_mlock())
+diff --git a/drivers/infiniband/hw/mlx4/qp.c b/drivers/infiniband/hw/mlx4/qp.c
+index a16f0c8..2ed14a7 100644
+--- a/drivers/infiniband/hw/mlx4/qp.c
++++ b/drivers/infiniband/hw/mlx4/qp.c
+@@ -1670,8 +1670,7 @@ static int build_lso_seg(struct mlx4_wqe_lso_seg *wqe, struct ib_send_wr *wr,
+
+ memcpy(wqe->header, wr->wr.ud.header, wr->wr.ud.hlen);
+
+- *lso_hdr_sz = cpu_to_be32((wr->wr.ud.mss - wr->wr.ud.hlen) << 16 |
+- wr->wr.ud.hlen);
++ *lso_hdr_sz = cpu_to_be32(wr->wr.ud.mss << 16 | wr->wr.ud.hlen);
+ *lso_seg_len = halign;
+ return 0;
+ }
+diff --git a/drivers/input/mouse/elantech.c b/drivers/input/mouse/elantech.c
+index 2d5bb5b..548ea99 100644
+--- a/drivers/input/mouse/elantech.c
++++ b/drivers/input/mouse/elantech.c
+@@ -296,7 +296,7 @@ static void elantech_report_semi_mt_data(struct input_dev *dev,
+ unsigned int x2, unsigned int y2)
+ {
+ elantech_set_slot(dev, 0, num_fingers != 0, x1, y1);
+- elantech_set_slot(dev, 1, num_fingers == 2, x2, y2);
++ elantech_set_slot(dev, 1, num_fingers >= 2, x2, y2);
+ }
+
+ /*
+@@ -692,18 +692,18 @@ static int elantech_packet_check_v3(struct psmouse *psmouse)
+ static int elantech_packet_check_v4(struct psmouse *psmouse)
+ {
+ unsigned char *packet = psmouse->packet;
++ unsigned char packet_type = packet[3] & 0x03;
+
+- if ((packet[0] & 0x0c) == 0x04 &&
+- (packet[3] & 0x1f) == 0x11)
++ switch (packet_type) {
++ case 0:
++ return PACKET_V4_STATUS;
++
++ case 1:
+ return PACKET_V4_HEAD;
+
+- if ((packet[0] & 0x0c) == 0x04 &&
+- (packet[3] & 0x1f) == 0x12)
++ case 2:
+ return PACKET_V4_MOTION;
+-
+- if ((packet[0] & 0x0c) == 0x04 &&
+- (packet[3] & 0x1f) == 0x10)
+- return PACKET_V4_STATUS;
++ }
+
+ return PACKET_UNKNOWN;
+ }
+@@ -766,6 +766,21 @@ static psmouse_ret_t elantech_process_byte(struct psmouse *psmouse)
+ }
+
+ /*
++ * This writes the reg_07 value again to the hardware at the end of every
++ * set_rate call because the register loses its value. reg_07 allows setting
++ * absolute mode on v4 hardware
++ */
++static void elantech_set_rate_restore_reg_07(struct psmouse *psmouse,
++ unsigned int rate)
++{
++ struct elantech_data *etd = psmouse->private;
++
++ etd->original_set_rate(psmouse, rate);
++ if (elantech_write_reg(psmouse, 0x07, etd->reg_07))
++ psmouse_err(psmouse, "restoring reg_07 failed\n");
++}
++
++/*
+ * Put the touchpad into absolute mode
+ */
+ static int elantech_set_absolute_mode(struct psmouse *psmouse)
+@@ -1131,10 +1146,11 @@ static bool elantech_is_signature_valid(const unsigned char *param)
+ return true;
+
+ /*
+- * Some models have a revision higher then 20. Meaning param[2] may
+- * be 10 or 20, skip the rates check for these.
++ * Some hw_version >= 4 models have a revision higher then 20. Meaning
++ * that param[2] may be 10 or 20, skip the rates check for these.
+ */
+- if (param[0] == 0x46 && (param[1] & 0xef) == 0x0f && param[2] < 40)
++ if ((param[0] & 0x0f) >= 0x06 && (param[1] & 0xaf) == 0x0f &&
++ param[2] < 40)
+ return true;
+
+ for (i = 0; i < ARRAY_SIZE(rates); i++)
+@@ -1269,6 +1285,12 @@ static int elantech_set_properties(struct elantech_data *etd)
+ etd->hw_version = 3;
+ break;
+ case 6:
++ case 7:
++ case 8:
++ case 9:
++ case 10:
++ case 13:
++ case 14:
+ etd->hw_version = 4;
+ break;
+ default:
+@@ -1353,6 +1375,11 @@ int elantech_init(struct psmouse *psmouse)
+ goto init_fail;
+ }
+
++ if (etd->fw_version == 0x381f17) {
++ etd->original_set_rate = psmouse->set_rate;
++ psmouse->set_rate = elantech_set_rate_restore_reg_07;
++ }
++
+ if (elantech_set_input_params(psmouse)) {
+ psmouse_err(psmouse, "failed to query touchpad range.\n");
+ goto init_fail;
+diff --git a/drivers/input/mouse/elantech.h b/drivers/input/mouse/elantech.h
+index 3569bed..092ac72 100644
+--- a/drivers/input/mouse/elantech.h
++++ b/drivers/input/mouse/elantech.h
+@@ -136,6 +136,7 @@ struct elantech_data {
+ unsigned int width;
+ struct finger_pos mt[ETP_MAX_FINGERS];
+ unsigned char parity[256];
++ void (*original_set_rate)(struct psmouse *psmouse, unsigned int rate);
+ };
+
+ #ifdef CONFIG_MOUSE_PS2_ELANTECH
+diff --git a/drivers/lguest/core.c b/drivers/lguest/core.c
+index b5fdcb7..34842e5 100644
+--- a/drivers/lguest/core.c
++++ b/drivers/lguest/core.c
+@@ -171,7 +171,7 @@ static void unmap_switcher(void)
+ bool lguest_address_ok(const struct lguest *lg,
+ unsigned long addr, unsigned long len)
+ {
+- return (addr+len) / PAGE_SIZE < lg->pfn_limit && (addr+len >= addr);
++ return addr+len <= lg->pfn_limit * PAGE_SIZE && (addr+len >= addr);
+ }
+
+ /*
+diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
+index c293d9c..6056ee7 100644
+--- a/drivers/md/raid5.c
++++ b/drivers/md/raid5.c
+@@ -1554,7 +1554,8 @@ static int resize_stripes(struct r5conf *conf, int newsize)
+
+ conf->slab_cache = sc;
+ conf->active_name = 1-conf->active_name;
+- conf->pool_size = newsize;
++ if (!err)
++ conf->pool_size = newsize;
+ return err;
+ }
+
+diff --git a/drivers/memstick/core/mspro_block.c b/drivers/memstick/core/mspro_block.c
+index 9729b92..f8449d5 100644
+--- a/drivers/memstick/core/mspro_block.c
++++ b/drivers/memstick/core/mspro_block.c
+@@ -760,7 +760,7 @@ static int mspro_block_complete_req(struct memstick_dev *card, int error)
+
+ if (error || (card->current_mrq.tpc == MSPRO_CMD_STOP)) {
+ if (msb->data_dir == READ) {
+- for (cnt = 0; cnt < msb->current_seg; cnt++)
++ for (cnt = 0; cnt < msb->current_seg; cnt++) {
+ t_len += msb->req_sg[cnt].length
+ / msb->page_size;
+
+@@ -768,6 +768,7 @@ static int mspro_block_complete_req(struct memstick_dev *card, int error)
+ t_len += msb->current_page - 1;
+
+ t_len *= msb->page_size;
++ }
+ }
+ } else
+ t_len = blk_rq_bytes(msb->block_req);
+diff --git a/drivers/mmc/core/core.c b/drivers/mmc/core/core.c
+index 411a994..fc7386e 100644
+--- a/drivers/mmc/core/core.c
++++ b/drivers/mmc/core/core.c
+@@ -2424,6 +2424,7 @@ int mmc_pm_notify(struct notifier_block *notify_block,
+ switch (mode) {
+ case PM_HIBERNATION_PREPARE:
+ case PM_SUSPEND_PREPARE:
++ case PM_RESTORE_PREPARE:
+
+ spin_lock_irqsave(&host->lock, flags);
+ host->rescan_disable = 1;
+diff --git a/drivers/mtd/ubi/cdev.c b/drivers/mtd/ubi/cdev.c
+index ad76592..7ac2c05 100644
+--- a/drivers/mtd/ubi/cdev.c
++++ b/drivers/mtd/ubi/cdev.c
+@@ -475,7 +475,7 @@ static long vol_cdev_ioctl(struct file *file, unsigned int cmd,
+ /* Validate the request */
+ err = -EINVAL;
+ if (req.lnum < 0 || req.lnum >= vol->reserved_pebs ||
+- req.bytes < 0 || req.lnum >= vol->usable_leb_size)
++ req.bytes < 0 || req.bytes > vol->usable_leb_size)
+ break;
+ if (req.dtype != UBI_LONGTERM && req.dtype != UBI_SHORTTERM &&
+ req.dtype != UBI_UNKNOWN)
+diff --git a/drivers/mtd/ubi/eba.c b/drivers/mtd/ubi/eba.c
+index cd26da8..22b3636 100644
+--- a/drivers/mtd/ubi/eba.c
++++ b/drivers/mtd/ubi/eba.c
+@@ -1261,7 +1261,8 @@ int ubi_eba_init_scan(struct ubi_device *ubi, struct ubi_scan_info *si)
+ * during re-size.
+ */
+ ubi_scan_move_to_list(sv, seb, &si->erase);
+- vol->eba_tbl[seb->lnum] = seb->pnum;
++ else
++ vol->eba_tbl[seb->lnum] = seb->pnum;
+ }
+ }
+
+diff --git a/drivers/mtd/ubi/misc.c b/drivers/mtd/ubi/misc.c
+index f6a7d7a..b14ab43 100644
+--- a/drivers/mtd/ubi/misc.c
++++ b/drivers/mtd/ubi/misc.c
+@@ -74,6 +74,8 @@ int ubi_check_volume(struct ubi_device *ubi, int vol_id)
+ for (i = 0; i < vol->used_ebs; i++) {
+ int size;
+
++ cond_resched();
++
+ if (i == vol->used_ebs - 1)
+ size = vol->last_eb_bytes;
+ else
+diff --git a/drivers/mtd/ubi/scan.c b/drivers/mtd/ubi/scan.c
+index b2b62de..c5b2357 100644
+--- a/drivers/mtd/ubi/scan.c
++++ b/drivers/mtd/ubi/scan.c
+@@ -408,7 +408,7 @@ static int compare_lebs(struct ubi_device *ubi, const struct ubi_scan_leb *seb,
+ second_is_newer = !second_is_newer;
+ } else {
+ dbg_bld("PEB %d CRC is OK", pnum);
+- bitflips = !!err;
++ bitflips |= !!err;
+ }
+
+ vfree(buf);
+diff --git a/drivers/mtd/ubi/wl.c b/drivers/mtd/ubi/wl.c
+index cf42971..422e5be 100644
+--- a/drivers/mtd/ubi/wl.c
++++ b/drivers/mtd/ubi/wl.c
+@@ -665,7 +665,7 @@ static int wear_leveling_worker(struct ubi_device *ubi, struct ubi_work *wrk,
+ int cancel)
+ {
+ int err, scrubbing = 0, torture = 0, protect = 0, erroneous = 0;
+- int vol_id = -1, uninitialized_var(lnum);
++ int vol_id = -1, lnum = -1;
+ struct ubi_wl_entry *e1, *e2;
+ struct ubi_vid_hdr *vid_hdr;
+
+diff --git a/drivers/net/ethernet/intel/e1000/e1000_main.c b/drivers/net/ethernet/intel/e1000/e1000_main.c
+index 6546191..bd4e598 100644
+--- a/drivers/net/ethernet/intel/e1000/e1000_main.c
++++ b/drivers/net/ethernet/intel/e1000/e1000_main.c
+@@ -149,6 +149,11 @@ static bool e1000_clean_rx_irq(struct e1000_adapter *adapter,
+ static bool e1000_clean_jumbo_rx_irq(struct e1000_adapter *adapter,
+ struct e1000_rx_ring *rx_ring,
+ int *work_done, int work_to_do);
++static void e1000_alloc_dummy_rx_buffers(struct e1000_adapter *adapter,
++ struct e1000_rx_ring *rx_ring,
++ int cleaned_count)
++{
++}
+ static void e1000_alloc_rx_buffers(struct e1000_adapter *adapter,
+ struct e1000_rx_ring *rx_ring,
+ int cleaned_count);
+@@ -3322,8 +3327,11 @@ static int e1000_change_mtu(struct net_device *netdev, int new_mtu)
+ msleep(1);
+ /* e1000_down has a dependency on max_frame_size */
+ hw->max_frame_size = max_frame;
+- if (netif_running(netdev))
++ if (netif_running(netdev)) {
++ /* prevent buffers from being reallocated */
++ adapter->alloc_rx_buf = e1000_alloc_dummy_rx_buffers;
+ e1000_down(adapter);
++ }
+
+ /* NOTE: netdev_alloc_skb reserves 16 bytes, and typically NET_IP_ALIGN
+ * means we reserve 2 more, this pushes us to allocate from the next
+diff --git a/drivers/net/phy/dp83640.c b/drivers/net/phy/dp83640.c
+index 9663e0b..bb335ab 100644
+--- a/drivers/net/phy/dp83640.c
++++ b/drivers/net/phy/dp83640.c
+@@ -42,7 +42,7 @@
+ #define PSF_TX 0x1000
+ #define EXT_EVENT 1
+ #define CAL_EVENT 7
+-#define CAL_TRIGGER 7
++#define CAL_TRIGGER 1
+ #define PER_TRIGGER 6
+
+ /* phyter seems to miss the mark by 16 ns */
+diff --git a/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c b/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c
+index 1644b1f..ec347d2 100644
+--- a/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c
++++ b/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c
+@@ -367,6 +367,7 @@ static struct usb_device_id rtl8192c_usb_ids[] = {
+ {RTL_USB_DEVICE(0x2001, 0x3307, rtl92cu_hal_cfg)}, /*D-Link-Cameo*/
+ {RTL_USB_DEVICE(0x2001, 0x3309, rtl92cu_hal_cfg)}, /*D-Link-Alpha*/
+ {RTL_USB_DEVICE(0x2001, 0x330a, rtl92cu_hal_cfg)}, /*D-Link-Alpha*/
++ {RTL_USB_DEVICE(0x2001, 0x330d, rtl92cu_hal_cfg)}, /*D-Link DWA-131 */
+ {RTL_USB_DEVICE(0x2019, 0xab2b, rtl92cu_hal_cfg)}, /*Planex -Abocom*/
+ {RTL_USB_DEVICE(0x20f4, 0x624d, rtl92cu_hal_cfg)}, /*TRENDNet*/
+ {RTL_USB_DEVICE(0x2357, 0x0100, rtl92cu_hal_cfg)}, /*TP-Link WN8200ND*/
+diff --git a/drivers/net/wireless/rtlwifi/usb.c b/drivers/net/wireless/rtlwifi/usb.c
+index e5fe956..17e6429 100644
+--- a/drivers/net/wireless/rtlwifi/usb.c
++++ b/drivers/net/wireless/rtlwifi/usb.c
+@@ -117,7 +117,7 @@ static int _usbctrl_vendorreq_sync_read(struct usb_device *udev, u8 request,
+ reqtype = REALTEK_USB_VENQT_READ;
+
+ status = usb_control_msg(udev, pipe, request, reqtype, value, index,
+- pdata, len, 0); /* max. timeout */
++ pdata, len, 1000);
+
+ if (status < 0)
+ pr_err("reg 0x%x, usbctrl_vendorreq TimeOut! status:0x%x value=0x%x\n",
+diff --git a/drivers/net/xen-netback/xenbus.c b/drivers/net/xen-netback/xenbus.c
+index 1ce729d..b7d782f 100644
+--- a/drivers/net/xen-netback/xenbus.c
++++ b/drivers/net/xen-netback/xenbus.c
+@@ -27,6 +27,8 @@ struct backend_info {
+ enum xenbus_state frontend_state;
+ struct xenbus_watch hotplug_status_watch;
+ u8 have_hotplug_status_watch:1;
++
++ const char *hotplug_script;
+ };
+
+ static int connect_rings(struct backend_info *);
+@@ -45,6 +47,7 @@ static int netback_remove(struct xenbus_device *dev)
+ xenvif_disconnect(be->vif);
+ be->vif = NULL;
+ }
++ kfree(be->hotplug_script);
+ kfree(be);
+ dev_set_drvdata(&dev->dev, NULL);
+ return 0;
+@@ -62,6 +65,7 @@ static int netback_probe(struct xenbus_device *dev,
+ struct xenbus_transaction xbt;
+ int err;
+ int sg;
++ const char *script;
+ struct backend_info *be = kzalloc(sizeof(struct backend_info),
+ GFP_KERNEL);
+ if (!be) {
+@@ -122,6 +126,15 @@ static int netback_probe(struct xenbus_device *dev,
+ goto fail;
+ }
+
++ script = xenbus_read(XBT_NIL, dev->nodename, "script", NULL);
++ if (IS_ERR(script)) {
++ err = PTR_ERR(script);
++ xenbus_dev_fatal(dev, err, "reading script");
++ goto fail;
++ }
++
++ be->hotplug_script = script;
++
+ err = xenbus_switch_state(dev, XenbusStateInitWait);
+ if (err)
+ goto fail;
+@@ -150,22 +163,14 @@ static int netback_uevent(struct xenbus_device *xdev,
+ struct kobj_uevent_env *env)
+ {
+ struct backend_info *be = dev_get_drvdata(&xdev->dev);
+- char *val;
+
+- val = xenbus_read(XBT_NIL, xdev->nodename, "script", NULL);
+- if (IS_ERR(val)) {
+- int err = PTR_ERR(val);
+- xenbus_dev_fatal(xdev, err, "reading script");
+- return err;
+- } else {
+- if (add_uevent_var(env, "script=%s", val)) {
+- kfree(val);
+- return -ENOMEM;
+- }
+- kfree(val);
+- }
++ if (!be)
++ return 0;
++
++ if (add_uevent_var(env, "script=%s", be->hotplug_script))
++ return -ENOMEM;
+
+- if (!be || !be->vif)
++ if (!be->vif)
+ return 0;
+
+ return add_uevent_var(env, "vif=%s", be->vif->dev->name);
+diff --git a/drivers/of/base.c b/drivers/of/base.c
+index 37639a6..21935580 100644
+--- a/drivers/of/base.c
++++ b/drivers/of/base.c
+@@ -761,6 +761,42 @@ int of_property_read_string_index(struct device_node *np, const char *propname,
+ }
+ EXPORT_SYMBOL_GPL(of_property_read_string_index);
+
++/**
++ * of_property_match_string() - Find string in a list and return index
++ * @np: pointer to node containing string list property
++ * @propname: string list property name
++ * @string: pointer to string to search for in string list
++ *
++ * This function searches a string list property and returns the index
++ * of a specific string value.
++ */
++int of_property_match_string(struct device_node *np, const char *propname,
++ const char *string)
++{
++ struct property *prop = of_find_property(np, propname, NULL);
++ size_t l;
++ int i;
++ const char *p, *end;
++
++ if (!prop)
++ return -EINVAL;
++ if (!prop->value)
++ return -ENODATA;
++
++ p = prop->value;
++ end = p + prop->length;
++
++ for (i = 0; p < end; i++, p += l) {
++ l = strlen(p) + 1;
++ if (p + l > end)
++ return -EILSEQ;
++ pr_debug("comparing %s with %s\n", string, p);
++ if (strcmp(string, p) == 0)
++ return i; /* Found it; return index */
++ }
++ return -ENODATA;
++}
++EXPORT_SYMBOL_GPL(of_property_match_string);
+
+ /**
+ * of_property_count_strings - Find and return the number of strings from a
+diff --git a/drivers/platform/x86/compal-laptop.c b/drivers/platform/x86/compal-laptop.c
+index 8877b83..ba3638e 100644
+--- a/drivers/platform/x86/compal-laptop.c
++++ b/drivers/platform/x86/compal-laptop.c
+@@ -1046,7 +1046,14 @@ static int __devinit compal_probe(struct platform_device *pdev)
+
+ /* Power supply */
+ initialize_power_supply_data(data);
+- power_supply_register(&compal_device->dev, &data->psy);
++ err = power_supply_register(&compal_device->dev, &data->psy);
++ if (err < 0) {
++ hwmon_device_unregister(data->hwmon_dev);
++ sysfs_remove_group(&pdev->dev.kobj,
++ &compal_attribute_group);
++ kfree(data);
++ return err;
++ }
+
+ platform_set_drvdata(pdev, data);
+
+diff --git a/drivers/scsi/3w-9xxx.c b/drivers/scsi/3w-9xxx.c
+index 3868ab2..fb37df6 100644
+--- a/drivers/scsi/3w-9xxx.c
++++ b/drivers/scsi/3w-9xxx.c
+@@ -149,7 +149,6 @@ static int twa_reset_sequence(TW_Device_Extension *tw_dev, int soft_reset);
+ static int twa_scsiop_execute_scsi(TW_Device_Extension *tw_dev, int request_id, char *cdb, int use_sg, TW_SG_Entry *sglistarg);
+ static void twa_scsiop_execute_scsi_complete(TW_Device_Extension *tw_dev, int request_id);
+ static char *twa_string_lookup(twa_message_type *table, unsigned int aen_code);
+-static void twa_unmap_scsi_data(TW_Device_Extension *tw_dev, int request_id);
+
+ /* Functions */
+
+@@ -1352,11 +1351,11 @@ static irqreturn_t twa_interrupt(int irq, void *dev_instance)
+ }
+
+ /* Now complete the io */
++ scsi_dma_unmap(cmd);
++ cmd->scsi_done(cmd);
+ tw_dev->state[request_id] = TW_S_COMPLETED;
+ twa_free_request_id(tw_dev, request_id);
+ tw_dev->posted_request_count--;
+- tw_dev->srb[request_id]->scsi_done(tw_dev->srb[request_id]);
+- twa_unmap_scsi_data(tw_dev, request_id);
+ }
+
+ /* Check for valid status after each drain */
+@@ -1414,26 +1413,6 @@ static void twa_load_sgl(TW_Device_Extension *tw_dev, TW_Command_Full *full_comm
+ }
+ } /* End twa_load_sgl() */
+
+-/* This function will perform a pci-dma mapping for a scatter gather list */
+-static int twa_map_scsi_sg_data(TW_Device_Extension *tw_dev, int request_id)
+-{
+- int use_sg;
+- struct scsi_cmnd *cmd = tw_dev->srb[request_id];
+-
+- use_sg = scsi_dma_map(cmd);
+- if (!use_sg)
+- return 0;
+- else if (use_sg < 0) {
+- TW_PRINTK(tw_dev->host, TW_DRIVER, 0x1c, "Failed to map scatter gather list");
+- return 0;
+- }
+-
+- cmd->SCp.phase = TW_PHASE_SGLIST;
+- cmd->SCp.have_data_in = use_sg;
+-
+- return use_sg;
+-} /* End twa_map_scsi_sg_data() */
+-
+ /* This function will poll for a response interrupt of a request */
+ static int twa_poll_response(TW_Device_Extension *tw_dev, int request_id, int seconds)
+ {
+@@ -1612,9 +1591,11 @@ static int twa_reset_device_extension(TW_Device_Extension *tw_dev)
+ (tw_dev->state[i] != TW_S_INITIAL) &&
+ (tw_dev->state[i] != TW_S_COMPLETED)) {
+ if (tw_dev->srb[i]) {
+- tw_dev->srb[i]->result = (DID_RESET << 16);
+- tw_dev->srb[i]->scsi_done(tw_dev->srb[i]);
+- twa_unmap_scsi_data(tw_dev, i);
++ struct scsi_cmnd *cmd = tw_dev->srb[i];
++
++ cmd->result = (DID_RESET << 16);
++ scsi_dma_unmap(cmd);
++ cmd->scsi_done(cmd);
+ }
+ }
+ }
+@@ -1793,21 +1774,18 @@ static int twa_scsi_queue_lck(struct scsi_cmnd *SCpnt, void (*done)(struct scsi_
+ /* Save the scsi command for use by the ISR */
+ tw_dev->srb[request_id] = SCpnt;
+
+- /* Initialize phase to zero */
+- SCpnt->SCp.phase = TW_PHASE_INITIAL;
+-
+ retval = twa_scsiop_execute_scsi(tw_dev, request_id, NULL, 0, NULL);
+ switch (retval) {
+ case SCSI_MLQUEUE_HOST_BUSY:
++ scsi_dma_unmap(SCpnt);
+ twa_free_request_id(tw_dev, request_id);
+- twa_unmap_scsi_data(tw_dev, request_id);
+ break;
+ case 1:
+- tw_dev->state[request_id] = TW_S_COMPLETED;
+- twa_free_request_id(tw_dev, request_id);
+- twa_unmap_scsi_data(tw_dev, request_id);
+ SCpnt->result = (DID_ERROR << 16);
++ scsi_dma_unmap(SCpnt);
+ done(SCpnt);
++ tw_dev->state[request_id] = TW_S_COMPLETED;
++ twa_free_request_id(tw_dev, request_id);
+ retval = 0;
+ }
+ out:
+@@ -1875,8 +1853,8 @@ static int twa_scsiop_execute_scsi(TW_Device_Extension *tw_dev, int request_id,
+ command_packet->sg_list[0].address = TW_CPU_TO_SGL(tw_dev->generic_buffer_phys[request_id]);
+ command_packet->sg_list[0].length = cpu_to_le32(TW_MIN_SGL_LENGTH);
+ } else {
+- sg_count = twa_map_scsi_sg_data(tw_dev, request_id);
+- if (sg_count == 0)
++ sg_count = scsi_dma_map(srb);
++ if (sg_count < 0)
+ goto out;
+
+ scsi_for_each_sg(srb, sg, sg_count, i) {
+@@ -1991,15 +1969,6 @@ static char *twa_string_lookup(twa_message_type *table, unsigned int code)
+ return(table[index].text);
+ } /* End twa_string_lookup() */
+
+-/* This function will perform a pci-dma unmap */
+-static void twa_unmap_scsi_data(TW_Device_Extension *tw_dev, int request_id)
+-{
+- struct scsi_cmnd *cmd = tw_dev->srb[request_id];
+-
+- if (cmd->SCp.phase == TW_PHASE_SGLIST)
+- scsi_dma_unmap(cmd);
+-} /* End twa_unmap_scsi_data() */
+-
+ /* This function gets called when a disk is coming on-line */
+ static int twa_slave_configure(struct scsi_device *sdev)
+ {
+diff --git a/drivers/scsi/3w-9xxx.h b/drivers/scsi/3w-9xxx.h
+index 040f721..0fdc83c 100644
+--- a/drivers/scsi/3w-9xxx.h
++++ b/drivers/scsi/3w-9xxx.h
+@@ -324,11 +324,6 @@ static twa_message_type twa_error_table[] = {
+ #define TW_CURRENT_DRIVER_BUILD 0
+ #define TW_CURRENT_DRIVER_BRANCH 0
+
+-/* Phase defines */
+-#define TW_PHASE_INITIAL 0
+-#define TW_PHASE_SINGLE 1
+-#define TW_PHASE_SGLIST 2
+-
+ /* Misc defines */
+ #define TW_9550SX_DRAIN_COMPLETED 0xFFFF
+ #define TW_SECTOR_SIZE 512
+diff --git a/drivers/scsi/3w-sas.c b/drivers/scsi/3w-sas.c
+index 13e39e1..c555ccb 100644
+--- a/drivers/scsi/3w-sas.c
++++ b/drivers/scsi/3w-sas.c
+@@ -303,26 +303,6 @@ static int twl_post_command_packet(TW_Device_Extension *tw_dev, int request_id)
+ return 0;
+ } /* End twl_post_command_packet() */
+
+-/* This function will perform a pci-dma mapping for a scatter gather list */
+-static int twl_map_scsi_sg_data(TW_Device_Extension *tw_dev, int request_id)
+-{
+- int use_sg;
+- struct scsi_cmnd *cmd = tw_dev->srb[request_id];
+-
+- use_sg = scsi_dma_map(cmd);
+- if (!use_sg)
+- return 0;
+- else if (use_sg < 0) {
+- TW_PRINTK(tw_dev->host, TW_DRIVER, 0x1, "Failed to map scatter gather list");
+- return 0;
+- }
+-
+- cmd->SCp.phase = TW_PHASE_SGLIST;
+- cmd->SCp.have_data_in = use_sg;
+-
+- return use_sg;
+-} /* End twl_map_scsi_sg_data() */
+-
+ /* This function hands scsi cdb's to the firmware */
+ static int twl_scsiop_execute_scsi(TW_Device_Extension *tw_dev, int request_id, char *cdb, int use_sg, TW_SG_Entry_ISO *sglistarg)
+ {
+@@ -370,8 +350,8 @@ static int twl_scsiop_execute_scsi(TW_Device_Extension *tw_dev, int request_id,
+ if (!sglistarg) {
+ /* Map sglist from scsi layer to cmd packet */
+ if (scsi_sg_count(srb)) {
+- sg_count = twl_map_scsi_sg_data(tw_dev, request_id);
+- if (sg_count == 0)
++ sg_count = scsi_dma_map(srb);
++ if (sg_count <= 0)
+ goto out;
+
+ scsi_for_each_sg(srb, sg, sg_count, i) {
+@@ -1116,15 +1096,6 @@ out:
+ return retval;
+ } /* End twl_initialize_device_extension() */
+
+-/* This function will perform a pci-dma unmap */
+-static void twl_unmap_scsi_data(TW_Device_Extension *tw_dev, int request_id)
+-{
+- struct scsi_cmnd *cmd = tw_dev->srb[request_id];
+-
+- if (cmd->SCp.phase == TW_PHASE_SGLIST)
+- scsi_dma_unmap(cmd);
+-} /* End twl_unmap_scsi_data() */
+-
+ /* This function will handle attention interrupts */
+ static int twl_handle_attention_interrupt(TW_Device_Extension *tw_dev)
+ {
+@@ -1265,11 +1236,11 @@ static irqreturn_t twl_interrupt(int irq, void *dev_instance)
+ }
+
+ /* Now complete the io */
++ scsi_dma_unmap(cmd);
++ cmd->scsi_done(cmd);
+ tw_dev->state[request_id] = TW_S_COMPLETED;
+ twl_free_request_id(tw_dev, request_id);
+ tw_dev->posted_request_count--;
+- tw_dev->srb[request_id]->scsi_done(tw_dev->srb[request_id]);
+- twl_unmap_scsi_data(tw_dev, request_id);
+ }
+
+ /* Check for another response interrupt */
+@@ -1414,10 +1385,12 @@ static int twl_reset_device_extension(TW_Device_Extension *tw_dev, int ioctl_res
+ if ((tw_dev->state[i] != TW_S_FINISHED) &&
+ (tw_dev->state[i] != TW_S_INITIAL) &&
+ (tw_dev->state[i] != TW_S_COMPLETED)) {
+- if (tw_dev->srb[i]) {
+- tw_dev->srb[i]->result = (DID_RESET << 16);
+- tw_dev->srb[i]->scsi_done(tw_dev->srb[i]);
+- twl_unmap_scsi_data(tw_dev, i);
++ struct scsi_cmnd *cmd = tw_dev->srb[i];
++
++ if (cmd) {
++ cmd->result = (DID_RESET << 16);
++ scsi_dma_unmap(cmd);
++ cmd->scsi_done(cmd);
+ }
+ }
+ }
+@@ -1521,9 +1494,6 @@ static int twl_scsi_queue_lck(struct scsi_cmnd *SCpnt, void (*done)(struct scsi_
+ /* Save the scsi command for use by the ISR */
+ tw_dev->srb[request_id] = SCpnt;
+
+- /* Initialize phase to zero */
+- SCpnt->SCp.phase = TW_PHASE_INITIAL;
+-
+ retval = twl_scsiop_execute_scsi(tw_dev, request_id, NULL, 0, NULL);
+ if (retval) {
+ tw_dev->state[request_id] = TW_S_COMPLETED;
+diff --git a/drivers/scsi/3w-sas.h b/drivers/scsi/3w-sas.h
+index d474892..fec6449 100644
+--- a/drivers/scsi/3w-sas.h
++++ b/drivers/scsi/3w-sas.h
+@@ -103,10 +103,6 @@ static char *twl_aen_severity_table[] =
+ #define TW_CURRENT_DRIVER_BUILD 0
+ #define TW_CURRENT_DRIVER_BRANCH 0
+
+-/* Phase defines */
+-#define TW_PHASE_INITIAL 0
+-#define TW_PHASE_SGLIST 2
+-
+ /* Misc defines */
+ #define TW_SECTOR_SIZE 512
+ #define TW_MAX_UNITS 32
+diff --git a/drivers/scsi/3w-xxxx.c b/drivers/scsi/3w-xxxx.c
+index 7fe96ff..86bc5f9 100644
+--- a/drivers/scsi/3w-xxxx.c
++++ b/drivers/scsi/3w-xxxx.c
+@@ -1283,32 +1283,6 @@ static int tw_initialize_device_extension(TW_Device_Extension *tw_dev)
+ return 0;
+ } /* End tw_initialize_device_extension() */
+
+-static int tw_map_scsi_sg_data(struct pci_dev *pdev, struct scsi_cmnd *cmd)
+-{
+- int use_sg;
+-
+- dprintk(KERN_WARNING "3w-xxxx: tw_map_scsi_sg_data()\n");
+-
+- use_sg = scsi_dma_map(cmd);
+- if (use_sg < 0) {
+- printk(KERN_WARNING "3w-xxxx: tw_map_scsi_sg_data(): pci_map_sg() failed.\n");
+- return 0;
+- }
+-
+- cmd->SCp.phase = TW_PHASE_SGLIST;
+- cmd->SCp.have_data_in = use_sg;
+-
+- return use_sg;
+-} /* End tw_map_scsi_sg_data() */
+-
+-static void tw_unmap_scsi_data(struct pci_dev *pdev, struct scsi_cmnd *cmd)
+-{
+- dprintk(KERN_WARNING "3w-xxxx: tw_unmap_scsi_data()\n");
+-
+- if (cmd->SCp.phase == TW_PHASE_SGLIST)
+- scsi_dma_unmap(cmd);
+-} /* End tw_unmap_scsi_data() */
+-
+ /* This function will reset a device extension */
+ static int tw_reset_device_extension(TW_Device_Extension *tw_dev)
+ {
+@@ -1331,8 +1305,8 @@ static int tw_reset_device_extension(TW_Device_Extension *tw_dev)
+ srb = tw_dev->srb[i];
+ if (srb != NULL) {
+ srb->result = (DID_RESET << 16);
+- tw_dev->srb[i]->scsi_done(tw_dev->srb[i]);
+- tw_unmap_scsi_data(tw_dev->tw_pci_dev, tw_dev->srb[i]);
++ scsi_dma_unmap(srb);
++ srb->scsi_done(srb);
+ }
+ }
+ }
+@@ -1779,8 +1753,8 @@ static int tw_scsiop_read_write(TW_Device_Extension *tw_dev, int request_id)
+ command_packet->byte8.io.lba = lba;
+ command_packet->byte6.block_count = num_sectors;
+
+- use_sg = tw_map_scsi_sg_data(tw_dev->tw_pci_dev, tw_dev->srb[request_id]);
+- if (!use_sg)
++ use_sg = scsi_dma_map(srb);
++ if (use_sg <= 0)
+ return 1;
+
+ scsi_for_each_sg(tw_dev->srb[request_id], sg, use_sg, i) {
+@@ -1967,9 +1941,6 @@ static int tw_scsi_queue_lck(struct scsi_cmnd *SCpnt, void (*done)(struct scsi_c
+ /* Save the scsi command for use by the ISR */
+ tw_dev->srb[request_id] = SCpnt;
+
+- /* Initialize phase to zero */
+- SCpnt->SCp.phase = TW_PHASE_INITIAL;
+-
+ switch (*command) {
+ case READ_10:
+ case READ_6:
+@@ -2196,12 +2167,11 @@ static irqreturn_t tw_interrupt(int irq, void *dev_instance)
+
+ /* Now complete the io */
+ if ((error != TW_ISR_DONT_COMPLETE)) {
++ scsi_dma_unmap(tw_dev->srb[request_id]);
++ tw_dev->srb[request_id]->scsi_done(tw_dev->srb[request_id]);
+ tw_dev->state[request_id] = TW_S_COMPLETED;
+ tw_state_request_finish(tw_dev, request_id);
+ tw_dev->posted_request_count--;
+- tw_dev->srb[request_id]->scsi_done(tw_dev->srb[request_id]);
+-
+- tw_unmap_scsi_data(tw_dev->tw_pci_dev, tw_dev->srb[request_id]);
+ }
+ }
+
+diff --git a/drivers/scsi/3w-xxxx.h b/drivers/scsi/3w-xxxx.h
+index 49dcf03..1d31858 100644
+--- a/drivers/scsi/3w-xxxx.h
++++ b/drivers/scsi/3w-xxxx.h
+@@ -195,11 +195,6 @@ static unsigned char tw_sense_table[][4] =
+ #define TW_AEN_SMART_FAIL 0x000F
+ #define TW_AEN_SBUF_FAIL 0x0024
+
+-/* Phase defines */
+-#define TW_PHASE_INITIAL 0
+-#define TW_PHASE_SINGLE 1
+-#define TW_PHASE_SGLIST 2
+-
+ /* Misc defines */
+ #define TW_ALIGNMENT_6000 64 /* 64 bytes */
+ #define TW_ALIGNMENT_7000 4 /* 4 bytes */
+diff --git a/drivers/scsi/megaraid/megaraid_sas_fusion.c b/drivers/scsi/megaraid/megaraid_sas_fusion.c
+index bfd87fa..3e0f71c 100644
+--- a/drivers/scsi/megaraid/megaraid_sas_fusion.c
++++ b/drivers/scsi/megaraid/megaraid_sas_fusion.c
+@@ -1426,11 +1426,11 @@ megasas_build_ldio_fusion(struct megasas_instance *instance,
+ fp_possible = io_info.fpOkForIo;
+ }
+
+- /* Use smp_processor_id() for now until cmd->request->cpu is CPU
++ /* Use raw_smp_processor_id() for now until cmd->request->cpu is CPU
+ id by default, not CPU group id, otherwise all MSI-X queues won't
+ be utilized */
+ cmd->request_desc->SCSIIO.MSIxIndex = instance->msix_vectors ?
+- smp_processor_id() % instance->msix_vectors : 0;
++ raw_smp_processor_id() % instance->msix_vectors : 0;
+
+ if (fp_possible) {
+ megasas_set_pd_lba(io_request, scp->cmd_len, &io_info, scp,
+diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c
+index 5c6b5f5..a50825b 100644
+--- a/drivers/scsi/sd.c
++++ b/drivers/scsi/sd.c
+@@ -1338,6 +1338,7 @@ static unsigned int sd_completed_bytes(struct scsi_cmnd *scmd)
+ {
+ u64 start_lba = blk_rq_pos(scmd->request);
+ u64 end_lba = blk_rq_pos(scmd->request) + (scsi_bufflen(scmd) / 512);
++ u64 factor = scmd->device->sector_size / 512;
+ u64 bad_lba;
+ int info_valid;
+ /*
+@@ -1359,16 +1360,9 @@ static unsigned int sd_completed_bytes(struct scsi_cmnd *scmd)
+ if (scsi_bufflen(scmd) <= scmd->device->sector_size)
+ return 0;
+
+- if (scmd->device->sector_size < 512) {
+- /* only legitimate sector_size here is 256 */
+- start_lba <<= 1;
+- end_lba <<= 1;
+- } else {
+- /* be careful ... don't want any overflows */
+- u64 factor = scmd->device->sector_size / 512;
+- do_div(start_lba, factor);
+- do_div(end_lba, factor);
+- }
++ /* be careful ... don't want any overflows */
++ do_div(start_lba, factor);
++ do_div(end_lba, factor);
+
+ /* The bad lba was reported incorrectly, we have no idea where
+ * the error is.
+@@ -1895,8 +1889,7 @@ got_data:
+ if (sector_size != 512 &&
+ sector_size != 1024 &&
+ sector_size != 2048 &&
+- sector_size != 4096 &&
+- sector_size != 256) {
++ sector_size != 4096) {
+ sd_printk(KERN_NOTICE, sdkp, "Unsupported sector size %d.\n",
+ sector_size);
+ /*
+@@ -1945,8 +1938,6 @@ got_data:
+ sdkp->capacity <<= 2;
+ else if (sector_size == 1024)
+ sdkp->capacity <<= 1;
+- else if (sector_size == 256)
+- sdkp->capacity >>= 1;
+
+ blk_queue_physical_block_size(sdp->request_queue,
+ sdkp->physical_block_size);
+diff --git a/drivers/scsi/sg.c b/drivers/scsi/sg.c
+index 2d25616..b4cac39 100644
+--- a/drivers/scsi/sg.c
++++ b/drivers/scsi/sg.c
+@@ -1687,6 +1687,9 @@ static int sg_start_req(Sg_request *srp, unsigned char *cmd)
+ md->from_user = 0;
+ }
+
++ if (unlikely(iov_count > UIO_MAXIOV))
++ return -EINVAL;
++
+ if (iov_count) {
+ int len, size = sizeof(struct sg_iovec) * iov_count;
+ struct iovec *iov;
+diff --git a/drivers/staging/hv/storvsc_drv.c b/drivers/staging/hv/storvsc_drv.c
+index c43a9e8..54ef3d4 100644
+--- a/drivers/staging/hv/storvsc_drv.c
++++ b/drivers/staging/hv/storvsc_drv.c
+@@ -940,23 +940,24 @@ static unsigned int copy_to_bounce_buffer(struct scatterlist *orig_sgl,
+ if (bounce_sgl[j].length == PAGE_SIZE) {
+ /* full..move to next entry */
+ kunmap_atomic((void *)bounce_addr, KM_IRQ0);
++ bounce_addr = 0;
+ j++;
++ }
+
+- /* if we need to use another bounce buffer */
+- if (srclen || i != orig_sgl_count - 1)
+- bounce_addr =
++ /* if we need to use another bounce buffer */
++ if (srclen && bounce_addr == 0)
++ bounce_addr =
+ (unsigned long)kmap_atomic(
+ sg_page((&bounce_sgl[j])), KM_IRQ0);
+
+- } else if (srclen == 0 && i == orig_sgl_count - 1) {
+- /* unmap the last bounce that is < PAGE_SIZE */
+- kunmap_atomic((void *)bounce_addr, KM_IRQ0);
+- }
+ }
+
+ kunmap_atomic((void *)(src_addr - orig_sgl[i].offset), KM_IRQ0);
+ }
+
++ if (bounce_addr)
++ kunmap_atomic((void *)bounce_addr, KM_IRQ0);
++
+ local_irq_restore(flags);
+
+ return total_copied;
+diff --git a/drivers/staging/line6/pcm.c b/drivers/staging/line6/pcm.c
+index 2d3a420..955c6de 100644
+--- a/drivers/staging/line6/pcm.c
++++ b/drivers/staging/line6/pcm.c
+@@ -88,10 +88,13 @@ static DEVICE_ATTR(impulse_period, S_IWUSR | S_IRUGO, pcm_get_impulse_period,
+
+ int line6_pcm_start(struct snd_line6_pcm *line6pcm, int channels)
+ {
+- unsigned long flags_old =
+- __sync_fetch_and_or(&line6pcm->flags, channels);
+- unsigned long flags_new = flags_old | channels;
+- int err = 0;
++ unsigned long flags_old, flags_new;
++ int err;
++
++ do {
++ flags_old = ACCESS_ONCE(line6pcm->flags);
++ flags_new = flags_old | channels;
++ } while (cmpxchg(&line6pcm->flags, flags_old, flags_new) != flags_old);
+
+ #if LINE6_BACKUP_MONITOR_SIGNAL
+ if (!(line6pcm->line6->properties->capabilities & LINE6_BIT_HWMON)) {
+@@ -133,10 +136,8 @@ int line6_pcm_start(struct snd_line6_pcm *line6pcm, int channels)
+ line6pcm->prev_fsize = 0;
+ err = line6_submit_audio_in_all_urbs(line6pcm);
+
+- if (err < 0) {
+- __sync_fetch_and_and(&line6pcm->flags, ~channels);
+- return err;
+- }
++ if (err < 0)
++ goto fail;
+ }
+
+ if (((flags_old & MASK_PLAYBACK) == 0) &&
+@@ -160,20 +161,29 @@ int line6_pcm_start(struct snd_line6_pcm *line6pcm, int channels)
+ line6pcm->count_out = 0;
+ err = line6_submit_audio_out_all_urbs(line6pcm);
+
+- if (err < 0) {
+- __sync_fetch_and_and(&line6pcm->flags, ~channels);
+- return err;
+- }
++ if (err < 0)
++ goto fail;
+ }
+
+ return 0;
++
++fail:
++ do {
++ flags_old = ACCESS_ONCE(line6pcm->flags);
++ flags_new = flags_old & ~channels;
++ } while (cmpxchg(&line6pcm->flags, flags_old, flags_new) != flags_old);
++
++ return err;
+ }
+
+ int line6_pcm_stop(struct snd_line6_pcm *line6pcm, int channels)
+ {
+- unsigned long flags_old =
+- __sync_fetch_and_and(&line6pcm->flags, ~channels);
+- unsigned long flags_new = flags_old & ~channels;
++ unsigned long flags_old, flags_new;
++
++ do {
++ flags_old = ACCESS_ONCE(line6pcm->flags);
++ flags_new = flags_old & ~channels;
++ } while (cmpxchg(&line6pcm->flags, flags_old, flags_new) != flags_old);
+
+ if (((flags_old & MASK_CAPTURE) != 0) &&
+ ((flags_new & MASK_CAPTURE) == 0)) {
+diff --git a/drivers/staging/panel/panel.c b/drivers/staging/panel/panel.c
+index 4683d5f..9a584da 100644
+--- a/drivers/staging/panel/panel.c
++++ b/drivers/staging/panel/panel.c
+@@ -274,11 +274,11 @@ static unsigned char lcd_bits[LCD_PORTS][LCD_BITS][BIT_STATES];
+ * LCD types
+ */
+ #define LCD_TYPE_NONE 0
+-#define LCD_TYPE_OLD 1
+-#define LCD_TYPE_KS0074 2
+-#define LCD_TYPE_HANTRONIX 3
+-#define LCD_TYPE_NEXCOM 4
+-#define LCD_TYPE_CUSTOM 5
++#define LCD_TYPE_CUSTOM 1
++#define LCD_TYPE_OLD 2
++#define LCD_TYPE_KS0074 3
++#define LCD_TYPE_HANTRONIX 4
++#define LCD_TYPE_NEXCOM 5
+
+ /*
+ * keypad types
+@@ -456,8 +456,7 @@ MODULE_PARM_DESC(keypad_enabled, "Deprecated option, use keypad_type instead");
+ static int lcd_type = -1;
+ module_param(lcd_type, int, 0000);
+ MODULE_PARM_DESC(lcd_type,
+- "LCD type: 0=none, 1=old //, 2=serial ks0074, "
+- "3=hantronix //, 4=nexcom //, 5=compiled-in");
++ "LCD type: 0=none, 1=compiled-in, 2=old, 3=serial ks0074, 4=hantronix, 5=nexcom");
+
+ static int lcd_proto = -1;
+ module_param(lcd_proto, int, 0000);
+diff --git a/drivers/target/target_core_pscsi.c b/drivers/target/target_core_pscsi.c
+index ebf9b60..1fb9e58 100644
+--- a/drivers/target/target_core_pscsi.c
++++ b/drivers/target/target_core_pscsi.c
+@@ -569,6 +569,7 @@ static struct se_device *pscsi_create_virtdevice(
+ " pdv_host_id: %d\n", pdv->pdv_host_id);
+ return ERR_PTR(-EINVAL);
+ }
++ pdv->pdv_lld_host = sh;
+ }
+ } else {
+ if (phv->phv_mode == PHV_VIRUTAL_HOST_ID) {
+@@ -655,6 +656,8 @@ static void pscsi_free_device(void *p)
+ if ((phv->phv_mode == PHV_LLD_SCSI_HOST_NO) &&
+ (phv->phv_lld_host != NULL))
+ scsi_host_put(phv->phv_lld_host);
++ else if (pdv->pdv_lld_host)
++ scsi_host_put(pdv->pdv_lld_host);
+
+ if ((sd->type == TYPE_DISK) || (sd->type == TYPE_ROM))
+ scsi_device_put(sd);
+diff --git a/drivers/target/target_core_pscsi.h b/drivers/target/target_core_pscsi.h
+index fdc17b6..8b0a336 100644
+--- a/drivers/target/target_core_pscsi.h
++++ b/drivers/target/target_core_pscsi.h
+@@ -46,6 +46,7 @@ struct pscsi_dev_virt {
+ struct block_device *pdv_bd;
+ struct scsi_device *pdv_sd;
+ struct se_hba *pdv_se_hba;
++ struct Scsi_Host *pdv_lld_host;
+ } ____cacheline_aligned;
+
+ typedef enum phv_modes {
+diff --git a/drivers/tty/hvc/hvc_xen.c b/drivers/tty/hvc/hvc_xen.c
+index 52fdf60..df8f8e0 100644
+--- a/drivers/tty/hvc/hvc_xen.c
++++ b/drivers/tty/hvc/hvc_xen.c
+@@ -167,7 +167,7 @@ static int __init xen_hvc_init(void)
+
+ if (xen_initial_domain()) {
+ ops = &dom0_hvc_ops;
+- xencons_irq = bind_virq_to_irq(VIRQ_CONSOLE, 0);
++ xencons_irq = bind_virq_to_irq(VIRQ_CONSOLE, 0, false);
+ } else {
+ if (!xen_start_info->console.domU.evtchn)
+ return -ENODEV;
+diff --git a/drivers/tty/serial/of_serial.c b/drivers/tty/serial/of_serial.c
+index 6563cad..746e771 100644
+--- a/drivers/tty/serial/of_serial.c
++++ b/drivers/tty/serial/of_serial.c
+@@ -192,7 +192,6 @@ static struct of_device_id __devinitdata of_platform_serial_table[] = {
+ { .compatible = "ibm,qpace-nwp-serial",
+ .data = (void *)PORT_NWPSERIAL, },
+ #endif
+- { .type = "serial", .data = (void *)PORT_UNKNOWN, },
+ { /* end of list */ },
+ };
+
+diff --git a/drivers/tty/serial/uartlite.c b/drivers/tty/serial/uartlite.c
+index 6cd4143..d9706e7 100644
+--- a/drivers/tty/serial/uartlite.c
++++ b/drivers/tty/serial/uartlite.c
+@@ -573,7 +573,8 @@ MODULE_DEVICE_TABLE(of, ulite_of_match);
+
+ static int __devinit ulite_probe(struct platform_device *pdev)
+ {
+- struct resource *res, *res2;
++ struct resource *res;
++ int irq;
+ int id = pdev->id;
+ #ifdef CONFIG_OF
+ const __be32 *prop;
+@@ -587,11 +588,11 @@ static int __devinit ulite_probe(struct platform_device *pdev)
+ if (!res)
+ return -ENODEV;
+
+- res2 = platform_get_resource(pdev, IORESOURCE_IRQ, 0);
+- if (!res2)
+- return -ENODEV;
++ irq = platform_get_irq(pdev, 0);
++ if (irq <= 0)
++ return -ENXIO;
+
+- return ulite_assign(&pdev->dev, id, res->start, res2->start);
++ return ulite_assign(&pdev->dev, id, res->start, irq);
+ }
+
+ static int __devexit ulite_remove(struct platform_device *pdev)
+diff --git a/drivers/tty/serial/xilinx_uartps.c b/drivers/tty/serial/xilinx_uartps.c
+index b627363..778c39a 100644
+--- a/drivers/tty/serial/xilinx_uartps.c
++++ b/drivers/tty/serial/xilinx_uartps.c
+@@ -941,9 +941,9 @@ static struct uart_driver xuartps_uart_driver = {
+ **/
+ static int __devinit xuartps_probe(struct platform_device *pdev)
+ {
+- int rc;
++ int rc, irq;
+ struct uart_port *port;
+- struct resource *res, *res2;
++ struct resource *res;
+ int clk = 0;
+
+ #ifdef CONFIG_OF
+@@ -964,9 +964,9 @@ static int __devinit xuartps_probe(struct platform_device *pdev)
+ if (!res)
+ return -ENODEV;
+
+- res2 = platform_get_resource(pdev, IORESOURCE_IRQ, 0);
+- if (!res2)
+- return -ENODEV;
++ irq = platform_get_irq(pdev, 0);
++ if (irq <= 0)
++ return -ENXIO;
+
+ /* Initialize the port structure */
+ port = xuartps_get_port();
+@@ -980,7 +980,7 @@ static int __devinit xuartps_probe(struct platform_device *pdev)
+ * and triggers invocation of the config_port() entry point.
+ */
+ port->mapbase = res->start;
+- port->irq = res2->start;
++ port->irq = irq;
+ port->dev = &pdev->dev;
+ port->uartclk = clk;
+ dev_set_drvdata(&pdev->dev, port);
+diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
+index 360ddb5..57d6302 100644
+--- a/drivers/usb/class/cdc-acm.c
++++ b/drivers/usb/class/cdc-acm.c
+@@ -947,11 +947,16 @@ static int acm_probe(struct usb_interface *intf,
+ }
+
+ while (buflen > 0) {
++ elength = buffer[0];
++ if (!elength) {
++ dev_err(&intf->dev, "skipping garbage byte\n");
++ elength = 1;
++ goto next_desc;
++ }
+ if (buffer[1] != USB_DT_CS_INTERFACE) {
+ dev_err(&intf->dev, "skipping garbage\n");
+ goto next_desc;
+ }
+- elength = buffer[0];
+
+ switch (buffer[2]) {
+ case USB_CDC_UNION_TYPE: /* we've found it */
+diff --git a/drivers/usb/class/cdc-wdm.c b/drivers/usb/class/cdc-wdm.c
+index 06dfb4f..d34005b 100644
+--- a/drivers/usb/class/cdc-wdm.c
++++ b/drivers/usb/class/cdc-wdm.c
+@@ -224,7 +224,7 @@ static void wdm_int_callback(struct urb *urb)
+ case USB_CDC_NOTIFY_RESPONSE_AVAILABLE:
+ dev_dbg(&desc->intf->dev,
+ "NOTIFY_RESPONSE_AVAILABLE received: index %d len %d",
+- dr->wIndex, dr->wLength);
++ le16_to_cpu(dr->wIndex), le16_to_cpu(dr->wLength));
+ break;
+
+ case USB_CDC_NOTIFY_NETWORK_CONNECTION:
+@@ -237,14 +237,16 @@ static void wdm_int_callback(struct urb *urb)
+ clear_bit(WDM_POLL_RUNNING, &desc->flags);
+ dev_err(&desc->intf->dev,
+ "unknown notification %d received: index %d len %d\n",
+- dr->bNotificationType, dr->wIndex, dr->wLength);
++ dr->bNotificationType,
++ le16_to_cpu(dr->wIndex),
++ le16_to_cpu(dr->wLength));
+ goto exit;
+ }
+
+ req->bRequestType = (USB_DIR_IN | USB_TYPE_CLASS | USB_RECIP_INTERFACE);
+ req->bRequest = USB_CDC_GET_ENCAPSULATED_RESPONSE;
+ req->wValue = 0;
+- req->wIndex = desc->inum;
++ req->wIndex = desc->inum; /* already converted */
+ req->wLength = cpu_to_le16(desc->wMaxCommand);
+
+ usb_fill_control_urb(
+@@ -401,7 +403,7 @@ static ssize_t wdm_write
+ USB_RECIP_INTERFACE);
+ req->bRequest = USB_CDC_SEND_ENCAPSULATED_COMMAND;
+ req->wValue = 0;
+- req->wIndex = desc->inum;
++ req->wIndex = desc->inum; /* already converted */
+ req->wLength = cpu_to_le16(count);
+ set_bit(WDM_IN_USE, &desc->flags);
+ desc->outbuf = buf;
+@@ -414,7 +416,7 @@ static ssize_t wdm_write
+ dev_err(&desc->intf->dev, "Tx URB error: %d\n", rv);
+ } else {
+ dev_dbg(&desc->intf->dev, "Tx URB has been submitted index=%d",
+- req->wIndex);
++ le16_to_cpu(req->wIndex));
+ }
+ out:
+ usb_autopm_put_interface(desc->intf);
+diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
+index 25e9eb4..a47e29a 100644
+--- a/drivers/usb/host/xhci-ring.c
++++ b/drivers/usb/host/xhci-ring.c
+@@ -2060,8 +2060,13 @@ static int process_isoc_td(struct xhci_hcd *xhci, struct xhci_td *td,
+ break;
+ case COMP_DEV_ERR:
+ case COMP_STALL:
++ frame->status = -EPROTO;
++ skip_td = true;
++ break;
+ case COMP_TX_ERR:
+ frame->status = -EPROTO;
++ if (event_trb != td->last_trb)
++ return 0;
+ skip_td = true;
+ break;
+ case COMP_STOP:
+@@ -2646,7 +2651,7 @@ irqreturn_t xhci_irq(struct usb_hcd *hcd)
+ xhci_halt(xhci);
+ hw_died:
+ spin_unlock(&xhci->lock);
+- return -ESHUTDOWN;
++ return IRQ_HANDLED;
+ }
+
+ /*
+diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h
+index efbdf83..d676ae0 100644
+--- a/drivers/usb/host/xhci.h
++++ b/drivers/usb/host/xhci.h
+@@ -1231,7 +1231,7 @@ union xhci_trb {
+ * since the command ring is 64-byte aligned.
+ * It must also be greater than 16.
+ */
+-#define TRBS_PER_SEGMENT 64
++#define TRBS_PER_SEGMENT 256
+ /* Allow two commands + a link TRB, along with any reserved command TRBs */
+ #define MAX_RSVD_CMD_TRBS (TRBS_PER_SEGMENT - 3)
+ #define SEGMENT_SIZE (TRBS_PER_SEGMENT*16)
+diff --git a/drivers/usb/musb/musb_core.c b/drivers/usb/musb/musb_core.c
+index 641caf8..6f7d84e 100644
+--- a/drivers/usb/musb/musb_core.c
++++ b/drivers/usb/musb/musb_core.c
+@@ -1524,16 +1524,30 @@ irqreturn_t musb_interrupt(struct musb *musb)
+ (devctl & MUSB_DEVCTL_HM) ? "host" : "peripheral",
+ musb->int_usb, musb->int_tx, musb->int_rx);
+
+- /* the core can interrupt us for multiple reasons; docs have
+- * a generic interrupt flowchart to follow
++ /**
++ * According to Mentor Graphics' documentation, flowchart on page 98,
++ * IRQ should be handled as follows:
++ *
++ * . Resume IRQ
++ * . Session Request IRQ
++ * . VBUS Error IRQ
++ * . Suspend IRQ
++ * . Connect IRQ
++ * . Disconnect IRQ
++ * . Reset/Babble IRQ
++ * . SOF IRQ (we're not using this one)
++ * . Endpoint 0 IRQ
++ * . TX Endpoints
++ * . RX Endpoints
++ *
++ * We will be following that flowchart in order to avoid any problems
++ * that might arise with internal Finite State Machine.
+ */
++
+ if (musb->int_usb)
+ retval |= musb_stage0_irq(musb, musb->int_usb,
+ devctl, power);
+
+- /* "stage 1" is handling endpoint irqs */
+-
+- /* handle endpoint 0 first */
+ if (musb->int_tx & 1) {
+ if (devctl & MUSB_DEVCTL_HM)
+ retval |= musb_h_ep0_irq(musb);
+@@ -1541,43 +1555,37 @@ irqreturn_t musb_interrupt(struct musb *musb)
+ retval |= musb_g_ep0_irq(musb);
+ }
+
+- /* RX on endpoints 1-15 */
+- reg = musb->int_rx >> 1;
++ reg = musb->int_tx >> 1;
+ ep_num = 1;
+ while (reg) {
+ if (reg & 1) {
+- /* musb_ep_select(musb->mregs, ep_num); */
+- /* REVISIT just retval = ep->rx_irq(...) */
+ retval = IRQ_HANDLED;
+ if (devctl & MUSB_DEVCTL_HM) {
+ if (is_host_capable())
+- musb_host_rx(musb, ep_num);
++ musb_host_tx(musb, ep_num);
+ } else {
+ if (is_peripheral_capable())
+- musb_g_rx(musb, ep_num);
++ musb_g_tx(musb, ep_num);
+ }
+ }
+-
+ reg >>= 1;
+ ep_num++;
+ }
+
+- /* TX on endpoints 1-15 */
+- reg = musb->int_tx >> 1;
++ reg = musb->int_rx >> 1;
+ ep_num = 1;
+ while (reg) {
+ if (reg & 1) {
+- /* musb_ep_select(musb->mregs, ep_num); */
+- /* REVISIT just retval |= ep->tx_irq(...) */
+ retval = IRQ_HANDLED;
+ if (devctl & MUSB_DEVCTL_HM) {
+ if (is_host_capable())
+- musb_host_tx(musb, ep_num);
++ musb_host_rx(musb, ep_num);
+ } else {
+ if (is_peripheral_capable())
+- musb_g_tx(musb, ep_num);
++ musb_g_rx(musb, ep_num);
+ }
+ }
++
+ reg >>= 1;
+ ep_num++;
+ }
+diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c
+index 7f32c74..073a0f98 100644
+--- a/drivers/usb/serial/cp210x.c
++++ b/drivers/usb/serial/cp210x.c
+@@ -133,6 +133,8 @@ static const struct usb_device_id id_table[] = {
+ { USB_DEVICE(0x10C4, 0x88A5) }, /* Planet Innovation Ingeni ZigBee USB Device */
+ { USB_DEVICE(0x10C4, 0x8946) }, /* Ketra N1 Wireless Interface */
+ { USB_DEVICE(0x10C4, 0x8977) }, /* CEL MeshWorks DevKit Device */
++ { USB_DEVICE(0x10C4, 0x8998) }, /* KCF Technologies PRN */
++ { USB_DEVICE(0x10C4, 0x8A2A) }, /* HubZ dual ZigBee and Z-Wave dongle */
+ { USB_DEVICE(0x10C4, 0xEA60) }, /* Silicon Labs factory default */
+ { USB_DEVICE(0x10C4, 0xEA61) }, /* Silicon Labs factory default */
+ { USB_DEVICE(0x10C4, 0xEA70) }, /* Silicon Labs factory default */
+diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
+index e13ebb0..8257d3b 100644
+--- a/drivers/usb/serial/ftdi_sio.c
++++ b/drivers/usb/serial/ftdi_sio.c
+@@ -723,6 +723,7 @@ static struct usb_device_id id_table_combined [] = {
+ { USB_DEVICE(XSENS_VID, XSENS_AWINDA_DONGLE_PID) },
+ { USB_DEVICE(XSENS_VID, XSENS_AWINDA_STATION_PID) },
+ { USB_DEVICE(XSENS_VID, XSENS_CONVERTER_PID) },
++ { USB_DEVICE(XSENS_VID, XSENS_MTDEVBOARD_PID) },
+ { USB_DEVICE(XSENS_VID, XSENS_MTW_PID) },
+ { USB_DEVICE(FTDI_VID, FTDI_OMNI1509) },
+ { USB_DEVICE(MOBILITY_VID, MOBILITY_USB_SERIAL_PID) },
+diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h
+index 361192c..e4a57bb 100644
+--- a/drivers/usb/serial/ftdi_sio_ids.h
++++ b/drivers/usb/serial/ftdi_sio_ids.h
+@@ -155,6 +155,7 @@
+ #define XSENS_AWINDA_STATION_PID 0x0101
+ #define XSENS_AWINDA_DONGLE_PID 0x0102
+ #define XSENS_MTW_PID 0x0200 /* Xsens MTw */
++#define XSENS_MTDEVBOARD_PID 0x0300 /* Motion Tracker Development Board */
+ #define XSENS_CONVERTER_PID 0xD00D /* Xsens USB-serial converter */
+
+ /* Xsens devices using FTDI VID */
+diff --git a/drivers/usb/serial/pl2303.c b/drivers/usb/serial/pl2303.c
+index 7ba38ea..a440387 100644
+--- a/drivers/usb/serial/pl2303.c
++++ b/drivers/usb/serial/pl2303.c
+@@ -67,7 +67,6 @@ static const struct usb_device_id id_table[] = {
+ { USB_DEVICE(DCU10_VENDOR_ID, DCU10_PRODUCT_ID) },
+ { USB_DEVICE(SITECOM_VENDOR_ID, SITECOM_PRODUCT_ID) },
+ { USB_DEVICE(ALCATEL_VENDOR_ID, ALCATEL_PRODUCT_ID) },
+- { USB_DEVICE(SAMSUNG_VENDOR_ID, SAMSUNG_PRODUCT_ID) },
+ { USB_DEVICE(SIEMENS_VENDOR_ID, SIEMENS_PRODUCT_ID_SX1) },
+ { USB_DEVICE(SIEMENS_VENDOR_ID, SIEMENS_PRODUCT_ID_X65) },
+ { USB_DEVICE(SIEMENS_VENDOR_ID, SIEMENS_PRODUCT_ID_X75) },
+diff --git a/drivers/usb/serial/pl2303.h b/drivers/usb/serial/pl2303.h
+index 71fd9da..e3b7af8 100644
+--- a/drivers/usb/serial/pl2303.h
++++ b/drivers/usb/serial/pl2303.h
+@@ -62,10 +62,6 @@
+ #define ALCATEL_VENDOR_ID 0x11f7
+ #define ALCATEL_PRODUCT_ID 0x02df
+
+-/* Samsung I330 phone cradle */
+-#define SAMSUNG_VENDOR_ID 0x04e8
+-#define SAMSUNG_PRODUCT_ID 0x8001
+-
+ #define SIEMENS_VENDOR_ID 0x11f5
+ #define SIEMENS_PRODUCT_ID_SX1 0x0001
+ #define SIEMENS_PRODUCT_ID_X65 0x0003
+diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h
+index 0e2c2de..68e8552 100644
+--- a/drivers/usb/storage/unusual_devs.h
++++ b/drivers/usb/storage/unusual_devs.h
+@@ -752,6 +752,13 @@ UNUSUAL_DEV( 0x059f, 0x0643, 0x0000, 0x0000,
+ USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+ US_FL_GO_SLOW ),
+
++/* Reported by Christian Schaller <cschalle@redhat.com> */
++UNUSUAL_DEV( 0x059f, 0x0651, 0x0000, 0x0000,
++ "LaCie",
++ "External HDD",
++ USB_SC_DEVICE, USB_PR_DEVICE, NULL,
++ US_FL_NO_WP_DETECT ),
++
+ /* Submitted by Joel Bourquard <numlock@freesurf.ch>
+ * Some versions of this device need the SubClass and Protocol overrides
+ * while others don't.
+diff --git a/drivers/xen/events.c b/drivers/xen/events.c
+index f6227cc..bcf7711 100644
+--- a/drivers/xen/events.c
++++ b/drivers/xen/events.c
+@@ -895,7 +895,7 @@ static int find_virq(unsigned int virq, unsigned int cpu)
+ return rc;
+ }
+
+-int bind_virq_to_irq(unsigned int virq, unsigned int cpu)
++int bind_virq_to_irq(unsigned int virq, unsigned int cpu, bool percpu)
+ {
+ struct evtchn_bind_virq bind_virq;
+ int evtchn, irq, ret;
+@@ -909,8 +909,12 @@ int bind_virq_to_irq(unsigned int virq, unsigned int cpu)
+ if (irq == -1)
+ goto out;
+
+- irq_set_chip_and_handler_name(irq, &xen_percpu_chip,
+- handle_percpu_irq, "virq");
++ if (percpu)
++ irq_set_chip_and_handler_name(irq, &xen_percpu_chip,
++ handle_percpu_irq, "virq");
++ else
++ irq_set_chip_and_handler_name(irq, &xen_dynamic_chip,
++ handle_edge_irq, "virq");
+
+ bind_virq.virq = virq;
+ bind_virq.vcpu = cpu;
+@@ -1023,7 +1027,7 @@ int bind_virq_to_irqhandler(unsigned int virq, unsigned int cpu,
+ {
+ int irq, retval;
+
+- irq = bind_virq_to_irq(virq, cpu);
++ irq = bind_virq_to_irq(virq, cpu, irqflags & IRQF_PERCPU);
+ if (irq < 0)
+ return irq;
+ retval = request_irq(irq, handler, irqflags, devname, dev_id);
+diff --git a/drivers/xen/xen-pciback/conf_space.c b/drivers/xen/xen-pciback/conf_space.c
+index 82ab1c3..bb8cb69 100644
+--- a/drivers/xen/xen-pciback/conf_space.c
++++ b/drivers/xen/xen-pciback/conf_space.c
+@@ -16,8 +16,8 @@
+ #include "conf_space.h"
+ #include "conf_space_quirks.h"
+
+-bool permissive;
+-module_param(permissive, bool, 0644);
++bool xen_pcibk_permissive;
++module_param_named(permissive, xen_pcibk_permissive, bool, 0644);
+
+ /* This is where xen_pcibk_read_config_byte, xen_pcibk_read_config_word,
+ * xen_pcibk_write_config_word, and xen_pcibk_write_config_byte are created. */
+@@ -262,7 +262,7 @@ int xen_pcibk_config_write(struct pci_dev *dev, int offset, int size, u32 value)
+ * This means that some fields may still be read-only because
+ * they have entries in the config_field list that intercept
+ * the write and do nothing. */
+- if (dev_data->permissive || permissive) {
++ if (dev_data->permissive || xen_pcibk_permissive) {
+ switch (size) {
+ case 1:
+ err = pci_write_config_byte(dev, offset,
+diff --git a/drivers/xen/xen-pciback/conf_space.h b/drivers/xen/xen-pciback/conf_space.h
+index 2e1d73d..62461a8 100644
+--- a/drivers/xen/xen-pciback/conf_space.h
++++ b/drivers/xen/xen-pciback/conf_space.h
+@@ -64,7 +64,7 @@ struct config_field_entry {
+ void *data;
+ };
+
+-extern bool permissive;
++extern bool xen_pcibk_permissive;
+
+ #define OFFSET(cfg_entry) ((cfg_entry)->base_offset+(cfg_entry)->field->offset)
+
+diff --git a/drivers/xen/xen-pciback/conf_space_header.c b/drivers/xen/xen-pciback/conf_space_header.c
+index a5bb81a..1667a90 100644
+--- a/drivers/xen/xen-pciback/conf_space_header.c
++++ b/drivers/xen/xen-pciback/conf_space_header.c
+@@ -105,7 +105,7 @@ static int command_write(struct pci_dev *dev, int offset, u16 value, void *data)
+
+ cmd->val = value;
+
+- if (!permissive && (!dev_data || !dev_data->permissive))
++ if (!xen_pcibk_permissive && (!dev_data || !dev_data->permissive))
+ return 0;
+
+ /* Only allow the guest to control certain bits. */
+diff --git a/firmware/ihex2fw.c b/firmware/ihex2fw.c
+index cf38e15..08d90e2 100644
+--- a/firmware/ihex2fw.c
++++ b/firmware/ihex2fw.c
+@@ -86,6 +86,7 @@ int main(int argc, char **argv)
+ case 'j':
+ include_jump = 1;
+ break;
++ default:
+ return usage();
+ }
+ }
+diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c
+index 2aed667..d252462 100644
+--- a/fs/binfmt_elf.c
++++ b/fs/binfmt_elf.c
+@@ -746,6 +746,7 @@ static int load_elf_binary(struct linux_binprm *bprm, struct pt_regs *regs)
+ i < loc->elf_ex.e_phnum; i++, elf_ppnt++) {
+ int elf_prot = 0, elf_flags;
+ unsigned long k, vaddr;
++ unsigned long total_size = 0;
+
+ if (elf_ppnt->p_type != PT_LOAD)
+ continue;
+@@ -809,10 +810,16 @@ static int load_elf_binary(struct linux_binprm *bprm, struct pt_regs *regs)
+ #else
+ load_bias = ELF_PAGESTART(ELF_ET_DYN_BASE - vaddr);
+ #endif
++ total_size = total_mapping_size(elf_phdata,
++ loc->elf_ex.e_phnum);
++ if (!total_size) {
++ retval = -EINVAL;
++ goto out_free_dentry;
++ }
+ }
+
+ error = elf_map(bprm->file, load_bias + vaddr, elf_ppnt,
+- elf_prot, elf_flags, 0);
++ elf_prot, elf_flags, total_size);
+ if (BAD_ADDR(error)) {
+ send_sig(SIGKILL, current, 0);
+ retval = IS_ERR((void *)error) ?
+diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
+index a694317..da528f8 100644
+--- a/fs/btrfs/extent-tree.c
++++ b/fs/btrfs/extent-tree.c
+@@ -5678,12 +5678,11 @@ static int __btrfs_free_reserved_extent(struct btrfs_root *root,
+ return -ENOSPC;
+ }
+
+- if (btrfs_test_opt(root, DISCARD))
+- ret = btrfs_discard_extent(root, start, len, NULL);
+-
+ if (pin)
+ pin_down_extent(root, cache, start, len, 1);
+ else {
++ if (btrfs_test_opt(root, DISCARD))
++ ret = btrfs_discard_extent(root, start, len, NULL);
+ btrfs_add_free_space(cache, start, len);
+ btrfs_update_reserved_bytes(cache, len, RESERVE_FREE);
+ }
+diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
+index 7cbe2f8..52bacff 100644
+--- a/fs/btrfs/ioctl.c
++++ b/fs/btrfs/ioctl.c
+@@ -2263,6 +2263,11 @@ static noinline long btrfs_ioctl_clone(struct file *file, unsigned long srcfd,
+ if (off + len == src->i_size)
+ len = ALIGN(src->i_size, bs) - off;
+
++ if (len == 0) {
++ ret = 0;
++ goto out_unlock;
++ }
++
+ /* verify the end result is block aligned */
+ if (!IS_ALIGNED(off, bs) || !IS_ALIGNED(off + len, bs) ||
+ !IS_ALIGNED(destoff, bs))
+diff --git a/fs/btrfs/xattr.c b/fs/btrfs/xattr.c
+index 3848b04..60ff45e 100644
+--- a/fs/btrfs/xattr.c
++++ b/fs/btrfs/xattr.c
+@@ -310,21 +310,40 @@ const struct xattr_handler *btrfs_xattr_handlers[] = {
+ /*
+ * Check if the attribute is in a supported namespace.
+ *
+- * This applied after the check for the synthetic attributes in the system
++ * This is applied after the check for the synthetic attributes in the system
+ * namespace.
+ */
+-static bool btrfs_is_valid_xattr(const char *name)
++static int btrfs_is_valid_xattr(const char *name)
+ {
+- return !strncmp(name, XATTR_SECURITY_PREFIX,
+- XATTR_SECURITY_PREFIX_LEN) ||
+- !strncmp(name, XATTR_SYSTEM_PREFIX, XATTR_SYSTEM_PREFIX_LEN) ||
+- !strncmp(name, XATTR_TRUSTED_PREFIX, XATTR_TRUSTED_PREFIX_LEN) ||
+- !strncmp(name, XATTR_USER_PREFIX, XATTR_USER_PREFIX_LEN);
++ int len = strlen(name);
++ int prefixlen = 0;
++
++ if (!strncmp(name, XATTR_SECURITY_PREFIX,
++ XATTR_SECURITY_PREFIX_LEN))
++ prefixlen = XATTR_SECURITY_PREFIX_LEN;
++ else if (!strncmp(name, XATTR_SYSTEM_PREFIX, XATTR_SYSTEM_PREFIX_LEN))
++ prefixlen = XATTR_SYSTEM_PREFIX_LEN;
++ else if (!strncmp(name, XATTR_TRUSTED_PREFIX, XATTR_TRUSTED_PREFIX_LEN))
++ prefixlen = XATTR_TRUSTED_PREFIX_LEN;
++ else if (!strncmp(name, XATTR_USER_PREFIX, XATTR_USER_PREFIX_LEN))
++ prefixlen = XATTR_USER_PREFIX_LEN;
++ else
++ return -EOPNOTSUPP;
++
++ /*
++ * The name cannot consist of just prefix
++ */
++ if (len <= prefixlen)
++ return -EINVAL;
++
++ return 0;
+ }
+
+ ssize_t btrfs_getxattr(struct dentry *dentry, const char *name,
+ void *buffer, size_t size)
+ {
++ int ret;
++
+ /*
+ * If this is a request for a synthetic attribute in the system.*
+ * namespace use the generic infrastructure to resolve a handler
+@@ -333,8 +352,9 @@ ssize_t btrfs_getxattr(struct dentry *dentry, const char *name,
+ if (!strncmp(name, XATTR_SYSTEM_PREFIX, XATTR_SYSTEM_PREFIX_LEN))
+ return generic_getxattr(dentry, name, buffer, size);
+
+- if (!btrfs_is_valid_xattr(name))
+- return -EOPNOTSUPP;
++ ret = btrfs_is_valid_xattr(name);
++ if (ret)
++ return ret;
+ return __btrfs_getxattr(dentry->d_inode, name, buffer, size);
+ }
+
+@@ -342,6 +362,7 @@ int btrfs_setxattr(struct dentry *dentry, const char *name, const void *value,
+ size_t size, int flags)
+ {
+ struct btrfs_root *root = BTRFS_I(dentry->d_inode)->root;
++ int ret;
+
+ /*
+ * The permission on security.* and system.* is not checked
+@@ -358,8 +379,9 @@ int btrfs_setxattr(struct dentry *dentry, const char *name, const void *value,
+ if (!strncmp(name, XATTR_SYSTEM_PREFIX, XATTR_SYSTEM_PREFIX_LEN))
+ return generic_setxattr(dentry, name, value, size, flags);
+
+- if (!btrfs_is_valid_xattr(name))
+- return -EOPNOTSUPP;
++ ret = btrfs_is_valid_xattr(name);
++ if (ret)
++ return ret;
+
+ if (size == 0)
+ value = ""; /* empty EA, do not remove */
+@@ -371,6 +393,7 @@ int btrfs_setxattr(struct dentry *dentry, const char *name, const void *value,
+ int btrfs_removexattr(struct dentry *dentry, const char *name)
+ {
+ struct btrfs_root *root = BTRFS_I(dentry->d_inode)->root;
++ int ret;
+
+ /*
+ * The permission on security.* and system.* is not checked
+@@ -387,8 +410,9 @@ int btrfs_removexattr(struct dentry *dentry, const char *name)
+ if (!strncmp(name, XATTR_SYSTEM_PREFIX, XATTR_SYSTEM_PREFIX_LEN))
+ return generic_removexattr(dentry, name);
+
+- if (!btrfs_is_valid_xattr(name))
+- return -EOPNOTSUPP;
++ ret = btrfs_is_valid_xattr(name);
++ if (ret)
++ return ret;
+
+ return __btrfs_setxattr(NULL, dentry->d_inode, name, NULL, 0,
+ XATTR_REPLACE);
+diff --git a/fs/dcache.c b/fs/dcache.c
+index 8bc98af..8a35300 100644
+--- a/fs/dcache.c
++++ b/fs/dcache.c
+@@ -1016,13 +1016,13 @@ ascend:
+ /* might go back up the wrong parent if we have had a rename */
+ if (!locked && read_seqretry(&rename_lock, seq))
+ goto rename_retry;
+- next = child->d_child.next;
+- while (unlikely(child->d_flags & DCACHE_DENTRY_KILLED)) {
++ /* go into the first sibling still alive */
++ do {
++ next = child->d_child.next;
+ if (next == &this_parent->d_subdirs)
+ goto ascend;
+ child = list_entry(next, struct dentry, d_child);
+- next = next->next;
+- }
++ } while (unlikely(child->d_flags & DCACHE_DENTRY_KILLED));
+ rcu_read_unlock();
+ goto resume;
+ }
+@@ -1142,13 +1142,13 @@ ascend:
+ /* might go back up the wrong parent if we have had a rename */
+ if (!locked && read_seqretry(&rename_lock, seq))
+ goto rename_retry;
+- next = child->d_child.next;
+- while (unlikely(child->d_flags & DCACHE_DENTRY_KILLED)) {
++ /* go into the first sibling still alive */
++ do {
++ next = child->d_child.next;
+ if (next == &this_parent->d_subdirs)
+ goto ascend;
+ child = list_entry(next, struct dentry, d_child);
+- next = next->next;
+- }
++ } while (unlikely(child->d_flags & DCACHE_DENTRY_KILLED));
+ rcu_read_unlock();
+ goto resume;
+ }
+@@ -2938,13 +2938,13 @@ ascend:
+ /* might go back up the wrong parent if we have had a rename */
+ if (!locked && read_seqretry(&rename_lock, seq))
+ goto rename_retry;
+- next = child->d_child.next;
+- while (unlikely(child->d_flags & DCACHE_DENTRY_KILLED)) {
++ /* go into the first sibling still alive */
++ do {
++ next = child->d_child.next;
+ if (next == &this_parent->d_subdirs)
+ goto ascend;
+ child = list_entry(next, struct dentry, d_child);
+- next = next->next;
+- }
++ } while (unlikely(child->d_flags & DCACHE_DENTRY_KILLED));
+ rcu_read_unlock();
+ goto resume;
+ }
+diff --git a/fs/debugfs/inode.c b/fs/debugfs/inode.c
+index a15f1e2..74f03b5 100644
+--- a/fs/debugfs/inode.c
++++ b/fs/debugfs/inode.c
+@@ -135,6 +135,7 @@ static void debugfs_evict_inode(struct inode *inode)
+
+ static const struct super_operations debugfs_super_operations = {
+ .evict_inode = debugfs_evict_inode,
++ .statfs = simple_statfs,
+ };
+
+ static int debug_fill_super(struct super_block *sb, void *data, int silent)
+diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c
+index 834d9a1..2da63ab 100644
+--- a/fs/ext4/extents.c
++++ b/fs/ext4/extents.c
+@@ -321,7 +321,7 @@ static int ext4_valid_extent(struct inode *inode, struct ext4_extent *ext)
+ ext4_lblk_t lblock = le32_to_cpu(ext->ee_block);
+ ext4_lblk_t last = lblock + len - 1;
+
+- if (lblock > last)
++ if (len == 0 || lblock > last)
+ return 0;
+ return ext4_data_block_valid(EXT4_SB(inode->i_sb), block, len);
+ }
+@@ -4470,13 +4470,6 @@ long ext4_fallocate(struct file *file, int mode, loff_t offset, loff_t len)
+ struct ext4_map_blocks map;
+ unsigned int credits, blkbits = inode->i_blkbits;
+
+- /*
+- * currently supporting (pre)allocate mode for extent-based
+- * files _only_
+- */
+- if (!(ext4_test_inode_flag(inode, EXT4_INODE_EXTENTS)))
+- return -EOPNOTSUPP;
+-
+ /* Return error if mode is not supported */
+ if (mode & ~(FALLOC_FL_KEEP_SIZE | FALLOC_FL_PUNCH_HOLE))
+ return -EOPNOTSUPP;
+@@ -4497,6 +4490,15 @@ long ext4_fallocate(struct file *file, int mode, loff_t offset, loff_t len)
+ */
+ credits = ext4_chunk_trans_blocks(inode, max_blocks);
+ mutex_lock(&inode->i_mutex);
++
++ /*
++ * We only support preallocation for extent-based files only
++ */
++ if (!(ext4_test_inode_flag(inode, EXT4_INODE_EXTENTS))) {
++ ret = -EOPNOTSUPP;
++ goto out;
++ }
++
+ ret = inode_newsize_ok(inode, (len + offset));
+ if (ret) {
+ mutex_unlock(&inode->i_mutex);
+@@ -4553,6 +4555,7 @@ retry:
+ ret = 0;
+ goto retry;
+ }
++out:
+ mutex_unlock(&inode->i_mutex);
+ trace_ext4_fallocate_exit(inode, offset, max_blocks,
+ ret > 0 ? ret2 : ret);
+diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c
+index c9f2e3d..cd1dd49 100644
+--- a/fs/ext4/namei.c
++++ b/fs/ext4/namei.c
+@@ -1456,7 +1456,7 @@ static int ext4_add_entry(handle_t *handle, struct dentry *dentry,
+ struct inode *inode)
+ {
+ struct inode *dir = dentry->d_parent->d_inode;
+- struct buffer_head *bh;
++ struct buffer_head *bh = NULL;
+ struct ext4_dir_entry_2 *de;
+ struct super_block *sb;
+ int retval;
+@@ -1471,7 +1471,7 @@ static int ext4_add_entry(handle_t *handle, struct dentry *dentry,
+ if (is_dx(dir)) {
+ retval = ext4_dx_add_entry(handle, dentry, inode);
+ if (!retval || (retval != ERR_BAD_DX_DIR))
+- return retval;
++ goto out;
+ ext4_clear_inode_flag(dir, EXT4_INODE_INDEX);
+ dx_fallback++;
+ ext4_mark_inode_dirty(handle, dir);
+@@ -1482,14 +1482,15 @@ static int ext4_add_entry(handle_t *handle, struct dentry *dentry,
+ if(!bh)
+ return retval;
+ retval = add_dirent_to_buf(handle, dentry, inode, NULL, bh);
+- if (retval != -ENOSPC) {
+- brelse(bh);
+- return retval;
+- }
++ if (retval != -ENOSPC)
++ goto out;
+
+ if (blocks == 1 && !dx_fallback &&
+- EXT4_HAS_COMPAT_FEATURE(sb, EXT4_FEATURE_COMPAT_DIR_INDEX))
+- return make_indexed_dir(handle, dentry, inode, bh);
++ EXT4_HAS_COMPAT_FEATURE(sb, EXT4_FEATURE_COMPAT_DIR_INDEX)) {
++ retval = make_indexed_dir(handle, dentry, inode, bh);
++ bh = NULL; /* make_indexed_dir releases bh */
++ goto out;
++ }
+ brelse(bh);
+ }
+ bh = ext4_append(handle, dir, &block, &retval);
+@@ -1499,6 +1500,7 @@ static int ext4_add_entry(handle_t *handle, struct dentry *dentry,
+ de->inode = 0;
+ de->rec_len = ext4_rec_len_to_disk(blocksize, blocksize);
+ retval = add_dirent_to_buf(handle, dentry, inode, de, bh);
++out:
+ brelse(bh);
+ if (retval == 0)
+ ext4_set_inode_state(inode, EXT4_STATE_NEWENTRY);
+diff --git a/fs/fhandle.c b/fs/fhandle.c
+index 6b08864..c9e18f3 100644
+--- a/fs/fhandle.c
++++ b/fs/fhandle.c
+@@ -196,8 +196,9 @@ static int handle_to_path(int mountdirfd, struct file_handle __user *ufh,
+ goto out_err;
+ }
+ /* copy the full handle */
+- if (copy_from_user(handle, ufh,
+- sizeof(struct file_handle) +
++ *handle = f_handle;
++ if (copy_from_user(&handle->f_handle,
++ &ufh->f_handle,
+ f_handle.handle_bytes)) {
+ retval = -EFAULT;
+ goto out_handle;
+diff --git a/fs/jbd2/recovery.c b/fs/jbd2/recovery.c
+index da6d7ba..421834b 100644
+--- a/fs/jbd2/recovery.c
++++ b/fs/jbd2/recovery.c
+@@ -711,11 +711,16 @@ static int scan_revoke_records(journal_t *journal, struct buffer_head *bh,
+ {
+ jbd2_journal_revoke_header_t *header;
+ int offset, max;
++ __u32 rcount;
+ int record_len = 4;
+
+ header = (jbd2_journal_revoke_header_t *) bh->b_data;
+ offset = sizeof(jbd2_journal_revoke_header_t);
+- max = be32_to_cpu(header->r_count);
++ rcount = be32_to_cpu(header->r_count);
++
++ if (rcount > journal->j_blocksize)
++ return -EINVAL;
++ max = rcount;
+
+ if (JBD2_HAS_INCOMPAT_FEATURE(journal, JBD2_FEATURE_INCOMPAT_64BIT))
+ record_len = 8;
+diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c
+index 6e91f8b..d455ea0 100644
+--- a/fs/nfsd/nfs4state.c
++++ b/fs/nfsd/nfs4state.c
+@@ -3272,10 +3272,17 @@ static int check_stateid_generation(stateid_t *in, stateid_t *ref, bool has_sess
+ return nfserr_old_stateid;
+ }
+
++static __be32 nfsd4_check_openowner_confirmed(struct nfs4_ol_stateid *ols)
++{
++ if (ols->st_stateowner->so_is_open_owner &&
++ !(openowner(ols->st_stateowner)->oo_flags & NFS4_OO_CONFIRMED))
++ return nfserr_bad_stateid;
++ return nfs_ok;
++}
++
+ __be32 nfs4_validate_stateid(struct nfs4_client *cl, stateid_t *stateid)
+ {
+ struct nfs4_stid *s;
+- struct nfs4_ol_stateid *ols;
+ __be32 status;
+
+ if (STALE_STATEID(stateid))
+@@ -3289,11 +3296,7 @@ __be32 nfs4_validate_stateid(struct nfs4_client *cl, stateid_t *stateid)
+ return status;
+ if (!(s->sc_type & (NFS4_OPEN_STID | NFS4_LOCK_STID)))
+ return nfs_ok;
+- ols = openlockstateid(s);
+- if (ols->st_stateowner->so_is_open_owner
+- && !(openowner(ols->st_stateowner)->oo_flags & NFS4_OO_CONFIRMED))
+- return nfserr_bad_stateid;
+- return nfs_ok;
++ return nfsd4_check_openowner_confirmed(openlockstateid(s));
+ }
+
+ static __be32 nfsd4_lookup_stateid(stateid_t *stateid, unsigned char typemask, struct nfs4_stid **s)
+@@ -3360,8 +3363,8 @@ nfs4_preprocess_stateid_op(struct nfsd4_compound_state *cstate,
+ status = nfs4_check_fh(current_fh, stp);
+ if (status)
+ goto out;
+- if (stp->st_stateowner->so_is_open_owner
+- && !(openowner(stp->st_stateowner)->oo_flags & NFS4_OO_CONFIRMED))
++ status = nfsd4_check_openowner_confirmed(stp);
++ if (status)
+ goto out;
+ status = nfs4_check_openmode(stp, flags);
+ if (status)
+diff --git a/fs/nilfs2/btree.c b/fs/nilfs2/btree.c
+index ecdbae1..090d8ce 100644
+--- a/fs/nilfs2/btree.c
++++ b/fs/nilfs2/btree.c
+@@ -388,7 +388,7 @@ static int nilfs_btree_root_broken(const struct nilfs_btree_node *node,
+ nchildren = nilfs_btree_node_get_nchildren(node);
+
+ if (unlikely(level < NILFS_BTREE_LEVEL_NODE_MIN ||
+- level > NILFS_BTREE_LEVEL_MAX ||
++ level >= NILFS_BTREE_LEVEL_MAX ||
+ nchildren < 0 ||
+ nchildren > NILFS_BTREE_ROOT_NCHILDREN_MAX)) {
+ pr_crit("NILFS: bad btree root (inode number=%lu): level = %d, flags = 0x%x, nchildren = %d\n",
+diff --git a/fs/ocfs2/dlm/dlmmaster.c b/fs/ocfs2/dlm/dlmmaster.c
+index dbc372e..7ba6ac1 100644
+--- a/fs/ocfs2/dlm/dlmmaster.c
++++ b/fs/ocfs2/dlm/dlmmaster.c
+@@ -729,6 +729,19 @@ lookup:
+ if (tmpres) {
+ spin_unlock(&dlm->spinlock);
+ spin_lock(&tmpres->spinlock);
++
++ /*
++ * Right after dlm spinlock was released, dlm_thread could have
++ * purged the lockres. Check if lockres got unhashed. If so
++ * start over.
++ */
++ if (hlist_unhashed(&tmpres->hash_node)) {
++ spin_unlock(&tmpres->spinlock);
++ dlm_lockres_put(tmpres);
++ tmpres = NULL;
++ goto lookup;
++ }
++
+ /* Wait on the thread that is mastering the resource */
+ if (tmpres->owner == DLM_LOCK_RES_OWNER_UNKNOWN) {
+ __dlm_wait_on_lockres(tmpres);
+diff --git a/fs/omfs/inode.c b/fs/omfs/inode.c
+index e043c4c..f58f1c4 100644
+--- a/fs/omfs/inode.c
++++ b/fs/omfs/inode.c
+@@ -361,7 +361,7 @@ nomem:
+ }
+
+ enum {
+- Opt_uid, Opt_gid, Opt_umask, Opt_dmask, Opt_fmask
++ Opt_uid, Opt_gid, Opt_umask, Opt_dmask, Opt_fmask, Opt_err
+ };
+
+ static const match_table_t tokens = {
+@@ -370,6 +370,7 @@ static const match_table_t tokens = {
+ {Opt_umask, "umask=%o"},
+ {Opt_dmask, "dmask=%o"},
+ {Opt_fmask, "fmask=%o"},
++ {Opt_err, NULL},
+ };
+
+ static int parse_options(char *options, struct omfs_sb_info *sbi)
+diff --git a/fs/pipe.c b/fs/pipe.c
+index 8ca88fc..d2cbeff 100644
+--- a/fs/pipe.c
++++ b/fs/pipe.c
+@@ -103,25 +103,27 @@ void pipe_wait(struct pipe_inode_info *pipe)
+ }
+
+ static int
+-pipe_iov_copy_from_user(void *to, struct iovec *iov, unsigned long len,
+- int atomic)
++pipe_iov_copy_from_user(void *addr, int *offset, struct iovec *iov,
++ size_t *remaining, int atomic)
+ {
+ unsigned long copy;
+
+- while (len > 0) {
++ while (*remaining > 0) {
+ while (!iov->iov_len)
+ iov++;
+- copy = min_t(unsigned long, len, iov->iov_len);
++ copy = min_t(unsigned long, *remaining, iov->iov_len);
+
+ if (atomic) {
+- if (__copy_from_user_inatomic(to, iov->iov_base, copy))
++ if (__copy_from_user_inatomic(addr + *offset,
++ iov->iov_base, copy))
+ return -EFAULT;
+ } else {
+- if (copy_from_user(to, iov->iov_base, copy))
++ if (copy_from_user(addr + *offset,
++ iov->iov_base, copy))
+ return -EFAULT;
+ }
+- to += copy;
+- len -= copy;
++ *offset += copy;
++ *remaining -= copy;
+ iov->iov_base += copy;
+ iov->iov_len -= copy;
+ }
+@@ -129,25 +131,27 @@ pipe_iov_copy_from_user(void *to, struct iovec *iov, unsigned long len,
+ }
+
+ static int
+-pipe_iov_copy_to_user(struct iovec *iov, const void *from, unsigned long len,
+- int atomic)
++pipe_iov_copy_to_user(struct iovec *iov, void *addr, int *offset,
++ size_t *remaining, int atomic)
+ {
+ unsigned long copy;
+
+- while (len > 0) {
++ while (*remaining > 0) {
+ while (!iov->iov_len)
+ iov++;
+- copy = min_t(unsigned long, len, iov->iov_len);
++ copy = min_t(unsigned long, *remaining, iov->iov_len);
+
+ if (atomic) {
+- if (__copy_to_user_inatomic(iov->iov_base, from, copy))
++ if (__copy_to_user_inatomic(iov->iov_base,
++ addr + *offset, copy))
+ return -EFAULT;
+ } else {
+- if (copy_to_user(iov->iov_base, from, copy))
++ if (copy_to_user(iov->iov_base,
++ addr + *offset, copy))
+ return -EFAULT;
+ }
+- from += copy;
+- len -= copy;
++ *offset += copy;
++ *remaining -= copy;
+ iov->iov_base += copy;
+ iov->iov_len -= copy;
+ }
+@@ -383,7 +387,7 @@ pipe_read(struct kiocb *iocb, const struct iovec *_iov,
+ struct pipe_buffer *buf = pipe->bufs + curbuf;
+ const struct pipe_buf_operations *ops = buf->ops;
+ void *addr;
+- size_t chars = buf->len;
++ size_t chars = buf->len, remaining;
+ int error, atomic;
+
+ if (chars > total_len)
+@@ -397,9 +401,11 @@ pipe_read(struct kiocb *iocb, const struct iovec *_iov,
+ }
+
+ atomic = !iov_fault_in_pages_write(iov, chars);
++ remaining = chars;
+ redo:
+ addr = ops->map(pipe, buf, atomic);
+- error = pipe_iov_copy_to_user(iov, addr + buf->offset, chars, atomic);
++ error = pipe_iov_copy_to_user(iov, addr, &buf->offset,
++ &remaining, atomic);
+ ops->unmap(pipe, buf, addr);
+ if (unlikely(error)) {
+ /*
+@@ -414,7 +420,6 @@ redo:
+ break;
+ }
+ ret += chars;
+- buf->offset += chars;
+ buf->len -= chars;
+
+ /* Was it a packet buffer? Clean up and exit */
+@@ -521,6 +526,7 @@ pipe_write(struct kiocb *iocb, const struct iovec *_iov,
+ if (ops->can_merge && offset + chars <= PAGE_SIZE) {
+ int error, atomic = 1;
+ void *addr;
++ size_t remaining = chars;
+
+ error = ops->confirm(pipe, buf);
+ if (error)
+@@ -529,8 +535,8 @@ pipe_write(struct kiocb *iocb, const struct iovec *_iov,
+ iov_fault_in_pages_read(iov, chars);
+ redo1:
+ addr = ops->map(pipe, buf, atomic);
+- error = pipe_iov_copy_from_user(offset + addr, iov,
+- chars, atomic);
++ error = pipe_iov_copy_from_user(addr, &offset, iov,
++ &remaining, atomic);
+ ops->unmap(pipe, buf, addr);
+ ret = error;
+ do_wakeup = 1;
+@@ -565,6 +571,8 @@ redo1:
+ struct page *page = pipe->tmp_page;
+ char *src;
+ int error, atomic = 1;
++ int offset = 0;
++ size_t remaining;
+
+ if (!page) {
+ page = alloc_page(GFP_HIGHUSER);
+@@ -585,14 +593,15 @@ redo1:
+ chars = total_len;
+
+ iov_fault_in_pages_read(iov, chars);
++ remaining = chars;
+ redo2:
+ if (atomic)
+ src = kmap_atomic(page, KM_USER0);
+ else
+ src = kmap(page);
+
+- error = pipe_iov_copy_from_user(src, iov, chars,
+- atomic);
++ error = pipe_iov_copy_from_user(src, &offset, iov,
++ &remaining, atomic);
+ if (atomic)
+ kunmap_atomic(src, KM_USER0);
+ else
+diff --git a/include/acpi/acpixf.h b/include/acpi/acpixf.h
+index f554a93..2ba218e 100644
+--- a/include/acpi/acpixf.h
++++ b/include/acpi/acpixf.h
+@@ -125,7 +125,7 @@ void acpi_free(void *address);
+ */
+ acpi_status acpi_reallocate_root_table(void);
+
+-acpi_status acpi_find_root_pointer(acpi_size *rsdp_address);
++acpi_status acpi_find_root_pointer(acpi_physical_address *rsdp_address);
+
+ acpi_status acpi_load_tables(void);
+
+diff --git a/include/acpi/actypes.h b/include/acpi/actypes.h
+index ed73f67..b0d7ef8 100644
+--- a/include/acpi/actypes.h
++++ b/include/acpi/actypes.h
+@@ -198,9 +198,29 @@ typedef int INT32;
+ typedef s32 acpi_native_int;
+
+ typedef u32 acpi_size;
++
++#ifdef ACPI_32BIT_PHYSICAL_ADDRESS
++
++/*
++ * OSPMs can define this to shrink the size of the structures for 32-bit
++ * none PAE environment. ASL compiler may always define this to generate
++ * 32-bit OSPM compliant tables.
++ */
+ typedef u32 acpi_io_address;
+ typedef u32 acpi_physical_address;
+
++#else /* ACPI_32BIT_PHYSICAL_ADDRESS */
++
++/*
++ * It is reported that, after some calculations, the physical addresses can
++ * wrap over the 32-bit boundary on 32-bit PAE environment.
++ * https://bugzilla.kernel.org/show_bug.cgi?id=87971
++ */
++typedef u64 acpi_io_address;
++typedef u64 acpi_physical_address;
++
++#endif /* ACPI_32BIT_PHYSICAL_ADDRESS */
++
+ #define ACPI_MAX_PTR ACPI_UINT32_MAX
+ #define ACPI_SIZE_MAX ACPI_UINT32_MAX
+
+diff --git a/include/acpi/platform/acenv.h b/include/acpi/platform/acenv.h
+index 5af3ed5..b9f9210 100644
+--- a/include/acpi/platform/acenv.h
++++ b/include/acpi/platform/acenv.h
+@@ -75,6 +75,7 @@
+ #define ACPI_CONSTANT_EVAL_ONLY
+ #define ACPI_LARGE_NAMESPACE_NODE
+ #define ACPI_DATA_TABLE_DISASSEMBLY
++#define ACPI_32BIT_PHYSICAL_ADDRESS
+ #endif
+
+ #ifdef ACPI_EXEC_APP
+diff --git a/include/linux/jhash.h b/include/linux/jhash.h
+index 47cb09e..348c6f4 100644
+--- a/include/linux/jhash.h
++++ b/include/linux/jhash.h
+@@ -145,11 +145,11 @@ static inline u32 jhash2(const u32 *k, u32 length, u32 initval)
+ }
+
+
+-/* jhash_3words - hash exactly 3, 2 or 1 word(s) */
+-static inline u32 jhash_3words(u32 a, u32 b, u32 c, u32 initval)
++/* __jhash_nwords - hash exactly 3, 2 or 1 word(s) */
++static inline u32 __jhash_nwords(u32 a, u32 b, u32 c, u32 initval)
+ {
+- a += JHASH_INITVAL;
+- b += JHASH_INITVAL;
++ a += initval;
++ b += initval;
+ c += initval;
+
+ __jhash_final(a, b, c);
+@@ -157,14 +157,19 @@ static inline u32 jhash_3words(u32 a, u32 b, u32 c, u32 initval)
+ return c;
+ }
+
++static inline u32 jhash_3words(u32 a, u32 b, u32 c, u32 initval)
++{
++ return __jhash_nwords(a, b, c, initval + JHASH_INITVAL + (3 << 2));
++}
++
+ static inline u32 jhash_2words(u32 a, u32 b, u32 initval)
+ {
+- return jhash_3words(a, b, 0, initval);
++ return __jhash_nwords(a, b, 0, initval + JHASH_INITVAL + (2 << 2));
+ }
+
+ static inline u32 jhash_1word(u32 a, u32 initval)
+ {
+- return jhash_3words(a, 0, 0, initval);
++ return __jhash_nwords(a, 0, 0, initval + JHASH_INITVAL + (1 << 2));
+ }
+
+ #endif /* _LINUX_JHASH_H */
+diff --git a/include/linux/libata.h b/include/linux/libata.h
+index 42ac6ad..3d4b5b6 100644
+--- a/include/linux/libata.h
++++ b/include/linux/libata.h
+@@ -182,6 +182,7 @@ enum {
+ ATA_LFLAG_DISABLED = (1 << 6), /* link is disabled */
+ ATA_LFLAG_SW_ACTIVITY = (1 << 7), /* keep activity stats */
+ ATA_LFLAG_NO_LPM = (1 << 8), /* disable LPM on this link */
++ ATA_LFLAG_CHANGED = (1 << 10), /* LPM state changed on this link */
+
+ /* struct ata_port flags */
+ ATA_FLAG_SLAVE_POSS = (1 << 0), /* host supports slave dev */
+@@ -284,6 +285,12 @@ enum {
+ */
+ ATA_TMOUT_PMP_SRST_WAIT = 5000,
+
++ /* When the LPM policy is set to ATA_LPM_MAX_POWER, there might
++ * be a spurious PHY event, so ignore the first PHY event that
++ * occurs within 10s after the policy change.
++ */
++ ATA_TMOUT_SPURIOUS_PHY = 10000,
++
+ /* ATA bus states */
+ BUS_UNKNOWN = 0,
+ BUS_DMA = 1,
+@@ -728,6 +735,8 @@ struct ata_link {
+ struct ata_eh_context eh_context;
+
+ struct ata_device device[ATA_MAX_DEVICES];
++
++ unsigned long last_lpm_change; /* when last LPM change happened */
+ };
+ #define ATA_LINK_CLEAR_BEGIN offsetof(struct ata_link, active_tag)
+ #define ATA_LINK_CLEAR_END offsetof(struct ata_link, device[0])
+@@ -1064,6 +1073,7 @@ extern struct ata_device *ata_dev_pair(struct ata_device *adev);
+ extern int ata_do_set_mode(struct ata_link *link, struct ata_device **r_failed_dev);
+ extern void ata_scsi_port_error_handler(struct Scsi_Host *host, struct ata_port *ap);
+ extern void ata_scsi_cmd_error_handler(struct Scsi_Host *host, struct ata_port *ap, struct list_head *eh_q);
++extern bool sata_lpm_ignore_phy_events(struct ata_link *link);
+
+ extern int ata_cable_40wire(struct ata_port *ap);
+ extern int ata_cable_80wire(struct ata_port *ap);
+diff --git a/include/linux/nilfs2_fs.h b/include/linux/nilfs2_fs.h
+index 7454ad7..d4d512f 100644
+--- a/include/linux/nilfs2_fs.h
++++ b/include/linux/nilfs2_fs.h
+@@ -457,7 +457,7 @@ struct nilfs_btree_node {
+ /* level */
+ #define NILFS_BTREE_LEVEL_DATA 0
+ #define NILFS_BTREE_LEVEL_NODE_MIN (NILFS_BTREE_LEVEL_DATA + 1)
+-#define NILFS_BTREE_LEVEL_MAX 14
++#define NILFS_BTREE_LEVEL_MAX 14 /* Max level (exclusive) */
+
+ /**
+ * struct nilfs_palloc_group_desc - block group descriptor
+diff --git a/include/linux/of.h b/include/linux/of.h
+index 9bf9611..c81ef31 100644
+--- a/include/linux/of.h
++++ b/include/linux/of.h
+@@ -211,6 +211,9 @@ extern int of_property_read_string(struct device_node *np,
+ extern int of_property_read_string_index(struct device_node *np,
+ const char *propname,
+ int index, const char **output);
++extern int of_property_match_string(struct device_node *np,
++ const char *propname,
++ const char *string);
+ extern int of_property_count_strings(struct device_node *np,
+ const char *propname);
+ extern int of_device_is_compatible(const struct device_node *device,
+@@ -315,6 +318,13 @@ static inline int of_property_read_u64(const struct device_node *np,
+ return -ENOSYS;
+ }
+
++static inline int of_property_match_string(struct device_node *np,
++ const char *propname,
++ const char *string)
++{
++ return -ENOSYS;
++}
++
+ static inline struct device_node *of_parse_phandle(struct device_node *np,
+ const char *phandle_name,
+ int index)
+diff --git a/include/linux/sched.h b/include/linux/sched.h
+index cb34ff4..44e5f47 100644
+--- a/include/linux/sched.h
++++ b/include/linux/sched.h
+@@ -2347,15 +2347,15 @@ static inline bool thread_group_leader(struct task_struct *p)
+ * all we care about is that we have a task with the appropriate
+ * pid, we don't actually care if we have the right task.
+ */
+-static inline int has_group_leader_pid(struct task_struct *p)
++static inline bool has_group_leader_pid(struct task_struct *p)
+ {
+- return p->pid == p->tgid;
++ return task_pid(p) == p->signal->leader_pid;
+ }
+
+ static inline
+-int same_thread_group(struct task_struct *p1, struct task_struct *p2)
++bool same_thread_group(struct task_struct *p1, struct task_struct *p2)
+ {
+- return p1->tgid == p2->tgid;
++ return p1->signal == p2->signal;
+ }
+
+ static inline struct task_struct *next_thread(const struct task_struct *p)
+diff --git a/include/net/ip_vs.h b/include/net/ip_vs.h
+index 416dcb0..b8b2e50 100644
+--- a/include/net/ip_vs.h
++++ b/include/net/ip_vs.h
+@@ -1202,6 +1202,8 @@ ip_vs_lookup_real_service(struct net *net, int af, __u16 protocol,
+
+ extern int ip_vs_use_count_inc(void);
+ extern void ip_vs_use_count_dec(void);
++extern int ip_vs_register_nl_ioctl(void);
++extern void ip_vs_unregister_nl_ioctl(void);
+ extern int ip_vs_control_init(void);
+ extern void ip_vs_control_cleanup(void);
+ extern struct ip_vs_dest *
+diff --git a/include/net/sctp/structs.h b/include/net/sctp/structs.h
+index a15432da..2cccd82 100644
+--- a/include/net/sctp/structs.h
++++ b/include/net/sctp/structs.h
+@@ -209,6 +209,7 @@ extern struct sctp_globals {
+ struct list_head addr_waitq;
+ struct timer_list addr_wq_timer;
+ struct list_head auto_asconf_splist;
++ /* Lock that protects both addr_waitq and auto_asconf_splist */
+ spinlock_t addr_wq_lock;
+
+ /* Lock that protects the local_addr_list writers */
+@@ -355,6 +356,10 @@ struct sctp_sock {
+ atomic_t pd_mode;
+ /* Receive to here while partial delivery is in effect. */
+ struct sk_buff_head pd_lobby;
++
++ /* These must be the last fields, as they will skipped on copies,
++ * like on accept and peeloff operations
++ */
+ struct list_head auto_asconf_list;
+ int do_auto_asconf;
+ };
+diff --git a/include/sound/emu10k1.h b/include/sound/emu10k1.h
+index 4f865df..7ee55e3 100644
+--- a/include/sound/emu10k1.h
++++ b/include/sound/emu10k1.h
+@@ -43,7 +43,8 @@
+
+ #define EMUPAGESIZE 4096
+ #define MAXREQVOICES 8
+-#define MAXPAGES 8192
++#define MAXPAGES0 4096 /* 32 bit mode */
++#define MAXPAGES1 8192 /* 31 bit mode */
+ #define RESERVED 0
+ #define NUM_MIDI 16
+ #define NUM_G 64 /* use all channels */
+@@ -52,8 +53,7 @@
+
+ /* FIXME? - according to the OSS driver the EMU10K1 needs a 29 bit DMA mask */
+ #define EMU10K1_DMA_MASK 0x7fffffffUL /* 31bit */
+-#define AUDIGY_DMA_MASK 0x7fffffffUL /* 31bit FIXME - 32 should work? */
+- /* See ALSA bug #1276 - rlrevell */
++#define AUDIGY_DMA_MASK 0xffffffffUL /* 32bit mode */
+
+ #define TMEMSIZE 256*1024
+ #define TMEMSIZEREG 4
+@@ -470,8 +470,11 @@
+
+ #define MAPB 0x0d /* Cache map B */
+
+-#define MAP_PTE_MASK 0xffffe000 /* The 19 MSBs of the PTE indexed by the PTI */
+-#define MAP_PTI_MASK 0x00001fff /* The 13 bit index to one of the 8192 PTE dwords */
++#define MAP_PTE_MASK0 0xfffff000 /* The 20 MSBs of the PTE indexed by the PTI */
++#define MAP_PTI_MASK0 0x00000fff /* The 12 bit index to one of the 4096 PTE dwords */
++
++#define MAP_PTE_MASK1 0xffffe000 /* The 19 MSBs of the PTE indexed by the PTI */
++#define MAP_PTI_MASK1 0x00001fff /* The 13 bit index to one of the 8192 PTE dwords */
+
+ /* 0x0e, 0x0f: Not used */
+
+@@ -1708,6 +1711,7 @@ struct snd_emu10k1 {
+ unsigned short model; /* subsystem id */
+ unsigned int card_type; /* EMU10K1_CARD_* */
+ unsigned int ecard_ctrl; /* ecard control bits */
++ unsigned int address_mode; /* address mode */
+ unsigned long dma_mask; /* PCI DMA mask */
+ unsigned int delay_pcm_irq; /* in samples */
+ int max_cache_pages; /* max memory size / PAGE_SIZE */
+diff --git a/include/xen/events.h b/include/xen/events.h
+index 8f3d622..89b672d 100644
+--- a/include/xen/events.h
++++ b/include/xen/events.h
+@@ -12,7 +12,7 @@ int bind_evtchn_to_irqhandler(unsigned int evtchn,
+ irq_handler_t handler,
+ unsigned long irqflags, const char *devname,
+ void *dev_id);
+-int bind_virq_to_irq(unsigned int virq, unsigned int cpu);
++int bind_virq_to_irq(unsigned int virq, unsigned int cpu, bool percpu);
+ int bind_virq_to_irqhandler(unsigned int virq, unsigned int cpu,
+ irq_handler_t handler,
+ unsigned long irqflags, const char *devname,
+diff --git a/kernel/ptrace.c b/kernel/ptrace.c
+index f79803a..f07c144 100644
+--- a/kernel/ptrace.c
++++ b/kernel/ptrace.c
+@@ -225,7 +225,7 @@ int __ptrace_may_access(struct task_struct *task, unsigned int mode)
+ */
+ int dumpable = 0;
+ /* Don't let security modules deny introspection */
+- if (task == current)
++ if (same_thread_group(task, current))
+ return 0;
+ rcu_read_lock();
+ tcred = __task_cred(task);
+@@ -640,6 +640,8 @@ static int ptrace_setsiginfo(struct task_struct *child, const siginfo_t *info)
+ static int ptrace_resume(struct task_struct *child, long request,
+ unsigned long data)
+ {
++ bool need_siglock;
++
+ if (!valid_signal(data))
+ return -EIO;
+
+@@ -667,8 +669,26 @@ static int ptrace_resume(struct task_struct *child, long request,
+ user_disable_single_step(child);
+ }
+
++ /*
++ * Change ->exit_code and ->state under siglock to avoid the race
++ * with wait_task_stopped() in between; a non-zero ->exit_code will
++ * wrongly look like another report from tracee.
++ *
++ * Note that we need siglock even if ->exit_code == data and/or this
++ * status was not reported yet, the new status must not be cleared by
++ * wait_task_stopped() after resume.
++ *
++ * If data == 0 we do not care if wait_task_stopped() reports the old
++ * status and clears the code too; this can't race with the tracee, it
++ * takes siglock after resume.
++ */
++ need_siglock = data && !thread_group_empty(current);
++ if (need_siglock)
++ spin_lock_irq(&child->sighand->siglock);
+ child->exit_code = data;
+ wake_up_state(child, __TASK_TRACED);
++ if (need_siglock)
++ spin_unlock_irq(&child->sighand->siglock);
+
+ return 0;
+ }
+diff --git a/kernel/softirq.c b/kernel/softirq.c
+index 2c71d91..44bc103 100644
+--- a/kernel/softirq.c
++++ b/kernel/softirq.c
+@@ -194,22 +194,28 @@ void local_bh_enable_ip(unsigned long ip)
+ EXPORT_SYMBOL(local_bh_enable_ip);
+
+ /*
+- * We restart softirq processing MAX_SOFTIRQ_RESTART times,
+- * and we fall back to softirqd after that.
++ * We restart softirq processing for at most MAX_SOFTIRQ_RESTART times,
++ * but break the loop if need_resched() is set or after 2 ms.
++ * The MAX_SOFTIRQ_TIME provides a nice upper bound in most cases, but in
++ * certain cases, such as stop_machine(), jiffies may cease to
++ * increment and so we need the MAX_SOFTIRQ_RESTART limit as
++ * well to make sure we eventually return from this method.
+ *
+- * This number has been established via experimentation.
++ * These limits have been established via experimentation.
+ * The two things to balance is latency against fairness -
+ * we want to handle softirqs as soon as possible, but they
+ * should not be able to lock up the box.
+ */
++#define MAX_SOFTIRQ_TIME msecs_to_jiffies(2)
+ #define MAX_SOFTIRQ_RESTART 10
+
+ asmlinkage void __do_softirq(void)
+ {
+ struct softirq_action *h;
+ __u32 pending;
+- int max_restart = MAX_SOFTIRQ_RESTART;
++ unsigned long end = jiffies + MAX_SOFTIRQ_TIME;
+ int cpu;
++ int max_restart = MAX_SOFTIRQ_RESTART;
+
+ pending = local_softirq_pending();
+ account_system_vtime(current);
+@@ -255,11 +261,13 @@ restart:
+ local_irq_disable();
+
+ pending = local_softirq_pending();
+- if (pending && --max_restart)
+- goto restart;
++ if (pending) {
++ if (time_before(jiffies, end) && !need_resched() &&
++ --max_restart)
++ goto restart;
+
+- if (pending)
+ wakeup_softirqd();
++ }
+
+ lockdep_softirq_exit();
+
+diff --git a/kernel/trace/ring_buffer_benchmark.c b/kernel/trace/ring_buffer_benchmark.c
+index a5457d5..6ad2e2d 100644
+--- a/kernel/trace/ring_buffer_benchmark.c
++++ b/kernel/trace/ring_buffer_benchmark.c
+@@ -455,7 +455,7 @@ static int __init ring_buffer_benchmark_init(void)
+
+ if (producer_fifo >= 0) {
+ struct sched_param param = {
+- .sched_priority = consumer_fifo
++ .sched_priority = producer_fifo
+ };
+ sched_setscheduler(producer, SCHED_FIFO, &param);
+ } else
+diff --git a/kernel/trace/trace_events_filter.c b/kernel/trace/trace_events_filter.c
+index b0996c1..47343cc 100644
+--- a/kernel/trace/trace_events_filter.c
++++ b/kernel/trace/trace_events_filter.c
+@@ -1343,19 +1343,25 @@ static int check_preds(struct filter_parse_state *ps)
+ {
+ int n_normal_preds = 0, n_logical_preds = 0;
+ struct postfix_elt *elt;
++ int cnt = 0;
+
+ list_for_each_entry(elt, &ps->postfix, list) {
+- if (elt->op == OP_NONE)
++ if (elt->op == OP_NONE) {
++ cnt++;
+ continue;
++ }
+
+ if (elt->op == OP_AND || elt->op == OP_OR) {
+ n_logical_preds++;
++ cnt--;
+ continue;
+ }
++ cnt--;
+ n_normal_preds++;
++ WARN_ON_ONCE(cnt < 0);
+ }
+
+- if (!n_normal_preds || n_logical_preds >= n_normal_preds) {
++ if (cnt != 1 || !n_normal_preds || n_logical_preds >= n_normal_preds) {
+ parse_error(ps, FILT_ERR_INVALID_FILTER, 0);
+ return -EINVAL;
+ }
+diff --git a/lib/string.c b/lib/string.c
+index 40136f6..dcbe695 100644
+--- a/lib/string.c
++++ b/lib/string.c
+@@ -595,7 +595,7 @@ EXPORT_SYMBOL(memset);
+ void memzero_explicit(void *s, size_t count)
+ {
+ memset(s, 0, count);
+- OPTIMIZER_HIDE_VAR(s);
++ barrier();
+ }
+ EXPORT_SYMBOL(memzero_explicit);
+
+diff --git a/mm/page-writeback.c b/mm/page-writeback.c
+index 1bf1f74..62bfbd9 100644
+--- a/mm/page-writeback.c
++++ b/mm/page-writeback.c
+@@ -560,7 +560,7 @@ static unsigned long bdi_position_ratio(struct backing_dev_info *bdi,
+ */
+ setpoint = (freerun + limit) / 2;
+ x = div64_s64(((s64)setpoint - (s64)dirty) << RATELIMIT_CALC_SHIFT,
+- limit - setpoint + 1);
++ (limit - setpoint) | 1);
+ pos_ratio = x;
+ pos_ratio = pos_ratio * x >> RATELIMIT_CALC_SHIFT;
+ pos_ratio = pos_ratio * x >> RATELIMIT_CALC_SHIFT;
+@@ -611,7 +611,7 @@ static unsigned long bdi_position_ratio(struct backing_dev_info *bdi,
+ * scale global setpoint to bdi's:
+ * bdi_setpoint = setpoint * bdi_thresh / thresh
+ */
+- x = div_u64((u64)bdi_thresh << 16, thresh + 1);
++ x = div_u64((u64)bdi_thresh << 16, thresh | 1);
+ bdi_setpoint = setpoint * (u64)x >> 16;
+ /*
+ * Use span=(8*write_bw) in single bdi case as indicated by
+@@ -626,7 +626,7 @@ static unsigned long bdi_position_ratio(struct backing_dev_info *bdi,
+
+ if (bdi_dirty < x_intercept - span / 4) {
+ pos_ratio = div64_u64(pos_ratio * (x_intercept - bdi_dirty),
+- x_intercept - bdi_setpoint + 1);
++ (x_intercept - bdi_setpoint) | 1);
+ } else
+ pos_ratio /= 4;
+
+diff --git a/mm/slub.c b/mm/slub.c
+index 6a4c2fb..60c6969 100644
+--- a/mm/slub.c
++++ b/mm/slub.c
+@@ -1873,18 +1873,24 @@ redo:
+ /* Unfreeze all the cpu partial slabs */
+ static void unfreeze_partials(struct kmem_cache *s)
+ {
+- struct kmem_cache_node *n = NULL;
++ struct kmem_cache_node *n = NULL, *n2 = NULL;
+ struct kmem_cache_cpu *c = this_cpu_ptr(s->cpu_slab);
+ struct page *page, *discard_page = NULL;
+
+ while ((page = c->partial)) {
+- enum slab_modes { M_PARTIAL, M_FREE };
+- enum slab_modes l, m;
+ struct page new;
+ struct page old;
+
+ c->partial = page->next;
+- l = M_FREE;
++
++ n2 = get_node(s, page_to_nid(page));
++ if (n != n2) {
++ if (n)
++ spin_unlock(&n->list_lock);
++
++ n = n2;
++ spin_lock(&n->list_lock);
++ }
+
+ do {
+
+@@ -1897,40 +1903,17 @@ static void unfreeze_partials(struct kmem_cache *s)
+
+ new.frozen = 0;
+
+- if (!new.inuse && (!n || n->nr_partial > s->min_partial))
+- m = M_FREE;
+- else {
+- struct kmem_cache_node *n2 = get_node(s,
+- page_to_nid(page));
+-
+- m = M_PARTIAL;
+- if (n != n2) {
+- if (n)
+- spin_unlock(&n->list_lock);
+-
+- n = n2;
+- spin_lock(&n->list_lock);
+- }
+- }
+-
+- if (l != m) {
+- if (l == M_PARTIAL)
+- remove_partial(n, page);
+- else
+- add_partial(n, page,
+- DEACTIVATE_TO_TAIL);
+-
+- l = m;
+- }
+-
+ } while (!cmpxchg_double_slab(s, page,
+ old.freelist, old.counters,
+ new.freelist, new.counters,
+ "unfreezing slab"));
+
+- if (m == M_FREE) {
++ if (unlikely(!new.inuse && n->nr_partial > s->min_partial)) {
+ page->next = discard_page;
+ discard_page = page;
++ } else {
++ add_partial(n, page, DEACTIVATE_TO_TAIL);
++ stat(s, FREE_ADD_PARTIAL);
+ }
+ }
+
+diff --git a/net/bridge/br_ioctl.c b/net/bridge/br_ioctl.c
+index 7222fe1..ea0e15c 100644
+--- a/net/bridge/br_ioctl.c
++++ b/net/bridge/br_ioctl.c
+@@ -246,9 +246,7 @@ static int old_dev_ioctl(struct net_device *dev, struct ifreq *rq, int cmd)
+ if (!capable(CAP_NET_ADMIN))
+ return -EPERM;
+
+- spin_lock_bh(&br->lock);
+ br_stp_set_bridge_priority(br, args[1]);
+- spin_unlock_bh(&br->lock);
+ return 0;
+
+ case BRCTL_SET_PORT_PRIORITY:
+diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c
+index 398a297..1bd197f 100644
+--- a/net/bridge/br_multicast.c
++++ b/net/bridge/br_multicast.c
+@@ -972,7 +972,7 @@ static int br_ip6_multicast_mld2_report(struct net_bridge *br,
+ }
+
+ err = br_ip6_multicast_add_group(br, port, &grec->grec_mca);
+- if (!err)
++ if (err)
+ break;
+ }
+
+@@ -991,6 +991,9 @@ static void br_multicast_add_router(struct net_bridge *br,
+ struct net_bridge_port *p;
+ struct hlist_node *n, *slot = NULL;
+
++ if (!hlist_unhashed(&port->rlist))
++ return;
++
+ hlist_for_each_entry(p, n, &br->router_list, rlist) {
+ if ((unsigned long) port >= (unsigned long) p)
+ break;
+@@ -1018,12 +1021,8 @@ static void br_multicast_mark_router(struct net_bridge *br,
+ if (port->multicast_router != 1)
+ return;
+
+- if (!hlist_unhashed(&port->rlist))
+- goto timer;
+-
+ br_multicast_add_router(br, port);
+
+-timer:
+ mod_timer(&port->multicast_router_timer,
+ now + br->multicast_querier_interval);
+ }
+diff --git a/net/bridge/br_stp_if.c b/net/bridge/br_stp_if.c
+index 19308e3..0f7dc60 100644
+--- a/net/bridge/br_stp_if.c
++++ b/net/bridge/br_stp_if.c
+@@ -235,12 +235,13 @@ bool br_stp_recalculate_bridge_id(struct net_bridge *br)
+ return true;
+ }
+
+-/* called under bridge lock */
++/* Acquires and releases bridge lock */
+ void br_stp_set_bridge_priority(struct net_bridge *br, u16 newprio)
+ {
+ struct net_bridge_port *p;
+ int wasroot;
+
++ spin_lock_bh(&br->lock);
+ wasroot = br_is_root_bridge(br);
+
+ list_for_each_entry(p, &br->port_list, list) {
+@@ -258,6 +259,7 @@ void br_stp_set_bridge_priority(struct net_bridge *br, u16 newprio)
+ br_port_state_selection(br);
+ if (br_is_root_bridge(br) && !wasroot)
+ br_become_root_bridge(br);
++ spin_unlock_bh(&br->lock);
+ }
+
+ /* called under bridge lock */
+diff --git a/net/caif/caif_socket.c b/net/caif/caif_socket.c
+index 7eed9eb..7e4b4b4 100644
+--- a/net/caif/caif_socket.c
++++ b/net/caif/caif_socket.c
+@@ -366,6 +366,10 @@ static long caif_stream_data_wait(struct sock *sk, long timeo)
+ release_sock(sk);
+ timeo = schedule_timeout(timeo);
+ lock_sock(sk);
++
++ if (sock_flag(sk, SOCK_DEAD))
++ break;
++
+ clear_bit(SOCK_ASYNC_WAITDATA, &sk->sk_socket->flags);
+ }
+
+@@ -410,6 +414,10 @@ static int caif_stream_recvmsg(struct kiocb *iocb, struct socket *sock,
+ struct sk_buff *skb;
+
+ lock_sock(sk);
++ if (sock_flag(sk, SOCK_DEAD)) {
++ err = -ECONNRESET;
++ goto unlock;
++ }
+ skb = skb_dequeue(&sk->sk_receive_queue);
+ caif_check_flow_release(sk);
+
+diff --git a/net/core/neighbour.c b/net/core/neighbour.c
+index 0ea3fd3..c8c2645 100644
+--- a/net/core/neighbour.c
++++ b/net/core/neighbour.c
+@@ -955,6 +955,8 @@ int __neigh_event_send(struct neighbour *neigh, struct sk_buff *skb)
+ rc = 0;
+ if (neigh->nud_state & (NUD_CONNECTED | NUD_DELAY | NUD_PROBE))
+ goto out_unlock_bh;
++ if (neigh->dead)
++ goto out_dead;
+
+ if (!(neigh->nud_state & (NUD_STALE | NUD_INCOMPLETE))) {
+ if (neigh->parms->mcast_probes + neigh->parms->app_probes) {
+@@ -1003,6 +1005,13 @@ out_unlock_bh:
+ write_unlock(&neigh->lock);
+ local_bh_enable();
+ return rc;
++
++out_dead:
++ if (neigh->nud_state & NUD_STALE)
++ goto out_unlock_bh;
++ write_unlock_bh(&neigh->lock);
++ kfree_skb(skb);
++ return 1;
+ }
+ EXPORT_SYMBOL(__neigh_event_send);
+
+@@ -1066,6 +1075,8 @@ int neigh_update(struct neighbour *neigh, const u8 *lladdr, u8 new,
+ if (!(flags & NEIGH_UPDATE_F_ADMIN) &&
+ (old & (NUD_NOARP | NUD_PERMANENT)))
+ goto out;
++ if (neigh->dead)
++ goto out;
+
+ if (!(new & NUD_VALID)) {
+ neigh_del_timer(neigh);
+diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
+index 8c2e259..5e92043 100644
+--- a/net/ipv4/udp.c
++++ b/net/ipv4/udp.c
+@@ -1248,10 +1248,8 @@ csum_copy_err:
+ UDP_INC_STATS_USER(sock_net(sk), UDP_MIB_INERRORS, is_udplite);
+ unlock_sock_fast(sk, slow);
+
+- if (noblock)
+- return -EAGAIN;
+-
+- /* starting over for a new packet */
++ /* starting over for a new packet, but check if we need to yield */
++ cond_resched();
+ msg->msg_flags &= ~MSG_TRUNC;
+ goto try_again;
+ }
+diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
+index d131a95..dc08afd 100644
+--- a/net/ipv6/udp.c
++++ b/net/ipv6/udp.c
+@@ -451,10 +451,8 @@ csum_copy_err:
+ }
+ unlock_sock_fast(sk, slow);
+
+- if (noblock)
+- return -EAGAIN;
+-
+- /* starting over for a new packet */
++ /* starting over for a new packet, but check if we need to yield */
++ cond_resched();
+ msg->msg_flags &= ~MSG_TRUNC;
+ goto try_again;
+ }
+diff --git a/net/mac80211/wep.c b/net/mac80211/wep.c
+index a1c6bfd..34583c5 100644
+--- a/net/mac80211/wep.c
++++ b/net/mac80211/wep.c
+@@ -97,8 +97,7 @@ static u8 *ieee80211_wep_add_iv(struct ieee80211_local *local,
+
+ hdr->frame_control |= cpu_to_le16(IEEE80211_FCTL_PROTECTED);
+
+- if (WARN_ON(skb_tailroom(skb) < WEP_ICV_LEN ||
+- skb_headroom(skb) < WEP_IV_LEN))
++ if (WARN_ON(skb_headroom(skb) < WEP_IV_LEN))
+ return NULL;
+
+ hdrlen = ieee80211_hdrlen(hdr->frame_control);
+@@ -160,6 +159,9 @@ int ieee80211_wep_encrypt(struct ieee80211_local *local,
+ size_t len;
+ u8 rc4key[3 + WLAN_KEY_LEN_WEP104];
+
++ if (WARN_ON(skb_tailroom(skb) < WEP_ICV_LEN))
++ return -1;
++
+ iv = ieee80211_wep_add_iv(local, skb, keylen, keyidx);
+ if (!iv)
+ return -1;
+diff --git a/net/netfilter/ipvs/ip_vs_core.c b/net/netfilter/ipvs/ip_vs_core.c
+index d864aaf..197ed93 100644
+--- a/net/netfilter/ipvs/ip_vs_core.c
++++ b/net/netfilter/ipvs/ip_vs_core.c
+@@ -2003,10 +2003,18 @@ static int __init ip_vs_init(void)
+ goto cleanup_dev;
+ }
+
++ ret = ip_vs_register_nl_ioctl();
++ if (ret < 0) {
++ pr_err("can't register netlink/ioctl.\n");
++ goto cleanup_hooks;
++ }
++
+ pr_info("ipvs loaded.\n");
+
+ return ret;
+
++cleanup_hooks:
++ nf_unregister_hooks(ip_vs_ops, ARRAY_SIZE(ip_vs_ops));
+ cleanup_dev:
+ unregister_pernet_device(&ipvs_core_dev_ops);
+ cleanup_sub:
+@@ -2022,6 +2030,7 @@ exit:
+
+ static void __exit ip_vs_cleanup(void)
+ {
++ ip_vs_unregister_nl_ioctl();
+ nf_unregister_hooks(ip_vs_ops, ARRAY_SIZE(ip_vs_ops));
+ unregister_pernet_device(&ipvs_core_dev_ops);
+ unregister_pernet_subsys(&ipvs_core_ops); /* free ip_vs struct */
+diff --git a/net/netfilter/ipvs/ip_vs_ctl.c b/net/netfilter/ipvs/ip_vs_ctl.c
+index 93acfa1..1e27a1f 100644
+--- a/net/netfilter/ipvs/ip_vs_ctl.c
++++ b/net/netfilter/ipvs/ip_vs_ctl.c
+@@ -3689,6 +3689,9 @@ void __net_init ip_vs_control_net_cleanup_sysctl(struct net *net)
+ cancel_work_sync(&ipvs->defense_work.work);
+ unregister_net_sysctl_table(ipvs->sysctl_hdr);
+ ip_vs_stop_estimator(net, &ipvs->tot_stats);
++
++ if (!net_eq(net, &init_net))
++ kfree(ipvs->sysctl_tbl);
+ }
+
+ #else
+@@ -3751,21 +3754,10 @@ void __net_exit ip_vs_control_net_cleanup(struct net *net)
+ free_percpu(ipvs->tot_stats.cpustats);
+ }
+
+-int __init ip_vs_control_init(void)
++int __init ip_vs_register_nl_ioctl(void)
+ {
+- int idx;
+ int ret;
+
+- EnterFunction(2);
+-
+- /* Initialize svc_table, ip_vs_svc_fwm_table, rs_table */
+- for(idx = 0; idx < IP_VS_SVC_TAB_SIZE; idx++) {
+- INIT_LIST_HEAD(&ip_vs_svc_table[idx]);
+- INIT_LIST_HEAD(&ip_vs_svc_fwm_table[idx]);
+- }
+-
+- smp_wmb(); /* Do we really need it now ? */
+-
+ ret = nf_register_sockopt(&ip_vs_sockopts);
+ if (ret) {
+ pr_err("cannot register sockopt.\n");
+@@ -3777,28 +3769,47 @@ int __init ip_vs_control_init(void)
+ pr_err("cannot register Generic Netlink interface.\n");
+ goto err_genl;
+ }
+-
+- ret = register_netdevice_notifier(&ip_vs_dst_notifier);
+- if (ret < 0)
+- goto err_notf;
+-
+- LeaveFunction(2);
+ return 0;
+
+-err_notf:
+- ip_vs_genl_unregister();
+ err_genl:
+ nf_unregister_sockopt(&ip_vs_sockopts);
+ err_sock:
+ return ret;
+ }
+
++void ip_vs_unregister_nl_ioctl(void)
++{
++ ip_vs_genl_unregister();
++ nf_unregister_sockopt(&ip_vs_sockopts);
++}
++
++int __init ip_vs_control_init(void)
++{
++ int idx;
++ int ret;
++
++ EnterFunction(2);
++
++ /* Initialize svc_table, ip_vs_svc_fwm_table, rs_table */
++ for (idx = 0; idx < IP_VS_SVC_TAB_SIZE; idx++) {
++ INIT_LIST_HEAD(&ip_vs_svc_table[idx]);
++ INIT_LIST_HEAD(&ip_vs_svc_fwm_table[idx]);
++ }
++
++ smp_wmb(); /* Do we really need it now ? */
++
++ ret = register_netdevice_notifier(&ip_vs_dst_notifier);
++ if (ret < 0)
++ return ret;
++
++ LeaveFunction(2);
++ return 0;
++}
++
+
+ void ip_vs_control_cleanup(void)
+ {
+ EnterFunction(2);
+ unregister_netdevice_notifier(&ip_vs_dst_notifier);
+- ip_vs_genl_unregister();
+- nf_unregister_sockopt(&ip_vs_sockopts);
+ LeaveFunction(2);
+ }
+diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
+index 4f19bf2..0c21f06 100644
+--- a/net/packet/af_packet.c
++++ b/net/packet/af_packet.c
+@@ -1170,16 +1170,6 @@ static void packet_sock_destruct(struct sock *sk)
+ sk_refcnt_debug_dec(sk);
+ }
+
+-static int fanout_rr_next(struct packet_fanout *f, unsigned int num)
+-{
+- int x = atomic_read(&f->rr_cur) + 1;
+-
+- if (x >= num)
+- x = 0;
+-
+- return x;
+-}
+-
+ static struct sock *fanout_demux_hash(struct packet_fanout *f, struct sk_buff *skb, unsigned int num)
+ {
+ u32 idx, hash = skb->rxhash;
+@@ -1191,13 +1181,9 @@ static struct sock *fanout_demux_hash(struct packet_fanout *f, struct sk_buff *s
+
+ static struct sock *fanout_demux_lb(struct packet_fanout *f, struct sk_buff *skb, unsigned int num)
+ {
+- int cur, old;
++ unsigned int val = atomic_inc_return(&f->rr_cur);
+
+- cur = atomic_read(&f->rr_cur);
+- while ((old = atomic_cmpxchg(&f->rr_cur, cur,
+- fanout_rr_next(f, num))) != cur)
+- cur = old;
+- return f->arr[cur];
++ return f->arr[val % num];
+ }
+
+ static struct sock *fanout_demux_cpu(struct packet_fanout *f, struct sk_buff *skb, unsigned int num)
+@@ -1211,7 +1197,7 @@ static int packet_rcv_fanout(struct sk_buff *skb, struct net_device *dev,
+ struct packet_type *pt, struct net_device *orig_dev)
+ {
+ struct packet_fanout *f = pt->af_packet_priv;
+- unsigned int num = f->num_members;
++ unsigned int num = ACCESS_ONCE(f->num_members);
+ struct packet_sock *po;
+ struct sock *sk;
+
+diff --git a/net/sctp/output.c b/net/sctp/output.c
+index c3b8549..6d56eec 100644
+--- a/net/sctp/output.c
++++ b/net/sctp/output.c
+@@ -587,7 +587,9 @@ out:
+ return err;
+ no_route:
+ kfree_skb(nskb);
+- IP_INC_STATS(&init_net, IPSTATS_MIB_OUTNOROUTES);
++
++ if (asoc)
++ IP_INC_STATS(&init_net, IPSTATS_MIB_OUTNOROUTES);
+
+ /* FIXME: Returning the 'err' will effect all the associations
+ * associated with a socket, although only one of the paths of the
+diff --git a/net/sctp/socket.c b/net/sctp/socket.c
+index fc63664..24e88af 100644
+--- a/net/sctp/socket.c
++++ b/net/sctp/socket.c
+@@ -1539,8 +1539,10 @@ SCTP_STATIC void sctp_close(struct sock *sk, long timeout)
+
+ /* Supposedly, no process has access to the socket, but
+ * the net layers still may.
++ * Also, sctp_destroy_sock() needs to be called with addr_wq_lock
++ * held and that should be grabbed before socket lock.
+ */
+- sctp_local_bh_disable();
++ spin_lock_bh(&sctp_globals.addr_wq_lock);
+ sctp_bh_lock_sock(sk);
+
+ /* Hold the sock, since sk_common_release() will put sock_put()
+@@ -1550,7 +1552,7 @@ SCTP_STATIC void sctp_close(struct sock *sk, long timeout)
+ sk_common_release(sk);
+
+ sctp_bh_unlock_sock(sk);
+- sctp_local_bh_enable();
++ spin_unlock_bh(&sctp_globals.addr_wq_lock);
+
+ sock_put(sk);
+
+@@ -3499,6 +3501,7 @@ static int sctp_setsockopt_auto_asconf(struct sock *sk, char __user *optval,
+ if ((val && sp->do_auto_asconf) || (!val && !sp->do_auto_asconf))
+ return 0;
+
++ spin_lock_bh(&sctp_globals.addr_wq_lock);
+ if (val == 0 && sp->do_auto_asconf) {
+ list_del(&sp->auto_asconf_list);
+ sp->do_auto_asconf = 0;
+@@ -3507,6 +3510,7 @@ static int sctp_setsockopt_auto_asconf(struct sock *sk, char __user *optval,
+ &sctp_auto_asconf_splist);
+ sp->do_auto_asconf = 1;
+ }
++ spin_unlock_bh(&sctp_globals.addr_wq_lock);
+ return 0;
+ }
+
+@@ -3942,18 +3946,28 @@ SCTP_STATIC int sctp_init_sock(struct sock *sk)
+ local_bh_disable();
+ percpu_counter_inc(&sctp_sockets_allocated);
+ sock_prot_inuse_add(sock_net(sk), sk->sk_prot, 1);
++
++ /* Nothing can fail after this block, otherwise
++ * sctp_destroy_sock() will be called without addr_wq_lock held
++ */
+ if (sctp_default_auto_asconf) {
++ spin_lock(&sctp_globals.addr_wq_lock);
+ list_add_tail(&sp->auto_asconf_list,
+ &sctp_auto_asconf_splist);
+ sp->do_auto_asconf = 1;
+- } else
++ spin_unlock(&sctp_globals.addr_wq_lock);
++ } else {
+ sp->do_auto_asconf = 0;
++ }
++
+ local_bh_enable();
+
+ return 0;
+ }
+
+-/* Cleanup any SCTP per socket resources. */
++/* Cleanup any SCTP per socket resources. Must be called with
++ * sctp_globals.addr_wq_lock held if sp->do_auto_asconf is true
++ */
+ SCTP_STATIC void sctp_destroy_sock(struct sock *sk)
+ {
+ struct sctp_sock *sp;
+@@ -6719,6 +6733,19 @@ void sctp_copy_sock(struct sock *newsk, struct sock *sk,
+ newinet->mc_list = NULL;
+ }
+
++static inline void sctp_copy_descendant(struct sock *sk_to,
++ const struct sock *sk_from)
++{
++ int ancestor_size = sizeof(struct inet_sock) +
++ sizeof(struct sctp_sock) -
++ offsetof(struct sctp_sock, auto_asconf_list);
++
++ if (sk_from->sk_family == PF_INET6)
++ ancestor_size += sizeof(struct ipv6_pinfo);
++
++ __inet_sk_copy_descendant(sk_to, sk_from, ancestor_size);
++}
++
+ /* Populate the fields of the newsk from the oldsk and migrate the assoc
+ * and its messages to the newsk.
+ */
+@@ -6733,7 +6760,6 @@ static void sctp_sock_migrate(struct sock *oldsk, struct sock *newsk,
+ struct sk_buff *skb, *tmp;
+ struct sctp_ulpevent *event;
+ struct sctp_bind_hashbucket *head;
+- struct list_head tmplist;
+
+ /* Migrate socket buffer sizes and all the socket level options to the
+ * new socket.
+@@ -6741,12 +6767,7 @@ static void sctp_sock_migrate(struct sock *oldsk, struct sock *newsk,
+ newsk->sk_sndbuf = oldsk->sk_sndbuf;
+ newsk->sk_rcvbuf = oldsk->sk_rcvbuf;
+ /* Brute force copy old sctp opt. */
+- if (oldsp->do_auto_asconf) {
+- memcpy(&tmplist, &newsp->auto_asconf_list, sizeof(tmplist));
+- inet_sk_copy_descendant(newsk, oldsk);
+- memcpy(&newsp->auto_asconf_list, &tmplist, sizeof(tmplist));
+- } else
+- inet_sk_copy_descendant(newsk, oldsk);
++ sctp_copy_descendant(newsk, oldsk);
+
+ /* Restore the ep value that was overwritten with the above structure
+ * copy.
+diff --git a/net/socket.c b/net/socket.c
+index 116cf9d..10ea25a 100644
+--- a/net/socket.c
++++ b/net/socket.c
+@@ -1911,14 +1911,12 @@ static int ___sys_sendmsg(struct socket *sock, struct msghdr __user *msg,
+ int err, ctl_len, iov_size, total_len;
+
+ err = -EFAULT;
+- if (MSG_CMSG_COMPAT & flags) {
+- if (get_compat_msghdr(msg_sys, msg_compat))
+- return -EFAULT;
+- } else {
++ if (MSG_CMSG_COMPAT & flags)
++ err = get_compat_msghdr(msg_sys, msg_compat);
++ else
+ err = copy_msghdr_from_user(msg_sys, msg);
+- if (err)
+- return err;
+- }
++ if (err)
++ return err;
+
+ /* do not move before msg_sys is valid */
+ err = -EMSGSIZE;
+@@ -2130,14 +2128,12 @@ static int ___sys_recvmsg(struct socket *sock, struct msghdr __user *msg,
+ struct sockaddr __user *uaddr;
+ int __user *uaddr_len;
+
+- if (MSG_CMSG_COMPAT & flags) {
+- if (get_compat_msghdr(msg_sys, msg_compat))
+- return -EFAULT;
+- } else {
++ if (MSG_CMSG_COMPAT & flags)
++ err = get_compat_msghdr(msg_sys, msg_compat);
++ else
+ err = copy_msghdr_from_user(msg_sys, msg);
+- if (err)
+- return err;
+- }
++ if (err)
++ return err;
+
+ err = -EMSGSIZE;
+ if (msg_sys->msg_iovlen > UIO_MAXIOV)
+diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
+index 8705ee3..9b1f371 100644
+--- a/net/unix/af_unix.c
++++ b/net/unix/af_unix.c
+@@ -1870,6 +1870,10 @@ static long unix_stream_data_wait(struct sock *sk, long timeo)
+ unix_state_unlock(sk);
+ timeo = schedule_timeout(timeo);
+ unix_state_lock(sk);
++
++ if (sock_flag(sk, SOCK_DEAD))
++ break;
++
+ clear_bit(SOCK_ASYNC_WAITDATA, &sk->sk_socket->flags);
+ }
+
+@@ -1930,6 +1934,10 @@ static int unix_stream_recvmsg(struct kiocb *iocb, struct socket *sock,
+ struct sk_buff *skb;
+
+ unix_state_lock(sk);
++ if (sock_flag(sk, SOCK_DEAD)) {
++ err = -ECONNRESET;
++ goto unlock;
++ }
+ skb = skb_peek(&sk->sk_receive_queue);
+ if (skb == NULL) {
+ unix_sk(sk)->recursion_level = 0;
+diff --git a/security/selinux/nlmsgtab.c b/security/selinux/nlmsgtab.c
+index 0920ea3..5776921 100644
+--- a/security/selinux/nlmsgtab.c
++++ b/security/selinux/nlmsgtab.c
+@@ -100,6 +100,12 @@ static struct nlmsg_perm nlmsg_xfrm_perms[] =
+ { XFRM_MSG_FLUSHPOLICY, NETLINK_XFRM_SOCKET__NLMSG_WRITE },
+ { XFRM_MSG_NEWAE, NETLINK_XFRM_SOCKET__NLMSG_WRITE },
+ { XFRM_MSG_GETAE, NETLINK_XFRM_SOCKET__NLMSG_READ },
++ { XFRM_MSG_REPORT, NETLINK_XFRM_SOCKET__NLMSG_READ },
++ { XFRM_MSG_MIGRATE, NETLINK_XFRM_SOCKET__NLMSG_WRITE },
++ { XFRM_MSG_NEWSADINFO, NETLINK_XFRM_SOCKET__NLMSG_READ },
++ { XFRM_MSG_GETSADINFO, NETLINK_XFRM_SOCKET__NLMSG_READ },
++ { XFRM_MSG_GETSPDINFO, NETLINK_XFRM_SOCKET__NLMSG_READ },
++ { XFRM_MSG_MAPPING, NETLINK_XFRM_SOCKET__NLMSG_READ },
+ };
+
+ static struct nlmsg_perm nlmsg_audit_perms[] =
+diff --git a/sound/pci/emu10k1/emu10k1.c b/sound/pci/emu10k1/emu10k1.c
+index eaa198e..f33e3cc 100644
+--- a/sound/pci/emu10k1/emu10k1.c
++++ b/sound/pci/emu10k1/emu10k1.c
+@@ -181,8 +181,10 @@ static int __devinit snd_card_emu10k1_probe(struct pci_dev *pci,
+ }
+ #endif
+
+- strcpy(card->driver, emu->card_capabilities->driver);
+- strcpy(card->shortname, emu->card_capabilities->name);
++ strlcpy(card->driver, emu->card_capabilities->driver,
++ sizeof(card->driver));
++ strlcpy(card->shortname, emu->card_capabilities->name,
++ sizeof(card->shortname));
+ snprintf(card->longname, sizeof(card->longname),
+ "%s (rev.%d, serial:0x%x) at 0x%lx, irq %i",
+ card->shortname, emu->revision, emu->serial, emu->port, emu->irq);
+diff --git a/sound/pci/emu10k1/emu10k1_callback.c b/sound/pci/emu10k1/emu10k1_callback.c
+index f35284b..8295950 100644
+--- a/sound/pci/emu10k1/emu10k1_callback.c
++++ b/sound/pci/emu10k1/emu10k1_callback.c
+@@ -415,7 +415,7 @@ start_voice(struct snd_emux_voice *vp)
+ snd_emu10k1_ptr_write(hw, Z2, ch, 0);
+
+ /* invalidate maps */
+- temp = (hw->silent_page.addr << 1) | MAP_PTI_MASK;
++ temp = (hw->silent_page.addr << hw->address_mode) | (hw->address_mode ? MAP_PTI_MASK1 : MAP_PTI_MASK0);
+ snd_emu10k1_ptr_write(hw, MAPA, ch, temp);
+ snd_emu10k1_ptr_write(hw, MAPB, ch, temp);
+ #if 0
+@@ -436,7 +436,7 @@ start_voice(struct snd_emux_voice *vp)
+ snd_emu10k1_ptr_write(hw, CDF, ch, sample);
+
+ /* invalidate maps */
+- temp = ((unsigned int)hw->silent_page.addr << 1) | MAP_PTI_MASK;
++ temp = ((unsigned int)hw->silent_page.addr << hw_address_mode) | (hw->address_mode ? MAP_PTI_MASK1 : MAP_PTI_MASK0);
+ snd_emu10k1_ptr_write(hw, MAPA, ch, temp);
+ snd_emu10k1_ptr_write(hw, MAPB, ch, temp);
+
+diff --git a/sound/pci/emu10k1/emu10k1_main.c b/sound/pci/emu10k1/emu10k1_main.c
+index d37b946..705e73e 100644
+--- a/sound/pci/emu10k1/emu10k1_main.c
++++ b/sound/pci/emu10k1/emu10k1_main.c
+@@ -282,7 +282,7 @@ static int snd_emu10k1_init(struct snd_emu10k1 *emu, int enable_ir, int resume)
+ snd_emu10k1_ptr_write(emu, TCB, 0, 0); /* taken from original driver */
+ snd_emu10k1_ptr_write(emu, TCBS, 0, 4); /* taken from original driver */
+
+- silent_page = (emu->silent_page.addr << 1) | MAP_PTI_MASK;
++ silent_page = (emu->silent_page.addr << emu->address_mode) | (emu->address_mode ? MAP_PTI_MASK1 : MAP_PTI_MASK0);
+ for (ch = 0; ch < NUM_G; ch++) {
+ snd_emu10k1_ptr_write(emu, MAPA, ch, silent_page);
+ snd_emu10k1_ptr_write(emu, MAPB, ch, silent_page);
+@@ -348,6 +348,11 @@ static int snd_emu10k1_init(struct snd_emu10k1 *emu, int enable_ir, int resume)
+ outl(reg | A_IOCFG_GPOUT0, emu->port + A_IOCFG);
+ }
+
++ if (emu->address_mode == 0) {
++ /* use 16M in 4G */
++ outl(inl(emu->port + HCFG) | HCFG_EXPANDED_MEM, emu->port + HCFG);
++ }
++
+ return 0;
+ }
+
+@@ -1390,7 +1395,7 @@ static struct snd_emu_chip_details emu_chip_details[] = {
+ *
+ */
+ {.vendor = 0x1102, .device = 0x0008, .subsystem = 0x20011102,
+- .driver = "Audigy2", .name = "SB Audigy 2 ZS Notebook [SB0530]",
++ .driver = "Audigy2", .name = "Audigy 2 ZS Notebook [SB0530]",
+ .id = "Audigy2",
+ .emu10k2_chip = 1,
+ .ca0108_chip = 1,
+@@ -1528,7 +1533,7 @@ static struct snd_emu_chip_details emu_chip_details[] = {
+ .adc_1361t = 1, /* 24 bit capture instead of 16bit */
+ .ac97_chip = 1} ,
+ {.vendor = 0x1102, .device = 0x0004, .subsystem = 0x10051102,
+- .driver = "Audigy2", .name = "SB Audigy 2 Platinum EX [SB0280]",
++ .driver = "Audigy2", .name = "Audigy 2 Platinum EX [SB0280]",
+ .id = "Audigy2",
+ .emu10k2_chip = 1,
+ .ca0102_chip = 1,
+@@ -1832,8 +1837,10 @@ int __devinit snd_emu10k1_create(struct snd_card *card,
+
+ is_audigy = emu->audigy = c->emu10k2_chip;
+
++ /* set addressing mode */
++ emu->address_mode = is_audigy ? 0 : 1;
+ /* set the DMA transfer mask */
+- emu->dma_mask = is_audigy ? AUDIGY_DMA_MASK : EMU10K1_DMA_MASK;
++ emu->dma_mask = emu->address_mode ? EMU10K1_DMA_MASK : AUDIGY_DMA_MASK;
+ if (pci_set_dma_mask(pci, emu->dma_mask) < 0 ||
+ pci_set_consistent_dma_mask(pci, emu->dma_mask) < 0) {
+ snd_printk(KERN_ERR "architecture does not support PCI busmaster DMA with mask 0x%lx\n", emu->dma_mask);
+@@ -1856,7 +1863,7 @@ int __devinit snd_emu10k1_create(struct snd_card *card,
+
+ emu->max_cache_pages = max_cache_bytes >> PAGE_SHIFT;
+ if (snd_dma_alloc_pages(SNDRV_DMA_TYPE_DEV, snd_dma_pci_data(pci),
+- 32 * 1024, &emu->ptb_pages) < 0) {
++ (emu->address_mode ? 32 : 16) * 1024, &emu->ptb_pages) < 0) {
+ err = -ENOMEM;
+ goto error;
+ }
+@@ -1955,8 +1962,8 @@ int __devinit snd_emu10k1_create(struct snd_card *card,
+
+ /* Clear silent pages and set up pointers */
+ memset(emu->silent_page.area, 0, PAGE_SIZE);
+- silent_page = emu->silent_page.addr << 1;
+- for (idx = 0; idx < MAXPAGES; idx++)
++ silent_page = emu->silent_page.addr << emu->address_mode;
++ for (idx = 0; idx < (emu->address_mode ? MAXPAGES1 : MAXPAGES0); idx++)
+ ((u32 *)emu->ptb_pages.area)[idx] = cpu_to_le32(silent_page | idx);
+
+ /* set up voice indices */
+diff --git a/sound/pci/emu10k1/emupcm.c b/sound/pci/emu10k1/emupcm.c
+index e22b8e2..c673d2b 100644
+--- a/sound/pci/emu10k1/emupcm.c
++++ b/sound/pci/emu10k1/emupcm.c
+@@ -379,7 +379,7 @@ static void snd_emu10k1_pcm_init_voice(struct snd_emu10k1 *emu,
+ snd_emu10k1_ptr_write(emu, Z1, voice, 0);
+ snd_emu10k1_ptr_write(emu, Z2, voice, 0);
+ /* invalidate maps */
+- silent_page = ((unsigned int)emu->silent_page.addr << 1) | MAP_PTI_MASK;
++ silent_page = ((unsigned int)emu->silent_page.addr << emu->address_mode) | (emu->address_mode ? MAP_PTI_MASK1 : MAP_PTI_MASK0);
+ snd_emu10k1_ptr_write(emu, MAPA, voice, silent_page);
+ snd_emu10k1_ptr_write(emu, MAPB, voice, silent_page);
+ /* modulation envelope */
+diff --git a/sound/pci/emu10k1/emuproc.c b/sound/pci/emu10k1/emuproc.c
+index bc38dd4..9c499e6 100644
+--- a/sound/pci/emu10k1/emuproc.c
++++ b/sound/pci/emu10k1/emuproc.c
+@@ -241,31 +241,22 @@ static void snd_emu10k1_proc_spdif_read(struct snd_info_entry *entry,
+ struct snd_emu10k1 *emu = entry->private_data;
+ u32 value;
+ u32 value2;
+- unsigned long flags;
+ u32 rate;
+
+ if (emu->card_capabilities->emu_model) {
+- spin_lock_irqsave(&emu->emu_lock, flags);
+ snd_emu1010_fpga_read(emu, 0x38, &value);
+- spin_unlock_irqrestore(&emu->emu_lock, flags);
+ if ((value & 0x1) == 0) {
+- spin_lock_irqsave(&emu->emu_lock, flags);
+ snd_emu1010_fpga_read(emu, 0x2a, &value);
+ snd_emu1010_fpga_read(emu, 0x2b, &value2);
+- spin_unlock_irqrestore(&emu->emu_lock, flags);
+ rate = 0x1770000 / (((value << 5) | value2)+1);
+ snd_iprintf(buffer, "ADAT Locked : %u\n", rate);
+ } else {
+ snd_iprintf(buffer, "ADAT Unlocked\n");
+ }
+- spin_lock_irqsave(&emu->emu_lock, flags);
+ snd_emu1010_fpga_read(emu, 0x20, &value);
+- spin_unlock_irqrestore(&emu->emu_lock, flags);
+ if ((value & 0x4) == 0) {
+- spin_lock_irqsave(&emu->emu_lock, flags);
+ snd_emu1010_fpga_read(emu, 0x28, &value);
+ snd_emu1010_fpga_read(emu, 0x29, &value2);
+- spin_unlock_irqrestore(&emu->emu_lock, flags);
+ rate = 0x1770000 / (((value << 5) | value2)+1);
+ snd_iprintf(buffer, "SPDIF Locked : %d\n", rate);
+ } else {
+@@ -410,14 +401,11 @@ static void snd_emu_proc_emu1010_reg_read(struct snd_info_entry *entry,
+ {
+ struct snd_emu10k1 *emu = entry->private_data;
+ u32 value;
+- unsigned long flags;
+ int i;
+ snd_iprintf(buffer, "EMU1010 Registers:\n\n");
+
+ for(i = 0; i < 0x40; i+=1) {
+- spin_lock_irqsave(&emu->emu_lock, flags);
+ snd_emu1010_fpga_read(emu, i, &value);
+- spin_unlock_irqrestore(&emu->emu_lock, flags);
+ snd_iprintf(buffer, "%02X: %08X, %02X\n", i, value, (value >> 8) & 0x7f);
+ }
+ }
+diff --git a/sound/pci/emu10k1/memory.c b/sound/pci/emu10k1/memory.c
+index 4f502a2..87b7c65 100644
+--- a/sound/pci/emu10k1/memory.c
++++ b/sound/pci/emu10k1/memory.c
+@@ -34,10 +34,11 @@
+ * aligned pages in others
+ */
+ #define __set_ptb_entry(emu,page,addr) \
+- (((u32 *)(emu)->ptb_pages.area)[page] = cpu_to_le32(((addr) << 1) | (page)))
++ (((u32 *)(emu)->ptb_pages.area)[page] = cpu_to_le32(((addr) << (emu->address_mode)) | (page)))
+
+ #define UNIT_PAGES (PAGE_SIZE / EMUPAGESIZE)
+-#define MAX_ALIGN_PAGES (MAXPAGES / UNIT_PAGES)
++#define MAX_ALIGN_PAGES0 (MAXPAGES0 / UNIT_PAGES)
++#define MAX_ALIGN_PAGES1 (MAXPAGES1 / UNIT_PAGES)
+ /* get aligned page from offset address */
+ #define get_aligned_page(offset) ((offset) >> PAGE_SHIFT)
+ /* get offset address from aligned page */
+@@ -124,7 +125,7 @@ static int search_empty_map_area(struct snd_emu10k1 *emu, int npages, struct lis
+ }
+ page = blk->mapped_page + blk->pages;
+ }
+- size = MAX_ALIGN_PAGES - page;
++ size = (emu->address_mode ? MAX_ALIGN_PAGES1 : MAX_ALIGN_PAGES0) - page;
+ if (size >= max_size) {
+ *nextp = pos;
+ return page;
+@@ -181,7 +182,7 @@ static int unmap_memblk(struct snd_emu10k1 *emu, struct snd_emu10k1_memblk *blk)
+ q = get_emu10k1_memblk(p, mapped_link);
+ end_page = q->mapped_page;
+ } else
+- end_page = MAX_ALIGN_PAGES;
++ end_page = (emu->address_mode ? MAX_ALIGN_PAGES1 : MAX_ALIGN_PAGES0);
+
+ /* remove links */
+ list_del(&blk->mapped_link);
+@@ -305,7 +306,7 @@ snd_emu10k1_alloc_pages(struct snd_emu10k1 *emu, struct snd_pcm_substream *subst
+ if (snd_BUG_ON(!emu))
+ return NULL;
+ if (snd_BUG_ON(runtime->dma_bytes <= 0 ||
+- runtime->dma_bytes >= MAXPAGES * EMUPAGESIZE))
++ runtime->dma_bytes >= (emu->address_mode ? MAXPAGES1 : MAXPAGES0) * EMUPAGESIZE))
+ return NULL;
+ hdr = emu->memhdr;
+ if (snd_BUG_ON(!hdr))
+diff --git a/sound/pci/hda/patch_conexant.c b/sound/pci/hda/patch_conexant.c
+index 843d9f3..6a524fb 100644
+--- a/sound/pci/hda/patch_conexant.c
++++ b/sound/pci/hda/patch_conexant.c
+@@ -4598,6 +4598,14 @@ static const struct hda_codec_preset snd_hda_preset_conexant[] = {
+ .patch = patch_conexant_auto },
+ { .id = 0x14f150b9, .name = "CX20665",
+ .patch = patch_conexant_auto },
++ { .id = 0x14f150f1, .name = "CX20721",
++ .patch = patch_conexant_auto },
++ { .id = 0x14f150f2, .name = "CX20722",
++ .patch = patch_conexant_auto },
++ { .id = 0x14f150f3, .name = "CX20723",
++ .patch = patch_conexant_auto },
++ { .id = 0x14f150f4, .name = "CX20724",
++ .patch = patch_conexant_auto },
+ { .id = 0x14f1510f, .name = "CX20751/2",
+ .patch = patch_conexant_auto },
+ { .id = 0x14f15110, .name = "CX20751/2",
+@@ -4632,6 +4640,10 @@ MODULE_ALIAS("snd-hda-codec-id:14f150ab");
+ MODULE_ALIAS("snd-hda-codec-id:14f150ac");
+ MODULE_ALIAS("snd-hda-codec-id:14f150b8");
+ MODULE_ALIAS("snd-hda-codec-id:14f150b9");
++MODULE_ALIAS("snd-hda-codec-id:14f150f1");
++MODULE_ALIAS("snd-hda-codec-id:14f150f2");
++MODULE_ALIAS("snd-hda-codec-id:14f150f3");
++MODULE_ALIAS("snd-hda-codec-id:14f150f4");
+ MODULE_ALIAS("snd-hda-codec-id:14f1510f");
+ MODULE_ALIAS("snd-hda-codec-id:14f15110");
+ MODULE_ALIAS("snd-hda-codec-id:14f15111");
+diff --git a/sound/soc/codecs/cs4271.c b/sound/soc/codecs/cs4271.c
+index 561d5e0..e99c10b 100644
+--- a/sound/soc/codecs/cs4271.c
++++ b/sound/soc/codecs/cs4271.c
+@@ -475,10 +475,10 @@ static int cs4271_probe(struct snd_soc_codec *codec)
+ if (gpio_nreset >= 0) {
+ /* Reset codec */
+ gpio_direction_output(gpio_nreset, 0);
+- udelay(1);
++ mdelay(1);
+ gpio_set_value(gpio_nreset, 1);
+ /* Give the codec time to wake up */
+- udelay(1);
++ mdelay(1);
+ }
+
+ cs4271->gpio_nreset = gpio_nreset;
+diff --git a/sound/soc/codecs/wm8741.c b/sound/soc/codecs/wm8741.c
+index 57ad22a..6ab4f27 100644
+--- a/sound/soc/codecs/wm8741.c
++++ b/sound/soc/codecs/wm8741.c
+@@ -117,7 +117,7 @@ static struct {
+ };
+
+ static unsigned int rates_11289[] = {
+- 44100, 88235,
++ 44100, 88200,
+ };
+
+ static struct snd_pcm_hw_constraint_list constraints_11289 = {
+@@ -144,7 +144,7 @@ static struct snd_pcm_hw_constraint_list constraints_16384 = {
+ };
+
+ static unsigned int rates_16934[] = {
+- 44100, 88235,
++ 44100, 88200,
+ };
+
+ static struct snd_pcm_hw_constraint_list constraints_16934 = {
+@@ -162,7 +162,7 @@ static struct snd_pcm_hw_constraint_list constraints_18432 = {
+ };
+
+ static unsigned int rates_22579[] = {
+- 44100, 88235, 1764000
++ 44100, 88200, 176400
+ };
+
+ static struct snd_pcm_hw_constraint_list constraints_22579 = {
+@@ -180,7 +180,7 @@ static struct snd_pcm_hw_constraint_list constraints_24576 = {
+ };
+
+ static unsigned int rates_36864[] = {
+- 48000, 96000, 19200
++ 48000, 96000, 192000
+ };
+
+ static struct snd_pcm_hw_constraint_list constraints_36864 = {
+diff --git a/sound/soc/codecs/wm8960.c b/sound/soc/codecs/wm8960.c
+index b2abe93..8d26104 100644
+--- a/sound/soc/codecs/wm8960.c
++++ b/sound/soc/codecs/wm8960.c
+@@ -336,7 +336,7 @@ static const struct snd_soc_dapm_route audio_paths[] = {
+ { "Right Input Mixer", "Boost Switch", "Right Boost Mixer", },
+ { "Right Input Mixer", NULL, "RINPUT1", }, /* Really Boost Switch */
+ { "Right Input Mixer", NULL, "RINPUT2" },
+- { "Right Input Mixer", NULL, "LINPUT3" },
++ { "Right Input Mixer", NULL, "RINPUT3" },
+
+ { "Left ADC", NULL, "Left Input Mixer" },
+ { "Right ADC", NULL, "Right Input Mixer" },
+diff --git a/sound/soc/codecs/wm8994.c b/sound/soc/codecs/wm8994.c
+index b73f226..9a56798 100644
+--- a/sound/soc/codecs/wm8994.c
++++ b/sound/soc/codecs/wm8994.c
+@@ -2449,7 +2449,7 @@ static struct {
+ };
+
+ static int fs_ratios[] = {
+- 64, 128, 192, 256, 348, 512, 768, 1024, 1408, 1536
++ 64, 128, 192, 256, 384, 512, 768, 1024, 1408, 1536
+ };
+
+ static int bclk_divs[] = {
+diff --git a/sound/soc/soc-dapm.c b/sound/soc/soc-dapm.c
+index 1d83a40..3dc1b8a 100644
+--- a/sound/soc/soc-dapm.c
++++ b/sound/soc/soc-dapm.c
+@@ -2675,12 +2675,18 @@ int snd_soc_dapm_new_control(struct snd_soc_dapm_context *dapm,
+ kfree(w);
+ return -ENOMEM;
+ }
+- if (dapm->codec && dapm->codec->name_prefix)
++ if (dapm->codec && dapm->codec->name_prefix) {
+ snprintf(w->name, name_len, "%s %s",
+ dapm->codec->name_prefix, widget->name);
+- else
++ if (widget->sname)
++ w->sname = kasprintf(GFP_KERNEL, "%s %s",
++ dapm->codec->name_prefix,
++ widget->sname);
++ } else {
+ snprintf(w->name, name_len, "%s", widget->name);
+-
++ if (widget->sname)
++ w->sname = kasprintf(GFP_KERNEL, "%s", widget->sname);
++ }
+ switch (w->id) {
+ case snd_soc_dapm_switch:
+ case snd_soc_dapm_mixer:
+diff --git a/sound/synth/emux/emux_oss.c b/sound/synth/emux/emux_oss.c
+index 319754c..daf61ab 100644
+--- a/sound/synth/emux/emux_oss.c
++++ b/sound/synth/emux/emux_oss.c
+@@ -118,12 +118,8 @@ snd_emux_open_seq_oss(struct snd_seq_oss_arg *arg, void *closure)
+ if (snd_BUG_ON(!arg || !emu))
+ return -ENXIO;
+
+- mutex_lock(&emu->register_mutex);
+-
+- if (!snd_emux_inc_count(emu)) {
+- mutex_unlock(&emu->register_mutex);
++ if (!snd_emux_inc_count(emu))
+ return -EFAULT;
+- }
+
+ memset(&callback, 0, sizeof(callback));
+ callback.owner = THIS_MODULE;
+@@ -135,7 +131,6 @@ snd_emux_open_seq_oss(struct snd_seq_oss_arg *arg, void *closure)
+ if (p == NULL) {
+ snd_printk(KERN_ERR "can't create port\n");
+ snd_emux_dec_count(emu);
+- mutex_unlock(&emu->register_mutex);
+ return -ENOMEM;
+ }
+
+@@ -148,8 +143,6 @@ snd_emux_open_seq_oss(struct snd_seq_oss_arg *arg, void *closure)
+ reset_port_mode(p, arg->seq_mode);
+
+ snd_emux_reset_port(p);
+-
+- mutex_unlock(&emu->register_mutex);
+ return 0;
+ }
+
+@@ -195,13 +188,11 @@ snd_emux_close_seq_oss(struct snd_seq_oss_arg *arg)
+ if (snd_BUG_ON(!emu))
+ return -ENXIO;
+
+- mutex_lock(&emu->register_mutex);
+ snd_emux_sounds_off_all(p);
+ snd_soundfont_close_check(emu->sflist, SF_CLIENT_NO(p->chset.port));
+ snd_seq_event_port_detach(p->chset.client, p->chset.port);
+ snd_emux_dec_count(emu);
+
+- mutex_unlock(&emu->register_mutex);
+ return 0;
+ }
+
+diff --git a/sound/synth/emux/emux_seq.c b/sound/synth/emux/emux_seq.c
+index 7778b8e..a020920 100644
+--- a/sound/synth/emux/emux_seq.c
++++ b/sound/synth/emux/emux_seq.c
+@@ -124,12 +124,10 @@ snd_emux_detach_seq(struct snd_emux *emu)
+ if (emu->voices)
+ snd_emux_terminate_all(emu);
+
+- mutex_lock(&emu->register_mutex);
+ if (emu->client >= 0) {
+ snd_seq_delete_kernel_client(emu->client);
+ emu->client = -1;
+ }
+- mutex_unlock(&emu->register_mutex);
+ }
+
+
+@@ -269,8 +267,8 @@ snd_emux_event_input(struct snd_seq_event *ev, int direct, void *private_data,
+ /*
+ * increment usage count
+ */
+-int
+-snd_emux_inc_count(struct snd_emux *emu)
++static int
++__snd_emux_inc_count(struct snd_emux *emu)
+ {
+ emu->used++;
+ if (!try_module_get(emu->ops.owner))
+@@ -284,12 +282,21 @@ snd_emux_inc_count(struct snd_emux *emu)
+ return 1;
+ }
+
++int snd_emux_inc_count(struct snd_emux *emu)
++{
++ int ret;
++
++ mutex_lock(&emu->register_mutex);
++ ret = __snd_emux_inc_count(emu);
++ mutex_unlock(&emu->register_mutex);
++ return ret;
++}
+
+ /*
+ * decrease usage count
+ */
+-void
+-snd_emux_dec_count(struct snd_emux *emu)
++static void
++__snd_emux_dec_count(struct snd_emux *emu)
+ {
+ module_put(emu->card->module);
+ emu->used--;
+@@ -298,6 +305,12 @@ snd_emux_dec_count(struct snd_emux *emu)
+ module_put(emu->ops.owner);
+ }
+
++void snd_emux_dec_count(struct snd_emux *emu)
++{
++ mutex_lock(&emu->register_mutex);
++ __snd_emux_dec_count(emu);
++ mutex_unlock(&emu->register_mutex);
++}
+
+ /*
+ * Routine that is called upon a first use of a particular port
+@@ -317,7 +330,7 @@ snd_emux_use(void *private_data, struct snd_seq_port_subscribe *info)
+
+ mutex_lock(&emu->register_mutex);
+ snd_emux_init_port(p);
+- snd_emux_inc_count(emu);
++ __snd_emux_inc_count(emu);
+ mutex_unlock(&emu->register_mutex);
+ return 0;
+ }
+@@ -340,7 +353,7 @@ snd_emux_unuse(void *private_data, struct snd_seq_port_subscribe *info)
+
+ mutex_lock(&emu->register_mutex);
+ snd_emux_sounds_off_all(p);
+- snd_emux_dec_count(emu);
++ __snd_emux_dec_count(emu);
+ mutex_unlock(&emu->register_mutex);
+ return 0;
+ }
+diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c
+index 88160b7..488e531 100644
+--- a/sound/usb/mixer.c
++++ b/sound/usb/mixer.c
+@@ -838,6 +838,8 @@ static void volume_control_quirks(struct usb_mixer_elem_info *cval,
+ case USB_ID(0x046d, 0x081b): /* HD Webcam c310 */
+ case USB_ID(0x046d, 0x081d): /* HD Webcam c510 */
+ case USB_ID(0x046d, 0x0825): /* HD Webcam c270 */
++ case USB_ID(0x046d, 0x0826): /* HD Webcam c525 */
++ case USB_ID(0x046d, 0x08ca): /* Logitech Quickcam Fusion */
+ case USB_ID(0x046d, 0x0991):
+ /* Most audio usb devices lie about volume resolution.
+ * Most Logitech webcams have res = 384.
+@@ -1423,11 +1425,6 @@ static int parse_audio_mixer_unit(struct mixer_build *state, int unitid, void *r
+ snd_printk(KERN_ERR "invalid MIXER UNIT descriptor %d\n", unitid);
+ return -EINVAL;
+ }
+- /* no bmControls field (e.g. Maya44) -> ignore */
+- if (desc->bLength <= 10 + input_pins) {
+- snd_printdd(KERN_INFO "MU %d has no bmControls field\n", unitid);
+- return 0;
+- }
+
+ num_ins = 0;
+ ich = 0;
+@@ -1435,6 +1432,9 @@ static int parse_audio_mixer_unit(struct mixer_build *state, int unitid, void *r
+ err = parse_audio_unit(state, desc->baSourceID[pin]);
+ if (err < 0)
+ return err;
++ /* no bmControls field (e.g. Maya44) -> ignore */
++ if (desc->bLength <= 10 + input_pins)
++ continue;
+ err = check_input_term(state, desc->baSourceID[pin], &iterm);
+ if (err < 0)
+ return err;
+diff --git a/sound/usb/mixer_maps.c b/sound/usb/mixer_maps.c
+index 1e0798f..851786f 100644
+--- a/sound/usb/mixer_maps.c
++++ b/sound/usb/mixer_maps.c
+@@ -380,6 +380,11 @@ static struct usbmix_ctl_map usbmix_ctl_maps[] = {
+ .ignore_ctl_error = 1,
+ },
+ {
++ /* MAYA44 USB+ */
++ .id = USB_ID(0x2573, 0x0008),
++ .map = maya44_map,
++ },
++ {
+ /* KEF X300A */
+ .id = USB_ID(0x27ac, 0x1000),
+ .map = scms_usb3318_map,
diff --git a/3.2.69/4420_grsecurity-3.1-3.2.69-201508020900.patch b/3.2.70/4420_grsecurity-3.1-3.2.70-201508102127.patch
index e361065..9aaf5cc 100644
--- a/3.2.69/4420_grsecurity-3.1-3.2.69-201508020900.patch
+++ b/3.2.70/4420_grsecurity-3.1-3.2.70-201508102127.patch
@@ -315,7 +315,7 @@ index 2a68089..b3300e1 100644
A toggle value indicating if modules are allowed to be loaded
diff --git a/Makefile b/Makefile
-index 8071888..b024b7b 100644
+index 41a626b..31e889e 100644
--- a/Makefile
+++ b/Makefile
@@ -245,8 +245,9 @@ CONFIG_SHELL := $(shell if [ -x "$$BASH" ]; then echo $$BASH; \
@@ -1693,14 +1693,14 @@ index af18cea..b5dc173 100644
#endif /* __ASSEMBLY__ */
diff --git a/arch/arm/include/asm/elf.h b/arch/arm/include/asm/elf.h
-index 0e9ce8d..6ef1e03 100644
+index a4b1186..6ef1e03 100644
--- a/arch/arm/include/asm/elf.h
+++ b/arch/arm/include/asm/elf.h
@@ -116,7 +116,14 @@ int dump_task_regs(struct task_struct *t, elf_gregset_t *elfregs);
the loader. We need to make sure that it is out of the way of the program
that it will "exec", and that there is sufficient room for the brk. */
--#define ELF_ET_DYN_BASE (2 * TASK_SIZE / 3)
+-#define ELF_ET_DYN_BASE (TASK_SIZE / 3 * 2)
+#define ELF_ET_DYN_BASE (TASK_SIZE / 3 * 2)
+
+#ifdef CONFIG_PAX_ASLR
@@ -4188,21 +4188,19 @@ index 883fc6c..28c0acd 100644
void __init gt641xx_irq_init(void)
diff --git a/arch/mips/kernel/irq.c b/arch/mips/kernel/irq.c
-index 7f50318..20685b9 100644
+index 6e489e5..79e10cb 100644
--- a/arch/mips/kernel/irq.c
+++ b/arch/mips/kernel/irq.c
-@@ -111,7 +111,10 @@ void __init init_IRQ(void)
- #endif
+@@ -112,6 +112,8 @@ void __init init_IRQ(void)
}
+ #ifdef CONFIG_DEBUG_STACKOVERFLOW
+
- #ifdef DEBUG_STACKOVERFLOW
+extern void gr_handle_kernel_exploit(void);
-+
static inline void check_stack_overflow(void)
{
unsigned long sp;
-@@ -127,6 +130,7 @@ static inline void check_stack_overflow(void)
+@@ -127,6 +129,7 @@ static inline void check_stack_overflow(void)
printk("do_IRQ: stack overflow: %ld\n",
sp - sizeof(struct thread_info));
dump_stack();
@@ -4472,10 +4470,10 @@ index 302d779..b8b4e97 100644
- return ret;
-}
diff --git a/arch/mips/pci/pci-octeon.c b/arch/mips/pci/pci-octeon.c
-index ed1c542..88552ac 100644
+index 66d3c38..fed57fa 100644
--- a/arch/mips/pci/pci-octeon.c
+++ b/arch/mips/pci/pci-octeon.c
-@@ -335,8 +335,8 @@ static int octeon_write_config(struct pci_bus *bus, unsigned int devfn,
+@@ -329,8 +329,8 @@ static int octeon_write_config(struct pci_bus *bus, unsigned int devfn,
static struct pci_ops octeon_pci_ops = {
@@ -4487,10 +4485,10 @@ index ed1c542..88552ac 100644
static struct resource octeon_pci_mem_resource = {
diff --git a/arch/mips/pci/pcie-octeon.c b/arch/mips/pci/pcie-octeon.c
-index 0583c463..c07a38e 100644
+index 37a8790..dd636c1 100644
--- a/arch/mips/pci/pcie-octeon.c
+++ b/arch/mips/pci/pcie-octeon.c
-@@ -1238,8 +1238,8 @@ static int octeon_pcie1_write_config(struct pci_bus *bus, unsigned int devfn,
+@@ -1235,8 +1235,8 @@ static int octeon_pcie1_write_config(struct pci_bus *bus, unsigned int devfn,
}
static struct pci_ops octeon_pcie0_ops = {
@@ -4501,7 +4499,7 @@ index 0583c463..c07a38e 100644
};
static struct resource octeon_pcie0_mem_resource = {
-@@ -1259,8 +1259,8 @@ static struct pci_controller octeon_pcie0_controller = {
+@@ -1256,8 +1256,8 @@ static struct pci_controller octeon_pcie0_controller = {
};
static struct pci_ops octeon_pcie1_ops = {
@@ -6337,13 +6335,13 @@ index 7450843..9f8cfc7 100644
return 0;
}
diff --git a/arch/powerpc/mm/mmap_64.c b/arch/powerpc/mm/mmap_64.c
-index 5a783d8..522eb00 100644
+index 67a42ed..333731a 100644
--- a/arch/powerpc/mm/mmap_64.c
+++ b/arch/powerpc/mm/mmap_64.c
-@@ -61,10 +61,14 @@ static inline int mmap_is_legacy(void)
- *
- * To avoid this we can shift the randomness by 1 bit.
- */
+@@ -53,10 +53,14 @@ static inline int mmap_is_legacy(void)
+ return sysctl_legacy_va_layout;
+ }
+
-static unsigned long mmap_rnd(void)
+static unsigned long mmap_rnd(struct mm_struct *mm)
{
@@ -6356,8 +6354,8 @@ index 5a783d8..522eb00 100644
if (current->flags & PF_RANDOMIZE) {
/* 8MB for 32bit, 1GB for 64bit */
if (is_32bit_task())
-@@ -75,7 +79,7 @@ static unsigned long mmap_rnd(void)
- return (rnd << PAGE_SHIFT) * 2;
+@@ -67,7 +71,7 @@ static unsigned long mmap_rnd(void)
+ return rnd << PAGE_SHIFT;
}
-static inline unsigned long mmap_base(void)
@@ -6365,7 +6363,7 @@ index 5a783d8..522eb00 100644
{
unsigned long gap = rlimit(RLIMIT_STACK);
-@@ -84,7 +88,7 @@ static inline unsigned long mmap_base(void)
+@@ -76,7 +80,7 @@ static inline unsigned long mmap_base(void)
else if (gap > MAX_GAP)
gap = MAX_GAP;
@@ -6374,7 +6372,7 @@ index 5a783d8..522eb00 100644
}
/*
-@@ -99,10 +103,22 @@ void arch_pick_mmap_layout(struct mm_struct *mm)
+@@ -91,10 +95,22 @@ void arch_pick_mmap_layout(struct mm_struct *mm)
*/
if (mmap_is_legacy()) {
mm->mmap_base = TASK_UNMAPPED_BASE;
@@ -8258,7 +8256,7 @@ index 42b282f..408977c 100644
addr = vmm->vm_end;
if (flags & MAP_SHARED)
diff --git a/arch/sparc/kernel/sys_sparc_64.c b/arch/sparc/kernel/sys_sparc_64.c
-index 5e4252b..379f84f 100644
+index 0ff682d..60e979d 100644
--- a/arch/sparc/kernel/sys_sparc_64.c
+++ b/arch/sparc/kernel/sys_sparc_64.c
@@ -119,12 +119,13 @@ unsigned long arch_get_unmapped_area(struct file *filp, unsigned long addr, unsi
@@ -10487,7 +10485,7 @@ index ad8f795..2c7eec6 100644
/*
* Memory returned by kmalloc() may be used for DMA, so we must make
diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
-index 28a1bca..0443883 100644
+index d720208..5653761 100644
--- a/arch/x86/Kconfig
+++ b/arch/x86/Kconfig
@@ -75,6 +75,7 @@ config X86
@@ -10498,7 +10496,7 @@ index 28a1bca..0443883 100644
select ARCH_SUPPORTS_ATOMIC_RMW
config INSTRUCTION_DECODER
-@@ -236,7 +237,7 @@ config X86_HT
+@@ -237,7 +238,7 @@ config X86_HT
config X86_32_LAZY_GS
def_bool y
@@ -10507,7 +10505,7 @@ index 28a1bca..0443883 100644
config ARCH_HWEIGHT_CFLAGS
string
-@@ -526,6 +527,7 @@ config SCHED_OMIT_FRAME_POINTER
+@@ -527,6 +528,7 @@ config SCHED_OMIT_FRAME_POINTER
menuconfig PARAVIRT_GUEST
bool "Paravirtualized guest support"
@@ -10515,7 +10513,7 @@ index 28a1bca..0443883 100644
---help---
Say Y here to get to see options related to running Linux under
various hypervisors. This option alone does not add any kernel code.
-@@ -903,6 +905,7 @@ config VM86
+@@ -904,6 +906,7 @@ config VM86
config X86_16BIT
bool "Enable support for 16-bit segments" if EXPERT
@@ -10523,7 +10521,7 @@ index 28a1bca..0443883 100644
default y
---help---
This option is required by programs like Wine to run 16-bit
-@@ -1040,7 +1043,7 @@ choice
+@@ -1041,7 +1044,7 @@ choice
config NOHIGHMEM
bool "off"
@@ -10532,7 +10530,7 @@ index 28a1bca..0443883 100644
---help---
Linux can use up to 64 Gigabytes of physical memory on x86 systems.
However, the address space of 32-bit x86 processors is only 4
-@@ -1077,7 +1080,7 @@ config NOHIGHMEM
+@@ -1078,7 +1081,7 @@ config NOHIGHMEM
config HIGHMEM4G
bool "4GB"
@@ -10541,7 +10539,7 @@ index 28a1bca..0443883 100644
---help---
Select this if you have a 32-bit processor and between 1 and 4
gigabytes of physical RAM.
-@@ -1131,7 +1134,7 @@ config PAGE_OFFSET
+@@ -1132,7 +1135,7 @@ config PAGE_OFFSET
hex
default 0xB0000000 if VMSPLIT_3G_OPT
default 0x80000000 if VMSPLIT_2G
@@ -10550,7 +10548,7 @@ index 28a1bca..0443883 100644
default 0x40000000 if VMSPLIT_1G
default 0xC0000000
depends on X86_32
-@@ -1514,6 +1517,7 @@ config SECCOMP
+@@ -1515,6 +1518,7 @@ config SECCOMP
config CC_STACKPROTECTOR
bool "Enable -fstack-protector buffer overflow detection (EXPERIMENTAL)"
@@ -10558,7 +10556,7 @@ index 28a1bca..0443883 100644
---help---
This option turns on the -fstack-protector GCC feature. This
feature puts, at the beginning of functions, a canary value on
-@@ -1532,6 +1536,7 @@ source kernel/Kconfig.hz
+@@ -1533,6 +1537,7 @@ source kernel/Kconfig.hz
config KEXEC
bool "kexec system call"
@@ -10566,7 +10564,7 @@ index 28a1bca..0443883 100644
---help---
kexec is a system call that implements the ability to shutdown your
current kernel, and to start another kernel. It is like a reboot
-@@ -1634,6 +1639,8 @@ config X86_NEED_RELOCS
+@@ -1635,6 +1640,8 @@ config X86_NEED_RELOCS
config PHYSICAL_ALIGN
hex "Alignment value to which kernel should be aligned" if X86_32
default "0x1000000"
@@ -10575,7 +10573,7 @@ index 28a1bca..0443883 100644
range 0x2000 0x1000000
---help---
This value puts the alignment restrictions on physical address
-@@ -1665,9 +1672,10 @@ config HOTPLUG_CPU
+@@ -1666,9 +1673,10 @@ config HOTPLUG_CPU
Say N if you want to disable CPU hotplug.
config COMPAT_VDSO
@@ -10587,7 +10585,7 @@ index 28a1bca..0443883 100644
---help---
Map the 32-bit VDSO to the predictable old-style address too.
-@@ -1720,6 +1728,22 @@ config CMDLINE_OVERRIDE
+@@ -1721,6 +1729,22 @@ config CMDLINE_OVERRIDE
This is used to work around broken boot loaders. This should
be set to 'N' under normal conditions.
@@ -23597,7 +23595,7 @@ index 42eb330..139955c 100644
return ret;
diff --git a/arch/x86/kernel/reboot.c b/arch/x86/kernel/reboot.c
-index 41b2f57..9dd7145 100644
+index 78842ce..2e4b56d 100644
--- a/arch/x86/kernel/reboot.c
+++ b/arch/x86/kernel/reboot.c
@@ -35,7 +35,7 @@ void (*pm_power_off)(void);
@@ -23700,7 +23698,7 @@ index 41b2f57..9dd7145 100644
{
int i;
int attempt = 0;
-@@ -717,13 +749,13 @@ void native_machine_shutdown(void)
+@@ -720,13 +752,13 @@ void native_machine_shutdown(void)
#endif
}
@@ -23716,7 +23714,7 @@ index 41b2f57..9dd7145 100644
{
printk("machine restart\n");
-@@ -732,7 +764,7 @@ static void native_machine_restart(char *__unused)
+@@ -735,7 +767,7 @@ static void native_machine_restart(char *__unused)
__machine_emergency_restart(0);
}
@@ -23725,7 +23723,7 @@ index 41b2f57..9dd7145 100644
{
/* stop other cpus and apics */
machine_shutdown();
-@@ -743,7 +775,7 @@ static void native_machine_halt(void)
+@@ -746,7 +778,7 @@ static void native_machine_halt(void)
stop_this_cpu(NULL);
}
@@ -23734,7 +23732,7 @@ index 41b2f57..9dd7145 100644
{
if (pm_power_off) {
if (!reboot_force)
-@@ -752,9 +784,10 @@ static void native_machine_power_off(void)
+@@ -755,9 +787,10 @@ static void native_machine_power_off(void)
}
/* a fallback in case there is no PM info available */
tboot_shutdown(TB_SHUTDOWN_HALT);
@@ -25424,7 +25422,7 @@ index 176205a..920cd58 100644
#define APIC_LVT_NUM 6
/* 14 is the version for Xeon and Pentium 8.4.8*/
diff --git a/arch/x86/kvm/mmu.c b/arch/x86/kvm/mmu.c
-index bfc9507..bf85b38 100644
+index 4a949c7..a1e965f 100644
--- a/arch/x86/kvm/mmu.c
+++ b/arch/x86/kvm/mmu.c
@@ -3558,7 +3558,7 @@ void kvm_mmu_pte_write(struct kvm_vcpu *vcpu, gpa_t gpa,
@@ -25495,7 +25493,7 @@ index 7a2d9d6..0e8286c 100644
local_irq_disable();
diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
-index 8831c43..98f1a3e 100644
+index 421958f..79e1420 100644
--- a/arch/x86/kvm/vmx.c
+++ b/arch/x86/kvm/vmx.c
@@ -1100,12 +1100,12 @@ static void vmcs_write64(unsigned long field, u64 value)
@@ -25550,7 +25548,7 @@ index 8831c43..98f1a3e 100644
if (enable_ept && !cpu_has_vmx_ept_2m_page())
kvm_disable_largepages();
-@@ -3638,7 +3649,10 @@ static void vmx_set_constant_host_state(struct vcpu_vmx *vmx)
+@@ -3646,7 +3657,10 @@ static void vmx_set_constant_host_state(struct vcpu_vmx *vmx)
unsigned long cr4;
vmcs_writel(HOST_CR0, read_cr0() | X86_CR0_TS); /* 22.2.3 */
@@ -25561,7 +25559,7 @@ index 8831c43..98f1a3e 100644
/* Save the most likely value for this task's CR4 in the VMCS. */
cr4 = read_cr4();
-@@ -3655,7 +3669,7 @@ static void vmx_set_constant_host_state(struct vcpu_vmx *vmx)
+@@ -3663,7 +3677,7 @@ static void vmx_set_constant_host_state(struct vcpu_vmx *vmx)
vmcs_writel(HOST_IDTR_BASE, dt.address); /* 22.2.4 */
asm("mov $.Lkvm_vmx_return, %0" : "=r"(tmpl));
@@ -25570,7 +25568,7 @@ index 8831c43..98f1a3e 100644
rdmsr(MSR_IA32_SYSENTER_CS, low32, high32);
vmcs_write32(HOST_IA32_SYSENTER_CS, low32);
-@@ -6206,6 +6220,12 @@ static void __noclone vmx_vcpu_run(struct kvm_vcpu *vcpu)
+@@ -6214,6 +6228,12 @@ static void __noclone vmx_vcpu_run(struct kvm_vcpu *vcpu)
"jmp .Lkvm_vmx_return \n\t"
".Llaunched: " __ex(ASM_VMX_VMRESUME) "\n\t"
".Lkvm_vmx_return: "
@@ -25583,7 +25581,7 @@ index 8831c43..98f1a3e 100644
/* Save guest registers, load host registers, keep flags */
"mov %0, %c[wordsize](%%"R"sp) \n\t"
"pop %0 \n\t"
-@@ -6254,6 +6274,11 @@ static void __noclone vmx_vcpu_run(struct kvm_vcpu *vcpu)
+@@ -6262,6 +6282,11 @@ static void __noclone vmx_vcpu_run(struct kvm_vcpu *vcpu)
#endif
[cr2]"i"(offsetof(struct vcpu_vmx, vcpu.arch.cr2)),
[wordsize]"i"(sizeof(ulong))
@@ -25595,7 +25593,7 @@ index 8831c43..98f1a3e 100644
: "cc", "memory"
, R"ax", R"bx", R"di", R"si"
#ifdef CONFIG_X86_64
-@@ -6282,7 +6307,16 @@ static void __noclone vmx_vcpu_run(struct kvm_vcpu *vcpu)
+@@ -6290,7 +6315,16 @@ static void __noclone vmx_vcpu_run(struct kvm_vcpu *vcpu)
}
}
@@ -28443,7 +28441,7 @@ index e218d5d..3966c85 100644
+EXPORT_SYMBOL(set_fs);
+#endif
diff --git a/arch/x86/lib/usercopy_64.c b/arch/x86/lib/usercopy_64.c
-index 554b7b5..4027e2c 100644
+index 433b21d..466fd0c 100644
--- a/arch/x86/lib/usercopy_64.c
+++ b/arch/x86/lib/usercopy_64.c
@@ -42,6 +42,12 @@ long
@@ -31046,7 +31044,7 @@ index 6687022..ceabcfa 100644
+ pax_force_retaddr
ret
diff --git a/arch/x86/net/bpf_jit_comp.c b/arch/x86/net/bpf_jit_comp.c
-index 5a5b6e4..07b4acb 100644
+index 11e3100..db113e1 100644
--- a/arch/x86/net/bpf_jit_comp.c
+++ b/arch/x86/net/bpf_jit_comp.c
@@ -11,6 +11,7 @@
@@ -31241,7 +31239,7 @@ index 5a5b6e4..07b4acb 100644
addrs[i] = proglen;
}
cleanup_addr = proglen; /* epilogue address */
-@@ -221,6 +337,10 @@ void bpf_jit_compile(struct sk_filter *fp)
+@@ -226,6 +342,10 @@ void bpf_jit_compile(struct sk_filter *fp)
for (i = 0; i < flen; i++) {
unsigned int K = filter[i].k;
@@ -31252,7 +31250,7 @@ index 5a5b6e4..07b4acb 100644
switch (filter[i].code) {
case BPF_S_ALU_ADD_X: /* A += X; */
seen |= SEEN_XREG;
-@@ -253,10 +373,8 @@ void bpf_jit_compile(struct sk_filter *fp)
+@@ -258,10 +378,8 @@ void bpf_jit_compile(struct sk_filter *fp)
case BPF_S_ALU_MUL_K: /* A *= K */
if (is_imm8(K))
EMIT3(0x6b, 0xc0, K); /* imul imm8,%eax,%eax */
@@ -31265,7 +31263,7 @@ index 5a5b6e4..07b4acb 100644
break;
case BPF_S_ALU_DIV_X: /* A /= X; */
seen |= SEEN_XREG;
-@@ -269,15 +387,21 @@ void bpf_jit_compile(struct sk_filter *fp)
+@@ -274,15 +392,21 @@ void bpf_jit_compile(struct sk_filter *fp)
EMIT_COND_JMP(X86_JE, addrs[pc_ret0 - 1] -
(addrs[i] - 4));
} else {
@@ -31288,7 +31286,7 @@ index 5a5b6e4..07b4acb 100644
EMIT4(0x48, 0xc1, 0xe8, 0x20); /* shr $0x20,%rax */
break;
case BPF_S_ALU_AND_X:
-@@ -477,7 +601,7 @@ void bpf_jit_compile(struct sk_filter *fp)
+@@ -482,7 +606,7 @@ void bpf_jit_compile(struct sk_filter *fp)
common_load: seen |= SEEN_DATAREF;
if ((int)K < 0) {
/* Abort the JIT because __load_pointer() is needed. */
@@ -31297,7 +31295,7 @@ index 5a5b6e4..07b4acb 100644
}
t_offset = func - (image + addrs[i]);
EMIT1_off32(0xbe, K); /* mov imm32,%esi */
-@@ -492,7 +616,7 @@ common_load: seen |= SEEN_DATAREF;
+@@ -497,7 +621,7 @@ common_load: seen |= SEEN_DATAREF;
case BPF_S_LDX_B_MSH:
if ((int)K < 0) {
/* Abort the JIT because __load_pointer() is needed. */
@@ -31306,7 +31304,7 @@ index 5a5b6e4..07b4acb 100644
}
seen |= SEEN_DATAREF | SEEN_XREG;
t_offset = sk_load_byte_msh - (image + addrs[i]);
-@@ -572,7 +696,7 @@ cond_branch: f_offset = addrs[i + filter[i].jf] - addrs[i];
+@@ -577,7 +701,7 @@ cond_branch: f_offset = addrs[i + filter[i].jf] - addrs[i];
}
if (filter[i].jt != 0) {
if (filter[i].jf && f_offset)
@@ -31315,7 +31313,7 @@ index 5a5b6e4..07b4acb 100644
EMIT_COND_JMP(t_op, t_offset);
if (filter[i].jf)
EMIT_JMP(f_offset);
-@@ -582,17 +706,18 @@ cond_branch: f_offset = addrs[i + filter[i].jf] - addrs[i];
+@@ -587,17 +711,18 @@ cond_branch: f_offset = addrs[i + filter[i].jf] - addrs[i];
break;
default:
/* hmm, too complex filter, give up with jit compiler */
@@ -31338,7 +31336,7 @@ index 5a5b6e4..07b4acb 100644
}
proglen += ilen;
addrs[i] = proglen;
-@@ -613,11 +738,9 @@ cond_branch: f_offset = addrs[i + filter[i].jf] - addrs[i];
+@@ -618,11 +743,9 @@ cond_branch: f_offset = addrs[i + filter[i].jf] - addrs[i];
break;
}
if (proglen == oldproglen) {
@@ -31352,7 +31350,7 @@ index 5a5b6e4..07b4acb 100644
}
oldproglen = proglen;
}
-@@ -633,7 +756,10 @@ cond_branch: f_offset = addrs[i + filter[i].jf] - addrs[i];
+@@ -638,7 +761,10 @@ cond_branch: f_offset = addrs[i + filter[i].jf] - addrs[i];
bpf_flush_icache(image, image + proglen);
fp->bpf_func = (void *)image;
@@ -31364,7 +31362,7 @@ index 5a5b6e4..07b4acb 100644
out:
kfree(addrs);
return;
-@@ -641,18 +767,20 @@ out:
+@@ -646,18 +772,20 @@ out:
static void jit_free_defer(struct work_struct *arg)
{
@@ -33729,10 +33727,10 @@ index cb842a8..6688e24 100644
* Broken _BQC workaround http://bugzilla.kernel.org/show_bug.cgi?id=13121
*/
diff --git a/drivers/ata/libahci.c b/drivers/ata/libahci.c
-index de2802c..2260da9 100644
+index 41ffb8c..2afaff8 100644
--- a/drivers/ata/libahci.c
+++ b/drivers/ata/libahci.c
-@@ -1211,7 +1211,7 @@ int ahci_kick_engine(struct ata_port *ap)
+@@ -1212,7 +1212,7 @@ int ahci_kick_engine(struct ata_port *ap)
}
EXPORT_SYMBOL_GPL(ahci_kick_engine);
@@ -33742,7 +33740,7 @@ index de2802c..2260da9 100644
unsigned long timeout_msec)
{
diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
-index 5d8fc3d..d537f03 100644
+index fcd8586..19ba966 100644
--- a/drivers/ata/libata-core.c
+++ b/drivers/ata/libata-core.c
@@ -4790,7 +4790,7 @@ void ata_qc_free(struct ata_queued_cmd *qc)
@@ -38367,10 +38365,10 @@ index b153674..ad2ba9b 100644
PCI_DEVICE(PCI_VENDOR_ID_RADISYS, R82600_BRIDGE_ID)
},
diff --git a/drivers/edac/sb_edac.c b/drivers/edac/sb_edac.c
-index da71881..8d7d62c 100644
+index f8f790c..b43f147 100644
--- a/drivers/edac/sb_edac.c
+++ b/drivers/edac/sb_edac.c
-@@ -367,7 +367,7 @@ static const struct pci_id_table pci_dev_descr_sbridge_table[] = {
+@@ -368,7 +368,7 @@ static const struct pci_id_table pci_dev_descr_sbridge_table[] = {
/*
* pci_device_id table for which devices we are looking for
*/
@@ -38482,10 +38480,10 @@ index 94a58a0..f5eba42 100644
container_of(_dev_attr, struct dmi_device_attribute, dev_attr)
diff --git a/drivers/firmware/dmi_scan.c b/drivers/firmware/dmi_scan.c
-index 2861ef4..9e90c69 100644
+index 20f7daa..91678be 100644
--- a/drivers/firmware/dmi_scan.c
+++ b/drivers/firmware/dmi_scan.c
-@@ -490,11 +490,6 @@ void __init dmi_scan_machine(void)
+@@ -488,11 +488,6 @@ void __init dmi_scan_machine(void)
}
}
else {
@@ -38497,7 +38495,7 @@ index 2861ef4..9e90c69 100644
p = dmi_ioremap(0xF0000, 0x10000);
if (p == NULL)
goto error;
-@@ -775,7 +770,7 @@ int dmi_walk(void (*decode)(const struct dmi_header *, void *),
+@@ -770,7 +765,7 @@ int dmi_walk(void (*decode)(const struct dmi_header *, void *),
if (buf == NULL)
return -1;
@@ -40584,10 +40582,10 @@ index 4ef02b2..8a96831 100644
for (i = 0; i < hid->maxcollection; i++)
diff --git a/drivers/hv/channel.c b/drivers/hv/channel.c
-index 44a1ea4..21cce84 100644
+index a7e6f03..a2b6d86 100644
--- a/drivers/hv/channel.c
+++ b/drivers/hv/channel.c
-@@ -403,8 +403,8 @@ int vmbus_establish_gpadl(struct vmbus_channel *channel, void *kbuffer,
+@@ -406,8 +406,8 @@ int vmbus_establish_gpadl(struct vmbus_channel *channel, void *kbuffer,
unsigned long flags;
int ret = 0;
@@ -43051,7 +43049,7 @@ index 614ebeb..ce439fd 100644
.callback = ss4200_led_dmi_callback,
.ident = "Intel SS4200-E",
diff --git a/drivers/lguest/core.c b/drivers/lguest/core.c
-index b5fdcb7..3cb34b8 100644
+index 34842e5..3cb34b8 100644
--- a/drivers/lguest/core.c
+++ b/drivers/lguest/core.c
@@ -92,9 +92,17 @@ static __init int map_switcher(void)
@@ -43081,15 +43079,6 @@ index b5fdcb7..3cb34b8 100644
end_switcher_text - start_switcher_text);
printk(KERN_INFO "lguest: mapped switcher at %p\n",
-@@ -171,7 +179,7 @@ static void unmap_switcher(void)
- bool lguest_address_ok(const struct lguest *lg,
- unsigned long addr, unsigned long len)
- {
-- return (addr+len) / PAGE_SIZE < lg->pfn_limit && (addr+len >= addr);
-+ return addr+len <= lg->pfn_limit * PAGE_SIZE && (addr+len >= addr);
- }
-
- /*
diff --git a/drivers/lguest/page_tables.c b/drivers/lguest/page_tables.c
index 3b62be16..e33134a 100644
--- a/drivers/lguest/page_tables.c
@@ -43750,7 +43739,7 @@ index abac83a..3652f35 100644
rdev_dec_pending(rdev, mddev);
diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
-index c293d9c..808ae97 100644
+index 6056ee7..a4c3ba4 100644
--- a/drivers/md/raid5.c
+++ b/drivers/md/raid5.c
@@ -598,23 +598,23 @@ async_copy_data(int frombio, struct bio *bio, struct page *page,
@@ -43806,7 +43795,7 @@ index c293d9c..808ae97 100644
sprintf(conf->cache_name[1], "%s-alt", conf->cache_name[0]);
conf->active_name = 0;
-@@ -1618,19 +1626,19 @@ static void raid5_end_read_request(struct bio * bi, int error)
+@@ -1619,19 +1627,19 @@ static void raid5_end_read_request(struct bio * bi, int error)
(unsigned long long)(sh->sector
+ rdev->data_offset),
bdevname(rdev->bdev, b));
@@ -43830,7 +43819,7 @@ index c293d9c..808ae97 100644
if (conf->mddev->degraded >= conf->max_degraded)
printk_ratelimited(
KERN_WARNING
-@@ -1650,7 +1658,7 @@ static void raid5_end_read_request(struct bio * bi, int error)
+@@ -1651,7 +1659,7 @@ static void raid5_end_read_request(struct bio * bi, int error)
(unsigned long long)(sh->sector
+ rdev->data_offset),
bdn);
@@ -46997,6 +46986,22 @@ index 3d21742..b8e03e7 100644
// waiting for all pending urbs to complete?
if (dev->wait) {
if ((dev->txq.qlen + dev->rxq.qlen + dev->done.qlen) == 0) {
+diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
+index f13a673..218ebf0 100644
+--- a/drivers/net/virtio_net.c
++++ b/drivers/net/virtio_net.c
+@@ -981,9 +981,9 @@ static int virtnet_probe(struct virtio_device *vdev)
+ /* Do we support "hardware" checksums? */
+ if (virtio_has_feature(vdev, VIRTIO_NET_F_CSUM)) {
+ /* This opens up the world of extra features. */
+- dev->hw_features |= NETIF_F_HW_CSUM|NETIF_F_SG|NETIF_F_FRAGLIST;
++ dev->hw_features |= NETIF_F_HW_CSUM|NETIF_F_SG;
+ if (csum)
+- dev->features |= NETIF_F_HW_CSUM|NETIF_F_SG|NETIF_F_FRAGLIST;
++ dev->features |= NETIF_F_HW_CSUM|NETIF_F_SG;
+
+ if (virtio_has_feature(vdev, VIRTIO_NET_F_GSO)) {
+ dev->hw_features |= NETIF_F_TSO | NETIF_F_UFO
diff --git a/drivers/net/vmxnet3/vmxnet3_drv.c b/drivers/net/vmxnet3/vmxnet3_drv.c
index 28ceef2..655b059 100644
--- a/drivers/net/vmxnet3/vmxnet3_drv.c
@@ -48357,7 +48362,7 @@ index 26fba2d..693b4d3 100644
1, asus->debug.method_id,
&input, &output);
diff --git a/drivers/platform/x86/compal-laptop.c b/drivers/platform/x86/compal-laptop.c
-index 8877b83..024cf2c 100644
+index ba3638e..70e74af 100644
--- a/drivers/platform/x86/compal-laptop.c
+++ b/drivers/platform/x86/compal-laptop.c
@@ -775,7 +775,7 @@ static int dmi_check_cb_extra(const struct dmi_system_id *id)
@@ -50086,7 +50091,7 @@ index 21a045e..ec89e03 100644
transport_setup_device(&rport->dev);
diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c
-index 5c6b5f5..015ec9d 100644
+index a50825b..7995f6ea 100644
--- a/drivers/scsi/sd.c
+++ b/drivers/scsi/sd.c
@@ -105,7 +105,7 @@ static void sd_shutdown(struct device *);
@@ -50098,7 +50103,7 @@ index 5c6b5f5..015ec9d 100644
static void sd_read_capacity(struct scsi_disk *sdkp, unsigned char *buffer);
static void scsi_disk_release(struct device *cdev);
static void sd_print_sense_hdr(struct scsi_disk *, struct scsi_sense_hdr *);
-@@ -1390,7 +1390,7 @@ static unsigned int sd_completed_bytes(struct scsi_cmnd *scmd)
+@@ -1384,7 +1384,7 @@ static unsigned int sd_completed_bytes(struct scsi_cmnd *scmd)
*
* Note: potentially run from within an ISR. Must not block.
**/
@@ -50107,7 +50112,7 @@ index 5c6b5f5..015ec9d 100644
{
int result = SCpnt->result;
unsigned int good_bytes = result ? 0 : scsi_bufflen(SCpnt);
-@@ -2635,7 +2635,7 @@ static int sd_probe(struct device *dev)
+@@ -2626,7 +2626,7 @@ static int sd_probe(struct device *dev)
device_initialize(&sdkp->dev);
sdkp->dev.parent = dev;
sdkp->dev.class = &sd_disk_class;
@@ -50117,7 +50122,7 @@ index 5c6b5f5..015ec9d 100644
if (device_add(&sdkp->dev))
goto out_free_index;
diff --git a/drivers/scsi/sg.c b/drivers/scsi/sg.c
-index 2d25616..c464bcf 100644
+index b4cac39..c464bcf 100644
--- a/drivers/scsi/sg.c
+++ b/drivers/scsi/sg.c
@@ -1077,7 +1077,7 @@ sg_ioctl(struct file *filp, unsigned int cmd_in, unsigned long arg)
@@ -50129,17 +50134,7 @@ index 2d25616..c464bcf 100644
case BLKTRACESTART:
return blk_trace_startstop(sdp->device->request_queue, 1);
case BLKTRACESTOP:
-@@ -1687,6 +1687,9 @@ static int sg_start_req(Sg_request *srp, unsigned char *cmd)
- md->from_user = 0;
- }
-
-+ if (unlikely(iov_count > UIO_MAXIOV))
-+ return -EINVAL;
-+
- if (iov_count) {
- int len, size = sizeof(struct sg_iovec) * iov_count;
- struct iovec *iov;
-@@ -2312,7 +2315,7 @@ struct sg_proc_leaf {
+@@ -2315,7 +2315,7 @@ struct sg_proc_leaf {
const struct file_operations * fops;
};
@@ -50148,7 +50143,7 @@ index 2d25616..c464bcf 100644
{"allow_dio", &adio_fops},
{"debug", &debug_fops},
{"def_reserved_size", &dressz_fops},
-@@ -2327,7 +2330,7 @@ sg_proc_init(void)
+@@ -2330,7 +2330,7 @@ sg_proc_init(void)
{
int k, mask;
int num_leaves = ARRAY_SIZE(sg_proc_leaf_arr);
@@ -56912,10 +56907,10 @@ index 4a88ac3..d2e1657 100644
EXPORT_SYMBOL_GPL(virtqueue_kick);
diff --git a/drivers/xen/events.c b/drivers/xen/events.c
-index f6227cc..3e22fab 100644
+index bcf7711..98a489c 100644
--- a/drivers/xen/events.c
+++ b/drivers/xen/events.c
-@@ -1632,7 +1632,7 @@ void xen_irq_resume(void)
+@@ -1636,7 +1636,7 @@ void xen_irq_resume(void)
restore_pirqs();
}
@@ -56924,7 +56919,7 @@ index f6227cc..3e22fab 100644
.name = "xen-dyn",
.irq_disable = disable_dynirq,
-@@ -1646,7 +1646,7 @@ static struct irq_chip xen_dynamic_chip __read_mostly = {
+@@ -1650,7 +1650,7 @@ static struct irq_chip xen_dynamic_chip __read_mostly = {
.irq_retrigger = retrigger_dynirq,
};
@@ -56933,7 +56928,7 @@ index f6227cc..3e22fab 100644
.name = "xen-pirq",
.irq_startup = startup_pirq,
-@@ -1666,7 +1666,7 @@ static struct irq_chip xen_pirq_chip __read_mostly = {
+@@ -1670,7 +1670,7 @@ static struct irq_chip xen_pirq_chip __read_mostly = {
.irq_retrigger = retrigger_dynirq,
};
@@ -57368,7 +57363,7 @@ index a6395bd..f1e376a 100644
(unsigned long) create_aout_tables((char __user *) bprm->p, bprm);
#ifdef __alpha__
diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c
-index 2aed667..52b96fd 100644
+index d252462..ebd7fd4 100644
--- a/fs/binfmt_elf.c
+++ b/fs/binfmt_elf.c
@@ -32,6 +32,7 @@
@@ -58005,10 +58000,12 @@ index 2aed667..52b96fd 100644
if (elf_read_implies_exec(loc->elf_ex, executable_stack))
current->personality |= READ_IMPLIES_EXEC;
-@@ -809,6 +1246,20 @@ static int load_elf_binary(struct linux_binprm *bprm, struct pt_regs *regs)
+@@ -810,8 +1247,21 @@ static int load_elf_binary(struct linux_binprm *bprm, struct pt_regs *regs)
#else
load_bias = ELF_PAGESTART(ELF_ET_DYN_BASE - vaddr);
#endif
+- total_size = total_mapping_size(elf_phdata,
+- loc->elf_ex.e_phnum);
+
+#ifdef CONFIG_PAX_RANDMMAP
+ /* PaX: randomize base address at the default exe base if requested */
@@ -58023,10 +58020,11 @@ index 2aed667..52b96fd 100644
+ }
+#endif
+
- }
-
- error = elf_map(bprm->file, load_bias + vaddr, elf_ppnt,
-@@ -841,9 +1292,9 @@ static int load_elf_binary(struct linux_binprm *bprm, struct pt_regs *regs)
++ total_size = total_mapping_size(elf_phdata, loc->elf_ex.e_phnum);
+ if (!total_size) {
+ retval = -EINVAL;
+ goto out_free_dentry;
+@@ -848,9 +1298,9 @@ static int load_elf_binary(struct linux_binprm *bprm, struct pt_regs *regs)
* allowed task size. Note that p_filesz must always be
* <= p_memsz so it is only necessary to check p_memsz.
*/
@@ -58039,7 +58037,7 @@ index 2aed667..52b96fd 100644
/* set_brk can never work. Avoid overflows. */
send_sig(SIGKILL, current, 0);
retval = -EINVAL;
-@@ -882,17 +1333,44 @@ static int load_elf_binary(struct linux_binprm *bprm, struct pt_regs *regs)
+@@ -889,17 +1339,44 @@ static int load_elf_binary(struct linux_binprm *bprm, struct pt_regs *regs)
goto out_free_dentry;
}
if (likely(elf_bss != elf_brk) && unlikely(padzero(elf_bss))) {
@@ -58090,7 +58088,7 @@ index 2aed667..52b96fd 100644
load_bias);
if (!IS_ERR((void *)elf_entry)) {
/*
-@@ -1099,7 +1577,7 @@ out:
+@@ -1106,7 +1583,7 @@ out:
* Decide what to dump of a segment, part, all or none.
*/
static unsigned long vma_dump_size(struct vm_area_struct *vma,
@@ -58099,7 +58097,7 @@ index 2aed667..52b96fd 100644
{
#define FILTER(type) (mm_flags & (1UL << MMF_DUMP_##type))
-@@ -1133,7 +1611,7 @@ static unsigned long vma_dump_size(struct vm_area_struct *vma,
+@@ -1140,7 +1617,7 @@ static unsigned long vma_dump_size(struct vm_area_struct *vma,
if (vma->vm_file == NULL)
return 0;
@@ -58108,7 +58106,7 @@ index 2aed667..52b96fd 100644
goto whole;
/*
-@@ -1355,9 +1833,9 @@ static void fill_auxv_note(struct memelfnote *note, struct mm_struct *mm)
+@@ -1362,9 +1839,9 @@ static void fill_auxv_note(struct memelfnote *note, struct mm_struct *mm)
{
elf_addr_t *auxv = (elf_addr_t *) mm->saved_auxv;
int i = 0;
@@ -58120,7 +58118,7 @@ index 2aed667..52b96fd 100644
fill_note(note, "CORE", NT_AUXV, i * sizeof(elf_addr_t), auxv);
}
-@@ -1852,14 +2330,14 @@ static void fill_extnum_info(struct elfhdr *elf, struct elf_shdr *shdr4extnum,
+@@ -1859,14 +2336,14 @@ static void fill_extnum_info(struct elfhdr *elf, struct elf_shdr *shdr4extnum,
}
static size_t elf_core_vma_data_size(struct vm_area_struct *gate_vma,
@@ -58137,7 +58135,7 @@ index 2aed667..52b96fd 100644
return size;
}
-@@ -1953,7 +2431,7 @@ static int elf_core_dump(struct coredump_params *cprm)
+@@ -1960,7 +2437,7 @@ static int elf_core_dump(struct coredump_params *cprm)
dataoff = offset = roundup(offset, ELF_EXEC_PAGESIZE);
@@ -58146,7 +58144,7 @@ index 2aed667..52b96fd 100644
offset += elf_core_extra_data_size();
e_shoff = offset;
-@@ -1967,10 +2445,12 @@ static int elf_core_dump(struct coredump_params *cprm)
+@@ -1974,10 +2451,12 @@ static int elf_core_dump(struct coredump_params *cprm)
offset = dataoff;
size += sizeof(*elf);
@@ -58159,7 +58157,7 @@ index 2aed667..52b96fd 100644
if (size > cprm->limit
|| !dump_write(cprm->file, phdr4note, sizeof(*phdr4note)))
goto end_coredump;
-@@ -1984,7 +2464,7 @@ static int elf_core_dump(struct coredump_params *cprm)
+@@ -1991,7 +2470,7 @@ static int elf_core_dump(struct coredump_params *cprm)
phdr.p_offset = offset;
phdr.p_vaddr = vma->vm_start;
phdr.p_paddr = 0;
@@ -58168,7 +58166,7 @@ index 2aed667..52b96fd 100644
phdr.p_memsz = vma->vm_end - vma->vm_start;
offset += phdr.p_filesz;
phdr.p_flags = vma->vm_flags & VM_READ ? PF_R : 0;
-@@ -1995,6 +2475,7 @@ static int elf_core_dump(struct coredump_params *cprm)
+@@ -2002,6 +2481,7 @@ static int elf_core_dump(struct coredump_params *cprm)
phdr.p_align = ELF_EXEC_PAGESIZE;
size += sizeof(phdr);
@@ -58176,7 +58174,7 @@ index 2aed667..52b96fd 100644
if (size > cprm->limit
|| !dump_write(cprm->file, &phdr, sizeof(phdr)))
goto end_coredump;
-@@ -2019,7 +2500,7 @@ static int elf_core_dump(struct coredump_params *cprm)
+@@ -2026,7 +2506,7 @@ static int elf_core_dump(struct coredump_params *cprm)
unsigned long addr;
unsigned long end;
@@ -58185,7 +58183,7 @@ index 2aed667..52b96fd 100644
for (addr = vma->vm_start; addr < end; addr += PAGE_SIZE) {
struct page *page;
-@@ -2028,6 +2509,7 @@ static int elf_core_dump(struct coredump_params *cprm)
+@@ -2035,6 +2515,7 @@ static int elf_core_dump(struct coredump_params *cprm)
page = get_dump_page(addr);
if (page) {
void *kaddr = kmap(page);
@@ -58193,7 +58191,7 @@ index 2aed667..52b96fd 100644
stop = ((size += PAGE_SIZE) > cprm->limit) ||
!dump_write(cprm->file, kaddr,
PAGE_SIZE);
-@@ -2045,6 +2527,7 @@ static int elf_core_dump(struct coredump_params *cprm)
+@@ -2052,6 +2533,7 @@ static int elf_core_dump(struct coredump_params *cprm)
if (e_phnum == PN_XNUM) {
size += sizeof(*shdr4extnum);
@@ -58201,7 +58199,7 @@ index 2aed667..52b96fd 100644
if (size > cprm->limit
|| !dump_write(cprm->file, shdr4extnum,
sizeof(*shdr4extnum)))
-@@ -2065,6 +2548,167 @@ out:
+@@ -2072,6 +2554,167 @@ out:
#endif /* CONFIG_ELF_CORE */
@@ -58482,7 +58480,7 @@ index dede441..f2a2507 100644
WARN_ON(trans->transid != btrfs_header_generation(parent));
diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
-index a694317..dc698a1 100644
+index da528f8..97002a3 100644
--- a/fs/btrfs/extent-tree.c
+++ b/fs/btrfs/extent-tree.c
@@ -5644,7 +5644,7 @@ again:
@@ -58495,10 +58493,10 @@ index a694317..dc698a1 100644
do_chunk_alloc(trans, root->fs_info->extent_root,
num_bytes, data, CHUNK_ALLOC_FORCE);
diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
-index 7cbe2f8..20cc43f 100644
+index 52bacff..a4b7f29 100644
--- a/fs/btrfs/ioctl.c
+++ b/fs/btrfs/ioctl.c
-@@ -2770,7 +2770,7 @@ long btrfs_ioctl_space_info(struct btrfs_root *root, void __user *arg)
+@@ -2775,7 +2775,7 @@ long btrfs_ioctl_space_info(struct btrfs_root *root, void __user *arg)
up_read(&info->groups_sem);
}
@@ -59438,7 +59436,7 @@ index 739fb59..5385976 100644
static int __init init_cramfs_fs(void)
{
diff --git a/fs/dcache.c b/fs/dcache.c
-index 8bc98af..68601d9 100644
+index 8a35300..aee4955 100644
--- a/fs/dcache.c
+++ b/fs/dcache.c
@@ -103,11 +103,11 @@ static unsigned int d_hash_shift __read_mostly;
@@ -59481,24 +59479,6 @@ index 8bc98af..68601d9 100644
/*
* If this dentry needs lookup, don't set the referenced flag so that it
* is more likely to be cleaned up by the dcache shrinker in case of
-@@ -1016,13 +1019,13 @@ ascend:
- /* might go back up the wrong parent if we have had a rename */
- if (!locked && read_seqretry(&rename_lock, seq))
- goto rename_retry;
-- next = child->d_child.next;
-- while (unlikely(child->d_flags & DCACHE_DENTRY_KILLED)) {
-+ /* go into the first sibling still alive */
-+ do {
-+ next = child->d_child.next;
- if (next == &this_parent->d_subdirs)
- goto ascend;
- child = list_entry(next, struct dentry, d_child);
-- next = next->next;
-- }
-+ } while (unlikely(child->d_flags & DCACHE_DENTRY_KILLED));
- rcu_read_unlock();
- goto resume;
- }
@@ -1235,6 +1238,9 @@ struct dentry *__d_alloc(struct super_block *sb, const struct qstr *name)
dentry->d_sb = sb;
dentry->d_op = NULL;
@@ -59520,10 +59500,10 @@ index 8bc98af..68601d9 100644
dcache_init();
inode_init();
diff --git a/fs/debugfs/inode.c b/fs/debugfs/inode.c
-index a15f1e2..3077628 100644
+index 74f03b5..c4a9396 100644
--- a/fs/debugfs/inode.c
+++ b/fs/debugfs/inode.c
-@@ -164,6 +164,7 @@ static struct file_system_type debug_fs_type = {
+@@ -165,6 +165,7 @@ static struct file_system_type debug_fs_type = {
.mount = debug_mount,
.kill_sb = kill_litter_super,
};
@@ -59531,7 +59511,7 @@ index a15f1e2..3077628 100644
static int debugfs_create_by_name(const char *name, mode_t mode,
struct dentry *parent,
-@@ -277,11 +278,20 @@ EXPORT_SYMBOL_GPL(debugfs_create_file);
+@@ -278,11 +279,20 @@ EXPORT_SYMBOL_GPL(debugfs_create_file);
* If debugfs is not enabled in the kernel, the value -%ENODEV will be
* returned.
*/
@@ -61286,7 +61266,7 @@ index 22764c7..86372c9 100644
break;
err = alloc_fd(arg, cmd == F_DUPFD_CLOEXEC ? O_CLOEXEC : 0);
diff --git a/fs/fhandle.c b/fs/fhandle.c
-index 6b08864..030db71 100644
+index c9e18f3..030db71 100644
--- a/fs/fhandle.c
+++ b/fs/fhandle.c
@@ -8,6 +8,7 @@
@@ -61306,18 +61286,6 @@ index 6b08864..030db71 100644
retval = -EPERM;
goto out_err;
}
-@@ -196,8 +197,9 @@ static int handle_to_path(int mountdirfd, struct file_handle __user *ufh,
- goto out_err;
- }
- /* copy the full handle */
-- if (copy_from_user(handle, ufh,
-- sizeof(struct file_handle) +
-+ *handle = f_handle;
-+ if (copy_from_user(&handle->f_handle,
-+ &ufh->f_handle,
- f_handle.handle_bytes)) {
- retval = -EFAULT;
- goto out_handle;
diff --git a/fs/fifo.c b/fs/fifo.c
index cf6f434..3d7942c 100644
--- a/fs/fifo.c
@@ -64749,10 +64717,10 @@ index 5d22872..523db20 100644
kfree(link);
}
diff --git a/fs/omfs/inode.c b/fs/omfs/inode.c
-index e043c4c..f99d456 100644
+index f58f1c4..7aed9d4 100644
--- a/fs/omfs/inode.c
+++ b/fs/omfs/inode.c
-@@ -570,6 +570,7 @@ static struct file_system_type omfs_fs_type = {
+@@ -571,6 +571,7 @@ static struct file_system_type omfs_fs_type = {
.kill_sb = kill_block_super,
.fs_flags = FS_REQUIRES_DEV,
};
@@ -64917,7 +64885,7 @@ index bd8ae78..539d250 100644
ldm_crit ("Out of memory.");
return false;
diff --git a/fs/pipe.c b/fs/pipe.c
-index 8ca88fc..db6ce82 100644
+index d2cbeff..db6ce82 100644
--- a/fs/pipe.c
+++ b/fs/pipe.c
@@ -33,7 +33,7 @@ unsigned int pipe_max_size = 1048576;
@@ -64929,109 +64897,7 @@ index 8ca88fc..db6ce82 100644
/*
* We use a start+len construction, which provides full use of the
-@@ -103,25 +103,27 @@ void pipe_wait(struct pipe_inode_info *pipe)
- }
-
- static int
--pipe_iov_copy_from_user(void *to, struct iovec *iov, unsigned long len,
-- int atomic)
-+pipe_iov_copy_from_user(void *addr, int *offset, struct iovec *iov,
-+ size_t *remaining, int atomic)
- {
- unsigned long copy;
-
-- while (len > 0) {
-+ while (*remaining > 0) {
- while (!iov->iov_len)
- iov++;
-- copy = min_t(unsigned long, len, iov->iov_len);
-+ copy = min_t(unsigned long, *remaining, iov->iov_len);
-
- if (atomic) {
-- if (__copy_from_user_inatomic(to, iov->iov_base, copy))
-+ if (__copy_from_user_inatomic(addr + *offset,
-+ iov->iov_base, copy))
- return -EFAULT;
- } else {
-- if (copy_from_user(to, iov->iov_base, copy))
-+ if (copy_from_user(addr + *offset,
-+ iov->iov_base, copy))
- return -EFAULT;
- }
-- to += copy;
-- len -= copy;
-+ *offset += copy;
-+ *remaining -= copy;
- iov->iov_base += copy;
- iov->iov_len -= copy;
- }
-@@ -129,25 +131,27 @@ pipe_iov_copy_from_user(void *to, struct iovec *iov, unsigned long len,
- }
-
- static int
--pipe_iov_copy_to_user(struct iovec *iov, const void *from, unsigned long len,
-- int atomic)
-+pipe_iov_copy_to_user(struct iovec *iov, void *addr, int *offset,
-+ size_t *remaining, int atomic)
- {
- unsigned long copy;
-
-- while (len > 0) {
-+ while (*remaining > 0) {
- while (!iov->iov_len)
- iov++;
-- copy = min_t(unsigned long, len, iov->iov_len);
-+ copy = min_t(unsigned long, *remaining, iov->iov_len);
-
- if (atomic) {
-- if (__copy_to_user_inatomic(iov->iov_base, from, copy))
-+ if (__copy_to_user_inatomic(iov->iov_base,
-+ addr + *offset, copy))
- return -EFAULT;
- } else {
-- if (copy_to_user(iov->iov_base, from, copy))
-+ if (copy_to_user(iov->iov_base,
-+ addr + *offset, copy))
- return -EFAULT;
- }
-- from += copy;
-- len -= copy;
-+ *offset += copy;
-+ *remaining -= copy;
- iov->iov_base += copy;
- iov->iov_len -= copy;
- }
-@@ -383,7 +387,7 @@ pipe_read(struct kiocb *iocb, const struct iovec *_iov,
- struct pipe_buffer *buf = pipe->bufs + curbuf;
- const struct pipe_buf_operations *ops = buf->ops;
- void *addr;
-- size_t chars = buf->len;
-+ size_t chars = buf->len, remaining;
- int error, atomic;
-
- if (chars > total_len)
-@@ -397,9 +401,11 @@ pipe_read(struct kiocb *iocb, const struct iovec *_iov,
- }
-
- atomic = !iov_fault_in_pages_write(iov, chars);
-+ remaining = chars;
- redo:
- addr = ops->map(pipe, buf, atomic);
-- error = pipe_iov_copy_to_user(iov, addr + buf->offset, chars, atomic);
-+ error = pipe_iov_copy_to_user(iov, addr, &buf->offset,
-+ &remaining, atomic);
- ops->unmap(pipe, buf, addr);
- if (unlikely(error)) {
- /*
-@@ -414,7 +420,6 @@ redo:
- break;
- }
- ret += chars;
-- buf->offset += chars;
- buf->len -= chars;
-
- /* Was it a packet buffer? Clean up and exit */
-@@ -437,9 +442,9 @@ redo:
+@@ -442,9 +442,9 @@ redo:
}
if (bufs) /* More to do? */
continue;
@@ -65043,7 +64909,7 @@ index 8ca88fc..db6ce82 100644
/* syscall merging: Usually we must not sleep
* if O_NONBLOCK is set, or if we got some data.
* But if a writer sleeps in kernel space, then
-@@ -503,7 +508,7 @@ pipe_write(struct kiocb *iocb, const struct iovec *_iov,
+@@ -508,7 +508,7 @@ pipe_write(struct kiocb *iocb, const struct iovec *_iov,
mutex_lock(&inode->i_mutex);
pipe = inode->i_pipe;
@@ -65052,26 +64918,7 @@ index 8ca88fc..db6ce82 100644
send_sig(SIGPIPE, current, 0);
ret = -EPIPE;
goto out;
-@@ -521,6 +526,7 @@ pipe_write(struct kiocb *iocb, const struct iovec *_iov,
- if (ops->can_merge && offset + chars <= PAGE_SIZE) {
- int error, atomic = 1;
- void *addr;
-+ size_t remaining = chars;
-
- error = ops->confirm(pipe, buf);
- if (error)
-@@ -529,8 +535,8 @@ pipe_write(struct kiocb *iocb, const struct iovec *_iov,
- iov_fault_in_pages_read(iov, chars);
- redo1:
- addr = ops->map(pipe, buf, atomic);
-- error = pipe_iov_copy_from_user(offset + addr, iov,
-- chars, atomic);
-+ error = pipe_iov_copy_from_user(addr, &offset, iov,
-+ &remaining, atomic);
- ops->unmap(pipe, buf, addr);
- ret = error;
- do_wakeup = 1;
-@@ -552,7 +558,7 @@ redo1:
+@@ -558,7 +558,7 @@ redo1:
for (;;) {
int bufs;
@@ -65080,34 +64927,7 @@ index 8ca88fc..db6ce82 100644
send_sig(SIGPIPE, current, 0);
if (!ret)
ret = -EPIPE;
-@@ -565,6 +571,8 @@ redo1:
- struct page *page = pipe->tmp_page;
- char *src;
- int error, atomic = 1;
-+ int offset = 0;
-+ size_t remaining;
-
- if (!page) {
- page = alloc_page(GFP_HIGHUSER);
-@@ -585,14 +593,15 @@ redo1:
- chars = total_len;
-
- iov_fault_in_pages_read(iov, chars);
-+ remaining = chars;
- redo2:
- if (atomic)
- src = kmap_atomic(page, KM_USER0);
- else
- src = kmap(page);
-
-- error = pipe_iov_copy_from_user(src, iov, chars,
-- atomic);
-+ error = pipe_iov_copy_from_user(src, &offset, iov,
-+ &remaining, atomic);
- if (atomic)
- kunmap_atomic(src, KM_USER0);
- else
-@@ -643,9 +652,9 @@ redo2:
+@@ -652,9 +652,9 @@ redo2:
kill_fasync(&pipe->fasync_readers, SIGIO, POLL_IN);
do_wakeup = 0;
}
@@ -65119,7 +64939,7 @@ index 8ca88fc..db6ce82 100644
}
out:
mutex_unlock(&inode->i_mutex);
-@@ -712,7 +721,7 @@ pipe_poll(struct file *filp, poll_table *wait)
+@@ -721,7 +721,7 @@ pipe_poll(struct file *filp, poll_table *wait)
mask = 0;
if (filp->f_mode & FMODE_READ) {
mask = (nrbufs > 0) ? POLLIN | POLLRDNORM : 0;
@@ -65128,7 +64948,7 @@ index 8ca88fc..db6ce82 100644
mask |= POLLHUP;
}
-@@ -722,7 +731,7 @@ pipe_poll(struct file *filp, poll_table *wait)
+@@ -731,7 +731,7 @@ pipe_poll(struct file *filp, poll_table *wait)
* Most Unices do not set POLLERR for FIFOs but on Linux they
* behave exactly like pipes for poll().
*/
@@ -65137,7 +64957,7 @@ index 8ca88fc..db6ce82 100644
mask |= POLLERR;
}
-@@ -736,10 +745,10 @@ pipe_release(struct inode *inode, int decr, int decw)
+@@ -745,10 +745,10 @@ pipe_release(struct inode *inode, int decr, int decw)
mutex_lock(&inode->i_mutex);
pipe = inode->i_pipe;
@@ -65151,7 +64971,7 @@ index 8ca88fc..db6ce82 100644
free_pipe_info(inode);
} else {
wake_up_interruptible_sync_poll(&pipe->wait, POLLIN | POLLOUT | POLLRDNORM | POLLWRNORM | POLLERR | POLLHUP);
-@@ -829,7 +838,7 @@ pipe_read_open(struct inode *inode, struct file *filp)
+@@ -838,7 +838,7 @@ pipe_read_open(struct inode *inode, struct file *filp)
if (inode->i_pipe) {
ret = 0;
@@ -65160,7 +64980,7 @@ index 8ca88fc..db6ce82 100644
}
mutex_unlock(&inode->i_mutex);
-@@ -846,7 +855,7 @@ pipe_write_open(struct inode *inode, struct file *filp)
+@@ -855,7 +855,7 @@ pipe_write_open(struct inode *inode, struct file *filp)
if (inode->i_pipe) {
ret = 0;
@@ -65169,7 +64989,7 @@ index 8ca88fc..db6ce82 100644
}
mutex_unlock(&inode->i_mutex);
-@@ -867,9 +876,9 @@ pipe_rdwr_open(struct inode *inode, struct file *filp)
+@@ -876,9 +876,9 @@ pipe_rdwr_open(struct inode *inode, struct file *filp)
if (inode->i_pipe) {
ret = 0;
if (filp->f_mode & FMODE_READ)
@@ -65181,7 +65001,7 @@ index 8ca88fc..db6ce82 100644
}
mutex_unlock(&inode->i_mutex);
-@@ -961,7 +970,7 @@ void free_pipe_info(struct inode *inode)
+@@ -970,7 +970,7 @@ void free_pipe_info(struct inode *inode)
inode->i_pipe = NULL;
}
@@ -65190,7 +65010,7 @@ index 8ca88fc..db6ce82 100644
/*
* pipefs_dname() is called from d_path().
-@@ -991,7 +1000,8 @@ static struct inode * get_pipe_inode(void)
+@@ -1000,7 +1000,8 @@ static struct inode * get_pipe_inode(void)
goto fail_iput;
inode->i_pipe = pipe;
@@ -65200,7 +65020,7 @@ index 8ca88fc..db6ce82 100644
inode->i_fop = &rdwr_pipefifo_fops;
/*
-@@ -1203,7 +1213,7 @@ static long pipe_set_size(struct pipe_inode_info *pipe, unsigned long nr_pages)
+@@ -1212,7 +1213,7 @@ static long pipe_set_size(struct pipe_inode_info *pipe, unsigned long nr_pages)
* Currently we rely on the pipe array holding a power-of-2 number
* of pages.
*/
@@ -65209,7 +65029,7 @@ index 8ca88fc..db6ce82 100644
{
unsigned long nr_pages;
-@@ -1253,13 +1263,16 @@ long pipe_fcntl(struct file *file, unsigned int cmd, unsigned long arg)
+@@ -1262,13 +1263,16 @@ long pipe_fcntl(struct file *file, unsigned int cmd, unsigned long arg)
switch (cmd) {
case F_SETPIPE_SZ: {
@@ -84014,10 +83834,10 @@ index f93d8c1..71244f6 100644
int kvm_arch_vcpu_init(struct kvm_vcpu *vcpu);
diff --git a/include/linux/libata.h b/include/linux/libata.h
-index 42ac6ad..703f223 100644
+index 3d4b5b6..3648fe8 100644
--- a/include/linux/libata.h
+++ b/include/linux/libata.h
-@@ -915,7 +915,7 @@ struct ata_port_operations {
+@@ -924,7 +924,7 @@ struct ata_port_operations {
* fields must be pointers.
*/
const struct ata_port_operations *inherits;
@@ -85621,7 +85441,7 @@ index 9aaf5bf..d5ee2a5 100644
}
diff --git a/include/linux/sched.h b/include/linux/sched.h
-index cb34ff4..c086c98 100644
+index 44e5f47..bf5c1f5 100644
--- a/include/linux/sched.h
+++ b/include/linux/sched.h
@@ -101,6 +101,7 @@ struct bio_list;
@@ -87830,7 +87650,7 @@ index 6e4569f..0c8aa25 100644
fib_info_update_nh_saddr((net), &FIB_RES_NH(res)))
#define FIB_RES_GW(res) (FIB_RES_NH(res).nh_gw)
diff --git a/include/net/ip_vs.h b/include/net/ip_vs.h
-index 416dcb0..e203877 100644
+index b8b2e50..91489a1 100644
--- a/include/net/ip_vs.h
+++ b/include/net/ip_vs.h
@@ -509,7 +509,7 @@ struct ip_vs_conn {
@@ -88203,10 +88023,10 @@ index 4d1be75..a54d29e 100644
/* Get the size of a DATA chunk payload. */
diff --git a/include/net/sctp/structs.h b/include/net/sctp/structs.h
-index a15432da..9459dcc 100644
+index 2cccd82..03b6412 100644
--- a/include/net/sctp/structs.h
+++ b/include/net/sctp/structs.h
-@@ -644,7 +644,7 @@ struct sctp_pf {
+@@ -649,7 +649,7 @@ struct sctp_pf {
struct sctp_association *asoc);
void (*addr_v4map) (struct sctp_sock *, union sctp_addr *);
struct sctp_af *af;
@@ -96335,7 +96155,7 @@ index 76b8e77..a2930e8 100644
}
diff --git a/kernel/ptrace.c b/kernel/ptrace.c
-index f79803a..0dcc1be 100644
+index f07c144..d2ad3b0 100644
--- a/kernel/ptrace.c
+++ b/kernel/ptrace.c
@@ -211,7 +211,8 @@ int ptrace_check_attach(struct task_struct *child, bool ignore_state)
@@ -96428,7 +96248,7 @@ index f79803a..0dcc1be 100644
return (data & ~PTRACE_O_MASK) ? -EINVAL : 0;
}
-@@ -720,7 +740,7 @@ int ptrace_request(struct task_struct *child, long request,
+@@ -740,7 +760,7 @@ int ptrace_request(struct task_struct *child, long request,
bool seized = child->ptrace & PT_SEIZED;
int ret = -EIO;
siginfo_t siginfo, *si;
@@ -96437,7 +96257,7 @@ index f79803a..0dcc1be 100644
unsigned long __user *datalp = datavp;
unsigned long flags;
-@@ -922,14 +942,21 @@ SYSCALL_DEFINE4(ptrace, long, request, long, pid, unsigned long, addr,
+@@ -942,14 +962,21 @@ SYSCALL_DEFINE4(ptrace, long, request, long, pid, unsigned long, addr,
goto out;
}
@@ -96460,7 +96280,7 @@ index f79803a..0dcc1be 100644
goto out_put_task_struct;
}
-@@ -957,7 +984,7 @@ int generic_ptrace_peekdata(struct task_struct *tsk, unsigned long addr,
+@@ -977,7 +1004,7 @@ int generic_ptrace_peekdata(struct task_struct *tsk, unsigned long addr,
copied = access_process_vm(tsk, addr, &tmp, sizeof(tmp), 0);
if (copied != sizeof(tmp))
return -EIO;
@@ -96469,7 +96289,7 @@ index f79803a..0dcc1be 100644
}
int generic_ptrace_pokedata(struct task_struct *tsk, unsigned long addr,
-@@ -1051,7 +1078,7 @@ int compat_ptrace_request(struct task_struct *child, compat_long_t request,
+@@ -1071,7 +1098,7 @@ int compat_ptrace_request(struct task_struct *child, compat_long_t request,
}
asmlinkage long compat_sys_ptrace(compat_long_t request, compat_long_t pid,
@@ -96478,7 +96298,7 @@ index f79803a..0dcc1be 100644
{
struct task_struct *child;
long ret;
-@@ -1067,14 +1094,21 @@ asmlinkage long compat_sys_ptrace(compat_long_t request, compat_long_t pid,
+@@ -1087,14 +1114,21 @@ asmlinkage long compat_sys_ptrace(compat_long_t request, compat_long_t pid,
goto out;
}
@@ -97949,7 +97769,7 @@ index 9e800b2..1533ba5 100644
raw_spin_unlock_irq(&call_function.lock);
}
diff --git a/kernel/softirq.c b/kernel/softirq.c
-index 2c71d91..6b690a4 100644
+index 44bc103..c131116 100644
--- a/kernel/softirq.c
+++ b/kernel/softirq.c
@@ -52,11 +52,11 @@ irq_cpustat_t irq_stat[NR_CPUS] ____cacheline_aligned;
@@ -97966,7 +97786,7 @@ index 2c71d91..6b690a4 100644
"HI", "TIMER", "NET_TX", "NET_RX", "BLOCK", "BLOCK_IOPOLL",
"TASKLET", "SCHED", "HRTIMER", "RCU"
};
-@@ -235,7 +235,7 @@ restart:
+@@ -241,7 +241,7 @@ restart:
kstat_incr_softirqs_this_cpu(vec_nr);
trace_softirq_entry(vec_nr);
@@ -97975,7 +97795,7 @@ index 2c71d91..6b690a4 100644
trace_softirq_exit(vec_nr);
if (unlikely(prev_count != preempt_count())) {
printk(KERN_ERR "huh, entered softirq %u %s %p"
-@@ -385,7 +385,7 @@ void raise_softirq(unsigned int nr)
+@@ -393,7 +393,7 @@ void raise_softirq(unsigned int nr)
local_irq_restore(flags);
}
@@ -97984,7 +97804,7 @@ index 2c71d91..6b690a4 100644
{
softirq_vec[nr].action = action;
}
-@@ -441,7 +441,7 @@ void __tasklet_hi_schedule_first(struct tasklet_struct *t)
+@@ -449,7 +449,7 @@ void __tasklet_hi_schedule_first(struct tasklet_struct *t)
EXPORT_SYMBOL(__tasklet_hi_schedule_first);
@@ -97993,7 +97813,7 @@ index 2c71d91..6b690a4 100644
{
struct tasklet_struct *list;
-@@ -476,7 +476,7 @@ static void tasklet_action(struct softirq_action *a)
+@@ -484,7 +484,7 @@ static void tasklet_action(struct softirq_action *a)
}
}
@@ -98002,7 +97822,7 @@ index 2c71d91..6b690a4 100644
{
struct tasklet_struct *list;
-@@ -712,7 +712,7 @@ static int __cpuinit remote_softirq_cpu_notify(struct notifier_block *self,
+@@ -720,7 +720,7 @@ static int __cpuinit remote_softirq_cpu_notify(struct notifier_block *self,
return NOTIFY_OK;
}
@@ -98011,7 +97831,7 @@ index 2c71d91..6b690a4 100644
.notifier_call = remote_softirq_cpu_notify,
};
-@@ -894,7 +894,7 @@ static int __cpuinit cpu_callback(struct notifier_block *nfb,
+@@ -902,7 +902,7 @@ static int __cpuinit cpu_callback(struct notifier_block *nfb,
return NOTIFY_OK;
}
@@ -99610,7 +99430,7 @@ index 875fed4..7a76cbb 100644
}
diff --git a/kernel/trace/trace_events_filter.c b/kernel/trace/trace_events_filter.c
-index b0996c1..9c39703 100644
+index 47343cc..9c39703 100644
--- a/kernel/trace/trace_events_filter.c
+++ b/kernel/trace/trace_events_filter.c
@@ -1027,6 +1027,9 @@ static void parse_init(struct filter_parse_state *ps,
@@ -99633,36 +99453,15 @@ index b0996c1..9c39703 100644
ps->infix.cnt--;
ps->infix.tail++;
}
-@@ -1343,19 +1349,27 @@ static int check_preds(struct filter_parse_state *ps)
- {
- int n_normal_preds = 0, n_logical_preds = 0;
- struct postfix_elt *elt;
-+ int cnt = 0;
-
- list_for_each_entry(elt, &ps->postfix, list) {
-- if (elt->op == OP_NONE)
-+ if (elt->op == OP_NONE) {
-+ cnt++;
- continue;
-+ }
-
- if (elt->op == OP_AND || elt->op == OP_OR) {
- n_logical_preds++;
-+ cnt--;
+@@ -1356,6 +1362,8 @@ static int check_preds(struct filter_parse_state *ps)
+ cnt--;
continue;
}
+ // OP_NOT is not supported in this kernel, will get
+ // a reject here when it's backported
-+ cnt--;
+ cnt--;
n_normal_preds++;
-+ WARN_ON_ONCE(cnt < 0);
- }
-
-- if (!n_normal_preds || n_logical_preds >= n_normal_preds) {
-+ if (cnt != 1 || !n_normal_preds || n_logical_preds >= n_normal_preds) {
- parse_error(ps, FILT_ERR_INVALID_FILTER, 0);
- return -EINVAL;
- }
+ WARN_ON_ONCE(cnt < 0);
diff --git a/kernel/trace/trace_functions_graph.c b/kernel/trace/trace_functions_graph.c
index a7d2a4c..b034c76 100644
--- a/kernel/trace/trace_functions_graph.c
@@ -104650,7 +104449,7 @@ index d0cb11f..e0a7fea 100644
struct mm_struct *mm;
diff --git a/mm/page-writeback.c b/mm/page-writeback.c
-index 1bf1f74..5e27559 100644
+index 62bfbd9..bfd70ee 100644
--- a/mm/page-writeback.c
+++ b/mm/page-writeback.c
@@ -522,7 +522,7 @@ unsigned long bdi_dirty_limit(struct backing_dev_info *bdi, unsigned long dirty)
@@ -105763,7 +105562,7 @@ index 8105be4..93fb21c 100644
EXPORT_SYMBOL(kmem_cache_free);
diff --git a/mm/slub.c b/mm/slub.c
-index 6a4c2fb..18d36e8 100644
+index 60c6969..dd5e22f 100644
--- a/mm/slub.c
+++ b/mm/slub.c
@@ -186,7 +186,7 @@ static enum {
@@ -105793,7 +105592,7 @@ index 6a4c2fb..18d36e8 100644
s, (void *)t->addr, jiffies - t->when, t->cpu, t->pid);
#ifdef CONFIG_STACKTRACE
{
-@@ -2537,6 +2537,14 @@ static __always_inline void slab_free(struct kmem_cache *s,
+@@ -2520,6 +2520,14 @@ static __always_inline void slab_free(struct kmem_cache *s,
slab_free_hook(s, x);
@@ -105808,7 +105607,7 @@ index 6a4c2fb..18d36e8 100644
redo:
/*
* Determine the currently cpus per cpu slab.
-@@ -2572,6 +2580,8 @@ void kmem_cache_free(struct kmem_cache *s, void *x)
+@@ -2555,6 +2563,8 @@ void kmem_cache_free(struct kmem_cache *s, void *x)
page = virt_to_head_page(x);
@@ -105817,7 +105616,7 @@ index 6a4c2fb..18d36e8 100644
slab_free(s, page, x, _RET_IP_);
trace_kmem_cache_free(_RET_IP_, x);
-@@ -2605,7 +2615,7 @@ static int slub_min_objects;
+@@ -2588,7 +2598,7 @@ static int slub_min_objects;
* Merge control. If this is set then no merging of slab caches will occur.
* (Could be removed. This was introduced to pacify the merge skeptics.)
*/
@@ -105826,7 +105625,7 @@ index 6a4c2fb..18d36e8 100644
/*
* Calculate the order of allocation given an slab object size.
-@@ -2909,6 +2919,9 @@ static int calculate_sizes(struct kmem_cache *s, int forced_order)
+@@ -2892,6 +2902,9 @@ static int calculate_sizes(struct kmem_cache *s, int forced_order)
s->inuse = size;
if (((flags & (SLAB_DESTROY_BY_RCU | SLAB_POISON)) ||
@@ -105836,7 +105635,7 @@ index 6a4c2fb..18d36e8 100644
s->ctor)) {
/*
* Relocate free pointer after the object if it is not
-@@ -3055,7 +3068,7 @@ static int kmem_cache_open(struct kmem_cache *s,
+@@ -3038,7 +3051,7 @@ static int kmem_cache_open(struct kmem_cache *s,
else
s->cpu_partial = 30;
@@ -105845,7 +105644,7 @@ index 6a4c2fb..18d36e8 100644
#ifdef CONFIG_NUMA
s->remote_node_defrag_ratio = 1000;
#endif
-@@ -3159,8 +3172,7 @@ static inline int kmem_cache_close(struct kmem_cache *s)
+@@ -3142,8 +3155,7 @@ static inline int kmem_cache_close(struct kmem_cache *s)
void kmem_cache_destroy(struct kmem_cache *s)
{
down_write(&slub_lock);
@@ -105855,7 +105654,7 @@ index 6a4c2fb..18d36e8 100644
list_del(&s->list);
up_write(&slub_lock);
if (kmem_cache_close(s)) {
-@@ -3189,6 +3201,10 @@ static struct kmem_cache *kmem_cache;
+@@ -3172,6 +3184,10 @@ static struct kmem_cache *kmem_cache;
static struct kmem_cache *kmalloc_dma_caches[SLUB_PAGE_SHIFT];
#endif
@@ -105866,7 +105665,7 @@ index 6a4c2fb..18d36e8 100644
static int __init setup_slub_min_order(char *str)
{
get_option(&str, &slub_min_order);
-@@ -3303,6 +3319,13 @@ static struct kmem_cache *get_slab(size_t size, gfp_t flags)
+@@ -3286,6 +3302,13 @@ static struct kmem_cache *get_slab(size_t size, gfp_t flags)
return kmalloc_dma_caches[index];
#endif
@@ -105880,7 +105679,7 @@ index 6a4c2fb..18d36e8 100644
return kmalloc_caches[index];
}
-@@ -3371,6 +3394,59 @@ void *__kmalloc_node(size_t size, gfp_t flags, int node)
+@@ -3354,6 +3377,59 @@ void *__kmalloc_node(size_t size, gfp_t flags, int node)
EXPORT_SYMBOL(__kmalloc_node);
#endif
@@ -105940,7 +105739,7 @@ index 6a4c2fb..18d36e8 100644
size_t ksize(const void *object)
{
struct page *page;
-@@ -3435,6 +3511,7 @@ void kfree(const void *x)
+@@ -3418,6 +3494,7 @@ void kfree(const void *x)
if (unlikely(ZERO_OR_NULL_PTR(x)))
return;
@@ -105948,7 +105747,7 @@ index 6a4c2fb..18d36e8 100644
page = virt_to_head_page(x);
if (unlikely(!PageSlab(page))) {
BUG_ON(!PageCompound(page));
-@@ -3645,7 +3722,7 @@ static void __init kmem_cache_bootstrap_fixup(struct kmem_cache *s)
+@@ -3628,7 +3705,7 @@ static void __init kmem_cache_bootstrap_fixup(struct kmem_cache *s)
int node;
list_add(&s->list, &slab_caches);
@@ -105957,7 +105756,7 @@ index 6a4c2fb..18d36e8 100644
for_each_node_state(node, N_NORMAL_MEMORY) {
struct kmem_cache_node *n = get_node(s, node);
-@@ -3762,17 +3839,17 @@ void __init kmem_cache_init(void)
+@@ -3745,17 +3822,17 @@ void __init kmem_cache_init(void)
/* Caches that are not of the two-to-the-power-of size */
if (KMALLOC_MIN_SIZE <= 32) {
@@ -105978,7 +105777,7 @@ index 6a4c2fb..18d36e8 100644
caches++;
}
-@@ -3814,6 +3891,22 @@ void __init kmem_cache_init(void)
+@@ -3797,6 +3874,22 @@ void __init kmem_cache_init(void)
}
}
#endif
@@ -106001,7 +105800,7 @@ index 6a4c2fb..18d36e8 100644
printk(KERN_INFO
"SLUB: Genslabs=%d, HWalign=%d, Order=%d-%d, MinObjects=%d,"
" CPUs=%d, Nodes=%d\n",
-@@ -3840,7 +3933,7 @@ static int slab_unmergeable(struct kmem_cache *s)
+@@ -3823,7 +3916,7 @@ static int slab_unmergeable(struct kmem_cache *s)
/*
* We may have set a slab to be unmergeable during bootstrap.
*/
@@ -106010,7 +105809,7 @@ index 6a4c2fb..18d36e8 100644
return 1;
return 0;
-@@ -3897,9 +3990,17 @@ struct kmem_cache *kmem_cache_create(const char *name, size_t size,
+@@ -3880,9 +3973,17 @@ struct kmem_cache *kmem_cache_create(const char *name, size_t size,
return NULL;
down_write(&slub_lock);
@@ -106029,7 +105828,7 @@ index 6a4c2fb..18d36e8 100644
/*
* Adjust the object sizes so that we clear
* the complete object on kzalloc.
-@@ -3908,7 +4009,7 @@ struct kmem_cache *kmem_cache_create(const char *name, size_t size,
+@@ -3891,7 +3992,7 @@ struct kmem_cache *kmem_cache_create(const char *name, size_t size,
s->inuse = max_t(int, s->inuse, ALIGN(size, sizeof(void *)));
if (sysfs_slab_alias(s, name)) {
@@ -106038,7 +105837,7 @@ index 6a4c2fb..18d36e8 100644
goto err;
}
up_write(&slub_lock);
-@@ -3979,7 +4080,7 @@ static int __cpuinit slab_cpuup_callback(struct notifier_block *nfb,
+@@ -3962,7 +4063,7 @@ static int __cpuinit slab_cpuup_callback(struct notifier_block *nfb,
return NOTIFY_OK;
}
@@ -106047,7 +105846,7 @@ index 6a4c2fb..18d36e8 100644
.notifier_call = slab_cpuup_callback
};
-@@ -4037,7 +4138,7 @@ void *__kmalloc_node_track_caller(size_t size, gfp_t gfpflags,
+@@ -4020,7 +4121,7 @@ void *__kmalloc_node_track_caller(size_t size, gfp_t gfpflags,
}
#endif
@@ -106056,7 +105855,7 @@ index 6a4c2fb..18d36e8 100644
static int count_inuse(struct page *page)
{
return page->inuse;
-@@ -4424,12 +4525,12 @@ static void resiliency_test(void)
+@@ -4407,12 +4508,12 @@ static void resiliency_test(void)
validate_slab_cache(kmalloc_caches[9]);
}
#else
@@ -106071,7 +105870,7 @@ index 6a4c2fb..18d36e8 100644
enum slab_stat_type {
SL_ALL, /* All slabs */
SL_PARTIAL, /* Only partially allocated slabs */
-@@ -4676,7 +4777,7 @@ SLAB_ATTR_RO(ctor);
+@@ -4659,7 +4760,7 @@ SLAB_ATTR_RO(ctor);
static ssize_t aliases_show(struct kmem_cache *s, char *buf)
{
@@ -106080,7 +105879,7 @@ index 6a4c2fb..18d36e8 100644
}
SLAB_ATTR_RO(aliases);
-@@ -5243,6 +5344,7 @@ static char *create_unique_id(struct kmem_cache *s)
+@@ -5226,6 +5327,7 @@ static char *create_unique_id(struct kmem_cache *s)
return name;
}
@@ -106088,7 +105887,7 @@ index 6a4c2fb..18d36e8 100644
static int sysfs_slab_add(struct kmem_cache *s)
{
int err;
-@@ -5271,7 +5373,7 @@ static int sysfs_slab_add(struct kmem_cache *s)
+@@ -5254,7 +5356,7 @@ static int sysfs_slab_add(struct kmem_cache *s)
}
s->kobj.kset = slab_kset;
@@ -106097,7 +105896,7 @@ index 6a4c2fb..18d36e8 100644
if (err) {
kobject_put(&s->kobj);
return err;
-@@ -5305,6 +5407,7 @@ static void sysfs_slab_remove(struct kmem_cache *s)
+@@ -5288,6 +5390,7 @@ static void sysfs_slab_remove(struct kmem_cache *s)
kobject_del(&s->kobj);
kobject_put(&s->kobj);
}
@@ -106105,7 +105904,7 @@ index 6a4c2fb..18d36e8 100644
/*
* Need to buffer aliases during bootup until sysfs becomes
-@@ -5318,6 +5421,7 @@ struct saved_alias {
+@@ -5301,6 +5404,7 @@ struct saved_alias {
static struct saved_alias *alias_list;
@@ -106113,7 +105912,7 @@ index 6a4c2fb..18d36e8 100644
static int sysfs_slab_alias(struct kmem_cache *s, const char *name)
{
struct saved_alias *al;
-@@ -5340,6 +5444,7 @@ static int sysfs_slab_alias(struct kmem_cache *s, const char *name)
+@@ -5323,6 +5427,7 @@ static int sysfs_slab_alias(struct kmem_cache *s, const char *name)
alias_list = al;
return 0;
}
@@ -107247,10 +107046,10 @@ index f20c4fd..73aee41 100644
if (err < 0) {
pr_err("bridge: can't register sap for STP\n");
diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c
-index 398a297..83fc29c 100644
+index 1bd197f..1119378 100644
--- a/net/bridge/br_multicast.c
+++ b/net/bridge/br_multicast.c
-@@ -1416,7 +1416,7 @@ static int br_multicast_ipv6_rcv(struct net_bridge *br,
+@@ -1415,7 +1415,7 @@ static int br_multicast_ipv6_rcv(struct net_bridge *br,
nexthdr = ip6h->nexthdr;
offset = ipv6_skip_exthdr(skb, sizeof(*ip6h), &nexthdr);
@@ -107344,7 +107143,7 @@ index 45f93f8..550f429 100644
break;
}
diff --git a/net/caif/caif_socket.c b/net/caif/caif_socket.c
-index 7eed9eb..fd7291e 100644
+index 7e4b4b4..6c8ce35 100644
--- a/net/caif/caif_socket.c
+++ b/net/caif/caif_socket.c
@@ -48,19 +48,20 @@ static struct dentry *debugfsdir;
@@ -107449,7 +107248,7 @@ index 7eed9eb..fd7291e 100644
set_rx_flow_on(cf_sk);
caif_flow_ctrl(sk, CAIF_MODEMCMD_FLOW_ON_REQ);
}
-@@ -852,7 +853,7 @@ static int caif_connect(struct socket *sock, struct sockaddr *uaddr,
+@@ -860,7 +861,7 @@ static int caif_connect(struct socket *sock, struct sockaddr *uaddr,
/*ifindex = id of the interface.*/
cf_sk->conn_req.ifindex = cf_sk->sk.sk_bound_dev_if;
@@ -107458,7 +107257,7 @@ index 7eed9eb..fd7291e 100644
cf_sk->layer.receive = caif_sktrecv_cb;
err = caif_connect_client(sock_net(sk), &cf_sk->conn_req,
-@@ -941,7 +942,7 @@ static int caif_release(struct socket *sock)
+@@ -949,7 +950,7 @@ static int caif_release(struct socket *sock)
spin_unlock_bh(&sk->sk_receive_queue.lock);
sock->sk = NULL;
@@ -107467,7 +107266,7 @@ index 7eed9eb..fd7291e 100644
WARN_ON(IS_ERR(cf_sk->debugfs_socket_dir));
if (cf_sk->debugfs_socket_dir != NULL)
-@@ -1120,7 +1121,7 @@ static int caif_create(struct net *net, struct socket *sock, int protocol,
+@@ -1128,7 +1129,7 @@ static int caif_create(struct net *net, struct socket *sock, int protocol,
cf_sk->conn_req.protocol = protocol;
/* Increase the number of sockets created. */
dbfs_atomic_inc(&cnt.caif_nr_socks);
@@ -108245,10 +108044,10 @@ index 66e3f1f..317ae80 100644
m->msg_iov = iov;
diff --git a/net/core/neighbour.c b/net/core/neighbour.c
-index 0ea3fd3..d87fef1 100644
+index c8c2645..e503d27 100644
--- a/net/core/neighbour.c
+++ b/net/core/neighbour.c
-@@ -2803,11 +2803,12 @@ int neigh_sysctl_register(struct net_device *dev, struct neigh_parms *p,
+@@ -2814,11 +2814,12 @@ int neigh_sysctl_register(struct net_device *dev, struct neigh_parms *p,
/* Terminate the table early */
memset(&t->neigh_vars[14], 0, sizeof(t->neigh_vars[14]));
} else {
@@ -110199,7 +109998,7 @@ index 2e0f0af..e2948bf 100644
syn_set ? 0 : icsk->icsk_user_timeout, syn_set)) {
/* Has it gone just too far? */
diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
-index 8c2e259..90d7b4e 100644
+index 5e92043..90d7b4e 100644
--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -86,6 +86,7 @@
@@ -110270,20 +110069,7 @@ index 8c2e259..90d7b4e 100644
ulen = skb->len - sizeof(struct udphdr);
copied = len;
if (copied > ulen)
-@@ -1248,10 +1269,8 @@ csum_copy_err:
- UDP_INC_STATS_USER(sock_net(sk), UDP_MIB_INERRORS, is_udplite);
- unlock_sock_fast(sk, slow);
-
-- if (noblock)
-- return -EAGAIN;
--
-- /* starting over for a new packet */
-+ /* starting over for a new packet, but check if we need to yield */
-+ cond_resched();
- msg->msg_flags &= ~MSG_TRUNC;
- goto try_again;
- }
-@@ -1486,7 +1505,7 @@ int udp_queue_rcv_skb(struct sock *sk, struct sk_buff *skb)
+@@ -1484,7 +1505,7 @@ int udp_queue_rcv_skb(struct sock *sk, struct sk_buff *skb)
drop:
UDP_INC_STATS_BH(sock_net(sk), UDP_MIB_INERRORS, is_udplite);
@@ -110292,7 +110078,7 @@ index 8c2e259..90d7b4e 100644
kfree_skb(skb);
return -1;
}
-@@ -1505,7 +1524,7 @@ static void flush_stack(struct sock **stack, unsigned int count,
+@@ -1503,7 +1524,7 @@ static void flush_stack(struct sock **stack, unsigned int count,
skb1 = (i == final) ? skb : skb_clone(skb, GFP_ATOMIC);
if (!skb1) {
@@ -110301,7 +110087,7 @@ index 8c2e259..90d7b4e 100644
UDP_INC_STATS_BH(sock_net(sk), UDP_MIB_RCVBUFERRORS,
IS_UDPLITE(sk));
UDP_INC_STATS_BH(sock_net(sk), UDP_MIB_INERRORS,
-@@ -1674,6 +1693,9 @@ int __udp4_lib_rcv(struct sk_buff *skb, struct udp_table *udptable,
+@@ -1672,6 +1693,9 @@ int __udp4_lib_rcv(struct sk_buff *skb, struct udp_table *udptable,
goto csum_error;
UDP_INC_STATS_BH(net, UDP_MIB_NOPORTS, proto == IPPROTO_UDPLITE);
@@ -110311,7 +110097,7 @@ index 8c2e259..90d7b4e 100644
icmp_send(skb, ICMP_DEST_UNREACH, ICMP_PORT_UNREACH, 0);
/*
-@@ -2097,8 +2119,13 @@ static void udp4_format_sock(struct sock *sp, struct seq_file *f,
+@@ -2095,8 +2119,13 @@ static void udp4_format_sock(struct sock *sp, struct seq_file *f,
sk_wmem_alloc_get(sp),
sk_rmem_alloc_get(sp),
0, 0L, 0, sock_i_uid(sp), 0, sock_i_ino(sp),
@@ -110906,7 +110692,7 @@ index 655cc60..c49497a 100644
static int tcp6_seq_show(struct seq_file *seq, void *v)
diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
-index d131a95..59d5161 100644
+index dc08afd..59d5161 100644
--- a/net/ipv6/udp.c
+++ b/net/ipv6/udp.c
@@ -50,6 +50,10 @@
@@ -110920,20 +110706,7 @@ index d131a95..59d5161 100644
int ipv6_rcv_saddr_equal(const struct sock *sk, const struct sock *sk2)
{
const struct in6_addr *sk_rcv_saddr6 = &inet6_sk(sk)->rcv_saddr;
-@@ -451,10 +455,8 @@ csum_copy_err:
- }
- unlock_sock_fast(sk, slow);
-
-- if (noblock)
-- return -EAGAIN;
--
-- /* starting over for a new packet */
-+ /* starting over for a new packet, but check if we need to yield */
-+ cond_resched();
- msg->msg_flags &= ~MSG_TRUNC;
- goto try_again;
- }
-@@ -546,7 +548,7 @@ int udpv6_queue_rcv_skb(struct sock * sk, struct sk_buff *skb)
+@@ -544,7 +548,7 @@ int udpv6_queue_rcv_skb(struct sock * sk, struct sk_buff *skb)
return 0;
drop:
@@ -110942,7 +110715,7 @@ index d131a95..59d5161 100644
drop_no_sk_drops_inc:
UDP6_INC_STATS_BH(sock_net(sk), UDP_MIB_INERRORS, is_udplite);
kfree_skb(skb);
-@@ -622,7 +624,7 @@ static void flush_stack(struct sock **stack, unsigned int count,
+@@ -620,7 +624,7 @@ static void flush_stack(struct sock **stack, unsigned int count,
continue;
}
drop:
@@ -110951,7 +110724,7 @@ index d131a95..59d5161 100644
UDP6_INC_STATS_BH(sock_net(sk),
UDP_MIB_RCVBUFERRORS, IS_UDPLITE(sk));
UDP6_INC_STATS_BH(sock_net(sk),
-@@ -777,6 +779,9 @@ int __udp6_lib_rcv(struct sk_buff *skb, struct udp_table *udptable,
+@@ -775,6 +779,9 @@ int __udp6_lib_rcv(struct sk_buff *skb, struct udp_table *udptable,
UDP6_INC_STATS_BH(net, UDP_MIB_NOPORTS,
proto == IPPROTO_UDPLITE);
@@ -110961,7 +110734,7 @@ index d131a95..59d5161 100644
icmpv6_send(skb, ICMPV6_DEST_UNREACH, ICMPV6_PORT_UNREACH, 0);
kfree_skb(skb);
-@@ -793,7 +798,7 @@ int __udp6_lib_rcv(struct sk_buff *skb, struct udp_table *udptable,
+@@ -791,7 +798,7 @@ int __udp6_lib_rcv(struct sk_buff *skb, struct udp_table *udptable,
if (!sock_owned_by_user(sk))
udpv6_queue_rcv_skb(sk, skb);
else if (sk_add_backlog(sk, skb)) {
@@ -110970,7 +110743,7 @@ index d131a95..59d5161 100644
bh_unlock_sock(sk);
sock_put(sk);
goto discard;
-@@ -1409,8 +1414,13 @@ static void udp6_sock_seq_show(struct seq_file *seq, struct sock *sp, int bucket
+@@ -1407,8 +1414,13 @@ static void udp6_sock_seq_show(struct seq_file *seq, struct sock *sp, int bucket
0, 0L, 0,
sock_i_uid(sp), 0,
sock_i_ino(sp),
@@ -111640,7 +111413,7 @@ index 6422845..2c19968 100644
if (!todrop_rate[i]) return 0;
diff --git a/net/netfilter/ipvs/ip_vs_core.c b/net/netfilter/ipvs/ip_vs_core.c
-index d864aaf..d6afbda 100644
+index 197ed93..49519a9 100644
--- a/net/netfilter/ipvs/ip_vs_core.c
+++ b/net/netfilter/ipvs/ip_vs_core.c
@@ -562,7 +562,7 @@ int ip_vs_leave(struct ip_vs_service *svc, struct sk_buff *skb,
@@ -111662,7 +111435,7 @@ index d864aaf..d6afbda 100644
if ((ipvs->sync_state & IP_VS_STATE_MASTER) &&
cp->protocol == IPPROTO_SCTP) {
diff --git a/net/netfilter/ipvs/ip_vs_ctl.c b/net/netfilter/ipvs/ip_vs_ctl.c
-index 93acfa1..e846c43 100644
+index 1e27a1f..9774f6b 100644
--- a/net/netfilter/ipvs/ip_vs_ctl.c
+++ b/net/netfilter/ipvs/ip_vs_ctl.c
@@ -788,7 +788,7 @@ __ip_vs_update_dest(struct ip_vs_service *svc, struct ip_vs_dest *dest,
@@ -112385,7 +112158,7 @@ index b4d889b..bb33240 100644
*uaddr_len = sizeof(struct sockaddr_ax25);
}
diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
-index 4f19bf2..e3a2b51 100644
+index 0c21f06..0f53a06 100644
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -195,6 +195,7 @@ struct tpacket_kbdq_core {
@@ -112404,7 +112177,7 @@ index 4f19bf2..e3a2b51 100644
prb_init_ft_ops(p1, req_u);
prb_setup_retire_blk_timer(po, tx_ring);
prb_open_block(p1, pbd);
-@@ -1678,7 +1680,7 @@ static int packet_rcv(struct sk_buff *skb, struct net_device *dev,
+@@ -1664,7 +1666,7 @@ static int packet_rcv(struct sk_buff *skb, struct net_device *dev,
spin_lock(&sk->sk_receive_queue.lock);
po->stats.tp_packets++;
@@ -112413,7 +112186,7 @@ index 4f19bf2..e3a2b51 100644
__skb_queue_tail(&sk->sk_receive_queue, skb);
spin_unlock(&sk->sk_receive_queue.lock);
sk->sk_data_ready(sk, skb->len);
-@@ -1687,7 +1689,7 @@ static int packet_rcv(struct sk_buff *skb, struct net_device *dev,
+@@ -1673,7 +1675,7 @@ static int packet_rcv(struct sk_buff *skb, struct net_device *dev,
drop_n_acct:
spin_lock(&sk->sk_receive_queue.lock);
po->stats.tp_drops++;
@@ -112422,7 +112195,7 @@ index 4f19bf2..e3a2b51 100644
spin_unlock(&sk->sk_receive_queue.lock);
drop_n_restore:
-@@ -1778,6 +1780,18 @@ static int tpacket_rcv(struct sk_buff *skb, struct net_device *dev,
+@@ -1764,6 +1766,18 @@ static int tpacket_rcv(struct sk_buff *skb, struct net_device *dev,
if ((int)snaplen < 0)
snaplen = 0;
}
@@ -112441,7 +112214,7 @@ index 4f19bf2..e3a2b51 100644
}
spin_lock(&sk->sk_receive_queue.lock);
h.raw = packet_current_rx_frame(po, skb,
-@@ -2623,6 +2637,7 @@ out:
+@@ -2609,6 +2623,7 @@ out:
static int packet_recv_error(struct sock *sk, struct msghdr *msg, int len)
{
@@ -112449,7 +112222,7 @@ index 4f19bf2..e3a2b51 100644
struct sock_exterr_skb *serr;
struct sk_buff *skb, *skb2;
int copied, err;
-@@ -2644,8 +2659,9 @@ static int packet_recv_error(struct sock *sk, struct msghdr *msg, int len)
+@@ -2630,8 +2645,9 @@ static int packet_recv_error(struct sock *sk, struct msghdr *msg, int len)
sock_recv_timestamp(msg, sk, skb);
serr = SKB_EXT_ERR(skb);
@@ -112460,7 +112233,7 @@ index 4f19bf2..e3a2b51 100644
msg->msg_flags |= MSG_ERRQUEUE;
err = copied;
-@@ -3273,7 +3289,7 @@ static int packet_getsockopt(struct socket *sock, int level, int optname,
+@@ -3259,7 +3275,7 @@ static int packet_getsockopt(struct socket *sock, int level, int optname,
case PACKET_HDRLEN:
if (len > sizeof(int))
len = sizeof(int);
@@ -112469,7 +112242,7 @@ index 4f19bf2..e3a2b51 100644
return -EFAULT;
switch (val) {
case TPACKET_V1:
-@@ -3323,7 +3339,11 @@ static int packet_getsockopt(struct socket *sock, int level, int optname,
+@@ -3309,7 +3325,11 @@ static int packet_getsockopt(struct socket *sock, int level, int optname,
if (put_user(len, optlen))
return -EFAULT;
@@ -112482,7 +112255,7 @@ index 4f19bf2..e3a2b51 100644
return -EFAULT;
return 0;
}
-@@ -3614,6 +3634,10 @@ static int packet_set_ring(struct sock *sk, union tpacket_req_u *req_u,
+@@ -3600,6 +3620,10 @@ static int packet_set_ring(struct sock *sk, union tpacket_req_u *req_u,
goto out;
if (unlikely(req->tp_block_size & (PAGE_SIZE - 1)))
goto out;
@@ -112661,6 +112434,19 @@ index e29e0ca..fa3a6a3 100644
}
#endif
+diff --git a/net/rds/info.c b/net/rds/info.c
+index f1c016c..a4adb39 100644
+--- a/net/rds/info.c
++++ b/net/rds/info.c
+@@ -176,7 +176,7 @@ int rds_info_getsockopt(struct socket *sock, int optname, char __user *optval,
+
+ /* check for all kinds of wrapping and the like */
+ start = (unsigned long)optval;
+- if (len < 0 || len + PAGE_SIZE - 1 < len || start + len < start) {
++ if (len < 0 || len > INT_MAX - PAGE_SIZE + 1 || start + len < start) {
+ ret = -EINVAL;
+ goto out;
+ }
diff --git a/net/rds/iw.h b/net/rds/iw.h
index 04ce3b1..48119a6 100644
--- a/net/rds/iw.h
@@ -113310,10 +113096,10 @@ index 76388b0..a967f68 100644
sctp_generate_t1_cookie_event,
sctp_generate_t1_init_event,
diff --git a/net/sctp/socket.c b/net/sctp/socket.c
-index fc63664..832978a 100644
+index 24e88af..047e703 100644
--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
-@@ -2190,11 +2190,13 @@ static int sctp_setsockopt_events(struct sock *sk, char __user *optval,
+@@ -2192,11 +2192,13 @@ static int sctp_setsockopt_events(struct sock *sk, char __user *optval,
{
struct sctp_association *asoc;
struct sctp_ulpevent *event;
@@ -113328,7 +113114,7 @@ index fc63664..832978a 100644
/*
* At the time when a user app subscribes to SCTP_SENDER_DRY_EVENT,
-@@ -4180,13 +4182,16 @@ static int sctp_getsockopt_disable_fragments(struct sock *sk, int len,
+@@ -4194,13 +4196,16 @@ static int sctp_getsockopt_disable_fragments(struct sock *sk, int len,
static int sctp_getsockopt_events(struct sock *sk, int len, char __user *optval,
int __user *optlen)
{
@@ -113346,7 +113132,7 @@ index fc63664..832978a 100644
return -EFAULT;
return 0;
}
-@@ -4204,6 +4209,8 @@ static int sctp_getsockopt_events(struct sock *sk, int len, char __user *optval,
+@@ -4218,6 +4223,8 @@ static int sctp_getsockopt_events(struct sock *sk, int len, char __user *optval,
*/
static int sctp_getsockopt_autoclose(struct sock *sk, int len, char __user *optval, int __user *optlen)
{
@@ -113355,7 +113141,7 @@ index fc63664..832978a 100644
/* Applicable to UDP-style socket only */
if (sctp_style(sk, TCP))
return -EOPNOTSUPP;
-@@ -4212,7 +4219,8 @@ static int sctp_getsockopt_autoclose(struct sock *sk, int len, char __user *optv
+@@ -4226,7 +4233,8 @@ static int sctp_getsockopt_autoclose(struct sock *sk, int len, char __user *optv
len = sizeof(int);
if (put_user(len, optlen))
return -EFAULT;
@@ -113365,7 +113151,7 @@ index fc63664..832978a 100644
return -EFAULT;
return 0;
}
-@@ -4576,12 +4584,15 @@ static int sctp_getsockopt_delayed_ack(struct sock *sk, int len,
+@@ -4590,12 +4598,15 @@ static int sctp_getsockopt_delayed_ack(struct sock *sk, int len,
*/
static int sctp_getsockopt_initmsg(struct sock *sk, int len, char __user *optval, int __user *optlen)
{
@@ -113382,7 +113168,7 @@ index fc63664..832978a 100644
return -EFAULT;
return 0;
}
-@@ -4622,6 +4633,8 @@ static int sctp_getsockopt_peer_addrs(struct sock *sk, int len,
+@@ -4636,6 +4647,8 @@ static int sctp_getsockopt_peer_addrs(struct sock *sk, int len,
addrlen = sctp_get_af_specific(temp.sa.sa_family)->sockaddr_len;
if (space_left < addrlen)
return -ENOMEM;
@@ -113445,7 +113231,7 @@ index 8da4481..d02565e 100644
+ (rtt >> sctp_rto_alpha);
} else {
diff --git a/net/socket.c b/net/socket.c
-index 116cf9d..a13ae17 100644
+index 10ea25a..e5f6b01 100644
--- a/net/socket.c
+++ b/net/socket.c
@@ -88,6 +88,7 @@
@@ -113629,7 +113415,7 @@ index 116cf9d..a13ae17 100644
int err, err2;
int fput_needed;
-@@ -1973,7 +2039,7 @@ static int ___sys_sendmsg(struct socket *sock, struct msghdr __user *msg,
+@@ -1971,7 +2037,7 @@ static int ___sys_sendmsg(struct socket *sock, struct msghdr __user *msg,
* checking falls down on this.
*/
if (copy_from_user(ctl_buf,
@@ -113638,7 +113424,7 @@ index 116cf9d..a13ae17 100644
ctl_len))
goto out_freectl;
msg_sys->msg_control = ctl_buf;
-@@ -2124,7 +2190,7 @@ static int ___sys_recvmsg(struct socket *sock, struct msghdr __user *msg,
+@@ -2122,7 +2188,7 @@ static int ___sys_recvmsg(struct socket *sock, struct msghdr __user *msg,
int err, iov_size, total_len, len;
/* kernel mode address */
@@ -113647,7 +113433,7 @@ index 116cf9d..a13ae17 100644
/* user mode address pointers */
struct sockaddr __user *uaddr;
-@@ -2155,7 +2221,8 @@ static int ___sys_recvmsg(struct socket *sock, struct msghdr __user *msg,
+@@ -2151,7 +2217,8 @@ static int ___sys_recvmsg(struct socket *sock, struct msghdr __user *msg,
/* Save the user-mode address (verify_iovec will change the
* kernel msghdr to use the kernel address space)
*/
@@ -113657,7 +113443,7 @@ index 116cf9d..a13ae17 100644
uaddr_len = COMPAT_NAMELEN(msg);
if (MSG_CMSG_COMPAT & flags)
err = verify_compat_iovec(msg_sys, iov,
-@@ -2799,9 +2866,9 @@ static int ethtool_ioctl(struct net *net, struct compat_ifreq __user *ifr32)
+@@ -2795,9 +2862,9 @@ static int ethtool_ioctl(struct net *net, struct compat_ifreq __user *ifr32)
}
ifr = compat_alloc_user_space(buf_size);
@@ -113669,7 +113455,7 @@ index 116cf9d..a13ae17 100644
return -EFAULT;
if (put_user(convert_in ? rxnfc : compat_ptr(data),
-@@ -2823,12 +2890,12 @@ static int ethtool_ioctl(struct net *net, struct compat_ifreq __user *ifr32)
+@@ -2819,12 +2886,12 @@ static int ethtool_ioctl(struct net *net, struct compat_ifreq __user *ifr32)
offsetof(struct ethtool_rxnfc, fs.ring_cookie));
if (copy_in_user(rxnfc, compat_rxnfc,
@@ -113686,7 +113472,7 @@ index 116cf9d..a13ae17 100644
copy_in_user(&rxnfc->rule_cnt, &compat_rxnfc->rule_cnt,
sizeof(rxnfc->rule_cnt)))
return -EFAULT;
-@@ -2840,12 +2907,12 @@ static int ethtool_ioctl(struct net *net, struct compat_ifreq __user *ifr32)
+@@ -2836,12 +2903,12 @@ static int ethtool_ioctl(struct net *net, struct compat_ifreq __user *ifr32)
if (convert_out) {
if (copy_in_user(compat_rxnfc, rxnfc,
@@ -113703,7 +113489,7 @@ index 116cf9d..a13ae17 100644
copy_in_user(&compat_rxnfc->rule_cnt, &rxnfc->rule_cnt,
sizeof(rxnfc->rule_cnt)))
return -EFAULT;
-@@ -2915,14 +2982,14 @@ static int bond_ioctl(struct net *net, unsigned int cmd,
+@@ -2911,14 +2978,14 @@ static int bond_ioctl(struct net *net, unsigned int cmd,
old_fs = get_fs();
set_fs(KERNEL_DS);
err = dev_ioctl(net, cmd,
@@ -113720,7 +113506,7 @@ index 116cf9d..a13ae17 100644
return -EFAULT;
if (get_user(data, &ifr32->ifr_ifru.ifru_data))
-@@ -3024,7 +3091,7 @@ static int compat_sioc_ifmap(struct net *net, unsigned int cmd,
+@@ -3020,7 +3087,7 @@ static int compat_sioc_ifmap(struct net *net, unsigned int cmd,
old_fs = get_fs();
set_fs(KERNEL_DS);
@@ -113729,7 +113515,7 @@ index 116cf9d..a13ae17 100644
set_fs(old_fs);
if (cmd == SIOCGIFMAP && !err) {
-@@ -3129,7 +3196,7 @@ static int routing_ioctl(struct net *net, struct socket *sock,
+@@ -3125,7 +3192,7 @@ static int routing_ioctl(struct net *net, struct socket *sock,
ret |= __get_user(rtdev, &(ur4->rt_dev));
if (rtdev) {
ret |= copy_from_user(devname, compat_ptr(rtdev), 15);
@@ -113738,7 +113524,7 @@ index 116cf9d..a13ae17 100644
devname[15] = 0;
} else
r4.rt_dev = NULL;
-@@ -3369,8 +3436,8 @@ int kernel_getsockopt(struct socket *sock, int level, int optname,
+@@ -3365,8 +3432,8 @@ int kernel_getsockopt(struct socket *sock, int level, int optname,
int __user *uoptlen;
int err;
@@ -113749,7 +113535,7 @@ index 116cf9d..a13ae17 100644
set_fs(KERNEL_DS);
if (level == SOL_SOCKET)
-@@ -3390,7 +3457,7 @@ int kernel_setsockopt(struct socket *sock, int level, int optname,
+@@ -3386,7 +3453,7 @@ int kernel_setsockopt(struct socket *sock, int level, int optname,
char __user *uoptval;
int err;
@@ -114590,7 +114376,7 @@ index 1983717..4d6102c 100644
sub->evt.event = htohl(event, sub->swap);
diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
-index 8705ee3..cf68ef1 100644
+index 9b1f371..ff529bf 100644
--- a/net/unix/af_unix.c
+++ b/net/unix/af_unix.c
@@ -768,6 +768,12 @@ static struct sock *unix_find_other(struct net *net,
@@ -114639,7 +114425,7 @@ index 8705ee3..cf68ef1 100644
mutex_unlock(&path.dentry->d_inode->i_mutex);
dput(path.dentry);
path.dentry = dentry;
-@@ -2180,11 +2200,14 @@ static unsigned int unix_dgram_poll(struct file *file, struct socket *sock,
+@@ -2188,11 +2208,14 @@ static unsigned int unix_dgram_poll(struct file *file, struct socket *sock,
writable = unix_writable(sk);
other = unix_peer_get(sk);
if (other) {
@@ -114656,7 +114442,7 @@ index 8705ee3..cf68ef1 100644
sock_put(other);
}
-@@ -2276,9 +2299,13 @@ static int unix_seq_show(struct seq_file *seq, void *v)
+@@ -2284,9 +2307,13 @@ static int unix_seq_show(struct seq_file *seq, void *v)
seq_puts(seq, "Num RefCount Protocol Flags Type St "
"Inode Path\n");
else {
@@ -114671,7 +114457,7 @@ index 8705ee3..cf68ef1 100644
seq_printf(seq, "%pK: %08X %08X %08X %04X %02X %5lu",
s,
-@@ -2303,10 +2330,29 @@ static int unix_seq_show(struct seq_file *seq, void *v)
+@@ -2311,10 +2338,29 @@ static int unix_seq_show(struct seq_file *seq, void *v)
seq_putc(seq, '@');
i++;
}
@@ -119101,7 +118887,7 @@ index 6ce2778..f25c378 100644
fail:
diff --git a/sound/synth/emux/emux_seq.c b/sound/synth/emux/emux_seq.c
-index 7778b8e..3d619fc 100644
+index a020920..55579f6 100644
--- a/sound/synth/emux/emux_seq.c
+++ b/sound/synth/emux/emux_seq.c
@@ -33,13 +33,13 @@ static int snd_emux_unuse(void *private_data, struct snd_seq_port_subscribe *inf
diff --git a/3.2.69/4425_grsec_remove_EI_PAX.patch b/3.2.70/4425_grsec_remove_EI_PAX.patch
index ba92792..ba92792 100644
--- a/3.2.69/4425_grsec_remove_EI_PAX.patch
+++ b/3.2.70/4425_grsec_remove_EI_PAX.patch
diff --git a/3.2.69/4427_force_XATTR_PAX_tmpfs.patch b/3.2.70/4427_force_XATTR_PAX_tmpfs.patch
index caaeed1..caaeed1 100644
--- a/3.2.69/4427_force_XATTR_PAX_tmpfs.patch
+++ b/3.2.70/4427_force_XATTR_PAX_tmpfs.patch
diff --git a/3.2.69/4430_grsec-remove-localversion-grsec.patch b/3.2.70/4430_grsec-remove-localversion-grsec.patch
index 31cf878..31cf878 100644
--- a/3.2.69/4430_grsec-remove-localversion-grsec.patch
+++ b/3.2.70/4430_grsec-remove-localversion-grsec.patch
diff --git a/3.2.69/4435_grsec-mute-warnings.patch b/3.2.70/4435_grsec-mute-warnings.patch
index baa71cb..baa71cb 100644
--- a/3.2.69/4435_grsec-mute-warnings.patch
+++ b/3.2.70/4435_grsec-mute-warnings.patch
diff --git a/3.2.69/4440_grsec-remove-protected-paths.patch b/3.2.70/4440_grsec-remove-protected-paths.patch
index 741546d..741546d 100644
--- a/3.2.69/4440_grsec-remove-protected-paths.patch
+++ b/3.2.70/4440_grsec-remove-protected-paths.patch
diff --git a/3.2.69/4450_grsec-kconfig-default-gids.patch b/3.2.70/4450_grsec-kconfig-default-gids.patch
index 5e1cb04..5e1cb04 100644
--- a/3.2.69/4450_grsec-kconfig-default-gids.patch
+++ b/3.2.70/4450_grsec-kconfig-default-gids.patch
diff --git a/3.2.69/4465_selinux-avc_audit-log-curr_ip.patch b/3.2.70/4465_selinux-avc_audit-log-curr_ip.patch
index f73d198..f73d198 100644
--- a/3.2.69/4465_selinux-avc_audit-log-curr_ip.patch
+++ b/3.2.70/4465_selinux-avc_audit-log-curr_ip.patch
diff --git a/3.2.69/4470_disable-compat_vdso.patch b/3.2.70/4470_disable-compat_vdso.patch
index 34d46de..34d46de 100644
--- a/3.2.69/4470_disable-compat_vdso.patch
+++ b/3.2.70/4470_disable-compat_vdso.patch
diff --git a/3.2.69/4475_emutramp_default_on.patch b/3.2.70/4475_emutramp_default_on.patch
index 2db58ab..2db58ab 100644
--- a/3.2.69/4475_emutramp_default_on.patch
+++ b/3.2.70/4475_emutramp_default_on.patch
diff --git a/4.1.4/1003_linux-4.1.4.patch b/4.1.4/1003_linux-4.1.4.patch
deleted file mode 100644
index d9bc159..0000000
--- a/4.1.4/1003_linux-4.1.4.patch
+++ /dev/null
@@ -1,11078 +0,0 @@
-diff --git a/Documentation/ABI/testing/ima_policy b/Documentation/ABI/testing/ima_policy
-index d0d0c57..0a378a8 100644
---- a/Documentation/ABI/testing/ima_policy
-+++ b/Documentation/ABI/testing/ima_policy
-@@ -20,17 +20,19 @@ Description:
- action: measure | dont_measure | appraise | dont_appraise | audit
- condition:= base | lsm [option]
- base: [[func=] [mask=] [fsmagic=] [fsuuid=] [uid=]
-- [fowner]]
-+ [euid=] [fowner=]]
- lsm: [[subj_user=] [subj_role=] [subj_type=]
- [obj_user=] [obj_role=] [obj_type=]]
- option: [[appraise_type=]] [permit_directio]
-
- base: func:= [BPRM_CHECK][MMAP_CHECK][FILE_CHECK][MODULE_CHECK]
- [FIRMWARE_CHECK]
-- mask:= [MAY_READ] [MAY_WRITE] [MAY_APPEND] [MAY_EXEC]
-+ mask:= [[^]MAY_READ] [[^]MAY_WRITE] [[^]MAY_APPEND]
-+ [[^]MAY_EXEC]
- fsmagic:= hex value
- fsuuid:= file system UUID (e.g 8bcbe394-4f13-4144-be8e-5aa9ea2ce2f6)
- uid:= decimal value
-+ euid:= decimal value
- fowner:=decimal value
- lsm: are LSM specific
- option: appraise_type:= [imasig]
-@@ -49,11 +51,25 @@ Description:
- dont_measure fsmagic=0x01021994
- dont_appraise fsmagic=0x01021994
- # RAMFS_MAGIC
-- dont_measure fsmagic=0x858458f6
- dont_appraise fsmagic=0x858458f6
-+ # DEVPTS_SUPER_MAGIC
-+ dont_measure fsmagic=0x1cd1
-+ dont_appraise fsmagic=0x1cd1
-+ # BINFMTFS_MAGIC
-+ dont_measure fsmagic=0x42494e4d
-+ dont_appraise fsmagic=0x42494e4d
- # SECURITYFS_MAGIC
- dont_measure fsmagic=0x73636673
- dont_appraise fsmagic=0x73636673
-+ # SELINUX_MAGIC
-+ dont_measure fsmagic=0xf97cff8c
-+ dont_appraise fsmagic=0xf97cff8c
-+ # CGROUP_SUPER_MAGIC
-+ dont_measure fsmagic=0x27e0eb
-+ dont_appraise fsmagic=0x27e0eb
-+ # NSFS_MAGIC
-+ dont_measure fsmagic=0x6e736673
-+ dont_appraise fsmagic=0x6e736673
-
- measure func=BPRM_CHECK
- measure func=FILE_MMAP mask=MAY_EXEC
-@@ -70,10 +86,6 @@ Description:
- Examples of LSM specific definitions:
-
- SELinux:
-- # SELINUX_MAGIC
-- dont_measure fsmagic=0xf97cff8c
-- dont_appraise fsmagic=0xf97cff8c
--
- dont_measure obj_type=var_log_t
- dont_appraise obj_type=var_log_t
- dont_measure obj_type=auditd_log_t
-diff --git a/Documentation/ABI/testing/sysfs-ata b/Documentation/ABI/testing/sysfs-ata
-index 0a93215..9231dae 100644
---- a/Documentation/ABI/testing/sysfs-ata
-+++ b/Documentation/ABI/testing/sysfs-ata
-@@ -90,6 +90,17 @@ gscr
- 130: SATA_PMP_GSCR_SII_GPIO
- Only valid if the device is a PM.
-
-+trim
-+
-+ Shows the DSM TRIM mode currently used by the device. Valid
-+ values are:
-+ unsupported: Drive does not support DSM TRIM
-+ unqueued: Drive supports unqueued DSM TRIM only
-+ queued: Drive supports queued DSM TRIM
-+ forced_unqueued: Drive's unqueued DSM support is known to be
-+ buggy and only unqueued TRIM commands
-+ are sent
-+
- spdn_cnt
-
- Number of time libata decided to lower the speed of link due to errors.
-diff --git a/Documentation/ABI/testing/sysfs-bus-iio b/Documentation/ABI/testing/sysfs-bus-iio
-index 3befcb1..1fbdd79 100644
---- a/Documentation/ABI/testing/sysfs-bus-iio
-+++ b/Documentation/ABI/testing/sysfs-bus-iio
-@@ -1165,10 +1165,8 @@ Description:
- object is near the sensor, usually be observing
- reflectivity of infrared or ultrasound emitted.
- Often these sensors are unit less and as such conversion
-- to SI units is not possible. Where it is, the units should
-- be meters. If such a conversion is not possible, the reported
-- values should behave in the same way as a distance, i.e. lower
-- values indicate something is closer to the sensor.
-+ to SI units is not possible. Higher proximity measurements
-+ indicate closer objects, and vice versa.
-
- What: /sys/.../iio:deviceX/in_illuminance_input
- What: /sys/.../iio:deviceX/in_illuminance_raw
-diff --git a/Documentation/devicetree/bindings/pinctrl/marvell,armada-370-pinctrl.txt b/Documentation/devicetree/bindings/pinctrl/marvell,armada-370-pinctrl.txt
-index adda2a8..e357b02 100644
---- a/Documentation/devicetree/bindings/pinctrl/marvell,armada-370-pinctrl.txt
-+++ b/Documentation/devicetree/bindings/pinctrl/marvell,armada-370-pinctrl.txt
-@@ -92,5 +92,5 @@ mpp61 61 gpo, dev(wen1), uart1(txd), audio(rclk)
- mpp62 62 gpio, dev(a2), uart1(cts), tdm(drx), pcie(clkreq0),
- audio(mclk), uart0(cts)
- mpp63 63 gpo, spi0(sck), tclk
--mpp64 64 gpio, spi0(miso), spi0-1(cs1)
--mpp65 65 gpio, spi0(mosi), spi0-1(cs2)
-+mpp64 64 gpio, spi0(miso), spi0(cs1)
-+mpp65 65 gpio, spi0(mosi), spi0(cs2)
-diff --git a/Documentation/devicetree/bindings/pinctrl/marvell,armada-375-pinctrl.txt b/Documentation/devicetree/bindings/pinctrl/marvell,armada-375-pinctrl.txt
-index 7de0cda..bedbe42 100644
---- a/Documentation/devicetree/bindings/pinctrl/marvell,armada-375-pinctrl.txt
-+++ b/Documentation/devicetree/bindings/pinctrl/marvell,armada-375-pinctrl.txt
-@@ -22,8 +22,8 @@ mpp5 5 gpio, dev(ad7), spi0(cs2), spi1(cs2)
- mpp6 6 gpio, dev(ad0), led(p1), audio(rclk)
- mpp7 7 gpio, dev(ad1), ptp(clk), led(p2), audio(extclk)
- mpp8 8 gpio, dev (bootcs), spi0(cs0), spi1(cs0)
--mpp9 9 gpio, nf(wen), spi0(sck), spi1(sck)
--mpp10 10 gpio, nf(ren), dram(vttctrl), led(c1)
-+mpp9 9 gpio, spi0(sck), spi1(sck), nand(we)
-+mpp10 10 gpio, dram(vttctrl), led(c1), nand(re)
- mpp11 11 gpio, dev(a0), led(c2), audio(sdo)
- mpp12 12 gpio, dev(a1), audio(bclk)
- mpp13 13 gpio, dev(readyn), pcie0(rstoutn), pcie1(rstoutn)
-diff --git a/Documentation/devicetree/bindings/pinctrl/marvell,armada-38x-pinctrl.txt b/Documentation/devicetree/bindings/pinctrl/marvell,armada-38x-pinctrl.txt
-index b17c968..4ac138a 100644
---- a/Documentation/devicetree/bindings/pinctrl/marvell,armada-38x-pinctrl.txt
-+++ b/Documentation/devicetree/bindings/pinctrl/marvell,armada-38x-pinctrl.txt
-@@ -27,15 +27,15 @@ mpp8 8 gpio, ge0(txd1), dev(ad10)
- mpp9 9 gpio, ge0(txd2), dev(ad11)
- mpp10 10 gpio, ge0(txd3), dev(ad12)
- mpp11 11 gpio, ge0(txctl), dev(ad13)
--mpp12 12 gpio, ge0(rxd0), pcie0(rstout), pcie1(rstout) [1], spi0(cs1), dev(ad14)
--mpp13 13 gpio, ge0(rxd1), pcie0(clkreq), pcie1(clkreq) [1], spi0(cs2), dev(ad15)
--mpp14 14 gpio, ge0(rxd2), ptp(clk), m(vtt_ctrl), spi0(cs3), dev(wen1)
--mpp15 15 gpio, ge0(rxd3), ge(mdc slave), pcie0(rstout), spi0(mosi), pcie1(rstout) [1]
--mpp16 16 gpio, ge0(rxctl), ge(mdio slave), m(decc_err), spi0(miso), pcie0(clkreq)
-+mpp12 12 gpio, ge0(rxd0), pcie0(rstout), spi0(cs1), dev(ad14), pcie3(clkreq)
-+mpp13 13 gpio, ge0(rxd1), pcie0(clkreq), pcie1(clkreq) [1], spi0(cs2), dev(ad15), pcie2(clkreq)
-+mpp14 14 gpio, ge0(rxd2), ptp(clk), m(vtt_ctrl), spi0(cs3), dev(wen1), pcie3(clkreq)
-+mpp15 15 gpio, ge0(rxd3), ge(mdc slave), pcie0(rstout), spi0(mosi)
-+mpp16 16 gpio, ge0(rxctl), ge(mdio slave), m(decc_err), spi0(miso), pcie0(clkreq), pcie1(clkreq) [1]
- mpp17 17 gpio, ge0(rxclk), ptp(clk), ua1(rxd), spi0(sck), sata1(prsnt)
--mpp18 18 gpio, ge0(rxerr), ptp(trig_gen), ua1(txd), spi0(cs0), pcie1(rstout) [1]
--mpp19 19 gpio, ge0(col), ptp(event_req), pcie0(clkreq), sata1(prsnt), ua0(cts)
--mpp20 20 gpio, ge0(txclk), ptp(clk), pcie1(rstout) [1], sata0(prsnt), ua0(rts)
-+mpp18 18 gpio, ge0(rxerr), ptp(trig_gen), ua1(txd), spi0(cs0)
-+mpp19 19 gpio, ge0(col), ptp(event_req), ge0(txerr), sata1(prsnt), ua0(cts)
-+mpp20 20 gpio, ge0(txclk), ptp(clk), sata0(prsnt), ua0(rts)
- mpp21 21 gpio, spi0(cs1), ge1(rxd0), sata0(prsnt), sd0(cmd), dev(bootcs)
- mpp22 22 gpio, spi0(mosi), dev(ad0)
- mpp23 23 gpio, spi0(sck), dev(ad2)
-@@ -58,23 +58,23 @@ mpp39 39 gpio, i2c1(sck), ge1(rxd2), ua0(cts), sd0(d1), dev(a2)
- mpp40 40 gpio, i2c1(sda), ge1(rxd3), ua0(rts), sd0(d2), dev(ad6)
- mpp41 41 gpio, ua1(rxd), ge1(rxctl), ua0(cts), spi1(cs3), dev(burst/last)
- mpp42 42 gpio, ua1(txd), ua0(rts), dev(ad7)
--mpp43 43 gpio, pcie0(clkreq), m(vtt_ctrl), m(decc_err), pcie0(rstout), dev(clkout)
--mpp44 44 gpio, sata0(prsnt), sata1(prsnt), sata2(prsnt) [2], sata3(prsnt) [3], pcie0(rstout)
--mpp45 45 gpio, ref(clk_out0), pcie0(rstout), pcie1(rstout) [1], pcie2(rstout), pcie3(rstout)
--mpp46 46 gpio, ref(clk_out1), pcie0(rstout), pcie1(rstout) [1], pcie2(rstout), pcie3(rstout)
--mpp47 47 gpio, sata0(prsnt), sata1(prsnt), sata2(prsnt) [2], spi1(cs2), sata3(prsnt) [2]
--mpp48 48 gpio, sata0(prsnt), m(vtt_ctrl), tdm2c(pclk), audio(mclk), sd0(d4)
--mpp49 49 gpio, sata2(prsnt) [2], sata3(prsnt) [2], tdm2c(fsync), audio(lrclk), sd0(d5)
--mpp50 50 gpio, pcie0(rstout), pcie1(rstout) [1], tdm2c(drx), audio(extclk), sd0(cmd)
-+mpp43 43 gpio, pcie0(clkreq), m(vtt_ctrl), m(decc_err), spi1(cs2), dev(clkout)
-+mpp44 44 gpio, sata0(prsnt), sata1(prsnt), sata2(prsnt) [2], sata3(prsnt) [3]
-+mpp45 45 gpio, ref(clk_out0), pcie0(rstout)
-+mpp46 46 gpio, ref(clk_out1), pcie0(rstout)
-+mpp47 47 gpio, sata0(prsnt), sata1(prsnt), sata2(prsnt) [2], sata3(prsnt) [2]
-+mpp48 48 gpio, sata0(prsnt), m(vtt_ctrl), tdm2c(pclk), audio(mclk), sd0(d4), pcie0(clkreq)
-+mpp49 49 gpio, sata2(prsnt) [2], sata3(prsnt) [2], tdm2c(fsync), audio(lrclk), sd0(d5), pcie1(clkreq)
-+mpp50 50 gpio, pcie0(rstout), tdm2c(drx), audio(extclk), sd0(cmd)
- mpp51 51 gpio, tdm2c(dtx), audio(sdo), m(decc_err)
--mpp52 52 gpio, pcie0(rstout), pcie1(rstout) [1], tdm2c(intn), audio(sdi), sd0(d6)
-+mpp52 52 gpio, pcie0(rstout), tdm2c(intn), audio(sdi), sd0(d6)
- mpp53 53 gpio, sata1(prsnt), sata0(prsnt), tdm2c(rstn), audio(bclk), sd0(d7)
--mpp54 54 gpio, sata0(prsnt), sata1(prsnt), pcie0(rstout), pcie1(rstout) [1], sd0(d3)
-+mpp54 54 gpio, sata0(prsnt), sata1(prsnt), pcie0(rstout), ge0(txerr), sd0(d3)
- mpp55 55 gpio, ua1(cts), ge(mdio), pcie1(clkreq) [1], spi1(cs1), sd0(d0)
- mpp56 56 gpio, ua1(rts), ge(mdc), m(decc_err), spi1(mosi)
- mpp57 57 gpio, spi1(sck), sd0(clk)
- mpp58 58 gpio, pcie1(clkreq) [1], i2c1(sck), pcie2(clkreq), spi1(miso), sd0(d1)
--mpp59 59 gpio, pcie0(rstout), i2c1(sda), pcie1(rstout) [1], spi1(cs0), sd0(d2)
-+mpp59 59 gpio, pcie0(rstout), i2c1(sda), spi1(cs0), sd0(d2)
-
- [1]: only available on 88F6820 and 88F6828
- [2]: only available on 88F6828
-diff --git a/Documentation/devicetree/bindings/pinctrl/marvell,armada-xp-pinctrl.txt b/Documentation/devicetree/bindings/pinctrl/marvell,armada-xp-pinctrl.txt
-index 373dbccd..96e7744 100644
---- a/Documentation/devicetree/bindings/pinctrl/marvell,armada-xp-pinctrl.txt
-+++ b/Documentation/devicetree/bindings/pinctrl/marvell,armada-xp-pinctrl.txt
-@@ -42,15 +42,15 @@ mpp20 20 gpio, ge0(rxd4), ge1(rxd2), lcd(d20), ptp(clk)
- mpp21 21 gpio, ge0(rxd5), ge1(rxd3), lcd(d21), mem(bat)
- mpp22 22 gpio, ge0(rxd6), ge1(rxctl), lcd(d22), sata0(prsnt)
- mpp23 23 gpio, ge0(rxd7), ge1(rxclk), lcd(d23), sata1(prsnt)
--mpp24 24 gpio, lcd(hsync), sata1(prsnt), nf(bootcs-re), tdm(rst)
--mpp25 25 gpio, lcd(vsync), sata0(prsnt), nf(bootcs-we), tdm(pclk)
--mpp26 26 gpio, lcd(clk), tdm(fsync), vdd(cpu1-pd)
-+mpp24 24 gpio, lcd(hsync), sata1(prsnt), tdm(rst)
-+mpp25 25 gpio, lcd(vsync), sata0(prsnt), tdm(pclk)
-+mpp26 26 gpio, lcd(clk), tdm(fsync)
- mpp27 27 gpio, lcd(e), tdm(dtx), ptp(trig)
- mpp28 28 gpio, lcd(pwm), tdm(drx), ptp(evreq)
--mpp29 29 gpio, lcd(ref-clk), tdm(int0), ptp(clk), vdd(cpu0-pd)
-+mpp29 29 gpio, lcd(ref-clk), tdm(int0), ptp(clk)
- mpp30 30 gpio, tdm(int1), sd0(clk)
--mpp31 31 gpio, tdm(int2), sd0(cmd), vdd(cpu0-pd)
--mpp32 32 gpio, tdm(int3), sd0(d0), vdd(cpu1-pd)
-+mpp31 31 gpio, tdm(int2), sd0(cmd)
-+mpp32 32 gpio, tdm(int3), sd0(d0)
- mpp33 33 gpio, tdm(int4), sd0(d1), mem(bat)
- mpp34 34 gpio, tdm(int5), sd0(d2), sata0(prsnt)
- mpp35 35 gpio, tdm(int6), sd0(d3), sata1(prsnt)
-@@ -58,21 +58,18 @@ mpp36 36 gpio, spi(mosi)
- mpp37 37 gpio, spi(miso)
- mpp38 38 gpio, spi(sck)
- mpp39 39 gpio, spi(cs0)
--mpp40 40 gpio, spi(cs1), uart2(cts), lcd(vga-hsync), vdd(cpu1-pd),
-- pcie(clkreq0)
-+mpp40 40 gpio, spi(cs1), uart2(cts), lcd(vga-hsync), pcie(clkreq0)
- mpp41 41 gpio, spi(cs2), uart2(rts), lcd(vga-vsync), sata1(prsnt),
- pcie(clkreq1)
--mpp42 42 gpio, uart2(rxd), uart0(cts), tdm(int7), tdm-1(timer),
-- vdd(cpu0-pd)
--mpp43 43 gpio, uart2(txd), uart0(rts), spi(cs3), pcie(rstout),
-- vdd(cpu2-3-pd){1}
-+mpp42 42 gpio, uart2(rxd), uart0(cts), tdm(int7), tdm-1(timer)
-+mpp43 43 gpio, uart2(txd), uart0(rts), spi(cs3), pcie(rstout)
- mpp44 44 gpio, uart2(cts), uart3(rxd), spi(cs4), pcie(clkreq2),
- mem(bat)
- mpp45 45 gpio, uart2(rts), uart3(txd), spi(cs5), sata1(prsnt)
- mpp46 46 gpio, uart3(rts), uart1(rts), spi(cs6), sata0(prsnt)
- mpp47 47 gpio, uart3(cts), uart1(cts), spi(cs7), pcie(clkreq3),
- ref(clkout)
--mpp48 48 gpio, tclk, dev(burst/last)
-+mpp48 48 gpio, dev(clkout), dev(burst/last)
-
- * Marvell Armada XP (mv78260 and mv78460 only)
-
-@@ -84,9 +81,9 @@ mpp51 51 gpio, dev(ad16)
- mpp52 52 gpio, dev(ad17)
- mpp53 53 gpio, dev(ad18)
- mpp54 54 gpio, dev(ad19)
--mpp55 55 gpio, dev(ad20), vdd(cpu0-pd)
--mpp56 56 gpio, dev(ad21), vdd(cpu1-pd)
--mpp57 57 gpio, dev(ad22), vdd(cpu2-3-pd){1}
-+mpp55 55 gpio, dev(ad20)
-+mpp56 56 gpio, dev(ad21)
-+mpp57 57 gpio, dev(ad22)
- mpp58 58 gpio, dev(ad23)
- mpp59 59 gpio, dev(ad24)
- mpp60 60 gpio, dev(ad25)
-@@ -96,6 +93,3 @@ mpp63 63 gpio, dev(ad28)
- mpp64 64 gpio, dev(ad29)
- mpp65 65 gpio, dev(ad30)
- mpp66 66 gpio, dev(ad31)
--
--Notes:
--* {1} vdd(cpu2-3-pd) only available on mv78460.
-diff --git a/Documentation/devicetree/bindings/usb/atmel-usb.txt b/Documentation/devicetree/bindings/usb/atmel-usb.txt
-index e180d56..de773a0 100644
---- a/Documentation/devicetree/bindings/usb/atmel-usb.txt
-+++ b/Documentation/devicetree/bindings/usb/atmel-usb.txt
-@@ -60,9 +60,9 @@ Atmel High-Speed USB device controller
-
- Required properties:
- - compatible: Should be one of the following
-- "at91sam9rl-udc"
-- "at91sam9g45-udc"
-- "sama5d3-udc"
-+ "atmel,at91sam9rl-udc"
-+ "atmel,at91sam9g45-udc"
-+ "atmel,sama5d3-udc"
- - reg: Address and length of the register set for the device
- - interrupts: Should contain usba interrupt
- - ep childnode: To specify the number of endpoints and their properties.
-diff --git a/Documentation/kernel-parameters.txt b/Documentation/kernel-parameters.txt
-index 6726139..cd03a0f 100644
---- a/Documentation/kernel-parameters.txt
-+++ b/Documentation/kernel-parameters.txt
-@@ -1398,7 +1398,15 @@ bytes respectively. Such letter suffixes can also be entirely omitted.
- The list of supported hash algorithms is defined
- in crypto/hash_info.h.
-
-- ima_tcb [IMA]
-+ ima_policy= [IMA]
-+ The builtin measurement policy to load during IMA
-+ setup. Specyfing "tcb" as the value, measures all
-+ programs exec'd, files mmap'd for exec, and all files
-+ opened with the read mode bit set by either the
-+ effective uid (euid=0) or uid=0.
-+ Format: "tcb"
-+
-+ ima_tcb [IMA] Deprecated. Use ima_policy= instead.
- Load a policy which meets the needs of the Trusted
- Computing Base. This means IMA will measure all
- programs exec'd, files mmap'd for exec, and all files
-diff --git a/Makefile b/Makefile
-index e3cdec4..36f3225 100644
---- a/Makefile
-+++ b/Makefile
-@@ -1,6 +1,6 @@
- VERSION = 4
- PATCHLEVEL = 1
--SUBLEVEL = 3
-+SUBLEVEL = 4
- EXTRAVERSION =
- NAME = Series 4800
-
-diff --git a/arch/arm/boot/dts/at91-sama5d4ek.dts b/arch/arm/boot/dts/at91-sama5d4ek.dts
-index 89ef4a5..45e7761 100644
---- a/arch/arm/boot/dts/at91-sama5d4ek.dts
-+++ b/arch/arm/boot/dts/at91-sama5d4ek.dts
-@@ -108,8 +108,8 @@
- mmc0: mmc@f8000000 {
- pinctrl-names = "default";
- pinctrl-0 = <&pinctrl_mmc0_clk_cmd_dat0 &pinctrl_mmc0_dat1_3 &pinctrl_mmc0_cd>;
-- slot@1 {
-- reg = <1>;
-+ slot@0 {
-+ reg = <0>;
- bus-width = <4>;
- cd-gpios = <&pioE 5 0>;
- };
-diff --git a/arch/arm/boot/dts/at91sam9g45.dtsi b/arch/arm/boot/dts/at91sam9g45.dtsi
-index 70e59c5..e544211 100644
---- a/arch/arm/boot/dts/at91sam9g45.dtsi
-+++ b/arch/arm/boot/dts/at91sam9g45.dtsi
-@@ -1148,7 +1148,7 @@
- usb2: gadget@fff78000 {
- #address-cells = <1>;
- #size-cells = <0>;
-- compatible = "atmel,at91sam9rl-udc";
-+ compatible = "atmel,at91sam9g45-udc";
- reg = <0x00600000 0x80000
- 0xfff78000 0x400>;
- interrupts = <27 IRQ_TYPE_LEVEL_HIGH 0>;
-diff --git a/arch/arm/boot/dts/at91sam9x5.dtsi b/arch/arm/boot/dts/at91sam9x5.dtsi
-index 3aa56ae..3314a73 100644
---- a/arch/arm/boot/dts/at91sam9x5.dtsi
-+++ b/arch/arm/boot/dts/at91sam9x5.dtsi
-@@ -1062,7 +1062,7 @@
- usb2: gadget@f803c000 {
- #address-cells = <1>;
- #size-cells = <0>;
-- compatible = "atmel,at91sam9rl-udc";
-+ compatible = "atmel,at91sam9g45-udc";
- reg = <0x00500000 0x80000
- 0xf803c000 0x400>;
- interrupts = <23 IRQ_TYPE_LEVEL_HIGH 0>;
-diff --git a/arch/arm/boot/dts/imx23.dtsi b/arch/arm/boot/dts/imx23.dtsi
-index bbcfb5a..0cb8b0b 100644
---- a/arch/arm/boot/dts/imx23.dtsi
-+++ b/arch/arm/boot/dts/imx23.dtsi
-@@ -435,6 +435,7 @@
- interrupts = <36 37 38 39 40 41 42 43 44>;
- status = "disabled";
- clocks = <&clks 26>;
-+ #io-channel-cells = <1>;
- };
-
- spdif@80054000 {
-diff --git a/arch/arm/boot/dts/sama5d3.dtsi b/arch/arm/boot/dts/sama5d3.dtsi
-index 57ab858..37e6182 100644
---- a/arch/arm/boot/dts/sama5d3.dtsi
-+++ b/arch/arm/boot/dts/sama5d3.dtsi
-@@ -1321,7 +1321,7 @@
- usb0: gadget@00500000 {
- #address-cells = <1>;
- #size-cells = <0>;
-- compatible = "atmel,at91sam9rl-udc";
-+ compatible = "atmel,sama5d3-udc";
- reg = <0x00500000 0x100000
- 0xf8030000 0x4000>;
- interrupts = <33 IRQ_TYPE_LEVEL_HIGH 2>;
-diff --git a/arch/arm/boot/dts/sama5d4.dtsi b/arch/arm/boot/dts/sama5d4.dtsi
-index 6b1bb58..a5f5f40 100644
---- a/arch/arm/boot/dts/sama5d4.dtsi
-+++ b/arch/arm/boot/dts/sama5d4.dtsi
-@@ -123,7 +123,7 @@
- usb0: gadget@00400000 {
- #address-cells = <1>;
- #size-cells = <0>;
-- compatible = "atmel,at91sam9rl-udc";
-+ compatible = "atmel,sama5d3-udc";
- reg = <0x00400000 0x100000
- 0xfc02c000 0x4000>;
- interrupts = <47 IRQ_TYPE_LEVEL_HIGH 2>;
-@@ -1125,10 +1125,10 @@
- compatible = "atmel,at91sam9g46-aes";
- reg = <0xfc044000 0x100>;
- interrupts = <12 IRQ_TYPE_LEVEL_HIGH 0>;
-- dmas = <&dma0 (AT91_XDMAC_DT_MEM_IF(0) | AT91_XDMAC_DT_PER_IF(1))
-- AT91_XDMAC_DT_PERID(41)>,
-- <&dma0 (AT91_XDMAC_DT_MEM_IF(0) | AT91_XDMAC_DT_PER_IF(1))
-- AT91_XDMAC_DT_PERID(40)>;
-+ dmas = <&dma0 (AT91_XDMAC_DT_MEM_IF(0) | AT91_XDMAC_DT_PER_IF(1)
-+ | AT91_XDMAC_DT_PERID(41))>,
-+ <&dma0 (AT91_XDMAC_DT_MEM_IF(0) | AT91_XDMAC_DT_PER_IF(1)
-+ | AT91_XDMAC_DT_PERID(40))>;
- dma-names = "tx", "rx";
- clocks = <&aes_clk>;
- clock-names = "aes_clk";
-@@ -1139,10 +1139,10 @@
- compatible = "atmel,at91sam9g46-tdes";
- reg = <0xfc04c000 0x100>;
- interrupts = <14 IRQ_TYPE_LEVEL_HIGH 0>;
-- dmas = <&dma0 (AT91_XDMAC_DT_MEM_IF(0) | AT91_XDMAC_DT_PER_IF(1))
-- AT91_XDMAC_DT_PERID(42)>,
-- <&dma0 (AT91_XDMAC_DT_MEM_IF(0) | AT91_XDMAC_DT_PER_IF(1))
-- AT91_XDMAC_DT_PERID(43)>;
-+ dmas = <&dma0 (AT91_XDMAC_DT_MEM_IF(0) | AT91_XDMAC_DT_PER_IF(1)
-+ | AT91_XDMAC_DT_PERID(42))>,
-+ <&dma0 (AT91_XDMAC_DT_MEM_IF(0) | AT91_XDMAC_DT_PER_IF(1)
-+ | AT91_XDMAC_DT_PERID(43))>;
- dma-names = "tx", "rx";
- clocks = <&tdes_clk>;
- clock-names = "tdes_clk";
-@@ -1153,8 +1153,8 @@
- compatible = "atmel,at91sam9g46-sha";
- reg = <0xfc050000 0x100>;
- interrupts = <15 IRQ_TYPE_LEVEL_HIGH 0>;
-- dmas = <&dma0 (AT91_XDMAC_DT_MEM_IF(0) | AT91_XDMAC_DT_PER_IF(1))
-- AT91_XDMAC_DT_PERID(44)>;
-+ dmas = <&dma0 (AT91_XDMAC_DT_MEM_IF(0) | AT91_XDMAC_DT_PER_IF(1)
-+ | AT91_XDMAC_DT_PERID(44))>;
- dma-names = "tx";
- clocks = <&sha_clk>;
- clock-names = "sha_clk";
-diff --git a/arch/arm/kernel/smp.c b/arch/arm/kernel/smp.c
-index cca5b87..f11d825 100644
---- a/arch/arm/kernel/smp.c
-+++ b/arch/arm/kernel/smp.c
-@@ -576,7 +576,7 @@ void handle_IPI(int ipinr, struct pt_regs *regs)
- struct pt_regs *old_regs = set_irq_regs(regs);
-
- if ((unsigned)ipinr < NR_IPI) {
-- trace_ipi_entry(ipi_types[ipinr]);
-+ trace_ipi_entry_rcuidle(ipi_types[ipinr]);
- __inc_irq_stat(cpu, ipi_irqs[ipinr]);
- }
-
-@@ -635,7 +635,7 @@ void handle_IPI(int ipinr, struct pt_regs *regs)
- }
-
- if ((unsigned)ipinr < NR_IPI)
-- trace_ipi_exit(ipi_types[ipinr]);
-+ trace_ipi_exit_rcuidle(ipi_types[ipinr]);
- set_irq_regs(old_regs);
- }
-
-diff --git a/arch/arm/mach-dove/include/mach/irqs.h b/arch/arm/mach-dove/include/mach/irqs.h
-index 03d401d..3f29e6bc 100644
---- a/arch/arm/mach-dove/include/mach/irqs.h
-+++ b/arch/arm/mach-dove/include/mach/irqs.h
-@@ -14,73 +14,73 @@
- /*
- * Dove Low Interrupt Controller
- */
--#define IRQ_DOVE_BRIDGE 0
--#define IRQ_DOVE_H2C 1
--#define IRQ_DOVE_C2H 2
--#define IRQ_DOVE_NAND 3
--#define IRQ_DOVE_PDMA 4
--#define IRQ_DOVE_SPI1 5
--#define IRQ_DOVE_SPI0 6
--#define IRQ_DOVE_UART_0 7
--#define IRQ_DOVE_UART_1 8
--#define IRQ_DOVE_UART_2 9
--#define IRQ_DOVE_UART_3 10
--#define IRQ_DOVE_I2C 11
--#define IRQ_DOVE_GPIO_0_7 12
--#define IRQ_DOVE_GPIO_8_15 13
--#define IRQ_DOVE_GPIO_16_23 14
--#define IRQ_DOVE_PCIE0_ERR 15
--#define IRQ_DOVE_PCIE0 16
--#define IRQ_DOVE_PCIE1_ERR 17
--#define IRQ_DOVE_PCIE1 18
--#define IRQ_DOVE_I2S0 19
--#define IRQ_DOVE_I2S0_ERR 20
--#define IRQ_DOVE_I2S1 21
--#define IRQ_DOVE_I2S1_ERR 22
--#define IRQ_DOVE_USB_ERR 23
--#define IRQ_DOVE_USB0 24
--#define IRQ_DOVE_USB1 25
--#define IRQ_DOVE_GE00_RX 26
--#define IRQ_DOVE_GE00_TX 27
--#define IRQ_DOVE_GE00_MISC 28
--#define IRQ_DOVE_GE00_SUM 29
--#define IRQ_DOVE_GE00_ERR 30
--#define IRQ_DOVE_CRYPTO 31
-+#define IRQ_DOVE_BRIDGE (1 + 0)
-+#define IRQ_DOVE_H2C (1 + 1)
-+#define IRQ_DOVE_C2H (1 + 2)
-+#define IRQ_DOVE_NAND (1 + 3)
-+#define IRQ_DOVE_PDMA (1 + 4)
-+#define IRQ_DOVE_SPI1 (1 + 5)
-+#define IRQ_DOVE_SPI0 (1 + 6)
-+#define IRQ_DOVE_UART_0 (1 + 7)
-+#define IRQ_DOVE_UART_1 (1 + 8)
-+#define IRQ_DOVE_UART_2 (1 + 9)
-+#define IRQ_DOVE_UART_3 (1 + 10)
-+#define IRQ_DOVE_I2C (1 + 11)
-+#define IRQ_DOVE_GPIO_0_7 (1 + 12)
-+#define IRQ_DOVE_GPIO_8_15 (1 + 13)
-+#define IRQ_DOVE_GPIO_16_23 (1 + 14)
-+#define IRQ_DOVE_PCIE0_ERR (1 + 15)
-+#define IRQ_DOVE_PCIE0 (1 + 16)
-+#define IRQ_DOVE_PCIE1_ERR (1 + 17)
-+#define IRQ_DOVE_PCIE1 (1 + 18)
-+#define IRQ_DOVE_I2S0 (1 + 19)
-+#define IRQ_DOVE_I2S0_ERR (1 + 20)
-+#define IRQ_DOVE_I2S1 (1 + 21)
-+#define IRQ_DOVE_I2S1_ERR (1 + 22)
-+#define IRQ_DOVE_USB_ERR (1 + 23)
-+#define IRQ_DOVE_USB0 (1 + 24)
-+#define IRQ_DOVE_USB1 (1 + 25)
-+#define IRQ_DOVE_GE00_RX (1 + 26)
-+#define IRQ_DOVE_GE00_TX (1 + 27)
-+#define IRQ_DOVE_GE00_MISC (1 + 28)
-+#define IRQ_DOVE_GE00_SUM (1 + 29)
-+#define IRQ_DOVE_GE00_ERR (1 + 30)
-+#define IRQ_DOVE_CRYPTO (1 + 31)
-
- /*
- * Dove High Interrupt Controller
- */
--#define IRQ_DOVE_AC97 32
--#define IRQ_DOVE_PMU 33
--#define IRQ_DOVE_CAM 34
--#define IRQ_DOVE_SDIO0 35
--#define IRQ_DOVE_SDIO1 36
--#define IRQ_DOVE_SDIO0_WAKEUP 37
--#define IRQ_DOVE_SDIO1_WAKEUP 38
--#define IRQ_DOVE_XOR_00 39
--#define IRQ_DOVE_XOR_01 40
--#define IRQ_DOVE_XOR0_ERR 41
--#define IRQ_DOVE_XOR_10 42
--#define IRQ_DOVE_XOR_11 43
--#define IRQ_DOVE_XOR1_ERR 44
--#define IRQ_DOVE_LCD_DCON 45
--#define IRQ_DOVE_LCD1 46
--#define IRQ_DOVE_LCD0 47
--#define IRQ_DOVE_GPU 48
--#define IRQ_DOVE_PERFORM_MNTR 49
--#define IRQ_DOVE_VPRO_DMA1 51
--#define IRQ_DOVE_SSP_TIMER 54
--#define IRQ_DOVE_SSP 55
--#define IRQ_DOVE_MC_L2_ERR 56
--#define IRQ_DOVE_CRYPTO_ERR 59
--#define IRQ_DOVE_GPIO_24_31 60
--#define IRQ_DOVE_HIGH_GPIO 61
--#define IRQ_DOVE_SATA 62
-+#define IRQ_DOVE_AC97 (1 + 32)
-+#define IRQ_DOVE_PMU (1 + 33)
-+#define IRQ_DOVE_CAM (1 + 34)
-+#define IRQ_DOVE_SDIO0 (1 + 35)
-+#define IRQ_DOVE_SDIO1 (1 + 36)
-+#define IRQ_DOVE_SDIO0_WAKEUP (1 + 37)
-+#define IRQ_DOVE_SDIO1_WAKEUP (1 + 38)
-+#define IRQ_DOVE_XOR_00 (1 + 39)
-+#define IRQ_DOVE_XOR_01 (1 + 40)
-+#define IRQ_DOVE_XOR0_ERR (1 + 41)
-+#define IRQ_DOVE_XOR_10 (1 + 42)
-+#define IRQ_DOVE_XOR_11 (1 + 43)
-+#define IRQ_DOVE_XOR1_ERR (1 + 44)
-+#define IRQ_DOVE_LCD_DCON (1 + 45)
-+#define IRQ_DOVE_LCD1 (1 + 46)
-+#define IRQ_DOVE_LCD0 (1 + 47)
-+#define IRQ_DOVE_GPU (1 + 48)
-+#define IRQ_DOVE_PERFORM_MNTR (1 + 49)
-+#define IRQ_DOVE_VPRO_DMA1 (1 + 51)
-+#define IRQ_DOVE_SSP_TIMER (1 + 54)
-+#define IRQ_DOVE_SSP (1 + 55)
-+#define IRQ_DOVE_MC_L2_ERR (1 + 56)
-+#define IRQ_DOVE_CRYPTO_ERR (1 + 59)
-+#define IRQ_DOVE_GPIO_24_31 (1 + 60)
-+#define IRQ_DOVE_HIGH_GPIO (1 + 61)
-+#define IRQ_DOVE_SATA (1 + 62)
-
- /*
- * DOVE General Purpose Pins
- */
--#define IRQ_DOVE_GPIO_START 64
-+#define IRQ_DOVE_GPIO_START 65
- #define NR_GPIO_IRQS 64
-
- /*
-diff --git a/arch/arm/mach-dove/irq.c b/arch/arm/mach-dove/irq.c
-index 4a5a7ae..df0223f 100644
---- a/arch/arm/mach-dove/irq.c
-+++ b/arch/arm/mach-dove/irq.c
-@@ -126,14 +126,14 @@ __exception_irq_entry dove_legacy_handle_irq(struct pt_regs *regs)
- stat = readl_relaxed(dove_irq_base + IRQ_CAUSE_LOW_OFF);
- stat &= readl_relaxed(dove_irq_base + IRQ_MASK_LOW_OFF);
- if (stat) {
-- unsigned int hwirq = __fls(stat);
-+ unsigned int hwirq = 1 + __fls(stat);
- handle_IRQ(hwirq, regs);
- return;
- }
- stat = readl_relaxed(dove_irq_base + IRQ_CAUSE_HIGH_OFF);
- stat &= readl_relaxed(dove_irq_base + IRQ_MASK_HIGH_OFF);
- if (stat) {
-- unsigned int hwirq = 32 + __fls(stat);
-+ unsigned int hwirq = 33 + __fls(stat);
- handle_IRQ(hwirq, regs);
- return;
- }
-@@ -144,8 +144,8 @@ void __init dove_init_irq(void)
- {
- int i;
-
-- orion_irq_init(0, IRQ_VIRT_BASE + IRQ_MASK_LOW_OFF);
-- orion_irq_init(32, IRQ_VIRT_BASE + IRQ_MASK_HIGH_OFF);
-+ orion_irq_init(1, IRQ_VIRT_BASE + IRQ_MASK_LOW_OFF);
-+ orion_irq_init(33, IRQ_VIRT_BASE + IRQ_MASK_HIGH_OFF);
-
- #ifdef CONFIG_MULTI_IRQ_HANDLER
- set_handle_irq(dove_legacy_handle_irq);
-diff --git a/arch/arm/vdso/vdsomunge.c b/arch/arm/vdso/vdsomunge.c
-index 9005b07..aedec81 100644
---- a/arch/arm/vdso/vdsomunge.c
-+++ b/arch/arm/vdso/vdsomunge.c
-@@ -45,13 +45,11 @@
- * it does.
- */
-
--#define _GNU_SOURCE
--
- #include <byteswap.h>
- #include <elf.h>
- #include <errno.h>
--#include <error.h>
- #include <fcntl.h>
-+#include <stdarg.h>
- #include <stdbool.h>
- #include <stdio.h>
- #include <stdlib.h>
-@@ -82,11 +80,25 @@
- #define EF_ARM_ABI_FLOAT_HARD 0x400
- #endif
-
-+static int failed;
-+static const char *argv0;
- static const char *outfile;
-
-+static void fail(const char *fmt, ...)
-+{
-+ va_list ap;
-+
-+ failed = 1;
-+ fprintf(stderr, "%s: ", argv0);
-+ va_start(ap, fmt);
-+ vfprintf(stderr, fmt, ap);
-+ va_end(ap);
-+ exit(EXIT_FAILURE);
-+}
-+
- static void cleanup(void)
- {
-- if (error_message_count > 0 && outfile != NULL)
-+ if (failed && outfile != NULL)
- unlink(outfile);
- }
-
-@@ -119,68 +131,66 @@ int main(int argc, char **argv)
- int infd;
-
- atexit(cleanup);
-+ argv0 = argv[0];
-
- if (argc != 3)
-- error(EXIT_FAILURE, 0, "Usage: %s [infile] [outfile]", argv[0]);
-+ fail("Usage: %s [infile] [outfile]\n", argv[0]);
-
- infile = argv[1];
- outfile = argv[2];
-
- infd = open(infile, O_RDONLY);
- if (infd < 0)
-- error(EXIT_FAILURE, errno, "Cannot open %s", infile);
-+ fail("Cannot open %s: %s\n", infile, strerror(errno));
-
- if (fstat(infd, &stat) != 0)
-- error(EXIT_FAILURE, errno, "Failed stat for %s", infile);
-+ fail("Failed stat for %s: %s\n", infile, strerror(errno));
-
- inbuf = mmap(NULL, stat.st_size, PROT_READ, MAP_PRIVATE, infd, 0);
- if (inbuf == MAP_FAILED)
-- error(EXIT_FAILURE, errno, "Failed to map %s", infile);
-+ fail("Failed to map %s: %s\n", infile, strerror(errno));
-
- close(infd);
-
- inhdr = inbuf;
-
- if (memcmp(&inhdr->e_ident, ELFMAG, SELFMAG) != 0)
-- error(EXIT_FAILURE, 0, "Not an ELF file");
-+ fail("Not an ELF file\n");
-
- if (inhdr->e_ident[EI_CLASS] != ELFCLASS32)
-- error(EXIT_FAILURE, 0, "Unsupported ELF class");
-+ fail("Unsupported ELF class\n");
-
- swap = inhdr->e_ident[EI_DATA] != HOST_ORDER;
-
- if (read_elf_half(inhdr->e_type, swap) != ET_DYN)
-- error(EXIT_FAILURE, 0, "Not a shared object");
-+ fail("Not a shared object\n");
-
-- if (read_elf_half(inhdr->e_machine, swap) != EM_ARM) {
-- error(EXIT_FAILURE, 0, "Unsupported architecture %#x",
-- inhdr->e_machine);
-- }
-+ if (read_elf_half(inhdr->e_machine, swap) != EM_ARM)
-+ fail("Unsupported architecture %#x\n", inhdr->e_machine);
-
- e_flags = read_elf_word(inhdr->e_flags, swap);
-
- if (EF_ARM_EABI_VERSION(e_flags) != EF_ARM_EABI_VER5) {
-- error(EXIT_FAILURE, 0, "Unsupported EABI version %#x",
-- EF_ARM_EABI_VERSION(e_flags));
-+ fail("Unsupported EABI version %#x\n",
-+ EF_ARM_EABI_VERSION(e_flags));
- }
-
- if (e_flags & EF_ARM_ABI_FLOAT_HARD)
-- error(EXIT_FAILURE, 0,
-- "Unexpected hard-float flag set in e_flags");
-+ fail("Unexpected hard-float flag set in e_flags\n");
-
- clear_soft_float = !!(e_flags & EF_ARM_ABI_FLOAT_SOFT);
-
- outfd = open(outfile, O_RDWR | O_CREAT | O_TRUNC, S_IRUSR | S_IWUSR);
- if (outfd < 0)
-- error(EXIT_FAILURE, errno, "Cannot open %s", outfile);
-+ fail("Cannot open %s: %s\n", outfile, strerror(errno));
-
- if (ftruncate(outfd, stat.st_size) != 0)
-- error(EXIT_FAILURE, errno, "Cannot truncate %s", outfile);
-+ fail("Cannot truncate %s: %s\n", outfile, strerror(errno));
-
- outbuf = mmap(NULL, stat.st_size, PROT_READ | PROT_WRITE, MAP_SHARED,
- outfd, 0);
- if (outbuf == MAP_FAILED)
-- error(EXIT_FAILURE, errno, "Failed to map %s", outfile);
-+ fail("Failed to map %s: %s\n", outfile, strerror(errno));
-
- close(outfd);
-
-@@ -195,7 +205,7 @@ int main(int argc, char **argv)
- }
-
- if (msync(outbuf, stat.st_size, MS_SYNC) != 0)
-- error(EXIT_FAILURE, errno, "Failed to sync %s", outfile);
-+ fail("Failed to sync %s: %s\n", outfile, strerror(errno));
-
- return EXIT_SUCCESS;
- }
-diff --git a/arch/arm64/kernel/smp.c b/arch/arm64/kernel/smp.c
-index 2cb0081..d3a202b 100644
---- a/arch/arm64/kernel/smp.c
-+++ b/arch/arm64/kernel/smp.c
-@@ -569,7 +569,7 @@ void handle_IPI(int ipinr, struct pt_regs *regs)
- struct pt_regs *old_regs = set_irq_regs(regs);
-
- if ((unsigned)ipinr < NR_IPI) {
-- trace_ipi_entry(ipi_types[ipinr]);
-+ trace_ipi_entry_rcuidle(ipi_types[ipinr]);
- __inc_irq_stat(cpu, ipi_irqs[ipinr]);
- }
-
-@@ -612,7 +612,7 @@ void handle_IPI(int ipinr, struct pt_regs *regs)
- }
-
- if ((unsigned)ipinr < NR_IPI)
-- trace_ipi_exit(ipi_types[ipinr]);
-+ trace_ipi_exit_rcuidle(ipi_types[ipinr]);
- set_irq_regs(old_regs);
- }
-
-diff --git a/arch/arm64/mm/hugetlbpage.c b/arch/arm64/mm/hugetlbpage.c
-index 2de9d2e..0eeb4f09 100644
---- a/arch/arm64/mm/hugetlbpage.c
-+++ b/arch/arm64/mm/hugetlbpage.c
-@@ -40,13 +40,13 @@ int huge_pmd_unshare(struct mm_struct *mm, unsigned long *addr, pte_t *ptep)
-
- int pmd_huge(pmd_t pmd)
- {
-- return !(pmd_val(pmd) & PMD_TABLE_BIT);
-+ return pmd_val(pmd) && !(pmd_val(pmd) & PMD_TABLE_BIT);
- }
-
- int pud_huge(pud_t pud)
- {
- #ifndef __PAGETABLE_PMD_FOLDED
-- return !(pud_val(pud) & PUD_TABLE_BIT);
-+ return pud_val(pud) && !(pud_val(pud) & PUD_TABLE_BIT);
- #else
- return 0;
- #endif
-diff --git a/arch/arm64/net/bpf_jit.h b/arch/arm64/net/bpf_jit.h
-index de0a81a..98a26ce 100644
---- a/arch/arm64/net/bpf_jit.h
-+++ b/arch/arm64/net/bpf_jit.h
-@@ -110,6 +110,10 @@
- /* Rd = Rn >> shift; signed */
- #define A64_ASR(sf, Rd, Rn, shift) A64_SBFM(sf, Rd, Rn, shift, (sf) ? 63 : 31)
-
-+/* Zero extend */
-+#define A64_UXTH(sf, Rd, Rn) A64_UBFM(sf, Rd, Rn, 0, 15)
-+#define A64_UXTW(sf, Rd, Rn) A64_UBFM(sf, Rd, Rn, 0, 31)
-+
- /* Move wide (immediate) */
- #define A64_MOVEW(sf, Rd, imm16, shift, type) \
- aarch64_insn_gen_movewide(Rd, imm16, shift, \
-diff --git a/arch/arm64/net/bpf_jit_comp.c b/arch/arm64/net/bpf_jit_comp.c
-index dc6a484..c047598 100644
---- a/arch/arm64/net/bpf_jit_comp.c
-+++ b/arch/arm64/net/bpf_jit_comp.c
-@@ -113,9 +113,9 @@ static inline void emit_a64_mov_i(const int is64, const int reg,
- static inline int bpf2a64_offset(int bpf_to, int bpf_from,
- const struct jit_ctx *ctx)
- {
-- int to = ctx->offset[bpf_to + 1];
-+ int to = ctx->offset[bpf_to];
- /* -1 to account for the Branch instruction */
-- int from = ctx->offset[bpf_from + 1] - 1;
-+ int from = ctx->offset[bpf_from] - 1;
-
- return to - from;
- }
-@@ -289,23 +289,41 @@ static int build_insn(const struct bpf_insn *insn, struct jit_ctx *ctx)
- case BPF_ALU | BPF_END | BPF_FROM_BE:
- #ifdef CONFIG_CPU_BIG_ENDIAN
- if (BPF_SRC(code) == BPF_FROM_BE)
-- break;
-+ goto emit_bswap_uxt;
- #else /* !CONFIG_CPU_BIG_ENDIAN */
- if (BPF_SRC(code) == BPF_FROM_LE)
-- break;
-+ goto emit_bswap_uxt;
- #endif
- switch (imm) {
- case 16:
- emit(A64_REV16(is64, dst, dst), ctx);
-+ /* zero-extend 16 bits into 64 bits */
-+ emit(A64_UXTH(is64, dst, dst), ctx);
- break;
- case 32:
- emit(A64_REV32(is64, dst, dst), ctx);
-+ /* upper 32 bits already cleared */
- break;
- case 64:
- emit(A64_REV64(dst, dst), ctx);
- break;
- }
- break;
-+emit_bswap_uxt:
-+ switch (imm) {
-+ case 16:
-+ /* zero-extend 16 bits into 64 bits */
-+ emit(A64_UXTH(is64, dst, dst), ctx);
-+ break;
-+ case 32:
-+ /* zero-extend 32 bits into 64 bits */
-+ emit(A64_UXTW(is64, dst, dst), ctx);
-+ break;
-+ case 64:
-+ /* nop */
-+ break;
-+ }
-+ break;
- /* dst = imm */
- case BPF_ALU | BPF_MOV | BPF_K:
- case BPF_ALU64 | BPF_MOV | BPF_K:
-@@ -640,10 +658,11 @@ static int build_body(struct jit_ctx *ctx)
- const struct bpf_insn *insn = &prog->insnsi[i];
- int ret;
-
-+ ret = build_insn(insn, ctx);
-+
- if (ctx->image == NULL)
- ctx->offset[i] = ctx->idx;
-
-- ret = build_insn(insn, ctx);
- if (ret > 0) {
- i++;
- continue;
-diff --git a/arch/m68k/Kconfig.cpu b/arch/m68k/Kconfig.cpu
-index 33013df..5c68c85 100644
---- a/arch/m68k/Kconfig.cpu
-+++ b/arch/m68k/Kconfig.cpu
-@@ -125,6 +125,13 @@ endif # M68KCLASSIC
-
- if COLDFIRE
-
-+choice
-+ prompt "ColdFire SoC type"
-+ default M520x
-+ help
-+ Select the type of ColdFire System-on-Chip (SoC) that you want
-+ to build for.
-+
- config M5206
- bool "MCF5206"
- depends on !MMU
-@@ -174,9 +181,6 @@ config M525x
- help
- Freescale (Motorola) Coldfire 5251/5253 processor support.
-
--config M527x
-- bool
--
- config M5271
- bool "MCF5271"
- depends on !MMU
-@@ -223,9 +227,6 @@ config M5307
- help
- Motorola ColdFire 5307 processor support.
-
--config M53xx
-- bool
--
- config M532x
- bool "MCF532x"
- depends on !MMU
-@@ -251,9 +252,6 @@ config M5407
- help
- Motorola ColdFire 5407 processor support.
-
--config M54xx
-- bool
--
- config M547x
- bool "MCF547x"
- select M54xx
-@@ -280,6 +278,17 @@ config M5441x
- help
- Freescale Coldfire 54410/54415/54416/54417/54418 processor support.
-
-+endchoice
-+
-+config M527x
-+ bool
-+
-+config M53xx
-+ bool
-+
-+config M54xx
-+ bool
-+
- endif # COLDFIRE
-
-
-@@ -416,22 +425,10 @@ config HAVE_MBAR
- config HAVE_IPSBAR
- bool
-
--config CLOCK_SET
-- bool "Enable setting the CPU clock frequency"
-- depends on COLDFIRE
-- default n
-- help
-- On some CPU's you do not need to know what the core CPU clock
-- frequency is. On these you can disable clock setting. On some
-- traditional 68K parts, and on all ColdFire parts you need to set
-- the appropriate CPU clock frequency. On these devices many of the
-- onboard peripherals derive their timing from the master CPU clock
-- frequency.
--
- config CLOCK_FREQ
- int "Set the core clock frequency"
- default "66666666"
-- depends on CLOCK_SET
-+ depends on COLDFIRE
- help
- Define the CPU clock frequency in use. This is the core clock
- frequency, it may or may not be the same as the external clock
-diff --git a/arch/m68k/include/asm/coldfire.h b/arch/m68k/include/asm/coldfire.h
-index c94557b..50aa4da 100644
---- a/arch/m68k/include/asm/coldfire.h
-+++ b/arch/m68k/include/asm/coldfire.h
-@@ -19,7 +19,7 @@
- * in any case new boards come along from time to time that have yet
- * another different clocking frequency.
- */
--#ifdef CONFIG_CLOCK_SET
-+#ifdef CONFIG_CLOCK_FREQ
- #define MCF_CLK CONFIG_CLOCK_FREQ
- #else
- #error "Don't know what your ColdFire CPU clock frequency is??"
-diff --git a/arch/openrisc/Kconfig b/arch/openrisc/Kconfig
-index e5a693b..443f44d 100644
---- a/arch/openrisc/Kconfig
-+++ b/arch/openrisc/Kconfig
-@@ -17,6 +17,7 @@ config OPENRISC
- select GENERIC_IRQ_SHOW
- select GENERIC_IOMAP
- select GENERIC_CPU_DEVICES
-+ select HAVE_UID16
- select GENERIC_ATOMIC64
- select GENERIC_CLOCKEVENTS
- select GENERIC_STRNCPY_FROM_USER
-@@ -31,9 +32,6 @@ config MMU
- config HAVE_DMA_ATTRS
- def_bool y
-
--config UID16
-- def_bool y
--
- config RWSEM_GENERIC_SPINLOCK
- def_bool y
-
-diff --git a/arch/x86/mm/mmap.c b/arch/x86/mm/mmap.c
-index 9d518d6..844b06d 100644
---- a/arch/x86/mm/mmap.c
-+++ b/arch/x86/mm/mmap.c
-@@ -126,3 +126,10 @@ void arch_pick_mmap_layout(struct mm_struct *mm)
- mm->get_unmapped_area = arch_get_unmapped_area_topdown;
- }
- }
-+
-+const char *arch_vma_name(struct vm_area_struct *vma)
-+{
-+ if (vma->vm_flags & VM_MPX)
-+ return "[mpx]";
-+ return NULL;
-+}
-diff --git a/arch/x86/mm/mpx.c b/arch/x86/mm/mpx.c
-index c439ec4..4d1c11c 100644
---- a/arch/x86/mm/mpx.c
-+++ b/arch/x86/mm/mpx.c
-@@ -18,26 +18,9 @@
- #include <asm/processor.h>
- #include <asm/fpu-internal.h>
-
--static const char *mpx_mapping_name(struct vm_area_struct *vma)
--{
-- return "[mpx]";
--}
--
--static struct vm_operations_struct mpx_vma_ops = {
-- .name = mpx_mapping_name,
--};
--
--static int is_mpx_vma(struct vm_area_struct *vma)
--{
-- return (vma->vm_ops == &mpx_vma_ops);
--}
--
- /*
- * This is really a simplified "vm_mmap". it only handles MPX
- * bounds tables (the bounds directory is user-allocated).
-- *
-- * Later on, we use the vma->vm_ops to uniquely identify these
-- * VMAs.
- */
- static unsigned long mpx_mmap(unsigned long len)
- {
-@@ -83,7 +66,6 @@ static unsigned long mpx_mmap(unsigned long len)
- ret = -ENOMEM;
- goto out;
- }
-- vma->vm_ops = &mpx_vma_ops;
-
- if (vm_flags & VM_LOCKED) {
- up_write(&mm->mmap_sem);
-@@ -661,7 +643,7 @@ static int zap_bt_entries(struct mm_struct *mm,
- * so stop immediately and return an error. This
- * probably results in a SIGSEGV.
- */
-- if (!is_mpx_vma(vma))
-+ if (!(vma->vm_flags & VM_MPX))
- return -EINVAL;
-
- len = min(vma->vm_end, end) - addr;
-diff --git a/block/bio.c b/block/bio.c
-index f66a4ea..4441522 100644
---- a/block/bio.c
-+++ b/block/bio.c
-@@ -1814,8 +1814,9 @@ EXPORT_SYMBOL(bio_endio_nodec);
- * Allocates and returns a new bio which represents @sectors from the start of
- * @bio, and updates @bio to represent the remaining sectors.
- *
-- * The newly allocated bio will point to @bio's bi_io_vec; it is the caller's
-- * responsibility to ensure that @bio is not freed before the split.
-+ * Unless this is a discard request the newly allocated bio will point
-+ * to @bio's bi_io_vec; it is the caller's responsibility to ensure that
-+ * @bio is not freed before the split.
- */
- struct bio *bio_split(struct bio *bio, int sectors,
- gfp_t gfp, struct bio_set *bs)
-@@ -1825,7 +1826,15 @@ struct bio *bio_split(struct bio *bio, int sectors,
- BUG_ON(sectors <= 0);
- BUG_ON(sectors >= bio_sectors(bio));
-
-- split = bio_clone_fast(bio, gfp, bs);
-+ /*
-+ * Discards need a mutable bio_vec to accommodate the payload
-+ * required by the DSM TRIM and UNMAP commands.
-+ */
-+ if (bio->bi_rw & REQ_DISCARD)
-+ split = bio_clone_bioset(bio, gfp, bs);
-+ else
-+ split = bio_clone_fast(bio, gfp, bs);
-+
- if (!split)
- return NULL;
-
-diff --git a/crypto/asymmetric_keys/asymmetric_keys.h b/crypto/asymmetric_keys/asymmetric_keys.h
-index f973308..3f5b537 100644
---- a/crypto/asymmetric_keys/asymmetric_keys.h
-+++ b/crypto/asymmetric_keys/asymmetric_keys.h
-@@ -11,6 +11,9 @@
-
- extern struct asymmetric_key_id *asymmetric_key_hex_to_key_id(const char *id);
-
-+extern int __asymmetric_key_hex_to_key_id(const char *id,
-+ struct asymmetric_key_id *match_id,
-+ size_t hexlen);
- static inline
- const struct asymmetric_key_ids *asymmetric_key_ids(const struct key *key)
- {
-diff --git a/crypto/asymmetric_keys/asymmetric_type.c b/crypto/asymmetric_keys/asymmetric_type.c
-index bcbbbd7..b0e4ed2 100644
---- a/crypto/asymmetric_keys/asymmetric_type.c
-+++ b/crypto/asymmetric_keys/asymmetric_type.c
-@@ -104,6 +104,15 @@ static bool asymmetric_match_key_ids(
- return false;
- }
-
-+/* helper function can be called directly with pre-allocated memory */
-+inline int __asymmetric_key_hex_to_key_id(const char *id,
-+ struct asymmetric_key_id *match_id,
-+ size_t hexlen)
-+{
-+ match_id->len = hexlen;
-+ return hex2bin(match_id->data, id, hexlen);
-+}
-+
- /**
- * asymmetric_key_hex_to_key_id - Convert a hex string into a key ID.
- * @id: The ID as a hex string.
-@@ -111,21 +120,20 @@ static bool asymmetric_match_key_ids(
- struct asymmetric_key_id *asymmetric_key_hex_to_key_id(const char *id)
- {
- struct asymmetric_key_id *match_id;
-- size_t hexlen;
-+ size_t asciihexlen;
- int ret;
-
- if (!*id)
- return ERR_PTR(-EINVAL);
-- hexlen = strlen(id);
-- if (hexlen & 1)
-+ asciihexlen = strlen(id);
-+ if (asciihexlen & 1)
- return ERR_PTR(-EINVAL);
-
-- match_id = kmalloc(sizeof(struct asymmetric_key_id) + hexlen / 2,
-+ match_id = kmalloc(sizeof(struct asymmetric_key_id) + asciihexlen / 2,
- GFP_KERNEL);
- if (!match_id)
- return ERR_PTR(-ENOMEM);
-- match_id->len = hexlen / 2;
-- ret = hex2bin(match_id->data, id, hexlen / 2);
-+ ret = __asymmetric_key_hex_to_key_id(id, match_id, asciihexlen / 2);
- if (ret < 0) {
- kfree(match_id);
- return ERR_PTR(-EINVAL);
-diff --git a/crypto/asymmetric_keys/x509_public_key.c b/crypto/asymmetric_keys/x509_public_key.c
-index a6c4203..24f17e6 100644
---- a/crypto/asymmetric_keys/x509_public_key.c
-+++ b/crypto/asymmetric_keys/x509_public_key.c
-@@ -28,17 +28,30 @@ static bool use_builtin_keys;
- static struct asymmetric_key_id *ca_keyid;
-
- #ifndef MODULE
-+static struct {
-+ struct asymmetric_key_id id;
-+ unsigned char data[10];
-+} cakey;
-+
- static int __init ca_keys_setup(char *str)
- {
- if (!str) /* default system keyring */
- return 1;
-
- if (strncmp(str, "id:", 3) == 0) {
-- struct asymmetric_key_id *p;
-- p = asymmetric_key_hex_to_key_id(str + 3);
-- if (p == ERR_PTR(-EINVAL))
-- pr_err("Unparsable hex string in ca_keys\n");
-- else if (!IS_ERR(p))
-+ struct asymmetric_key_id *p = &cakey.id;
-+ size_t hexlen = (strlen(str) - 3) / 2;
-+ int ret;
-+
-+ if (hexlen == 0 || hexlen > sizeof(cakey.data)) {
-+ pr_err("Missing or invalid ca_keys id\n");
-+ return 1;
-+ }
-+
-+ ret = __asymmetric_key_hex_to_key_id(str + 3, p, hexlen);
-+ if (ret < 0)
-+ pr_err("Unparsable ca_keys id hex string\n");
-+ else
- ca_keyid = p; /* owner key 'id:xxxxxx' */
- } else if (strcmp(str, "builtin") == 0) {
- use_builtin_keys = true;
-diff --git a/drivers/acpi/acpi_lpss.c b/drivers/acpi/acpi_lpss.c
-index 37fb190..73f056a 100644
---- a/drivers/acpi/acpi_lpss.c
-+++ b/drivers/acpi/acpi_lpss.c
-@@ -352,13 +352,16 @@ static int acpi_lpss_create_device(struct acpi_device *adev,
- pdata->mmio_size = resource_size(rentry->res);
- pdata->mmio_base = ioremap(rentry->res->start,
- pdata->mmio_size);
-- if (!pdata->mmio_base)
-- goto err_out;
- break;
- }
-
- acpi_dev_free_resource_list(&resource_list);
-
-+ if (!pdata->mmio_base) {
-+ ret = -ENOMEM;
-+ goto err_out;
-+ }
-+
- pdata->dev_desc = dev_desc;
-
- if (dev_desc->setup)
-diff --git a/drivers/acpi/acpica/aclocal.h b/drivers/acpi/acpica/aclocal.h
-index 87b2752..7f50dd9 100644
---- a/drivers/acpi/acpica/aclocal.h
-+++ b/drivers/acpi/acpica/aclocal.h
-@@ -213,6 +213,7 @@ struct acpi_table_list {
-
- #define ACPI_TABLE_INDEX_DSDT (0)
- #define ACPI_TABLE_INDEX_FACS (1)
-+#define ACPI_TABLE_INDEX_X_FACS (2)
-
- struct acpi_find_context {
- char *search_for;
-diff --git a/drivers/acpi/acpica/tbfadt.c b/drivers/acpi/acpica/tbfadt.c
-index 7d24860..05be59c 100644
---- a/drivers/acpi/acpica/tbfadt.c
-+++ b/drivers/acpi/acpica/tbfadt.c
-@@ -350,9 +350,18 @@ void acpi_tb_parse_fadt(u32 table_index)
- /* If Hardware Reduced flag is set, there is no FACS */
-
- if (!acpi_gbl_reduced_hardware) {
-- acpi_tb_install_fixed_table((acpi_physical_address)
-- acpi_gbl_FADT.Xfacs, ACPI_SIG_FACS,
-- ACPI_TABLE_INDEX_FACS);
-+ if (acpi_gbl_FADT.facs) {
-+ acpi_tb_install_fixed_table((acpi_physical_address)
-+ acpi_gbl_FADT.facs,
-+ ACPI_SIG_FACS,
-+ ACPI_TABLE_INDEX_FACS);
-+ }
-+ if (acpi_gbl_FADT.Xfacs) {
-+ acpi_tb_install_fixed_table((acpi_physical_address)
-+ acpi_gbl_FADT.Xfacs,
-+ ACPI_SIG_FACS,
-+ ACPI_TABLE_INDEX_X_FACS);
-+ }
- }
- }
-
-@@ -491,13 +500,9 @@ static void acpi_tb_convert_fadt(void)
- acpi_gbl_FADT.header.length = sizeof(struct acpi_table_fadt);
-
- /*
-- * Expand the 32-bit FACS and DSDT addresses to 64-bit as necessary.
-+ * Expand the 32-bit DSDT addresses to 64-bit as necessary.
- * Later ACPICA code will always use the X 64-bit field.
- */
-- acpi_gbl_FADT.Xfacs = acpi_tb_select_address("FACS",
-- acpi_gbl_FADT.facs,
-- acpi_gbl_FADT.Xfacs);
--
- acpi_gbl_FADT.Xdsdt = acpi_tb_select_address("DSDT",
- acpi_gbl_FADT.dsdt,
- acpi_gbl_FADT.Xdsdt);
-diff --git a/drivers/acpi/acpica/tbutils.c b/drivers/acpi/acpica/tbutils.c
-index 6559a58..2fb1afa 100644
---- a/drivers/acpi/acpica/tbutils.c
-+++ b/drivers/acpi/acpica/tbutils.c
-@@ -68,7 +68,8 @@ acpi_tb_get_root_table_entry(u8 *table_entry, u32 table_entry_size);
-
- acpi_status acpi_tb_initialize_facs(void)
- {
-- acpi_status status;
-+ struct acpi_table_facs *facs32;
-+ struct acpi_table_facs *facs64;
-
- /* If Hardware Reduced flag is set, there is no FACS */
-
-@@ -77,11 +78,22 @@ acpi_status acpi_tb_initialize_facs(void)
- return (AE_OK);
- }
-
-- status = acpi_get_table_by_index(ACPI_TABLE_INDEX_FACS,
-- ACPI_CAST_INDIRECT_PTR(struct
-- acpi_table_header,
-- &acpi_gbl_FACS));
-- return (status);
-+ (void)acpi_get_table_by_index(ACPI_TABLE_INDEX_FACS,
-+ ACPI_CAST_INDIRECT_PTR(struct
-+ acpi_table_header,
-+ &facs32));
-+ (void)acpi_get_table_by_index(ACPI_TABLE_INDEX_X_FACS,
-+ ACPI_CAST_INDIRECT_PTR(struct
-+ acpi_table_header,
-+ &facs64));
-+
-+ if (acpi_gbl_use32_bit_facs_addresses) {
-+ acpi_gbl_FACS = facs32 ? facs32 : facs64;
-+ } else {
-+ acpi_gbl_FACS = facs64 ? facs64 : facs32;
-+ }
-+
-+ return (AE_OK);
- }
- #endif /* !ACPI_REDUCED_HARDWARE */
-
-@@ -101,7 +113,7 @@ acpi_status acpi_tb_initialize_facs(void)
- u8 acpi_tb_tables_loaded(void)
- {
-
-- if (acpi_gbl_root_table_list.current_table_count >= 3) {
-+ if (acpi_gbl_root_table_list.current_table_count >= 4) {
- return (TRUE);
- }
-
-@@ -357,11 +369,11 @@ acpi_status __init acpi_tb_parse_root_table(acpi_physical_address rsdp_address)
- table_entry = ACPI_ADD_PTR(u8, table, sizeof(struct acpi_table_header));
-
- /*
-- * First two entries in the table array are reserved for the DSDT
-- * and FACS, which are not actually present in the RSDT/XSDT - they
-- * come from the FADT
-+ * First three entries in the table array are reserved for the DSDT
-+ * and 32bit/64bit FACS, which are not actually present in the
-+ * RSDT/XSDT - they come from the FADT
- */
-- acpi_gbl_root_table_list.current_table_count = 2;
-+ acpi_gbl_root_table_list.current_table_count = 3;
-
- /* Initialize the root table array from the RSDT/XSDT */
-
-diff --git a/drivers/acpi/acpica/tbxfload.c b/drivers/acpi/acpica/tbxfload.c
-index aadb300..b63e35d 100644
---- a/drivers/acpi/acpica/tbxfload.c
-+++ b/drivers/acpi/acpica/tbxfload.c
-@@ -166,7 +166,8 @@ static acpi_status acpi_tb_load_namespace(void)
-
- (void)acpi_ut_acquire_mutex(ACPI_MTX_TABLES);
- for (i = 0; i < acpi_gbl_root_table_list.current_table_count; ++i) {
-- if ((!ACPI_COMPARE_NAME
-+ if (!acpi_gbl_root_table_list.tables[i].address ||
-+ (!ACPI_COMPARE_NAME
- (&(acpi_gbl_root_table_list.tables[i].signature),
- ACPI_SIG_SSDT)
- &&
-diff --git a/drivers/acpi/acpica/utxfinit.c b/drivers/acpi/acpica/utxfinit.c
-index 083a768..42a32a6 100644
---- a/drivers/acpi/acpica/utxfinit.c
-+++ b/drivers/acpi/acpica/utxfinit.c
-@@ -179,10 +179,12 @@ acpi_status __init acpi_enable_subsystem(u32 flags)
- * Obtain a permanent mapping for the FACS. This is required for the
- * Global Lock and the Firmware Waking Vector
- */
-- status = acpi_tb_initialize_facs();
-- if (ACPI_FAILURE(status)) {
-- ACPI_WARNING((AE_INFO, "Could not map the FACS table"));
-- return_ACPI_STATUS(status);
-+ if (!(flags & ACPI_NO_FACS_INIT)) {
-+ status = acpi_tb_initialize_facs();
-+ if (ACPI_FAILURE(status)) {
-+ ACPI_WARNING((AE_INFO, "Could not map the FACS table"));
-+ return_ACPI_STATUS(status);
-+ }
- }
- #endif /* !ACPI_REDUCED_HARDWARE */
-
-diff --git a/drivers/acpi/osl.c b/drivers/acpi/osl.c
-index 5226a8b..98f5316 100644
<